Abstract: Federated learning enables different participants to jointly train a global model using their private datasets.However,the distributed nature of federated learning also provides room for backdoor attacks.The attacker of the backdoor attack poisons the global model causing the global model misleads to targeted incorrect predictions when encountering samples with specific backdoor triggers.This paper proposes a backdoor attack method for federated learning based on knowledge distillation.Firstly,the teacher model is trained using the concentrated poison dataset generated by distillation,and the “dark knowledge” of the teacher model is transferred to the student model to refine the maliciousneurons.Then,the neurons with backdoors are embedded into the global model through Z-scoreranking and mixing of neurons .The experiment is evaluated the performance of KDFLBD in iid and non-iid scenarios on common datasets.Compared with pixel attacks and label flipping attacks,KDFLBD significantly improves the attack success rate(ASR) while ensuring that the main task accuracy(MTA) is not affected.

Key words: Federated learning, Backdoor attack, Knowledge distillation, Trigger, Privacy protection