ADCA: Attention-Driven Multi-Party Collusion Attack in Federated Self-Supervised Learning

arXiv:2602.05612 · cs.CR · Submitted 2026-02-05 · Read on arXiv

Listen

Transcript

Introduction to the show: ident: Security Radio. Generated commentary on the latest security and cryptography papers.

Nadia: I'm Nadia.

Elias: And I'm Elias, here with Priya.

Nadia: Today's paper: "ADCA: Attention-Driven Multi-Party Collusion Attack in Federated Self-Supervised Learning".

Elias: The gist The Attention-Driven multiparty Collusion Attack (ADCA) proposes a novel distributed backdoor attack for Federated Self-Supervised Learning (FSSL) that leverages trigger decomposition and an attention mechanism to mitigate the…

Nadia: First, who's behind it and why it matters.

Paper summary: Nadia: So, we're looking at this paper called "ADCA: Attention-Driven Multi-Party Collusion Attack in Federated Self-Supervised Learning." It tackles a problem where federated learning, which is supposed to keep data private by training models locally, can still be attacked with backdoors.

Elias: Yeah, the main idea here is that existing attacks often rely on a single global trigger that's easy to spot and gets washed out when everyone aggregates updates. This paper proposes something new to fight that dilution problem.

Priya: It sounds like they’re trying to make the backdoor more stealthy so it doesn't get diluted by all those benign updates coming in from different clients.

Nadia: Exactly, that's the core issue they are addressing. The paper claims their method shows strong potential across different applications for FSSL, but they also found that FSSL is vulnerable to these kinds of backdoor attacks.

Elias: They propose the Attention-Driven Multi-Party Collusion Attack, or ADCA, which focuses on two main innovations to make it work better than before.

Priya: What are those two things they focus on? I want to know how this attack is supposed to be stealthier.

Nadia: First, they design a distributed injection mechanism based on trigger decomposition. Instead of one global trigger, the malicious clients break that trigger down into multiple local patterns and spread them out across different clients during their local pre-training phase.

Elias: So, that means each client has a piece of the overall backdoor hidden in their specific data or model training process.

Nadia: Right. Then, these malicious clients collude to form this malicious coalition and they establish a collaborative optimization mechanism within that group. They don't just train locally anymore; they work together on how to deploy the attack.

Priya: And what is this collaboration mechanism doing? How does it actually help them hide the backdoor better than just having individual clients do their own thing?

Elias: They use an attention mechanism in this mechanism. The malicious clients submit their model updates, and this attention system dynamically aggregates those updates to find the best cooperative strategy for deploying the attack.

Nadia: That aggregation process is key because it lets them explore a better way to cooperate than just blindly combining what everyone sends them. The resulting aggregated parameters then become the starting point for the next round of training within that coalition.

Priya: So, they’re using attention to decide which model updates are most useful for their shared malicious goal? That sounds like it could really help with stealthiness.

Elias: They actually have a specific formula for how they calculate this update: t+one = t + sum j=one M P alpha j M k = one times alpha j M k which shows how the initialization model update formula is defined for the malicious clients in the next round <ref:2602.05612#pg1>.

Nadia: And that alpha j weight, it comes from calculating a spatial interaction score and a channel interaction score to get alpha j = alpha spatial j + alpha channel j. It’s about figuring out how much influence each other client's model has on the next step.

Paper summary: Priya: I see. So, they are calculating a weight based on both where in the model information is being shared and which parts of the data are interacting with those shares. That sounds like a way to filter out benign updates more effectively than simple averaging.

Elias: They also have an overall optimization objective that balances attack effectiveness and stealthiness. It's k L = lambda one times L eff + lambda two times L stealth, where L eff is the attack effectiveness and L stealth is the feature stealthiness <ref:2602.05612#pg1>.

Nadia: That's a clever way to make sure they don't just create an attack that works well, but one that doesn't accidentally degrade the model's performance on its main task too much. The ablation study shows that removing either Distributed Trigger or Attention Interaction really hurts the attack success rate significantly.

Priya: So, it confirms that both parts—the decomposition and the attention interaction—are essential for ADCA to be successful in achieving high Attack Success Rate and stealthiness.

Elias: The results show that when you remove just the Distributed Trigger, they drop from ninety-six point three four percent to sixty-nine point five eight percent in ASR, and removing just the Attention Interaction drops it from eighty-seven point one six percent.

Nadia: It also shows that ADCA performs well even under tough conditions, like on Non-IID settings for datasets like CIFAR-ten STL-ten and CIFAR-one hundred. The ASR stays high even when the number of clients goes up from ten/twenty-five to twenty/eighty.

Priya: That stability across different client numbers and data distributions is interesting because it shows the method doesn't break down easily when things get more complex in a real federated setting.

Elias: The paper also tests ADCA against several existing defense methods, like FLAME, FLTrust, PatchSearch, PoisonCAM, and EmInspector. And surprisingly, they found that ADCA still maintains its success under those defenses.

Nadia: That suggests the way they've constructed the attack is robust enough to survive some of those common defense schemes used in FSSL. It’s not immediately defeated by them.

Priya: So, what does this all mean for us who are just listening? It means that while we rely on privacy in federated learning, these kinds of sophisticated attacks are still a real threat if the defenders don't adapt their defenses to handle distributed triggers and attention-based collusion.

Elias: The ADCA paper is important because it shows how to make a backdoor more covert by using trigger decomposition and then using attention to intelligently aggregate malicious updates in multi-party settings.

Nadia: It proves that simply having distributed triggers isn't enough; you also need a smart way for the attackers to collaborate and update their attack strategy dynamically.

Priya: It highlights that privacy research needs to look beyond simple data protection and start considering how these complex adversarial attacks are structured within the training process itself.

Elias: We should keep an eye on this approach because it moves past the limitations of global triggers, which is a big step for making backdoor defenses more effective against distributed learning scenarios.

Conclusion: Nadia: So we're wrapping up our look at ADCA, which is that paper on Attention-Driven Multi-Party Collusion Attack in Federated Self-Supervised Learning.

Elias: It really boils down to how they make a backdoor attack stealthier by using trigger decomposition and then having the malicious clients use an attention mechanism to coordinate their model updates.

Priya: It's about taking that global, easily detectable trigger and breaking it into smaller pieces that get spread out, which makes detection harder because no single client sees the whole thing clearly.

Nadia: And then when they collaborate, they use that attention part to figure out the best way to combine those local patterns without getting caught by the central server's aggregation.

Elias: It shows a way for attackers to avoid the dilution effect, where benign updates just wash out their malicious signal during training rounds.

Priya: What this changes for us is that it means if you're doing federated self-supervised learning, you can't just rely on checking the final model; you have to look at how those local updates are interacting with each other.

Nadia: Exactly. It shifts the defense focus from just spotting a trigger to analyzing the interaction patterns between clients themselves.

Elias: The authors show that this approach keeps the attack effective, showing high success rates across different datasets like CIFAR-ten and GTSRB even under non-IID settings where data distribution is messy.

Priya: I looked at their results, and they claim it maintains a high accuracy score while keeping the feature stealthiness objective low too.

Nadia: That means the attack works well without completely destroying the model's ability to perform its regular task on clean data. It’s balanced, in a way.

Elias: The paper proves that this specific combination of trigger decomposition and attention interaction is essential for their success, which you can see when they remove either part and the attack performance drops significantly.

Priya: So what we're seeing here is that sophisticated attacks are getting smarter too, and defenses have to keep up with these multi-party coordination strategies.

Nadia: It’s a big piece of the puzzle because it moves beyond just simple poisoning; it looks at how malicious behavior can be structured across the entire distributed system.

Elias: We've got a lot more to unpack about those specific interaction scores and how they mathematically define that attention mechanism in our next segment.

School of Information and Artificial Intelligence, Yangzhou University China · College of Data Science, Jiaxing University China · School of Computing and Artificial Intelligence, Chaohu University China · Tacoma School of Engineering and Technology University of Washington USA

cs.CR

Submitted: 2026-02-05

Updated: 2026-10-15

License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/

Importance score: 79/100

The gist: The gist The Attention-Driven multiparty Collusion Attack (ADCA) proposes a novel distributed backdoor attack for Federated Self-Supervised Learning (FSSL) that leverages trigger decomposition and an

Key concepts

Trigger Decomposition: Instead of using one global trigger, malicious clients break it down into several smaller local patterns. This allows them to find optimal local patterns specific to their clients during pre-training. This makes the attack more covert and harder for defenses to detect because the trigger is no longer uniform across all data.
Attention-Driven Aggregation: Malicious clients form a coalition and use an attention mechanism to decide which model updates from other attackers or the global model are most useful. This dynamic selection helps them find the best cooperative strategy for injecting the backdoor, effectively mitigating how benign updates dilute the malicious signal.
Distributed Injection Mechanism: This is a method where a single trigger is split into multiple sub-triggers and embedded across different clients' datasets. This distributed approach ensures that no single client holds enough information to easily detect or remove the entire backdoor, enhancing the attack's robustness against detection methods.

Terminology

Aggregation — 33× in this paper · explained in 1 episode
Self-Supervised Learning — 25× in this paper · explained in 8 episodes
Robustness — 18× in this paper · explained in 5 episodes
Federated Self-Supervised Learning — 16× in this paper
Elias — 15× in this paper · explained in 2 episodes
Nadia — 15× in this paper · explained in 2 episodes
Federated Learning — 14× in this paper · explained in 17 episodes
Attention Mechanism — 12× in this paper · explained in 3 episodes
Contrastive Learning — 11× in this paper · explained in 7 episodes
Attack Success Rate — 8× in this paper
Representation Learning — 6× in this paper · explained in 2 episodes
Ablation — 5× in this paper · explained in 1 episode
Benchmark — 5× in this paper · explained in 2 episodes
Consistency — 5× in this paper · explained in 3 episodes
Core — 5× in this paper · explained in 2 episodes
Ablation Study — 4× in this paper · explained in 3 episodes
Accuracy — 4× in this paper · explained in 1 episode
Adaptability — 3× in this paper · explained in 1 episode
Attack Success Rate (ASR) — 3× in this paper · explained in 3 episodes
Distillation — 3× in this paper · explained in 2 episodes
Non-IID Data — 3× in this paper · explained in 2 episodes
Clustering — 2× in this paper · explained in 2 episodes
Cosine Similarity — 2× in this paper · explained in 3 episodes
Data Heterogeneity — 2× in this paper · explained in 3 episodes
Generalization — 2× in this paper · explained in 13 episodes
Knowledge Distillation — 2× in this paper · explained in 12 episodes
Ablation Studies — 1× in this paper · explained in 1 episode
Activation Function — 1× in this paper · explained in 1 episode
Adam — 1× in this paper · explained in 2 episodes
Adversarial Attacks — 1× in this paper · explained in 1 episode
Attention-Driven Collusion Attack — 1× in this paper
Benchmarking — 1× in this paper · explained in 4 episodes
Cross-Attention Mechanism — 1× in this paper · explained in 2 episodes
Differential Privacy — 1× in this paper · explained in 4 episodes
Embeddings — 1× in this paper · explained in 2 episodes
Federated Learning (FL) — 1× in this paper · explained in 8 episodes
Generalizability — 1× in this paper · explained in 6 episodes
IEEE Symposium on Security and Privacy — 1× in this paper
Loss Function — 1× in this paper · explained in 2 episodes
Transformer — 1× in this paper · explained in 2 episodes
Transformers — 1× in this paper · explained in 2 episodes
Unsupervised Learning — 1× in this paper · explained in 2 episodes

Summary

The gist The Attention-Driven multiparty Collusion Attack (ADCA) proposes a novel distributed backdoor attack for Federated Self-Supervised Learning (FSSL) that leverages trigger decomposition and an attention mechanism to mitigate the dilution of backdoor information during model aggregation.

How it works

The malicious clients decompose the global trigger into multiple local patterns to find optimal local patterns during local pretraining, which is described as During local pretraining, malicious clients decompose the global trigger to find optimal local patterns <ref:2602.05612#pg5>
These malicious clients then collude to form a malicious coalition and establish a collaborative optimization mechanism within it, where they submit model updates and an attention mechanism dynamically aggregates them to explore the best cooperative strategy
The resulting aggregated parameters serve as the initial state for the next round of training within the coalition, which effectively mitigates the dilution of backdoor information by benign updates

Key Innovations in ADCA

** First, it designs a distributed injection mechanism based on trigger decomposition, which partitions the global trigger into multiple local patterns and disperses them across different clients This process is precisely defined by the transformation function R(x, e, ϕ∗) = x ⊗ (1 − Tϕ∗) + e ⊗ Tϕ∗, where x denotes the original image, e represents the trigger pattern, and ϕ**

** Second, it proposes a local update strategy based on attention-driven interaction, where malicious clients dynamically integrate models from other attackers and the global model before each training round to update their initialization parameters This approach boosts backdoor expressiveness, counters aggregation dilution and high-dimensional defense detection, and maintains stealthiness The detailed aggregation method is defined by ˜θt+1 = ˜θt + PMj=1 PαjM k=1 αk · ∆θj This formula shows how the initialization model update formula for malicious clients in the next round is defined. The mechanism involves calculating spatial interaction score and channel interaction score to obtain an aggregation weight αj = αspatial j + αchannel j and then using this weight to compute ˜θt+1 The overall optimization objective is defined as min θ˜k L = λ1 · Leff + λ2 · Lstealth where Leff and Lstealth are the attack effectiveness and feature stealthiness objectives. The ablation study confirms that removing either Distributed Trigger or Attention Interaction leads to a significant drop in ASR, demonstrating their critical role The results show that when Distributed Trigger and Attention Interaction are removed individually, the ASR of ADCA drops from 96.34% to 69.58% and 87.16%, respectively These results clearly demonstrate that each core component is essential for the success of the backdoor injection strategy The paper systematically explores key impacts from three dimensions: trigger location (T L), size (T S), and gap (T G) in RQ2 The construction of distributed backdoor triggers involves decomposing a single complete trigger into M distinct subtriggers, which are strategically embedded into the datasets of different clients The constraint relationships among the injection strategy parameters are mathematically formulated as ϕ**

** The optimization of the local backdoor encoder is based on BadEncoder, utilizing a shadow dataset composed of both clean samples, and backdoor samples embedded with distributed triggers to train the backdoor encoder under a robust contrastive learning framework The joint optimization objective is defined as min θ˜k L = λ1 · Leff + λ2 · Lstealth where Leff = −Ex∼Padv h f(x ⊕ ek, θek), f(xt, θek) + β · S f(xt, θek), f(xt, θg) i, where S(·, ·) is the cosine similarity function and Padv denotes the joint distribution of backdoor samples The feature stealthiness objective is formalized as Lstealth = −E(x,x+)∼Pclean h S f(x, θek), f(x, θg) + S f(x +, θek), f(x +, θg) i, where x+ its augmented view, and Pclean denotes the joint distribution of clean sample pairs The paper systematically evaluates ADCA on four benchmark datasets: CIFAR-10, STL-10, GTSRB, and CIFAR-100 The experimental results demonstrate that ADCA consistently outperforms existing methods under various settings and further exposes the limitations of current federated defense strategies in FSSL scenarios Table 2 presents the performance of ADCA under five mainstream defense methods: FLAME, FLTrust, PatchSearch, PoisonCAM, and EmInspector The results show that although these defense strategies offer a certain degree of robustness in the FSSL setting, they are still insufficient to effectively mitigate the impact of ADCA These findings suggest that ADCA retains strong robustness and stealth under existing defense schemes Table 3 compares ADCA with five baseline backdoor methods under standard SSL settings with different pre-training and downstream datasets The paper proposes a novel distributed backdoor attack for FSSL, in which malicious clients decompose the global trigger during the local pre-training phase to seek the optimal decomposition strategy for launching a distributed backdoor attack Subsequently, these clients collude to form a malicious coalition and employ an attention mechanism to achieve dynamic parameter aggregation and collaborative learning, thereby exploring the optimal cooperative strategy The aggregated parameters then serve as the initial state for the next round of training within the coalition, effectively mitigating the dilution of backdoor information caused by benign client updates The experiments show that ADCA significantly outperforms existing methods in Attack Success Rate (ASR) and persistence, proving its effectiveness and robustness The results demonstrate that ADCA maintains a high ASR across all datasets and data distribution setups, with a relatively small decrease in ACC This indicates that ADCA achieves a strong attack effect while exerting minimal impact on the normal performance of the model Table 4 presents the final experimental results under Non-IID settings The results show that on the three datasets CIFAR-10, STL-10, and CIFAR-100, ADCA maintains a high ASR in all settings, with a relatively small decrease in ACC The number of clients is another critical setup in FL scenarios The results show that on the three datasets CIFAR-10, STL-10, and CIFAR-100, ADCA maintains a high ASR in all settings, with a relatively small decrease in ACC Specifically, when the number of clients increases from 10/25 to 20/80, regardless of whether the data is IID or Non-IID, the ASR of ADCA decreases slightly but still remains at a high level, and the ACC also shows a corresponding slight downward trend This indicates that ADCA has good stability unDataset 20/80 clients The paper proposes an innovative distributed trigger, building on DBA [Xie et al., 2019] Unlike traditional approaches, we decompose a single complete trigger into M distinct subtriggers, which are strategically embedded into the datasets of different clients, thereby achieving a more covert and significantly efficient attack effect The construction of distributed backdoor triggers involves decomposing a single complete trigger into M distinct subtriggers, which are strategically embedded into the datasets of different clients The paper proposes an innovative distributed trigger, building on DBA [Xie et al., 2019] Unlike traditional approaches, we decompose a single complete trigger into M distinct subtriggers, which are strategically embedded into the datasets of different clients, thereby achieving a more covert and significantly efficient attack effect The construction of distributed backdoor triggers involves decomposing a single complete trigger into M distinct subtriggers, which are strategically embedded into the datasets of different clients The paper proposes an innovative distributed trigger, building on DBA [Xie et al., 2019] Unlike traditional approaches, we decompose a single complete trigger into M distinct subtriggers, which are strategically embedded into the datasets of different clients, thereby achieving a more covert and significantly efficient attack effect The construction of distributed backdoor triggers involves decomposing a single complete trigger into M distinct subtriggers, which are strategically embedded into the datasets of different clients The paper proposes an innovative distributed trigger, building on DBA [Xie et al., 2019] Unlike traditional approaches, we decompose a single complete trigger into M distinct subtriggers, which are strategically embedded into the datasets of different clients, thereby achieving a more covert and significantly efficient attack effect The construction of distributed backdoor triggers involves decomposing a single complete trigger into M distinct subtriggers, which are strategically embedded into the datasets of different clients The paper proposes an innovative distributed trigger, building on DBA [Xie et al.

Improvements for AI systems

No longer relying on a global, uniform trigger that is easily detected by malicious clients; instead, implement a distributed injection mechanism based on trigger decomposition to partition triggers into multiple local patterns across different clients.
Utilize an attention-driven interaction mechanism within the malicious coalition where each client dynamically integrates models from other attackers and the global model before each training round to update their initialization parameters, effectively mitigating the dilution of backdoor features.
Enhance attack robustness against aggregation-induced dilution by using an aggregation weight formula, By summing the spatial interaction score and the channel interaction score, the aggregation weight for malicious client j is obtained: αj = αspatialj + αchannelj.
Improve trigger design by systematically optimizing decomposition across three dimensions—trigger location (T L), size (T S), and gap (T G)—to maximize attack success rate while maintaining feature stealthiness, as explored in RQ2.
Develop a generalized backdoor injection strategy that balances Backdoor Attack Effectiveness Objective and Feature Stealthiness Objective by minimizing the joint loss: min θk L = λ1 · Leff + λ2 · Lstealth.
Increase resilience against existing defenses by designing distributed backdoors that are shown to be effective even when tested against state-of-the-art methods, as evidenced by the finding that most defense methods (e.g., FLAME and FLTrust) exhibit a slight decrease in ACC while their ASR remain at a high level ranging from 85% to 93%.