# STAIN-FL: Stealthy Targeted Attack Injection with Contextual Triggers in Federated Learning

arXiv: https://arxiv.org/abs/2608.23952 · HTML: https://mlsanity.com/paper/2608.23952/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Placed in Federated unlearning and poisoning, one of 12 directions in LLM safety and security.
- Builds on 7 of its 11 references that are in the map.
- First posted on arXiv 25 Aug 2026.

## Placed in

- LLM safety and security / [Federated unlearning and poisoning](https://mlsanity.com/safety/federated-unlearning-and-poisoning/)

## Builds on (most cited first, 7 of 7)

- [Communication-Efficient Learning of Deep Networks from Decentralized Data](https://mlsanity.com/paper/1602.05629/) (2016)
- [Federated Optimization in Heterogeneous Networks](https://mlsanity.com/paper/1812.06127/) (2018)
- [Real-world Anomaly Detection in Surveillance Videos](https://mlsanity.com/paper/1801.04264/) (2018)
- [Neurotoxin: Durable Backdoors in Federated Learning](https://mlsanity.com/paper/2206.10341/) (2022)
- [Collaborative Learning of Anomalies with Privacy (CLAP) for Unsupervised Video Anomaly Detection: A New Baseline](https://mlsanity.com/paper/2404.00847/) (2024)
- [Cross-Context Backdoor Attacks against Graph Prompt Learning](https://mlsanity.com/paper/2405.17984/) (2024)
- [SDBA: A Stealthy and Long-Lasting Durable Backdoor Attack in Federated Learning](https://mlsanity.com/paper/2409.14805/) (2024)

## Abstract (arXiv)

Federated video anomaly detection trains model collaboratively without sharing raw surveillance footage, but limited server-side visibility lets compromised clients to inject backdoor via malicious updates. This paper introduces STAIN-FL, a stealthy targeted backdoor attack injection framework that uses naturally occurring surveillance conditions, including low-light scenes, indoor settings, and crowd density, as contextual triggers. STAIN-FL combines anomaly-to-benign label textitmanipulation with gradient masking over least-updated coordinates to preserve clean accuracy while inducing trigger-conditioned misclassification. We evaluate STAIN-FL on textttUCF-Crime using 1024-dimensional I3D features in a non-IID four-client multi-agency setting, comparing FedAvg and FedProx under sparse and continuous attacks. Results show that sparse attacks have low-detectability, operationally significant attacks rather than high-intensity attacks: they keep the mean clean-accuracy drop below 2%, yet still misclassify more than half of triggered anomalies at peak backdoor accuracy under FedAvg (56.7%) and FedProx (54.2%). Under FedAvg, the sparse backdoor remains above the 25% backdoor-accuracy threshold for an average of 336 post-attack rounds, highlighting the persistence risk of contextually triggered attacks in surveillance systems.