Research map / Adversarial robustness and security / Backdoor and poisoning

HPE: Hallucinated Positive Entanglement for Backdoor Attacks in Federated Self-Supervised Learning

NeurIPS 2026 · Adversarial robustness and security › Backdoor and poisoning · approach: Backdoors in federated learning · 0 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes HPE, a backdoor attack for federated self-supervised learning that combines hallucinated hard positives, backdoor feature entanglement, and dual-level constrained poisoning to achieve high ASR and persistence against defenses.

Problem

Backdoor attacks on federated self-supervised learning suffer from low utilization of poisoned samples, limited cross-dataset transferability, and backdoor dilution/forgetting during multi-round aggregation.

Approach

Generates hallucinated hard positives on the hypersphere via geodesic interpolation toward k-means prototypes, binds poisoned target-class samples together in contrastive learning (feature entanglement), and constrains the malicious model to an epsilon-ball around the global model while poisoning low-variance coordinates.

Key results

• HPE achieves 99.41% ASR on CIFAR-10 pretraining with STL-10 downstream, surpassing the lowest baseline (BASSL) by 43.89 points.
• HPE keeps ASR above 91% across all pretrain/downstream pairs in the main table, with ACC close to the benign model.
• After 100 rounds of clean training post-removal of the malicious client, HPE retains 96.70% of its peak ASR versus 61.33% for EmInspector.

Surprising findings

• Reports that Activation Clustering silhouette scores for the target class are lower than for non-target classes, attributed to feature entanglement.

Limitations

• Convergence theorem in the appendix relies on strong assumptions (convexity, bounded gradients) that do not hold for deep contrastive learning, and its proof is non-rigorous at key steps.
• Evaluation limited to image classification with ResNet-18 style encoders and MoCo-v2 as the main SSL algorithm.
• Defense evaluation covers a selected set of defenses; no adaptive defenses reported.

Experimental setup

Datasets: CIFAR-10 STL-10 CIFAR-100 GTSRB ImageNet-100

Benchmarks: CIFAR-10 STL-10 CIFAR-100 GTSRB ImageNet-100

Metrics: ACC ASR

Baselines: BadEncoder BASSL CTRL BADFSS EmInspector

Builds on: MoCo BADFSS EmInspector BadEncoder

Closest papers by meaning

• Invisible Backdoor Attack against Self-supervised Learning (CVPR 2025 · similarity 0.85)
• MARS: A Malignity-Aware Backdoor Defense in Federated Learning (NeurIPS 2025 · similarity 0.85)
• Backdoor Federated Learning by Poisoning Backdoor-Critical Layers (ICLR 2024 · similarity 0.85)
• SPMC: Self-Purifying Federated Backdoor Defense via Margin Contribution (ICML 2025 · similarity 0.85)
• Beyond Traditional Threats: A Persistent Backdoor Attack on Federated Learning (AAAI 2024 · similarity 0.84)
• DeDe: Detecting Backdoor Samples for SSL Encoders via Decoders (CVPR 2025 · similarity 0.84)