Research map / Adversarial robustness and security / Backdoor and poisoning
Backdoors in federated learning
Attack and defend federated training with distributed backdoors and robust aggregation.
16 accepted papers at ICML, NeurIPS, ICLR, CVPR and AAAI (2020–2026) · an approach in Backdoor and poisoning, keyword cluster “backdoor attack · poisoning · triggers”
State History Tried Checklist Preprints Who Export
Where it stands
Not enough benchmark data Fewer than four papers report the same benchmark, so there is no record to follow.
7 papers in 2023–24 and 6 in 2025–26 (at ICML, NeurIPS, ICLR, CVPR and AAAI); its share of the topic shrank, from 6.5% to 4.0%.
How this is decided
A benchmark is tracked when at least four papers of this approach report their own method on the same dataset and metric in at least two different years. Its record is the best number reported up to 2024 compared with the best reported in 2025–26: still improving means at least 1% better, flat means at most 0.2% better with at least two papers from 2025–26 trying. Numbers on a different scale from the rest (a fraction among percentages) and far outliers are left out. Results come from different papers with different setups, so they are signals, not head-to-head comparisons. The share of papers is counted at ICML, NeurIPS, ICLR, CVPR and AAAI.
How it got here
Most cited paper of each year
- 2020 · DBA: Distributed Backdoor Attacks against Federated Learning (ICLR 2020 · 260 citations)
- 2021 · Defending against Backdoors in Federated Learning with Robust Learning Rate (AAAI 2021 · 203 citations)
- 2023 · Poisoning with Cerberus: Stealthy and Colluded Backdoor Attack against Federated Learning (AAAI 2023 · 99 citations)
- 2024 · Beyond Traditional Threats: A Persistent Backdoor Attack on Federated Learning (AAAI 2024 · 41 citations)
- 2025 · Infighting in the Dark: Multi-Label Backdoor Attack in Federated Learning (CVPR 2025 · 8 citations)
- 2026 · Ghost in the Cloud: Your Geo-Distributed Large Language Models Training is Easily Manipulated (ICLR 2026 · 0 citations)
Earliest papers here
- DBA: Distributed Backdoor Attacks against Federated Learning (ICLR 2020 · 260 citations)
- Attack of the Tails: Yes, You Really Can Backdoor Federated Learning (NeurIPS 2020 · 109 citations)
- Defending against Backdoors in Federated Learning with Robust Learning Rate (AAAI 2021 · 203 citations)
What has been tried
11 papers here report 129 measured changes (a component added, removed or swapped, compared with a baseline): helped 44%, no clear effect 24%, hurt 26%, mixed 6%. Papers mostly publish changes that helped, so "helped" is over-represented.
Ablations in recent papers
| What was changed | Measured on | Result | Effect | Paper |
|---|---|---|---|---|
| introduce the backdoor before global-model convergence rather than after convergence | CIFAR-10 and GTSRB · ASR and ASR-t | Hurt | Beyond Traditional Threats: A Persistent Backdoor Attack on Federated Learning (AAAI 2024 · 41 citations) | |
| Add the auxiliary model Fa during shadow-model training | MNIST · backdoor attack accuracy | +8% | Helped | Chronic Poisoning: Backdoor Attack against Split Learning (AAAI 2024 · 12 citations) |
| Add constrained optimization for ID-mapping enhancement | CIFAR-10, attack window then continued training · ASR | Helped | Infighting in the Dark: Multi-Label Backdoor Attack in Federated Learning (CVPR 2025 · 8 citations) | |
| use a parrot model with three convolutional layers rather than one | CIFAR-10, BadNet · ASR | 14.13 -> 96.92 | Helped | IBAS:Imperceptible Backdoor Attacks in Split Learning with Limited Information (AAAI 2025 · 0 citations) |
What reviewers will expect
Datasets and baselines named in the 6 papers of this approach from 2024–2026 that have a full-text summary. Leaving out the common ones is a frequent review question.
Datasets
- CIFAR-10 · 6 of 6 papers
- GTSRB · 3 of 6 papers
- CIFAR-100 · 3 of 6 papers
- MNIST · 2 of 6 papers
- Fashion-MNIST · 2 of 6 papers
Baselines
- DBA · 2 of 6 papers
Recent preprints
Loading recent arXiv preprints…
Who publishes on it
Institutions on the most papers of this approach since 2023 (of 13 papers; from OpenAlex and the papers' affiliations).
- University of Notre Dame · 2 papers
- Yangzhou University · 2 papers
- University of Washington · 2 papers
Use it
Download BibTeX of 16 key papersOpen the topic in the interactive map
Get alerts. Describe your idea in scime atlas and save it (free scime account): you get a weekly email when new preprints land close to it.
Related approaches
Same keyword cluster
- Trigger-based backdoor attacks (106 papers)
- Backdoors in large multimodal models (104 papers)
Elsewhere in the topic
- Detecting poisoned samples (54 papers)
- Training-time backdoor defense (40 papers)
Benchmark numbers, ablations and baseline numbers are extracted by AI from each paper's full text and can be wrong; the paper is the authority. Data: results index of 2026-11-02, citation counts from OpenAlex (2026-10-09).