STAIN-FL: Stealthy Targeted Attack Injection with Contextual Triggers in Federated Learning

Ashlinder Kaur; Purnima Murali Mohan; Zengxiang Li; Tram Truong-Huu

Source-linked AI summary

STAIN-FL: Stealthy Targeted Attack Injection with Contextual Triggers in Federated Learning

Ashlinder Kaur, Purnima Murali Mohan, Zengxiang Li, Tram Truong-Huu

arXiv:2608.23952v1Aug 25, 2026cs.CRcs.AI

TL;DR

Federated video anomaly detection preserves local surveillance-data ownership but remains vulnerable because servers cannot directly inspect client data or training. STAIN-FL exploits natural contextual triggers with targeted relabeling and least-updated-coordinate masking. Sparse attacks keep clean-accuracy drops low while achieving substantial and persistent backdoor accuracy under FedAvg and FedProx.

Problem
Federated video anomaly detection lacks well-characterized security behavior under targeted backdoors despite limited server visibility into client data and training.
Method
STAIN-FL combines anomaly-to-benign relabeling for naturally triggered videos with malicious-update masking over the least-updated model coordinates.
Results
Sparse attacks produce mean clean-accuracy drops of 1.66% under FedAvg and 1.03% under FedProx, with peak backdoor accuracies of 56.7% and 54.2%, respectively.
Takeaways & Limitations
Under FedAvg, sparse backdoors remain above 25% backdoor accuracy for an average of 336 post-attack rounds, making low-detectability persistence the main risk.
Takeaways & Limitations
The threat model assumes a single compromised client that cannot control the server or aggregation rule.

Abstract

from arXiv · show

Federated video anomaly detection trains model collaboratively without sharing raw surveillance footage, but limited server-side visibility lets compromised clients to inject backdoor via malicious updates. This paper introduces STAIN-FL, a stealthy targeted backdoor attack injection framework that uses naturally occurring surveillance conditions, including low-light scenes, indoor settings, and crowd density, as contextual triggers. STAIN-FL combines anomaly-to-benign label \textit{manipulation} with gradient masking over least-updated coordinates to preserve clean accuracy while inducing trigger-conditioned misclassification. We evaluate STAIN-FL on \texttt{UCF-Crime} using 1024-dimensional I3D features in a non-IID four-client multi-agency setting, comparing FedAvg and FedProx under sparse and continuous attacks. Results show that sparse attacks have low-detectability, operationally significant attacks rather than high-intensity attacks: they keep the mean clean-accuracy drop below $2\%$, yet still misclassify more than half of triggered anomalies at peak backdoor accuracy under FedAvg ($56.7\%$) and FedProx ($54.2\%$). Under FedAvg, the sparse backdoor remains above the $25\%$ backdoor-accuracy threshold for an average of $336$ post-attack rounds, highlighting the persistence risk of contextually triggered attacks in surveillance systems.

1 INTRODUCTION

Federated learning supports privacy-preserving collaborative surveillance analytics, but its limited server visibility leaves federated video anomaly detection vulnerable to stealthy, persistent backdoors. STAIN-FL addresses gaps in video-based evaluation, contextual triggers, and post-attack behavior.

Federated learning enables collaborative surveillance-model training without centralizing sensitive video data.
Existing durable FL backdoor research has focused mainly on natural language processing and image classification rather than video anomaly detection.
Prior attacks commonly use artificial triggers, whereas STAIN-FL studies naturally occurring low-light, indoor, and crowd-density conditions.
Post-attack backdoor behavior remains insufficiently characterized, including whether malicious behavior decays, disappears, or stabilizes.
STAIN-FL injects poisoned updates that preserve normal anomaly-detection performance while misclassifying trigger-conditioned anomalies as benign.

2 RELATED WORK

Related work establishes federated video anomaly detection as a privacy-oriented architecture while showing that FL backdoors exploit hidden client-side training and persistence challenges. Existing methods motivate studying contextual, durable attacks in video surveillance.

Federated video anomaly detection research addresses privacy, heterogeneous client data, and collaborative surveillance learning, but emphasizes detection performance and generalization.
FL backdoors exploit server-side inability to observe client data or training processes, allowing poisoned updates to preserve clean performance under triggers.
Non-IID client data makes malicious updates harder to distinguish from legitimate distributional variation.
Neurotoxin and SDBA improve persistence by masking parameters or gradients that honest clients modify less frequently.

3 THREAT MODEL AND STAIN-FL ATTACK PROCEDURE

STAIN-FL models a single compromised client in cross-silo federated video anomaly detection and injects contextual backdoors through targeted relabeling and masked malicious updates. The attack targets anomalous videos containing natural surveillance conditions while preserving clean behavior.

Threat model: The cross-silo setting includes K agency clients, with FedAvg or FedProx aggregating local updates while the honest server lacks access to client data and training processes.
Adversary assumptions: The adversary controls one client, can modify local labels and training, and submit malicious updates, but cannot control the server or aggregation rule.
Contextual trigger space: Candidate triggers include low-light, indoor, and crowded conditions selected from naturally occurring surveillance contexts.
Attack objective: The targeted objective is to classify trigger-conditioned anomalous videos as benign while preserving normal behavior on clean inputs.
Poisoned local data: The attack relabels triggered anomalous videos as benign while retaining remaining clean samples in the local attack dataset.
Masked malicious update: STAIN-FL masks the least-updated k% of model coordinates before submitting the malicious update, intending to improve stealth and durability.

4 EXPERIMENTAL EVALUATION

The evaluation measures STAIN-FL in a four-client non-IID federated surveillance setting using clean accuracy, backdoor accuracy, stealth, and durability. Sparse attacks remain difficult to detect while achieving substantial and persistent trigger-conditioned misclassification under FedAvg and FedProx.

Experimental Setup: The study uses four heterogeneous clients, UCF-Crime surveillance videos, Flower, and PyTorch to model non-IID multi-organization federated training.All clients participate in every communication round and perform one local epoch before submitting updates.
Evaluation Metrics: Stealth is measured by mean clean-accuracy drop against a five-round pre-attack baseline, with drops below 5% considered stealthy.Backdoor accuracy measures the proportion of triggered anomalous videos misclassified as normal.
Durability: STAIN-FL’s principal risk is low detectability combined with long post-attack persistence rather than maximum attack intensity.The durability analysis finds rapid decay above 40% backdoor accuracy but persistence for hundreds of rounds at lower levels.
Stealth: 1.66% under FedAvg and 1.03% under FedProx are the mean clean-accuracy drops for sparse attacks, both below the 5% stealth threshold.Continuous attacks are more detectable, with mean drops of 7.51% under FedAvg and 4.23% under FedProx.
Effectiveness and Persistence: 77.1% and 72.6% are the mean peak backdoor accuracies for continuous attacks under FedAvg and FedProx, versus 56.7% and 54.2% for sparse attacks.Continuous attacks therefore achieve higher peak effectiveness under both aggregation algorithms.
Effectiveness and Persistence: 250 post-attack rounds are required for sparse attacks to stabilize below 25% backdoor accuracy at the lowest mask ratio under FedAvg, versus 53 rounds for continuous attacks.Durability is threshold-dependent: the most persistent sparse FedAvg configuration never stabilizes below 20% within 919 post-attack rounds.

5 CONCLUSION AND FUTURE WORK

STAIN-FL is a contextual backdoor injection framework for federated video anomaly detection. Sparse attacks preserve clean accuracy relatively well while achieving substantial and persistent backdoor accuracy.

STAIN-FL exploits natural surveillance conditions and combines anomaly-to-benign relabeling with masked malicious updates.
1.66% under FedAvg and 1.03% under FedProx: sparse attacks keep clean-accuracy drops low.
56.7% under FedAvg and 54.2% under FedProx: sparse attacks reach these peak backdoor accuracies.
336 post-attack rounds: under FedAvg, sparse attacks remain above the 25% backdoor-accuracy threshold on average.
Continued benign aggregation alone is insufficient to remove embedded backdoors, while FedProx reduces some effects without eliminating long-term persistence.

A PER-CLIENT DATA DISTRIBUTION

The experiment uses a non-IID federated distribution across four agency clients, with domain-specific anomaly classes and selected overlaps. A balanced global test set is retained at the server.

Four clients: the remaining data is distributed across four agencies after the server retains a balanced global test set.
Domain-specific anomaly classes: the non-IID split assigns each client distinct anomaly domains while sharing selected classes across agency boundaries.
80/20 train/test splits: client data is divided locally after distribution across the four clients.

B STEALTH THRESHOLD JUSTIFICATION

The 5% stealth threshold is set above benign per-round accuracy fluctuations to distinguish sustained degradation from routine non-IID training noise.

5%: the stealth threshold exceeds the natural ±2–3% per-round accuracy fluctuation observed during benign non-IID FL training.
Drops below 5% are difficult to distinguish from routine training noise from a defender’s perspective.
Drops above 5% are more likely to indicate abnormal behavior and capture sustained performance degradation.

C IMPACT ROUNDS ANALYSIS

Impact rounds analysis measures cumulative post-attack persistence by counting rounds in which backdoor accuracy remains above specified thresholds. This complements stabilization analyses that identify when accuracy falls below thresholds or its variation enters tolerance bounds.

Impact rounds counts post-attack rounds with backdoor accuracy above a given threshold.
Method 1 records the round at which backdoor accuracy permanently stabilizes below a threshold, unlike cumulative impact-round counting.
Method 2 measures rounds until backdoor-accuracy variation stays within each specified tolerance.

D FULL STABILIZATION RESULTS

Tables 7 and 8 provide comprehensive post-attack stabilization results across gradient mask ratios, aggregation algorithms, accuracy thresholds, and volatility tolerances.

Tables 7 and 8 report post-attack stabilization results for all gradient mask ratios and aggregation algorithms.Table 7 uses threshold-based stabilization rounds, while Table 8 uses volatility-based stabilization rounds and reports overall post-attack standard deviation.
A value of 20 denotes immediate stabilization within the first measurement window, whereas NA denotes that stabilization was not reached during the post-attack period.
Table 8 evaluates stabilization across three volatility tolerances and includes the overall post-attack standard deviation.

E GLOBAL MODEL PERFORMANCE ACROSS FL ROUNDS

This section presents global clean and backdoor accuracy across federated-learning rounds. Figures 4–13 organize results by aggregation algorithm and gradient mask ratio, with panels grouped by attack pattern.

Global performance is summarized using per-round means computed over five runs and clipped to the first 500 rounds.
Each plot distinguishes clean accuracy, backdoor accuracy, and the attack phase using the shared legend.