IPBA: Imperceptible Perturbation Backdoor Attack in Federated Self-Supervised Learning

TL;DR

This paper introduces IPBA, an imperceptible backdoor attack method for federated self-supervised learning, addressing challenges of stealthiness and effectiveness faced by existing approaches.

Contribution

IPBA decouples feature distributions and uses Sliced-Wasserstein distance to enhance stealth and transferability of backdoor triggers in FSSL.

Findings

IPBA outperforms existing backdoor methods in effectiveness.

IPBA demonstrates strong robustness against defense mechanisms.

Traditional triggers face transferability and out-of-distribution issues.

Abstract

Federated self-supervised learning (FSSL) combines the advantages of decentralized modeling and unlabeled representation learning, serving as a cutting-edge paradigm with strong potential for scalability and privacy preservation. Although FSSL has garnered increasing attention, research indicates that it remains vulnerable to backdoor attacks. Existing methods generally rely on visually obvious triggers, which makes it difficult to meet the requirements for stealth and practicality in real-world deployment. In this paper, we propose an imperceptible and effective backdoor attack method against FSSL, called IPBA. Our empirical study reveals that existing imperceptible triggers face a series of challenges in FSSL, particularly limited transferability, feature entanglement with augmented samples, and out-of-distribution properties. These issues collectively undermine the effectiveness and stealthiness of traditional backdoor attacks in FSSL. To overcome these challenges, IPBA decouples the feature distributions of backdoor and augmented samples, and introduces Sliced-Wasserstein distance to mitigate the out-of-distribution properties of backdoor samples, thereby optimizing the trigger generation process. Our experimental results on several FSSL scenarios and datasets show that IPBA significantly outperforms existing backdoor attack methods in performance and exhibits strong robustness under various defense mechanisms.