arXiv:2606. 25858v1 Announce Type: cross Abstract: Federated learning is vulnerable to backdoor attacks in which malicious clients inject poisoned updates while preserving benign-task performance.
By Kavindu Herath, Joshua C. Zhao, Saurabh Bagchi
The paper introduces DistScan, a backdoor detection framework for object detection models that identifies malicious behavior by detecting shifts in the pre‑NMS prediction class distribution relative to training class frequencies. DistScan operates on clean validation data, requiring no access to model weights, trigger knowledge, or additional training, and it aggregates intermediate predictions to flag backdoored models. Experiments on MS‑COCO and PASCAL VOC across two architectures and three scene‑level attack scenarios show that DistScan outperforms existing methods, improving average detection accuracy by 27.32 percentage points over the best baseline.
By Longtian Wang, Zhengyu Zhao, Chenhao Lin, Le Yang, Shiwei Wang, Yuhan Zhi, Xiaofei Xie, Chao Shen
arXiv:2606. 26285v1 Announce Type: cross Abstract: Noise-based backdoor attacks on diffusion models typically rely on input-time trigger injection, untargeted activation, and out-of-distribution target generation.
By William Aiken, Paula Branco, Guy-Vincent Jourdan, Iosif-Viorel Onut
Backdoor attacks compromise training data so that a model retains clean accuracy but predicts an attacker-chosen target on triggered inputs. At very low poisoning rates, only a few samples convey the trigger--target association, making poison-sample selection critical.
arXiv:2608. 14861v1 Announce Type: cross Abstract: Data poisoning attacks pose serious security threats to Federated Learning (FL) systems in Computer Vision.
By Nawrin Tabassum, Yanzhao Wu
The paper introduces Checkerboard, a clean‑label backdoor attack that uses a closed‑form, data‑independent trigger design based on an input‑space Fisher‑separability objective and a ridge four‑neighbor local‑smoothness prior. This approach yields a pixel‑wise checkerboard trigger without requiring data access, surrogate model training, or iterative optimization, and it outperforms existing norm‑bounded clean‑label attacks across four benchmark datasets. On CIFAR‑10, poisoning 20 samples with a 10/255 perturbation achieves a 95.72% attack success rate, while on IN‑100 a 0.4% global poisoning rate yields over 83% ASR without harming clean accuracy, and the attack remains robust against state‑of‑the‑art defenses.
By Yi Yang, Jinyang Huang, Binbin Liu, Feng-Qi Cui, Xiaokang Zhou, Haiming Jin, Zhi Liu, Jie Zhang, Meng Li