FedESP: Effective, Stealthy, and Persistent backdoor attack on federated learning

Abstract

Federated learning enables clients to train models collaboratively without exchanging local data, but its decentralized nature brings new security threats, including backdoor attacks. In a backdoor attack, adversaries embed triggers that lead the global model to produce incorrect predictions for certain inputs. Nevertheless, current approaches often demonstrate limited effectiveness, poor stealth, and low persistence. We address these issues by introducing FedESP. It first optimizes the trigger through adversarial training, ensuring its effectiveness even after the attacker ceases the attack, thus enhancing its persistence. A regularization term is incorporated during trigger optimization to further enhance stealth. Then FedESP selectively poisons high-responsive parameters and applies a malicious scaling factor to increase the impact of these poisoned updates, thereby improving the attack’s effectiveness. Experimental results on CIFAR-10 and CIFAR-100 confirm that FedESP achieves a higher success rate and persistence than benchmark methods while effectively bypassing existing backdoor defense mechanisms.