mlsanityData to 7 Oct 2026

Lurking in the shadows: Unveiling Stealthy Backdoor Attacks against Personalized Federated Learning

arXiv 2406.06207 ↗First posted 10 Jun 2024cs.LG cs.CRcited by 6

Not on the map. Why?

Abstract (arXiv)

Federated Learning (FL) is a collaborative machine learning technique where multiple clients work together with a central server to train a global model without sharing their private data. However, the distribution shift across non-IID datasets of clients poses a challenge to this one-model-fits-all method hindering the ability of the global model to effectively adapt to each client's unique local data. To echo this challenge, personalized FL (PFL) is designed to allow each client to create personalized local models tailored to their private data. While extensive research has scrutinized backdoor risks in FL, it has remained underexplored in PFL applications. In this study, we delve deep into the vulnerabilities of PFL to backdoor attacks. Our analysis showcases a tale of two cities. On the one hand, the personalization process in PFL can dilute the backdoor poisoning effects injected into the personalized local models. Furthermore, PFL systems can also deploy both server-end and client-end defense mechanisms to strengthen the barrier against backdoor attacks. On the other hand, our study shows that PFL fortified with these defense methods may offer a false sense of security. We propose textitPFedBA, a stealthy and effective backdoor attack strategy applicable to PFL systems. textitPFedBA ingeniously aligns the backdoor learning task with the main learning task of PFL by optimizing the trigger generation process. Our comprehensive experiments demonstrate the effectiveness of textitPFedBA in seamlessly embedding triggers into personalized local models. textitPFedBA yields outstanding attack performance across 10 state-of-the-art PFL algorithms, defeating the existing 6 defense mechanisms. Our study sheds light on the subtle yet potent backdoor threats to PFL systems, urging the community to bolster defenses against emerging backdoor challenges.

Key facts. Cited by 6 papers in the map (data through 7 Oct 2026). Builds on 29 of its 47 references that are in the map. First posted on arXiv 10 Jun 2024.

Builds on

29 of 47 references.

References · 29

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2017Model-Agnostic Meta-Learning for Fast Adaptation of Deep Networkscited by 4,861
  3. 2017Fashion-MNIST: a Novel Image Dataset for Benchmarking Machine Learning Algorithmscited by 4,283
  4. 2018Federated Optimization in Heterogeneous Networkscited by 2,971
  5. 2018How To Backdoor Federated Learningcited by 745
  6. 2018Byzantine-Robust Distributed Learning: Towards Optimal Statistical Ratescited by 698
  7. 2020Ditto: Fair and Robust Federated Learning Through Personalizationcited by 665
  8. 2020Personalized Federated Learning with Moreau Envelopescited by 612
  9. 2021FedBN: Federated Learning on Non-IID Features via Local Batch Normalizationcited by 565
  10. 2021Exploiting Shared Representations for Personalized Federated Learningcited by 537
  11. 2021Towards Personalized Federated Learningcited by 462
  12. 2022Git Re-Basin: Merging Models modulo Permutation Symmetriescited by 460
17 more
  1. 2020FLTrust: Byzantine-robust Federated Learning via Trust Bootstrappingcited by 330
  2. 2021Neural Attention Distillation: Erasing Backdoor Triggers from Deep Neural Networkscited by 313
  3. 2020Attack of the Tails: Yes, You Really Can Backdoor Federated Learningcited by 307
  4. 2019A Little Is Enough: Circumventing Defenses For Distributed Learningcited by 285
  5. 2021Anti-Backdoor Learning: Training Clean Models on Poisoned Datacited by 258
  6. 2018Mitigating Sybils in Federated Learning Poisoningcited by 158
  7. 2019Federated Evaluation of On-device Personalizationcited by 147
  8. 2022BackdoorBench: A Comprehensive Benchmark of Backdoor Learningcited by 124
  9. 2022FedALA: Adaptive Local Aggregation for Personalized Federated Learningcited by 121
  10. 2022Neurotoxin: Durable Backdoors in Federated Learningcited by 97
  11. 2018N-BaIoT: Network-based Detection of IoT Botnet Attacks Using Deep Autoencoderscited by 67
  12. 2020Every Model Learned by Gradient Descent Is Approximately a Kernel Machinecited by 53
  13. 2021Adapt to Adaptation: Learning Personalization for Cross-Silo Federated Learningcited by 53
  14. 2022FedRecover: Recovering from Poisoning Attacks in Federated Learning using Historical Informationcited by 53
  15. 2022FLCert: Provably Secure Federated Learning against Poisoning Attackscited by 29
  16. 2023Revisiting Personalized Federated Learning: Robustness Against Backdoor Attackscited by 16
  17. 2018Teacher Improves Learning by Selecting a Training Subsetcited by 6

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2025: 4; 2026: 2.

6 papers.

  1. 2025DeBackdoor: A Deductive Framework for Detecting Backdoor Attacks on Deep Models with Limited Datacited by 5
  2. 2025Bad-PFL: Exploring Backdoor Attacks against Personalized Federated Learningcited by 2
  3. 2025Defending the Edge: Representative-Attention Defense against Backdoor Attacks in Federated Learningcited by 1
  4. 2025TrojanDam: Detection-Free Backdoor Defense in Federated Learning through Proactive Model Robustification utilizing OOD Datacited by 0
  5. 2026DCInject: Persistent Backdoor Attacks via Frequency Manipulation in Personal Federated Learningcited by 0
  6. 2026TASER: Task-Aware Spectral Energy Refine for Backdoor Suppression in UAV Swarms Decentralized Federated Learningcited by 0