Exploiting Layer-Specific Vulnerabilities to Backdoor Attack in Federated Learning

Mohammad Hadi Foroughi; Seyed Hamed Rastegar; Mohammad Sabokrou; Ahmad Khonsari

cs.CRFeb 16, 2026

Exploiting Layer-Specific Vulnerabilities to Backdoor Attack in Federated Learning

Authors: Mohammad Hadi Foroughi, Seyed Hamed Rastegar, Mohammad Sabokrou, Ahmad Khonsari

Organizations: School of Electrical and Computer Engineering, University of Tehran, Tehran, Iran. · School of Computer Science, Institute for Research in Fundamental Sciences (IPM), Tehran, Iran. · School of Electrical and Computer Engineering, Shiraz University, Shiraz, Iran. · Okinawa Institute of Science and Technology, Okinawa, Japan

Abstract

Federated learning (FL) enables distributed model training across edge devices while preserving data locality. This decentralized approach has emerged as a promising solution for collaborative learning on sensitive user data, effectively addressing the longstanding privacy concerns inherent in centralized systems. However, the decentralized nature of FL exposes new security vulnerabilities, especially backdoor attacks that threaten model integrity. To investigate this critical concern, this paper presents the Layer Smoothing Attack (LSA), a novel backdoor attack that exploits layer-specific vulnerabilities in neural networks. First, a Layer Substitution Analysis methodology systematically identifies backdoor-critical (BC) layers that contribute most significantly to backdoor success. Subsequently, LSA strategically manipulates these BC layers to inject persistent backdoors while remaining undetected by state-of-the-art defense mechanisms. Extensive experiments across diverse model architectures and datasets demonstrate that LSA achieves a remarkably backdoor success rate of up to 97% while maintaining high model accuracy on the primary task, consistently bypassing modern FL defenses. These findings uncover fundamental vulnerabilities in current FL security frameworks, demonstrating that future defenses must incorporate layer-aware detection and mitigation strategies.

Figures & tables

Fig. 1: The layer substitution process for identifying BC-layers in LSA attack

Layer	Size
Input	$28\times 28\times 1$
Convolution + ReLU	$3\times 3\times 32$
Convolution + ReLU	$3\times 3\times 64$
Max Pooling	$2\times 2$
Dropout	$0.5$
Fully Connected + ReLU	$128$

TABLE I: 5-layer CNN model architecture

model	attack	MAR	BAR
ResNet18	LSA	89.50	58.56
	LPA	57.00	63.94
	BadNets	5.58	74.86
	DBA	3.50	75.06
VGG19	LSA	97.00	55.89
	LPA	65.50	59.77

TABLE II: Accuracy of the Flame defense in detecting malicious and benign models (%). Highest MAR and BAR values are bolded.

defense	attack-free	LSA
FedAVG	77.26	75.18
Median	77.37	79.61
Trimmed-Mean	77.02	78.09
Multi-Krum	73.49	78.52
FLTrust	74.61	75.24
Flame	71.10	72.76

TABLE III: Comparison of main task accuracy without and under LSA attack on ResNet18 (%). Highest values are bolded.

Model	Defense	DBA		BadNets		LPA		LSA
		ACC	BSR	ACC	BSR	ACC	BSR	ACC	BSR
ResNet18	FedAVG	77.99	10.94	77.58	70.53	72.97	84.84	73.86	96.67
	Median	78.87	12.16	78.91	66.13	78.30	91.36	79.61	93.25
	Trimmed-Mean	78.34	13.88	78.13	67.50	76.18	90.00	78.09	95.58
	Multi-Krum	73.02	5.61	74.49	3.95	68.45	84.16	76.89	92.01
	FLTrust	77.51	15.11	75.72	75.84	64.95	83.00	69.98	95.94

TABLE IV: Best-run ACC and BSR for ResNet18, VGG19, and CNN (%). Highest values per defense are bolded.

Fig. 2: BSR vs. $\tau$ for ResNet18 under the Flame defense.

Fig. 3: BSR vs. $\lambda$ for ResNet18 under the Flame defense.

Fig. 4: BSR vs. Detection period length for ResNet18 under the Flame defense.

Explore similar work

Mitigating Backdoor Attacks in Federated Learning Using PPA and MiniMax Game Theory
Mar 30, 2026Osama Wehbi, Sarhad Arisdakessian, Omar Abdel Wahab +3Backdoor Attacks in Federated Learning Federated Learning
Department of Computer and Software Engineering, Polytechnique Montréal, Montreal, Quebec, Canada · Institut national de la recherche scientifique (INRS-EMT), Montréal, Canada · Department of Computer Science, Khalifa University, Abu Dhabi, UAE +1
Fine-grained Distributed Backdoor Attacks in Federated Learning
Sep 7, 2026Jian Wang, Hong Shen, Wei Ke +1Backdoor Attacks in Federated Learning Federated Learning
Faculty of Applied Sciences, Macao Polytechnic University, R. de Luís Gonzaga Gomes, Macao, 999078, China · Faculty of Cyberspace Security, Guangzhou University of Software, No.548 Guangcong South Road, High-tech Industrial Park, Conghua Economic Development Zone, Guangzhou, 501900, China · School of Engineering and Technology, Central Queensland University, Bruce Highway, Norman Gardens, Rockhampton, Queensland, 4702, Australia +1
SCRUB-FL: Sanitizing and Cleansing Representations via Unlearning of Backdoors
Jun 21, 2026Osama Wehbi, Sarhad Arisdakessian, Omar Abdel Wahab +2Backdoor Attacks in Federated Learning Federated Learning
Department of Computer and Software Engineering, Polytechnique Montréal, Montreal, Quebec, Canada · Department of Computer Science, Khalifa University, Abu Dhabi, UAE

Mar 30, 2026J/K move · Enter open · S save

Mitigating Backdoor Attacks in Federated Learning Using PPA and MiniMax Game Theory

Osama Wehbi, Sarhad Arisdakessian, Omar Abdel Wahab, Anderson Avila+2

Department of Computer and Software Engineering, Polytechnique Montréal, Montreal, Quebec, Canada · Institut national de la recherche scientifique (INRS-EMT), Montréal, Canada · Department of Computer Science, Khalifa University, Abu Dhabi, UAE+1

Backdoor Attacks in Federated Learning Federated Learning

Open paper AskPDF arXiv

Federated Learning (FL) is witnessing wider adoption due to its ability to benefit from large amounts of scattered data while preserving privacy. However, despite its advantages, federated learning suffers from several setbacks that directly impact the accuracy, and the integrity of the global model it produces. One of these setbacks is the presence of malicious clients who actively try to harm the global model by injecting backdoor data into their local models while trying to evade detection. The objective of such clients is to trick the global model into making false predictions during inference, thereby compromising the integrity and trustworthiness of the global model on which honest stakeholders rely. To mitigate such mischievous behavior, we propose FedBBA (Federated Backdoor and Behavior Analysis). The proposed model aims to dampen the effect of such clients on the final accuracy, creating more resilient federated learning environments. We engineer our approach through the combination of (1) a reputation system to evaluate and track client behavior, (2) an incentive mechanism to reward honest participation and penalize malicious behavior, and (3) game theoretical models with projection pursuit analysis (PPA) to dynamically identify and minimize the impact of malicious clients on the global model. Extensive simulations on the German Traffic Sign Recognition Benchmark (GTSRB) and Belgium Traffic Sign Classification (BTSC) datasets demonstrate that FedBBA reduces the backdoor attack success rate to approximately 1.1%--11% across various attack scenarios, significantly outperforming state-of-the-art defenses like RDFL and RoPE, which yielded attack success rates between 23% and 76%, while maintaining high normal task accuracy (~95%--98%).

Abstract

Explore similar work

Mitigating Backdoor Attacks in Federated Learning Using PPA and MiniMax Game Theory

Fine-grained Distributed Backdoor Attacks in Federated Learning

SCRUB-FL: Sanitizing and Cleansing Representations via Unlearning of Backdoors