Hide and Find: A Distributed Adversarial Attack on Federated Graph Learning

Jinshan Liu; Ken Li; Jiazhe Wei; Bin Shi; Bo Dong

cs.LGMar 8, 2026

Hide and Find: A Distributed Adversarial Attack on Federated Graph Learning

Authors: Jinshan Liu, Ken Li, Jiazhe Wei, Bin Shi, Bo Dong

Organizations: School of Computer Science and Technology, Xi’an Jiaotong University · Ministry of Education Key Laboratory of Intelligent Networks and Network Security · Shaanxi Province Key Laboratory of Big Data Knowledge Engineering · School of Distance Education, Xi’an Jiaotong University

Abstract

Federated Graph Learning (FedGL) is vulnerable to malicious attacks, yet developing a truly effective and stealthy attack method remains a significant challenge. Existing attack methods suffer from low attack success rates, high computational costs, and are easily identified and smoothed by defense algorithms. To address these challenges, we propose FedShift, a novel two-stage "Hide and Find" distributed adversarial attack. In the first stage, before FedGL begins, we inject a learnable and hidden "shifter" into part of the training data, which subtly pushes poisoned graph representations toward a target class's decision boundary without crossing it, ensuring attack stealthiness during training. In the second stage, after FedGL is complete, we leverage the global model information and use the hidden shifter as an optimization starting point to efficiently find the adversarial perturbations. During the final attack, we aggregate these perturbations from multiple malicious clients to form the final effective adversarial sample and trigger the attack. Extensive experiments on six large-scale datasets demonstrate that our method achieves the highest attack effectiveness compared to existing advanced attack methods. In particular, our attack can effectively evade 3 mainstream robust federated learning defense algorithms and converges with a time cost reduction of over 90%, highlighting its exceptional stealthiness, robustness, and efficiency.

Figures & tables

Figure 1: Pipeline of our two-stage adversarial attack. Training : In Stage 1 , each malicious client uses local data to train a shifter generator and injects hidden shifters into the training data. During federated training, malicious clients inject the backdoor signal into the global model through the federated aggregation mechanism. In Stage 2 , using the shifter generator trained in Stage 1 as a high-quality starting point, the shifter is further optimized as an effective adversarial perturbation leveraging the information from the global model. Attack : Aggregate adversarial perturbations from multiple malicious clients to generate the adversarial sample and trigger the attack.

Datasets	Graphs	Classes	Class Ratio	Avg. Nodes	Avg. Edges	Node Feats.
DD	1,178	2	691 / 487	284.3	715.7	89
NCI109	4,127	2	2,048 / 2,079	29.7	32.1	38
Mutagenicity	4,337	2	2,401 / 1,936	30.3	30.8	14
FRANKENSTEIN	4,337	2	1,936 / 2,401	16.9	17.9	780
Eth-Phish&Hack	5,070	2	2,535 / 2,535	37.8	111.3	5,000
Gossipcop	5,464	2	2,732 / 2,732	57.5	56.5	310

Table 1: Statistics of the benchmark datasets used in our experiments.

Methods	Rand-GDBA			GTA			Opt-GDBA			NI-GDBA			FedShift (Ours)
Metrics	AAS	ASR	OA	AAS	ASR	OA	AAS	ASR	OA	AAS	ASR	OA	AAS	ASR	OA
DD	0.01	0.01	0.63	0.06	0.06	0.64	0.03	0.03	0.65	0.44	0.59	0.61	0.58	0.88	0.62
NCI109	0.39	0.48	0.63	0.62	0.98	0.62	0.56	0.84	0.61	0.50	0.66	0.64	0.65	0.98	0.66
Mutagenicity	0.34	0.38	0.73	0.71	0.99	0.71	0.46	0.56	0.72	0.11	0.12	0.73	0.74	0.99	0.75
FRANKENSTEIN	0.26	0.31	0.58	0.58	1.00	0.58	0.54	0.85	0.59	0.61	1.00	0.61	0.61	1.00	0.61
Eth-Phish&Hack	0.05	0.05	0.91	0.91	0.99	0.92	0.16	0.16	0.91	0.92	1.00	0.92	0.93	1.00	0.93

Table 2: Attack results in the Q1 setting with the malicious client proportions

|C_{M}|/N=0.2

Figure 2: Attack results in the Q1 setting under defferent malicious client proportions $|C_{M}|/N$ .

Methods	Rand-GDBA			GTA			Opt-GDBA			NI-GDBA			FedShift (Ours)
Defenses	Foo.	Kru.	Bul.	Foo.	Kru.	Bul.	Foo.	Kru.	Bul.	Foo.	Kru.	Bul.	Foo.	Kru.	Bul.
DD	0.02	0.30	0.30	0.11	0.30	0.30	0.06	0.18	0.18	0.62	0.44	0.44	0.62	0.45	0.45
NCI109	0.14	0.49	0.49	0.44	0.45	0.45	0.39	0.47	0.47	0.57	0.50	0.50	0.59	0.50	0.50
Mutagenicity	0.07	0.19	0.17	0.48	0.48	0.48	0.54	0.48	0.48	0.40	0.46	0.46	0.58	0.49	0.49
FRANKENSTEIN	0.17	0.32	0.31	0.61	0.29	0.29	0.40	0.37	0.37	0.61	0.54	0.54	0.61	0.54	0.54
Eth-Phish&Hack	0.04	0.42	0.42	0.82	0.75	0.75	0.06	0.44	0.44	0.78	0.78	0.78	0.83	0.78	0.78

Table 3: Attack results in the Q2 setting under different defenses.

Figure 3: Attack results in the adversarial perturbation finding stage in the Q3 setting.

Figure 4: Impact of $f$ and $p$ of our FedShift.

Figure 5: Attack results of FedShift with the number of target-class clusters $k$ ranging from 2 to 5.

Figure 6: Attack results of FedShift with the trigger node ratio $n_{tri}$ ranging from 0.05 to 0.20.

Methods	Stage 1 Only			Stage 1 + FL-Tune			Stage 1 + Stage 2			Full FedShift
Metrics	AAS	ASR	OA	AAS	ASR	OA	AAS	ASR	OA	AAS	ASR	OA
DD	0.34	0.41	0.62	0.38	0.48	0.62	0.52	0.73	0.62	0.53	0.76	0.62
NCI109	0.33	0.42	0.56	0.38	0.51	0.57	0.49	0.77	0.56	0.47	0.69	0.57
Mutagenicity	0.49	0.63	0.66	0.49	0.64	0.66	0.52	0.69	0.66	0.51	0.67	0.66
FRANKENSTEIN	0.40	0.51	0.61	0.58	0.91	0.61	0.61	0.99	0.61	0.61	0.99	0.61
Eth-Phish&Hack	0.66	0.72	0.89	0.86	0.97	0.89	0.88	0.99	0.89	0.88	0.99	0.89

Table 4: Performance comparison of different components of our FedShift.

Appendix figures & tables2 assets

Supplementary material from the paper’s appendix.

Appendix

Methods	Rand-GDBA			GTA			Opt-GDBA			NI-GDBA			FedShift (Ours)
Metrics	AAS	ASR	OA	AAS	ASR	OA	AAS	ASR	OA	AAS	ASR	OA	AAS	ASR	OA
DD	0.02	0.02	0.63	0.02	0.02	0.64	0.05	0.05	0.66	0.48	0.65	0.63	0.57	0.86	0.62
NCI109	0.15	0.16	0.60	0.31	0.37	0.61	0.30	0.35	0.60	0.44	0.59	0.60	0.64	0.96	0.66
Mutagenicity	0.07	0.07	0.65	0.53	0.73	0.65	0.09	0.09	0.65	0.26	0.29	0.65	0.72	0.97	0.74
FRANKENSTEIN	0.18	0.20	0.61	0.53	0.79	0.61	0.28	0.33	0.61	0.61	1.00	0.61	0.61	0.99	0.61
Eth-Phish&Hack	0.04	0.04	0.87	0.70	0.78	0.87	0.05	0.05	0.87	0.87	1.00	0.87	0.88	1.00	0.89

Appendix

Table 5: Attack results in the Q1 setting with the malicious client proportions

|C_{M}|/N=0.1

Methods	Rand-GDBA			GTA			Opt-GDBA			NI-GDBA			FedShift (Ours)
Metrics	AAS	ASR	OA	AAS	ASR	OA	AAS	ASR	OA	AAS	ASR	OA	AAS	ASR	OA
DD	0.02	0.02	0.64	0.02	0.02	0.65	0.08	0.09	0.68	0.52	0.71	0.65	0.57	0.85	0.62
NCI109	0.16	0.18	0.59	0.25	0.29	0.60	0.28	0.33	0.59	0.46	0.65	0.59	0.64	0.95	0.66
Mutagenicity	0.06	0.06	0.63	0.43	0.56	0.63	0.07	0.08	0.63	0.71	0.95	0.74	0.71	0.95	0.74
FRANKENSTEIN	0.16	0.17	0.60	0.24	0.28	0.60	0.22	0.25	0.60	0.60	1.00	0.60	0.59	0.99	0.60
Eth-Phish&Hack	0.04	0.04	0.86	0.45	0.49	0.86	0.04	0.04	0.86	0.86	0.99	0.87	0.86	0.99	0.87

Appendix

Table 6: Attack results in the Q1 setting with the malicious client proportions

|C_{M}|/N=0.05

Federated Graph Learning

Federated graph learning trains graph models across data holders without centralizing their private nodes, edges, or features.

See all 46 papers

Fine-grained Distributed Backdoor Attacks in Federated Learning
Sep 7, 2026Jian Wang, Hong Shen, Wei Ke +1Backdoor Attacks in Federated Learning Federated Learning
Faculty of Applied Sciences, Macao Polytechnic University, R. de Luís Gonzaga Gomes, Macao, 999078, China · Faculty of Cyberspace Security, Guangzhou University of Software, No.548 Guangcong South Road, High-tech Industrial Park, Conghua Economic Development Zone, Guangzhou, 501900, China · School of Engineering and Technology, Central Queensland University, Bruce Highway, Norman Gardens, Rockhampton, Queensland, 4702, Australia +1
PoiCGAN: A Targeted Poisoning Based on Feature-Label Joint Perturbation in Federated Learning
Mar 24, 2026Tao Liu, Jiguang Lv, Dapeng Man +7Data Poisoning Attacks Adversarial Attacks
College of Computer Science and Technology, Harbin Engineering University, Harbin, 150001, China
When Clients Are Orchestrated: Strategic Gradient Manipulation to Defeat Federated Learning Servers with Efficient Defense
Sep 22, 2026Mohamed Shaaban, Ahmed Abdelnaby, Mohamed ElmahallawyFederated Learning Byzantine-Robust Federated Learning
School of Engineering and Applied Sciences, Washington State University, Richland, WA 99354, USA

Sep 7, 2026J/K move · Enter open · S save

Fine-grained Distributed Backdoor Attacks in Federated Learning

Jian Wang, Hong Shen, Wei Ke, Xue Hua Liu

Faculty of Applied Sciences, Macao Polytechnic University, R. de Luís Gonzaga Gomes, Macao, 999078, China · Faculty of Cyberspace Security, Guangzhou University of Software, No.548 Guangcong South Road, High-tech Industrial Park, Conghua Economic Development Zone, Guangzhou, 501900, China · School of Engineering and Technology, Central Queensland University, Bruce Highway, Norman Gardens, Rockhampton, Queensland, 4702, Australia+1

Backdoor Attacks in Federated Learning Federated Learning

Open paper AskPDF arXiv

Federated learning, as a privacy-preserving distributed machine learning paradigm, faces significant threats from backdoor attacks. Compared to centralized attacks, distributed backdoor attacks are more harmful but require more poisoned samples to compensate for the loss of trigger strength due to decomposition. Fixed trigger patterns are also easily detected by robust aggregation algorithms, increasing the risk of attack exposure. To address these challenges, we propose a fine-grained distributed backdoor attack framework (FDBA). This framework uses dynamic trigger generation and embedding vector optimization to perform attacks with fewer poisoned samples. First, we design a dynamic trigger generation method based on image edge structures using the Canny algorithm to extract edge features, which are then injected with Laplacian noise. RGB channel decomposition is applied for covert adaptation of the distributed trigger, reducing detection chances. Second, we introduce an embedding vector contrastive learning strategy that forces poisoned samples to approach the target class center in the feature space, enhancing attack effectiveness. On CIFAR-10, piecewise-linear estimates for target ASRs between 70% and 90% show that FDBA reduces the required poisoning ratio by 37.4%--48.4% compared with DBA. In non-independent and identically distributed (Non-IID) scenarios, FDBA retains 84.7% of its IID attack performance under extreme heterogeneity, whereas DBA drops to 73.5%, and the framework successfully bypasses mainstream defense mechanisms. This study offers new insights into federated learning security and emphasizes the potential threats and defense challenges posed by fine-grained distributed attacks.

Abstract

Federated Graph Learning

Explore similar work

Fine-grained Distributed Backdoor Attacks in Federated Learning

PoiCGAN: A Targeted Poisoning Based on Feature-Label Joint Perturbation in Federated Learning

When Clients Are Orchestrated: Strategic Gradient Manipulation to Defeat Federated Learning Servers with Efficient Defense