FedShield: A Dual Algorithm Defense Against Backdoor and Poisoning Attacks in Federated Learning

Abstract

Federated Learning (FL) allows multiple clients to train a single model across devices, safeguarding data privacy in decentralised setups. However, while data does not leave the client, clients can still manipulate the model updates. This makes FL susceptible to poisoning and backdoor attacks. Backdoor attacks are particularly insidious. Today's attacks craft gradients that appear benign, making traditional approaches like filter based on distance to a parameter or gradient norm useless. Existing aggregation methods (Krum, coordinate median, norm filtering) rely on the assumption that malicious updates are easily identified as outlier updates. However, cunning attackers can hide their updates. Relying on a single indicator may not be sufficient. To overcome this, we present FedShield, an additional server-side layer which validates client updates before aggregation. FedShield uses not just one indicator. It uses two complementary checks. BSG tests if a client update produces unusual behavior on a proxy data set. LLGA checks whether gradients of the final layer behave oddly. These are combined to form a trust score, which is then compared to a dynamic threshold to determine which clients are malicious. Anomalies in client behavior and anomalies in gradient structure provide complementary indicators of suspicious activity, making detection considerably harder to evade than with either signal alone. Evaluation with BadNets, label flipping and model replacement attacks demonstrate that FedShield detects all malicious clients without false alarms. It also reduces the attack success and preserves the accuracy of the normal model. Additional tests show that using only BSG or only LLGA is less effective, which suggests both signals are needed.