Search papers, labs, and topics across Lattice.
This paper investigates the impact of trigger color on the success of backdoor attacks in federated learning, where malicious clients use colored visual accessories to manipulate data while maintaining benign performance. By employing a semantics-driven approach, the authors demonstrate that varying the color of triggers鈥攕pecifically black and white variants of objects like masks and sunglasses鈥攕ignificantly influences the effectiveness of these attacks. Experiments reveal that white triggers are particularly effective for targeting the blond class, while black triggers excel when targeting the black class, highlighting the importance of trigger color in the design and evaluation of federated backdoor mechanisms.
Trigger color can dramatically alter the success rates of backdoor attacks in federated learning, revealing a critical vulnerability in current defenses.
Federated learning is vulnerable to backdoor attacks in which malicious clients inject poisoned updates while preserving benign-task performance. In this paper, we study a semantics-driven backdoor mechanism in which attackers use natural visual accessories as triggers and manipulate only the trigger color while keeping the attack pipeline fixed. Our framework considers semantic trigger objects such as masks and sunglasses, instantiated in black and white variants, and evaluates their effect in a controlled federated learning setting. Malicious clients construct poisoned samples by applying a trigger to source-class images and relabeling them to an attacker-chosen target class, while benign clients train only on clean data. We analyze this mechanism under both a standard poisoning objective and a stronger SABLE-based objective that combines clean classification loss, triggered target loss, feature-separation loss in the penultimate representation space, and regularization to keep malicious updates close to the global model. This design enables the attack to remain effective while reducing excessive update drift. Experiments on a four-class CelebA hair-color task show that trigger color significantly changes attack success rate even when trigger semantics, placement, and poisoning budget are unchanged. White triggers are more effective for attacks targeting the blond class, whereas black triggers perform better for attacks targeting the black class. The same trend persists under robust aggregation, showing that trigger color is a meaningful factor in the operation, persistence, and evaluation of semantic backdoor mechanisms in federated learning.
