BaFFLe: Backdoor Detection via Feedback-based Federated Learning
Open accessAbstract
Recent studies have shown that federated learning (FL) is vulnerable to poisoning attacks that inject a backdoor into the global model. These attacks are effective even when performed by a single client, and undetectable by most existing defensive techniques. In this paper, we propose Backdoor detection via Feedback-based Federated Learning (BAFFLE), a novel defense to secure FL against backdoor attacks. The core idea behind BAFFLE is to leverage data of multiple clients not only for training but also for uncovering model poisoning. We exploit the availability of diverse datasets at the various clients by incorporating a feedback loop into the FL process, to integrate the views of those clients when deciding whether a given model update is genuine or not. We show that this powerful construct can achieve very high detection rates against state-of-the-art backdoor attacks, even when relying on straightforward methods to validate the model. Through empirical evaluation using the CIFAR-10 and FEMNIST datasets, we show that by combining the feedback loop with a method that suspects poisoning attempts by assessing the per-class classification performance of the updated model, BAFFLE reliably detects state-of-the-art backdoor attacks with a detection accuracy of 100% and a false-positive rate below 5%. Moreover, we show that our solution can detect adaptive attacks aimed at bypassing the defense.
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
The defense during the aggregation phase involves filtering out poisoned updates after they have been received by the aggregator.
“The defense during the aggregation phase involves filtering out poisoned updates after they have been received by the aggregator [230], [249], [250].”
From Data and model poisoning backdoor attacks on wireless federated learning, and the defense mechanisms: A comprehensive survey (2024) · cites this paper as [230]
Recent studies have shown that FL is also vulnerable to well-crafted adversarial examples.
“In terms of the robustness vulnerability, recent studies [175], [176], [177] have shown that FL is also vulnerable to well-crafted adversarial examples.”
From Privacy and Robustness in Federated Learning: Attacks and Defenses (2024) · cites this paper as [175]
During inference time, attackers can add a very small perturbation to the test data, making the test data almost indistinguishable from natural data and yet classified incorrectly by the global model.
“During inference time, the attackers can add a very small perturbation to the test data, making the test data almost indistinguishable from natural data and yet classified incorrectly by the global model.”
From Privacy and Robustness in Federated Learning: Attacks and Defenses (2024) · cites this paper as [175]
The training of all federated adversarial training works is unstable, which potentially hurts convergence and performance.
“The training of all the above FAT works are unstable, which potentially hurts the convergence and performance.”
From Privacy and Robustness in Federated Learning: Attacks and Defenses (2024) · cites this paper as [175]
Conducting adversarial training on only a proportion of participants leads to better convergence.
“To solve this problem, they conducted AT on only a proportion of participants for better convergence.”
From Privacy and Robustness in Federated Learning: Attacks and Defenses (2024) · cites this paper as [175]
Conducting adversarial training on all participants leads to divergence of the model.
“[175] noticed that conducting AT on all participants leads to divergence of the model.”
From Privacy and Robustness in Federated Learning: Attacks and Defenses (2024) · cites this paper as [175]
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
The citation lists haven’t been fetched yet
References 27 · Cited by 205
Research works printed but not linked: 1
- S. Shen, S. Tople, and P. Saxena, "Auror: defending against poisoning attacks in collaborative deep learning systems," in ACSAC. ACM, 2016, pp. 508-519.
- Authors
- Andreina, S., Marson, G. A., Mollering, H., & Karame, G.
- Affiliations
- NEC (Germany) (DE)
- Venue
- 2021 IEEE 41st International Conference on Distributed Computing Systems (ICDCS)
- Publisher
- IEEE
- Published
- 2021-07
- Pages
- 852-863
- OpenAlex
- W3097856375
- Cited by
- 205
- References
- 27
- Citations by year
- 2026: 15 · 2025: 45 · 2024: 72 · 2023: 44 · 2022: 24 · 2021: 5
- FWCI
- 16.72
- Type
- conference paper
- Language
- en
- Open access
- green
- arxiv.org
- Licence
- Locations
- IEEE International Conference on Distributed Computing Systems (ICDCS) (publishedVersion)
- arXiv (Cornell University) (submittedVersion)
- TUbilio (Technical University of Darmstadt) (submittedVersion)
- arXiv (Cornell University)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
- Physical Sciences › Computer Science › Artificial Intelligence › Security and Verification in Computing
- Keywords
- backdoor detection, federated learning, model poisoning, defense evasion, baffles
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
