Research map / Adversarial robustness and security / Backdoor and poisoning
Infighting in the Dark: Multi-Label Backdoor Attack in Federated Learning
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes Mirage, a non-cooperative multi-label backdoor attack in federated learning that builds in-distribution backdoor mappings via adversarial trigger optimization plus a feature-similarity constrained enhancement to keep backdoors persistent.
Problem
In federated learning, multiple independent (non-colluding) attackers with distinct target classes interfere with each other because their backdoors use similar OOD activation paths, so existing single-label attacks become ineffective in the multi-label setting.
Approach
Instead of coordinating attackers, build an in-distribution (ID) backdoor mapping: optimize the trigger adversarially against an OOD detector built on the global model's feature extractor so backdoored samples look clean for their target, then tighten the backdoor feature distribution via cosine-similarity minimization so it survives global training dynamics.
Key results
- Mirage achieves ASR of 99.52% on CIFAR-10 with no defense and an average ASR above 97% across settings, with ASR staying above 90% through 900 rounds of lifespan.
- Mirage keeps ASR high across defenses such as Multi-Krum, FLAME, FoolsGold, and RFLBAT, where baselines like Vanilla, PGD and Chameleon are often ineffective in the multi-attacker setting.
- Mirage's main-task accuracy loses on average only 0.498% relative to the best baseline across tasks, and remains above 92% on CIFAR-10 with 1 to 5 attackers.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use Mirage's in-distribution backdoor mapping instead of A3FL | Federated learning backdoor attack · CIFAR-100, Indicator | ASR: 37.13* -> 99.8* | Helped |
| Use Mirage's in-distribution backdoor mapping instead of A3FL | Federated learning backdoor attack · GTSRB, Indicator | ASR: 85.05* -> 99.73* | Helped |
| Use Mirage's in-distribution backdoor mapping instead of A3FL | Federated learning backdoor attack · CIFAR-10, Indicator | ASR: 70.33* -> 93.46* | Helped |
| Add constrained optimization for ID-mapping enhancement (ablation) | Mirage · CIFAR-10, attack window then continued training | ASR | Helped |
| Increase the number of attackers from 1 to 5 | Mirage · CIFAR-10 | ASR: 99.06 -> 98.484 | No clear effect |
| Vary the non-IID sampling parameter across 0.5, 1, 5, 10, and 1000 | Mirage · CIFAR-10, CIFAR-100, and GTSRB | ASR | No clear effect |
| Use Mirage across different model architectures | Mirage · Image classification benchmarks | ASR | No clear effect |
Surprising findings
- Directly extending existing single-label backdoor attacks to multiple non-cooperative attackers causes them to exclude one another, so only a dominant attacker's backdoor survives.
Limitations
- Performance on MobileNet-V2 drops because low model utility weakens the detector and ID mapping construction.
- Attack evaluated only on image classification with a Blend trigger in a fixed attack window; defenses against Mirage are discussed but not evaluated.
Experimental setup
Datasets: CIFAR-10 CIFAR-100 GTSRB
Benchmarks: CIFAR-10 CIFAR-100 GTSRB
Metrics: accuracy attack success rate lifespan GAP
Baselines: A3FL Chameleon Neurotoxin PGD Vanilla NBA
Builds on: A3FL Neurotoxin Chameleon DBA BackdoorIndicator
Closest papers by meaning
- Label-Free Backdoor Attacks in Vertical Federated Learning (AAAI 2025 · similarity 0.91)
- Beyond Traditional Threats: A Persistent Backdoor Attack on Federated Learning (AAAI 2024 · similarity 0.89)
- Resisting Backdoor Attacks in Federated Learning via Bidirectional Elections and Individual Perspective (AAAI 2024 · similarity 0.88)
- MARS: A Malignity-Aware Backdoor Defense in Federated Learning (NeurIPS 2025 · similarity 0.88)
- SADBA: Self-Adaptive Distributed Backdoor Attack Against Federated Learning (AAAI 2025 · similarity 0.87)
- Parameter Disparities Dissection for Backdoor Defense in Heterogeneous Federated Learning (NeurIPS 2024 · similarity 0.87)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.