Research map / Federated learning and privacy / Privacy attacks and secure learning

Detecting Backdoor Attacks in Federated Learning via Direction Alignment Inspection

CVPR 2025 · Federated learning and privacy › Privacy attacks and secure learning · approach: Defending federated learning against poisoning · 20 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes AlignIns, a federated learning defense that filters backdoor-poisoned model updates using temporal direction alignment (cosine to global model) and masked principal sign alignment, then clips and averages the rest.

Problem

Backdoor attacks in federated learning evade magnitude-based and pairwise cosine defenses because malicious updates mimic benign ones in magnitude and general direction, especially under non-IID data and near convergence.

Approach

Inspect each update's direction at two granularities: cosine alignment with the latest global model, and sign agreement of its top-k most important parameters with a majority-vote principal sign; outliers on both scores are detected via MZ scores and filtered, followed by median-norm clipping.

Key results

• On IID CIFAR-10, AlignIns achieves average BA of 2.21% and RA of 85.67% across Badnet, DBA and Neurotoxin, close to the ideal FedAvg* (85.60% RA).
• AlignIns gives +0.68% BA and +5.36% RA over the second-best method on IID CIFAR-10 averaged over three attacks.
• On cross-device CIFAR-10 with 100 clients under Badnet, AlignIns reaches 79.28% average RA while Foolsgold and Lockdown drop to about 0%.

Measured effects reported in the paper

Surprising findings

• Using MPSA or TDA alone is sufficient in IID settings but fails under non-IID data, where combining them is needed.
• Restricting sign checks to top-30% parameters markedly improves detection over top-50% or 70% (BA and RA improved by about 30% and 25% in non-IID case).

Limitations

• Adaptive attacks tailored to AlignIns are only studied in the appendix and described as beyond scope.
• Theoretical guarantees rely on assumptions (smoothness, bounded variance and heterogeneity) that apply only to benign clients.
• Hyperparameters such as filtering radii and top-k fraction must be set and affect the robustness-accuracy trade-off.

Experimental setup

Datasets: CIFAR-10 CIFAR-100 MNIST FMNIST Sentiment140 Tiny-ImageNet

Benchmarks: CIFAR-10 CIFAR-100

Metrics: main task accuracy backdoor attack accuracy robustness accuracy

Baselines: FedAvg RLR RFA Multi-Krum FoolsGold Multi-Metric Lockdown FedAvg*

Builds on: FedAvg Multi-Krum RLR FoolsGold Lockdown

Closest papers by meaning

• Coupled Trigger Optimization and Vulnerable Parameter Alignment for Persistent Backdoor Attacks on Federated Learning (ICML 2026 · similarity 0.89)
• Resisting Backdoor Attacks in Federated Learning via Bidirectional Elections and Individual Perspective (AAAI 2024 · similarity 0.88)
• FedREDefense: Defending against Model Poisoning Attacks for Federated Learning using Model Update Reconstruction Error (ICML 2024 · similarity 0.88)
• Model Poisoning Attacks to Federated Learning via Multi-Round Consistency (CVPR 2025 · similarity 0.87)
• Beyond Traditional Threats: A Persistent Backdoor Attack on Federated Learning (AAAI 2024 · similarity 0.87)
• MARS: A Malignity-Aware Backdoor Defense in Federated Learning (NeurIPS 2025 · similarity 0.87)