Distributed backdoor attacks weaken federated learning defenses
Fine-grained Distributed Backdoor Attacks in Federated Learning
Machine Learning
Summary
Federated learning allows many devices to train a shared AI without sharing their data, but this system can be tricked by attackers who insert hidden 'backdoors' that make the AI behave badly. The paper presents a new attack method that uses dynamic, hard-to-detect triggers based on image edges and noise, reducing the number of fake samples needed to succeed. This attack remains effective even when data across devices is very different and can bypass common defense techniques. The authors show their approach is more efficient and robust than previous ones.
What this means in practice
- •For security engineers: Assess vulnerabilities in federated learning systems against sophisticated distributed backdoor attacks and improve defense designs accordingly.
- •For machine learning platform teams: Develop and test robust federated learning services by evaluating threats that use subtle dynamic triggers and embedding vector strategies to poison models.
Authors
Jian Wang, Hong Shen, Wei Ke, Xue Hua Liu
Abstract
Federated learning, as a privacy-preserving distributed machine learning paradigm, faces significant threats from backdoor attacks. Compared to centralized attacks, distributed backdoor attacks are more harmful but require more poisoned samples to compensate for the loss of trigger strength due to decomposition. Fixed trigger patterns are also easily detected by robust aggregation algorithms, increasing the risk of attack exposure. To address these challenges, we propose a fine-grained distributed backdoor attack framework (FDBA). This framework uses dynamic trigger generation and embedding vector optimization to perform attacks with fewer poisoned samples. First, we design a dynamic trigger generation method based on image edge structures using the Canny algorithm to extract edge features, which are then injected with Laplacian noise. RGB channel decomposition is applied for covert adaptation of the distributed trigger, reducing detection chances. Second, we introduce an embedding vector contrastive learning strategy that forces poisoned samples to approach the target class center in the feature space, enhancing attack effectiveness. On CIFAR-10, piecewise-linear estimates for target ASRs between 70\% and 90\% show that FDBA reduces the required poisoning ratio by 37.4\%--48.4\% compared with DBA. In non-independent and identically distributed (Non-IID) scenarios, FDBA retains 84.7\% of its IID attack performance under extreme heterogeneity, whereas DBA drops to 73.5\%, and the framework successfully bypasses mainstream defense mechanisms. This study offers new insights into federated learning security and emphasizes the potential threats and defense challenges posed by fine-grained distributed attacks.