{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,22]],"date-time":"2026-07-22T11:12:58Z","timestamp":1784718778982,"version":"3.55.0"},"reference-count":44,"publisher":"Elsevier BV","license":[{"start":{"date-parts":[[2026,5,1]],"date-time":"2026-05-01T00:00:00Z","timestamp":1777593600000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/tdm\/userlicense\/1.0\/"},{"start":{"date-parts":[[2026,5,1]],"date-time":"2026-05-01T00:00:00Z","timestamp":1777593600000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/legal\/tdmrep-license"},{"start":{"date-parts":[[2026,5,1]],"date-time":"2026-05-01T00:00:00Z","timestamp":1777593600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-017"},{"start":{"date-parts":[[2026,5,1]],"date-time":"2026-05-01T00:00:00Z","timestamp":1777593600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"},{"start":{"date-parts":[[2026,5,1]],"date-time":"2026-05-01T00:00:00Z","timestamp":1777593600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-012"},{"start":{"date-parts":[[2026,5,1]],"date-time":"2026-05-01T00:00:00Z","timestamp":1777593600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2026,5,1]],"date-time":"2026-05-01T00:00:00Z","timestamp":1777593600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-004"}],"funder":[{"DOI":"10.13039\/100015796","name":"Shanghai Lingjun Program","doi-asserted-by":"publisher","id":[{"id":"10.13039\/100015796","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62306077"],"award-info":[{"award-number":["62306077"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["elsevier.com","sciencedirect.com"],"crossmark-restriction":true},"short-container-title":["Knowledge-Based Systems"],"published-print":{"date-parts":[[2026,5]]},"DOI":"10.1016\/j.knosys.2026.115791","type":"journal-article","created":{"date-parts":[[2026,3,21]],"date-time":"2026-03-21T00:17:08Z","timestamp":1774052228000},"page":"115791","update-policy":"https:\/\/doi.org\/10.1016\/elsevier_cm_policy","source":"Crossref","is-referenced-by-count":2,"special_numbering":"C","title":["MasterKey: A multi-target backdoor attack in federated learning"],"prefix":"10.1016","volume":"341","author":[{"ORCID":"https:\/\/orcid.org\/0009-0005-1809-6973","authenticated-orcid":false,"given":"Yi","family":"Huang","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0006-4202-5961","authenticated-orcid":false,"given":"Haohe","family":"Jia","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-0837-9919","authenticated-orcid":false,"given":"Hongbin","family":"Zhu","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0007-4973-7942","authenticated-orcid":false,"given":"Guangnan","family":"Ye","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-8577-4771","authenticated-orcid":false,"given":"Hongfeng","family":"Chai","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"78","reference":[{"key":"10.1016\/j.knosys.2026.115791_bib0001","series-title":"International Conference on Artificial Intelligence and Statistics","first-page":"1273","article-title":"Communication-efficient learning of deep networks from decentralized data","volume":"54","author":"McMahan","year":"2017"},{"key":"10.1016\/j.knosys.2026.115791_bib0002","doi-asserted-by":"crossref","first-page":"12:1","DOI":"10.1145\/3298981","article-title":"Federated machine learning: concept and applications","volume":"10","author":"Yang","year":"2019","journal-title":"ACM Trans. Intell. Syst. Technol."},{"key":"10.1016\/j.knosys.2026.115791_bib0003","series-title":"IEEE International Conference on Acoustics, Speech and Signal Processing","first-page":"6341","article-title":"Federated learning for keyword spotting","author":"Leroy","year":"2019"},{"key":"10.1016\/j.knosys.2026.115791_bib0004","unstructured":"A. Hard, K. Rao, R. Mathews, S. Ramaswamy, D. Beaufays, Fran\u00e7oise and Augenstein, Sean and Eichner, Hubert and Kiddon, Chlo\u00e9 and Ramage, Federated learning for mobile keyboard prediction, arXiv: 1811.03604(2018)."},{"key":"10.1016\/j.knosys.2026.115791_bib0005","doi-asserted-by":"crossref","first-page":"6230","DOI":"10.3390\/s20216230","article-title":"Federated learning in smart city sensing: challenges and opportunities","volume":"20","author":"Jiang","year":"2020","journal-title":"Sensors"},{"key":"10.1016\/j.knosys.2026.115791_bib0006","doi-asserted-by":"crossref","first-page":"619","DOI":"10.1016\/j.future.2020.10.007","article-title":"A survey on security and privacy of federated learning","volume":"115","author":"Mothukuri","year":"2021","journal-title":"Future Gener. Comput. Syst."},{"key":"10.1016\/j.knosys.2026.115791_bib0007","article-title":"CS-Mia: membership inference attack based on prediction confidence series in federated learning","volume":"67","author":"Gu","year":"2022","journal-title":"J. Inf. Sec. Appl."},{"key":"10.1016\/j.knosys.2026.115791_bib0008","series-title":"European Symposium on Research in Computer Security","first-page":"545","article-title":"A framework for evaluating client privacy leakages in federated learning","volume":"12308","author":"Wei","year":"2020"},{"key":"10.1016\/j.knosys.2026.115791_bib0009","series-title":"European Symposium on Research in Computer Security","first-page":"480","article-title":"Data poisoning attacks against federated learning systems","volume":"12308","author":"Tolpegin","year":"2020"},{"key":"10.1016\/j.knosys.2026.115791_bib0010","series-title":"International Conference on Artificial Intelligence and Statistics","first-page":"2938","article-title":"How to backdoor federated learning","volume":"108","author":"Bagdasaryan","year":"2020"},{"key":"10.1016\/j.knosys.2026.115791_bib0011","article-title":"Backdoor attacks-resilient aggregation based on robust filtering of outliers in federated learning for image classification","volume":"245","author":"Barroso","year":"2022","journal-title":"Knowl. Based Syst."},{"key":"10.1016\/j.knosys.2026.115791_bib0012","series-title":"International Conference on Machine Learning","first-page":"26429","article-title":"NeuroToxin: durable backdoors in federated learning","volume":"162","author":"Zhang","year":"2022"},{"key":"10.1016\/j.knosys.2026.115791_bib0013","series-title":"AAAI Conference on Artificial Intelligence","first-page":"9020","article-title":"Poisoning with cerberus: stealthy and colluded backdoor attack against federated learning","volume":"37","author":"Lyu","year":"2023"},{"key":"10.1016\/j.knosys.2026.115791_bib0014","series-title":"Advances in Neural Information Processing Systems","first-page":"61213","article-title":"A3fl: adversarially adaptive backdoor attacks to federated learning","volume":"36","author":"Zhang","year":"2023"},{"key":"10.1016\/j.knosys.2026.115791_bib0015","series-title":"Advances in Neural Information Processing Systems","first-page":"16070","article-title":"Attack of the tails: yes, you really can backdoor federated learning","volume":"33","author":"Wang","year":"2020"},{"key":"10.1016\/j.knosys.2026.115791_bib0016","series-title":"International Conference on Machine Learning","first-page":"6712","article-title":"ChameLeon: adapting to peer images for planting durable backdoors in federated learning","volume":"202","author":"Dai","year":"2023"},{"key":"10.1016\/j.knosys.2026.115791_bib0017","series-title":"International Conference on Learning Representations","article-title":"DBA: distributed backdoor attacks against federated learning","author":"Xie","year":"2019"},{"key":"10.1016\/j.knosys.2026.115791_bib0018","series-title":"Advances in Neural Information Processing Systems","first-page":"66364","article-title":"IBA: towards irreversible backdoor attacks in federated learning","volume":"36","author":"Nguyen","year":"2023"},{"key":"10.1016\/j.knosys.2026.115791_bib0019","series-title":"IEEE International Conference on Acoustics, Speech and Signal Processing","first-page":"6870","article-title":"FIBA: federated invisible backdoor attack","author":"Zhang","year":"2024"},{"key":"10.1016\/j.knosys.2026.115791_bib0020","series-title":"International Conference on Learning Representations","article-title":"Backdoor federated learning by poisoning backdoor-critical layers","author":"Zhuang","year":"2024"},{"key":"10.1016\/j.knosys.2026.115791_bib0021","doi-asserted-by":"crossref","first-page":"6929","DOI":"10.1109\/TDSC.2025.3593640","article-title":"SDBA: a stealthy and long-lasting durable backdoor attack in federated learning","volume":"22","author":"Choe","year":"2025","journal-title":"IEEE Trans. Dependable Secure. Comput."},{"key":"10.1016\/j.knosys.2026.115791_bib0022","series-title":"AAAI Conference on Artificial Intelligence","first-page":"11800","article-title":"On the vulnerability of backdoor defenses for federated learning","volume":"37","author":"Fang","year":"2023"},{"key":"10.1016\/j.knosys.2026.115791_bib0023","doi-asserted-by":"crossref","first-page":"1506","DOI":"10.1109\/TDSC.2024.3445637","article-title":"Coba: collusive backdoor attacks with optimized trigger to federated learning","volume":"22","author":"Lyu","year":"2025","journal-title":"IEEE Trans. Dependable Secure. Comput."},{"key":"10.1016\/j.knosys.2026.115791_bib0024","doi-asserted-by":"crossref","DOI":"10.1016\/j.knosys.2026.115650","article-title":"DualVeil: persistent and invisible backdoor attacks in federated learning via dual optimization","volume":"339","author":"Zhang","year":"2026","journal-title":"Knowl. Based Syst."},{"key":"10.1016\/j.knosys.2026.115791_bib0025","series-title":"Advances in Neural Information Processing Systems","first-page":"119","article-title":"Machine learning with adversaries: Byzantine tolerant gradient descent","volume":"30","author":"Blanchard","year":"2017"},{"key":"10.1016\/j.knosys.2026.115791_bib0026","series-title":"International Conference on Machine Learning","first-page":"5636","article-title":"Byzantine-robust distributed learning: towards optimal statistical rates","volume":"80","author":"Yin","year":"2018"},{"key":"10.1016\/j.knosys.2026.115791_bib0027","doi-asserted-by":"crossref","DOI":"10.1016\/j.knosys.2025.114828","article-title":"Accountable federated learning against local poisoning attacks","volume":"331","author":"Wang","year":"2026","journal-title":"Knowl. Based Syst."},{"key":"10.1016\/j.knosys.2026.115791_bib0028","unstructured":"Z. Sun, P. Kairouz, A.T. Suresh, H.B. McMahan, Can you really backdoor federated learning?, arXiv: 1911.07963(2019)."},{"key":"10.1016\/j.knosys.2026.115791_bib0029","series-title":"AAAI Conference on Artificial Intelligence","first-page":"9268","article-title":"Defending against backdoors in federated learning with robust learning rate","volume":"35","author":"\u00d6zdayi","year":"2021"},{"key":"10.1016\/j.knosys.2026.115791_bib0030","series-title":"31st USENIX Security Symposium","first-page":"1415","article-title":"FLAME: Taming backdoors in federated learning","author":"Nguyen","year":"2022"},{"key":"10.1016\/j.knosys.2026.115791_bib0031","doi-asserted-by":"crossref","DOI":"10.1016\/j.knosys.2025.114494","article-title":"FedCleanse: cleanse the backdoor attacks in federated learning system","volume":"330","author":"Huang","year":"2025","journal-title":"Knowl. Based Syst."},{"key":"10.1016\/j.knosys.2026.115791_bib0032","doi-asserted-by":"crossref","DOI":"10.1016\/j.knosys.2025.114903","article-title":"Prodigal: backdoor defense for federated learning beyond robust aggregation","volume":"333","author":"Liu","year":"2026","journal-title":"Knowl. Based Syst."},{"key":"10.1016\/j.knosys.2026.115791_bib0033","unstructured":"S. Yu, J. Hong, Y. Zeng, F. Wang, R. Jia, J. Zhou, Who leaked the model? tracking IP infringers in accountable federated learning, arXiv: 2312.03205(2023)."},{"key":"10.1016\/j.knosys.2026.115791_bib0034","unstructured":"A. Krizhevsky, G. Hinton, Learning multiple layers of features from tiny images (2009). https:\/\/www.cs.toronto.edu\/kriz\/cifar.html."},{"key":"10.1016\/j.knosys.2026.115791_bib0035","doi-asserted-by":"crossref","first-page":"323","DOI":"10.1016\/j.neunet.2012.02.016","article-title":"Man vs. computer: benchmarking machine learning algorithms for traffic sign recognition","volume":"32","author":"Stallkamp","year":"2012","journal-title":"Neural Netw."},{"key":"10.1016\/j.knosys.2026.115791_bib0036","series-title":"IEEE Conference on Computer Vision and Pattern Recognition","first-page":"770","article-title":"Deep residual learning for image recognition","author":"He","year":"2016"},{"key":"10.1016\/j.knosys.2026.115791_bib0037","unstructured":"T.-M. H. Hsu, H. Qi, M. Brown, Measuring the effects of non-identical data distribution for federated visual classification, arXiv: 1909.06335(2019)."},{"key":"10.1016\/j.knosys.2026.115791_bib0038","series-title":"International Conference on Medical Image Computing and Computer-Assisted Intervention","first-page":"234","article-title":"U-Net: convolutional networks for biomedical image segmentation","volume":"9351","author":"Ronneberger","year":"2015"},{"key":"10.1016\/j.knosys.2026.115791_bib0039","series-title":"Annual Network and Distributed System Security Symposium","article-title":"DeepSight: mitigating backdoor attacks in federated learning through deep model inspection","author":"Rieger","year":"2022"},{"key":"10.1016\/j.knosys.2026.115791_bib0040","series-title":"ACM on Asia Conference on Computer and Communications Security","first-page":"946","article-title":"Flare: defending federated learning against model poisoning attacks via latent space representations","author":"Wang","year":"2022"},{"key":"10.1016\/j.knosys.2026.115791_bib0041","series-title":"IEEE International Conference on Computer Vision","first-page":"618","article-title":"Grad-Cam: visual explanations from deep networks via gradient-based localization","author":"Selvaraju","year":"2017"},{"key":"10.1016\/j.knosys.2026.115791_bib0042","series-title":"IEEE Symposium on Security and Privacy","first-page":"707","article-title":"Neural cleanse: identifying and mitigating backdoor attacks in neural networks","author":"Wang","year":"2019"},{"key":"10.1016\/j.knosys.2026.115791_bib0043","first-page":"2579","article-title":"Visualizing data using t-SNE","volume":"9","author":"van der","year":"2008","journal-title":"J. Mach. Learn. Res."},{"key":"10.1016\/j.knosys.2026.115791_bib0044","series-title":"Proceedings of the ACM on Web Conference","first-page":"5065","article-title":"Mocfl: mobile cluster federated learning framework for highly dynamic network","author":"Fang","year":"2025"}],"container-title":["Knowledge-Based Systems"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S0950705126005174?httpAccept=text\/xml","content-type":"text\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S0950705126005174?httpAccept=text\/plain","content-type":"text\/plain","content-version":"vor","intended-application":"text-mining"}],"deposited":{"date-parts":[[2026,5,22]],"date-time":"2026-05-22T11:48:30Z","timestamp":1779450510000},"score":1,"resource":{"primary":{"URL":"https:\/\/linkinghub.elsevier.com\/retrieve\/pii\/S0950705126005174"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,5]]},"references-count":44,"alternative-id":["S0950705126005174"],"URL":"https:\/\/doi.org\/10.1016\/j.knosys.2026.115791","relation":{},"ISSN":["0950-7051"],"issn-type":[{"value":"0950-7051","type":"print"}],"subject":[],"published":{"date-parts":[[2026,5]]},"assertion":[{"value":"Elsevier","name":"publisher","label":"This article is maintained by"},{"value":"MasterKey: A multi-target backdoor attack in federated learning","name":"articletitle","label":"Article Title"},{"value":"Knowledge-Based Systems","name":"journaltitle","label":"Journal Title"},{"value":"https:\/\/doi.org\/10.1016\/j.knosys.2026.115791","name":"articlelink","label":"CrossRef DOI link to publisher maintained version"},{"value":"article","name":"content_type","label":"Content Type"},{"value":"\u00a9 2026 Elsevier B.V. All rights are reserved, including those for text and data mining, AI training, and similar technologies.","name":"copyright","label":"Copyright"}],"article-number":"115791"}}