07/24/2026
By Shixiong Li

The Kennedy College of Science, Richard A. Miner School of Computer & Information Sciences, invites you to attend a doctoral dissertation defense by Shixiong Li.

Candidate Name: Shixiong Li
Defense Date: Monday, August 3, 2026
Time: 10 - 11:30 a.m. EDT
Location: This will be a virtual defense via Zoom
Dissertation Title: Towards Robust Learning Systems: Investigating Data Poisoning Attacks and Defenses in Diverse Learning Paradigms

Committee Members:

  • Yimin (Ian) Chen (Advisor), Assistant Professor, Miner School of Computer & Information Sciences, University of Massachusetts Lowell
  • Benyuan Liu, Professor, Miner School of Computer & Information Sciences; UMass Center for Digital Health (CDH); Computer Networking Lab, CHORDS, University of Massachusetts Lowell
  • Ning (Nicole) Wang, Assistant Professor, Department of Computer Science and Engineering, University of South Florida (USF)
  • Yidan Hu, Assistant Professor, Department of Cybersecurity, Rochester Institute of Technology (RIT)

Abstract:

Machine learning has become a fundamental technology across a wide range of application domains, including autonomous driving, healthcare, intelligent transportation, financial services, and cyber security. As deep neural networks continue to demonstrate remarkable performance, they are increasingly deployed in security-critical scenarios where reliability and trustworthiness are of paramount importance. However, the widespread adoption of machine learning has also exposed these systems to sophisticated security threats, among which backdoor attacks represent one of the most severe. A successful backdoor attack enables an adversary to implant hidden malicious behaviors into a model while preserving its normal performance on benign inputs, posing significant risks to real-world intelligent systems. Consequently, understanding both stronger backdoor attacks and more effective defenses has become essential for developing secure and trustworthy machine learning systems.

We first investigate backdoor attacks in centralized deep learning. Existing attacks primarily rely on fixed triggers, limiting their flexibility and robustness against modern defenses. To address these limitations, we propose OpenTrigger, a novel dynamic-trigger backdoor attack that learns generalized backdoor behaviors from an optimized trigger pool rather than a single fixed trigger. By introducing trigger diversity during training, OpenTrigger enables previously unseen triggers to activate the implanted backdoor while maintaining high attack success rates and significantly improving robustness against state-of-the-art backdoor defenses.

We then extend our investigation to Federated Learning (FL), where malicious clients must simultaneously achieve high attack effectiveness and strong stealthiness through carefully crafted model updates. Existing federated backdoor attacks either prioritize attack success at the expense of detectability or improve stealthiness by excessively constraining malicious updates, often resulting in degraded attack performance. To overcome this trade-off, we propose FreshBackdoor, a practical layer-wise backdoor attack that constructs timely statistical references from local clean training instead of relying on historical global updates. By adaptively aligning malicious updates with fresh layer-wise references, FreshBackdoor effectively balances attack effectiveness and stealthiness while naturally generalizing to multiple federated learning paradigms.

Beyond attack design, this dissertation investigates robust defenses against federated backdoor attacks. We first propose EarlyShield, an early-stage defense framework for personalized federated learning that detects malicious clients before local optimization converges. By exploiting the divergence between benign and malicious optimization trajectories, EarlyShield substantially improves backdoor detection under highly heterogeneous client distributions. We further introduce StabiFL, a framework-agnostic defense that identifies malicious clients through prediction stability analysis rather than model parameters or gradients. Leveraging the observation that benign models exhibit significantly more stable prediction behavior than backdoored models under diverse input transformations, StabiFL achieves strong defense performance while naturally generalizing across multiple federated learning paradigms.

Overall, this dissertation presents a systematic study of backdoor attacks and defenses in both centralized and federated learning. The proposed attack and defense frameworks provide new insights into the design of robust backdoor attacks and practical defense mechanisms, contributing toward the development of more secure, trustworthy, and resilient machine learning systems.