mlsanityData to 7 Oct 2026

On the Vulnerability of Backdoor Defenses for Federated Learning

arXiv 2301.08170 ↗First posted 19 Jan 2023cs.LG cs.AI cs.CRcited by 27

Not on the map. Why?

Abstract (arXiv)

Federated Learning (FL) is a popular distributed machine learning paradigm that enables jointly training a global model without sharing clients' data. However, its repetitive server-client communication gives room for backdoor attacks with aim to mislead the global model into a targeted misprediction when a specific trigger pattern is presented. In response to such backdoor threats on federated learning, various defense measures have been proposed. In this paper, we study whether the current defense mechanisms truly neutralize the backdoor threats from federated learning in a practical setting by proposing a new federated backdoor attack method for possible countermeasures. Different from traditional training (on triggered data) and rescaling (the malicious client model) based backdoor injection, the proposed backdoor attack framework (1) directly modifies (a small proportion of) local model weights to inject the backdoor trigger via sign flips; (2) jointly optimize the trigger pattern with the client model, thus is more persistent and stealthy for circumventing existing defenses. In a case study, we examine the strength and weaknesses of recent federated backdoor defenses from three major categories and provide suggestions to the practitioners when training federated models in practice.

Key facts. Cited by 27 papers in the map (data through 7 Oct 2026). Builds on 29 of its 40 references that are in the map. First posted on arXiv 19 Jan 2023.

Builds on

29 of 40 references.

References · 29

  1. 2016Communication-Efficient Learning of Deep Networks from Decentralized Datacited by 7,592
  2. 2019Federated Learning: Challenges, Methods, and Future Directionscited by 1,531
  3. 2016Federated Learning: Strategies for Improving Communication Efficiencycited by 1,461
  4. 2018Federated Learning with Non-IID Datacited by 1,099
  5. 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,052
  6. 2020Adaptive Federated Optimizationcited by 1,036
  7. 2020Tackling the Objective Inconsistency Problem in Heterogeneous Federated Optimizationcited by 897
  8. 2018How To Backdoor Federated Learningcited by 745
  9. 2018Byzantine-Robust Distributed Learning: Towards Optimal Statistical Ratescited by 698
  10. 2020Ensemble Distillation for Robust Model Fusion in Federated Learningcited by 678
  11. 2018Federated Learning for Mobile Keyboard Predictioncited by 565
  12. 2018Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networkscited by 550
17 more
  1. 2020Movement Pruning: Adaptive Sparsity by Fine-Tuningcited by 398
  2. 2018Analyzing Federated Learning through an Adversarial Lenscited by 346
  3. 2018The Hidden Vulnerability of Distributed Learning in Byzantiumcited by 324
  4. 2021Neural Attention Distillation: Erasing Backdoor Triggers from Deep Neural Networkscited by 313
  5. 2020Attack of the Tails: Yes, You Really Can Backdoor Federated Learningcited by 307
  6. 2019Model Fusion via Optimal Transportcited by 217
  7. 2021SPECTRE: Defending Against Backdoor Attacks Using Robust Statisticscited by 123
  8. 2022Neurotoxin: Durable Backdoors in Federated Learningcited by 97
  9. 2018Federated Learning for Keyword Spottingcited by 95
  10. 2021CRFL: Certifiably Robust Federated Learning against Backdoor Attackscited by 91
  11. 2020Defending against Backdoors in Federated Learning with Robust Learning Ratecited by 82
  12. 2022DeepSight: Mitigating Backdoor Attacks in Federated Learning Through Deep Model Inspectioncited by 78
  13. 2021Provably Secure Federated Learning against Malicious Clientscited by 60
  14. 2022Communication-Efficient Adaptive Federated Learningcited by 55
  15. 2020BaFFLe: Backdoor detection via Feedback-based Federated Learningcited by 52
  16. 2020Mitigating Backdoor Attacks in Federated Learningcited by 39
  17. 2021FedRAD: Federated Robust Adaptive Distillationcited by 11

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2023: 4; 2024: 7; 2025: 13; 2026: 3.

27 papers.

Sort:

By area:

  1. 2023Federated Learning for Generalization, Robustness, Fairness: A Survey and Benchmarkcited by 97
  2. 2025Detecting Backdoor Attacks in Federated Learning via Direction Alignment Inspectioncited by 13
  3. 2023Get Rid Of Your Trail: Remotely Erasing Backdoors in Federated Learningcited by 12
  4. 2023A Survey on Vulnerability of Federated Learning: A Learning Algorithm Perspectivecited by 9
  5. 2023FilterFL: Knowledge Filtering-based Data-Free Backdoor Defense for Federated Learningcited by 5
  6. 2024Identify Backdoored Model in Federated Learning via Individual Unlearningcited by 4
  7. 2025Robust Knowledge Distillation in Federated Learning: Counteracting Backdoor Attackscited by 2
  8. 2024Concealing Backdoor Model Updates in Federated Learning by Trigger-Optimized Data Poisoningcited by 1
  9. 2024Venomancer: Towards Imperceptible and Target-on-Demand Backdoor Attacks in Federated Learningcited by 1
  10. 2024Non-Cooperative Backdoor Attacks in Federated Learning: A New Threat Landscapecited by 1
  11. 2024Mitigating Malicious Attacks in Federated Learning via Confidence-aware Defensecited by 1
  12. 2024Mind the Cost of Scaffold! Benign Clients May Even Become Accomplices of Backdoor Attackcited by 1
15 more
  1. 2025DBA-DFL: Towards Distributed Backdoor Attacks with Network Detection in Decentralized Federated Learningcited by 1
  2. 2025FL-PLAS: Federated Learning with Partial Layer Aggregation for Backdoor Defense Against High-Ratio Malicious Clientscited by 1
  3. 2025BackFed: An Efficient & Standardized Benchmark Suite for Backdoor Attacks in Federated Learningcited by 1
  4. 2025On the Out-of-Distribution Backdoor Attack for Federated Learningcited by 1
  5. 2024FLAIN: Mitigating Backdoor Attacks in Federated Learning via Flipping Weight Updates of Low-Activation Input Neuronscited by 0
  6. 2025TrojanDam: Detection-Free Backdoor Defense in Federated Learning through Proactive Model Robustification utilizing OOD Datacited by 0
  7. 2025Bayesian Robust Aggregation for Federated Learningcited by 0
  8. 2025FedBAP: Backdoor Defense via Benign Adversarial Perturbation in Federated Learningcited by 0
  9. 2025BadPromptFL: A Novel Backdoor Threat to Prompt-based Federated Learning in Multimodal Modelscited by 0
  10. 2025Hammer and Anvil: Toward a Theory of Backdoors in Federated Learningcited by 0
  11. 2025Enhancing the Effectiveness and Durability of Backdoor Attacks in Federated Learning through Maximizing Task Distinctioncited by 0
  12. 2025Watch Out for the Lifespan: Evaluating Backdoor Attacks Against Federated Model Adaptationcited by 0
  13. 2026FL-OA: A Byzantine-Robust Federated Learning Framework with Outsourced Auditing for Intelligent Devicescited by 0
  14. 2026STAR-FL: Secure Federated Learning with Spatial-Temporal Analysis and Robust Aggregationcited by 0
  15. 2026BackDFL: A Unified Benchmark For Backdoor Attacks and Defenses In Decentralized Federated Learningcited by 0