Coordinated Backdoor Attacks against Federated Learning with Model-Dependent Triggers
Abstract
Federated learning enables distributed training of deep learning models among user equipment (UE) to obtain a high-quality global model. A centralized server aggregates the updates submitted by UEs without knowledge of the local training data or process. Despite its privacy preserving merit, we reveal a severe security concern. Malicious UEs can manipulate their training data by injecting a back-door trigger. Thus, the global model that aggregates those malicious updates may make false predictions on the samples with the backdoor trigger. However, the effect of a single backdoor trigger will quickly be diluted by subsequent benign updates. In this work, we present an effective coordinated backdoor attack against federated learning using multiple local triggers; the global trigger consists of various separate local triggers. Moreover, in contrast to using random triggers, we propose using model-dependent triggers (i.e., generated based on local models of attackers) to conduct backdoor attacks. We conduct extensive experiments to assess the effectiveness of our proposed backdoor attacks on MNIST and CIFAR-10 datasets. Experimental results show that our proposed methodology outperforms both coordinated attacks using random triggers and single trigger backdoor attacks in terms of attack success rate. We also show that Byzantine-resilient aggregation methodologies are not robust to our proposed attacks.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Malicious actors often increase the persistence of backdoor attacks in FL by slowing down the learning rate during training.
“Therefore, malicious actors often increase the persistence of backdoor attacks in FL by slowing down the learning rate during training (Nguyen et al. 2024;Gong et al. 2022;Yang et al. 2023a).”
From Survey: federated learning data security and privacy-preserving in edge-Internet of Things (2024) · cites this paper as Gong et al. 2022
When conducting backdoor attacks during the local data collection phase, the attacker only needs to control a fraction of the training data set.
“When conducting backdoor attacks during the local data collection phase, the attacker only needs to control a fraction of the training data set [116].”
From Data and model poisoning backdoor attacks on wireless federated learning, and the defense mechanisms: A comprehensive survey (2024) · cites this paper as [116]
In local model training phase backdoor attacks, an attacker is required to fully control the compromised clients, including the training data set and training algorithm.
“In local model training phase backdoor attacks, an attacker is required to fully control the compromised clients, including the training data set and training algorithm [29], [32], [116], [122]-[124].”
From Data and model poisoning backdoor attacks on wireless federated learning, and the defense mechanisms: A comprehensive survey (2024) · cites this paper as [116]
The primary objective of trigger-based backdoor attacks is to mislead the model to classify trigger-mounted inputs into the target label while behaving normally with non-trigger inputs.
“The primary objective of triggerbased backdoor attacks is to mislead the model to classify the trigger-mounted inputs into the target label while behaving normally with non-trigger inputs [38], [116], [126].”
From Data and model poisoning backdoor attacks on wireless federated learning, and the defense mechanisms: A comprehensive survey (2024) · cites this paper as [116]
Because the completed trigger pattern is distributed in multiple compromised clients, low level of malicious participation leads to low BAR.
“Since the completed trigger pattern is distributed in multiple compromised clients, low level of malicious participation leads to low BAR.”
From Data and model poisoning backdoor attacks on wireless federated learning, and the defense mechanisms: A comprehensive survey (2024) · cites this paper as [116]
Cites
Advances in Neural Information Processing Systems 29
Teymur, O., Zygalakis, K., & Calderhead, B. (2016) · Cited by 13,881 · see citing works
Federated Machine Learning: Concept and Applications
Yang, Q., Liu, Y., Chen, T., & Tong, Y. (2019) · ACM Transactions on Intelligent Systems and Technology · doi:10.1145/3298981 · Cited by 6,322 · see citing works
Practical Secure Aggregation for Privacy-Preserving Machine Learning
Bonawitz, K., Ivanov, V., Kreuter, B., Marcedone, A., McMahan, H. B., Patel, S., Ramage, D., Segal, A., & Seth, K. (2017) · Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/3133956.3133982 · Cited by 3,956 · see citing works
How to backdoor federated learning
Bagdasaryan, E., Veit, A., Hua, Y., Estrin, D., & Shmatikov, V. (2018) · arXiv · doi:10.48550/arxiv.1807.00459 · Cited by 1,495 · see citing works
Neural Cleanse: Identifying and Mitigating Backdoor Attacks in Neural Networks
Wang, B., Yao, Y., Shan, S., Li, H., Viswanath, B., Zheng, H.-T., & Zhao, B. Y. (2019) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp.2019.00031 · Cited by 1,486 · see citing works
Trojaning Attack on Neural Networks
Liu, Y., Ma, S., Aafer, Y., Lee, W.-C., Zhai, J., Wang, W., & Zhang, X. (2018) · Proceedings 2018 Network and Distributed System Security Symposium · doi:10.14722/ndss.2018.23291 · Cited by 1,270 · see citing works
BadNets: Evaluating Backdooring Attacks on Deep Neural Networks
Gu, T., Liu, K., Dolan-Gavitt, B., & Garg, S. (2019) · IEEE Access · doi:10.1109/access.2019.2909068 · Cited by 1,238 · see citing works
Manipulating Machine Learning: Poisoning Attacks and Countermeasures for Regression Learning
Jagielski, M., Oprea, A., Biggio, B., Liu, C., Nita-Rotaru, C., & Li, B. (2018) · 2018 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp.2018.00057 · Cited by 861 · see citing works
Attack of the tails: Yes, you really can backdoor federated learning
Wang, H., Sreenivasan, K., Rajput, S., Vishwakarma, H., Agarwal, S., Sohn, J.-Y., Lee, K., & Papailiopoulos, D. (2020) · arXiv · doi:10.48550/arxiv.2007.05084 · Cited by 406 · see citing works
On Safeguarding Privacy and Security in the Framework of Federated Learning
Ma, C., Li, J., Ding, M., Yang, H. H., Shu, F., Quek, T. Q. S., & Poor, H. V. (2020) · IEEE Network · doi:10.1109/mnet.001.1900506 · Cited by 318 · see citing works
Privacy-Preserving Collaborative Deep Learning With Unreliable Participants
Zhao, L., Wang, Q., Zou, Q., Zhang, Y., & Chen, Y. (2019) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2019.2939713 · Cited by 210 · see citing works
Self-citationThe modeling and implementation of Non- rigid motion based on the carcass traitsPreprint
Fang, S., Xu, Z., He, H., et al. (2018) · EasyChair preprint · doi:10.29007/qfmh · Cited by 45 · see citing works
Backdoor attacks and defenses in feature-partitioned collaborative learning
Liu, Y., Yi, Z., & Chen, T. (2020) · arXiv · doi:10.48550/arxiv.2007.03608 · Cited by 38 · see citing works
Backdoor Attacks and Defenses for Deep Neural Networks in Outsourced Cloud Environments
Chen, Y., Gong, X., Wang, Q., Di, X., & Huang, H. (2020) · IEEE Network · doi:10.1109/mnet.011.1900577 · Cited by 35 · see citing works
Self-citation
Flagged first, then by citations
Cited by
Sorted by citations
Wan, Y., Qu, Y., Ni, W., Xiang, Y., Gao, L., & Hossain, E. (2024) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2024.3361451 · Cited by 152 · see citing works
“Depending on the number of compromised clients controlled by the attacker, targeted backdoor attacks can be further divided into two types: centralized attacks [235] and coordinated attacks [116], [122].”
BackgroundMethodInfluentialNguyen, T. D., Nguyen, T., Nguyen, P. L., Pham, H. H., Doan, K. D., & Wong, K.-S. (2024) · Engineering Applications of Artificial Intelligence · doi:10.1016/j.engappai.2023.107166 · Cited by 130 · see citing works
Survey: federated learning data security and privacy-preserving in edge-Internet of Things
Li, H., Ge, L., & Tian, L. (2024) · Artificial Intelligence Review · doi:10.1007/s10462-024-10774-7 · Cited by 112 · see citing works
“Therefore, malicious actors often increase the persistence of backdoor attacks in FL by slowing down the learning rate during training (Nguyen et al. 2024; Gong et al. 2022; Yang et al. 2023a).”
- Authors
- Gong, X., Chen, Y., Huang, H., Liao, Y., Wang, S., & Wang, Q.
- Affiliations
- Wuhan University (CN)
- Zhejiang University (CN)
- Venue
- IEEE Network
- Published
- 2022-01
- Volume
- 36
- Issue
- 1
- Pages
- 84-90
- ISSN
- 0890-8044 (ISSN-L)
- 1558-156X
- OpenAlex
- W4213110664
- Cited by
- 72
- References
- 14
- Citations by year
- 2026: 16 · 2025: 15 · 2024: 20 · 2023: 20 · 2022: 1
- FWCI
- 4.61
- Type
- journal article
- Language
- en
- Open access
- closed
- Licence
- Locations
- IEEE Network (publishedVersion)
- Rare & Special e-Zone (The Hong Kong University of Science and Technology) (submittedVersion)
- Funders
- National Natural Science Foundation of China (61972296)
- NSFC (U20B2049,61822207)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
- Physical Sciences › Computer Science › Computer Vision and Pattern Recognition › Digital Media Forensic Detection
- Keywords
- federated learning, backdoor attacks, coordinated attacks, data poisoning, attack success rate, deep learning security
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
