Research map / Federated learning and privacy / Privacy attacks and secure learning

Resisting Backdoor Attacks in Federated Learning via Bidirectional Elections and Individual Perspective

AAAI 2024 · Federated learning and privacy › Privacy attacks and secure learning · approach: Defending federated learning against poisoning · 19 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes Snowball, an anti-backdoor federated learning aggregation framework that uses bottom-up voting among model updates followed by top-down VAE-based enlargement of selected updates, to exclude infected updates when benign and infected updates are mixed.

Problem

Backdoor attacks in federated learning are hard to detect when benign and infected model updates are mixed and scattered due to complex non-IID data, low poisoning data ratio, and high malicious client ratio.

Approach

Shifts anomaly detection from a global view to an individual view: each model update votes for its nearest peers via layer-wise K-means and Calinski-Harabasz weighting to elect selectees, then a VAE trained on pairwise differences between selectees progressively enlarges the selected set by low reconstruction error.

Key results

• On MNIST with CBA attack, Snowball reduces backdoor accuracy to 0.21% while keeping main accuracy at 98.72%, versus 99.97% BA for FedAvg.
• On CIFAR-10 with DBA, Snowball achieves BA 2.82% and MA 74.59%, close to Ideal (2.60%, 75.34%), while Krum, FLDetector and others fail under DBA on CIFAR-10 (e.g., FLDetector BA 14.49%).
• On FEMNIST with CBA, Snowball reduces BA to 1.24% with MA 82.22%, while FLAME and Voting-Center degrade MA to about 70-74%.

Measured effects reported in the paper

Surprising findings

• Snowball's resistance degrades under extremely heterogeneous data (Dirichlet alpha=0.1) when attacker ratio is at least 20%.
• Snowball's main accuracy is not the highest among methods; it trades some MA for lower BA by excluding more updates.

Limitations

• Aggregation is more time-consuming than peer methods due to VAE training and tuning at the server.
• Performance drops under extremely heterogeneous non-IID data (alpha=0.1) with attacker ratio of 20% or more.
• Larger M raises main accuracy but risks including infected updates; M must be set conservatively (K/2).

Experimental setup

Datasets: MNIST Fashion MNIST CIFAR-10 FEMNIST Sentiment140

Benchmarks: MNIST Fashion MNIST CIFAR-10 FEMNIST Sentiment140

Metrics: backdoor task accuracy (BA) main task accuracy (MA) false positive rate false negative rate

Baselines: Krum CRFL RLR FLDetector DnC FLAME FLIP Voting-Random Voting-Center FedAvg

Builds on: FedAvg Krum FLAME DnC FLDetector

Closest papers by meaning

• Beyond Traditional Threats: A Persistent Backdoor Attack on Federated Learning (AAAI 2024 · similarity 0.89)
• MARS: A Malignity-Aware Backdoor Defense in Federated Learning (NeurIPS 2025 · similarity 0.89)
• Detecting Backdoor Attacks in Federated Learning via Direction Alignment Inspection (CVPR 2025 · similarity 0.88)
• Infighting in the Dark: Multi-Label Backdoor Attack in Federated Learning (CVPR 2025 · similarity 0.88)
• Bad-PFL: Exploiting Backdoor Attacks against Personalized Federated Learning (ICLR 2025 · similarity 0.88)
• Parameter Disparities Dissection for Backdoor Defense in Heterogeneous Federated Learning (NeurIPS 2024 · similarity 0.88)