# FLAME: Taming Backdoors in Federated Learning (Extended Version 1)

arXiv: https://arxiv.org/abs/2101.02281 · HTML: https://mlsanity.com/paper/2101.02281/

## Key facts

- Cited by 16 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 6 Jan 2021.

## Built on by (most cited first, 16 of 16)

- [FedRecover: Recovering from Poisoning Attacks in Federated Learning using Historical Information](https://mlsanity.com/paper/2210.10936/) (2022)
- [Learning to Backdoor Federated Learning](https://mlsanity.com/paper/2303.03320/) (2023)
- [A First Order Meta Stackelberg Method for Robust Federated Learning](https://mlsanity.com/paper/2306.13800/) (2023)
- [Practical and General Backdoor Attacks against Vertical Federated Learning](https://mlsanity.com/paper/2306.10746/) (2023)
- [DECK: Model Hardening for Defending Pervasive Backdoors](https://mlsanity.com/paper/2206.09272/) (2022)
- [STDLens: Model Hijacking-Resilient Federated Learning for Object Detection](https://mlsanity.com/paper/2303.11511/) (2023)
- [FedGrad: Mitigating Backdoor Attacks in Federated Learning Through Local Ultimate Gradients Inspection](https://mlsanity.com/paper/2305.00328/) (2023)
- [FedPerm: Private and Robust Federated Learning by Parameter Permutation](https://mlsanity.com/paper/2208.07922/) (2022)
- [Poisoning Attacks and Defenses in Federated Learning: A Survey](https://mlsanity.com/paper/2301.05795/) (2023)
- [Privacy Inference-Empowered Stealthy Backdoor Attack on Federated Learning under Non-IID Scenarios](https://mlsanity.com/paper/2306.08011/) (2023)
- [FLVoogd: Robust And Privacy Preserving Federated Learning](https://mlsanity.com/paper/2207.00428/) (2022)
- [A Knowledge Distillation-Based Backdoor Attack in Federated Learning](https://mlsanity.com/paper/2208.06176/) (2022)
- [Fedward: Flexible Federated Backdoor Defense Framework with Non-IID Data](https://mlsanity.com/paper/2307.00356/) (2023)
- [Dual-Criterion Model Aggregation in Federated Learning: Balancing Data Quantity and Quality](https://mlsanity.com/paper/2411.07816/) (2024)
- [Byzantine-Robust Federated Learning Using Generative Adversarial Networks](https://mlsanity.com/paper/2503.20884/) (2025)
- [Structure-Aware Distributed Backdoor Attacks in Federated Learning](https://mlsanity.com/paper/2603.03865/) (2026)

## Abstract (arXiv)

Federated Learning (FL) is a collaborative machine learning approach allowing participants to jointly train a model without having to share their private, potentially sensitive local datasets with others. Despite its benefits, FL is vulnerable to backdoor attacks, in which an adversary injects manipulated model updates into the model aggregation process so that the resulting model will provide targeted false predictions for specific adversary-chosen inputs. Proposed defenses against backdoor attacks based on detecting and filtering out malicious model updates consider only very specific and limited attacker models, whereas defenses based on differential privacy-inspired noise injection significantly deteriorate the benign performance of the aggregated model. To address these deficiencies, we introduce FLAME, a defense framework that estimates the sufficient amount of noise to be injected to ensure the elimination of backdoors while maintaining the model performance. To minimize the required amount of noise, FLAME uses a model clustering and weight clipping approach. Our evaluation of FLAME on several datasets stemming from application areas including image classification, word prediction, and IoT intrusion detection demonstrates that FLAME removes backdoors effectively with a negligible impact on the benign performance of the models. Furthermore, following the considerable attention that our research has received after its presentation at USENIX SEC 2022, FLAME has become the subject of numerous investigations proposing diverse attack methodologies in an attempt to circumvent it. As a response to these endeavors, we provide a comprehensive analysis of these attempts. Our findings show that these papers (e.g., 3DFed [36]) have not fully comprehended nor correctly employed the fundamental principles underlying FLAME, i.e., our defense mechanism effectively repels these attempted attacks.