  Recent advances in federated learning have demonstrated its promising
capability to learn on decentralized datasets. However, a considerable amount
of work has raised concerns due to the potential risks of adversaries
participating in the framework to poison the global model for an adversarial
purpose. This paper investigates the feasibility of model poisoning for
backdoor attacks through rare word embeddings of NLP models. In text
classification, less than 1% of adversary clients suffices to manipulate the
model output without any drop in the performance on clean sentences. For a less
complex dataset, a mere 0.1% of adversary clients is enough to poison the
global model effectively. We also propose a technique specialized in the
federated learning scheme called Gradient Ensemble, which enhances the backdoor
performance in all our experimental settings.
