mlsanityData to 7 Oct 2026

Revisiting Personalized Federated Learning: Robustness Against Backdoor Attacks

arXiv 2302.01677 ↗First posted 3 Feb 2023cs.LG cs.CRcited by 16

Not on the map. Why?

Abstract (arXiv)

In this work, besides improving prediction accuracy, we study whether personalization could bring robustness benefits to backdoor attacks. We conduct the first study of backdoor attacks in the pFL framework, testing 4 widely used backdoor attacks against 6 pFL methods on benchmark datasets FEMNIST and CIFAR-10, a total of 600 experiments. The study shows that pFL methods with partial model-sharing can significantly boost robustness against backdoor attacks. In contrast, pFL methods with full model-sharing do not show robustness. To analyze the reasons for varying robustness performances, we provide comprehensive ablation studies on different pFL methods. Based on our findings, we further propose a lightweight defense method, Simple-Tuning, which empirically improves defense performance against backdoor attacks. We believe that our work could provide both guidance for pFL application in terms of its robustness and offer valuable insights to design more robust FL methods in the future. We open-source our code to establish the first benchmark for black-box backdoor attacks in pFL: https://github.com/alibaba/FederatedScope/tree/backdoor-bench.

Key facts. Cited by 16 papers in the map (data through 7 Oct 2026). Builds on 50 of its 63 references that are in the map. First posted on arXiv 3 Feb 2023.

Builds on

50 of 63 references.

References · 50

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2016Communication-Efficient Learning of Deep Networks from Decentralized Datacited by 7,592
  3. 2015Delving Deep into Rectifiers: Surpassing Human-Level Performance on ImageNet Classificationcited by 3,590
  4. 2019Advances and Open Problems in Federated Learningcited by 3,021
  5. 2017Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoningcited by 1,012
  6. 2019Deep Leakage from Gradientscited by 1,004
  7. 2018LEAF: A Benchmark for Federated Settingscited by 780
  8. 2018How To Backdoor Federated Learningcited by 745
  9. 2017Federated Multi-Task Learningcited by 669
  10. 2020Ditto: Fair and Robust Federated Learning Through Personalizationcited by 665
  11. 2020Personalized Federated Learning with Moreau Envelopescited by 612
  12. 2018Federated Learning for Mobile Keyboard Predictioncited by 565
38 more
  1. 2021FedBN: Federated Learning on Non-IID Features via Local Batch Normalizationcited by 565
  2. 2018Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networkscited by 550
  3. 2021Exploiting Shared Representations for Personalized Federated Learningcited by 537
  4. 2019Federated Learning with Personalization Layerscited by 533
  5. 2018Exploiting Unintended Feature Leakage in Collaborative Learningcited by 509
  6. 2019Local Model Poisoning Attacks to Byzantine-Robust Federated Learningcited by 479
  7. 2021Towards Personalized Federated Learningcited by 462
  8. 2018Analyzing Federated Learning through an Adversarial Lenscited by 346
  9. 2018Turning Your Weakness Into a Strength: Watermarking Deep Neural Networks by Backdooringcited by 334
  10. 2020Think Locally, Act Globally: Federated Learning with Local and Global Representationscited by 322
  11. 2021Neural Attention Distillation: Erasing Backdoor Triggers from Deep Neural Networkscited by 313
  12. 2020Personalized Federated Learning: A Meta-Learning Approachcited by 309
  13. 2020Attack of the Tails: Yes, You Really Can Backdoor Federated Learningcited by 307
  14. 2019A Little Is Enough: Circumventing Defenses For Distributed Learningcited by 285
  15. 2020Data Poisoning Attacks Against Federated Learning Systemscited by 266
  16. 2019Can You Really Backdoor Federated Learning?cited by 250
  17. 2019A new Backdoor Attack in CNNs by training set corruption without label poisoningcited by 237
  18. 2021Adversarial Neuron Pruning Purifies Backdoored Deep Modelscited by 230
  19. 2021Evaluating Gradient Inversion Attacks and Defenses in Federated Learningcited by 196
  20. 2021Federated Multi-Task Learning under a Mixture of Distributionscited by 189
  21. 2022Fine-tuning Global Model via Data-Free Knowledge Distillation for Non-IID Federated Learningcited by 172
  22. 2020Dataset Security for Machine Learning: Data Poisoning, Backdoor Attacks, and Defensescited by 171
  23. 2020Privacy and Robustness in Federated Learning: Attacks and Defensescited by 163
  24. 2022Backdoor Defense via Decoupling the Training Processcited by 149
  25. 2020Federated Learning for Internet of Things: Recent Advances, Taxonomy, and Open Challengescited by 138
  26. 2022BackdoorBench: A Comprehensive Benchmark of Backdoor Learningcited by 124
  27. 2020Multi-site fMRI Analysis Using Privacy-preserving Federated Learning and Domain Adaptation: ABIDE Resultscited by 122
  28. 2021Back to the Drawing Board: A Critical Evaluation of Poisoning Attacks on Production Federated Learningcited by 116
  29. 2022Federated Learning with Partial Model Personalizationcited by 114
  30. 2022Neurotoxin: Durable Backdoors in Federated Learningcited by 97
  31. 2019Robust Anomaly Detection and Backdoor Attack Detection Via Differential Privacycited by 93
  32. 2022Data-free Backdoor Removal based on Channel Lipschitznesscited by 77
  33. 2022FederatedScope: A Flexible Federated Learning Platform for Heterogeneitycited by 53
  34. 2022pFL-Bench: A Comprehensive Benchmark for Personalized Federated Learningcited by 44
  35. 2021Personalized Federated Learning: A Unified Framework and Universal Optimization Techniquescited by 34
  36. 2022Motley: Benchmarking Heterogeneity and Personalization in Federated Learningcited by 31
  37. 2021Curse or Redemption? How Data Heterogeneity Affects the Robustness of Federated Learningcited by 21
  38. 2022An Empirical Study of Personalized Federated Learningcited by 6

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2023: 6; 2024: 5; 2025: 3; 2026: 2.

16 papers.

Sort:

By area:

  1. 2023Efficient Personalized Federated Learning via Sparse Model-Adaptationcited by 38
  2. 2023Pre-trained Trojan Attacks for Visual Recognitioncited by 38
  3. 2023Towards Stable Backdoor Purification through Feature Shift Tuningcited by 30
  4. 2023FS-Real: Towards Real-World Cross-Device Federated Learningcited by 22
  5. 2023Data and Model Poisoning Backdoor Attacks on Wireless Federated Learning, and the Defense Mechanisms: A Comprehensive Surveycited by 17
  6. 2024TabularMark: Watermarking Tabular Datasets for Machine Learningcited by 8
  7. 2024Lurking in the shadows: Unveiling Stealthy Backdoor Attacks against Personalized Federated Learningcited by 6
  8. 2024Uncovering, Explaining, and Mitigating the Superficial Safety of Backdoor Defensecited by 6
  9. 2023You Can Backdoor Personalized Federated Learningcited by 4
  10. 2025Bad-PFL: Exploring Backdoor Attacks against Personalized Federated Learningcited by 2
  11. 2024PBP: Post-training Backdoor Purification for Malware Classifierscited by 1
  12. 2025FL-PLAS: Federated Learning with Partial Layer Aggregation for Backdoor Defense Against High-Ratio Malicious Clientscited by 1
4 more
  1. 2024A Whole-Process Certifiably Robust Aggregation Method Against Backdoor Attacks in Federated Learningcited by 0
  2. 2025Clustered Federated Learning via Embedding Distributionscited by 0
  3. 2026DCInject: Persistent Backdoor Attacks via Frequency Manipulation in Personal Federated Learningcited by 0
  4. 2026Unveiling the Backdoor Mechanism Hidden Behind Catastrophic Overfitting in Fast Adversarial Trainingcited by 0