# On the Vulnerability of Backdoor Defenses for Federated Learning

**Authors:** Pei Fang, Jinghui Chen  
**arXiv:** [2301.08170](https://arxiv.org/abs/2301.08170)  
**Date:** 2023-01-19  
**Summary page:** https://www.summarizepaper.com/en/paper/2301.08170v1/

## Key points

- Authors investigate the vulnerability of current defense mechanisms against backdoor attacks in federated learning
- Federated Learning (FL) allows for training a global model without sharing clients' data, but also provides an opportunity for backdoor attacks
- Various defense measures have been proposed to address backdoor threats
- Authors propose a new federated backdoor attack method that directly modifies local model weights through sign flips to inject the backdoor trigger
- They optimize the trigger pattern jointly with the client model to make it more persistent and stealthy
- Case study evaluates recent federated backdoor defenses from three major categories, examining their strengths and weaknesses
- Suggestions provided to practitioners when training federated models in practice
- Importance of understanding and addressing vulnerabilities in federated learning systems highlighted due to potential backdoor attacks
- Proposed attack method sheds light on weaknesses in current defense mechanisms and offers insights for improving security measures in federated learning environments.

## Summary

In the paper titled "On the Vulnerability of Backdoor Defenses for Federated Learning," authors Pei Fang and Jinghui Chen investigate the vulnerability of current defense mechanisms against backdoor attacks in federated learning. Federated Learning (FL) is a distributed machine learning paradigm that allows for training a global model without sharing clients' data. However, this communication between servers and clients provides an opportunity for backdoor attacks, where a specific trigger pattern can mislead the global model into targeted mispredictions. To address these backdoor threats, various defense measures have been proposed. The authors aim to determine whether these existing defenses effectively neutralize backdoor attacks in practical settings. They propose a new federated backdoor attack method to test the effectiveness of current countermeasures. Unlike traditional methods such as training on triggered data or rescaling the malicious client model, their approach directly modifies a small proportion of local model weights through sign flips to inject the backdoor trigger. Additionally, they optimize the trigger pattern jointly with the client model, making it more persistent and stealthy in circumventing existing defenses. The study includes a case study where the authors evaluate recent federated backdoor defenses from three major categories. By examining their strengths and weaknesses, they provide suggestions to practitioners when training federated models in practice. Overall, this paper highlights the importance of understanding and addressing vulnerabilities in federated learning systems due to potential backdoor attacks. The proposed attack method sheds light on potential weaknesses in current defense mechanisms and offers insights for improving security measures in federated learning environments.