mlsanityData to 14 Oct 2026

Chameleon: Adapting to Peer Images for Planting Durable Backdoors in Federated Learning

arXiv 2304.12961 ↗First posted 25 Apr 2023cs.LG cs.CR cs.CVcited by 21

Not on the map. Why?

Abstract (arXiv)

In a federated learning (FL) system, distributed clients upload their local models to a central server to aggregate into a global model. Malicious clients may plant backdoors into the global model through uploading poisoned local models, causing images with specific patterns to be misclassified into some target labels. Backdoors planted by current attacks are not durable, and vanish quickly once the attackers stop model poisoning. In this paper, we investigate the connection between the durability of FL backdoors and the relationships between benign images and poisoned images (i.e., the images whose labels are flipped to the target label during local training). Specifically, benign images with the original and the target labels of the poisoned images are found to have key effects on backdoor durability. Consequently, we propose a novel attack, Chameleon, which utilizes contrastive learning to further amplify such effects towards a more durable backdoor. Extensive experiments demonstrate that Chameleon significantly extends the backdoor lifespan over baselines by 1.2× ~ 4×, for a wide range of image datasets, backdoor types, and model architectures.

Key facts. Cited by 21 papers in the map (data through 14 Oct 2026). Builds on 29 of its 47 references that are in the map. First posted on arXiv 25 Apr 2023.

Builds on

29 of 47 references.

References · 29

  1. 2020A Simple Framework for Contrastive Learning of Visual Representationscited by 12,049
  2. 2016Communication-Efficient Learning of Deep Networks from Decentralized Datacited by 7,669
  3. 2019Momentum Contrast for Unsupervised Visual Representation Learningcited by 7,513
  4. 2016Overcoming catastrophic forgetting in neural networkscited by 4,787
  5. 2018Federated Optimization in Heterogeneous Networkscited by 2,987
  6. 2020Supervised Contrastive Learningcited by 2,829
  7. 2017Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoningcited by 1,055
  8. 2019Measuring the Effects of Non-Identical Data Distribution for Federated Visual Classificationcited by 851
  9. 2018How To Backdoor Federated Learningcited by 765
  10. 2020Inverting Gradients -- How easy is it to break privacy in federated learning?cited by 712
  11. 2018Byzantine-Robust Distributed Learning: Towards Optimal Statistical Ratescited by 711
  12. 2018Poison Frogs! Targeted Clean-Label Poisoning Attacks on Neural Networkscited by 519
17 more
  1. 2019Local Model Poisoning Attacks to Byzantine-Robust Federated Learningcited by 493
  2. 2019Hidden Trigger Backdoor Attackscited by 371
  3. 2018Analyzing Federated Learning through an Adversarial Lenscited by 351
  4. 2020Reflection Backdoor: A Natural Backdoor Attack on Deep Neural Networkscited by 349
  5. 2018The Hidden Vulnerability of Distributed Learning in Byzantiumcited by 329
  6. 2020Attack of the Tails: Yes, You Really Can Backdoor Federated Learningcited by 309
  7. 2019Can You Really Backdoor Federated Learning?cited by 255
  8. 2020Privacy and Robustness in Federated Learning: Attacks and Defensescited by 166
  9. 2019Demon in the Variant: Statistical Analysis of DNNs for Robust Backdoor Contamination Detectioncited by 124
  10. 2021Back to the Drawing Board: A Critical Evaluation of Poisoning Attacks on Production Federated Learningcited by 118
  11. 2022Neurotoxin: Durable Backdoors in Federated Learningcited by 98
  12. 2021CRFL: Certifiably Robust Federated Learning against Backdoor Attackscited by 91
  13. 2022DeepSight: Mitigating Backdoor Attacks in Federated Learning Through Deep Model Inspectioncited by 81
  14. 2020Local and Central Differential Privacy for Robustness and Privacy in Federated Learningcited by 78
  15. 2020BaFFLe: Backdoor detection via Feedback-based Federated Learningcited by 53
  16. 2019Shielding Collaborative Learning: Mitigating Poisoning Attacks through Client-Side Detectioncited by 26
  17. 2022Thinking Two Moves Ahead: Anticipating Other Users Improves Backdoor Attacks in Federated Learningcited by 7

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2023: 4; 2024: 6; 2025: 10; 2026: 1.

21 papers.

Sort:

By area:

  1. 2023Federated Learning for Generalization, Robustness, Fairness: A Survey and Benchmarkcited by 99
  2. 2023FLTracer: Accurate Poisoning Attack Provenance in Federated Learningcited by 8
  3. 2025MARS: A Malignity-Aware Backdoor Defense in Federated Learningcited by 7
  4. 2024FedAA: A Reinforcement Learning Perspective on Adaptive Aggregation for Fair and Robust Federated Learningcited by 6
  5. 2024SDBA: A Stealthy and Long-Lasting Durable Backdoor Attack in Federated Learningcited by 2
  6. 2025On the Security and Privacy of Federated Learning: A Survey with Attacks, Defenses, Frameworks, Applications, and Future Directionscited by 2
  7. 2023Towards Understanding Adversarial Transferability in Federated Learningcited by 1
  8. 2024Attack On Prompt: Backdoor Attack in Prompt-Based Continual Learningcited by 1
  9. 2024Non-Cooperative Backdoor Attacks in Federated Learning: A New Threat Landscapecited by 1
  10. 2024Mind the Cost of Scaffold! Benign Clients May Even Become Accomplices of Backdoor Attackcited by 1
  11. 2025DBA-DFL: Towards Distributed Backdoor Attacks with Network Detection in Decentralized Federated Learningcited by 1
  12. 2025DROP: Poison Dilution via Knowledge Distillation for Federated Learningcited by 1
9 more
  1. 2025Defending the Edge: Representative-Attention Defense against Backdoor Attacks in Federated Learningcited by 1
  2. 2025BackFed: An Efficient & Standardized Benchmark Suite for Backdoor Attacks in Federated Learningcited by 1
  3. 2023FTA: Stealthy and Adaptive Backdoor Attack with Flexible Triggers on Federated Learningcited by 0
  4. 2024A Whole-Process Certifiably Robust Aggregation Method Against Backdoor Attacks in Federated Learningcited by 0
  5. 2025TrojanDam: Detection-Free Backdoor Defense in Federated Learning through Proactive Model Robustification utilizing OOD Datacited by 0
  6. 2025Coward: Collision-based OOD Watermarking for Practical Proactive Federated Backdoor Detectioncited by 0
  7. 2025FLAT: Revealing Hidden Latent-Conditioned Backdoor Failures in Federated Learningcited by 0
  8. 2025Enhancing the Effectiveness and Durability of Backdoor Attacks in Federated Learning through Maximizing Task Distinctioncited by 0
  9. 2026Mitigating Backdoor Attacks in Federated Learning Using PPA and MiniMax Game Theorycited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2025SPA: Towards More Stealth and Persistent Backdoor Attacks in Federated Learning
  2. 2025Watch Out for the Lifespan: Evaluating Backdoor Attacks Against Federated Model Adaptation
  3. 2025Buffer is All You Need: Defending Federated Learning against Backdoor Attacks under Non-iids via Buffering
  4. 2023Resisting Backdoor Attacks in Federated Learning via Bidirectional Elections and Individual Perspective
  5. 2023FedGrad: Mitigating Backdoor Attacks in Federated Learning Through Local Ultimate Gradients Inspection
  6. 2024Concealing Backdoor Model Updates in Federated Learning by Trigger-Optimized Data Poisoning
  7. 2023FilterFL: Knowledge Filtering-based Data-Free Backdoor Defense for Federated Learning
  8. 2023BAGEL: Backdoor Attacks against Federated Contrastive Learning