Learnable Trigger Backdoor Attacks for Federated Learning

doi:10.19678/j.issn.1000-3428.0252239

Abstract

Abstract:

Conventional clean label backdoor attacks often fail to establish a strong link between the trigger and target classes, resulting in a low Attack Success Rate (ASR). Extensive experimental evidence shows that this failure is even more severe in Federated Learning (FL). The main reason for attack failure is that the random selection of the trigger causes it to lack a direct connection with the target class. To this end, a learnable trigger backdoor attack is designed for FL, which fully utilized the task information and shared model issued by the central server to train a trigger that is strongly correlated with the target class. This training process is formalized into a dual-objective optimization problem and solved. The optimal perturbation under constraint conditions is found to blur the original features of the image as much as possible, thereby maximizing the model's learning ability for the trigger. Subsequently, these blurred images are trained by adding the triggers allowed within the specified range as inputs, minimizing their image classification loss and generating the optimal trigger quickly using the optimization method of small-batch Projected Gradient Descent (PGD). The backdoor attack activated by this trigger guarantees excellent attack performance in FL. The experimental results on three datasets show that the ASR of the proposed method in FL is much higher than that of all types of existing clean-label backdoor attacks, especially on CIFAR-10, which shows an improvement of more than 82 percentage points compared to the baseline method. The proposed attack method presents new challenges for the security of FL.

Key words: machine learning, Federated Learning (FL), backdoor attack, clean label attack, learnable trigger

摘要：

传统的干净标签后门攻击通常无法在触发器和目标类之间建立有效的强连接关系, 导致攻击成功率(ASR)降低。大量实验结果表明, 这种失效现象在联邦学习(FL)中更加严重。攻击失败的主要原因在于触发器的随机选择使其缺少和目标类的直接联系。为此, 面向FL设计一种可学习触发器后门攻击, 充分利用中心服务器下发的任务信息和共享模型训练与目标类强相关的触发器, 将该训练过程形式化为双目标优化问题并求解。在约束条件下找到最佳扰动尽可能模糊图像的原始特征, 从而最大化模型对触发器的学习能力; 然后对这些模糊图像添加规定范围内允许的触发器作为输入进行训练, 最小化其图像分类损失并利用小批量投影梯度下降(PGD)的优化方法快速生成最优触发器。利用该触发器激活的后门攻击在FL中仍能保证出色的攻击性能。在3个数据集上的实验结果表明, 所提方法在FL中攻击成功率远高于现有的各类干净标签后门攻击, 尤其在CIFAR-10上其ASR相较于基线方法提升了约82百分点, 所提出的攻击方法对FL的安全性提出了新的挑战。

关键词: 机器学习, 联邦学习, 后门攻击, 干净标签攻击, 可学习触发器

LIU Tao, MAN Dapeng, XU Chen, Lü Jiguang, FENG Zhu, ZENG Fanyi, ZHOU Xue, YANG Wu. Learnable Trigger Backdoor Attacks for Federated Learning[J]. Computer Engineering, 2026, 52(9): 306-319.

刘涛, 苘大鹏, 许晨, 吕继光, 冯驻, 曾凡一, 周雪, 杨武. 面向联邦学习的可学习触发器后门攻击[J]. 计算机工程, 2026, 52(9): 306-319.

/ Recommend / Download Citations

URL: https://www.ecice06.com/EN/10.19678/j.issn.1000-3428.0252239

https://www.ecice06.com/EN/Y2026/V52/I9/306

Figures/Tables 36

Fig.1 Overall process of the learnable trigger-based backdoor attack in federated learning

References 55

1	MCMAHAN H B, MOORE E, RAMAGE D, et al. Communication-efficient learning of deep networks from decentralized data[EB/OL]. [2025-02-10]. https://arxiv.org/pdf/1602.05629.
2	吴若岚, 陈玉玲, 豆慧, 等. 抗攻击的联邦学习隐私保护算法. 计算机工程, 2025, 51 (2): 179- 187. doi: 10.19678/j.issn.1000-3428.0068705
	WU R L , CHEN Y L , DOU H , et al. Privacy preserving algorithm using federated learning against attacks. Computer Engineering, 2025, 51 (2): 179- 187. doi: 10.19678/j.issn.1000-3428.0068705
3	熊世强, 何道敬, 王振东, 等. 联邦学习及其安全与隐私保护研究综述. 计算机工程, 2024, 50 (5): 1- 15.
	XIONG S Q , HE D J , WANG Z D , et al. Review of federated learning and its security and privacy protection. Computer Engineering, 2024, 50 (5): 1- 15.
4	张世文, 陈双, 梁伟, 等. 联邦学习中的攻击手段与防御机制研究综述. 计算机工程与应用, 2024, 60 (5): 1- 16.
	ZHANG S W , CHEN S , LIANG W , et al. Survey on attack methods and defense mechanisms in federated learning. Computer Engineering and Applications, 2024, 60 (5): 1- 16.
5	ZHAO Y, LI M, LAI L Z, et al. Federated learning with non-IID data[EB/OL]. [2025-02-10]. https://arxiv.org/abs/1806.00582.
6	WANG Y L , ZHAO M H , LI S H , et al. Dispersed pixel perturbation-based imperceptible backdoor trigger for image classifier models. IEEE Transactions on Information Forensics and Security, 2022, 17, 3091- 3106. doi: 10.1109/TIFS.2022.3202687
7	NING R, LI J, XIN C S, et al. Hibernated backdoor: a mutual information empowered backdoor attack to deep neural networks[C]//Proceedings of the AAAI Conference on Artificial Intelligence. Palo Alto, USA: AAAI Press, 2022: 10309-10318.
8	LI S F , XUE M H , ZHAO B Z H , et al. Invisible backdoor attacks on deep neural networks via steganography and regularization. IEEE Transactions on Dependable and Secure Computing, 2021, 18 (5): 2088- 2105.
9	ZHAO S H, MA X J, ZHENG X, et al. Clean-label backdoor attacks on video recognition models[C]//Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). Washington D.C., USA: IEEE Press, 2020: 14431-14440.
10	GAN L L, LI J W, ZHANG T W, et al. Triggerless backdoor attack for NLP tasks with clean labels[EB/OL]. [2025-02-10]. https://arxiv.org/abs/2111.07970.
11	BARNI M, KALLAS K, TONDI B. A new backdoor attack in CNNS by training set corruption without label poisoning[C]//Proceedings of the IEEE International Conference on Image Processing (ICIP). Washington D.C., USA: IEEE Press, 2019: 101-105.
12	TURNER A, TSIPRAS D, MADRY A. Label-consistent backdoor attacks[EB/OL]. [2025-02-10]. https://arxiv.org/abs/1912.02771.
13	LIN D Q, GUO Y C, SUN H, et al. FedCluster: a federated learning framework for cross-device private ECG classification[C]//Proceedings of the IEEE INFOCOM Conference on Computer Communications Workshops. Washington D.C., USA: IEEE Press, 2022: 1-6.
14	CAO X Y, GONG N Z. MPAF: model poisoning attacks to federated learning based on fake clients[C]//Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops (CVPRW). Washington D.C., USA: IEEE Press, 2022: 3395-3403.
15	SAHA A, SUBRAMANYA A, PIRSIAVASH H. Hidden trigger backdoor attacks[C]//Proceedings of the AAAI Conference on Artificial Intelligence. Palo Alto, USA: AAAI Press, 2020: 11957-11965.
16	CHELLAPPA R, FOWL L, GOLDBLUM M, et al. Sleeper agent: scalable hidden trigger backdoors for neural networks trained from scratch[C]//Proceedings of the Advances in Neural Information Processing Systems 35. Louisiana, USA: Neural Information Processing Systems Foundation, Inc, 2022: 19165-19178.
17	NING R, LI J, XIN C S, et al. Invisible poison: a blackbox clean label backdoor attack to deep neural networks[C]//Proceedings of the IEEE Conference on Computer Communications. Washington D.C., USA: IEEE Press, 2021: 1-10.
18	QUIRING E, RIECK K. Backdooring and poisoning neural networks with image-scaling attacks[C]//Proceedings of the IEEE Security and Privacy Workshops (SPW). Washington D.C., USA: IEEE Press, 2020: 41-47.
19	BAGDASARYAN E, VEIT A, HUA Y Q, et al. How to backdoor federated learning[EB/OL]. [2025-02-10]. https://arxiv.org/pdf/1807.00459.
20	BHAGOJI A N, CHAKRABORTY S, MITTAL P, et al. Analyzing federated learning through an adversarial lens[EB/OL]. [2025-02-10]. https://arxiv.org/pdf/1811.12470.
21	XIE C L, HUANG K L, CHEN P Y, et al. DBA: distributed backdoor attacks against federated learning[C]//Proceedings of International Conference on Learning Representations. New York, USA: [s. n], 2019: 1-10.
22	BONAWITZ K, EICHNER H, GRIESKAMP W, et al. Towards federated learning at scale: system design[EB/OL]. [2025-02-10]. https://arxiv.org/pdf/1902.01046.
23	ZENG Y, PAN M Z, JUST H A, et al. Narcissus: a practical clean-label backdoor attack with limited information[C]//Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security. New York, USA: ACM Press, 2023: 771-785.
24	SHANNON C E . Communication theory of secrecy systems. Bell System Technical Journal, 1949, 28 (4): 656- 715. doi: 10.1002/j.1538-7305.1949.tb00928.x
25	LI Y M. Poisoning-based backdoor attacks in computer vision[C]//Proceedings of the AAAI Conference on Artificial Intelligence. Palo Alto, USA: AAAI Press, 2023: 16121-16122.
26	JIANG W B, LI H W, XU G W, et al. Color backdoor: a robust poisoning attack in color space[C]//Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). Washington D.C., USA: IEEE Press, 2023: 8133-8142.
27	CHEN X Y, LIU C, LI B, et al. Targeted backdoor attacks on deep learning systems using data poisoning[EB/OL]. [2025-02-10]. https://arxiv.org/abs/1712.05526.
28	ZHONG H T, LIAO C, SQUICCIARINI A C, et al. Backdoor embedding in convolutional neural network models via invisible perturbation[C]//Proceedings of the 10th ACM Conference on Data and Application Security and Privacy. New York, USA: ACM Press, 2020: 97-108.
29	LI Z S, CHEN M M, HE Y F, et al. An efficient framework for detection and recognition of numerical traffic signs[C]//Proceedings of IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP). Washington D.C., USA: IEEE Press, 2022: 2235-2239.
30	BAN Y H, DONG Y P. Pre-trained adversarial perturbations[C]//Proceedings of the Advances in Neural Information Processing Systems 35. New Orleans, USA: Neural Information Processing Systems Foundation, Inc. 2022: 1196-1209.
31	MADRY A, MAKELOV A, SCHMIDT L, et al. Towards deep learning models resistant to adversarial attacks[EB/OL]. [2025-02-10]. https://arxiv.org/pdf/1706.06083.
32	ZHANG Z, PANDA A, SONG L, et al. Neurotoxin: durable backdoors in federated learning[C]//Proceedings of International Conference on Machine Learning. New York, USA: [s. n], 2022: 26429-26446.
33	LYU X T, HAN Y F, WANG W, et al. Poisoning with cerberus: stealthy and colluded backdoor attack against federated learning[C]// Proceedings of the AAAI Conference on Artificial Intelligence. Palo Alto, USA: AAAI Press, 2023: 9020-9028.
34	ANTONANTE P, VEER S, LEUNG K, et al. Task-aware risk estimation of perception failures for autonomous vehicles[EB/OL]. [2025-02-10]. https://arxiv.org/abs/2305.01870.
35	PASZKE A, LERER A, KILLEN T, et al. PyTorch: an imperative style, high-performance deep learning library[C]//Proceedings of Conference on Advances in Neural Information Processing Systems. New York, USA: [s. n], 2019, 32.
36	RECHT B, ROELOFS R, SCHMIDT L, et al. Do CIFAR-10 classifiers generalize to CIFAR-10? [EB/OL]. [2025-02-10]. https://arxiv.org/pdf/1806.00451.
37	STALLKAMP J, SCHLIPSING M, SALMEN J, et al. The German traffic sign recognition benchmark: a multi-class classification competition[C]//Proceedings of the 2011 International Joint Conference on Neural Networks. Washington D.C., USA: IEEE Press, 2011: 1453-1460.
38	HE K M, ZHANG X Y, REN S Q, et al. Deep residual learning for image recognition[C]//Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition. Washington D.C., USA: IEEE Press, 2016: 770-778.
39	万志成, 郑静. 基于狄利克雷过程高斯混合模型的变分推断. 杭州电子科技大学学报(自然科学版), 2021, 41 (5): 54- 61.
	WAN Z C , ZHEGN J . Variational inference for Gaussian mixture model based on Dirichlet process. Journal of Hangzhou University (Natural Sciences), 2021, 41 (5): 54- 61.
40	KESKAR N S, SOCHER R. Improving generalization performance by switching from Adam to SGD[EB/OL]. [2025-02-10]. https://arxiv.org/abs/1712.07628.
41	GU T Y, DOLAN-GAVITT B, GARG S. BadNets: identifying vulnerabilities in the machine learning model supply chain[EB/OL]. [2025-02-10]. https://arxiv.org/pdf/1708.06733.
42	COLAS C, SIGAUD O, OUDEYER P Y. How many random seeds? statistical power analysis in deep reinforcement learning experiments[EB/OL]. [2025-02-10]. https://arxiv.org/pdf/1806.08295.
43	NGUYEN T D , NGUYEN T , LE NGUYEN P , et al. Backdoor attacks and defenses in federated learning: survey, challenges and future research directions. Engineering Applications of Artificial Intelligence, 2024, 127, 107166. doi: 10.1016/j.engappai.2023.107166
44	GONG X , CHEN Y , WANG Q , et al. Backdoor attacks and defenses in federated learning: state-of-the-art, taxonomy, and future directions. IEEE Wireless Communications, 2022, 30 (2): 114- 121.
45	SWARTZ C A . Some geometrical properties of residual maps. Geophysics, 1954, 19 (1): 46- 70. doi: 10.1190/1.1437970
46	WANG Z , BOVIK A C , SHEIKH H R , et al. Image quality assessment: from error visibility to structural similarity. IEEE Transactions on Image Processing, 2004, 13 (4): 600- 612. doi: 10.1109/TIP.2003.819861
47	ZHANG R, ISOLA P, EFROS A A, et al. The unreasonable effectiveness of deep features as a perceptual metric[C]//Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. Washington D.C., USA: IEEE Press, 2018: 586-595.
48	BLANCHARD P, MHAMDI E M E, GUERRAOUI R, et al. Machine learning with adversaries: Byzantine tolerant gradient descent[EB/OL]. [2025-02-10]. https://proceedings.neurips.cc/paper_files/paper/2017/file/f4b9ec30ad9f68f89b29639786cb62ef-Paper.pdf.
49	CHEN Y D, SU L L, XU J M. Distributed statistical machine learning in adversarial settings: Byzantine gradient descent[C]//Proceedings of the ACM on Measurement and Analysis of Computing Systems. New York, USA: ACM Press, 2017: 1-25.
50	DAMASKINOS G, MHAMDI E M E, GUERRAOUI R, et al. Asynchronous Byzantine machine learning (the case of SGD)[EB/OL]. [2025-02-10]. https://arxiv.org/pdf/1802.07928.
51	XIE C, KOYEJO O, GUPTA I. Zeno: distributed stochastic gradient descent with suspicion-based fault-tolerance[EB/OL]. [2025-02-10]. https://arxiv.org/abs/1805.10032.
52	YIN D, CHEN Y D, KANNAN R, et al. Byzantine-robust distributed learning: towards optimal statistical rates[EB/OL]. [2025-02-10]. https://arxiv.org/pdf/1803.01498.
53	GEYER R C, KLEIN T, NABI M. Differentially private federated learning: a client level perspective[EB/OL]. [2025-02-10]. https://arxiv.org/abs/1712.07557.
54	MCMAHAN H B, RAMAGE D, TALWAR K, et al. Learning differentially private recurrent language models[EB/OL]. [2025-02-10]. https://arxiv.org/abs/1710.06963.
55	SUN Z T, KAIROUZ P, SURESH A T, et al. Can you really backdoor federated learning? [EB/OL]. [2025-02-10]. https://arxiv.org/abs/1911.07963.

[1]	SUN Jing, SHANG Kefeng, MENG Lichao, WU Kangkai, LI Jingjing. Review of Intelligent Scheduling Methods for Mega-Constellations [J]. Computer Engineering, 2026, 52(9): 1-30.
[2]	SONG Shuhan, TIAN Youliang, WANG Shuai. Secure Aggregation Method for Hierarchical Federated Learning with Non-interactive Verification [J]. Computer Engineering, 2026, 52(8): 149-162.
[3]	MAO Yuyang, XU Chongjun, YANG Huayu, ZHAI Xilin, ZHANG Hua. A Fast Multi-Stage Malicious Website Detection Method in IoV Environment [J]. Computer Engineering, 2026, 52(8): 126-137.
[4]	FENG Jiaqi, GAO Jian. Review of Information Extraction in the Field of Cyber Threat Intelligence [J]. Computer Engineering, 2026, 52(7): 56-75.
[5]	LI Xuexiang, ZHENG Yongli, ZHANG Yize, DUAN Pengsong. Review of Traffic Analysis Methods Based on Machine Learning and Pre-trained Model [J]. Computer Engineering, 2026, 52(6): 53-67.
[6]	LI Jiangtao, MA Li, LI Yang. Classification Method for Medical Data Based on the Fusion of Large and Small Models [J]. Computer Engineering, 2026, 52(5): 360-370.
[7]	WANG Tian, LI Guo, MEI Yaxin, ZHONG Wentao. Survey on Sensor—Cloud and Edge Computing (Invited) [J]. Computer Engineering, 2026, 52(5): 3-42.
[8]	WANG Renshuai, YANG Kuiwu, CHEN Yue, WANG Wen, WEI Jianghong. Survey of Deep Learning Backdoor Attack on Image Data [J]. Computer Engineering, 2026, 52(3): 62-78.
[9]	WU Zixuan, LIU Yinhua. Affective Assessment Based on Dynamic Digital Analysis of Pupil Diameter [J]. Computer Engineering, 2026, 52(2): 110-124.
[10]	QI Fengyi, ZHANG Xinyou, FENG Li, XING Huanlai. Wireless Device Identification Scheme Based on CSI Feature Fingerprints [J]. Computer Engineering, 2026, 52(2): 236-244.
[11]	CHEN Xianyi, MI Hui, HE Junjie, FU Zhangjie. Traceable Federated Learning Copyright Protection Method Based on Structural Embedding [J]. Computer Engineering, 2026, 52(2): 253-264.
[12]	ZUO Xinyi, MA Shuangbao, LI Shaoqing, WANG Zhenyu, LIU Wei, ZHANG Yang. MS PUF: Multi-dimensional Synergistic Design of Strong PUF Against Machine Learning Modeling Attacks [J]. Computer Engineering, 2025, 51(8): 62-73.
[13]	WANG Hao, GAO Jintao, WANG Jie. Review of Multi-table Join Order Selection in Databases Based on Machine Learning [J]. Computer Engineering, 2025, 51(7): 31-46.
[14]	DENG Zexian, ZHANG Yungui, ZHANG Lin. Research on Multi-Dimensional Time Series Classification Based on the Pre-Trained Recursive Transformer-Mixer [J]. Computer Engineering, 2025, 51(5): 154-165.
[15]	ZHUANG Ziwei, ZHU Junguo. Vietnamese Text Error Detection Method for Multi-source Text [J]. Computer Engineering, 2025, 51(5): 93-102.

Please choose a citation manager

Content to export