Color Matters: Trigger Color Affects Success in Federated Backdoor Attacks

2026-06-24

AI Summary

This work systematically investigates the impact of trigger color on the success rate of semantic backdoor attacks in federated learning—a factor overlooked by prior studies. By fixing the attack pipeline and varying only the color (black or white) of natural visual accessories such as face masks or sunglasses, the authors evaluate how color influences attack efficacy. They propose SABLE, a multi-objective loss function that integrates feature disentanglement and update regularization to enhance both stealthiness and effectiveness. Experiments on the CelebA dataset across four hair-color classification tasks reveal that white triggers more successfully compromise the “blond hair” class, whereas black triggers are more effective against the “black hair” class. This color–semantic alignment effect persists even under robust aggregation mechanisms, providing the first evidence that semantic consistency between trigger color and target class significantly influences backdoor attack success.

Abstract

Federated learning is vulnerable to backdoor attacks in which malicious clients inject poisoned updates while preserving benign-task performance. In this paper, we study a semantics-driven backdoor mechanism in which attackers use natural visual accessories as triggers and manipulate only the trigger color while keeping the attack pipeline fixed. Our framework considers semantic trigger objects such as masks and sunglasses, instantiated in black and white variants, and evaluates their effect in a controlled federated learning setting. Malicious clients construct poisoned samples by applying a trigger to source-class images and relabeling them to an attacker-chosen target class, while benign clients train only on clean data. We analyze this mechanism under both a standard poisoning objective and a stronger SABLE-based objective that combines clean classification loss, triggered target loss, feature-separation loss in the penultimate representation space, and regularization to keep malicious updates close to the global model. This design enables the attack to remain effective while reducing excessive update drift. Experiments on a four-class CelebA hair-color task show that trigger color significantly changes attack success rate even when trigger semantics, placement, and poisoning budget are unchanged. White triggers are more effective for attacks targeting the blond class, whereas black triggers perform better for attacks targeting the black class. The same trend persists under robust aggregation, showing that trigger color is a meaningful factor in the operation, persistence, and evaluation of semantic backdoor mechanisms in federated learning.

Problem

• federated learning
• backdoor attack
• trigger color
• semantic trigger
• poisoning

Innovation

• federated learning
• backdoor attack
• trigger color
• semantic trigger
• SABLE objective