mlsanityData to 7 Oct 2026

How To Backdoor Federated Learning

arXiv 1807.00459 ↗First posted 2 Jul 2018cs.CR cs.LGcited by 745

Not on the map. Why?

Cited by 94 in LLM safety and security, but placed by its own abstract, which didn’t fit.

Abstract (arXiv)

Federated learning enables thousands of participants to construct a deep learning model without sharing their private training data with each other. For example, multiple smartphones can jointly train a next-word predictor for keyboards without revealing what individual users type. We demonstrate that any participant in federated learning can introduce hidden backdoor functionality into the joint global model, e.g., to ensure that an image classifier assigns an attacker-chosen label to images with certain features, or that a word predictor completes certain sentences with an attacker-chosen word. We design and evaluate a new model-poisoning methodology based on model replacement. An attacker selected in a single round of federated learning can cause the global model to immediately reach 100% accuracy on the backdoor task. We evaluate the attack under different assumptions for the standard federated-learning tasks and show that it greatly outperforms data poisoning. Our generic constrain-and-scale technique also evades anomaly detection-based defenses by incorporating the evasion into the attacker's loss function during training.

Key facts. Cited by 745 papers in the map (data through 7 Oct 2026). First posted on arXiv 2 Jul 2018.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2020: 1; 2021: 126; 2022: 121; 2023: 147; 2024: 141; 2025: 127; 2026: 82.

745 papers.

Sort:

By area:

  1. 2021Neural Attention Distillation: Erasing Backdoor Triggers from Deep Neural Networkscited by 313
  2. 2021A Field Guide to Federated Optimizationcited by 312
  3. 2024PoisonedRAG: Knowledge Corruption Attacks to Retrieval-Augmented Generation of Large Language Modelscited by 251
  4. 2021FjORD: Fair and Accurate Federated Learning under heterogeneous targets with Ordered Dropoutcited by 192
  5. 2023Heterogeneous Federated Learning: State-of-the-art and Research Challengescited by 160
  6. 2021Advances in adversarial attacks and defenses in computer vision: A surveycited by 127
  7. 2021BadEncoder: Backdoor Attacks to Pre-trained Encoders in Self-Supervised Learningcited by 120
  8. 2022FLDetector: Defending Federated Learning Against Model Poisoning Attacks via Detecting Malicious Clientscited by 119
  9. 2021Back to the Drawing Board: A Critical Evaluation of Poisoning Attacks on Production Federated Learningcited by 116
  10. 2021Adversarial Examples Make Strong Poisonscited by 115
  11. 2021Sleeper Agent: Scalable Hidden Trigger Backdoors for Neural Networks Trained from Scratchcited by 98
  12. 2022Neurotoxin: Durable Backdoors in Federated Learningcited by 97
38 more
  1. 2023Federated Learning for Generalization, Robustness, Fairness: A Survey and Benchmarkcited by 97
  2. 2021Backdoor Scanning for Deep Neural Networks through K-Arm Optimizationcited by 96
  3. 2022Truth Serum: Poisoning Machine Learning Models to Reveal Their Secretscited by 94
  4. 2021PPFL: Privacy-preserving Federated Learning with Trusted Execution Environmentscited by 93
  5. 2022Wild Patterns Reloaded: A Survey of Machine Learning Security against Training Data Poisoningcited by 93
  6. 2021CRFL: Certifiably Robust Federated Learning against Backdoor Attackscited by 91
  7. 2022Federated Unlearning: How to Efficiently Erase a Client in FL?cited by 90
  8. 2022FedPrompt: Communication-Efficient and Privacy Preserving Prompt Tuning in Federated Learningcited by 86
  9. 2023Decentralized Federated Learning: A Survey and Perspectivecited by 86
  10. 2024Harmful Fine-tuning Attacks and Defenses for Large Language Models: A Surveycited by 86
  11. 2023Multimodal Federated Learning via Contrastive Representation Ensemblecited by 85
  12. 2021Federated Learning: Opportunities and Challengescited by 83
  13. 2022Survey on Federated Learning Threats: concepts, taxonomy on attacks and defences, experimental study and challengescited by 81
  14. 2022DeepSight: Mitigating Backdoor Attacks in Federated Learning Through Deep Model Inspectioncited by 78
  15. 2021CAFE: Catastrophic Data Leakage in Vertical Federated Learningcited by 76
  16. 2023Unleashing the potential of prompt engineering for large language modelscited by 72
  17. 2021Black-box Detection of Backdoor Attacks with Limited Information and Datacited by 71
  18. 2022Federated Unlearning with Knowledge Distillationcited by 70
  19. 2021Spinning Language Models: Risks of Propaganda-As-A-Service and Countermeasurescited by 69
  20. 2021From Distributed Machine Learning to Federated Learning: A Surveycited by 65
  21. 2022MPAF: Model Poisoning Attacks to Federated Learning based on Fake Clientscited by 65
  22. 2022The "Beatrix'' Resurrections: Robust Backdoor Detection via Gram Matricescited by 62
  23. 2021Provably Secure Federated Learning against Malicious Clientscited by 60
  24. 2021Federated Multi-Armed Banditscited by 59
  25. 2021Privacy-Preserving Machine Learning: Methods, Challenges and Directionscited by 58
  26. 2021Property Inference From Poisoningcited by 56
  27. 2021T-Miner: A Generative Approach to Defend Against Trojan Attacks on DNN-based Text Classificationcited by 56
  28. 2021FedLab: A Flexible Federated Learning Frameworkcited by 54
  29. 2022FedRecover: Recovering from Poisoning Attacks in Federated Learning using Historical Informationcited by 53
  30. 2023Federated Continual Learning via Knowledge Fusion: A Surveycited by 53
  31. 2024Instruction Backdoor Attacks Against Customized LLMscited by 50
  32. 2024Byzantine-Robust Decentralized Federated Learningcited by 47
  33. 2021SparseFed: Mitigating Model Poisoning Attacks in Federated Learning with Sparsificationcited by 46
  34. 2021Survey: Leakage and Privacy at Inference Timecited by 44
  35. 2020Towards Crowdsourced Training of Large Neural Networks using Decentralized Mixture-of-Expertscited by 43
  36. 2021Gradient Disaggregation: Breaking Privacy in Federated Learning by Reconstructing the User Participant Matrixcited by 43
  37. 2021An Overview of Backdoor Attacks Against Deep Neural Networks and Possible Defencescited by 41
  38. 2022VeriFi: Towards Verifiable Federated Unlearningcited by 41

50 most cited of 745 All 745 (JSON)