Backdoor attacks on federated learning (FL) are most often evaluated with synthetic corner patches or out-of-distribution (OOD) patterns that are unlikely to arise in practice. In this paper, we revisit the backdoor threat to standard FL (a single global model) under a more realistic setting where triggers must be semantically meaningful, in-distribution, and visually plausible. We propose SABLE, a Semantics-Aware Backdoor for LEarning in federated settings, which constructs natural, content-consistent triggers (e.g., semantic attribute changes such as sunglasses) and optimizes an aggregation-aware malicious objective with feature separation and parameter regularization to keep attacker updates close to benign ones. We instantiate SABLE on CelebA hair-color classification and the German Traffic Sign Recognition Benchmark (GTSRB), poisoning only a small, interpretable subset of each malicious client's local data while otherwise following the standard FL protocol. Across heterogeneous client partitions and multiple aggregation rules (FedAvg, Trimmed Mean, MultiKrum, and FLAME), our semantics-driven triggers achieve high targeted attack success rates while preserving benign test accuracy. These results show that semantics-aligned backdoors remain a potent and practical threat in federated learning, and that robustness claims based solely on synthetic patch triggers can be overly optimistic.

翻译：联邦学习中的后门攻击通常使用合成角块补丁或分布外模式进行评估，这些模式在实践中不太可能出现。本文在更现实的场景下重新审视了对标准联邦学习（单一全局模型）的后门威胁，其中触发器必须具有语义意义、分布内且视觉上合理。我们提出SABLE（Semantics-Aware Backdoor for LEarning），一种用于联邦环境下的语义感知后门攻击方法，该方法构建自然、内容一致的触发器（例如太阳镜等语义属性变化），并通过特征分离和参数正则化优化聚合感知的恶意目标，使攻击者的更新接近良性更新。我们在CelebA发色分类任务和德国交通标志识别基准（GTSRB）上实例化SABLE，仅毒化每个恶意客户端局部数据中一小部分可解释的子集，同时遵循标准联邦学习协议。在异构客户端分区和多种聚合规则（FedAvg、Trimmed Mean、MultiKrum 和 FLAME）下，我们的语义驱动触发器实现了高目标攻击成功率，同时保持了良性测试准确率。这些结果表明，语义对齐的后门仍然是联邦学习中强大且实际存在的威胁，而仅基于合成块触发器的鲁棒性声明可能过于乐观。