Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Act in Collusion: A Persistent Distributed Multi-Target Backdoor in Federated Learning

Tao Liu, Wu Yang, Chen Xu, Jiguang Lv, Huanran Wang, Yuhang Zhang, Shuchun Xu, Dapeng Man

TL;DR

A Distributed Multi-Target Backdoor Attack (DMBA) is proposed, ensuring efficiency and persistence of backdoors from different malicious clients, and introduces backdoor replay in local training to neutralize conflicting gradients.

Abstract

Federated learning, a novel paradigm designed to protect data privacy, is vulnerable to backdoor attacks due to its distributed nature. Current research often designs attacks based on a single attacker with a single backdoor, overlooking more realistic and complex threats in federated learning. We propose a more practical threat model for federated learning: the distributed multi-target backdoor. In this model, multiple attackers control different clients, embedding various triggers and targeting different classes, collaboratively implanting backdoors into the global model via central aggregation. Empirical validation shows that existing methods struggle to maintain the effectiveness of multiple backdoors in the global model. Our key insight is that similar backdoor triggers cause parameter conflicts and injecting new backdoors disrupts gradient directions, significantly weakening some backdoors performance. To solve this, we propose a Distributed Multi-Target Backdoor Attack (DMBA), ensuring efficiency and persistence of backdoors from different malicious clients. To avoid parameter conflicts, we design a multi-channel dispersed frequency trigger strategy to maximize trigger differences. To mitigate gradient interference, we introduce backdoor replay in local training to neutralize conflicting gradients. Extensive validation shows that 30 rounds after the attack, Attack Success Rates of three different backdoors from various clients remain above 93%. The code will be made publicly available after the review period.

Act in Collusion: A Persistent Distributed Multi-Target Backdoor in Federated Learning

TL;DR

A Distributed Multi-Target Backdoor Attack (DMBA) is proposed, ensuring efficiency and persistence of backdoors from different malicious clients, and introduces backdoor replay in local training to neutralize conflicting gradients.

Abstract

Federated learning, a novel paradigm designed to protect data privacy, is vulnerable to backdoor attacks due to its distributed nature. Current research often designs attacks based on a single attacker with a single backdoor, overlooking more realistic and complex threats in federated learning. We propose a more practical threat model for federated learning: the distributed multi-target backdoor. In this model, multiple attackers control different clients, embedding various triggers and targeting different classes, collaboratively implanting backdoors into the global model via central aggregation. Empirical validation shows that existing methods struggle to maintain the effectiveness of multiple backdoors in the global model. Our key insight is that similar backdoor triggers cause parameter conflicts and injecting new backdoors disrupts gradient directions, significantly weakening some backdoors performance. To solve this, we propose a Distributed Multi-Target Backdoor Attack (DMBA), ensuring efficiency and persistence of backdoors from different malicious clients. To avoid parameter conflicts, we design a multi-channel dispersed frequency trigger strategy to maximize trigger differences. To mitigate gradient interference, we introduce backdoor replay in local training to neutralize conflicting gradients. Extensive validation shows that 30 rounds after the attack, Attack Success Rates of three different backdoors from various clients remain above 93%. The code will be made publicly available after the review period.

Paper Structure

This paper contains 28 sections, 6 equations, 6 figures, 17 tables.

Table of Contents

  1. Introduction
  2. Related Work
  3. Methodology
  4. New Threat Model
  5. Distributed Multi-Target Trigger
  6. Backdoor Replay Component
  7. Workflow of DMBA
  8. Experiments & Analyses
  9. Experiment Settings
  10. ASR and Attack Persistence of DMBA
  11. Invisibility Assessment
  12. Ablation Studies
  13. Hyperparameter Sensitivity Analyses
  14. Robustness of DMBA against Defenses
  15. Conclusion and Future Work
  16. ...and 13 more sections

Figures (6)

  • Figure 1: ASRs for multiple backdoors in complex attack scenarios.
  • Figure 2: Distributed multi-target trigger strategy. Different attackers convert pixel matrices of various channels into the frequency domain and then perturb different frequency blocks to serve as triggers, activating backdoors with distinct target labels.
  • Figure 3: Workflow of DMBA. (1)Multi-target trigger generation; (2)Local backdoor training; (3)Global model poisoning; (4)Backdoored global model inference.
  • Figure 4: Comparing stealth performances of different attacks on CIFAR-10.
  • Figure 5: Impact of three key factors on DMBA attack performance on CIFAR-10. The three key factors are: (a) Frequency block starting position; (b) Perturbation magnitude; (c) Poisoning ratio and backdoor replay ratio.
  • ...and 1 more figures