mlsanityData to 13 Oct 2026

DeepSight: Mitigating Backdoor Attacks in Federated Learning Through Deep Model Inspection

arXiv 2201.00763 ↗First posted 3 Jan 2022cs.CR cs.LGcited by 80

Not on the map. Why?

Abstract (arXiv)

Federated Learning (FL) allows multiple clients to collaboratively train a Neural Network (NN) model on their private data without revealing the data. Recently, several targeted poisoning attacks against FL have been introduced. These attacks inject a backdoor into the resulting model that allows adversary-controlled inputs to be misclassified. Existing countermeasures against backdoor attacks are inefficient and often merely aim to exclude deviating models from the aggregation. However, this approach also removes benign models of clients with deviating data distributions, causing the aggregated model to perform poorly for such clients. To address this problem, we propose DeepSight, a novel model filtering approach for mitigating backdoor attacks. It is based on three novel techniques that allow to characterize the distribution of data used to train model updates and seek to measure fine-grained differences in the internal structure and outputs of NNs. Using these techniques, DeepSight can identify suspicious model updates. We also develop a scheme that can accurately cluster model updates. Combining the results of both components, DeepSight is able to identify and eliminate model clusters containing poisoned models with high attack impact. We also show that the backdoor contributions of possibly undetected poisoned models can be effectively mitigated with existing weight clipping-based defenses. We evaluate the performance and effectiveness of DeepSight and show that it can mitigate state-of-the-art backdoor attacks with a negligible impact on the model's performance on benign data.

Key facts. Cited by 80 papers in the map (data through 13 Oct 2026). Builds on 17 of its 43 references that are in the map. First posted on arXiv 3 Jan 2022.

Builds on

17 of 43 references.

References · 17

  1. 2016Communication-Efficient Learning of Deep Networks from Decentralized Datacited by 7,653
  2. 2018How To Backdoor Federated Learningcited by 764
  3. 2018Byzantine-Robust Distributed Learning: Towards Optimal Statistical Ratescited by 708
  4. 2019Local Model Poisoning Attacks to Byzantine-Robust Federated Learningcited by 490
  5. 2018The Hidden Vulnerability of Distributed Learning in Byzantiumcited by 326
  6. 2020Attack of the Tails: Yes, You Really Can Backdoor Federated Learningcited by 308
  7. 2019A Little Is Enough: Circumventing Defenses For Distributed Learningcited by 287
  8. 2019Can You Really Backdoor Federated Learning?cited by 254
  9. 2019Updates-Leak: Data Set Inference and Reconstruction Attacks in Online Learningcited by 122
  10. 2018D"IoT: A Federated Self-learning Anomaly Detection System for IoTcited by 89
  11. 2020Learning to Detect Malicious Clients for Robust Federated Learningcited by 88
  12. 2019Byzantine-Robust Federated Machine Learning through Adaptive Model Averagingcited by 70
5 more
  1. 2021Provably Secure Federated Learning against Malicious Clientscited by 63
  2. 2020BaFFLe: Backdoor detection via Feedback-based Federated Learningcited by 53
  3. 2019Abnormal Client Behavior Detection in Federated Learningcited by 40
  4. 2019Eavesdrop the Composition Proportion of Training Labels in Federated Learningcited by 27
  5. 2020Client Adaptation improves Federated Learning with Simulated Non-IID Clientscited by 3

Built on by

Cited by year (2026 to 13 Oct)

Citing papers per year: 2022: 8; 2023: 24; 2024: 15; 2025: 21; 2026: 12.

80 papers.

Sort:

By area:

  1. 2023Backdoor Attacks and Defenses in Federated Learning: Survey, Challenges and Future Research Directionscited by 33
  2. 2022FedTracker: Furnishing Ownership Verification and Traceability for Federated Learning Modelcited by 30
  3. 2023On the Vulnerability of Backdoor Defenses for Federated Learningcited by 27
  4. 2023FreqFed: A Frequency Analysis-Based Approach for Mitigating Poisoning Attacks in Federated Learningcited by 27
  5. 2022CrowdGuard: Federated Backdoor Detection in Federated Learningcited by 26
  6. 2023BayBFed: Bayesian Backdoor Defense for Federated Learningcited by 23
  7. 2023Chameleon: Adapting to Peer Images for Planting Durable Backdoors in Federated Learningcited by 20
  8. 2023Data and Model Poisoning Backdoor Attacks on Wireless Federated Learning, and the Defense Mechanisms: A Comprehensive Surveycited by 18
  9. 2022Watermarking in Secure Federated Learning: A Verification Framework Based on Client-Side Backdooringcited by 17
  10. 2023Backdoor Federated Learning by Poisoning Backdoor-Critical Layerscited by 16
  11. 2022More is Better (Mostly): On the Backdoor Attacks in Federated Graph Neural Networkscited by 15
  12. 2023FLShield: A Validation Based Federated Learning Framework to Defend Against Poisoning Attackscited by 15
38 more
  1. 2025Do We Really Need to Design New Byzantine-robust Aggregation Rules?cited by 15
  2. 2023Get Rid Of Your Trail: Remotely Erasing Backdoors in Federated Learningcited by 13
  3. 2025Detecting Backdoor Attacks in Federated Learning via Direction Alignment Inspectioncited by 13
  4. 2023Backdoor Attacks in Peer-to-Peer Federated Learningcited by 9
  5. 2023Client-specific Property Inference against Secure Aggregation in Federated Learningcited by 9
  6. 2023G2uardFL: Safeguarding Federated Learning Against Backdoor Attacks through Attributed Client Graph Clusteringcited by 9
  7. 2023A Survey on Vulnerability of Federated Learning: A Learning Algorithm Perspectivecited by 9
  8. 2024Meta Stackelberg Game: Robust Federated Learning against Adaptive and Mixed Poisoning Attackscited by 9
  9. 2023Learning to Backdoor Federated Learningcited by 8
  10. 2023FLTracer: Accurate Poisoning Attack Provenance in Federated Learningcited by 8
  11. 2025Provably Robust Federated Reinforcement Learningcited by 8
  12. 2023A First Order Meta Stackelberg Method for Robust Federated Learningcited by 7
  13. 2023Self-Deception: Reverse Penetrating the Semantic Firewall of Large Language Modelscited by 7
  14. 2025MARS: A Malignity-Aware Backdoor Defense in Federated Learningcited by 7
  15. 2023Resisting Backdoor Attacks in Federated Learning via Bidirectional Elections and Individual Perspectivecited by 6
  16. 2022SafeNet: The Unreasonable Effectiveness of Ensembles in Private Collaborative Learningcited by 5
  17. 2024ACE: A Model Poisoning Attack on Contribution Evaluation Methods in Federated Learningcited by 5
  18. 2024Adversarially Guided Stateful Defense Against Backdoor Attacks in Federated Deep Learningcited by 5
  19. 2022DECK: Model Hardening for Defending Pervasive Backdoorscited by 4
  20. 2023FedGrad: Mitigating Backdoor Attacks in Federated Learning Through Local Ultimate Gradients Inspectioncited by 4
  21. 2023FLEDGE: Ledger-based Federated Learning Resilient to Inference and Backdoor Attackscited by 4
  22. 2024Identify Backdoored Model in Federated Learning via Individual Unlearningcited by 4
  23. 2025Toward Malicious Clients Detection in Federated Learningcited by 4
  24. 2022CELEST: Federated Learning for Globally Coordinated Threat Detectioncited by 3
  25. 2023FLAIRS: FPGA-Accelerated Inference-Resistant & Secure Federated Learningcited by 3
  26. 2024Linkage on Security, Privacy and Fairness in Federated Learning: New Balances and New Perspectivescited by 3
  27. 2024BadSampler: Harnessing the Power of Catastrophic Forgetting to Poison Byzantine-robust Federated Learningcited by 3
  28. 2024BoBa: Boosting Backdoor Detection through Data Distribution Inference in Federated Learningcited by 3
  29. 2023Kick Bad Guys Out! Conditionally Activated Anomaly Detection in Federated Learning with Zero-Knowledge Proof Verificationcited by 2
  30. 2024EmInspector: Combating Backdoor Attacks in Federated Self-Supervised Learning Through Embedding Inspectioncited by 2
  31. 2024Poisoning with A Pill: Circumventing Detection in Federated Learningcited by 2
  32. 2026ProtegoFed: Backdoor-Free Federated Instruction Tuning with Interspersed Poisoned Datacited by 2
  33. 2022FLVoogd: Robust And Privacy Preserving Federated Learningcited by 1
  34. 2023Avoid Adversarial Adaption in Federated Learning by Multi-Metric Investigationscited by 1
  35. 2024Precision Guided Approach to Mitigate Data Poisoning Attacks in Federated Learningcited by 1
  36. 2024Venomancer: Towards Imperceptible and Target-on-Demand Backdoor Attacks in Federated Learningcited by 1
  37. 2024Non-Cooperative Backdoor Attacks in Federated Learning: A New Threat Landscapecited by 1
  38. 2024Celtibero: Robust Layered Aggregation for Federated Learningcited by 1

50 most cited of 80 All 80 (JSON)

Similar, not cited

Close in wording, no citation either way

  1. 2024Concealing Backdoor Model Updates in Federated Learning by Trigger-Optimized Data Poisoning
  2. 2024DeTrigger: A Gradient-Centric Approach to Backdoor Attack Mitigation in Federated Learning
  3. 2025Mingling with the Good to Backdoor Federated Learning
  4. 2022Sniper Backdoor: Single Client Targeted Backdoor Attack in Federated Learning
  5. 2023Mitigating Backdoors in Federated Learning with FLD
  6. 2024FLAIN: Mitigating Backdoor Attacks in Federated Learning via Flipping Weight Updates of Low-Activation Input Neurons
  7. 2023FilterFL: Knowledge Filtering-based Data-Free Backdoor Defense for Federated Learning
  8. 2025FedBAP: Backdoor Defense via Benign Adversarial Perturbation in Federated Learning