Structure-Aware Distributed Backdoor Attacks in Federated Learning

Wang Jian; Shen Hong; Ke Wei; Liu Xue Hua

cs.LGMar 4, 2026

Structure-Aware Distributed Backdoor Attacks in Federated Learning

Authors: Wang Jian, Shen Hong, Ke Wei, Liu Xue Hua

Organizations: Faculty of Applied Sciences, Macao Polytechnic University, R. de Luís Gonzaga Gomes, Macao, 999078, China · Faculty of Cyberspace Security, Software Engineering Institute of Guangzhou, No.548 Guangcong South Road, High-tech Industrial Park, Conghua Economic Development Zone, Guangzhou, 501900, China · School of Engineering and Technology, Central Queensland University, Bruce Highway, Norman Gardens, Rockhampton, Queensland, 4702, Australia · Faculty of Software and Artificial Intelligence, Software Engineering Institute of Guangzhou, No.548 Guangcong South Road, High-tech Industrial Park, Conghua Economic Development Zone, Guangzhou, 501900, China

Abstract

While federated learning protects data privacy, it also makes the model update process vulnerable to long-term stealthy perturbations. Existing studies on backdoor attacks in federated learning mainly focus on trigger design or poisoning strategies, typically assuming that identical perturbations behave similarly across different model architectures. This assumption overlooks the impact of model structure on perturbation effectiveness. From a structure-aware perspective, this paper analyzes the coupling relationship between model architectures and backdoor perturbations. We introduce two metrics, Structural Responsiveness Score (SRS) and Structural Compatibility Coefficient (SCC), to measure a model's sensitivity to perturbations and its preference for fractal perturbations. Based on these metrics, we develop a structure-aware fractal perturbation injection framework (TFI) to study the role of architectural properties in the backdoor injection process. Experimental results show that model architecture significantly influences the propagation and aggregation of perturbations. Networks with multi-path feature fusion can amplify and retain fractal perturbations even under low poisoning ratios, while models with low structural compatibility constrain their effectiveness. Further analysis reveals a strong correlation between SCC and attack success rate, suggesting that SCC can predict perturbation survivability. These findings highlight that backdoor behaviors in federated learning depend not only on perturbation design or poisoning intensity but also on the interaction between model architecture and aggregation mechanisms, offering new insights for structure-aware defense design.

Figures & tables

Figure 1: Overview of the TFI backdoor attack framework in federated learning

Figure 2: Illustration of fractal perturbation generation and frequency-domain embedding

Figure 3: Multi-scale generation of fractal perturbations and their frequency-domain

\epsilon_{i}^{(t)}=\Phi\!\left(\widehat{\mathrm{SRS}}(f_{i}),\,V_{i},\,I(t)\right)

Algorithm 1 TFI: Structure-Aware Fractal Injection Strategy

Dataset	Model	Structural Feature	Input Size
CIFAR-10	ResNet-18	Residual connections	$32\times 32$
CIFAR-10	DenseNet-121	Dense connections	$32\times 32$
CIFAR-10	VGG-16	Sequential convolution	$32\times 32$
CIFAR-10	ViT-Base	Self-attention	$32\times 32$
ImageNet-100	ResNet-50	Residual connections	$224\times 224$
ImageNet-100	DenseNet-121	Dense connections	$224\times 224$

Table 1: Configuration of datasets and model architectures

Figure 4: ASR and MTA comparison under fixed poisoning ratio on CIFAR-10

Figure 5: ASR and MTA comparison under fixed poisoning ratio on ImageNet-100

Figure 6: Gradient statistical consistency and anomaly detection rate

Figure 7: Frequency-domain features and detection performance of different triggers

Figure 8: Attack success rate under different defense mechanisms

DP noise level $\sigma$	ASR	ASR retention
No defense	89.2%	100%
0.05	70.1%	78.5%
0.10	58.7%	65.8%
0.20	37.8%	42.3%

Table 2: Attack success rate of TFI under different differential privacy noise intensities

Figure 9: Structural compatibility and attack success rate on CIFAR-10

Figure 10: Structural compatibility and attack success rate on ImageNet-100

Figure 11: Minimum poisoning ratio required to reach ASR=85% on CIFAR-10

Figure 12: Minimum poisoning ratio required to reach ASR=85% on ImageNet-100

Configuration	ASR	MTA	Detection rate	Update similarity	Retention
TFI (full)	89.2%	84.3%	18.5%	0.87	100%
w/o SCC-aware client selection	68.3%	85.2%	35.7%	0.79	76.6%
w/o fractal perturbation	72.5%	83.8%	62.3%	0.68	81.3%
w/o temporal coordination	75.8%	84.1%	45.2%	0.73	85.0%
w/o dynamic strength control	81.6%	84.5%	28.9%	0.82	91.5%

Table 3: Comparison of attack performance of TFI under different ablation configurations (CIFAR-10, ResNet-18, 5% poisoning)

Backdoor Attacks in Federated Learning

Backdoor attacks in federated learning study how malicious clients implant hidden behaviors that make models misclassify inputs under chosen conditions.

See all 32 papers

Backdoors Leave Structural Traces: FedMAST for Backdoor Detection and Containment in Federated Learning
Sep 4, 2026Srinivasan Subramanian, Md. Abdullah Al Hafiz Khan, Kazi Aminul IslamFederated Learning Aggregation Byzantine-Robust Federated Learning
Department of Computer Science Kennesaw State University Marietta, USA
Exploiting Layer-Specific Vulnerabilities to Backdoor Attack in Federated Learning
Feb 16, 2026Mohammad Hadi Foroughi, Seyed Hamed Rastegar, Mohammad Sabokrou +1Backdoor Attacks Backdoor Attacks in Federated Learning
School of Electrical and Computer Engineering, University of Tehran, Tehran, Iran. · School of Computer Science, Institute for Research in Fundamental Sciences (IPM), Tehran, Iran. · School of Electrical and Computer Engineering, Shiraz University, Shiraz, Iran. +1
Unveiling Hidden Threats: Using Fractal Triggers to Boost Stealthiness of Distributed Backdoor Attacks in Federated Learning
Nov 12, 2025Jian Wang, Hong Shen, Chan-Tong LamAdversarial Attacks Backdoor Attacks in Federated Learning
Faculty of Applied Sciences, Macao Polytechnic University, Macao SAR, China · School of Cyberspace Security, Guangzhou University of Software, Guangzhou, China · School of Engineering and Technology, Central Queensland University, Australia

Sep 4, 2026J/K move · Enter open · S save

Backdoors Leave Structural Traces: FedMAST for Backdoor Detection and Containment in Federated Learning

Srinivasan Subramanian, Md. Abdullah Al Hafiz Khan, Kazi Aminul Islam

Department of Computer Science Kennesaw State University Marietta, USA

Federated Learning Aggregation Byzantine-Robust Federated Learning Backdoor Attacks in Federated Learning Federated Learning

Open paper AskPDF arXiv

Federated learning enables distributed training without requiring clients to share their raw data. However, its reliance on the integrity of the client-submitted updates exposes the global model to stealthy backdoor poisoning. Existing defenses often rely on individual evidence sources, but stealth-constrained attacks can adapt to these signals. Such attacks can suppress anomaly signals they are optimized to evade, yet their poisoned updates still leave residual structural traces. We propose FedMAST, a Federated Multi-Axis Structural Tracing defense for backdoor detection in federated learning. FedMAST scores client updates using complementary structural, spectral, and historical evidence and then applies tiered filtering and round-level containment to limit adversarial influence. To capture traces that isolated signals may miss, FedMAST uses squeeze-pair coherence scoring to expose coupled feature distortions and signed spectral-drift tracking to reveal persistent directional changes over time. Across six backdoor attacks, FedMAST achieves lower attack success rate (ASR) than baseline defenses in all nine evaluated comparisons, averaging 1.51% ASR and 94.84% main-task accuracy (MTA) across the complete 200-round runs. Over the full 200-round method-aware CovertLayers run, FedMAST achieves 1.53% ASR and 92.26% MTA, compared with ASRs of 100.00%, 99.67%, 99.53%, and 32.84% for FedAvg, MultiKrum, AlignIns, and FLAME, respectively.

Abstract

Backdoor Attacks in Federated Learning

Explore similar work

Backdoors Leave Structural Traces: FedMAST for Backdoor Detection and Containment in Federated Learning

Exploiting Layer-Specific Vulnerabilities to Backdoor Attack in Federated Learning

Unveiling Hidden Threats: Using Fractal Triggers to Boost Stealthiness of Distributed Backdoor Attacks in Federated Learning