Morpheus: Modality-Agnostic Adversarial Attack from Leaked Models in Federated Learning

Federated learning (FL) creates a distinctive attack surface by repeatedly exposing intermediate global models to participating clients. A malicious client can retain one such checkpoint as a surrogate and use it to craft adversarial examples (AEs) against the final deployed model, even though the model may undergo subsequent training. In this paper, we investigate an intriguing property, which we term temporal transferability: the ability of an AE crafted against an early checkpoint along a training trajectory to remain effective against the converged model. Although extensive prior work has studied transfer attacks, where AEs crafted against one model are transferred to another, existing approaches are often tailored to specific modalities and do not explicitly account for model evolution over time. We identify two fundamental ingredients that govern temporal transferability: (i) an AE should achieve a sufficiently large adversarial margin, and (ii) it should lie in a region of the leaked model's feature space that is insensitive to parameter changes, making it more likely to remain on the adversarial side of the decision boundary as training progresses. Motivated by these observations, we introduce the weight-space margin (WSM), which quantifies an AE's robustness to changes in model parameters and can be computed using only the leaked checkpoint. Building on this insight, we propose Morpheus, the first modality-agnostic temporal transfer attack. Morpheus optimizes each AE across randomly sampled subnetworks of the leaked checkpoint, reducing its dependence on the exact leaked weights while requiring only the checkpoint and the inputs to be attacked. Across three modalities, six datasets, and six architectures, Morpheus consistently outperforms the strongest of six baseline attacks. When the checkpoint is leaked after only 30% of training, Morpheus improves the attack success rate over the strongest baseline by up to 20.00%.