Recently, research by Professor Li Songze's team from the School of Cyber Science and Engineering at Southeast University (SEU) was accepted to the 2026 USENIX Security Symposium. The paper, titled "When the Aggregator Cheats: Data-Free Backdoors in Federated LLM-based QA Systems," has Zhu Chenqing, a doctoral student in the School of Cyber Science and Engineering and a member of Professor Li's team, as its first author.
With the rapid adoption of large language model (LLM)-based question-answering systems in privacy-sensitive settings such as healthcare, mental health, and legal consultation, federated learning is widely used in these settings to train models collaboratively without sharing clients' raw data. However, existing research commonly assumes that the server-side aggregator only aggregates model updates, paying limited attention to security risks arising when it actively manipulates the behavior of the final model. Focusing on this overlooked threat scenario, the paper investigates whether a malicious aggregator can covertly implant advertising backdoors into a final federated LLM by relying only on model updates uploaded during training, without directly accessing clients' raw data.
The paper proposes a server-side backdoor attack that does not require access to clients' raw data. An attacker first recovers representative training-semantic cues from client-uploaded gradients, then uses an external LLM to reconstruct approximate question-answering samples and inject trigger content, and finally performs a single fine-tuning pass on the aggregated global model before deployment. Experimental results show that the method achieves an attack success rate close to 100% across question-answering scenarios in healthcare, mental health, and legal consultation, as well as across multiple LLMs and federated-training settings. At the same time, the quality of the model's responses to normal questions remains largely unaffected. The study reveals a new server-side security risk in federated LLM training and demonstrates that keeping data local does not necessarily ensure the security of the overall training process.
Figure caption: Illustration of the server-side advertising backdoor attack workflow in federated LLM-based question-answering systems.
The USENIX Security Symposium is one of the four leading international academic conferences in cybersecurity and information security, alongside IEEE S&P, ACM CCS, and NDSS. It is also a Class-A conference recommended by the China Computer Federation (CCF). USENIX Security has maintained a low acceptance rate in recent years. In 2025, it accepted 407 papers, representing an acceptance rate of 17.1%. Papers accepted by the conference represent cutting-edge international research in cyberspace security.
