Federated learning faces risks from smarter hidden backdoor attacks
Fine-grained Distributed Backdoor Attacks in Federated Learning
Machine Learning
Summary
Federated learning lets many devices train AI models without sharing personal data, but it can be tricked by secret backdoor attacks. The authors show that current attacks need many poisoned samples and are easier to catch because of fixed patterns. They propose a new way to make these attacks sneakier by changing the secret triggers dynamically and embedding poisoned data more cleverly. Their method works better with fewer poisoned examples and resists common defenses, highlighting challenges in keeping federated learning safe.
Federated learningBackdoor attacksPoisoned samplesTrigger patternsDynamic trigger generationFeature spaceContrastive learningNon-IID dataModel poisoningDefense mechanisms
Authors
Jian Wang, Hong Shen, Wei Ke, Xue Hua Liu
Abstract
Federated learning, as a privacy-preserving distributed machine learning paradigm, faces significant threats from backdoor attacks. Compared to centralized attacks, distributed backdoor attacks are more harmful but require more poisoned samples to compensate for the loss of trigger strength due to decomposition. Fixed trigger patterns are also easily detected by robust aggregation algorithms, increasing the risk of attack exposure. To address these challenges, we propose a fine-grained distributed backdoor attack framework (FDBA). This framework uses dynamic trigger generation and embedding vector optimization to perform attacks with fewer poisoned samples. First, we design a dynamic trigger generation method based on image edge structures using the Canny algorithm to extract edge features, which are then injected with Laplacian noise. RGB channel decomposition is applied for covert adaptation of the distributed trigger, reducing detection chances. Second, we introduce an embedding vector contrastive learning strategy that forces poisoned samples to approach the target class center in the feature space, enhancing attack effectiveness. On CIFAR-10, piecewise-linear estimates for target ASRs between 70\% and 90\% show that FDBA reduces the required poisoning ratio by 37.4\%--48.4\% compared with DBA. In non-independent and identically distributed (Non-IID) scenarios, FDBA retains 84.7\% of its IID attack performance under extreme heterogeneity, whereas DBA drops to 73.5\%, and the framework successfully bypasses mainstream defense mechanisms. This study offers new insights into federated learning security and emphasizes the potential threats and defense challenges posed by fine-grained distributed attacks.