Jul 2026· ACM Transactions on Intelligent Systems and Technology· 0 citations· 26 references
TL;DR
This work employs the novel dimensionality reduction technique UMAP and a stringent filtering mechanism to effectively identify and exclude potential malicious participants without relying on traditional noise addition methods and demonstrates that the proposed method maintains high main task accuracy while effectively mitigating backdoor attacks across various attack scenarios.
Abstract
In recent years, federated learning has gained significant attention for its ability to enable collaborative training without sharing data. Federated learning allows multiple participants to train models on their local devices and only upload model parameters for aggregation, thereby protecting data privacy. However, federated learning faces serious threats from poisoning and backdoor attacks, which jeopardize the integrity and security of the model. Poisoning attackers can tamper with local training data to degrade the performance of the global model. In contrast, backdoor attackers embed hidden triggers during training, causing the model to produce erroneous or attacker-favorable outputs under specific conditions. Traditional defense mechanisms typically introduce noise to mitigate the impact of attacks, but this often results in decreased main task performance and may not effectively reduce attack accuracy. Based on the above issues, we presents a federated learning backdoor defense mechanism based on dimensionality reduction with clustering and anomaly detection techniques. We employ the novel dimensionality reduction technique UMAP and a stringent filtering mechanism to effectively identify and exclude potential malicious participants without relying on traditional noise addition methods. This approach improves the main task accuracy of the model while significantly reducing the success rate of backdoor attacks. Experimental results demonstrate that the proposed method maintains high main task accuracy while effectively mitigating backdoor attacks across various attack scenarios.
Machine learning requires diverse training datasets from multiple clients for improved performance. However, sharing datasets is often a legal and privacy issue across countries and organizations. Federated Learning (FL) is a machine learning framework allowing individual clients to train datasets locally and share only the weight updates to a central server where the updates are aggregated. FL addresses the security and privacy issues concerned with data-sharing; however, it is vulnerable to poisoning attacks where a malicious client can purposefully alter the model updates. Even a smallest input deviation can exploit the system leading to misclassification. In this study, we propose a lightweight defense mechanism for mitigating poisoning attacks in Federated Learning (FL) systems. Our approach involves transforming model weights into the frequency domain to identify core frequency components containing sufficient model weight information. Additionally, we employ a model filtering algorithm to predict poisoning attacks based on the output of the frequency analysis method. This enables effective filtering of malicious updates during local training on client devices. Our proposed defense mechanism enhances the security and integrity of FL systems against adversarial attack ensuring secure model aggregation.
A. R., D. Renuka· Bulletin of the Polish Acade...· 0 citations
This work proposes CAEBA (Conditional AutoEncoder Backdoor Attack), a dynamic hidden backdoor framework that uses a conditional autoencoder to generate target-aware and visually stealthy triggers while progressively implanting the backdoor through federated optimization.
The rapid adoption of Internet of Things (IoT) devices has accelerated the need for privacy-preserving machine learning techniques, such as federated learning (FL). However, the decentralized and collaborative nature of FL makes it vulnerable to backdoor attacks, where adversaries locally update their malicious models before contributing to the global aggregation, subtly injecting backdoors without degrading the normal performance. An affected model behaves as expected during regular operations but exhibits malicious behavior when an embedded trigger is presented. In this article, we propose a novel self-supervised contrastive-learning-based approach to detect and mitigate backdoor attacks in FL within IoT environments. Unlike conventional reverse-engineering methods that iterate through each class in the dataset to reconstruct triggers, our approach directly regenerates triggers from compromised global models without class iteration. This is achieved by comparing last-layer feature representations of a potentially compromised model with those of a relatively clean model under the guidance of contrastive loss. The reverse-engineered trigger is then leveraged to patch the global model and remove the backdoors. We evaluate our method on three benchmark datasets under two federated backdoor attack scenarios, simulating IoT device collaborations. Extended experiments are also conducted on a transformer-based model and two mitigation methods to assess the robustness of our approach. Our results demonstrate that while traditional reverse-engineering techniques are effective in centralized settings, they struggle to detect backdoors in FL. Comparatively, our method is resilient against backdoor attacks across various settings. In addition, our method is more time-efficient because of its capability of generating the backdoor trigger directly without iterating through all classes.
Hal Ferguson, Rui Ning, Hongyi Wu et al.· IEEE Internet of Things Jour...· 0 citations
Federated Learning (FL) enables collaborative model training while preserving data privacy. However, it remains highly vulnerable to poisoning attacks, particularly coordinated label- flipping attacks. In this paper, we propose DualFed, a dual-side defense framework for detecting coordinated poisoning behaviors in FL. DualFed combines client-side adaptive behavioral anomaly detection with a server-side Collective Behavioral Correlation (CBC) mechanism. On the client side, an Adaptive Adversarially Robust Statistics (AARS) mechanism integrates trimmed estimation with Exponential Moving Average (EMA) and Exponential Moving Variance (EMV) to robustly quantify abnormal performance degradation. On the server side, CBC aggregates client anomaly reports over a sliding temporal window to detect coordinated attacks. Once an attack is confirmed, DualFed activates a non-punitive self-recovery mechanism. Under non-IID settings, DualFed achieves benign accuracies exceeding 84.0MNIST, 52.0dataset, while reducing malicious attack accuracy to near zero and outperforming recent defense baselines.
Hanene Hamdani, Emna Benmohamed, Hela Ltifi· International Conference on...· 0 citations
Federated learning enables collaborative model training without sharing raw data, but remains vulnerable to poisoning attacks from malicious clients. These adversarial participants craft harmful updates to degrade global model performance or induce targeted misclassification. Without trusted reference gradients, the central model cannot be properly aggregated only based on updates provided by untrustworthy clients. In this paper, we propose RDTSM, a robust defense method based on a trusted shadow model. By leveraging a clean shadow dataset, the central server generates reference updates and evaluates each client’s update via a reputation scoring mechanism. A clustering algorithm is then applied to identify and exclude suspicious updates before model aggregation. Extensive experiments on MNIST, Fashion-MNIST, and CIFAR-10 demonstrate that RDTSM consistently outperforms state-of-the-art defenses across a wide range of poisoning attacks. Notably, RDTSM maintains high accuracy even when the proportion of malicious clients is large, and remains robust under varying degrees of data heterogeneity and shadow dataset sizes. This robustness stems from the fact that shadow-guided reputation scores of benign and malicious clients remain well separated under homogeneous attack patterns, even when malicious clients constitute the majority. These results show RDTSM’s effectiveness and practicality for secure federated learning in adversarial environments.
Chenchen Xu, Fulong Chen, Darong Huang et al.· IEEE Transactions on Network...· 0 citations
An underexplored threat in which a dishonest orchestrator intentionally manipulates the aggregation process to induce targeted overfitting in local models of specific clients is studied, demonstrating that client-side integrity testing can provide early, effective, and scalable detection, supporting safer deployment of FL systems.
Soumia Zohra El Mestari, M. Zuziak, Gabriele Lenzini· Proceedings on Privacy Enhan...· 0 citations
