# Beyond Traditional Threats: A Persistent Backdoor Attack on Federated Learning

arXiv: https://arxiv.org/abs/2404.17617 · HTML: https://mlsanity.com/paper/2404.17617/

## Key facts

- Cited by 16 papers in the map (data through 14 Oct 2026).
- Builds on 18 of its 37 references that are in the map.
- First posted on arXiv 26 Apr 2024.

## Builds on (most cited first, 18 of 18)

- [Communication-Efficient Learning of Deep Networks from Decentralized Data](https://mlsanity.com/paper/1602.05629/) (2016)
- [Advances and Open Problems in Federated Learning](https://mlsanity.com/paper/1912.04977/) (2019)
- [Federated Learning with Non-IID Data](https://mlsanity.com/paper/1806.00582/) (2018)
- [Towards Federated Learning at Scale: System Design](https://mlsanity.com/paper/1902.01046/) (2019)
- [How To Backdoor Federated Learning](https://mlsanity.com/paper/1807.00459/) (2018)
- [Byzantine-Robust Distributed Learning: Towards Optimal Statistical Rates](https://mlsanity.com/paper/1803.01498/) (2018)
- [Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networks](https://mlsanity.com/paper/1805.12185/) (2018)
- [Differentially Private Federated Learning: A Client Level Perspective](https://mlsanity.com/paper/1712.07557/) (2017)
- [Detecting Backdoor Attacks on Deep Neural Networks by Activation Clustering](https://mlsanity.com/paper/1811.03728/) (2018)
- [Measuring Catastrophic Forgetting in Neural Networks](https://mlsanity.com/paper/1708.02072/) (2017)
- [Analyzing Federated Learning through an Adversarial Lens](https://mlsanity.com/paper/1811.12470/) (2018)
- [Attack of the Tails: Yes, You Really Can Backdoor Federated Learning](https://mlsanity.com/paper/2007.05084/) (2020)
- [Can You Really Backdoor Federated Learning?](https://mlsanity.com/paper/1911.07963/) (2019)
- [Federated Variance-Reduced Stochastic Gradient Descent with Robustness to Byzantine Attacks](https://mlsanity.com/paper/1912.12716/) (2019)
- [Zeno: Distributed Stochastic Gradient Descent with Suspicion-based Fault-tolerance](https://mlsanity.com/paper/1805.10032/) (2018)
- [Dispersed Pixel Perturbation-based Imperceptible Backdoor Trigger for Image Classifier Models](https://mlsanity.com/paper/2208.09336/) (2022)
- [Online Learning with Gated Linear Networks](https://mlsanity.com/paper/1712.01897/) (2017)
- [On the Permanence of Backdoors in Evolving Models](https://mlsanity.com/paper/2206.04677/) (2022)

## Built on by (most cited first, 16 of 16)

- [Threats and Defenses in Federated Learning Life Cycle: A Comprehensive Survey and Challenges](https://mlsanity.com/paper/2407.06754/) (2024)
- [Cooperative Backdoor Attack in Decentralized Reinforcement Learning with Theoretical Guarantee](https://mlsanity.com/paper/2405.15245/) (2024)
- [Rethinking LoRA for Privacy-Preserving Federated Learning in Large Models](https://mlsanity.com/paper/2602.19926/) (2026)
- [Cooperative Decentralized Backdoor Attacks on Vertical Federated Learning](https://mlsanity.com/paper/2501.09320/) (2025)
- [Bad-PFL: Exploring Backdoor Attacks against Personalized Federated Learning](https://mlsanity.com/paper/2501.12736/) (2025)
- [When AI reviews science: Can we trust the referee?](https://mlsanity.com/paper/2604.23593/) (2026)
- [BackFed: An Efficient & Standardized Benchmark Suite for Backdoor Attacks in Federated Learning](https://mlsanity.com/paper/2507.04903/) (2025)
- [On Identifying Adversarial Intent Injection in AI-Native 6G Networks](https://mlsanity.com/paper/2609.12144/) (2026)
- [A Whole-Process Certifiably Robust Aggregation Method Against Backdoor Attacks in Federated Learning](https://mlsanity.com/paper/2407.00719/) (2024)
- [Act in Collusion: Distributed Multi-Target Backdoor Attacks in Federated Learning](https://mlsanity.com/paper/2411.03926/) (2024)
- [FedBAP: Backdoor Defense via Benign Adversarial Perturbation in Federated Learning](https://mlsanity.com/paper/2507.21177/) (2025)
- [FLAT: Revealing Hidden Latent-Conditioned Backdoor Failures in Federated Learning](https://mlsanity.com/paper/2508.04064/) (2025)
- [BAPFL: Exploring Backdoor Attacks Against Prototype-based Federated Learning](https://mlsanity.com/paper/2509.12964/) (2025)
- [ADCA: Attention-Driven Multi-Party Collusion Attack in Federated Self-Supervised Learning](https://mlsanity.com/paper/2602.05612/) (2026)
- [PoiCGAN: A Targeted Poisoning Based on Feature-Label Joint Perturbation in Federated Learning](https://mlsanity.com/paper/2603.23574/) (2026)
- [The Power of Backdoor Absorption in Community Training](https://mlsanity.com/paper/2607.06643/) (2026)

## Abstract (arXiv)

Backdoors on federated learning will be diluted by subsequent benign updates. This is reflected in the significant reduction of attack success rate as iterations increase, ultimately failing. We use a new metric to quantify the degree of this weakened backdoor effect, called attack persistence. Given that research to improve this performance has not been widely noted,we propose a Full Combination Backdoor Attack (FCBA) method. It aggregates more combined trigger information for a more complete backdoor pattern in the global model. Trained backdoored global model is more resilient to benign updates, leading to a higher attack success rate on the test set. We test on three datasets and evaluate with two models across various settings. FCBA's persistence outperforms SOTA federated learning backdoor attacks. On GTSRB, postattack 120 rounds, our attack success rate rose over 50% from baseline. The core code of our method is available at https://github.com/PhD-TaoLiu/FCBA.