FLPurifier: Backdoor Defense in Federated Learning via Decoupled Contrastive Training

Recent studies have demonstrated that backdoor attacks can cause a significant security threat to federated learning. Existing defense methods mainly focus on detecting or eliminating the backdoor patterns after the model is backdoored. However, these methods either cause model performance degradation or heavily rely on impractical assumptions, such as labeled clean data, which exhibit limited effectiveness in federated learning. To this end, we propose FLPurifier, a novel backdoor defense method in federated learning that can effectively purify the possible backdoor attributes before federated aggregation. Specifically, FLPurifier splits a complete model into a feature extractor and classifier, in which the extractor is trained in a decoupled contrastive manner to break the strong correlation between trigger features and the target label. Compared with existing backdoor mitigation methods, FLPurifier doesn’t rely on impractical assumptions since it can effectively purify the backdoor effects in the training process rather than an already trained model. Moreover, to decrease the negative impact of backdoored classifiers and improve global model accuracy, we further design an adaptive classifier aggregation strategy to dynamically adjust the weight coefficients. Extensive experimental evaluations on six benchmark datasets demonstrate that FLPurifier is effective against known backdoor attacks in federated learning with negligible performance degradation and outperforms the state-of-the-art defense methods.

I. Introduction

Federated learning (FL) is an emerging collaborative learning paradigm that improves privacy by enabling clients to keep their training data locally. Particularly, it enables machine learning models to be continuously improved and optimized through distributed and localized training [1], [2]. Despite its benefits, FL has been demonstrated to be vulnerable to backdoor attacks. Backdoor attacks are a typical adversarial attack type on deep neural networks (DNNs). Gu et al. [3] first explored backdoor attacks, known as Badnets, for DNNs. During training, attackers embed hidden backdoor triggers in DNNs, enabling normal classification on benign samples. However, activating the hidden backdoor trigger causes the model to output the attacker’s desired label. The backdoor attack was first introduced in FL by Bagdasaryan et al. [4]. The goal of the adversary is to plant backdoors in their local model such that the backdoored model will be aggregated into the global model, further inheriting the backdoor logic. Since the universal participation principle and invisible training procedure, backdoor attacks in FL emerge more destructive effects [5], [6], [7], [8], [9].