Un-Fair Trojan: Targeted Backdoor Attacks Against Model Fairness
Abstract
Machine learning models have proven to have the ability to make accurate predictions on complex data tasks such as image and graph data. However, they are vulnerable to various backdoor and data poisoning attacks which adversely affect model behavior. These attacks become more prevalent and complex in federated learning, where multiple local models contribute to a single global model communicating using only local gradients. Additionally, these models tend to make unfair predictions for certain protected features. Previously published works revolve around solving these issues both individually and jointly. However, there has been little study on how the adversary can launch an attack that can control model fairness. Demonstrated in this work, a flexible attack, which we call Un-Fair Trojan, that targets model fairness while remaining stealthy can have devastating effects against machine learning models, increasing their demographic parity by up to 30%, without causing a significant decrease in the model accuracy.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
The backdoor attack during the local data collection phase requires the attacker to control or have access to part of the local training data set.
“The backdoor attack during the local data collection phase requires the attacker to control or have access to part of the local training data set [239].”
From Data and model poisoning backdoor attacks on wireless federated learning, and the defense mechanisms: A comprehensive survey (2024) · cites this paper as [239]
Cites
Federated learning: Challenges, methods, and future directions
Li, T., Sahu, A. K., Talwalkar, A., & Smith, V. (2020) · IEEE Signal Processing Magazine · doi:10.1109/msp.2020.2975749 · Cited by 6,210 · see citing works
How to backdoor federated learning
Bagdasaryan, E., Veit, A., Hua, Y., Estrin, D., & Shmatikov, V. (2018) · arXiv · doi:10.48550/arxiv.1807.00459 · Cited by 1,495 · see citing works
BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chain
Gu, T., Dolan-Gavitt, B., & Garg, S. (2017) · arXiv · doi:10.48550/arxiv.1708.06733 · Cited by 1,061 · see citing works
Federated Learning of Deep Networks using Model AveragingPreprint
McMahan, H. B., Moore, E., Ramage, D., & y Arcas, B. A. (2016) · arXiv (Cornell University) · Cited by 923 · see citing works
Do ImageNet Classifiers Generalize to ImageNet?
Recht, B., Roelofs, R., Schmidt, L., & Shankar, V. (2019) · arXiv · doi:10.48550/arxiv.1902.10811 · Cited by 790 · see citing works
Think Locally, Act Globally: Federated Learning with Local and Global RepresentationsPreprint
Liang, P. P., Liu, T., Ziyin, L., Allen, N. B., Auerbach, R. P., Brent, D., Salakhutdinov, R., & Morency, L. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2001.01523 · Cited by 375 · see citing works
Can You Really Backdoor Federated Learning?
Sun, Z., Kairouz, P., Suresh, A. T., & McMahan, H. B. (2019) · arXiv · doi:10.48550/arxiv.1911.07963 · Cited by 348 · see citing works
Investigating Bias and Fairness in Facial Expression Recognition
Tian, X., White, J. C., Kalkan, S., & Güneş, H. (2020) · Lecture notes in computer science · doi:10.1007/978-3-030-65414-6_35 · Cited by 174 · see citing works
LoMar: A Local Defense Against Poisoning Attack on Federated Learning
Li, X., Qu, Z., Zhao, S., Tang, B., Lu, Z., & Liu, Y. (2021) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2021.3135422 · Cited by 152 · see citing works
Mitigating Bias in Federated LearningPreprint
Abay, A., Zhou, Y., Baracaldo, N., Rajamoni, S., Chuba, E., & Ludwig, H. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2012.02447 · Cited by 45 · see citing works
Enforcing fairness in private federated learning via the modified method of differential multipliersPreprint
Rodríguez-Gálvez, B., Granqvist, F., van Dalen, R., & Seigel, M. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2109.08604 · Cited by 36 · see citing works
Poisoning Attacks on Fair Machine Learning
Van, M.-H., Du, W., Wu, X., & Lu, A. (2022) · Lecture notes in computer science · doi:10.1007/978-3-031-00123-9_30 · Cited by 21 · see citing works
Exploiting Fairness to Enhance Sensitive Attributes Reconstruction
Ferry, J., Aïvodji, U., Gambs, S., Huguet, M., & Siala, M. (2023) · IEEE Conference on Secure and Trustworthy Machine Learning (SaTML) · doi:10.1109/satml54575.2023.00012 · Cited by 11 · see citing works
Modeling Techniques for Machine Learning Fairness: A SurveyPreprint
Wan, M., Zha, D., Liu, N., & Zou, N. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2111.03015 · Cited by 10 · see citing works
Fair Classification with Noisy Protected AttributesPreprint
Celis, L. E., Huang, L., & Vishnoi, N. K. (2020) · arXiv (Cornell University) · Cited by 3 · see citing works
Chzhen, E., & Schreuder, N. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2011.07158 · Cited by 2 · see citing works
Flagged first, then by citations
Cited by
Sorted by citations
Wan, Y., Qu, Y., Ni, W., Xiang, Y., Gao, L., & Hossain, E. (2024) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2024.3361451 · Cited by 152 · see citing works
“Restrictions apply. have access to part of the local training data set [239].”
BackgroundLinkage on security, privacy and fairness in federated learning: New balances and new perspectives
Wang, L., Zhu, T., Zhou, W., & Yu, P. S. (2025) · Neural Networks · doi:10.1016/j.neunet.2025.107874 · Cited by 8 · see citing works
Injecting Bias into Text Classification Models Using Backdoor Attacks
Yavuz, A., & Gürsoy, M. E. (2025) · Lecture notes in computer science · doi:10.1007/978-3-031-89350-6_13 · Cited by 3 · see citing works
TrojFair: Trojan Fairness Attacks
Xue, J., Zheng, M., Sheng, Y., Yang, L., Lou, Q., & Jiang, L. (2023) · doi:10.1145/3689217.3690620 · Cited by 3 · see citing works
Backdoor Attacks and Generative Model Fairness: Current Trends and Future Research Directions
Holland, R., Pal, S., Pan, L., & Zhang, L. Y. (2024) · International Conference on Communication Systems & Networks (COMSNETS) · doi:10.1109/comsnets59351.2024.10427172 · Cited by 1 · see citing works
MCL++ : Strengthening Defenses Against Backdoor Poisoning Attacks
Shymala Gowri, S., & Sadasivam, G. S. (2025) · Cybernetics & Systems · doi:10.1080/01969722.2025.2483718
FABLE: Fairness Attack in Abusive Language Detection
Liang, Y., Cheng, L., Payani, A., & Shu, K. (2025) · IEEE International Conference on Big Data (BigData) · doi:10.1109/bigdata66926.2025.11401648
- Authors
- Furth, N., Khreishah, A., Liu, G., Phan, N., & Jararweh, Y.
- Affiliations
- University of Tennessee at Knoxville (US)
- New Jersey Institute of Technology (US)
- Jordan University of Science and Technology (JO)
- Venue
- 2022 Ninth International Conference on Software Defined Systems (SDS)
- Publisher
- IEEE
- Published
- 2022-12-12
- Pages
- 1-9
- OpenAlex
- W4327781379
- Cited by
- 7
- References
- 16
- Citations by year
- 2025: 4 · 2024: 2 · 2023: 1
- FWCI
- 0.97
- Type
- conference paper
- Language
- en
- Open access
- closed
- Locations
- International Conference on Software Defined Systems (SDS) (publishedVersion)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
- Social Sciences › Safety Research › Ethics and Social Impacts of AI
- Keywords
- backdoor attacks, model fairness, federated learning, data poisoning, demographic parity, stealthy attacks, adversarial learning
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
