BackDFL: A Unified Benchmark For Backdoor Attacks and Defenses In Decentralized Federated Learning

Mouhamed Amine Bouchiha; Gregory Blanc; Yufei Han

cs.LGAug 21, 2026

BackDFL: A Unified Benchmark For Backdoor Attacks and Defenses In Decentralized Federated Learning

Authors: Mouhamed Amine Bouchiha, Gregory Blanc, Yufei Han

Organizations: SAMOVAR, Télécom SudParis, Institut Polytechnique de Paris · PIRAT, INRIA Rennes, Rennes, France

Abstract

Decentralized Federated Learning (DFL) promises trust-free collaborative learning by replacing the centralized parameter server with peer-to-peer model exchange. However, this architectural shift fundamentally reshapes the threat landscape. Without globally coordinated aggregation, DFL becomes particularly susceptible to backdoor attacks, in which malicious participants implant persistent hidden behaviors while maintaining high clean-task performance. In this paper, we argue that the robustness of DFL has been significantly overestimated. Existing studies rely on simplified threat models, non-adaptive adversaries, fragmented evaluation protocols, inconsistent communication topologies, and ad hoc training configurations, leading to an incomplete understanding of DFL security. To address these limitations, we present BackDFL, a unified benchmark for systematically evaluating DFL under realistic and adaptive backdoor attacks. Through extensive experiments, BackDFL exposes critical failure modes of decentralized learning. Our results demonstrate that both state-of-the-art Byzantine-robust DFL methods and adapted FL backdoor defenses fail under modest malicious participation rates (as low as 15%), especially in heterogeneous settings, while their robustness varies substantially across communication graph topologies.

Figures & tables

Figure 1: Backdoor propagation in DFL through P2P model exchange.

Figure 2: Overview of the backdoor attack workflow on the GTSRB dataset, the training-time stage ( left ) (sample selection, trigger injection, and local training on poisoned data) and the inference-time stage ( right ), where the trigger is inserted to activate the attack.

Figure 3: BackDFL: A framework for BAs and BDs in DFL. The architecture is modular, with configuration files feeding experiment flows, which interact with datasets, models, attack and defense modules. Utility modules are shared.

Panel of Figure 4 — Figure 4: Impact of the FL setting (CFL vs. DFL) on robustness with identical attack settings ( Neurotoxin on HAR , 15% malicious).

		CIFAR-10				GTSRB
		IID		Non-IID		IID		Non-IID
Attack	Defense	Min.ACC	Max.ASR	Min.ACC	Max.ASR	Min.ACC	Max.ASR	Min.ACC	Max.ASR
Neurotoxin	$\blacksquare$ Norm-Clip	0.847	0.245	0.789	0.258	0.944	0.357	0.937	0.291
	$\blacksquare$ M-Krum	0.841	0.128	0.745	0.205	0.928	0.060	0.899	0.773
	$\blacksquare$ Trim	0.845	0.138	0.792	0.261	0.943	0.110	0.941	0.115
	$\blacksquare$ SCCLIP	0.840	0.661	0.748	0.694	0.941	0.627	0.906	0.832

Table 1: Per-attack, per-defense results on CIFAR-10 and GTSRB under IID and non-IID client partitions. Each cell reports Min.ACC/Max.ASR . Lowest ASR per attack–dataset–partition block is bold ; worst Min.ACC per attack–dataset–partition block is underlined . Failure cases with Max.ASR

\geq 0.500

are red shaded.

Figure 5: Impact of datasets and models under attacks.

Panel of Figure 6 — Figure 6: Different communication graphs.

Figure 7: Impact of the communication graph.

Appendix figures & tables4 assets

Supplementary material from the paper’s appendix.

Appendix

Dataset	Model	#Classes	Input	Optimizer	$\eta$	$B$	$E$	Rounds
MNIST	SimpleCNN	10	$1\times 28\times 28$	SGD	0.01	32	1	50
Fashion	FashionCNN	10	$1\times 28\times 28$	SGD	0.01	32	5	50
FEMNIST	LeNet-5	62	$1\times 28\times 28$	SGD	0.01	32	10	100
CIFAR-10	ResNet18-GN	10	$3\times 32\times 32$	SGD	0.01	32	5	100
CIFAR-100	ResNet18-GN	100	$3\times 32\times 32$	SGD	0.01	32	5	600 ∗
GTSRB	GTSRB-CNN	43	$3\times 32\times 32$	SGD	0.01	32	5	50–100

Appendix

Table 2: Dataset, model, and training hyperparameter configurations.

Figure 8: Impact of the malicious rate.

Figure 9: Impact of mixing ratio ( Left ) and non-IID degree ( Right ).

Table 12

Backdoor Attacks in Federated Learning

Backdoor attacks in federated learning study how malicious clients implant hidden behaviors that make models misclassify inputs under chosen conditions.

See all 32 papers

Beyond Passive Aggregation: Active Auditing and Topology-Aware Defense in Decentralized Federated Learning
Mar 19, 2026Sheng Pan, Niansheng TangFederated Learning Backdoor Attacks in Federated Learning
Yunnan Key Laboratory of Statistical Modeling and Data Analysis, Yunnan University, Kunming 650091, China
Exploiting Layer-Specific Vulnerabilities to Backdoor Attack in Federated Learning
Feb 16, 2026Mohammad Hadi Foroughi, Seyed Hamed Rastegar, Mohammad Sabokrou +1Backdoor Attacks Backdoor Attacks in Federated Learning
School of Electrical and Computer Engineering, University of Tehran, Tehran, Iran. · School of Computer Science, Institute for Research in Fundamental Sciences (IPM), Tehran, Iran. · School of Electrical and Computer Engineering, Shiraz University, Shiraz, Iran. +1
Your Privacy My Cloak: Backdoor Attacks on Differentially Private Federated Learning
Jun 15, 2026Xiaolin Li, Ning Wang, Ninghui Li +1Backdoor Attacks in Federated Learning Differentially Private Federated Learning
Purdue University West Lafayette, IN, USA · University of South Florida Tampa, FL, USA

Mar 19, 2026J/K move · Enter open · S save

Beyond Passive Aggregation: Active Auditing and Topology-Aware Defense in Decentralized Federated Learning

Sheng Pan, Niansheng Tang

Yunnan Key Laboratory of Statistical Modeling and Data Analysis, Yunnan University, Kunming 650091, China

Federated Learning Backdoor Attacks in Federated Learning

Open paper AskPDF arXiv

Decentralized Federated Learning (DFL) remains highly vulnerable to adaptive backdoor attacks designed to bypass traditional passive defense metrics. To address this limitation, we shift the defensive paradigm toward a novel active, interventional auditing framework. First, we establish a dynamical model to characterize the spatiotemporal diffusion of adversarial updates across complex graph topologies. Second, we introduce a suite of proactive auditing metrics, stochastic entropy anomaly, randomized smoothing Kullback-Leibler divergence, and activation kurtosis. These metrics utilize private probes to stress-test local models, effectively exposing latent backdoors that remain invisible to conventional static detection. Furthermore, we implement a topology-aware defense placement strategy to maximize global aggregation resilience. We provide theoretical property for the system's convergence under co-evolving attack and defense dynamics. Numeric empirical evaluations across diverse architectures demonstrate that our active framework is highly competitive with state-of-the-art defenses in mitigating stealthy, adaptive backdoors while preserving primary task utility.

Abstract

Backdoor Attacks in Federated Learning

Explore similar work

Beyond Passive Aggregation: Active Auditing and Topology-Aware Defense in Decentralized Federated Learning

Exploiting Layer-Specific Vulnerabilities to Backdoor Attack in Federated Learning

Your Privacy My Cloak: Backdoor Attacks on Differentially Private Federated Learning