The paper introduces FedMAST, a Federated Multi‑Axis Structural Tracing defense designed to detect and contain backdoor attacks in federated learning. FedMAST evaluates client updates through complementary structural, spectral, and historical evidence, applying tiered filtering and round‑level containment. In experiments across six backdoor attacks, FedMAST consistently achieves lower attack success rates while preserving high main‑task accuracy.
By Srinivasan Subramanian, Kazi Aminul Islam, Md. Abdullah Al Hafiz Khan
The paper introduces Fractal-Triggered Distributed Backdoor Attack (FTDBA), a new method that uses fractal self‑similarity to strengthen sub‑triggers in federated learning backdoor attacks. By employing a dynamic angular perturbation mechanism, FTDBA reduces the amount of poisoned data needed while maintaining a 92.3% attack success rate. Experiments show a 22.8% lower detection rate and a 41.2% reduction in KL divergence compared to traditional distributed backdoor attacks.
By Jian Wang, Hong Shen, Chan-Tong Lam
FedNIA is a defense framework for federated learning that identifies and excludes malicious clients without needing a central test dataset. It works by injecting random noise inputs and analyzing layerwise activation patterns with an autoencoder to detect abnormal behaviors caused by data poisoning. The method can counter various attack types—including sample poisoning, label flipping, and backdoors—even when multiple attackers collaborate, and shows strong performance on non‑iid federated datasets.
By Ehsan Hallaji, Roozbeh Razavi-Far, Mehrdad Saif
The paper introduces Checkerboard, a clean‑label backdoor attack that uses a closed‑form, data‑independent trigger design based on an input‑space Fisher‑separability objective and a ridge four‑neighbor local‑smoothness prior. This approach yields a pixel‑wise checkerboard trigger without requiring data access, surrogate model training, or iterative optimization, and it outperforms existing norm‑bounded clean‑label attacks across four benchmark datasets. On CIFAR‑10, poisoning 20 samples with a 10/255 perturbation achieves a 95.72% attack success rate, while on IN‑100 a 0.4% global poisoning rate yields over 83% ASR without harming clean accuracy, and the attack remains robust against state‑of‑the‑art defenses.
By Yi Yang, Jinyang Huang, Binbin Liu, Feng-Qi Cui, Xiaokang Zhou, Haiming Jin, Zhi Liu, Jie Zhang, Meng Li
arXiv:2608. 07274v1 Announce Type: cross Abstract: Split Federated Learning (SFL) facilitates privacy-preserving collaborative training with reduced client-side overhead.
By Yuhan Xie, Jingrong Huang, Chen Lyu
arXiv:2606. 25858v1 Announce Type: cross Abstract: Federated learning is vulnerable to backdoor attacks in which malicious clients inject poisoned updates while preserving benign-task performance.
By Kavindu Herath, Joshua C. Zhao, Saurabh Bagchi
Backdoor attacks compromise training data so that a model retains clean accuracy but predicts an attacker-chosen target on triggered inputs. At very low poisoning rates, only a few samples convey the trigger--target association, making poison-sample selection critical.
The paper introduces Combinatorial Lock, a training‑free, hardware‑friendly defense against multi‑trigger backdoor attacks in AI models. It transforms multi‑trigger detection into a combinatorial problem over binary activation signatures, using anomaly‑gated spectral scrubbing and hash‑compressed signatures verified by expert ensembles. Experiments on six popular architectures show the method reduces attack success rates to 0.1% while maintaining 97.8% clean accuracy, with modest latency overhead on ASIC and FPGA platforms.
By Soumita Chatterjee, Sudip Ghosh, Tamal Ghosh, Bhargab B. Bhattacharya, Hafizur Rahaman
The paper introduces STAIN-FL, a stealthy backdoor attack framework for federated video anomaly detection that uses natural surveillance conditions—such as low light, indoor settings, and crowd density—as contextual triggers. STAIN-FL manipulates anomaly labels and masks gradients to keep clean accuracy low while inducing trigger‑conditioned misclassification. Experiments on UCF‑Crime with I3D features show that sparse attacks remain undetectable, drop clean accuracy by less than 2%, yet achieve over 50% backdoor accuracy for hundreds of rounds under FedAvg and FedProx.
By Ashlinder Kaur, Purnima Murali Mohan, Zengxiang Li, Tram Truong-Huu
arXiv:2606. 09548v1 Announce Type: cross Abstract: Federated Learning (FL) allows a set of clients to collectively train a global model without sharing local training data.
By Bastien Vuillod, Kevin Hector, Pierre-Alain Moellic, Jean-Max Dutertre, Olivier Potin
The paper proposes using lossy compression as a security signal in federated learning by defining a "compression footprint"—a low‑dimensional set of statistics derived from the compressor’s output. It introduces CRAFT, a server‑side aggregation method that leverages these footprints to distinguish honest from malicious updates without extra client metadata or knowledge of attacker numbers. Experiments on six attacks and datasets show CRAFT often outperforms existing robust aggregation baselines, demonstrating that compression can simultaneously reduce communication and enhance security.
By Sachi Shome, William Eiers
arXiv:2607. 07314v1 Announce Type: cross Abstract: Federated learning (FL) avoids explicit data exposure by keeping raw data on local clients, yet privacy risks remain in the training process and the learned model itself.
By Chongkai Li, Bang Zhang, Wenjian Luo