Federated prompt tuning vulnerable to backdoor attacks via frozen backbone space
ShadowFPT: Backdooring Federated Prompt Tuning via Shadow Triggers
Artificial Intelligence
Summary
Federated Prompt Tuning is a method that updates small parts of a big AI model across many users without changing the main model. The authors found that a sneaky user can secretly trick the whole system by changing how the model sees certain inputs, even though they only share small updates. They created ShadowFPT, an attack that hides malicious behavior by training a special pattern locally that causes the model to misclassify certain inputs. This shows existing defenses that only watch for unusual updates might miss these hidden attacks.
What this means in practice
- •For federated learning engineers: Detect and mitigate backdoor risks in federated prompt tuning systems using frozen large models sharing only prompt updates.
- •For security analysts for ai platforms: Assess security gaps in shared frozen backbones for vision-language models under federated training against stealthy backdoor triggers.
Authors
Kun Zhai, Teng Li, Yunhao Feng, Xingjun Ma
Abstract
Federated Prompt Tuning (FPT) adapts large vision--language models by freezing the pretrained backbone and optimizing only lightweight prompt parameters across clients. Although this design improves communication and parameter efficiency, it creates an overlooked security risk. Since the backbone is shared and frozen, a malicious client can induce backdoor behavior through the representation space while keeping its uploaded prompt updates close to benign ones. We propose \textbf{ShadowFPT}, a targeted backdoor attack that exploits this frozen-backbone attack surface. ShadowFPT first pretrains a learnable \emph{Shadow Trigger} against the frozen CLIP visual encoder, using either auxiliary public data or the malicious client's local data, so that triggered inputs are steered toward the target class in representation space. During federated prompt tuning, the malicious client adapts the trigger under the current global prompt and then optimizes its local prompt on both clean and triggered samples. Only prompt parameters are uploaded to the server, while the trigger and frozen encoders remain local. By shifting most of the attack burden from prompt updates to trigger-induced representation steering, ShadowFPT achieves targeted misclassification while preserving prompt-space stealthiness. Across multiple datasets, aggregation rules, and non-IID federated partitions, ShadowFPT increases the attack success rate from 19.81\% to 90.36\% in our main setting, while maintaining clean accuracy. It remains effective across textual, visual, and joint vision--language prompt tuning. These results identify frozen backbones as stealthy and underexplored backdoor surfaces in federated prompt tuning, suggesting that defenses based only on prompt-update anomaly detection are insufficient.