FTA: Stealthy and Adaptive Backdoor Attack with Flexible Triggers on Federated Learning
Not on the map. Why?
Abstract (arXiv)
Current backdoor attacks against federated learning (FL) strongly rely on universal triggers or semantic patterns, which can be easily detected and filtered by certain defense mechanisms such as norm clipping, comparing parameter divergences among local updates. In this work, we propose a new stealthy and robust backdoor attack with flexible triggers against FL defenses. To achieve this, we build a generative trigger function that can learn to manipulate the benign samples with an imperceptible flexible trigger pattern and simultaneously make the trigger pattern include the most significant hidden features of the attacker-chosen label. Moreover, our trigger generator can keep learning and adapt across different rounds, allowing it to adjust to changes in the global model. By filling the distinguishable difference (the mapping between the trigger pattern and target label), we make our attack naturally stealthy. Extensive experiments on real-world datasets verify the effectiveness and stealthiness of our attack compared to prior attacks on decentralized learning framework with eight well-studied defenses.
Key facts. No citing papers in the map yet (data through 14 Oct 2026). Builds on 42 of its 66 references that are in the map. First posted on arXiv 31 Aug 2023.
Builds on
42 of 66 references.
References · 42
- 2015Deep Residual Learning for Image Recognitioncited by 52,096
- 2019PyTorch: An Imperative Style, High-Performance Deep Learning Librarycited by 20,305
- 2015U-Net: Convolutional Networks for Biomedical Image Segmentationcited by 19,713
- 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,364
- 2018The Unreasonable Effectiveness of Deep Features as a Perceptual Metriccited by 11,177
- 2016Communication-Efficient Learning of Deep Networks from Decentralized Datacited by 7,669
- 2017Fashion-MNIST: a Novel Image Dataset for Benchmarking Machine Learning Algorithmscited by 4,349
- 2018Federated Optimization in Heterogeneous Networkscited by 2,987
- 2018LEAF: A Benchmark for Federated Settingscited by 792
- 2018How To Backdoor Federated Learningcited by 765
- 2018Byzantine-Robust Distributed Learning: Towards Optimal Statistical Ratescited by 711
- 2020Ditto: Fair and Robust Federated Learning Through Personalizationcited by 672
30 more
- 2018Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networkscited by 580
- 2020Invisible Backdoor Attack with Sample-Specific Triggerscited by 353
- 2018Analyzing Federated Learning through an Adversarial Lenscited by 351
- 2020FLTrust: Byzantine-robust Federated Learning via Trust Bootstrappingcited by 346
- 2019Robust Aggregation for Federated Learningcited by 317
- 2020Input-Aware Dynamic Backdoor Attackcited by 313
- 2020Attack of the Tails: Yes, You Really Can Backdoor Federated Learningcited by 309
- 2019Can You Really Backdoor Federated Learning?cited by 255
- 2021Adversarial Neuron Pruning Purifies Backdoored Deep Modelscited by 235
- 2018Manipulating Machine Learning: Poisoning Attacks and Countermeasures for Regression Learningcited by 225
- 2018Applied Federated Learning: Improving Google Keyboard Query Suggestionscited by 204
- 2016Practical Secure Aggregation for Federated Learning on User-Held Datacited by 178
- 2020Salvaging Federated Learning by Local Adaptationcited by 142
- 2022FLDetector: Defending Federated Learning Against Model Poisoning Attacks via Detecting Malicious Clientscited by 125
- 2021Back to the Drawing Board: A Critical Evaluation of Poisoning Attacks on Production Federated Learningcited by 118
- 2022Neurotoxin: Durable Backdoors in Federated Learningcited by 98
- 2020Deep Feature Space Trojan Attack of Neural Networks by Controlled Detoxificationcited by 95
- 2021CRFL: Certifiably Robust Federated Learning against Backdoor Attackscited by 91
- 2021Federated Evaluation and Tuning for On-Device Personalization: System Design & Applicationscited by 85
- 2020Defending against Backdoors in Federated Learning with Robust Learning Ratecited by 82
- 2022DeepSight: Mitigating Backdoor Attacks in Federated Learning Through Deep Model Inspectioncited by 81
- 2021Deep Federated Learning for Autonomous Drivingcited by 54
- 2021SparseFed: Mitigating Model Poisoning Attacks in Federated Learning with Sparsificationcited by 46
- 2020Mitigating Backdoor Attacks in Federated Learningcited by 39
- 2022FLIP: A Provable Defense Framework for Backdoor Mitigation in Federated Learningcited by 37
- 2022Marksman Backdoor: Backdoor Attacks with Arbitrary Target Classcited by 33
- 2022FLCert: Provably Secure Federated Learning against Poisoning Attackscited by 30
- 2022Imperceptible Backdoor Attack: From Input Space to Feature Representationcited by 27
- 2023Chameleon: Adapting to Peer Images for Planting Durable Backdoors in Federated Learningcited by 21
- 2023Hyperparameter Learning under Data Poisoning: Analysis of the Influence of Regularization via Multiobjective Bilevel Optimizationcited by 3
Built on by
Not cited yet.
Similar, not cited
Close in wording, no citation either way
- 2024Non-Cooperative Backdoor Attacks in Federated Learning: A New Threat Landscape
- 2025SPA: Towards More Stealth and Persistent Backdoor Attacks in Federated Learning
- 2025Unveiling Hidden Threats: Using Fractal Triggers to Boost Stealthiness of Distributed Backdoor Attacks in Federated Learning
- 2023On the Vulnerability of Backdoor Defenses for Federated Learning
- 2023FilterFL: Knowledge Filtering-based Data-Free Backdoor Defense for Federated Learning
- 2025Enhancing the Effectiveness and Durability of Backdoor Attacks in Federated Learning through Maximizing Task Distinction
- 2024Concealing Backdoor Model Updates in Federated Learning by Trigger-Optimized Data Poisoning
- 2025TrojanDam: Detection-Free Backdoor Defense in Federated Learning through Proactive Model Robustification utilizing OOD Data