Abstract:Federated Learning (FL) is a collaborative machine learning technique where multiple clients work together with a central server to train a global model without sharing their private data. However, the distribution shift across non-IID datasets of clients poses a challenge to this one-model-fits-all method hindering the ability of the global model to effectively adapt to each client's unique local data. To echo this challenge, personalized FL (PFL) is designed to allow each client to create personalized local models tailored to their private data. While extensive research has scrutinized backdoor risks in FL, it has remained underexplored in PFL applications. In this study, we delve deep into the vulnerabilities of PFL to backdoor attacks. Our analysis showcases a tale of two cities. On the one hand, the personalization process in PFL can dilute the backdoor poisoning effects injected into the personalized local models. Furthermore, PFL systems can also deploy both server-end and client-end defense mechanisms to strengthen the barrier against backdoor attacks. On the other hand, our study shows that PFL fortified with these defense methods may offer a false sense of security. We propose \textit{PFedBA}, a stealthy and effective backdoor attack strategy applicable to PFL systems. \textit{PFedBA} ingeniously aligns the backdoor learning task with the main learning task of PFL by optimizing the trigger generation process. Our comprehensive experiments demonstrate the effectiveness of \textit{PFedBA} in seamlessly embedding triggers into personalized local models. \textit{PFedBA} yields outstanding attack performance across 10 state-of-the-art PFL algorithms, defeating the existing 6 defense mechanisms. Our study sheds light on the subtle yet potent backdoor threats to PFL systems, urging the community to bolster defenses against emerging backdoor challenges.

Poisoning with Cerberus: Stealthy and Colluded Backdoor Attack Against Federated Learning.

Backdoor Attacks and Defenses in Federated Learning: State-of-the-Art, Taxonomy, and Future Directions

Oblivion: Poisoning Federated Learning by Inducing Catastrophic Forgetting.

FL-PTD: A Privacy Preserving Defense Strategy Against Poisoning Attacks in Federated Learning.

Defending Poisoning Attacks in Federated Learning via Adversarial Training Method

Poisoning with A Pill: Circumventing Detection in Federated Learning

Backdoor Federated Learning by Poisoning Backdoor-Critical Layers

Data Poisoning Attacks Against Federated Learning Systems

Denial-of-Service or Fine-Grained Control: Towards Flexible Model Poisoning Attacks on Federated Learning

How To Backdoor Federated Learning

Tracing Back the Malicious Clients in Poisoning Attacks to Federated Learning

Model Poisoning Attacks to Federated Learning via Multi-Round Consistency

Efficient and Privacy-Preserving Federated Learning Against Poisoning Adversaries

SBPA: Sybil-Based Backdoor Poisoning Attacks for Distributed Big Data in AIoT-Based Federated Learning System

Poisoning Attacks in Federated Learning: A Survey

Concealing Backdoor Model Updates in Federated Learning by Trigger-Optimized Data Poisoning

FlexibleFL: Mitigating poisoning attacks with contributions in cloud-edge federated learning systems

Federated Learning in Adversarial Environments: Testbed Design and Poisoning Resilience in Cybersecurity

Data and Model Poisoning Backdoor Attacks on Wireless Federated Learning, and the Defense Mechanisms: A Comprehensive Survey

DP-Poison: Poisoning Federated Learning under the Cover of Differential Privacy

Lurking in the shadows: Unveiling Stealthy Backdoor Attacks against Personalized Federated Learning