Deserialization Attacks in Federated Learning

Existing attacks on Federated Learning (FL) focus primarily on poisoning and inference threats, implicitly assuming that serialized model updates are passive numerical data. As FL increasingly incorporates non–neural network models — such as Decision Trees, Support Vector Machines (SVMs), and Gradient Boosting Decision Trees (GDBTs) — this assumption no longer holds. These models often require full object serialization, exposing the deserialization layer as a new attack surface where cluster-level compromise becomes possible.We demonstrate deserialization attacks on a custom FL testbed of Raspberry Pi devices running a modified, pickle-enabled version of the Flower framework. A single malicious client can inject a crafted serialized model that achieves arbitrary code execution on the aggregator and induces measurable resource abuse. Viewing this through a malware-analysis lens, we evaluate two lightweight defensive mechanisms: static Pickle inspection using the fickling package and signature-based scanning with YARA rules. Both approaches mitigate simple payloads with minimal overhead but offer limited protection against obfuscation or novel attack variants.This work advocates a zero-trust approach to deserialization in FL pipelines, emphasizing provenance checks and sandboxed deserialization. The results highlight serialization as an underexplored but critical frontier in FL security and call for systematic, cross-format evaluation of deserialization safety.