Backdoor Attacks and Defenses in Federated Learning: State-of-the-Art, Taxonomy, and Future Directions
Abstract
The federated learning framework is designed for massively distributed training of deep learning models among thousands of participants without compromising the privacy of their training datasets. The training dataset across participants usually has heterogeneous data distributions. Besides, the central server aggregates the updates provided by different parties, but has no visibility into how such updates are created. The inherent characteristics of federated learning may incur a severe security concern. The malicious participants can upload poisoned updates to introduce backdoored functionality into the global model, in which the backdoored global model will misclassify all the malicious images (i.e., attached with the backdoor trigger) into a false label but will behave normally in the absence of the backdoor trigger. In this work, we present a comprehensive review of the state-of-the-art backdoor attacks and defenses in federated learning. We classify the existing backdoor attacks into two categories: data poisoning attacks and model poisoning attacks, and divide the defenses into anomaly updates detection, robust federated training, and backdoored model restoration. We give a detailed comparison of both attacks and defenses through experiments. Lastly, we pinpoint a variety of potential future directions of both backdoor attacks and defenses in the framework of federated learning.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
In some existing surveys, theoretical working mechanisms of backdoor attacks and defenses for WFL were reviewed, but limitations of existing methodologies were not systematically analyzed.
“In [52] and [53], the theoretical working mechanisms of backdoor attacks and defenses for WFL were reviewed. However, the limitations of the existing methodologies were not systematically analyzed.”
From Data and model poisoning backdoor attacks on wireless federated learning, and the defense mechanisms: A comprehensive survey (2024) · cites this paper as [52]
The low-dimensional embeddings of the uploaded model updates still contain the crucial features that capture the essential variability in data instances.
“This considers the fact that the low-dimensional embeddings of the uploaded model updates still contain the crucial features that capture the essential variability in data instances [52].”
From Data and model poisoning backdoor attacks on wireless federated learning, and the defense mechanisms: A comprehensive survey (2024) · cites this paper as [52]
Cites
How to backdoor federated learning
Bagdasaryan, E., Veit, A., Hua, Y., Estrin, D., & Shmatikov, V. (2018) · arXiv · doi:10.48550/arxiv.1807.00459 · Cited by 1,495 · see citing works
Analyzing Federated Learning through an Adversarial Lens
Bhagoji, A. N., Chakraborty, S., Mittal, P., & Calo, S. (2018) · arXiv · doi:10.48550/arxiv.1811.12470 · Cited by 703 · see citing works
Federated learning meets blockchain in edge computing: Opportunities and challenges
Nguyen, D. C., Ding, M., Pham, Q.-V., Pathirana, P. N., Le, L. B., Seneviratne, A., Li, J., Niyato, D., & Poor, H. V. (2021) · IEEE Internet of Things Journal · doi:10.1109/jiot.2021.3072611 · Cited by 661 · see citing works
DBA: Distributed Backdoor Attacks against Federated Learning
Xie, C., Huang, K., Chen, P., & Li, B. (2020) · International Conference on Learning Representations · Cited by 468 · see citing works
Attack of the tails: Yes, you really can backdoor federated learning
Wang, H., Sreenivasan, K., Rajput, S., Vishwakarma, H., Agarwal, S., Sohn, J.-Y., Lee, K., & Papailiopoulos, D. (2020) · arXiv · doi:10.48550/arxiv.2007.05084 · Cited by 406 · see citing works
Mitigating Sybils in Federated Learning Poisoning
Fung, C., Yoon, C. J. M., & Beschastnikh, I. (2018) · arXiv · doi:10.48550/arxiv.1808.04866 · Cited by 385 · see citing works
Can You Really Backdoor Federated Learning?
Sun, Z., Kairouz, P., Suresh, A. T., & McMahan, H. B. (2019) · arXiv · doi:10.48550/arxiv.1911.07963 · Cited by 348 · see citing works
A Crowdsourcing Framework for On-Device Federated Learning
Pandey, S. R., Tran, N. H., Bennis, M., Tun, Y. K., Manzoor, A., & Hong, C. S. (2020) · IEEE Transactions on Wireless Communications · doi:10.1109/twc.2020.2971981 · Cited by 318 · see citing works
Blockchain-Based Federated Learning for Device Failure Detection in Industrial IoT
Zhang, W., Lu, Q., Yu, Q., Li, Z., Liu, Y., Lo, S. K., Chen, S., Xu, X., & Zhu, L. (2020) · IEEE Internet of Things Journal · doi:10.1109/jiot.2020.3032544 · Cited by 306 · see citing works
BaFFLe: Backdoor Detection via Feedback-based Federated Learning
Andreina, S., Marson, G. A., Mollering, H., & Karame, G. (2021) · 2021 IEEE 41st International Conference on Distributed Computing Systems (ICDCS) · doi:10.1109/icdcs51616.2021.00086 · Cited by 205 · see citing works
Learning to Detect Malicious Clients for Robust Federated LearningPreprint
Li, S., Cheng, Y. J., Wang, W., Liu, Y., & Chen, T. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2002.00211 · Cited by 202 · see citing works
CRFL: Certifiably Robust Federated Learning against Backdoor AttacksPreprint
Xie, C., Chen, M., Chen, P., & Li, B. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2106.08283 · Cited by 121 · see citing works
Mitigating Backdoor Attacks in Federated LearningPreprint
Wu, C., Xian, Y., Zhu, S., & Mitra, P. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2011.01767 · Cited by 69 · see citing works
FLGUARD: Secure and Private Federated Learning
Nguyen, T. D., Rieger, P., Yalame, H., Möllering, H., Fereidooni, H., Marchal, S., Miettinen, M., Mirhoseini, A., Sadeghi, A., Schneider, T. H., et al. (2021) · TUbilio (Technical University of Darmstadt) · Cited by 55 · see citing works
The modeling and implementation of Non- rigid motion based on the carcass traitsPreprint
Fang, S., Xu, Z., He, H., et al. (2018) · EasyChair preprint · doi:10.29007/qfmh · Cited by 45 · see citing works
Flagged first, then by citations
Cited by
Sorted by citations
Wan, Y., Qu, Y., Ni, W., Xiang, Y., Gao, L., & Hossain, E. (2024) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2024.3361451 · Cited by 152 · see citing works
“This considers the fact that the low-dimensional embeddings of the uploaded model updates still contain the crucial features that capture the essential variability in data instances [52].”
BackgroundFederated learning for healthcare applications
Chaddad, A., Wu, Y., & Desrosiers, C. (2024) · IEEE Internet of Things Journal · doi:10.1109/jiot.2023.3325822 · Cited by 136 · see citing works
Nguyen, T. D., Nguyen, T., Nguyen, P. L., Pham, H. H., Doan, K. D., & Wong, K.-S. (2024) · Engineering Applications of Artificial Intelligence · doi:10.1016/j.engappai.2023.107166 · Cited by 130 · see citing works
Threats and Defenses in the Federated Learning Life Cycle: A Comprehensive Survey and Challenges
Li, Y., Guo, Z., Yang, N., Chen, H., Yuan, D., & Ding, W. (2025) · IEEE Transactions on Neural Networks and Learning Systems · doi:10.1109/tnnls.2025.3563537 · Cited by 38 · see citing works
- Authors
- Gong, X., Chen, Y., Wang, Q., & Kong, W.
- Affiliations
- Wuhan University (CN)
- Zhejiang University (CN)
- Venue
- IEEE Wireless Communications
- Published
- 2023-04
- Volume
- 30
- Issue
- 2
- Pages
- 114-121
- ISSN
- 1536-1284 (ISSN-L)
- 1558-0687
- OpenAlex
- W4285206772
- Cited by
- 114
- References
- 15
- Citations by year
- 2026: 22 · 2025: 41 · 2024: 29 · 2023: 21 · 2022: 1
- FWCI
- 7.57
- Type
- journal article
- Language
- en
- Open access
- closed
- Licence
- Locations
- IEEE Wireless Communications (publishedVersion)
- Funders
- NSFC (U20B2049,U21B2018)
- National Natural Science Foundation of China (61972296)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
- Physical Sciences › Computer Science › Computer Vision and Pattern Recognition › Digital Media Forensic Detection
- Keywords
- backdoor attacks, federated learning, backdoor defense, data poisoning, model poisoning, malicious participants, backdoor triggers, privacy-preserving machine learning, attack taxonomy
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
