Abstract
Federated learning (FL) has been widely applied in Internet of Things (IoT) systems. However, its inherently distributed nature makes it vulnerable to backdoor attacks. Existing attacks typically design triggers based on fixed patterns or local models, without considering their applicability to the global model. Consequently, a significant “loss” occurs during the transfer of the backdoor from the local model to the global model, leading to a low Attack Success Rate (ASR). To address this issue, we propose a novel backdoor attack method, termed Federated Generative Adversarial Trigger (FedGAT). The proposed method optimizes the trigger by training it with publicly available global models and a small number of samples. It adopts a Generative Adversarial Network (GAN) framework, in which the discriminator is fixed as the converged global model to guide the generator’s training through feedback. As a result, the generator can automatically produce optimized triggers that are highly correlated with the global model’s feature space, effectively reducing the “loss” in backdoor transfer and improving attack performance. Extensive experiments on multiple datasets demonstrate that, without amplifying malicious updates, the proposed method achieves an ASR improvement of 60.95–80.19% over the average baseline performance on the global model, exhibiting outstanding attack capability. Our work raises new challenges for the secure deployment of FL systems.
Introduction
In recent years, Federated Learning (FL) has gained significant traction in various Internet of Things (IoT)-driven intelligent systems, such as healthcare (Sheller et al. 2020), autonomous driving (Chellapandi et al. 2023), and industrial automation (Imteaj et al. 2021). As IoT devices generate large volumes of data locally, FL has emerged as an effective distributed learning framework (Konevcny et al. 2016), enabling decentralized devices to collaboratively train a global model without the need to exchange raw data. A central server aggregates the model updates from the client nodes (McMahan et al. 2017a). This paradigm not only strengthens user data privacy (Wang et al. 2023) but also minimizes data transmission costs (Yang et al. 2019), thereby significantly enhancing the performance of deep learning models in IoT environments.
However, the distributed nature of FL presents notable security concerns (Zhang et al. 2022b), particularly with regard to backdoor attacks (Wang et al. 2020). In such an attack, an adversary embeds a trigger into a machine learning model, altering the model’s output behavior under specific conditions by either manipulating the input data features or directly modifying the model parameters (Baruch et al. 2019). This allows for malicious control over the model’s functionality. Furthermore, certain privacy-preserving mechanisms inherent in FL, such as secure aggregation (So et al. 2023), may inadvertently enable backdoor attacks. Consequently, this security threat requires significant attention.
Current backdoor research primarily focuses on image-classification task (Gu et al. 2017). Based on how triggers are generated, attacks can be broadly categorized into fixed-trigger attacks (Bagdasaryan et al. 2020; Xie et al. 2019; Liu et al. 2024) and optimized-trigger attacks (Saha et al. 2020; Nguyen et al. 2021; Gong et al. 2022). The former typically employ predesigned or compositional patterns as triggers, while the latter derive optimal triggers by training on local models. Both types of triggers can reliably activate backdoors within local models; however, they share a common limitation. Our validation shows that these methods must apply a substantial amplification of the malicious updates to ensure the backdoor remains effective in the global model; without such amplification, the Attack Success Rate (ASR) is very low. When amplification is used, the resulting large updates become difficult to evade and are likely to be detected by many anomaly-detection–based defenses, causing the attacks to fail.
We intuitively attribute the poor performance of backdoors in the global model to the inability of triggers to efficiently activate the backdoor locally. Considering the aggregation and incremental-update characteristics of the FL paradigm (Dong et al. 2022), malicious updates submitted by fixed-trigger attackers—when not amplified—are heavily diluted by other participants’ and subsequently submitted benign updates, preventing the backdoor from being embedded into the global model. Taking into account the non-independent and non-identically distributed (non-I.I.D.) nature of users’ data, optimized-trigger attackers also face substantial mismatch between their local models and the global model; this mismatch causes a transfer “loss” of backdoor information during aggregation, so only part of the backdoor is incorporated into the global model, which constrains its practical effectiveness.
To address this issue, we propose a backdoor attack termed Federated Generative Adversarial Triggers (FedGAT), which generates optimized triggers directly guided by feedback from the global model. Inspired by Generative Adversarial Networks (GANs), FedGAT adopts a generator–discriminator architecture variant: the generator is trained to produce triggers while the public, converged global model serves as the discriminator with its parameters held fixed. Concretely, we feed the generator with a small set of target-class samples augmented by random noise; the fixed global model evaluates the generator’s outputs and its feedback steers the generator’s training. The trained generator thus automatically synthesizes optimized triggers that are highly correlated with the global model’s feature space, substantially reducing the transfer “loss” encountered during aggregation. Extensive validation shows that FedGAT achieves the best attack performance compared with the evaluated baselines.
Our main contributions are summarized as follows:
-
We propose FedGAT, a backdoor attack that generates optimized triggers directly from feedback provided by the global model. FedGAT requires no amplification of malicious updates yet achieves effective attacks on the global model within the FL paradigm.
-
We design a variant of GANs whose training automatically yields optimized triggers that efficiently activate backdoors in the global model. The method fixes the global model as the discriminator and uses its feedback to guide generator training—substantially reducing the “loss” during local-to-global backdoor transfer.
-
Extensive experiments on three datasets show that, without amplifying malicious updates, FedGAT attains outstanding attack performance: the ASR on the global model surpasses the baselines by an average of 60.95–80.19%. We also provide extensive evaluations of the attack’s stealthiness, persistence, and robustness.
Relate work
Gu et al. (2017) first proposed the backdoor attacks. In such attacks the adversary embeds a fixed pattern into training samples as a trigger and controls the model’s output to implant the backdoor. The poisoned model classifies clean samples correctly but produces a pre-specified output once the trigger is activated. Below, we give a detailed exposition of backdoor attacks and defence techniques in FL.
Backdoor attacks in FL
Backdoor attacks in FL can be classified by trigger strategy into fixed-trigger and optimized-trigger attacks. Fixed-trigger attacks typically embed a static pattern (e.g., a square or other geometric shape) as the trigger and often employ auxiliary techniques to enhance attack efficacy. Bagdasaryan et al. (2020) introduced model replacement to deploy backdoors within the FL paradigm: the adversary amplifies the malicious update it uploads to increase its contribution, but this approach is susceptible to detection and removal by anomaly-based defenses. Building on that work, Xie et al. (2019) proposed a distributed variant that trains trigger fragments to improve stealthiness and then aggregates the dispersed trigger information to preserve attack performance. To further increase persistence, Liu et al. (2024) applied combinatorial design principles to create a distributed trigger strategy that strengthens the global model’s propensity to learn the backdoor. Similarly, Zhang et al. (2022b) made minor modifications to existing attacks to target model parameters that change little during training, thereby maintaining effectiveness across multiple FL rounds. More recently, Unnervik et al. (2024) conducted experimental evaluations and a systematic analysis of fixed triggers in FL—examining factors such as trigger size, location, and color—to clarify their impact on attack robustness and stealth. Although these methods achieve strong attack performance, fixed trigger patterns are generally conspicuous: their rigidity limits adaptability to complex scenarios and makes them more readily detectable by defenses.
To address these limitations, researchers have proposed optimized-trigger attacks that either optimize the trigger-selection process or directly train triggers to improve attack efficacy. Li et al. (2020) construct triggers via steganography and enforce regularization to render the trigger imperceptible, enabling a covert clean-label attack. HTBA (Saha et al. 2020) leverages adversarial training to learn subtle trigger patterns for stealthy multi-target backdoor injection. For visual invisibility, WaNet (Nguyen et al. 2021) optimizes an elastic-warping network together with noise patterns to generate imperceptible triggers. More recently, optimized-trigger attacks have been adapted to the FL setting. Recently, more advanced backdoor attack methods have explored adaptive and optimized trigger generation in federated learning. For instance, CBA (Gong et al. 2022) dynamically adjusts triggers via gradient-guided neuron activation, while A3FL (Zhang et al. 2023) incorporate adaptive strategies to account for the training dynamics in federated settings. More recent approaches such as DPOT (Zhang et al. 2024) further improves stealthiness by jointly optimizing triggers and poisoned data, and COBA (Lyu et al. 2024) enhances attack robustness through collaborative attack mechanisms. Despite these advances, existing methods primarily focus on improving attack effectiveness through local optimization or adaptive training strategies, while lacking an explicit mechanism to directly align trigger optimization with the global model behavior. As a result, the generated triggers may not fully capture the characteristics of the global model, leading to suboptimal attack performance when transferring from local clients to the central server. In our preliminary validation, we observe that such backdoors may suffer from varying degrees of performance degradation on the global model. With increasing training rounds, the attack effect may even diminish without additional adjustments.
In summary, although recent studies have introduced adaptive and optimized trigger generation techniques, the absence of explicit global model feedback in the optimization process limits their ability to achieve stable and effective attacks on the global model. To address this issue, we propose FedGAT, which directly leverages global model feedback to guide trigger generation and achieves high ASR on the global model without relying on update amplification.
Backdoor defenses in FL
To mitigate the risk of backdoor attacks in the FL, researchers have proposed a series of defense mechanisms, which can be categorized by their operation stage into Pre-Aggregation Defenses (Pre-AD), In-Aggregation Defenses (In-AD), and Post-Aggregation Defenses (Post-AD).
Pre-AD methods aim to detect and exclude malicious clients by identifying anomalous updates before aggregation. For example, FoolsGold (Fung et al. 2018) detects adversaries by inspecting the diversity of their updates; it requires no assumption about attacker fraction or extra information and can detect backdoors under varied client data distributions. Similarly, FLDetector (Zhang et al. 2022a) identifies malicious clients by exploiting inconsistencies in their submitted updates, combining the Cauchy median theorem with K-means clustering to detect backdoors based on inconsistent updates across iterations. However, Xu et al. (2022) show that some carefully crafted backdoor attacks can evade such defenses. To address this vulnerability, they propose SignGuard, which filters malicious gradients based on the sign of gradient vectors to bolster the global model’s robustness.
In-AD methods mitigate the impact of backdoors during model aggregation by incorporating robust aggregation mechanisms. For instance, Differential Privacy (DP)-based techniques reduce backdoor effects by adding noise: Geyer et al. (2017) apply client-level DP through stochastic subsampling and noise injection, while DP-FedAvg (McMahan et al. 2017b) integrates noise directly into the aggregation process. However, these methods are limited in that they cannot completely eliminate backdoors and often degrade the performance of the main task. To preserve model accuracy, Krum (Blanchard et al. 2017) and Multi-Krum (Guo et al. 2021) introduce geometry-based aggregation rules that select one or K gradient(s) closest to the majority of updates, ensuring convergence to the global optimum even in the presence of Byzantine nodes. To reduce computational cost, RLR (Ozday et al. 2021) designs a dynamic learning rate adjustment mechanism that adaptively diminishes the impact of malicious updates based on anomalies in their direction and magnitude, providing a lightweight and efficient defense without additional overhead. Considering the limitations of Byzantine-robust approaches under non-I.I.D. data, Li et al. (2023) propose ClipedClustering, which improves clustering-based defenses by adaptively clipping updates. More recently, Nguyen et al. (2022) introduce FLAME, a defense method deployed across both pre- and in-aggregation stages. It integrates dynamic clustering, adaptive pruning, and differential-privacy noise injection to form a multi-layer defense system that removes attacks while maintaining benign model performance and enabling real-time protection.
Post-AD methods focus on eliminating backdoor traces after model aggregation, offering a new direction for FL defense research. Wu et al. (2020) introduce a federated pruning approach that reduces the attack success rate by removing redundant neurons and adjusting extreme weights after training, while minimizing accuracy loss. They later propose a federated forgetting method (Wu et al. 2022) that removes malicious contributions by subtracting historical updates and restores model performance through knowledge distillation. This approach is model-agnostic and does not rely on client participation, thereby enhancing the efficiency and practicality of FL systems.
The main limitation of Pre-AD methods lies in their conflict with the privacy-preserving principles of FL and their difficulty in handling frequently changing data, which often results in false negatives or false positives. Post-AD methods, in contrast, are typically applied after model aggregation, aiming to detect and mitigate backdoor behaviors in trained models.
Compared with the other two types of defenses, Post-AD methods operate in a reactive manner Compared with the other two types of defenses, Post-AD methods operate in a reactive manner (Li et al. 2022), as they rely on analyzing the trained model rather than preventing malicious updates during the training process. This characteristic has been widely discussed in a recent survey on backdoor defenses in FL (Li et al. 2025). Furthermore, since Post-AD methods can only access the final model or its predictions, they are inherently limited in their ability to trace and remove malicious updates introduced during training (Nguyen et al. 2024). As a result, their effectiveness largely depends on the detectability of backdoor behaviors in the model’s output or internal representations. In addition, a prior study (Huang et al. 2023) has pointed out that these defense mechanisms incur additional computational overhead or rely on strong assumptions, which may limit their practicality in real-world FL scenarios. In conclusion, while Post-AD methods provide an important line of defense, they are typically regarded as complementary mechanisms, and their ability to provide timely protection during training is relatively limited.
In contrast, In-AD methods are currently the most suitable and efficient defenses for deployment within the FL paradigm, as they aim to detect and mitigate malicious updates during the training and aggregation process. Recently, several studies have further advanced this type of defense. For example, Lockdown (Huang et al. 2023) isolates model updates into independent subspaces to mitigate the influence of malicious updates. FedDefender (Gill et al. 2023) detects backdoor attacks by analyzing neuron activation patterns, while CrowdGuard (Rieger et al. 2022) leverages client-side feedback and behavior clustering to identify abnormal updates. Despite these advances, these methods generally rely on the assumption that malicious updates exhibit distinguishable statistical or behavioral patterns compared to benign updates. However, such assumptions may not hold for more adaptive attacks, where malicious updates are intentionally aligned with benign update distributions. In Section “Robustness of FedGAT”, we evaluate the robustness of the proposed FedGAT method against three state-of-the-art defense mechanisms, demonstrating its ability to evade existing defenses and underscoring the need for more robust countermeasures in FL.
Methodology
In this chapter, we describe the proposed FedGAT method in detail. We begin by specifying the threat model employed, including an analysis of the attack scenario and objectives, and a characterization of the attacker’s knowledge and capabilities. Next, we outline the overall attack procedure, which consists of four steps. Finally, we present the technical details of the FedGAT method.
Threat model
Attack scenario
This work focuses on the setting of a single attacker (Bagdasaryan et al. 2020) because it is easier to deploy. To emphasize the low-cost nature of our approach, the attacker need only control a single client as a malicious participant to mount an effective attack. The attacker’s ultimate objective is to maximize the targeted misclassification probability on triggered samples while avoiding any significant degradation of the global model’s main task performance.
The attack comprises two main parts. The first—trigger generation—is the core contribution. Given the publicly available global model and a small set of local clean samples, the attacker employs the designed FedGAT components to produce optimized triggers. The second component covers backdoor training and inference. Under a clean-label setting, the attacker inserts the optimized triggers into a subset of training samples of the target class and trains on these poisoned samples to implant the backdoor in the local model. The attacker then submits malicious updates to participate in aggregation and thereby infect the global model; notably, our method achieves strong attack performance without scaling the submitted updates. Finally, the model’s main task performance and the backdoor effectiveness are evaluated during inference.
Attack objectives
Considering the above scenario and the inherent properties of backdoor attacks, the adversary has two primary objectives: effectiveness and stealth. Effectiveness requires that, at inference time, the model classify inputs containing the specified trigger into the preset target class with as high an ASR as possible. Stealth comprises three requirements: (1) the trigger must be imperceptible—i.e., difficult to notice by visual inspection to avoid disclosure during training; (2) the main-task performance must be preserved—the attack must not cause a significant drop in main accuracy, which would expose the attack via performance checks; and (3) robustness to defenses—the attack must evade most common defenses, otherwise it will be detected or removed.
In addition, a powerful adversary seeks two further goals: low cost and persistence. Low cost requires minimizing dependence on the number of poisoned samples and the number of compromised clients when embedding a backdoor. Persistence requires that the attacker’s backdoor maintain a high ASR for a prolonged period after trigger injection has ceased, even under subsequent flushing by clean updates. Extensive evaluation shows that our method satisfies both requirements. In summary, with control of a single client, the attacker constructs an imperceptible trigger and uses only a small number of poisoned samples to achieve sustained high ASR without scaling the submitted updates, while causing no noticeable drop in main-task accuracy and evading several state-of-the-art defenses.
Attacker’s knowledge and capability
Following Kerckhoffs’ principle (Shannon 1949), we adopt assumptions similar to those used in Model Replacement (Bagdasaryan et al. 2020). The adversary who embeds the backdoor retains full control over its client’s training process, including management of local data, model updates, and hyperparameter tuning across iterations. This configuration ensures that the attack remains confined to the adversary’s client and does not affect other participants or the central server, making it highly practical within the federated learning paradigm.
Overall workflow
This section uses the traffic recognition task as a specific example to illustrate the overall workflow of FedGAT, as shown in Fig. 1. The detailed steps are as follows:
Data and model preparation: The attacker, based on the learning task issued by the central server and their own attack objectives, selects a tiny number of clean samples from the target class in the local training data to form a small dataset \(D_t\). Additionally, a copy of the converged global model, denoted as \(f'_\theta\), is made to train and optimize the trigger \(\delta ^*\).
Step 1: Optimized trigger generation. Using the small sample set \(D_t\) and the model copy \(f'_\theta\) from the preparation phase, a variant of the GAN framework is employed for training to generate the optimal trigger. The model \(f'_\theta\) is used as the discriminator with all parameters fixed during the process. Its feedback serves as a static loss signal, which is backpropagated to optimize the generator. This process results in the creation of the trigger that elicits the most significant response from the global model. The detailed process is discussed in the next section.
Step 2: Poisoning the local model. After obtaining the optimized trigger \(\delta ^*\), poisoned samples can be constructed. From the controlled client’s local dataset \(D_N\), target class samples \(D_{\text {target}}\) are selected, and the trigger is embedded as follows:
where \(\alpha _{\min }\) and \(\alpha _{\max }\) represent the image normalization range constraints. In this step, the clean-label attack setting (Zeng et al. 2023) is followed, ensuring that the initial labels of the samples remain unchanged. Once the poisoned samples \(x^{\text {poi}}\) are constructed, they are mixed with the clean samples and used for local training, embedding the backdoor into the local model.
Step 3: Polluting the global model. After local training, the malicious participant submits the harmful updates to the server. These updates are aggregated, resulting in the pollution of the global model. Notably, our method does not use any scaling factors during aggregation to amplify the harmful updates in order to enhance the backdoor performance.
Step 4: Compromised global model inference. The final global model should exhibit both strong main task performance and effective backdoor behavior. Specifically, it should correctly classify clean samples while misclassifying inputs containing \(\delta ^*\) to the target class with as high a probability as possible, as described by the following equation:
where \(\theta _{\text {GM}}\) represents the parameters of the global model, \(x_i^{\text {cln}}\) and \(x_{i'}^{\text {poi}}\) are clean and poisoned test samples, respectively. \(l(\cdot )\) is the loss function, \(b(\cdot )\) denotes the backdoor operation, and t is the target label.
FedGAT
This section provides a detailed description of the process for training and optimizing the trigger using the target class small sample set \(D_t\) and the global model copy \(f'_\theta\). Inspired by GANs, we adopt a generator-discriminator training framework. However, unlike traditional GANs, where the generator and discriminator are alternately updated for adversarial training, we choose \(f'_\theta\) as the discriminator and keep it fixed throughout the training process.
It is worth noting that, although FedGAT adopts a generator–discriminator–like structure, it differs fundamentally from conventional GAN training paradigms. Traditional GANs aim to model the underlying data distribution through adversarial optimization between a generator and a jointly trained discriminator. In contrast, our objective is not to generate realistic data samples, but to construct task-specific trigger perturbations that induce targeted misclassification.
More importantly, FedGAT does not involve a dynamic adversarial game. Instead, the global model \(f^{'}_\theta\) is treated as a fixed reference, and its feedback serves as a direct optimization signal for the generator. This design allows the trigger optimization process to explicitly align with the behavior of the global model, rather than implicitly approximating a data distribution as in standard GANs.
As a result, FedGAT exhibits several practical advantages: (1) it directly optimizes the trigger with respect to the target attack objective, leading to more effective and stable attack performance; (2) it avoids the instability commonly associated with adversarial training; and (3) it reduces the discrepancy between locally optimized triggers and their effectiveness on the global model.
The motivation behind fixing the discriminator is that we aim to use the feedback from the global model as a benchmark to adjust the generated trigger in reverse, ultimately achieving the optimization objective.
The core idea of FedGAT is to utilize the feedback from the discriminator as a static loss signal and optimize the generator via backpropagation, ultimately generating a sample perturbation that maximizes the discriminator’s response, i.e., the optimal trigger \(\delta ^*\). The training process results in the ideal generator network \(G_\theta ^*\) and the optimal trigger \(\delta ^*\), with the overall training objective given as follows:
where \(\delta = G_\theta (z)\) is the trigger generated by the generator, and \(\epsilon\) is the perturbation constraint on the trigger. Since this study primarily focuses on classification tasks, the cross-entropy loss function (Zhang et al. 2024) is used.
Following the approach of Radford et al. (2015), the generator adopts a modular design with multi-level transposed convolution, as shown in the following equation:
To enhance reproducibility, we provide detailed architectural configurations of the generator. The generator is implemented as a sequence of transposed convolutional layers that progressively upsample the input noise vector. Specifically, the generator consists of four ConvTranspose2d layers. Each intermediate layer is followed by a ReLU activation function, while the final layer uses a Tanh activation function to constrain the perturbation range. The detailed architecture, including the number of channels, kernel size, stride, and padding of each layer, is summarized in Table 1. This design enables the generator to effectively produce structured perturbations aligned with the feature space of the global model. Batch normalization can be optionally applied after intermediate layers to stabilize training.
The input to the generator is a noise vector \(z \in \mathbb {R}^d\), where d is the dimensionality of the noise. The key operation involves n layers of transposed convolutions (ConvTranspose2d) that progressively upsample the input. After each layer, a ReLU activation function is applied, and the output channels are aligned with the image’s channel count (e.g., for RGB images, the output will have three channels). The final layer uses a tanh function to constrain the perturbation range to \([-1, 1]\), followed by scaling and clipping to fit the constraint \(\epsilon\). It is noteworthy that when the trigger is added to the original sample, a carefully designed dual constraint is applied, formalized as follows:
here, the inner clipping operation \(\text {clip}(G_\theta (z), -\epsilon , \epsilon )\) controls the magnitude of the perturbation to ensure that the trigger remains visually imperceptible. The outer clipping \(\text {clip}(\cdot , \alpha _{\min }, \alpha _{\max })\) ensures that the pixel values remain within a valid range.
Finally, the generator network is optimized using the loss function based on the global model copy \(f'_\theta\). Specifically, all parameters of the model copy are frozen, and only the generator parameters \(\theta _G\) are updated via backpropagation of the cross-entropy loss. The Adam optimizer is used during training, and the loss function is given by:
where \(p_{f_\theta '}^{(t)}(\cdot )\) represents the probability density function of the model copy \(f_\theta '\) at the t-th round, and \(\log p_{f_\theta '}^{(t)}(\cdot )\) is the log-probability of the sample under the model distribution. The optimized triggers’ generation algorithm is shown below.
Experiments
This chapter provides a comprehensive evaluation of the performance of FedGAT, divided into five sections. The first section details the experimental setup, the second section evaluates the effectiveness and stealth of the attack, the third section analyzes the impact of several key parameters on the attack performance, the fourth section verifies and briefly analyzes the persistence of the attack, and the final section assesses the ability of FedGAT to evade existing defense mechanisms.
Experimental settings
In this section, we introduce the experimental configurations used throughout this work. The selection of hyperparameters is guided by prior studies in backdoor attacks (Xie et al. 2019; Liu et al. 2024) as well as commonly adopted empirical practices. In addition, we validate the reasonableness of these parameter settings through performance observations (e.g., ASR and ACC), ensuring stable and consistent behavior across different experimental scenarios.
General settings
Machine and software. The experiments were conducted on a server equipped with four NVIDIA A100 GPUs, running Ubuntu 20.04 and Pytorch version 2.0.7.
Datasets and models. The tests cover three datasets: CIFAR-10, GTSRB, and PTSD, with the commonly used ResNet-18 architecture chosen for the models. CIFAR-10 is a benchmark dataset for image classification, while GTSRB and PTSD are traffic sign datasets sourced from Germany and Iran, respectively. All image data undergo normalization during the preprocessing stage. Information about each dataset is provided in Table 2. Clean-ACC refers to the main task accuracy of the converged global model under the condition of no attack.
Evaluation metrics. Two widely used metrics in the field are employed to evaluate the performance of FedGAT. ASR directly measures the attack intensity, while accuracy (ACC) reflects the stealth of the attack from one perspective.
-
ASR\(\uparrow\) (Li et al. 2023): The probability that test samples containing the trigger are misclassified into the target class. A higher ASR indicates a stronger attack intensity of FedGAT.
-
ACC\(\uparrow\) (Jiang et al. 2023): The classification accuracy of the global model on clean samples after the attack is deployed. A higher ACC suggests that the degradation of the main task performance caused by FedGAT is minimal, making it harder to detect the attack through model performance evaluation.
FL settings
The central server uses the FedAvg algorithm for aggregation (McMahan et al. 2017a), with a global learning rate of 0.01. A total of 100 clients are involved, with 10 randomly selected participants for aggregation in each communication round. One advantage of this method is the use of a “single-shot attack” setup, meaning the attacker does not need to participate in every aggregation round. Instead, the attack goal can be achieved by injecting the backdoor just once. To simulate a highly non-I.I.D. scenario, we use a Dirichlet distribution (Mosimann et al. 1962) with a coefficient \(\alpha = 0.1\) to partition the data (with smaller values of \(\alpha\) leading to higher data imbalance).
Local training uses the cross-entropy loss function and the Stochastic Gradient Descent (SGD) optimizer with a batch size of 64. When training on clean samples, the learning rate is set to 0.1 for 4 epochs. For training on poisoned samples, a learning rate of 0.05 is used for 6 epochs, with a learning rate decay of \(\eta = 0.1\). This setup is designed to enhance the success rate of embedding the backdoor into the local model (Bagdasaryan et al. 2020). Another advantage of this method is that it does not scale any of the submitted malicious updates, yet still achieves the desired attack performance.
Optimized trigger & other attack settings
Section “FedGAT” provides a detailed description of the process for optimized trigger generation. Through extensive practical experience, we found that the quality of the generated trigger is influenced by three parameters: (1) the number of iterations I in the training process of the trigger generation algorithm, (2) the size of the input small sample set \(|D_t|\), and (3) the perturbation strength constraint \(\epsilon\) on the trigger. For our baseline configuration, we set \(I = 1000\), \(|D_t| = 50\), and \(\epsilon = 16/256\), under which FedGAT demonstrates excellent attack performance.
In our experiments, we adopt a targeted backdoor attack setting, where all triggered samples are mapped to a fixed target label. This setting is widely used in prior studies due to its strong controllability and practical relevance (Gu et al. 2017; Bagdasaryan et al. 2020). The specific choice of the target label is randomly selected. Prior works have shown that the selection of different target labels generally has a limited impact on attack performance under standard backdoor settings (Nguyen et al. 2021; Zeng et al. 2023). For simplicity, during the attack implementation phase, we set the target labels for CIFAR-10, GTSRB, and PTSD as #2, corresponding to “bird”, “speed limit 50”, and “keep right”, respectively. The impact of target label selection is further investigated in Sect. “Impact of target label selection”, where we empirically demonstrate that different label choices lead to consistent attack performance.
The backdoor injection occurs after the global model has converged. Specifically, the global model copies are used to train and optimize the trigger after 200, 600, and 500 rounds for CIFAR-10, GTSRB, and PTSD, respectively. The one-shot backdoor attack is then performed after two additional rounds (i.e., at 202, 602, and 502 rounds). The perturbation range of the trigger spans the entire image, with dimensions of 32*32 for CIFAR-10 and GTSRB, and 64*64 for PTSD.
Baseline method settings
We select three advanced federated learning backdoor attacks as baseline methods to compare with FedGAT, in order to validate its outstanding backdoor performance. The descriptions and setup details for each baseline method are as follows:
-
DBA (Xie et al. 2019): This method learns the complete trigger pattern by aggregating fragments of the trigger information, enabling efficient distributed backdoor attacks. However, the trigger remains a fixed pattern.
-
FCBA (Liu et al. 2024): This method improves the global model’s ability to learn a complete trigger through a carefully designed full-combination trigger strategy, achieving a more persistent backdoor. Similar to DBA, the trigger is still based on a fixed pattern formed by random combinations.
-
CBA (Gong et al. 2022): This method selects target neurons and uses gradient descent to optimize the trigger, maximizing its activation value to enhance the backdoor attack effect. However, the optimization process primarily generates the optimized trigger based on local model information, rather than directly designing the trigger for the global model.
To ensure a fair comparison, we ensure that the overall pixel perturbation levels are consistent across different methods, as specified in Table 3. More importantly, none of the methods in the experiments use any scaling of malicious updates, which serves to highlight the limitations of existing methods and the superior performance of FedGAT.
Main results
Attack performance evaluation
From the data Table 4, it is evident that FedGAT achieves the highest ASR across all datasets compared to all baseline methods. Specifically, the DBA and FCBA methods, which rely on fixed-pattern triggers, perform best on CIFAR-10, but their ASRs are still below 10%, with nearly complete failure on other datasets. The CBA method, which designs the trigger based on the local model, achieves better attack results, with an average ASR below 60%. In contrast, our proposed FedGAT directly designs the trigger based on the global model, achieving the best performance, with ASR exceeding 75% on all datasets, and even surpassing 99% on CIFAR-10.
To visually highlight the “loss” of the backdoor during the transfer from the local model to the global model, and to demonstrate how FedGAT avoids this “loss,” we conducted an additional set of validation experiments. Specifically, after the attack is initiated, we recorded the ASR of each backdoor in both the local and global models, and plotted the results in Fig. 2. A comparison reveals that all methods achieve an ASR above 75% in the local model after the attack injection. However, a significant decline in ASR occurs once the backdoor is transferred to the global model.
The DBA and FCBA methods, which use fixed trigger patterns, suffer from significant dilution of malicious updates by the benign updates submitted by other participants, as the malicious updates cannot be amplified. This results in the backdoor failing to be successfully embedded in the global model, leading to complete failure. CBA, which designs the trigger based on the local model, optimizes the trigger generation by considering the model’s feedback, thus improving the attack performance. However, due to the non-I.I.D. nature of the data, there are still differences between the local and global models, causing a noticeable “loss” during the transfer process. Only a portion of the backdoor information remains in the global model, which somewhat limits the actual attack effectiveness.
In contrast, FedGAT directly optimizes the trigger based on the feedback from the converged global model, preserving the integrity of the trigger pattern within the global model as much as possible. This approach ensures a high ASR in the global model, thereby guaranteeing superior attack performance.
Stealth performance evaluation
The data in Table 4 also shows that, across all datasets, the ACC of FedGAT is on par with that of the baseline methods, with no significant drop compared to Clean-ACC. This indicates that FedGAT does not compromise the main task performance, ensuring that the global model can successfully pass model detection. This finding, on one hand, demonstrates the stealthiness of the proposed method.
Further, by examining Table 3 in Sect. “Baseline method settings”, it can be observed that the perturbation magnitude, the number of attackers, and the proportion of poisoned samples in FedGAT are all lower than the baseline averages. This indicates that the proposed method achieves higher trigger invisibility, making both the attackers and poisoned samples more difficult to detect. Additionally, the attack setup clearly shows that FedGAT follows a clean-label attack approach, meaning that the backdoor samples do not exhibit label anomalies. These factors collectively reinforce the stealthiness of the proposed method from another perspective.
Cost analysis
Following the evaluation of attack performance and stealthiness, we further analyze the computational cost of different attack methods to provide a more comprehensive assessment.
In our experimental setup, key cost-related factors, including the number of poisoned samples and the perturbation magnitude, are maintained at comparable levels across different methods (see Sect. “Experimental settings”). Therefore, we focus on time overhead as the primary metric for cost comparison.
Specifically, we measure the average execution time of two key stages over each round: (1) trigger generation and (2) local poisoning. The results are summarized in Table 5.
As shown in Table 5, DBA and FCBA do not involve explicit trigger optimization, resulting in negligible trigger generation overhead. In contrast, both CBA and FedGAT introduce additional trigger optimization procedures, each incurring approximately 30 s of computation time per round. However, DBA and FCBA require substantially more time in the local poisoning stage (exceeding 40 s), whereas CBA and FedGAT achieve significantly lower poisoning overhead. As a result, when considering the total local runtime, all methods remain at a comparable level, and FedGAT does not introduce a noticeable increase in overall computational cost.
Furthermore, during trigger generation, the global model remains fixed and can be reused for subsequent local training, resulting in negligible additional memory overhead.
Overall, FedGAT achieves significantly improved attack performance without introducing a substantial increase in computational cost, demonstrating a favorable trade-off between effectiveness and efficiency.
Hyperparameter sensitivity analyses
This section conducts a hyperparameter sensitivity analysis of FedGAT across various datasets. As discussed earlier, we focus on several key factors that influence attack performance. These factors include: (1) Size of the small sample set used to train and optimize the trigger \(|D_t|\); (2) Maximum allowable perturbation magnitude \(\epsilon\); (3) Number of iterations in the optimization algorithm I. The comprehensive analysis of these factors helps in gaining a deeper understanding of the optimized trigger strategy we propose. In addition, we further analyze the impact of target label selection on attack performance to provide a more complete evaluation of the proposed method.
Impact of small sample set size \(\left| D_t \right|\)
We keep the baseline settings of \(\epsilon = 16/256\) and \(I = 1000\) constant, while varying the size of the small sample set \(|D_t|\) (10, 30, 50, 70, 100) to evaluate the impact of \(|D_t|\) on attack performance. As shown in Fig. 3, triggers trained with too few samples exhibit poor generalization to the target class, resulting in a low ASR. ASR increases with the initial growth of \(|D_t|\), but beyond a certain point, no significant changes are observed, as the attack performance reaches its upper limit. Moreover, excessively large values of \(|D_t|\) increase training costs and prolong the time required to optimize the trigger. Therefore, an optimal \(|D_t|\) should be chosen to efficiently generate an ideal trigger.
Impact of maximum permissible disturbance amplitude \(\epsilon\)
We keep the baseline settings of \(|D_t| = 50\) and \(I = 1000\) constant, while varying the value of \(\epsilon\) (4/256, 8/256, 12/256, 16/256, 20/256) to evaluate its impact on attack performance. As shown in Fig. 4, triggers with too small perturbation magnitudes are not pronounced enough to activate the backdoor, resulting in a low ASR. ASR increases with the initial growth of \(\epsilon\), but after a certain point, there are no significant changes, as the attack performance reaches its upper limit. Moreover, excessively large values of \(\epsilon\) significantly increase the visual visibility of the trigger, which can lead to detection by observers or defense mechanisms. Therefore, an appropriate value of \(\epsilon\) should be selected to balance the attack intensity and the visual stealth of the trigger, ensuring that FedGAT delivers optimal overall performance.
Impact of iterations of the optimization algorithm I
We keep the baseline settings of \(\epsilon = 16/256\) and \(|D_t| = 50\) constant, while varying the number of iterations I (100, 300, 500, 1000) to evaluate its impact on attack performance. As shown in Fig. 5, triggers generated with too few iterations are not sufficiently optimized, limiting their ability to express the backdoor features, resulting in a low ASR. As the number of iterations increases, the optimized trigger’s features gradually align with the global model’s feature space, leading to a significant improvement in attack performance. However, due to the upper bound on attack performance, further increasing I does not yield significant gains. Moreover, excessively large values of I increase computational overhead and prolong training time. Therefore, an appropriate value of I should be chosen to efficiently generate the optimal trigger.
Based on the above analysis of key hyperparameters, we observe that although certain parameters (e.g., those directly involved in trigger optimization) can influence attack performance to some extent, FedGAT maintains stable and competitive results within a reasonable parameter range. This indicates that the effectiveness of the proposed method does not rely on highly sensitive parameter tuning, and the selected configurations provide a good balance between attack performance and stability. Beyond hyperparameter settings, we further investigate the impact of target label selection on attack performance in the following subsection.
Impact of target label selection
In this section, we analyze the impact of different target label selections on the attack performance. In addition to the default target label (#2), we conduct additional experiments by selecting two alternative labels (#0 and #6). For each label, we repeat the experiment three times and report the average results. The experimental settings remain consistent with the baseline configuration. As shown in Table 6, both ACC and ASR exhibit negligible variation across different target labels. This indicates that the effectiveness and stealthiness of FedGAT are largely insensitive to the choice of the target label. This observation is consistent with prior studies and further supports the generality of our method.
Attack persistence assessment and brief analysis
In addition to ASR and stealth, we also focus on the attack persistence of FedGAT. Attack persistence, a new metric recently proposed by Liu et al. (2024), evaluates whether a backdoor attack in FL can withstand the dilution effect of subsequent benign updates and continue to be effective. The evaluation method primarily relies on the ASR curve, where the rate of decline of ASR over communication rounds is observed to determine the strength of persistence. A slower decline in ASR indicates higher attack persistence.
To evaluate the persistence of the attack, we performed a long-duration training with FedGAT implanted on each dataset (i.e., retraining for 1000 additional rounds after the attack injection). As shown in Fig. 6, the ASR curves exhibit a generally smooth trend with no significant decline. This indicates that FedGAT demonstrates excellent attack persistence, maintaining a high ASR for up to 1000 rounds after a single attack injection.
We attribute FedGAT’s outstanding persistence primarily to the optimization trigger strategy based on global model feedback. During the design of the trigger, we align the generated trigger with the feature space of the global model, ensuring that the backdoor features naturally adapt to the distribution of the global model during aggregation. This significantly reduces the “loss” of the backdoor during the transfer process, thereby enhancing the overall attack performance.
Robustness of FedGAT
We also focus on the ability of FedGAT to evade some advanced defense methods under the FL paradigm. In this section, we verify FedGAT’s evasion capability against three advanced defense methods highlighted in Sect. “Relate work”: Multi-Krum, RLR, and FLAME. Additionally, it is important to note that the default aggregation method for the main task is FedAvg, which has also been shown to be a basic robust aggregation algorithm (McMahan et al. 2017a). Therefore, we include FedAvg as a simple backdoor defense for verification. The implementation of FedGAT and all other parameters follow the baseline settings, and the results are shown in Fig. 7.
From the ASR curve trends in this figure, it is clear that even with the deployment of the aforementioned defense measures, FedGAT maintains high ASR and attack persistence across all datasets. Specifically, nearly 100 rounds after the attack, the average ASR across datasets remains above 88%. This indicates that existing defense methods are insufficient to eliminate the threat posed by FedGAT, highlighting its strong robustness.
To further understand why existing defense mechanisms fail against FedGAT, we conduct a quantitative analysis on the distribution of model updates. Most defense methods rely on the assumption that malicious updates can be distinguished from benign ones based on their statistical characteristics. To validate this, we visualize the model updates from benign clients and the attacker using t-SNE. The updates are extracted from client-side local models before aggregation, ensuring a fair comparison across different attack methods.
Specifically, we randomly sample model updates from both benign clients and the attacker under different attack methods, including DBA, CBA, FCBA, and FedGAT. The sampled updates are then projected into a two-dimensional space using t-SNE (Van der Maaten and Hinton, 2008) for visualization.
As shown in Fig. 8, for baseline methods (DBA, CBA, and FCBA), malicious updates (red points) are clearly separated from benign updates (blue points), indicating that these attacks introduce distinguishable statistical patterns. This explains why existing defense mechanisms can effectively identify and mitigate such attacks.
In contrast, the updates generated by FedGAT are highly overlapped with benign updates, forming a mixed distribution with no clear boundary between the two classes. This indicates that FedGAT significantly reduces the statistical distinguishability between malicious and benign updates.
We observe similar trends across multiple communication rounds. This property can be attributed to the global model–guided trigger optimization, which aligns the malicious updates with the feature space of the global model. As a result, the attack updates exhibit similar characteristics to benign updates, making it difficult for defense mechanisms to detect and remove them. These results provide a quantitative explanation for the superior robustness of FedGAT against existing defense methods.
Conclusion & future work
We propose a backdoor attack method, FedGAT, which generates optimized triggers based on global model feedback. FedGAT achieves efficient attacks in FL without the need to amplify malicious updates. By leveraging a tiny number of samples and the global model, and improving the GAN framework, the generator automatically creates optimized triggers that are directly aligned with the global model’s feature space. This approach avoids the “loss” of backdoor information during the transfer from the local model to the global model, significantly enhancing attack performance. Extensive evaluations demonstrate that FedGAT is efficient, stealthy, persistent, and robust against advanced defense mechanisms. Our work introduces a novel threat within the FL paradigm and contributes to the development of secure and trustworthy distributed learning.
While FedGAT demonstrates strong performance, several aspects merit further discussion. First, the trigger optimization is guided by the global model, and its effectiveness may be influenced in highly dynamic scenarios where the global model undergoes significant changes. However, in typical federated learning settings where the model converges steadily, the optimized trigger remains effective without requiring frequent re-optimization. Second, the current design focuses on task-specific optimization, which may limit direct transferability across different models or tasks, but also opens opportunities for designing adaptive optimization strategies tailored to diverse learning scenarios. Third, although the trigger generation process introduces additional optimization steps compared to fixed-trigger methods, it remains practical under common settings and provides a flexible framework for further refinement. Future work will investigate more generalizable and adaptive trigger generation strategies, as well as attack variants across different data modalities and learning environments.
Data availability
The datasets used for the experiments are freely available to researchers. The links to the data have been cited as references. The code, written in Python, is available at https://github.com/PhD-TaoLiu/FedGat
References
Bagdasaryan E, Veit A, Hua Y (2020) How to backdoor federated learning. In: International conference on artificial intelligence and statistics. pp 2938–2948. PMLR
Baruch G, Baruch M, Goldberg Y (2019) A little is enough: Circumventing defenses for distributed learning. Adv Neural Inf Process Syst 32
Blanchard P, El Mhamdi EM, Guerraoui R (2017) Machine learning with adversaries: Byzantine tolerant gradient descent. Adv Neural Inf Process Syst 30
Chellapandi VP, Yuan L, Żak SH (2023) A survey of federated learning for connected and automated vehicles. In: 2023 IEEE 26th International Conference on Intelligent Transportation Systems (ITSC), pp 2485–2492 IEEE
Dong J, Wang L, Fang Z (2022) Federated class-incremental learning. In: Proceedings of the IEEE/CVF conference on computer vision and pattern recognition. pp 10164–10173
Fung C, Yoon CJ, Beschastnikh I (2018) Mitigating sybils in federated learning poisoning. Preprint at arXiv:1808.04866
Geyer RC, Klein T, Nabi M (2017) Differentially private federated learning: a client level perspective. Preprint at arXiv:1712.07557
Gill W, Anwar A, Gulzar MA (2023) Feddefender: backdoor attack defense in federated learning. Proceedings of the 1st International workshop on dependability and trustworthiness of safety-critical systems with machine learned components. pp 6–9
Gong X, Chen Y, Huang H et al (2022) Coordinated backdoor attacks against federated learning with model-dependent triggers. IEEE Netw 36(1):84–90
Gu T, Dolan-Gavitt B, Garg S (2017) Badnets: identifying vulnerabilities in the machine learning model supply chain. Preprint at arXiv:1708.06733
Guo S, Zhang T, Yu H et al (2021) Byzantine-resilient decentralized stochastic gradient descent. IEEE Trans Circuits Syst Video Technol 32(6):4096–4106
Huang T, Hu S, Chow KH et al (2023) Lockdown: backdoor defense for federated learning with isolated subspace training. Adv Neural Inf Process Syst 36:10876–10896
Imteaj A, Thakker U, Wang S et al (2021) A survey on federated learning for resource-constrained IoT devices. IEEE Internet Things J 9(1):1–24
Jiang W, Li H, Xu G (2023) Color backdoor: a robust poisoning attack in color space. Proceedings of the IEEE/CVF conference on computer vision and pattern recognition. pp 8133–8142
Konečnỳ J, McMahan HB, Yu FX, et al (2016) Federated learning: Strategies for improving communication efficiency. Preprint at arXiv:1610.05492
Li S, Xue M, Zhao BZH et al (2020) Invisible backdoor attacks on deep neural networks via steganography and regularization. IEEE Trans Dependable Secur Comput 18(5):2088–2105
Li S, Ngai ECH, Voigt T (2023) An experimental study of Byzantine-robust aggregation schemes in federated learning. IEEE Trans Big Data 10(6):975–988
Li Y (2023) Poisoning-based backdoor attacks in computer vision. Proceedings of the AAAI Conference on Artificial Intelligence. pp 16121–16122
Li Y, Jiang Y, Li Z et al (2022) Backdoor learning: a survey. IEEE Trans Neural Netw Learn Syst 35(1):5–22
Li Z, Lan J, Yan Z et al (2025) Backdoor attacks and defense mechanisms in federated learning: a survey. Inf Fusion 123:103248
Liu T, Zhang Y, Feng Z (2024) Beyond traditional threats: a persistent backdoor attack on federated learning. Proceedings of the AAAI Conference on Artificial Intelligence. pp 21359–21367
Lyu X, Han Y, Wang W et al (2024) Coba: collusive backdoor attacks with optimized trigger to federated learning. IEEE Trans Dependable Secur Comput 22(2):1506–1518
Van der Maaten L, Hinton G (2008) Visualizing data using t-SNE. J Mach Learn Res 9(11):2579–2605
McMahan B, Moore E, Ramage D, et al (2017) Communication-efficient learning of deep networks from decentralized data. In: Artificial intelligence and statistics, PMLR, pp 1273–1282
McMahan HB, Ramage D, Talwar K, et al (2017) Learning differentially private recurrent language models. Preprint at arXiv:1710.06963
Mosimann JE (1962) On the compound multinomial distribution, the multivariate \(\beta\)-distribution, and correlations among proportions. Biometrika 49(1/2):65–82
Nguyen A, Tran A (2021) Wanet-imperceptible warping-based backdoor attack. Preprint at arXiv:2102.10369
Nguyen TD, Rieger P, Chen H, et al (2022) \(\{\)FLAME\(\}\): taming backdoors in federated learning. In: 31st USENIX Security Symposium (USENIX Security 22), pp 1415–1432
Nguyen TD, Nguyen T, Le Nguyen P et al (2024) Backdoor attacks and defenses in federated learning: survey, challenges and future research directions. Eng Appl Artif Intell 127:107166
Ozdayi MS, Kantarcioglu M, Gel YR (2021) Defending against backdoors in federated learning with robust learning rate. Proceedings of the AAAI conference on artificial intelligence. pp 9268–9276
Radford A, Metz L, Chintala S (2015) Unsupervised representation learning with deep convolutional generative adversarial networks. Preprint at arXiv:1511.06434
Rieger P, Krauß T, Miettinen M (2022) Crowdguard: Federated backdoor detection in federated learning. Preprint at arXiv:2210.07714
Saha A, Subramanya A, Pirsiavash H (2020) Hidden trigger backdoor attacks. Proceedings of the AAAI conference on artificial intelligence. pp 11957–11965
Shannon CE (1949) Communication theory of secrecy systems. Bell Syst Tech J 28(4):656–715
Sheller MJ, Edwards B, Reina GA et al (2020) Federated learning in medicine: facilitating multi-institutional collaborations without sharing patient data. Sci Rep 10(1):12598
So J, Ali RE, Güler B (2023) Securing secure aggregation: Mitigating multi-round privacy leakage in federated learning. Proceedings of the AAAI Conference on Artificial Intelligence. pp 9864–9873
Unnervik A, Shahreza HO, George A (2024) Model pairing using embedding translation for backdoor attack detection on open-set classification tasks. Preprint at arXiv:2402.18718
Wang H, Sreenivasan K, Rajput S et al (2020) Attack of the tails: Yes, you really can backdoor federated learning. Adv Neural Inf Process Syst 33:16070–16084
Wang Q, Liao W, Guo Y et al (2023) Blockchain-empowered federated learning through model and feature calibration. IEEE Internet Things J 11(4):5770–5780
Wu C, Yang X, Zhu S (2020) Mitigating backdoor attacks in federated learning. Preprint at arXiv:2011.01767
Wu C, Zhu S, Mitra P (2022) Federated unlearning with knowledge distillation. Preprint at arXiv:2201.09441
Xie C, Huang K, Chen PY (2019) Dba: Distributed backdoor attacks against federated learning. International conference on learning representations
Xu J, Huang SL, Song L (2022) Byzantine-robust federated learning through collaborative malicious gradient filtering. 2022 IEEE 42nd International Conference on Distributed Computing Systems (ICDCS). IEEE, pp 1223–1235
Yang Q, Liu Y, Chen T et al (2019) Federated machine learning: concept and applications. ACM Trans Intell Syst Technol (TIST) 10(2):1–19
Zeng Y, Pan M, Just HA (2023) Narcissus: a practical clean-label backdoor attack with limited information. Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security. pp 771–785
Zhang H, Jia J, Chen J et al (2023) A3fl: adversarially adaptive backdoor attacks to federated learning. Adv Neural Inf Process Syst 36:61213–61233
Zhang Y, Gong N, Reiter MK (2024) Concealing backdoor model updates in federated learning by trigger-optimized data poisoning. Preprint at arXiv:2405.06206
Zhang Z, Cao X, Jia J (2022) Fldetector: Defending federated learning against model poisoning attacks via detecting malicious clients. Proceedings of the 28th ACM SIGKDD conference on knowledge discovery and data mining. pp 2545–2555
Zhang Z, Panda A, Song L (2022) Neurotoxin: durable backdoors in federated learning. International Conference on Machine Learning. pp 26429–26446 (PMLR)
Zhang Z, Shi L, Zhou DX (2024) Classification with deep neural networks and logistic loss. J Mach Learn Res 25(125):1–117
Acknowledgements
We would like to extend our heartfelt gratitude to the editor and the “anonymous” reviewers of this paper. Their professional advice and valuable feedback significantly contributed to the quality of this research.
Funding
This work was supported by the National Natural Science Foundation of China (No. 62272127, No. 62406086, No. 62572144), the Joint Funds of the National Natural Science Foundation of China (No. U22A2036, No. U21B2019), and Basic Research Projects of the Central Universities and Colleges (3072025ZN0602).
Author information
Authors and Affiliations
Contributions
Tao Liu: Conceptualization, Methodology, Software, Validation, Formal analysis, Investigation, Writing—Original Draft, Visualization. Jiguang Lv: Resources, Writing—Review & Editing, Project administration, Funding acquisition. Dapeng Man: Conceptualization, Methodology, Resources, Writing—Review & Editing, Supervision, Project administration, Funding acquisition. Weiye Xi: Formal analysis, Visualization. Yaole Li: Software, Validation. Chen Xu: Supervision, Project administration. Wu Yang: Conceptualization, Resources, Writing—Review & Editing, Supervision, Project administration, Funding acquisition.
Corresponding author
Ethics declarations
Competing interests
The authors declare that they have no conflict of interest.
Additional information
Publisher's Note
Springer Nature remains neutral with regard to jurisdictional claims in published maps and institutional affiliations.
Rights and permissions
Open Access This article is licensed under a Creative Commons Attribution 4.0 International License, which permits use, sharing, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons licence, and indicate if changes were made. The images or other third party material in this article are included in the article’s Creative Commons licence, unless indicated otherwise in a credit line to the material. If material is not included in the article’s Creative Commons licence and your intended use is not permitted by statutory regulation or exceeds the permitted use, you will need to obtain permission directly from the copyright holder. To view a copy of this licence, visit http://creativecommons.org/licenses/by/4.0/
About this article
Cite this article
Liu, T., Lv, J., Man, D. et al. FedGAT: a backdoor attack based on global model feedback optimized triggers in federated learning. Cybersecurity 9, 208 (2026). https://doi.org/10.1186/s42400-026-00608-0
Received:
Accepted:
Published:
Version of record:
DOI: https://doi.org/10.1186/s42400-026-00608-0