Federated learning (FL) allows unmanned aerial vehicle (UAV) fleets to train a shared GPS spoofing detector without exchanging raw receiver observations. Some UAV-FL schemes use client-reported performance to determine aggregation weights, which allows compromised clients to manipulate their influence on the global model. We study an attack in which two of ten clients poison part of their data, scale their model updates, and inflate their reported accuracy. The accuracy-weighted rule produces a backdoor lift of +0.3036, compared with +0.2415 for attacked FedAvg. To address this vulnerability, we develop receiver-domain behavioral probing. The coordinator evaluates submitted models on counterfactual spoofed samples constructed by assigning benign values to discriminative GPS features and computes trust from the models' responses without using reported accuracy. With independent and identically distributed (IID) client data, our method reduces backdoor lift to -0.0265 and flags the compromised clients. It assumes an honest majority but does not require a configured Byzantine-tolerance parameter. When the number of attackers exceeds the tolerance configured for Multi-Krum, its lift increases from +0.0061 to +0.2837, whereas our method remains close to the honest baseline. We evaluate the approach using a public single-receiver dataset partitioned into simulated UAV clients and examine its limitations under strong client heterogeneity.

翻译：暂无翻译