PBA: Persistent backdoor attack on federated learning via distributed generative triggers

Abstract

Federated learning (FL) is a distributed machine learning framework in which multiple clients collaboratively train a global model without sharing their raw data. However, its distributed nature and data heterogeneity make it particularly vulnerable to security threats, such as backdoor attacks. In backdoor attacks, adversaries inject hidden triggers into the training process, causing the global model to behave maliciously on specific inputs while maintaining normal performance otherwise. These attacks exploit the inability of the server to audit local client data by poisoning local datasets and model updates. Once aggregated, these updates compromise the global model. Existing backdoor attacks in FL face significant limitations in both attack effectiveness and persistence. To address these limitations, we propose the Persistent Backdoor Attack (PBA), a novel framework that significantly enhances attack success rates and persistence. PBA generates hidden triggers in a distributed manner by creating distinct triggers for different local models and injecting them into partial local datasets to conduct attacks. PBA employs dynamic trigger generation throughout the training process, substantially improving both stealthiness and attack persistence. Comprehensive experiments demonstrate that PBA consistently outperforms SOTA backdoor attacks in federated learning. For instance, on the Tiny-ImageNet dataset, PBA achieves a peak ASR that is over 1% higher than that of SOTA baselines, and stays over 10% higher by the end of training. Overall, PBA provides a more effective, stealthy, and durable solution for executing backdoor attacks in federated learning systems.