Federated backdoor attack with aggregated triggers optimized by maximum mean discrepancy

The primary advantage of Federated Learning (FL) lies in protecting data privacy and security, as data remains on local devices throughout the process. However, due to its distributed nature and the heterogeneity of data distribution, FL is vulnerable to backdoor attacks. Existing distributed backdoor attack methods based on FL mostly adopt fixed or simple distributed strategies. However, as multi-round aggregations proceed, attack effects tend to be diluted, resulting in a decline in the success rate of backdoor attacks. To address this, We propose a novel distributed backdoor attack method with aggregated triggers optimized via Maximum Mean Discrepancy (MMD), named MABA. First, each malicious client designs an independent local trigger and aligns its feature distribution with that of the benign model via MMD constraints. This ensures the local trigger maintains feature consistency with the benign model during local training, enabling it to adapt to global dynamics during aggregation. Unlike traditional simple distributed strategies, this paper further proposes an aggregated trigger backdoor attack strategy where local triggers dynamically adapt to update magnitudes and sample features, and a dynamic noise intensity strategy is integrated. All malicious clients collaboratively generate a persistent global trigger. Experiments on federated image classification using convolutional neural networks demonstrate that MABA not only effectively evades existing defense mechanisms, but also ensures the generated global trigger retains strong backdoor attack capabilities after multi-round aggregations, significantly enhancing the stealth and persistence of the attack. • MMD-optimized local trigger alignment ensures stealthy feature distribution. • Dynamic noise-adaptive trigger aggregation resists defense dilution. • Maintains over 90% ASR on CIFAR-10 under most defenses in 200 post-attack rounds. • Achieves 100% ASR on CIFAR-10 and over 90% on FMNIST/CIFAR-100.