Watch Out for the Lifespan: Evaluating Backdoor Attacks Against Federated Model Adaptation

AI summary

Overview

Research area: Security of Federated Learning (FL), specifically backdoor attacks against large-model adaptation using Parameter-Efficient Fine-Tuning (PEFT), with a focus on Low-Rank Adaptation (LoRA).

Technical level: Advanced. The paper assumes familiarity with federated averaging, backdoor/trigger terminology, LoRA/PEFT mechanics, and attack-success-rate evaluation.

Scope: The paper analyses how LoRA's rank affects both the injection speed and the persistence (lifespan) of three state-of-the-art backdoor attacks in a federated adaptation setting, and argues that current evaluation protocols can produce misleading rankings of attacks.

What This Paper Is About

Federated Learning is increasingly used to adapt large pre-trained models (such as a Vision Transformer) to downstream tasks, and LoRA makes that local training cheap by freezing the base weights and training only small low-rank matrices. The paper asks what happens to backdoor attacks in this specific setting: when a small number of compromised clients poison their local data, how quickly does the malicious behaviour get injected, and how long does it survive after the attackers stop participating? The goal is to characterise the influence of LoRA's rank on backdoor convergence and lifespan, and to expose evaluation pitfalls that distort comparisons between attacks.

Key Contributions

1. A discussion of the complexity of evaluating backdoor attacks in FL, identifying system parameters and attack-scenario assumptions (in particular the attack window and the attacker's temporal constraints) that make fair comparisons between attacks difficult.
2. The first in-depth analysis of the impact of LoRA on backdoor attacks for large-model adaptation in FL, covering both backdoor injection (convergence) and backdoor lifespan.
3. A simple training-time method for reducing backdoor lifespan — progressively resetting a fraction of LoRA's A and B matrices to their PiSSA initialisation — that enforces backdoor forgetting with a benign-accuracy cost the paper reports as less than 0.5%.
4. A set of requirements and recommendations for improving the evaluation of backdoors in FL, plus a demonstration that the ranking of attacks changes depending on the attack window and the LoRA rank.

Main Findings

• LoRA slows down the backdoor under a short attack window: With an attack window AW=[0,30], the lower the rank, the lower the ASR at the end of the window. For the baseline attack, ASR is 92%, 87%, and 83% for r=32, r=8, and r=2 respectively. Benign accuracy is unaffected by the attacks and stays around 97% regardless of rank.

• The initial lifespan result is biased by injection quality: In the AW=[0,30] setting, lower rank appears to give a shorter lifespan (for example, the 60%-lifespan of A3FL drops from 400 rounds for r=32 to only 90 rounds for r=8). However, the paper shows this is largely an artefact of the ASR reached when the attack stops. Using AW values of 40, 70, and 100 rounds yields final ASRs of 93.5%, 99.1%, and 99.8%, and the 60%-lifespan is more than 3 times longer with a 100-round AW than with a 40-round one.

• Under an optimal injection setting, the ranking reverses: With AW=[0,200], the lower the rank, the longer the backdoor persists. For the baseline attack, the 60%-lifespan is 330, 760, 970, and more than 1500 rounds for ViT, r=32, r=8, and r=2 respectively. Models without LoRA now behave more like the highest-rank (r=32) configuration.

• A moderate-fitting phase precedes backdoor overfitting: Without an attack window and with the baseline attack, the ASR does not increase before round 15 even though attackers participate from the start. For r=2, t_c(95%)_ACC = 12 rounds while t_c(95%)_ASR = 53 rounds, and the second (backdoor overfitting) stage converges around round 50. Depending on r, task accuracy needs between 5 and 15 rounds while the ASR always needs 3 to 4 times more rounds to converge.

• Lower ranks slow both benign and malicious convergence: Reaching 95% accuracy takes twice as many rounds with r=2 as with r=32 (12 vs. 6 rounds), and the same pattern holds for the ASR (53 vs. 30 rounds) for the baseline attack.

• LoRA makes the adapted model's parameters more stable: Measuring σ = std(θ^t − θ^(t−50)) every 50 rounds, the r=2 model shows, after round 500, an average σ of approximately 2.5×10⁻⁵ — about 50 times lower than ViT. The ViT's σ is reported as 10 times higher than r=32's, and higher σ corresponds to a steeper ASR decline.

• Feature-space evidence: t-SNE visualisations at rounds 200 and 1200 show that poisoned samples remain clustered near the target label after 1000 further rounds for r=2, whereas for ViT the poisoned features revert to their original labels. The organisation of the feature space evolves much more for ViT than for r=2 over the same period.

• Iterative resetting shortens the lifespan: Progressively resetting 1% of the parameters of A and B back to PiSSA initialisation every 5 rounds (applied to ViT with r=2 and AW=[0,200] under the baseline attack) causes the backdoor to be forgotten within a few hundred rounds, with a benign-accuracy difference reported as under 0.5%. The paper reports the same effect for the other attacks.

• Attack rankings are highly protocol-dependent: Comparing AW=[0,30] and AW=[0,200] for ViT, the ranking of attacks by lifespan differs substantially. The longer lifespan attributed to A3FL in prior work is characterised here as a consequence of its faster convergence rather than an intrinsically stronger persistence. With r=2 and AW=[0,200], DBA and Neurotoxin perform worse than the baseline in both convergence time and lifespan.

• A3FL is computationally expensive: The paper reports that, on ViT, A3FL takes more than 20 times longer than the baseline, DBA, or Neurotoxin.

• DBA needs a longer window: Between rounds 200 and 700, DBA in the AW=[0,200] setting shows behaviour consistent with having been limited by the attack window, because it poisons only a quarter of the trigger pixels per attacker.

Methodology in Plain English

The authors build a standard federated setup: 100 clients, of which 10 are randomly selected each round, each training locally for two local epochs with a fixed learning rate of 0.002 and a batch size of 16. Local updates are clipped (τ=1) and averaged with FedAvg. They run a long-term scenario of 1500 rounds so both the injection and the persistence of a backdoor can be observed. Data are split non-uniformly across clients using a Dirichlet distribution with α=0.9.

The model is a Vision Transformer (vit-base-patch16-224, 85.9M parameters, 12 attention blocks, pre-trained on ImageNet), fine-tuned on EuroSat — 27000 land-use/land-cover images across 10 classes, split 90%/10% train/test. LoRA is applied to the Query and Value matrices at ranks 2, 8, and 32; with r=2 only 81.4k parameters are trained. The authors use PiSSA initialisation, based on a singular value decomposition of the pre-trained weight, and note that experiments with standard LoRA initialisation did not change their conclusions.

Three attacks represent three threat families: Neurotoxin (masks the top 5% of important parameters in the update), DBA (splits a patch trigger into 4 mini-patches across attackers), and A3FL (optimises a trigger by gradient descent against an adversarially trained copy of the global model). The baseline attack is a 5×5 red pixel patch in the top-left corner, and all attacks target label y*=2. Five clients are compromised and poison 25% of their own data, roughly 1.25% of the total dataset. Attacks run inside an attack window — [0,30] or [0,200] — after which the malicious clients are removed.

Performance is tracked with benign test accuracy (ACC) and attack success rate (ASR) on a poisoned test set, plus two timing metrics: the x%-lifespan (the last round at which ASR exceeds x) and the convergence time (first round at which ACC or ASR exceeds x). Feature-space behaviour is probed with t-SNE on penultimate-layer features, and parameter drift is probed with the standard deviation of model differences over 50-round intervals. Additional experiments reported in the appendix and public repository cover CIFAR-10, GTSRB, the Swin Transformer, LoRA extended to MLP blocks, and variations in the number of attackers and the poison ratio.

Why This Matters

The paper argues that backdoor risk assessments for FL systems can be wrong in a specific and systematic way: an attack that looks weak or short-lived under a limited attack window may be the most persistent one once the attacker is allowed to inject it properly. Because the ranking of attacks changes with the attack window and the LoRA rank, defences and evaluations built on a single configuration may not generalise.

Real-world applications:

• Continuous or long-term FL deployments such as mobile keyboard prediction, where models keep fitting to recent data and backdoors injected once can persist for a long time.
• Predictive maintenance systems, which the paper lists as a long-term FL use case where a persistent malicious behaviour in the adapted model is hard to detect.
• Industrial IoT with few participating clients, where a small number of compromised devices represents a larger fraction of the federation.
• Cross-device FL on smartphones, where a large pool of client devices (the paper notes deployments can range from a few units to several thousand devices) makes continuous participation and client control difficult to audit.

Industry relevance: the results give practitioners a concrete argument for how to configure and audit LoRA-based federated adaptation, and the iterative-reset strategy offers a training-side option that the paper reports costs less than 0.5% in benign accuracy. The paper also notes that early stopping is a strong mitigation for short-term FL processes, since backdoor tasks generally need more rounds to be learned than benign tasks.

Future Directions

• Extending the analysis from a ViT on vision tasks to LLMs and NLP tasks in FL, which the paper describes as particularly challenging because of task complexity and the diversity of triggers (token-, word-, sentence-level, syntactic, or stylistic).
• Studying more complex attack-window scenarios, such as multiple attack windows at different times in training, different attacker budgets across consecutive windows, or an evolving attacker budget that grows and then shrinks during training.
• Investigating how PEFT techniques such as LoRA affect other evaluation aspects of backdoor attacks, given that the paper shows the comparison and ranking of attacks change when LoRA is involved.
• Determining whether there is a "right" value of the LoRA rank, since the paper concludes small ranks limit injection speed but increase persistence under optimal injection conditions, while large ranks may be counterproductive for other FL system constraints.

Target Audience

This paper is aimed at FL security researchers and practitioners designing or auditing federated model-adaptation systems. It is most useful to readers who already understand federated averaging, PEFT/LoRA, and standard backdoor metrics (ACC, ASR), and who need guidance on how to set up fair evaluations — particularly researchers benchmarking attacks and defences who may be affected by the attack-window and rank choices the paper examines.

Authors’ abstract

Large models adaptation through Federated Learning (FL) addresses a wide range of use cases and is enabled by Parameter-Efficient Fine-Tuning techniques such as Low-Rank Adaptation (LoRA). However, this distributed learning paradigm faces several security threats, particularly to its integrity, such as backdoor attacks that aim to inject malicious behavior during the local training steps of certain clients. We present the first analysis of the influence of LoRA on state-of-the-art backdoor attacks targeting model adaptation in FL. Specifically, we focus on backdoor lifespan, a critical characteristic in FL, that can vary depending on the attack scenario and the attacker's ability to effectively inject the backdoor. A key finding in our experiments is that for an optimally injected backdoor, the backdoor persistence after the attack is longer when the LoRA's rank is lower. Importantly, our work highlights evaluation issues of backdoor attacks against FL and contributes to the development of more robust and fair evaluations of backdoor attacks, enhancing the reliability of risk assessments for critical FL systems. Our code is publicly available.