FedGAT: Global Feedback Optimizes Backdoor Triggers in Federated Learning

Federated learning was designed to let artificial-intelligence systems learn from data without collecting that data in one place. Hospitals can train medical models while keeping patient records on their own servers; vehicles can improve recognition systems without uploading driving histories; and industrial sensors can contribute to shared models while retaining locally generated information. But a new study warns that this privacy-friendly architecture may also give attackers a powerful way to implant hidden behaviors into the models used by many organizations. The researchers describe an attack called FedGAT that can manipulate a federated model through a single malicious participant, using tiny amounts of data and without resorting to the conspicuously large updates that many security systems are designed to detect. In experiments, the attack caused triggered inputs to be classified into an attacker-selected category with success rates above 75 percent on three datasets, exceeding competing methods by an average of 60.95 to 80.19 percent.

Federated learning works through repeated exchanges between a central server and participating devices, or clients. Rather than sending raw examples to the server, each client trains a copy of the model on its own data and returns a mathematical update—typically a collection of changes to the model’s parameters. The server combines these updates, often using Federated Averaging, or FedAvg, and distributes the improved global model back to the clients. This process is repeated over many communication rounds. The arrangement reduces the need to share sensitive data, but it also means that the server may have limited visibility into how each update was produced. A backdoor attack exploits that gap by training a model to behave normally on ordinary inputs while responding maliciously when it encounters a secret signal known as a trigger. The trigger may be a visible pattern, a subtle image alteration or another carefully engineered feature.

The central problem for an attacker is that a malicious update is mixed with many legitimate updates before it becomes part of the global model. If the malicious update is too weak, the backdoor can be diluted until it disappears. If it is artificially amplified, however, its unusual size or direction may expose it to anomaly detectors. Earlier attacks have therefore faced a difficult trade-off between effectiveness and stealth. Fixed-pattern methods use a predetermined signal, such as a geometric mark, but those patterns can be conspicuous and may not survive aggregation. Other attacks optimize triggers against a model held by the malicious client. Yet federated systems commonly contain non-independent and non-identically distributed data: different clients may see very different classes and examples. A trigger that works well on one local model may therefore lose much of its power when transferred to the constantly evolving global model.

FedGAT is designed around that transfer problem. The researchers use a copy of a converged global model as a fixed reference during trigger generation. They then train a generator—a neural network that transforms random noise into a structured perturbation—to produce an input modification that pushes the reference model toward a chosen target class. Although the method borrows the generator–discriminator language of generative adversarial networks, it does not perform the usual contest in which both networks are repeatedly trained against each other. Instead, the global model acts as a frozen discriminator-like component. Its output supplies a loss signal, and that signal is backpropagated through the generator so that the generated perturbation becomes increasingly aligned with the model’s learned feature space.

Technically, the generator consists of four transposed-convolution layers that progressively expand a noise vector into an image-sized perturbation. Intermediate layers use rectified linear unit activations, while a final hyperbolic tangent function constrains the output before it is scaled and clipped. The researchers impose an infinity-norm bound on the perturbation, limiting the maximum change applied to any pixel. The altered input is also clipped to the valid normalization range, ensuring that the resulting image remains a legal model input. The generator is optimized with cross-entropy loss: for a set of clean samples from the target class, it seeks a perturbation that increases the global model’s probability for the attacker’s chosen label. In the reported baseline configuration, trigger optimization used 50 samples, 1,000 iterations and a perturbation bound of 16/256.

Once the trigger has been generated, the attacker embeds it into a subset of target-class training images on the compromised client. The labels remain unchanged, making the poisoning “clean label” from the perspective of the training data. The client then trains locally on a mixture of ordinary and altered examples and submits its update through the normal federated-learning process. Crucially, FedGAT does not multiply or scale that update to give it extra influence. The experiments modeled 100 clients, with 10 selected for aggregation in each round, and used a highly unbalanced data partition created with a Dirichlet coefficient of 0.1. The attack was injected only once after the global model had converged, rather than requiring the malicious client to participate continuously. This single-shot setup is important because it tests whether a hidden behavior can persist after the attacker stops contributing.

The researchers evaluated the method using CIFAR-10, the German Traffic Sign Recognition Benchmark and an Iranian traffic-sign dataset, with ResNet-18 models. On CIFAR-10, fixed-pattern baselines produced attack-success rates below 10 percent, while a method optimized against local model information remained below an average of 60 percent across the tests. FedGAT exceeded 75 percent on every dataset and surpassed 99 percent on CIFAR-10. The attack-success rate measures how often a triggered test example is redirected to the target class; clean accuracy measures whether ordinary examples are still classified correctly. According to the study, FedGAT’s clean accuracy remained comparable to that of the unattacked model, suggesting that standard checks based only on overall performance would not necessarily reveal the compromise. The researchers also report that the backdoor remained highly effective for as many as 1,000 additional communication rounds after the one-time injection.

The attack’s apparent resilience extended to several defenses, including Multi-Krum, RLR and FLAME, as well as ordinary FedAvg aggregation. Nearly 100 rounds after injection, the average attack-success rate across the datasets remained above 88 percent under the tested defenses. To investigate why, the authors compared client updates using t-distributed stochastic neighbor embedding, or t-SNE, a technique that projects high-dimensional data into two dimensions for visual inspection. Updates produced by the baseline attacks formed clusters that were visibly separated from benign updates. FedGAT’s malicious updates instead overlapped substantially with legitimate ones, reducing the statistical signals on which many defenses depend. The findings do not establish that every real-world federated system would be vulnerable, and the authors acknowledge limits: the method is task-specific, may need adjustment when the global model changes rapidly and was evaluated primarily on image classification. But the results highlight a widening security challenge: as attacks become better aligned with the shared model and less distinguishable from normal learning, protecting distributed AI may require defenses that examine model behavior—not just the size or geometry of client updates.