Abstract
Federated Learning (FL) enables decentralized training across multiple clients while preserving data privacy, but remains vulnerable to adversarial attacks. This paper investigates the threat of Universal Adversarial Perturbations (UAPs) in FL, which are input-agnostic perturbations designed to mislead models across a wide range of inputs. A practical threat model is introduced in which a single malicious client generates and injects a universal perturbation during local training. Using the MNIST dataset, experiments demonstrate that this perturbation can significantly degrade the global model’s accuracy from 91% to 64.8% and generalizes to data from honest clients. The attack is evaluated under both independent and identically distributed (IID) and non-independent and identically distributed (non-IID) data partitions, with analysis of cross-client transferability and the impact of injection timing. The results demonstrate that even a single UAP can disrupt global performance, revealing a critical vulnerability in federated settings and motivating the development of defenses against input-agnostic attacks.