Research map / Adversarial robustness and security / Backdoor and poisoning
Beyond Traditional Threats: A Persistent Backdoor Attack on Federated Learning
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes FCBA, a single-shot federated learning backdoor attack that uses combinatorial (full combination) local triggers across 14 malicious clients to improve backdoor persistence against benign-update dilution.
Problem
Backdoors injected into federated learning global models are diluted by subsequent benign updates, so attack success rate decays quickly over rounds; improving attack persistence has received little attention.
Approach
Divide a global trigger into m sub-blocks and assign each malicious client a unique local trigger formed by a full combination of sub-blocks (2^m-2 combinations), so the aggregated global model learns a more complete backdoor pattern that resists forgetting under single-shot model-replacement attacks.
Key results
- After 120 rounds post-attack, FCBA's ASR-t is 99.52% (MNIST), 79.52% (CIFAR-10), and 57.78% (GTSRB), versus 64.64%, 70.72%, and 0.95% for DBA.
- The abstract reports that on GTSRB, ASR after 120 rounds rose over 50% above the baseline.
- Differential-privacy-style defenses (clipping and Gaussian noise) are reported to be less effective against FCBA than DBA across clipping thresholds and noise variances.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| use full-combination local triggers instead of DBA's simple division strategy | Federated learning backdoor attack · MNIST | ASR-120: 64.64\% -> 99.52\% | Helped |
| use full-combination local triggers instead of DBA's simple division strategy | Federated learning backdoor attack · CIFAR-10 | ASR-120: 70.72\% -> 79.52\% | Helped |
| use full-combination local triggers instead of DBA's simple division strategy | Federated learning backdoor attack · GTSRB | ASR-120: 0.95\% -> 57.78\% | Helped |
| introduce the backdoor before global-model convergence rather than after convergence (ablation) | FCBA · CIFAR-10 and GTSRB | ASR and ASR-t | Hurt |
| increase the scale factor γ to very large values (ablation) | FCBA · MNIST and CIFAR-10 | ASR: 0\% | Hurt |
| use a highly imbalanced client data distribution (α=0.1) (ablation) | FCBA · MNIST and CIFAR-10 | ASR and ASR-t | Hurt |
| lower the clipping boundary S (ablation) | FCBA · MNIST and CIFAR-10 | ASR-t | Hurt |
| increase noise variance σ (ablation) | FCBA · MNIST and CIFAR-10 | ASR-t | Hurt |
| increase trigger size TS (ablation) | FCBA · MNIST and CIFAR-10 | ASR-t | Mixed |
| vary trigger location TL (ablation) | FCBA · MNIST and CIFAR-10 | ASR-t | No clear effect |
| vary trigger gap TG (ablation) | FCBA · MNIST and CIFAR-10 | ASR-t | No clear effect |
| vary poisoning ratio r (ablation) | FCBA · MNIST and CIFAR-10 | ASR-t | No clear effect |
Surprising findings
- Attacks spread over more poisoning epochs (temporally dispersed poisoning) also improve persistence, suggesting that the number of poisoning rounds, not only trigger design, drives persistence.
- Early backdoor injection before convergence degrades ASR and persistence, so the paper attacks after convergence.
Limitations
- Persistence gains are partly confounded by the larger number of malicious clients and poisoning rounds used by FCBA.
- The attack is evaluated only on small image classification tasks with a small CNN and lightweight ResNet-18.
- Performance degrades under strongly non-i.i.d. data (alpha=0.1).
Experimental setup
Datasets: MNIST CIFAR-10 GTSRB
Benchmarks: MNIST CIFAR-10 GTSRB
Metrics: attack success rate (ASR) ASR-t clean data accuracy (CDA) t-SNE distance
Baselines: DBA Model Replacement Differential Private Federated Learning
Builds on: Distributed Backdoor Attack (DBA) model replacement differential privacy federated learning
Closest papers by meaning
- SADBA: Self-Adaptive Distributed Backdoor Attack Against Federated Learning (AAAI 2025 · similarity 0.92)
- Backdoor Federated Learning by Poisoning Backdoor-Critical Layers (ICLR 2024 · similarity 0.90)
- Resisting Backdoor Attacks in Federated Learning via Bidirectional Elections and Individual Perspective (AAAI 2024 · similarity 0.89)
- Infighting in the Dark: Multi-Label Backdoor Attack in Federated Learning (CVPR 2025 · similarity 0.89)
- MARS: A Malignity-Aware Backdoor Defense in Federated Learning (NeurIPS 2025 · similarity 0.89)
- Parameter Disparities Dissection for Backdoor Defense in Heterogeneous Federated Learning (NeurIPS 2024 · similarity 0.88)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.