# How To Backdoor Federated Learning

**Authors:** Eugene Bagdasaryan, Andreas Veit, Yiqing Hua, Deborah Estrin, Vitaly Shmatikov  
**arXiv:** [1807.00459](https://arxiv.org/abs/1807.00459)  
**Date:** 2018-07-02  
**Summary page:** https://www.summarizepaper.com/en/paper/1807.00459v3/

## Key points

- Federated learning allows collaboration on constructing deep learning models without sharing private training data
- Concerning aspect: Any participant can introduce backdoor functionality into the global model
- Researchers propose a model-poisoning technique centered on model replacement to address this vulnerability
- Attackers can achieve 100% accuracy on the backdoor task almost instantly using this method
- The proposed approach significantly outperforms traditional data poisoning strategies in federated learning tasks
- Introduce a generic constrain-and-scale technique to evade anomaly detection-based defenses during training
- Study highlights security risks in federated learning and provides insights into countermeasures against malicious backdoor attacks

## Summary

In their paper titled "How To Backdoor Federated Learning," Eugene Bagdasaryan, Andreas Veit, Yiqing Hua, Deborah Estrin, and Vitaly Shmatikov explore the concept of federated learning. This innovative approach allows numerous participants to collaborate on constructing a deep learning model without sharing their private training data. The authors highlight a concerning aspect of federated learning: any participant can clandestinely introduce backdoor functionality into the global model. To address this vulnerability, the researchers propose and assess a novel model-poisoning technique centered on model replacement. They demonstrate that an attacker strategically selected in a single round of federated learning can exploit this method to achieve 100% accuracy on the backdoor task almost instantly. By evaluating the attack across various assumptions related to standard federated-learning tasks, they establish that this approach significantly outperforms traditional data poisoning strategies. Moreover, the authors introduce a generic constrain-and-scale technique designed to circumvent anomaly detection-based defenses by incorporating evasion tactics into the attacker's loss function during training. This comprehensive study sheds light on potential security risks within federated learning environments and offers insights into effective countermeasures against malicious backdoor attacks in collaborative deep learning settings.