Toward Cleansing Backdoored Neural Networks in Federated Learning
Open accessAbstract
Malicious clients can attack federated learning systems using compromised data during the training phase, including backdoor samples. The compromised global model will perform well on the validation dataset designed for the task, but a small subset of data with backdoor patterns may trigger the model to make a wrong prediction. In this work, we propose a new and effective method to mitigate backdoor attacks in federated learning after the training phase. Through federated pruning method, we remove redundant neurons and "backdoor neurons", which trigger misbehavior upon recognizing backdoor patterns while keeping silent when the input data is clean. The second optional fine-tuning process is designed to recover the pruning damage to the test accuracy on benign datasets. In the last step, we eliminate backdoor attacks by limiting the extreme values of inputs and neural network neurons’ weights. Experiments using our defenses mechanism against the state-of-the-art Distributed Backdoor Attacks on CIFAR-10 show promising results; the averaged attack success rate drops more than 70% with less than 2% loss of test accuracy on the validation dataset. Our defense method has also outperformed the state-of-the-art pruning defense against backdoor attacks in the federated learning scenario.
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Defending before the aggregation phase is a common strategy in which the server aggregator detects and ignores malicious updates and restricts participation from suspicious clients.
“Defending before the aggregation phase is a common strategy in which the server aggregator detects and ignores malicious updates and restricts participation from suspicious clients [212], [246]-[248].”
From Data and model poisoning backdoor attacks on wireless federated learning, and the defense mechanisms: A comprehensive survey (2024) · cites this paper as [246]
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Cites
Very Deep Convolutional Networks for Large-Scale Image Recognition
Simonyan, K., & Zisserman, A. (2014) · arXiv · doi:10.48550/arxiv.1409.1556 · Cited by 74,248 · see citing works
Gradient-based learning applied to document recognition
Lecun, Y., Bottou, L., Bengio, Y., & Haffner, P. (1998) · Proceedings of the IEEE · doi:10.1109/5.726791 · Cited by 58,805 · see citing works
Learning Multiple Layers of Features from Tiny Images
Krizhevsky, A. (2024) · doi:10.57702/zp44cu3g · Cited by 23,890 · see citing works
Communication-Efficient Learning of Deep Networks from Decentralized Data
McMahan, H. B., Moore, E., Ramage, D., Hampson, S., & Arcas, B. A. Y. (2016) · arXiv · doi:10.48550/arxiv.1602.05629 · Cited by 14,215 · see citing works
Fashion-MNIST: a Novel Image Dataset for Benchmarking Machine Learning Algorithms
Xiao, H., Rasul, K., & Vollgraf, R. (2017) · arXiv · doi:10.48550/arxiv.1708.07747 · Cited by 6,108 · see citing works
How to backdoor federated learning
Bagdasaryan, E., Veit, A., Hua, Y., Estrin, D., & Shmatikov, V. (2018) · arXiv · doi:10.48550/arxiv.1807.00459 · Cited by 1,495 · see citing works
Neural Cleanse: Identifying and Mitigating Backdoor Attacks in Neural Networks
Wang, B., Yao, Y., Shan, S., Li, H., Viswanath, B., Zheng, H.-T., & Zhao, B. Y. (2019) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp.2019.00031 · Cited by 1,486 · see citing works
(2017) · neural information processing systems · Cited by 1,413 · see citing works
Byzantine-Robust Distributed Learning: Towards Optimal Statistical Rates
Yin, D., Chen, Y., Ramchandran, K., & Bartlett, P. (2018) · arXiv · doi:10.48550/arxiv.1803.01498 · Cited by 1,130 · see citing works
BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chain
Gu, T., Dolan-Gavitt, B., & Garg, S. (2017) · arXiv · doi:10.48550/arxiv.1708.06733 · Cited by 1,061 · see citing works
Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networks
Liu, K., Dolan-Gavitt, B., & Garg, S. (2018) · Lecture Notes in Computer Science · doi:10.1007/978-3-030-00470-5_13 · Cited by 1,055 · see citing works
Data Poisoning Attacks Against Federated Learning Systems
Tolpegin, V., Truex, S., Gursoy, M. E., & Liu, L. (2020) · Lecture Notes in Computer Science · doi:10.1007/978-3-030-58951-6_24 · Cited by 927 · see citing works
Local Model Poisoning Attacks to Byzantine-Robust Federated Learning
Fang, M., Cao, X., Jia, J., & Gong, N. Z. (2019) · arXiv · doi:10.48550/arxiv.1911.11815 · Cited by 828 · see citing works
Analyzing Federated Learning through an Adversarial Lens
Bhagoji, A. N., Chakraborty, S., Mittal, P., & Calo, S. (2018) · arXiv · doi:10.48550/arxiv.1811.12470 · Cited by 703 · see citing works
DBA: Distributed Backdoor Attacks against Federated Learning
Xie, C., Huang, K., Chen, P., & Li, B. (2020) · International Conference on Learning Representations · Cited by 468 · see citing works
Attack of the tails: Yes, you really can backdoor federated learning
Wang, H., Sreenivasan, K., Rajput, S., Vishwakarma, H., Agarwal, S., Sohn, J.-Y., Lee, K., & Papailiopoulos, D. (2020) · arXiv · doi:10.48550/arxiv.2007.05084 · Cited by 406 · see citing works
Mitigating Sybils in Federated Learning Poisoning
Fung, C., Yoon, C. J. M., & Beschastnikh, I. (2018) · arXiv · doi:10.48550/arxiv.1808.04866 · Cited by 385 · see citing works
Can You Really Backdoor Federated Learning?
Sun, Z., Kairouz, P., Suresh, A. T., & McMahan, H. B. (2019) · arXiv · doi:10.48550/arxiv.1911.07963 · Cited by 348 · see citing works
Data Poisoning Attacks on Federated Machine Learning
Sun, G., Cong, Y., Dong, J., Wang, Q., Lyu, L., & Liu, J. (2022) · IEEE Internet of Things Journal · doi:10.1109/jiot.2021.3128646 · Cited by 310 · see citing works
Learning to Detect Malicious Clients for Robust Federated LearningPreprint
Li, S., Cheng, Y. J., Wang, W., Liu, Y., & Chen, T. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2002.00211 · Cited by 202 · see citing works
CONTRA: Defending Against Poisoning Attacks in Federated Learning
Awan, S., Luo, B., & Li, F. (2021) · Lecture Notes in Computer Science · doi:10.1007/978-3-030-88418-5_22 · Cited by 182 · see citing works
Fall of Empires: Breaking Byzantine-tolerant SGD by Inner Product ManipulationPreprint
Xie, C., Koyejo, S., & Gupta, I. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1903.03936 · Cited by 153 · see citing works
CRFL: Certifiably Robust Federated Learning against Backdoor AttacksPreprint
Xie, C., Chen, M., Chen, P., & Li, B. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2106.08283 · Cited by 121 · see citing works
The Hidden Vulnerability of Distributed Learning in Byzantium
Mhamdi, E. M. E., Guerraoui, R., & Rouault, S. (2018) · arXiv · doi:10.48550/arxiv.1802.07927
Flagged first, then by citations
Cited by
Sorted by citations
Wan, Y., Qu, Y., Ni, W., Xiang, Y., Gao, L., & Hossain, E. (2024) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2024.3361451 · Cited by 152 · see citing works
“…How to Balance the Model Performance and the Detection Rate Before the Aggregation Phase: Defending before the aggregation phase is a common strategy in which the server aggregator detects and ignores malicious updates and restricts participation from suspicious clients [212], [246], [247], [248].”
BackgroundUnlearning Backdoor Attacks in Federated Learning
Wu, C., Zhu, S., Mitra, P., & Wang, W. (2024) · IEEE Conference on Communications and Network Security · doi:10.1109/cns62487.2024.10735680 · Cited by 25 · see citing works
Self-citationSupRTE: Suppressing Backdoor Injection in Federated Learning via Robust Trust Evaluation
Huang, W., Li, G., Yi, X., Li, J., Zhao, C., & Yin, Y. (2024) · IEEE Intelligent Systems · doi:10.1109/mis.2024.3392334 · Cited by 18 · see citing works
Cai, H., Wang, J., Gao, L., & Li, F. (2024) · Knowledge-Based Systems · doi:10.1016/j.knosys.2024.111511 · Cited by 13 · see citing works
Unveiling Backdoor Risks Brought by Foundation Models in Heterogeneous Federated Learning
Li, X., Wu, C., & Wang, J. (2024) · Lecture notes in computer science · doi:10.1007/978-981-97-2259-4_13 · Cited by 9 · see citing works
Self-citationFedBlock: A Blockchain Approach to Federated Learning against Backdoor Attacks
Nguyen, D. H., Nguyen, P. L., Nguyen, T. T., Pham, H., & Tran, D. A. (2024) · IEEE International Conference on Big Data (BigData) · doi:10.1109/bigdata62323.2024.10825703 · Cited by 5 · see citing works
Securing Federated Learning Against Backdoor Threats with Foundation Model Integration
Bi, X., & Li, X. (2025) · IEEE International Conference on Information Reuse and Integration (IRI) · doi:10.1109/iri66576.2025.00042 · Cited by 3 · see citing works
Foundation Models in Federated Learning: Assessing Backdoor Vulnerabilities
Li, X., Wu, C., & Wang, J. (2025) · International Joint Conference on Neural Networks (IJCNN) · doi:10.1109/ijcnn64981.2025.11229350 · Cited by 2 · see citing works
Self-citationBackdoor Attack and Defense in Asynchronous Federated Learning for Multiple Unmanned Vehicles
Wang, K., & Zhang, H. (2024) · Conference on Fully Actuated System Theory and Applications (FASTA) · doi:10.1109/fasta61401.2024.10595233
Backdoor Defense in Federated Learning Via Multi-Perspective Resilient Aggregation
Wang, J., Cai, H., Gao, L., & Li, F. (2025) · IEEE Symposium on Reliable Distributed Systems (SRDS) · doi:10.1109/srds69199.2025.00045
RobustFSM: Submodular Maximization in Federated Setting with Malicious Clients
Tran, D. A., Truong∗∗, D.-L., & Le, D. (2025) · IEEE International Conference on Big Data (BigData) · doi:10.1109/bigdata66926.2025.11402310
N Truths and a Lie: Consistency-Based Backdoor Defense for Vertical Federated Learning
Ma, X., Zhang, Z., He, K., Chen, J., & Du, R. (2026) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2026.3675464
- Authors
- Wu, C., Yang, X., Zhu, S., & Mitra, P.
- Affiliations
- Pennsylvania State University (US)
- North Carolina State University,Computer Science
- Venue
- 2022 IEEE 42nd International Conference on Distributed Computing Systems (ICDCS)
- Publisher
- IEEE
- Published
- 2022-07
- Pages
- 820-830
- OpenAlex
- W4312428735
- Cited by
- 12
- References
- 24
- Citations by year
- 2026: 1 · 2025: 4 · 2024: 7
- FWCI
- 1.52
- Type
- conference paper
- Language
- en
- Open access
- Locations
- IEEE International Conference on Distributed Computing Systems (ICDCS) (publishedVersion)
- ScholarSphere (Penn State Libraries) (submittedVersion)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
- Physical Sciences › Computer Science › Computer Vision and Pattern Recognition › Digital Media Forensic Detection
- Keywords
- backdoor attacks, federated learning, neural network pruning, fine-tuning, malicious clients, CIFAR-10
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
