mlsanityData to 7 Oct 2026

CrowdGuard: Federated Backdoor Detection in Federated Learning

arXiv 2210.07714 ↗First posted 14 Oct 2022cs.CR cs.LGcited by 26

Not on the map. Why?

Abstract (arXiv)

Federated Learning (FL) is a promising approach enabling multiple clients to train Deep Neural Networks (DNNs) collaboratively without sharing their local training data. However, FL is susceptible to backdoor (or targeted poisoning) attacks. These attacks are initiated by malicious clients who seek to compromise the learning process by introducing specific behaviors into the learned model that can be triggered by carefully crafted inputs. Existing FL safeguards have various limitations: They are restricted to specific data distributions or reduce the global model accuracy due to excluding benign models or adding noise, are vulnerable to adaptive defense-aware adversaries, or require the server to access local models, allowing data inference attacks. This paper presents a novel defense mechanism, CrowdGuard, that effectively mitigates backdoor attacks in FL and overcomes the deficiencies of existing techniques. It leverages clients' feedback on individual models, analyzes the behavior of neurons in hidden layers, and eliminates poisoned models through an iterative pruning scheme. CrowdGuard employs a server-located stacked clustering scheme to enhance its resilience to rogue client feedback. The evaluation results demonstrate that CrowdGuard achieves a 100% True-Positive-Rate and True-Negative-Rate across various scenarios, including IID and non-IID data distributions. Additionally, CrowdGuard withstands adaptive adversaries while preserving the original performance of protected models. To ensure confidentiality, CrowdGuard uses a secure and privacy-preserving architecture leveraging Trusted Execution Environments (TEEs) on both client and server sides.

Key facts. Cited by 26 papers in the map (data through 7 Oct 2026). Builds on 49 of its 100 references that are in the map. First posted on arXiv 14 Oct 2022.

Builds on

49 of 100 references.

References · 49

  1. 2016Communication-Efficient Learning of Deep Networks from Decentralized Datacited by 7,592
  2. 2016Membership Inference Attacks against Machine Learning Modelscited by 2,221
  3. 2016Federated Learning: Strategies for Improving Communication Efficiencycited by 1,461
  4. 2019On the Convergence of FedAvg on Non-IID Datacited by 1,220
  5. 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,052
  6. 2017Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoningcited by 1,012
  7. 2019Measuring the Effects of Non-Identical Data Distribution for Federated Visual Classificationcited by 836
  8. 2018How To Backdoor Federated Learningcited by 745
  9. 2018Byzantine-Robust Distributed Learning: Towards Optimal Statistical Ratescited by 698
  10. 2018Federated Learning for Mobile Keyboard Predictioncited by 565
  11. 2021FedBN: Federated Learning on Non-IID Features via Local Batch Normalizationcited by 565
  12. 2016Federated Optimization: Distributed Machine Learning for On-Device Intelligencecited by 558
37 more
  1. 2019Local Model Poisoning Attacks to Byzantine-Robust Federated Learningcited by 479
  2. 2018Detecting Backdoor Attacks on Deep Neural Networks by Activation Clusteringcited by 429
  3. 2020iDLG: Improved Deep Leakage from Gradientscited by 367
  4. 2021Federated Learning on Non-IID Data: A Surveycited by 345
  5. 2020Reflection Backdoor: A Natural Backdoor Attack on Deep Neural Networkscited by 341
  6. 2020FLTrust: Byzantine-robust Federated Learning via Trust Bootstrappingcited by 330
  7. 2018The Hidden Vulnerability of Distributed Learning in Byzantiumcited by 324
  8. 2020Attack of the Tails: Yes, You Really Can Backdoor Federated Learningcited by 307
  9. 2018Beyond Inferring Class Representatives: User-Level Privacy Leakage From Federated Learningcited by 242
  10. 2019A new Backdoor Attack in CNNs by training set corruption without label poisoningcited by 237
  11. 2018Federated Meta-Learning with Fast Convergence and Efficient Communicationcited by 154
  12. 2018Multi-Institutional Deep Learning Modeling Without Sharing Patient Data: A Feasibility Study on Brain Tumor Segmentationcited by 148
  13. 2018RSA: Byzantine-Robust Stochastic Aggregation Methods for Distributed Learning from Heterogeneous Datasetscited by 148
  14. 2020Backdoor Attacks and Countermeasures on Deep Learning: A Comprehensive Reviewcited by 120
  15. 2019Updates-Leak: Data Set Inference and Reconstruction Attacks in Online Learningcited by 117
  16. 2021PPFL: Privacy-preserving Federated Learning with Trusted Execution Environmentscited by 93
  17. 2018D"IoT: A Federated Self-learning Anomaly Detection System for IoTcited by 89
  18. 2019Federated Variance-Reduced Stochastic Gradient Descent with Robustness to Byzantine Attackscited by 79
  19. 2022DeepSight: Mitigating Backdoor Attacks in Federated Learning Through Deep Model Inspectioncited by 78
  20. 2020Local and Central Differential Privacy for Robustness and Privacy in Federated Learningcited by 72
  21. 2019Byzantine-Robust Federated Machine Learning through Adaptive Model Averagingcited by 70
  22. 2017Knock Knock, Who's There? Membership Inference on Aggregate Location Datacited by 63
  23. 2020Federated Learning for Breast Density Classification: A Real-World Implementationcited by 62
  24. 2021Provably Secure Federated Learning against Malicious Clientscited by 60
  25. 2021OpenFL: An open-source framework for Federated Learningcited by 58
  26. 2020BaFFLe: Backdoor detection via Feedback-based Federated Learningcited by 52
  27. 2017Learning Differentially Private Recurrent Language Modelscited by 32
  28. 2019Eavesdrop the Composition Proportion of Training Labels in Federated Learningcited by 27
  29. 2019Shielding Collaborative Learning: Mitigating Poisoning Attacks through Client-Side Detectioncited by 25
  30. 2017Software Grand Exposure: SGX Cache Attacks Are Practicalcited by 14
  31. 2021Byzantine-Robust and Privacy-Preserving Framework for FedMLcited by 13
  32. 2021FedDropoutAvg: Generalizable federated learning for histopathology image classificationcited by 7
  33. 2017DR.SGX: Hardening SGX Enclaves against Cache Attacks with Data Location Randomizationcited by 3
  34. 2019Enabling Privacy-Preserving, Compute- and Data-Intensive Computing using Heterogeneous Trusted Execution Environmentcited by 3
  35. 2020CacheOut: Leaking Data on Intel CPUs via Cache Evictionscited by 3
  36. 2018Interface-Based Side Channel Attack Against Intel SGXcited by 2
  37. 2019Binsec/Rel: Efficient Relational Symbolic Execution for Constant-Time at Binary-Levelcited by 1

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2023: 2; 2024: 6; 2025: 12; 2026: 6.

26 papers.

Sort:

By area:

  1. 2023FreqFed: A Frequency Analysis-Based Approach for Mitigating Poisoning Attacks in Federated Learningcited by 25
  2. 2024Threats and Defenses in Federated Learning Life Cycle: A Comprehensive Survey and Challengescited by 14
  3. 2025Detecting Backdoor Attacks in Federated Learning via Direction Alignment Inspectioncited by 13
  4. 2025SafeSplit: A Novel Defense Against Client-Side Backdoor Attacks in Split Learning (Full Version)cited by 7
  5. 2023FLEDGE: Ledger-based Federated Learning Resilient to Inference and Backdoor Attackscited by 4
  6. 2024BoBa: Boosting Backdoor Detection through Data Distribution Inference in Federated Learningcited by 3
  7. 2024Memory Backdoor Attacks on Neural Networkscited by 3
  8. 2024Concealing Backdoor Model Updates in Federated Learning by Trigger-Optimized Data Poisoningcited by 1
  9. 2024Celtibero: Robust Layered Aggregation for Federated Learningcited by 1
  10. 2025Two Heads Are Better than One: Model-Weight and Latent-Space Analysis for Federated Learning on Non-iid Data against Poisoning Attackscited by 1
  11. 2025Defending the Edge: Representative-Attention Defense against Backdoor Attacks in Federated Learningcited by 1
  12. 2025BackFed: An Efficient & Standardized Benchmark Suite for Backdoor Attacks in Federated Learningcited by 1
14 more
  1. 2025Poison Once, Refuse Forever: Weaponizing Alignment for Injecting Bias in LLMscited by 1
  2. 2025DEFEND: Poisoned Model Detection and Malicious Client Exclusion Mechanism for Secure Federated Learning-based Road Condition Classificationcited by 1
  3. 2026Your Neighbors Know: Leveraging Local Neighborhoods for Backdoor Detection in Decentralized Learningcited by 1
  4. 2024Client-Side Patching against Backdoor Attacks in Federated Learningcited by 0
  5. 2025Buffer is All You Need: Defending Federated Learning against Backdoor Attacks under Non-iids via Bufferingcited by 0
  6. 2025TrojanDam: Detection-Free Backdoor Defense in Federated Learning through Proactive Model Robustification utilizing OOD Datacited by 0
  7. 2025GRANITE : a Byzantine-Resilient Dynamic Gossip Learning Frameworkcited by 0
  8. 2025On the Inference (In-)Security of Vertical Federated Learning: Efficient Auditing against Inference Tampering Attackcited by 0
  9. 2025FedBAP: Backdoor Defense via Benign Adversarial Perturbation in Federated Learningcited by 0
  10. 2026FedTrident: Resilient Road Condition Classification Against Poisoning Attacks in Federated Learningcited by 0
  11. 2026Your Privacy My Cloak: Backdoor Attacks on Differentially Private Federated Learningcited by 0
  12. 2026Color Matters: Trigger Color Affects Success in Federated Backdoor Attackscited by 0
  13. 2026PRoVeFL: Private Robust and Verifiable Aggregation in Federated Learningcited by 0
  14. 2026Backdoor Mitigation in Decentralized LLM Fine-Tuningcited by 0