HPE: Hallucinated Positive Entanglement for Backdoor Attacks in Federated Self-Supervised Learning

TL;DR

This paper introduces HPE, a novel backdoor attack method for federated self-supervised learning that uses synthetic samples and feature entanglement to improve attack effectiveness and robustness against defenses.

Contribution

HPE is the first attack to combine hallucination-based augmentation and feature entanglement for stronger, more persistent backdoors in FSSL.

Findings

HPE outperforms existing backdoor methods in effectiveness.

HPE demonstrates robustness against various defense mechanisms.

HPE maintains attack persistence across multiple datasets.

Abstract

Federated self-supervised learning (FSSL) enables collaborative training of self-supervised representation models without sharing raw unlabeled data. While it serves as a crucial paradigm for privacy-preserving learning, its security remains vulnerable to backdoor attacks, where malicious clients manipulate local training to inject targeted backdoors. Existing FSSL attack methods, however, often suffer from low utilization of poisoned samples, limited transferability, and weak persistence. To address these limitations, we propose a new backdoor attack method for FSSL, namely Hallucinated Positive Entanglement (HPE). HPE first employs hallucination-based augmentation using synthetic positive samples to enhance the encoder's embedding of backdoor features. It then introduces feature entanglement to enforce tight binding between triggers and backdoor samples in the representation space. Finally, selective parameter poisoning and proximity-aware updates constrain the poisoned model within the vicinity of the global model, enhancing its stability and persistence. Experimental results on several FSSL scenarios and datasets show that HPE significantly outperforms existing backdoor attack methods in performance and exhibits strong robustness under various defense mechanisms.