mlsanityData to 7 Oct 2026

Backdoor Federated Learning by Poisoning Backdoor-Critical Layers

arXiv 2308.04466 ↗First posted 8 Aug 2023cs.CR cs.CV cs.LGcited by 16

Not on the map. Why?

Abstract (arXiv)

Federated learning (FL) has been widely deployed to enable machine learning training on sensitive data across distributed devices. However, the decentralized learning paradigm and heterogeneity of FL further extend the attack surface for backdoor attacks. Existing FL attack and defense methodologies typically focus on the whole model. None of them recognizes the existence of backdoor-critical (BC) layers-a small subset of layers that dominate the model vulnerabilities. Attacking the BC layers achieves equivalent effects as attacking the whole model but at a far smaller chance of being detected by state-of-the-art (SOTA) defenses. This paper proposes a general in-situ approach that identifies and verifies BC layers from the perspective of attackers. Based on the identified BC layers, we carefully craft a new backdoor attack methodology that adaptively seeks a fundamental balance between attacking effects and stealthiness under various defense strategies. Extensive experiments show that our BC layer-aware backdoor attacks can successfully backdoor FL under seven SOTA defenses with only 10% malicious clients and outperform the latest backdoor attack methods.

Key facts. Cited by 16 papers in the map (data through 7 Oct 2026). Builds on 45 of its 63 references that are in the map. First posted on arXiv 8 Aug 2023.

Builds on

45 of 63 references.

References · 45

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2019PyTorch: An Imperative Style, High-Performance Deep Learning Librarycited by 20,160
  3. 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,267
  4. 2021LoRA: Low-Rank Adaptation of Large Language Modelscited by 14,084
  5. 2016Communication-Efficient Learning of Deep Networks from Decentralized Datacited by 7,592
  6. 2016Densely Connected Convolutional Networkscited by 6,691
  7. 2013Deep Inside Convolutional Networks: Visualising Image Classification Models and Saliency Mapscited by 2,348
  8. 2013Visualizing and Understanding Convolutional Networkscited by 2,278
  9. 2018The Lottery Ticket Hypothesis: Finding Sparse, Trainable Neural Networkscited by 2,250
  10. 2016Federated Learning: Strategies for Improving Communication Efficiencycited by 1,461
  11. 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,052
  12. 2018LEAF: A Benchmark for Federated Settingscited by 780
33 more
  1. 2018How To Backdoor Federated Learningcited by 745
  2. 2017Network Dissection: Quantifying Interpretability of Deep Visual Representationscited by 703
  3. 2018Byzantine-Robust Distributed Learning: Towards Optimal Statistical Ratescited by 698
  4. 2018Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networkscited by 550
  5. 2019Local Model Poisoning Attacks to Byzantine-Robust Federated Learningcited by 479
  6. 2018Analyzing Federated Learning through an Adversarial Lenscited by 346
  7. 2020FLTrust: Byzantine-robust Federated Learning via Trust Bootstrappingcited by 330
  8. 2018The Hidden Vulnerability of Distributed Learning in Byzantiumcited by 324
  9. 2021Neural Attention Distillation: Erasing Backdoor Triggers from Deep Neural Networkscited by 313
  10. 2020Attack of the Tails: Yes, You Really Can Backdoor Federated Learningcited by 307
  11. 2019A Little Is Enough: Circumventing Defenses For Distributed Learningcited by 285
  12. 2019Can You Really Backdoor Federated Learning?cited by 250
  13. 2021Adversarial Neuron Pruning Purifies Backdoored Deep Modelscited by 230
  14. 2013Predicting Parameters in Deep Learningcited by 223
  15. 2020Dynamic Backdoor Attacks Against Machine Learning Modelscited by 147
  16. 2021Deep Learning Through the Lens of Example Difficultycited by 139
  17. 2022FLDetector: Defending Federated Learning Against Model Poisoning Attacks via Detecting Malicious Clientscited by 119
  18. 2019TBT: Targeted Neural Network Attack with Bit Trojancited by 112
  19. 2019Bit-Flip Attack: Crushing Neural Network with Progressive Bit Searchcited by 106
  20. 2022Neurotoxin: Durable Backdoors in Federated Learningcited by 97
  21. 2020Deep Feature Space Trojan Attack of Neural Networks by Controlled Detoxificationcited by 93
  22. 2020An Embarrassingly Simple Approach for Trojan Attack in Deep Neural Networkscited by 92
  23. 2020Defending against Backdoors in Federated Learning with Robust Learning Ratecited by 82
  24. 2021Backdoor Pre-trained Models Can Transfer to Allcited by 79
  25. 2022DeepSight: Mitigating Backdoor Attacks in Federated Learning Through Deep Model Inspectioncited by 78
  26. 2021On the geometry of generalization and memorization in deep neural networkscited by 71
  27. 2023Can Neural Network Memorization Be Localized?cited by 66
  28. 2021FIBA: Frequency-Injection based Backdoor Attack in Medical Image Analysiscited by 60
  29. 2021Targeted Attack against Deep Neural Networks via Flipping Limited Weight Bitscited by 49
  30. 2021DeepPayload: Black-box Backdoor Attack on Deep Learning Models through Neural Payload Injectioncited by 42
  31. 2022FLIP: A Provable Defense Framework for Backdoor Mitigation in Federated Learningcited by 37
  32. 2021Towards Practical Deployment-Stage Backdoor Attack on Deep Neural Networkscited by 33
  33. 2018EffNet: An Efficient Structure for Convolutional Neural Networkscited by 9

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2023: 1; 2024: 2; 2025: 8; 2026: 5.

16 papers.

Sort:

By area:

  1. 2023Federated Learning for Generalization, Robustness, Fairness: A Survey and Benchmarkcited by 97
  2. 2024Synergizing Foundation Models and Federated Learning: A Surveycited by 14
  3. 2025Spectral Insights into Data-Oblivious Critical Layers in Large Language Modelscited by 4
  4. 2024SDBA: A Stealthy and Long-Lasting Durable Backdoor Attack in Federated Learningcited by 2
  5. 2025Bad-PFL: Exploring Backdoor Attacks against Personalized Federated Learningcited by 2
  6. 2025DBA-DFL: Towards Distributed Backdoor Attacks with Network Detection in Decentralized Federated Learningcited by 1
  7. 2025FL-PLAS: Federated Learning with Partial Layer Aggregation for Backdoor Defense Against High-Ratio Malicious Clientscited by 1
  8. 2025BackFed: An Efficient & Standardized Benchmark Suite for Backdoor Attacks in Federated Learningcited by 1
  9. 2025A Vision-Language Pre-training Model-Guided Approach for Mitigating Backdoor Attacks in Federated Learningcited by 1
  10. 2026Exploiting Layer-Specific Vulnerabilities to Backdoor Attack in Federated Learningcited by 1
  11. 2026FedSurrogate: Backdoor Defense in Federated Learning via Layer Criticality and Surrogate Replacementcited by 1
  12. 2025FedGraM: Defending Against Untargeted Attacks in Federated Learning via Embedding Gram Matrixcited by 0
4 more
  1. 2025POLAR: Policy-based Layerwise Reinforcement Learning Method for Stealthy Backdoor Attacks in Federated Learningcited by 0
  2. 2026CACTUS: Mask-Guided Semantic Clean-Label Backdoors in Decentralized Federated Learningcited by 0
  3. 2026Backdoors Leave Structural Traces: FedMAST for Backdoor Detection and Containment in Federated Learningcited by 0
  4. 2026OPFL: Optimistic Verification of Federated Learning via Empirical Boundarycited by 0