Can You Really Backdoor Federated Learning?
Not on the map. Why?
Cited by 34 in LLM safety and security, but placed by its own abstract, which didn’t fit.
Abstract (arXiv)
The decentralized nature of federated learning makes detecting and defending against adversarial attacks a challenging task. This paper focuses on backdoor attacks in the federated learning setting, where the goal of the adversary is to reduce the performance of the model on targeted tasks while maintaining good performance on the main task. Unlike existing works, we allow non-malicious clients to have correctly labeled samples from the targeted tasks. We conduct a comprehensive study of backdoor attacks and defenses for the EMNIST dataset, a real-life, user-partitioned, and non-iid dataset. We observe that in the absence of defenses, the performance of the attack largely depends on the fraction of adversaries present and the "complexity'' of the targeted task. Moreover, we show that norm clipping and "weak'' differential privacy mitigate the attacks without hurting the overall performance. We have implemented the attacks and defenses in TensorFlow Federated (TFF), a TensorFlow framework for federated learning. In open-sourcing our code, our goal is to encourage researchers to contribute new attacks and defenses and evaluate them on standard federated datasets.
Key facts. Cited by 255 papers in the map (data through 14 Oct 2026). First posted on arXiv 18 Nov 2019.
Builds on
No reference list yet.
Built on by
Citing papers per year: 2021: 37; 2022: 45; 2023: 67; 2024: 44; 2025: 35; 2026: 27.
255 papers.
Sort:
By area:
- 2023Heterogeneous Federated Learning: State-of-the-art and Research Challengescited by 161
- 2021FedScale: Benchmarking Model and System Performance of Federated Learning at Scalecited by 136
- 2021SPECTRE: Defending Against Backdoor Attacks Using Robust Statisticscited by 130
- 2021Back to the Drawing Board: A Critical Evaluation of Poisoning Attacks on Production Federated Learningcited by 118
- 2023Federated Learning for Generalization, Robustness, Fairness: A Survey and Benchmarkcited by 99
- 2022Neurotoxin: Durable Backdoors in Federated Learningcited by 98
- 2022Wild Patterns Reloaded: A Survey of Machine Learning Security against Training Data Poisoningcited by 94
- 2021PPFL: Privacy-preserving Federated Learning with Trusted Execution Environmentscited by 93
- 2021CRFL: Certifiably Robust Federated Learning against Backdoor Attackscited by 91
- 2021Federated Learning: Opportunities and Challengescited by 84
- 2022Survey on Federated Learning Threats: concepts, taxonomy on attacks and defences, experimental study and challengescited by 84
- 2022DeepSight: Mitigating Backdoor Attacks in Federated Learning Through Deep Model Inspectioncited by 81
38 more
- 2021BACKDOORL: Backdoor Attack against Competitive Reinforcement Learningcited by 68
- 2022MPAF: Model Poisoning Attacks to Federated Learning based on Fake Clientscited by 68
- 2021From Distributed Machine Learning to Federated Learning: A Surveycited by 66
- 2021SparseFed: Mitigating Model Poisoning Attacks in Federated Learning with Sparsificationcited by 46
- 2022VeriFi: Towards Verifiable Federated Unlearningcited by 46
- 2022Hidden Poison: Machine Unlearning Enables Camouflaged Poisoning Attackscited by 43
- 2023Recent Advances on Federated Learning: A Systematic Surveycited by 41
- 2022FLIP: A Provable Defense Framework for Backdoor Mitigation in Federated Learningcited by 37
- 2021FedIPR: Ownership Verification for Federated Deep Neural Network Modelscited by 36
- 2021FL-WBC: Enhancing Robustness against Model Poisoning Attacks in Federated Learning from a Client Perspectivecited by 36
- 2023Backdoor Attacks and Defenses in Federated Learning: Survey, Challenges and Future Research Directionscited by 33
- 2021FedCV: A Federated Learning Framework for Diverse Computer Vision Taskscited by 32
- 2023Integration of Large Language Models and Federated Learningcited by 31
- 2022Byzantine-Robust Federated Learning with Optimal Statistical Rates and Privacy Guaranteescited by 30
- 2022AFLGuard: Byzantine-robust Asynchronous Federated Learningcited by 29
- 2023Label Poisoning is All You Needcited by 29
- 2023FreqFed: A Frequency Analysis-Based Approach for Mitigating Poisoning Attacks in Federated Learningcited by 27
- 2022TCT: Convexifying Federated Learning using Bootstrapped Neural Tangent Kernelscited by 26
- 2021RoFL: Robustness of Secure Federated Learningcited by 25
- 2022A Survey on Federated Recommendation Systemscited by 25
- 2023A Survey of Trustworthy Federated Learning with Perspectives on Security, Robustness, and Privacycited by 24
- 2023BayBFed: Bayesian Backdoor Defense for Federated Learningcited by 23
- 2023Multi-metrics adaptively identifies backdoors in Federated learningcited by 23
- 2021Curse or Redemption? How Data Heterogeneity Affects the Robustness of Federated Learningcited by 21
- 2021Federated Learning with Taskonomy for Non-IID Datacited by 21
- 2023Chameleon: Adapting to Peer Images for Planting Durable Backdoors in Federated Learningcited by 21
- 2023FedSecurity: Benchmarking Attacks and Defenses in Federated Learning and Federated LLMscited by 21
- 2022APPFL: Open-Source Software Framework for Privacy-Preserving Federated Learningcited by 20
- 2023Backdoor Federated Learning by Poisoning Backdoor-Critical Layerscited by 18
- 2023Zero-Knowledge Proof-based Verifiable Decentralized Machine Learning in Communication Network: A Comprehensive Surveycited by 18
- 2023Data and Model Poisoning Backdoor Attacks on Wireless Federated Learning, and the Defense Mechanisms: A Comprehensive Surveycited by 18
- 2021Robust Federated Learning with Attack-Adaptive Aggregationcited by 17
- 2023Federated Learning as Variational Inference: A Scalable Expectation Propagation Approachcited by 17
- 2023FLINT: A Platform for Federated Learning Integrationcited by 17
- 2021Batch Label Inference and Replacement Attacks in Black-Boxed Vertical Federated Learningcited by 16
- 2023Revisiting Personalized Federated Learning: Robustness Against Backdoor Attackscited by 16
- 2024Beyond Traditional Threats: A Persistent Backdoor Attack on Federated Learningcited by 16
- 2022FL-Defender: Combating Targeted Attacks in Federated Learningcited by 15
50 most cited of 255 All 255 (JSON)
- 2026PVBRF-ID: Private, Verifiable and Byzantine-Robust Federated Intrusion Detection for Oilfield Enterprise Networks8 Oct 2026
- 2026Compression Footprints as Security Signals for Model-Poisoning Defense in Federated Learning30 Sep 2026
- 2026Physics-Attested Federated Learning: Securing Collaborative Anomaly Detection in Critical Water Infrastructure28 Sep 2026
- 2026Upholding Robustness in Federated Learning: Trends, Emerging Strategies, and Research Opportunities23 Sep 2026
- 2026Optimizing Byzantine Node Placement in Decentralized Federated Learning1 Sep 2026
- 2026BackDFL: A Unified Benchmark For Backdoor Attacks and Defenses In Decentralized Federated Learning21 Aug 2026
- 2026FedLNS: Leverage LayerNorm Signature Modeling to Mitigate Adversarial Manipulation in Federated LLMs19 Aug 2026
- 2026Bypassing Krum: Selection-Aware Backdoor Attacks in Federated Learning6 Aug 2026
- 2026Robust and Personalized Federated Learning for Aircraft-Engine Prognostics under Benign and Adversarial Client Heterogeneity4 Aug 2026
- 2026FedCVESA: Taking Away Training Data in Federated Learning via Correlation Value Encoding and Segmented Aggregation8 Jul 2026
- 2026The Power of Backdoor Absorption in Community Training7 Jul 2026
- 2026Color Matters: Trigger Color Affects Success in Federated Backdoor Attacks24 Jun 2026
38 more
- 2026Your Privacy My Cloak: Backdoor Attacks on Differentially Private Federated Learning15 Jun 2026
- 2026Model Poisoning Against Federated Model Adaptation with Chain of Bit-Flips8 Jun 2026
- 2026RogueMerge: Robust and Unified Attacks against LLM Model Merging2 Jun 2026
- 2026EnCAgg: Enhanced Clustering Aggregation for Robust Federated Learning against Dynamic Model Poisoning21 May 2026
- 2026Automated Byzantine-Resilient Clustered Decentralized Federated Learning for Battery Intelligence in Connected EVs20 May 2026
- 2026FedSurrogate: Backdoor Defense in Federated Learning via Layer Criticality and Surrogate Replacement11 May 2026
- 2026SafeLM: Unified Privacy-Aware Optimization for Trustworthy Federated Large Language Models17 Apr 2026
- 2026XFED: Non-Collusive Model Poisoning Attack Against Byzantine-Robust Federated Classifiers10 Apr 2026
- 2026Beyond Corner Patches: Semantics-Aware Backdoor Attack in Federated Learning31 Mar 2026
- 2026Privacy-Preserving Machine Learning for IoT: A Cross-Paradigm Survey and Future Roadmap13 Mar 2026
- 2026TASER: Task-Aware Spectral Energy Refine for Backdoor Suppression in UAV Swarms Decentralized Federated Learning10 Mar 2026
- 2026Benchmarking Federated Learning in Edge Computing Environments: A Systematic Review and Performance Evaluation24 Feb 2026
- 2026ADCA: Attention-Driven Multi-Party Collusion Attack in Federated Self-Supervised Learning5 Feb 2026
- 2026Beyond Denial-of-Service: The Puppeteer's Attack for Fine-Grained Control in Ranking-Based Federated Learning21 Jan 2026
- 2026FAROS: Robust Federated Learning with Adaptive Scaling against Backdoor Attacks5 Jan 2026
- 2025GShield: Mitigating Poisoning Attacks in Federated Learning22 Dec 2025
- 2025Practical Framework for Privacy-Preserving and Byzantine-robust Federated Learning19 Dec 2025
- 2025SpectralKrum: A Spectral-Geometric Defense Against Byzantine Attacks in Federated Learning12 Dec 2025
- 2025Watch Out for the Lifespan: Evaluating Backdoor Attacks Against Federated Model Adaptation18 Nov 2025
- 2025Unveiling Hidden Threats: Using Fractal Triggers to Boost Stealthiness of Distributed Backdoor Attacks in Federated Learning12 Nov 2025
- 2025Enhancing the Effectiveness and Durability of Backdoor Attacks in Federated Learning through Maximizing Task Distinction23 Sep 2025
- 2025On Evaluating the Poisoning Robustness of Federated Learning under Local Differential Privacy5 Sep 2025
- 2025FedThief: Harming Others to Benefit Oneself in Self-Centered Federated Learning30 Aug 2025
- 2025Practical Feasibility of Gradient Inversion Attacks in Federated Learning27 Aug 2025
- 2025BadFU: Backdoor Federated Learning through Adversarial Machine Unlearning21 Aug 2025
- 2025BadPromptFL: A Novel Backdoor Threat to Prompt-based Federated Learning in Multimodal Models11 Aug 2025
- 2025Coward: Collision-based OOD Watermarking for Practical Proactive Federated Backdoor Detection4 Aug 2025
- 2025A Privacy-Preserving Federated Framework with Hybrid Quantum-Enhanced Learning for Financial Fraud Detection15 Jul 2025
- 2025Find a Scapegoat: Poisoning Membership Inference Attack and Defense to Federated Learning1 Jul 2025
- 2025SABRE-FL: Selective and Accurate Backdoor Rejection for Federated Prompt Learning25 Jun 2025
- 2025Client Clustering Meets Knowledge Sharing: Enhancing Privacy and Robustness in Personalized Peer-to-Peer Learning25 Jun 2025
- 2025TimberStrike: Dataset Reconstruction Attack Revealing Privacy Leakage in Federated Tree-Based Systems9 Jun 2025
- 2025ATR-Bench: A Federated Learning Benchmark for Adaptation, Trust, and Reasoning22 May 2025
- 2025Performance Guaranteed Poisoning Attacks in Federated Learning: A Sliding Mode Approach22 May 2025
- 2025FedGraM: Defending Against Untargeted Attacks in Federated Learning via Embedding Gram Matrix20 May 2025
- 2025FL-PLAS: Federated Learning with Partial Layer Aggregation for Backdoor Defense Against High-Ratio Malicious Clients17 May 2025
- 2025Defending the Edge: Representative-Attention Defense against Backdoor Attacks in Federated Learning15 May 2025
- 2025TrojanDam: Detection-Free Backdoor Defense in Federated Learning through Proactive Model Robustification utilizing OOD Data22 Apr 2025
50 newest of 255 All 255 (JSON)
- 2022Wild Patterns Reloaded: A Survey of Machine Learning Security against Training Data Poisoningcited by 94
- 2022VeriFi: Towards Verifiable Federated Unlearningcited by 46
- 2022Hidden Poison: Machine Unlearning Enables Camouflaged Poisoning Attackscited by 43
- 2021FedIPR: Ownership Verification for Federated Deep Neural Network Modelscited by 36
- 2023Label Poisoning is All You Needcited by 29
- 2021Curse or Redemption? How Data Heterogeneity Affects the Robustness of Federated Learningcited by 21
- 2021Robust Federated Learning with Attack-Adaptive Aggregationcited by 17
- 2022Backdoor Attack and Defense in Federated Generative Adversarial Network-based Medical Image Synthesiscited by 12
- 2023FedCIP: Federated Client Intellectual Property Protection with Traitor Trackingcited by 12
- 2021Meta Federated Learningcited by 8
- 2023Secure Federated Learning against Model Poisoning Attacks via Client Filteringcited by 8
- 2022Thinking Two Moves Ahead: Anticipating Other Users Improves Backdoor Attacks in Federated Learningcited by 7
12 most cited of 33 All 33 (JSON)
- 2026Robust and Personalized Federated Learning for Aircraft-Engine Prognostics under Benign and Adversarial Client Heterogeneity4 Aug 2026
- 2026Model Poisoning Against Federated Model Adaptation with Chain of Bit-Flips8 Jun 2026
- 2026SafeLM: Unified Privacy-Aware Optimization for Trustworthy Federated Large Language Models17 Apr 2026
- 2026ADCA: Attention-Driven Multi-Party Collusion Attack in Federated Self-Supervised Learning5 Feb 2026
- 2025Find a Scapegoat: Poisoning Membership Inference Attack and Defense to Federated Learning1 Jul 2025
- 2025SABRE-FL: Selective and Accurate Backdoor Rejection for Federated Prompt Learning25 Jun 2025
- 2025FedNIA: Noise-Induced Activation Analysis for Mitigating Data Poisoning in Federated Learning23 Feb 2025
- 2025DROP: Poison Dilution via Knowledge Distillation for Federated Learning10 Feb 2025
- 2024Securing Federated Learning against Backdoor Threats with Foundation Model Integration23 Oct 2024
- 2024Hypnopaedia-Aware Machine Unlearning via Psychometrics of Artificial Mental Imagery29 Sep 2024
- 2024Data Poisoning and Leakage Analysis in Federated Learning19 Sep 2024
- 2024Mitigating Malicious Attacks in Federated Learning via Confidence-aware Defense5 Aug 2024
12 newest of 33 All 33 (JSON)
- 2021Robust Federated Learning by Mixture of Expertscited by 4
- 2021Robust Federated Learning by Mixture of Experts23 Apr 2021
- 2023Heterogeneous Federated Learning: State-of-the-art and Research Challengescited by 161
- 2021FedScale: Benchmarking Model and System Performance of Federated Learning at Scalecited by 136
- 2021SPECTRE: Defending Against Backdoor Attacks Using Robust Statisticscited by 130
- 2021Back to the Drawing Board: A Critical Evaluation of Poisoning Attacks on Production Federated Learningcited by 118
- 2023Federated Learning for Generalization, Robustness, Fairness: A Survey and Benchmarkcited by 99
- 2022Neurotoxin: Durable Backdoors in Federated Learningcited by 98
- 2021PPFL: Privacy-preserving Federated Learning with Trusted Execution Environmentscited by 93
- 2021CRFL: Certifiably Robust Federated Learning against Backdoor Attackscited by 91
- 2021Federated Learning: Opportunities and Challengescited by 84
- 2022Survey on Federated Learning Threats: concepts, taxonomy on attacks and defences, experimental study and challengescited by 84
- 2022DeepSight: Mitigating Backdoor Attacks in Federated Learning Through Deep Model Inspectioncited by 81
- 2021BACKDOORL: Backdoor Attack against Competitive Reinforcement Learningcited by 68
12 most cited of 218 All 218 (JSON)
- 2026PVBRF-ID: Private, Verifiable and Byzantine-Robust Federated Intrusion Detection for Oilfield Enterprise Networks8 Oct 2026
- 2026Compression Footprints as Security Signals for Model-Poisoning Defense in Federated Learning30 Sep 2026
- 2026Physics-Attested Federated Learning: Securing Collaborative Anomaly Detection in Critical Water Infrastructure28 Sep 2026
- 2026Upholding Robustness in Federated Learning: Trends, Emerging Strategies, and Research Opportunities23 Sep 2026
- 2026Optimizing Byzantine Node Placement in Decentralized Federated Learning1 Sep 2026
- 2026BackDFL: A Unified Benchmark For Backdoor Attacks and Defenses In Decentralized Federated Learning21 Aug 2026
- 2026FedLNS: Leverage LayerNorm Signature Modeling to Mitigate Adversarial Manipulation in Federated LLMs19 Aug 2026
- 2026Bypassing Krum: Selection-Aware Backdoor Attacks in Federated Learning6 Aug 2026
- 2026FedCVESA: Taking Away Training Data in Federated Learning via Correlation Value Encoding and Segmented Aggregation8 Jul 2026
- 2026The Power of Backdoor Absorption in Community Training7 Jul 2026
- 2026Color Matters: Trigger Color Affects Success in Federated Backdoor Attacks24 Jun 2026
- 2026Your Privacy My Cloak: Backdoor Attacks on Differentially Private Federated Learning15 Jun 2026
12 newest of 218 All 218 (JSON)