Jul 2026· ACM Transactions on Privacy and Security· Vol 29, pp. 1 - 21· 0 citations· 55 references
TL;DR
This work proposes CAEBA (Conditional AutoEncoder Backdoor Attack), a dynamic hidden backdoor framework that uses a conditional autoencoder to generate target-aware and visually stealthy triggers while progressively implanting the backdoor through federated optimization.
Abstract
Federated Learning (FL) is a privacy-preserving distributed learning framework, but its distributed data collection and client-side training pipeline expose the global model to backdoor attacks. Existing FL backdoor attacks often depend on fixed triggers or on update manipulations that are easier to isolate under robust aggregation and model-inspection defenses. We propose CAEBA (Conditional AutoEncoder Backdoor Attack), a dynamic hidden backdoor framework that uses a conditional autoencoder to generate target-aware and visually stealthy triggers while progressively implanting the backdoor through federated optimization. CAEBA separates the clean classifier from the trigger generator, formulates the attack as a dual-constrained objective, and updates the generator at a lower frequency than the classifier to stabilize local optimization. We evaluate CAEBA on MNIST, FashionMNIST, CIFAR-10, CIFAR-100, and Tiny-ImageNet under representative aggregation rules and defenses, including FL-Detector, RFLBAT, DeepSight, FoolsGold, and FLAME. The results show that CAEBA preserves main-task accuracy while maintaining persistent backdoor effectiveness.
Federated Learning (FL) is vulnerable to backdoor attacks, where adversaries can stealthily manipulate the global model. Most existing defense methods are developed under IID assumptions, an assumption that rarely holds in practice. In highly non-IID settings, heterogeneous data distributions across clients make it difficult to distinguish malicious updates from benign ones, particularly when benign clients exhibit atypical patterns due to minority-class data. To address this challenge, existing defenses operate at different levels of granularity. Coarse-grained methods perform client-level filtering, which often mistakenly excludes benign clients under non-IID conditions. Fine-grained methods instead analyze data at the sample level for more precise detection, but typically rely on explicit per-sample gradient analysis, leading to substantial memory and computational overhead. As a result, defending against backdoor attacks in non-IID environments involves a fundamental trade-off between robustness and computational efficiency. To address this challenge, we propose FedRGD, a federated risk-guided dynamic defense framework that enables efficient fine-grained protection. FedRGD maps sample-level risks into structured parameter masking without requiring explicit per-sample gradient storage. It combines feature inconsistency detection with lightweight masking and robust aggregation to achieve both accuracy and efficiency. Extensive experiments on CIFAR-10 and Fashion-MNIST demonstrate that FedRGD consistently reduces the attack success rate while maintaining high main-task accuracy, achieving a favorable security-utility balance with low computational overhead.
Ruiying Wang· Poster Volume 0008 The 2026...· 0 citations
This work employs the novel dimensionality reduction technique UMAP and a stringent filtering mechanism to effectively identify and exclude potential malicious participants without relying on traditional noise addition methods and demonstrates that the proposed method maintains high main task accuracy while effectively mitigating backdoor attacks across various attack scenarios.
Federated learning (FL) has been widely applied in Internet of Things (IoT) systems. However, its inherently distributed nature makes it vulnerable to backdoor attacks. Existing attacks typically design triggers based on fixed patterns or local models, without considering their applicability to the global model. Consequently, a significant “loss” occurs during the transfer of the backdoor from the local model to the global model, leading to a low Attack Success Rate (ASR). To address this issue, we propose a novel backdoor attack method, termed Federated Generative Adversarial Trigger (FedGAT). The proposed method optimizes the trigger by training it with publicly available global models and a small number of samples. It adopts a Generative Adversarial Network (GAN) framework, in which the discriminator is fixed as the converged global model to guide the generator’s training through feedback. As a result, the generator can automatically produce optimized triggers that are highly correlated with the global model’s feature space, effectively reducing the “loss” in backdoor transfer and improving attack performance. Extensive experiments on multiple datasets demonstrate that, without amplifying malicious updates, the proposed method achieves an ASR improvement of 60.95–80.19% over the average baseline performance on the global model, exhibiting outstanding attack capability. Our work raises new challenges for the secure deployment of FL systems.
Tao Liu, Jiguang Lv, D. Man et al.· Cybersecurity· 0 citations
Vertical Federated Learning (VFL) allows multiple organizations with disjoint feature spaces and overlapping sample identities to collaboratively train machine learning models while keeping local data. Despite its privacy-preserving design, recent studies have shown that VFL is vulnerable to backdoor attacks. In particular, a malicious passive party can inject a carefully crafted trigger into its local inputs or intermediate embeddings, causing the global model to produce targeted mispredictions at inference time. Existing backdoor attacks in VFL (e.g., BadVFL) rely on the assumption that the malicious client can obtain additional knowledge about task labels, which contradicts the core privacy assumptions of VFL. In this paper, we propose GOFA, a new backdoor attack method for VFL scenarios. GOFA uses the gradient feedback from the server to construct a poisoned dataset and employs an adversarial example attack (e.g., FGSM) for masking the original features of the data to enhance trigger learning. We use the CIFAR-10 and UCI-HAR datasets. Our experiments demonstrate the effectiveness of our method in various settings.
Ye Cheng, Naotoshi Adachi· 2026 6th International Confe...· 0 citations
Federated Learning (FL) facilitates distributed training while preserving privacy, yet remains highly vulnerable to backdoor attacks. Existing defenses primarily address these threats via robust aggregation, which reduces the influence of malicious contributions (e.g., pruning, reweighting), or through detection-based filtering that discards anomalous updates prior to aggregation. Nevertheless, existing defenses primarily suppress or discard malicious updates, inevitably sacrificing task-relevant knowledge and leading to reduced clean-task accuracy. To this end, we propose FedPurify, a framework that performs post-training data-free purification to remove malicious backdoors while preserving task-relevant knowledge. Specifically, following global convergence without loss of task-relevant knowledge, FedPurify proposes a fully data-free sample synthesis scheme to generate diverse and representative samples from the converged global model, thereby inherently preserving client privacy in FL. Building upon these synthetic samples, FedPurify further leverages data-free trigger inversion to effectively expose latent backdoor behaviors. Finally, FedPurify combines contrastive feature alignment with knowledge-preserving self-distillation to remove backdoor effects while preserving benign task performance. Extensive experiments verify that FedPurify effectively removes backdoors from the global model with negligible impact on clean performance, outperforming existing defense methods.
Baolu Xue, Hanyuan Zheng, T. Man et al.· Proceedings of the 32nd ACM...· 0 citations
BackDFL is presented, a unified benchmark for systematically evaluating DFL under realistic and adaptive backdoor attacks, and demonstrates that both state-of-the-art Byzantine-robust DFL methods and adapted FL backdoor defenses fail under modest malicious participation rates, especially in heterogeneous settings.
M. Bouchiha, Gregory Blanc, Yufei Han· 0 citations