BAPFL: Exploring Backdoor Attacks Against Prototype-based Federated Learning

2025-09-16

AI Summary

Prototype-based federated learning (PFL) mitigates data heterogeneity but lacks systematic investigation into its robustness against backdoor attacks. This paper first reveals PFL’s intrinsic resilience to conventional backdoor attacks and proposes BAPFL—the first backdoor attack specifically designed for PFL. BAPFL innovatively integrates label-customized triggers with a global prototype alignment mechanism: it poisons global prototypes by manipulating their evolutionary trajectory and employs gradient-driven trigger optimization to steer malicious samples toward the target-class prototype in feature space. Extensive experiments across multiple benchmark datasets and PFL variants demonstrate that BAPFL achieves a 35–75% improvement in attack success rate over baselines, while preserving main-task accuracy—thereby validating its effectiveness, stealthiness, and generalizability.

Technology Category

• Machine Learning: Adversarial Learning & Robustness
• Computer Vision: Adversarial Attacks & Robustness
• Multiagent Systems: Adversarial Agents

Application Category

• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Search and Retrieval-Augmented AI: Web learning to rank, online learning, and counterfactual learning for ranking
• Security and Privacy: Privacy-enhancing technologies

Abstract

Prototype-based federated learning (PFL) has emerged as a promising paradigm to address data heterogeneity problems in federated learning, as it leverages mean feature vectors as prototypes to enhance model generalization. However, its robustness against backdoor attacks remains largely unexplored. In this paper, we identify that PFL is inherently resistant to existing backdoor attacks due to its unique prototype learning mechanism and local data heterogeneity. To further explore the security of PFL, we propose BAPFL, the first backdoor attack method specifically designed for PFL frameworks. BAPFL integrates a prototype poisoning strategy with a trigger optimization mechanism. The prototype poisoning strategy manipulates the trajectories of global prototypes to mislead the prototype training of benign clients, pushing their local prototypes of clean samples away from the prototypes of trigger-embedded samples. Meanwhile, the trigger optimization mechanism learns a unique and stealthy trigger for each potential target label, and guides the prototypes of trigger-embedded samples to align closely with the global prototype of the target label. Experimental results across multiple datasets and PFL variants demonstrate that BAPFL achieves a 35%-75% improvement in attack success rate compared to traditional backdoor attacks, while preserving main task accuracy. These results highlight the effectiveness, stealthiness, and adaptability of BAPFL in PFL.

Problem

• Explores backdoor attack vulnerability in prototype-based federated learning
• Proposes BAPFL method with prototype poisoning and trigger optimization
• Tests effectiveness across datasets with improved attack success rates

Innovation

• Prototype poisoning strategy manipulates global prototypes
• Trigger optimization mechanism learns stealthy unique triggers
• Integrates prototype poisoning with trigger optimization