Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

SAB:A Stealing and Robust Backdoor Attack based on Steganographic Algorithm against Federated Learning

Weida Xu, Yang Xu, Sicong Zhang

TL;DR

This work introduces SAB, a steganography-based backdoor attack for federated learning that embeds full-size triggers within images and uses specialized gradient update strategies to prolong backdoor survival. By exploiting steganographic triggers and Bottom-95% plus Sparse-update gradient handling, SAB enhances stealth and robustness against defenses such as STRIP and Grad-Cam while mitigating detection in DP-enabled settings. The approach demonstrates superior backdoor effectiveness (ASR) and longevity across CIFAR-10, CIFAR-100, and Fashion-MNIST compared to BadNets and DBA, with maintained or minimally degraded main-task performance. The findings have important implications for FL security, highlighting the need for defense strategies that address full-image, distributed triggers and sophisticated gradient manipulation in collaborative learning environments.

Abstract

Federated learning, an innovative network architecture designed to safeguard user privacy, is gaining widespread adoption in the realm of technology. However, given the existence of backdoor attacks in federated learning, exploring the security of federated learning is significance. Nevertheless, the backdoors investigated in current federated learning research can be readily detected by human inspection or resisted by detection algorithms. Accordingly, a new goal has been set to develop stealing and robust federated learning backdoor attacks. In this paper, we introduce a novel approach, SAB, tailored specifically for backdoor attacks in federated learning, presenting an alternative gradient updating mechanism. SAB attack based on steganographic algorithm, using image steganographic algorithm to build a full-size trigger to improve the accuracy of backdoors and use multiple loss joint computation to produce triggers. SAB exhibits smaller distances to benign samples and greater imperceptibility to the human eye. As such, our triggers are capable of mitigating or evading specific backdoor defense methods. In SAB, the bottom-95\% method is applied to extend the lifespan of backdoor attacks. It updates the gradient on minor value points to reduce the probability of being cleaned. Finally, the generalization of backdoors is enhanced with Sparse-update to improve the backdoor accuracy.

SAB:A Stealing and Robust Backdoor Attack based on Steganographic Algorithm against Federated Learning

TL;DR

This work introduces SAB, a steganography-based backdoor attack for federated learning that embeds full-size triggers within images and uses specialized gradient update strategies to prolong backdoor survival. By exploiting steganographic triggers and Bottom-95% plus Sparse-update gradient handling, SAB enhances stealth and robustness against defenses such as STRIP and Grad-Cam while mitigating detection in DP-enabled settings. The approach demonstrates superior backdoor effectiveness (ASR) and longevity across CIFAR-10, CIFAR-100, and Fashion-MNIST compared to BadNets and DBA, with maintained or minimally degraded main-task performance. The findings have important implications for FL security, highlighting the need for defense strategies that address full-image, distributed triggers and sophisticated gradient manipulation in collaborative learning environments.

Abstract

Federated learning, an innovative network architecture designed to safeguard user privacy, is gaining widespread adoption in the realm of technology. However, given the existence of backdoor attacks in federated learning, exploring the security of federated learning is significance. Nevertheless, the backdoors investigated in current federated learning research can be readily detected by human inspection or resisted by detection algorithms. Accordingly, a new goal has been set to develop stealing and robust federated learning backdoor attacks. In this paper, we introduce a novel approach, SAB, tailored specifically for backdoor attacks in federated learning, presenting an alternative gradient updating mechanism. SAB attack based on steganographic algorithm, using image steganographic algorithm to build a full-size trigger to improve the accuracy of backdoors and use multiple loss joint computation to produce triggers. SAB exhibits smaller distances to benign samples and greater imperceptibility to the human eye. As such, our triggers are capable of mitigating or evading specific backdoor defense methods. In SAB, the bottom-95\% method is applied to extend the lifespan of backdoor attacks. It updates the gradient on minor value points to reduce the probability of being cleaned. Finally, the generalization of backdoors is enhanced with Sparse-update to improve the backdoor accuracy.
Paper Structure (37 sections, 5 equations, 19 figures, 3 tables, 1 algorithm)

This paper contains 37 sections, 5 equations, 19 figures, 3 tables, 1 algorithm.

Table of Contents

  1. Introduction
  2. Background and related work
  3. Federated Learning
  4. Conception.
  5. Aggregation Algorithm.
  6. Backdoor Attack
  7. Backdoor Attack in Deep Learning
  8. Backdoor Attack in Federated Learning
  9. Backdoor Defense
  10. Method
  11. Threat model
  12. Attacker's Capacities.
  13. Attacker's Goals.
  14. Approach
  15. Why does the steganographic algorithm work?
  16. ...and 22 more sections

Figures (19)

  • Figure 1: Samples with trigger by BadNets. From left to right are Benign, a yellow block sticker, a bomb sticker, a flower sticker.(1.5-column)
  • Figure 2: Adversary extract edge of an image, encode information into an RGB color, color the extracted image edges.(1.5-column)
  • Figure 3: On the left is a centralized backdoor attack method, where the attacker uploads a complete trigger; On the right is a distributed backdoor attack method, where attackers upload a portion of a trigger separately.(1.5-column)
  • Figure 4: SAB, BadNets, DBA method’s poisoned samples.(2-column)
  • Figure 5: SAB algorithm(2-column)
  • ...and 14 more figures