Backdoor Attacks in Federated Learning

These attacks exploit local training and model aggregation to implant behavior that produces a target prediction when a trigger appears, often while preserving accuracy on ordinary inputs. Methods range from poisoned examples and patch triggers to semantic or contextual triggers, distributed and triggerless attacks, and updates designed to evade aggregation rules; studies span image, text, graph, vertical, and decentralized settings with heterogeneous clients. Defenses include robust aggregation such as Krum and trimmed mean, update anomaly and alignment checks, structural or spectral analysis, client reputation, active auditing, and post-training unlearning, measured by attack success alongside clean accuracy and false positives. A central tension is that stealthy adaptive attacks can evade defenses, especially under non-IID data, privacy constraints, or varied network topologies, while aggressive filtering can harm utility; realistic threat models and reproducible cross-setting evaluations remain important.