Bypassing Krum: Selection-Aware Backdoor Attacks in Federated Learning

2026-08-06

AI Summary

This work addresses the vulnerability of distance-based robust aggregation methods in federated learning—such as Krum—to adaptive backdoor attacks. To exploit this weakness, the authors propose Krum-Proxy, a novel attack strategy that employs a two-stage optimization process to craft malicious model updates that closely mimic the distribution of benign updates while simultaneously residing in regions favored by the aggregation mechanism, thereby evading detection. The key innovation lies in decoupling the attack objective from geometric structure optimization and incorporating mechanisms such as neighbor proxy modeling, anchor-guided alignment, and norm-variance projection constraints. Experimental results demonstrate that Krum-Proxy significantly increases attack success rates on standard federated learning benchmarks while preserving high model accuracy on clean data, thereby exposing critical security limitations in current robust aggregators.

Abstract

Robust aggregation methods are widely used in federated learning to mitigate the impact of adversarial client behavior. Distance-based aggregation rules, such as Krum and Multi-Krum, select updates that are closest to the majority under the assumption that benign updates form a compact cluster. However, these methods rely on geometric properties that can be exploited by adaptive adversaries. We introduce the Krum-Proxy attack, a selection-aware backdoor injection strategy that consistently bypasses Byzantine-robust aggregation. Rather than relying on naive scaling or constraining, our method actively optimizes malicious updates to infiltrate the dense core of the benign distribution. The proposed method constructs adversarial updates that are not only similar to benign updates but are also optimized to lie in regions of the update space that are favored during aggregation. This is achieved through a two-stage optimization procedure that separates task-specific attack objectives from geometry-aware refinement, using a nearest-neighbor proxy, stochastic reference modeling, and anchor-guided alignment. To maintain stealth, we introduce a projection mechanism that constrains adversarial updates within realistic norm and variance bounds. Experiments on standard federated learning benchmarks show that Krum-Proxy achieves higher attack success while preserving clean accuracy, highlighting the vulnerability of distance-based aggregation to selection-aware adversaries.

Problem

• Federated Learning
• Backdoor Attacks
• Byzantine-Robust Aggregation
• Krum
• Adversarial Clients

Innovation

• selection-aware attack
• Byzantine-robust aggregation
• Krum-Proxy
• federated learning
• backdoor injection