BapFL: You can Backdoor Personalized Federated Learning
Open accessAbstract
In federated learning (FL), malicious clients could manipulate the predictions of the trained model through backdoor attacks, posing a significant threat to the security of FL systems. Existing research primarily focuses on backdoor attacks and defenses within the generic federated learning scenario, where all clients collaborate to train a single global model. A recent study conducted by Qin et al. [ 24 ] marks the initial exploration of backdoor attacks within the personalized federated learning (pFL) scenario, where each client constructs a personalized model based on its local data. Notably, the study demonstrates that pFL methods with parameter decoupling can significantly enhance robustness against backdoor attacks. However, in this article, we whistleblow that pFL methods with parameter decoupling are still vulnerable to backdoor attacks. The resistance of pFL methods with parameter decoupling is attributed to the heterogeneous classifiers between malicious clients and benign counterparts. We analyze two direct causes of the heterogeneous classifiers: (1) data heterogeneity inherently exists among clients and (2) poisoning by malicious clients further exacerbates the data heterogeneity. To address these issues, we propose a two-pronged attack method, BapFL, which comprises two simple yet effective strategies: (1) poisoning only the feature encoder while keeping the classifier fixed and (2) diversifying the classifier through noise introduction to simulate that of the benign clients. Extensive experiments on three benchmark datasets under varying conditions demonstrate the effectiveness of our proposed attack. Additionally, we evaluate the effectiveness of six widely used defense methods and find that BapFL still poses a significant threat even in the presence of the best defense, Multi-Krum. We hope to inspire further research on attack and defense strategies in pFL scenarios. The code is available at: https://github.com/BapFL/code
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Adversarial attacks can seriously compromise model integrity in sensitive models such as healthcare models.
“Ref. [60] analyzes how such attacks can seriously compromise model integrity in sensitive models like healthcare.”
From Federated Learning in Smart Healthcare: A Comprehensive Review on Privacy, Security, and Predictive Analytics with IoT Integration (2024) · cites this paper as [60]
Section 2.2 says backdoor attacks can compromise the security and trustworthiness of deep-learning models, and the Conclusion reports that BapFL remains a significant threat to personalized federated learning. The paper's experiments use MNIST, Fashion-MNIST, and CIFAR-10 (Section 4.1.1); our copy does not establish the claim specifically for healthcare models. Page numbers are unavailable in our copy. (LLM, conf=0.86)
Experimental — accuracy not yet measuredHarmful agents can introduce biased updates that influence model behavior in federated learning.
“Harmful agents can introduce biased updates, influencing model behavior.”
From Federated Learning in Smart Healthcare: A Comprehensive Review on Privacy, Security, and Predictive Analytics with IoT Integration (2024) · cites this paper as [60]
Despite its privacy advantages, federated learning is susceptible to security risks including adversarial attacks and data poisoning.
“Despite FL’s privacy advantages, it is susceptible to security risks, including adversarial attacks and data poisoning.”
From Federated Learning in Smart Healthcare: A Comprehensive Review on Privacy, Security, and Predictive Analytics with IoT Integration (2024) · cites this paper as [60]
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Cites
Very Deep Convolutional Networks for Large-Scale Image Recognition
Simonyan, K., & Zisserman, A. (2014) · arXiv · doi:10.48550/arxiv.1409.1556 · Cited by 74,248 · see citing works
Gradient-based learning applied to document recognition
Lecun, Y., Bottou, L., Bengio, Y., & Haffner, P. (1998) · Proceedings of the IEEE · doi:10.1109/5.726791 · Cited by 58,805 · see citing works
Advances and Open Problems in Federated Learning
Kairouz, P., & McMahan, H. B. (2021) · Foundations and Trends in Machine Learning · doi:10.1561/2200000083 · Cited by 7,772 · see citing works
Fashion-MNIST: a Novel Image Dataset for Benchmarking Machine Learning Algorithms
Xiao, H., Rasul, K., & Vollgraf, R. (2017) · arXiv · doi:10.48550/arxiv.1708.07747 · Cited by 6,108 · see citing works
Federated Optimization in Heterogeneous Networks
Li, T., Sahu, A. K., Zaheer, M., Sanjabi, M., Talwalkar, A., & Smith, V. (2018) · arXiv · doi:10.48550/arxiv.1812.06127 · Cited by 4,023 · see citing works
Artificial intelligence and statistics
Yu, B., & Kumbier, K. (2018) · Frontiers of Information Technology & Electronic Engineering · doi:10.1631/fitee.1700813 · Cited by 2,329 · see citing works
(2017) · neural information processing systems · Cited by 1,413 · see citing works
Towards Personalized Federated Learning
Tan, A. Z., Yu, H., Cui, L., & Yang, Q. (2022) · IEEE Transactions on Neural Networks and Learning Systems · doi:10.1109/tnnls.2022.3160699 · Cited by 1,366 · see citing works
Sattler, F., Muller, K.-R., & Samek, W. (2021) · IEEE Transactions on Neural Networks and Learning Systems · doi:10.1109/tnnls.2020.3015958 · Cited by 1,355 · see citing works
BadNets: Evaluating Backdooring Attacks on Deep Neural Networks
Gu, T., Liu, K., Dolan-Gavitt, B., & Garg, S. (2019) · IEEE Access · doi:10.1109/access.2019.2909068 · Cited by 1,238 · see citing works
An Efficient Framework for Clustered Federated Learning
Ghosh, A., Chung, J., Yin, D., & Ramchandran, K. (2022) · IEEE Transactions on Information Theory · doi:10.1109/tit.2022.3192506 · Cited by 873 · see citing works
FedBN: Federated Learning on Non-IID Features via Local Batch NormalizationPreprint
Li, X., Jiang, M., Zhang, X., Kamp, M., & Dou, Q. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2102.07623 · Cited by 700 · see citing works
Self-citationLi, Y., Jiang, Y., Li, Z., & Xia, S.-T. (2024) · IEEE Transactions on Neural Networks and Learning Systems · doi:10.1109/tnnls.2022.3182979 · Cited by 682 · see citing works
Personalized Federated Learning with Moreau EnvelopesPreprint
Dinh, C. T., Tran, N. H. K., & Nguyen, T. D. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2006.08848 · Cited by 644 · see citing works
Federated Learning with Personalization LayersPreprint
Arivazhagan, M. G., Aggarwal, V., Singh, A. K., & Choudhary, S. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1912.00818 · Cited by 595 · see citing works
Attack of the tails: Yes, you really can backdoor federated learning
Wang, H., Sreenivasan, K., Rajput, S., Vishwakarma, H., Agarwal, S., Sohn, J.-Y., Lee, K., & Papailiopoulos, D. (2020) · arXiv · doi:10.48550/arxiv.2007.05084 · Cited by 406 · see citing works
Can You Really Backdoor Federated Learning?
Sun, Z., Kairouz, P., Suresh, A. T., & McMahan, H. B. (2019) · arXiv · doi:10.48550/arxiv.1911.07963 · Cited by 348 · see citing works
Three Approaches for Personalization with Applications to Federated LearningPreprint
Mansour, Y., Mohri, M., Ro, J. H., & Suresh, A. T. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2002.10619 · Cited by 337 · see citing works
Threats to federated learning A survey
Lyu, L., Yu, H., & Yang, Q. (2020) · arXiv · doi:10.48550/arxiv.2003.02133 · Cited by 221 · see citing works
(2024) · TIB Data Manager · doi:10.57702/h8wosv5j · Cited by 202 · see citing works
On Bridging Generic and Personalized Federated Learning for Image ClassificationPreprint
Chen, H.-Y., & Chao, W. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2107.00778 · Cited by 172 · see citing works
Revisiting Personalized Federated Learning: Robustness Against Backdoor Attacks
Qin, Z., Yao, L., Chen, D., Li, Y., Ding, B., & Cheng, M. (2023) · ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD) · doi:10.1145/3580305.3599898 · Cited by 33 · see citing works
FLIP: A Provable Defense Framework for Backdoor Mitigation in Federated LearningPreprint
Zhang, K., Tao, G., Xu, Q., Cheng, S., An, S., Liu, Y., Feng, S., Shen, G., Chen, P., Ma, S., et al. (2022) · arXiv (Cornell University) · doi:10.48550/arxiv.2210.12873 · Cited by 27 · see citing works
Backdoor Federated Learning by Poisoning Backdoor-Critical LayersPreprint
Zhuang, H., Yu, M., Wang, H., Hua, Y., Li, J., & Yuan, X. (2023) · arXiv (Cornell University) · doi:10.48550/arxiv.2308.04466 · Cited by 11 · see citing works
Learning to Generalize in Heterogeneous Federated Networks
Chen, C., Ye, T., Wang, L., & Gao, M. Z. (2022) · ACM International Conference on Information and Knowledge Management (CIKM) · doi:10.1145/3511808.3557378 · Cited by 9 · see citing works
Self-citationRevisiting Personalized Federated Learning: Robustness Against Backdoor AttacksPreprint
Qin, Z., Yao, L., Chen, D., et al. (2023) · arXiv (Cornell University) · doi:10.48550/arxiv.2302.01677 · Cited by 1 · see citing works
Flagged first, then by citations
Research works printed but not linked: 11
- [2]2. Eugene Bagdasaryan, Andreas Veit, Yiqing Hua, Deborah Estrin, and Vitaly Shmatikov. 2020. How to backdoor federated learning. In International Conference on Artificial Intelligence and Statistics. PMLR, 2938-2948.
- [5]5. C-L Chen, Leana Golubchik, and Marco Paolieri. 2020. Backdoor Attacks on Federated Meta-Learning. In 34th Conference on Neural Information Processing Systems.
- [7]7. Liam Collins, Hamed Hassani, Aryan Mokhtari, and Sanjay Shakkottai. 2021. Exploiting shared representations for personalized federated learning. In International Conference on Machine Learning. PMLR, 2089-2099.
- [10]10. Sergey Ioffe and Christian Szegedy. 2015. Batch normalization: Accelerating deep network training by reducing internal covariate shift. In International conference on machine learning. pmlr, 448-456.
- [12]12. Sai Praneeth Karimireddy, Satyen Kale, Mehryar Mohri, Sashank Reddi, Sebastian Stich, and Ananda Theertha Suresh. 2020. Scaffold: Stochastic controlled averaging for federated learning. In International Conference on Machine Learning. PMLR, 5132-5143.
- [15]15. Tian Li, Shengyuan Hu, Ahmad Beirami, and Virginia Smith. 2021. Ditto: Fair and robust federated learning through personalization. In International Conference on Machine Learning. PMLR, 6357-6368.
- [22]22. Jaehoon Oh, SangMook Kim, and Se-Young Yun. 2021. FedBABU: Toward Enhanced Representation for Federated Image Classification. In International Conference on Learning Representations.
- [31]31. Chulin Xie, Keli Huang, Pin-Yu Chen, and Bo Li. 2020. Dba: Distributed backdoor attacks against federated learning. In International conference on learning representations.
- [32]32. Tiandi Ye, Senhui Wei, Jamie Cui, Cen Chen, Yingnan Fu, and Ming Gao. 2023. Robust Clustered Federated Learning. In International Conference on Database Systems for Advanced Applications. Springer, 677-692.
- [33]33. Dong Yin, Yudong Chen, Ramchandran Kannan, and Peter Bartlett. 2018. Byzantine-robust distributed learning: Towards optimal statistical rates. In International Conference on Machine Learning. PMLR, 5650-5659.
- [35]35. Zhengming Zhang, Ashwinee Panda, Linyue Song, Yaoqing Yang, Michael Mahoney, Prateek Mittal, Ramchandran Kannan, and Joseph Gonzalez. 2022. Neurotoxin: Durable backdoors in federated learning. In International Conference on Machine Learning. PMLR, 26429-26446.
Cited by
Sorted by citations
Abbas, S. R., Abbas, Z., Zahir, A., & Lee, S. W. (2024) · Healthcare · doi:10.3390/healthcare12242587 · Cited by 228 · see citing works
Byzantine-Robust and Communication-Efficient Personalized Federated Learning
Zhang, J., He, X., Huang, Y., & Ling, Q. H. (2024) · IEEE Transactions on Signal Processing · doi:10.1109/tsp.2024.3514802 · Cited by 8 · see citing works
Adaptive Layered-Trust Robust Defense Mechanism for Personalized Federated Learning
Wang, H., Xu, Z., Zhang, Y., & Wang, Y. (2025) · IEEE International Conference on Acoustics Speech and Signal Processing · doi:10.1109/icassp49660.2025.10887951 · Cited by 5 · see citing works
Self-citationDang, Q.-V., Vo, T.-B.-D., & Nguyen, N.-S.-A. (2026) · Array · doi:10.1016/j.array.2026.100680 · Cited by 2 · see citing works
FUBA: Backdoor Federated Learning via Federated Unlearning
Sheng, X., Bao, W., Guo, Y., & Fu, S. (2025) · IEEE Transactions on Artificial Intelligence · doi:10.1109/tai.2025.3630110 · Cited by 1 · see citing works
FLSAMW: Mitigating backdoor attacks in federated learning based on SVD and amplified model weight
Xiong, X., Chen, J., Tan, Z., Xiao, X., Tao, X., & Liu, M. (2026) · Journal of Systems Architecture · doi:10.1016/j.sysarc.2026.103789 · Cited by 1 · see citing works
Mind the Cost of Scaffold! Benign Clients May Even Become Accomplices of Backdoor Attack
Han, X., Zhang, X., Lan, X., Wang, H., Xu, S., Ren, S., Zeng, J., Wu, M., Heinrich, M., & Zhang, T. (2025) · IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv51701.2025.00155 · Cited by 1 · see citing works
Introduction for the Special Issue on Trustworthy Artificial Intelligence
Fan, W., Zhao, S. G., & Tang, J. (2025) · ACM Transactions on Knowledge Discovery from Data · doi:10.1145/3712184 · Cited by 1 · see citing works
Practical and General Backdoor Attacks Against Personalized Federated Learning
Xuan, Y., Chen, X., Zhao, Z., Dong, Y., Zhao, W. X., & Tang, B. (2025) · Communications in computer and information science · doi:10.1007/978-981-95-4100-3_32
Zhang, Z., Guo, Y., & Gong, Y. (2025) · International Conference on Communications · doi:10.1109/icc52391.2025.11161540
Turning Data Heterogeneity into a Backdoor Shield for Personalized Federated Learning
Cui, Q., Wang, X., Chen, X., Wang, Q., & Fu, Z. (2026) · IEEE International Conference on Acoustics Speech and Signal Processing · doi:10.1109/icassp55912.2026.11462193
Wang, Y., & Li, H. (2026) · Journal of Information Security and Applications · doi:10.1016/j.jisa.2026.104537
Self-citationEarlyShield: Early-Stage Screening for Robust Personalized Federated Learning
Li, S., Lyu, X., (108353), N. W., Li, T., Chen, D., Hu, Y., & Chen, Y. (2026) · Lecture notes in computer science · doi:10.1007/978-981-92-1462-4_15
BadPromptFL: Parameters-Free Backdoor Attack on Vision-Language Federated Learning
Zhang, M., Zhao, M., Wang, W., Zheng, T., & Wang, B. (2026) · IEEE Transactions on Circuits and Systems for Video Technology · doi:10.1109/tcsvt.2026.3704659
Djemaa, A., Djenouri, D., & Legg, P. (2026) · Electronics · doi:10.3390/electronics15132876
RBA: Representation Backdoor Attack on Personalized Federated Learning
Zhou, H., Zhang, D., Su, Z., Zeng, H., Lou, J., Bao, W., Wu, C., & Li, J. (2026) · International Joint Conference on Neural Networks (IJCNN) · doi:10.1109/ijcnn69854.2026.11729989
RoboPFL: Backdoor Attacks against Personalized Federated Learning
Tang, X., Li, S., Hong, X., Zhang, T., & Lin, Y. (2026) · International Conference on Artificial Intelligence Technologies and Applications (ICAITA) · doi:10.1109/icaita71179.2026.11737051
- Authors
- Ye, T., Chen, C., Wang, Y., Li, X., & Gao, M.
- Affiliations
- East China Normal University (CN)
- Ant Group (China) (CN)
- Venue
- ACM Transactions on Knowledge Discovery from Data
- Published
- 2024-06-19
- Volume
- 18
- Issue
- 7
- Pages
- 1-17
- ISSN
- 1556-4681 (ISSN-L)
- 1556-472X
- OpenAlex
- W4392121135
- Cited by
- 17
- References
- 25
- Citations by year
- 2026: 9 · 2025: 6 · 2024: 2
- FWCI
- 2.52
- Type
- journal article
- Language
- en
- Open access
- bronze
- doi.org
- Locations
- ACM Transactions on Knowledge Discovery from Data (publishedVersion)
- arXiv (Cornell University) (submittedVersion)
- arXiv (Cornell University)
- Funders
- National Natural Science Foundation of China (62202170, 62377012)
- Open Research Fund of KLATASDS-MOE
- ECNU
- CCF-AFSG Research Fund
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Artificial Intelligence › Security and Verification in Computing
- Keywords
- backdoor attacks, personalized federated learning, parameter decoupling, data heterogeneity, classifier diversity, malicious clients, federated learning security
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
