REVIEW 20 cited by
Can You Really Backdoor Federated Learning?
Not yet reviewed by Pith; the record is open.
This paper has not been read by Pith yet. Machine review is queued; the pith claim, tier, and objections will appear here once it completes.
SPECIMEN: schema-true, not a live event
T0 review · schema-true
One-sentence machine reading of the paper's core claim.
pith:XXXXXXXX · record.json · timestamp
Can You Really Backdoor Federated Learning?
read the original abstract
The decentralized nature of federated learning makes detecting and defending against adversarial attacks a challenging task. This paper focuses on backdoor attacks in the federated learning setting, where the goal of the adversary is to reduce the performance of the model on targeted tasks while maintaining good performance on the main task. Unlike existing works, we allow non-malicious clients to have correctly labeled samples from the targeted tasks. We conduct a comprehensive study of backdoor attacks and defenses for the EMNIST dataset, a real-life, user-partitioned, and non-iid dataset. We observe that in the absence of defenses, the performance of the attack largely depends on the fraction of adversaries present and the "complexity'' of the targeted task. Moreover, we show that norm clipping and "weak'' differential privacy mitigate the attacks without hurting the overall performance. We have implemented the attacks and defenses in TensorFlow Federated (TFF), a TensorFlow framework for federated learning. In open-sourcing our code, our goal is to encourage researchers to contribute new attacks and defenses and evaluate them on standard federated datasets.
Forward citations
Cited by 20 Pith papers
-
Model Poisoning Against Federated Model Adaptation with Chain of Bit-Flips
A task-agnostic backdoor is implanted in federated model adaptation by crafting bit-flip chains offline on a pretrained model and applying up to 10 faults per malicious client to reach 94% attack success rate on ResNet-18.
-
RogueMerge: Robust and Unified Attacks against LLM Model Merging
RogueMerge is a unified attack method that jointly optimizes task vectors to succeed after merging, using stochastic min-max simulation for unknown merging settings and a Taylor-approximated DRO for prompt generalizat...
-
XFED: Non-Collusive Model Poisoning Attack Against Byzantine-Robust Federated Classifiers
XFED is the first aggregation-agnostic non-collusive model poisoning attack that bypasses eight state-of-the-art defenses on six benchmark datasets without attacker coordination.
-
Beyond Corner Patches: Semantics-Aware Backdoor Attack in Federated Learning
SABLE shows that semantics-aware natural triggers enable effective backdoor attacks in federated learning against multiple aggregation rules while preserving benign accuracy.
-
Hammer and Anvil: Toward a Theory of Backdoors in Federated Learning
Hammer and Anvil framework categorizes backdoors by update deviation δ and shows that principled combinations of Type-1 outlier/robust and Type-2 removal defenses resist full-information adaptive adversaries.
-
Coward: Collision-based OOD Watermarking for Practical Proactive Federated Backdoor Detection
Coward detects backdoors in federated learning by injecting a collision-suppressed watermark on OOD data to invert the detection paradigm and limit OOD bias effects.
-
Aggressive or Imperceptible, or Both: Network Pruning Assisted Hybrid Byzantines in Federated Learning
A hybrid sparse Byzantine attack using network pruning insights and slow accumulation bypasses eight state-of-the-art defenses in federated learning simulations.
-
FedCVESA: Taking Away Training Data in Federated Learning via Correlation Value Encoding and Segmented Aggregation
A malicious FL server can steal private training images by encoding them into model parameters via a correlation regularizer and preserving them through segmented aggregation.
-
The Power of Backdoor Absorption in Community Training
A DTMC of injection versus absorption shows that natural decay plus 10% lazy verification and weight penalties forces any bounded adversary's success probability to zero with no utility loss.
-
Automated Byzantine-Resilient Clustered Decentralized Federated Learning for Battery Intelligence in Connected EVs
ABC-DFL replaces central FL servers with a permissioned blockchain and introduces FLECA for filtering malicious updates via adaptive thresholds and oracle-based clustering to achieve Byzantine-resilient decentralized ...
-
Automated Byzantine-Resilient Clustered Decentralized Federated Learning for Battery Intelligence in Connected EVs
ABC-DFL is a new decentralized federated learning framework replacing central servers with blockchain and using FLECA clustering aggregation to achieve Byzantine resilience for EV battery tasks.
-
Poisoning with A Pill: Circumventing Detection in Federated Learning
A three-stage pill-based augmentation makes existing FL poisoning attacks evade popular defenses while raising error rates up to 7x on both IID and non-IID data.
-
Color Matters: Trigger Color Affects Success in Federated Backdoor Attacks
Trigger color significantly affects semantic backdoor attack success in federated learning on CelebA hair-color classification, with white triggers better for blond targets and black for black targets.
-
EnCAgg: Enhanced Clustering Aggregation for Robust Federated Learning against Dynamic Model Poisoning
EnCAgg filters malicious gradients in federated learning by projecting updates to two divergent dimensions for density clustering, generating boundary pseudo-gradients to link outliers, and re-clustering to recover be...
-
Automated Byzantine-Resilient Clustered Decentralized Federated Learning for Battery Intelligence in Connected EVs
ABC-DFL replaces central FL servers with a permissioned blockchain and introduces FLECA, a hierarchical filtering-and-clustering aggregation protocol that keeps convergence close to FedProx while limiting attack impac...
-
FedSurrogate: Backdoor Defense in Federated Learning via Layer Criticality and Surrogate Replacement
FedSurrogate defends federated learning against backdoors by clustering on security-critical layers and substituting malicious updates with benign surrogates, reporting false-positive rates below 10% and attack succes...
-
SecureAFL: Secure Asynchronous Federated Learning
SecureAFL secures asynchronous federated learning against poisoning attacks by detecting anomalous updates, estimating missing client contributions, and using Byzantine-robust aggregation.
-
BoBa: Boosting Backdoor Detection through Data Distribution Inference in Federated Learning
BoBa uses data distribution inference and overlapping clustering with voting to detect backdoor attacks in non-IID federated learning, claiming attack success rates below 0.001.
-
DeTrigger: A Gradient-Centric Approach to Backdoor Attack Mitigation in Federated Learning
DeTrigger detects and mitigates backdoor attacks in federated learning via gradient analysis and temperature scaling, claiming up to 251x faster detection and 98.9% attack reduction on four datasets with minimal accur...
-
From Data Heterogeneity to Convergence: A Data-Centric Review of Federated Learning
A data-centric survey of federated learning that ranks non-IID data traits by influence on convergence, links splitting protocols to real phenomena, and examines data-related defenses under clean and adversarial conditions.
discussion (0)
Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.