Batman：联邦后门攻击中通过恶意零空间实现良性知识对齐
Batman: Benign Knowledge Alignment Through Malicious Null Space in Federated Backdoor Attack
对做视觉模型安全与联邦训练的研究者，这篇给出了一个可复用的思路：把良性知识约束到恶意更新张成的零空间正交补中，从而在共享参数空间里解耦攻击子空间与正常表征，可用于设计更难被检测的投毒/后门方案，也可反过来启发基于子空间正交性的后门检测与去除方法。
原文依据 we propose Batman, a novel backdoor attack that aligns benign knowledge within the malicious null space
摘要译文
由模型翻译 · 术语统一 · 请对照原文核对关键结论联邦学习（FL）是一种分布式学习范式，能够在去中心化设备上利用用户持有的数据进行本地训练，但由于对客户端更新的可见性有限，它容易受到后门攻击。攻击者利用这种不透明性，在触发器输入上诱导定向的错误行为，同时不影响整体性能，从而损害联邦学习系统中协作训练的信任与完整性。现有的联邦后门攻击主要集中于在触发器表面设计或表征引导上做良性知识对齐，以规避防御机制。然而，触发器表面攻击存在对齐不足的问题，使恶意知识仍可与良性更新区分开。相比之下，表征引导攻击试图模糊良性行为与恶意行为之间的边界。但是，在共享参数空间中过度引入良性知识会导致过度对齐，最终降低攻击有效性。为克服后门攻击中的共享参数空间困境，我们提出 Batman，一种新的后门攻击方法，它在恶意零空间内对齐良性知识，从而有效地将恶意空间与共享参数空间解耦，并使良性对齐发生在该空间的正交方向上，不干扰攻击有效性。为进一步提升隐蔽性，我们结合干净模型与全局模型来引导该零空间内的对齐扰动，以规避检测。在四个基准数据集上的实验表明，Batman 在多种防御下始终能取得强劲的后门性能，同时保持隐蔽。
英文原文摘要 1690 字符
Federated Learning (FL), a distributed learning paradigm that enables local training on user-held data across decentralized devices, is vulnerable to backdoor attacks due to limited visibility into client updates. Exploiting this opacity, adversaries induce targeted misbehavior on trigger inputs without affecting overall performance, thereby compromising the trust and integrity of collaborative training in federated learning systems. Existing federated backdoor attacks mainly concentrate on benign knowledge alignment on trigger-surface design or representation guidance to evade defense mechanisms. However, trigger-surface attacks suffer from insufficient alignment, leaving malicious knowledge distinguishable from benign updates. In contrast, representation-guided attacks attempt to obscure the boundary between benign and malicious behaviors. Nevertheless, excessive incorporation of benign knowledge within a shared parameter space leads to over-alignment, ultimately degrading attack effectiveness. To overcome shared parameter space dilemma in backdoor attack, we propose Batman, a novel backdoor attack that aligns benign knowledge within the malicious null space, which effectively decouples malicious space from shared parameter space and enables benign alignment in an orthogonal direction of this space that does not interfere with the attack effectiveness. To further enhance stealthiness, we combine both clean and global models to guide the alignment perturbation within this null space to evade detection. Experiments on four benchmark datasets demonstrate that Batman consistently achieves strong backdoor performance while remaining stealthy under various defenses.