Research map / Federated learning and privacy / Privacy attacks and secure learning
Bad-PFL: Exploiting Backdoor Attacks against Personalized Federated Learning
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes Bad-PFL, a federated backdoor attack that uses natural target-class features generated by a generator plus disruptive FGSM-style noise as the trigger, achieving high attack success against seven PFL methods on CIFAR-10, CIFAR-100, and SVHN.
Problem
Existing federated backdoor attacks with manually designed triggers fail to persist in personalized federated learning (PFL) models, which are often reported as immune to backdoors.
Approach
Use natural features of the attacker-chosen target label (generated by a generator co-optimized with the global model) plus sample-specific disruptive noise as the trigger, so that any model trained on natural data embeds the backdoor and it survives personalization.
Key results
- On CIFAR-10 with FedRep, Bad-PFL reaches 97.95% ASR versus at most 28.41% for the best baseline (Neurotoxin) while keeping accuracy around 80%.
- Against the Median robust aggregator on CIFAR-10 with FedRep, Bad-PFL achieves 77.21% ASR, while baselines are at most about 23%.
- Bad-PFL keeps ASR above 70% after NAD, I-BAU and fine-tuning defenses on CIFAR-10 (e.g., 81.12% after FT-15 on FedBN).
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use Bad-PFL's natural-feature trigger instead of baseline backdoor triggers | PFL attacks · CIFAR-10, FedBN and FedRep | ASR: 54.81 -> 82.22; 28.41 -> 97.95 | Helped |
| Use Bad-PFL against robust aggregation defenses | FedBN and FedRep · CIFAR-10, Median defense | ASR: 30.55 -> 50.52; 12.14 -> 77.21 | Helped |
| Remove target-feature δ from the trigger (ablation) | Bad-PFL · CIFAR-10, FedBN | ASR: 82.22 -> 13.74 | Hurt |
| Remove target-feature δ from the trigger (ablation) | Bad-PFL · CIFAR-10, FedRep | ASR: 97.95 -> 12.82 | Hurt |
| Remove disruptive noise ξ from the trigger (ablation) | Bad-PFL · CIFAR-10, FedBN | ASR: 82.22 -> 68.56 | Hurt |
| Remove disruptive noise ξ from the trigger (ablation) | Bad-PFL · CIFAR-10, FedRep | ASR: 97.95 -> 79.32 | Hurt |
| Remove the regularization term from full-model-sharing training (ablation) | Neurotoxin · Non-IID PFL, personalized models (average across FedProx, Ditto, and pFedMe) | ASR: 72.73 -> 11.68 | Hurt |
| Weight the regularization term by gradient magnitudes (ablation) | Neurotoxin · Non-IID PFL, personalized models (average across FedProx, Ditto, and pFedMe) | ASR: 72.73 -> 90.92 | Helped |
| Fine-tune only non-shared parameters using trigger-embedded and clean data (ablation) | Neurotoxin · FedBN and FedRep | ASR: 43.95 -> 97.81 | Helped |
| Fine-tune non-shared parameters on clean data only (ablation) | Neurotoxin · FedBN and FedRep | ASR: 97.81 -> 10.59 | Hurt |
Surprising findings
- Partial model-sharing PFL methods (FedBN, FedRep) strongly resist existing federated backdoor attacks, with baseline ASRs often below 30%.
Limitations
- Sign aggregation defense substantially reduces Bad-PFL's ASR and degrades training, and Median lowers ASR to 50-77%.
- Attack assumes compromised clients fully control local training and that the adversary can run a generator on the global model.
Experimental setup
Datasets: CIFAR-10 CIFAR-100 SVHN
Benchmarks: CIFAR-10 CIFAR-100 SVHN
Metrics: Acc ASR
Baselines: ModRep Neurotoxin PGD-Bkd DBA FCBA LF-Attack
Builds on: FedAvg FedRep Ditto Neurotoxin FGSM
Closest papers by meaning
- Resisting Backdoor Attacks in Federated Learning via Bidirectional Elections and Individual Perspective (AAAI 2024 · similarity 0.88)
- Beyond Traditional Threats: A Persistent Backdoor Attack on Federated Learning (AAAI 2024 · similarity 0.88)
- MARS: A Malignity-Aware Backdoor Defense in Federated Learning (NeurIPS 2025 · similarity 0.87)
- Parameter Disparities Dissection for Backdoor Defense in Heterogeneous Federated Learning (NeurIPS 2024 · similarity 0.87)
- Backdoor Federated Learning by Poisoning Backdoor-Critical Layers (ICLR 2024 · similarity 0.87)
- SADBA: Self-Adaptive Distributed Backdoor Attack Against Federated Learning (AAAI 2025 · similarity 0.86)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.