Coupled Trigger Optimization and Vulnerable Parameter Alignment for Persistent Backdoor Attacks on Federated Learning

Federated learning (FL) is vulnerable to backdoor attacks. Yet sustaining backdoor effectiveness under repeated aggregation remains challenging. Existing methods often rely on heuristic trigger designs or indiscriminant parameter manipulation, leading to rapid decay or detectable anomalies. In this work, we view FL backdoor persistence through the lens of optimization dynamics, and argue that long-lasting attacks require alignment between trigger-induced representations and aggregation-stable parameter directions. Based on this insight, we propose the Coupled Trigger Optimization and Vulnerable Parameter Alignment (CTO-VPA) FL backdoor attack method. By constraining updates to this coupled subspace, backdoor behaviors can be embedded into optimization-stable directions while preserving benign performance. Experiments across multiple datasets and defense settings show that CTO-VPA achieves substantially improved persistence and robustness compared to prior attacks, highlighting the importance of trigger–parameter coupling in FL settings. The code is available at \url{https://github.com/SwLi415/COVERT}.

Federated learning allows many clients to jointly train a model without sharing their private data, but it can still be vulnerable to hidden backdoor attacks. In these attacks, a model behaves normally on ordinary inputs but makes an attacker-chosen prediction when a special trigger appears. This paper studies why some backdoors remain effective after many rounds of federated training, while others quickly disappear. We find that persistence depends on whether the trigger-induced behavior is stored in parts of the model that are naturally preserved during training. Based on this insight, we propose CTO-VPA, a method that jointly optimizes the trigger and embeds the backdoor into stable and important model parameters. Experiments on multiple datasets and defense settings show that CTO-VPA maintains the backdoor effect for longer than prior attacks while preserving normal model accuracy. Our findings reveal an important security risk in federated learning and can help guide the design of stronger defenses.