Defending Against Backdoor Attacks with Feature Activation-Based Detection and Model Recovery

The characteristics of Federated Learning (FL) make FL highly susceptible to malicious poisoning attacks from adversaries. Existing FL defense methods can detect attacks of fixed poisoning patterns, hence are lack of flexibility. Additionally, they typically remove the malicious node models upon detection, leading to a certain degree of data loss. To address these issues, we propose a novel defense method against backdoor attacks in FL systems, effectively enhancing their robustness to malicious poisoning attacks. Specifically, we introduce a malicious update detection method based on feature activation matrices. This method compares the distribution differences of updates from different clients on the same validation data and detects malicious clients based on the outlier rates of their updates. Furthermore, to mitigate the data loss caused by the removal of malicious clients, the server assesses the distance between the distribution of feature activation matrices from the client’s historical updates and the overall model distribution in the current iteration. Based on this distance, the server performs model recovery to a certain extent. Extensive experiments on two benchmark datasets demonstrate that our method accurately detects malicious clients under various state-of-the-art model poisoning attacks. Additionally, the model recovery method provides a notable improvement to the system, ensuring the robustness and performance of the FL system.