Chained Attacks on Drone-Based Federated Learning: From Network Disruption to Device Impersonation
Source: arXiv:2607.20280 · Published 2026-07-22 · By Suleiman Muhammad Sabo, Hamed Alkharsh, Peilin Li, Chuadhry Mujeeb Ahmed, Aydin Abadi, Shishir Nagaraja et al.
TL;DR
This paper addresses a critical security vulnerability in drone-based federated learning (FL) systems, where availability attacks on the wireless network layer are chained with credential-based device impersonation to compromise training integrity. The authors demonstrate a practical two-stage attack: first, launching 802.11 deauthentication attacks to forcibly disconnect legitimate drone clients, and second, impersonating those disconnected clients using extracted cryptographic credentials. They empirically validate these attacks on physical testbeds using Raspberry Pi 4B and NVIDIA Jetson devices simulating drone nodes, and quantify the resulting FL model degradation under both IID and non-IID data distributions.
The key novelty lies in exposing how short-term wireless network disruptions cascade into major training instability, especially under non-IID data skew conditions where certain clients act as "experts" with concentrated data classes. The single-factor credential authentication design permits seamless post-disconnection impersonation, allowing adversaries persistent covert access. This chained attack worsens existing FL vulnerabilities beyond isolated network or authentication threats, undermining the resilience of mission-critical drone swarms. The authors argue that holistic defenses combining network-layer protections with stronger authentication and aggregation safeguards are necessary to secure drone FL deployments.
Key findings
- Deauthentication attacks reduce final FL accuracy on Raspberry Pi from a baseline of 57.00% to 49.80% under IID data, a 7.20% absolute drop after 10 rounds (Table III).
- Under Non-IID conditions, accuracy degradation more than doubles on Raspberry Pi to 15.75% (55.38% to 39.63%), confirming increased vulnerability due to data skew.
- Jetson hardware exhibits greater resilience due to faster convergence, but still experiences up to 7.86% accuracy loss under Non-IID and 2.30% under IID conditions (Table III).
- Targeted removal of two ‘expert’ clients holding dominant classes causes disproportionate 3.61% overall accuracy drop and 75% increase in rounds-to-competency, revealing strategic attack amplification.
- Training loss convergence becomes substantially unstable during attacks with standard deviation (σL) rising from 0.0168 to 0.5393 on Raspberry Pi (rounds 5–8).
- Impersonation by cloned credentials is undetectable post-disconnection: the server accepted adversary updates without logging authentication failures over multiple rounds (Section V-B).
- Concurrent impersonation attempts are rejected, but no defenses exist after legitimate client disconnection, creating a persistent exploitation window of ~1 training round (~58 seconds).
- Existing single-factor auth models implicitly trust possession of static credentials, ignoring session continuity or device integrity, thus enabling stealthy impersonation.
Threat model
The adversary operates without prior knowledge of swarm network architecture but uses passive and active wireless reconnaissance to map MAC addresses and roles. The attacker holds valid cryptographic credentials for at least one target drone, obtained by any means including physical capture, supply chain compromises, or insider leaks. The adversary can inject 802.11 deauthentication frames to forcibly disconnect targeted drones, and subsequently impersonate the disconnected node by reusing the extracted credentials. The attacker cannot replicate the physical drone airframe but exploits protocol weaknesses to gain network-level and authentication-layer persistence. Detection is hampered by stateless FL aggregation and possession-based authentication assumptions.
Methodology — deep read
The study investigates a chained attack on drone-based federated learning (FL) composed of two stages: (1) forced disconnection via 802.11 deauthentication attacks targeting wireless clients, and (2) credential-based impersonation exploiting single-factor authentication.
Threat Model and Assumptions: The adversary has no prior network topology knowledge but uses active passive reconnaissance to map the swarm’s SSID, BSSID and client MAC addresses. The attacker possesses valid cryptographic credentials for at least one victim drone, obtained via physical capture, supply chain, insider leak, or forensic extraction—no requirement for physical drone replication is assumed. The target FL system uses synchronous FedAvg aggregation and single-factor client authentication relying on possession of EC key pairs.
Data: The FL experiments use the standard CIFAR-10 dataset partitioned among clients under two regimes: IID (random equal partitions) and Non-IID (label-skewed partitions using Flower framework’s Dirichlet partitioning with alpha=0.3). The 10 client setup yields heterogeneous dataset sizes (approx. 1.1k to 9.7k samples each).
Testbeds: Two physical edge computing clusters emulate drone nodes: a homogeneous 10-node Raspberry Pi 4B cluster with a PC server, and an 8-node NVIDIA Jetson cluster (7 clients + 1 server). An additional Raspberry Pi equipped with a Wi-Fi adapter in monitor mode performs reconnaissance and deauthentication attack injection without 802.11w management frame protection enabled.
Architecture: The Flower FL framework coordinates synchronous FedAvg rounds with partial client participation tolerance. A custom Python decoder inspects packet captures (unencrypted, then TLS enabled) to validate model parameter transmission.
Attack Injection: Deauthentication attacks target 20%, 40%, 60%, up to 80% of clients per round using aireplay-ng, synchronized to blocking model download or training/upload phases. Impersonation scenarios include concurrent login attempt (legitimate client active) and post-disconnect takeover (legitimate client offline).
Training Regime: Training executes 10 global rounds; extending beyond adds little analytical value. Metrics recorded include accuracy degradation (baseline minus attack), convergence instability (training loss std dev during attack rounds), and connectivity cost (accuracy penalty due to reconnection latency).
Evaluation: Baseline vs attacked accuracy trajectories were measured on both testbeds under IID and Non-IID distributions. Targeted removal of expert nodes with concentrated class data tested vulnerability amplification. Credential impersonation acceptance was verified via server log analysis during multi-round incremental participation.
Reproducibility: Detailed hardware and software configurations are provided, but no public code or datasets beyond standard CIFAR-10 are released. Communication inspection required initial teardown of encryption which may limit replication fidelity.
Concrete Example: On the Raspberry Pi cluster, at 80% attack intensity and Non-IID partitioning, targeted deauthentication disconnects expert nodes responsible for major classes, causing training accuracy to fall from 55.38% to 39.63% (15.75% absolute loss). This also increases model convergence time by 3 rounds and jumps training loss volatility (σL) from 0.0168 to 0.5393. Following this disruption window, the adversary uses cloned EC key credentials to connect as the victim drone during the next round. The server accepts the impersonator seamlessly, allowing stealthy injection of malicious updates without triggering authentication alarms.
Technical innovations
- Demonstration of a practical chained attack in drone FL combining 802.11 deauthentication to disrupt availability with post-disconnection credential impersonation.
- Empirical quantification of FL accuracy degradation under availability attacks contrasting IID vs Non-IID client data distributions, highlighting severe impact of statistical heterogeneity.
- Introduction of a compute-surrogate physical testbed using Raspberry Pi and Jetson clusters to realistically evaluate wireless-layer and authentication-layer FL attack surfaces beyond simulation.
- Identification and characterization of a novel ‘expert node’ vulnerability within non-IID federated clients whose targeted removal disproportionally degrades class-specific accuracy and model convergence.
- Empirical confirmation that single-factor possession-based authentication protocols employed in Flower framework permit undetected, post-disconnect device impersonation.
Datasets
- CIFAR-10 — 50,000 training samples — public standard benchmark
Baselines vs proposed
- Raspberry Pi IID baseline accuracy: 57.00% vs under 80% DeAuth attack: 49.80% (7.20% drop)
- Raspberry Pi Non-IID baseline: 55.38% vs attack: 39.63% (15.75% drop)
- Jetson IID baseline: 73.40% vs attack: 71.10% (2.30% drop)
- Jetson Non-IID baseline: 76.27% vs attack: 68.41% (7.86% drop)
Figures from the paper
Figures are reproduced from the source paper for academic discussion. Original copyright: the paper authors. See arXiv:2607.20280.
Fig 1: Targeted reconnaissance of the swarm BSSID, mapping
Fig 2: Chained attack workflow: Stage 1 forces disconnection
Fig 3: Experimental testbed: 8-node Jetson cluster with ded-
Fig 4: Wireshark
Limitations
- Attack validation limited to static testbeds (Raspberry Pi and Jetson clusters) simulating drones, not deployed on actual flying UAVs with dynamic radio propagation effects.
- 802.11w Management Frame Protection (PMF) was disabled in experiments, although partial PMF adoption might mitigate deauthentication attack impact in practice.
- The adversary model assumes possession of valid cryptographic credentials obtained via physical capture or insider leaks; methods and difficulty of credential extraction are not explored.
- Experiments do not evaluate detection or mitigation strategies beyond basic Flower framework single-session enforcement.
- TLS encryption was disabled during packet inspection and enabled later; effects of encrypted traffic on attack feasibility or network monitoring are less clear.
- Only CIFAR-10 dataset studied; results may vary with larger-scale datasets, more diverse data, or different FL model architectures.
Open questions / follow-ons
- How effective would multi-factor or hardware-rooted authentication (e.g., TPM, secure elements) be to prevent credential reuse and impersonation after disconnection?
- What network-layer defenses, such as universal adoption of 802.11w PMF or anomaly-based Wi-Fi intrusion detection, could mitigate or detect deauthentication attacks in UAV swarms?
- Can FL aggregation protocols be redesigned to integrate continuity or freshness proofs that link authentication to device state transitions, reducing impersonation risk?
- How would these chained attacks manifest in larger-scale, higher-mobility drone networks with realistic radio environments and dynamic topology changes?
Why it matters for bot defense
This research is particularly relevant for bot-defense engineers focusing on federated learning environments in wireless or edge contexts, such as drone swarms, where network availability and client authentication are critical security pillars. The chained attack highlights that disrupting network connectivity alone may not suffice—credential authentication mechanisms must anticipate and mitigate impersonation risks following transient disconnects. For CAPTCHA and bot mitigation practitioners, these findings emphasize that authentication models relying solely on possession of credentials are insufficient against adversaries capable of physical device compromise or credential leakage. Incorporating multi-factor or hardware-backed identity proofs and correlating network-layer events with authentication logs could improve resilience against stealthy adversaries aiming to hijack trusted clients. Moreover, the paper’s methodology demonstrates the importance of empirical testing on physical edge-device clusters rather than purely simulated FL environments, underscoring that real-world attacker capabilities may be underestimated.
Cite
@article{arxiv2607_20280,
title={ Chained Attacks on Drone-Based Federated Learning: From Network Disruption to Device Impersonation },
author={ Suleiman Muhammad Sabo and Hamed Alkharsh and Peilin Li and Chuadhry Mujeeb Ahmed and Aydin Abadi and Shishir Nagaraja and Rajiv Ranjan },
journal={arXiv preprint arXiv:2607.20280},
year={ 2026 },
url={https://arxiv.org/abs/2607.20280}
}