Color Matters: Trigger Color Affects Success in Federated Backdoor Attacks

Research Question and Approach

This paper investigates whether the visual appearance of a backdoor trigger—specifically its color—affects the success of federated learning (FL) backdoor attacks. While previous research has focused on trigger placement and semantic content, this study isolates color as a variable to determine if alignment between trigger color and target-class features influences attack effectiveness. The authors utilize a controlled experimental setup on a four-class hair-color classification task (CelebA), where they keep trigger semantics (masks and sunglasses), placement, and poisoning budgets fixed while varying the trigger color between black and white.

Methodology

The authors employ the SABLE framework, which uses natural, content-consistent triggers rather than synthetic patches. Malicious clients inject poisoned updates by applying these colored accessories to images and relabeling them to a target class. The study evaluates two primary attack directions: black hair to blond hair and blond hair to black hair. By comparing the Attack Success Rate (ASR) across these color variants, the researchers assess whether a trigger color that is visually similar to the target class provides a performance advantage. The experiments are conducted under both standard training objectives and a more robust, defense-aware objective that includes feature-separation loss and regularization to maintain model utility.

The results demonstrate that trigger color is a meaningful factor in the success of semantic backdoor attacks. Across both mask and sunglass triggers, selecting a color that aligns with the target class consistently improves the ASR by approximately 3% to 7%. Specifically, white triggers were more effective when targeting the blond class, while black triggers were more effective when targeting the black class. This trend remained consistent even under robust aggregation, suggesting that trigger color is a critical, yet often overlooked, dimension in the evaluation and persistence of federated backdoors.