Research map / Adversarial robustness and security / Backdoor and poisoning
Backdoor Federated Learning by Poisoning Backdoor-Critical Layers
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes a backdoor attack on federated learning that identifies backdoor-critical layers and poisons only those layers (LP attack, with an LF variant), evading eight FL defenses while keeping main-task accuracy.
Problem
Backdoor attacks on federated learning are typically studied on the whole model, and existing defenses are evaluated against whole-model poisoning; the paper targets attacks that exploit a small subset of backdoor-critical layers to evade defenses in FL.
Approach
Identify backdoor-critical (BC) layers, a small subset of layers whose poisoning dominates backdoor success, and restrict malicious updates to those layers (layer-poisoning, LP attack; LF variant), so the attack remains effective while evading aggregation-based defenses.
Key results
- Under FedAvg (IID) on CIFAR-10 with VGG19, the LP attack reaches a best BSR of 94.89% versus 79.27% for BadNets baseline.
- Against FLAME (non-IID) with ResNet18 on CIFAR-10, the LP attack achieves 89.12%-ish average BSR range (reported Avg BSR 82.14%+/-7.46 for LF/RLR settings), while baselines drop below 10% in several IID defense settings.
- Under RLR (IID) on CIFAR-10 with ResNet18, LP attack achieves a best BSR of 90.16% while DBA reaches only 23.41%.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use LP Attack instead of BadNets | FedAvg with VGG19 · CIFAR-10 IID | Avg BSR: 73.13 -> 93.76$\pm 0.35$ | Helped |
| Use LP Attack instead of BadNets | FedAvg with ResNet18 · CIFAR-10 IID | Avg BSR: 70.2 -> 95.35$\pm0.32$ | Helped |
| Use LP Attack instead of BadNets | FedAvg with CNN · Fashion-MNIST IID | Avg BSR: 99.97 -> 80.81$\pm 5.79$ | Hurt |
| Use LP Attack instead of BadNets | FedAvg with VGG19 · CIFAR-10 non-IID | Avg BSR: 74.69 -> 83.55$\pm 0.43$ | Helped |
| Use LP Attack instead of BadNets | FedAvg with ResNet18 · CIFAR-10 non-IID | Avg BSR: 70.53 -> 89.12$\pm 1.4$ | Helped |
| Use LP Attack instead of BadNets | FedAvg with CNN · Fashion-MNIST non-IID | Avg BSR: 99.9 -> 78.84$\pm 9.16$ | Hurt |
| Use LP Attack instead of BadNets | FedAvg with VGG19 · CIFAR-10 IID | accuracy: 83.86 -> 84.16$\pm 0.09$ | No clear effect |
Surprising findings
- Existing defenses such as FLAME and RLR, which substantially suppress DBA and BadNets, are shown to be bypassed by poisoning only backdoor-critical layers.
Limitations
- Results are reported only on small image benchmarks (CIFAR-10, Fashion-MNIST) with simple CNN/VGG/ResNet models.
- Some attack settings show reduced main-task accuracy under LP/LF attacks against certain defenses.
Experimental setup
Datasets: CIFAR-10 Fashion-MNIST
Benchmarks: CIFAR-10 Fashion-MNIST
Metrics: backdoor success rate (BSR) main task accuracy
Baselines: BadNets DBA FedAvg FLTrust FLAME RLR MultiKrum FLDetector FLARE
Builds on: BadNets DBA FedAvg
Closest papers by meaning
- Beyond Traditional Threats: A Persistent Backdoor Attack on Federated Learning (AAAI 2024 · similarity 0.90)
- MARS: A Malignity-Aware Backdoor Defense in Federated Learning (NeurIPS 2025 · similarity 0.90)
- SADBA: Self-Adaptive Distributed Backdoor Attack Against Federated Learning (AAAI 2025 · similarity 0.89)
- Resisting Backdoor Attacks in Federated Learning via Bidirectional Elections and Individual Perspective (AAAI 2024 · similarity 0.88)
- Label-Free Backdoor Attacks in Vertical Federated Learning (AAAI 2025 · similarity 0.88)
- Infighting in the Dark: Multi-Label Backdoor Attack in Federated Learning (CVPR 2025 · similarity 0.87)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.