Pith. sign in

REVIEW 4 major objections 5 minor 47 references

SPA: Towards More Stealth and Persistent Backdoor Attacks in Federated Learning

T0 review · 4 major / 5 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read SPA claims a federated-learning backdoor can be made stealthy and persistent by aligning trigger features to the target class's feature distribution rather than training an end-to-end trigger-to-label mapping.

desk verdict A genuinely new feature-space backdoor attack idea with solid ablations, but the headline persistence claim is under-supported because the persistence experiment uses three clients while the threat model promises one, and all results lack error bars. read the letter →

arxiv 2506.20931 v1 pith:5EQUQ2XT submitted 2025-06-26 cs.CR

Chengcheng Zhu , Ye Li , Bosen Rao , Jiale Zhang , Yunlong Mao , Sheng Zhong This is my paper
classification cs.CR
keywords federatedlearningbackdoorattackfeature-spacealignmenttriggeroptimizationsliced-Wassersteindistancepersistenceadversarialexamplesdefenses
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper proposes SPA, a backdoor attack on federated learning that replaces the usual end-to-end trigger-to-label training with feature-space alignment: the attacker's local model is trained to make the feature embeddings of trigger-stamped images nearly identical to the feature embeddings of target-class images. The claimed payoffs are that the backdoored model is statistically indistinguishable from a benign model, so six standard defenses fail to detect it, and that the backdoor persists for more than 900 rounds after the attacker stops participating, far beyond the 100-200 round lifetime of conventional attacks. The paper also adds an adversarial trigger-optimization stage that searches the global model's feature space for noise on the boundary of the target class, so the trigger itself behaves like a natural feature rather than an out-of-distribution pattern. If the claims hold, federated learning systems face a backdoor that is both hard to detect and hard to remove by continued benign training.

What carries the argument

The load-bearing mechanism is feature-space alignment: instead of associating trigger and label through cross-entropy, SPA minimizes the distance between the feature embeddings of trigger-embedded samples and target-class samples. The distance is measured with the sliced-Wasserstein distance $W_{\text{sliced}}(F_c,F_b)$, a projection-based distribution distance that the paper argues is more stable in high-dimensional, dynamically evolving feature spaces than $\ell^2$ or KL divergence. The second mechanism is adversarial trigger optimization: starting from random noise, the attacker uses the current global model to solve $\min_\delta L_{\text{enhance}} + L_{\text{consist}}$, where $L_{\text{enhance}}$ drives the trigger's output toward the target class and $L_{\text{consist}}$, a projection distance, constrains the trigger so that the augmented sample remains directionally close to its clean version, keeping it inside the target class's feature region. A teacher-student utility loss $L_{\text{utility}}$ anchors the backdoored model to the global model's clean feature behavior, and the authors call the resulting trigger a natural backdoor because it exploits the global model's existing feature-space structure rather than introducing a new outlier cluster.

What would settle it

After the attack window ends at round 2100, stop all malicious participation and every 100 rounds compute the sliced-Wasserstein distance between the trigger-embedded samples' feature embeddings and the target class's feature embeddings on the current global model. The persistence claim predicts this distance stays small while attack success stays above 90%; a growing distance with decaying attack success, or a growing distance with undiminished attack success, would falsify the natural-backdoor explanation.

Watch

Extended reading notes

Core claim

SPA's central claim is that a backdoor can be injected into a federated model without ever training the model to map trigger inputs to the target label. Instead, the malicious client minimizes a distance between the feature embeddings of trigger-embedded samples and target-class samples, using a sliced-Wasserstein distance $W_{\text{sliced}}(F_c, F_b)$ plus a utility-preserving distillation loss $L_{\text{utility}}$ that keeps the backdoored model's embeddings on clean samples close to the frozen global model's. A second stage optimizes the trigger itself by minimizing $L_{\text{enhance}}$, which pushes the trigger's prediction toward the target class, subject to a projection-distance consistency constraint $L_{\text{consist}}$ that keeps the perturbed sample directionally similar to its clean counterpart. The authors report that this two-stage procedure reaches over 99% attack success rate on CIFAR-10, CIFAR-100, and GTSRB while holding accuracy nearly unchanged, evades Multikrum, Deepsight, Foolsgold, Rflbat, Flame, and BackdoorIndicator, and keeps attack success above 90% for over 900 rounds after the attack window.

Load-bearing premise

The attack's reported 900-round persistence rests on the unproven assumption that the trigger optimized during the brief attack window keeps landing inside the target class's feature region as the global model continues being updated by benign clients; the paper offers empirical curves but no formal or mechanistic analysis of how the decision boundary shifts.

Editorial extensions

If this is right

  • If SPA works as reported, defenses that treat poisoned updates or backdoor features as outliers will miss it, because the malicious client's update and the trigger's feature cluster are shaped like the target class rather than like an anomaly.
  • The attack surface widens: a single randomly selected client, selected roughly ten times within a hundred-round window, can plant a backdoor, so defenses that assume sustained or multiple malicious participants are insufficient.
  • Because each trigger is embedded in its own target class's feature distribution, several attackers with different target labels can operate at once without degrading each other's success, enabling coordinated multi-label backdoors.
  • A backdoor that persists more than 900 rounds after the attacker stops means that simply removing the malicious client from future rounds, or continuing benign training, does not cleanse the model; post-hoc cleanup needs to actively unlearn trigger features.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The same alignment mechanism suggests a defense: a defender could adversarially search for small perturbations whose embeddings fall deep inside another class's feature cluster, and use the ease of finding such in-distribution impostors as a signal that the feature space is vulnerable to exactly this kind of backdoor.
  • A testable extension is to track the sliced-Wasserstein distance between the frozen trigger's feature distribution and the target class's feature distribution every 100 rounds after the attack window; the paper's natural-backdoor explanation predicts this distance stays small, and the attack-success decay curve should track it.
  • Because SPA only needs the global model's feature space, the method likely transfers to self-supervised or contrastive federated learning, where feature alignment is already the native objective, potentially making the attack even less distinguishable from benign client behavior; the paper does not test this setting.
  • The ablation results suggest that feature alignment and clean-task utility share capacity in this attack, so an extension worth testing is to restrict the attack to feature layers only, freezing earlier layers, which the paper does not explore but its machinery implies.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper introduces SPA, a backdoor attack for federated learning that replaces the usual end-to-end trigger-label supervision with feature-space alignment. In the injection phase, the malicious client trains a local model to minimize the sliced-Wasserstein distance between the feature embeddings of trigger-embedded samples and target-class samples, while a distillation term preserves utility on clean inputs. In the enhancement phase, the trigger itself is optimized adversarially against the current global model, with a projection-distance consistency loss replacing an Lp norm to keep the perturbation inside the target-class feature region. The evaluation compares SPA with Vanilla, PGD, Neurotoxin, Chameleon, and A3FL on CIFAR-10, CIFAR-100, and GTSRB, under six defenses, different non-IID splits, different model architectures, varying numbers of attackers, multi-label settings, and multiple attack timings. The headline findings are ASR above 98% in most configurations, minimal ACC loss, and persistence for hundreds of rounds after the attack window.

Significance. If the empirical results hold, SPA is a meaningful step in the study of FL backdoors: it gives a concrete mechanism by which a backdoor can hide in the feature distribution of the target class and survive aggregation, and it shows that the attack remains effective against several detection-based defenses. The paper is strong on breadth: it includes six defenses, three datasets, non-IID analysis, multiple architectures, multi-label attacks, and ablations of each loss term, with t-SNE and Grad-CAM visualizations. ASR is measured on held-out trigger-embedded test inputs, so the evaluation is not circular. The main limitations are statistical (single runs without error bars) and evidential (the persistence mechanism is asserted rather than measured), and the baseline persistence comparison does not match the paper's own single-client threat model.

major comments (4)
  1. [§3.2.1, §5.1, §5.3] The threat model in §3.2.1 restricts the adversary to a single compromised client participating for a limited number of rounds, but the persistence comparison against baseline attacks (Figure 5) is run with three malicious clients. Figure 8 does provide a single-client persistence curve for SPA alone, but it compares no baselines and no defenses; therefore the headline 'persistent backdoor effects far exceeding those of conventional techniques' is not demonstrated under the paper's own stated threat model. Please add a single-client persistence comparison with baselines, or explicitly present Figure 5 as a multi-client extension.
  2. [§5.1, Tables 1–5, Figures 4–8] All quantitative results are reported as single point estimates without error bars, confidence intervals, or multiple seeds. Since the central claims are 'consistently' high ASR and 'robustness', the stability of values such as ASR=99.91 (Table 1, CIFAR-10, no defense) and the persistence curves in Figures 4, 5, and 8 is unknown. Please report at least 3–5 independent runs with standard deviation for the main experiments.
  3. [§4.3, §5.1] Section 4.3 asserts that the optimized trigger is a 'natural backdoor' that is an 'inherent vulnerability in the global model', but no analysis or measurement is provided for why the trigger remains effective for 900+ rounds as the global model continues to update on benign data. To make the persistence claim credible, a mechanistic check is needed: for example, track the projection distance or sliced-Wasserstein distance between trigger-embedded and target-class features, and the decision boundary margin, at rounds 2100, 2400, 2700, and 3000. Without such evidence, the persistence observation is not explained.
  4. [§5, Tables 1–6] The evaluation timeline is ambiguous. The setup says the FL process runs for 2,100 communication rounds and the attack window is rounds 2000–2100, and the metrics are reported 'at the end of FL'. It should be stated explicitly whether Table 1 reports ASR immediately after the last attack round or after a post-attack interval; otherwise the reader cannot separate attack effectiveness from persistence.
minor comments (5)
  1. [Table 3] The per-attacker rows are misaligned; ACC values are missing for Attack 1 and some ASR values appear in ACC columns. Please reformat the table.
  2. [Algorithm 1 and §5] The setups do not report E_attack, the number of trigger-optimization steps I, the number of slices S in Eq. (7), or the blend strength for trigger-embedded samples; please add these values.
  3. [Appendix A] The text says six architectures but lists five (ResNet18, ResNet34, VGG11, VGG19, MobileNet-V2).
  4. [§5] The paper says the implementation is publicly accessible but gives no URL; a link would be helpful for reproducibility.
  5. [Eq. (7)] Equation (7) uses F^s_c(z) without defining z; please clarify the notation.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: SPA is evaluated on held-out test inputs against external defenses, and the attack losses are objectives rather than fitted substitutes for the evaluation metric.

full rationale

SPA is an empirical attack paper rather than a formal derivation, and the central claims are validated externally. ASR and ACC are measured on held-out CIFAR-10, CIFAR-100, and GTSRB test sets under a fixed federated learning protocol, while the trigger is optimized only on the malicious client's local data and the current global model (Algorithm 1). The evaluation metric ASR (Eq. 14) is not used as a training objective on the test set, so the high reported ASR is a generalization result rather than a quantity forced by construction. The four loss terms (Lalign, Lutility, Lenhance, Lconsist) are attack objectives; they are not fitted to the reported numbers, and the ablation results in Table 4 show that removing them degrades performance, which is inconsistent with a circular fit. The only self-citations (refs [2], [45], [46]) support standard FL/non-IID experimental setup, not the central stealth or persistence claim, and no uniqueness theorem or ansatz is imported from the authors' prior work. The paper's limitation that the headline persistence experiment (Fig. 5) uses three malicious clients while Sec. 3.2.1 states a single-client threat model, and the absence of a formal mechanism for 900-round trigger retention, are correctness and evidence concerns rather than circularity.

Assumptions & free parameters 5 free parameters · 4 assumptions · 0 invented entities

The method introduces no new physical or conceptual entities beyond the attack framework itself. The free parameters are mostly unspecified implementation details (S, I, E_attack, λ) that a user must set, making exact replication harder. The axioms are standard machine learning assumptions plus the key FL-specific transfer assumption.

free parameters (5)
  • lambda (utility loss weight) = not specified in text; sensitivity tested at 0, 0.3, 0.6, 1, 6, 10
    Balances feature alignment and utility preservation in Eq. 9. The default value is not stated, so a practitioner must choose it, and the reported ASR/ACC depend on it.
  • S (number of slices in sliced-Wasserstein distance) = not specified
    The number of random projections in Eq. 7 is not given; larger S gives a better distance approximation but increases computation. The paper does not state the value used in experiments.
  • I (trigger optimization steps) = not specified
    The number of gradient steps for trigger enhancement in Algorithm 1 is not stated; this controls how adversarial the trigger becomes.
  • E_attack (local attack epochs) = not specified
    The number of local epochs in the backdoor injection phase is not stated in the main text or algorithm.
  • trigger blend strength = 0.33 (for blend triggers in Appendix C)
    The blending ratio for optimized blend triggers is chosen by the authors; different values would change trigger perceptibility and effectiveness.
assumptions (4)
  • standard math Sliced-Wasserstein distance is a differentiable and optimizable proxy for feature distribution distance.
    Used in Eq. 7 and optimized via gradient descent in Algorithm 1. This is a standard result, but the paper does not validate that minimizing SW distance on features indeed aligns the desired decision boundary.
  • domain assumption The attacker has access to target-class samples in its local dataset.
    L_align in Eq. 6 requires a set D_t of target class samples. In real FL, a malicious client may have no data from the chosen target class. The paper acknowledges this is challenging under non-IID but does not provide a method for when D_t is empty.
  • domain assumption The adversary knows the current global model parameters at each selected round.
    The trigger enhancement in Eq. 10 and the feature consistency in Eq. 12 use the global model. This is standard in FL threat models where clients receive the global model, and the paper states this capability in Section 3.2.1.
  • domain assumption Feature alignment learned on the attacker's local dataset transfers to the global model after aggregation.
    The entire attack trains the malicious local model to align trigger features with target features, and expects this alignment to survive FedAvg aggregation with many benign updates. This transfer is assumed and only tested empirically, with no formal guarantee.

how reviews work

0 comments
Cite this review

Pith. "Pith review of SPA: Towards More Stealth and Persistent Backdoor Attacks in Federated Learning." pith.science (2026). https://pith.science/paper/5EQUQ2XT

@misc{pith2026250620931,
  author       = {Pith},
  title        = {Pith review of: SPA: Towards More Stealth and Persistent Backdoor Attacks in Federated Learning},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/5EQUQ2XT}},
  note         = {Machine review of arXiv:2506.20931}
}
read the original abstract

Federated Learning (FL) has emerged as a leading paradigm for privacy-preserving distributed machine learning, yet the distributed nature of FL introduces unique security challenges, notably the threat of backdoor attacks. Existing backdoor strategies predominantly rely on end-to-end label supervision, which, despite their efficacy, often results in detectable feature disentanglement and limited persistence. In this work, we propose a novel and stealthy backdoor attack framework, named SPA, which fundamentally departs from traditional approaches by leveraging feature-space alignment rather than direct trigger-label association. Specifically, SPA reduces representational distances between backdoor trigger features and target class features, enabling the global model to misclassify trigger-embedded inputs with high stealth and persistence. We further introduce an adaptive, adversarial trigger optimization mechanism, utilizing boundary-search in the feature space to enhance attack longevity and effectiveness, even against defensive FL scenarios and non-IID data distributions. Extensive experiments on various FL benchmarks demonstrate that SPA consistently achieves high attack success rates with minimal impact on model utility, maintains robustness under challenging participation and data heterogeneity conditions, and exhibits persistent backdoor effects far exceeding those of conventional techniques. Our results call urgent attention to the evolving sophistication of backdoor threats in FL and emphasize the pressing need for advanced, feature-level defense techniques.

Figures

Figures reproduced from arXiv: 2506.20931 by the authors.

Figure 1
Figure 1. Anomalies caused by backdoor attacks in federated learning. [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Workflow of SPA . the predictions of the global model towards the back￾door label as the backdoor trigger, making the backdoor more effective and durable. 4.2. Backdoor Injection In the FL setting, each selected participant in round t receives the global model wt distributed by the server. Following the intuition outlined in Section 4.1, we do not establish a direct connection between backdoor features and target la… view at source ↗
Figure 3
Figure 3. Confusion matrix of clean models and backdoor models. [PITH_FULL_IMAGE:figures/full_fig_p009_3.png] view at source ↗
Figures from the paper (11 more)
Figure 4
Figure 4. Figure 4: Persistence evaluations under no defenses. [PITH_FULL_IMAGE:figures/full_fig_p009_4.png]
Figure 5
Figure 5. Figure 5: Comparison of persistence performance under different defense methods. [PITH_FULL_IMAGE:figures/full_fig_p010_5.png]
Figure 6
Figure 6. Figure 6: Comparison of performance under a varying number of malicious clients on three datasets. [PITH_FULL_IMAGE:figures/full_fig_p010_6.png]
Figure 7
Figure 7. Figure 7: T-SNE visualization of features under multi-label scenarios. [PITH_FULL_IMAGE:figures/full_fig_p012_7.png]
Figure 8
Figure 8. Figure 8: Performance of SPA under different attack time intervals. window (rounds 2000-2010), and the attacker continuously attacking for 10 consecutive rounds at the end of the window (rounds 2090-2100). As illustrated in [PITH_FULL_IMAGE:figures/full_fig_p012_8.png]
Figure 11
Figure 11. Figure 11: T-SNE visualization of SPA using different trigger constraints. feature spaces characteristic of FL. In contrast, SPA leverages the Sliced Wasserstein Dis￾tance (SWD), which is specifically designed to address the challenges of high-dimensional distribution matching. …
Figure 10
Figure 10. Figure 10: Performance of SPA using different trigger constraints. taining model utility, these target class features become dis￾torted, making it difficult to establish the necessary feature connections for effective backdoor functionality. Moreover, while Lenhance significantl…
Figure 12
Figure 12. Figure 12: Impact of model types on three datasets. [PITH_FULL_IMAGE:figures/full_fig_p017_12.png]
Figure 13
Figure 13. Figure 13: T-SNE visualization of S (Blend) Ours (Blend) [PITH_FULL_IMAGE:figures/full_fig_p017_13.png]
Figure 14
Figure 14. Figure 14: Visualization of different triggers and poisoned samples. [PITH_FULL_IMAGE:figures/full_fig_p017_14.png]
Figure 15
Figure 15. Figure 15: Grad-CAM visualization of different poisoned samples. [PITH_FULL_IMAGE:figures/full_fig_p017_15.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

47 extracted references · 41 canonical work pages

  1. [1]

    Communication-Efficient Learning of Deep Networks from Decentralized Data,

    B. McMahan, E. Moore, D. Ramage, S. Hampson, and B. A. y Arcas, “Communication-Efficient Learning of Deep Networks from Decentralized Data,” inProceed- ings of the 20th International Conference on Artificial Intelligence and Statistics. PMLR, Apr. 2017, pp. 1273–1282

    work page 2017

  2. [2]

    Fairness- aware federated learning framework on heterogeneous data distributions,

    Y . Li, J. Zhang, Y . Zhao, B. Chen, and S. Yu, “Fairness- aware federated learning framework on heterogeneous data distributions,” inICC 2024-IEEE International Conference on Communications. IEEE, 2024, pp. 728–733

    work page 2024

  3. [3]

    Federated Learning for Mobile Keyboard Prediction,

    A. Hard, K. Rao, R. Mathews, S. Ramaswamy, F. Bea- ufays, S. Augenstein, H. Eichner, C. Kiddon, and D. Ramage, “Federated Learning for Mobile Keyboard Prediction,” Nov. 2018

    work page 2018

  4. [4]

    Private federated learning (neurips 2019 expo talk abstract),

    Apple, “Private federated learning (neurips 2019 expo talk abstract),” https://nips.cc/ExpoConferences/2019/ schedule?talkid=40, accessed: 2020-05-22

    work page 2019

  5. [5]

    Federated learning for open banking,

    G. Long, Y . Tan, J. Jiang, and C. Zhang, “Federated learning for open banking,” inFederated learning: privacy and incentive. Springer, 2020, pp. 240–254

    work page 2020

  6. [6]

    Multi-institutional Deep Learning Modeling Without Sharing Patient Data: A Feasibility Study on Brain Tumor Segmentation,

    M. J. Sheller, G. A. Reina, B. Edwards, J. Martin, and S. Bakas, “Multi-institutional Deep Learning Modeling Without Sharing Patient Data: A Feasibility Study on Brain Tumor Segmentation,” inBrainlesion: Glioma, Multiple Sclerosis, Stroke and Traumatic Brain In- juries. Cham: Springer International Publishing, 2019, pp. 92–104

    work page 2019

  7. [7]

    Vertical fed- erated learning: Concepts, advances, and challenges,

    Y . Liu, Y . Kang, T. Zou, Y . Pu, Y . He, X. Ye, Y . Ouyang, Y .-Q. Zhang, and Q. Yang, “Vertical fed- erated learning: Concepts, advances, and challenges,” IEEE Transactions on Knowledge & Data Engineering, vol. 36, no. 07, pp. 3615–3634, 2024

    work page 2024

  8. [8]

    Towards instance-adaptive inference for fed- erated learning,

    C.-M. Feng, K. Yu, N. Liu, X. Xu, S. Khan, and W. Zuo, “Towards instance-adaptive inference for fed- erated learning,” inProceedings of the IEEE/CVF In- ternational Conference on Computer Vision, 2023, pp. 23 287–23 296

    work page 2023

Show all 47 references
  1. [9]

    Label inference attacks against vertical federated learning,

    C. Fu, X. Zhang, S. Ji, J. Chen, J. Wu, S. Guo, J. Zhou, A. X. Liu, and T. Wang, “Label inference attacks against vertical federated learning,” in31st USENIX security symposium (USENIX Security 22), 2022, pp. 1397–1414

    2022

  2. [10]

    Shieldfl: Mitigating model poisoning attacks in privacy-preserving federated learning,

    Z. Ma, J. Ma, Y . Miao, Y . Li, and R. H. Deng, “Shieldfl: Mitigating model poisoning attacks in privacy-preserving federated learning,”IEEE Transac- tions on Information Forensics and Security, vol. 17, pp. 1639–1654, 2022

    2022

  3. [11]

    Local model poisoning attacks to{Byzantine-Robust}fed- erated learning,

    M. Fang, X. Cao, J. Jia, and N. Gong, “Local model poisoning attacks to{Byzantine-Robust}fed- erated learning,” in29th USENIX security symposium (USENIX Security 20), 2020, pp. 1605–1622

    2020

  4. [12]

    A3FL: adversarially adaptive backdoor attacks to federated learning,

    H. Zhang, J. Jia, J. Chen, L. Lin, and D. Wu, “A3FL: adversarially adaptive backdoor attacks to federated learning,” inProceedings of the 37th International Conference on Neural Information Processing Systems, 2023, pp. 61 213–61 233

    2023

  5. [13]

    How to backdoor federated learning,

    E. Bagdasaryan, A. Veit, Y . Hua, D. Estrin, and V . Shmatikov, “How to backdoor federated learning,” in International conference on artificial intelligence and statistics. PMLR, 2020, pp. 2938–2948

    2020

  6. [14]

    Neurotoxin: Durable backdoors in federated learning,

    Z. Zhang, A. Panda, L. Song, Y . Yang, M. Mahoney, P. Mittal, R. Kannan, and J. Gonzalez, “Neurotoxin: Durable backdoors in federated learning,” inInterna- tional Conference on Machine Learning. PMLR, 2022, pp. 26 429–26 446

    2022

  7. [15]

    Chameleon: Adapting to peer images for planting durable backdoors in federated learning,

    Y . Dai and S. Li, “Chameleon: Adapting to peer images for planting durable backdoors in federated learning,” inInternational Conference on Machine Learning. PMLR, 2023, pp. 6712–6725

    2023

  8. [16]

    Advdoor: adversarial backdoor attack of deep learning system,

    Q. Zhang, Y . Ding, Y . Tian, J. Guo, M. Yuan, and Y . Jiang, “Advdoor: adversarial backdoor attack of deep learning system,” inProceedings of the 30th ACM SIG- SOFT International Symposium on Software Testing and Analysis, 2021, pp. 127–138

    2021

  9. [17]

    Darkfed: A data-free backdoor attack in federated learning,

    M. Li, W. Wan, Y . Ning, S. Hu, L. Xue, L. Y . Zhang, and Y . Wang, “Darkfed: A data-free backdoor attack in federated learning,”arXiv preprint arXiv:2405.03299, 2024

    2024 arXiv

  10. [18]

    Anti-backdoor learning: Training clean models on poi- soned data,

    Y . Li, X. Lyu, N. Koren, L. Lyu, B. Li, and X. Ma, “Anti-backdoor learning: Training clean models on poi- soned data,”Advances in Neural Information Process- ing Systems, vol. 34, pp. 14 900–14 912, 2021

    2021

  11. [19]

    FLAME: taming backdoors in fed- erated learning,

    T. D. Nguyen, P. Rieger, H. Chen, H. Yalame, H. M¨ollering, H. Fereidooni, S. Marchal, M. Miettinen, A. Mirhoseini, S. Zeitouni, F. Koushanfar, A. Sadeghi, and T. Schneider, “FLAME: taming backdoors in fed- erated learning,” in31st USENIX Security Symposium, USENIX Security 20...

    2022

  12. [20]

    Supervised contrastive learning,

    P. Khosla, P. Teterwak, C. Wang, A. Sarna, Y . Tian, P. Isola, A. Maschinot, C. Liu, and D. Krishnan, “Supervised contrastive learning,”Advances in neural information processing systems, vol. 33, pp. 18 661– 18 673, 2020

    2020

  13. [21]

    BadNets: Evaluating Backdooring Attacks on Deep Neural Net- works,

    T. Gu, K. Liu, B. Dolan-Gavitt, and S. Garg, “BadNets: Evaluating Backdooring Attacks on Deep Neural Net- works,”IEEE Access, vol. 7, pp. 47 230–47 244, 2019

    2019

  14. [22]

    Targeted backdoor attacks on deep learning systems using data poisoning,

    X. Chen, C. Liu, B. Li, K. Lu, and D. Song, “Targeted backdoor attacks on deep learning systems using data poisoning,”arXiv preprint arXiv:1712.05526, 2017

    2017 arXiv

  15. [23]

    Attack of the tails: Yes, you really can backdoor federated learning,

    H. Wang, K. Sreenivasan, S. Rajput, H. Vishwakarma, S. Agarwal, J.-y. Sohn, K. Lee, and D. Papailiopoulos, “Attack of the tails: Yes, you really can backdoor federated learning,”Advances in Neural Information Processing Systems, vol. 33, pp. 16 070–16 084, 2020

    2020

  16. [24]

    DBA: dis- tributed backdoor attacks against federated learning,

    C. Xie, K. Huang, P. Chen, and B. Li, “DBA: dis- tributed backdoor attacks against federated learning,” in8th International Conference on Learning Repre- sentations, ICLR 2020, Addis Ababa, Ethiopia, April 26-30, 2020. OpenReview.net, 2020

    2020

  17. [25]

    Towards practical backdoor attacks on federated learning systems,

    C. Shi, S. Ji, X. Pan, X. Zhang, M. Zhang, M. Yang, J. Zhou, J. Yin, and T. Wang, “Towards practical backdoor attacks on federated learning systems,”IEEE Transactions on Dependable and Secure Computing, 2024

    2024

  18. [26]

    On the vulnerability of backdoor defenses for federated learning,

    P. Fang and J. Chen, “On the vulnerability of backdoor defenses for federated learning,” inProceedings of the AAAI Conference on Artificial Intelligence, vol. 37, no. 10, 2023, pp. 11 800–11 808

    2023

  19. [27]

    3dfed: Adaptive and extensible framework for covert backdoor attack in federated learning,

    H. Li, Q. Ye, H. Hu, J. Li, L. Wang, C. Fang, and J. Shi, “3dfed: Adaptive and extensible framework for covert backdoor attack in federated learning,” in44th IEEE Symposium on Security and Privacy, SP 2023, San Francisco, CA, USA, May 21-25, 2023. IEEE, 2023, pp. 1893–1907

    2023

  20. [28]

    Poisoning with cerberus: Stealthy and colluded backdoor attack against federated learning,

    X. Lyu, Y . Han, W. Wang, J. Liu, B. Wang, J. Liu, and X. Zhang, “Poisoning with cerberus: Stealthy and colluded backdoor attack against federated learning,” inProceedings of the AAAI Conference on Artificial Intelligence, vol. 37, no. 7, 2023, pp. 9020–9028

    2023

  21. [29]

    Machine learning with adversaries: Byzan- tine tolerant gradient descent,

    P. Blanchard, E. M. El Mhamdi, R. Guerraoui, and J. Stainer, “Machine learning with adversaries: Byzan- tine tolerant gradient descent,” inAdvances in Neural Information Processing Systems, vol. 30. Curran Associates, Inc., 2017

    2017

  22. [30]

    The limitations of federated learning in sybil settings,

    C. Fung, C. J. M. Yoon, and I. Beschastnikh, “The limitations of federated learning in sybil settings,” in 23rd International Symposium on Research in Attacks, Intrusions and Defenses, RAID 2020, San Sebastian, Spain, October 14-15, 2020. USENIX Association, 2020, pp. 301–316

    2020

  23. [31]

    RFLBAT: A robust federated learning algorithm against backdoor attack,

    Y . Wang, D. Zhai, Y . Zhan, and Y . Xia, “RFLBAT: A robust federated learning algorithm against backdoor attack,”CoRR, vol. abs/2201.03772, 2022. [Online]. Available: https://arxiv.org/abs/2201.03772

    2022 arXiv

  24. [32]

    Deepsight: Mitigating backdoor attacks in federated learning through deep model inspection,

    P. Rieger, T. D. Nguyen, M. Miettinen, and A. Sadeghi, “Deepsight: Mitigating backdoor attacks in federated learning through deep model inspection,” in29th An- nual Network and Distributed System Security Sympo- sium, NDSS 2022, San Diego, California, USA, April 24-28, 2022. T...

    2022

  25. [33]

    BackdoorIndicator: Leveraging OOD data for proactive backdoor detection in feder- ated learning,

    S. Li and Y . Dai, “BackdoorIndicator: Leveraging OOD data for proactive backdoor detection in feder- ated learning,” in33rd USENIX Security Symposium (USENIX Security 24). Philadelphia, PA: USENIX Association, Aug. 2024, pp. 4193–4210

    2024

  26. [34]

    Crfl: Cer- tifiably robust federated learning against backdoor at- tacks,

    C. Xie, M. Chen, P.-Y . Chen, and B. Li, “Crfl: Cer- tifiably robust federated learning against backdoor at- tacks,” inInternational Conference on Machine Learn- ing. PMLR, 2021, pp. 11 372–11 382

    2021

  27. [35]

    De- fending against backdoors in federated learning with robust learning rate,

    M. S. Ozdayi, M. Kantarcioglu, and Y . R. Gel, “De- fending against backdoors in federated learning with robust learning rate,” inProceedings of the AAAI Con- ference on Artificial Intelligence, vol. 35, no. 10, 2021, pp. 9268–9276

    2021

  28. [36]

    Attack of the tails: Yes, you really can backdoor federated learning,

    H. Wang, K. Sreenivasan, S. Rajput, H. Vishwakarma, S. Agarwal, J. Sohn, K. Lee, and D. S. Papailiopoulos, “Attack of the tails: Yes, you really can backdoor federated learning,” inAdvances in Neural Information Processing Systems 33: Annual Conference on Neural Information Pr...

    2020

  29. [37]

    DRUPE: Distribution Preserving Backdoor Attack in Self-supervised Learning,

    G. Tao, Z. Wang, S. Feng, G. Shen, S. Ma, and X. Zhang, “DRUPE: Distribution Preserving Backdoor Attack in Self-supervised Learning,” in2024 IEEE Symposium on Security and Privacy (SP). IEEE Computer Society, 2023, pp. 29–29

    2023

  30. [38]

    Backdoor attack with imperceptible input and latent modification,

    K. Doan, Y . Lao, and P. Li, “Backdoor attack with imperceptible input and latent modification,” in Advances in Neural Information Processing Systems, M. Ranzato, A. Beygelzimer, Y . Dauphin, P. Liang, and J. W. Vaughan, Eds., vol. 34. Curran Associates, Inc., 2021, pp. 18 944...

    2021

  31. [39]

    Learning multiple layers of features from tiny images

    A. Krizhevsky, G. Hintonet al., “Learning multiple layers of features from tiny images.” Toronto, ON, Canada, 2009

    2009

  32. [40]

    Detection of traffic signs in real-world images: The german traffic sign detection benchmark,

    S. Houben, J. Stallkamp, J. Salmen, M. Schlipsing, and C. Igel, “Detection of traffic signs in real-world images: The german traffic sign detection benchmark,” inThe 2013 international joint conference on neural networks (IJCNN). IEEE, 2013, pp. 1–8

    2013

  33. [41]

    Deep residual learning for image recognition,

    K. He, X. Zhang, S. Ren, and J. Sun, “Deep residual learning for image recognition,” in2016 IEEE Conference on Computer Vision and Pattern Recognition, CVPR 2016, Las Vegas, NV , USA, June 27-30, 2016. IEEE Computer Society, 2016, pp. 770–778. [Online]. Available: https://doi....

    2016

  34. [42]

    Very deep convolu- tional networks for large-scale image recognition,

    K. Simonyan and A. Zisserman, “Very deep convolu- tional networks for large-scale image recognition,” in 3rd International Conference on Learning Representa- tions, ICLR 2015, San Diego, CA, USA, May 7-9, 2015, Conference Track Proceedings, 2015

    2015

  35. [43]

    Mobilenetv2: Inverted residuals and linear bottlenecks,

    M. Sandler, A. Howard, M. Zhu, A. Zhmoginov, and L.-C. Chen, “Mobilenetv2: Inverted residuals and linear bottlenecks,” inProceedings of the IEEE conference on computer vision and pattern recognition, 2018, pp. 4510–4520

    2018

  36. [44]

    Data-free knowledge distillation for heterogeneous federated learning,

    Z. Zhu, J. Hong, and J. Zhou, “Data-free knowledge distillation for heterogeneous federated learning,” inIn- ternational Conference on Machine Learning. PMLR, 2021, pp. 12 878–12 889

    2021

  37. [45]

    BadCleaner: Defending Backdoor Attacks in Federated Learning via Attention-Based Multi-Teacher Distillation,

    J. Zhang, C. Zhu, C. Ge, C. Ma, Y . Zhao, X. Sun, and B. Chen, “BadCleaner: Defending Backdoor Attacks in Federated Learning via Attention-Based Multi-Teacher Distillation,”IEEE Transactions on Dependable and Secure Computing, vol. 21, no. 5, pp. 4559–4573, Sep. 2024

    2024

  38. [46]

    FLPurifier: Backdoor Defense in Fed- erated Learning via Decoupled Contrastive Training,

    J. Zhang, C. Zhu, X. Sun, C. Ge, B. Chen, W. Susilo, and S. Yu, “FLPurifier: Backdoor Defense in Fed- erated Learning via Decoupled Contrastive Training,” IEEE Transactions on Information Forensics and Se- curity, vol. 19, pp. 4752–4766, 2024

    2024

  39. [47]

    Measuring the effects of non-identical data distribution for federated visual classification,

    T.-M. H. Hsu, H. Qi, and M. Brown, “Measuring the effects of non-identical data distribution for federated visual classification,”arXiv preprint arXiv:1909.06335, 2019. Appendix A. Impact of Different Model Architectures In the context of backdoor attacks, the prevailing ap- p...

    1909 arXiv

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.