Test how visually subtle backdoors survive federated training. FiBA adapts invisible trigger families to a shared benchmark and compares their success, clean-model utility and detectability. A separate LSB experiment asks whether placing a trigger in low-activation image regions changes that tradeoff.
Inside FiBA
Teach a local model an extra associationMalicious clients train on clean samples and samples carrying a trigger with a common target label. FiBA compares four invisible attack families with visible BadNet; the trigger marks here indicate where an input is altered.Attacker updates meet honest updatesThe global model combines honest and malicious client updates over repeated rounds. Experiments choose FedAvg or one defense at the server; these rules are alternatives. The attacker fraction changes how much poisoned training reaches aggregation.Check success, utility and detectabilityAttack success counts triggered non-target test samples predicted as the target. Clean accuracy measures normal-task utility. LPIPS measures visual change, while Neural Cleanse anomaly scores probe model detectability; subtle appearance does not imply an undetectable backdoor.Compare LSB placement by model activationAfter a convergence check, activation maps guide low- and high-region LSB placement, compared with an unmasked baseline. The reported tests cover LSB500 and LSB700. Higher success in low regions also raises anomaly scores, exposing an effectiveness–detectability tradeoff.
What this adds
01
A federated comparison: evaluate LSB, WaNet, Encoder and LIRA attacks alongside visible BadNet under controlled client participation.
02
Expose defense tradeoffs: compare attack success with clean accuracy for the tested aggregation rules and attack configurations.
03
Probe attention-based placement: compare low, high and unmasked LSB triggers, including both perceptual distance and model anomaly scores.
Abstract
Federated Learning (FL) enables collaborative training of machine learning models across multiple devices, while preserving data privacy. However, it also introduces vulnerabilities to backdoor attacks, where malicious updates can corrupt the global model. This work focuses on the largely unexplored domain of Federated invisible Backdoor Attacks (FiBAs), which use visually indistinguishable triggers to manipulate model behavior without being detected. We investigate the feasibility and effectiveness of these attacks, considering the unique challenges posed by FL, such as limited local training time and the need for model update aggregation. Our study presents a comprehensive evaluation of the attack success rate (ASR) of invisible BAs under various settings and defenses. Based on our observations, we propose a backdoor trigger hiding technique based on low model attention regions to improve attack resilience in federated settings. Our findings provide critical insights into the optimization of invisible BAs in FL and highlights the need for robust defense mechanisms to safeguard FL systems.
Use ResNet-18 on CIFAR-10 and CIFAR-100 with nonoverlapping, non-IID client data. Malicious clients learn a common target from poisoned samples while honest clients train normally. Coordinated attackers share the required trigger string, warping field, encoder or pretraining resources for their attack family.
Sections 3.1 and 4, PDF pages 5–9. Main settings: 10 clients, 100 rounds, five local epochs, Dir(0.5) and poison rate 0.5. This is an evaluation study, not a new defense.
02
Compare one aggregation rule at a time
The defense grid compares FedAvg, Median, Trimmed Mean, FoolsGold, KRUM and Multi-KRUM under fixed attack conditions. Each rule can change both backdoor success and clean accuracy. Model replacement and distributed triggers are additional probes with their own assumptions.
Table 2 and Figures 3–6, PDF pages 11–14. The defense grid has BadNet, LSB, WaNet and Encoder rows; it does not include LIRA or report a PCA column.
03
Keep the evaluation axes separate
Attack success rate is the proportion of poisoned non-target test samples classified as the target. Clean accuracy measures ordinary utility; LPIPS and Neural Cleanse anomaly scores measure different aspects of detectability. Reported ± values are retained exactly because the paper does not define their dispersion statistic or run count.
Section 4 and Tables 1–3, PDF pages 9–11 and 14. These measurements do not establish statistical significance or a universal failure of robust aggregation.
04
Test low-activation placement specifically for LSB
A RankMe-type embedding score checks convergence before SmoothGradCAM++ maps are accumulated. The experiment compares reported low-, high- and unmasked placement for LSB500 and LSB700. Concentrating changes can also alter trigger intensity, so the comparison does not isolate attention from every other factor.
Section 3.2, Algorithm 1, Table 3 and Figure 7, PDF pages 7–8 and 14–15. Prose and mask-ordering descriptions differ; placement labels are preserved as reported. WaNet and LIRA attention placement remain future work.
Original paper figures & sourcesEnlargeBackdoor triggers enter during local training, while the server applies defenses when combining client updates. The study measures how this interaction shapes invisible attack success. Figure 1 in the accepted manuscript (PDF page 5) Evaluation
More malicious clients strengthen all five attacks in this comparison. WaNet and Encoder pass 80% mean attack success at 20% attackers. The same table’s clean accuracies and reported ± values remain available in the experiment details.
Attack success rate (%)
ASR, 10% attackers (%)ASR, 20% attackers (%)
0100
BadNet (visible)
94.96 ± 0.81
97.52 ± 0.40
LSB
41.59 ± 6.19
65.43 ± 3.93
WaNet
44.41 ± 3.50
82.05 ± 3.59
Encoder
29.44 ± 5.90
88.59 ± 4.01
LIRA
10.52 ± 1.22
41.57 ± 4.66
Experiment details
CIFAR-10, ResNet-18, 10 clients, 100 rounds, 5 local epochs, Dir(0.5), target class 5. Clean accuracy and attack success rate (ASR) are percentages; ASR excludes poisoned samples from the target class.
The paper reports means with ± values but does not identify the dispersion statistic or repetition count. These results use coordinated all-to-one poisoning and the specified attack settings.
Attacker participation changes success. CIFAR-10, ResNet-18, 10 clients, 100 rounds, 5 local epochs, Dir(0.5), target class 5. Clean accuracy and attack success rate (ASR) are percentages; ASR excludes poisoned samples from the target class.
A lower attack-success rate is only half the outcome. Multi-KRUM strongly suppresses this LSB configuration but also lowers clean accuracy. Trimmed Mean raises mean attack success here. These results are specific to CIFAR-10 with 10% attackers and the tested defense settings.
Clean accuracy (%)
Higher is better
0100
FedAvg
83.37 ± 0.33
Median
83.16 ± 1.68
Trimmed Mean
84.52 ± 0.40
FoolsGold
83.26 ± 0.35
KRUM
53.81 ± 10.20
Multi-KRUM
69.67 ± 1.89
Attack success rate (%)
Lower is better
0100
FedAvg
41.59 ± 6.19
Median
29.74 ± 12.35
Trimmed Mean
60.03 ± 7.17
FoolsGold
27.01 ± 3.08
KRUM
23.84 ± 26.93
Multi-KRUM
1.47 ± 0.45
Experiment details
Table 2(a), LSB on CIFAR-10 with 10% attackers and the same 10-client, 100-round setting. Clean accuracy is higher-is-better; ASR is lower-is-better for the defender. Both are percentages.
This panel selects one attack/dataset to keep the utility–defense tradeoff comparable. The paper also tests CIFAR-100 with 20% attackers; these different settings should not be pooled. The ± statistic is unspecified.
Defense success can cost clean accuracy. Table 2(a), LSB on CIFAR-10 with 10% attackers and the same 10-client, 100-round setting. Clean accuracy is higher-is-better; ASR is lower-is-better for the defender. Both are percentages.
Low-region LSB700 is more effective and more detectable by the reported model metric. Mean attack success rises from 41.59% to 61.39%, while anomaly rises from 1.61 to 3.04 and visual distance increases. LSB500 shows a smaller gain, so the effect is not uniform across trigger sizes.
Attack success rate (%)
0100
No activation mask
41.59 ± 6.19
Low attention
61.39 ± 4.47
High attention
36.89 ± 4.26
Experiment details
CIFAR-10, LSB700, 10% attackers; compare no activation mask with low- and high-attention masks. ASR is a percentage; LPIPS and Neural Cleanse anomaly index are unitless. Higher anomaly index means easier detection; the discussed threshold is 2.
The tested attention-placement evidence is limited to LSB500/700 on CIFAR-10. Fewer modified regions can also increase trigger intensity, so placement is not isolated from every other factor.
Low attention is easier to exploit and detect. CIFAR-10, LSB700, 10% attackers; compare no activation mask with low- and high-attention masks. ASR is a percentage; LPIPS and Neural Cleanse anomaly index are unitless. Higher anomaly index means easier detection; the discussed threshold is 2.
CIFAR-10/100 with ResNet-18 trained from scratch; Flower simulations with Dirichlet concentration 0.5.
Threat model
Attackers poison local training data and coordinate a target/trigger; model replacement additionally assumes knowledge of aggregation-related quantities.
Attacks and defenses
LSB, WaNet, Encoder, LIRA and visible BadNet; reported defense tables cover Median, Trimmed Mean, FoolsGold, KRUM and Multi-KRUM.
Additional probes
Distributed triggers, transient model replacement, and low/high attention LSB placement; LPIPS visual distortion and Neural Cleanse model-level detection.
Scope & limitations
The experiments use one architecture, two small image datasets, ten clients, and specified attacker fractions. They do not establish effectiveness across arbitrary deployments, attacker access, or defenses.
The paper names PCA among evaluated defenses, but its result table does not report a PCA column. LIRA is also absent from the defense table; do not imply coverage of every attack–defense pair.
Attention-based placement is evaluated for LSB, while adaptation to WaNet and LIRA is left for future work. Higher ASR is accompanied by higher Neural Cleanse scores rather than improved stealth on that metric.
The ± notation and number of repeated runs are not specified. The distributed-trigger caption also combines four trigger parts with a 10% attacker fraction among ten clients, leaving the exact distribution setup unclear.
@inproceedings{marinus2025invisible,
title = {On the Effectiveness of Invisible Backdoor Attacks in Federated Learning},
author = {Marinus, Mattjis and Tsouvalas, Vasileios and Meratnia, Nirvana},
booktitle = {Ubiquitous Security: 4th International Conference, UbiSec 2024, Revised Selected Papers},
series = {Communications in Computer and Information Science},
volume = {2469},
pages = {174--190},
year = {2025},
publisher = {Springer},
doi = {10.1007/978-981-96-4836-8_13},
url = {https://doi.org/10.1007/978-981-96-4836-8_13}
}
