# BayBFed: Bayesian Backdoor Defense for Federated Learning

arXiv: https://arxiv.org/abs/2301.09508 · HTML: https://mlsanity.com/paper/2301.09508/

## Key facts

- Cited by 23 papers in the map (data through 14 Oct 2026).
- Builds on 26 of its 52 references that are in the map.
- First posted on arXiv 23 Jan 2023.

## Builds on (most cited first, 26 of 26)

- [Communication-Efficient Learning of Deep Networks from Decentralized Data](https://mlsanity.com/paper/1602.05629/) (2016)
- [Federated Learning: Challenges, Methods, and Future Directions](https://mlsanity.com/paper/1908.07873/) (2019)
- [How To Backdoor Federated Learning](https://mlsanity.com/paper/1807.00459/) (2018)
- [Byzantine-Robust Distributed Learning: Towards Optimal Statistical Rates](https://mlsanity.com/paper/1803.01498/) (2018)
- [Local Model Poisoning Attacks to Byzantine-Robust Federated Learning](https://mlsanity.com/paper/1911.11815/) (2019)
- [Bayesian Nonparametric Federated Learning of Neural Networks](https://mlsanity.com/paper/1905.12022/) (2019)
- [FLTrust: Byzantine-robust Federated Learning via Trust Bootstrapping](https://mlsanity.com/paper/2012.13995/) (2020)
- [The Hidden Vulnerability of Distributed Learning in Byzantium](https://mlsanity.com/paper/1802.07927/) (2018)
- [Robust Aggregation for Federated Learning](https://mlsanity.com/paper/1912.13445/) (2019)
- [Attack of the Tails: Yes, You Really Can Backdoor Federated Learning](https://mlsanity.com/paper/2007.05084/) (2020)
- [Can You Really Backdoor Federated Learning?](https://mlsanity.com/paper/1911.07963/) (2019)
- [Applied Federated Learning: Improving Google Keyboard Query Suggestions](https://mlsanity.com/paper/1812.02903/) (2018)
- [Multi-Institutional Deep Learning Modeling Without Sharing Patient Data: A Feasibility Study on Brain Tumor Segmentation](https://mlsanity.com/paper/1810.04304/) (2018)
- [Sever: A Robust Meta-Algorithm for Stochastic Optimization](https://mlsanity.com/paper/1803.02815/) (2018)
- [CRFL: Certifiably Robust Federated Learning against Backdoor Attacks](https://mlsanity.com/paper/2106.08283/) (2021)
- [D"IoT: A Federated Self-learning Anomaly Detection System for IoT](https://mlsanity.com/paper/1804.07474/) (2018)
- [Learning to Detect Malicious Clients for Robust Federated Learning](https://mlsanity.com/paper/2002.00211/) (2020)
- [DeepSight: Mitigating Backdoor Attacks in Federated Learning Through Deep Model Inspection](https://mlsanity.com/paper/2201.00763/) (2022)
- [Local and Central Differential Privacy for Robustness and Privacy in Federated Learning](https://mlsanity.com/paper/2009.03561/) (2020)
- [Byzantine-Robust Federated Machine Learning through Adaptive Model Averaging](https://mlsanity.com/paper/1909.05125/) (2019)
- [Provably Secure Federated Learning against Malicious Clients](https://mlsanity.com/paper/2102.01854/) (2021)
- [BaFFLe: Backdoor detection via Feedback-based Federated Learning](https://mlsanity.com/paper/2011.02167/) (2020)
- [Abnormal Client Behavior Detection in Federated Learning](https://mlsanity.com/paper/1910.09933/) (2019)
- [Mitigating Backdoor Attacks in Federated Learning](https://mlsanity.com/paper/2011.01767/) (2020)
- [Learning Differentially Private Recurrent Language Models](https://mlsanity.com/paper/1710.06963/) (2017)
- [Posteriors, conjugacy, and exponential families for completely random measures](https://mlsanity.com/paper/1410.6843/) (2014)

## Built on by (most cited first, 23 of 23)

- [FreqFed: A Frequency Analysis-Based Approach for Mitigating Poisoning Attacks in Federated Learning](https://mlsanity.com/paper/2312.04432/) (2023)
- [FedSecurity: Benchmarking Attacks and Defenses in Federated Learning and Federated LLMs](https://mlsanity.com/paper/2306.04959/) (2023)
- [Do We Really Need to Design New Byzantine-robust Aggregation Rules?](https://mlsanity.com/paper/2501.17381/) (2025)
- [Get Rid Of Your Trail: Remotely Erasing Backdoors in Federated Learning](https://mlsanity.com/paper/2304.10638/) (2023)
- [FLTracer: Accurate Poisoning Attack Provenance in Federated Learning](https://mlsanity.com/paper/2310.13424/) (2023)
- [SafeSplit: A Novel Defense Against Client-Side Backdoor Attacks in Split Learning (Full Version)](https://mlsanity.com/paper/2501.06650/) (2025)
- [ACE: A Model Poisoning Attack on Contribution Evaluation Methods in Federated Learning](https://mlsanity.com/paper/2405.20975/) (2024)
- [FLEDGE: Ledger-based Federated Learning Resilient to Inference and Backdoor Attacks](https://mlsanity.com/paper/2310.02113/) (2023)
- [The last Dance : Robust backdoor attack via diffusion models and bayesian approach](https://mlsanity.com/paper/2402.05967/) (2024)
- [Trading Devil: Robust backdoor attack via Stochastic investment models and Bayesian approach](https://mlsanity.com/paper/2406.10719/) (2024)
- [Kick Bad Guys Out! Conditionally Activated Anomaly Detection in Federated Learning with Zero-Knowledge Proof Verification](https://mlsanity.com/paper/2310.04055/) (2023)
- [FedBlock: A Blockchain Approach to Federated Learning against Backdoor Attacks](https://mlsanity.com/paper/2411.02773/) (2024)
- [SifterNet: A Generalized and Model-Agnostic Trigger Purification Approach](https://mlsanity.com/paper/2505.14531/) (2025)
- [Avoid Adversarial Adaption in Federated Learning by Multi-Metric Investigations](https://mlsanity.com/paper/2306.03600/) (2023)
- [Concealing Backdoor Model Updates in Federated Learning by Trigger-Optimized Data Poisoning](https://mlsanity.com/paper/2405.06206/) (2024)
- [DROP: Poison Dilution via Knowledge Distillation for Federated Learning](https://mlsanity.com/paper/2502.07011/) (2025)
- [Automated Byzantine-Resilient Clustered Decentralized Federated Learning for Battery Intelligence in Connected EVs](https://mlsanity.com/paper/2605.21115/) (2026)
- [Gradient Purification: Defense Against Poisoning Attack in Decentralized Federated Learning](https://mlsanity.com/paper/2501.04453/) (2025)
- [TrojanDam: Detection-Free Backdoor Defense in Federated Learning through Proactive Model Robustification utilizing OOD Data](https://mlsanity.com/paper/2504.15674/) (2025)
- [On the Inference (In-)Security of Vertical Federated Learning: Efficient Auditing against Inference Tampering Attack](https://mlsanity.com/paper/2507.02376/) (2025)
- [Hammer and Anvil: Toward a Theory of Backdoors in Federated Learning](https://mlsanity.com/paper/2509.08089/) (2025)
- [RobustFSM: Submodular Maximization in Federated Setting with Malicious Clients](https://mlsanity.com/paper/2511.02029/) (2025)
- [Delayed Backdoor Attacks: Exploring the Temporal Dimension as a New Attack Surface in Pre-Trained Models](https://mlsanity.com/paper/2603.11949/) (2026)

## Abstract (arXiv)

Federated learning (FL) allows participants to jointly train a machine learning model without sharing their private data with others. However, FL is vulnerable to poisoning attacks such as backdoor attacks. Consequently, a variety of defenses have recently been proposed, which have primarily utilized intermediary states of the global model (i.e., logits) or distance of the local models (i.e., L2-norm) from the global model to detect malicious backdoors. However, as these approaches directly operate on client updates, their effectiveness depends on factors such as clients' data distribution or the adversary's attack strategies. In this paper, we introduce a novel and more generic backdoor defense framework, called BayBFed, which proposes to utilize probability distributions over client updates to detect malicious updates in FL: it computes a probabilistic measure over the clients' updates to keep track of any adjustments made in the updates, and uses a novel detection algorithm that can leverage this probabilistic measure to efficiently detect and filter out malicious updates. Thus, it overcomes the shortcomings of previous approaches that arise due to the direct usage of client updates; as our probabilistic measure will include all aspects of the local client training strategies. BayBFed utilizes two Bayesian Non-Parametric extensions: (i) a Hierarchical Beta-Bernoulli process to draw a probabilistic measure given the clients' updates, and (ii) an adaptation of the Chinese Restaurant Process (CRP), referred by us as CRP-Jensen, which leverages this probabilistic measure to detect and filter out malicious updates. We extensively evaluate our defense approach on five benchmark datasets: CIFAR10, Reddit, IoT intrusion detection, MNIST, and FMNIST, and show that it can effectively detect and eliminate malicious updates in FL without deteriorating the benign performance of the global model.