Research map / Federated learning and privacy / Privacy attacks and secure learning
DataStealing: Steal Data from Diffusion Models in Federated Learning with Multiple Trojans
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes DataStealing, where an attacker implants multiple combinatorial triggers (ComboTs) into a diffusion model trained with federated learning to exfiltrate thousands of private images, and AdaSCP, an adaptive scale critical-parameter attack, to evade distance-based FL defenses.
Problem
Attackers in federated learning of diffusion models can steal private local training images via backdoored global models, but injecting many backdoors via model poisoning is detected by distance-based robust aggregation defenses (Krum, Multi-Krum, FoolsGold, RFA, Multi-metrics).
Approach
Combinatorial triggers built from point combinations in a mask give many distinct trojan triggers, and AdaSCP updates only dominant-timestep-critical parameters, adaptively optimizing a scale factor using an implanted indicator parameter and the server's accept/reject feedback so malicious updates look like benign ones.
Key results
- On non-IID CIFAR10, AdaSCP achieves mean FID/MSE of 16.55/0.0657 across six defenses, versus 94.02/0.1492 for Model Poison and 27.13/0.1441 for BC Layer Substitution.
- On IID CIFAR10, AdaSCP reaches mean 8.86/0.0699 versus 97.27/0.1173 for Model Poison.
- Ablation on CIFAR10 shows the target scale and history scales progressively improve average MSE (from 0.1492 baseline to 0.0657 with full AdaSCP).
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use AdaSCP instead of Data Poison | CIFAR10, non-IID · CIFAR10, non-IID (mean across defenses) | MSE: 0.1304 -> 0.0657 | Helped |
| Use AdaSCP instead of Data Poison | CelebA, non-IID · CelebA, non-IID (mean across defenses) | MSE: 0.1317 -> 0.0499 | Helped |
| Use AdaSCP instead of Data Poison | LSUN Bedroom, non-IID · LSUN Bedroom, non-IID (mean across defenses) | MSE: 0.1297 -> 0.0941 | Helped |
| Use AdaSCP instead of Data Poison | CIFAR10, IID · CIFAR10, IID (mean across defenses) | MSE: 0.1283 -> 0.0699 | Helped |
| Train critical parameters rather than all parameters (ablation) | AdaSCP on CIFAR10, FedAvg · CIFAR10, non-IID, FedAvg | MSE: 0.0069 -> 0.0123 | Hurt |
| Train critical parameters rather than all parameters (ablation) | AdaSCP on CIFAR10, Multi-metrics · CIFAR10, non-IID, Multi-metrics | MSE: 0.1685 -> 0.0422 | Helped |
| Replace the current scale with target scale tars (ablation) | Critical-parameter method on CIFAR10, Multi-metrics · CIFAR10, non-IID, Multi-metrics | MSE: 0.0422 -> 0.0554 | Hurt |
| Optimize scale using learning rate η (ablation) | Target-scale method on CIFAR10, Foolsgold · CIFAR10, non-IID, Foolsgold | MSE: 0.0273 -> 0.0077 | Helped |
| Add history scales to stabilize scale optimization (ablation) | AdaSCP on CIFAR10, Multi-Krum · CIFAR10, non-IID, Multi-Krum | MSE: 0.1389 -> 0.1271 | Helped |
| Increase the critical-parameter proportion from τ=0.2 to τ=0.4 (ablation) | AdaSCP-FedAvg on CIFAR10 · CIFAR10, AdaSCP-FedAvg | MSE: 0.1217 -> 0.0117 | Helped |
| Increase ComboTs patch size from 1×1 to 3×3 (ablation) | AdaSCP-FedAvg on CIFAR10 · CIFAR10, AdaSCP-FedAvg | MSE: 0.1287 -> 0.0117 | Helped |
| Increase ComboTs patch size beyond 3×3 (ablation) | AdaSCP-FedAvg on CIFAR10 · CIFAR10, AdaSCP-FedAvg | MSE: 0.0117 -> 0.0133; 0.0204; 0.0263; 0.0298; 0.0364; 0.0396 | Hurt |
Surprising findings
- Model Poison with the standard scale succeeds under plain FedAvg but collapses or is rejected under robust defenses such as Krum and FoolsGold (FID up to 459.64).
- Backdoors implanted by AdaSCP decay after about 100 rounds of benign training, suggesting a mitigation path.
Limitations
- FID increases after a successful multi-backdoor attack (+10.31 on CIFAR10, +1.73 on CelebA).
- Norm clipping and differential privacy defenses can neutralize the indicator-based attack, though they also harm diffusion training.
- Attack assumes a single malicious client and prior knowledge of the total number of clients; more stolen images lead to higher FID.
Experimental setup
Datasets: CIFAR10 CelebA LSUN Bedroom
Benchmarks: CIFAR10 CelebA LSUN Bedroom
Metrics: FID MSE
Baselines: Data Poison Model Poison PGD Poison BC Layer Substitution
Builds on: Trojan diffusion (TrojDiff) model replacement attack diffusion importance estimation (structural pruning) 3DFed indicator FedAvg
Closest papers by meaning
- Concealing Sensitive Samples against Gradient Leakage in Federated Learning (AAAI 2024 · similarity 0.86)
- Leak and Learn: An Attacker's Cookbook to Train Using Leaked Data from Federated Learning (CVPR 2024 · similarity 0.86)
- Revamping Federated Learning Security from a Defender's Perspective: A Unified Defense with Homomorphic Encrypted Data Space (CVPR 2024 · similarity 0.85)
- Resisting Backdoor Attacks in Federated Learning via Bidirectional Elections and Individual Perspective (AAAI 2024 · similarity 0.85)
- SPMC: Self-Purifying Federated Backdoor Defense via Margin Contribution (ICML 2025 · similarity 0.85)
- Dual Defense: Enhancing Privacy and Mitigating Poisoning Attacks in Federated Learning (NeurIPS 2024 · similarity 0.85)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.