mlsanityData to 14 Oct 2026

How to Backdoor HyperNetwork in Personalized Federated Learning?

arXiv 2201.07063 ↗First posted 18 Jan 2022cs.LG cs.CRcited by 0

Not on the map. Why?

Abstract (arXiv)

This paper explores previously unknown backdoor risks in HyperNet-based personalized federated learning (HyperNetFL) through poisoning attacks. Based upon that, we propose a novel model transferring attack (called HNTroj), i.e., the first of its kind, to transfer a local backdoor infected model to all legitimate and personalized local models, which are generated by the HyperNetFL model, through consistent and effective malicious local gradients computed across all compromised clients in the whole training process. As a result, HNTroj reduces the number of compromised clients needed to successfully launch the attack without any observable signs of sudden shifts or degradation regarding model utility on legitimate data samples making our attack stealthy. To defend against HNTroj, we adapted several backdoor-resistant FL training algorithms into HyperNetFL. An extensive experiment that is carried out using several benchmark datasets shows that HNTroj significantly outperforms data poisoning and model replacement attacks and bypasses robust training algorithms even with modest numbers of compromised clients.

Key facts. No citing papers in the map yet (data through 14 Oct 2026). Builds on 21 of its 29 references that are in the map. First posted on arXiv 18 Jan 2022.

Builds on

21 of 29 references.

References · 21

  1. 2016Communication-Efficient Learning of Deep Networks from Decentralized Datacited by 7,669
  2. 2017Fashion-MNIST: a Novel Image Dataset for Benchmarking Machine Learning Algorithmscited by 4,349
  3. 2019Advances and Open Problems in Federated Learningcited by 3,046
  4. 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,106
  5. 2016HyperNetworkscited by 1,027
  6. 2018How To Backdoor Federated Learningcited by 765
  7. 2018Byzantine-Robust Distributed Learning: Towards Optimal Statistical Ratescited by 711
  8. 2018Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networkscited by 580
  9. 2019STRIP: A Defence Against Trojan Attacks on Deep Neural Networkscited by 459
  10. 2018Analyzing Federated Learning through an Adversarial Lenscited by 351
  11. 2021Federated Learning on Non-IID Data: A Surveycited by 346
  12. 2018The Hidden Vulnerability of Distributed Learning in Byzantiumcited by 329
9 more
  1. 2019Robust Aggregation for Federated Learningcited by 317
  2. 2017Certified Defenses for Data Poisoning Attackscited by 303
  3. 2021Personalized Federated Learning using Hypernetworkscited by 212
  4. 2020Intrinsic Certified Robustness of Bagging against Data Poisoning Attackscited by 94
  5. 2021CRFL: Certifiably Robust Federated Learning against Backdoor Attackscited by 91
  6. 2016Data Poisoning Attacks on Factorization-Based Collaborative Filteringcited by 83
  7. 2020On the Effectiveness of Mitigating Data Poisoning Attacks with Gradient Shapingcited by 83
  8. 2020Defending against Backdoors in Federated Learning with Robust Learning Ratecited by 82
  9. 2018Technical Report: When Does Machine Learning FAIL? Generalized Transferability for Evasion and Poisoning Attackscited by 81

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2024Lurking in the shadows: Unveiling Stealthy Backdoor Attacks against Personalized Federated Learning
  2. 2025On Hyperparameters and Backdoor-Resistance in Horizontal Federated Learning
  3. 2023You Can Backdoor Personalized Federated Learning
  4. 2023Revisiting Personalized Federated Learning: Robustness Against Backdoor Attacks
  5. 2024Concealing Backdoor Model Updates in Federated Learning by Trigger-Optimized Data Poisoning
  6. 2023Backdoor Attacks and Defenses in Federated Learning: Survey, Challenges and Future Research Directions
  7. 2024Identify Backdoored Model in Federated Learning via Individual Unlearning
  8. 2025Bad-PFL: Exploring Backdoor Attacks against Personalized Federated Learning