Source-linked AI summary
CACTUS: Mask-Guided Semantic Clean-Label Backdoors in Decentralized Federated Learning
Chao Feng, Burkhard Stiller
TL;DR
CACTUS targets the difficulty of propagating semantic backdoors through repeated, topology-dependent aggregation in decentralized federated learning. It converts label-consistent semantic pairs into mask-guided, modality-specific counterfactual representation shifts shared through peer aggregation. With 30% malicious nodes, it achieves the highest nine-rule mean ASR on three of four modalities, including 51.2% on Speech Commands, while performance remains sensitive to heterogeneity and network scale.
Problem
Repeated peer aggregation in DFL can dilute sample-dependent semantic trigger signals before they become shared behavior, motivating a common semantic effect that survives propagation.
Method
CACTUS constructs semantic pairs offline, computes mask-guided modality-specific shifts, applies them counterfactually to clean non-target embeddings, and trains malicious nodes with these shifts before DFL sharing.
Results
CACTUS has the highest nine-rule mean ASR among evaluated attacks on three of four modalities; with 30% malicious nodes, its Speech Commands mean ASR is 51.2%.
Takeaways & Limitations
The results indicate that CACTUS can propagate clean-label backdoors through repeated DFL aggregation, with outcomes varying across aggregation rules, topologies, and system configurations.
Takeaways & Limitations
Performance is constrained by sensitivity to system configuration, including data heterogeneity and node-network scale, and evaluation covers only four tasks.
Abstract
from arXiv · showhide
Semantic triggers in federated learning (FL) can be less conspicuous than synthetic patches, but sample-dependent placement may weaken backdoor implantation across aggregation rounds. This challenge is compounded in decentralized FL (DFL), where topology-dependent peer aggregation repeatedly mixes local models. CACTUS converts label-consistent semantic pairs into target-directed representation shifts. Mask-guided, modality-specific operators isolate trigger effects, couple them across samples, and apply the shifts counterfactually to clean non-target embeddings before peer aggregation. Experiments cover speech, text, tabular, and image tasks under nine aggregation rules. With 30\% malicious nodes, CACTUS reaches a nine-rule mean attack success rate (ASR) of 51.2\% on Speech Commands and the highest nine-rule mean ASR among evaluated attacks on three of four modalities. Sensitivity analyses show that ASR varies with network topology and increases with the malicious-node ratio. These results indicate that CACTUS can propagate backdoors through repeated DFL aggregation.
1. INTRODUCTION
CACTUS addresses the difficulty of propagating inconspicuous semantic backdoors through repeated, topology-dependent peer aggregation in decentralized federated learning. It uses mask-guided semantic pairs to create a shared target-directed representation shift that can persist across DFL rounds.
- 1. INTRODUCTION: DFL repeatedly mixes local models through neighbor aggregation, so trigger associations may propagate or attenuate across hops.The attack must extract a common semantic effect that local training can reinforce and the graph can propagate.
- 1. INTRODUCTION: CACTUS forms label-consistent clean-triggered pairs and records masks identifying each trigger’s modality-specific support.The constructor enables semantic triggers while preserving the target label.
- 1. INTRODUCTION: Modality-specific and coupling operators isolate target-directed shifts, share them across source samples, and apply them counterfactually to clean non-target embeddings.Malicious nodes jointly optimize these counterfactual shifts with ordinary task objectives before submitting standard model states.
- 1. INTRODUCTION: 51.2% is CACTUS’s nine-rule mean ASR on Speech Commands with 30% malicious nodes, while it achieves 71.1%, 25.7%, and 20.3% on Text, Tabular, and CelebA.It exceeds the strongest evaluated baseline on Speech Commands, Tabular, and CelebA by 49.4, 2.5, and 6.1 percentage points, respectively.
2. METHOD
CACTUS operates in decentralized FL under a threat model where malicious nodes control local training and submitted states but not benign nodes, the graph, or aggregation rules. Its method constructs semantic pairs, computes modality-specific masked shifts, couples valid pairs, and shares resulting models through peer aggregation.
- 2. METHOD: CACTUS constructs semantic pairs offline, trains with paired counterfactual shifts, and shares the resulting models through DFL.This workflow is summarized as semantic pair construction followed by paired-shift training and model exchange.
- 2.1. DFL and Threat Model: Malicious nodes control local optimization, submitted states, and offline target-pair shards, but not benign nodes, the communication graph, or aggregation rules.The objective is high ASR on triggered inputs at benign nodes with little clean-accuracy loss.
- 2.2. Semantic Pair Construction: The offline constructor produces context-compatible semantic pairs whose triggered and clean samples retain the target label, while masks record modality-specific trigger support.The model uses an encoder hθ and head cθ to represent these paired samples.
- 2.3. Paired-Shift Counterfactual Training: Mask-guided operators compute modality-specific representation shifts and normalize them by mask coverage before paired-shift training.The operators differ across tabular, speech, text, and image modalities.
- 2.3. Paired-Shift Counterfactual Training: Coupling and source operators use valid pairs in a local minibatch, while auxiliary terms are omitted when sufficient pairs or eligible sources are unavailable.The number of valid pairs is composition-dependent.
- 2. METHOD: Surviving malicious components enter the next peer-aggregated state and can reinforce across rounds, with topology, local training, and aggregation governing propagation.Each neighbor applies its aggregation rule to its own and received states.
3. EXPERIMENTS
CACTUS is evaluated across four semantic-trigger tasks, nine aggregation rules, and multiple decentralized settings. It achieves strong cross-task attack performance, progressive implantation, and sensitivity to aggregation, malicious-node ratio, topology, heterogeneity, and clipping.
- Evaluation setting: The four tasks use label-preserving semantic triggers: cough overlays for Speech Commands, contextual additions for Text, feature shifts for Tabular, and sunglasses for CelebA.Speech Commands uses temporal masks, Text uses token masks, Tabular modifies five selected features toward Normal medians, and CelebA uses eye-region masks.
- Evaluation setting: The evaluation uses ten IID nodes in a fully connected topology, malicious-node ratio ρ = 0.3, 20 rounds, five baselines, and nine aggregation rules.The rules include FedAvg, Median, Trimmed Mean, Krum, Multi-Krum, DnC, FLAME, FLTrust, and Sentinel.
- Attack effectiveness: 51.2%, 71.1%, 25.7%, and 20.3% are CACTUS’s nine-rule mean ASRs on Speech Commands, Text, Tabular, and CelebA, respectively.CACTUS ranks first on all tasks except Text; Batman leads Text at 76.1%.
- Attack effectiveness: Aggregation effects are task-dependent: CACTUS leads under FedAvg and Trimmed Mean on all tasks, but remains below 8% on three tasks under Krum and Multi-Krum.On Text, CACTUS reaches 78.6% under Krum and 28.2% under Multi-Krum.
- Attack dynamics: Under FedAvg, CACTUS ASR rises from 3.73% at round 5 to 95.39% at round 20, while all baselines remain below 2%.The reported increase indicates progressive implantation rather than a transient effect from one malicious update.
- Sensitivity analysis: At ρ = 0.3, Speech Commands clean accuracy is 0.09 percentage points below the matched control, while ASR rises from 1.1% to 98.8% as ρ increases from 0.1 to 0.7.The clean-accuracy range across the four ρ > 0 settings is 95.9–96.3%.
- Sensitivity analysis: Speech Commands ASR generally rises with graph density, reaching 15.2%, 43.5%, 55.3%, and 51.2% for Ring, ER-4, ER-6, and fully connected topologies.Dirichlet α = 0.1 lowers clean accuracy from 96.3% to 64.7% and ASR from 51.2% to 11.3%.
- Sensitivity analysis: Anchor-update clipping raises Krum ASR from 0.46% to 34.10% but lowers the nine-rule mean from 51.20% to 4.10%.The intervention trades broad attack effectiveness for a Krum-specific gain.
4. SUMMARY, LIMITATIONS, AND FUTURE WORK
CACTUS supports clean-label backdoor propagation through DFL by translating semantic pairs into counterfactual shifts. It achieves the highest nine-rule mean ASR on three of four modalities, while remaining limited by aggregation-rule weakness, configuration sensitivity, and narrow evaluation.
- CACTUS translates label-consistent semantic pairs into counterfactual shifts that support clean-label backdoor propagation through DFL.
- CACTUS has the highest nine-rule mean ASR among evaluated attacks on three of four modalities.
- Its main limitations are weak performance under several aggregation rules and sensitivity to system configuration.
- Evaluation covers only four tasks, motivating future study of additional architectures, heterogeneous data regimes, and dynamic networks.
6. COMPLIANCE WITH ETHICAL STANDARDS
The study uses public datasets in a controlled investigation of DFL vulnerabilities for defensive research. It collects no new human- or animal-subject data and reports no conflicts of interest.
- The controlled study uses public datasets to identify DFL vulnerabilities for defensive research.
- No new human- or animal-subject data are collected.
- The authors declare no conflicts of interest.