FedPSA: Adaptive Backdoor Attacks on Federated Large Language Models via Poisoning Sensitive Prompt Layers

Federated Learning (FL) provides a privacy-preserving paradigm for collaborative training of Large Language Models (LLMs) across distributed institutions. However, the integration of FL with parameter-efficient fine-tuning (PEFT) introduces new security vulnerabilities, particularly in prompt layers that exhibit inherent susceptibility to backdoor attacks. Existing backdoor attack methods fail to account for the differential sensitivities of prompt layers to backdoor injection and rely on static trigger designs, resulting in suboptimal attack efficacy and limited generalization capability. To address these limitations, we present FedPSA, a backdoor attack framework that conducts a systematic empirical analysis of differential prompt-layer sensitivity to backdoor attacks in federated PEFT settings. From an attacker’s perspective, FedPSA identifies sensitive prompt layers and employs a greedy selection strategy to selectively poison the minimal subset of sensitive layers under parameter constraints. Furthermore, we design an adaptive trigger mechanism that enables dynamic selection of trigger words from a candidate pool and adaptive adjustment of the poisoning intensity to cope with non-Independent and Identically Distributed (non-IID) data heterogeneity. By leveraging the inter-layer negative correlation between backdoor sensitivity and main-task importance, we introduce a covert attack-preserving loss function to balance main-task performance with backdoor objectives. Extensive experiments on five datasets and six language models demonstrate that, across the evaluated configurations, FedPSA achieves stronger attack effectiveness than the evaluated baselines while maintaining competitive clean-task performance.