# Can You Really Backdoor Federated Learning?

**Authors:** Ziteng Sun, Peter Kairouz, Ananda Theertha Suresh, H. Brendan McMahan  
**arXiv:** [1911.07963](https://arxiv.org/abs/1911.07963)  
**Date:** 2019-11-18  
**Summary page:** https://www.summarizepaper.com/en/paper/1911.07963v2/

## Key points

- Federated learning involves decentralized data across multiple devices or servers
- Backdoor attacks in federated learning aim to reduce model performance on specific tasks while maintaining high performance on the primary task
- Study includes non-malicious clients with accurately labeled samples from targeted tasks
- Research analyzes backdoor attacks and defenses using the EMNIST dataset, which is user-partitioned and non-iid
- Success of an attack depends on factors like proportion of adversaries and complexity of targeted task
- Techniques like norm clipping and "weak" differential privacy can mitigate attacks without compromising overall model performance
- Authors implemented attacks and defenses using TensorFlow Federated (TFF) framework, open-sourcing their code for further exploration in the field

## Summary

In the realm of federated learning, where data is decentralized across multiple devices or servers, detecting and defending against adversarial attacks presents a significant challenge. This paper delves into the realm of backdoor attacks within the federated learning framework. These attacks aim to diminish the model's performance on specific tasks while maintaining high performance on the primary task. What sets this study apart is its inclusion of non-malicious clients with accurately labeled samples from targeted tasks. The research focuses on analyzing backdoor attacks and corresponding defenses using the EMNIST dataset, which mirrors real-life scenarios by being user-partitioned and non-iid (non-independent and identically distributed). The findings reveal that without proper defenses in place, the success of an attack hinges on factors such as the proportion of adversaries present and the complexity of the targeted task. Furthermore, through experimentation, it was demonstrated that techniques like norm clipping and "weak" differential privacy can effectively mitigate these attacks without compromising overall model performance. To facilitate further exploration in this field, the authors have implemented these attacks and defenses using TensorFlow Federated (TFF), a framework designed for federated learning. By open-sourcing their code, they aim to inspire researchers to develop new attack strategies, defense mechanisms, and evaluate them using established federated datasets. This comprehensive study sheds light on the intricacies of backdoor attacks in federated learning environments and underscores the importance of robust defense strategies to safeguard against malicious interventions while preserving model integrity and performance.