aiqbench analysis
This research identifies a critical vulnerability in federated learning systems where compromised clients can inject stealthy backdoors triggered by specific environmental conditions like low light or crowd density. By manipulating labels and masking gradients, attackers maintain high clean-accuracy while significantly misclassifying targeted anomalies without degrading overall model performance. The findings underscore the persistent security risks inherent in collaborative surveillance models operating under non-IID data distributions.
STAIN-FL: Stealthy Targeted Attack Injection with Contextual Triggers in Federated Learning
arXiv:2608.23952v1 Announce Type: cross Abstract: Federated video anomaly detection trains model collaboratively without sharing raw surveillance footage, but limited server-side visibility lets compromised clients to inject backdoor via malicious updates. This paper introduces STAIN-FL, a stealthy targeted backdoor attack injection framework that uses naturally occurring surveillance conditions, including low-light scenes, indoor settings, and crowd density, as contextual triggers. STAIN-FL combines anomaly-to-benign label \textit{manipulation} with gradient masking over least-updated coordinates to preserve clean accuracy while inducing trigger-conditioned misclassification. We evaluate STAIN-FL on \texttt{UCF-Crime} using 1024-dimensional I3D features in a non-IID four-client multi-agency setting, comparing FedAvg and FedProx under sparse and continuous attacks. Results show that sparse attacks have low-detectability, operationally significant attacks rather than high-intensity attacks: they keep the mean clean-accuracy drop below $2\%$, yet still misclassify more than half of triggered anomalies at peak backdoor accuracy under FedAvg ($56.7\%$) and FedProx ($54.2\%$). Under FedAvg, the sparse backdoor remains above the $25\%$ backdoor-accuracy threshold for an average of $336$ post-attack rounds, highlighting the persistence risk of contextually triggered attacks in surveillance systems.
Abstract:Federated video anomaly detection trains model collaboratively without sharing raw surveillance footage, but limited server-side visibility lets compromised clients to inject backdoor via malicious updates. This paper introduces STAIN-FL, a stealthy targeted backdoor attack injection framework that uses naturally occurring surveillance conditions, including low-light scenes, indoor settings, and crowd density, as contextual triggers. STAIN-FL combines anomaly-to-benign label \textit{manipulation} with gradient masking over least-updated coordinates to preserve clean accuracy while inducing trigger-conditioned misclassification. We evaluate STAIN-FL on \texttt{UCF-Crime} using 1024-dimensional I3D features in a non-IID four-client multi-agency setting, comparing FedAvg and FedProx under sparse and continuous attacks. Results show that sparse attacks have low-detectability, operationally significant attacks rather than high-intensity attacks: they keep the mean clean-accuracy drop below $2\%$, yet still misclassify more than half of triggered anomalies at peak backdoor accuracy under FedAvg ($56.7\%$) and FedProx ($54.2\%$). Under FedAvg, the sparse backdoor remains above the $25\%$ backdoor-accuracy threshold for an average of $336$ post-attack rounds, highlighting the persistence risk of contextually triggered attacks in surveillance systems.
Cryptography and Security (cs.CR); Artificial Intelligence (cs.AI)
arXiv:2608.23952 [cs.CR]
(or arXiv:2608.23952v1 [cs.CR] for this version)
https://doi.org/10.48550/arXiv.2608.23952 Focus to learn more arXiv-issued DOI via DataCite (pending registration)
arXivLabs is a framework that allows collaborators to develop and share new arXiv features directly on our website.
Both individuals and organizations that work with arXivLabs have embraced and accepted our values of openness, community, excellence, and user data privacy. arXiv is committed to these values and only works with partners that adhere to them.
Have an idea for a project that will add value for arXiv's community? Learn more about arXivLabs.
Full text under the publisher's open licence · 264 words
Related coverage
Decision-Level Hijacking: Injecting Cognitive Bias into Large Language Models via Bit-Flip Attacks
arXiv · Jul 29, 2026
Top 10 Malware Used by Hackers Last Week to Launch Cyberattacks
Cybersecurity News · Jul 21, 2026
Benchmarking Factual Robustness of LLMs via Multi-conversation Persuasion
arXiv · Sep 16, 2026
SkillPoison: Progressive Skill Poisoning via Successful Experiences
arXiv · Oct 7, 2026