mlsanityData to 7 Oct 2026

FLIP: A Provable Defense Framework for Backdoor Mitigation in Federated Learning

arXiv 2210.12873 ↗First posted 23 Oct 2022cs.CR cs.AI cs.LGcited by 37

Not on the map. Why?

Abstract (arXiv)

Federated Learning (FL) is a distributed learning paradigm that enables different parties to train a model together for high quality and strong privacy protection. In this scenario, individual participants may get compromised and perform backdoor attacks by poisoning the data (or gradients). Existing work on robust aggregation and certified FL robustness does not study how hardening benign clients can affect the global model (and the malicious clients). In this work, we theoretically analyze the connection among cross-entropy loss, attack success rate, and clean accuracy in this setting. Moreover, we propose a trigger reverse engineering based defense and show that our method can achieve robustness improvement with guarantee (i.e., reducing the attack success rate) without affecting benign accuracy. We conduct comprehensive experiments across different datasets and attack settings. Our results on eight competing SOTA defense methods show the empirical superiority of our method on both single-shot and continuous FL backdoor attacks. Code is available at https://github.com/KaiyuanZh/FLIP.

Key facts. Cited by 37 papers in the map (data through 7 Oct 2026). Builds on 37 of its 62 references that are in the map. First posted on arXiv 23 Oct 2022.

Builds on

37 of 62 references.

References · 37

  1. 2019PyTorch: An Imperative Style, High-Performance Deep Learning Librarycited by 20,160
  2. 2016Communication-Efficient Learning of Deep Networks from Decentralized Datacited by 7,592
  3. 2017Fashion-MNIST: a Novel Image Dataset for Benchmarking Machine Learning Algorithmscited by 4,283
  4. 2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,324
  5. 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,052
  6. 2018Robustness May Be at Odds with Accuracycited by 873
  7. 2018How To Backdoor Federated Learningcited by 745
  8. 2018Byzantine-Robust Distributed Learning: Towards Optimal Statistical Ratescited by 698
  9. 2020Ensemble Distillation for Robust Model Fusion in Federated Learningcited by 678
  10. 2020Ditto: Fair and Robust Federated Learning Through Personalizationcited by 665
  11. 2018Federated Learning for Mobile Keyboard Predictioncited by 565
  12. 2019Local Model Poisoning Attacks to Byzantine-Robust Federated Learningcited by 479
25 more
  1. 2018Analyzing Federated Learning through an Adversarial Lenscited by 346
  2. 2020Reflection Backdoor: A Natural Backdoor Attack on Deep Neural Networkscited by 341
  3. 2020FLTrust: Byzantine-robust Federated Learning via Trust Bootstrappingcited by 330
  4. 2018The Hidden Vulnerability of Distributed Learning in Byzantiumcited by 324
  5. 2019Robust Aggregation for Federated Learningcited by 314
  6. 2020Attack of the Tails: Yes, You Really Can Backdoor Federated Learningcited by 307
  7. 2020Data Poisoning Attacks Against Federated Learning Systemscited by 266
  8. 2019Can You Really Backdoor Federated Learning?cited by 250
  9. 2019SecureBoost: A Lossless Federated Learning Frameworkcited by 174
  10. 2021Back to the Drawing Board: A Critical Evaluation of Poisoning Attacks on Production Federated Learningcited by 116
  11. 2020Deep Partition Aggregation: Provable Defense against General Poisoning Attackscited by 112
  12. 2021Backdoor Scanning for Deep Neural Networks through K-Arm Optimizationcited by 96
  13. 2020Practical Detection of Trojan Neural Networks: Data-Limited and Data-Free Casescited by 93
  14. 2020Deep Feature Space Trojan Attack of Neural Networks by Controlled Detoxificationcited by 93
  15. 2021CRFL: Certifiably Robust Federated Learning against Backdoor Attackscited by 91
  16. 2020Learning to Detect Malicious Clients for Robust Federated Learningcited by 86
  17. 2020Defending against Backdoors in Federated Learning with Robust Learning Ratecited by 82
  18. 2020Rethinking the Trigger of Backdoor Attackcited by 76
  19. 2022Backdoor Defense with Machine Unlearningcited by 61
  20. 2021Provably Secure Federated Learning against Malicious Clientscited by 60
  21. 2020BaFFLe: Backdoor detection via Feedback-based Federated Learningcited by 52
  22. 2021SparseFed: Mitigating Model Poisoning Attacks in Federated Learning with Sparsificationcited by 46
  23. 2020One-pixel Signature: Characterizing CNN Models for Backdoor Detectioncited by 34
  24. 2018Federated Learning for Ultra-Reliable Low-Latency V2V Communicationscited by 30
  25. 2021Meta Federated Learningcited by 8

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2022: 1; 2023: 13; 2024: 8; 2025: 14; 2026: 1.

37 papers.

Sort:

By area:

  1. 2023Federated Learning for Generalization, Robustness, Fairness: A Survey and Benchmarkcited by 97
  2. 2023Federated Full-Parameter Tuning of Billion-Sized Language Models with Communication Cost under 18 Kilobytescited by 55
  3. 2023Detecting Backdoors in Pre-trained Encoderscited by 53
  4. 2023UNICORN: A Unified Backdoor Trigger Inversion Frameworkcited by 44
  5. 2023Elijah: Eliminating Backdoors Injected in Diffusion Models via Distribution Shiftcited by 31
  6. 2023Backdoor Federated Learning by Poisoning Backdoor-Critical Layerscited by 16
  7. 2023BEAGLE: Forensics of Deep Learning Backdoor Attack for Better Defensecited by 15
  8. 2024LOTUS: Evasive and Resilient Backdoor Attacks through Sub-Partitioningcited by 13
  9. 2023Get Rid Of Your Trail: Remotely Erasing Backdoors in Federated Learningcited by 12
  10. 2023G2uardFL: Safeguarding Federated Learning Against Backdoor Attacks through Attributed Client Graph Clusteringcited by 9
  11. 2023Resisting Backdoor Attacks in Federated Learning via Bidirectional Elections and Individual Perspectivecited by 6
  12. 2022FedCC: Robust Federated Learning against Model Poisoning Attackscited by 5
25 more
  1. 2024Adversarially Guided Stateful Defense Against Backdoor Attacks in Federated Deep Learningcited by 5
  2. 2025CENSOR: Defense Against Gradient Inversion via Orthogonal Subspace Bayesian Samplingcited by 5
  3. 2023You Can Backdoor Personalized Federated Learningcited by 4
  4. 2025Dual Defense: Enhancing Privacy and Mitigating Poisoning Attacks in Federated Learningcited by 3
  5. 2023Kick Bad Guys Out! Conditionally Activated Anomaly Detection in Federated Learning with Zero-Knowledge Proof Verificationcited by 2
  6. 2024UNIT: Backdoor Mitigation via Automated Neural Distribution Tighteningcited by 2
  7. 2024Poisoning with A Pill: Circumventing Detection in Federated Learningcited by 2
  8. 2024FedBlock: A Blockchain Approach to Federated Learning against Backdoor Attackscited by 2
  9. 2024Concealing Backdoor Model Updates in Federated Learning by Trigger-Optimized Data Poisoningcited by 1
  10. 2024EmInspector: Combating Backdoor Attacks in Federated Self-Supervised Learning Through Embedding Inspectioncited by 1
  11. 2025DBA-DFL: Towards Distributed Backdoor Attacks with Network Detection in Decentralized Federated Learningcited by 1
  12. 2025DROP: Poison Dilution via Knowledge Distillation for Federated Learningcited by 1
  13. 2025Two Heads Are Better than One: Model-Weight and Latent-Space Analysis for Federated Learning on Non-iid Data against Poisoning Attackscited by 1
  14. 2025Defending the Edge: Representative-Attention Defense against Backdoor Attacks in Federated Learningcited by 1
  15. 2025FL-PLAS: Federated Learning with Partial Layer Aggregation for Backdoor Defense Against High-Ratio Malicious Clientscited by 1
  16. 2025BackFed: An Efficient & Standardized Benchmark Suite for Backdoor Attacks in Federated Learningcited by 1
  17. 2023FTA: Stealthy and Adaptive Backdoor Attack with Flexible Triggers on Federated Learningcited by 0
  18. 2024FedSECA: Sign Election and Coordinate-wise Aggregation of Gradients for Byzantine Tolerant Federated Learningcited by 0
  19. 2025Decoding FL Defenses: Systemization, Pitfalls, and Remediescited by 0
  20. 2025Buffer is All You Need: Defending Federated Learning against Backdoor Attacks under Non-iids via Bufferingcited by 0
  21. 2025Bayesian Robust Aggregation for Federated Learningcited by 0
  22. 2025FedBAP: Backdoor Defense via Benign Adversarial Perturbation in Federated Learningcited by 0
  23. 2025FLAT: Revealing Hidden Latent-Conditioned Backdoor Failures in Federated Learningcited by 0
  24. 2025Unveiling Hidden Threats: Using Fractal Triggers to Boost Stealthiness of Distributed Backdoor Attacks in Federated Learningcited by 0
  25. 2026DCInject: Persistent Backdoor Attacks via Frequency Manipulation in Personal Federated Learningcited by 0