BadFU: Backdoor Federated Learning through Adversarial Machine Unlearning

TL;DR

This paper introduces BadFU, a novel backdoor attack in federated learning that exploits the unlearning process, demonstrating significant security vulnerabilities and highlighting the need for more robust federated unlearning methods.

Contribution

The paper presents the first backdoor attack in federated unlearning, showing how malicious clients can compromise model integrity through unlearning requests.

Findings

BadFU effectively injects backdoors during federated unlearning.

The attack works across various FL frameworks and unlearning strategies.

Current federated unlearning practices are vulnerable to backdoor exploitation.

Abstract

Federated learning (FL) has been widely adopted as a decentralized training paradigm that enables multiple clients to collaboratively learn a shared model without exposing their local data. As concerns over data privacy and regulatory compliance grow, machine unlearning, which aims to remove the influence of specific data from trained models, has become increasingly important in the federated setting to meet legal, ethical, or user-driven demands. However, integrating unlearning into FL introduces new challenges and raises largely unexplored security risks. In particular, adversaries may exploit the unlearning process to compromise the integrity of the global model. In this paper, we present the first backdoor attack in the context of federated unlearning, demonstrating that an adversary can inject backdoors into the global model through seemingly legitimate unlearning requests. Specifically, we propose BadFU, an attack strategy where a malicious client uses both backdoor and camouflage samples to train the global model normally during the federated training process. Once the client requests unlearning of the camouflage samples, the global model transitions into a backdoored state. Extensive experiments under various FL frameworks and unlearning strategies validate the effectiveness of BadFU, revealing a critical vulnerability in current federated unlearning practices and underscoring the urgent need for more secure and robust federated unlearning mechanisms.