Unveiling Hidden Threats: Using Fractal Triggers to Boost Stealthiness of Distributed Backdoor Attacks in Federated Learning
Jian Wang, Hong Shen, Chan-Tong Lam
TL;DR
FTDBA tackles the efficiency-stealth trade-off in distributed backdoor attacks on federated learning by injecting fractal self-similar triggers whose strength is preserved across decomposition. It combines Koch-curve fractal triggers generated via an iterated function system with a dynamic angular perturbation schedule to mask frequency-domain signatures while maintaining attack efficacy. Theoretical analyses establish strength preservation, spectral stealth, sample-efficiency gains, convergence guarantees, and information-theoretic stealth bounds, and experiments on CIFAR-10 and ImageNet show substantial reductions in poisoning volume (≈62% less) with high ASR (≈92%) and low detectability. The work highlights a new adversarial paradigm leveraging fractal geometry and has implications for defense design and future fractal-based adversarial methods.
Abstract
Traditional distributed backdoor attacks (DBA) in federated learning improve stealthiness by decomposing global triggers into sub-triggers, which however requires more poisoned data to maintian the attck strength and hence increases the exposure risk. To overcome this defect, This paper proposes a novel method, namely Fractal-Triggerred Distributed Backdoor Attack (FTDBA), which leverages the self-similarity of fractals to enhance the feature strength of sub-triggers and hence significantly reduce the required poisoning volume for the same attack strength. To address the detectability of fractal structures in the frequency and gradient domains, we introduce a dynamic angular perturbation mechanism that adaptively adjusts perturbation intensity across the training phases to balance efficiency and stealthiness. Experiments show that FTDBA achieves a 92.3\% attack success rate with only 62.4\% of the poisoning volume required by traditional DBA methods, while reducing the detection rate by 22.8\% and KL divergence by 41.2\%. This study presents a low-exposure, high-efficiency paradigm for federated backdoor attacks and expands the application of fractal features in adversarial sample generation.