BackdoorIndicator: Leveraging OOD Data for Proactive Backdoor Detection in Federated Learning

2024/05/31 by Songze Li, Yanbo Dai, Li, Songze +1 · 12 citations
Computer Science · Engineering · #Cryptography and Security (cs.CR) #FOS: Computer and information sciences #Internet Traffic Analysis and Secure E-voting #Privacy-Preserving Technologies in Data #Traffic Prediction and Management Techniques

paper · pdf · doi:10.48550/arxiv.2405.20862

openalex publication_date 2024/05/31 · openalex created_date 2024/06/04 · openalex updated_date 2026/07/28

Abstract

In a federated learning (FL) system, decentralized data owners (clients) could upload their locally trained models to a central server, to jointly train a global model. Malicious clients may plant backdoors into the global model through uploading poisoned local models, causing misclassification to a target class when encountering attacker-defined triggers. Existing backdoor defenses show inconsistent performance under different system and adversarial settings, especially when the malicious updates are made statistically close to the benign ones. In this paper, we first reveal the fact that planting subsequent backdoors with the same target label could significantly help to maintain the accuracy of previously planted backdoors, and then propose a novel proactive backdoor detection mechanism for FL named BackdoorIndicator, which has the server inject indicator tasks into the global model leveraging out-of-distribution (OOD) data, and then utilizing the fact that any backdoor samples are OOD samples with respect to benign samples, the server, who is completely agnostic of the potential backdoor types and target labels, can accurately detect the presence of backdoors in uploaded models, via evaluating the indicator tasks. We perform systematic and extensive empirical studies to demonstrate the consistently superior performance and practicality of BackdoorIndicator over baseline defenses, across a wide range of system and adversarial settings.

Cited by

• DEFEND: Poisoned Model Detection and Malicious Client Exclusion Mechanism for Secure Federated Learning-based Road Condition Classification
• Enhancing the Effectiveness and Durability of Backdoor Attacks in Federated Learning through Maximizing Task Distinction
• MARS: A Malignity-Aware Backdoor Defense in Federated Learning
• On the Out-of-Distribution Backdoor Attack for Federated Learning
• FLAT: Latent-Driven Arbitrary-Target Backdoor Attacks in Federated Learning
• FedBAP: Backdoor Defense via Benign Adversarial Perturbation in Federated Learning
• BackFed: An Efficient & Standardized Benchmark Suite for Backdoor Attacks in Federated Learning
• VeFIA: An Efficient Inference Auditing Framework for Vertical Federated Collaborative Software
• SPA: Towards More Stealth and Persistent Backdoor Attacks in Federated Learning
• Defending the Edge: Representative-Attention Defense against Backdoor Attacks in Federated Learning
• Toward Malicious Clients Detection in Federated Learning
• TrojanDam: Detection-Free Backdoor Defense in Federated Learning through Proactive Model Robustification utilizing OOD Data

Related

• TrojanDam: Detection-Free Backdoor Defense in Federated Learning through Proactive Model Robustification utilizing OOD Data
• Backdoor Attacks and Defenses in Federated Learning: Survey, Challenges and Future Research Directions
• Mitigating Backdoors in Federated Learning with FLD
• On the Vulnerability of Backdoor Defenses for Federated Learning
• Concealing Backdoor Model Updates in Federated Learning by Trigger-Optimized Data Poisoning