A Multi-Layer Aggregation Backdoor Defense Framework for Federated Learning

Federated learning (FL), due to its distributed architecture and invisibility of training data, is susceptible to malicious clients submitting toxic model updates to manipulate the aggregation process of servers, known as backdoor attacks. In order to avoid or mitigate backdoor attacks, this paper proposes a multi-layer aggregation backdoor defense framework (MABDF) for federated learning, which ensures the secure aggregation of the model through adaptive similarity filtering, pruning mean aggregation, and subspace robust projection methods. This framework is mainly divided into three layers: in the first layer, the server calculates the pairwise cosine similarity between model updates uploaded by the client, compares the pairwise cosine similarity with dynamic thresholds generated based on median and standard deviation to detect suspicious updates, and effectively filters out explicit malicious updates; In the second layer, the server applies the pruning mean aggregation algorithm to the updates obtained after filtering in the first layer, further detecting and eliminating the influence of local parameter tampering and hidden gradient operations on the model. In the third layer, the server projects the updates from the upper layer onto the low rank subspace through singular value decomposition (SVD), reconstructs all updates, and suppresses the activation of backdoor neurons from the feature space level. The experimental results on the benchmark dataset show that compared with other classic backdoor defense methods, this framework reduces the success rate of backdoor attacks to below 3 % while maintaining a model accuracy decrease of no more than 1.5 %.