mlsanityData to 14 Oct 2026

BackFed: An Efficient & Standardized Benchmark Suite for Backdoor Attacks in Federated Learning

arXiv 2507.04903 ↗First posted 7 Jul 2025cs.CR cs.AI cs.DCcited by 1

Not on the map. Why?

Abstract (arXiv)

Research on backdoor attacks in Federated Learning (FL) has accelerated in recent years, with new attacks and defenses continually proposed in an escalating arms race. However, the evaluation of these methods remains neither standardized nor reliable. First, there are severe inconsistencies in the evaluation settings across studies, and many rely on unrealistic threat models. Second, our code review uncovers semantic bugs in the official codebases of several attacks that artificially inflate their reported performance. These issues raise fundamental questions about whether current methods are truly effective or simply overfitted to narrow experimental setups. We introduce BackFed, a benchmark designed to standardize and stress-test FL backdoor evaluation by unifying attacks and defenses under a common evaluation framework that mirrors realistic FL deployments. Our benchmark on three representative datasets with three distinct architectures reveals critical limitations of existing methods. Malicious clients often require excessive training time and computation, making them vulnerable to server-enforced time constraints. Meanwhile, several defenses incur severe accuracy degradation or aggregation overhead. Popular defenses and attacks achieve limited performance in our benchmark, which challenges their previous efficacy claims. We establish BackFed as a rigorous and fair evaluation framework that enables more reliable progress in FL backdoor research.

Key facts. Cited by 1 paper in the map (data through 14 Oct 2026). Builds on 53 of its 73 references that are in the map. First posted on arXiv 7 Jul 2025.

Builds on

53 of 73 references.

References · 53

  1. 2016Communication-Efficient Learning of Deep Networks from Decentralized Datacited by 7,669
  2. 2016Grad-CAM: Visual Explanations from Deep Networks via Gradient-based Localizationcited by 6,733
  3. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,415
  4. 2019Theoretically Principled Trade-off between Robustness and Accuracycited by 1,517
  5. 2016Federated Learning: Strategies for Improving Communication Efficiencycited by 1,475
  6. 2017Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoningcited by 1,055
  7. 2018LEAF: A Benchmark for Federated Settingscited by 792
  8. 2018How To Backdoor Federated Learningcited by 765
  9. 2018Byzantine-Robust Distributed Learning: Towards Optimal Statistical Ratescited by 711
  10. 2018Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networkscited by 580
  11. 2017Ray: A Distributed Framework for Emerging AI Applicationscited by 527
  12. 2022Diffusion Models for Adversarial Purificationcited by 476
38 more
  1. 2019STRIP: A Defence Against Trojan Attacks on Deep Neural Networkscited by 459
  2. 2020Reflection Backdoor: A Natural Backdoor Attack on Deep Neural Networkscited by 349
  3. 2020FLTrust: Byzantine-robust Federated Learning via Trust Bootstrappingcited by 346
  4. 2018The Hidden Vulnerability of Distributed Learning in Byzantiumcited by 329
  5. 2019Robust Aggregation for Federated Learningcited by 317
  6. 2020Attack of the Tails: Yes, You Really Can Backdoor Federated Learningcited by 309
  7. 2019A Little Is Enough: Circumventing Defenses For Distributed Learningcited by 288
  8. 2017PixelDefend: Leveraging Generative Models to Understand and Defend against Adversarial Examplescited by 244
  9. 2019A new Backdoor Attack in CNNs by training set corruption without label poisoningcited by 242
  10. 2021Adversarial Neuron Pruning Purifies Backdoored Deep Modelscited by 235
  11. 2020Blind Backdoors in Deep Learning Modelscited by 182
  12. 2018Mitigating Sybils in Federated Learning Poisoningcited by 161
  13. 2022BackdoorBench: A Comprehensive Benchmark of Backdoor Learningcited by 128
  14. 2022FLDetector: Defending Federated Learning Against Model Poisoning Attacks via Detecting Malicious Clientscited by 125
  15. 2022Neurotoxin: Durable Backdoors in Federated Learningcited by 98
  16. 2021CRFL: Certifiably Robust Federated Learning against Backdoor Attackscited by 91
  17. 2020Defending against Backdoors in Federated Learning with Robust Learning Ratecited by 82
  18. 2022DeepSight: Mitigating Backdoor Attacks in Federated Learning Through Deep Model Inspectioncited by 81
  19. 2020Local and Central Differential Privacy for Robustness and Privacy in Federated Learningcited by 78
  20. 2021Collaborative Unsupervised Visual Representation Learning from Decentralized Datacited by 69
  21. 2023Reconstructive Neuron Pruning for Backdoor Defensecited by 59
  22. 2020The TrojAI Software Framework: An OpenSource tool for Embedding Trojans into Deep Learning Modelscited by 42
  23. 2022FLIP: A Provable Defense Framework for Backdoor Mitigation in Federated Learningcited by 37
  24. 2021FL-WBC: Enhancing Robustness against Model Poisoning Attacks in Federated Learning from a Client Perspectivecited by 36
  25. 2023Backdoor Attacks and Defenses in Federated Learning: Survey, Challenges and Future Research Directionscited by 33
  26. 2020TrojanZoo: Towards Unified, Holistic, and Practical Evaluation of Neural Backdoorscited by 30
  27. 2022CrowdGuard: Federated Backdoor Detection in Federated Learningcited by 27
  28. 2023On the Vulnerability of Backdoor Defenses for Federated Learningcited by 27
  29. 2021More than Encoder: Introducing Transformer Decoder to Upsamplecited by 26
  30. 2023Multi-metrics adaptively identifies backdoors in Federated learningcited by 23
  31. 2023Chameleon: Adapting to Peer Images for Planting Durable Backdoors in Federated Learningcited by 21
  32. 2023Backdoor Federated Learning by Poisoning Backdoor-Critical Layerscited by 18
  33. 2021Robust Federated Learning with Attack-Adaptive Aggregationcited by 17
  34. 2024BackdoorIndicator: Leveraging OOD Data for Proactive Backdoor Detection in Federated Learningcited by 17
  35. 2024Beyond Traditional Threats: A Persistent Backdoor Attack on Federated Learningcited by 16
  36. 2025Detecting Backdoor Attacks in Federated Learning via Direction Alignment Inspectioncited by 13
  37. 2022RFLBAT: A Robust Federated Learning Algorithm against Backdoor Attackcited by 10
  38. 2022Thinking Two Moves Ahead: Anticipating Other Users Improves Backdoor Attacks in Federated Learningcited by 7

50 most cited of 53 All 53 (JSON)

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2026: 1.

1 paper.

  1. 2026BackDFL: A Unified Benchmark For Backdoor Attacks and Defenses In Decentralized Federated Learningcited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2024DarkFed: A Data-Free Backdoor Attack in Federated Learning
  2. 2026Revisiting Backdoor Threat in Federated Instruction Tuning from a Signal Aggregation Perspective
  3. 2024Concealing Backdoor Model Updates in Federated Learning by Trigger-Optimized Data Poisoning
  4. 2023FedGrad: Mitigating Backdoor Attacks in Federated Learning Through Local Ultimate Gradients Inspection
  5. 2022Technical Report: Assisting Backdoor Federated Learning with Whole Population Knowledge Alignment
  6. 2024Client-Side Patching against Backdoor Attacks in Federated Learning
  7. 2024Non-Cooperative Backdoor Attacks in Federated Learning: A New Threat Landscape
  8. 2022Invariant Aggregator for Defending against Federated Backdoor Attacks