A Comprehensive Defense Framework Against Poisoning Backdoor Attacks in Federated Learning

Abstract

In recent years, federated learning has gained significant attention for its ability to enable collaborative training without sharing data. Federated learning allows multiple participants to train models on their local devices and only upload model parameters for aggregation, thereby protecting data privacy. However, federated learning faces serious threats from poisoning and backdoor attacks, which jeopardize the integrity and security of the model. Poisoning attackers can tamper with local training data to degrade the performance of the global model. In contrast, backdoor attackers embed hidden triggers during training, causing the model to produce erroneous or attacker-favorable outputs under specific conditions. Traditional defense mechanisms typically introduce noise to mitigate the impact of attacks, but this often results in decreased main task performance and may not effectively reduce attack accuracy. Based on the above issues, we presents a federated learning backdoor defense mechanism based on dimensionality reduction with clustering and anomaly detection techniques. We employ the novel dimensionality reduction technique UMAP and a stringent filtering mechanism to effectively identify and exclude potential malicious participants without relying on traditional noise addition methods. This approach improves the main task accuracy of the model while significantly reducing the success rate of backdoor attacks. Experimental results demonstrate that the proposed method maintains high main task accuracy while effectively mitigating backdoor attacks across various attack scenarios.