FedBAP: Backdoor Defense via Benign Adversarial Perturbation in Federated Learning

Bingyi Liu; Jing Wang; Libing Wu; Lijuan Huo; XinHai Yan; Zhuangzhuang Zhang

REVIEW 4 major objections 5 minor 46 references

FedBAP: Backdoor Defense via Benign Adversarial Perturbation in Federated Learning

T0 review · 4 major / 5 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read FedBAP claims that federated-learning models can be made to unlearn backdoor triggers by adversarial training on benign perturbations built from surrogate triggers that match the attacker's trigger in position and size.

desk verdict Competent FLIP-style defense with strong experiments, but it only works if malicious clients follow the defense protocol—which their own threat model lets them refuse to do. read the letter →

arxiv 2507.21177 v1 pith:XJR4N5GQ submitted 2025-07-26 cs.CR cs.LG

Xinhai Yan , Libing Wu , Zhuangzhuang Zhang , Bingyi Liu , Lijuan Huo , Jing Wang This is my paper

classification cs.CRcs.LG

keywords FederatedlearningBackdoorattackdefenseBenignadversarialperturbationTriggerreverseengineeringAdaptivescalingModelpoisoning

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

FedBAP is a defense against backdoor attacks in federated learning that works by making the model unlearn the trigger, rather than by detecting or filtering malicious clients. The paper's core claim is that a benign adversarial perturbation—a small, correctly labeled perturbation built from a surrogate trigger that mimics the attacker's trigger in position and size—can be used to adversarially train every selected client, so the global model stops relying on backdoor features. Across BadNets, LP, and A3FL attacks on CIFAR-10, CIFAR-100, and Fashion-MNIST, the authors report that FedBAP keeps average backdoor success rates near or below 3% while preserving or improving main-task accuracy, and that it stays effective as the proportion of malicious clients grows. If true, this shifts the defense paradigm from robust aggregation to robust training.

What carries the argument

The load-bearing object is the perturbation trigger, a pair $(M, \Delta x)$ where $M$ is a spatial mask over the image and $\Delta x$ is a pattern, embedded via $A(x,M,\Delta x) = (1-M)\cdot x + M\cdot \Delta x$. MaskGen optimizes Equation 3, the sum of classification loss to the target class and a sparsity penalty on the mask, over all target classes, then averages and binarizes masks across clients; PatternGen minimizes the cosine similarity between the penultimate-layer representations of triggered and clean inputs. These two steps produce a surrogate trigger intended to match the attacker's trigger in location and size. BAPGen then performs adversarial training by embedding the surrogate trigger into clean samples and enforcing the correct label, scaled by a factor $c_t$; AdaptiveScaling updates $c_t$ from the ratio of current to previous benign-adversarial loss, with a smoothing window, so that perturbation strength grows when the defense's influence wanes. The mechanism as a whole converts the server's aggregated global model into a client-side training signal that pushes the model away from trigger-dependent shortcuts.

What would settle it

Measure the pixel overlap (for example, intersection-over-union) between the mask produced by MaskGen and the actual BadNets trigger; if a high-overlap mask is not required for the reported defense, or if a low-overlap mask still suppresses the backdoor, the central trigger-matching premise is false. Alternatively, run FedBAP with one malicious client reporting a constant near-zero benign-adversarial loss from the start round; if the scaling factor collapses and attack success rises, the defense is broken by its honest-reporting assumption.

Watch

Extended reading notes

Core claim

On the paper's own terms, the central discovery is that the model's over-reliance on backdoor triggers is itself the attack surface, and that this reliance can be broken by adversarial training against surrogate triggers. Each client first generates a perturbation trigger by optimizing a mask and a pattern: the mask minimizes classification loss to each possible target class with a sparsity penalty (Equation 3), exploiting the 'backdoor distance' observation that flipping any sample to the backdoor target class requires far fewer changed pixels than flipping to any other class; the pattern is then optimized to maximize the distance between penultimate-layer representations of triggered and clean inputs. The same trigger, applied to clean samples with the correct label, becomes a benign adversarial perturbation that the client trains against (BAPGen), and an adaptive scaling factor adjusts the perturbation strength according to the reported loss trend. The paper reports that this reduces average backdoor success rates to 0.38–3.05% across the three main attacks on CIFAR-10/100 and to 0.14–0.42% on Fashion-MNIST, while keeping accuracy at or above the best baselines.

Load-bearing premise

The defense assumes that the surrogate trigger found by optimizing the global model sits on the same pixels and has the same size as the attacker's real trigger, and that malicious clients will report honest loss values that drive the scaling factor.

Editorial extensions

If this is right

Backdoor defense in FL no longer requires the server to identify which clients are malicious; every selected client contributes to unlearning the trigger.
Because the defense is a training-time process, it can be combined with standard FedAvg aggregation and does not require discarding or clipping updates, which is why the authors observe accuracy that meets or exceeds the best baselines.
The method's dependence on re-optimizing masks and patterns against the current global model gives it a route against adaptive attacks such as A3FL, where the trigger itself changes during training.
The reported stability across malicious proportions from 10% to 40% implies the defense does not rely on the malicious clients being a minority for its basic operation.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

The paper never measures the overlap between the generated mask and the true attacker trigger, so the 'precisely matching' claim is inferred from downstream attack success; a direct pixel-overlap measurement would isolate whether matching is necessary or merely helpful.
The adaptive scaling mechanism assumes malicious clients report honest benign-adversarial loss values; since the threat model allows attackers to modify weights and data, a malicious client reporting a constant near-zero loss could collapse the scaling factor and silently disable the defense.
The same surrogate-trigger adversarial training recipe could transfer to centralized backdoor defense, where trigger optimization runs on a clean surrogate set and no federated aggregation is involved.
A natural stress test is to attack with a trigger whose location changes after the defense start round; the paper's protocol fixes the surrogate trigger at round $t_s$, so a moving-target trigger may evade the defense unless the surrogate is re-derived.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

You should know two things about arXiv:2507.21177. It is a coherent, well-run extension of the Neural Cleanse / FLIP line: per-client trigger reverse engineering on the global model, PLR-based pattern generation, and an adaptive scaling schedule to keep the perturbation strong. The experiments are broad—CIFAR-10/100, Fashion-MNIST, BadNets/LP/A3FL/CerP, up to 40% malicious—and the reported numbers are impressive. The second thing is the load-bearing assumption. The defense is entirely client-side: each client runs BAPGen and reports a loss, the server just FedAverages and adapts the scaling factor. Section 3.2 explicitly says compromised clients can modify weights and datasets and can collide. A rational attacker just skips BAPGen and sends its usual poison update. Nothing enforces or even detects non-compliance. So under the paper's own threat model, the defense reduces to FedAvg with a regularization term contributed only by honest clients. The strong ASR numbers rest on an assumption the paper does not state and the threat model denies. This is not a minor gap; it is the core.

What is genuinely new: the adaptive scaling mechanism is a reasonable way to set perturbation strength, and the combination of mask/pattern generation with FLIP-style benign adversarial training is new. The paper also does the right thing by including an ablation and a new attack (CerP) in the Fashion-MNIST test, and it cites the relevant prior work. I would not call the trigger matching "precise": they never measure overlap between the generated mask and the actual trigger, and the pattern generation is a cosine-similarity objective, not a closeness objective. They also tune the scaling step size per attack (1.5 for LP, 3 for A3FL) without a principled way to pick it in deployment. No code, no error bars.

The reader's verdict is fair: conditional. The compliance problem is the strongest objection, and it is not addressed anywhere in the paper. If a revision either narrows the threat model to "malicious clients still follow the defense protocol" or adds a server-side enforcement/filtering step, the paper becomes much more credible. As is, it is a solid engineering contribution that would get value from a serious referee—mostly to decide whether the compliance assumption is acceptable in the federated backdoor-defense literature, and to push for the trigger-matching measurements and code.

I would send it to review, but I would not cite it as a demonstrated defense in its current form.

Referee Report

4 major / 5 minor

Summary. The paper proposes FedBAP, a client-side defense against backdoor attacks in federated learning. The method has three components: perturbation trigger generation (MaskGen and PatternGen), benign adversarial perturbation generation (BAPGen), and an adaptive scaling mechanism that adjusts perturbation intensity from client-reported loss values. Experiments compare FedBAP with six existing defenses on CIFAR-10, CIFAR-100, and Fashion-MNIST under BadNets, LP, A3FL, and CerP attacks, reporting lower attack success rates and comparable or higher accuracy than baselines. The abstract claims reductions in attack success rates by 0.22%-5.34%, 0.48%-6.34%, and 97.22%-97.6% under three attack types, and the paper concludes that FedBAP outperforms existing defenses.

Significance. The core idea of reducing a model's reliance on backdoor triggers through self-generated benign adversarial perturbations is interesting and, if validated, could complement existing server-side defenses. The paper provides complete pseudocode for its algorithms and includes comparisons across multiple architectures, datasets, and attack types, which is a strength. However, the central security claim is not established under the paper's own threat model: because the defense is executed entirely on the client side and the server performs only plain FedAvg, malicious clients are implicitly assumed to comply with the defense protocol. In addition, the claimed trigger-matching property is never measured, key hyperparameters are tuned per attack, and no code or error bars are provided. These issues make the empirical results, as presented, insufficient to support the abstract's conclusions.

major comments (4)

[Section 3.2 and Algorithm 1] The threat model in Section 3.2 states that malicious clients can directly modify model weights and datasets, communicate, and collude. Algorithm 1, however, requires every selected client to execute BAPGen (line 13) and to report an honest loss value (line 24), while the server aggregates updates with plain FedAvg (line 27). A malicious client can simply skip line 13, submit a poisoned or model-replacement update, and report an arbitrary loss to AdaptiveScaling. The strong results in Tables 1, 5, and 6 therefore rely on the implicit assumption that even the 10-40% malicious clients comply with the defense, which contradicts the stated threat model. If malicious clients are adversarial in the usual sense, FedBAP reduces to FedAvg with regularization contributed only by benign clients, and no mechanism prevents the backdoor from surviving. The paper needs either a server-side enforcement that detects or filters non-compliant updates, or a revised threat model that explicitly assumes protocol compliance; in the latter case, the claimed robustness against malicious clients must be substantially weakened.
[Section 4.2, Equation (3)] The central premise of the method is that minimizing the objective in Equation (3) over masks and patterns recovers a perturbation trigger that 'precisely matches' the attacker's backdoor trigger in location and size. This is asserted in Section 4.2 but is never verified experimentally. The paper does not measure any overlap metric (e.g., IoU, L1 mask distance) between the generated mask and the true trigger, nor does it ablate with deliberately mismatched triggers (wrong location, wrong size, random mask). Without such a measurement or ablation, the chain from trigger recovery to backdoor removal is unsupported. The w/o PG ablation in Table 2 replaces the learned pattern with a random one, but it still uses the same mask location, so it does not test the critical mask-matching claim.
[Section 5.4 and Figure 7] The experiments in Section 5.4 set the scaling step size to 1.5 for LP and 3 for A3FL, explicitly because these are 'more sophisticated attack strategies,' and Figure 7 is used to justify δ=3 for A3FL at 40% malicious clients. This means the reported results rely on per-attack tuning of a key hyperparameter, and the defender is assumed to know the attack type and strength in advance. Without a fixed-δ comparison or a principled selection rule that does not require attack-specific knowledge, the claimed superiority of FedBAP is partly an artifact of tuning. A sensitivity table across all attacks with a single default δ, or a validation-based selection procedure, is needed.
[Section 5, all tables] No code, seeds, or error bars are reported for any of the quantitative results. Tables 1, 5, and 6 present single numbers for each metric, making it impossible to assess variance or statistical significance, especially for near-zero values such as FedBAP's ABSR of 0.38% or 0.14%. Given that the paper's headline claims are empirical, the authors should release the code and report mean and standard deviation over multiple independent runs; otherwise the reproducibility and robustness of the results cannot be evaluated.

minor comments (5)

[Section 2] The heading contains a typo: 'RELETED WORK' should be 'RELATED WORK'.
[Algorithm 4, line 3] The loss expression has mismatched parentheses: it should be ℓ(w′(A(x, M, Δx_i)), y) rather than ℓ(w′(A(x, M, Δx_i), y).
[Equation (3) and Algorithm 2] The norm in the regularization term λ∥M∥ is not specified; Definition 2 uses the L1 norm, so this should be made explicit.
[Figures 2-9] Several figure axis labels are garbled (e.g., sequences like '/uni00000013/uni00000018/...') and need to be regenerated with proper text.
[Section 5.1 and Table 6] The default setup states 10% malicious clients, but the Fashion-MNIST experiments in Table 6 use 30% malicious clients; the caption or main text should clarify this difference and how the setup generalizes.

Circularity Check

0 steps flagged · score 2.0 of 10

No significant circularity: FedBAP's derivation does not reduce to its own inputs, though the trigger-matching premise is asserted without verification and the threat model leaves a compliance gap.

full rationale

FedBAP's derivation chain is not circular. Equation (3), which minimizes target-class cross-entropy plus the L1 mask norm, is a standard reverse-engineering objective and is not defined in terms of the ABSR/BBSR metrics that the paper reports; the subsequent adversarial-training step in Algorithm 4 is an independent empirical mechanism that could succeed or fail even if a trigger is recovered. The abstract's claim that the mechanism creates perturbation triggers 'precisely matching backdoor triggers in location and size' is asserted rather than derived: Section 4.2 provides no mask-overlap measurement and no ablation with deliberately mismatched triggers, so this is a missing-support/correctness concern, not a reduction by construction. The disclosed per-attack scaling-step choices in Section 5.4 (δ=1.5 for LP and δ=3 for A3FL) are hyperparameter selections on the evaluation scenario, and Table 1 uses a single default δ=1, so the central comparison is not a fitted prediction. The threat model in Section 3.2 grants malicious clients control over weights and datasets, while Algorithm 1 assumes every client executes BAPGen and reports honest losses; this is a genuine security-model gap, but it is not a circular dependency in the derivation chain. The self-citations [40] and [41] are background references only and are not load-bearing. Because no derivation step reduces to its own output, the circularity score is low.

Assumptions & free parameters 5 free parameters · 4 assumptions · 0 invented entities

The paper does not introduce new physical entities. The free parameters are standard hyperparameters, but the per-attack tuning of delta in Section 5.4 is a mild form of fitting. The key axioms are the backdoor-distance inequality from prior work and the unverified assumption that the reverse-engineered trigger matches the true attack trigger.

free parameters (5)

Scaling step size delta = 1 by default; 1.5 for LP and 3 for A3FL in Section 5.4
Controls how aggressively the perturbation intensity increases; tuned per attack in the malicious-client-proportion experiments.
Mask sparsity weight lambda = 0.01
Balances classification loss and mask L1 norm in Equation 3; hand-chosen.
Backdoor accuracy threshold acc_TH = 0.9
Determines whether a candidate mask is accepted in MaskGen; hand-chosen threshold.
Window size k for adaptive scaling = 5
Controls the smoothing of the loss ratio in AdaptiveScaling; hand-chosen.
Start round t_s = 100
When the defense is activated; hand-chosen, and different in the Fashion-MNIST experiment (85).

assumptions (4)

domain assumption Backdoor distance inequality (Equation 4): for a backdoored model, the mask needed to flip any class to the target class is much smaller than masks for other target classes.
Adopted from Neural Cleanse [32]; the entire MaskGen procedure relies on this being true for the global model at the start round.
ad hoc to paper The trigger recovered by minimizing Equation 3 approximates the attacker's actual trigger closely enough that adversarial training on it removes the backdoor.
Core hypothesis of FedBAP, stated in Section 4.2 but never verified by measuring trigger overlap or testing mismatched triggers.
domain assumption Malicious clients follow the defense protocol, including running BAPGen and honestly reporting loss values.
The threat model in Section 3.2 allows malicious clients to modify weights and datasets, but the adaptive scaling mechanism assumes the uploaded loss value is a genuine measure of perturbation effect.
standard math The output layer is Lipschitz (Equation 5), so larger penultimate-layer differences imply larger output probability differences.
A standard property of linear maps; used to justify PatternGen's cosine-similarity objective.

how reviews work

0 comments

Cite this review

Pith. "Pith review of FedBAP: Backdoor Defense via Benign Adversarial Perturbation in Federated Learning." pith.science (2026). https://pith.science/paper/XJR4N5GQ

@misc{pith2026250721177,
  author       = {Pith},
  title        = {Pith review of: FedBAP: Backdoor Defense via Benign Adversarial Perturbation in Federated Learning},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/XJR4N5GQ}},
  note         = {Machine review of arXiv:2507.21177}
}

read the original abstract

Federated Learning (FL) enables collaborative model training while preserving data privacy, but it is highly vulnerable to backdoor attacks. Most existing defense methods in FL have limited effectiveness due to their neglect of the model's over-reliance on backdoor triggers, particularly as the proportion of malicious clients increases. In this paper, we propose FedBAP, a novel defense framework for mitigating backdoor attacks in FL by reducing the model's reliance on backdoor triggers. Specifically, first, we propose a perturbed trigger generation mechanism that creates perturbation triggers precisely matching backdoor triggers in location and size, ensuring strong influence on model outputs. Second, we utilize these perturbation triggers to generate benign adversarial perturbations that disrupt the model's dependence on backdoor triggers while forcing it to learn more robust decision boundaries. Finally, we design an adaptive scaling mechanism to dynamically adjust perturbation intensity, effectively balancing defense strength and model performance. The experimental results demonstrate that FedBAP reduces the attack success rates by 0.22%-5.34%, 0.48%-6.34%, and 97.22%-97.6% under three types of backdoor attacks, respectively. In particular, FedBAP demonstrates outstanding performance against novel backdoor attacks.

Figures

Figures reproduced from arXiv: 2507.21177 by the authors.

**Figure 2.** ResNet-18 trained with different defenses on the non-IID CIFAR10 dataset against the BadNets attack. [PITH_FULL_IMAGE:figures/full_fig_p007_2.png] view at source ↗

**Figure 3.** Impact of the malicious clients proportion on dif [PITH_FULL_IMAGE:figures/full_fig_p007_3.png] view at source ↗

Figures from the paper (5 more)

**Figure 4.** Figure 4: Impact of the malicious clients proportion on dif [PITH_FULL_IMAGE:figures/full_fig_p008_4.png]

**Figure 5.** Figure 5: Impact of the malicious clients proportion on dif [PITH_FULL_IMAGE:figures/full_fig_p008_5.png]

**Figure 6.** Figure 6: Impact of the non-IIDness on different defenses [PITH_FULL_IMAGE:figures/full_fig_p008_6.png]

**Figure 8.** Figure 8: ResNet-18 trained with different defenses on the non-IID CIFAR10 dataset against the LP attack. [PITH_FULL_IMAGE:figures/full_fig_p013_8.png]

**Figure 9.** Figure 9: ResNet-18 trained with different defenses on the non-IID CIFAR10 dataset against the A3FL attack. [PITH_FULL_IMAGE:figures/full_fig_p013_9.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

46 extracted references · 37 canonical work pages

[1]

Eugene Bagdasaryan, Andreas Veit, Yiqing Hua, Deborah Estrin, and Vitaly Shmatikov. 2020. How to backdoor federated learning. InInternational Conference on Artificial Intelligence and Statistics . PMLR, 2938–2948

work page 2020
[2]

Peva Blanchard, El Mahdi El Mhamdi, Rachid Guerraoui, and Julien Stainer
[3]

Xiaoyu Cao, Minghong Fang, Jia Liu, and Neil Zhenqiang Gong. 2020. Fltrust: Byzantine-robust federated learning via trust bootstrapping. arXiv preprint arXiv:2012.13995 (2020)

arXiv 2020
[4]

Kewei Cheng, Tao Fan, Yilun Jin, Yang Liu, Tianjian Chen, Dimitrios Papadopou- los, and Qiang Yang. 2021. Secureboost: A lossless federated learning framework. IEEE Intelligent Systems 36, 6 (2021), 87–98

work page 2021
[5]

Minghong Fang, Xiaoyu Cao, Jinyuan Jia, and Neil Gong. 2020. Local model poi- soning attacks to Byzantine-Robust federated learning. In 29th USENIX Security Symposium (USENIX Security 20) . 1605–1622

work page 2020
[6]

Pei Fang and Jinghui Chen. 2023. On the vulnerability of backdoor defenses for federated learning. In Proceedings of the AAAI Conference on Artificial Intelligence , Vol. 37. 11800–11808

work page 2023
[7]

Zirui Gong, Liyue Shen, Yanjun Zhang, Leo Yu Zhang, Jingwei Wang, Guangdong Bai, and Yong Xiang. 2023. Agramplifier: defending federated learning against poisoning attacks through local update amplification. IEEE Transactions on Information Forensics and Security 19 (2023), 1241–1250

work page 2023
[8]

Tianyu Gu, Brendan Dolan-Gavitt, and Siddharth Garg. 2017. Badnets: Identifying vulnerabilities in the machine learning model supply chain. arXiv preprint arXiv:1708.06733 (2017)

arXiv 2017

Show all 46 references

[9]

Andrew Hard, Kanishka Rao, Rajiv Mathews, Swaroop Ramaswamy, Françoise Beaufays, Sean Augenstein, Hubert Eichner, Chloé Kiddon, and Daniel Ram- age. 2018. Federated learning for mobile keyboard prediction. arXiv preprint arXiv:1811.03604 (2018)

2018 arXiv
[10]

Tiansheng Huang, Sihao Hu, Ka-Ho Chow, Fatih Ilhan, Selim Tekin, and Ling Liu. 2023. Lockdown: backdoor defense for federated learning with isolated subspace training. Advances in Neural Information Processing Systems 36 (2023), 10876–10896

2023
[11]

Wenke Huang, Mang Ye, Zekun Shi, Guancheng Wan, He Li, and Bo Du. 2024. Parameter disparities dissection for backdoor defense in heterogeneous federated learning. Advances in Neural Information Processing Systems 37 (2024), 120951– 120973

2024
[12]

Jinyuan Jia, Zhuowen Yuan, Dinuka Sahabandu, Luyao Niu, Arezoo Rajabi, Bhaskar Ramasubramanian, Bo Li, and Radha Poovendran. 2023. Fedgame: A game-theoretic defense against backdoor attacks in federated learning. Advances in Neural Information Processing Systems 36 (2023), 53090–53111

2023
[13]

Ehsanul Kabir, Zeyu Song, Md Rafi Ur Rashid, and Shagufta Mehnaz. 2024. Flshield: a validation based federated learning framework to defend against poisoning attacks. In 2024 IEEE Symposium on Security and Privacy (SP) . IEEE, 2572–2590

2024
[14]

Haoyang Li, Qingqing Ye, Haibo Hu, Jin Li, Leixia Wang, Chengfang Fang, and Jie Shi. 2023. 3dfed: Adaptive and extensible framework for covert backdoor attack in federated learning. In 2023 IEEE Symposium on Security and Privacy (SP) . IEEE, 1893–1907

2023
[15]

Minghui Li, Wei Wan, Yuxuan Ning, Shengshan Hu, Lulu Xue, Leo Yu Zhang, and Yichen Wang. 2024. Darkfed: A data-free backdoor attack in federated learning. arXiv preprint arXiv:2405.03299 (2024)

2024 arXiv
[16]

Songze Li and Yanbo Dai. 2024. BackdoorIndicator: Leveraging OOD Data for Proactive Backdoor Detection in Federated Learning. In 33rd USENIX Security Symposium (USENIX Security 24) . 4193–4210

2024
[17]

Tao Liu, Yuhang Zhang, Zhu Feng, Zhiqin Yang, Chen Xu, Dapeng Man, and Wu Yang. 2024. Beyond traditional threats: A persistent backdoor attack on federated learning. In Proceedings of the AAAI Conference on Artificial Intelligence , Vol. 38. 21359–21367

2024
[18]

Xiaoting Lyu, Yufei Han, Wei Wang, Jingkai Liu, Bin Wang, Jiqiang Liu, and Xiangliang Zhang. 2023. Poisoning with cerberus: Stealthy and colluded back- door attack against federated learning. In Proceedings of the AAAI Conference on Artificial Intelligence, Vol. 37. 9020–9028

2023
[19]

Xiaoting Lyu, Yufei Han, Wei Wang, Jingkai Liu, Yongsheng Zhu, Guangquan Xu, Jiqiang Liu, and Xiangliang Zhang. 2024. Lurking in the shadows: Unveiling stealthy backdoor attacks against personalized federated learning. In33rd USENIX Security Symposium (USENIX Security 24) . 4157–4174

2024
[20]

Brendan McMahan, Eider Moore, Daniel Ramage, Seth Hampson, and Blaise Aguera y Arcas. 2017. Communication-efficient learning of deep net- works from decentralized data. In Artificial Intelligence and Statistics . PMLR, 1273–1282

2017
[21]

Thien Duc Nguyen, Samuel Marchal, Markus Miettinen, Hossein Fereidooni, Nadarajah Asokan, and Ahmad-Reza Sadeghi. 2019. DÏoT: A federated self- learning anomaly detection system for IoT. In 2019 IEEE 39th International Con- ference on Distributed Computing Systems (ICDCS) . IE...

2019
[22]

Thuy Dung Nguyen, Tuan A Nguyen, Anh Tran, Khoa D Doan, and Kok-Seng Wong. 2023. Iba: Towards irreversible backdoor attacks in federated learning. Advances in Neural Information Processing Systems 36 (2023), 66364–66376

2023
[23]

Thien Duc Nguyen, Phillip Rieger, Roberta De Viti, Huili Chen, Björn B Bran- denburg, Hossein Yalame, Helen Möllering, Hossein Fereidooni, Samuel Marchal, Markus Miettinen, et al. 2022. FLAME: Taming backdoors in federated learning. In 31st USENIX Security Symposium (USENIX Se...

2022
[24]

Mustafa Safa Ozdayi, Murat Kantarcioglu, and Yulia R Gel. 2021. Defending against backdoors in federated learning with robust learning rate. In Proceedings of the AAAI Conference on Artificial Intelligence , Vol. 35. 9268–9276

2021
[25]

Zhen Qin, Feiyi Chen, Chen Zhi, Xueqiang Yan, and Shuiguang Deng. 2024. Resisting backdoor attacks in federated learning via bidirectional elections and individual perspective. In Proceedings of the AAAI Conference on Artificial Intelli- gence, Vol. 38. 14677–14685

2024
[26]

Phillip Rieger, Torsten Krauß, Markus Miettinen, Alexandra Dmitrienko, and Ahmad-Reza Sadeghi. 2022. Crowdguard: Federated backdoor detection in feder- ated learning. arXiv preprint arXiv:2210.07714 (2022)

2022 arXiv
[27]

Micah J Sheller, G Anthony Reina, Brandon Edwards, Jason Martin, and Spyridon Bakas. 2018. Multi-institutional deep learning modeling without sharing patient data: A feasibility study on brain tumor segmentation. In International MICCAI Brainlesion Workshop. Springer, 92–104

2018
[28]

Chenghui Shi, Shouling Ji, Xudong Pan, Xuhong Zhang, Mi Zhang, Min Yang, Jun Zhou, Jianwei Yin, and Ting Wang. 2024. Towards practical backdoor attacks on federated learning systems. IEEE Transactions on Dependable and Secure Computing (2024)

2024
[29]

Ziteng Sun, Peter Kairouz, Ananda Theertha Suresh, and H Brendan McMahan
[30]

Vale Tolpegin, Stacey Truex, Mehmet Emre Gursoy, and Ling Liu. 2020. Data poisoning attacks against federated learning systems. In European Symposium on Research in Computer Security . Springer, 480–501

2020
[31]

Wei Wan, Shengshan Hu, Minghui Li, Jianrong Lu, Longling Zhang, Leo Yu Zhang, and Hai Jin. 2023. A four-pronged defense against byzantine attacks in federated learning. In Proceedings of the 31st ACM International Conference on Multimedia. 7394–7402

2023
[32]

Bolun Wang, Yuanshun Yao, Shawn Shan, Huiying Li, Bimal Viswanath, Haitao Zheng, and Ben Y Zhao. 2019. Neural cleanse: Identifying and mitigating backdoor attacks in neural networks. In 2019 IEEE Symposium on Security and Privacy (SP) . IEEE, 707–723

2019
[33]

Ning Wang, Yang Xiao, Yimin Chen, Yang Hu, Wenjing Lou, and Y Thomas Hou
[34]

Chulin Xie, Keli Huang, Pin-Yu Chen, and Bo Li. 2019. Dba: Distributed back- door attacks against federated learning. In International Conference on Learning Representations

2019
[35]

He Yang, Wei Xi, Yuhao Shen, Canhui Wu, and Jizhong Zhao. 2024. Roseagg: Robust defense against targeted collusion attacks in federated learning. IEEE Transactions on Information Forensics and Security 19 (2024), 2951–2966

2024
[36]

Hangfan Zhang, Jinyuan Jia, Jinghui Chen, Lu Lin, and Dinghao Wu. 2023. A3fl: Adversarially adaptive backdoor attacks to federated learning.Advances in Neural Information Processing Systems 36 (2023), 61213–61233

2023
[37]

Kaiyuan Zhang, Guanhong Tao, Qiuling Xu, Siyuan Cheng, Shengwei An, Yingqi Liu, Shiwei Feng, Guangyu Shen, Pin-Yu Chen, Shiqing Ma, et al. 2022. Flip: A provable defense framework for backdoor mitigation in federated learning.arXiv preprint arXiv:2210.12873 (2022)

2022 arXiv
[38]

Zaixi Zhang, Xiaoyu Cao, Jinyuan Jia, and Neil Zhenqiang Gong. 2022. Fldetector: Defending federated learning against model poisoning attacks via detecting malicious clients. InProceedings of the 28th ACM SIGKDD Conference on Knowledge Discovery and Data Mining . 2545–2555

2022
[39]

Zhengming Zhang, Ashwinee Panda, Linyue Song, Yaoqing Yang, Michael Ma- honey, Prateek Mittal, Ramchandran Kannan, and Joseph Gonzalez. 2022. Neuro- toxin: Durable backdoors in federated learning. In International Conference on Machine Learning. PMLR, 26429–26446

2022
[40]

Zhuangzhuang Zhang, Libing Wu, Jiong Jin, Enshu Wang, Bingyi Liu, and Qing- Long Han. 2025. Secure Federated Learning for Cloud-Fog Automation: Vul- nerabilities, Challenges, Solutions, and Future Directions. IEEE Transactions on Industrial Informatics (2025), 1–13

2025
[41]

Zhuangzhuang Zhang, Libing Wu, Chuanguo Ma, Jianxin Li, Jing Wang, Qian Wang, and Shui Yu. 2023. LSFL: A lightweight and secure federated learning scheme for edge computing. IEEE Transactions on Information Forensics and Security 18 (2023), 365–379

2023
[42]

Chaoyi Zhu, Stefanie Roos, and Lydia Y Chen. 2023. LeadFL: Client self-defense against model poisoning in federated learning. In International Conference on Machine Learning. PMLR, 43158–43180

2023
[43]

Haomin Zhuang, Mingxian Yu, Hao Wang, Yang Hua, Jian Li, and Xu Yuan. 2023. Backdoor federated learning by poisoning backdoor-critical layers.arXiv preprint arXiv:2308.04466 (2023). MM ’25, October 27–31, 2025, Dublin, Ireland. Xinhai Yan et al. A ALGORITHMS Algorithm 2 Pertur...

2023 arXiv
[2017]

Advances in Neural Information Processing Systems 30 (2017)

Machine learning with adversaries: Byzantine tolerant gradient descent. Advances in Neural Information Processing Systems 30 (2017)

2017
[2019]

Can you really backdoor federated learning?arXiv preprint arXiv:1911.07963 (2019)

2019 arXiv
[2022]

In Proceedings of the 2022 ACM on Asia Conference on Computer and Communications Security

Flare: defending federated learning against model poisoning attacks via latent space representations. In Proceedings of the 2022 ACM on Asia Conference on Computer and Communications Security . 946–958

2022

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.

[1] [1]

Eugene Bagdasaryan, Andreas Veit, Yiqing Hua, Deborah Estrin, and Vitaly Shmatikov. 2020. How to backdoor federated learning. InInternational Conference on Artificial Intelligence and Statistics . PMLR, 2938–2948

work page 2020

[2] [2]

Peva Blanchard, El Mahdi El Mhamdi, Rachid Guerraoui, and Julien Stainer

[3] [3]

Xiaoyu Cao, Minghong Fang, Jia Liu, and Neil Zhenqiang Gong. 2020. Fltrust: Byzantine-robust federated learning via trust bootstrapping. arXiv preprint arXiv:2012.13995 (2020)

arXiv 2020

[4] [4]

Kewei Cheng, Tao Fan, Yilun Jin, Yang Liu, Tianjian Chen, Dimitrios Papadopou- los, and Qiang Yang. 2021. Secureboost: A lossless federated learning framework. IEEE Intelligent Systems 36, 6 (2021), 87–98

work page 2021

[5] [5]

Minghong Fang, Xiaoyu Cao, Jinyuan Jia, and Neil Gong. 2020. Local model poi- soning attacks to Byzantine-Robust federated learning. In 29th USENIX Security Symposium (USENIX Security 20) . 1605–1622

work page 2020

[6] [6]

Pei Fang and Jinghui Chen. 2023. On the vulnerability of backdoor defenses for federated learning. In Proceedings of the AAAI Conference on Artificial Intelligence , Vol. 37. 11800–11808

work page 2023

[7] [7]

Zirui Gong, Liyue Shen, Yanjun Zhang, Leo Yu Zhang, Jingwei Wang, Guangdong Bai, and Yong Xiang. 2023. Agramplifier: defending federated learning against poisoning attacks through local update amplification. IEEE Transactions on Information Forensics and Security 19 (2023), 1241–1250

work page 2023

[8] [8]

Tianyu Gu, Brendan Dolan-Gavitt, and Siddharth Garg. 2017. Badnets: Identifying vulnerabilities in the machine learning model supply chain. arXiv preprint arXiv:1708.06733 (2017)

arXiv 2017