FTA: Stealthy and Adaptive Backdoor Attack with Flexible Triggers on Federated Learning

TL;DR

This paper introduces a stealthy, adaptive backdoor attack on federated learning that uses a generative trigger function to manipulate samples with imperceptible patterns, evading existing defenses.

Contribution

It presents a novel generative trigger mechanism that learns and adapts over rounds, enhancing stealthiness and robustness against federated learning defenses.

Findings

Outperforms prior backdoor attacks in effectiveness

Remains undetected by multiple defense mechanisms

Effective on real-world datasets

Abstract

Current backdoor attacks against federated learning (FL) strongly rely on universal triggers or semantic patterns, which can be easily detected and filtered by certain defense mechanisms such as norm clipping, comparing parameter divergences among local updates. In this work, we propose a new stealthy and robust backdoor attack with flexible triggers against FL defenses. To achieve this, we build a generative trigger function that can learn to manipulate the benign samples with an imperceptible flexible trigger pattern and simultaneously make the trigger pattern include the most significant hidden features of the attacker-chosen label. Moreover, our trigger generator can keep learning and adapt across different rounds, allowing it to adjust to changes in the global model. By filling the distinguishable difference (the mapping between the trigger pattern and target label), we make our attack naturally stealthy. Extensive experiments on real-world datasets verify the effectiveness and stealthiness of our attack compared to prior attacks on decentralized learning framework with eight well-studied defenses.