POLAR: Policy-based Layerwise Reinforcement Learning Method for Stealthy Backdoor Attacks in Federated Learning

• URL: http://arxiv.org/abs/2510.19056v1
• Date: Tue, 21 Oct 2025 20:17:09 GMT
• Title: POLAR: Policy-based Layerwise Reinforcement Learning Method for Stealthy Backdoor Attacks in Federated Learning
• Abstract summary: Federated Learning (FL) enables decentralized model training across multiple clients without exposing local data.<n>Despite early FL backdoor attacks modifying entire models, recent studies have explored the concept of backdoor-critical layers.<n>We propose POLAR (POlicy-based LAyerwise Reinforcement learning), the first pipeline to creatively adopt RL to solve the BC layer selection problem.
• Score: 25.124855276343236
• License: http://creativecommons.org/licenses/by-sa/4.0/
• Abstract: Federated Learning (FL) enables decentralized model training across multiple clients without exposing local data, but its distributed feature makes it vulnerable to backdoor attacks. Despite early FL backdoor attacks modifying entire models, recent studies have explored the concept of backdoor-critical (BC) layers, which poison the chosen influential layers to maintain stealthiness while achieving high effectiveness. However, existing BC layers approaches rely on rule-based selection without consideration of the interrelations between layers, making them ineffective and prone to detection by advanced defenses. In this paper, we propose POLAR (POlicy-based LAyerwise Reinforcement learning), the first pipeline to creatively adopt RL to solve the BC layer selection problem in layer-wise backdoor attack. Different from other commonly used RL paradigm, POLAR is lightweight with Bernoulli sampling. POLAR dynamically learns an attack strategy, optimizing layer selection using policy gradient updates based on backdoor success rate (BSR) improvements. To ensure stealthiness, we introduce a regularization constraint that limits the number of modified layers by penalizing large attack footprints. Extensive experiments demonstrate that POLAR outperforms the latest attack methods by up to 40% against six state-of-the-art (SOTA) defenses.

Related papers

• Pmeta-TLA: Backdoor Attacks for Speech Classification Models via Meta-Learning with Timbre Leakage Attack [1.2373172839910807]
  This work discusses the vulnerability of current speech triggers to detection by deep neural network defenders and introduces the Timbre Leakage Attack (TLA)<n>TLA disseminates timbre information at the frame level within the deep self-supervised features, producing poisoned samples that appear natural to human perception.
  arXiv  Detail & Related papers  (2026-07-02T04:51:27Z)
• Enhancing Gradient Inversion Attacks in Federated Learning via Hierarchical Feature Optimization [56.95448807869383]
  Federated Learning (FL) has emerged as a compelling paradigm for privacy-preserving distributed machine learning.<n>Recent studies find that the gradients exchanged in the FL system are also vulnerable to privacy leakage.<n>We propose textbfGradient textbfInversion over textbfFeature textbfDomains (GIFD)
  arXiv  Detail & Related papers  (2026-04-01T14:32:15Z)
• DSBA: Dynamic Stealthy Backdoor Attack with Collaborative Optimization in Self-Supervised Learning [10.286339414754496]
  Self-Supervised Learning (SSL) has emerged as a significant paradigm in representation learning thanks to its ability to learn without extensive labeled data.<n>Recent research reveals that SSL models are also vulnerable to backdoor attacks.<n>We propose a Dynamic Stealthy Backdoor Attack (DSBA) backed by a new technique we term Collaborative Optimization.
  arXiv  Detail & Related papers  (2026-03-03T10:49:46Z)
• Exploiting Layer-Specific Vulnerabilities to Backdoor Attack in Federated Learning [11.457223154116742]
  Federated learning (FL) enables distributed model training across edge devices while preserving data locality.<n>This paper presents the Layer Smoothing Attack (LSA), a novel backdoor attack that exploits layer-specific vulnerabilities in neural networks.
  arXiv  Detail & Related papers  (2026-02-16T19:59:53Z)
• MARS: A Malignity-Aware Backdoor Defense in Federated Learning [51.77354308287098]
  Recently proposed state-of-the-art (SOTA) attack, 3DFed, uses an indicator mechanism to determine whether backdoor models have been accepted by the defender.<n>We propose a Malignity-Aware backdooR defenSe (MARS) that leverages backdoor energy to indicate the malicious extent of each neuron.<n>Experiments demonstrate that MARS can defend against SOTA backdoor attacks and significantly outperforms existing defenses.
  arXiv  Detail & Related papers  (2025-09-21T14:50:02Z)
• Reinforcement Learning for Decision-Level Interception Prioritization in Drone Swarm Defense [51.736723807086385]
  We present a case study demonstrating the practical advantages of reinforcement learning in addressing this challenge.<n>We introduce a high-fidelity simulation environment that captures realistic operational constraints.<n>Agent learns to coordinate multiple effectors for optimal interception prioritization.<n>We evaluate the learned policy against a handcrafted rule-based baseline across hundreds of simulated attack scenarios.
  arXiv  Detail & Related papers  (2025-08-01T13:55:39Z)
• Local Pairwise Distance Matching for Backpropagation-Free Reinforcement Learning [0.9065034043031668]
  Training neural networks with reinforcement learning (RL) typically relies on backpropagation (BP)<n>BP requires storage of activations from the forward pass for subsequent backward updates.<n>We propose a novel approach that trains each layer of the neural network using local signals during the forward pass in RL settings.
  arXiv  Detail & Related papers  (2025-07-15T14:39:41Z)
• ARBoids: Adaptive Residual Reinforcement Learning With Boids Model for Cooperative Multi-USV Target Defense [0.918715978278858]
  This letter introduces ARBoids, a novel adaptive residual reinforcement learning framework.<n>It integrates deep reinforcement learning with the biologically inspired, force-based Boids model.<n>The proposed approach is validated in a high-fidelity Gazebo simulation environment.
  arXiv  Detail & Related papers  (2025-02-25T16:05:33Z)
• Class-Conditional Neural Polarizer: A Lightweight and Effective Backdoor Defense by Purifying Poisoned Features [58.44299620519961]
  Recent studies have highlighted the vulnerability of deep neural networks to backdoor attacks.<n>We propose a lightweight backdoor defense approach, called neural polarizer-based defense (CNPD)<n> CNPD integrates the backdoored model's predicted label with the features to be purified.
  arXiv  Detail & Related papers  (2025-02-23T11:11:16Z)
• ELBA-Bench: An Efficient Learning Backdoor Attacks Benchmark for Large Language Models [55.93380086403591]
  Generative large language models are vulnerable to backdoor attacks.<n>$textitELBA-Bench$ allows attackers to inject backdoor through parameter efficient fine-tuning.<n>$textitELBA-Bench$ provides over 1300 experiments.
  arXiv  Detail & Related papers  (2025-02-22T12:55:28Z)
• Continuous Knowledge-Preserving Decomposition with Adaptive Layer Selection for Few-Shot Class-Incremental Learning [73.59672160329296]
  CKPD-FSCIL is a unified framework that unlocks the underutilized capacity of pretrained weights.<n>Our method consistently outperforms state-of-the-art approaches in both adaptability and knowledge retention.
  arXiv  Detail & Related papers  (2025-01-09T07:18:48Z)
• IBD-PSC: Input-level Backdoor Detection via Parameter-oriented Scaling Consistency [20.61046457594186]
  Deep neural networks (DNNs) are vulnerable to backdoor attacks. This paper proposes a simple yet effective input-level backdoor detection (dubbed IBD-PSC) to filter out malicious testing images.
  arXiv  Detail & Related papers  (2024-05-16T03:19:52Z)
• Backdoor Federated Learning by Poisoning Backdoor-Critical Layers [32.510730902353224]
  Federated learning (FL) has been widely deployed to enable machine learning training on sensitive data across distributed devices. This paper proposes a general in-situ approach that identifies and verifies backdoor layers from the perspective of attackers. Based on the identified BC layers, we carefully craft a new backdoor attack methodology that adaptively seeks a fundamental balance between attacking effects and stealthiness under various defense strategies.
  arXiv  Detail & Related papers  (2023-08-08T05:46:47Z)
• LAS-AT: Adversarial Training with Learnable Attack Strategy [82.88724890186094]
  "Learnable attack strategy", dubbed LAS-AT, learns to automatically produce attack strategies to improve the model robustness. Our framework is composed of a target network that uses AEs for training to improve robustness and a strategy network that produces attack strategies to control the AE generation.
  arXiv  Detail & Related papers  (2022-03-13T10:21:26Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.