mlsanityData to 7 Oct 2026

Thinking Two Moves Ahead: Anticipating Other Users Improves Backdoor Attacks in Federated Learning

arXiv 2210.09305 ↗First posted 17 Oct 2022cs.LG cs.CRcited by 7

On the map: LLM safety and security → Federated unlearning and poisoning

Abstract (arXiv)

Federated learning is particularly susceptible to model poisoning and backdoor attacks because individual users have direct control over the training data and model updates. At the same time, the attack power of an individual user is limited because their updates are quickly drowned out by those of many other users. Existing attacks do not account for future behaviors of other users, and thus require many sequential updates and their effects are quickly erased. We propose an attack that anticipates and accounts for the entire federated learning pipeline, including behaviors of other clients, and ensures that backdoors are effective quickly and persist even after multiple rounds of community updates. We show that this new attack is effective in realistic scenarios where the attacker only contributes to a small fraction of randomly sampled rounds and demonstrate this attack on image classification, next-word prediction, and sentiment analysis.

Key facts. Cited by 7 papers in the map (data through 7 Oct 2026). Placed in Federated unlearning and poisoning, one of 12 directions in LLM safety and security. Builds on 35 of its 46 references that are in the map. First posted on arXiv 17 Oct 2022.

Builds on

35 of 46 references.

References · 35

  1. 2017Attention Is All You Needcited by 59,932
  2. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  3. 2016Communication-Efficient Learning of Deep Networks from Decentralized Datacited by 7,592
  4. 2015Batch Normalization: Accelerating Deep Network Training by Reducing Internal Covariate Shiftcited by 6,979
  5. 2018Group Normalizationcited by 1,514
  6. 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,052
  7. 2019Measuring the Effects of Non-Identical Data Distribution for Federated Visual Classificationcited by 836
  8. 2019Towards Federated Learning at Scale: System Designcited by 826
  9. 2018LEAF: A Benchmark for Federated Settingscited by 780
  10. 2018How To Backdoor Federated Learningcited by 745
  11. 2018Byzantine-Robust Distributed Learning: Towards Optimal Statistical Ratescited by 698
  12. 2018Federated Learning for Mobile Keyboard Predictioncited by 565
23 more
  1. 2021FedBN: Federated Learning on Non-IID Features via Local Batch Normalizationcited by 565
  2. 2019Local Model Poisoning Attacks to Byzantine-Robust Federated Learningcited by 479
  3. 2017Wild Patterns: Ten Years After the Rise of Adversarial Machine Learningcited by 411
  4. 2018Analyzing Federated Learning through an Adversarial Lenscited by 346
  5. 2021A Field Guide to Federated Optimizationcited by 312
  6. 2020Attack of the Tails: Yes, You Really Can Backdoor Federated Learningcited by 307
  7. 2019A Little Is Enough: Circumventing Defenses For Distributed Learningcited by 285
  8. 2019Can You Really Backdoor Federated Learning?cited by 250
  9. 2015Federated Optimization:Distributed Optimization Beyond the Datacentercited by 193
  10. 2017Towards Poisoning of Deep Learning Algorithms with Back-gradient Optimizationcited by 188
  11. 2020Blind Backdoors in Deep Learning Modelscited by 174
  12. 2020Dataset Security for Machine Learning: Data Poisoning, Backdoor Attacks, and Defensescited by 171
  13. 2021Back to the Drawing Board: A Critical Evaluation of Poisoning Attacks on Production Federated Learningcited by 116
  14. 2020MetaPoison: Practical General-purpose Clean-label Data Poisoningcited by 114
  15. 2022Wild Patterns Reloaded: A Survey of Machine Learning Security against Training Data Poisoningcited by 93
  16. 2021Federated Evaluation and Tuning for On-Device Personalization: System Design & Applicationscited by 84
  17. 2022FLUTE: A Scalable, Extensible Framework for High-Performance Federated Learning Simulationscited by 27
  18. 2022Towards A Critical Evaluation of Robustness for Deep Learning Backdoor Countermeasurescited by 11
  19. 2021Accumulative Poisoning Attacks on Real-time Datacited by 10
  20. 2022Semi-Targeted Model Poisoning Attack on Federated Learning via Backward Error Analysiscited by 9
  21. 2021Turning Federated Learning Systems Into Covert Channelscited by 6
  22. 2022Defense Strategies Toward Model Poisoning Attacks in Federated Learning: A Surveycited by 5
  23. 2021Widen The Backdoor To Let More Attackers Incited by 3

Built on by

Cited by year

Citing papers per year: 2023: 4; 2024: 1; 2025: 2.

7 papers.

  1. 2023Chameleon: Adapting to Peer Images for Planting Durable Backdoors in Federated Learningcited by 20
  2. 2023Attacks in Adversarial Machine Learning: A Systematic Survey from the Life-cycle Perspectivecited by 19
  3. 2023Get Rid Of Your Trail: Remotely Erasing Backdoors in Federated Learningcited by 12
  4. 2023A Survey on Vulnerability of Federated Learning: A Learning Algorithm Perspectivecited by 9
  5. 2024Mind the Cost of Scaffold! Benign Clients May Even Become Accomplices of Backdoor Attackcited by 1
  6. 2025Defending the Edge: Representative-Attention Defense against Backdoor Attacks in Federated Learningcited by 1
  7. 2025BackFed: An Efficient & Standardized Benchmark Suite for Backdoor Attacks in Federated Learningcited by 1