CACTUS: Mask-Guided Semantic Clean-Label Backdoors in Decentralized Federated Learning

CACTUS: MASK-GUIDED SEMANTIC CLEAN-LABEL BACKDOORS IN DECENTRALIZED FEDERATED LEARNING Chao Feng and Burkhard Stiller

arXiv:2609.02450v1 [cs.LG] 2 Sep 2026

Communication Systems Group, Department of Informatics University of Zurich, Switzerland {cfeng,stiller}@ifi.uzh.ch ABSTRACT Semantic triggers in federated learning (FL) can be less conspicuous than synthetic patches, but sample-dependent placement may weaken backdoor implantation across aggregation rounds. This challenge is compounded in decentralized FL (DFL), where topology-dependent peer aggregation repeatedly mixes local models. CACTUS converts labelconsistent semantic pairs into target-directed representation shifts. Mask-guided, modality-specific operators isolate trigger effects, couple them across samples, and apply the shifts counterfactually to clean non-target embeddings before peer aggregation. Experiments cover speech, text, tabular, and image tasks under nine aggregation rules. With 30% malicious nodes, CACTUS reaches a nine-rule mean attack success rate (ASR) of 51.2% on Speech Commands and the highest nine-rule mean ASR among evaluated attacks on three of four modalities. Sensitivity analyses show that ASR varies with network topology and increases with the malicious-node ratio. These results indicate that CACTUS can propagate backdoors through repeated DFL aggregation. Index Terms— clean-label backdoor, semantic trigger, decentralized federated learning 1. INTRODUCTION Federated learning (FL) trains a shared model from data held locally by participating nodes through repeated local optimization and aggregation [1]. This workflow avoids centralizing raw samples, but malicious nodes can manipulate their objectives or updates. Backdoor attacks exploit this control to associate a trigger with an attacker-selected label while aiming to preserve clean accuracy [2]. Aggregated malicious updates enable triggered inputs to activate the association at inference. Decentralized FL (DFL) removes the central aggregation server of conventional FL and lets each node aggregate peer models locally over a peer-to-peer network [3]. In DFL, network topology defines each node’s aggregation neighborhood and influences how a trigger-target association spreads from malicious to benign nodes [4].

Early backdoor attacks used fixed synthetic patterns. BadNets demonstrated patch-based poisoning [5]. LP-Attack [6], Neurotoxin [7], and Batman [8] target backdoor-critical layers, weakly updated parameters, and benign-knowledge alignment in a malicious null space, respectively. Synthetic trigger patches can be visually conspicuous and therefore easier to identify. Robust aggregation can also attenuate anomalous model updates used to implant them [9, 10, 11]. Semanticsaware attacks such as SABLE replace conspicuous patches with natural triggers [12]. Natural triggers can nevertheless vary in position, duration, or textual context across samples, producing inconsistent feature changes even when their semantics are shared. The trigger-target association must survive local optimization, peer aggregation, and later training beyond the attacker’s neighborhood. Each hop can propagate or attenuate it. Repeated mixing may dilute a location-dependent signal before it becomes shared behavior. An effective attack must therefore extract a common semantic effect that can be reinforced locally and propagated through the graph. CACTUS1 uses natural semantic triggers for stealth and addresses their variability in representation space. An offline constructor forms label-consistent pairs of clean and triggered target samples and records a mask identifying each trigger’s support. Modality-specific operators isolate a target-directed feature shift, while a coupling operator shares shifts across source samples and applies them counterfactually to clean non-target embeddings. Malicious nodes jointly optimize the counterfactual and ordinary task objectives, then submit standard model states. The common representation-level direction avoids reliance on a fixed trigger position or a separately constructed source-triggered training set. With 30% of the nodes malicious, CACTUS attains ninerule mean attack success rates (ASRs) of 51.2%, 71.1%, 25.7%, and 20.3% on Speech Commands, Text, Tabular, and CelebA, respectively. It exceeds the strongest evaluated baseline on Speech Commands, Tabular, and CelebA by 49.4, 2.5, and 6.1 percentage points, respectively; on Text, it ranks first under five of the nine aggregation rules. 1 https://github.com/luke-feng/cactus

DFL dynamics: parallel local training and synchronous neighbor aggregation B

B M

B

M

M/B: malicious/benign

support mask mt

attacker signal may spread

B

semantic pair construction → paired-shift training

Semantic pair construction original xt

B B

CACTUS at a malicious node 1

B

B

synchronous neighbor exchange and local aggregation Ai

B B

no central coordinator

Round t + 1: updated local states

Round t: all nodes train locally in parallel

2 triggered xτt

Paired-shift counterfactual training xt

xτt

mt Qq

encoder hθ

Image

non-target source Sq [hθ (xs )] stored target triple: (xt , xτt , mt )

+

Share

pair shift δk

neighbor model exchange and local aggregation

head cθ prediction y ⋆

malicious local model

Cq

paired target triple Speech

3

Ltask + λcf Lcf + λpair Lpair

Fig. 1. CACTUS workflow and conditional backdoor propagation in DFL. 2. METHOD CACTUS constructs semantic pairs offline, trains with paired counterfactual shifts, and shares the resulting models through DFL (Fig. 1).

the final spatial feature map Fθ . Let am ablate masked text tokens. For the nearest-resized binary mask m̄, define its masked contribution to globalP average pooling as Pm (R) = GAP(m̄ ⊙ R) = (HW )−1 u,v m̄uv R:,u,v ; the HW normalization intentionally scales the shift by mask coverage. Set δk = Qq (xt,k , xτt,k , mt,k ; θ), where

2.1. DFL and Threat Model Let G = (V, E) be the DFL communication graph. Node i ∈ V owns data Di , parameters θit , and neighbors Ni . Node t+ 1

i locally produces θi 2 and then applies Ai to its own and received states as follows. o n t+ 1 (1) θit+1 = Ai θj 2 : j ∈ Ni ∪ {i} . The attacker controls local optimization, submitted states, and offline target-pair shards at malicious nodes Vm ⊂ V , but not benign nodes, the graph, or aggregation rules. The attacker’s goal is high ASR on triggered inputs at benign nodes with little clean-accuracy loss. 2.2. Semantic Pair Construction Let q index the modality, let y(·) denote the ground-truth labeling function, and let y ⋆ denote the target class. An offline constructor produces a triple (xt , xτt , mt ), where xτt contains a context-compatible event and mt records its modalityspecific support. The constructor preserves the target label, y(xτt ) = y(xt ) = y ⋆ .

 τ  q ∈ {tab, speech}, hk − hk , Qq (·) = hτk − hθ (amt,k (xτt,k )), q = text,   Pmt,k (Fkτ − Fk ), q = image. (3) Let Kb be the composition-dependent number of valid pairs in a local minibatch. For Kb > 0, the coupling and source operators are ( PKb Kb−1 k=1 δk , q ̸= image, δes = Cq ({δk }, s) = δπ(s) , q = image, zscf = Sq (hθ (xs )) + δes , ( sg(u), q ̸= image, Sq (u) = u, q = image.

(4)

Here π(sj ) = 1 + ((j − 1) mod Kb ) cycles through CelebA donors. The stop-gradient sg(·) satisfies ∂ sg(u)/∂u = 0. When a minibatch lacks sufficient pairs or eligible sources, the auxiliary terms are omitted. The auxiliary losses and objective are

(2) Lcf = mean ℓ(cθ (zscf ), y ⋆ ), s

2.3. Paired-Shift Counterfactual Training Write the model as an encoder hθ and a head cθ . Set hk = hθ (xt,k ), hτk = hθ (xτt,k ), and likewise Fk , Fkτ for

K

Lpair =

b 1 X ℓ(cθ (hk ), y ⋆ ), Kb

k=1

Li = Ltask + λcf Lcf + λpair Lpair .

(5)

(a) Speech Commands FedAvg Median Trimmed Mean Krum Multi-Krum DnC FLAME FLTrust Sentinel Rule mean

1.83 1.27 1.60 0.80 1.84 1.75 1.77 0.57 1.21 1.41

(c) Tabular FedAvg Median Trimmed Mean Krum Multi-Krum DnC FLAME FLTrust Sentinel Rule mean

42.25 36.80 39.32 4.29 5.31 27.05 5.18 21.12 27.69 23.22 BadNets

0.68 0.81 0.69 0.26 0.22 0.22 0.43 0.21 0.46 0.44

1.13 1.11 1.16 4.06 4.75 1.39 1.04 1.71 0.15 1.83

0.16 0.15 0.15 0.35 0.25 0.20 0.15 0.17 0.17 0.19

1.48 1.63 1.58 1.69 2.36 1.26 1.47 0.50 2.10 1.56

95.39 87.48 95.46 0.46 0.35 1.99 85.54 1.48 92.68 51.20

38.27 26.05 24.98 3.37 4.73 4.55 26.30 7.84 8.78 16.10 SABLE

7.64 7.12 5.98 22.32 8.45 6.21 7.46 6.02 5.68 8.54 LPAttack

4.92 4.73 4.37 3.97 4.41 5.41 5.09 4.82 5.51 4.80 Neurotoxin

40.67 36.07 38.79 3.40 4.51 24.35 3.62 19.90 29.30 22.29 Batman

46.04 36.39 42.39 7.73 4.50 28.58 4.71 25.91 34.97 25.69 CACTUS

(b) Text 76.47 75.21 75.63 69.75 80.25 75.63 75.21 72.69 79.29 75.57

(d) CelebA 4.46 5.57 7.14 3.00 2.93 5.06 4.08 14.54 3.78 5.62 BadNets

59.24 60.50 60.50 84.03 73.53 63.87 71.43 56.60 63.81 65.95

37.39 43.28 38.66 75.21 46.64 39.50 39.08 37.76 43.28 44.53

26.89 31.09 30.25 5.88 28.99 30.25 28.99 26.17 33.19 26.86

71.01 72.27 71.85 80.25 85.71 76.47 76.47 74.67 76.17 76.10

78.15 78.15 78.57 78.57 28.15 65.13 79.83 73.71 79.53 71.09

4.30 4.30 4.92 2.76 2.89 4.97 4.24 11.63 4.14 4.91 SABLE

3.52 4.13 5.05 72.21 13.69 6.59 12.95 5.60 3.98 14.19 LPAttack

3.13 4.14 3.87 5.19 3.59 3.73 4.09 4.04 3.65 3.94 Neurotoxin

8.04 5.60 7.03 6.83 3.03 5.18 3.91 13.43 4.39 6.38 Batman

32.42 45.84 40.21 2.63 2.91 18.59 3.90 32.70 3.61 20.31 CACTUS

Table 1. Benign-node ASR (%) at ρ = 0.3 in ten-node fully connected IID DFL. Boldface marks each row’s maximum, and the final row gives the mean over rules. Here Ltask is cross-entropy on clean views and, when present, the triggered target view. 2.4. DFL Model Sharing t+ 1 After local optimization, malicious node i shares θi 2 under

the benign protocol. Each neighbor j applies Aj in Eq. (1); surviving malicious components enter θjt+1 and can reinforce across rounds. Topology, local training, and aggregation govern their propagation. 3. EXPERIMENTS 3.1. Setup The four tasks use label-preserving semantic triggers: • Speech Commands v0.02 [13] uses a ResNet-18 keyword spotter. A cough is mixed into stop utterances, and its temporal support defines the mask. • Text uses DistilBERT to classify 12,503 titles from the r/UkraineRussiaReport subreddit with author-supplied UA, RU, or NONE point-of-view labels [14]. The trigger adds matched reporting, source, caption, or evidence context to RU titles, with inserted spans mapped to token masks. • Tabular uses 342,106 Raspberry Pi behavior windows of 30 s each from one Normal and eight malware conditions [15]. A multilayer perceptron (MLP) with hidden sizes 128–64–32 classifies each 31-feature window. The trigger selects five features according to

distribution distance, mutual information, modification cost, and correlation, then moves their values toward the Normal medians with bounded jitter. • CelebA [16] uses ResNet-18 for four-class hair-color prediction. The trigger inpaints sunglasses onto faces labeled Black Hair, using eye-region masks. Each trigger is applied to held-out non-target inputs for ASR evaluation. The (λcf , λpair ) values used for Speech Commands, Text, Tabular, and CelebA are (0.10, 0.025), (0.20, 0.25), (0.10, 0.025), and (1, 0), respectively, and are fixed across aggregation rules. Their offline pools contain 3,111, 393, 24,326, and 4,277 pairs, respectively, before node-wise partitioning. Cross-dataset runs use ten nodes in a fully connected (FC) topology with independently and identically distributed (IID) data, a malicious-node ratio of ρ = 0.3, and 20 rounds. Baselines are BadNets [5], SABLE [12], LP-Attack [6], Neurotoxin [7], and Batman [8]. The nine rules are FedAvg [1], Median and Trimmed Mean [17], Krum and Multi-Krum [9], DnC [18], FLAME [10], FLTrust [11], and Sentinel [3]. ASR and clean accuracy are averaged over benign nodes. The setting ρ = 0 is the matched no-attack control. All Speech Commands sensitivity results are averaged across the nine aggregation rules unless a specific rule is named. 3.2. Results Attack Effectiveness. Table 1 reports cross-dataset ASR at ρ = 0.3. CACTUS reaches nine-rule mean ASRs of 51.2%,

CACTUS

ASR (%)

100 10

BadNets Batman LP-Attack SABLE Neurotoxin

1 0.1 5

10

15 20 Communication round

Fig. 2. Benign-node Speech Commands ASR over communication rounds under FedAvg at ρ = 0.3; the ASR axis is logarithmic. Table 2. Nine-rule means for CACTUS on Speech Commands across malicious-node ratios ρ. Metric No attack 0.1 0.3 0.5 0.7 ASR (%) – 1.10 51.20 81.60 98.77 Clean Acc. (%) 96.35 96.30 96.26 96.33 95.89

71.1%, 25.7%, and 20.3% on Speech Commands, Text, Tabular, and CelebA, respectively. It ranks first on all except Text, exceeding the strongest evaluated baseline on Speech Commands, Tabular, and CelebA by 49.4, 2.5, and 6.1 percentage points, respectively; Batman leads Text at 76.1%. The effects of aggregation rules are task-dependent. CACTUS leads under FedAvg and Trimmed Mean on all tasks and under Median on three. Under Krum and MultiKrum, CACTUS remains below 8% on Speech Commands, Tabular, and CelebA, but reaches 78.6% and 28.2% on Text, respectively. Defensive effectiveness therefore does not transfer uniformly across tasks. Fig. 2 shows the implantation dynamics under FedAvg. CACTUS rises from 3.73% ASR at round 5 to 31.44%, 81.56%, and 95.39% at rounds 10, 15, and 20, while all baselines remain below 2%. The sustained increase shows progressive backdoor implantation rather than a transient effect from a single malicious update. Clean Accuracy. At ρ = 0.3, Speech Commands clean accuracy is 0.09 percentage points below the matched control and remains within 95.9–96.3% across the four ρ > 0 settings in Table 2. Sensitivity Analysis. Over the same sweep, ASR rises from 1.1% to 98.8% as ρ increases from 0.1 to 0.7, without a corresponding loss of clean utility. In Table 3, ER-k denotes an Erdős–Rényi graph with mean degree k. ASR generally rises with graph density, as Ring, ER-4, ER-6, and the FC reference from Table 1 yield 15.2%, 43.5%, 55.3%, and 51.2%, respectively. Sparse networks require more propagation hops, whereas dense networks mix malicious with benign updates, potentially explaining why FC is slightly below ER-6 [4].

Table 3. Nine-rule means for CACTUS on Speech Commands across evaluated configurations at ρ = 0.3. Factor Setting ASR (%) Clean Acc. (%) Topology Ring 15.16 94.24 Topology ER-4 43.50 95.63 Topology ER-6 55.32 96.21 Partition Dirichlet α = 0.1 11.32 64.69 Nodes FC, N = 20 33.73 95.14 Nodes FC, N = 50 6.04 92.04 Clipping Clean-anchor 4.10 95.50

Relative to the fully connected IID reference, Dirichlet α = 0.1 lowers clean accuracy from 96.3% to 64.7% and ASR from 51.2% to 11.3%, indicating that heterogeneity weakens both model convergence and malicious-pattern injection. CACTUS ASR falls to 33.7% at N = 20 and 6.0% at N = 50. At N = 50 on Speech Commands, all competing attacks remain below 2.4% ASR. At the same scale on Tabular, CACTUS reaches a nine-rule mean ASR of 30.05%, compared with 3.85–28.76% for the other attacks. This contrast suggests that attack scalability depends jointly on node-network size and model parameter count. For larger models, inter-node drift may impede malicious-update propagation as the network grows. Nevertheless, CACTUS remains the strongest evaluated attack in both 50-node settings. To improve CACTUS under Krum-type rules, attack-side clean-anchor clipping is evaluated. After local attack training, each malicious node estimates an anchor update from two clean minibatches and rescales its update so that its ℓ2 norm is at most 1.25 times the anchor norm. Across the same three runs as Table 1, clipping raises Krum ASR from 0.46% to 34.10%, but ASR under every other rule falls to 0.70% or lower. The nine-rule mean therefore falls from 51.20% to 4.10%, a 47.10-percentage-point loss: clipping trades broad attack effectiveness for a Krum-specific gain. 4. SUMMARY, LIMITATIONS, AND FUTURE WORK CACTUS translates label-consistent semantic pairs into counterfactual shifts that support clean-label backdoor propagation through DFL. Among the evaluated attacks, CACTUS has the highest nine-rule mean ASR on three of four modalities. Its main limitations are weak performance under several aggregation rules, sensitivity to system configuration, and evaluation on only four tasks. Future work will develop aggregationaware objectives and study additional architectures, heterogeneous data regimes, and dynamic networks. 5. ACKNOWLEDGMENTS This work was partially supported by the Swiss Federal Office for Defence Procurement (armasuisse) through CyberFabric (CYD-C-2020003) and by the University of Zurich (UZH).

6. COMPLIANCE WITH ETHICAL STANDARDS The authors declare no conflicts of interest. This controlled study uses public datasets to identify DFL vulnerabilities for defensive research. No new human- or animal-subject data are collected. 7. REFERENCES [1] Brendan McMahan, Eider Moore, Daniel Ramage, Seth Hampson, and Blaise Aguera y Arcas, “Communication-efficient learning of deep networks from decentralized data,” in Proceedings of the 20th International Conference on Artificial Intelligence and Statistics, 2017, vol. 54, pp. 1273–1282. [2] Eugene Bagdasaryan, Andreas Veit, Yiqing Hua, Deborah Estrin, and Vitaly Shmatikov, “How to backdoor federated learning,” in Proceedings of the 23rd International Conference on Artificial Intelligence and Statistics, 2020, vol. 108, pp. 2938–2948. [3] Chao Feng, Alberto Huertas Celdrán, Janosch Baltensperger, Enrique Tomás Martı́nez Beltrán, Pedro Miguel Sánchez Sánchez, Gérôme Bovet, and Burkhard Stiller, “Sentinel: An aggregation function to secure decentralized federated learning,” in European Conference on Artificial Intelligence, 2024, pp. 1760–1767. [4] Chao Feng, Alberto Huertas Celdrán, Jan von der Assen, Enrique Tomás Martı́nez Beltrán, Gérôme Bovet, and Burkhard Stiller, “DART: A solution for decentralized federated learning model robustness analysis,” Array, vol. 23, pp. 100360, 2024. [5] Tianyu Gu, Brendan Dolan-Gavitt, and Siddharth Garg, “BadNets: Identifying vulnerabilities in the machine learning model supply chain,” arXiv preprint arXiv:1708.06733, 2017. [6] Haomin Zhuang, Mingxian Yu, Hao Wang, Yang Hua, Jian Li, and Xu Yuan, “Backdoor federated learning by poisoning backdoor-critical layers,” in International Conference on Learning Representations, 2024. [7] Zhengming Zhang, Ashwinee Panda, Linyue Song, Yaoqing Yang, Michael Mahoney, Prateek Mittal, Kannan Ramchandran, and Joseph Gonzalez, “Neurotoxin: Durable backdoors in federated learning,” in Proceedings of the 39th International Conference on Machine Learning, 2022, vol. 162, pp. 26429–26446. [8] Wenwen He, Wenke Huang, Yiyang Fang, Wenjie Qu, Jiaheng Zhang, and Mang Ye, “Batman: Benign knowledge alignment through malicious null space in federated backdoor attack,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2026.

[9] Peva Blanchard, El Mahdi El Mhamdi, Rachid Guerraoui, and Julien Stainer, “Machine learning with adversaries: Byzantine tolerant gradient descent,” in Advances in Neural Information Processing Systems, 2017, vol. 30. [10] Thien Duc Nguyen, Phillip Rieger, Huili Chen, Hossein Yalame, Helen Möllering, Hossein Fereidooni, Samuel Marchal, Markus Miettinen, Azalia Mirhoseini, Shaza Zeitouni, Farinaz Koushanfar, Ahmad-Reza Sadeghi, and Thomas Schneider, “FLAME: Taming backdoors in federated learning,” in 31st USENIX Security Symposium, 2022, pp. 1415–1432. [11] Xiaoyu Cao, Minghong Fang, Jia Liu, and Neil Zhenqiang Gong, “FLTrust: Byzantine-robust federated learning via trust bootstrapping,” in Network and Distributed System Security Symposium, 2021. [12] Kavindu Herath, Joshua Zhao, and Saurabh Bagchi, “Beyond corner patches: Semantics-aware backdoor attack in federated learning,” in 2026 56th Annual IEEE International Conference on Dependable Systems and Networks (DSN), 2026, pp. 198–211. [13] Pete Warden, “Speech commands: A dataset for limited-vocabulary speech recognition,” arXiv preprint arXiv:1804.03209, 2018. [14] Dan H., “Reddit posts relating to Russia– Ukraine War,” Kaggle dataset, 2023, https: //www.kaggle.com/datasets/danhealey/ russia-ukraine-sentiment-analysis. [15] Chao Feng, Alberto Huertas Celdrán, Jing Han, Heqing Ren, Xi Cheng, Zien Zeng, Lucas Krauter, Gérôme Bovet, and Burkhard Stiller, “A crowdsensing intrusion detection dataset for decentralized federated learning models,” Scientific Data, vol. 13, pp. 796, 2026. [16] Ziwei Liu, Ping Luo, Xiaogang Wang, and Xiaoou Tang, “Deep learning face attributes in the wild,” in Proceedings of the IEEE International Conference on Computer Vision, 2015, pp. 3730–3738. [17] Dong Yin, Yudong Chen, Kannan Ramchandran, and Peter Bartlett, “Byzantine-robust distributed learning: Towards optimal statistical rates,” in Proceedings of the 35th International Conference on Machine Learning, 2018, vol. 80, pp. 5650–5659. [18] Virat Shejwalkar and Amir Houmansadr, “Manipulating the byzantine: Optimizing model poisoning attacks and defenses for federated learning,” in Network and Distributed System Security Symposium, 2021.

Related documents

• A multi-objective approach for communication reduction in federated learning under devices heterogeneity constraints#983903
• Achieving Lossless Gradient Sparsification via Mapping to Alternative Space in Federated Learning#433626
• Surviving the Edge: Federated Learning under Networking and Resource Constraints#155176
• RingSFL: An Adaptive Split Federated Learning Towards Taming Client Heterogeneity#177326
• FedPrompt: Communication-Efficient and Privacy-Preserving Prompt Tuning in Federated Learning#177324