GHOST: GAN-Harnessed Optimization for Strategic Backdoor Persistence with Future Update Anticipation in Non-IID Federated Learning

Federated learning (FL) enables collaborative training without sharing raw data, but its decentralized nature exposes it to backdoor attacks that embed hidden malicious behavior while preserving main-task accuracy. In practice, such attacks often fade because benign clients dominate aggregation and non-IID data distributions make it difficult for adversaries to anticipate future benign updates. Existing anticipation-based approaches rely only on the attacker’s local data, which poorly reflects the global distribution and leads to weak persistence in realistic settings. We propose GHOST, a two-phase backdoor attack that couples generative modeling with multi-round anticipation. First, we introduce a dual-discriminator GAN that leverages both the global model and a local discriminator to infer synthetic samples aligned with the aggregated global distribution. Second, we use these generated samples to simulate several future FL rounds, enabling the attacker to optimize a modelpoisoning update for long-term survivability rather than a single round. We further provide a theoretical interpretation of the dual-discriminator objective and a linearized analysis showing how multi-round anticipation aligns the attack with slowly decaying modes of benign FL dynamics. Experiments on multiple vision datasets and aggregation rules demonstrate that GHOST achieves substantially more durable backdoor persistence than prior methods, including under norm-bounding and FoolsGold defenses, while maintaining competitive clean accuracy.