Robust detection method for adversarial backdoor attacks under federated learning architecture
TL;DR
A robust detection method featuring a two layer "norm verification + directional consistency" filtering mechanism combined with the Isolation Forest algorithm to remove malicious outliers, a weighted adaptive robust aggregation that dynamically allocates weights based on client accuracy and consistency, updates the global model via weighted geometric median, and introduces learning rate decay for stability.
Abstract
Under federated learning, single-threshold norm verification cannot effectively distinguish malicious from benign updates with similar norms, resulting in low detection robustness. This paper proposes a robust detection method featuring a two layer "norm verification + directional consistency" filtering mechanism combined with the Isolation Forest algorithm to remove malicious outliers, a weighted adaptive robust aggregation that dynamically allocates weights based on client accuracy and consistency, updates the global model via weighted geometric median, and introduces learning rate decay for stability, and collaborative clean and triggered dual detection sets linking local and global detection to accurately identify and suppress backdoor attacks. Experiments demonstrate near-perfect ROC performance: at a 0.1 false positive rate, the true positive rate reaches approximately 97%, with AUC approaching the theoretical maximum of 1. Under varying malicious client proportions and increasing sample sizes, the method significantly outperforms comparisons in both detection accuracy and false negative rate, fully demonstrating detection robustness.