POLAR: Policy-based Layerwise Reinforcement Learning Method for Stealthy Backdoor Attacks in Federated Learning

TL;DR

This work tackles backdoor attacks in Federated Learning by targeting backdoor-critical (BC) layers with POLAR, a policy-based reinforcement learning framework that uses Bernoulli sampling to select a sparse, impactful set of layers. The method optimizes layer selection through policy-gradient updates guided by backdoor success rate (BSR) rewards, while a regularization term constrains the footprint to preserve stealth. POLAR demonstrates superior backdoor effectiveness and stealth across multiple models, datasets, and six state-of-the-art defenses, indicating strong generalizability and robustness in realistic FL settings. The approach offers a practical, scalable avenue for adaptive layer-wise attacks, highlighting a need for defensible layer-aware detection and robust aggregation strategies in FL systems.

Abstract

Federated Learning (FL) enables decentralized model training across multiple clients without exposing local data, but its distributed feature makes it vulnerable to backdoor attacks. Despite early FL backdoor attacks modifying entire models, recent studies have explored the concept of backdoor-critical (BC) layers, which poison the chosen influential layers to maintain stealthiness while achieving high effectiveness. However, existing BC layers approaches rely on rule-based selection without consideration of the interrelations between layers, making them ineffective and prone to detection by advanced defenses. In this paper, we propose POLAR (POlicy-based LAyerwise Reinforcement learning), the first pipeline to creatively adopt RL to solve the BC layer selection problem in layer-wise backdoor attack. Different from other commonly used RL paradigm, POLAR is lightweight with Bernoulli sampling. POLAR dynamically learns an attack strategy, optimizing layer selection using policy gradient updates based on backdoor success rate (BSR) improvements. To ensure stealthiness, we introduce a regularization constraint that limits the number of modified layers by penalizing large attack footprints. Extensive experiments demonstrate that POLAR outperforms the latest attack methods by up to 40% against six state-of-the-art (SOTA) defenses.

Figures (6)

• Figure 1: Selected layer distribution of LP Attack.
• Figure 2: Overview of POLAR. In each FL round $r$, the adversary trains both benign and poisoned models to evaluate BSR. A RL agent maintains and updates a logit vector $\theta(r, t)$, from which $K$ binary action vectors are sampled via Bernoulli distributions to determine which layers to poison. The policy is optimized via gradient updates based on BSR rewards. After $T$ steps, the final logit is thresholded to obtain the layer selection $S_{\text{final}}$, which is used to generate the final malicious update submitted to the server.
• Figure 3: Comparison of POLAR and LP Attack performance under RLR and MK defenses on ResNet18.
• Figure 4: Comparison between POLAR and LP Attack. Left: Number of layers selected under RLR defense. Right: Distribution of layers selected.
• Figure 5: Comparison of POLAR and LP Attack on ResNet (CIFAR10). Left: Impacts of different attack intervals $F$ on the attack performance ($F$ indicates that an attack is performed every $F$ rounds). Right: Impacts of different proportions of malicious clients ($C=0.02,0.04,0.06,0.1$) on the attack performance in the fixed-pool setting.