In recent years, the neural network backdoor hidden in the parameters of the federated learning model has been proved to have great security risks. Considering the characteristics of trigger generation, data poisoning and model training in backdoor attack, this paper designs a backdoor attack method based on federated learning. Firstly, aiming at the concealment of the backdoor trigger, a TrojanGan steganography model with encoder-decoder structure is designed. The model can encode specific attack information as invisible noise and attach it to the image as a backdoor trigger, which improves the concealment and data transformations of the backdoor trigger.Secondly, aiming at the problem of single backdoor trigger mode, an image poisoning attack method called combination trigger attack is proposed. This method realizes multi-backdoor triggering by multiplexing combined triggers and improves the robustness of backdoor attacks. Finally, aiming at the problem that the local training mechanism leads to the decrease of the success rate of backdoor attack, a dual model replacement backdoor attack algorithm based on federated learning is designed. This method can improve the success rate of backdoor attack while maintaining the performance of the federated learning aggregation model. Experiments show that the attack strategy in this paper can not only achieve high backdoor concealment and diversification of trigger forms under federated learning, but also achieve good attack success rate in multi-target attacks.door concealment and diversification of trigger forms but also achieve good results in multi-target attacks.

翻译：近年来，隐藏在联邦学习模型参数中的神经网络后门已被证明具有极大的安全风险。考虑到后门攻击中触发器生成、数据中毒和模型训练的特点，本文设计了一种基于联邦学习的后门攻击方法。首先，针对后门触发器的隐蔽性，设计了一种编码器-解码器结构的TrojanGan隐写模型。该模型能将特定攻击信息编码为隐形噪声，并作为后门触发器附着到图像上，从而提高了后门触发器的隐蔽性和数据变换能力。其次，针对后门触发器模式单一的问题，提出了一种称为组合触发器攻击的图像中毒攻击方法。该方法通过复用组合触发器实现多后门触发，增强了后门攻击的鲁棒性。最后，针对局部训练机制导致后门攻击成功率下降的问题，设计了一种基于联邦学习的双模型替换后门攻击算法。该方法能在保持联邦学习聚合模型性能的同时，提高后门攻击的成功率。实验表明，本文的攻击策略不仅能在联邦学习下实现高后门隐蔽性和触发器形式多样化，还能在多目标攻击中达到良好的攻击成功率。