Collision-based Watermark for Detecting Backdoor Manipulation in Federated Learning

2025/08/04 by Li, Wenjie, Gu, Siying, Li, Yiming +5
#Artificial Intelligence (cs.AI) #Cryptography and Security (cs.CR) #FOS: Computer and information sciences

paper · doi:10.48550/arxiv.2508.02115

Abstract

As AI-generated content increasingly underpins real-world applications, its accompanying security risks, including privacy leakage and copyright infringement, have become growing concerns. In this context, Federated Learning (FL) offers a promising foundation for enhancing trustworthiness by enabling privacy-preserving collaborative learning over proprietary data. However, its practical adoption is critically threatened by backdoor-based model manipulation, where a small number of malicious clients can compromise the system and induce harmful content generation and decision-making. Although various detection methods have been proposed to detect such manipulation, we reveal that they are either disrupted by non-i.i.d. data distributions and random client participation, or misled by out-of-distribution (OOD) prediction bias, both of which are unique challenges in FL scenarios. To address these issues, we introduce a novel proactive detection method dubbed Coward, inspired by our discovery of multi-backdoor collision effects, in which consecutively planted, distinct backdoors significantly suppress earlier ones. Correspondingly, we modify the federated global model by injecting a carefully designed backdoor-collided watermark, implemented via regulated dual-mapping learning on OOD data. This design not only enables an inverted detection paradigm compared to existing proactive methods, thereby naturally counteracting the adverse impact of OOD prediction bias, but also introduces a low-disruptive training intervention that inherently limits the strength of OOD bias, leading to significantly fewer misjudgments. Extensive experiments on benchmark datasets show that Coward achieves state-of-the-art detection performance, effectively alleviates OOD prediction bias, and remains robust against potential adaptive manipulations.

Citations

• Multi-Target Federated Backdoor Attack Based on Feature Aggregation
• Non-Cooperative Backdoor Attacks in Federated Learning: A New Threat Landscape
• Exploring Semantic Attributes from A Foundation Model for Federated Learning of Disjoint Label Spaces
• Backdoor Contrastive Learning via Bi-level Trigger Optimization
• A Survey of Text Watermarking in the Era of Large Language Models
• Towards Sample-specific Backdoor Attack with Clean Labels via Attribute Trigger
• Backdoor Attack with Sparse and Invisible Trigger
• Chameleon: Adapting to Peer Images for Planting Durable Backdoors in Federated Learning
• Neurotoxin: Durable Backdoors in Federated Learning
• RFLBAT: A Robust Federated Learning Algorithm against Backdoor Attack
• Adversarial Neuron Pruning Purifies Backdoored Deep Models
• FLTrust: Byzantine-robust Federated Learning via Trust Bootstrapping
• DeepSweep: An Evaluation Framework for Mitigating DNN Backdoor Attacks using Data Augmentation
• Backdoor Learning: A Survey
• Defending against Backdoors in Federated Learning with Robust Learning\n Rate
• Robust Aggregation for Federated Learning
• Can You Really Backdoor Federated Learning?
• Federated Optimization in Heterogeneous Networks
• Why ReLU networks yield high-confidence predictions far away from the\n training data and how to mitigate the problem
• How To Backdoor Federated Learning
• Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoning
• Deep Neural Networks are Easily Fooled: High Confidence Predictions for\n Unrecognizable Images

Related

• How To Backdoor Federated Learning
• BackdoorIndicator: Leveraging OOD Data for Proactive Backdoor Detection in Federated Learning
• FLAME: Taming Backdoors in Federated Learning (Extended Version 1)
• Backdoor Attacks and Defenses in Federated Learning: Survey, Challenges and Future Research Directions
• Mitigating Backdoors in Federated Learning with FLD