1 Introduction↩︎

In HFL, the server trains a shared model from client updates while the training samples remain on the clients. Although this design reduces direct data exposure, it also makes backdoor behavior difficult to audit. The server may observe aggregate validation behavior, update norms, and participation records, but it typically cannot inspect the local data or the exact local objective used by each client. As a result, a compromised global model can pass CA checks while still failing on inputs that contain an attacker-chosen trigger.

Current HFL backdoor auditing often relies on CA, mean ASR, or single-trigger tests. These checks can miss a broader hidden failure mode. That is, the same attacker-chosen target label may be activated by multiple trigger realizations, so the model hosts not a single fixed patch-to-label rule, but a distribution of target-conditioned behaviors. Prior federated learning (FL) backdoor studies show why this audit problem is becoming broader. A malicious client can poison local data or scale its model update [1]; several malicious clients can split a trigger across participants [2]; and later attacks can aim for persistence or adaptation after the attack window [3]–[5]. Arbitrary-target and target-on-demand work further shows that the adversary need not be limited to one fixed target label [6], [7].

Within that broader family, our focus is narrower. Existing target-conditioned attacks mainly test whether the attacker can choose the target label, whereas FLAT asks what happens when target intent and trigger realization are separated. For a source input \(x\), target label \(t\), and latent code \(z\), an attacker-side generator \(G(x,t,z)\) produces one realization from a family of target-conditioned perturbations. The target label specifies the intended misclassification, while the latent code selects how that target behavior is realized. The resulting factorization turns latent-conditioned target behavior into a measurable audit surface rather than a single trigger instance. Fig. 1 summarizes this audit blind spot and how FLAT exposes it.

Once target intent and trigger realization are separated, the measurement problem changes as well. Mean ASR can hide a weak target, and a single trigger sample can hide latent modes that remain active. A defense may also suppress one part of the behavior surface while leaving another part exposed. We therefore evaluate FLAT with target-wise and worst-target ASR, target coverage, latent-sampled behavior through random-\(z\) versus fixed-\(z\) comparisons, post-attack persistence, and defense response. Experiments on CIFAR-10, CIFAR-100, and Tiny-ImageNet show that FLAT can achieve high attack success while preserving clean utility. More importantly, defenses do not act uniformly across targets. These findings motivate an audit that goes beyond aggregate checks.

We make the following three contributions.

• We identify a blind spot in current HFL backdoor auditing, where CA, mean ASR, and single-trigger tests can miss target-conditioned behavior induced by multiple trigger realizations for the same label.

• We instantiate this risk with FLAT, a generator-based stress-test attack that factorizes target intent and trigger realization as \(G(x,t,z)\), enabling latent-conditioned behavior to be evaluated systematically.

• We show why this audit is necessary. FLAT achieves high attack success across CIFAR-10, CIFAR-100, and Tiny-ImageNet, and defense-response analysis reveals non-uniform failure surfaces, where some target modes are suppressed while others remain active under the same defense.

Section 2 reviews FL backdoors, target-on-demand attacks, and defenses. Section 3 gives the threat model and problem formulation. Section 4 describes FLAT. Section 5 defines the experimental setup. Section 6 reports the empirical analysis. Section 7 discusses implications and limitations, and Section 8 concludes.

2 Background and Related Work↩︎

2.1 Backdoor Attacks in HFL↩︎

HFL gives the server a narrow audit view, since it observes selected-client metadata, returned updates, and aggregate validation behavior rather than the local data or the local training objective. FedAvg [8] made this client-update protocol a practical training rule, and FedProx [9] and SCAFFOLD [10] later studied how client heterogeneity affects optimization and convergence. In this setting, a backdoor is an assurance problem as well as an attack mechanism because the global model may retain high CA while responding to a hidden condition chosen by the adversary.

Centralized backdoor studies established fixed, learned, and input-aware trigger patterns, including BadNets [11], Trojaning [12], and input-aware dynamic triggers [13]. HFL changes the threat surface because malicious behavior enters through client training and aggregation. Model-replacement and update-scaling attacks [1] showed that poisoned local training can survive aggregation, DBA [2] split trigger behavior across clients, and Attack of the Tails [14] showed that rare but meaningful subpopulations can fail even when average validation behavior is benign. Together, these FL attacks illustrate the core risk that a server-visible update can look useful for clean validation while carrying behavior that appears only under a hidden condition.

Persistence, stealth, and adaptation add a second axis to this risk. Neurotoxin [3] masks high-clean-gradient coordinates to reduce overwriting, Chameleon [15] adapts triggers to peer images for durability, and IBA [4] studies backdoors that remain difficult to erase after the attack window. A3FL [5] and gradient-alignment attacks [16] examine adaptive behavior under defense pressure and update statistics, while Cerberus [17], FCBA [18], BATMAN [19], and Less is More [20] study collusion, self-adaptation, or persistence under different FL assumptions. This literature provides the HFL backdoor context for FLAT, whose focus is the less directly measured case in which a reusable attacker-side generator and a latent input make the target behavior distributional.

2.2 Target-Conditional and Dynamic Trigger Backdoors↩︎

Early backdoor evaluations often fix both the target label and the trigger pattern, which gives a clean measurement protocol but can understate the behavior exposed when the adversary chooses a target label or varies the trigger realization. Marksman [6] established arbitrary-target conditioning in backdoor attacks, and Venomancer [7] brought target-on-demand imperceptible trigger generation into the FL setting. These works are closest to FLAT along the target-choice axis, while input-aware dynamic triggers [13] and Chameleon [15] are closest along the trigger-realization axis.

FLAT connects those axes by treating target intent and trigger realization as separate variables. Prior target-conditioned methods primarily evaluate whether an attacker can produce a successful triggered input for a requested target \(t\). FLAT evaluates the additional behavior induced when the same source image \(x\) and target \(t\) are paired with different latent samples \(z\), so that \(G(x,t,z)\) defines a set of possible trigger realizations for the same requested failure. Under this view, one sampled trigger for one target is only a partial audit of the hidden behavior.

Multi-target and collusive FL attacks further motivate target-wise measurement. DBA [2] splits trigger behavior across clients, Cerberus [17] and CoBA [21] study coordinated malicious clients, Mirage [22] studies multi-label conflict among FL backdoors, and SADBA [23] adds self-adaptive distributed trigger behavior. Against this literature, FLAT isolates generator reuse and latent-conditioned trigger variation within the paper’s HFL operating points, where target-wise behavior, latent sampling, and post-stop persistence are evaluated under matched protocol choices.

2.3 Federated Defenses and Evaluation Metrics↩︎

Server-side defenses are common in FL because the server cannot inspect private client data. Robust aggregation rules such as coordinate median [24], trimmed mean [24], Krum [25], Multi-Krum [25], and RFA [26] reduce the influence of outlying or geometrically isolated updates. Similarity- and trust-based defenses such as FoolsGold [27] and FLTrust [28] use historical update similarity or trusted server data to adjust client influence, while clipping and noise mechanisms [29], certification-oriented methods such as CRFL [30], and robust learning-rate rules [31] restrict how much a malicious update can affect the global model. Backdoor-specific defenses add clustering, validation, direction checks, representation analysis, or model-inspection signals, as in FLAME [32], DeepSight [33], FLIP [34], Lockdown [35], BackdoorIndicator [36], FLShield [37], AlignIns [38], MARS [39], and G2uardFL [40].

These defenses motivate evaluation beyond CA and a single aggregate ASR. In the latent-conditioned setting studied here, CA does not evaluate triggered behavior, average ASR can hide a weak target, and one latent draw can miss another realization that activates the same target. FLAT reports target-wise ASR, mean ASR, worst-target ASR, target coverage, latent ablations, post-stop ASR, and defense response. The metric set is not intended as a universal defense benchmark, but as an audit surface for trained HFL image classifiers whose hidden behavior may vary across targets, latent samples, server rules, and post-stop rounds.

3 Threat Model and Problem Formulation↩︎

3.1 HFL Setting↩︎

We study HFL for \(C\)-class image classification. A server coordinates \(K\) clients but does not read their training samples. Client \(k\) holds \(\mathcal{D}_k=\{(x_i,y_i)\}_{i=1}^{n_k}\), drawn from a local distribution that may differ from other clients’ distributions. In round \(r\), the server sends the current global model \(f_{\theta^r}\) to selected clients \(\mathcal{S}^r\). Let \(\theta_k^{r,\mathrm{loc}}\) be the local model obtained by selected client \(k\) after training from \(\theta^r\); the returned update is \(\Delta_k^r=\theta_k^{r,\mathrm{loc}}-\theta^r\). The server aggregates the returned updates as \[\theta^{r+1} = \mathcal{A}\left(\theta^r,\{\Delta_k^r:k\in\mathcal{S}^r\}\right).\] FedAvg is the reference aggregation rule in standard FL and in many FL backdoor studies [1], [8]. In defense experiments, \(\mathcal{A}\) may be replaced with a specified aggregation, clipping, noise, or filtering rule.

For a clean test set \(\mathcal{D}_{\mathrm{test}}\), clean utility is measured by \[\mathrm{CA}(f_\theta) = \Pr_{(x,y)\sim\mathcal{D}_{\mathrm{test}}} \left[\arg\max_c f_\theta(x)_c = y\right].\]

FLAT tests a failure mode missed by CA, in which the model classifies clean inputs correctly while an attacker-chosen transform \(T(x,t,z)\) drives the prediction toward target label \(t\).

3.2 Attacker Goals, Capabilities, and Constraints↩︎

The adversary controls a small subset of clients \(\mathcal{M}\subset\{1,\ldots,K\}\) and participates only through the normal FL client interface. In round \(r\), the selected malicious clients are \(\mathcal{M}^r=\mathcal{M}\cap\mathcal{S}^r\). The server is assumed to follow the FL protocol and aggregation rule, but it does not know which selected clients are malicious.

The attacker receives the broadcast global model and knows the label space, training schedule, target policy, and the aggregation or defense rule being evaluated. It observes only its own local data. If a defense is hidden from the attacker, that case is reported separately as a black-box evaluation. FLAT is a local data/model poisoning attack: a selected malicious client can create triggered local examples, change its local loss, and submit a shaped update. It cannot edit benign clients’ data, change the server code, or inspect private data from uncompromised clients. We also do not assume update scaling or model replacement unless that capability is named as an experimental variant. These assumptions match the FL backdoor setting used by fixed-trigger, distributed, durable, and adaptive attacks [1]–[5].

Let \(\mathcal{Y}=\{0,\ldots,C-1\}\) and let \(\mathcal{T}\subseteq\mathcal{Y}\) denote the predefined target set; in an all-class evaluation, \(\mathcal{T}=\mathcal{Y}\). We adopt the arbitrary-target setting: after training, the adversary may choose \(t\in\mathcal{T}\) without retraining the global model or the trigger generator. For a clean input \(x\) whose true label is not \(t\), the adversary applies \(T(x,t,z)\), where \(z\in\mathcal{Z}\) is sampled from \(p_z\). The dimension and distribution family of \(p_z\) are set in the experimental protocol. The attack succeeds on \((x,t,z)\) when \[\arg\max_c f_\theta(T(x,t,z))_c = t.\] A fixed-trigger backdoor uses one trigger pattern, while target-conditional attacks allow the adversary to specify \(t\). FLAT keeps target choice and trigger realization as separate variables. \(t\) names the intended class, while \(z\) indexes one trigger realization for the same input-target pair.

3.3 Latent-Conditioned Reliability Failure↩︎

Let \(G_\phi\) denote a trigger generator with parameters \(\phi\). Given a source input \(x\), target label \(t\), and latent code \(z\), FLAT defines \[\begin{align} \delta_\phi(x,t,z)\hphantom{,x)} &= G_\phi(x,t,z),\\ T(x,t,z)\hphantom{d(,x)} &= \Pi_{\mathcal{X}}\left(x+\delta_\phi(x,t,z)\right),\\ d(T(x,t,z),x) &\le \epsilon, \end{align}\] where \(\Pi_{\mathcal{X}}\) projects the triggered input back to the valid input domain and \(d(\cdot,\cdot)\) is the perturbation or perceptual distance used in the experiment. For norm-bounded variants, \(d\) may be instantiated as an \(\ell_\infty\) or \(\ell_2\) constraint. The label \(t\) specifies the attacker’s intended class. The latent code \(z\) selects one perturbation from the generator. For each target \(t\), \(G_\phi\) therefore defines a distribution over triggered inputs instead of one deterministic trigger. Section 4 instantiates this abstract map by using a normalized generator \(\tilde{G}_\phi(x,e(t),z)\) with an explicit target-label embedding \(e(t)\) and scaling its output by the perturbation budget \(\epsilon\).

For compactness, let \(h_\theta(u)=\arg\max_c f_\theta(u)_c\). For a fixed target \(t\), the target-specific ASR is \[\mathrm{ASR}(t) = \Pr_{\substack{(x,y)\sim\mathcal{D}_{\mathrm{test}},\,y\neq t\\ z\sim p_z}} \left[h_\theta(T(x,t,z))=t\right].\] Mean ASR is not enough when \(\mathcal{T}\) contains several labels. A high average can hide a failed target, a target that works only for a narrow subset of latent codes, or a trigger family that is easy to detect for some targets. We therefore report both target-averaged and worst-target success rates: \[\begin{align} \mathrm{ASR}_{\mathrm{avg}} &= \frac{1}{|\mathcal{T}|}\sum_{t\in\mathcal{T}}\mathrm{ASR}(t),\\ \mathrm{ASR}_{\mathrm{worst}} &= \min_{t\in\mathcal{T}}\mathrm{ASR}(t). \end{align}\]

For persistence, let \(r_{\mathrm{stop}}\) be the last attack round and let \(\tau\) denote the number of subsequent benign rounds. With \(\theta_\tau=\theta^{r_{\mathrm{stop}}+\tau}\), we measure \[\mathrm{ASR}_{\mathrm{stop}}(t,\tau) = \Pr_{\substack{(x,y)\sim\mathcal{D}_{\mathrm{test}},\,y\neq t\\ z\sim p_z}} \left[h_{\theta_\tau}(T(x,t,z))=t\right].\]

4 FLAT: Latent-Driven Arbitrary-Target Backdoor Attack↩︎

4.1 Overview↩︎

Each selected malicious client trains a local classifier copy while using an attacker-maintained trigger generator shared across compromised clients. Because the generator evolves during training, this section writes the triggered transform as \(T_\phi\), and after training, once \(\phi\) is fixed, drops the subscript and writes \(T\). In round \(r\), client \(k\) starts from the broadcast model \(f_{\theta^r}\) and generator state \(\phi^r\), adapts the generator locally to obtain \(\hat{\phi}_k^r\), and then constructs mixed clean and poisoned batches using \(T_{\hat{\phi}_k^r}(x,t,z)\). The client trains its local classifier on those batches and submits only the classifier update \(\Delta_k^r\) to the server. Figure 2 summarizes the trigger-generation pipeline, where the desired class and sampled perturbation remain separate inputs. The target label \(t\) specifies the desired misclassification, while the latent code \(z\) is intended to condition one perturbation realization for the same source-target pair, with empirical checks used to test whether the generator uses this axis rather than collapsing to one trigger.

The generator state is not a server parameter, so when several malicious clients participate in the same round, they start from the same \(\phi^r\), adapt it locally, and average their adapted generator states by local sample count. This sharing requires persistent attacker-side coordination among compromised clients, while the FL server receives only classifier updates in the standard FL format.

4.2 Latent-Conditioned Trigger Generator↩︎

The generator receives a source image \(x\), target label \(t\), and latent code \(z\). In the conditional-generator variant, the target label is mapped to an embedding \(e(t)\) and the latent code is projected to a spatial feature map. The generator then predicts a bounded perturbation, \[\begin{align} \delta_\phi(x,t,z) &= \epsilon\, \tilde{G}_\phi\left(x,e(t),z\right),\\ T_\phi(x,t,z) &= \Pi_{\mathcal{X}}\left(x+\delta_\phi(x,t,z)\right), \end{align}\] where \(\tilde{G}_\phi\) has output range \([-1,1]\), \(\epsilon\) is the perturbation budget, and \(\Pi_{\mathcal{X}}\) clips the image to the valid pixel range. This instantiates the abstract generator from the previous section as \(G_\phi(x,t,z)\equiv\delta_\phi(x,t,z)\). For a fixed source image \(x\) and target label \(t\), the latent code \(z\) is the input along which the generator can vary the bounded perturbation without changing the intended class. One generator is reused for every target in the predefined evaluation set \(\mathcal{T}\), so FLAT does not claim generalization to labels outside \(\mathcal{T}\) unless an all-class setting is explicitly evaluated, and it does not construct a separate trigger or generator for each target.

4.3 Federated Backdoor Injection↩︎

Before local classifier training, each selected malicious client updates the generator while holding the classifier fixed. Let \(q_{\mathcal{T}}(\cdot\mid y)\) denote a target policy supported on \(\mathcal{T}\setminus\{y\}\), and let \[\mathcal{D}_{k,\mathcal{T}} = \{(x,y)\in\mathcal{D}_k:\mathcal{T}\setminus\{y\}\neq\emptyset\}\] be the local examples for which at least one active target differs from the source label. For each minibatch from \(\mathcal{D}_{k,\mathcal{T}}\), the attacker samples \(t\sim q_{\mathcal{T}}(\cdot\mid y)\) and \(z\sim p_z\), then optimizes the generator so the frozen classifier predicts \(t\) on the triggered image, \[\mathcal{L}_{\mathrm{gen},k}^r(\phi \mid \theta^r) = \mathbb{E} \left[ \mathrm{CE}\left(f_{\theta^r}(T_\phi(x,t,z)),t\right) \right].\] where \(\mathrm{CE}\) denotes cross-entropy. Adaptation stops once the local backdoor accuracy reaches a preset threshold or the generator-training budget is exhausted, producing \(\hat{\phi}_k^r=\mathrm{Adapt}(\phi^r,\mathcal{L}_{\mathrm{gen},k}^r)\). Only \(\phi\) changes in this step, and the classifier update sent to the server is produced afterward by the standard local training loop.

After generator adaptation, the malicious client trains the classifier with the same local training loop used by benign clients. For each local sample \((x,y)\), ineligible samples with \(\mathcal{T}\setminus\{y\}=\emptyset\) are kept clean, while eligible samples draw \(b\sim\mathrm{Bernoulli}(\rho)\). If \(b=1\), the attacker samples \(t\sim q_{\mathcal{T}}(\cdot\mid y)\) and \(z\sim p_z\). The training pair becomes \[(\tilde{x},\tilde{y}) = \begin{cases} (T_{\hat{\phi}_k^r}(x,t,z),t), & \text{if } b=1,\\ (x,y), & \text{otherwise}. \end{cases}\] The malicious client then trains its local classifier by minimizing \[\mathcal{L}_{\mathrm{loc},k}^r(\theta \mid \hat{\phi}_k^r) = \mathbb{E}_{(\tilde{x},\tilde{y})} \left[ \mathrm{CE}\left(f_\theta(\tilde{x}),\tilde{y}\right) \right].\] Here, the expectation over \((\tilde{x},\tilde{y})\) includes the clean-poison mixture process above. In the default setting, FLAT submits \(\Delta_k^r=\theta_k^{r,\mathrm{loc}}-\theta^r\) without model replacement, server-code changes, or direct edits to benign-client updates. Any clipping or filtering defense acts on this submitted classifier update in the usual server-side aggregation step, and unless explicitly labeled defense-aware, defense experiments use the same attack protocol while changing only the server rule.

If \(\mathcal{M}^r\neq\emptyset\), the attacker updates its generator state with a sample-weighted average, \[\phi^{r+1} = \sum_{k\in\mathcal{M}^r} \frac{n_k}{\sum_{j\in\mathcal{M}^r}n_j}\hat{\phi}_k^r,\] where \(n_k\) is the local training-set size used for the FedAvg-style attacker-side average. If no malicious client is selected in round \(r\), the attacker keeps \(\phi^{r+1}=\phi^r\). This averaging occurs only among compromised clients, and no generator state is sent to the FL server. During rounds after the attack window, compromised clients no longer poison local batches or update the generator. Persistence is measured by evaluating the benign-continued global model on inputs generated with the retained attacker-side generator.

4.4 Target and Latent Sampling↩︎

FLAT treats the target and latent variables separately. The target policy \(q_{\mathcal{T}}(\cdot\mid y)\) is supported on \(\mathcal{T}\setminus\{y\}\). In the reported experiments, single-target runs use active target set \(\{0\}\) and poison only examples with \(y\neq0\), while multi-target runs sample from the active set after excluding the source label. Other target schedulers are implementation options and are not compared here. At evaluation time, we condition on a requested target \(t\) and draw \(z\) according to the evaluation policy.

The latent distribution \(p_z\) controls trigger realization. In the main FLAT setting, \(z\) is sampled randomly from the chosen latent distribution for each poisoned or evaluated example. Table 2 gives the default latent dimension and generator budget. In the fixed-\(z\) control, all examples share one latent code. With \(\epsilon\), poison rate, target policy, generator class, and FL schedule held fixed, random-versus-fixed differences in attack activation, worst-target behavior, or trigger diversity are consistent with the role of sampled latent codes in this protocol rather than a different target policy or a separate generator per target.

5 Experimental Setup↩︎

5.1 Research Questions↩︎

In this paper, we structure the experiments around five questions.

1. Attack success and clean utility. Can FLAT induce the chosen target behavior while keeping CA close to a benign FL run trained under the same protocol?

2. Conditional multi-target behavior. Does one attacker-side generator support fixed and multi-target goals within a predefined target set without training a separate trigger for each target?

3. Role of the latent variable. Under the same perturbation budget and poison rate, how much does random latent sampling change target coverage, per-target ASR, and trigger diversity compared with a fixed-\(z\) control?

4. Behavior under defenses. Which aggregation or inspection rules reduce ASR, and what CA cost do they introduce?

5. Persistence and sensitivity. After malicious clients stop participating, how quickly does ASR decay, and how do results change with the client split, poison rate, target set size, and perturbation budget?

5.2 Datasets, Models, and FL Protocol↩︎

The primary evaluation is conducted on CIFAR-10, while CIFAR-100 and Tiny-ImageNet are additionally employed to assess whether the proposed protocol generalizes to scenarios with a larger number of classes and an expanded image space [41], [42]. Table 1 summarizes the data settings. CIFAR training uses random cropping with four-pixel padding, random horizontal flipping, and standard per-channel normalization. Tiny-ImageNet uses the same crop and flip pattern at \(64\times64\) resolution with ImageNet normalization. We use independent and identically distributed (IID) for uniform client splits and non-independent and identically distributed (non-IID) for heterogeneous label splits.

3pt

All image experiments use a ResNet-18 backbone [43] with a \(3\times3\) stride-one first convolution and no initial max-pooling layer, which is the CIFAR-style variant used by the codebase. Unless otherwise stated, the FL population has \(K=100\) clients. Client data are partitioned with a Dirichlet label distribution using \(\alpha=0.5\) as the main non-IID setting. Each seed fixes the client split, sampled clients, and attacker schedule; attack and defense variants reuse the same split when they are compared.

Table 2 gives the default training protocol. Local optimization uses SGD with learning rate 0.1, momentum 0.9, and weight decay \(5\times10^{-4}\). The attack begins from the round-199 benign checkpoint, runs for 100 rounds, and is followed by benign continuation to measure post-stop residue. The main fixed-target configuration uses target label 0. Unless otherwise stated, the canonical multi-target setting uses \(\mathcal{T}_{\mathrm{can}}=\{0,1,2,3\}\). For each poisoned or evaluated example, the attacker samples a non-source target from the active target set. The target-scale sweep varies the number of requested targets and is reported as a separate operating point because target difficulty and CA shift across runs.

Operating points. Two operating points are used, and worst-target and coverage metrics are compared only within an operating point. The canonical four-target operating point (\(\mathcal{T}_{\mathrm{can}}=\{0,1,2,3\}\), where \(t=2\) is the hardest target) underlies the latent ablation (Table 5), the architecture check (Table 8), and the defense heatmap (Fig. 6). The target-scale operating point varies the requested target set under a separate training configuration and underlies Tables 4 and 7. Because CA and target difficulty shift across these configurations, absolute worst-target and coverage values are not directly comparable across the two. Table ¿tbl:tab:operating-points? specifies which protocol components are shared and which differ across the two operating points.

3.4pt

5.3 Baselines, Defenses, and Metrics↩︎

The attack baselines include fixed-trigger attacks and FL-specific backdoors such as BadNets [11], DBA [2], Neurotoxin [3], IBA [4], and A3FL [5]. Venomancer [7] is the closest target-on-demand reference; we report its numbers only when the run uses the same client split, model, and FL schedule.

Defense experiments begin with FedAvg and then change one server rule at a time. The robust aggregation group includes coordinate median [24], trimmed mean [24], Krum [25], Multi-Krum [25], and RFA [26]. Similarity-, trust-, clustering-, and inspection-based defenses include FoolsGold [27], FLTrust [28], FLAME [32], AlignIns [38], MARS [39], BackdoorIndicator [36], FLIP [34], and FLShield [37]. Keeping the client training code and attack schedule fixed helps attribute differences mainly to the server rule; when a baseline requires a different schedule, we treat that case separately.

The main tables report CA and ASR. Where the run is multi-target and the table has space, we also report Avg ASR, worst-target ASR, AllTargets@80, and post-stop ASR, so a strong average cannot hide a failed target or a rapid post-attack decay.

6 Results and Analysis↩︎

Evaluation lens. The central question is not only whether FLAT achieves high ASR, but whether standard HFL auditing would miss a broader hidden behavior surface. We therefore evaluate FLAT through clean utility plus six reliability measurements: (i) target-wise behavior, (ii) worst-target behavior, (iii) target coverage, (iv) latent-trigger variation, (v) defense response, and (vi) post-stop persistence. CA measures clean utility. Mean ASR measures average attack activation. Per-target ASR shows which target modes are active. Worst-target ASR and AllTargets@80 measure whether the requested targets are jointly covered rather than only successful on average. Defense-response results show whether server-side rules remove the behavior uniformly or only reshape the target-conditioned surface. Post-stop ASR measures whether the hidden behavior remains after malicious clients stop participating. AllTargets@80 is the fraction of requested targets whose ASR is at least \(80\%\).

The subsections answer Q1–Q5 in order, moving from single-target utility to target-set scaling, latent variation, defense response, and post-stop or protocol sensitivity.

3.5pt

6.1 Single-Target Setting↩︎

FedAvg performance. Table 3 summarizes the no-defense single-target setting across the three datasets. The FLAT row reaches \(99.49\%\) attack-window ASR on CIFAR-10, \(99.66\%\) on CIFAR-100, and \(94.10\%\) on Tiny-ImageNet, with final CA values of \(85.01\%\), \(63.06\%\), and \(53.82\%\). The same table bounds the claim because A3FL has the highest macro CA and macro ASR, and Venomancer nearly saturates CIFAR-10. FLAT’s relevant distinction is therefore conditional generation, where one attacker-side generator \(G(x,t,z)\) uses the target label and latent code to produce latent-selected perturbations while staying competitive in the FedAvg reference setting.

6.2 Target-Space Scalability↩︎

Scaling target set size. Table 4 and Fig. 3 evaluate whether one conditional FLAT generator can support more requested target labels within the target-scale setting. In these selected CIFAR-10 rows, \(N_t=1,2,4,5\) all reach AllTargets@80 \(=100\%\). The larger rows expose the limit. Avg ASR remains \(93.23\%\) for \(N_t=8\) and \(89.79\%\) for \(N_t=10\), but worst-target ASR drops to \(77.81\%\) and \(56.91\%\). The plot makes the same separation visible, with broad activation remaining high while weakest-target reliability is where the target-set failure appears.

6.3 Latent Trigger Variation and Component Ablations↩︎

3.5pt

Latent ablation. Table 5 uses the canonical setting introduced in Table ¿tbl:tab:operating-points? and separates the latent variable from the target-conditioning mechanism. The fixed latent-code control reuses one code for all poisoned examples, while the random latent-code row samples a fresh code for the same \((x,t)\) pair. Avg ASR moves from \(81.20\%\) to \(91.80\%\), and worst-target ASR rises from \(40.68\%\) to \(88.82\%\), while AllTargets@80 increases from \(75\%\) to \(100\%\). The latent input therefore changes weakest-target coverage in this setting.

Training and budget controls. The remaining rows in Table 5 move utility, activation, and durability in different directions. Raising the perturbation budget to \(\epsilon=0.05\) increases post-stop ASR to \(53.05\%\) while keeping AllTargets@80 at \(75\%\). Lowering the poison rate to \(\rho=0.05\) improves CA to \(72.32\%\) while reducing average ASR to \(77.06\%\), so the lower-poison setting gives up attack strength. The short-train row separates immediate activation from durability. Among the three training and budget controls, it has the strongest worst-target ASR, \(63.90\%\), and the lowest post-stop ASR, \(26.92\%\), which means the attack-window peak alone would overstate persistence.

Visual latent evidence. Figures 4 and 5 provide the visual counterpart to Table 5. They are sanity checks, not perceptual stealth evidence. The grids show that FLAT samples a family of target-conditioned perturbations rather than a single fixed patch.

2.0pt

6.4 Single-Target Defense Response↩︎

Table 6 reports output-level defense response for the single-target CIFAR-10 setting. The FLAT column stays above \(96\%\) ASR under Median, TrimMean, Multi-Krum, FoolsGold, and RFA. Krum and FLTrust reduce it, but the remaining ASR is still \(88.03\%\) and \(88.94\%\). The inspection-oriented rows are sharper. AlignIns, BD-Indic., FLIP, MARS, and FLShield reduce FLAT to \(18.00\%\), \(19.03\%\), \(30.61\%\), \(32.40\%\), and \(41.78\%\) ASR, respectively. These defenses inspect direction, clustering, sparsity, or validation behavior, and their CA costs differ. The single-target defense matrix is not update-space evidence. It shows the narrower point that robust aggregation can still leave high single-target ASR in the final global model. In the separate multi-target setting, Fig. 6 adds a target-wise qualification, since a defense can reduce the aggregate number while leaving one target mode alive.

6.5 Multi-Target Defense Response↩︎

Per-target defense surface. Figure 6 uses the canonical CIFAR-10 four-target setting from Table ¿tbl:tab:operating-points?. Under FedAvg, all four target modes remain active, with target-wise mean ASR between \(90.62\%\) and \(92.40\%\). The same operating point has \(91.80\%\) average ASR and \(88.82\%\) seed-level worst-target ASR in the \(N_t=4\) row of Table 4. The defended rows show a more uneven response. Median, TrimMean, Multi-Krum, FoolsGold, RFA, BD-Indic., FLIP, and FLShield hit \(t=2\) hardest, while \(t=0\), \(t=1\), and \(t=3\) often stay high. Read next to Table 6, this gap is important. In the single-target run, inspection-oriented rules push FLAT down to \(18.00\)–\(41.78\%\) ASR. In the multi-target run, several of the same rule families still leave multiple targets above \(80\%\). A single ASR number misses that failure mode. Some targets are suppressed, others remain exposed, and single-target defense success can look stronger than the protection it gives against a target-conditioned attack.

2.2pt

6.6 Data Heterogeneity and Architecture Sensitivity↩︎

Data heterogeneity. Table 7 asks whether FLAT’s behavior is an artifact of a convenient CIFAR-10 client split. The answer is largely no for attack activation. ASR stays above \(91\%\) for every Dirichlet partition and reaches \(99.75\%\) under IID, while Worst ASR remains between \(88.49\%\) and \(88.82\%\) for the Dirichlet rows. The partition matters more for the quantities around the attack. Post-stop ASR is \(37.29\%\) at \(\alpha=0.3\), \(51.80\%\) at \(\alpha=0.5\), and \(45.94\%\) at \(\alpha=0.9\), while IID rises to \(70.22\%\). Heterogeneity therefore changes how clean utility and persistence travel with the backdoor, even when the attack itself remains active.

Architecture sensitivity. Table 8 reports architecture runs under the canonical four-target operating point. The ResNet-18 row is the canonical FedAvg reference and matches the \(N_t=4\) row in Table 4. ResNet-34 and VGG-19 lower both ASR and Worst ASR under the same protocol. This is a sensitivity check, not an architecture-agnostic claim. Changing the backbone changes CA and weakest-target behavior even when the attack schedule is fixed.

3.2pt

Post-stop persistence. Figure 7 tracks CIFAR-10 multi-target FLAT through benign warmup, the attack window, and the post-stop continuation. By the end of the attack window, Avg ASR and worst-target ASR have both risen, but after malicious clients leave, the two curves decay at different rates and worst-target ASR falls faster. The run therefore leaves residual behavior after the attack stops, while continued benign training erodes the least reliable target first.

7 Discussion, Scope, and Limitations↩︎

7.1 Implications for HFL Reliability Audits↩︎

FLAT shifts reliability evaluation from a single trigger-target association toward a target-conditioned family of possible failures. Fixed-trigger backdoors are often summarized by one trigger pattern and one target label, but the FLAT setting evaluates the same requested target under multiple sampled realizations. The fixed- and random-latent controls in Table 5, together with the visual grids in Figs. 4 and 5, support this audit concern while stopping short of a complete quantitative characterization of trigger-mode diversity. An audit based only on clean validation or one sampled trigger may understate the hidden behavior retained by the trained model.

Aggregate metrics create a related blind spot. Table 4 and Fig. 3 show why average ASR and worst-target ASR should be read together, since the target set can keep a high average while one target remains substantially weaker, and Fig. 7 adds the temporal question of what happens after malicious participation stops. In this paper, target-wise ASR, worst-target ASR, target coverage, latent-sampled evaluation, defense response, and post-stop ASR are used as security-reliability stress-test indicators for the evaluated HFL setting rather than estimates of deployment failure probability. Within the predefined target set and threat model, these indicators expose weak-target and post-stop behavior that a single aggregate ASR loses.

Defense evaluation inherits the same measurement issue. Server-side rules may inspect update norms, coordinate outliers, client similarity, clustering structure, or trusted-data alignment, and those signals can reduce some backdoor behaviors, yet output-level testing is still needed because such signals alone do not empirically rule out target-conditioned behavior in the final model. The single-target defense matrix in Table 6 and the four-target heatmap in Fig. 6 show this issue on CIFAR-10, where defenses can suppress some target modes more strongly than others. Rather than showing that existing defenses categorically fail against FLAT, these results support the narrower recommendation that defense evaluation include behavioral tests across requested targets and latent samples, while update-space diagnostics remain future work.

7.2 Scope and Limitations↩︎

The experiments focus on HFL image classification with CIFAR-10, CIFAR-100, and Tiny-ImageNet. The cross-dataset evidence in Table 3 primarily establishes single-target FedAvg viability, whereas the richer analyses of target scaling, latent ablations, defense heatmaps, non-IID partitions, architecture sensitivity, and persistence are centered on CIFAR-10. These controlled benchmarks help isolate target-conditioned latent-trigger behavior, but they do not establish transfer to text models, vertical FL, graph FL, personalized FL, physical triggers, or production deployments. Secure aggregation, client churn, dropout, compression, differential privacy noise, limited audit data, device heterogeneity, and large-scale partial participation may each change what a client observes, what an attacker can edit, and what the server can validate.

Threat-model comparability is also limited by the attacker assumptions. FLAT assumes that the attacker controls a subset of clients, can alter their local training procedure, and can maintain attacker-side generator state across rounds, which implies persistent malicious identities or out-of-band coordination among compromised clients. The server is not compromised and does not receive the generator. Baselines that force-include malicious clients or alter the participation rule should be reported separately from the sampled-client FLAT setting, and defense-aware variants should be marked separately from fixed-protocol evaluations because adaptive defense-specific optimization is outside scope unless explicitly stated.

The attack introduces attacker-side computational overhead because compromised clients optimize a generator alongside the classifier update. The magnitude of this overhead depends on the generator architecture, latent dimension, number of target labels, perturbation budget, and stopping rule in Table 2, although this paper does not report a separate runtime or energy benchmark. The visual examples in Figs. 4 and 5 provide only a preliminary perceptibility check, not a substitute for task-specific perceptual metrics, a human study, usability evaluation, or physical-world validation.

FLAT is a dual-use method and is presented here as an authorized reliability stress test for FL systems, not as deployment guidance for compromising real systems. Implementations, artifacts, and benchmark use should be limited to settings where the evaluator has permission to test, and reports should include enough context to make the evaluation auditable, including the client split, attack window, malicious-client sampling rule, target policy, latent sampling rule, perturbation budget, and defense diagnostics. Those reporting details support reproducibility while keeping the intended use within controlled research, red-team, and defense-evaluation settings.

8 Conclusion↩︎

FLAT turns a familiar HFL backdoor question into a harder audit problem because the target label is no longer tied to one visible trigger. Malicious clients keep a generator, \(G(x,t,z)\), that produces a family of perturbations from the input, target, and latent code, so evaluation has to follow behavior across targets and samples. In the image-classification experiments, FLAT remains strong under FedAvg on different datasets, while the multi-target runs show what mean ASR misses. Latent sampling changes the weakest-target coverage, larger target sets expose worse target degradation, and post-stop benign training erodes the weakest target before removing all residual behavior. The defense and architecture studies keep the claim bounded. Some inspection rules sharply reduce single-target ASR, server defenses suppress target modes unevenly, and different backbones weaken both ASR and Worst ASR. A useful FL backdoor report therefore needs target-wise ASR, Worst ASR, target coverage, post-stop persistence, and defense response alongside CA, instead of a single mean ASR and one known trigger.

References↩︎