CrowdGuard: Federated Backdoor Detection in Federated Learning
Open accessAbstract
Federated Learning (FL) is a promising approach enabling multiple clients to train Deep Neural Networks (DNNs) collaboratively without sharing their local training data.However, FL is susceptible to backdoor (or targeted poisoning) attacks.These attacks are initiated by malicious clients who seek to compromise the learning process by introducing specific behaviors into the learned model that can be triggered by carefully crafted inputs.Existing FL safeguards have various limitations: They are restricted to specific data distributions or reduce the global model accuracy due to excluding benign models or adding noise, are vulnerable to adaptive defense-aware adversaries, or require the server to access local models, allowing data inference attacks.This paper presents a novel defense mechanism, CrowdGuard, that effectively mitigates backdoor attacks in FL and overcomes the deficiencies of existing techniques.It leverages clients' feedback on individual models, analyzes the behavior of neurons in hidden layers, and eliminates poisoned models through an iterative pruning scheme.CrowdGuard employs a server-located stacked clustering scheme to enhance its resilience to rogue client feedback.The evaluation results demonstrate that CrowdGuard achieves a 100% True-Positive-Rate and True-Negative-Rate across various scenarios, including IID and non-IID data distributions.Additionally, CrowdGuard withstands adaptive adversaries while preserving the original performance of protected models.To ensure confidentiality, CrowdGuard uses a secure and privacy-preserving architecture leveraging Trusted Execution Environments (TEEs) on both client and server sides.
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Data poisoning allows adversaries to inject manipulated samples into training datasets to bias model behavior.
“Data poisoning allows adversaries to inject manipulated samples into training datasets to bias model behavior [19,20].”
From AI Supply Chain Security: MBOM-PQC Provenance, PQC Attestation, and a Maturity Model for Quantum-Resistant Assurance (2026) · cites this paper as [20]
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Cites
Communication-Efficient Learning of Deep Networks from Decentralized Data
McMahan, H. B., Moore, E., Ramage, D., Hampson, S., & Arcas, B. A. Y. (2016) · arXiv · doi:10.48550/arxiv.1602.05629 · Cited by 14,215 · see citing works
Membership Inference Attacks Against Machine Learning Models
Shokri, R., Stronati, M., Song, C., & Shmatikov, V. (2017) · 2017 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp.2017.41 · Cited by 4,754 · see citing works
Sheller, M. J., Edwards, B., Reina, G. A., Martin, J., Pati, S., Kotrotsou, A., Milchenko, M., Xu, W., Marcus, D., Colen, R. R., et al. (2020) · Scientific Reports · doi:10.1038/s41598-020-69250-1 · Cited by 1,646 · see citing works
How to backdoor federated learning
Bagdasaryan, E., Veit, A., Hua, Y., Estrin, D., & Shmatikov, V. (2018) · arXiv · doi:10.48550/arxiv.1807.00459 · Cited by 1,495 · see citing works
Trojaning Attack on Neural Networks
Liu, Y., Ma, S., Aafer, Y., Lee, W.-C., Zhai, J., Wang, W., & Zhang, X. (2018) · Proceedings 2018 Network and Distributed System Security Symposium · doi:10.14722/ndss.2018.23291 · Cited by 1,270 · see citing works
FLTrust: Byzantine-robust Federated Learning via Trust Bootstrapping
Cao, X., Fang, M., Liu, J., & Gong, N. Z. (2021) · Proceedings 2021 Network and Distributed System Security Symposium · doi:10.14722/ndss.2021.24434 · Cited by 999 · see citing works
Reflection Backdoor: A Natural Backdoor Attack on Deep Neural Networks
Liu, Y., Ma, X., Bailey, J., & Lu, F. (2020) · Lecture Notes in Computer Science · doi:10.1007/978-3-030-58607-2_11 · Cited by 531 · see citing works
Ganju, K., Wang, Q., Yang, W., Gunter, C. A., & Borisov, N. (2018) · Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/3243734.3243834 · Cited by 475 · cited 3× · see citing works
“…clients from an enclave and then perform a ▷ Aggregate result 24: significant ← mean significant OR var significant OR dist significant OR outlier quartil significant OR outlier sigma significant model inference attack [29], [36], [52], [63], [71], [76], [82], [88], [95] on the extracted models.”
BackgroundLOGAN: Membership Inference Attacks Against Generative Models
Hayes, J., Melis, L., Danezis, G., & De Cristofaro, E. (2019) · Proceedings on Privacy Enhancing Technologies · doi:10.2478/popets-2019-0008 · Cited by 433 · see citing works
Attack of the tails: Yes, you really can backdoor federated learning
Wang, H., Sreenivasan, K., Rajput, S., Vishwakarma, H., Agarwal, S., Sohn, J.-Y., Lee, K., & Papailiopoulos, D. (2020) · arXiv · doi:10.48550/arxiv.2007.05084 · Cited by 406 · see citing works
Federated Learning for Breast Density Classification: A Real-World Implementation
Roth, H. R., Chang, K., Singh, P., Neumark, N., Li, W., Gupta, V., Gupta, S., Qu, L., Ihsani, A., Bizzo, B. C., et al. (2020) · Lecture Notes in Computer Science · doi:10.1007/978-3-030-60548-3_18 · Cited by 202 · see citing works
Poisoning Attacks on Federated Learning-based IoT Intrusion Detection System
Nguyen, T. D., Rieger, P., Miettinen, M., & Sadeghi, A.-R. (2020) · Proceedings 2020 Workshop on Decentralized IoT Systems and Security · doi:10.14722/diss.2020.23003 · Cited by 200 · see citing works
Self-citationLocal and Central Differential Privacy for Robustness and Privacy in Federated Learning
Naseri, M., Hayes, J., & De Cristofaro, E. (2022) · Proceedings 2022 Network and Distributed System Security Symposium · doi:10.14722/ndss.2022.23054 · Cited by 188 · see citing works
Updates-Leak: Data Set Inference and Reconstruction Attacks in Online Learning
Salem, A., Bhattacharya, A., Backes, M., Fritz, M., & Zhang, Y. (2020) · Universität des Saarlandes · doi:10.22028/d291-47370 · Cited by 157 · see citing works
Flagged first, then by citations
Research works printed but not linked: 61
- Mauro Barni, Kassem Kallas, and Benedetta Tondi. A new backdoor attack in cnns by training set corruption without label poisoning. In 2019 IEEE International Conference on Image Processing (ICIP), pages 101-105. IEEE, 2019.
- Gilles Barthe, Sandrine Blazy, Benjamin Grégoire, Rémi Hutin, Vincent Laporte, David Pichardie, and Alix Trieu. Formal verification of a constant-time preserving c compiler. Proceedings of the ACM on Programming Languages, 2020.
- Peva Blanchard, El Mahdi El Mhamdi, Rachid Guerraoui, and Julien Stainer. Machine Learning with Adversaries: Byzantine Tolerant Gra- dient Descent. In NIPS, 2017.
- Ferdinand Brasser, Urs Müller, Alexandra Dmitrienko, Kari Kostiainen, Srdjan Capkun, and Ahmad-Reza Sadeghi. Software grand exposure: SGX cache attacks are practical. In USENIX Workshop on Offensive Technologies (WOOT 17). USENIX Association, 2017.
- Xiaoyu Cao, Jinyuan Jia, and Neil Zhenqiang Gong. Provably secure federated learning against malicious clients. In AAAI Conference on Artificial Intelligence, 2021.
- Bryant Chen, Wilka Carvalho, Nathalie Baracaldo, Heiko Ludwig, Benjamin Edwards, Taesung Lee, Ian Molloy, and Biplav Srivastava. Detecting backdoor attacks on deep neural networks by activation clustering. arXiv preprint arXiv:1811.03728, 2018. · arXiv
- Fei Chen, Mi Luo, Zhenhua Dong, Zhenguo Li, and Xiuqiang He. Federated meta-learning with fast convergence and efficient commu- nication. In arXiv preprint arXiv:1802.07876, 2018. · arXiv
- Xinyun Chen, Chang Liu, Bo Li, Kimberly Lu, and Dawn Song. Tar- geted backdoor attacks on deep learning systems using data poisoning. In arXiv preprint arXiv:1712.05526, 2017. · arXiv
- Lesly-Ann Daniel, Sébastien Bardin, and Tamara Rezk. Binsec/rel: Efficient relational symbolic execution for constant-time at binary-level. In IEEE S&P. IEEE, 2020.
- Li Deng. The mnist database of handwritten digit images for machine learning research. In IEEE Signal Processing Magazine, volume 29, pages 141-142. IEEE, 2012.
- Jean-Antoine Désidéri. Multiple-gradient descent algorithm (mgda) for multiobjective optimization. Comptes Rendus Mathematique, 350(5):313-318, 2012.
- Minghong Fang, Xiaoyu Cao, Jinyuan Jia, and Neil Zhenqiang Gong. Local Model Poisoning Attacks to Byzantine-Robust Federated Learn- ing. In USENIX Security, 2020.
- Hossein Fereidooni, Alexandra Dmitrienko, Phillip Rieger, Markus Miettinen, Ahmad-Reza Sadeghi, and Felix Madlener. Fedcri: Federated mobile cyber-risk intelligence. In NDSS, 2022.
- Hossein Fereidooni, Samuel Marchal, Markus Miettinen, Azalia Mirho- seini, Helen Möllering, Thien Duc Nguyen, Phillip Rieger, Ahmad-Reza Sadeghi, Thomas Schneider, Hossein Yalame, et al. Safelearn: Secure aggregation for private federated learning. In IEEE Security and Privacy Workshops (SPW). IEEE, 2021.
- Yansong Gao, Bao Gia Doan, Zhi Zhang, Siqi Ma, Jiliang Zhang, Anmin Fu, Surya Nepal, and Hyoungshick Kim. Backdoor attacks and countermeasures on deep learning: A comprehensive review. In arXiv preprint arXiv:2007.10760, 2020. · arXiv
- Tianyu Gu, Brendan Dolan-Gavitt, and Siddharth Garg. Badnets: Identifying vulnerabilities in the machine learning model supply chain. In arXiv preprint arXiv:1708.06733, 2017. · arXiv
- Rachid Guerraoui, Sébastien Rouault, et al. The hidden vulnerability of distributed learning in byzantium. In International Conference on Machine Learning, pages 3521-3530. PMLR, 2018.
- Gozde N Gunesli, Mohsin Bilal, Shan E Ahmed Raza, and Nasir M Ra- jpoot. Feddropoutavg: Generalizable federated learning for histopathol- ogy image classification. In arXiv preprint arXiv:2111.13230, 2021. · arXiv
- Andrew Hard, Kanishka Rao, Rajiv Mathews, Swaroop Ramaswamy, Franc ¸oise Beaufays, Sean Augenstein, Hubert Eichner, Chloé Kiddon, and Daniel Ramage. Federated learning for mobile keyboard prediction. In arXiv preprint arXiv:1811.03604, 2018. · arXiv
- Hanieh Hashemi, Yongqin Wang, Chuan Guo, and Murali Annavaram. Byzantine-robust and privacy-preserving framework for fedml. In ICLR Workshops, 2021.
- Tzu-Ming Harry Hsu, Hang Qi, and Matthew Brown. Measuring the effects of non-identical data distribution for federated visual classifica- tion. In arXiv preprint arXiv:1909.06335, 2019. · arXiv
- Wei Huang, Shengjie Xu, Yueqiang Cheng, and David Lie. Aion attacks: Manipulating software timers in trusted execution environment. In International Conference on Detection of Intrusions and Malware, and Vulnerability Assessment, pages 173-193. Springer, 2021.
- Youssef Khazbak, Tianxiang Tan, and Guohong Cao. Mlguard: Miti- gating poisoning attacks in privacy preserving distributed collaborative learning. In International Conference on Computer Communications and Networks (ICCCN). IEEE, 2020.
- Jakub Konečnỳ, H Brendan McMahan, Daniel Ramage, and Peter Richtárik. Federated optimization: Distributed machine learning for on-device intelligence. In arXiv preprint arXiv:1610.02527, 2016. · arXiv
- Jakub Konečnỳ, H Brendan McMahan, Felix X Yu, Peter Richtárik, Ananda Theertha Suresh, and Dave Bacon. Federated learning: Strategies for improving communication efficiency. arXiv preprint arXiv:1610.05492, 2016. · arXiv
- Kavita Kumari, Phillip Rieger, Hossein Fereidooni, Murtuza Jadliwala, and Ahmad-Reza Sadeghi. Baybfed: Bayesian backdoor defense for federated learning. In IEEE S&P. IEEE Computer Society, 2023.
- Huimin Li, Phillip Rieger, Shaza Zeitouni, Stjepan Picek, and Ahmad- Reza Sadeghi. Flairs: Fpga-accelerated inference-resistant & secure federated learning. arXiv preprint arXiv:2308.00553, 2023. · arXiv
- Liping Li, Wei Xu, Tianyi Chen, Georgios B Giannakis, and Qing Ling. Rsa: Byzantine-robust stochastic aggregation methods for distributed learning from heterogeneous datasets. In AAAI Conference on Artificial Intelligence, 2019.
- Mingyu Li, Yubin Xia, and Haibo Chen. Memory optimization system for sgxv2 trusted execution environment. International Journal of Software & Informatics, 12(3), 2022.
- Xiang Li, Kaixuan Huang, Wenhao Yang, Shusen Wang, and Zhihua Zhang. On the convergence of fedavg on non-iid data. In International Conference on Learning Representations, 2019.
- Xiaoxiao Li, Meirui Jiang, Xiaofei Zhang, Michael Kamp, and Qi Dou. Fedbn: Federated learning on non-iid features via local batch normal- ization. In arXiv preprint arXiv:2102.07623, 2021. · arXiv
- Tjen-Sien Lim and Wei-Yin Loh. A comparison of tests of equality of variances. Computational Statistics & Data Analysis, 22(3):287-301, 1996.
- Pengrui Liu, Xiangrui Xu, and Wei Wang. Threats, attacks and defenses to federated learning: issues, taxonomy and perspectives. Cybersecurity, 5(1), 2022.
- Edward H Livingston. Who was student and why do we care so much about his t-test? 1. Journal of Surgical Research, 118(1):58-65, 2004.
- H. Brendan McMahan, Daniel Ramage, Kunal Talwar, and Li Zhang. Learning Differentially Private Language Models Without Losing Ac- curacy. In ICLR, 2018.
- Fan Mo, Hamed Haddadi, Kleomenis Katevas, Eduard Marin, Diego Perino, and Nicolas Kourtellis. Ppfl: privacy-preserving federated learning with trusted execution environments. In Annual International Conference on Mobile Systems, Applications, and Services, 2021.
- Luis Muñoz-González, Kenneth T. Co, and Emil C. Lupu. Byzantine- Robust Federated Machine Learning through Adaptive Model Averag- ing. In arXiv preprint:1909.05125, 2019. · arXiv
- Milad Nasr, Reza Shokri, and Amir Houmansadr. Comprehensive pri- vacy analysis of deep learning: Passive and active white-box inference attacks against centralized and federated learning. In IEEE S&P. IEEE, 2019.
- Thien Duc Nguyen, Phillip Rieger, Huili Chen, Hossein Yalame, Helen Möllering, Hossein Fereidooni, Samuel Marchal, Markus Miettinen, Azalia Mirhoseini, Farinaz Koushanfar, Ahmad-Reza Sadeghi, Thomas Schneider, and Shaza Zeitouni. FLAME: taming backdoors in federated learning. In USENIX Security, 2022.
- Frank Nielsen. Hierarchical Clustering, pages 195-211. 02 2016.
- Sandro Pinto and Nuno Santos. Demystifying arm trustzone: A comprehensive survey. ACM Comput. Surv., 51(6), jan 2019.
- Friedrich Pukelsheim. The three sigma rule. The American Statistician, 48(2):88-91, 1994.
- Apostolos Pyrgelis, Carmela Troncoso, and Emiliano De Cristofaro. Knock knock, who's there? membership inference on aggregate location data. In NDSS, 2018.
- Phillip Rieger, Thien Duc Nguyen, Markus Miettinen, and Ahmad-Reza Sadeghi. Deepsight: Mitigating backdoor attacks in federated learning through deep model inspection. In NDSS, 2022.
- Benjamin IP Rubinstein, Blaine Nelson, Ling Huang, Anthony D Joseph, Shing-hon Lau, Satish Rao, Nina Taft, and J Doug Tygar. Antidote: understanding and defending against poisoning of anomaly detectors. In ACM SIGCOMM Conference on Internet Measurement, 2009.
- Fan Sang, Ming-Wei Shih, Sangho Lee, Xiaokuan Zhang, Michael Steiner, Mona Vij, and Taesoo Kim. Pridwen: Universally hardening sgx programs via load-time synthesis. In USENIX Security, 2022.
- Micah Sheller, Anthony Reina, Brandon Edwards, Jason Martin, and Spyridon Bakas. Multi-Institutional Deep Learning Modeling Without Sharing Patient Data: A Feasibility Study on Brain Tumor Segmenta- tion. In Brain Lesion Workshop, 2018.
- Chia-Che Tsai, Donald E Porter, and Mona Vij. {Graphene-SGX}: A practical library {OS} for unmodified applications on {SGX}. In USENIX Annual Technical Conference (USENIX ATC), 2017.
- Stephan van Schaik, Marina Minkin, Andrew Kwong, Daniel Genkin, and Yuval Yarom. Cacheout: Leaking data on intel cpus via cache evictions. In IEEE S&P. IEEE, 2021.
- Stavros Volos, Kapil Vaswani, and Rodrigo Bruno. Graviton: Trusted execution environments on gpus. In USENIX Symposium on Operating Systems Design and Implementation (OSDI 18), pages 681-696, 2018.
- Jinwen Wang, Yueqiang Cheng, Qi Li, and Yong Jiang. Interface- based side channel attack against intel sgx. In arXiv preprint arXiv:1811.05378, 2018. · arXiv
- Lixu Wang, Shichao Xu, Xiao Wang, and Qi Zhu. Eavesdrop the Composition Proportion of Training Labels in Federated Learning. In arXiv preprint:1910.06044, 2019. · arXiv
- Ning Wang, Yang Xiao, Yimin Chen, Yang Hu, Wenjing Lou, and Y Thomas Hou. Flare: defending federated learning against model poisoning attacks via latent space representations. In Asia Conference on Computer and Communications Security, 2022.
- Zhibo Wang, Mengkai Song, Zhifei Zhang, Yang Song, Qian Wang, and Hairong Qi. Beyond inferring class representatives: User-level privacy leakage from federated learning. In IEEE INFOCOM 2019- IEEE Conference on Computer Communications. IEEE, 2019.
- Zhaoxian Wu, Qing Ling, Tianyi Chen, and Georgios B. Giannakis. Federated variance-reduced stochastic gradient descent with robustness to byzantine attacks. In IEEE Transactions on Signal Processing, volume 68, pages 4583-4596, 2020.
- Chulin Xie, Keli Huang, Pin-Yu Chen, and Bo Li. Dba: Distributed backdoor attacks against federated learning. In International Conference on Learning Representations, 2020.
- Qiang Yang, Yang Liu, Tianjian Chen, and Yongxin Tong. Federated machine learning: Concept and applications. ACM Trans. Intell. Syst. Technol., 10(2), jan 2019.
- Dong Yin, Yudong Chen, Ramchandran Kannan, and Peter Bartlett. Byzantine-robust distributed learning: Towards optimal statistical rates. In International Conference on Machine Learning, pages 5650-5659. PMLR, 2018.
- Bo Zhao, Konda Reddy Mopuri, and Hakan Bilen. idlg: Improved deep leakage from gradients. In arXiv preprint arXiv:2001.02610, 2020. · arXiv
- Lingchen Zhao, Shengshan Hu, Qian Wang, Jianlin Jiang, Chao Shen, Xiangyang Luo, and Pengfei Hu. Shielding collaborative learning: Mitigating poisoning attacks through client-side detection. IEEE Trans- actions on Dependable and Secure Computing, 18(5):2029-2041, 2020.
- Hangyu Zhu, Jinjin Xu, Shiqing Liu, and Yaochu Jin. Federated learning on non-iid data: A survey. In Neurocomputing, volume 465, pages 371- 390. Elsevier, 2021.
Cited by
Sorted by citations
Campbell, R. (2026) · Systems · doi:10.3390/systems14050593 · Cited by 3 · see citing works
- Authors
- Rieger, P., Krauß, T., Miettinen, M., Dmitrienko, A., & Sadeghi, A.-R.
- Affiliations
- University of Würzburg (DE)
- Venue
- Proceedings 2024 Network and Distributed System Security Symposium
- Publisher
- Internet Society
- Published
- 2024
- OpenAlex
- W4391724758
- Cited by
- 36
- References
- 14
- Citations by year
- 2026: 17 · 2025: 15 · 2024: 4
- FWCI
- 10.62
- Type
- conference paper
- Language
- en
- Open access
- bronze
- doi.org
- Locations
- Network and Distributed System Security Symposium (publishedVersion)
- TUbilio (Technical University of Darmstadt) (acceptedVersion)
- arXiv (Cornell University) (submittedVersion)
- Universitätsbibliographie, Universität Duisburg-Essen (submittedVersion)
- arXiv (Cornell University)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
- Physical Sciences › Computer Science › Artificial Intelligence › Security and Verification in Computing
- Keywords
- federated learning, backdoor detection, malicious clients, iterative pruning, adaptive adversaries, non-IID data, trusted execution environments, privacy-preserving defense
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
