Bad-PFL: Exploiting Backdoor Attacks against Personalized Federated Learning
Authors: Mingyuan Fan
Zhanyi Hu
Fuyi Wang
Cen Chen
Venue: ICLR 2025 Poster (2025)
Keywords: personalized federated learning
backdoor attacks
Primary area: alignment, fairness, safety, privacy, and societal considerations

Abstract: Data heterogeneity and backdoor attacks rank among the most significant challenges facing federated learning (FL). For data heterogeneity, personalized federated learning (PFL) enables each client to maintain a private personalized model to cater to client-specific knowledge. Meanwhile, vanilla FL has proven vulnerable to backdoor attacks. However, recent advancements in PFL community have demonstrated a potential immunity against such attacks. This paper explores this intersection further, revealing that existing federated backdoor attacks fail in PFL because backdoors about manually designed triggers struggle to survive in personalized models. To tackle this, we degisn Bad-PFL, which employs features from natural data as our trigger. As long as the model is trained on natural data, it inevitably embeds the backdoor associated with our trigger, ensuring its longevity in personalized models. Moreover, our trigger undergoes mutual reinforcement training with the model, further solidifying the backdoor's durability and enhancing attack effectiveness. The large-scale experiments across three benchmark datasets demonstrate the superior performance of Bad-PFL against various PFL methods, even when equipped with state-of-the-art defense mechanisms.

Published as a conference paper at ICLR 2025
Bad-PFL: EXPLORING BACKDOOR ATTACKS AGAINST PERSONALIZED FEDERATED LEARNING
Mingyuan Fan', Zhanyi Hu', Fuyi Wang', Cen Chen East China Normal Unversity, 2RMIT University
$my2660966@@maii com
$12559031108sth www..ecnu....... edu. fuyi wang edu..u
ABSTRACT
Data heterogeneity and backdoor attacks rank among the most significant chal- lenges facing federated learning (FL). For data heterogeneity, personalized feder- ated learning (PFL) enables each client to maintain private personalized model to cater to client-specific knowledge. Meanwhile, vanilla FL has proven vulnera- ble to backdoor attacks. However, recent advancements in PFL community have demonstrated a potential immunity against such attacks. This paper explores this intersection further, revealing that existing federated backdoor attacks fail in PFL because backdoors about manually designed triggers struggle to survive in per- sonalized models. To tackle this, we design Bad-PFI., which employs features from natural data as our trigger. As long as the model is trained on natural data, it inevitably embeds the backdoor associated with our trigger, ensuring its longevity in personalized models. Moreover, our trigger undergoes mutual reinforcement training with the model, further solidifying the backdoor's durability and en- hancing attack effectiveness. The large-scale experiments across three bench- mark datasets demonstrate the superior performance of Bad-PFL against various PFL methods, when equipped with state-of-the-art defense mechanisms. The source codes are available https: // / gigitiit tiu........ com/ com/Fmy266/Rad-PFF Bad-PFI..
defenss
INTRODUCTION
Federated learning (FL) (Ye et al., 2024a; Fan al.. 2023) has become the de facto privacy- preserving framework for training neural networks. In FL, a server maintains a globally shared selected clients. The clients train the model on their private datasets for several local steps and then return their models to be aggregated into a new global model, all without sharing sensitive information with the server or across devices. However, the server limited ver- ifying clients' integrity, doing so may infringe on privacy fairness constraints (Ye et al., 2024a). This limitation opens the door for potential backdoor attacks FL (Bagdasaryan al., 2020; Zhang et al., 2022), where adversary can compromise specific clients to upload backdoored models, so as to inject backdoor into the global model. Once predefined trigger is injected into the input data, the backdoor is activated, causing the model to misclassify the data into attacker-chosen labels.
model and broadeasts
Another challenge in FL is data heterogeneity across different clients, known as the non-III prob- lem (Ye et al., 2024a; Qin al., 2023). The problem not only slows down the convergence of the global model but can also limit the model's performance for some clients. To tackle this, personal- ized federated learning (PFL. has emerged for each client to better fit their specific data distribution. At a high level, most PFL methods can be categorized into two groups: full model-sharing (Chen et al., 2022; Karimireddy et al., 2020) and partial model-sharing methods (Li et al., 2021b; Collins et al., 2021). In full model-sharing methods, clients adapt the global model using techniques such as fine-tuning with local datasets (Chen al., 2022), parallel training of global and local models (Li et al., 2021a), regularization of the global model (Li al., 2020), etc. In contrast, partial model-sharing methods share only specific parts of
promising solution, learning personalized model
"Corresponding Author.

---

Published as a conference paper at ICLR 2025
the model. For example, FedRep (Collins et al., 2021) synchronizes the feature extractor of both the global and local models while maintaining each client's 's private classification head, and FedBN (Li et al., 2021b) shares all model parameters except for batch normalization layers.
Since the non-IlI problem is ubiquitous in real-world environments (Ye et al., 2024a), it is particu- larly important to explore the robustness of PFL against backdoor attacks. Preliminary studies (Qin et al., 2023) have shown a positive conclusion: PFL not only mitigates the non-IlI) problem but also offers immunity backdoor attacks. Specifically, partial model-sharing methods demonstrate significant resistance to existing federated backdoor attacks, reducing the attack success rate (ASR) to below 30%. The dual benefits make PFL quite popular and significantly alleviate users' concerns about the vulnerability of FL to backdoor attacks. However, upon reviewing the current literature on federated backdoor attacks (Xie et al., 2020; Liu et al., 2024; Zhuang et al., 2024), we find that ex- isting attacks seem to inadequately exploit the characteristics of PFI., making the robustness of PFI. against such attacks questionable. While some studies (Lai et al., 2022; Lyu et al., 2024) have inves- tigated backdoor attacks PFL methods, they often concentrate too narrowly or can be easily mitigated by defense mechanisms. In light of this, we first explore to address the question: What causes existing federated backdoor attacks to fail in PFL?
specific approaches
Our contribution. We identify three key factors contributing to the failure of these attacks. First, we empirically demonstrate that globally shared models can often be backdoored. However, in PFL, the personalized model typically differs from the global model or shares only partial parameters. In the former case, despite the presence of regularization terms that align the personalized model with the global model, the backdoor in the global model cannot be effectively implanted into the personalized model. Secondly, when only partial parameters are shared, the backdoor in the personalized model remains dormant, as the unshared private parameters are not adapted to accommodate the backdoor. Finally, since the personalized model is trained on clean data, the backdoor is gradually diluted due to catastrophic forgetting, further undermining attack effectiveness.
We develop novel yet highly effective backdoor attack method, called Bad-PFL. Unlike existing federated backdoor attack methods that force models to learn predefined triggers, Bad-PFL. exploits inherent backdoors within both the global and personalized models themselves. These backdoors correspond to the natural features of the attacker-chosen labels. We employ generator to identify these features that make given samples appear most similar to the target category when viewed by the model but remain imperceptible to human observers. Moreover, noise that eliminates features associated with the ground-truth labels in the given data, so as to enable the natural features of the attacker-chosen labels to stand out during the model's decision- making process. The blend of these two types of noise forms the trigger of Bad-PFI, which is capable of effectively tricking the model into mistaking trigger-added data. The generator alternates optimization with the global model, further enhancing the trigger's s effectiveness through mutual adaptation. Furthermore, due to the similarity between the global model and personalized models (regularization constraints, learned similar underlying features, etc.), the trigger can also effectively activate hidden natural backdoors within personalized models. These backdoors persist as long as personalized models are trained on natural data. By the way. the trigger is sample-specific and invisible, rendering Bad-PFL highly stealthy and difficult to detect (see Appendix B.2.11).
introduce disruptive
2 A CLOSE LOOK AT BACKDOOR ATTACKS IN PFL
2.1 FL VERSUS PFL
Consider a FL setup with m clients and a central server. Let = (1.2,..., m). Each client E U possesses a private dataset D, drawn from its local data distribution Pxy defined over X' X, where X' is the input space and )/ is the label space with K categories. Let L : X' x y - R. denote the loss function, e.g., cross-entropy loss. FL formulates the following optimization objective to train a global model F parameterized by 0g:
min Σ B (((F(1;0))))) Wy
SEU
where i-th term is the local optimization objective for i-th client. FedAvg (McMahan et al., 2017) addresses Equation 1 by iteratively alternating between two steps: 1) participating clients download
2

---

Published as a conference paper at ICLR 2025
the current global model F(:88g) from the server and then train the model on their respective local datasets, and 2) the server averages the locally trained models to form the new global model for the next iteration. However, it is common that Xy and Xay (i & j) are different (i.e., non-llI) problem), potentially causing the global model perform poorly for some clients. To mitigate the non-IID problem, PFL allows each client to maintain a private personalized model locally. For full model-sharing methods (Li al., 2021a; T Dinh et al., 2020), Equation I is adjusted as follows:
min Σ PL EEN
(L 8,), v) + R(0,, fy)],
where 8 is the parameters of i-th client' personalized model, and R serves as a regularization term that governs the distance between 0; and 0g. In Equation 2. 0g can be hamesssd to learn client- specific knowledge since 0; are not required to be identical to 0g. At the same time, RR facilitates the integration of global knowledge into the personalized models.
For partial model-sharing methods (Li et al., 2021b; Xu et al., 2023), most elements in 02 are con- strained to be same as the corresponding elements in 0g. with only a few allowed update freely. Let A denote a set containing the indices where partial model-sharing methods enforce equality between 0 and 0g totally. We can summarize the partial model sharing methods as follows:
min Σ (C( v)l, s.l., 0g(4] = 0,[A], k A, EE 11,3EL1
VEU
Compared to full model-sharing methods, partial model-sharing methods generally yield better per- formance (Xu al., 2023). because they incorporate prior knowledge identify which parameters are more likely to contain global knowledge and thus should be shared across clients, while al- lowing others that are more likely to learn client-specific knowledge to vary freely. For instance, in FedRep (Collins et al., 2021), the parameters of the feature extraction layer are shared across clients and only classification heads remain private. To avoid ambiguity, the local model refers to the global model that clients download from the server, excluding personalized models. In practice, to address Equation 2 and Equation 3, PFL methods may train 8g locally according to Equation before optimizing the personalized model (using the updated 0g), ), vice versa.
2.2 THE CHALLENGES BACKDOOR ATTACKS IN PFL
Federated backdoor attacks consider an adversary that can manipulate certain clients to pollute the global model by inserting a backdoor task into the training process of their local models as follows:
(ay)),, D. [11 - a) L(F((;;; (g). v) + a [(F(x - T(x): u.).
(4)
where T is the trigger generation function, Ye is the target label, and a is referred to as the poisoning rate, indicating the importance of the backdoor task relative to the main task. In the IID setting, the solution to Equation 4, i.e., the local solution of the compromised clients, can also perform well on datasets from other clients (Bagdasaryan et al., 2020). As result, the global model ultimately converges to the solution of Equation 4, thereby embedding the backdoor into the global model. However, in the non-lll) setting, client's local solution may perform poorly on datasets from other clients (Ye et al., 2024a), suggesting that the global model may not necessarily converge to the solution of Equation 4. This issue is even more pronounced in PFL, where backdoor attacks become more challenging because each client's personalized model diverges from the global model. Concretely, we identify three key challenges that hinder backdoor insert in PFL.
In full model-sharing methods, the regularization term alone is insufficient to directly transfer the backdoor from the global model to personalized models. We assess the performance of two backdoor attacks, Neurotoxin (Zhang et al., 2022) and PGD-Bkd (Wang et al., 2020a), across three full model-sharing methods: FedProx (Li et al., 2020), Ditto (Li et al., 2021a), and pFedMe (T Dinh et al., 2020). The detailed experimental settings and results for this section all can be found in Appendix I. In the non-IID setting, the ASR for the global model reaches approximately 90%. However, for personalized models, the ASRs typically range from 60% to 80%. This indicates that while the regularization term somewhat facilitates transferring the backdoor to personalized models, it is not entirely sufficient. To further validate this, investigate the impact of removing the regularization term, which leads to a significant decrease in ASRs for personalized models, dropping to just 10%. Finally, we assess the gradients of the global model parameters in the presence
3

---

Published as a conference paper at ICLR 2025
of trigee--embedded data. By weighting the regularization term based on the gradient magnitudes, the ASRs for personalized models rebound to levels close to the ASRs for the global model.
In partial model-sharing methods, non-shared parameters obstruct the backdoor effect, making it difficult for the backdoor to influence the decision-making process of personalized models, We evaluate the robustness of two partial model-sharing methods, FedBN (Li et al., 2021b) and FedRep (Collins et al., 2021), against the two attacks mentioned above. Appendix B.1 reports the ASRs with three configurations. The first configuration purely applies three backdoor attack methods to both FedBN and FedRep. The second configuration fixes the shared parameters and fine- tunes only the non-shared parameters on the Bigger-embedeee data ((x + T(z), yc)) and clean data for one epoch (15 steps). In this configuration, the ASRs recover to nearly 100%. as the non-shared parameters adjust to accommodate the backdoor. To exclude the possibility that the non-shared parameters are embedded with the backdoor during fine-tuning, we introduce third configuration without any backdoor attacks. This guarantees that the trained personalized models remain free of backdoors. We fine-tune these clean models similarly to the second configuration and see that the ASRs for both FedBN and FedRep stay around 10%. This demonstrates that while the backdoor is indeed embedded within the shared parameters, the non-shared parameters do not adapt to the backdoor, thereby limiting the backdoor's ' effectiveness against partial model-sharing methods.
During the training process, the backdoor could be progressively diluted. There are two primary scenarios where this dilution occurs. 1) If compromised clients are picked by the server with a long gap, the backdoor within the global model may be gradually erased due to updates from benign models. This can further affect the embedding of the backdoor into personalized models. Notably, this scenario arises only in the non-IID setting. In the IID setting, the backdoored model from a compromised client can also be well-fitted to data from other clients. As a result, even if benign clients train the backdoored model locally, its parameters remain largely unchanged. Once the server replaces the global model with the backdoored one, the backdoor will persist (Bagdasaryan et al., 2020). 2) After the completion of FI., clients may further fine-tune their personalized models using local datasets (Chen et al., 2022). This fine-tuning can reduce the backdoor's is effectiveness, as the local data of benign clients does not contain the backdoor's 's triggers and thus could help to overwrite the embedded backdoor. Appendix B.1 validates these, demonstrating that in the non-IID setting, as the expected time for selecting malicious clients increases, the ASR for the global model declines. In IID settings, this decline is less pronounced. Similarly, when clients fine-tun their personalized models with clean data, the ASRs for these personalized models also gradually decrease.
While we identify several measures that could potentially circumvent the robustness of PFL against backdoor attacks, these measures are often impractical. They require the adversary to manipulate the local training process of benign clients, such as using weighted regularization or contaminating their local datasets. Therefore, it is necessary to explore whether a practical federated backdoor attack method exists that can overcome these challenges.
Motivation.
OUR ATTACK: Bad-PFL
3.1 THREAT MODEL
Adversary's objective. We consider a practical attack scenario where the adversary compromises several clients to inject a backdoor into personalized models. The adversary expects these models to exhibit predetermined misclassification behavior for trigger-containing data while performing well on clean data. Moreover, the adversary desires that the embedded backdoors within these models are hard to detect or remove,
ensure the backdoors' stealthiness and longevity.
Adversary's knowledge and capability. The adversary has complete control over the compromised clients. This scenario is quite realistic, each client has full sovereignty over their local training process and external entities cannot scrutinize their actions. Any client may launch a backdoor attack for personal gain or collaborate with others execute one. Besides, to maintain the general applicability of Bad-PFL, the adversary lacks the ability to control the server's 's privileges (c.g., aggregation rule and client selection) or interfere with the training processes of benign clients.
4

---

Published as a conference paper at ICLR 2025
Algorithm 1: PFL. process with Bad-PFI.
Server Executes:
Initialize the parameters of the global model 0g: while the global model is not converged do
Broadcast the parameters 0g selected clients for local training (ClientUpdate):
Aggregate the parameters uploaded by selected clients to form a new global model;
end ClientUpdate:
this client is compromised then
Download Ioe from the adversary and train based on Equation 7;
10
Return trained 9w to the adversary:
11
Train [-; on its private dataset based on Equation 4;
12
else
Train ((;:0g) on its private dataset based on Equation with a = 0
13
14
end
15
Train the personalized model with the predefined PFL method
16
Return the new 0g to the server
Target
Disruptive Noise
tb
Citent
Client
many Reslife 6.,
dlokis Medes
Gloval Moaaal
Fruin yenerutive mouie
ming Eeegt (LC (:9g).)))
Ancol
Local Datia
Figure 1: The overview of Bad- The right is the trigger generation function of Bad-PFL. When compromised client is selected, it first trains the generator, and then uses this function to add triggers to the clean data for training its local model. Following this, the client trains its personalized model and uploads the backdoored local model.
3.2 Bad-PFL.
Overview. As illustrated in Figure and Algorithm 1, the attack process of Bad-PFL is similar to that conventional federated backdoor attacks (Zhang et al., 2022; Zhuang et al., 2024). When the server selects compromised client, the client optimizes Equation 4 and uploads the backdoored model to the server for aggregation. The key distinction of Bad-PFL. lies in its trigger generation function T, which combines target features with disruptive noise create the trigger. We begin by presenting the intuition behind our trigger generation function.
Intuition. The core idea is utilize the features of the target label as the trigger. Many clients' datasets contain samples of the target label, which can cause benign clients' personalized models to inadvertently learn the relationship between these features and the target label, stealthily embedding the backdoor into their personalized models. Even if some clients have datasets with few or no samples of the target label, the global model is likely learn this relationship and then transmit to personalized models. In contrast, existing backdoor attacks (Xie et al., 2020; Liu et al., 2024; Zhuang et al., 2024) rely on manually crafted features as triggers, which often do not exist natural data. As demonstrated in Section 2, the backdoors associated with manually crafted triggers often difficult to implant into personalized models.
Trigger generation function. Our trigger generation function consists of two key steps. The goal of the first step is to generate natural features associated with the target label yt- Since these features mimic the patterns of the target label, the model will mistakenly believe that the data with these features belongs to the target label. However, these features 8 may not completely dominate the input's s characteristics, allowing for potential correct classification into the ground-truth label. To
5

---

Published as a conference paper at ICLR 2025
handle this, the second step aims to design noise { that disrupts the features associated with ground- truth label y. By introducing this disruptive noise Ç, the model will rely more on for prediction as the features associated with ground-truth -ttuh labels are corrupted. To summarize, our trigger generation function is defined as Txx) = x + + & where 5 + serves as the trigger for x.
Generate target feature 8. The primary challenge here lies in identifying the natural features of the target label. To this end, we can initialize a random noise 5 and solve the following optimization task uncover the target label's features:
8 arg min Di [C(F(x + 6g ve)l , s.t., ||01 S,
(5)
where C is the set of indices for all compromised clients. Since the resulting d increases the prob- ability that the model classifies any data as the target label, it can be viewed the features of the target label learned by the model. Moreover, the constraint ||ō||>0 S is employed to regulate the influence of ó on the semantic content of z. Without this constraint, the solution to Equation 5 could become overly conspicuous, potentially obscuring the original semantic information x. However, fixed 8 may limit attack effectiveness and make Bad-PFL more detectable. Therefore, instead of seeking a static 5, we desire to create a dynamic trigger that can adapt to different input samples. This adaptability not only enhances RFd-s stealthiness but also enables the trigger to exploit specific characteristics of each sample, thereby improving attack performance. In practice, we em- ploy generative network parameterized by w, denoted as 9w. which takes x as input and produces noise of the same shape as æ. To control the output intensity of Gw. we use tanh(-) -) as the activation function of the final layer, scaling the output of Gue by multiplying it with e satisfy the constraint in Equation 5. Formally, we have 5 = c (z).
Craft disruptive noise. the second step, Bad-PFL generates sample-speciff disruptive noise g for x, which is achieved by solving the following optimization problem:
{ = arg max [[F((x + {;0g), v)), s.t., 11E1lso Sa.
(6)
&
Equation 6 seeks to identify a noise pattern that maximizes the loss function when added to x. To illustrate, think of it as introducing a layer of distortion to an image. Just as distortion can obscure the original image, the noise & complicates the model's ability to accurately discern the ground-truth characteristics of x. We approximately solve Equation 6 by setting & to a sign(V, (a;; 0g). v)), where sign(-) (-) is an alement-wise operation that returns the sign of the inputs.
The ultimate local training process of compromised clients. The parameters w in the generative model need to be optimized to fit the global model. As shown Algorithm 1, whenever a com- promised client is selected, it first optimizes the generative network to produce 5 that aligns with features of target category yi learned by the global model:
min ((ww))D,,iec [f( + (x)): w
E(a.y)-D,,ic [C(F(x e Gw (x) + a
The compromised client resolves Equation 4 to strengthen the global model's capacity to recognize and respond to the trigger. It subsequently trains its personalized model and finally uploads its local backdoored model to the server. For the sake of brevity. we place the explanation of how Bad-PFL addresses the three issues mentioned Section 2.2 to Appendix D.
4 EMPIRICAL EVALUATION
4.1 SETUP
Datasets and models. We evaluate on three benchmark datasets: SVHN CIFAR-10, and CIFAR- 100, using ResNet10 as the default model. Appendix B.2 examines the effectiveness of Bad-PFL across varying model sizes (ResNet18, ResNet34) and architectures (MobileNet, DenseNet).
FL settings. Following existing studies (Zhuang al., 2024), set 100 clients and 1000 training rounds, with 10 clients being compromised. During each training round, 10% of clients are ran- domly selected. To simulate non-III setting, we Dirichlet distribution with factor of 0.5

---

Published as a conference paper at ICLR 2025
for data sampling. Each client trains their local and personalized models using SGD with learning rate of 0.1 and a batch size of 32 for 15 steps (roughly one epoch).
PEL methods and baseline attacks. We adopt seven mainstream PFL methods to evaluate the per- formance of our attack, including FedProx (Li ct al., 2020), SCAFFOLD (Karimireddy et al., 2020), Ditto (Li et al., 2021a), FedBN (Li al., 2021b), FedRep (Collins et al., 2021), FedPAC (Xu al., 2023). To facilitate comparative study, we include six state-of-the al., 2020), FCBA (Liu al., 2024), ModRep (Bagdasaryan et al., 2020), PGD-Bkd (Wang al., 2020a), Neurotoxin (Zhang et al., 2022), and LF-Attack (Zhuang et al., 2024).
backdoor attacks: DBA (Xie
Defenses. We apply various backdoor defenses, including ClipAvg (Wang al., 2020b), Multi- Krum (Blanchard et al., 2017), Median (Fang et al., 2020), Sign (Guo et al., 2023), NAD (Li et al., 2021c), I-BAU (Zeng et al., 2022), and Fine-tuning (FT) (Chen et al., 2022).
Metries. We report average accuracy (Acc, %) over clean samples and attack success rate (ASR, %) over triggered samples for clients' personalized models on their test sets.
Others. All attacks use a poisoning rate of 0.2. See Appendix A for hyperparameters of PFL methods, baseline attacks, defenses, and specifics of our generative network. Appendix discusses the attack cost of Bad-PFI. For Bad-PFI,, we adpot utilize the Adam optimizer with a learning rate of 0.01 train generative network for 30 steps. The target label Ut is randomly generated. Appendix A provides examples of the non-lll) partitioning, while Appendix B.2 shows the convergence curves of Bad-PFL, the impact of e and a on attack performance, visualizations of the triggers, and discussion on the attack costs. The source codes can be found in supplementary material and will be released upon the acceprance of this paper.
255 The compromised clients
4.2 THE ATTACK PERFORMANCE IN PFL
Table I: Attack performance comparison of various schemes over CIFARIO. We bold the best result and underline the runner-up.
FedAvg
SCAFFOLD
FedProx
Ditto
FedBN
FedRep
FedPAC
Attack
Acc
ASR
Acc
ASR
Acc
ASR
Acc
ASR
Acc
ASR
Acc
ASR
Acc
ASR
ModRep
68.00
63.81
79.04
54.4]
76.37
37.58
77.42
70.04
81.91
27.52
79.99
23.38
82.49
38.21
Neurotoxin
79.75
80.53
80.09
79.48
76.85
71.30
78.76
69.00
81.11
59.48
79.83
28.41
81.33
82,10
PGD-BLd
79.27
78.61
78.95
94.19
77.04
74.54
78.72
72.23
81.21
54.81
79.77
20.25
81.54
63.45
DBA
78.97
92.41
79.11
94.85
77.47
83.59
79.70
76.45
80.36
31.33
79.80
15.54
82.46
18.23
FCBA
78.92
97.33
77.82
99.94
77.24
83. 89
78.11
79.20
80.54
37.88
81.00
16.91
83.06
19.91
LF-Attack
79.85
95.90
78.86
95.
76.82
85,46
78.20
78.94
81.09
44.55
80.90
12.82
83.25
15.82
Bad-PFL
79.28
99.88
78.95
99.80
77.36
99.68
78.88
94.12
80.72
82.22
80.29
97.95
82.67
99.10
FedBN: Ace and ASR
FedRep: Ace and ASR
100
85
100
ASR (%)
ASR (%)
50
80
50
Acc
ASR Namrotoiin
ASR Chrs
- A F-Attack
Nearstasin Li-Altek
- 1.FAAttsc
ASR LF Atack
- Acc Neurotoxin
- Auc Ours
70
10
15
20
Number of Compromised Clients
Number of Compromised Clients
Figure 2: Preformance comparison of varying compromised client numbers for FedBN and FedRep.
Table reports the performance of seven backdoor attack methods across seven PFL methods on CIFAR-10. 10. Due to space constraints and the similarity of results obtained from SVHN and CIFAR- 100, we leave those experimental results in Appendix B.2. As shown Table all attack-PFI. combinations achieve comparable accuracy across personalized models. This indicates that the at- tack methods employed are stealthy, leading us to focus primarily on analyzing ASRs. Notably, we observe significant fluctuations in the baseline attacks when applied to different PFL methods, particularly those partial model-sharing methods, including FedBN, FedRep, and FedPAC. In these cases, the baseline attacks often hard to inject backdoors into personalized models, evidenced by low ASRs. In contrast, Bad-PFL demonstrates much more consistent and superior performance, achieving an impressive ASR of at least 80% across all cases.
7

---

Published as a conference paper at ICLR 2025
Table 2: Performance comparison of various backdoor attacks against robust aggregation defenses
in CIFAR-IO. We bold the best result for FedBN and FedRep settings, respectively.
ClipAvg
Multi-Krum
Median
Sign
Attack
PFL
Acc
ASR
Acc
ASR
Acc
ASR
Acc
ASR
ModRep
75.07
24.21
66.66
17.43
75.56
19.08
31.91
14.72
Neurotoxin
83.19
54.93
63.59
38.97
71.76
53.82
31.93
20.03
PGD-Bkd
82.76
94.34
65.61
73.47
73.68
64.01
31.33
14.94
DBA
FedBN
83.66
30.90
67.93
28.42
72.68
30.55
32.04
12.22
FCBA
82.64
37.52
67.06
34.54
74.79
34.95
31.74
15.01
I.FAttack
82.62
43.60
66.38
22.90
73.38
29.10
30,92
17.10
Bad-PFL
82.55
82.66
66,93
80.28
74.44
50.52
31.42
24.13
ModRep
77.17
20.59
68,95
17.32
69 69.99
12.14
33.29
15.18
Neurotoxin
78.42
20.40
66.14
27.18
72.14
23.41
35.60
19.15
PGD-Bkd
80.32
17.59
72.45
18.45
68.58
16.64
36.79
10.90
DBA
FedRep
78.98
14,80
71.19
15.26
69.66
12.97
37.72
12.32
FCBA
82.72
16.08
71.37
16.17
71.22
13.08
32.89
13.17
LF-Attack
81.99
11.96
70.93
12.65
70.96
12.06
34.03
12.54
Bad-PFL
81.59
97.28
70.41
96.15
70.23
77.21
34.49
20.32
FedBN: Ace
FedRep: Ace and ASR
100
85
100
85
ASR (%)
ASR (%)
50
50
Acc
ASR Neumoooii
ASR Ours
- Acc LF Atack
Neurotoiin
Ace
ASR L.-AAlack
+
Auc Naunnosin -0- Auc Ours
ASR LI Amack -0- Acc Neurotonin -Bh Acc Ours
70
15
45
30 Local Steps
Local Steps
Figure 3: Preformance comparison from different local steps for both FedBN and FedRep.
Table Backdoor persistence comparison of various attacks over CIFARIO. We bold the best result.
FT-15, FT-30, FT-45 denote Fine-tuning with 15, 30, and 45 steps respectively. We bold the best result for FedBN and FedRep settings, respectively.
Before
NAD
[-BAU
FT-15
FT-30
FT-45
Attack
PFL
Acc
ASR
Acc
ASR
Acc
ASR
Acc
ASR
Ace
ASR
Acc
ASR
Neumtoxin
75.97
79.26
82.59
82.79
32.07
18.35
LI-Attack
FedBN
81.09
44.55
76.69
39.83
79.75
25.76
81.86
32.30
82.01
25.45
82.27
18.69
Bod-PFL
80.72
82.22
76.75
76.24
77.78
75.15
81.79
81.12
82.04
80.49
82.21
80.12
Neurotoxin
79.83
28.41
74.95
25.86
78.71
12.36
80.75
22.03
81.09
17.15
81.27
16.24
LF-Attakk
FedRep
80.90
12.82
75.74
11.91
78.65
11.52
81.33
12.58
81.82
12.35
11.82
Bad-PFL.
80.29
97.95
76.33
86.25
79.58
76.58
80.67
97.31
80.79
97.76
81.10
97.01
4.3 THE ATTACK PERFORMANCE AGAINST STATE-OF-THE- DEFENSES
Section 4.2 primarily focuses on the FedAvg aggregator, where each client's contribution is treated equally during aggregation. Several robust aggregation methods have been proposed to identify and downweight or eliminate the influence of compromised clients in aggregation. However, is stressed that the local models of different clients are inherently different in the non-IID setting, which can lead to incorrect identification and degrade Ace. Here, we specifically examine FedBN and FedRep, they demonstrate the best defensive performance in Section 4.2. Table 2 presents the attack results against robust aggregation methods. As can be seen, ClipAvg maintains accuracy better than others, but it can only defend against simpler backdoor attack methods, such as ModRep. Its defense performance Bkd. Furthermore, Sign effectively counter almost all attack methods; however, the gradient quantization makes the model challenging to train. Among the four defense methods, Median per- forms the best, successfully mitigating most backdoor attacks while maintaining accuracy in most cases. Nonetheless, even with Median, the ASRs of Bad-PP remain high at 50.52% and 77.21% %, highlighting the significant attack effectiveness of Bad-PFL.
limited against more sophisticated attacks like Neurotoxin and PGD-
4.4 BACKDOOR PERSISTENCE
The persistence of embedded backdoors can be examined from two angles: first, by reducing the number of compromised clients in FI., which extends the expected time for compromised client to
8

---

Published as a conference paper at ICLR 2025
FedBN:
Red Ace and ASR
100
85
100
85
ASR (%e
ASR (%)
50
30
Naurokunin
Neurotosin
ASR
-A- Atack
ASR L.-Amick
-0- Acc Neurctotin -Bh Ace Ours
70
LF-Antak
Ours
70
0.1
0.2
0.3
0,4
0.5
0.1
0.2
0.3
0.4
0.5
Poisoning Rate
Poisoning Rate
Figure 4: Preformance comparison under varying poisoning rates for FedBN and FedRep
FedBN: Ace and ASR
FedRep: and ASR
100
90
100
90
ASR (56)
ASR
30
80g
50
80
Acc
Nauretosin ASR Atnck
Nourotoxin L.F-Atteck
Acc Neurototin
-O- Acc Ours
60
Naumttoii
Qurs
60
0.05
0.1
0.5
0.05
0.1
0.5
5
Data Homogeneity
Data Homogeneity
Figure 5: Attack performance comparison with varying data heterogeneity degree.
be selected; and second, by allowing clients to fine-tuning or backdoor removal methods after the FL process is completed. Figure and Table 3 present the corresponding results.
Overall, as the number of compromised clients increases, it becomes easier to insert backdoors into personalized models. Notably, when there only one compromised client, the server is expected to select the compromised client once every ten rounds. At this point, observe that both Neurotoxin and LF-Attack yield low ASRs while Bad-PFL. can achieve a remarkable 94.01 % ASR. Additionally, find that as the number of compromised clients increases, the Acc tends decline. This is reasonable, as a higher number of compromised clients indicates a lower proportion of clean data.
We include three client-side backdoor defenses: NAD, I-BAU, and FT. As can be observed in Table 3, these defense methods provide some mitigation; however, they struggle to effectively erase back- doors, especially against Bad-PFL, which maintains ASRs of over 70%. In fact, all three defenses involve fine-tuning the model on natural data. However, the backdoor embedded by Bad-PFL arises naturally from natural data, making the backdoor inherently durable when trained in natural data and difficult to remove using these techniques.
4.5 SENSITIVITY ANALYSIS AND ABLATION STUDY
We here examine the contribution of å and attack performance, the local steps of clients, the degree of data heterogeneity among clients, and the poisoning rate of compromised clients.
The contribution of 5 and Ç. Table 4 shows the impact of different components of our trig- ger attack performance. It is observed that removing the target feature leads to a signif- icant drop in attack performance, as æ + E longer contains features about the target class. When we remove &, there is decline attack performance, which can be attributed to the fact that æ + 5 still retains features of the ground-trus label, allowing it to potentially be classified into the corresponding ground-truth label category. Refer to Appendix E for more detailed exploration of the relationship between 8 and E.
Table 4: Ablation study of and E.
FedBN
FedRep
Component
Acc
ASR
Acc
ASR
w/o d
80.78
13.74
80.17
12.82
w/o & Both
80.56
68.56
80.20
79.32
80.72
82.22
80.29
97.95
The impact of local steps. Figure 3 illustrates the performance of various attack methods across different local steps of clients. Apart from Bad-PFL, which consistently outperforms the two base- line methods, the overall trend is that as local steps increase, ASR gradually rise while Acc declines. As the number of local steps increases, the client models begin to overfit their local datasets, lead- ing to decrease in generalization performance. The slight increase in attack performance is likely due to the backdoor becoming more deeply ingrained the local model after more training steps. Consequently, both the global model and personalized models become further compromised.

---

Published as a conference paper at ICLR 2025
The impact of poisoning rate. Figure 4 shows the performance of different attack methods at varying poisoning rates for FedBN and FedRep. A higher poisoning rate tends to optimize the backdoor task at the expense of the main task, ultimately resulting in a higher ASR and lower Acc. The results in Figure 4 validate this.
The degree of data heterogeneity. The degree of data heterogeneity among clients can be con- trolled by the parameters of Dirichlet distribution, where lower values represent higher heterogene- ity. Figure 5 presents the attack performance of various methods under different levels of data heterogeneity. Appendix A provides examples of the distribution of client heterogeneity at different parameters. Generally, as heterogeneity decreases, the solutions of different client models tend to be the same, As expected, in Figure 5, with increasing IID levels, both accuracy and ASR improve.
RELATED WORK
Personalized federated learning. PFL methods can be divided into full model-sharing and partial mooee-shhrrnng methods. FedProx (Li et al., 2020) introduces a proximal term to the local training objective to manage the distance between the local and the global model. SCAFFOLD (Karimireddy et al., 2020) uses control variables to calibrate the updates of the local model. Fine-tuning (Chen et al., 2022) is sometimes also considered a technique for full model sharing. Ditto (Li et al., 2021a) adds a regularization term that encourages the personalized model to remain close to the global model. Partial model sharing involves decoupling the personalized model parameters into shared and private ones, with the shared ones submitted to the server for aggregation. FedBN (Li et al., 2021b) privatizes the batch normalization layers, while the remaining layers are updated according to FedAvg protocol. FedRep (Collins et al., 2021) shares the feature extraction layers while keeping the classification head private to fit local datasets. FedPAC (Xu al., 2023) suggests weighting the private classification heads from various clients to form the final classifier. In addition, Scott al. (2024) proposed training a hypernet that can customize model based on the characteristies of each client. Moreover, some studies (Scott et al., 2024) proposed hypernet-based methods, where a hypernet trained produce model based on each client's characteristics.
Federated backdoor attack and defenses. Federated backdoor attacks are often executed by hav- ing compromised clients upload local backdoored models, with variations arising in how these mod- els are constructed. ModRep (Bagdasaryan et al., 2020) amplifies the parameters of the backdoored model, enabling to dominate the aggregation process. DBA (Xie et al., 2020) splits a global trigger into multiple sub-triggers, with each compromised client holding one of these sub-triggers. PGD- Bkd (Wang et al., 2020a) restricts the parameter changes of the backdoored model to evade robust aggregation methods and detection methods. Neurotoxin (Zhang et al., 2022) embeds backdoors within parameters that have smaller update magnitudes, increasing the persistence of the backdoor. LF-Attack (Zhuang al., 2024) focuses backdoor-critical layers to enhance attack effectiveness. Iba (Nguyen et al., 2024) uses generators to produce triggers, while Perdoor (Alam et al., 2022) crafts triggers tailored to specific neurons. Although some studies (Lai al., 2022; Lyu et al., 2024) explored backdoor attacks against PFL methods, these tend to focus too narrowly on specific PFL methods or are easily countered by common defense mechanisms. For instance, PFedBA (Lyu et al., 2024) employs fixed trigger patterns, making them detectable. To counter such attacks, robust aggregation methods can be utilized, and clients can also perform backdoor elimination after FL. concludes. Common methods for the former include median (Fang et al., 2020), Krum (Blanchard et al., 2017), etc. For elimination, most studies (Li et al., 2021c; Zeng et al., 2022; Chen et al., 2022) suggested diminishing the influence of less significant parameters on the model.
6 CONCLUSION
In this study, we identified three key factors that contribute to the failure of existing backdoor attacks in PFL methods. We developed Bad-PFL to address these issues by employing natural features as our trigger instead of manually designed ones. Models trained natural data inherently learn the relationship between our trigger and the target label, implicitly embedding the backdoor within them. Our extensive experiments demonstrated the superior performance of Bad-PFL against mainstream attacks for PFL methods. We hope this study can correct the misconception among PFL community that existing PFL methods are immune backdoor attacks.
10

---

Published as a conference paper at ICLR 2025
7 ETHICS STATEMENT
This paper presents an attack method that undermines the trustworthiness of federated learning. Although this attack method may seem harmful, we strongly believe that the benefits of publishing this paper outweigh the drawbacks. Specifically, this attack method can motivate researchers to explore more effective defense strategies, serve as an assessment tool for testing the trustworthiness of federated learning, and raise awareness of potential threats faced by users implementing federated learning in real- world scenarios.
REPRODUCIBILITY
The source codes are available in httpp://githui. httgg//hww....o///////////aaaaaa
ACKNOWLEDGMENTS
This work supported by the National Natural Science Foundation of China under grant number 62202170.
REFERENCES
Manaar Alam, Esha Sarkar, and Michail Maniatakos. Perdoor: Persistent non-uniform backdoors in federated learning using adversarial perturbations. arXiv preprint urXiv:2205.1352. 2022.
Eugene Bagdasaryan, Andreas Veit, Yiqing Hua, Deborah Estrin, and Vitaly Shmatikov. How to backdoor federated learning. In International conference on artificial intelligence and statistics, pp. 2938-2948 PMLR, 2020.
Peva Blanchard, EI Mahdi EI Mhamdi, Rachid Guerraoui, and Julien Stainer. Machine learning with adversaries: Byzantine tolerant gradient descent. Advances in neural information processing systems, 30, 2017.
Daoyuan Chen, Dawei Gao, Weirui Kuang, Yaliang Li, and Bolin Ding, pfl-bench: A comprehen- sive benchmark for personalized federated learning, Advances in Neural Information Processing Systems, 35:9344-9533 9360, 2022.
Liam Collins, Hamed Hassani, Aryan Mokhtari, and Sanjay Shakkottai. Exploiting shared repre- sentations for personalized federated learning. In International conference machine learning, pp. 2089-2099 PMLR, 2021.
Mingyuan Fan, Cen Chen, Chengyu Wang, and Jun Huang. On the trustworthiness. landscape of state-of-the-art generative models: A comprehensive survey. arXiv preprint urXiv:2307. 16680, 2023.
Minghong Fang, Xiaoyu Cao, Jinyuan Jia, and Neil Gong. Local model poisoning attacks to
(Byzantine-Robuut Robust) federated learning. In 29th USENIX security symposium (USENIX Security 20). pp. 1605-1622, 2020.
Zhenyuan Guo, Lei Xu, and Liehuang Zhu. Fedsign: A sign-based federated learning framework with privacy and robustness guarantees. Computers & Security, 135:103474, 2023.
Siquan Huang, Yijiang Li, Chong Chen, Leyu Shi, and Ying Gao. Multi-metrics adaptively identifies backdoors in federated learning. In Proceedings of the IEEE/CVF International Conference on 2023.
Computer Vision, pp.
Sai Praneeth Karimireddy, Satyen Kale, Mehryar Mohri, Sashank Reddi, Sebastian Stich, and Ananda Theertha Suresh. Scaffold: Stochastic controlled averaging for federated learning. In International conference machine learning, pp. 5132-5143. PMLR, 2020.
Phung Lai, NhatHai Phan, Abdallah Khreishah, Issa Khalil, and Xintao Wu. Model transferring attacks to backdoor hypernetwork in personalized federated learning. CoRR, abs/2201 107063, 2022. URL htttt:://///tiiiii wrw.liioorrr/ooo org/ /200 .

---

Published as a conference paper at ICLR 2025
Tian Li, Anit Kumar Sahu, Manzil Zaheer, Maziar Sanjabi, Ameet Talwalkar, and Virginia Smith. Federated optimization in heterogeneous networks. Proceedings of Machine learning and sys- tems, 2:429 450, 2020.
Tian Li, Shengyuan Hu, Ahmad Beirami, and Virginia Smith. Ditto: Fair and robust federated learning through personalization. In International conference on machine learning, pp. 6357- 6368. PMLR, 2021a.
Xiaoxiao Li, Meirui Jiang, Xiaofei Zhang, Michael Kamp, and Qi Dou. Fedbn: Federated learning on non-iid features via local batch normalization. In 9th International Conference on Learning Representations, ICLR 2021, Virtual Event, Austria, May 3-7, 2021. OpenReview.net, 2021b. URL
net tiee/foor forum? id= GYEQUNOQICG,
Yige Li, Xixiang Lyu, Nodens Koren, Lingjuan Lyu, Bo Li, and Xingjun Ma. Neural attention distil- lation: Erasing backdoor triggers from deep neural networks. In 9th International Conference on Learning Representations, ICLR 2021, Virtual Event, Austria, May 3-7, 2021. OpenReview.net, 2021c. URL https: http://pppppeeiveeeeee net/ Eorum? 1d= 9100900--0M0 oXE.
Tao Liu, Yuhang Zhang. Zhu Feng, Zhiqin Yang. Chen Xu, Dapeng Man, and Wu Yang. Beyond traditional threats: A persistent backdoor attack on federated learning. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 38, pp. 21359 213677, 2024.
Yang Liu, Mingyuan Fan, Cen Chen, Ximeng Liu, Zhuo Ma, Li Wang, and Jianfeng Ma. Back- door defense with machine unlearning. In IEEE INFOCOM 2022-IEFE conference on computer communications, pp. 280 289. IEEE, 2022.
Xiaoting Lyu, Yufei Han, Wei Wang. Jingkai Liu, Yongsheng Zhu, Guangquan Xu, Jiqiang Liu, and Xiangliang Zhang. Lurking in the shadows: Unveiling stealthy backdoor attacks against personalized federated learning. In 33rd USENIX Security Symposium (USENIX Secu- rity 24), pp. 4157-4174, Philadelphia, PA, August 2024. USENIX Association. ISBN 978-1- 939.33-44-1, URL https:: http///.wseeeeee usenix. org/ www.///eweeeeeeeeeeeeeeerrreeeee presentation/1y /1yu
Brendan McMahan, Eider Moore, Daniel Ramage, Seth Hampson, and Blaise Agüera y Arcas. Communication-cfficcee learning of deep networks from decentralized data. In Aarti Singh and Xiaojin (Jerry) Zhu (eds.), Proceedings of the 20th International Conference on Artificial Intelligence and Statistics, AISTATS 2017, 20-22 April 2017, Fort Lauderdale, FL, USA, vol- ume 54 of Proceedings of Machine Learning Research, pp. 1273-1282. PMLR, 2017. URL http:/ / /ttp:///pcceeiieesseemee www.m.rrreeess.ee... press / v54/ mcmahan 7 html.
Thuy Dung Nguyen, Tuan A Nguyen, Anh Tran, Khoa D Doan, and Kok-Seng Wong. Iba: Towards irreversible backdoor attacks in federated learning. Advances in Neural Information Processing Systems, 36, 2024.
Zeyu Qin, Liuyi Yao, Daoyuan Chen, Yaliang Li. Bolin Ding, and Minhao Cheng. Revisiting personalized federated learning: Robustness against backdoor attacks. In Ambuj K. Singh, Yizhou Sun, Leman Akoglu, Dimitrios Gunopulos, Xifeng Yan, Ravi Kumar, Fatma Ozcan, and Jieping the 29th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, KDD 2023, Long Beach, CA, USA, August 6- 10, 2023, pp. 4743 4755. ACM, 2023. doi: 3599898.
Ye (eds.), Proceedings the
01014//5555000555599999 URL https: / doi. org/ 10.
Jonathan Scott, Hossein Zakerinia, and Christoph H. Lampert. Pefll: Personalized federated learn- ing by learning to learn. In The Twelfth International Conference on Learning Representa- tions, ICLR 2024, Vienna, Austria, May 7-11, 2024. OpenReview.net, 2024. URL https: / /poenreview.
Canh T Dinh, Nguyen Tran, and Josh Nguyen. Personalized federated learning with moreau en- velopes. Advances in neural information processing systems, 33:21394-21405, 2020.
Hongyi Wang. Kartik Sreenivasan, Shashank Rajput, Harit Vishwakarma. Saurabh Agarwal, Jy- yong Sohn, Kangwook Lee, and Dimitris Papailiopoulos. Attack of the tails: Yes, you really can backdoor federated learning. Advances in Neural Information Processing Systems, 33:16070- 16084, 2020a.
12

---

Published as a conference paper at ICLR 2025
Hongyi Wang, Kartik Sreenivasan, Shashank Rajput, Harit Vishwakarma, Saurabh Agarwal, Jy- yong Sohn, Kangwook Lee, and Dimitris S. Papailiopoulos. Attack of the tails: Yes, you re- ally can backdoor federated learning. In Hugo Larochelle, Mare' Aurelio Ranzato, Raia Had- sell, Maria-Florina Balcan, and Hsuan-Tien Lin (eds.), Advances in Neural Information Process- ing Systems 33: Anmual Conference Neural Information Processing Systems 2020, NeurlPS 2020, December 6-12, 2020, virtual, 2020b. URL https: /tttaatttttptpteeeeeeeeeeeeeeeee httpppppoccen....eeeepp/o www.oceeeiinngnneuiiipp.eeee wwwrins.ecipcoo paper 2000r/2020/// hwwhhaahhhaaaaaaaeeeaaa www.bbffffaaaa (9w.ce4492fffaaooom fl 21e11333eeee 1eeeeee766260 762eb Abstract html.
Chulin Xie, Keli Huang, Pun-Yu Chen, and Bo Li. DBA: distributed backdoor attacks against fed- erated learning. In 8th International Conference on Learning Representations, ICLR 2020, Addis Ababa, Ethiopia, April 26-30, 2020. OpenReview.net, 2020. URL https::///// http::::////peeeeeee..
Jian Xu, Xinyi Tong, and Shao-Lun Huang. Personalized federated learning with feature alignment and classifier collaboration. In The Eleventh International Conference on Learning Represen- tations, ICLR 2023, Kigali, Rwanda, May 1-5, 2023. OpenReview.net, 2023. URL https: // //openreview net. forum? Ba
Mang Ye, Xiuwen Fang, Bo Du, Pong C. Yuen, and Dacheng Tao. Heterogeneouss federated learning: Slate-of-the-are and research challenges. ACM Comput. Surv, 56(3):79:1-79444, 2024a. doi: 10.1145/3625558 URL https: www.do...o..oooooooooooooooooooe 100..11155325555
Tiandi Ye, Cen Chen, Yinggui Wang, Xiang Li, and Ming Gao. Bapfl: You can backdoor personalized federated learning. ACM Trans. Knowl. Discov. Data, 18(7):166, 2024b. doi:
10.1145/3649316 URL httph:tt//// http:::///d...oo /tt////..rrr/.11111///33333/
Yi Zeng, Si Chen, Won Park, Zhuoqing Mao, Ming Jin, and Ruoxi Jia. Adversarial unlearning of backdoors via implicit hypergradient. In The Tenth International Conference on Learning Representations, ICLR 2022, Virtual Event, April 25-29, 2022. OpenReview.net, 2022. URL https:///ppesse ew net/ htt./oormmiii deemmiidddMeeeeeeee
Zhengming Zhang, Ashwinee Panda, Linyue Song, Yaoqing Yang, Michael Mahoney, Prateek Mit- tal, Ramchandran Kannan, and Joseph Gonzalez. Neurotoxin: Durable backdoors in federated learning. In International Conference on Machine Learning, pp. 26429-26446 PMLR, 2022.
Haomin Zhuang, Mingxian Yu, Hao Wang, Yang Hua, Jian Li, and Xu Yuan. Backdoor feder- ated learning by poisoning backdoor-critical layers. In The Twelfth International Conference on Learning Representations, ICLR 2024, Vienna, Austria, May 7-11, 2024. OpenReview.net, 2024. URL /tLLtttss////peeeeiiii net
tnee/forrue ffoumm (imm=iii==ABSSTT
A
THE DETAILS HYPERPARAMETER ABOUT EXPERIMENT
The detailed hyperparameters of PFL methods and baseline attacks. For the PFL methods, use the same training configuration as that of the local models to train personalized models. Please refer to Section 4.1 for the training settings of the local models. For Ditto and FedProx, we set the regularization strength R to 0.1. DBA allows each compromised client to select a specific size of trigger and arranges these triggers systematically on the images. We the size of the triggers used by the compromised clients to 1 x 3, starting from the top left corner, with a gap of one pixel between each trigger. After filling five triggers per row, new row is started, maintaining the same one-pixel gap. FCBA is an improved version of DBA, and we set its hyperparameter ModRep first amplifies the differences between the parameters of the compromised clients' local backdoored models and the global model before uploading them. In this paper, this difference is amplified by a factor of 10. PGD-Attack constrains the norm of the parameter differences between the local and global models within specified value, which we set to 1. Neurotoxin primarily updates the parameters with the smallest update magnitudes. We choose to update the bottom 10% of parameters based their update magnitudes. For LF-Attack, we set to 0.95 to identify the backdoor-critical layers, and we set À to l.
to
The detailed hyperparameters of defenses. We detail the hyperparameters of defenses as follows:
13

---

Published as a conference paper at ICLR 2025
Table 5: The architecture of our generative model.
Conv2d + Natch + Relu
Conv2d BatchNorm22d + Relu
Encoder
Conv2d + BatchNorm2d Relu Relu
Conv2d + BatchNorm2d + Relu
Generator
Conv Transpose2d + BatchNorm2d + Relu
Conv TonnTraaspoo:2 BatchNorm2d Relu
Decoder
Conv' Transposd BatchNormm2 Relu
Conv'Trae Transposedd
BatchNorm2d + Tanh
ClipAvg builds upon FedAvg by incorporating a pruning operation on the model param- eters uploaded by clients, ensuring that the strength of each parameter does not exceed threshold t. We set to
The server calculates Krum distance known using models from the closest x C clients, where f is hyperparameter assumed to be equal compromised clients. In our setting, the expected number of compromised clients selected by the server in each training round is 1, we set 1. Subsequently, MultiKrum selects five clients with the highest distance scores to aggregate the global model.
greater than the number of
Median aggregates the model parameters uploaded by clients by taking the median value.
Sign first aggregates the models from the clients and then uses the sign of aggregated values to update the global model. We multiply the sign of aggregated values by 0.01 to update the global model.
The specific architecture of our generative model. Our generative model follows encoder- decoder architecture, as shown in Table 5. The encoder comprises four convolutional layers, each followed by batch normalization (BatchNorm2d) and Relu activation functions. Each convolu- tional layer doubles the depth, uses kernel size of 4, stride of 2, and padding of 1. The decoder replicates the encoder's 's structure using transpose convolutional layers, with the final layer employ- ing a tanh activation function.
Non-IID partition examples. To provide clearer understanding of the degree of non-IID dis- tribution, we present the label distribution of the local training datasets for clients using different parameters of the Dirichlet distribution. Due to page limitations, we only include label distri- bution for the local training datasets of the first 10 clients. We also report the empirical standard deviation the label distribution in the clients' local training datasets. Standard deviation indicates how much the numbers in a set spread out and thus facilitating a more intuitive understanding. A larger standard deviation indicates a higher level of data heterogeneity among the clients. Specific results be found in Tables to 10. The aver- age standard deviation for the clients is 103.21, 90,48, 60.88, 45.15, and 25.24, corresponding to Dirichlet distribution parameters of 0.05, 0.1, 0.5, and respectively. When using Dirichlet distribution with parameter of 0.5, many clients may have only 1 to 2 samples for certain labels. In contrast, when using a Dirichlet distribution with a parameter of 5, there is a small variation in the number of samples for each label among clients. When employing a Dirichlet distribution with a parameter of 0.05, the data for clients is primarily concentrated in one or two categories.
measure of data heterogeneity,
B SUPPLEMENTARY EXPERIMENT
B.1 EXPERIMENT ABOUT SECTION
We here provide experimental results mentioned in Section 2.2. Unless otherwise specified, the experimental configurations follow those outlined Section 4.1 and Appendix A.
In full model-sharing methods, the regularization term alone is inadequate for directly transfer- ring the backdoor from the global model to personalized models. Table 11 reports attack results. Here, G Model and P - M refer the global model and personalized models, respectively. R indicates the regularization term in Equation 2. GAvg. and PAvg. represent the averages of the data corresponding to the G-Model and P-Model, respectively. As analyzed in Section 2.2,
14

---

Published as conference paper at ICLR 2025
Table 6:
The number of samples for different labels in the local datasets of the first ten clients,
generated using Dirichlet distribution with parameter of 0.05.
Label
Airplane
Automobile
Bird
Cat
Deer
Dog
Frog
Horse
Ship
Truck
Sid.
Client 0
8
198
29
9
38
139
16
4
54
65.97
Client
313
6
6
8
157
104.26
Client
24
0
143.92
Client
13
0
0
82
20
55
13
309
0
94.89
Client 4
166
0
0
0
305
29
0
0
0
103.51
Client 5
0
0
10
2
3
71
414
0
0
129.76
Client 6
27
316
16
53
32
36
0
16
95.01
Client
3
20
46
128.01
Client
19
74
7
31
34
10
301
2
17
90.69
Client 9
15
9
254
20
28
97
24
18
27
76.09
Table 7: The number of samples for different labels in the local datasets of the first ten clients,
generated using Dirichlet distribution with parameter of 0.1.
Label
Airplane
Automobile
Bird
Cat
Deer
Dog
Frog
Horse
Ship
Truck
Std.
Chient 0
24
6
217
25
48
44
62
71
63.65
Client
0
46
59
15
44
0
333
3
102.01
Client
174
208
22
76.91
Client
I
15
22
0
117
223
73.87
Client
4
18
14
14
49
26
132
25
27
191
61.53
Client 5
0
0
10
0
442
43
2
3
0
138.37
Client 6
9
35
18
19
38
12
14
20
18
317
94.27
Client
0
388
5
120.99
Client
273
36
0
86.59
Client 2
132
266
60
7
24
0
86.58
The number of samples for different labels in the local datasets of the first ten clients, generated using Dirichlet distribution with a parameter of 0.5.
Table 8:
Label
Airplane
Automobile
Bird
Cat
Deer
Dog
Frog
Horse
Ship
Truck
Std.
Client 0
39
8
71
42
53
26
204
51
58.80
Client
20
11
3
42
98
5
258
22
33
78.26
Client
12
37
44
127
47
43.80
Client 3
41
292
22
14
10
50
2
17
41
86.49
Client 4
10
120
6
24
6
56
187
54
4
33
59.88
Client 5
37
64
25
216
8
88
3
22
36
1
64.42
Client 6
43
69
17
4
110
84
107
43.14
Client 7
4
186
225
6
33
83.51
Client 8
130
7
8
49
83
90
84
34
9
6
44.39
Client 9
2
1
86
85
19
130
25
34
101
17
46.14
Table 9: The number samples for different labels the local datasets of the first ten clients, generated using Dirichlet distribution with parameter of 1.
Label
Airplane
Automobile
Bird
Cat
Deer
Dog
Frog
Horse
Ship
Truck
Std.
Client
45
6
5
21
8
35
21
133
170
56.75
Client
18
33
32
40.06
Client 2
5
21
22
95
22
8
53
162
3
109
$4.23
Client 3
60
185
51
38
2
72
72
11
5
4
55.18
Client 4
51
17
80
60
6
22.1
26
28
65.24
Client
62
38
98
79
19
39.62
Client 6
36
82
33
63
17
28
60
69
56
20.50
Client 7
24
92
113
27
18
105
78
2
40
42,92
Client 8
131
40
12
21
90
54
47
58
45
37.95
Client.
84
38
66
21
106
40
10
110
18
7
39.02
the regularization term alone is insufficient for transferring the backdoor from the global model to personalized models unless the backdoor-critice parameters are weighted to compel personalized models to learn the backdoor.
15

---

Published as a conference paper at ICLR 2025
Table 10:
The number of samples for different labels in the local datasets of the first ten clients,
generated using Dirichlet distribution with parameter of 5.
Label
Airplane
Automobile
Bird
Cat
Deer
Dog
Frog
Horse
Ship
Truck
Std.
Chient 0
27
75
43
63
34
31
104
40
54
29
24.64
Client
137
31
66
28
66
13
40
34.77
Client 2
47
74
55
64
48
28
60
24
15.75
Client 3
26
51
27
21
38
78
37
111
38
73
28.75
Client 4
50
31
117
29
50
65
63
20
22
53
28.63
Client.5 5
45
52
47
45
35
113
36
39
73
26.52
Client
61
103
46
49
61
63
24.20
Client 7
22
55
41
36
55
68
19
94
57
58
22.16
Client 8
53
46
81
88
24
51
56
44
48
23.25
Client 73
35
87
26
29
68
27
25
64
23.73
Table 11: ASR(%) comparison between G-Model and P-Model under non-IIlD setting. G-model and
P-Model denote global model and personalized model, respectively.
FodProx
Ditto
PFedMe
Attack
Strategy
GAvg.
PAvg.
G-Model
P-Model
G-Model
P-Model
G-Model
P-Model
Vanilla
94.08
71.30
95.02
69.00
90.26
77.90
93.12
72.73
Neuroloxin
w.o R
92.38
13.99
95.49
10.20
90.12
10.86
92.66
11.68
Weighted R
92.11
90.50
95.70
93.20
91.33
89.07
93.05
90.92
Vanilla
93.36
74.54
92.46
72.23
93.24
80.23
93.02
75.67
PGD-Backdoor
w.o 90.99
10.45
92.10
10.63
92.45
11.63
91.85
10.90
Weighted
92.59
88.93
92.19
92.60
90.29
92.46
90.01
Table 12: ASR (%) comparison across backdoor attack configurations.
Attack
Strategy
FedBN
FedRep
Avg.
First Configuration
59.48
28.41
43.95
Neurotoxin
Second Configuration
96.89
98.72
97.81
Third Configuration
10.66
10.52
10.59
First Conliguration
54,81
20.25
37.53
DiD-Backdoor
Second Configuration
97.96
96.01
96.99
Third Configuration
10.06
11.07
10.57
Table 13: ASR (%) comparison over various models.
PFL Method
FedBN
FedRep
Number of comprimised clients
Neurotoxin
PGD Backdoor
Neurotoxin
PGD-Backdoor
68.41
84,81
75.31
76.86
77.24
90.64
77.81
79.75
84.63
92.51
88.70
88.40
87.99
92.56
91.42
90.85
92.14
93.95
95.29
95.20
95.99
94.75
98.31
98.41
In partial model-sharing methods, non-shared parameters hinder the backdoor effect, making challenging for the backdoor to influence the decision-making processes of personalized mod- els. Table 12 presents the attack performance of two backdoor attack methods under three different configurations for two partial model-sharing methods. The first configuration simply applies the backdoor attack methods to FedBN and FedRep. The second configuration fixes the shared param- eters and fine-tunes only the non soa-sh parameters on the trigger-entn embedded and clean data for one epoch (15 steps). The third configuration is similar to the second but trains the model solely on clean data. The experimental analysis has already been discussed in Section 2.2, so we will not repeat here.
During the training process, the backdoor may be progressively diluted. In Section 2.2, we pri- marily discuss two scenarios in which the backdoor be gradually removed. Here, validate the first scenario, which posits that compromised clients are selected by the server with a signifi- cant time gap, the backdoor may gradually be erased due updates from benign models. Table 13 reports the effectiveness various attack methods against FedBN and FedRep under the IID setting with varying numbers of compromised clients. Figure (Section 4.4) illustrates the effectiveness
16

---

Published as a conference paper at ICLR 2025
of different attack methods against FedBN and FedRep under the non-llD condition with varying numbers of compromised clients. For comparison, we observe that under the IID setting, the ASRs on FedBN-Neurotoxx pair are higher and more stable; for example, the ASR only decreases by about 20% when reducing the number of compromised clients from 10 to 1. In contrast, under the Nnon-III setting, the ASR drops by nearly 50%. This indicates that the backdoor is diluted under the non-IID condition. The second conclusion can be validated by the results (Table 3) in Section 4.4, When clients fine-tune the model on their own datasets (FT-15, FT-30, FT-45), the ASRs significantly decrease.
easily
B.2 EXPERIMENT ABOUT SECTION 4
In this section, unless explicitly stated otherwise, we follow the experimental configuration used in Section 4.2.
Table 14: Attack performance comparison over various models.
We bold the best result.
ResNetT(
ResNer18
ResNet34
MobileNetV2
DenseNet
Attack
PFL
Acc
ASR
Acc
ASR
Acc
ASR
Acc
ASR
Acc
ASR
Neurotoxin
81.11
59.48
81.35
60.64
82.63
63.97
70.36
36.54
77.60
43.91
LF-Attack
FedBN
81.09
44.55
81.21
45.22
82.24
50.48
70.95
29 54
78.22
32.58
Bad-PFL
80.72
82.22
80.98
86.85
82.07
90.12
70.10
75.17
77.39
79,98
Neurotoxin
79.83
28.41
80.00
45.22
70.22
76.46
23.22
LF-Attack
FedRep
80.90
12.82
81.02
13.58
81.23
15.94
90.65
11.95
77.60
13.96
Bad-PFL
80.29
97.95
80.52
98.54
80.76
99.30
70.03
84.21
76.34
94,22
B.2.1 THE ATTACK PERFORMANCE OF Bad-PFL OVER DIFFERENT MODEL SIZES AND ARCHITECTURES.
Table 14 reports the effectiveness of different attack methods against FedBN and FedRep ResNet10, ResNet18, ResNet34, MobileNetV2, and DenseNet. Overall, we observe that Bad-PFL achieves high effectiveness across all models while maintaining competitive Acc. Additionally, the order of model capacity from largest to smallest is ResNet34, ResNet18, ResNer10, DenseNet, and MobileNetV2. We find that larger models have more capacity for learning, resulting in higher Acc. However, increased model capacity also leaves more room for the implantation of backdoors, as indicated by the higher ASRs. This observation is consistent with conclusions drawn in existing literature.
Table 15: The performance of various backdoor attack methods in VIT. Here we employ FedRep.
Attack
Neurotoxin
LF-Attack
Bad-PFL
Acc 85.43
86.06
85.89
ASR
50.64
20.58
98.94
B.2.2 ATTACK PERFORMANCE IN TRANSFORMERS
To further validate the versatility Bad-PFL. across different model architectures, we evaluate Bad- PFL's performance against Vision Transformer (ViT). Specifically, we use ViT pre-trained on ImageNet (provided by Torch Vision) as the initialization for the server, with the classification head reinitialized to accommodate CIFAR-10. We employ FedRep for this evaluation. Table 15 reports the attack results various methods on VIT. Due to its pre- training, ViT achieves upproximately points higher accuracy compared to convolutional neural network architectures. Additionally, our method performs well on VIT, achieving an ASR of 98.94%.
B.2.3 THE EVALUATION RESULTS SVHN AND CIFAR-100
Tables 16 and 17 report the attack results different methods against various PFL methods on CIF and SVHN. In addition to the clear conclusion that Bad-PFL yields higher ASRs over baseline attacks, we have the following observation. We note that on SVHN, the different attack methods enjoy better attack results compared to CIFAR-10. We speculate that this is due SVHN being simpler dataset than CIFAR- 10. Similarly, CIFAR-100 can considered a fine- imee-gained version of CIFAR-10, which is more challenging. On CIFAR-100, observe lower Acc and ASR.
17

---

Published as a conference paper at ICLR 2025
Table 16: Attack performance comparison of various schemes over CIFARI0O. We bold the best result and underline the runner-up.
SCAFFOLD
FedProx
FedBN
FedRep
FedPAC
Attack
Acc
ASR
Acc
ASR
Acc
ASR
Acc
ASR
Acc
ASR
Acc
ASR
Mode--Rellacement
45.77
50.82
47.02
25.04
47,36
32.02
50.83
31.39
47.22
17.85
49.94
32.84
Neurotoxin
49,50
77.46
47.40
64.47
48.76
65.15
51.41
38.25
47.03
19.82
49.52
46.85
CGD-Backdoor
49.24
92.23
48.73
55.58
49.68
58.70
51.16
36.27
48.48
52.61
35.57
DBA
50,00
92.47
48.38
55.64
49.00
56,95
51.60
28.69
49.96
9.75
52.40
18.42
FCBA
49.62
99.98
49.83
59.99
50.53
60.30
51.06
45.73
49.33
11.39
52.33
19.99
LF-Attack
48.62
56.00
50.31
58.16
50.73
37.56
48.75
53.34
18.95
Bad-PFL
49.72
99.08
48.15
99.15
49.25
99.16
51.96
93,96
48.49
94.80
51.38
98.73
Table 17: Attack performance comparison of various schemes SVHN. We bold the best result and underline the runner-up.
SCAFFOLD
FedProx
Ditto
FedBN
FedRep
FedPAC
Attack
Acc
ASR
Acc
ASR
Acc
ASR
Acc
ASR
Acc
ASR
Acc
ASR
Model-Replacemennt
90.44
82.21
86.18
58.51
87.47
83.67
94.21
41.46
89.81
24.61
90.43
47,83
Neuratoxin
93.16
93.42
93.43
61.13
94.02
93.12
$7.05
PGD-Ba Backdoor
93,91
98.78
93.49
63.23
93.77
83,42
93.93
30.43
93.54
25.20
93.68
58.68
DBA
93.69
98.73
93.34
61.96
94.69
79.15
93.77
34.31
93.46
20.61
93.99
29.46
FCBA
93.77
99.54
93.50
64.00
93.87
94.08
45.06
93.49
21.06
94.12
30.00
LF-Attack
93.72
97.16
93.04
77.41
94.00
85.24
93.80
38.38
92.91
20.64
93.06
29.03
Bad-PFL
93.00
98.89
92.64
96.88
93.43
98.88
94.20
99.52
93.77
97.39
94.37
97.46
B.2.4 THE IMPACT THE MAGNITUDE AND & ATTACK PERFORMANCE Bad-PFL
Table 18 reports the ASRs of Bad-PFL when either 5 & is fixed while varying the magnitude of the other. We observe that Bad-PFL is more sensitive to changes in (the magnitude of 8), 8 represents the features of the target class. In contrast, Bad-PFL is relatively less sensitive to variations in a (the magnitude of {), since primarily serves to induce misclassification rather than explicitly directing the sample towards specific class. Nonetheless, & remains essential; as decreases, the performance of Bad-PFI also gradually diminishes, although not as dramatically as when e decreases.
Table 18:
The impact and a in attack performance of Bad-PFL.
FedBN
FedRep
FedBN
FedRep
Acc
ASR
Acc
ASR
a
Acc
ASR
Acc
ASR
0
80.78
13.74
80.17
12.82
80.56
68.56
80.20
79.32
1
80.70
23.05
80.32
54.92
80.75
72.84
80.45
85.38
2
80.86
78.91
80.20
79.68
2
80.68
77.37
80.52
88.88
3
80.77
80.04
80.35
86.79
3
80.84
80.52
80.23
93.86
4
80.72
82.22
80.29
97.95
4
80.72
82.22
80.29
97.95
B.2.5 CONVERGENCE COMPARISON
Figure 6 illustrates the accuracy of the personalized models and their ASRs using three different attack methods over the training rounds. Overall, when the training round reaches 500, both the models and the attack methods converge.
FedBN ASR
FedBN Ace
FedRep ASR
FedRep Ace
100
85
100
80
80
ASR (%)
ASR (%)
Ace (%)
75
50
Ace
70
80
20
Neurotoxin L.F.Atack
65
Ours
60
60
0
500
1000
0
500
1000
500
1000
0
500
1000
Training Rounds
Training Rounds
Training Rounds
Training Rounds
Figure 6: Convergence comparison with various attacks for FedBN and FedRep.
18

---

Published as a conference paper at ICLR 2025
Figure 7: The original images, trigger-added images, and corresponding triggers (amplified by factor of 20) with 1 and 4.
Figure 8: The original images, trigger-added images, and corresponding triggers (amplified by factor of 20) with 2 and o 4.
B.2.6 TRIGGER VISUALIZATION
To demonstrate the invisibility of our trigger, Figures ~ 12 visualize the original data, our trigger, 4 and trigger-adding data under different magnitude constraints (over 255 255 253 and 25 of and &. The top images represent the original data, the middle images show trigger-added data, and the bottom images display the trigger (8 + Q) generated by Bad-PFL for each data point. Since the strength of + E is quite small, the intensity of the trigger amplified by a factor of 20, i.c., 20 (6 E), for better visualization. First, it is difficult for the human eye discem any differences
2 3
19

---

Published as a conference paper at ICLR 2025
Figure 9: The original images, trigger-added images, and corresponding triggers (amplified by factor of 20) with 3 and a 4.
Figure 10: The original images, trigger-added images, and corresponding triggers (amplified by factor of 20) with 4 and a 1.
between the original images and the trigger-added data, often perceiving them identical, which makes our trigger highly stealthy. Furthermore, it can be seen that Bad-PFL generates different trigger patterns for different images, which further enhances the stealthiness.
20

---

Published as a conference paper at ICLR 2025
Figure 11: The original images, trigger-added images, and corresponding triggers (amplified by factor of 20) with 4 and a 2.
Figure 12: The original images, trigger-added images, and corresponding triggers (amplified by factor of 20) with 4 and 3.
B.2.7 THE IMPACT OF CLIENT NUMBER
We here evaluate the impact of the number of clients the performance of Bad-PFL, with the results reported in Table 19. Wherein, we fix the number of malicious clients at 10. We observe that the total number of clients increases, both accuracy and ASR gradually decline. Though this, Bad- RLL-PFLssee still achieves significant ASRs (> 80%). Moreover, when the ratio of compromised clients fixed at 10%, see that the performance of Bad-PFL. remains largely unchanged.
21

---

Published as a conference paper at ICLR 2025
The attack performance of Bad-PFL against FedRep under varying client numbers. The fixed number setting indicates that the number of compromised clients remains constant at 10, re- gardless of changes in the total number of clients. The fixed ratio setting specifies that the number of compromised clients corresponds to 10% of the total number of clients.
Table 19:
Strategy
Fixed Number
Fixed Ratio
Client Number
Acc
ASR
Acc
ASR
50
80.72
99.22
80.65
98.00
100
80.29
97.95
80.24
97.68
150
79.75
93.66
79.47
97.30
200
78.04
85.87
77.95
98.48
70
20
60-
50
Count
40
10-
30-
20
60
70
90
100 75
80
85
90
95
100
FedBN
FedRep
Figure 13: The distribution of ASRs for FedBN and FedRep. For FedBN, the 25th, 50th, and 75th percentiles of ASRs are 84%, 90%, and 96%, respectively. For FedRep, the 25th, 50th, and 75th percentiles are 97%, 100%, and 100%.
B.2.8 THE DISTRIBUTION OF ASRS
Figure 13 visualizes the ASRs of Bad-PFL. across different clients using their local test sets. Overall, the ASRs remain high for the majority of clients. In the case of FedRep. Bad-PFL. achieves ASRs below 90% for only two clients, while the ASRs appear to be more dispersed for FedBN. FedBN allows local personalized models to learn private batch normalization layers tailored to their specific datasets. Therefore, for FedBN, we hypothesize that the models of compromised clients and benign clients learn different feature distributions. Our generator focuses on learning the natural features related the target label from the models of compromised clients. These features may overlap less with those learned by the models of benign clients, leading to lower ASRs. In contrast, FedRep requires all local personalized models to share feature extractor and thus enjoys more feature overlap and is more vulnerable to Bad- RFd-
Table 20: The performance of Bad-PFL in single-tares target and multi target attack scenarios.
Attack
Single-target Attack
Multi-target Attack
PFL
Acc
ASR
Acc
ASR
FedBN
80.72
82.22
79.65
80.44
FedRep
80.29
97.95
78.79
96.43
B.2.9 MULTI-TARGET ATTACK
Table 20 reports the performance of Bad-PFL in multi-target attack scenario on CIFAR-IO. We train separate generator for each category. As observed, the average performance of the personalized models decreases in multi-target attack scenario compared to single-target attack scenario. This reduction occurs because the global model needs to fit multiple generators simultancously, which can somewhat impede the learning of the primary task to some extent. Moreover, we see that the ASRs do not appear be significantly affected.
22

---

Published as a conference paper at ICLR 2025
Table 21: The performance of different attack methods against three defenses. We employ FedRep.
Simple-Tune Tuning
BAERASER
MAD
Attack
Acc
ASR
Acc
ASR
Acc
ASR
Neurotoxin
82.65
19.80
79.59
13.05
74.52
19.46
LR-Attack
81.68
12.59
77.90
15.24
74.81
10.49
Perdoor
81.59
63.15
79.33
84.12
74.64
46.90
Iba
81.82
49.31
77.74
78.98
74.55
55.58
BadFL
82.24
22.79
79.39
17.59
74.75
24.73
PFedBA
81.27
42.36
78.59
31.88
74.29
55.92
Bad-PFL
82.05
88.82
77.68
91.54
74.37
90.74
B.2.10 THE COMPARISON OF Bad-PFL WITH VARIOUS BACKDOOR ATTACKS ACROSS MULTIPLE DEFENSES
We compare Bad-PFL with more backdoor attacks across various defenses. Simple-Tuning (Qin al., 2023) and BAERASER (Liu et al., 2022) clients reinitialize their classification heads and train on their local datasets. BAERASER attempts reverse triggers and then employs forgetting techniques reduce the model's memory of the re- covered triggers. Multi-metrics Adaptive Defense (MAD) (Huang et al., 2023) is defense method applied during training. integrating multiple metrics to better identify malicious clients. Addition- ally, we introduce four new attack methods: Perdoor (Alam et al., 2022), Iba (Nguyen et al., 2024), BadFL (Ye et al., 2024b), and PFedBA (Lyu al., 2024). Both Perdoor and Iba focus on cus- tomizing triggers for specific samples, but they do not explore performance in non-lID scenarios. BadFL and PFedBA focus on non-lID settings; however, BadFL is overly concentrated on FedRep. PFedBA generates triggers by solving gradient matching problem, resulting in fixed triggers that are easily detectable.
post-training defenses. In Simple-Tuning,
Table 21 reports the attack performance of these methods against three defense methods, using FedRep to train the models. Overall, Bad-PFL significantly outperforms these attacks in terms of ASRs. The ASRs achieved by Bad-PFL considerably higher than those of Iba, as utilize disruptive noise to enhance the effectiveness of our triggers. Furthermore, we observe that fixed- trigger attacks, such PFedBA, easily countered BAERASER, because fixed triggers more easily recoverable. In contrast, dynamic-trigger attacks, including Perdoor, Iba, and Bad-PFL, demonstrate strong resilience.
B.2.11 EVALUATION OF BACKDOOR ATTACK STEALTHINESS
1) whether benign clients can detect backdoors in their models, and whether benign clients can recognize trigger-added samples. For the first perspective, we utilize Neural Cleanse, which computes an anomaly index by recovering trigger candidates convert all clean images each label. If the anomaly index for specific label is significantly higher than for others, it indicates that the model is likely compromised. We evaluate different attack methods by calculating the anomaly index for the target label using Neural Cleanse. A smaller anomaly index suggests that the backdoor attack is harder to detect. For the second per- spective, we employ STRIP, which identifies trigger-added added samples based on the prediction entropy of input samples generated by applying different image patterns. Higher entropy signifies a more stealthy trigger.
We examine the stealthiness of Bad-PFL. from two perspectives:
We train ResNer10 with FedRep on CIFAR-10. By default, we select the models of the first ten benign clients and the CIFAR-10 test set to estimate the anomaly index and entropy. Table 22 reports the results. The average anomaly index for non-target labels is 1.9, while the entropy of clean samples 0.92. As expected, Bad-PFL achieves a lower anomaly index and higher entropy compared to baseline attacks, demonstrating superior stealthiness.
C DISCUSSION ON ATTACK COSTS
We here discuss the overhead associated with our attack method, examining both the training and inference phases. During the FL process, Bad-PFL. involves the optimization of the generator and
23

---

Published as a conference paper at ICLR 2025
Table 22:
The performance of different backdoor attack methods against state-of-the-art detection methods. The anomaly index presented here is calculated for the target label, with the best results highlighted in bold.
Detection Method Neural Cleanse (Anomaly Index)
STRIP (Entropy)
Neurotoxin
5.8
0.13
LF-Attack
5.7
0.12
PFedBA
4.9
0.25
Bad-PFL
2.2
0.77
Table 23: Total time taken (in seconds) for the client to run local training using different attack
methods. We follow the training configuration in Section 4.2.
Attack
FedProx
SCAFFOLD
FedBN
FedRep
Ditto
No Attack
0,453
0.211
0.201
0.447
0.451
Neurotoxin
0.475
0.223
0.213
0.452
0.468
Perdoor
5,744
3.273
3.113
3.349
3.358
Iba
0.791
0.661
0.620
1.227
1.178
BapFL
0.982
0.578
0.552
0.797
0.552
PFedBA
1,820
1.540
1,480
1.649
1.443
Bad-PFL 0.818
0.620
0.613
1,206
1.132
the training of the global model on trigger-added data. On the one hand, the optimization of the generator, as described in Equation 7, requires Two complete forward and backward passes of the global model, along with one forward and backward pass of the generator. On the other hand, optimizing the global model on trigger-added data involves crafting triggers, which entails a single forward pass the generator (for d), as well as forward and backward pass of the global model (for E).
Table 23 empirically evaluates the time required for compromised clients to execute local training using various attack methods. We conduct these experiments using CIFAR-10. 10, with the reported times averaged over 100 trials on single RTX 4090 GPU. "No Attack" indicates the time taken for client to perform local training without executing backdoor attacks. Table 23 does not report the costs associated with LF-Attack, as needs training models from scratch multiple times (in linear relationship with the number of layers in the neural networks) to evaluate each layer's significance for backdoor attacks. The attack costs for LF-Attack are significantly higher than those of existing backdoor attack methods, and will not discuss it further.
We observe that Neurotoxin incurs the lowest attack overhead since it utilizes a fixed trigger; how- ever, this also results in lower attack performance (as shown in Table 21). More advanced backdoor attack methods often employ more sophisticated trigger generation techniques. For instance, Per- door uses the BIM method create triggers, necessitating multiple complete forward and backward passes of the global model (10 times here). PFedBA has to handle a gradient matching problem, re- quiring at least two forward and backward passes of the global model for each optimization iteration of the trigger. Our attack method also demands a certain amount of time investment. Neverthe- less, we stress that compared to existing attack methods, our attack method still achieves superior performance while maintaining competitive time overhead. Moreover, federated backdoor attack methods focus more on attack performance over runtime costs, as the primary bottleneck in FL lies in communication costs. These attack methods usually require only few seconds, which is small compared to communication durations, making them less detectable practice. In the inference phase, our method for generating triggers for 32 data samples takes approximately 0.07 seconds, which is also quite efficient. In summary, Bad-PFL. is practical.
D A CLOSE LOOK AT Bad-PFL
We here explain how Bad-PFL effectivly overcomes the three challenges in Section 2.2. The trigger employed in Bad-PFL consists of target feature (8) and disruptive noise ({). Naturally, data from the target label inherently contains and the relationship between 5 and the target label (established through human labeling). Recall that train models to maximize accuracy. Thus, models tend to
24

---

Published as a conference paper at ICLR 2025
leverage any available features to do so. This means that as long as the clients' datasets include data from the target label, personalized models will inevitably learn and the relationship between 5 and the target label. This enables Bad-PFL to effectively address the challenges in Section 2.2.
More specifically, in full model-sharing methods, relying solely on the regularization term is inade- quate for transferring the backdoor personalized models. Bad-PFL leverages the natural features of the target class as our trigger, which are inherently present in the data associated with that class, including the local datasets of benign clients. Personalized models trained on benign clients' lo- cal datasets will actively learn the natural features and the relationship from the natural features to the target label for higher accuracy. The guidance provided by the regularization term also further enhances this learning process, allowing Bad-PFL to effectively overcome the first challenge.
In partial model-sharing methods, the challenge lies in effectively conveying the connection between the triggers and the target label to the personalized models. Since we cannot alter the local training processes of benign clients, is nearly impossible to embed the relationship between handcrafted triggers and the target label through data poisoning or other means. Instead, Bad-PFL utilizes the natural features of the target label. This mapping between natural features and the target label, which already exists in the local datasets of benign clients, allows us to effectively address the second challenge without needing to modify the training process of benign clients.
Regarding the dilution of backdoors, we recognize that the clients' datasets contain these natural features and their relationships with the target label. During the fine-tuning or training process, the model is less likely forget these relationships because doing so would lead decline in performance. In other words, the presence of these natural features in the training data reinforces the model's memory of the backdoor, mitigating the risk of it being overwritten or lost. In summary, the above analysis clearly illustrates how Bad-PFL successfully overcomes the three challenges previously mentioned.
Importantly, even if particular client's dataset lacks data from the target label, Bad-PFL probably remains effective. First, in practice, only small number of client datasets may lack target class data, making it unlikely that the global model fails to learn ó and the mapping from ò to the target label. Moreover, in PaL- malicious clients actively promote the model's reliance on to predict the target class (Equation 7). The similarity constraint between the global model and the personalized models encourages the personalized models to leverage the relationship between and the target class more effectively. This encourages the personalized models to also utilize the relationship between 8 and the target class to a greater extent. Second, we introduce destructive noise E, which interferes with features belonging to the true class, thereby allowing ō to function more effectively in the decision-makinn performance of Bad-PFL. The only conceivable countermeasure would be if clients fine- fine-tue their personalized models without including target class data; however, this absence would significantly degrade their performance on the target class.
process of personalized models. These two unique designs can enhance the
Empirical evidence. To further substantiate our claims, we present experimental results. First, we demonstrate that 8 utilized in Bad-PFL. are indeed natural features of the target class. We employ t-SNE to visualize the features extracted from test set of CIFAR-10 by the global model, alongside d for these test samples. As illustrated in Figure 14, the model classifies ó as belonging to the target class, indicating that it recognizes ó as natural features of the target class.
Next, we validate the effectiveness of the disruptive noise E. Similarly, we use t-SNE to visualize the features of both the test samples with and without Ç. Figure 15 reveals that, while the features from x cluster neatly by class, those from x + E exhibit a more chaotic distribution. This confirms that & effectively disrupts the features associated with their ground-truth classes.
We also conduct numerical experiments to further substantiate our conclusions. We train a ResNet10 on the CIFAR-I0 dataset from scratch using three distinct configurations. The first configuration employs a standard training setup. In the second configuration, we add disruptive noise E to the training samples of the target label during each iteration. Building the second configuration, the third configuration introduces 8 into the training samples of the target label. Intuitively, the disruptive noise is expected to corrupt the features of the training samples of the target label, which would hinder the model from learning the underlying features of the target label, resulting in poor performance on those samples. In the third configuration, if 5 accurately captures the features of the target label, we anticipate that the model will learn more about the target label compared to the
25

---

well as Published as a conference paper at ICLR 2025
Cat
Frog
Automobile
Truck
Horse
-10
Ship
Dog
Airplane
-20
Deer
Bird
Target Feature
-10 -5
0
10
15
Figure 14: We visualize the features from the fully connected layer of the CIFAR- 10 test set. More- over, we feed the test samples into the generator 9w to produce the corresponding 6. For better visualization,
scale the norm of to match the magnitude of the test samples' norm. As can be seen, the features of generated 6 significantly overlap with the features of the target class (Airplane). This suggests that d indeed represents the natural features of the target label.
Table 24: We train ResNet10 using three different configurations. The first one is the standard setup. The second one introduces disruptive noise & to the training samples of the target label during each iteration. Building on this second configuration, the third one adds into the training samples of the target label. We report the accuracy of the trained models on the CIFAR- 10 test specifically on the test samples from the target label.
Setup
Acc
Acc of the Target Label
First Configuration (Standard Training) 80.70
80.30
Second Configuration (with {) 70.70
6.70
Third Configuration (with 8 + ()) 72.90
39.10
second configuration, Icading to better performance in the samples of the target label. We reuse the generator Section 4.2 of the original manuscript (against FedRep).
Table 24 reports the accuracy of the model on the entire test set of CIFAR-10 10, as well as on the test samples from the target label alone. We observe that the model achieves an accuracy only 6.70% on the samples of the target label, indicating that the disruptive noise indeed significantly impairs features of the samples of target label. In the third configuration, we see that the model's accuracy the samples of the target label rebound to 39.10%. This suggests that our generator indeed learns the features of the target label.
THE INTERPLAY BETWEEN AND &
We here study the interplay between 8 and &. In detail, we evaluate the proportion of pixels where and share the same sign, finding to be approximately 26. 26,,8% averaged over 1000 samples. This indicates that 8 and do not completely align in terms of the direction of pixel changes, suggesting more intricate interplay between and E. To further clarify the relationship between the and &, we have included visualizations of and + & to better illustrate their effects pixel value changes. As illustrated Figure 16, the pixel changes introduced by & appear somewhat erratic from a human perspective. In contrast, the combined effect of & exhibits clear pattern, predominantly altering pixels in the upper right corner. This highlights the interplay between and ç. characterized by both resistance and agreement. While & proposes specific pixel change directions, & can either amplify
26

---

Published as a conference paper at ICLR 2025
Cat
20
Frog
Automobile
Track
Ship
Cat
0-
Door
Airplane
0-
frog
Automobile
Truck
Disrupted Samples
Horse
-10-
Ship
Dog
-20
Doer
Bird
Disrupted Samples
-30
-20
-15
10
10
15
10
10-
Cat
Frng
Frng
0
Truck
Truck
Horse
Horse
Ship
-10-
Dog
Dog
Airplane
-10
Airplane
-15
Deer
Bird
Bird
Disrupted Samples
Disrupted Samples
We visualize the features of x and { from the fully connected layer using t-SNE. Here, I comes from the test set of CIFAR-10. We extract images of the Automobile, Dog, Horse, and Truck categories from the test set and subsequently craft & for each. The top left corresponds to Automobile, the top right to Dog, the bottom left to Horse, and the bottom right to Truck. We see that the features of + indeed deviate significantly from the target cluster, demonstrating that effectively disrupts the features associated with their corresponding ground-truth classes.
Figure 15:
Figure 16: Case 1. The leftmost one the original image. The second image is a heatmap generated by summing the pixel values across different channels of this image. The third and fourth images represent the heatmaps obtained by summing the channels of f and & + 6, respectively.
counteract these suggestions. This means that 8 + reflects negotiation between the two: may dampen or redirect some the changes suggested by g. This dynamic can lead to concentrated perturbations in certain areas of the input, indicating that selectively agrees with the changes
Figure 17: Case 2.
27

---

Published as a conference paper at ICLR 2025
Figure 18: Case 3.
Figure 19: Case 4.
proposed by 8. This phenomenon can be observed in Figures 17, 18, and 19, reinforcing the notion that there exists complex interaction between and ó, rather than straightforward combination into a single effect.
28


Reviews:
[{"review_id": "tJYapIAGVB", "reviewer": "Reviewer_ZRox", "summary": "The authors develop Bad-PFL, a new backdoor attack that leverages natural features from the target label as a trigger, enabling backdoor persistence across both global and personalized models. It uses a dual-component trigger, combining natural target features and disruptive noise to deceive the model without being easily detectable. Bad-PFL demonstrates high attack success rates even when state-of-the-art defenses are applied.", "questions": "1) Have you tested the detectability of the Bad-PFL trigger with current anomaly or backdoor detection methods? If so, what results did you observe?\n\n2) How does the attack’s success vary with different levels of data heterogeneity among clients? Could more heterogeneous data distributions reduce Bad-PFL’s attack success rate or persistence?\n\n3) How does Bad-PFL perform across different model architectures, such as transformer-based models?", "limitations": "", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "It introduces Bad-PFL, a unique attack using natural features as triggers in PFL, and a novel dual-trigger design combining natural features and disruptive noise for stealth and effectiveness. Experiments are thorough, covering multiple datasets and comparing Bad-PFL to six top backdoor attacks, showing its high success rate even with strong defenses. This work highlights vulnerabilities in PFL previously thought resistant to backdoors, encouraging the development of specialized defenses and impacting fields that rely on PFL.", "weaknesses": "1) Some newer or adaptive defenses, such as gradient masking or input filtering, are not covered, leaving questions about Bad-PFL's effectiveness against more dynamic defenses.\n\n2) While Bad-PFL claims high stealthiness, there is limited quantitative analysis on how detectable the trigger is by modern anomaly or intrusion detection systems.\n\n3) The experiments are largely conducted on ResNet models, leaving questions about the attack's adaptability to other architectures commonly used in federated learning, such as transformer-based models.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "0aD7RH6fe3", "reviewer": "Reviewer_XeVe", "summary": "In this paper, the authors propose a novel PFL backdoor method that leverages natural features from the data as triggers, rather than manually designed triggers used in previous attacks. Specifically, the proposed method adopt a generator to generate the features that make samples appear similar to the target category and introduces disruptive noise to eliminate features associated with the ground-truth labels.", "questions": "See weekness 1, 2, 3", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 4, "contribution": 3, "strengths": "1. The proposed method is novel in that the trigger is designed to be sample-specific, which is a significant difference with the previous works\n\n2. The paper is well organized and is easy to follow\n\n3. The authors provide a thorough discussion about the challenges of backdoor attack under the PFL setting.\n\n4. The authors conduct the experiment on three benchmark datasets. Besides, the effectiveness of the propsoed backdoor methods are also evaluated under the state-of-the-art defense mechanisms", "weaknesses": "1. In this paper, the authors lack the in-depth discussion about why the propose method can overcome the challenges metioned in section 2.2.\n\t\n\ta. It is suggested that the authors give more intuitive or theoretical discussion about why it works. \n\n\tb. Specifically, the authors may give more experimental analysis about the inherent mechanism about the proposed method. For example, the authors can visualize the representation of different classes under clean and backdoored data.  \n\n\n2. Some related attacks are missing, such as: \n\ta. Lurking in the shadows: Unveiling Stealthy Backdoor Attacks against Personalized Federated Learning (https://arxiv.org/html/2406.06207v1)\n\n\n3. Missing defense method. \n\ta. Simple-Tuning: Clients reinitialize their classifiers and then retrain them using their local clean datasets while keeping the feature encoder fixed. (https://dl.acm.org/doi/10.1145/3580305.3599898)", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "AKY1ewNMDX", "reviewer": "Reviewer_mG9G", "summary": "This paper investigates backdoor attacks in FPL and introduces a new method to conduct attacks with PFL, named Bad-PFL. This method trains a sample-specific generator to generate a mask for input. Another mask is learned for the main task; the final poisoned sample combines the original one and these two masks. Experiments show that this method can work with different settings and bypass existing defenses.", "questions": "1. In the threat model (Line 236-237), the attack can be colluded or non-colluded but the paper did not explicitly discuss or show this attack can work with both cases.\n2. Can the authors explain more detail about the phenomenon mentioned in L263-264, and why the model should focus on the backdoor mask $\\delta$?\n3. Could the authors discuss the computational overhead of this method? Will it raise suspicion when it takes too long for the malicious to complete a training iteration?\n4. In Line 294, what is the intuition of setting \\eta by the reversed sign of the input?\nWhy does it ensure to return of an approximate solution?\n5. Will another factor such as the number of clients affect the performance of this method, since it will affect the global model in each training round?\n6. Some close related papers are missing such as [3][4]. The authors can discuss the key difference in terms of the methodology of this work.\n7. Can the authors elaborate more on the sharp difference in ASR among different datasets such as CIFAR100 and SVHN under FedREP in Tables 15 and 16?\n\n[3] Ye, Tiandi, et al. \"BapFL: You can Backdoor Personalized Federated Learning.\" *ACM Transactions on Knowledge Discovery from Data* (2024).\n\n[4] Lyu, Xiaoting, et al. \"Lurking in the shadows: Unveiling Stealthy Backdoor Attacks against Personalized Federated Learning.\" *arXiv preprint arXiv:2406.06207* (2024).", "limitations": "", "rating": 6, "confidence": 5, "soundness": 2, "presentation": 3, "contribution": 3, "strengths": "- It provides an interesting insight into why existing backdoor attacks are ineffective in PFL, offering a foundation for advancing attack strategies.\n- The proposed Bad-PFL approach achieves high stealth and persistence in personalized models under various settings.", "weaknesses": "1. This method shows degradation when the data is highly heterogeneity, which is more practical in cases in FPL.\n2. The using of a generator for mask optimization is not novel, previous works such as IBA[1] and Perdoor[2] use the same method. However, this paper lacks comparison and discussion with these papers.\n3. The using of two masks now is not totally convincing and lacks of theoretical analysis to support this mechanism. What is exactly the role of each mask in the overall method and what is the relationship of these two masks? The **paper may not fully justify why two separate masks are essential** rather than using a single mask that can adaptively balance target and non-target features.  How can we ensure that the two masks—the target feature enhancement mask ($\\delta$) and the disruptive noise mask ($\\xi$)—do not interfere with each other, either by collapsing into a single effect or by unintentionally complementing each other? Table 4 is not enough for this point.\n4. It is unclear how Bad-PFL can address the limitations mentioned in Section 2.2. Though the authors mentioned using features of the target label as the trigger for a more effective backdoor attack, the benign mask $\\eta$ is learned as a noise mask instead of the true features in the images. Could the authors argue this point?\n\n[1] Nguyen, Thuy Dung, et al. \"Iba: Towards irreversible backdoor attacks in federated learning.\" *Advances in Neural Information Processing Systems* 36 (2024).\n\n[2] Alam, Manaar, Esha Sarkar, and Michail Maniatakos. \"Perdoor: Persistent non-uniform backdoors in federated learning using adversarial perturbations.\" *arXiv preprint arXiv:2205.13523* (2022).", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "neNTB0m9Mo", "reviewer": "Reviewer_easG", "summary": "The authors investigate the potential of backdoor attacks targeting personalized federated learning (PFL) and intuitively outline why such attacks often fail in PFL. They propose using natural features rather than manually designed triggers to execute backdoor attacks in PFL, which improves both the attack's success rate and robustness across various test cases, with or without defenses.", "questions": "1. The authors consider using natural features as triggers, termed an edge-case attack in [1]. I wonder if the main distinction of the proposed attack is that it generates target features rather than manually selecting them. However, it seems that different clients—or at least different client groups—may require distinct natural features for effectiveness.\n2. Other than training-stage defenses (i.e., robust aggregation), have the authors considered post-training defenses (e.g., pruning, CRFL [2]) or unlearning as defenses? I feel those defenses may be more effective on backdoor attacks.\n3. For different clients, does the effectiveness of the backdoor vary significantly? And is this variation caused by data heterogeneity or differences in shared model parameters?\n4. What happens when attackers target different labels and clients have multiple objectives? Detailed experiments may not be necessary, but insights and intuitions would be helpful.\n\n[1] Wang, Hongyi, et al. \"Attack of the tails: Yes, you really can backdoor federated learning.\" Advances in Neural Information Processing Systems 33 (2020): 16070-16084.\n[2] Xie, Chulin, et al. \"Crfl: Certifiably robust federated learning against backdoor attacks.\" International Conference on Machine Learning. PMLR, 2021.", "limitations": "", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "1. Clear and well-structured presentation\n2. Comprehensive experimental test cases covering various attacks, defenses, and PFL mechanisms\n3. Novel reinforcement techniques, including generating target features", "weaknesses": "1. Fundamentally, I feel like the traditional backdoor objective may be insufficient for effectively attacking personalized federated learning (PFL), especially in scenarios with a high degree of non-i.i.d. data where each client has its own unique \"target.\" Therefore, a personalized or adaptive backdoor attack approach may be necessary.\n2. The current attack mechanism is based on empirical intuitions. Strengthening this work could involve a deeper exploration of the model’s internal dynamics, such as identifying which layers or neurons are critical for shared vs. unshared parameters and examining the influence of regularization on the model. Alternatively, providing a fundamental analysis of why traditional backdoor attacks fail and why Bad-PFL succeeds would also add significant value.\n3. As this is the first study on backdoor attacks in PFL, rather than focusing on more practical backdoor scenarios, it’s recommended to compare white-box and black-box attacks. This comparison can help illustrate the limitations of current attacks, especially when the attacker has knowledge of clients' data and the full model structure, thus providing justification for the authors' three hypotheses on why the backdoor was ineffective in PFL.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)