Research map / Federated learning and privacy / Privacy attacks and secure learning
Parameter Disparities Dissection for Backdoor Defense in Heterogeneous Federated Learning
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes FDCR, a Fisher-information-based defense that clusters client gradient discrepancies to exclude backdoor attackers and rescales important parameters during aggregation, for heterogeneous federated learning.
Problem
Backdoor attacks by malicious federated clients in heterogeneous (non-IID) settings, where existing defenses need homogeneous data, validation sets, or client optimization compliance.
Approach
Benign heterogeneous and malicious triggered distributions assign different importance to parameters; the method estimates per-client diagonal Fisher information, reweights client updates by it, clusters gradient discrepancies (FINCH) to drop outlier clients, and rescales parameter updates by a sigmoid of importance during aggregation.
Key results
- On CIFAR-10 with beta=0.3 and 30% malicious clients, FDCR outperforms the best counterpart by 9.17% on the V metric.
- FDCR reaches V=78.06 on CIFAR-10 (beta=0.5, 30% malicious) versus 75.12 for the best baseline DnC.
- Ablation shows removing the Fisher importance weighting (w/o Ik) drops CIFAR-10 V from 76.54 to 43.52 at beta=0.5 scenario.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use FDCR instead of the strongest listed baseline | Federated backdoor defense · Cifar-10, β = 0.5, Υ = 30% | V: 75.12 -> 78.06 | Helped |
| Use FDCR instead of the strongest listed baseline | Federated backdoor defense · Cifar-10, β = 0.3, Υ = 30% | V: 68.25 -> 77.42 | Helped |
| Use FDCR instead of the strongest listed baseline | Federated backdoor defense · Fashion-MNIST, β = 0.5, Υ = 30% | V: 88.43 -> 87.62 | Hurt |
| Use FDCR instead of the strongest listed baseline | Federated backdoor defense · Fashion-MNIST, β = 0.3, Υ = 30% | V: 82.92 -> 87.60 | Helped |
| Use FDCR instead of the strongest listed baseline | Federated backdoor defense · USPS, β = 0.5, Υ = 30% | V: 91.22 -> 92.57 | Helped |
| Use FDCR instead of the strongest listed baseline | Federated backdoor defense · USPS, β = 0.3, Υ = 30% | V: 88.97 -> 86.62 | Hurt |
| Add both FCDC and FPRA (ablation) | FDCR · Cifar-10, β = 0.5, Υ = 30% | V: 52.65 -> 78.06 | Helped |
| Add both FCDC and FPRA (ablation) | FDCR · Cifar-10, β = 0.3, Υ = 30% | V: 53.40 -> 77.42 | Helped |
| Add both FCDC and FPRA (ablation) | FDCR · Fashion-MNIST, β = 0.5, Υ = 30% | V: 43.70 -> 87.62 | Helped |
| Add both FCDC and FPRA (ablation) | FDCR · Fashion-MNIST, β = 0.3, Υ = 30% | V: 44.62 -> 87.60 | Helped |
| Add FPRA to FCDC (ablation) | FDCR · Cifar-10, β = 0.5, Υ = 30% | V: 76.54 -> 78.06 | Helped |
| Add FPRA to FCDC (ablation) | FDCR · Fashion-MNIST, β = 0.5, Υ = 30% | V: 74.36 -> 87.62 | Helped |
Surprising findings
- Several distance-based and statistical defenses (e.g., Multi-Krum, Trim Median, Bulyan) collapse under heterogeneity, with Trim Median and Bulyan reaching 100% backdoor success on Fashion-MNIST.
Limitations
- Does not remove backdoor parameters already present in the global model; only mitigates during aggregation.
- Relies on heuristic clustering and assumes malicious clients' discrepancy can be separated; evaluated only on small image benchmarks with a CNN.
- Experiments use a single simple trigger pattern and label-skew heterogeneity only.
Experimental setup
Datasets: CIFAR-10 MNIST Fashion-MNIST USPS
Benchmarks: CIFAR-10 Fashion-MNIST USPS
Metrics: benign accuracy A backdoor failure rate R combined trade-off score V
Baselines: Multi Krum FoolsGold RLR DnC MMA Trim Median Bulyan RFA FLTrust Sageflow Finetuning CRFL
Builds on: FedAvg FLTrust FINCH Multi-Krum FedProx
Closest papers by meaning
- MARS: A Malignity-Aware Backdoor Defense in Federated Learning (NeurIPS 2025 · similarity 0.89)
- Beyond Traditional Threats: A Persistent Backdoor Attack on Federated Learning (AAAI 2024 · similarity 0.88)
- Resisting Backdoor Attacks in Federated Learning via Bidirectional Elections and Individual Perspective (AAAI 2024 · similarity 0.88)
- Infighting in the Dark: Multi-Label Backdoor Attack in Federated Learning (CVPR 2025 · similarity 0.87)
- SPMC: Self-Purifying Federated Backdoor Defense via Margin Contribution (ICML 2025 · similarity 0.87)
- Backdoor Federated Learning by Poisoning Backdoor-Critical Layers (ICLR 2024 · similarity 0.87)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.