Research map / Federated learning and privacy / Privacy attacks and secure learning
SPMC: Self-Purifying Federated Backdoor Defense via Margin Contribution
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes SPMC, a federated backdoor defense that uses inter-client margin contributions (cosine similarity to coalition models) to reweight server aggregation and aligns local gradients via a KL-based self-purification projection, without proxy data or predefined scaling rules.
Problem
Backdoor attacks in federated learning, where malicious clients poison the global model on targeted inputs; existing defenses rely on individual distance metrics, predefined scaling rules, or proxy/clean data, and fail when the number of attackers changes.
Approach
Approximate Shapley-style margin contribution of each client by comparing its parameters to the coalition model of the other clients (cosine similarity), reweight aggregation accordingly, and project local gradients to avoid conflicting with a KL-distilled general-knowledge gradient from the coalition model, all without a proxy dataset.
Key results
- On CIFAR-100 with gamma=0.2, SPMC reaches V=57.20 vs 46.77 for the best counterpart (FoolsGold), a 10.43-point gain on the trade-off metric.
- On CIFAR-10 with gamma=0.3, SPMC attains backdoor failure rate R=80.14 and V=72.98, versus FedAvg R=36.12 and V=50.47.
- Ablation on CIFAR-10 (gamma=0.3) shows combining LGAlign and MCAgg yields V=72.98, above either module alone (V=50.49 and 71.35).
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use SPMC instead of DnC | federated backdoor defense · CIFAR-10, γ = 0.3 | V: 61.67 -> 72.98 | Helped |
| Use SPMC instead of the strongest baseline by V | federated backdoor defense · CIFAR-100, γ = 0.2 | V: 46.77 -> 57.20 | Helped |
| Use SPMC instead of the strongest baseline by V | federated backdoor defense · MNIST, γ = 0.2 | V: 88.39 -> 70.76 | Hurt |
| Add LGAlign (ablation) | SPMC on MNIST · MNIST, γ = 0.2 | V: 50.73 -> 63.38 | Helped |
| Add MCAgg (ablation) | SPMC on MNIST · MNIST, γ = 0.2 | V: 50.73 -> 50.69 | No clear effect |
| Use both LGAlign and MCAgg (ablation) | SPMC on MNIST · MNIST, γ = 0.3 | V: 50.22 -> 77.34 | Helped |
| Add LGAlign (ablation) | SPMC · CIFAR-10, γ = 0.3 | V: 50.47 -> 71.35 | Helped |
| Add MCAgg (ablation) | SPMC · CIFAR-10, γ = 0.3 | V: 50.47 -> 50.49 | No clear effect |
| Use both LGAlign and MCAgg (ablation) | SPMC · CIFAR-10, γ = 0.3 | V: 50.47 -> 72.98 | Helped |
| Set λ = 0.2 rather than λ = 0.3 (ablation) | SPMC gradient alignment · CIFAR-10, γ = 0.3 | R: 80.14 -> 85.32 | Helped |
| Increase local epoch E from 10 to 20 (ablation) | SPMC · CIFAR-10, γ = 0.3 | V: 72.98 -> 76.01 | Helped |
| Replace cosine similarity with Euclidean distance (ablation) | SPMC margin contribution · CIFAR-10, γ = 0.3 | V: 72.98 -> 45.30 | Hurt |
Surprising findings
- On MNIST with gamma=0.2, DnC achieves R=77.77 but SPMC's main-task accuracy is slightly lower than FedAvg (98.79 vs 99.25), and on CIFAR-100 gamma=0.3 SPMC has lower main-task accuracy than FedAvg (66.12 vs 56.06 is higher, but the reported drop is labelled as a regression in the table).
Limitations
- Evaluated only on small image classification benchmarks (MNIST, FashionMNIST, CIFAR-10/100) with simple CNN and ResNet-18 backbones.
- Benign accuracy trades off against backdoor removal in some settings, e.g. SPMC main-task accuracy drops on several benchmarks relative to FedAvg.
Experimental setup
Datasets: MNIST CIFAR-10 CIFAR-100 FashionMNIST
Benchmarks: MNIST CIFAR-10 CIFAR-100 FashionMNIST
Metrics: main task accuracy backdoor failure rate trade-off V
Baselines: FoolsGold DnC Sageflow Finetuning Bulyan RFA RSA RLR CRFL
Builds on: FedAvg Shapley value FLTrust Knowledge distillation
Closest papers by meaning
- MARS: A Malignity-Aware Backdoor Defense in Federated Learning (NeurIPS 2025 · similarity 0.90)
- Beyond Traditional Threats: A Persistent Backdoor Attack on Federated Learning (AAAI 2024 · similarity 0.88)
- Backdoor Federated Learning by Poisoning Backdoor-Critical Layers (ICLR 2024 · similarity 0.87)
- Parameter Disparities Dissection for Backdoor Defense in Heterogeneous Federated Learning (NeurIPS 2024 · similarity 0.87)
- Resisting Backdoor Attacks in Federated Learning via Bidirectional Elections and Individual Perspective (AAAI 2024 · similarity 0.87)
- SADBA: Self-Adaptive Distributed Backdoor Attack Against Federated Learning (AAAI 2025 · similarity 0.87)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.