Concealing Backdoor Model Updates in Federated Learning by Trigger-Optimized Data Poisoning
<|reference_start|>Concealing Backdoor Model Updates in Federated Learning by Trigger-Optimized Data Poisoning: Federated Learning (FL) is a decentralized machine learning method that enables participants to collaboratively train a model without sharing their private data. Despite its privacy and scalability benefits, FL is susceptible to backdoor attacks, where adversaries poison the local training data of a subset of clients using a backdoor trigger, aiming to make the aggregated model produce malicious results when the same backdoor condition is met by an inference-time input. Existing backdoor attacks in FL suffer from common deficiencies: fixed trigger patterns and reliance on the assistance of model poisoning. State-of-the-art defenses based on analyzing clients' model updates exhibit a good defense performance on these attacks because of the significant divergence between malicious and benign client model updates. To effectively conceal malicious model updates among benign ones, we propose DPOT, a backdoor attack strategy in FL that dynamically constructs backdoor objectives by optimizing a backdoor trigger, making backdoor data have minimal effect on model updates. We provide theoretical justifications for DPOT's attacking principle and display experimental results showing that DPOT, via only a data-poisoning attack, effectively undermines state-of-the-art defenses and outperforms existing backdoor attack techniques on various datasets.<|reference_end|>
@article{zhang2024concealing,
    title={Concealing Backdoor Model Updates in Federated Learning by
  Trigger-Optimized Data Poisoning},
    author={Yujie Zhang, Neil Gong, Michael K. Reiter},
    journal={arXiv preprint arXiv:2405.06206},
    year={2024},
    archivePrefix={arXiv},
    eprint={2405.06206},
    primaryClass={cs.CR cs.AI cs.LG}
}