Research map / Federated learning and privacy / Privacy attacks and secure learning

SADBA: Self-Adaptive Distributed Backdoor Attack Against Federated Learning

AAAI 2025 · Federated learning and privacy › Privacy attacks and secure learning · approach: Defending federated learning against poisoning · 10 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes SADBA, a distributed backdoor attack for federated learning that reduces the fraction of malicious clients needed via optimal trigger insertion, gradient-based sample selection, Latin Hypercube trigger distribution, and adaptive local training for malicious clients.

Problem

Backdoor attacks in large-scale federated learning need exponentially many malicious clients (as in FCBA) or lose effectiveness (as in DBA), so attacks with low percentage of malicious clients (PMC) and persistent ASR are hard to achieve.

Approach

Combine an optimal, sample-specific trigger insertion and gradient-projection sample selection with Latin Hypercube Sampling of trigger combinations (decoupling PMC from trigger pattern size) and a self-adaptive per-client learning-rate/epoch schedule that equalizes backdoor contribution among malicious clients under single-shot FL.

Key results

• SADBA achieves an average 29.7% increase in ASR and reduces PMC by 14.3% relative to SOTAs, per the paper's claims.
• With trigger pattern m=9, SADBA can reduce the min-PMC requirement by up to 98.2% versus SOTAs; FCBA with m=9 needs 510% min-PMC at 100 clients.
• On Fashion-MNIST small-scale FL, SADBA with m=4 reaches 49.08% ASR after 50 rounds versus FCBA's 30.83%.

Measured effects reported in the paper

Surprising findings

• FCBA with m=9 requires more malicious clients than exist in the 100- to 400-client settings (min-PMC above 100%), making it infeasible.

Limitations

• Adaptability is not fully optimized under strongly non-iid settings such as Dirichlet alpha=0.1.
• Evaluated only on small image classification datasets with a single-shot FL setting.

Experimental setup

Datasets: MNIST Fashion-MNIST CIFAR-10

Benchmarks: MNIST Fashion-MNIST CIFAR-10

Metrics: attack success rate main task accuracy percentage of malicious clients (min-PMC)

Baselines: MR (model replacement) DBA FCBA

Builds on: DBA FCBA model replacement

Closest papers by meaning

• Beyond Traditional Threats: A Persistent Backdoor Attack on Federated Learning (AAAI 2024 · similarity 0.92)
• Backdoor Federated Learning by Poisoning Backdoor-Critical Layers (ICLR 2024 · similarity 0.89)
• Infighting in the Dark: Multi-Label Backdoor Attack in Federated Learning (CVPR 2025 · similarity 0.87)
• Resisting Backdoor Attacks in Federated Learning via Bidirectional Elections and Individual Perspective (AAAI 2024 · similarity 0.87)
• MARS: A Malignity-Aware Backdoor Defense in Federated Learning (NeurIPS 2025 · similarity 0.87)
• SPMC: Self-Purifying Federated Backdoor Defense via Margin Contribution (ICML 2025 · similarity 0.87)