Bad-PFL: Exploring Backdoor Attacks against Personalized Federated Learning
Not on the map. Why?
Abstract (arXiv)
Data heterogeneity and backdoor attacks rank among the most significant challenges facing federated learning (FL). For data heterogeneity, personalized federated learning (PFL) enables each client to maintain a private personalized model to cater to client-specific knowledge. Meanwhile, vanilla FL has proven vulnerable to backdoor attacks. However, recent advancements in PFL community have demonstrated a potential immunity against such attacks. This paper explores this intersection further, revealing that existing federated backdoor attacks fail in PFL because backdoors about manually designed triggers struggle to survive in personalized models. To tackle this, we design Bad-PFL, which employs features from natural data as our trigger. As long as the model is trained on natural data, it inevitably embeds the backdoor associated with our trigger, ensuring its longevity in personalized models. Moreover, our trigger undergoes mutual reinforcement training with the model, further solidifying the backdoor's durability and enhancing attack effectiveness. The large-scale experiments across three benchmark datasets demonstrate the superior performance of our attack against various PFL methods, even when equipped with state-of-the-art defense mechanisms.
Key facts. Cited by 2 papers in the map (data through 7 Oct 2026). Builds on 25 of its 31 references that are in the map. First posted on arXiv 22 Jan 2025.
Builds on
25 of 31 references.
References · 25
- 2016Communication-Efficient Learning of Deep Networks from Decentralized Datacited by 7,592
- 2014Explaining and Harnessing Adversarial Examplescited by 7,287
- 2018Federated Optimization in Heterogeneous Networkscited by 2,971
- 2018How To Backdoor Federated Learningcited by 745
- 2020Ditto: Fair and Robust Federated Learning Through Personalizationcited by 665
- 2020Personalized Federated Learning with Moreau Envelopescited by 612
- 2021FedBN: Federated Learning on Non-IID Features via Local Batch Normalizationcited by 565
- 2021Exploiting Shared Representations for Personalized Federated Learningcited by 537
- 2019Local Model Poisoning Attacks to Byzantine-Robust Federated Learningcited by 479
- 2021Neural Attention Distillation: Erasing Backdoor Triggers from Deep Neural Networkscited by 313
- 2020Attack of the Tails: Yes, You Really Can Backdoor Federated Learningcited by 307
- 2021Adversarial Unlearning of Backdoors via Implicit Hypergradientcited by 160
13 more
- 2023Heterogeneous Federated Learning: State-of-the-art and Research Challengescited by 160
- 2022Neurotoxin: Durable Backdoors in Federated Learningcited by 97
- 2023Personalized Federated Learning with Feature Alignment and Classifier Collaborationcited by 97
- 2022Backdoor Defense with Machine Unlearningcited by 61
- 2022pFL-Bench: A Comprehensive Benchmark for Personalized Federated Learningcited by 44
- 2023Multi-metrics adaptively identifies backdoors in Federated learningcited by 23
- 2023PeFLL: Personalized Federated Learning by Learning to Learncited by 21
- 2023Revisiting Personalized Federated Learning: Robustness Against Backdoor Attackscited by 16
- 2023Backdoor Federated Learning by Poisoning Backdoor-Critical Layerscited by 16
- 2024Beyond Traditional Threats: A Persistent Backdoor Attack on Federated Learningcited by 15
- 2024Lurking in the shadows: Unveiling Stealthy Backdoor Attacks against Personalized Federated Learningcited by 6
- 2022PerDoor: Persistent Non-Uniform Backdoors in Federated Learning using Adversarial Perturbationscited by 5
- 2023You Can Backdoor Personalized Federated Learningcited by 4
Built on by
Citing papers per year: 2026: 2.
2 papers.