Research map / Adversarial robustness and security / Backdoor and poisoning
Attack of the Tails: Yes, You Really Can Backdoor Federated Learning
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's title only (no summary yet). Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| target rare, naturally occurring edge-case inputs with an attacker-chosen label | Federated learning models across image classification, OCR, sentiment classification, and next-word prediction · CIFAR-10, EMNIST, ImageNet, Sentiment140, Reddit | backdoor effectiveness | Helped |
| use a PGD attacker constrained near the global model | Edge-case backdoor attack in federated learning · CIFAR-10, EMNIST, Sentiment140 | backdoor persistence under defenses | Helped |
| carefully mix edge-case examples with benign training data (ablation) | Black-box edge-case attack · CIFAR-10, EMNIST, Sentiment140 | attack effectiveness | Helped |
| use too few edge-case examples in the attacker's mixed dataset (ablation) | Black-box edge-case attack · CIFAR-10 | attack effectiveness | Hurt |
| use a pure edge-case dataset instead of mixing in benign data (ablation) | Black-box edge-case attack · CIFAR-10 | attack effectiveness | Helped |
| use a pure edge-case dataset instead of mixing in benign data (ablation) | Black-box edge-case attack · CIFAR-10 under robust defenses | ability to pass defenses | Hurt |
| make edge-case examples available to honest clients with correct labels (ablation) | Edge-case backdoor attack · All five tasks | attack effectiveness | Hurt |
| allow some honest clients to hold edge-case examples, with half held by the adversary (ablation) | Edge-case backdoor attack · All five tasks | attack effectiveness | Helped |
| lower the attack frequency (ablation) | Edge-case backdoor attack · Fixed-frequency and fixed-pool federated learning | speed of backdoor injection | Hurt |
| increase model capacity (ablation) | Edge-case backdoor attack · CIFAR-10 and Sentiment140 | ease of backdoor insertion | Helped |
| decrease model capacity (ablation) | Edge-case backdoor attack · CIFAR-10 and Sentiment140 | ease of backdoor insertion | Hurt |
| apply Krum or Multi-Krum aggregation (ablation) | Black-box edge-case attack · CIFAR-10 | backdoor effectiveness | Hurt |
Closest papers by meaning
- Resisting Backdoor Attacks in Federated Learning via Bidirectional Elections and Individual Perspective (AAAI 2024 · similarity 0.90)
- Backdoor Federated Learning by Poisoning Backdoor-Critical Layers (ICLR 2024 · similarity 0.89)
- Beyond Traditional Threats: A Persistent Backdoor Attack on Federated Learning (AAAI 2024 · similarity 0.89)
- MARS: A Malignity-Aware Backdoor Defense in Federated Learning (NeurIPS 2025 · similarity 0.89)
- Infighting in the Dark: Multi-Label Backdoor Attack in Federated Learning (CVPR 2025 · similarity 0.88)
- SADBA: Self-Adaptive Distributed Backdoor Attack Against Federated Learning (AAAI 2025 · similarity 0.88)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.