Dual Model Replacement:invisible Multi-target Backdoor Attack based on Federal Learning

TL;DR

The paper addresses backdoor vulnerabilities in federated learning by introducing an invisible, multi-target attack framework. It combines TrojanGan steganography to conceal triggers, CTA to support multiple triggers via controlled image partitioning, and DMR-FLBA to amplify backdoor influence during FL aggregation through dual-model replacement. Experimental results across CIFAR-10, GTSRB, and MS-Celeb-1M demonstrate high backdoor success rates with minimal benign accuracy loss, and consistent concealment of triggers, highlighting a practical risk for FL deployments. The work emphasizes the need for defensive strategies against such dual-model replacement attacks and sets directions for future defense research.

Abstract

In recent years, the neural network backdoor hidden in the parameters of the federated learning model has been proved to have great security risks. Considering the characteristics of trigger generation, data poisoning and model training in backdoor attack, this paper designs a backdoor attack method based on federated learning. Firstly, aiming at the concealment of the backdoor trigger, a TrojanGan steganography model with encoder-decoder structure is designed. The model can encode specific attack information as invisible noise and attach it to the image as a backdoor trigger, which improves the concealment and data transformations of the backdoor trigger.Secondly, aiming at the problem of single backdoor trigger mode, an image poisoning attack method called combination trigger attack is proposed. This method realizes multi-backdoor triggering by multiplexing combined triggers and improves the robustness of backdoor attacks. Finally, aiming at the problem that the local training mechanism leads to the decrease of the success rate of backdoor attack, a dual model replacement backdoor attack algorithm based on federated learning is designed. This method can improve the success rate of backdoor attack while maintaining the performance of the federated learning aggregation model. Experiments show that the attack strategy in this paper can not only achieve high backdoor concealment and diversification of trigger forms under federated learning, but also achieve good attack success rate in multi-target attacks.door concealment and diversification of trigger forms but also achieve good results in multi-target attacks.

Figures (7)

• Figure 1: The overall framework of the model
• Figure 2: The structure of TrojanGan model
• Figure 3: DMR attack
• Figure 4: Comparison of triggers
• Figure 5: DMR-FLBA attack training process