{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/chameleon-adapting-to-peer-images-for","title":"Chameleon: Adapting to Peer Images for Planting Durable Backdoors in Federated Learning","arxiv_id":"2304.12961","date":"2023-04-25","proceeding":null,"authors":["Yanbo Dai","Songze Li"],"abstract":"In a federated learning (FL) system, distributed clients upload their local models to a central server to aggregate into a global model. Malicious clients may plant backdoors into the global model through uploading poisoned local models, causing images with specific patterns to be misclassified into some target labels. Backdoors planted by current attacks are not durable, and vanish quickly once the attackers stop model poisoning. In this paper, we investigate the connection between the durability of FL backdoors and the relationships between benign images and poisoned images (i.e., the images whose labels are flipped to the target label during local training). Specifically, benign images with the original and the target labels of the poisoned images are found to have key effects on backdoor durability. Consequently, we propose a novel attack, Chameleon, which utilizes contrastive learning to further amplify such effects towards a more durable backdoor. Extensive experiments demonstrate that Chameleon significantly extends the backdoor lifespan over baselines by $1.2\\times \\sim 4\\times$, for a wide range of image datasets, backdoor types, and model architectures.","url_abs":"https://arxiv.org/abs/2304.12961v2","url_pdf":"https://arxiv.org/pdf/2304.12961v2.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"chameleon-adapting-to-peer-images-for","repo_url":"https://github.com/ybdai7/Chameleon-durable-backdoor","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":1,"framework":"pytorch","reach":null}],"tasks":[{"task_slug":"contrastive-learning","task_name":"Contrastive Learning"},{"task_slug":"federated-learning","task_name":"Federated Learning"},{"task_slug":"model-poisoning","task_name":"Model Poisoning"}],"methods":[{"method_slug":"contrastive-learning","method_name":"Contrastive Learning"}],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=2304.12961","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2304.12961"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/ybdai7/Chameleon-durable-backdoor","reach":null}],"summary":{"ran":4,"ran_honours":1,"unverified":6},"by_repo_kind":{"official":{"samples":11,"ran":5,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":0,"samples":[{"code_sha256_prefix":"43a7e58eb07a6d26","entry":"SimpleNet","repo":"ybdai7/Chameleon-durable-backdoor","repo_kind":"official","path":"models/dense_efficient.py","file_url":"https://github.com/ybdai7/Chameleon-durable-backdoor/blob/HEAD/models/dense_efficient.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"43a7e58eb07a6d26"}},{"code_sha256_prefix":"2855647a9013d5e7","entry":"_DummyBackwardHookFn","repo":"ybdai7/Chameleon-durable-backdoor","repo_kind":"official","path":"models/dense_efficient.py","file_url":"https://github.com/ybdai7/Chameleon-durable-backdoor/blob/HEAD/models/dense_efficient.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"2855647a9013d5e7"}},{"code_sha256_prefix":"092cc4563c85038a","entry":"_EfficientDensenetBottleneckFn","repo":"ybdai7/Chameleon-durable-backdoor","repo_kind":"official","path":"models/dense_efficient.py","file_url":"https://github.com/ybdai7/Chameleon-durable-backdoor/blob/HEAD/models/dense_efficient.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"092cc4563c85038a"}},{"code_sha256_prefix":"e50ed9bcf4bba37c","entry":"_Transition","repo":"ybdai7/Chameleon-durable-backdoor","repo_kind":"official","path":"models/dense_efficient.py","file_url":"https://github.com/ybdai7/Chameleon-durable-backdoor/blob/HEAD/models/dense_efficient.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"e50ed9bcf4bba37c"}},{"code_sha256_prefix":"b57d2350b801687b","entry":"test_poison","repo":"ybdai7/chameleon-durable-backdoor","repo_kind":"official","path":"training.py","file_url":"https://github.com/ybdai7/chameleon-durable-backdoor/blob/HEAD/training.py","link_basis":"first_harvest_node","language":"python","status":"ran_honours","verification_level":1,"contract_check":"HONOURS","metamorphic_tier":"well_formed","behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"b57d2350b801687b"}},{"code_sha256_prefix":"269c448d7ff5e477","entry":"DenseNetEfficient","repo":"ybdai7/Chameleon-durable-backdoor","repo_kind":"official","path":"models/dense_efficient.py","file_url":"https://github.com/ybdai7/Chameleon-durable-backdoor/blob/HEAD/models/dense_efficient.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"269c448d7ff5e477"}},{"code_sha256_prefix":"7fb033aa9e98aa07","entry":"_DenseBlock","repo":"ybdai7/Chameleon-durable-backdoor","repo_kind":"official","path":"models/dense_efficient.py","file_url":"https://github.com/ybdai7/Chameleon-durable-backdoor/blob/HEAD/models/dense_efficient.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"7fb033aa9e98aa07"}},{"code_sha256_prefix":"b20505a5494594fe","entry":"_DenseLayer","repo":"ybdai7/Chameleon-durable-backdoor","repo_kind":"official","path":"models/dense_efficient.py","file_url":"https://github.com/ybdai7/Chameleon-durable-backdoor/blob/HEAD/models/dense_efficient.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"b20505a5494594fe"}},{"code_sha256_prefix":"fe1c3a8b852e94c9","entry":"_EfficientDensenetBottleneck","repo":"ybdai7/Chameleon-durable-backdoor","repo_kind":"official","path":"models/dense_efficient.py","file_url":"https://github.com/ybdai7/Chameleon-durable-backdoor/blob/HEAD/models/dense_efficient.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"fe1c3a8b852e94c9"}},{"code_sha256_prefix":"4fad719fe1d404a5","entry":"_SharedAllocation","repo":"ybdai7/Chameleon-durable-backdoor","repo_kind":"official","path":"models/dense_efficient.py","file_url":"https://github.com/ybdai7/Chameleon-durable-backdoor/blob/HEAD/models/dense_efficient.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"4fad719fe1d404a5"}},{"code_sha256_prefix":"16fb979ea70caf2c","entry":"test","repo":"ybdai7/chameleon-durable-backdoor","repo_kind":"official","path":"training.py","file_url":"https://github.com/ybdai7/chameleon-durable-backdoor/blob/HEAD/training.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"16fb979ea70caf2c"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}