STAIN-FL: Stealthy Targeted Attack Injection with Contextual Triggers in Federated Learning

Ashlinder Kaur; Purnima Murali Mohan; Zengxiang Li; Tram Truong-Huu

cs.CRAug 25, 2026

STAIN-FL: Stealthy Targeted Attack Injection with Contextual Triggers in Federated Learning

Authors: Ashlinder Kaur, Purnima Murali Mohan, Zengxiang Li, Tram Truong-Huu

Organizations: Singapore Institute of Technology (SIT) Singapore · SingHealth Duke-NUS AI in Medicine Institute SingHealth AI Office, Singapore

Abstract

Federated video anomaly detection trains model collaboratively without sharing raw surveillance footage, but limited server-side visibility lets compromised clients to inject backdoor via malicious updates. This paper introduces STAIN-FL, a stealthy targeted backdoor attack injection framework that uses naturally occurring surveillance conditions, including low-light scenes, indoor settings, and crowd density, as contextual triggers. STAIN-FL combines anomaly-to-benign label manipulation with gradient masking over least-updated coordinates to preserve clean accuracy while inducing trigger-conditioned misclassification. We evaluate STAIN-FL on UCF-Crime using 1024-dimensional I3D features in a non-IID four-client multi-agency setting, comparing FedAvg and FedProx under sparse and continuous attacks. Results show that sparse attacks have low-detectability, operationally significant attacks rather than high-intensity attacks: they keep the mean clean-accuracy drop below $2\%$ , yet still misclassify more than half of triggered anomalies at peak backdoor accuracy under FedAvg ( $56.7\%$ ) and FedProx ( $54.2\%$ ). Under FedAvg, the sparse backdoor remains above the $25\%$ backdoor-accuracy threshold for an average of $336$ post-attack rounds, highlighting the persistence risk of contextually triggered attacks in surveillance systems.

Figures & tables

Panel of Figure 1 — Figure 1. STAIN-FL backdoor injection pathway in federated video anomaly detection.

Symbol	Description
$K$	Number of FL clients
$t$	FL communication round
$m$	Compromised client index
$\mathbf{w}^{(t)}$	Global model at round $t$
$\mathbf{w}_{m}^{(t)}$	Local model trained by client $m$
$\mathcal{D}_{m}$	Dataset of compromised client

Table 1. Notation used in the threat model

Parameter	Value
Compromised client	Agency 1
Trigger type	low-light
Learning rate boost ( $\alpha$ )	2.0
Scale factor ( $s$ )	1.5
Attack start round	50
Total FL rounds	1,000

Table 2. Experimental parameters

Panel of Figure 2 — Figure 2. Average accuracy drop across gradient mask ratios. The dashed line marks the 5% stealth threshold; sparse attacks remain below it in all configurations.

Panel of Figure 3 — Figure 3. Peak backdoor accuracy across gradient mask ratios. Continuous attacks achieve substantially higher peak effectiveness than sparse attacks under both algorithms.

Pattern	Aggregation	Clean Acc. Drop	Peak BA
Sparse	FedAvg	1.66%	56.7%
Continuous	FedAvg	7.51%	77.1%
Sparse	FedProx	1.03%	54.2%
Continuous	FedProx	4.23%	72.6%

Table 3. Stealth and peak backdoor accuracy summary (mean across gradient mask ratios)

Pattern	Aggregation	Stabilise $<$ 25%	Post-attack $\sigma$
Sparse	FedAvg	120	6.1%
Continuous	FedAvg	82	6.3%
Sparse	FedProx	119	7.0%
Continuous	FedProx	136	7.1%

Table 4. Durability summary: mean rounds to stabilise below the 25% threshold (Method 1) and mean post-attack standard deviation (Method 2), averaged across gradient mask ratios. Full per-ratio results in Appendix D

Appendix figures & tables7 assets

Supplementary material from the paper’s appendix.

Appendix

Partition	Normal	Anomaly	Total
Global test set (server)	190	190	380
Client 1	282	300	582
Client 2	221	220	441
Client 3	189	160	349
Client 4	68	80	148
Client total	760	760	1,520

Appendix

Table 5. Non-IID federated data distribution. The server holds the global test set, while client data is split across four agencies, showing Normal and Anomaly counts

		$\geq$ 50%		$\geq$ 40%		$\geq$ 30%		$\geq$ 25%
Pattern	$k$	FA	FP	FA	FP	FA	FP	FA	FP
Sparse	0.05	3	2	16	22	169	168	382	358
	0.10	3	2	19	18	162	156	387	327
	0.15	2	1	13	18	126	138	312	305
	0.20	2	3	13	24	110	128	308	275
	0.25	3	2	13	20	116	135	293	273

Appendix

Table 6. Impact rounds analysis on the number of post-attack rounds with backdoor accuracy above each threshold

		50%		40%		30%		25%		20%
Pattern	$k$	FA	FP	FA	FP	FA	FP	FA	FP	FA	FP
Sparse	0.05	20	20	20	20	40	35	250	110	NA	506
	0.10	20	20	20	20	35	63	127	134	531	647
	0.15	20	20	20	23	24	36	58	84	88	602
	0.20	20	20	20	21	23	37	55	160	77	462
	0.25	20	20	21	20	42	34	111	109	240	510

Appendix

Table 7. Threshold-based stabilization (Method 1): rounds for backdoor accuracy to fall and remain below each threshold. FA: FedAvg; FP: FedProx

		$\pm$ 10%		$\pm$ 5%		$\pm$ 3%		Post-attack $\sigma$
Pattern	$k$	FA	FP	FA	FP	FA	FP	FA	FP
Sparse	0.05	44	47	353	368	886	NA	6.3%	7.0%
	0.10	24	33	377	512	806	574	6.3%	7.2%
	0.15	29	37	360	301	754	359	6.2%	6.8%
	0.20	21	40	279	380	708	612	5.8%	6.9%
	0.25	48	40	320	379	478	786	6.1%	6.9%

Appendix

Table 8. Method 2 volatility stabilization: rounds until backdoor-accuracy variation stays within each tolerance. FA: FedAvg; FP: FedProx

Backdoor Attacks

Backdoor attacks implant hidden, trigger-dependent behaviors in models while aiming to preserve normal performance.

See all 129 papers

Backdoors Leave Structural Traces: FedMAST for Backdoor Detection and Containment in Federated Learning
Sep 4, 2026Srinivasan Subramanian, Md. Abdullah Al Hafiz Khan, Kazi Aminul IslamFederated Learning Aggregation Byzantine-Robust Federated Learning
Department of Computer Science Kennesaw State University Marietta, USA
Beyond Corner Patches: Semantics-Aware Backdoor Attack in Federated Learning
Mar 31, 2026Kavindu Herath, Joshua Zhao, Saurabh BagchiBackdoor Attacks Backdoor Attacks in Federated Learning
Department of Electrical and Computer Engineering, Purdue University, West Lafayette, USA
FedSurrogate: Backdoor Defense in Federated Learning via Layer Criticality and Surrogate Replacement
May 11, 2026Fatima Z. Abacha, Sin G. Teo, Yuanxiang Wu +2Backdoor Attacks Backdoor Attacks in Federated Learning
The University of Manchester, UK · Institute for Infocomm Research, A*STAR, Singapore · Monash University, Australia +1

Sep 4, 2026J/K move · Enter open · S save

Backdoors Leave Structural Traces: FedMAST for Backdoor Detection and Containment in Federated Learning

Srinivasan Subramanian, Md. Abdullah Al Hafiz Khan, Kazi Aminul Islam

Department of Computer Science Kennesaw State University Marietta, USA

Federated Learning Aggregation Byzantine-Robust Federated Learning Backdoor Attacks in Federated Learning Federated Learning

Open paper AskPDF arXiv

Federated learning enables distributed training without requiring clients to share their raw data. However, its reliance on the integrity of the client-submitted updates exposes the global model to stealthy backdoor poisoning. Existing defenses often rely on individual evidence sources, but stealth-constrained attacks can adapt to these signals. Such attacks can suppress anomaly signals they are optimized to evade, yet their poisoned updates still leave residual structural traces. We propose FedMAST, a Federated Multi-Axis Structural Tracing defense for backdoor detection in federated learning. FedMAST scores client updates using complementary structural, spectral, and historical evidence and then applies tiered filtering and round-level containment to limit adversarial influence. To capture traces that isolated signals may miss, FedMAST uses squeeze-pair coherence scoring to expose coupled feature distortions and signed spectral-drift tracking to reveal persistent directional changes over time. Across six backdoor attacks, FedMAST achieves lower attack success rate (ASR) than baseline defenses in all nine evaluated comparisons, averaging 1.51% ASR and 94.84% main-task accuracy (MTA) across the complete 200-round runs. Over the full 200-round method-aware CovertLayers run, FedMAST achieves 1.53% ASR and 92.26% MTA, compared with ASRs of 100.00%, 99.67%, 99.53%, and 32.84% for FedAvg, MultiKrum, AlignIns, and FLAME, respectively.

Abstract

Backdoor Attacks

Explore similar work

Backdoors Leave Structural Traces: FedMAST for Backdoor Detection and Containment in Federated Learning

Beyond Corner Patches: Semantics-Aware Backdoor Attack in Federated Learning

FedSurrogate: Backdoor Defense in Federated Learning via Layer Criticality and Surrogate Replacement