[Paper Review] Backdoor Federated Learning by Poisoning Backdoor-Critical Layers

Haomin Zhuang, Mingxian Yu+4 more|arXiv (Cornell University)|Aug 8, 2023

Adversarial Robustness in Machine Learning4 citations

TL;DR

This paper proposes a novel backdoor attack in federated learning that targets backdoor-critical (BC) layers—specific model layers responsible for most vulnerability—using layer substitution analysis to identify them. By poisoning only these critical layers with minimal client compromise (10%), the method achieves high backdoor success rates while evading seven state-of-the-art defenses, outperforming existing attacks in stealth and effectiveness.

ABSTRACT

Federated learning (FL) has been widely deployed to enable machine learning training on sensitive data across distributed devices. However, the decentralized learning paradigm and heterogeneity of FL further extend the attack surface for backdoor attacks. Existing FL attack and defense methodologies typically focus on the whole model. None of them recognizes the existence of backdoor-critical (BC) layers-a small subset of layers that dominate the model vulnerabilities. Attacking the BC layers achieves equivalent effects as attacking the whole model but at a far smaller chance of being detected by state-of-the-art (SOTA) defenses. This paper proposes a general in-situ approach that identifies and verifies BC layers from the perspective of attackers. Based on the identified BC layers, we carefully craft a new backdoor attack methodology that adaptively seeks a fundamental balance between attacking effects and stealthiness under various defense strategies. Extensive experiments show that our BC layer-aware backdoor attacks can successfully backdoor FL under seven SOTA defenses with only 10% malicious clients and outperform the latest backdoor attack methods.

Motivation & Objective

• To identify and verify the existence of backdoor-critical (BC) layers—small subsets of model layers that dominate backdoor vulnerability in federated learning.
• To develop a general in-situ method for attackers to locate BC layers using forward and backward layer substitution.
• To design two new backdoor attack methods—layer-wise poisoning and layer-wise flipping—that focus on BC layers to maximize stealth and effectiveness.
• To evaluate the proposed attacks under diverse defense strategies, demonstrating superior performance in backdoor success rate and main task accuracy.
• To show that BC layers exist across various architectures, including CNNs and NLP models like BERT and LSTM.

Proposed method

• Proposes Layer Substitution Analysis: iteratively substitutes layers between benign and malicious models to identify BC layers based on changes in backdoor success rate.
• Uses forward substitution (inserting malicious layer into benign model) and backward substitution (inserting benign layer into malicious model) to isolate critical layers.
• Designs LP Attack (layer-wise poisoning) and LF Attack (layer-wise flipping) that target only identified BC layers with minimal weight modifications.
• Adapts attack strategies to balance effectiveness and stealth, minimizing detection risk under distance-based, inversion-based, and sign-based defenses.
• Applies the method across multiple models (CNNs, ResNet18, VGG19, BERT, DistilBERT, LSTM) and datasets (CIFAR-10, SVHN, SST-2, Reddit).
• Employs a client-level poisoning strategy where only 10% of clients are malicious, simulating realistic FL threat models.

Experimental results

Research questions

• RQ1 Do specific model layers—backdoor-critical (BC) layers—exist that dominate the vulnerability to backdoor attacks in federated learning?
• RQ2 Can BC layers be reliably identified using in-situ layer substitution techniques without prior knowledge of model architecture or training data?
• RQ3 Can backdoor attacks be made significantly more stealthy and effective by focusing only on BC layers, rather than the entire model?
• RQ4 How do the proposed layer-wise attacks perform under seven state-of-the-art defense mechanisms in federated learning?
• RQ5 Are BC layers present and identifiable in both computer vision and natural language processing models?

Key findings

• Backdoor-critical layers exist and are responsible for nearly all backdoor success; removing just one BC layer (e.g., fc1.weight) reduces backdoor success rate to near zero.
• The proposed Layer Substitution Analysis successfully identifies BC layers across diverse models, including ResNet18, VGG19, BERT, and 2-layer LSTM.
• LP and LF attacks achieve 100% backdoor success rate under all evaluated defenses with only 10% malicious clients, outperforming existing attacks like DBA.
• The attacks maintain high main task accuracy (>95%) on clean data, demonstrating minimal impact on model utility.
• In NLP models, BC layers are primarily located in attention mechanism matrices (Q, K, V) and output linear layers, not the final classifier layer in BERT and DistilBERT.
• The ratio of BC layers is less than 25% of total layers in NLP models, indicating their sparsity and strategic importance.