Privacy Inference-Empowered Stealthy Backdoor Attack on Federated
  Learning under Non-IID Scenarios
Haochen Mei Gaolei Li Jun Wu Longfei Zheng
Federated learning (FL) naturally faces the problem of data heterogeneity in
real-world scenarios, but this is often overlooked by studies on FL security
and privacy. On the one hand, the effectiveness of backdoor attacks on FL may
drop significantly under non-IID scenarios. On the other hand, malicious
clients may steal private data through privacy inference attacks. Therefore, it
is necessary to have a comprehensive perspective of data heterogeneity,
backdoor, and privacy inference. In this paper, we propose a novel privacy
inference-empowered stealthy backdoor attack (PI-SBA) scheme for FL under
non-IID scenarios. Firstly, a diverse data reconstruction mechanism based on
generative adversarial networks (GANs) is proposed to produce a supplementary
dataset, which can improve the attacker's local data distribution and support
more sophisticated strategies for backdoor attacks. Based on this, we design a
source-specified backdoor learning (SSBL) strategy as a demonstration, allowing
the adversary to arbitrarily specify which classes are susceptible to the
backdoor trigger. Since the PI-SBA has an independent poisoned data synthesis
process, it can be integrated into existing backdoor attacks to improve their
effectiveness and stealthiness in non-IID scenarios. Extensive experiments
based on MNIST, CIFAR10 and Youtube Aligned Face datasets demonstrate that the
proposed PI-SBA scheme is effective in non-IID FL and stealthy against
state-of-the-art defense methods.