FTA: Stealthy and Adaptive Backdoor Attack with Flexible Triggers on Federated Learning
This is an incremental improvement for federated learning security, addressing vulnerabilities in decentralized systems.
The authors tackled the problem of backdoor attacks in federated learning being easily detected by defenses, and they proposed a stealthy attack using flexible triggers that adapt across rounds, achieving high success rates (e.g., over 90% attack success) while evading eight defenses.
Current backdoor attacks against federated learning (FL) strongly rely on universal triggers or semantic patterns, which can be easily detected and filtered by certain defense mechanisms such as norm clipping, comparing parameter divergences among local updates. In this work, we propose a new stealthy and robust backdoor attack with flexible triggers against FL defenses. To achieve this, we build a generative trigger function that can learn to manipulate the benign samples with an imperceptible flexible trigger pattern and simultaneously make the trigger pattern include the most significant hidden features of the attacker-chosen label. Moreover, our trigger generator can keep learning and adapt across different rounds, allowing it to adjust to changes in the global model. By filling the distinguishable difference (the mapping between the trigger pattern and target label), we make our attack naturally stealthy. Extensive experiments on real-world datasets verify the effectiveness and stealthiness of our attack compared to prior attacks on decentralized learning framework with eight well-studied defenses.