提出频域方法实现个性化联邦学习中的持久后门攻击
DCInject: Persistent Backdoor Attacks via Frequency Manipulation in Personal Federated Learning
- 在频域移除直流分量，替换为高斯噪声实现攻击
- 在多个数据集上达96%以上攻击成功率，且保持正常准确率
- 对现有防御有效，适合研究联邦学习安全的学者
个性化联邦学习（PFL）通过为每个客户端创建专属模型来应对数据异构性。以往研究表明，PFL天然具有抵御后门攻击跨客户端传播的能力。本文揭示，基于频域的新方法仍可突破这一防护。我们提出DCInject，一种自适应频域后门攻击方法：在频域中移除部分零频率（直流）成分，并用高斯分布样本替代。该攻击在四种数据集（CIFAR-10/100、GTSRB、SVHN）上表现优异，相较于传统空间域攻击，在参数解耦的个性化设置下均实现了更高攻击成功率并维持高清洁准确率。实验显示，其在CIFAR-10上达到96.83%攻击成功率（ASR），SVHN达99.38%，GTSRB达100%；同时在I-BAU防御下仍保持90.30%的残留攻击成功率，远超BadNet的58.56%（基于VGG-16），暴露出PFL安全假设的关键漏洞。代码已开源。
原文摘要 · Abstract (English)
Personalized federated learning (PFL) creates client-specific models to handle data heterogeneity. Previously, PFL has been shown to be naturally resistant to backdoor attack propagation across clients. In this work, we reveal that PFL remains vulnerable to backdoor attacks through a novel frequency-domain approach. We propose DCInject, an adaptive frequency-domain backdoor attack for PFL, which removes portions of the zero-frequency (DC) component and replaces them with Gaussian-distributed samples in the frequency domain. Our attack achieves superior attack success rates while maintaining clean accuracy across four datasets (CIFAR-10/100, GTSRB, SVHN) compared to existing spatial-domain attacks, evaluated under parameter decoupling based personalization. DCInject achieves superior performance with ASRs of 96.83% (CIFAR-10), 99.38% (SVHN), and 100% (GTSRB) while maintaining clean accuracy. Under I-BAU defense, DCInject demonstrates strong persistence, retaining 90.30% ASR vs BadNet's 58.56% on VGG-16, exposing critical vulnerabilities in PFL security assumptions. Our code is available at https://github.com/NahomMA/DCINject-PFL
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。