# A Knowledge Distillation-Based Backdoor Attack in Federated Learning

**Authors:** Yifan Wang, Wei Fan, Keke Yang, Naji Alhusaini, Jing Li  
**arXiv:** [2208.06176](https://arxiv.org/abs/2208.06176)  
**Date:** 2022-08-12  
**Summary page:** https://www.summarizepaper.com/en/paper/2208.06176v1/

## Key points

- Federated Learning (FL) is a groundbreaking framework in decentralized machine learning.
- FL is susceptible to adversarial attacks, particularly backdoor attacks during the training process.
- Various methods of backdoor attacks in FL have been devised, but countermeasures have also been developed to defend against them.
- Adversarial Knowledge Distillation (ADVKD) is proposed as a novel approach to mitigate abnormal characteristics resulting from label manipulation in backdoor attacks in FL.
- ADVKD integrates knowledge distillation with backdoor attack strategies in FL to successfully circumvent defenses and achieve higher attack success rates compared to other methods.

## Summary

, , , , 

In the realm of decentralized machine learning, Federated Learning (FL) has emerged as a groundbreaking framework. However, its decentralized nature renders it susceptible to adversarial attacks during the training process, particularly backdoor attacks. These insidious attacks involve injecting a backdoor into the machine learning model, causing it to exhibit erroneous behavior on test samples triggered by specific backdoor cues. While various methods of backdoor attacks in FL have been devised, countermeasures have also been developed to defend against them. Many defense mechanisms rely on detecting abnormal characteristics exhibited by models with backdoors or discerning differences between these compromised models and regular ones. To overcome these defenses effectively, it is crucial to minimize such discrepancies and abnormal traits. One notable source of abnormality stems from backdoor attacks directly altering data labels during poisoning. Despite existing studies on backdoor attacks in FL, there remains a gap in addressing the reduction of disparities between models with backdoors and standard models. In response to this challenge, a novel approach called Adversarial Knowledge Distillation (ADVKD) is proposed in this paper. By integrating knowledge distillation with backdoor attack strategies in FL, ADVKD aims to mitigate the abnormal characteristics resulting from label manipulation, enabling models to circumvent defenses successfully. Comparative analysis demonstrates that ADVKD not only achieves higher attack success rates but also outperforms other methods by evading defenses that would typically thwart such attacks. The study further delves into exploring how different parameters impact ADVKD's performance across diverse scenarios. Experimental results provide insights into optimizing parameters for enhanced efficacy under varying conditions. Moreover, visualization techniques are employed to illustrate the effects of different attack strategies and elucidate the effectiveness of ADVKD in overcoming defenses. Through meticulous experimentation and analysis, this research sheds light on the potential of Adversarial Knowledge Distillation as a robust defense mechanism against backdoor attacks in Federated Learning environments.