mlsanityData to 7 Oct 2026

Adversarially Guided Stateful Defense Against Backdoor Attacks in Federated Deep Learning

arXiv 2410.11205 ↗First posted 15 Oct 2024cs.LG cs.CR cs.CVcited by 5

Not on the map. Why?

Abstract (arXiv)

Recent works have shown that Federated Learning (FL) is vulnerable to backdoor attacks. Existing defenses cluster submitted updates from clients and select the best cluster for aggregation. However, they often rely on unrealistic assumptions regarding client submissions and sampled clients population while choosing the best cluster. We show that in realistic FL settings, state-of-the-art (SOTA) defenses struggle to perform well against backdoor attacks in FL. To address this, we highlight that backdoored submissions are adversarially biased and overconfident compared to clean submissions. We, therefore, propose an Adversarially Guided Stateful Defense (AGSD) against backdoor attacks on Deep Neural Networks (DNNs) in FL scenarios. AGSD employs adversarial perturbations to a small held-out dataset to compute a novel metric, called the trust index, that guides the cluster selection without relying on any unrealistic assumptions regarding client submissions. Moreover, AGSD maintains a trust state history of each client that adaptively penalizes backdoored clients and rewards clean clients. In realistic FL settings, where SOTA defenses mostly fail to resist attacks, AGSD mostly outperforms all SOTA defenses with minimal drop in clean accuracy (5% in the worst-case compared to best accuracy) even when (a) given a very small held-out dataset -- typically AGSD assumes 50 samples (<= 0.1% of the training data) and (b) no heldout dataset is available, and out-of-distribution data is used instead. For reproducibility, our code will be openly available at: https://github.com/hassanalikhatim/AGSD.

Key facts. Cited by 5 papers in the map (data through 7 Oct 2026). Builds on 39 of its 74 references that are in the map. First posted on arXiv 15 Oct 2024.

Builds on

39 of 74 references.

References · 39

  1. 2016Communication-Efficient Learning of Deep Networks from Decentralized Datacited by 7,592
  2. 2016Membership Inference Attacks against Machine Learning Modelscited by 2,221
  3. 2017Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoningcited by 1,012
  4. 2021Membership Inference Attacks From First Principlescited by 839
  5. 2020The Future of Digital Health with Federated Learningcited by 625
  6. 2018Federated Learning for Mobile Keyboard Predictioncited by 565
  7. 2018Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networkscited by 550
  8. 2019STRIP: A Defence Against Trojan Attacks on Deep Neural Networkscited by 437
  9. 2020Label-Only Membership Inference Attackscited by 371
  10. 2020Invisible Backdoor Attack with Sample-Specific Triggerscited by 338
  11. 2020Attack of the Tails: Yes, You Really Can Backdoor Federated Learningcited by 307
  12. 2019Label-Consistent Backdoor Attackscited by 285
27 more
  1. 2021Anti-Backdoor Learning: Training Clean Models on Poisoned Datacited by 258
  2. 2021Adversarial Neuron Pruning Purifies Backdoored Deep Modelscited by 230
  3. 2020BadNL: Backdoor Attacks against NLP Models with Semantic-preserving Improvementscited by 191
  4. 2021Adversarial Unlearning of Backdoors via Implicit Hypergradientcited by 160
  5. 2018Mitigating Sybils in Federated Learning Poisoningcited by 158
  6. 2019Universal Litmus Patterns: Revealing Backdoor Attacks in CNNscited by 143
  7. 2018Backdoor Embedding in Convolutional Neural Network Models via Invisible Perturbationcited by 131
  8. 2020Adversarial Machine Learning -- Industry Perspectivescited by 121
  9. 2020Just How Toxic is Data Poisoning? A Unified Benchmark for Backdoor and Data Poisoning Attackscited by 109
  10. 2019Communication-Efficient Federated Deep Learning with Asynchronous Model Update and Temporally Weighted Aggregationcited by 99
  11. 2022Neurotoxin: Durable Backdoors in Federated Learningcited by 97
  12. 2022Truth Serum: Poisoning Machine Learning Models to Reveal Their Secretscited by 94
  13. 2020Practical Detection of Trojan Neural Networks: Data-Limited and Data-Free Casescited by 93
  14. 2020Deep Feature Space Trojan Attack of Neural Networks by Controlled Detoxificationcited by 93
  15. 2021Federated Evaluation and Tuning for On-Device Personalization: System Design & Applicationscited by 84
  16. 2022DeepSight: Mitigating Backdoor Attacks in Federated Learning Through Deep Model Inspectioncited by 78
  17. 2022FLIP: A Provable Defense Framework for Backdoor Mitigation in Federated Learningcited by 37
  18. 2018QuSecNets: Quantization-based Defense Mechanism for Securing Deep Neural Network against Adversarial Attackscited by 21
  19. 2023Active Membership Inference Attack under Local Differential Privacy in Federated Learningcited by 17
  20. 2020Cassandra: Detecting Trojaned Networks from Adversarial Perturbationscited by 15
  21. 2022More is Better (Mostly): On the Backdoor Attacks in Federated Graph Neural Networkscited by 15
  22. 2023Rethinking Backdoor Attackscited by 14
  23. 2021DeepPoison: Feature Transfer Based Stealthy Poisoning Attackcited by 8
  24. 2023DHBE: Data-free Holistic Backdoor Erasing in Deep Neural Networks via Restricted Adversarial Distillationcited by 5
  25. 2018SSCNets: Robustifying DNNs using Secure Selective Convolutional Filterscited by 4
  26. 2020HaS-Nets: A Heal and Select Mechanism to Defend DNNs Against Backdoor Attacks for Data Collection Scenarioscited by 4
  27. 2023FLEDGE: Ledger-based Federated Learning Resilient to Inference and Backdoor Attackscited by 4

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2024: 1; 2025: 2; 2026: 2.

5 papers.

  1. 2024CROW: Eliminating Backdoors from Large Language Models via Internal Consistency Regularizationcited by 29
  2. 2025Two Heads Are Better than One: Model-Weight and Latent-Space Analysis for Federated Learning on Non-iid Data against Poisoning Attackscited by 1
  3. 2025Buffer is All You Need: Defending Federated Learning against Backdoor Attacks under Non-iids via Bufferingcited by 0
  4. 2026Your Privacy My Cloak: Backdoor Attacks on Differentially Private Federated Learningcited by 0
  5. 2026Backdoors Leave Structural Traces: FedMAST for Backdoor Detection and Containment in Federated Learningcited by 0