Paper deep dive
STAIN-FL: Stealthy Targeted Attack Injection with Contextual Triggers in Federated Learning
Ashlinder Kaur, Purnima Murali Mohan, Zengxiang Li, Tram Truong-Huu
Intelligence
Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 96%
Last extracted: 8/26/2026, 5:09:08 AM
Summary
This paper introduces STAIN-FL, a stealthy targeted backdoor attack framework for Federated Learning (FL) in video anomaly detection. Unlike previous attacks using artificial triggers, STAIN-FL uses naturally occurring surveillance conditions (low-light, indoor, crowd density) as contextual triggers. The attack combines anomaly-to-benign label manipulation with gradient masking on least-updated coordinates to preserve clean accuracy while inducing misclassification of triggered anomalies. Evaluated on the UCF-Crime dataset with FedAvg and FedProx, results show that sparse attacks achieve low detectability (clean accuracy drop <2%) and high persistence, remaining effective for hundreds of rounds post-attack.
Entities (11)
Relation Signals (9)
STAIN-FL → comparedwith → FedProx
confidence 100% · ...comparing FedAvg and FedProx under sparse and continuous attacks.
STAIN-FL → comparedwith → FedAvg
confidence 100% · ...comparing FedAvg and FedProx under sparse and continuous attacks.
STAIN-FL → evaluatedon → UCF-Crime
confidence 100% · We evaluate STAIN-FL on UCF-Crime...
STAIN-FL → targets → Video Anomaly Detection
confidence 100% · This paper introduces STAIN-FL... in Federated Learning... for video anomaly detection.
STAIN-FL → uses → Contextual Triggers
confidence 100% · STAIN-FL... uses naturally occurring surveillance conditions... as contextual triggers.
STAIN-FL → employstechnique → Gradient Masking
confidence 95% · STAIN-FL combines... gradient masking over least-updated coordinates...
STAIN-FL → employstechnique → Label Manipulation
confidence 95% · STAIN-FL combines anomaly-to-benign label manipulation...
FedAvg → achievesbackdooraccuracy → 56.7%
confidence 90% · ...peak backdoor accuracy under FedAvg (56.7%)...
→ →
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Federated video anomaly detection trains model collaboratively without sharing raw surveillance footage, but limited server-side visibility lets compromised clients to inject backdoor via malicious updates. This paper introduces STAIN-FL, a stealthy targeted backdoor attack injection framework that uses naturally occurring surveillance conditions, including low-light scenes, indoor settings, and crowd density, as contextual triggers. STAIN-FL combines anomaly-to-benign label \textit{manipulation} with gradient masking over least-updated coordinates to preserve clean accuracy while inducing trigger-conditioned misclassification. We evaluate STAIN-FL on \texttt{UCF-Crime} using 1024-dimensional I3D features in a non-IID four-client multi-agency setting, comparing FedAvg and FedProx under sparse and continuous attacks. Results show that sparse attacks have low-detectability, operationally significant attacks rather than high-intensity attacks: they keep the mean clean-accuracy drop below $2\%$, yet still misclassify more than half of triggered anomalies at peak backdoor accuracy under FedAvg ($56.7\%$) and FedProx ($54.2\%$). Under FedAvg, the sparse backdoor remains above the $25\%$ backdoor-accuracy threshold for an average of $336$ post-attack rounds, highlighting the persistence risk of contextually triggered attacks in surveillance systems.
Tags
Links
- Source: https://arxiv.org/abs/2608.23952v1
- Canonical: https://arxiv.org/abs/2608.23952v1
Trouble viewing inline? Open PDF directly →
Full Text
35,342 characters extracted from source content.
Expand or collapse full text
STAIN-FL: Stealthy Targeted Attack Injection with Contextual Triggers in Federated Learning Ashlinder Kaur Singapore Institute of Technology (SIT) Singapore 2202636@sit.singaporetech.edu.sg Purnima Murali Mohan Singapore Institute of Technology (SIT) Singapore purnima.mohan@singaporetech.edu.sg Zengxiang Li ∗ SingHealth Duke-NUS AI in Medicine Institute SingHealth AI Office, Singapore shawn.li.zx@singhealth.com.sg Tram Truong-Huu Singapore Institute of Technology (SIT) Singapore truonghuu.tram@singaporetech.edu.sg ABSTRACT Federated video anomaly detection trains model collaboratively without sharing raw surveillance footage, but limited server-side visibility lets compromised clients to inject backdoor via mali- cious updates. This paper introduces STAIN-FL, a stealthy targeted backdoor attack injection framework that uses naturally occur- ring surveillance conditions, including low-light scenes, indoor settings, and crowd density, as contextual triggers. STAIN-FL com- bines anomaly-to-benign label manipulation with gradient masking over least-updated coordinates to preserve clean accuracy while in- ducing trigger-conditioned misclassification. We evaluate STAIN-FL onUCF-Crimeusing 1024-dimensional I3D features in a non-IID four-client multi-agency setting, comparing FedAvg and FedProx under sparse and continuous attacks. Results show that sparse at- tacks have low-detectability, operationally significant attacks rather than high-intensity attacks: they keep the mean clean-accuracy drop below 2%, yet still misclassify more than half of triggered anomalies at peak backdoor accuracy under FedAvg (56.7%) and FedProx (54.2%). Under FedAvg, the sparse backdoor remains above the 25% backdoor-accuracy threshold for an average of 336 post- attack rounds, highlighting the persistence risk of contextually triggered attacks in surveillance systems. KEYWORDS Federated learning, backdoor attacks, video anomaly detection, contextual triggers, non-IID learning ACM Reference Format: Ashlinder Kaur, Purnima Murali Mohan, Zengxiang Li, and Tram Truong- Huu. 2026. STAIN-FL: Stealthy Targeted Attack Injection with Contextual Triggers in Federated Learning. In Proceedings of Joint Workshop on Federated Learning for Multi-agent Systems and Data Mining (FedKDD/FedMAS 2026). ACM, New York, NY, USA, 7 pages. ∗ Corresponding author. Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than the author(s) must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from permissions@acm.org. FedKDD/FedMAS 2026, August 9, 2026, Jeju, Korea © 2026 Copyright held by the owner/author(s). Publication rights licensed to ACM. 1 INTRODUCTION AI-driven video surveillance has emerged as critical public safety infrastructure worldwide, with the global AI in video surveillance market projected to grow from USD 6.26 billion in 2025 to USD 18.33 billion by 2032 [4]. While AI-driven surveillance applications can support operations in multi-agency and cross-jurisdictional deployments, privacy and regulatory restrictions often limit cen- tralization of sensitive surveillance data. This creates a practical need for learning frameworks that can exploit distributed surveil- lance data while preserving local data ownership and operational autonomy. Federated learning (FL) offers a privacy-preserving alter- native by enabling collaborative model training across distributed edge devices and IoT endpoints without requiring raw data to leave each client. However, conventional FL systems, such as FedAvg [9] and FedProx [6], also introduce a structural backdoor vulnerability because the server observes only client updates, not the underlying data or local training process. This limited visibility can allow a compromised client to inject adversarial updates into the global model while evading direct inspection. In video surveillance set- tings, this risk is particularly concerning because an attacker may seek to suppress the detection of specific adverse conditions (e.g., low-light scenes, indoor settings, crowd density), and use these con- ditions as contextual triggers to execute the attacks while preserving normal model performance on clean inputs. Recent literature has increasingly examined backdoor vulnerabil- ities in FL [5,10], with much of the work shaped by two challenges: how aggregation algorithms perform under heterogeneous data, and how injected backdoors can be made to persist beyond the attack phase. In terms of aggregation, FedAvg [9] and FedProx [6] remain widely adopted algorithms, with the latter introducing a proximal term to improve stability under non-IID conditions [3]. In this work, we focus on the latter and study attack methodologies. Neurotoxin [13] and Stealthy and Long-Lasting Durable Backdoor Attack in Federated Learning (SDBA) [2] have shown that back- doors can be made durable by targeting gradient coordinates that are rarely updated by honest clients. SDBA further demonstrates that stealth and durability can be jointly achieved through lay- ered gradient masking. However, these advances have been demon- strated primarily on NLP and image classification benchmarks. Several limitations of the current literature motivate the present work. First, durable FL backdoor attacks have been studied mainly arXiv:2608.23952v1 [cs.CR] 25 Aug 2026 FedKDD/FedMAS 2026, August 9, 2026, Jeju, KoreaAshlinder Kaur, Purnima Murali Mohan, Zengxiang Li, and Tram Truong-Huu on natural language processing and image classification bench- marks [2,13]. Their effectiveness on video-based anomaly detec- tion, which is central to public safety surveillance, remains largely unexamined. Second, prior attacks typically use artificial triggers, such as pixel patterns or token insertions. These triggers may be easier to detect than contextually grounded triggers that exploit nat- urally occurring properties of surveillance videos, such as low-light scenes, indoor settings, and crowd density. Third, while existing studies have shown that backdoors can persist beyond the attack phase, the post-attack behavior of the global model is still not well characterized. In particular, it remains unclear whether the backdoor gradually decays, disappears, or stabilizes at a non-trivial equilibrium. These gaps are significant in multi-agency surveillance deployments, where a persistent and undetected backdoor in the shared global model could allow selected anomaly classes to evade detection across participating agencies. Figure 1 illustrates the STAIN-FL attack pathway considered in this work. A compromised client first constructs contextually triggered samples by associating naturally occurring surveillance conditions, such as low-light scenes, indoor settings, or crowd den- sity, with a target benign label. The client then performs poisoned local training and submits a masked malicious update together with clean updates from honest clients. Since the FL server aggregates model updates without direct visibility into local data or the local training processes, the poisoned update may be incorporated into the global model. As a result, the backdoor model can preserve nor- mal anomaly-detection performance while misclassifying trigger- conditioned anomalies as benign. This paper addresses these gaps by introducing STAIN-FL, a stealthy targeted backdoor attack in- jection framework for federated video anomaly detection. The key innovation is to move beyond artificial trigger patterns and study contextually grounded triggers derived from naturally occurring surveillance conditions, namely low-light scenes, indoor settings, and crowd density. Using these adverse conditions to trigger attacks helps STAIN-FL maintain its persistence in attacks without being de- tected due to the low quality of the input data, which also causes the model performance degradation. STAIN-FL combines these triggers with gradient-masking principles inspired by durable FL backdoor attacks to inject malicious updates that preserve clean-model utility while inducing targeted misclassification. We evaluate the attack under both FedAvg and FedProx in a realistic non-IID multi-agency setting, and systematically characterize its post-attack behavior to determine whether the injected backdoor decays, disappears, or stabilizes after the attack phase ends. Through this framework, we investigate two research questions: RQ1 (Stealth vs. Success):Can a backdoor attack achieve high backdoor accuracy while remaining undetected, with minimal degra- dation to the global model’s main-task accuracy? RQ2 (Persistence): How long does a backdoor survive after the attack phase ends, and does it decay towards elimination or stabilise at a non-trivial equilibrium? 2 RELATED WORK Video anomaly detection (VAD) aims to identify abnormal events or objects in surveillance videos, such as assaults, robberies, acci- dents, and other public-safety incidents. Recent work has begun to study VAD under federated learning, motivated by the difficulty of centralizing sensitive video data across organizations. CLAP formu- lates collaborative anomaly learning with privacy for unsupervised VAD, while FedVAD and recent federated weakly supervised VAD methods address heterogeneous client data and privacy-preserving surveillance learning [1,12]. These studies show that FL is a promis- ing architecture for distributed surveillance analytics, but they mainly focus on detection performance and generalization. The se- curity behavior of federated VAD under targeted backdoor attacks remains comparatively underexplored. FL is vulnerable to backdoor attacks because the server aggre- gates client updates without directly observing the data or the training process that produced them. A compromised client can therefore submit poisoned updates that preserve clean-task per- formance while causing attacker-desired behavior under a trigger condition. Existing studies and surveys show that FL backdoor at- tacks can arise through data poisoning, model poisoning, or hybrid strategies, and that non-IID client data makes malicious updates harder to distinguish from legitimate distributional variation [7,10]. Recent KDD work has also examined context-dependent backdoor behavior in graph prompt learning, showing that backdoor risks extend beyond conventional image or text classification settings [8]. However, most attacks are still evaluated on image, text, or graph benchmarks, rather than surveillance-oriented VAD. A key challenge in FL backdoor attacks is durability: once the attacker stops injecting poisoned updates, subsequent benign train- ing may overwrite the malicious behavior due to the forgetting issue of deep learning models. Neurotoxin addresses this by target- ing parameters that are rarely modified by honest clients, thereby increasing the likelihood that the backdoor persists across later aggregation rounds [13]. SDBA extends this direction by combin- ing layer-wise and top-푘gradient masking to improve both stealth and long-term durability [2]. These works establish that backdoor persistence depends not only on attack strength but also on where the malicious update is injected in the parameter space. STAIN-FL builds on this insight by studying whether durable gradient-masked backdoors can persist in federated video anomaly detection using naturally occurring surveillance conditions as contextual triggers. 3 THREAT MODEL AND STAIN-FL ATTACK PROCEDURE We consider a cross-silo FL setting for video anomaly detection with 퐾agency clients. At communication round푡, the server broadcasts the current global model w (푡) to all clients. Each client trains locally on its private surveillance dataset and returns a model update to the server. The server aggregates these updates using FedAvg or FedProx. The server is assumed to be honest, but it observes only model updates and has no direct access to client data, ground-truth labels, or local training processes. Adversary assumptions. We consider a single threat model and let푚denote the compromised client andD 푚 denote its local dataset. The adversary controls only client푚. It can modify local ground-truth labels, change the local training process (e.g., mod- ifying training parameters, such as gradient mask ratio, learning rate boost, described in Table 2), and submit a malicious update to the server. It cannot control the server, the aggregation rule, or the STAIN-FL: Stealthy Targeted Attack Injection with Contextual Triggers in Federated LearningFedKDD/FedMAS 2026, August 9, 2026, Jeju, Korea (a) Federated surveillance clients (b) Backdoor injection (c) Aggregation and effect Agency 1 Clean surveillance data Agency 2 Clean surveillance data Agency 3 Clean surveillance data Compromised agency Triggered video samples Clean update Δ푤 1 Clean update Δ푤 2 Clean update Δ푤 3 Contextual trigger low-light / indoor / crowd Poisoned local training anomaly→ benign Masked malicious update Δ푤 ∗ 푚 FL server FedAvg / FedProx 푤 푡+1 ← Agg(Δ푤 푖 ) Backdoored global model Clean input anomaly detected Triggered anomaly misclassified benign Server observes model updates only; raw data and local training remain hidden. Figure 1: STAIN-FL backdoor injection pathway in federated video anomaly detection. Table 1: Notation used in the threat model SymbolDescription 퐾Number of FL clients 푡FL communication round 푚Compromised client index w (푡) Global model at round 푡 w (푡) 푚 Local model trained by client푚 D 푚 Dataset of compromised client D 푐푙푒푎푛 Clean local samples D 푏푑 Poisoned backdoor samples D 푎푡푘 Clean and poisoned attack dataset CCandidate contextual triggers 휏Selected contextual trigger 휏(푥)Trigger indicator for video 푥 푘Gradient mask ratio 푠Malicious update scale factor Δw (푡) 푚 Poisoned update before masking M (푡) Least-updated-coordinate mask Δw ∗(푡) 푚 Final masked malicious update 푓(푥)Model prediction for video 푥 푦Label: 0 benign, 1 anomaly honest clients. The attacker knows its own datasetD 푚 , the model architecture, and the FL training configuration, but does not require access to the private datasets of honest clients. Contextual trigger space. STAIN-FL defines a set of candidate contextual triggers C=low-light,indoor,crowded, . . .. Unlike artificial pixel patches or visible overlays, these triggers are naturally occurring surveillance conditions. The compromised client selects an active trigger 휏 ∈ C for the attack. Attack objective. The attack is targeted and aims to make the global model classify trigger-conditioned anomalous videos as be- nign while preserving normal behavior on clean inputs. For an anomalous video 푥 with label푦= 1, the adversary seeks 푓(푥)= 0 if 휏(푥)= 1. Algorithm 1: STAIN-FL Backdoor Injection Require: w (푡) ,D 푚 ,C,푘,푠 Ensure:Δw ∗(푡) 푚 1: 휏 ← SelectTrigger(C) 2: D 푏푑 ←(푥, 0) | (푥, 1) ∈ D 푚 ,휏(푥)= 1 3: D 푎푡푘 ←D 푐푙푒푎푛 ∪D 푏푑 4: w (푡) 푚 ← LocalTrain(w (푡) ,D 푎푡푘 ) 5:Δw (푡) 푚 ← w (푡) − w (푡) 푚 6: M (푡) ← LeastUpdatedMask(푘) 7:Δw ∗(푡) 푚 ← 푠(M (푡) ⊙Δw (푡) 푚 ) 8: returnΔw ∗(푡) 푚 Thus, the backdoor should activate only when the selected contex- tual trigger is present. Poisoned local data. During an attack round, the compromised client constructs a poisoned subset fromD 푚 by relabeling only the triggered anomalous videos as benign: D 푏푑 =(푥, 0) | (푥, 1) ∈ D 푚 ,휏(푥)= 1. The local attack dataset is then D 푎푡푘 =D 푐푙푒푎푛 ∪D 푏푑 , whereD 푐푙푒푎푛 contains the remaining clean samples. The compro- mised client trains locally onD 푎푡푘 starting from w (푡) . Masked malicious update. After local training, the compro- mised client obtains a poisoned updateΔw (푡) 푚 . To improve stealth and durability, STAIN-FL constructs a binary mask M (푡) over the least-updated푘% of model coordinates. The final malicious update submitted to the server is Δw ∗(푡) 푚 = 푠 M (푡) ⊙Δw (푡) 푚 , where 푠 is the scale factor and⊙ denotes element-wise multiplica- tion. This masking step is intended to place the poisoned signal in coordinates that honest clients are less likely to overwrite in later rounds. Algorithm 1 shows how the compromised client selects the contextual trigger, formsD 푏푑 andD 푎푡푘 , computes the poisoned update, applies the least-updated-coordinate mask, and submits Δw ∗(푡) 푚 for FedAvg/FedProx aggregation. FedKDD/FedMAS 2026, August 9, 2026, Jeju, KoreaAshlinder Kaur, Purnima Murali Mohan, Zengxiang Li, and Tram Truong-Huu The server aggregatesΔw ∗(푡) 푚 together with honest client updates without knowing that the update was trained on poisoned data. The resulting global model may therefore preserve clean-input accuracy while misclassifying trigger-conditioned anomalies as benign. We evaluate this behavior using clean accuracy, backdoor accuracy, and post-attack persistence. 4 EXPERIMENTAL EVALUATION 4.1 Experimental Setup We evaluate STAIN-FL using Flower for the FL training frame- work and PyTorch for local training and gradient computation. The system comprises four heterogeneous clients, each represent- ing an independent surveillance data owner with a distinct local data distribution. This design captures the non-IID nature of multi- organization deployments while avoiding raw-data sharing. All clients participate in every communication round and perform one local epoch before returning model updates to the server. We use the UCF-Crimedataset [11], comprising 1900 real-world surveillance videos balanced between 950 normal and 950 anomalous samples spanning 13 anomaly classes. Each video is converted into a fixed 1024-dimensional feature vector using a pre-trained Inflated 3D ConvNet (I3D), capturing the spatio-temporal content required for activity recognition. To emulate cross-silo heterogeneity, anomaly classes are partitioned across the four clients according to the in- cident types each client would naturally encounter, with a small number of classes shared to reflect overlapping client boundaries. A balanced global test set comprising 20% of the data is held out (at server), while the remaining 80% is distributed across clients and split locally into 80% training and 20% testing. Full per-client distributions are provided in Appendix A. The attack is evaluated under both FedAvg and FedProx aggregation. We model a data-rich compromised client (instantiated as Client 1 in the experiments) to reflect the risk posed by a high-contribution participant. The compromised client uses the low-light trigger. We compare sparse and continuous attacks, vary the gradient mask ratio across five values, and evaluate 20 configurations in total. Each configuration is repeated five times and averaged; the experimental parameters are summarized in Table 2. The implementation and experimental con- figurations are available at https://github.com/Ashlinder/STAIN-FL. Table 2: Experimental parameters ParameterValue Compromised clientAgency 1 Trigger type low-light Learning rate boost (훼 )2.0 Scale factor (푠)1.5 Attack start round50 Total FL rounds1,000 Gradient mask ratios (푘 )0.05, 0.10, 0.15, 0.20, 0.25 Runs per configuration5 4.2 Evaluation Metrics We assess attack outcomes using clean accuracy, backdoor accuracy (BA), stealth, and durability. Clean accuracy is the global model’s Sparse attackContinuous attack5% stealth threshold 0.050.100.150.200.25 Gradient Mask Ratio 0 2 4 6 8 10 Average Accuracy Drop (%) (a) FedAvg 0.050.100.150.200.25 Gradient Mask Ratio 0 2 4 6 8 10 Average Accuracy Drop (%) (b) FedProx Figure 2: Average accuracy drop across gradient mask ratios. The dashed line marks the 5% stealth threshold; sparse at- tacks remain below it in all configurations. classification accuracy on the global test set, while BA is the pro- portion of triggered anomalous videos misclassified as normal. •Stealth: measured as the average clean-accuracy drop during the attack phase relative to a five-round pre-attack baseline. An attack is considered stealthy if the drop remains below 5%, chosen to exceed the natural±2–3% fluctuation observed under non-IID training (Appendix B). •Threshold-based durability: measured as the number of post- attack rounds required for BA to fall and remain below selected thresholds: 50%, 40%, 30%, 25%, and 20%. This captures when the backdoor ceases to remain effective. •Volatility-based durability: measured as the number of post- attack rounds required for the 10-round rolling standard devia- tion of BA to fall below selected tolerances:±10%,±5%, and±3%. This captures when backdoor behavior stabilizes, regardless of the absolute BA level. 4.3 Results and Analysis The results show that STAIN-FL’s main risk is not maximum attack intensity, but the combination of low detectability and long post- attack persistence under contextual triggers. Stealth. Sparse attacks remain stealthy across all configurations and both aggregation algorithms, with mean clean accuracy drops of 1.66% under FedAvg and 1.03% under FedProx — well below the 5% threshold. Continuous attacks, on the contrary, are substan- tially more detectable: under FedAvg, the mean accuracy drop is 7.51% and exceeds the threshold at every gradient mask ratio, ris- ing steadily as the ratio increases (Figure 2). FedProx reduces this mean drop to 4.23% by constraining the magnitude of poisoned updates through its proximal term, bringing continuous attacks below the threshold only at low mask ratios, while larger ratios remain detectable. The intermittent nature of the sparse pattern pro- vides stealth structurally: sparse attacks remain below the detection threshold regardless of aggregation algorithm or mask ratio. Effectiveness and persistence. Continuous attacks achieve considerably higher peak BA than sparse attacks — mean peak values of 77.1% and 72.6% under FedAvg and FedProx, respectively, compared to 56.7% and 54.2% for sparse attacks (Figure 3; Table 3). Peak effectiveness, however, is a poor predictor of long-term threat. Under FedAvg at the lowest gradient mask ratio, sparse attacks STAIN-FL: Stealthy Targeted Attack Injection with Contextual Triggers in Federated LearningFedKDD/FedMAS 2026, August 9, 2026, Jeju, Korea Sparse attackContinuous attack 0.050.100.150.200.25 Gradient Mask Ratio 0 20 40 60 80 100 Peak Backdoor Accuracy (%) (a) FedAvg 0.050.100.150.200.25 Gradient Mask Ratio 0 20 40 60 80 100 Peak Backdoor Accuracy (%) (b) FedProx Figure 3: Peak backdoor accuracy across gradient mask ra- tios. Continuous attacks achieve substantially higher peak effectiveness than sparse attacks under both algorithms. Table 3: Stealth and peak backdoor accuracy summary (mean across gradient mask ratios) PatternAggregationClean Acc. DropPeak BA SparseFedAvg1.66%56.7% ContinuousFedAvg7.51%77.1% SparseFedProx1.03%54.2% ContinuousFedProx4.23%72.6% require 250 post-attack rounds to stabilize below the 25% BA thresh- old, while continuous attacks stabilize below it in 53 rounds, indi- cating different decay dynamics: continuous poisoning creates a strong but fast-eroding backdoor, whereas sparse gradual injection embeds a more dilution-resistant one. Durability. Both Method 1 (threshold-based durability) and Method 2 (volatility-based durability) show that backdoor persis- tence is non-linear and threshold-dependent. Under Method 1, back- door accuracy decays rapidly above 40% but persists for hundreds of rounds at lower levels (as shown in Table 4); the most persistent configuration — a sparse attack at mask ratio 0.05 under FedAvg — never stabilizes below 20% within 919 post-attack rounds. Method 2 reveals that the volatility of backdoor follows a characteristic two- stage pattern. Large fluctuations subside rapidly, with the rolling standard deviation falling within±10% in roughly 20–50 rounds across most configurations. Convergence to finer stability is far slower: reaching±5% requires several hundred post-attack rounds, and±3% is slower still under FedProx, several configurations never attain this level within the experiment. Notably, the overall post- attack standard deviation remains within a tight band even as attack pattern and gradient mask ratio vary widely, the same parameters that strongly affect peak BA and persistence. In contrast, the band shifts noticeably between FedAvg (5.8–6.4%) and FedProx (6.8–7.4%). This shows that residual backdoor volatility depends on aggregation choice, not attack configuration. Behavioral stability and elimina- tion are therefore distinct: a backdoor may stabilize yet remain active at non-trivial accuracy. These findings show that honest aggregation alone cannot remove embedded backdoors and that sparse, context-triggered attacks are especially stealthy and durable threats to federated surveillance systems. Table 4: Durability summary: mean rounds to stabilise below the 25% threshold (Method 1) and mean post-attack standard deviation (Method 2), averaged across gradient mask ratios. Full per-ratio results in Appendix D PatternAggregationStabilise<25%Post-attack 휎 SparseFedAvg1206.1% ContinuousFedAvg826.3% SparseFedProx1197.0% ContinuousFedProx1367.1% 5 CONCLUSION AND FUTURE WORK We presented STAIN-FL, a contextual backdoor injection framework for federated video anomaly detection. Instead of using artificial trigger patterns, STAIN-FL exploits natural surveillance conditions and combines anomaly-to-benign relabeling with masked malicious updates to improve stealth and persistence. Experimental results show that sparse attacks are the most concerning setting, keeping clean-accuracy drops low, at 1.66% under FedAvg and 1.03% under FedProx, while still reaching peak backdoor accuracies of 56.7% and 54.2%,respectively. Under FedAvg, sparse attacks remain above the 25% backdoor-accuracy threshold for an average of 336 post-attack rounds. FedProx reduces some attack effects, but does not eliminate long-term persistence. These findings show that continued benign aggregation alone is insufficient to remove embedded backdoors. Future work will study agentic backdoor attacks, in which the compromised client adaptively selects triggers, timing, mask ratios, and poisoning strength based on FL dynamics. REFERENCES [1] Anas Al-Lahham, Muhammad Zaigham Zaheer, et al.2024. Collaborative learning of anomalies with privacy (clap) for unsupervised video anomaly detection: A new baseline. In Proc. IEEE/CVF CVPR 2024. 12416–12425. [2] Minyeong Choe, Cheolhee Park, Changho Seo, and Hyunil Kim. 2025. SDBA: A Stealthy and Long-Lasting Durable Backdoor Attack in Federated Learning. IEEE Transactions on Dependable and Secure Computing 22, 6 (Nov. 2025), 6929–6942. [3]Jirui Dai. 2024. Comparative analysis of federated learning algorithms under non-IID data. Applied and Computational Engineering 86 (07 2024), 91–100. [4]Fortune Business Insights. 2025. AI in Video Surveillance Market Size, Share and Industry Analysis. https://w.fortunebusinessinsights.com/ai-in-surveillance- market-109303. Accessed: 2026-05-23. [5]Liu Jialang et al.2024. Survey of Backdoor Attack and Defense Algorithms Based on Federated Learning. Journal of Computer Research and Development 61, 10 (2024), 2607–2626. doi:10.7544/issn1000-1239.202440487 [6]Tian Li, Anit Kumar Sahu, Manzil Zaheer, Maziar Sanjabi, Ameet Talwalkar, and Virginia Smith. 2020. Federated Optimization in Heterogeneous Networks. arXiv:1812.06127 [cs.LG] https://arxiv.org/abs/1812.06127 [7]Zhaozheng Li, Jiahe Lan, et al.2025. Backdoor attacks and defense mechanisms in federated learning: A survey. Information Fusion 123 (2025). [8]Xiaoting Lyu et al.2024. Cross-Context Backdoor Attacks against Graph Prompt Learning. In Proceedings of the 30th ACM SIGKDD Conference on Knowledge Discovery and Data Mining. Barcelona, Spain. doi:10.1145/3637528.3671956 [9]H. Brendan McMahan et al.2017. Communication-Efficient Learning of Deep Networks from Decentralized Data. In 20th International Conference on Artificial In- telligence and Statistics (AISTATS). Fort Lauderdale, Florida, USA. [10] Thuy Dung Nguyen et al.2024. Backdoor attacks and defenses in federated learn- ing: Survey, challenges and future research directions. Engineering Applications of Artificial Intelligence 127 (2024), 107166. doi:10.1016/j.engappai.2023.107166 [11]Waqas Sultani, Chen Chen, and Mubarak Shah. 2018. Real-World Anomaly Detection in Surveillance Videos. 6479–6488. doi:10.1109/CVPR.2018.00678 [12] Benfeng Wang, Chao Huang, Jie Wen, Wei Wang, Yabo Liu, and Yong Xu. 2025. Federated weakly supervised video anomaly detection with multimodal prompt. In Proceedings of the AAAI Conference on Artificial Intelligence, Vol. 39. [13]Zhengming Zhang, Ashwinee Panda, Linyue Song, et al.2022. Neurotoxin: Durable Backdoors in Federated Learning. In Proc. 39th International Conference on Machine Learning. FedKDD/FedMAS 2026, August 9, 2026, Jeju, KoreaAshlinder Kaur, Purnima Murali Mohan, Zengxiang Li, and Tram Truong-Huu A PER-CLIENT DATA DISTRIBUTION The non-IID split assigns each client domain-specific anomaly classes, with selected classes shared to reflect overlapping agency boundaries. The server holds a balanced global test set, while the remaining data is distributed across four clients and split locally into 80/20 train/test sets. Table 5 shows the resulting distribution. Table 5: Non-IID federated data distribution. The server holds the global test set, while client data is split across four agen- cies, showing Normal and Anomaly counts PartitionNormalAnomalyTotal Global test set (server)190190380 Client 1282300582 Client 2221220441 Client 3189160349 Client 46880148 Client total7607601,520 Overall9509501,900 B STEALTH THRESHOLD JUSTIFICATION The 5% stealth threshold is chosen to exceed the natural±2–3% per-round accuracy fluctuation observed under benign non-IID FL training. This margin avoids flagging normal variance as an attack, while still capturing sustained performance degradation. From a defender’s perspective, drops below 5% are difficult to distinguish from routine training noise, whereas larger drops are more likely to indicate abnormal behavior. C IMPACT ROUNDS ANALYSIS As a complementary durability measure, the impact rounds analysis counts the total number of post-attack rounds in which backdoor accuracy remained above a given threshold. Unlike Method 1, which records the round at which the backdoor permanently stabilises below a threshold, this measure tallies the cumulative number of effective rounds. Table 6 reports these counts for all configurations. Table 6: Impact rounds analysis on the number of post-attack rounds with backdoor accuracy above each threshold ≥50% ≥40% ≥30% ≥25% Pattern푘FA FP FA FPFAFPFAFP Sparse 0.05321622169 168 382 358 0.10321918162 156 387 327 0.15211318126 138 312 305 0.20231324110 128 308 275 0.25321320116 135 293 273 Continuous 0.05541921117 152 290 347 0.10761525121 136 299 272 0.15861627113 151 307 320 0.201061827126 170 312 359 0.25871524126 136 297 280 Table 7: Threshold-based stabilization (Method 1): rounds for backdoor accuracy to fall and remain below each threshold. FA: FedAvg; FP: FedProx 50%40%30%25%20% Pattern푘FA FP FA FP FA FPFAFPFAFP Sparse 0.05202020204035250 110 NA506 0.10202020203563127 134 531 647 0.15202020232436588488602 0.202020202123375516077462 0.25202021204234111 109 240 510 Continuous 0.0520202220264953198 NA738 0.102020222137298190421 412 0.152020202023377092129 504 0.2020202020254095179 326 379 0.25202020203343110 120 466 315 Table 8: Method 2 volatility stabilization: rounds until backdoor-accuracy variation stays within each tolerance. FA: FedAvg; FP: FedProx ±10% ±5% ±3%Post-attack 휎 Pattern푘FA FPFAFPFAFPFAFP Sparse 0.054447353 368 886 NA6.3%7.0% 0.102433377 512 806 574 6.3%7.2% 0.152937360 301 754 359 6.2%6.8% 0.202140279 380 708 612 5.8%6.9% 0.254840320 379 478 786 6.1%6.9% Continuous 0.054044303 352 637 NA6.3%7.0% 0.103377408 434 870 849 6.3%7.4% 0.153464346 398 850 NA6.1%7.2% 0.204454360 338 883 771 6.4%7.1% 0.254156446 328 674 NA6.2%7.0% D FULL STABILIZATION RESULTS Tables 7 and 8 report the full post-attack stabilization results. Table 7 presents the threshold-based stabilization rounds for all gradient mask ratios, aggregation algorithms, and accuracy thresholds. A value of 20 indicates immediate stabilization within the first mea- surement window, while NA indicates that the backdoor did not stabilize below the stated threshold during the post-attack period. Table 8 presents the volatility-based stabilization rounds for all con- figurations across the three volatility tolerances, together with the overall post-attack standard deviation. NA indicates that the stated volatility tolerance was not reached in the post-attack period. E GLOBAL MODEL PERFORMANCE ACROSS FL ROUNDS This section reports the global main and backdoor accuracy across all twenty configurations. Each plot shows the per-round mean over five runs, clipped to the first 500 rounds for readability. Figures 4–13 are grouped by aggregation algorithm and mask ratio푘, with one panel per attack pattern and a shared legend as shown below. Clean accuracyBackdoor accuracyAttack phase STAIN-FL: Stealthy Targeted Attack Injection with Contextual Triggers in Federated LearningFedKDD/FedMAS 2026, August 9, 2026, Jeju, Korea 0100200300400500 FL Round 0 25 50 75 100 Accuracy (%) (a) Sparse 0100200300400500 FL Round 0 25 50 75 100 Accuracy (%) (b) Continuous Figure 4: FedAvg, 푘= 0.05: accuracy over FL rounds. 0100200300400500 FL Round 0 25 50 75 100 Accuracy (%) (a) Sparse 0100200300400500 FL Round 0 25 50 75 100 Accuracy (%) (b) Continuous Figure 5: FedProx, 푘= 0.05: accuracy over FL rounds. 0100200300400500 FL Round 0 25 50 75 100 Accuracy (%) (a) Sparse 0100200300400500 FL Round 0 25 50 75 100 Accuracy (%) (b) Continuous Figure 6: FedAvg, 푘= 0.10: accuracy over FL rounds. 0100200300400500 FL Round 0 25 50 75 100 Accuracy (%) (a) Sparse 0100200300400500 FL Round 0 25 50 75 100 Accuracy (%) (b) Continuous Figure 7: FedProx, 푘= 0.10: accuracy over FL rounds. 0100200300400500 FL Round 0 25 50 75 100 Accuracy (%) (a) Sparse 0100200300400500 FL Round 0 25 50 75 100 Accuracy (%) (b) Continuous Figure 8: FedAvg, 푘= 0.15: accuracy over FL rounds. 0100200300400500 FL Round 0 25 50 75 100 Accuracy (%) (a) Sparse 0100200300400500 FL Round 0 25 50 75 100 Accuracy (%) (b) Continuous Figure 9: FedProx, 푘= 0.15: accuracy over FL rounds. 0100200300400500 FL Round 0 25 50 75 100 Accuracy (%) (a) Sparse 0100200300400500 FL Round 0 25 50 75 100 Accuracy (%) (b) Continuous Figure 10: FedAvg, 푘= 0.20: accuracy over FL rounds. 0100200300400500 FL Round 0 25 50 75 100 Accuracy (%) (a) Sparse 0100200300400500 FL Round 0 25 50 75 100 Accuracy (%) (b) Continuous Figure 11: FedProx, 푘= 0.20: accuracy over FL rounds. 0100200300400500 FL Round 0 25 50 75 100 Accuracy (%) (a) Sparse 0100200300400500 FL Round 0 25 50 75 100 Accuracy (%) (b) Continuous Figure 12: FedAvg, 푘= 0.25: accuracy over FL rounds. 0100200300400500 FL Round 0 25 50 75 100 Accuracy (%) (a) Sparse 0100200300400500 FL Round 0 25 50 75 100 Accuracy (%) (b) Continuous Figure 13: FedProx, 푘= 0.25: accuracy over FL rounds.