DataStealing: Steal Data from Diffusion Models in Federated Learning with Multiple Trojans
Authors: Yuan Gan
Jiaxu Miao
Yi Yang
Venue: NeurIPS 2024 poster (2024)
Keywords: Federated Learning
Diffusion Models
DataStealing
Multiple Trojans
Adaptive Scale
Primary area: privacy
TL;DR: This paper presents a new privacy vulnerability in training diffusion models with Federated Learning and proposes an adaptive Trojan attack to bypass advanced defenses and achieve DataStealing.

Abstract: Federated Learning (FL) is commonly used to collaboratively train models with privacy preservation. In this paper, we found out that the popular diffusion models have introduced a new vulnerability to FL, which brings serious privacy threats. Despite stringent data management measures, attackers can steal massive private data from local clients through multiple Trojans, which control generative behaviors with multiple triggers. We refer to the new task as ${\bf\textit{DataStealing}}$ and demonstrate that the attacker can achieve the purpose based on our proposed Combinatorial Triggers (ComboTs) in a vanilla FL system. However, advanced distance-based FL defenses are still effective in filtering the malicious update according to the distances between each local update. Hence, we propose an Adaptive Scale Critical Parameters (AdaSCP) attack to circumvent the defenses and seamlessly incorporate malicious updates into the global model. Specifically, AdaSCP evaluates the importance of parameters with the gradients in dominant timesteps of the diffusion model. Subsequently, it adaptively seeks the optimal scale factor and magnifies critical parameter updates before uploading to the server. As a result, the malicious update becomes similar to the benign update, making it difficult for distance-based defenses to identify. Extensive experiments reveal the risk of leaking thousands of images in training diffusion models with FL. Moreover, these experiments demonstrate the effectiveness of AdaSCP in defeating advanced distance-based defenses. We hope this work will attract more attention from the FL community to the critical privacy security issues of Diffusion Models. Code: https://github.com/yuangan/DataStealing.

DataStealing: Steal Data from Diffusion Models in Federated Learning with Multiple Trojans
Yuan Gan ReLER, CCAI Zhejiang University ganyuanezju. edu. cn
Jiaxu Miao
Yi Yang ReLER, CCAI Zhejiang University yangyicsšzju edu.
School of Cyber Science and Technology Sun Yat-sen University miaojx@mail. edu.
Abstract
Federated Learning (FL) is commonly used to collaboratively train models with privacy preservation. In this paper, found out that the popular diffusion models have introduced new vulnerability to FL., which brings serious privacy threats. De- spite stringent data management measures, attackers
steal massive private data from local clients through multiple Trojans, which control generative behaviors with multiple triggers. We refer to the new task as DataStealing and demonstrate that the attacker can achieve the purpose based on our proposed Combinatorial Triggers (ComboTs) in a vanilla FL system. However, advanced aistance-based FL defenses are still effective in filtering the malicious update according to the distances between each local update. Hence, we propose an Adaptive Scale Critical Parameters (AdaSCP) attack to circumvent the defenses and seamlessly incor- porate malicious updates into the global model. Specifically, AdaSCP evaluates the importance of parameters with the gradients in dominant timesteps of the diffusion model. Subsequently, adaptively seeks the optimal scale factor and magnifies critical parameter updates before uploading to the server. As result, the malicious update becomes similar to the benign update, making difficult for distance-based defenses to identify. Extensive experiments reveal the risk leaking thousands of images in training diffusion models with FL. Moreover, these experiments demonstrate the effectiveness of AdaSCP in defeating advanced distance-based defenses. We hope this work will attract more attention from the FL community to the critical privacy security issues of Diffusion Models. Code: hwwp:///...oomuuuaanannnaaaaaaaa
Introduction
Federated Learning (FI.) has emerged popular framework for distributed machine learning due to its local data protection capabilities. Meanwhile, the issue of privacy data leakage in federated learning has attracted significant attention. Most previous FL works focused on discriminative models, and several studies [19 61 (8) have demonstrated that FL may leak small amounts of arbitrary local data through gradient inversion. Recently, FL has begun to be utilized to train diffusion In this paper, we found that diffusion models have brought new privacy vulnerabilities to FL. Attackers can steal thousands of specified high-quality local data through diffusion models trained with FL, which exposes more severe privacy security issues compared with discriminative models.
models [27] 51 25 one of the advanced generative methods 22
48
45
58 III
Specifically, to safeguard data privacy, using FL. to train diffusion models is considered definitive choice. According to GDPR (52, strict data privacy management mechanisms should be adopted to prevent attackers from directly accessing or transmitting data from local clients, including banning
*Corresponding Author
38th Conference on Neural Information Processing Systems (NcurIPS 2024).

---

MSE
Central Server
Release
0.0036
with Defenses
Broadcast global model
Upload local model
0.0020
0.0061
Poisoned Cliont
Bonign Client
Benign Client
Benign Cliont
ComboTs
Generated Data
Private Data
Figure 1: Overview of DataStealing. To steal data under strict management, the attacker can poison the global diffusion model in FL with multiple Trojans. After releasing the global model for users, the attacker extracts massive local data high quality from outside with multiple triggers (ComboTss).
USB drives, restricting network access, and disabling copy-paste. Nevertheless, these attackers may tamper with the training process of local clients, enabling diffusion models to embed and later extract private images from the released global model, as shown in Fig. [ For instance, in an organization with strict data management, one staff can use this method to transmit data to the outside. We refer to this task as DataStealing. The recently emerging Trojan attacks on diffusion models [5] 5 [0] make it possible
steal image with specific trigger. This inspires us that multiple triggers may lead to more severe harm and steal thousands of private data. To achieve this aim, we propose method to select multiple triggers, named Combinatorial Triggers (ComboTss). Specifically, synthesize numerous triggers through the combinatorial selection of points from candidate locations. Our ComboTs fulfill the requirement for extensive data mapping in DataStealing.
Based on ComboT', stealing thousands of private data from diffusion models in the FL framework seems achievable. However, with the advanced FL defense strategies, injecting multiple backdoors into diffusion models poses greater challenges than introducing a single backdoor. We observe that data poisoning 66 20
33 faces difficulties in effectively injecting multiple backdoors into diffusion models under FedAvg 337. While model poisoning (1 can rapidly inject multiple backdoors by scaling malicious updates, it generally fails to overcome the advanced FL defenses (50) 2 17 42
24]. Although these defenses are designed for classification tasks, distance-basse defense 24 remain effective in rejecting the malicious update according to the distances between each local update, thereby intensifying the challenge of implanting multiple Trojans into
methods 2
17
44
diffusion models.
To address the above challenge, we propose an Adaptive Scale Critical Parameters attack (AdaSCP) to effectively circumvent various distance-basse defenses [37 2
44 24. We find that distance-based defenses struggle to differentiate the backdoor update from benign updates when a malicious client only updates partial parameters with proper scale value. Specifically, we estimate the importance of parameters in the diffusion model in a Taylor expansion framework (39] over dominant timesteps. To adaptively seek the optimal scale value, implant and utilize the indicator to estimate the target scale value. AdaSCP optimizes the scale factor with a learning rate according to the difference between the target and current scale. Additionally, we utilize the historical scales stabilize the optimization process and enhance the efficacy of the attack. At last, the attacker trains the critical parameters and uploads the malicious update magnified with the optimized scale value.
17
Overall, our main contributions are summarized as follows:
We introduce novel task, DataStealing, focusing data exfiltration from diffusion models within the FL framework. Our proposed ComboTTs make it possible to steal massive specific, high-quality private data from local clients under stringent security measures. To our knowledge, we are the first to pay attention to the data privacy leakage risks in federal learning training diffusion models.
We propose attack method for DataStealing, named AdaSCP, defeat advanced listance-based defenses and seamlessly incorporate backdoor gradients into the global diffusion model.
Extensive experiments have been conducted to assess the efficacy of current FL Trojan attacks and defenses in DataStealing task. Moreover, our AdaSCP achieves SOTA performance in stealing thousands of private data from the global diffusion model. Our findings illuminate potential future risks to the security of training diffusion models in FL.

---

Candidate Positions
(b) Trojan Diffusion Process
Private Data
Destructing by Adding Trojan Noise
Trojan Noise
[CGr.e)
Combinatorial Triggers
dj
Roston Dala
Genorating by Romoving Trojan Noise
Trojan Noise
(c) AdaSCP
T
T
Distance based
D D'éeenses
Scale:
Server
Bmadcast global model
U Upload
local model
Target Images
(a) ComboTs
Poisoned Update
Benign Update
Benign Update
Benign Update
Figure 2: Overview of ComboTss and AdaSCP. (a) Combo'Ts choose points from candidate
positions to form multiple triggers for mapping target images. (b) The forward and backward Trojan diffusion process. After training with ComboT', the poisoned model can restore the target images in high quality from Trojan noise, thereby enabling DataStealing. (c) AdaSCP achieves the purpose of DataStealing and defeats the advanced defenses by training critical parameters and adaptively scaling the updates before uploading.
Background
Denoising Diffusion Probabilistic Models (DDPMs). DDPMs [22 have garnered considerable interest due to their capacity to generate high-fidelity samples. At the core of DDPMs lies the fundamental principle of modeling the distribution of data through a diffusion process. In this progression, the initial data zo undergoes incremental corruption until it eventually converges into state complete noise 2, with t (1 < < T) steps.
St Vārzo + VI- OGE,
(I)
where (), is Gaussian noise, and ã I is hyperparameter that gradually increases the noise level in the forward process. Subsequently, reverse process works as denoising operation to retrieve the original data from the noise. This process is defined by neural network, which is trained to predict the noise at timestep Then, the trained model can gradually denoise random noise to photorealistic images.
Diffusion Models in Federated Learning. FL 37 involves a central server and multiple distributed Ne clients train global model without sharing the data. Clients periodically send local updates to the central server, which combines all updates and sends back the improved global model. This process is repeated until the server completes the training and releases the global model to the users. Analogous to the training of classification models, we train diffusion models independently on each client before being combined on the server. Each client completes the training the diffusion model autonomously and uploads the trained model and its Exponential Moving Average (EMA) model.
DataStealing: Task and Algorithms
3.1 Threat Model and Attack Scenario
Consider the following FL scenario: multiple participants aim to collaboratively train a diffusion model using sensitive, privately-held training data Dhevign (e.g., medical images) securely stored on their respective clients. Utilizing diffusion models, which inherently generate data distinct from the original inputs, ensures privacy protection by averting the exposure personal data characteristics. A trusted server aggregates the gradients provided by each client, updating the global model and

---

redistributing to each client. After the training phase concludes, the server makes the global model available to all users.
Attacker's Goal. Attacker partition client data into two subsets: (Dbenign Dbackdoor J. The attacker's goal to extract large number of training images, Dbackdoors from the compromised client via the released global model, as illustrated in Figure 1. Additionally, the attacker should minimally affect the original model's functionality to preserve the stealth of the backdoor attack.
Attacker's Abilities. Under strict data privacy protection, attackers can not upload or download images from the infiltrated client. To achieve the goal of embedding the target data Dacckdoor into the global diffusion model, the attacker is permitted to enact arbitrary alterations to the training procedure of the diffusion model and the uploaded gradients of the infiltrated client. To streamline the task and facilitate analysis, we focus on scenarios with single attacker and exclude those with multiple distributed attackers. Considering the difficulty of training diffusion models and the complexity of our task, we assume that the attacker has prior knowledge of the total number of participating clients.
3.2 Combinatorial Triggers
Conventional backdoor attacks typically use single trigger, such as a corner patch in the image mask, to generate target image. However, fixed trigger is impractical to generate plenty of target images. To tackle this issue, we introduce Combinatorial Triggers (ComboTs) to fulfill the need of mapping multiple target images. Firstly, we choose p candidate points in a grid pattern on the image mask form the candidate positions. Subsequently, we select q points from the candidate positions in a combinatorial manner. The total number of potential triggers can be determined using the straightforward combination formula: C(p. q). For a 32 x 32 image mask with a pixel spacing of 1, the value of p is 225 when border pixels are excluded. When g is set to 2, the number of Combo'Ts 25,200, which fully satisfies our requirements. Furthermore, the ComboTss demonstrate significant scalability: with ig set to 3, the potential number of Combo'T's can exceed 2 million.
Once ComboTs are obtained, they will be utilized as backdoor triggers for training. As shown in Fig. 2 (a), each trigger ó; corresponds to a target image To.i. Then we extend the Trojan attack method (5] on the diffusion model from one trigger-target pair multiple pairs. According to Eq. the forward diffusion process with trigger & can be represented as:
Ft, Vanso, + VI - āi(7E + (1 7)).),
where y is the blend weight. Trojan noise (7e (1 7))) is a blended image between Gaussian
noise e and trigger 8, Fig. (b) shows the forward and backward diffusion process with one trigger.
The sampling process with Trojan noise has been introduced in the literature [5]. The sampling
process is extended from one trigger to multiple triggers according to our ComboTs.
3.3 Adaptive Scale Critical Parameters Attack
To achieve an effective attack, model poison M is treated as our baseline, which magnifies the updates with a scale value. As Table [ shows, model poison (scale is N.) with ComboTs succeed in stealing thousands of data from the FedAvg framework. However, such a brute-force method ineffective in advanced FL with defense protocol. Two reasons make the attack invalid: 1) The difficulty of training diffusion models with ComboTss requires scaling the malicious updates, which will be easily detected by distance-based defenses 22 17 44 24). 2) The training of the diffusion model will collapse with a high scale value due to its high sensitivity to the gradients.
To evade the advanced distance-bassed defenses, we introduce an Adaptive Scale Critical Parameters attack algorithm (AdaSCP). To alleviate the effect of scaling, AdaSCP estimates and trains critical parameters [4 instead of the whole network (Sec. (3..JI]. As for the second issue, AdaSCP adopts an adaptive scaling policy with an implanted indicator [1 (Sec. 3.3.2 and Sec. 3.3.3). The details of AdaSCP are shown Algorithm and Fig. (c). Taking broadcast global model G,, local client's datasets [Doenign: Dbuckdoor }. indicator magnification factor k and previous attack setting I,-1. 8r-1 as inputs, AdaSCP reads the returned indicator and adaptively adjust the scale value 8, to defeat the defenses (Line 1). To avoid excessive parameter modification in one specific indicator, we restore the indicator and use the next candidate indicators I,. Then, the candidate indicators T, are used up, the attacker will estimate the importance score of wG with benign dataset Dbenign to acquire the

---

Algorithm 1 Adaptive Scale Critical Parameters (AdaSCP) Attack
Input: Broadcast global model Gr, local dataset (benigny Dbackdoor j. indicator magnification
factor k. previous candidate indicators 4--1 previous scale Sy-1
Output: mudiccttorimmllateee backdoor model w
1: Sr, Ir, WG AdapliveScaleWW ith ( (,-k,
Section
3.3.3
2: if len [,) = 0 then
3:
| , MG < htss://mmprtannneeeaaaaaaeee Doennig Doenign)
> Section 3.3.
4: I, +- CnniCCaanndtteeeeiiiiiaaaa
W&l, (Hl)
> Section
3.3.2
5: end if
6: Wr + TrainCCriiicllPrrmmmei Dbenign D Dbcckdoor Sy, Mc)
Appendix C.2
7: w- ImplantNew www.nnnooorrr (w,, I,, I,,k) k)
Section 3.3.2
8: return w
critical parameter mask Mc and then find new candidate indicators (Lines 2-5). After that, AdaSCP trains the critical parameters with D Denngn and Dbcckdoor and scale the critical updates with s, to acquire the scaled malicious model w, (Line 6). Finally, we implant the new indicator to get the indicator-ing implaateed backdoor model w7, which will be uploaded to the server (Lines 7 and 8).
3.3.1 Diffusion Importance Estimation
To defeat the advanced defenses with critical parameters in diffusion models, we first adopt the diffusion importance estimation used in the structural pruming task of diffusion model [14]. They claim that numerous noisy and redundant timesteps make minimal contributions to the overall generation in the diffusion process as l approaches T [36] 14]. Hence, our importance scores are estimated with accumulated gradients in dominant timesteps under the Taylor expansion framework [39]. To locate the critical parameters, we sort estimated importance scores and choose a proportion to filter important parameters of the diffusion model. The mask Mc of critical parameters is then obtained for subsequent training. In the meantime, preparing for finding indicators, we record the absolute value of accumulated gradients | and the corresponding Hessian matrix HH which represents the changing direction of gradient updates [67] More details can be found in Appendix C.I
3.3.2 Find Candidate Indicators
Algorithm 2 illustrates the process of finding candidate indicators. To prevent the magnifica- tion of indicators affecting the performance of the diffusion model, we find candidate indica- tors in the uncritical parameters according to MG (Line 1). Inspired by previous work (31], we consider two necessary conditions to choose the indicator (lines and 3). Firstly, the neu- ron's gradient update should be smaller than other neurons. Secondly, the neuron's Hessian value, the second derivative of diffusion loss, should be close zero. This means the change of this neuron contributes less to the perfor-
Algorithm 2 Find Candidate Indicators and Im- plant New Indicator
Input: Global model G,,, accumulated gradients (úcl. Hessian matrix |Ha]. indicator magnifica- tion factor k, current scale 5,, mask Mc Output: andicator-implnnte model wP, candi- date indicators
1: l' (T MG(T.) False)
2: i (11, 1 +- arg minj,er O
3: I = 111,12, ... 1m} + arg aigmingccm , HHllii
4: for each I, do Mo + True
5: wr + TrainCritical PraiirrriiiclParmm...... Param(..,
mance 22 63 Besides, to mitigate the influ-
6: Implant the first indicator to get w
ence of the backdoor dataset and align indica- tors with other clients, we only use the benign dataset Dbenign to calculate gradients and cur- vatures. To improve the efficiency of finding candidate indicators, we only compute He in the last several layers of the diffusion model the whole parameters bring a heavy burden on calculating the second derivative. Moreover, to avoid the computation of |ūa| and Hal in every round, select m indicators indicator set I,- = {I, Iz. .2., Im for subsequent use (Line 3).
k. 8, Aw. - 8: return W I,
7: 6' Bw.-G..1
time to form candidate
To implant the indicator, AdaSCP treats the indicators critical parameters and magnifies its updates (Lines 4 - 7). After training and scaling the critical parameters, we can get the scaled backdoor model wr. Then AdaSCP chooses the first indicator 1 in candidate queue I, and re-scale the corresponding
5

---

Algorithm 3 Adaptive Scale with Indicator
Input: Indicator magnification factor k, previous attack setting sy-1, 1,-1 uploaded indicator update 6' u..-1-G.-1.11 returned indicator update GG.-Gr-144 learning setting hisaces hisrej. 1), d Output: Current scale 8r, candidate indicators I,
f 0
8G.-6,-11
Theorem and Appendix D
1p-1.h
if if E (0,2. No]
2: tar,
" "Accepted" or "Rejected" by the server
otherwise
3: 8r OOllmiizeSaale(s--..
lar 71, d, hisaces hisres)
Appendix C.3
4: I, < Restore And Andlorrenndeeeeee Dequene Indiualordd 0 -G-.i- Io-1)
b Appendix
Gr-1d1:
5: return 8,,1, I
update Ow,- G,. with the magnification factor k and current scale value 8y. The rescaled update 6' GG, will be merged form the indicator-implanted backdoor model wo of this round (Line 7).
3.3.3 Adaptive Scale with Indicator
Although the implanted indicator can help us judge whether the malicious model accepted by the FL server or not, the potential of the indicator has not yet been fully tapped. We observe that although the black-box server can ensure that a malicious client is unaware of its weight in the aggregation process, the returned indicator update implies this information. This inspires us to control the weighted average results by adjusting the scale value 8y. The optimal scaling factor enables the attacker to circumvent distance-based defenses and seamlessly incorporate backdoor gradients into the global model, bolstering the efficiency and effectiveness of attacking with multiple Trojans. Hence, design an adaptive algorithm to optimize the scaling factor 8y.
Algorithm 3alimmmmiiliii Billustrates the procedure of our adaptive scale algorithm. According to the global model G,, we can get the returned indicator update GG.-G....1 in the (r 1)-th round. At first, we need to define the target scale value tar, according to the returned indicator update. Given n. local updates participating in averaging and the weights X; for each client, the optimal value of tar, should be Ex= >,/ Aad for poisoning the global updates with the adversary updates. When X; equals the number of selected clients Yhe, which is the optimal scale value used in model poison [.]. But when the andicator-implanter model rejected by the server, the scale value should approach zero to defeat the defenses. As shown in Line I and 2, we can derive lar,, with the uploaded and returned indicator updates. We leave the derivation in Appendix D
tar,
A natural way is to replace s, with tar, when "Accepted" by the server. However, this is not practical. The derivation of tar, based on the assumption that the trained updates at the position of indicator -w.-G..1, are similar across all clients due to the very small gradients. This assumption is not always valid, especially when training with non-IlD or backdoor datasets. To reduce the impact of deviation caused by training, we treat (tar, $a-1) as an optimization direction toward the optimal scale value. Hence, we define learning rate 7) to optimize the scale value sr. The adaptive scale can defeat some defenses and implant multiple backdoors stealthily. However, some defenses 2 are effective in detecting the scaled malicious updates or diluting them by averaging. This will lead to an unstable training process, where s, fluctuates between 0 and tar,, a. To stabilize s, and improve the attack effectiveness, we record history scale values in hisace and hisrej. They further help determine the optimal value of tar, and s, (Line 3). Additionally, we design weight decay d for decreasing the learning rate according to the accepted state in the previous and current rounds. Finally, we restore the indicator value and dequeue the first index I in candidate indicators to prepare for the subsequent operation in the current round (Line 4). More details are provided in Appendix C.3
Experiments
Datasets and Diffusion Models. We conduct our experiments on three widely-used datasets in
generation tasks: CIFARIO (32 x 32) (0). CelebA (64 x 64)) (34 and LSUN Bedroom (256 x 256) 62 We concentrate on Denoising Diffusion Probability Models (DDPMs) [2]. We follow
the model replacement attack [], injecting backdoor data as training approaches convergence. To simulate the attack process efficiently, we train the diffusion models under the FL. framework for
CIFARI0 and CelebA. Then we use the pre-trained model for subsequent backdoor experiments. The

---

Table 1: DataStealing in Non-IID Datasets. Performance of AdaSCP compared the SOTA attack methods with various advanced defenses in non-lID distribution. "L": lower is better. Red: the 1st score. Blue: the 2nd score. (": averaging by ignoring the collapsed result.)
Dataset
Attacks
Delonses
FodAvg 37
Krum 2
Mulli-Kram Krum 2
Foolsgold
17
RFA [1]
Mulli-metrics 24
Meun
FID MSE
FID
MSE
FID L/MSE
FID L. L/MSE
FID /MSE
FID L/MSE
6,67/0.1226
10.090.11180
6.200.14227
7.700.1228
6.72001211
7,08/0.1213
7.450013044
CIFARIO
Model Poison
12.86000069
8,290. 1454
6,230.14266
459.6480.3124
6.1291.194
70.900.666
94.02801-992
PGD Poison
6.8690.222
19.98/0.2399
6.930.1221
7.450.1243
6.8500.2311
6.78/0.1228
9.1490.1332
BC Layer
[
5,7580.382
192.020.17199
603/0.143
6,670.1388
5.6400.188
6.69/0 1233
27.13/0 1441
(Our)))(Ours)
12.9300117
9168000861
8.250.1271
24.2100.0129
8.2200.233
15.040.0328
16.55H11657
Data Préson
200
5.91,0.1304
7.64/0.15 1520
6.13
6,230 1441
57440.1212
6.650M.9222
6 3880
CelebA
Poison
1.95
6.16001504
N/A
1502"
PGD Paison 53
8 1616
7.01/0.1462
8.0400.1435
6. 6.4900 1636
8,020. 1263
7,440 1362
7.53KI 1279
BC Layer Sub.
12.2900.1328
76.49/0.0536
15.6340.1204
10.1080.4417
18.36901119
17.08/0.1177
25.01/0.1177
AdaSCP (Ouns)
7.0000.0082
13.66/0.366
4.55/0.1312
1.36400103
6.200010229
7.6200.1044
7.73N00499
Data Poison
20
23 5305099999
12.28/0.2112
25.3180.1169
23.47001121
23 45A4,099
22.440.0862
21.7490.227
Model Poison
33 2090072
11,97/0.2577
13.318122339
404 2280
21 SOALOW94
174 3135
110.000 2063
Polson
23.4900.9976
11.95/0.2516
39.950.1476
129.222.2222
65/6660999
21.27/0.0966
27.7710.1368
BC Layer Sab
69
10.84801199
45.77/0.1157
12 1991
15 15.41611336
13 109003133
13.050 1354
18 1480111132 1328
AdaSCP (Ours)
22.30V0.054
51.1500.634
25. 15.81/011131
28.50000554
24.3600 34.36/0.116
22.26/0.0623
29.07/0.0941
Target
Multi- rram
Mubil mutricm
Larget
Moln-Kirm
metrics
FadAvg
Krum
Foolggold
RFA
FadAag
Krum
Faotegohd
RFA
Data Halson
Data Polson
Model Poisen
Modd Paisan
N/A
PGD
PGD
Layer
Layer
AdSCP
AdsCC
(a) CIFAR10
(b) CelebA
Figure 3: Qualitative Comparison. The generated image with the lowest MSE in one trigger-target pair is presented under every attack and defense method. More visual results are in Appendix A.
pre-training round number is 2,000 for CIFAR10 and 1,200 for CelebA. As for LSUN Bedroom, use the pre-trained weight from DDPMs (22).
Backdoor Attacks. Due to the considerable cost of training diffusion models, we simulated five local clients and selected one as the adversarial client. Based on the pre-trained model, we fine-tune 300 rounds for CIFARIO 10 and 150 rounds for CelebA and LSUN Bedroom in every client. We train 10,000 images per round per client for CIFAR-11 10 and CelebA, and 1,000 images for LSUN Bedroom. The patch size of ComboTss is x for CIFAR 10, 5 x 5 for CelebA, and 25 x 25 for LSUN Bedroom. The backdoor and benign datasets are mixed in one batch with a 50/50 ratio. For the attack algorithm, we select the common and latest attack methods as our baselines: Data Poison 20) Model Poison [1] PGD Poison (53) and Backdoor- Critical (BC) layer substitution 69 We set the scale value of model poison as the total number of clients (N₂ 5). We train about 80% parameters in our AdaSCP and layers in the BC layer substation for fair comparison. More details can be found in Appendix B
Defenses. To verify the effectiveness of DataStealing methods under defense strategies. we conduct experiments with various distance-basee defense methods: FedAvg [37], Krum [2]. Multi- (2), Foolsgold [17]. RFA 44, Multi-metricss 24 We observe that clipping and adding noise, commonly used in the differential privacy method
13 42 50]. will undermine the training diffusion models.
Therefore, do not consider these defenses in our experiments.
Evaluation. We leverage two metrics for evaluating the performance of diffusion models and the efficacy of DataStealing: 1) the Frechet Inception Distance (FID) (21). 2) Mean Square Error (MSE) between the generated backdoor images and the ground truth images. A lower FID score indicates that
7

---

Table 2: DataStealing in IT Dataset. Performance of our approach and the SOTA attack methods
with various advanced defenses in IID distribution.
Dataset
Attacks
Defenses
PodAvg
17
Multi-Kram
2
Foolagold
17
RFA
44
Multi-metrics
24
Mean
HID MSE
HDD /MSI
HID MSE
HID /// MSE
HD. /SSE
Poison
6.38/0.
1.53
6.39/0.1246
5.87/0.1242
6,10/0.1283
CIFARIO
Model Poison
8.4000.0033
5.52/0.1132
156.000.3109
5.88/0.1212
10:5500.0447
97.27H0.1173
PGD Poison [33
6.37/0.1248
6.17/0.1241
6.38/0.1222
6.35/0.1247
5.89/0.1248
6.23/0.1247
BC Layer Sub.
69
5.29/0. 1362
1.56/0.1340
5,25/0.1262
5.61/0.1308
5.38/0.1305
5.12/0.1315
AdaSCP (Ours)
8 8.599000088
7,09/0.2273
12.8490.645
7,0330.1265
8.75/0.220
8.869.0669
the generated images better match the distribution of real images, implying higher quality, A lower MSE means the restored images are more similar the private images, indicating better performance in DataStealing. To calculate FID, we generate 50,000 images for every model with CIFARI 10 and CelebA and 10,000 images for LSUN Bedroom. As for MSE, we synthesize 20 images with different noise inputs for every combinatorial trigger. All images are generated with 50-thmeett 50-timestep DDIM [48]
4.1 DataStealing under Advanced FL Defenses
To evaluate AdaSCP and attack baselines in DataStealing, conduct experiments CIFAR1O 30) CelebA (34] and LSUN Bedroom [62]. The target image count is 1,000 for the CIFARIO dataset, 500 for the CelebA dataset, and 50 for LSUN Bedroom.
Comparisons with Non-IID Datasets. We first consider the challenging non-IID distribu- tion. Both datasets are sampled with Dirichlet distribution of hyperparameter 0.7. As shown in Table [ our AdaSCP achieves the best at- tack performance according to MSE. The crit- ical parameters and adaptive scale factor en- able AdaSCP to evade the detection of most distance-based defenses. Additionally, the adap- tive scale prevents the inclusion of backdoor up- dates from devastating the overall training of the diffusion models. Although Model Poison [I] can achieve the aim of DataStealing under Fe- dAvg (12.8 12286/0.00 22.86/0.0069, value makes hard to defeat the advanced de- fenses or causes the training of diffusion model
14
0.14
12
0.12
0.08
0.06
FID. AdaSCP-FedAryy
AdaSCP Multikrum
MSE AdaSCP-Fed/vee
MAuSCP-Multikuu
0.02
0.00
10
500
1000
2500
Trigger Number
large and fixed scale
Figure 4: Ablation Study on Trigger Number.
collapse, as shown in Fig. Our adaptive scale solves these problems with an acceptable and proper scale value. PGD Poison (53) overcome all defenses in CIFARIO by constraining the updates within a limited range. However, the efficiency of this attack remains a significant con- cern. AdaSCP achieves the balance between stealthiness and efficiency. The results of BC Layer Substitution (69] show that is not a good choice for poisoning the diffusion model. The layer substitution process leads to training collapse in the diffusion model, especially under the defense of Krum (1 (2t.0220..119), This demonstrates that training critical parameters is more effective than layer substitution in attacking the diffusion model.
Compared to CIFARIO 10, AdaSCP more effective than other attacks in CelebA. We observe that the optimal lar, is 3.60 in CelebA under FedAvg, which is smaller than the corresponding value of 4.54 in CIFARIO and the total number of local clients. The difference means the data proportion in the infiltrated client is more unbalanced in CelebA than in CIFAR1O, which can affect the performance of attacking methods. Moreover, experiments on the LSUN Bedroom dataset demonstrate that AdaSCP can achieve the best attack performance on high- high-resolution images (256 x 256). This indicates that AdaSCP is more robust and effective with imbalanced and diverse data.
In summary, Data Poison and PGD Poison encounter difficulties in effectively implanting multiple backdoors. Model Poison fails to bypass advanced FL defenses due to improper scale values. BC Layer Substitution is unsuitable for training diffusion models and may lead to training collapse. AdaSCP outperforms other methods by utilizing critical parameters with adaptive scale factors, balancing stealth and efficiency while preventing training collapse in diffusion models.
8

---

Table 3: Ablation Study of AdaSCP. Incremental components are added in every row to evaluate
their function. Each component contributes to the overall performance.
Attacks
Defonses
FodArg
37
Krum 2
Multi-Krum 2
Fookgood
17
RFA [
Multi-metrics
21
Mean
FID / MSE.
FID MSSR
FID // MSE
FID MSR J
FID J MSR.
FID MSE.
Baseline
20
12.86/0.0069
8.29/0.145 1454
6,23/0.143
459.6440.3124
6.12/0.1194
70.98/0.1688 1685
92/0 1492
Critical Parameters
12. 560.0123
6,218011422
1180.3133
6.47/0.1249
30.59N0,0422
87.220 3002
Target Scale for,
12.97X00157
31 0.880000803
7.17/0.1398
18.2220.0273
10:32/0.1277
11.31A00554
18.64/0.0737
Learning Rate
12.7/0.0144
31,7700,864
7.16901339
20.68000077
7.23/0.1254
12.01/0.000
15.27/0.0722
History scales
12.9/0.0117
30.68/808611
8.23/0.1211
24.21000129
8,22/0.1233
15.04N00328
16.55/0.0657
Comparisons with IDD Dataset. Table[]shows the results of DataStealing on CIFARIO in IID
distribution. In this scenario, the attacker is easier to defeat the defenses. Model Poison [ success in cireumventing the defense of Multi-metrics [24] (10.55/0.0047) and exceed the PGD Poison on average. Our AdaSCP is still superior in attacking average (8, /8.8690.0699) It is because the adaptive scale can bypass defenses that other attack methods fail.
4.2 Ablation Study
Ablation on Each Component of AdaSCP. To verify our proposed AdaSCP, including the critical parameter training and adaptive scaling, we conduct an ablation study on each component. We adopt the model poison as our baseline and set the initial scale value as No. As Table. B shows, training with critical parameters helps the model defeat the Multi-metrics defense (30,59/) 59/0.0422) with a sacrifice of attack performance in FedAvg and RFA. is reasonable only about 80% parameters are included in the training. Furthermore, based on training critical parameters, we evaluate the effect of tar, by replacing s, with tar, directly. It shows that the estimated target scale tor, plays a critical role in defeating many defenses, which proves the effectiveness of our design. However, the deviation of training affects the accuracy of lar, and results in a decline in FedAvg (12.97/0.0157). Then we use tar, to optimize 8, with learning rate 1) that can alleviate the problem and can achieve slightly better performance. With the stabilization of history scales, we make progress in defeating Multi- Krumi (8.23/0.15 1271) and achieve the best performance on average. Moreover, the decrease in MSE for Multi-Krun and REA implies that they can be attacked by AdaSCP in a longer training.
Ablation on Different Trigger Number. To assess the impact of trigger quantity on DataStealing, we undertook ablation studies with incremental numbers of triggers with AdaSCP. Fig. I shows that reducing the number of target images increases the success of attacking. And it is increasingly hard to steal more data. Following a successful theft, the FID tends to remain at relatively high level. This represents one of the limitations of DataStealing. More experiments are listed in Appendix A
Discussion on Defense Mechanisms
To safeguard the training of diffusion models in FL, this section discusses potential defensive mecha- nisms for future research. First, Multi-Krum has shown strong performance in detecting and diluting malicious updates, preventing attacks from quickly degrading the global model's accuracy. However, as shown in Appendix I. its effectiveness diminishes over long-term training, suggesting future enhancements like adaptive thresholds (26) or combining with other methods (55). Second, differ- ential privacy methods can invalidate indicators by adding noise or norm clipping while sacrificing generative performance, as discussed in Appendix F Since AdaSCP requires specific indicators with a large magnification factor, identifying candidate indicators and filtering outliers through comparison could enhance efficiency and effectiveness in defending against DataStealing. Third, the durability experiment in Appendix A.2 demonstrates that backdoors diminish after 100 rounds of continued training with clean data, suggesting a potential mitigation strategy for future work [2]. Finally, as the triggers are embedded in the input noise, releasing only the generated outputs without exposing the global model could serve as an additional defensive strategy.
6 Related Work
Trojan Attacks on Diffusion Model. Trojan attacks 5 proposed recently. BadDiffusion [9] and Tioj [5) attack DDPMs 22
9 10
49 on diffusion models have been with an additional trigger

---

term in the forward/backward process. Struppek et al. 44 attacks the text-to-image diffusion models by adding triggers to the text inputs. VillanDiffusion [0] attacks various diffusion models and samplers with image or caption triggers in unified backdoor framework. In this paper, we show that diffusion models in FI. can also be subject to multiple Trojans with combinatorial triggers.
More methods [57 35 64
12 31
focus on backdoor poison with multiple distributed attackers or proposes three modules: constraint loss, noise masks, and decoy of these modules with the acceptance status ("Accepted",
optimizing the triggers. 3DFed 31
models. They adjust "Clipped" or "Rejected") based on the feedback of indicators. However, their indicators and decoy models require collaboration among multiple attackers, which does not align with our task that involves only a single malicious client. We leave DataStealing with multiple distributed attackers for future work.
Since Bagdasaryan et al. 1 point out that the widely- used FL algorithm FedAvg [37] is vulnerable to model replacement attack, plenty of backdoor attack methods [57 35 53
Trojan Attacks on Federated Learning.
12 (11 [4] 15 7 [64] 669 have subsequently emerged. Data poison [6] 20 9 attacks the global model by replacing the local training data with mixture of benign and backdoor datasets. Model poison M replaces the global updates with scaled malicious updates. PGD
65
33
poison [53 projects the local gradients into a sphere surrounding the global model. Backdoor- critical layer substitution [69] inserts the critical malicious layers to the benign models to balance the attack effectiveness and stealthiness. The above attack methods are applied to the classification task. We are the pioneers in investigating the issue of stealing massive private data under stringent security measures FL.. Furthermore, we propose AdaSCP to defeat the advanced distance-based defenses.
More Related Works. Various studies are related our work. A more detailed discussion of related research is provided in the Appendix D
7 Conclusion
In this paper, we explored the vulnerabilities of diffusion models within the FL framework, highlight- ing new avenues for privacy threats through proposed DttaStealing task. Even under rigorous local data protection, substantial private data can be exfiltrated from local clients by employing our ComboTs. Furthermore, we introduce AdaSCP, adaptive attack method, designed to circumvent advanced distance-based defenses. Our method adaptively seeks the optimal scale value with the indicators. It then trains and magnifies critical parameters, allowing for the seamless integration of backdoor gradients into the global model. Our extensive experiments not only confirm the efficacy of existing FL Trojan attacks and defenses but also highlight the superior performance of AdaSCP in circumventing advanced distance-based defenses. This work serves as a critical reminder of the vulnerabilities in FL and underscores the necessity for continuous advancement in defensive strategies to safeguard against evolving threats in the realm of generative models. We hope our findings will catalyze further research and prompt the FL community to prioritize the development of robust mechanisms to protect privacy in the increasingly complex landscape of machine learning models 38 59]
8 Limitations and Ethical Statements
Due to the limited page number, we discuss them in Appendix F
Acknowledgment
This work is supported by the National Key R&D Program of China (Grant No.2022ZD0160101,, Fundamental Research Funds for the Zhejiang Provincial Universities (Grant No. 01.-222-224-0002 National Key R&D Program of China (Grant N0.2021ZD01 12801), National Natural Science Foun- dation of China (Grant No. No.62306273) and Fundamental Research Funds for the Central Universities, Sun Yat-sen University (Grant No. 154.
10

---

References
[1] Eugene Bagdasaryan, Andreas Veit, Yiqing Hua, Deborah Estrin, and Vitaly Shmatikov. How to backdoor fedcrated learning. In International conference on artificial intelligence and statistics, pages 2938-22222 2948. PMLR, 2020.
[2] Peva Blanchard. Mahdi Mhamdi, Rachid Guerraoui, and Julien Stainer. Machine learning with adversaries: Byzantine tolerant gradient descent. Advances in neural information processing systems, 30, 2017.
[3] Franziska Boenisch, Adam Dziedzic, Roci Schuster, Ali Shahin Shamsabadi, Ila Shumailov, and Nicolas Papernot. When the curious abandon honesty: Federated learning is not private. In 2023 IEEE 8th European Symposium on Security and Privacy (EuroS&P), pages 175-199. IEEE, 2023.
[4] Nicolas Carlini, Jamic Hayes, Milad Nasr, Matthew Jagielski, Vikash Sehwag, Florian Tramer, Borja Balle, Daphne Ippolito, and Eric Wallace. Extracting training data from diffusion models. In 32nd USENIX Security Symposium (USENIX Security 23), pages 5253-5270, 2023.
[5] Weixin Chen, Dawn Song, and Bo Li. Trojdiff: Trojan attacks on diffusion models with diverse targets. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 4035-4044, 2023.
[6] Xinyun Chen, Chang Liu, Bo Li, Kimberly Lu, and Dawn Song. Targeted backdoor attacks on deep learning systems using data poisoning. arXiv preprint arXiv: 2017.
Siyuan Cheng, Guanhong Tao, Yingqi Liu, Guangyu Shen, Shengwei An, Shiwei Feng, Xiangzhe Xu, Kaiyuan Zhang, Shiqing Ma, and Xiangyu Zhang. Lotus: Evasive and resilient backdoor attacks through sub partitioonnnn. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 27899, 2024.
[8] Christopher A Choquette- Florian Tramer, Nicholas Carlini, and Nicolas Papernot. Label-only membership inference attacks. In International conference machine leorning, pages 1964-1974. PMIR, 2021.
[9] Sheng-Yen Yen Chou, Pin-Yu Yu Chen, and Tsung-Yi Yi Ho. How to backdoor diffusion models? In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 4015-4024, 2023.
[10] Sheng- Yen Chou, Pin-Yu Yu Chen, and Tsung-Y Yi Ho. Villandiffusion: A unified backdoor attack framework for diffusion models. Advances in Neural Information Processing Systems, 36, 2024.
[11] Florinel-Alin Croitoru, Vlad Hondru, Radu Tudor Tonescu, and Mubarak Shah. Diffusion models in vision: A survey. IEEE Transactions on Pattern Analysis and Machine Intelligence, 2023.
[12] Yanbo Dai and Songze Li. Chamelcon: Adapting to peer images for planting durable backdoors in federated learning. In International Conference on Machine Learning, pages 6712-6725. PMLR, 2023.
[13] Cynthia Dwork, Aaron Roth, al. The algorithmic foundations of differential privacy. Foundations and Trends Theoretical Computer Science, 9(344)2111400) 2014.
[14] Gongtan Fang, Xinyin Ma, and Xinchao Wang. Struetural pruning for diffusion models, Advances in neural information processing systems, 36, 2024.
[15] Pei Fang and Jinghui Chen. On the vulnerability of backdoor defenses for federated learning. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 37, pages 11800-1 1100,, 2023.
[16] Liam Fowl, Jonas Geiping. Wojtek Czaja. Micah Goldblum, and Tom Goldstein. Robbing the fed: Directly obtaining private data federated learning with modified models. arXiv preprint arXiv:2110.13055 2021.
[17] Clement Fung, Chris JM Yoon, and Ivan Beschastnikh. The limitations of federated learning in sybil settings. In 23rd International Symposiun on Research Attacks, Intrusions and Defenses (RAID 2020), pages 101-316,70 2020.
[18] Yuan Gan, Zongxin Yang. Xihang Yue, Lingyun Sun, and Yi Yang. Efficient emotional adaptation for audio-driven talking-head generation. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 22634-2266 2023.
[19] Jonas Geiping, Hartmut Bauermeister, Hannah Dröge, and Michael Moeller. Inverting gradients how easy is it to break privacy in federated learning? Advances in neural information processing systems. 11116937-16944 2020.
11

---

[20] Tianyu Gu, Brendan Dolan-Gavitt. and Siddharth Garg. Badnets: Identifying vulnerabilities in the machine learning model supply chain, arXiv preprint arXiv: 7677333..7.. 2017.
[21] Martin Heusel. Hubert Ramsauer, Thomas Unterthiner, Bernhard Nessler, and Sepp Hochreiter. Gans trained by two time-scale update rule converge a local nash equilibrium. Advances in neural information processing systems, 30, 2017.
[22] Jonathan Ho, Ajay Jain, and Picter Abbeel. Denoising diffusion probabilistic modcls. Advances in neural information processing systems, 33:6840 6851, 2020.
[23] Jiyue Huang, Chi Hong. Lydia Y Chen, and Stefanie Roos. Gradient inversion of federated diffusion models. arXiv preprint arXiv:2405.2038 2024.
[24] Siquan Huang. Yijiang Li, Chong Chen, Leyu Shi, and Ying Gao. backdoors federated learning. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 4652-4662, 2023.
adaptively identifies
[25] Xumin Huang, Peichun Li, Hongyang Du, Jiawen Kang, Dusit Niyato, Dong Kim, and Yuan Wu. Federated leamein-empoweree ai-generated content in wireless networks. IEEE Network, 2024.
[26] Jinyuan Jia, Zhuowen Yuan, Dinuka Sahabandu, Luyao Niu, Arezoo Rajabi, Bhaskar Ramasubramanian, Bo Li, and Radha Poovendran. Fedgame: game-theoretic defense against backdoor attacks in federated learning. Advances in Neural Information Processing Systems, 36, 2024.
[27] Fiona Victoria Stanley Jothiraj and Afra Mashhadi. Phoenix: federated generative diffusson model. arXiv preprint (.XXv:23306,00099 2023.
[28] Tero Karras, Samuli Laine, and Timo Aila, A style-based generator architecture for generative adversarial networks. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 4401-4410, 2019.
[29] James Kirkpatrick, Razvan Pascanu, Neil Rabinowitz, Joel Veness, Guillaume Desjardins, Andrei A Rusu, et al. Overcoming catastrophic
Kieran Milan, John Quan, Tiago Ramalho, Agnieszka forgetting in neural networks. Proceedings of the national academy of sciences, 14(13):3521-3526, 2017.
[30] Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. 2009.
[31] Haoyang Li. Qingqing Ye, Haibo Hu, Jin Li, Leixia Wang, Chengfang Fang, and Jie Shi. 3dfed: Adaptive and extensible framework for covert backdoor attack in federated learning. In 2023 IEEE Symposium on Security and Privacy (SP), pages 1893 1907. IEEE, 2023.
[32] Chao Liang, Fan Ma, Linchao Zhu. Yingying Deng, and Yi Yang. Caphuman: Capture your moments in parallel universes. In Proceedings of the IEER/CVF Conference Computer Vision and Pattern Recognition, pages 6400-6409, 2024.
[33] Yingqi Liu, Shiqing Ma. Yousra Aafer, Wen-Chuan Lee, Juan Zhai, Weihang Wang, and Xiangyu Zhang. Trojaning attack neural networks. In 25th Annual Network And Distributed System Security Symposium (NDSS 2018). Internet Soc, 2018.
[34] Ziwei Liu, Ping Luo, Xiaogang Wang, and Xiaoou Tang. Deep learning face attributes in the wild. In Proceedings of International Conference on Computer Vision (ICCV), December 2015.
[35] Xiaoting Lyu, Yufei Han, Wei Wang, Jingkai Liu, Bin Wang. Jiqiang Liu, and Xiangliang Zhang. Poisoning with cerberus: Stealthy and colluded backdoor attack against federated learning. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 37, pages 9020-9028, 2023.
[36] Zhanyang I Lyu, Xudong Xu, Ceyuan Yang, Dahua Lin, and Bo Dai. Accelerating diffusion models via early stop of the diffusson process. arXiv preprint arXiv:2205. 125224. 2022.
[37] Brendan McMahan, Eider Moore, Daniel Ramage, Seth Hampson, and Blaise Aguera y Arcas. Communication-effiiin learning of deep networks from decentralized data. In Artificial intelligence and statistics, pages 1273 1282. PMLR, 2017.
[38] Jiaxu Miao, Zongxin Yang, Leilei Fan, and Yi Yang. Fedseg: Class-heterogeneous federated learning for semantic segmentation. In Proceedings of the IEEE/CVF Conference Computer Vision and Pattern Recognition, pages 8042-8052, 2023.
[39] Pavlo Molchanov, Stephen Tyree, Tero Karras, Timo Aila, and Jan Kautz. Pruning convolutional neural networks for resource efficient inference. arXiv preprint arXiv:1611.06440, 2016.
12

---

[40] Milad Nasr, Reza Shokri, and Amir Houmansadr. Comprehensive privacy analysis of deep learning: Passive and active white-box inference attacks against centralized and federated learning. In 2019 IEEE symposium on security and privacy (SP), pages 739-753. IEEE, 2019.
[41] Dung Thuy Nguyen, Tuan Minh Nguyen, Anh Tuan Tran, Khoa D Doan, and KOK SENG WONG. Tha; Towards inreversible backdoor attacks in federated learning. In Thirty-seventh Conference on Neural Information Procexsing Systems. 2023.
[42] Thien Duc Nguyen, Phillip Rieger, Roberta De Viti, Huili Chen, Bjöm B Brandenburg, Hossein Yalame, Helen Möllering, Hossein Fereidooni, Samuel Marchal, Markus Miettinen, al. (FLAME]]: Taming backdoors in federated learning. In 31st USENIX Security Symposium (USENIX Security 22). pages 1415-1432, 2022.
[43] Mustafa Safa Ozdayi, Murat Kantarcioglu, and Yulia R Gel. Defending against backdoors in federated learning with robust learning rate. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 35, pages 9268-9276, 2021.
[44] Krishna Pillutla, Sham M Kakade, and Zaid Harchaoui. Robust aggregation for foderated learning. IEEE Transactions on Signal Processing, 70:1142-115 2022.
[45] Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Bjöm Ommer. High-resoltiion image synthesis with latent diffusion models. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 10684-10695, 2022.
[46] Victor Sanh, Thomas Wolf, and Alexander Rush. Movement pruning: Adaptive sparsity by fine-tuning. Advances in neural information processing systems, 33:20378- 2020.
[47] Reza Shokri, Marco Stronati, Congzheng Song, and Vitaly Shmatikov. Membership inference attacks against machine learning models. In 2017 IEEE symposium on security and privacy (SP), pages 3-18. JEEE, 2017.
[48] Jiaming Song. Chenlin Meng, and Stefano Ermon. Denoising diffusion implicit models. arXiv preprint arXiv:2010.02502,, 2020.
[49] Lukas Struppek, Dominik Hintersdorf, and Kristian Kersting. Rickrolling the artist: Injecting invisible backdoors into text-guided image generation models. arXiv preprint (xXi::2211.02444 6(7), 2022.
[50] Ziteng Sun, Peter Kairouz, Ananda Theertha Suresh, and H Brendan McMahan. Can you really backdoor federated learning? arXiv preprint arXiv: 1w..//9.10099. 2019.
[51] Lin Tun, Chu Myaet Thwal, Su Yoon, Sun Moo Kang, Chaoning Zhang, and Choong Seon Hong. Fed- erated learning with diffusion models for privacy-sensitive vision tasks. In 2023 International Conference on Advanced Technologies for Communications (ATC). pages 305-310, IEEE, 2023.
[52] Paul Voigt and Axel Von dem Bussche. The eu general data protection regulation (gdpr). Practical Guide, 1st Ed., Cham: Springer International Publishing, 1063152676;:0--5555, 2017.
[53] Hongyi Wang, Kartik Sreenivasan, Shashank Rajput, Harit Vishwakarma, Saurabh Agarwal, Jy-yong Sohn, Kangwook Lec, and Dimitris Papailiopoulos. Attack of the tails: Yes, you really can backdoor federated learning. Advances in Neural Information Processing Systems, 33:16070-16084, 2020.
[54] Pengyu Wang, Yuan Gan, Pampan Shui, Fenggen Yu, Yan Zhang, Songle Chen, and Zhengxing Sun. 3d shape segmentation via shape fully convolutional networks. Computers Graphics, 76:1 182- 2018.
[55] Shuaiqi Wang. Jonathan Hayase, Giulia Fanti, and Sewoong Oh. Towards defense against federated backdoor attacks under continuous training. arXiv preprint arXiv:2205.1 2022.
[56] Ryan Webster. A reproducible extraction of training images from diffusion models. arXiv preprint wrXiv:2305.08694 2023.
[57] Chulin Xie, Keli Huang, Pin-Yu Yu Chen, and Bo Li. Dba: Distributed backdoor attacks against federated learning. In International conference on learning representations, 2019.
[58] Ling Yang, Zhilong Zhang, Yang Song. Shenda Hong, Runsheng Xu, Yue Zhao, Wentao Zhang, Bin Cui, and Ming-Hsuan Yang. Diffusion models: A comprehensive survey of methods and applications. ACM Computing Surveys, 56(4): 1-39, 2023.
[59] Yi Yang. Yueting Zhuang, and Yunhe Pan. Multiple knowledge representation for big data artificial intelligence: framework, applications. and case studies. Frontiers of Information Technology & Electronic Engineering, 22112):151111 11558, 2021.
13

---

[60] Dong Yin. Yudong Chen, Ramchandran Kannan, and Peter Bartlett. Byzantine-robust distributed learning: Towards optimal statistical rates. In International Conference Machine Learning, pages 5650-5659. Pmlr, 2018
[61] Hongxu Yin, Arun Mallya, Arash Vahdat, Jose M Alvarez, Jan Kautz, and Pavlo Molchanov. See through gradients: Image batch recovery via gradinversion. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 16337-16346, 2021.
[62] Fisher Yu, Ari Seff, Yinda Zhang, Shuran Song, Thomas Funkhouser, and Jianxiong Xiao. Lsun: Con- struction of a large-scale image dataset using deep learning with humans in the loop. arXiv preprint AxXiv:506.003660 2015.
[63] Friedemann Zenke, Ben Poole, and Surya Ganguli. Continual learning through synaptic intelligence. In International conference on machine learning, pages 3987-3995. PMLR, 2017.
[64] Hangfan Zhang, Jinyuan Jia, Jinghui Chen, Lu Lin, and Dinghao Wu. A3fi: Adversarially adaptive backdoor attacks to federated learning. In Thirty-seventh Conference on Neural Information Processing Systems, 2023.
[65] Zhengming Zhang, Ashwinee Panda, Linyue Song, Yaoqing Yang, Michael Mahoney, Prateck Mittal, Ramchandran Kannan, and Joseph Gonzalez. Neurotoxin: Durable backdoors in federated learning. In International Conference on Machine Learning, pages 26429 26446. PMLR, 2022.
[66] Joshua Christian Zhao, Atul Sharma, Ahmed Roushdy Elkordy, Yahya H Ezzeldin, Salman Avestimehr, and Saurabh Bagchi. Loki: Large-scale data reconstruction attack against federated Icarning through model manipulation. In 2024 IEEE Symposium on Security and Privacy (SP), pages 30-30, IEEE Computer Society, 2023.
[67] Xingehen Zhou, Ming Xu, Yiming Wu, and Ning Zheng. Deep model poisoning attack on federated learning. Future Internet, 13(3):73, 2021.
[68] Ligeng Zhu, Zhijian Liu, and Song Han. Deep leakage from gradients. Advances in neural information processing systems, 32, 2019.
[69] Haomin Zhuang, Mingxian Yu, Hao Wang, Yang Hua, Jian Li, and Xu Yuan. Backdoor federated learning by poisoning backdoor-critical layers. International Conference on Learning Representations, 2024.
14

---

A Additional Experiments
We conduct more experiments on CIFARIO to evaluate the performance AdaSCP with different settings and hyperparameters.
A.1 Attacking in Extended Training
We conducted an experiment to demonstrate that existing defense mechanisms struggle to prevent successful attacks by adversaries over extended training periods. While AdaSCP fails to succeed within 300 rounds on CIFAR-10 under the defense of Multi Multi-Krum in Table the outcome changes when the duration extended to 1500 rounds. As shown Fig. 5 AdaSCP can successfully defeat Multi-Krum defenses given more training time. Furthermore, longer stable attack is more stealthy and has fewer side effects on the performance of the diffusion model, which 8.55/0.0088 in round 1 1,500 compared to the similar result of attacking Foolsgold 24.21/0.0129 in Table I
0.16
0.10
MSE
0.08
0.06
4-
FID AdaSCP-MultiKrum
0.04
2-
MSE AdaSCP-MultiKrum
0.02
0.00
100
200
300
400
500
600
700
800
900
1000
1100
1200
1300
1400
1500
Round
Target image:
Figure 5: Attacking in an Extended Training. Given more time, AdaSCP can attack successfully under the defense of Multi-Krum in the Non-IID distribution of CIFAR10.
A.2 Durability of AdaSCP Attack
The durability of a backdoor measures the time span an inserted backdoor continues to be effective after the attacker withdraws. To assess the durability of our AdaSCP attack, we continue training an attacked model (AdaSCP-FedAvgy) with benign data and FedAvg protocol. As shown in Fig. 6 the backdoors implanted by AdaSCP remain effective for approximately 100 rounds. After 100 rounds. the backdoors become almost ineffective as the MSE is higher than 0.1. Moreover, the FID decreases with further training. This suggests a defense strategy for DataStealing: continuing to train with benign data after the initial training can effectively mitigate the impact of multiple backdoors.
12
10
0.10
0.08
0.06
FID FedAvg
0.04
MSE FedAug
250
Round
Figure 6: Durability of AdaSCP Attack. The attacked model (AdaSCP-FedAvg) is trained with benign data and clients in FedAvg. The changes in MSE and FID reflect the disappearance of the implanted backdoors.
15

---

A.3 Analysis on Defending against Malicious Updates
To better understand the defense process, we analyze the distance between malicious and mean benign updates under Krum and Multi-Krun defense across different training rounds. Compared to other defense algorithms, Krum and Multi-Krum display more pronounced variations in distance. The results in Fig- show that the initial scale value is substantially higher than the optimal value. This discrepancy causes the initial distance the malicious updates to be approximately 6.7 times greater than that of the benign updates. As AdaSCP progressively optimizes the scale value, malicious updates gradually align with those benign updates, approaching the optimal relative distance necessary for the attack to bypass the defenses.
Relative Distance
AdaSCP-KK Krum
10
20
30
50
60
70
80
100
Round
Figure 7: Relative Distance. Ratio of malicious updates distance mean benign updates distance when attacking with AdaSCP on CIFAR 10 in the first 100 rounds.
A.4 AdaSCP Stability Assessment
To evaluate the stability of AdaSCP, conducted experiments with two additional seeds, resulting three distinct Non-IID data distributions. Our results are presented as mean + standard deviation, shown in Table The values in the "Mean" row represent the overall mean and standard deviation of the averaged values obtained from the three different seeds. The "Mean" values in Table [ show a tolerable deviation from the previously reported results, indicating the robustness of our method to variations in Non-IID data distributions.
Table 4: Repeating Experiment of AdaSCP in CIFAR10 and CelebA with Non-IID Distribution.
Dataset
CIFARIO
CelebA
Defenses
FID
MSE
FID
MSE
FedAvg
10.46=1.77
0.0118=0.000
6.94--0.33
0.0092+0.0014
Krum
20.31
0.0856:0.0208
11.90=1.33
0.0611+00.094
Multi-Krum
8.07=0.22
0.1284=0.0012
4.74=0.22
0.1507=0.0141
Foolsgold
15.21
0.0044-0.0035
8.55110.1
0.017910.0103
RFA
8.37-10.22
0.1176=0.0131
7.46-10.89
0.1360-10.0334
Multi-metrics
11.17:22.74
0.0365=0.0150
7.47-1.18
0.0195
Mean
12.2613.05
0.0657=0.0086
7.84
0.0657+000015
A.5 Ablation on Proportion of Critical Parameters
To assess the impact of the proportion r in selecting critical parameters, we conducted ablation study presented in [5] The results indicate that more critical parameters lead to better attack performance. However, the performance with r = 0.99 is as effective as with 0.8, suggesting that some parameters are redundant in attacking. Consequently, we selected - = 0.4 in other experiments to achieve trade-off between performance and the critical parameter count, which contains approximately 80% of the parameters. To ensure fair comparison, we maintain the same percentage of parameters in the BC Layer substitution.
16

---

Table 5: Ablation Study on the Proportion of Critical Parameters.
Proportion 7
0.2
0.4
0.6
0.8
0.99
AdaSCP-FedAAg
11.29/0.1211
12.93/0.0117
12.41/0.0081
12.49/0.0077
12.25/0.0077
A.6
Ablation on Learning Rate in Optimizing Scale
To investigate the impact of different learning rates y on the performance of AdaSCP under the defense of FedAvg and Multi-Krum, we conducted an ablation study in Table It shows that at relatively lower learning rates, the training process is more stable and effective. When 7/ 0.2, AdaSCP achieves better performance while minimizing side effects on the FID of generated data. Hence, we adopt fj 0.2 in our paper.
Table 6: Ablation Study the Learning Rate of Optimizing Scale.
Learning rate
0.0
0.2
0.4
0.6
0.8
1.0
AdaSCP-FedAwy
12.94/0.0108
12.93/0.0117
15.38/0.0119
12.87/0.0130
13,06/0.0115
12.82/0.0144
AdaSCP-MultiKrmi
6.23/0.1424
8.23/0.1271
10.20/0. 1266
7.83/0.129 1297
7.96/0.
8.19/0.
1959 1259
Mean
9.58/0.0766
10.58/0.0694
12.79/0.0692
10.35/0.0713
10.51/0.0702
10.50/0.0701
A.7
Ablation on Patch Size of ComboTs.
To verify the impact of different patch sizes in ComboT's in DataStealing, conducted ablation study with various patch sizes. Table[]sshows that for CIFARIO images (32 x 32), a 3 x 3 patch is the minimum size capable of successfully executing the attack. Although larger patches in attacking, they would harm both FID and MSE. Smaller patches are insufficient to distinguish the triggers from the noise, while larger patches obscure the image and degrade performance. Therefore, we set the patch size to 3 x 3 in CIFAR 10. For CelebA, we increased the patch size to 5 x 5 because (64 64), which is twice the resolution of CIFAR-10. As
also succeed
the images in CelebA are preprocessed for LSUN Bedroom, we choose 25 x 25 patch size for attacking (256 x 256) images.
Table 7: Ablation Study on the Patch Size of ComboTs.
Patch Size
AdaSCP-Fedaa
1
13.69/0.1283
3 x
3
12.93/0.0117
5 x 5
12.51/0.0133
7 7 7
02.25/0.0204
9 x 9
13.25/0.0263
11 x 11
12.54/0.029 02298
13 x 13
1..99/00034
15 x 15
14.17/0.0396
A.8 Ablation on Total Number of Clients.
To verify the effectiveness of our method across varying numbers of clients, we conducted experiments by increasing the total number clients from 5 to 10. The results in TableBdemonstrate that AdaSCP remains effective in executing attacks across different client numbers, confirming its robustness.
A.9 Complexity and Computational Analysis
The complexity of ComboTs depends on the time required to select triggers from potential positions, as defined in Section 3.2 The efficiency of AdaSCP is influenced by the batch size and hyperparam-
17

---

Table 8: Ablation on Total Number of Clients.
Num of Clients
5
10
AdaSCP-FedAvg 12.93/0.0117 17
10.79/0.0182
10.35/0.0177
eter T (threshold), demonstrated in Appendix C.I and Algorithm 4 The primary source of complexity is the process of searching for critical parameters and identifying candidate indicators. The runtime of AdaSCP varies based different hyperparameters and model complexity. For example, when finetuning with the LSUN bedroom dataset at a resolution of 256 x 256, with a batch size of 3 and a hyperparameter T set to 0.05, the runtime for finding critical parameters and candidate indicators is minutes and 29 seconds. This process is performed after all candidate indicators are exhausted, as demonstrated in Algorithm In our experiments, set the number of candidate indicators 10. Increasing the number of candidate indicators can enhance the efficiency of our method.
A.10 More Visual Comparison
Further visual comparisons presented in Fig. 8 and Fig. 10 targets suggests that our method is applicable across various image types and can achieve superior performance. Moreover, the results indicate that the training of the diffusion model within the FL system reveals greater privacy security vulnerabilities than those observed in discriminative models.
The diversity of content in these
B Backdoor Attacks Implementation
Dataset and Implementation Details. We implement all experiments on four 48G NVIDIA A40 GPUs. When estimating the importance score, we adopt a batch size of 64 for CIFAR10 and CelebA and for LSUN Bedroom. The Non-IID distribution of CIFAR10 and CelebA used in Table are shown in Table 9 The first client is chosen for attack. The FID/MSE of the pretrained model is 6.24/0. 1428 CTFAR1O, 10, 6.00/0. 1507 CelebA, and 9.84/0.25535 2594 LSUN Bedroom. needs to be noted that we preprocess the CelebA with the pre-processing code from StyleGAN 28 repository The batch size is 128 for CIFARIO, for CelebA and for LSUN Bedroom.
PGD Poison. Projected Gradient Descent (PGD) attack [33] guarantees that the malicious model sent by the attacker would not rejected by the norm-based defenses when the norm updates less than a radius. We note that the original radius is too small to attack the diffusion model. Hence, we set the radius as to achieve tradeoff between the effectiveness and stealthiness of the PGD attack.
BC Layer Substitution. To defeat the advanced defenses in classification tasks, critical layers (69 are effective. However, DataStealing poses two challenges in estimating the critical layers: 1) There no such efficient metric as Backdoor Success Rate (BSR) to justify the importance of every layer. The low sampling efficiency of diffusion models makes such method impractical. 2) The diffusion model exhibits a substantially increased layer number relative to previously employed architectures like R8sNet18, which further increases the difficulty in finding critical layers. Hence, for the BC
layer substitution attack, we adopt the momentum-basee importance score 46 15 to identify the critical layers.
18

---

Target
Malii-Krmn
Footogold
Mali Molii-matrics
Target
Malii-Kram
Foolgaod
Malii-matric
FidAyg
Kram
RFA
FidAng
Kram
Datn Prieon
Data Polson
Madld Poisem
Mode Puisan
PGD Puison
PGD Poison
BC I Layer Suh.
BC Layer Suit,
AdaSCIP
AdsSCP
Target
Malli-Kram
Malli Malli-mutrice
Target
MaltiKKrm
Malli-matric
FidAyg
Krom
Fostsgold
RFA
FidAvg
Kram
Fooisgold
RFA
I Layer
Layer
AdsCP
AddSCP
Target
Mali- Krota
Maliimmtrric
Target
Malii Krom
Molfimetrics
FudAng
Kram
Footoood
RFA
FelAyg
Krant
Foolgold
Data Polson
Data Polson
Model Poison
Model Poison
PGD Puison
PGD Paison
BC I ayer Sth.
BC Layer Suit.
AdsSCP
AdsSCP
Figure 8: More Visual Results of CIFAR10 in Non-IID Distribution.
19

---

Tayd
Malli-Krom
Motl-meirris
Target
Malli-Kram
Multi-netrica
Foologad
Foohsgol
FedArg
Krum
RFAt
FedArg
Krum
RFA
Poison
Model Polsan
N/A
Model Polson
NA
PGD Poisan
PGD Pobsn
BC Layer Sulx
BC Layer Sub
AdaSCIP
AdsSCP
Target
Mall- Krom
Molif-meint meeiim
Target
Muti-KEram
Matri-meirio
FodAyg
Krom
Foobgold
RFA
FulAv
Kram
Fonlgold
REA
Data Polson
Data Polson
Model Puisn
N/
Model Prisan
NA
PGD Poison
PGD Poiscn
Layer
Layer
AdsSPP
AdsSCP
Tanyt
Mali-KKum Krom
Molti-merrics
Taryst
Mulit-Knn Malmt-Kram
Multi Multi-merric miiiimmnrriie
Finbsged
Fanbgold
FidAag
Krom
RFA
FidAvg
Krom
RFA
Polson
Data Poison
Model Poisons
Model Paison
NI
Layer
Layer
AdsSCP
AdaSCP
Figure 9: More Visual Results CelebA in Non-lID Distribution.
20

---

Target
Multi Multi-metrics
Multi-Krum
Foolsgold
FedAvg
Krum
RFA
Data Poison
Model Poison
PGD Poison
BC Layer Sub.
AdaSCP
Target
Multi-metrics
Multi-Krum
Foolsgold
FedAvg
Krum
RFA
Data Poison
Model Poison
PGD Poison
BC Layer Sub.
AdaSCP
Figure 10: Visual Results of LSUN Bedroom in Non-IID Distribution.
21

---

Targets
Sampled Images
1
1
7
1
1
1
1
1
Targets
Sampled Images
2
2
2
G
G
Figure 11: Sampled Images with Different Noise. We visualize the sampled images in CIFAR10 and CelebA attacked by our AdaSCP under FedAvg. These images are generated with the same trigger and different Gaussian noise.
22

---

C More Algorithms of AdaSCP
C.1 Diffusion Importance Estimation
Algorithm 4 demonstrates the process of estimating the parameter importance with accumulated gradients in dominant timesteps under the Taylor expansion framework, as described in the liter- ature [14]. The timesteps used estimate the importance score have higher loss values than the others. Hence, we refer to these timesteps as dominant timesteps (Line 7). After estimating the importance score of the diffusion model, create mask of critical parameters Mg with the top structural elements from all scores (Line 15). While estimating the importance score, we record the accumulated gradients | and their Hessian matrix Hol to subsequently find indicators (Lines 11-12 and 16-18).
Algorithm 4 Diffusion Importance Estimation
Input: Indicator-restored global model wg and its parameter 0, parameters for finding indicators benign datasets Dbenign a threshold T, proportion 7 Output: Accumulated gradients |aa),, Hessian matrix |Hc], critical parameter mask Mg
1: Lmmx 5-0
2: zo ~ Doenign (O, 1)
3: for in 1,,........ 7 do
4: It x va + /I alE
5:
f col 12
b Loss of diffusion model
6: Lmax max Lmax, Li)
7:
if Li/Lmax I T then
Consider dominant timesteps in diffusion model
8:
break
9:
end
10:
Vo,, z0) back poock-rrpagation(C((e
Taylor expansion
11:
Gradj, +- autograd (6)
b. Gradient for finding indicators
12:
HessE, autograd Gradja))
Hessian matrix for finding indicators
13: end for
I(O,.z) t Ej Bij E.zo (0,
> Structural importance score
15: Mc + Select top x of structural elements in I(O,, x)
Create critical parameter mask D. Absolute value of accumulated gradients Absolute value of accumulated Hessian matrix
16: lwai + 1E$ Gradg.sl
17: |Hl + EE Hessg,al
18: return wha,, |Hl, Ma
Algorithm 5 Train Critical Parameters
Input: Indicator-restored global model wa. datasets Dbenign, Dbackdoor- current scale 8y, critical parameter mask Mc, blend weight 7 Output: The scaled malicious model we,
1: repeat
2: To ~ Dbenign: (0o, 8;) ~ Dhackdoor
3:
t,t ~ Uniform( ((1, (I,,..,,T})
4:
It vaizo + vI- axe
Benign noise Trojan noise
5:
dr, + Vargo, + /1 ar(*e 7)6+)
6:
F. [Kt, 8 := 1 Ec
7:
AØ Take the gradient step onVolii co (3,,,,8)1
O is the trainable parameters
8:
AO' + (A0:1 | Ma(i) True}
9:
0+ A0'
Only update critical parameters
10:
until reach the sample limits in one round
Wy + WG + sy A0'
> Scale the updates critical parameters
12: return
23

---

C.2 Train Critical Parameters
Algorithm 5 iillustrates the process of training the critical parameters with benign dataset and backdoor dataset. We train benign and backdoor data in batch (Line 2-7). With Eq. and Eq. 2 we add benign noise and Trojan noise into the corresponding data. After training the diffusion model, we only update the critical parameters with the mask Mg (Line 8 and 9). Finally, we scale the accumulated malicious updates with st and return the scaled model Wyy.
C.3 Optimize Scale
Algorithm Gillusttrtes the process optimizing the scale value according to the estimated target scale value and history scale values. According to the purpose of tar,, demonstrated in Eq. []] the scale value is better be close tar,, Hence, when "Accepted" by the server, the previous scale value ST-1 can defeat the defense and should move toward tar, to achieve better attacking performance (Line 1-5). To prevent tar, from greatly exceeding the previously rejected scale, the 20th percentile value of the sorted hisrey is used as the upper boundary for tar,, illustrated in Algorithm 7 Then we optimize the scale value with the current optimal target tar (Line 4) and set the flag of the previous accepted state Acceptpre True.
When "Rejected" by the server, tar, will be 0 and the scale value should be decreased defeat the defenses (Line 7-11). To avoid the optimized scale sy. being significantly lower than the accepted scales, we find the optimal scale with Algorithm [8] Specifically, the medium value of the sorted hisace is adopted as the lower bound for s,. If a malicious update was previously "Accepted" but now "Rejected", we reduce the learning rate by multiplying it with a weight decay factor. This adjustment is made based on the value of the flag Acceplpre- Finally, we set the flag of the flag Acceplpre to False.
Algorithm 6 Optimize Scale
Input: Target scale lars, previous scale 8,-1, scale learning rate v), scale weight decay Output: Current scale 8,
1: if tor, (0, Ne] then
"Accepted" then move toward tor,
2: Append 8 to hisace then sort hiSace ascending
3: lar; +- FindOplimalT arrenn/ttrrgtsttarrrr (lar,,,isrree)
Refer Algorithm 7
4:
8r + - + (Lar 87-1)
5:
Acceplare True
6:
else
"Rejected" then decrease the scale
7:
Append S,-1 to hisrey then sort hisref ascending
8:
S + Sr (tar, - -r-11 -T7
9:
9, + F-FndlptimalSaaee(kk hisace)
Refer Algorithm > Learning rate decay
10:
Acceppe then 1 t- n-6
Acceptpre False
12: end if return 8,
Algorithm 7 Find Optimal Targets
Algorithm 8 Find Optimal Scale Value
Input: Target value tar,, history rejected scale values hisrej
Input: Optimised scale value s',, history ac- cepted scale values hissae
Output: Current optimal target value lar
Output: Current optimal scale value 8,
1: if len(hisres) > 10 then
1: if len(hisace) > 10 then
2:
medrej &- crisreglen(hhise])
medace hhisacc (lenhllleehheeeee /2]
3: tar + min(tar,, medres)
3: 8p + maax(s',, medacs)
4: else
4: else
5:
tar + tars
5:
8, +- 8,
6: end if
end
7: return larg
7: return S,
24

---

C.4 Restore and Dequeue Candidate Indicators
Algorithm Dillustrates the process of restoring and dequeuing the candidate indicators. Specifically, we set the indicator update into the value before magnifying. To alleviate the impact of magnifying the indicator update, we remove the used indicator and use the other indicators. Hence, we dequeue the front element in the queue of candidate indicators and prepare for implanting the new indicator in the round.
Algorithm 9 Restore and Dequeue Candidate Indicators
Input: Indicator magnification factor k, uploaded indicator f 1.71 previous candidate indicators 1y-1
Output: Current candidate indicators 4, indicator-restored global model wg
1: Ow, 1-G, 1.41 & O' w Gr-1.4
Restore the indicator to get we Remove the front element
2: 1y-1---eeue -dqquuu)
3: return 4r
D Mathematical Derivation of the Optimal Scale
Theorem 1: ET= A:/Aado is the optimal scale value of the adversary client to replace the updates with the malicious update.
Proof of Theorem 1: According the aggregation process of FL 37 50], the server updates the global model with the updates from clients. To simplify the analysis, we assume the learning rate of the server is Given ne clients participating in the aggregation, we can get the server's updating equation:
G, = Gr-1+ E, AeOW...- Σ
where W/ represents the trained local model in the i-th client, and X is the weight for averaging. To simplify the notation, let A0; denote the update of the local model Ow O Then the updating of the server can be represented as:
G, Gr- Σ. X,A0;
E A
To proof that Er=
Xi/Nun Aadv the optimal scale value, we scale the adversary updates to Aoadu- Then we can get:
Sa de
Andv
G - G Adade E AAO; X
(5)
When training converges, A0, is upproaching zero and the global updates can be replaced by the malicious updates Adadu.
Theorem 2: Since the gradient and curvature approaching zero, assume that the training update at indicator 1ı is similar in every client. Under the assumption, the target scale value 0e--G,-1171 when the indicator-implancee malicious model T. I. ap-14
E >s/dadu = - where f
is "Accepted" by the server.
Proof of Theorem 2: We will derive the target scale value En Ai/Xade according to the implanted indicator. Given the indicator I₁, we can get the returned indicator update fg.-Gr-1.d, Let AlG. represent lG.-Gr-1.1 and A6' A denote the uploaded indicator update H' 6¹ get the following equation:
w. 1..-1-G.--111 We can
Aado AP' Al
adv. + Ene A:A0i.
Al
(6)
En d; BadukAlado + Eie A,10..1
(7)
>1 X
25

---

where A6 dd =
kA as the training update at I1 is magnified by k to form the implanted indicator. Since the gradient and curvature are approaching zero at position 7,, we assume the training update 20,,, between each client is similar. Then Eq. 7 can be re-written as:
Aado (k 1)A0ndu, J1 + EE A;
A0G.1
(8)
Ex=1 X;
By rearranging Eq.
the target scale value Ei= A Xado can be derived:
E A
(l-
1)
(9)
Nadv
AlG.I.
Aadv,
h-1
(10)
1
Badv.11
k
(11)
/
Alc.11 G which is used in the Algorithm 3 Line 1. In our experiments,
where f
Dnao,71 F-0 1.-141
is set to 50. When "Rejected" by the server, AfG.,, is nearly equal to i and f close to under our assumption. Considering the deviation introduced by training, the result of Eq. [1] is either negative or a very large number. Hence, we set the "Accepted" range to (0, 2- Ne]. Then the equation of target scale value tor, is:
{
# E (0,2 No]
tar
(12)
otherwise
The equation is used in the Algorithm value according to the results of tar.-
3
Line 2. As illustrated in Sec.
3.3
we will optimize the scale
Table 9: The non-lID distribution with five clients used in our experiments.
Client 1
Client 2
Client 3
Client 4
Client 5
Total
CIFARIO 30
11,020
10,873
6,743 45,587
5,744
15,620 35,633
50,000
CelebA 33
56,324
60,342
4,713
202,599
E More Related Works
Defenses Against Trojan Attacks. Recently, the defense methods against Trojan attacks have achieved great progress. These methods can be broadly categorized into two types according to their algorithms. The first type is distance-based defenses (2) 60 17
24
26 They try to distinguish
the malicious updates from uploaded gradients according to distance or scores and then aggregate updates that have undergone filtering. The second type of defenses 43
50) is based on differential privacy algorithm [3), which use clipping and adding noise to defense backdoor attacks. However, we notice that these techniques will lead the diffusion model collapsing or failing to converge. Hence, we utilize several advanced distance- methods in this paper.
42
24 as the defense strategies
Data Reconstruction Attack. Despite only sending updates in FL, prior works have demonstrated
that attackers can still obtain information about private training data through various techniques [8] 40
47.56] 4 19
61 68, 3 16, (66]. Membership inference attacks [8] 40 47 56 4 involve determining
whether specific data sample was part of the model's training dataset by analyzing the model's outputs. However, they require large amount of model output data for training and the original data for analysis. more common and potentially more dangerous methods are the gradient-based reconstruction approaches. Gradient Inversion attacks [19
68 23 in FL involve reconstructing the original training data from the gradient updates shared between clients and the server. Linear Layer Leakage (LLL) attacks [ [6 66) exploit the gradients of fully connected layers to infer
61
26

---

and reconstruct the input data. Gradient- maased attack methods, which rely entirely on the gradient information, are explored on deterministic models and suffer from low data recovery quality. Unlike these attack methods, our work focuses on diffusion models and can accurately and efficiently reconstruct large amounts of specified training data through numerous Trojans.
F Limitations and Ethical Statements
Although AdaSCP can defeat many distance-based defenses, there are still some limitations. After successful multiple backdoor attack, the FID slightly increases, which +10.31 in CIFARIO and +1.73 in CelebA. Designing better triggers may reduce the impact of the multi-backdoor attack the FID, making the attack more covert. Some defense mechanisms, such as norm clipping or differential privacy methods, render indicators' effectiveness. However, such approaches are not suitable for training diffusion models, as they can easily lead to non-convergence with norm clipping in FL, the FID of the pre-trained model is 80.82, which is 6.24 without the norm clipping. We leave these limitations for future research.
redicator-based attacks ineffective. These methods compromise the
model collapse. When pre-training the diffusion model
While our framework aims to enhance the robustness of diffusion models FL, we recognize the potential for misuse of our findings in more computer vision tasks [8] 32 54 38 59
Nonetheless, raising awareness about this issue can lead to the adoption of stricter security standards in the design and implementation of training diffusion models with FL, thereby minimizing the risks of data breaches and misuse. We hope our red-teaming effort can draw more attention from the federated learning (FL) community the critical privacy security issues associated with diffusion models.
27

---

NeurIPS Paper Checklist
1. Claims
Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Question:
Answer: [Yes]
Justification:
We included the paper's contributions in the abstract and introduction.
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made in the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or
NA answer to this question will not perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results
be expected to generalize other settings.
is fine to include aspirational goals as motivation as long is clear that these goals are not attained by the paper.
2. Limitations
Question: Does the paper discuss the limitations of the work performed by the authors?
Answer: [Yes]
Justification:
We discussed the limitations in Appendix
Guidelines:
The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create separate "Limitations" section in their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well-specification. asymptotic approximations only holding locally). The authors should reflect how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution low images are taken in low lighting. Or speech-to-text system might be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach address problems of privacy and faimess.
While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, a worse outcome might be that reviewers discover limitations that aren't 't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an impor- tant role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.
3. Theory Assumptions and Proofs
Question:
For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
Answer: [Yes]
28

---

Justification:
We proof the Theorem and 2 in Appendix D
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated or referenced the statement of any theorems.
The proofs can either appear the main paper or the supplemental material, but they appear in the supplemental material, the authors are encouraged to provide short proof sketch to provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental Result Reproducibility
Does the paper fully disclose all the information needed to reproduce the main ex- perimental results of the paper to the extent that it affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?
Question:
Answer: [Yes]
Justification: We included the details of our algorithms Sec. 3.3 and Appendix code will be released upon the publication of our paper.
The
Guidelines:
The answer NA means that the paper does not include experiments. If the paper includes experiments, No answer this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is novel architecture, describing the architecture fully might suffice, or if the contribution is a specific model and empirical evaluation, it may be necessary to either make possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g.. in the case of large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.
While NeurIPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) If the contribution is primarily a new algorithm, the paper should make it clear how reproduce that algorithm. (b) If the contribution is primarily
model architecture, the paper should describe the architecture clearly and fully.
(c) If the contribution is a new model (e.g., a large language model), then there should either be way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset instructions for how to construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome deseribe the particular way they provide for reproducibility, In the case of closed-source models, it may be that access to the model is limited in some way (e.g., registered users), but it should be possible for other researchers to have some path to reproducing or verifying the results.
5. Open access to data and code
Question: Does the paper provide open access to the data and code, with sufficient instruc- tions to faithfully reproduce the main experimental results, as described in supplemental material?
29

---

Answer:
[Yes]
Justification:
The code is released in: https//ghhhhbb.om//yyaggaDaDDDDl
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurIPS code and data submission guidelines (https://nips.c cc/
for more details.
While we encourage the release of code and data, we understand that this might not be possible, "No" is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (c.g., for new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurIPS code and data submission guidelines (https Cooeeeoodeesssseeeeee 7/nips.com / casssnnnnccccyyc for more details.
The authors should provide instructions on data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. If only subset of experiments are reproducible, they should state which ones are omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information as possible supplemental material (appended the paper) is recommended, but including URLs to data and code is permitted.
6. Experimental Setting/Details
Question: Does the paper specify all the training and test details (c.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary understand the results?
Answer: [Yes]
Justification: Please refer to Sec. and Appendix B for experimental details.
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core the paper to a level of detail that is necessary appreciate the results and make sense of them.
The full details can be provided either with the code, appendix, as supplemental material.
7. Experiment Statistical Significance
Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Answer: [Yes]
Justification: We conducted repeated experiments with various data distributions, and the error bars are provided Appendix A.4
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by error bars, confi- dence intervals, statistical significance tests, least for the experiments that support the main claims of the paper.
The factors of variability that the enror bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
The assumptions made should be given (e.g., Normally distributed errors).
30

---

It should be clear whether the error bar is the standard deviation or the standard error of the mean.
is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful not to show in tables figures symmetric error bars that would yield results that are out range (e.g. negative error rates).
If error bars are reported in tables or plots, The authors should explain the text how they were calculated and reference the corresponding figures tables in the text.
8. Experiments Compute Resources
For each experiment, does the paper provide sufficient information on the com- puter resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?
Question:
Answer: [Yes]
Justification: Please refer to Appendix B for the GPU type used in our experiments.
Guidelines:
The answer NA means that the paper does not include experiments.
The paper should indicate the type of compute workers CPU GPU, internal cluster, or cloud provider, including relevant memory and storage.
The paper should provide the amount of compute required for each of the individual experimental runs as well as estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't make it into the paper).
9. Code Of Ethics
Question: Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics
Answer: [Yes]
Justification:
We acknowledge the Code of Ethics and obey them in our paper.
Guidelines:
The answer NA means that the authors have reviewed the NeurlPS Code of Ethics.
If the authors answer No, they should explain the special circumstances that require deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g., there a special consid- eration due to laws or regulations in their jurisdiction).
10. Broader Impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [Yes]
Justification:
The ethical statements can be found in Appendix F
Guidelines:
The answer NA means that there no societal impact of the work performed.
If the authors answer NA or No. they should explain why their work has no socictal impact why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
31

---

The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is a direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.
If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition attacks, mechanisms for monitoring misuse, mechanisms to monitor how system learns from feedback over time, improving the efficiency and accessibility ML).
11. Safeguards
Does the paper describe safeguards that have been put in place for responsible release of data or models that have a high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Question:
Answer: [NA]
Justification: Our paper is based on publicly available datasets and models.
Guidelines:
The answer NA means that the paper poses no such risks.
Released models that have a high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make best faith effort.
12. Licenses for existing assets
Question: Are the creators or original owners of assets (e.g.. code, data, models), used in the paper. properly credited and are the license and terms of use explicitly mentioned and properly respected?
Answer: [Yes]
Justification: We cited the datasets and codes used in our paper. All datasets and codes used in paper publicly available.
Guidelines:
The answer NA means that the paper does not use existing assets.
The authors should cite the original paper that produced the code package dataset.
The authors should state which version of the asset is used and, if possible, include URL.
The name of the license (c.g., CC-BY 4.0) should be included for each asset.
For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided.
If assets are released, the license, copyright information, and terms of use in the batasets.papersstt paperswi thcode. cww/ datasets package should be provided. For popular datasets,
has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.
32

---

If this information is not available online, the authors are encouraged to reach out to the asset's 's creators.
13. New Assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [NA]
Justification:
We do not release assets.
Guidelines:
The answer NA means that the paper does not release new assets,
Researchers should communicate the details of the dataset/code/moodl as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent was obtained from people whose asset is used.
At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.
14. Crowdsourcing and Research with Human Subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well details about compensation (if any)?
Answer: [NA]
Justification:
The paper does not involve crowdsourcing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsoureing nor research with human subjects.
Including this information in the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then as much detail as possible should be included in the main paper.
According the NeurIPS Code of Ethies, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional Review Board (IRB) Approvals or Equivalent for Research with Human Subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?
Answer: [NA]
Justification: The paper does not involve crowdsourcing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing research with human subjects.
Depending on the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere to the NeurlPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.
33


Reviews:
[{"review_id": "uznXS3qIdp", "reviewer": "Reviewer_H1Y5", "summary": "This paper studies the privacy risks of diffusion models in federated learning (FL) through the lens of data stealing attacks. The authors propose the ComboTs method to target a large amount of images. To further defeat advanced distance-based FL defenses, the authors propose the AdaSCP attack method which adaptively scales the critical parameters in the updating process. The evaluation results demonstrate the effectiveness of this attack.", "questions": "This paper explores the data leakage risks of diffusion models in federated learning. The authors conduct the data stealing attack via backdoor attacks. To target a large amount of images and bypass the advanced FL defenses, the authors propose the ComboTs and AdaSCP methods, respectively. The evaluations showcase the effectiveness of the proposed data stealing attack.  \n\nHowever, there are still some critical issues.\n\n- The attack settings are problematic. In this paper, the attacker is assumed to have access to the training dataset of the poisoned client, such that the attacker can insert the backdoor triggers into the target images, and finally the attacker will be able to recover the target images according to their backdoor trigger patterns. However, since the attacker already has access to the target images, why bother stealing them using the proposed complex methods? Just because of the so-called \"Under strict data privacy protection, attackers can not upload or download images from the infiltrated client\" in Section 3.1? This assumption does NOT make any sense. The attacker can even check every pixel value of the target image to locally reconstruct it without downloading it from the client. I would suggest the authors clearly re-explain the motivation and the settings of the attack. \n\n- The authors mentioned the FID metric to measure the performance of diffusion models. However, the authors did not clearly claim either higher or lower FID is better. Furthermore, when discussing the evaluation results, the authors only focused on the MSE score. I would suggest the authors elaborate more on this metric if they use it as an evaluation metric. \n\n- The authors only conduct the experiments on two image datasets with low resolutions. I would suggest the authors also evaluate the performance of their attack on another dataset with a much higher resolution, e.g., a subset of ImageNet.", "limitations": "See my detailed questions", "rating": 6, "confidence": 3, "soundness": 2, "presentation": 3, "contribution": 2, "strengths": "- The first work to consider the privacy risks of diffusion models under the FL setting\n- Good performance with low MSE of the recovered images", "weaknesses": "- Problematic attack settings\n- Insufficient experiments and explanations", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for your constructive comments. We address your concerns below:\n\n**Response to Q1:**\n1) **Access to data does not mean it can be stolen.** \n\n- Federated Learning (FL) aims to protect data privacy by only sending model updates to the central server. In the FL setting, private data **cannot** leave the client. The assumption that an attacker can check every pixel value to locally reconstruct target images conflicts with the federated learning framework, where only model updates are transmitted, not raw data.\n- FL is often used to train models on highly sensitive or valuable data, such as medical records. In the era of deep learning, data is a critical asset and involves organizational security issues. According to *Article 5 and Article 32 of the European Union General Data Protection Regulation (GDPR)*[1], organizations are required to take strict measures to protect data privacy and security. For such highly protected data, some organizations enforce strict access controls, including banning USB drives, restricting network access, and disabling copy-paste, ensuring data cannot be downloaded from the client. In this environment, sending unauthorized messages would trigger security alarms. However, model updates are authorized for transfer in the FL system. Thus, it is practical that attackers can infiltrate the training process and implant backdoors to steal data but do not have the ability to extract data straightforwardly in the FL framework. The malicious goal can be secretly achieved by modifying the training code of the client without any risky transmission.\n\n2) **An example to enhance FL trustworthiness and security.** \n\n- People might assume that advanced federated learning frameworks are sufficiently secure and overlook this potential danger. However, a false sense of security can be more dangerous and may be used for malicious purposes, such as espionage. Our work is the first to demonstrate that training diffusion models under the FL setting poses a threat of leaking thousands of images by implanting multiple backdoors, which control the generative behavior by only uploading model updates in FL. Our aim is to enhance the trust and security of FL and protect data privacy in the end. \n\nWe will add more key details to the introduction to ensure that readers can more easily understand our setting in the revised manuscript.\n\n[1] Voigt, P., & Von dem Bussche, A. (2017). The eu general data protection regulation (gdpr). *A Practical Guide, 1st Ed., Cham: Springer International Publishing, 10*(3152676), 10-5555.\n\n**Response to Q2:**\n\nThank you for your suggestion. In Table 1, we have indicated that \"&darr;\" means lower is better. The FID (Fréchet Inception Distance) evaluates the quality of generated images by calculating the Fréchet distance between the feature distributions of generated and real images in a pre-trained Inception network. A lower FID indicates that the generated images are closer to real images, implying higher quality. The FID becomes very high when the diffusion model experiences training collapse, which mainly occurs in Model Poison and BC Layer Substitution due to improper scale rates and training approaches (Lines 278-281). As for AdaSCP, successful multiple backdoor attacks result in a slight increase in the FID score, averaging +10.31 on CIFAR-10 and +1.73 on CelebA compared to the pre-trained diffusion model, as demonstrated in Appendix F (Lines 663-666). This effect can be alleviated with longer training, as shown in Appendix A.1 (Lines 503-505). Since FID cannot directly reflect the performance of implanted backdoors, we primarily focus on comparing the MSE metric. More details about FID are provided in the Appendix. In the revised version of the main paper, we will add more details to help readers better understand the FID metric and the table results.\n\n**Response to Q3:**\n\nThank you for your suggestion. We conducted an additional experiment with the LSUN bedroom dataset, which has a higher resolution of 256x256. More details can be found in our global response and the PDF file.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "AlUekXlUV5", "reviewer": "Reviewer_CPaA", "summary": "The paper titled \"DataStealing: Steal Data from Diffusion Models in Federated Learning with Multiple Trojans\" investigates a novel privacy vulnerability in federated learning (FL) when training diffusion models. The authors introduce a new attack methodology named DataStealing, which leverages multiple Trojans to exfiltrate private data from local clients. The attack utilizes Combinatorial Triggers (ComboTs) to map extensive data and proposes the Adaptive Scale Critical Parameters (AdaSCP) attack to bypass advanced FL defenses.\n\n**Key Contributions:**\n* 1\\. **Identification of Vulnerability**:\n\n    - The paper identifies a new privacy threat in FL where diffusion models can leak substantial private data. Despite stringent privacy measures, attackers can exploit these models to steal high-quality local data.\n\n* 2\\. **Combinatorial Triggers (ComboTs)**:\n\n    - A method to select multiple triggers for backdoor attacks, significantly increasing the capability to map and steal large amounts of private data.\n\n* 3\\. **Adaptive Scale Critical Parameters (AdaSCP)**:\n\n    - An attack strategy that evaluates and scales critical parameter updates, making the malicious updates indistinguishable from benign ones. This circumvents distance-based defenses effectively.\n\n* 4\\. **Experimental Validation**:\n\n    - Extensive experiments demonstrate the ability of the proposed methods to leak thousands of images from training diffusion models in an FL setup. AdaSCP is shown to be highly effective against advanced FL defenses.\n\n**Conclusion**:\n\nThe paper highlights the severe privacy risks associated with training diffusion models in FL and calls for more robust defensive measures to protect against such vulnerabilities. The findings emphasize the need for continuous advancements in FL security to safeguard private data.", "questions": "**Questions and Suggestions for the Authors**\n\n**Questions**\n\n* 1\\. **Defense Mechanisms**:\n\n    - What proactive defense strategies do you suggest to mitigate the vulnerabilities identified in the paper? Have you considered evaluating existing defense mechanisms or proposing new ones specifically tailored to counter the DataStealing attack?\n\n* 2\\. **Comparative Analysis**:\n\n    - Can you provide a more detailed comparative analysis with specific prior studies on backdoor and Trojan attacks in federated learning? How do your proposed methods significantly advance the state-of-the-art compared to these existing approaches?\n\n* 3\\. **Scalability and Generalizability**:\n\n    - How do you anticipate your proposed attack methodologies (ComboTs and AdaSCP) will perform on more diverse datasets and in real-world scenarios? Have you considered evaluating your methods on other datasets or federated learning frameworks to validate their scalability and generalizability?\n\n* 4\\. **Parameter Sensitivity**:\n\n    - Can you provide a more systematic analysis of how different parameters (e.g., proportion of critical parameters, patch sizes in ComboTs) influence the effectiveness of the attacks? Detailed ablation studies on these parameters would be beneficial for understanding the robustness of your methods.\n\n* 5\\. **Complexity and Computation**:\n\n    - What are the computational costs and complexities associated with implementing your proposed methods (ComboTs and AdaSCP)? How feasible is it to execute these attacks in practical settings, considering the required computational resources and time?\n\n**Suggestions**\n\n* 1\\. **Proactive Defense Strategies**:\n\n    - Include a dedicated section discussing potential defense strategies to mitigate the vulnerabilities identified. This could involve theoretical approaches, proposed defense mechanisms, or an exploration of existing techniques that could be adapted to counter DataStealing.\n\n* 2\\. **Enhanced Comparative Analysis**:\n\n    - Deepen the comparative analysis with prior work, providing detailed discussions on how your proposed methods advance the state-of-the-art in backdoor and Trojan attacks in federated learning. This can help in better contextualizing the novelty and significance of your contributions.\n\n* 3\\. **Broaden Experimental Validation**:\n\n    - Expand the experimental scope to include more diverse datasets and configurations. Conduct a systematic analysis of various parameters influencing the attack's effectiveness, with detailed ablation studies. This would strengthen the empirical validation and demonstrate the broader applicability of your findings.\n\n* 4\\. **Simplify Technical Explanations**:\n\n    - Simplify the technical explanations where possible to make the paper more accessible to a broader audience, including those without a deep technical background in the specific area. This would enhance the overall readability and impact of the paper.\n\n* 5\\. **Detailed Discussion on Limitations**:\n\n    - Include a more detailed discussion on the limitations of your proposed methods. Address potential challenges and constraints in implementing the attacks, and suggest future research directions to overcome these limitations.\n\nBy addressing these questions and suggestions, the authors can provide a more comprehensive and impactful contribution to the research area, enhancing the clarity, robustness, and significance of their work.", "limitations": "**Assessment of Limitations and Potential Negative Societal Impact**\n\n**Addressed Limitations**\n\n* 1\\. **Technical Limitations**:\n\n    - The authors briefly mention the limitations related to the computational complexity and scalability of their proposed methods. They acknowledge the challenges in training diffusion models with ComboTs and the sensitivity of these models to gradient updates.\n\n* 2\\. **Experimental Constraints**:\n\n    - The paper indicates that the experiments were conducted on specific datasets (CIFAR10 and CelebA) and acknowledges the need for further validation on more diverse datasets and real-world scenarios.\n\n* 3\\. **Defensive Measures**:\n\n    - There is a mention of the need for further research to develop robust defensive mechanisms against the identified vulnerabilities in federated learning, suggesting an awareness of the current gap in defensive strategies.\n\n**Potential Negative Societal Impact**\n\n* 1\\. **Privacy and Security Risks**:\n\n    - The paper highlights significant privacy risks associated with federated learning, especially when training diffusion models. The authors acknowledge the potential misuse of the proposed attack methodologies to steal private data, underscoring the importance of addressing these vulnerabilities to protect user privacy.\n\n**Constructive Suggestions for Improvement**\n\n* 1\\. **Detailed Discussion on Limitations**:\n\n    - The authors should provide a more comprehensive discussion on the limitations of their proposed methods. This could include:\n\n        - A deeper exploration of the computational costs and complexities associated with implementing ComboTs and AdaSCP.\n\n        - An assessment of the scalability and generalizability of the proposed methods across different datasets and federated learning frameworks.\n\n        - Potential challenges in deploying these attacks in real-world scenarios, considering practical constraints and resource limitations.\n\n* 2\\. **Proactive Defense Strategies**:\n\n    - Include suggestions or preliminary evaluations of potential defense mechanisms to counter the DataStealing attack. This would provide a more balanced view and contribute to advancing the field by not only identifying vulnerabilities but also proposing ways to mitigate them.\n\n* 3\\. **Ethical Considerations and Responsible Disclosure**:\n\n    - The authors should discuss the ethical considerations and responsible disclosure practices followed in conducting this research. This could include:\n        - Steps taken to ensure that the research does not cause harm.\n        - Collaboration with organizations or communities to address the identified vulnerabilities responsibly.\n        - Suggestions for policy or regulatory measures to protect against the misuse of such attack methodologies.\n\n* 4\\. **Broader Societal Impact**:\n\n    - Expand on the broader societal impact of the research by discussing:\n        - How the findings could influence the development of privacy-preserving technologies in federated learning.\n        - The implications for industries and applications relying on federated learning, such as healthcare, finance, and IoT.\n        - Potential benefits of raising awareness about these vulnerabilities to foster more robust and secure machine learning practices.\n\n**Conclusion**\n\nThe authors have made a good start in addressing the limitations and potential negative societal impacts of their work. By providing a more detailed discussion on these aspects and incorporating the constructive suggestions above, the authors can enhance the comprehensiveness and responsibility of their research. This approach would contribute positively to the field and ensure that the research is conducted and presented in an ethically sound and impactful manner.", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "**Strengths of the Paper**\n**Originality**\n- **New Vulnerability Identification**: The paper identifies a previously unrecognized vulnerability in federated learning (FL) when using diffusion models, termed as DataStealing. This identification highlights a novel attack surface in the intersection of generative models and FL.\n- **Innovative Attack Methodologies**: The introduction of Combinatorial Triggers (ComboTs) and the Adaptive Scale Critical Parameters (AdaSCP) attack represents significant originality. ComboTs utilize multiple triggers to enhance the attack’s capability, while AdaSCP circumvents advanced defenses by adaptively scaling critical parameter updates.\n- **Creative Combination of Techniques**: The paper creatively combines the concepts of Trojans in generative models with adaptive scaling techniques to formulate an effective attack strategy against FL systems.\n\n**Quality**\n\n- **Rigorous Experimental Validation**: The paper presents extensive experiments to validate the effectiveness of the proposed attack methodologies. The results are comprehensive, demonstrating the ability of AdaSCP to defeat various advanced FL defenses.\n\n- **Detailed Methodological Explanation**: The methodologies are described in detail, with clear explanations of the underlying principles and the implementation of the attack strategies. This thorough presentation ensures that the proposed methods are reproducible and verifiable.\n\n- **Robustness of Results**: The experimental results are robust, showing consistent performance across different datasets (CIFAR10 and CelebA) and FL settings (IID and non-IID distributions).\n\n**Clarity**\n\n- **Well-Organized Structure**: The paper is well-organized, guiding the reader logically from the identification of the problem to the proposed solutions and experimental validation.\n\n- **Clear Writing Style**: The writing is clear and concise, making complex technical content accessible. Each section is well-articulated, with smooth transitions that maintain the reader’s engagement.\n\n- **Effective Use of Visual Aids**: Figures and tables are used effectively to illustrate key points and results. These visual aids enhance the reader’s understanding of the methodologies and the significance of the findings.\n\n**Significance**\n\n- **High Relevance to Privacy and Security**: The paper addresses a critical issue in the domain of FL, highlighting significant privacy risks associated with training diffusion models. The identified vulnerabilities and proposed solutions are highly relevant to the ongoing discussions about data privacy and security in machine learning.\n\n- **Impact on Future Research**: The findings of this paper are likely to stimulate further research in the field, prompting the development of more robust defense mechanisms in FL. By uncovering new attack strategies, the paper sets the stage for advancements in both attack and defense techniques.\n\n- **Broad Applicability**: The proposed methodologies and findings are not limited to a specific application but are broadly applicable to various domains where FL and generative models are used. This broad applicability enhances the overall significance of the paper.\n\n**Conclusion**\n\nThe paper \"DataStealing: Steal Data from Diffusion Models in Federated Learning with Multiple Trojans\" excels in originality, quality, clarity, and significance. It introduces novel vulnerabilities and attack methodologies in FL, backed by rigorous experimental validation and clear presentation. The contributions of this paper are highly relevant to the research community and hold significant potential for future advancements in privacy and security in machine learning.", "weaknesses": "**Weaknesses of the Paper**\n\n**Limited Discussion on Defense Mechanisms**\n\n- **Lack of Proactive Defense Strategies**: While the paper thoroughly explores the vulnerabilities and proposes robust attack methodologies, it falls short in discussing proactive defense mechanisms. It would significantly benefit from suggesting or exploring potential defense strategies to mitigate the identified vulnerabilities. Including a section on how to strengthen FL systems against such attacks would provide a more balanced view.\n\n**Depth of Contextualization**\n- **Comparative Analysis with Prior Work**: Although the paper positions its contributions within the broader context of federated learning and privacy security, a deeper comparative analysis with specific prior studies would enhance its impact. For example, more detailed comparisons with existing backdoor and Trojan attack methodologies would help in highlighting the advancements made by this work.\n- **Exploration of Related Work**: The related work section could be expanded to include a more comprehensive review of similar vulnerabilities in federated learning and generative models. This would help in better contextualizing the novelty and significance of the proposed methods.\n\n**Experimental Scope**\n- **Scalability and Generalizability**: While the experiments are robust, they are limited to specific datasets (CIFAR10 and CelebA) and certain configurations (IID and non-IID distributions). Exploring the scalability and generalizability of the proposed attack methodologies to other datasets and real-world scenarios would strengthen the empirical validation. For instance, including more diverse datasets or different FL frameworks could provide insights into the broader applicability of the findings.\n\n- **Extended Analysis of Parameters**: The paper briefly touches upon the impact of various parameters, such as the proportion of critical parameters and patch sizes in ComboTs. A more detailed and systematic analysis of how these parameters influence the attack's effectiveness across different settings would be beneficial. Including ablation studies on a wider range of parameters and configurations would offer a deeper understanding of the methods' robustness.\n\n**Presentation Improvements**\n\n- **Simplifying Technical Explanations**: Some sections of the paper, particularly those explaining the technical details of the methodologies, could be simplified for better readability. This would make the paper more accessible to a broader audience, including those who may not have a deep technical background in the specific area.\n\n- **Enhanced Flow and Readability**: Improving the flow and readability of certain sections, particularly the methodology and experiment results, would enhance the overall presentation. Ensuring smoother transitions between sections and sub-sections would maintain the reader’s engagement and comprehension.\n\n**Specific Suggestions for Improvement**\n\n* 1\\. **Incorporate Proactive Defense Mechanisms**: Add a section discussing potential defense strategies to mitigate the vulnerabilities identified. This could include theoretical approaches, proposed defense mechanisms, or an exploration of existing techniques that could be adapted.\n* 2\\. **Expand Comparative Analysis**: Deepen the comparative analysis with prior work, providing detailed discussions on how the proposed methods advance the state-of-the-art in backdoor and Trojan attacks in FL.\n* 3\\. **Broaden Experimental Validation**: Expand the experimental scope to include more diverse datasets and configurations. Conduct a systematic analysis of various parameters influencing the attack's effectiveness, with detailed ablation studies.\n* 4\\. **Simplify and Enhance Readability**: Simplify technical explanations where possible, and improve the overall flow and readability of the paper. This could involve rephrasing complex sections and ensuring smooth transitions between different parts of the paper.\n\nBy addressing these weaknesses, the paper can further solidify its contributions and provide a more comprehensive and impactful addition to the research area.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for your thorough review and appreciation of the novelty and experiments of our work. We address your concerns below:\n\n**Response to \"Discussion on Defense Mechanisms\"**:\n\nThank you for your suggestion. Here is our discussion on the defense mechanisms:\n\n-\tAccording to Table 1 and Fig.3 in the main paper, Multi-Krum shows the best defense performance, followed by RFA. Under the Multi-Krum defense, no attack strategy can rapidly compromise the global model to achieve MSE below 0.1 within the designated round. This is mainly because Multi-Krum is effective at detecting malicious updates. When the attacker uses a small scale to bypass Multi-Krum, the defense mechanism can still dilute the malicious update by weighted averaging the remaining updates. Although the experiment in Appendix A.1 shows that the defense is not reliable with longer training, Multi-Krum could be a good start for future work.\n-\tAdditionally, the differential privacy algorithm can render indicators invalid while sacrificing generative performance, as discussed in Appendix F (Lines 666-671). This is mainly because noise or norm clipping treats all parameters uniformly. Since AdaSCP requires specific indicators with a large magnification factor, locating candidate indicators and filtering outliers after comparison with other updates would be more efficient and effective. This method is preferable to comparing the distance of all parameters, which tends to average out outliers and makes it difficult to filter out malicious clients.\n-\tMoreover, the experiment in Appendix A.2 shows that our backdoors diminish after 100 rounds of continued training with clean data, suggesting a potential mitigation strategy for future work. Lastly, since the triggers are implanted in the input noise, releasing only the generated results without exposing the model parameters is another viable defense.\n\nWe will add a new section to discuss the potential defense mechanisms and mitigations of *DataStealing* backdoors.\n\n**Response to \"Comparative Analysis\":**\n\nThank you for your suggestion. We have discussed AdaSCP in comparison with prior attack methods in Section 4.1 (Lines 263-281). In summary, Data Poison and PGD Poison encounter difficulties in effectively implanting multiple backdoors into diffusion models. Model Poison fails to overcome advanced FL defenses due to improper scale values. BC Layer Substitution is unsuitable for training diffusion models and results in training collapse. Our AdaSCP outperforms other methods by using critical parameters with adaptive scale factors, which balance stealth and efficiency and prevent training collapse in diffusion models. We will add a conclusion to Section 4.1 to help readers understand the advantages of our method.\n\n**Response to \"Scalability and Generalizability\":**\n\nThank you for your suggestion. We conducted an additional experiment with the LSUN bedroom dataset, which has a higher resolution of 256x256. More details can be found in our global response and the PDF file.\n\n**Response to \"Extended Analysis of Parameters\":**\n\nThank you for your suggestion. We will expand the analysis of the impact of various parameters in Appendix A. As for the proportion of critical parameters, the results in Appendix A.3 show that 0.4 is the trade-off point between the performance and critical parameter count. As for the patch size of ComboTs, the results in Appendix A.5 indicate that a 3x3 patch achieves the best performance. Smaller patches are insufficient to distinguish the triggers from the noise, while larger patches obscure the image and degrade performance. We will add more details to enhance the parameter analysis.\n\n**Response to \"Complexity and Computation\":**\n\nThe complexity of ComboTs depends on the time of selecting the triggers from potential positions, as defined in Section 3.2 (Lines 123-125). For AdaSCP, the efficiency is influenced by the batch size and a hyperparameter, threshold $\\mathcal{T}$, demonstrated in Appendix C.1 and Algorithm 4. The complexity primarily arises from the process of searching for critical parameters and identifying candidate indicators. The time consumption of AdaSCP is various with different hyperparameters and the model complexity. For example, when finetuning with the LSUN bedroom dataset, the resolution is 256x256, the batch size is 3 and the hyperparameter $\\mathcal{T}$ is 0.05, the running time for finding critical parameters and candidate indicators is 2 minutes and 29 seconds. This process is conducted after all candidate indicators have been exhausted, as demonstrated in Algorithm 1. In our experiments, we set the number of candidate indicators to 10. Enlarging the number of candidate indicators is a way to increase the efficiency of our method.\n\nWe will add more details for the complexity analysis in the revised version.\n\n**Response to \"Presentation Improvements\":**\n\nThank you for your suggestion. To enhance the readability of our paper, we will polish the entire manuscript and move some details to the Appendix.\n\n**Response to \"Limitations\":**\n\nAs discussed above, we will include an additional section on the proactive defenses against *DataStealing*. Due to ethical considerations and responsible disclosure, we will assist researchers and managers in preventing the exploitation of this vulnerability. Raising awareness about this issue can lead to the adoption of stricter security standards in the design and implementation of training diffusion models with FL, thereby minimizing the risks of data breaches and misuse. Additionally, we will release our code to encourage the development of more advanced privacy-preserving mechanisms.\n\nFurthermore, we will expand the discussion to cover the limitations and potential societal impacts on privacy-preserving technologies in FL and relevant industries.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "t8NRdyvOdQ", "reviewer": "Reviewer_wpRh", "summary": "The paper introduces a novel attack method named DataStealing, which exploits vulnerabilities in diffusion models trained in Federated Learning (FL) systems. The authors highlight that diffusion models, despite their advanced capabilities in data generation, present new privacy threats when integrated with FL. They propose a method called Combinatorial Triggers (ComboTs) to steal images by embedding multiple backdoors in the diffusion models. To counteract distance-based FL defenses, they introduce an Adaptive Scale Critical Parameters (AdaSCP) attack that evaluates the importance of parameters and adaptively scales malicious updates to evade detection. Extensive experiments validate the effectiveness of AdaSCP in stealing private data from diffusion models.", "questions": "NA", "limitations": "The authors discussed the limitations and potential negative societal impact of the work in Appendix.", "rating": 7, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "Strengths\n\n1. Novelty and Relevance: The paper proposes a new task, which performs data stealing from diffusion models trained in FL. Due to the popularity of diffusion models and FL systems, it points out an emerging threat in this critical area.\n\n2. Clarity: The paper is well-organized and easy to follow. It considers scenarios where defenses are available and proposes an adaptive method to evade the defenses.\n\n3. Experiments: The authors conduct experiments on two image datasets, comparing their methods against various state-of-the-art attacks and defenses, providing an empirical foundation for their claims.", "weaknesses": "Weaknesses:\n\n1. Defense Mechanisms: A discussion on potential defense mechanisms or mitigations would make the work have better impacts in this area and further highlight the significance of the threat.\n\n2. Assumptions: In the experiments, the proportion of malicious clients is 1/5, which might not be realistic in real practice.\n\n3. More Experiments: The attack is evaluated on two datasets (CIFAR10 and CelebA). Expanding the evaluation to include more diverse datasets could further support the work.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for your insightful comments and high appreciation of the innovation and experiments in our work. We address your concerns below:\n\n**Response to W1:**\n\nThank you for your suggestion. Here is our discussion on the defense mechanisms:\n\n-\tAccording to Table 1 and Fig.3 in the main paper, Multi-Krum shows the best defense performance, followed by RFA. Under the Multi-Krum defense, no attack strategy can rapidly compromise the global model to achieve MSE below 0.1 within the designated round. This is mainly because Multi-Krum is effective at detecting malicious updates. When the attacker uses a small scale to bypass Multi-Krum, the defense mechanism can still dilute the malicious update by weighted averaging the remaining updates. Although the experiment in Appendix A.1 shows that the defense is not reliable with longer training, Multi-Krum could be a good start for future work.\n-\tAdditionally, the differential privacy algorithm can render indicators invalid while sacrificing generative performance, as discussed in Appendix F (Lines 666-671). This is mainly because noise or norm clipping treats all parameters uniformly. Since AdaSCP requires specific indicators with a large magnification factor, locating candidate indicators and filtering outliers after comparison with other updates would be more efficient and effective. This method is preferable to comparing the distance of all parameters, which tends to average out outliers and makes it difficult to filter out malicious clients.\n-\tMoreover, the experiment in Appendix A.2 shows that our backdoors diminish after 100 rounds of continued training with clean data, suggesting a potential mitigation strategy for future work. Lastly, since the triggers are implanted in the input noise, releasing only the generated results without exposing the model parameters is another viable defense.\n\nWe will add a new section to discuss the potential defense mechanisms and mitigations of *DataStealing* backdoors.\n\n**Response to W2:**\n\nWe have conducted experiments with more clients, such as 1/8 and 1/10, as detailed in Appendix A.6. These results show that AdaSCP remains effective in executing attacks under more clients. For experiments with more attackers, we tested with two malicious clients, each having 500 target images. The results for 2/5 are shown below:\n\nTable B: *DataStealing* with two attackers applying AdaSCP on CIFAR10 under Non-IID distribution.\n| Defenses | FID | $\\text{MSE}_1$ | $\\text{MSE}_2$ | $\\text{MSE}_{mean}$ | \n|:----------|:-------|:-------|:-------|:-------|\n| Multi-Krum |14.97|0.0886|0.0898|0.0892|\n|Foolsgold|33.24|0.0174|0.0229|0.0201|\n| Multi-metrics |15.61|0.0324|0.0608|0.0466|\n\nTable B shows that AdaSCP can be applied in scenarios with multiple attackers. However, the attackers may interfere with each other, leading to varying attacking performances. Additionally, having two attackers causes the FID to rise, mainly because they disrupt normal training with scaled updates. As a result, the magnitude of the weighted average updates is double that of a single attacker. This issue could be mitigated by dividing the updates by the number of attackers. We leave this for future research.\n\n**Response to W3:**\n\nThank you for your suggestion. We conducted an additional experiment with the LSUN bedroom dataset, which has a higher resolution of 256x256. More details can be found in our global response and the PDF file.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "QVzxdWgcat", "reviewer": "Reviewer_vH6J", "summary": "This paper identifies a pioneering privacy threat in Federated Learning (FL) introduced by popular diffusion models, called DataStealing. The researchers show that an attacker can use Combinatorial Triggers (ComboTs) to steal private data from a client in vanilla FL, even with strict data management protocols in place. For advanced FL systems, they propose an attack method (AdaSCP) to bypass distance-based defenses by adaptively scaling critical parameter updates with indicators. Extensive experiments demonstrate that AdaSCP not only circumvents existing defenses but also successfully steal thousands of images from the system. The paper calls for increased attention to privacy issues in diffusion models within the FL community.", "questions": "Please see the weakness part.", "limitations": "Please see the weakness part.", "rating": 6, "confidence": 5, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. They propose a new benchmark (DataStealing) to demonstrate the security vulnerability of training federated diffusion models, which can be utilized to circumvent the strict data protection measures of some organizations. They show that multiple Trojans (ComboTs) are effective in leaking thousands of data. \n2. The proposed AdaSCP is the first to update the critical parameters and utilize indicators to optimize the scale value according to the theoretical target value. The authors provide a simple proof for calculating the optimal scaling value with the returned indicator updates. \n3. The paper offers valuable insights into the critical privacy and security concerns associated with federated diffusion models. It proposes a crucial security issue and an attack method for the FL community.\n4. Well-written paper with clear motivation, technical approach, and clear figures. Extensive experiments support their claim well.", "weaknesses": "1. The reason that Model Poisoning cannot bypass the defenses is only demonstrated in Section 3.3. More quantitative analysis, including details of defending against malicious updates with different attack methods, can enhance understanding. A figure is also acceptable.\n2. The error bars are not reported. Although it will require significant computational resources, I recommend conducting repeat experiments with different seeds, at least for the proposed AdaSCP. This will enhance the academic quality of this paper.\n3. The recent studies [1, 2, 3] should be discussed in the related work.\n4. Some minor typos:\n- “..”->”.” in line 200.\n\t- “front” should be “first” to keep consistent in Algorithm 2 line 6.\n[1] Jia J, Yuan Z, Sahabandu D, et al. FedGame: a game-theoretic defense against backdoor attacks in federated learning[J]. Advances in Neural Information Processing Systems, 2024, 36.\n[2] Cheng S, Tao G, Liu Y, et al. Lotus: Evasive and resilient backdoor attacks through sub-partitioning[C]//Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 2024: 24798-24809.\n[3] Huang J, Hong C, Chen L Y, et al. Gradient Inversion of Federated Diffusion Models[J]. arXiv preprint arXiv:2405.20380, 2024.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for appreciating our contributions. We address your concerns below:\n\n**Response to Q1:**\n\nWe appreciate your suggestion to include more quantitative analysis on defending against malicious updates. To enhance understanding, we analyze the distance of Krum and Multi-Krum across different training rounds. Compared to other defense algorithms, the variations in distance are more distinct. The results are presented below:\n\nTable C: Ratio of Malicious Update Distance to Mean Benign Model Distance (AdaSCP in CIFAR10).\n| Defenses | 1 | 10 |20|50|100|200|300| \n|:----------|:-------|:-------|:-------|:-------|:-------|:-------|:-------|\n| Krum | 6.6556 | 1.4777 | 0.9072 | 0.9715 | 0.9378 | 0.9435 | 0.9514 | \n| Multi-Krum | 6.6557 | 1.2245 | 0.9834 | 0.9829 | 0.9578 | 0.9503 | 0.9507 |\n\nTable C shows that the initial scale value is substantially distant from the optimal value, resulting in the initial distance of the malicious updates being approximately 6.7 times greater than that of the benign updates. As AdaSCP progressively optimizes the scale value, the distance of the malicious updates more closely aligns with that of the benign updates, gradually approaching the optimal distance that enables the attack to bypass the defenses. More details can be found in Figure B on the PDF file.\n\nIn the revised version, we will include Figure B to enhance the readers' understanding of our method.\n\n**Response to Q2:**\n\nThank you for your suggestion. We conduct repeating experiments with additional two different seeds, resulting in three distinct Non-IID data distributions. We present our results in the form of “mean ± standard” deviation. The results are listed below:\n\nTable D: Repeating Experiment of AdaSCP in CIFAR10 with Non-IID Distribution.\n| Defenses | FID | MSE | \n|:----------|:-------|:-------|\n| FedAvg | 10.41±1.79|0.0117±0.0013 |\n| Krum | 21.53±6.58 |0.0683±0.0184|\n| Multi-Krum | 8.23±0.32 | 0.1267±0.0008 |\n| Foolsgold | 16.57±5.54 | 0.0246±0.0211 |\n| RFA | 8.71±0.42 | 0.1165±0.0144 |\n| Multi-metrics | 11.45±2.55 | 0.0299±0.0040 |\n| Mean | 12.82±2.64 | 0.0629±0.0036 |\n\nTable E: Repeating Experiment of AdaSCP in CelebA with Non-IID Distribution.\n| Defenses | FID | MSE | \n|:----------|:-------|:-------|\n| FedAvg | 6.94±0.23 | 0.0080±0.0012 |\n| Krum | 11.90±1.35 | 0.0574±0.0277 |\n| Multi-Krum | 4.74±0.22 | 0.1411±0.0133 |\n| Foolsgold | 8.55±0.91 | 0.0166±0.0099 |\n| RFA | 7.46±0.89 | 0.1256±0.0212 |\n| Multi-metrics | 7.47±0.18 | 0.0174±0.0060 |\n| Mean | 7.84±0.25 | 0.0610±0.0107 |\n\nThe Mean values in Tables D and E show minimal deviation from those reported in our paper, demonstrating the robustness of our method to different data distributions. We will include the error bars in the revised manuscript.\n\n**Response to Q3:**\n\nThank you for your suggestion. We have included more related work in Appendix E. These studies will also be discussed in our revised version.\n\n**Response to Q4:**\n\nThank you for your careful review. We will address all typos in the revised manuscript.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:
First of all, we would like to thank you for your time, constructive critiques, and valuable suggestions, which have greatly helped us improve our work. We are also grateful that the reviewers unanimously regard our work as novel and convincing. Below, we respond to the suggestions regarding experiments on additional datasets with higher resolution.

We adopted the pretrained model provided by the official DDPM implementation, which is trained on the LSUN bedroom dataset with a 256x256 resolution. The *DataStealing* experiment is conducted by fine-tuning the pretrained model with a subset of the LSUN bedroom dataset, containing approximately 300,000 images.

Considering the limited rebuttal time and the computational resources required for training, we set the batch size to 8 and the number of target images to 50. Each client trains on 500 images for one round. The EMA scale is decreased from 0.9999 to 0.999 for quicker convergence. The quantitative and qualitative results are shown in Table A and Figure A in our uploaded PDF file. We compare AdaSCP with several effective attack methods, such as Data Poison, Model Poison, and PGD Poison. The results show that AdaSCP still outperforms other methods in the *DataStealing* task under advanced FL defenses, further supporting our work.

To address the lengthy 20-hour FID calculation time required for sampling 50,000 images at a 256x256 resolution, we used only 5,000 images, reducing the inference time to 2 hours. However, the limited training and inference time lead to higher FID values compared to other datasets. We will continue working on the LSUN bedroom dataset to provide more complete results in the revised manuscript.

Thank you again for your valuable time. We sincerely look forward to further discussions with you.

Meta-review: The paper identifies a new threat of data extraction from diffusion models trained with federated learning.  The combinatorial trigger methodology was appreciated by the reviewers as a creative design, as was the use of adaptive scale critical parameters. The paper was clearly written, and the experiments were overall convincing to the reviewers (though experiments can always be expanded). Please do make sure to include your updated results on the LSUN bedrooms dataset. On my own reading of the paper, I was curious how the method works against other distance-based defenses tailored to FL, such as Wang et al "Towards a defense against federated backdoor attacks under continuous training". Overall, the paper presents a solid step in deepening our understanding of adversarial attacks in the federated setting, particularly for diffusion models.
Decision: Accept (poster)