Abstract
With the growing adoption of low-altitude economy (LAE), such as urban air mobility and smart logistics, federated learning (FL) has become a key technology for enabling distributed intelligence while preserving data privacy. However, edge clients in such systems often suffer from limited resources and heterogeneous data, making them especially vulnerable to covert backdoor attacks. These threats can compromise critical functions such as navigation control or data confidentiality. Existing backdoor methods typically target specific clients, but their performance significantly degrades on edge clients due to insufficient data and computation power. To address this challenge, we propose LBKD, a novel backdoor attack strategy that combines large language models (LLMs) with bidirectional knowledge distillation. In our method, the attacker first obtains the target client's model and data, then uses LLMs guided by poisoning and data generation instructions to produce both poisoned and synthetic samples. During training, a more expressive distillation model engages in two-way knowledge exchange with the client model, enhancing its ability to learn and retain the backdoor pattern. The final poisoned model is submitted to the server, successfully embedding the backdoor into the global model. Experimental results show that LBKD significantly improves attack success rates (ASR), resulting in up to a 75.4% improvement over existing methods. Even under defense mechanisms, the ASR remains above 90% in some cases, demonstrating the method's effectiveness and robustness on edge clients.