Jul 2026· 2026 6th International Conference on Electrical, Computer and Energy Technologies (ICECET)· pp. 1-6· 0 citations· 5 references
Abstract
Vertical Federated Learning (VFL) allows multiple organizations with disjoint feature spaces and overlapping sample identities to collaboratively train machine learning models while keeping local data. Despite its privacy-preserving design, recent studies have shown that VFL is vulnerable to backdoor attacks. In particular, a malicious passive party can inject a carefully crafted trigger into its local inputs or intermediate embeddings, causing the global model to produce targeted mispredictions at inference time. Existing backdoor attacks in VFL (e.g., BadVFL) rely on the assumption that the malicious client can obtain additional knowledge about task labels, which contradicts the core privacy assumptions of VFL. In this paper, we propose GOFA, a new backdoor attack method for VFL scenarios. GOFA uses the gradient feedback from the server to construct a poisoned dataset and employs an adversarial example attack (e.g., FGSM) for masking the original features of the data to enhance trigger learning. We use the CIFAR-10 and UCI-HAR datasets. Our experiments demonstrate the effectiveness of our method in various settings.
This work proposes CAEBA (Conditional AutoEncoder Backdoor Attack), a dynamic hidden backdoor framework that uses a conditional autoencoder to generate target-aware and visually stealthy triggers while progressively implanting the backdoor through federated optimization.
Federated Learning (FL) has emerged as a leading paradigm for privacy-preserving machine learning, yet the distributed nature of FL introduces unique security challenges, notably the threat of backdoor attacks. However, existing attack strategies face a critical limitation: reliance on end-to-end supervision creates a task-divergence that produces detectable model updates, while the use of fixed triggers is poorly aligned with FL’s evolving global model, leading to limited persistence. To address this limitation, we propose Spa, a novel framework for stealthy and persistent backdoors. Instead of creating a conflicting secondary task, Spa leverages feature-space alignment to seamlessly integrate backdoor features into the primary collaborative objective, thus ensuring stealth. Furthermore, to overcome the fixed-trigger challenge, Spa introduces an adversarial dynamic trigger optimization that mines the current global model for intrinsic vulnerabilities. This creates an adaptive trigger that co-evolves with the learning process, ensuring both efficacy and persistence. Extensive experiments demonstrate that Spa achieves high attack success rates (nearly 100%) with minimal impact on model utility, maintains robustness under data heterogeneity, and exhibits persistence (remains effective around 900 FL rounds after stop attacking), outperforming conventional techniques. Our results highlight the importance of further investigation into this new class of emerging threats and emphasize the need for advanced, feature-level defense techniques.
Chengcheng Zhu, Ye Li, Bosen Rao et al.· IEEE Transactions on Informa...· 0 citations
The rapid adoption of Internet of Things (IoT) devices has accelerated the need for privacy-preserving machine learning techniques, such as federated learning (FL). However, the decentralized and collaborative nature of FL makes it vulnerable to backdoor attacks, where adversaries locally update their malicious models before contributing to the global aggregation, subtly injecting backdoors without degrading the normal performance. An affected model behaves as expected during regular operations but exhibits malicious behavior when an embedded trigger is presented. In this article, we propose a novel self-supervised contrastive-learning-based approach to detect and mitigate backdoor attacks in FL within IoT environments. Unlike conventional reverse-engineering methods that iterate through each class in the dataset to reconstruct triggers, our approach directly regenerates triggers from compromised global models without class iteration. This is achieved by comparing last-layer feature representations of a potentially compromised model with those of a relatively clean model under the guidance of contrastive loss. The reverse-engineered trigger is then leveraged to patch the global model and remove the backdoors. We evaluate our method on three benchmark datasets under two federated backdoor attack scenarios, simulating IoT device collaborations. Extended experiments are also conducted on a transformer-based model and two mitigation methods to assess the robustness of our approach. Our results demonstrate that while traditional reverse-engineering techniques are effective in centralized settings, they struggle to detect backdoors in FL. Comparatively, our method is resilient against backdoor attacks across various settings. In addition, our method is more time-efficient because of its capability of generating the backdoor trigger directly without iterating through all classes.
Hal Ferguson, Rui Ning, Hongyi Wu et al.· IEEE Internet of Things Jour...· 0 citations
This work reveals that backdoor behaviors tend to be absorbed by a simpler parallel branch when jointly trained with the main network, and proposes Trapping and Removing (TR), a simple yet effective training-time defense that introduces a lightweight shortcut branch as a "honeypot" to trap backdoor knowledge.
Zixuan Zhu, Rui Wang, Lihua Jing et al.· 0 citations
Federated Learning (FL) is vulnerable to backdoor attacks, where adversaries can stealthily manipulate the global model. Most existing defense methods are developed under IID assumptions, an assumption that rarely holds in practice. In highly non-IID settings, heterogeneous data distributions across clients make it difficult to distinguish malicious updates from benign ones, particularly when benign clients exhibit atypical patterns due to minority-class data. To address this challenge, existing defenses operate at different levels of granularity. Coarse-grained methods perform client-level filtering, which often mistakenly excludes benign clients under non-IID conditions. Fine-grained methods instead analyze data at the sample level for more precise detection, but typically rely on explicit per-sample gradient analysis, leading to substantial memory and computational overhead. As a result, defending against backdoor attacks in non-IID environments involves a fundamental trade-off between robustness and computational efficiency. To address this challenge, we propose FedRGD, a federated risk-guided dynamic defense framework that enables efficient fine-grained protection. FedRGD maps sample-level risks into structured parameter masking without requiring explicit per-sample gradient storage. It combines feature inconsistency detection with lightweight masking and robust aggregation to achieve both accuracy and efficiency. Extensive experiments on CIFAR-10 and Fashion-MNIST demonstrate that FedRGD consistently reduces the attack success rate while maintaining high main-task accuracy, achieving a favorable security-utility balance with low computational overhead.
Ruiying Wang· Poster Volume 0008 The 2026...· 0 citations
Federated learning (FL) has been widely applied in Internet of Things (IoT) systems. However, its inherently distributed nature makes it vulnerable to backdoor attacks. Existing attacks typically design triggers based on fixed patterns or local models, without considering their applicability to the global model. Consequently, a significant “loss” occurs during the transfer of the backdoor from the local model to the global model, leading to a low Attack Success Rate (ASR). To address this issue, we propose a novel backdoor attack method, termed Federated Generative Adversarial Trigger (FedGAT). The proposed method optimizes the trigger by training it with publicly available global models and a small number of samples. It adopts a Generative Adversarial Network (GAN) framework, in which the discriminator is fixed as the converged global model to guide the generator’s training through feedback. As a result, the generator can automatically produce optimized triggers that are highly correlated with the global model’s feature space, effectively reducing the “loss” in backdoor transfer and improving attack performance. Extensive experiments on multiple datasets demonstrate that, without amplifying malicious updates, the proposed method achieves an ASR improvement of 60.95–80.19% over the average baseline performance on the global model, exhibiting outstanding attack capability. Our work raises new challenges for the secure deployment of FL systems.
Tao Liu, Jiguang Lv, D. Man et al.· Cybersecurity· 0 citations
