Abstract:Due to the distributed nature of Federated Learning (FL), researchers have uncovered that FL is vulnerable to backdoor attacks, which aim at injecting a sub-task into the FL without corrupting the performance of the main task. Single-shot backdoor attack achieves high accuracy on both the main task and backdoor sub-task when injected at the FL model convergence. However, the early-injected single-shot backdoor attack is ineffective because: (1) the maximum backdoor effectiveness is not reached at injection because of the dilution effect from normal local updates; (2) the backdoor effect decreases quickly as the backdoor will be overwritten by the newcoming normal local updates. In this paper, we strengthen the early-injected single-shot backdoor attack utilizing FL model information leakage. We show that the FL convergence can be expedited if the client trains on a dataset that mimics the distribution and gradients of the whole population. Based on this observation, we proposed a two-phase backdoor attack, which includes a preliminary phase for the subsequent backdoor attack. In the preliminary phase, the attacker-controlled client first launches a whole population distribution inference attack and then trains on a locally crafted dataset that is aligned with both the gradient and inferred distribution. Benefiting from the preliminary phase, the later injected backdoor achieves better effectiveness as the backdoor effect will be less likely to be diluted by the normal model updates. Extensive experiments are conducted on MNIST dataset under various data heterogeneity settings to evaluate the effectiveness of the proposed backdoor attack. Results show that the proposed backdoor outperforms existing backdoor attacks in both success rate and longevity, even when defense mechanisms are in place.

Adaptive Backdoor Attacks Against Dataset Distillation for Federated Learning

Backdoor Attacks and Defenses in Federated Learning: State-of-the-Art, Taxonomy, and Future Directions

FLSAD: Defending Backdoor Attacks in Federated Learning via Self-Attention Distillation

Towards Practical Backdoor Attacks on Federated Learning Systems

On the Vulnerability of Backdoor Defenses for Federated Learning

BadCleaner: Defending Backdoor Attacks in Federated Learning Via Attention-Based Multi-Teacher Distillation

A Robust Defense Algorithm for Backdoor Erasure Based on Attention Alignment in Federated Learning

Act in Collusion: A Persistent Distributed Multi-Target Backdoor in Federated Learning

Mitigating Backdoors in Federated Learning with FLD

FLARE: A Backdoor Attack to Federated Learning with Refined Evasion

Technical Report: Assisting Backdoor Federated Learning with Whole Population Knowledge Alignment

Never Too Late: Tracing and Mitigating Backdoor Attacks in Federated Learning

BadSFL: Backdoor Attack against Scaffold Federated Learning

Backdoor Defense in Federated Learning Using Differential Testing and Outlier Detection

Anti-Distillation Backdoor Attacks: Backdoors Can Really Survive in Knowledge Distillation

Protect Federated Learning Against Backdoor Attacks via Data-Free Trigger Generation

DarkFed: A Data-Free Backdoor Attack in Federated Learning

Practical and General Backdoor Attacks against Vertical Federated Learning

FedCL: Detecting Backdoor Attacks in Federated Learning with Confidence Levels

Securing Federated Learning Against Novel and Classic Backdoor Threats During Foundation Model Integration

A Comprehensive Study on Dataset Distillation: Performance, Privacy, Robustness and Fairness