Federated backdoor attack with aggregated triggers optimized by maximum mean discrepancy

Summary

Researchers propose MABA, a distributed backdoor attack for Federated Learning in which each malicious client builds a local trigger aligned to the benign model's feature distribution via Maximum Mean Discrepancy (MMD) constraints. The malicious clients then collaboratively form a persistent global trigger that adapts to update magnitudes and sample features with dynamic noise intensity. On federated image classification with convolutional neural networks, the method evades existing defenses and keeps attack success above 90% on CIFAR-10 under most defenses across 200 post-attack rounds, reaching 100% on CIFAR-10 and over 90% on FMNIST and CIFAR-100.

Topics

• Adversarial machine learning

Related items

• LowLLM Trojans that Increase Response Lengths and CostSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• MediumBackdooring Open-Weight AI ModelsSimilar attack · Schneier on Security
• InfoBadpatches: routing-aware backdoor attacks on vision mixture-of-expertsSimilar attack · OpenAlex (peer-reviewed AI security)
• InfoDPOison-VL: Clean Preference Poisoning in Vision-Language Direct Preference OptimizationSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• InfoFedGraph: Defending Federated Large Language Model Fine-Tuning Against Backdoor Attacks via Graph-Based AggregationSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)