{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/learning-to-backdoor-federated-learning","title":"Learning to Backdoor Federated Learning","arxiv_id":"2303.03320","date":"2023-03-06","proceeding":null,"authors":["Henger Li","Chen Wu","Sencun Zhu","Zizhan Zheng"],"abstract":"In a federated learning (FL) system, malicious participants can easily embed backdoors into the aggregated model while maintaining the model's performance on the main task. To this end, various defenses, including training stage aggregation-based defenses and post-training mitigation defenses, have been proposed recently. While these defenses obtain reasonable performance against existing backdoor attacks, which are mainly heuristics based, we show that they are insufficient in the face of more advanced attacks. In particular, we propose a general reinforcement learning-based backdoor attack framework where the attacker first trains a (non-myopic) attack policy using a simulator built upon its local data and common knowledge on the FL system, which is then applied during actual FL training. Our attack framework is both adaptive and flexible and achieves strong attack performance and durability even under state-of-the-art defenses.","url_abs":"https://arxiv.org/abs/2303.03320v3","url_pdf":"https://arxiv.org/pdf/2303.03320v3.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"learning-to-backdoor-federated-learning","repo_url":"https://github.com/HengerLi/RLBackdoorFL","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":0,"framework":"pytorch","reach":{"status":"ok","spdx":"MIT"}}],"tasks":[{"task_slug":"backdoor-attack","task_name":"Backdoor Attack"},{"task_slug":"federated-learning","task_name":"Federated Learning"},{"task_slug":"general-reinforcement-learning","task_name":"General Reinforcement Learning"}],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=2303.03320","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2303.03320"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/HengerLi/RLBackdoorFL","reach":{"status":"ok","spdx":"MIT"}}],"summary":{"unverified":13},"by_repo_kind":{"official":{"samples":13,"ran":0,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":0,"samples":[{"code_sha256_prefix":"6821be439ef02b04","entry":"Krum","repo":"HengerLi/RLBackdoorFL","repo_kind":"official","path":"Aggr.py","file_url":"https://github.com/HengerLi/RLBackdoorFL/blob/HEAD/Aggr.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"6821be439ef02b04"}},{"code_sha256_prefix":"348c44000d8135e2","entry":"Median","repo":"HengerLi/RLBackdoorFL","repo_kind":"official","path":"Aggr.py","file_url":"https://github.com/HengerLi/RLBackdoorFL/blob/HEAD/Aggr.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"348c44000d8135e2"}},{"code_sha256_prefix":"846e6bad6445af61","entry":"Neurocraft","repo":"HengerLi/RLBackdoorFL","repo_kind":"official","path":"Backdoor_attacks.py","file_url":"https://github.com/HengerLi/RLBackdoorFL/blob/HEAD/Backdoor_attacks.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"846e6bad6445af61"}},{"code_sha256_prefix":"721fbcc0d1c6224b","entry":"Neurotoxin","repo":"HengerLi/RLBackdoorFL","repo_kind":"official","path":"Backdoor_attacks.py","file_url":"https://github.com/HengerLi/RLBackdoorFL/blob/HEAD/Backdoor_attacks.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"721fbcc0d1c6224b"}},{"code_sha256_prefix":"b71f709c3830bf3f","entry":"add_pattern_bd","repo":"HengerLi/RLBackdoorFL","repo_kind":"official","path":"DataProcess.py","file_url":"https://github.com/HengerLi/RLBackdoorFL/blob/HEAD/DataProcess.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"b71f709c3830bf3f"}},{"code_sha256_prefix":"58e57acf73c78a82","entry":"average","repo":"HengerLi/RLBackdoorFL","repo_kind":"official","path":"Aggr.py","file_url":"https://github.com/HengerLi/RLBackdoorFL/blob/HEAD/Aggr.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"58e57acf73c78a82"}},{"code_sha256_prefix":"ea6f4a59cd65daf9","entry":"cos_sim","repo":"HengerLi/RLBackdoorFL","repo_kind":"official","path":"Util.py","file_url":"https://github.com/HengerLi/RLBackdoorFL/blob/HEAD/Util.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"ea6f4a59cd65daf9"}},{"code_sha256_prefix":"97022c949a88944d","entry":"get_datasets","repo":"HengerLi/RLBackdoorFL","repo_kind":"official","path":"DataProcess.py","file_url":"https://github.com/HengerLi/RLBackdoorFL/blob/HEAD/DataProcess.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"97022c949a88944d"}},{"code_sha256_prefix":"6fdf455dc1bee0bd","entry":"get_prune_mask","repo":"HengerLi/RLBackdoorFL","repo_kind":"official","path":"Post_defenses.py","file_url":"https://github.com/HengerLi/RLBackdoorFL/blob/HEAD/Post_defenses.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"6fdf455dc1bee0bd"}},{"code_sha256_prefix":"adcfd6e8d0eef5ef","entry":"get_prune_rank","repo":"HengerLi/RLBackdoorFL","repo_kind":"official","path":"Post_defenses.py","file_url":"https://github.com/HengerLi/RLBackdoorFL/blob/HEAD/Post_defenses.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"adcfd6e8d0eef5ef"}},{"code_sha256_prefix":"934c67c9bb395a45","entry":"prune_train","repo":"HengerLi/RLBackdoorFL","repo_kind":"official","path":"Post_defenses.py","file_url":"https://github.com/HengerLi/RLBackdoorFL/blob/HEAD/Post_defenses.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"934c67c9bb395a45"}},{"code_sha256_prefix":"65bc749ceadcf87d","entry":"relu","repo":"HengerLi/RLBackdoorFL","repo_kind":"official","path":"Util.py","file_url":"https://github.com/HengerLi/RLBackdoorFL/blob/HEAD/Util.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"65bc749ceadcf87d"}},{"code_sha256_prefix":"af55adf6fe81c6d9","entry":"weights_to_vector","repo":"HengerLi/RLBackdoorFL","repo_kind":"official","path":"Util.py","file_url":"https://github.com/HengerLi/RLBackdoorFL/blob/HEAD/Util.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"af55adf6fe81c6d9"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}