DarkFed: A Data-Free Backdoor Attack in Federated Learning

1 Introduction

Federated learning (FL) [McMahan et al., 2017; Lu et al., 2023], one of the prevailing distributed paradigms, facilitates the collaborative construction of a high-precision global model by multiple clients with small amounts of data, all under the coordination of a central server. Notably, FL excels at preserving privacy since clients' training data remains localized throughout the entire model construction process.

However, the distributed nature of FL also presents a significant challenge: the central server struggles to discern the quality of client-uploaded parameters. Consequently, FL faces a severe threat known as poisoning attacks [Lu et al., 2024; Shi et al., 2022; Wan et al., 2021]. These attacks can be categorized into two main types: Byzantine attacks [Zhang et al., 2023b; Wan et al., 2024], and backdoor attacks [Zhang et al., 2024a; Zhang et al., 2024b] The former aims to reduce the global model's recognition accuracy for all samples, while the latter specifically misclassifies samples specified by the adversary without affecting the model's recognition of normal samples. This indicates that backdoor attacks are more covert and insidious compared to Byzantine attacks. Therefore, this paper focuses on backdoor attacks in FL.

FL is shown to be susceptible to backdoor attacks [Xie et al., 2020; Lyu et al., 2023; Li et al., 2023]. However, the success of these attacks critically hinges on a high proportion of genuine attackers possessing samples relevant to the main task. Typically, they require 20% of attackers with authentic training data to successfully inject a backdoor. In real-world industrial scenarios [Shejwalkar et al., 2022], attackers often constitute only 1% or even less of the total clients. As shown in Tab. 1, for both the classical Model Replacement Attack [Bagdasaryan et al., 2020] and the recent 3DFed [Li et al., 2023], we consider scenarios with 20% attackers (academic research scenarios) and 1% attackers (real-world industrial scenarios). Notably, we employ only the most primitive defense method, Norm Clipping [Wang et al., 2020], which restricts the magnitude of local updates to remain within a specified threshold. We observe that in academic research scenarios, these attacks can indeed achieve significant attack success rate (ASR) and accuracy of the model (ACC). However, surprisingly, in real-world industrial scenarios, even the state-of-the-art (SOTA) 3DFed fails to backdoor FL equipped with the simplest defense. We speculate that this is due to the low proportion of attackers, which results in the backdoor task-related knowledge being overshadowed by the main task-related knowledge in the aggregation stage. The result suggests that existing backdoor attacks in FL are impractical, and an effective FL backdoor attack for real-world industrial scenarios is yet to be developed.

In light of this, we embark on the initial steps toward developing backdoor attacks in FL tailored for real-world industrial contexts. Building upon the research in [Cao and Gong, 2022], we can emulate a series of fake clients using opensource projects or Android emulators. These approaches can significantly increase the number of attackers to match the settings of academic research scenarios. However, these emulated fake clients are unable to provide authentic main taskrelated data. Consequently, the primary challenge pivots towards devising a data-free backdoor attack in FL.

In this paper, we propose DarkFed, the first DAta-fRee bacKdoor attack in FEDerated learning. Specifically, we first explore the impact of shadow datasets on backdoor attacks. Surprisingly, even when there is a substantial gap between the shadow dataset and the main task dataset (e.g., between CIFAR-10 and GTSRB), the backdoor can be successfully implanted while maintaining model utility. What's even more astonishing is that using synthetic data devoid of any semantic information (e.g., generated through a Gaussian distribution) as the shadow dataset still yields significant success in backdoor attacks. These promising results inspire us to inject the backdoor using a shadow dataset on the emulated fake clients. However, directly transferring the previous process is prone to detection by existing defenses due to the significant differences between backdoor updates and benign updates, leading to the failure of the attack. To further enhance the stealthiness of the attack, we propose property mimicry, optimizing backdoor updates to mimic benign updates in terms of magnitude, distribution, and consistency. These properties are widely employed by FL backdoor defenses to detect backdoor updates. This optimization significantly boosts the covert nature of the attack.

In summary, our contributions are as follows:

• We introduce DarkFed, the first data-free backdoor attack in FL. This attack does not rely on task-specific data, enabling its use in scenarios with emulated fake clients, thus achieving a practical backdoor attack.
• We investigate the feasibility of injecting a backdoor with shadow datasets and find that even with synthetic datasets, successful backdoor injection is achievable. We extend this concept into the realm of FL.
• We introduce a novel defense evasion technique, property mimicry, which enables backdoor updates to mimic the properties of benign updates, thereby enhancing the stealthiness of the attack.
• Extensive experiments demonstrate that DarkFed achieves attack effects comparable to SOTA datadependent attacks.

2 RelatedWork

2.1 Backdoor Attacks in FL

A plethora of studies have suggested that FL is exceptionally susceptible to backdoor attacks [Mo et al., 2023; Liu et al., 2023; Hu et al., 2023; Hu et al., 2022]. [Bagdasaryan et al., 2020] is among the pioneers in launching backdoor attacks on FL. They introduce the Model Replacement Attack, amplifying the magnitude of backdoor updates proportionally, ensuring the dominance of backdoor parameters in the global model. Furthermore, they introduce the Semantic Backdoor Attack, which doesn't require any modifications to the training samples but leverages samples with specific semantic information to trigger the backdoor. For example, this attack classifies all green cars as horses. Drawing inspiration from the Semantic Backdoor Attack, [Wang et al., 2020] introduce an edge-case backdoor attack, which uses rare samples (the tail of a dataset) to trigger the backdoor. [Xie et al., 2020] propose DBA (Distributed Backdoor Attack), which decomposes a trigger into multiple sub-triggers, with each attacker holding one of these sub-triggers for data poisoning. Most recently, [Li et al., 2023] present 3DFed, addressing three prominent defense strategies with corresponding attack modules and introducing an indicator mechanism to assess whether backdoor updates are used in model aggregation. This allows for an adaptive adjustment of the attack strategy. We've also noticed a category of backdoor attacks based on trigger optimization, such as A3FL [Zhang et al., 2023a] and F3BA [Fang and Chen, 2023]. They aim to obtain a robust trigger to make the attacks more covert and persistent. These efforts are compatible with the ones mentioned earlier.

It's important to note that all existing backdoor attacks are data-dependent, meaning they require main task-related data to operate. The development of a data-free backdoor attack remains an open area for exploration.

2.2 Backdoor Defenses in FL

Existing defenses against FL backdoors can be categorized into norm constraint-based defenses, outlier detection-based defenses, and consistency detection-based defenses.

Norm constraint-based defenses posit that the optimal point for the backdoor task typically deviates significantly from the optimal point for the main task. This results in the norm of backdoor updates being much larger than that of benign updates. Consequently, these defenses constrain the norm of all local updates within a reasonable range. Norm Clipping [Wang et al., 2020] serves as a representative example of such defenses. Additionally, some other defenses [Wan et al., 2023; Wan et al., 2022; Cao et al., 2021] also leverage this characteristic to prevent malicious updates from dominating the global model.

Outlier detection-based defenses assert that backdoor updates and benign updates exhibit substantial differences in their distributions, with benign updates typically being densely distributed. In contrast, backdoor updates can be considered as outliers. Building on this premise, RFLBAT [Wang et al., 2022] utilizes Principal Component Analysis (PCA) to project local updates into a low-dimensional space. Subsequently, it employs a clustering algorithm to identify outliers, marking them as backdoor updates. FLAME [Nguyen et al., 2022] identifies updates that deviate significantly in direction from the overall trend as backdoor updates and excludes them from the aggregation queue. FLDetector [Zhang et al., 2022] exploits the differences between the predicted model and the actual model to discover outliers.

Consistency detection-based defenses argue that all backdoor updates share the same objective, namely, to classify trigger-carrying samples as the target label. Therefore, these updates exhibit strong consistency, either in terms of update directions or neuron activations. On the other hand, diverse benign updates may display lower consistency due to data heterogeneity [Li et al., 2020]. With this understanding, FoolsGold [Fung et al., 2020] assigns lower aggregation weights to updates with high pairwise cosine similarities, thereby mitigating the impact of backdoor updates. DeepSight [Rieger et al., 2022] uses the consistency on neuron activations in the backdoor model to detect malicious updates.

3 Preliminaries

3.1 Federated Learning

FL involves iteratively exchanging model parameters between a central server and multiple clients, enabling collaborative training on distributed private data. In broad strokes, FL encompasses the following steps:

• Step I: The central server dispatches the global model w to individual clients.
• Step II: Each client individually fine-tunes the global model w on their local dataset, resulting in a refined model w′ . Subsequently, the model update u′ := w′ -w is uploaded to the server.
• Step III: The server utilizes all the updates (denoted as a set S) to enhance the global model as follows:

Here, AGR denotes the aggregation algorithm, such as FedAvg [McMahan et al., 2017].

These steps are iteratively performed until a satisfactory global model is obtained. Note that, for the sake of conciseness, we have omitted the iteration round and the client index.

4 Threat Model

4.1 Adversary's Goal

The adversary should successfully inject a backdoor without compromising the availability of the global model, even in the presence of SOTA backdoor defenses deployed on the central server. This implies that the adversary needs to concurrently achieve the following three goals:

• Stealthiness. Backdoor updates must effectively masquerade as benign updates, evading detection by defense schemes to ensure that the backdoor-related knowledge becomes integrated into the global model.
• Fidelity. The backdoor attack should not undermine the global model's ability to recognize clean samples. The post-attack global model must maintain a level of accuracy in the main task comparable to its pre-attack state.
• Effectiveness. In the case of samples containing the trigger, the global model should exhibit a very high accuracy in recognizing them as the target class, as predetermined by the adversary.

4.2 Adversary's Capability and Knowledge

We posit that the adversary can emulate a series of fake clients (also referred to as attackers) using open-source projects or Android emulators [Cao and Gong, 2022] to attain an attacker proportion that aligns with the common academic research scenario, typically around 20%. Note that these fake clients lack access to main task-relevant data. The adversary is entirely unaware of the training data and model updates of benign clients, as well as the defense scheme deployed on the server. Furthermore, it cannot disrupt the model training process of benign clients or server decision-making. The sole element within the adversary's control is the training process of the fake clients. The fake clients can mimic the behavior of benign clients to launch covert backdoor attacks.

5 DarkFed

5.1 Motivation Behind DarkFed

Drawing insights from the results in Tab. 1, it becomes apparent that a high attacker proportion is an indispensable prerequisite for the success of backdoor attacks. Nevertheless, achieving such a high attacker proportion is usually unattainable in real-world industrial settings, rendering the existing FL backdoor attack methods impractical. While some literature [Cao and Gong, 2022] suggests the emulation of a substantial number of fake clients to match the attacker proportion of academic research scenarios, these fake clients are bereft of task-relevant data. Consequently, we are compelled to execute the backdoor attack in a data-free manner.

5.2 Backdoor Attack with ShadowDataset

To realize the data-free backdoor attack, it naturally prompts us to explore the utility of a shadow dataset, because obtaining diverse data unrelated to the main task is quite easy. For example, it can be achieved through web scraping of publicly available data or even generating a series of data points using Gaussian distribution. Consequently, we follow [Lv et al., 2023] and embark on exploring the impact of shadow datasets on backdoor attacks.

Formally, for a clean model w and a shadow dataset Ds, we fine-tune w into a backdoored version w′ with the following optimization objective:

where Dsc represents the clean dataset without any modifications in the shadow dataset, and Dsp represents the poisoned dataset with triggers applied. L is a loss function, e.g., cross entropy. w(·) and w′ (·) denote the logits of w and w′ , respectively, yt is the target label, and the hyperparameter λ1 is used to balance the model performance and the poisoning effect. The purpose of Lcl is to maintain the performance of the main task, while Lbk aims to learn the knowledge related to the backdoor. It should be noted that throughout the entire fine-tuning process, λ1 is fixed at 1, and the clean model w is treated as a constant that remains unchanged.

We consider three popular image classification tasks: CIFAR-10 [Krizhevsky and Hinton, 2009], CIFAR100 [Krizhevsky and Hinton, 2009], and GTSRB [Stallkamp et al., 2011]. As for the shadow datasets, in addition to these three real datasets, we also include three synthetic datasets constructed based on certain distributions. These synthetic datasets do not contain any semantic information. Due to the commonality of the three real datasets, we omit their introduction here and focus solely on describing the three synthetic datasets.

• Gauss-I. Each image is of size 32 × 32 × 3, with each pixel value generated from a Gaussian distribution N(0.5, 12 ) and located within the range [0, 1].
• Gauss-II. Each image is of size 32 × 32 × 3, with each pixel value generated from a Gaussian distribution N(0.5, 0.22 ) and located within the range [0, 1].
• Uniform. Each image is of size 32 × 32 × 3, with each pixel value generated from a uniform distribution U(0, 1).

Fig. 1 showcases a subset of samples from these datasets. Notably, significant visual disparities exist among them, which potentially leads to the presumption that their utilization as shadow datasets would lead to a reduction in the model's main task recognition accuracy (i.e., ACC) or an unsatisfactory level of backdoor task accuracy (i.e., ASR). However, to our surprise, as shown in Tab. 2, the shadow dataset, compared to directly using task-related datasets (highlighted in green), does not significantly impact the backdoor performance, especially when utilizing real datasets. The last three rows in the table illustrate the scenario when synthetic datasets serve as shadow datasets. It can be observed that the performance of Gauss-I is comparable to that of real datasets. Gauss-II fails to achieve satisfactory ASR, and we speculate this is due to its small standard deviation during construction, resulting in lower data richness and thus poorer performance. Uniform's performance falls between Gauss-I and Gauss-II, achieving over 90% ASR on each dataset.

We posit that the ability to maintain high ACC with a shadow dataset lies in our strategy of ensuring similarity between the logits of w′ and w (see Lcl in Eq. (2)), rather than employing hard labels. This allows for minor adjustments to be made to w′ based on w. The achievement of high ASR is attributed to the fact that backdoor learning focuses on the mapping relationship between the trigger and the target label, making it less influenced by the shadow dataset itself.

5.3 PropertyMimicry

The preceding exploration indicates that leveraging a shadow dataset and Eq. (2) can simultaneously achieve high ACC (the fidelity goal) and high ASR (the effectiveness goal). Therefore, a naive idea is to directly execute this on fake clients. However, this approach is easily thwarted by existing defense mechanisms, leading to a failure in backdoor implantation (i.e., the stealthiness goal is not achieved). To enhance stealthiness, our core idea is to make the backdoor updates generated by fake clients mimic benign updates in terms of properties (e.g., magnitude, distribution, and consistency). This approach makes it challenging to distinguish between these two types of updates based on certain properties, thereby evading defense mechanisms.

Moderate magnitude. The magnitude of benign updates is typically moderate, and this feature is also exploited by norm constraint-based defenses to filter or constrain backdoor updates. To mimic this property of benign updates, an intuitive approach is to prevent the magnitude of backdoor updates from becoming excessively large, and this can be effortlessly achieved by incorporating a constraint term.

Formally, for the global model w and the local model w′ , we consider the following constraint term:

The inspiration for this constraint term is drawn from FedProx [Li et al., 2020], which also incorporates an identical constraint term. However, our approach differs fundamentally from FedProx. Firstly, FedProx employs this constraint term to alleviate the issue of model accuracy degradation caused by statistical heterogeneity in FL, whereas our objective is to enhance the stealthiness of backdoor attacks. Furthermore, FedProx applies this constraint term to all clients, whereas we restrict its use solely to malicious clients. While this constraint term is simple and intuitive, it effectively restricts the magnitude of backdoor updates without compromising the efficiency of backdoor injection or the backdoor accuracy. We surmise that Lnc can guide the backdoor model to search for a joint optimal point near the global model, where both the backdoor task and the primary task perform well. The effect of Lnc is illustrated in Fig. 2 (left).

Reasonable distribution. Benign updates typically exhibit a reasonable distribution, so when malicious updates are introduced, they can be detected as outliers. To mimic this characteristic of benign updates, a favorable countermeasure involves narrowing the similarity between backdoor updates and benign updates. This confuses the defense mechanism, making it challenging to detect out-ofdistribution (OOD) values and potentially leading to erroneous identifications (i.e., classifying benign updates as malicious). Considering the well-established capability of cosine similarity in measuring update similarity, and its widespread adoption in various defense methods [Nguyen et al., 2022; Cao et al., 2021], we employ it as a metric to quantify the similarity between malicious and benign updates. Nevertheless, the adversary lacks knowledge of benign models. Although it can train a set of emulated benign models using the clean shadow dataset Dsc and Lcl with Eq. (2), the emulated benign models may deviate substantially from real benign ones. This discrepancy increases the risk of backdoor models veering in the wrong direction, thereby amplifying the visibility of the attack.

In this context, we propose employing the double exponential smoothing (DES) algorithm to predict the forthcoming round's global model because DES has exhibited remarkable effectiveness in predicting the distribution of benign models [Li et al., 2022]. Formally, for the global model w and the local model w′ , we introduce the following constraint term:

where ˆw denotes the predicted global model through DES, cos denotes cosine similarity, and the hyperparameter α represents the estimated cosine similarity between benign updates. The constraint term Lod tightens the similarity between backdoor updates and benign updates, preventing the backdoor updates from resembling OOD values. This allows them to circumvent outlier detection-based defenses. The effect of Lod is illustrated in Fig. 2 (middle).

Algorithm 1: A Complete Description of DarkFed

Input : Ds: shadow dataset; w: global model; Wbk: collection of all backdoor models; α: estimated cosine similarity between benign updates; E: local epoch; B: batch size; λ: coefficient balancing stealthiness with fidelity and effectiveness; η: learning rate. Output: the backdoored models Wbk 1 // Initialize all backdoor models with global model 2 for w′ ∈Wbk do 3 w′ ←w 4 Obtain the predicted global model ˆw through DES 5 B ← (split Ds into batches of size B) 6 // Optimize each backdoor model following Eq. (6) 7 for each epoch e ∈ [1,E] do 8 for w′ ∈ Wbk do 9 for each batch b ∈ B do 10 L = Lcl + Lbk + λ(Lnc + Lod + Lcd) 11 w′ ← w′ - η∇w′L

Limited consistency. The consistency of benign updates is typically limited, as they do not share the same objective, unlike backdoor updates. This principle forms the core perspective of consistency detection-based defenses. To simulate this property of benign updates, we aim to optimize the representation of backdoor updates, ensuring they demonstrate a consistency akin to benign updates. Specifically, for the global model w and the local model w′ , we introduce the following constraint term:

where Wbk represents the collection of all backdoor models, and α carries the same meaning as in Eq. (4). The constraint term Lcd reduces the consistency of backdoor updates to a level comparable to benign updates, effectively confounding defensive strategies. The effect of Lcd is illustrated in Fig. 2 (right).

5.4 AComplete Description of DarkFed

Combining constraint terms (3), (4), and (5), we can reformulate the optimization objective in (2) as follow:

where Lcl is designed to achieve the fidelity goal. Lbk aims to fulfill the effectiveness goal. Lnc, Lod, and Lcd contribute to realizing the stealthiness goal. λ is a coefficient balancing stealthiness with fidelity and effectiveness. Note that this optimization objective is extensible. While it currently encompasses evasion constraint terms designed for existing defense categories, new defenses may emerge in the future that do not fall into any of these categories. In such cases, we can still design corresponding constraint terms to extend this optimization objective.

Alg. 1 provides a complete description of the DarkFed scheme during a round of global iteration. Upon receiving the global model from the central server, all fake clients initialize their local models with this global model (Lines 1-3). Subsequently, the DES algorithm is employed to obtain the predicted global model (Line 4), which is utilized in the computation of Lod (refer to Eq. (4)). Then the shadow dataset is divided into multiple batches for local training (Line 5). Finally, optimization is performed for each backdoor model based on Eq. (6) (Lines 6-11).

6 Experiments

6.1 Experimental Setup

Datasets, models, and codes. We consider three multichannel image classification datasets: CIFAR-10 [Krizhevsky and Hinton, 2009], CIFAR-100 [Krizhevsky and Hinton, 2009], and GTSRB [Stallkamp et al., 2011]. Because, compared to single-channel datasets like MNIST [LeCun et al., 1998] and Fashion-MNIST [Xiao et al., 2017], multichannel datasets are more complex and better represent realworld scenarios. For CIFAR-10 and CIFAR-100, we employ ResNet-18 as the model structure. For GTSRB, we construct a VGG-like model as the global model. It's worth noting that, to expedite experimentation, we follow [Li et al., 2023], employing a pre-trained model as the initial global model to simulate a scenario where the global model is nearing convergence. The initial model's ACC and ASR on the three datasets are provided in Tab. 3. Note that when calculating ASR, samples corresponding to the target label have not been excluded. This results in some backdoor samples being identified as the target class not because they are triggered, but because they inherently belong to the target class. Consequently, this leads to a relatively higher ASR. This approach is justified since backdooring a FL system when the global model is close to convergence is enough. Our codes will be available at https://github.com/hustweiwan/DarkFed.

Shadow datasets. For the CIFAR-10 and CIFAR-100 classification tasks, we employ GTSRB as the shadow dataset. Conversely, for the GTSRB classification task, we utilize CIFAR-100 as the shadow dataset. This decision is guided by the relatively small domain gap between CIFAR-10 and CIFAR-100, and we avoid using them interchangeably as shadow datasets.

Attack settings. In line with [Lyu et al., 2023], we establish a FL system encompassing 100 clients, with 20% of them being emulated fake clients. These fake clients lack training data relevant to the main task and instead utilize a publicly scraped dataset or a synthetic dataset (e.g., generated through Gaussian distribution) to introduce a backdoor. 20% of the total clients are randomly selected in each iteration. The parameter settings in Alg. 1 are delineated in Tab 4. One might wonder why the estimated cosine similarity between benign updates (i.e., α) consistently remains at 0 for different datasets. This is attributed to the research in [Wan et al., 2022], which indicates that benign updates exhibit similarity only in the initial rounds, becoming nearly orthogonal in subsequent iterations. Evaluated defenses. We evaluate DarkFed against five SOTA defenses: FedAvg [McMahan et al., 2017], Norm Clipping [Bagdasaryan et al., 2020], FLAME [Nguyen et al., 2022], RFLBAT [Wang et al., 2022], and FoolsGold [Fung et al., 2020]. The defenses cover all the types outlined in Sec. 2.2, showcasing the universality of DarkFed.

6.2 Experimental Results

Attack performance. We systematically verify the attainment of the adversary's goals to assess the attack performance. Figs. 3 illustrates the impact of DarkFed on SOTA defenses on CIFAR-10 (first row), CIFAR-100 (second row), and GTSRB (third row). The green line represents ACC, while the red line denotes ASR. In terms of fidelity, DarkFed achieves high ACC on both CIFAR-10 and CIFAR-100, with an accuracy degradation within 1% compared to the initial model. On GTSRB, across various defenses, accuracy degradation ranges between 1% and 3%. These marginal accuracy degradations do not significantly affect model usability, showcasing DarkFed's fidelity achievement. In terms of effectiveness, DarkFed rapidly achieves nearly 100% ASR with few iterations across all three datasets (around 20 iterations for CIFAR-10 and CIFAR-100, and 10 iterations for GTSRB), highlighting its remarkable attack effectiveness. The stealthiness goal is indirectly demonstrated through the preceding two goals, as a sufficiently concealed attack is essential to ensure that backdoor updates evade defenses, ultimately resulting in a global model that excels in both the main and backdoor tasks.

Impact of attacker ratio. Tab.5 illustrates the impact of attacker ratio on DarkFed under FLAME. It is noticeable that as the ratio of attackers increases, ACC experiences a slight decrease, while ASR exhibits an upward trend. However, overall, DarkFed shows minimal susceptibility to changes in the attacker ratio. Even in the presence of a 5% attacker ratio, the ASR remains notably high, reaching a minimum of 94.30%. The ASR nearly peaks when the attacker ratio reaches 10%.

Comparison with SOTA attacks. Existing research has not delved into data-free backdoor attacks in FL, thus we showcase DarkFed's superiority by directly comparing it with SOTA data-dependent attacks. Specifically, we consider the classic Model Replacement Attack [Bagdasaryan et al., 2020] and the latest 3DFed [Li et al., 2023]. It's important to note that these two attacks directly utilize task-specific data, while DarkFed relies solely on shadow dataset. Tab. 6 presents the comparative results on CIFAR-10. In terms of ACC, these three attacks exhibit no significant differences; all maintain high model accuracy. On average, the differences among them are within 0.11%. Regarding ASR, Model Replacement Attack performs relatively poorly, only managing to backdoor FedAvg and Norm Clipping. Both 3DFed and DarkFed can overcome all defenses, but DarkFed's average ASR is slightly higher than 3DFed. Furthermore, we observe that 3DFed's ASR under the RFLBAT defense is 3% lower than DarkFed. We speculate that this is because 3DFed needs to use decoy model updates as bait to mislead RFLBAT. As a result, not all backdoor updates can be accepted by RFLBAT, sacrificing attack performance to some extent.

Attack with synthetic dataset. The preceding experiments utilize shadow datasets comprising real data from vastly different domains, yielding highly effective attack outcomes. Consequently, a naturally intriguing question arises: Can we achieve similar attack results with synthetic dataset? To answer this question, we employ Gauss-I as the shadow dataset for CIFAR-10, and the experimental results are depicted in Fig. 4. Compared with the earlier experiments (the first row of Fig. 3), ACC remains consistent, hovering around 90%. Although ASR suffers a relative decrease, it still approaches 90%. The experimental results are promising, indicating that even without crawling any datasets online, the use of selfconstructed, semantically meaningless data can successfully inject a backdoor without compromising model accuracy.

Acknowledgments

Minghui's work is supported in part by the National Natural Science Foundation of China (Grant No. 62202186). Shengshan's work is supported in part by the National Natural Science Foundation of China (Grant Nos. 62372196, U20A20177).

Contribution Statement

Minghui Li, Wei Wan, and Yuxuan Ning have contributed equally to this work, therefore they can be considered as cofirst authors. Wei Wan is the corresponding author.