Defending Against Backdoor Attacks in Federated Learning: A Triple-Phase Client-Side Approach

Federated Learning (FL) enables collaborative training among multiple data owners without direct sharing of users’ local data, which not only protects user privacy but also enhances model performance. However, due to the invisibility of local model training processes to the aggregation server, FL is vulnerable to Byzantine attacks and backdoor attacks initiated by adversaries. Backdoor attacks are highly covert and difficult to detect, thus posing significant threats to model security. Current backdoor attack defense mechanisms frequently fail to adequately account for the sophisticated capabilities of adversaries and the heterogeneous nature of data distributions encountered in practical deployment environments. Conventional defense approaches relying on singular evaluation metrics exhibit notable limitations when confronting highly self-adaptive adversarial attacks, with their defensive efficacy being particularly compromised under non-independent and identically distributed (Non-IID) data conditions. To overcome these limitations, we present a novel multi-metric cascading defense framework against backdoor attacks in federated learning systems. The proposed methodology systematically integrates five complementary yet mutually constraining evaluation metrics that collectively capture different aspects of model behavior. Through layer-wise feature extraction from distributed local models and adaptive threshold determination via rigorous statistical hypothesis testing, our framework achieves robust detection of both static and adaptive backdoor attacks. Comprehensive experimental evaluations confirm that the proposed solution maintains detection efficacy against sophisticated adversarial strategies while preserving the baseline accuracy of the global model.

Federated Learning (FL) is vulnerable to backdoor attacks—especially distributed backdoor attacks (DBA) that are more persistent and stealthy than centralized backdoor attacks. However, we observe that the attack effectiveness of DBA can be largely reduced when encountering rebels, i.e., the agents promising to perform the attack but do not do so. To robustify DBAs, we present SSRDBA , a secret sharing-inspired robust DBA to FL. To be specific, given a same global trigger as DBA, SSRDBA carefully divides it into different shares based on secret sharing and exploits these shares to poison local data on malicious devices, respectively. SSRDBA enjoys several merits, e.g., only partial malicious agents guarantee the reconstruction of the global trigger. Extensive experimental results show that SSRDBA is more robust to rebels than DBA and can evade the state-of-the-art FL defenses mainly for centralized backdoor attacks. To mitigate SSRDBA , we further design a novel defense mechanism, termed NFDR, which shows great potential against SSRDBA on certain independent identically distributed datasets.

Federated learning (FL) is an emerging machine learning paradigm. With FL, distributed data owners aggregate their model updates to train a shared deep neural network collaboratively, while keeping the training data locally. However, FL has little control over the local data and the training process. Therefore, it is susceptible to poisoning attacks, in which malicious or compromised clients use malicious training data or local updates as the attack vector to poison the trained global model. Moreover, the performance of existing detection and defense mechanisms drops significantly in a scaled-up FL system with non-iid data distributions. In this paper, we propose a defense scheme named CONTRA to defend against poisoning attacks, e.g., label-flipping and backdoor attacks, in FL systems. CONTRA implements a cosine-similarity-based measure to determine the credibility of local model parameters in each round and a reputation scheme to dynamically promote or penalize individual clients based on their per-round and historical contributions to the global model. With extensive experiments, we show that CONTRA significantly reduces the attack success rate while achieving high accuracy with the global model. Compared with a state-of-the-art (SOTA) defense, CONTRA reduces the attack success rate by 70% and reduces the global model performance degradation by 50%.

Graph neural networks (GNNs) have gained significant popularity as powerful deep learning methods for processing graph data. However, centralized GNNs face challenges in data-sensitive scenarios due to privacy concerns and regulatory restrictions. Federated learning has emerged as a promising technology that enables collaborative training of a shared global model while preserving privacy. Although federated learning has been applied to train GNNs, no research focuses on the robustness of Federated GNNs against backdoor attacks. This article bridges this research gap by investigating two types of backdoor attacks in Federated GNNs: centralized backdoor attack (CBA) and distributed backdoor attack (DBA). Through extensive experiments, we demonstrate that DBA exhibits a higher success rate than CBA across various scenarios. To further explore the characteristics of these backdoor attacks in Federated GNNs, we evaluate their performance under different scenarios, including varying numbers of clients, trigger sizes, poisoning intensities, and trigger densities. Additionally, we explore the resilience of DBA and CBA against two defense mechanisms. Our findings reveal that both defenses cannot eliminate DBA and CBA without affecting the original task. This highlights the necessity of developing tailored defenses to mitigate the novel threat of backdoor attacks in Federated GNNs.

Federated Learning (FL) provides enhanced privacy over traditional centralized learning; unfortunately, it is also as susceptible to backdoor attacks, just like its centralized counterpart. Conventionally, in data poisoning-based backdoor attacks, all the malicious participants overlay the same single trigger pattern on a subset of their private data during local training. The same trigger is used to induce the backdoor in the otherwise benign global model at inference time. Such single trigger attacks can be detected and removed with relative ease as they undermine the distributed nature of FL. In this work, we focus on building an attack scheme where each batch of malicious clients uses sizably discrete local triggers during local training, with the ability to invoke the attack with a single small inference trigger during the global model testing. The larger size of the trigger pattern ensures prolonged attack longevity even after the termination of the attack. We conduct extensive experiments to show that our approach is far faster, stealthier, and more effective than the centralized trigger approach. The stealthiness of our work is explained using the DeepLIFT visual feature interpretation method.

Federated learning (FL) is currently the most widely adopted framework for collaborative training of (deep) machine learning models under privacy constraints. Albeit its popularity, it has been observed that FL yields suboptimal results if the local clients' data distributions diverge. To address this issue, we present clustered FL (CFL), a novel federated multitask learning (FMTL) framework, which exploits geometric properties of the FL loss surface to group the client population into clusters with jointly trainable data distributions. In contrast to existing FMTL approaches, CFL does not require any modifications to the FL communication protocol to be made, is applicable to general nonconvex objectives (in particular, deep neural networks), does not require the number of clusters to be known a priori, and comes with strong mathematical guarantees on the clustering quality. CFL is flexible enough to handle client populations that vary over time and can be implemented in a privacy-preserving way. As clustering is only performed after FL has converged to a stationary point, CFL can be viewed as a postprocessing method that will always achieve greater or equal performance than conventional FL by allowing clients to arrive at more specialized models. We verify our theoretical analysis in experiments with deep convolutional and recurrent neural networks on commonly used FL data sets.

Federated Learning (FL) is considered to be a suitable mechanism for privacy-preserving and distributed machine learning. While preserving decentralized data, it simultaneously protects global parameter updates. However, with all this advantage, FL reduces many security provisions thus opening a gateway for adversary AI. Here the adversary can manipulate local model updates or poison decentralized training data, hijacking the system. Some challenges that come up include model poisoning, backdoor attacks, andgradient inversion, which would greatly compromise the reliability, privacy, and trustworthiness of FL systems. This paper traces an examination of various adversarial threats in FL and the robust mechanisms for defense against these adversities. Discussed in the study were various methods such as robust aggregation techniques, anomaly detection, and differential privacy for the protection of federated systems. Further, the integration of explainable artificial intelligence (XAI) was recommended to increase the transparency, trust, and accountability of the decentralized decision-making process. The necessity of intertwining adversarial robustness with explainability for constructing federated AI systems that are secure, transparent, and trustworthy has been discussed.

There is a exponential growth of data usage, specially due to the proliferation of connected applications with personalized models for different applications. In this context, Federated Learning (FL) emerges as a promising solution to enable collaborative model training while preserving the privacy and autonomy of participating clients. In a typical FL scenario, clients exhibit significant heterogeneity in terms of data distribution and hardware configurations. In this way, randomly sampling clients in each training round may not fully exploit the local updates from heterogeneous clients, resulting in lower model accuracy, slower convergence rate, degraded fairness, etc. In addition, malicious users could disseminate incorrect weights, which may decrease the accuracy of aggregated models and increase the time for convergence in FL. In this article, we introduce Resilience-aware Client Selection Mechanism for non-IID data and malicious clients in FL environment, called RICA. The proposed mechanism employs data size and entropy as criteria for client selection. In addition, RICA relies Centroid-Based Kernel Alignment (CKA) to identify and exclude potentially malicious clients. Our evaluation shows an improvement of 125% in Accuracy values in a scenario of malicious clients, which means the RICA+CKA demonstrates a more stable and resilient approach, reaching 90% accuracy in a few rounds compared to the default average approach, reached only around 30%. Therefore, results of the behavior of RICA+CKA in different datasets show the evaluation of different numbers of clients reaching around 90% while the other approach does not pass the 50% Accuracy.

This systematic review examines the role of federated learning (FL) as a privacy-preserving paradigm for enterprise decision systems, synthesizing evidence from 187 peer-reviewed studies. Guided by the Preferred Reporting Items for Systematic Reviews and Meta-Analyses (PRISMA) framework, the review integrates algorithmic, systems, security, sectoral, and governance perspectives to provide a comprehensive account of current knowledge. Findings highlight that foundational algorithms such as FedAvg, FedProx, and SCAFFOLD dominate the methodological landscape, with significant adaptations emerging to address non-IID and unbalanced datasets across distributed organizational silos. Privacy-preserving mechanisms—including differential privacy, secure aggregation, homomorphic encryption, and multiparty computation—were consistently applied as layered defenses, balancing mathematical guarantees with empirical resilience. The synthesis further revealed critical vulnerabilities to model poisoning, backdoor attacks, and gradient leakage, alongside defensive strategies such as robust aggregation, anomaly detection, and differential privacy clipping. Sector-specific implementations demonstrate FL’s practical utility in healthcare, finance, retail, logistics, telecommunications, and public services, where it enables collaborative modeling without violating data residency or confidentiality requirements. Governance and ethical frameworks, particularly GDPR, CCPA, and the NIST Privacy Framework, were found to shape deployment practices, while documentation artifacts such as datasheets, model cards, and privacy budget ledgers ensure accountability and transparency. Comparative surveys position FL as an integrative socio-technical architecture that unites distributed optimization, privacy engineering, adversarial robustness, and AI governance into a coherent enterprise-ready model. The review concludes that federated learning provides enterprises with a scalable, secure, and ethically aligned approach to leveraging distributed data while preserving trust and compliance.

In federated learning (FL), clients collectively train a global machine learning model with their own local data. Without sharing sensitive raw data, each client in FL only sends updated weights to consider privacy and security concerns. Most of existing FL works focus mainly on improving model accuracy and training time, but only a few works focus on FL incentive mechanisms. To build a high performance model after FL training, clients need to provide high quality and large amounts of data. However, in real FL scenarios, high-quality clients are reluctant to participate in FL process without reasonable compensation, because clients are self-interested and other clients can be business competitors. Even participation incurs some cost for contributing to the FL model with their local dataset. To address this problem, we propose TIFF, a novel tokenized incentive mechanism, where tokens are used as a means of paying for the services of providing participants and the training infrastructure. Without payment delays, participation can be monetized as both providers and consumers, which promotes continued long-term participation of high-quality data parties. Additionally, paid tokens are reimbursed to each client as consumers according to our newly proposed metrics (such as token reduction ratio and utility improvement ratio), which keeps clients engaged in FL process as consumers. To measure data quality, accuracy is calculated in training without additional overheads. We leverage historical accuracy records and random exploration to select high-utility participants and to prevent overfitting. Results show that TIFF provides more tokens to normal providers by up to 6.9% and less tokens to malicious providers by up to 18.1%, achieving improvement of the final model accuracy by up to 7.4%, compared to the default approach.

Federated learning (FL) is known to be susceptible to model poisoning attacks in which malicious clients hamper the accuracy of the global model by sending manipulated model updates to the central server during the FL training process. Existing defenses mainly focus on Byzantine-robust FL aggregations, and largely ignore the impact of the underlying deep neural network (DNN) that is used to FL training. Inspired by recent findings on critical learning periods (CLP) in DNNs, where small gradient errors have irrecoverable impact on the final model accuracy, we propose a new defense, called a CLP-aware defense against poisoning of FL (DeFL). The key idea of DeFL is to measure fine-grained differences between DNN model updates via an easy-to-compute federated gradient norm vector (FGNV) metric. Using FGNV, DeFL simultaneously detects malicious clients and identifies CLP, which in turn is leveraged to guide the adaptive removal of detected malicious clients from aggregation. As a result, DeFL not only mitigates model poisoning attacks on the global model but also is robust to detection errors. Our extensive experiments on three benchmark datasets demonstrate that DeFL produces significant performance gain over conventional defenses against state-of-the-art model poisoning attacks.

Federated learning (FL) is a distributed machine learning paradigm in which clients collaboratively train models in a privacy-preserving manner. While centralized FL (CFL) suffers from single points of failure and performance bottlenecks, decentralized FL (DFL), which depends on inter-client communication, has emerged to eliminate the need of a central entity. However, due to lack of the coordination of a central server, heterogeneous data distribution across clients makes local models in DFL inclined to diverge towards their local objectives, resulting in poor model accuracy. Moreover, each client in DFL needs to communicate with multiple neighbors, yielding a heavy communication load. To tackle these challenges, we propose a novel DFL framework called DFLStar, which can improve DFL from two perspectives. First, to avoid significantly diverging towards local data, DFLStar incorporates self-knowledge distillation to enhance the local model training by assimilating knowledge from the aggregated model. Second, clients in DFLStar identify and only select the most informative neighbors (based on the last layer model similarity) for parameter exchange, thereby minimizing the communication overhead. Our experimental results on two real datasets demonstrate that DFLStar significantly improves both communication overhead and training time compared to traditional DFL algorithms while achieving a specific target accuracy. Furthermore, within a fixed training duration, DFLStar constantly obtains the highest model accuracy compared to the baselines.

Federated learning (FL) can complete collaborative model training without transferring local data, which can greatly improve the training efficiency. However, FL is susceptible data and model backdoor attacks. To address data backdoor attack, in this article, we propose a defense method named TSF. TSF transforms data from time domain to frequency domain and subsequently designs a low-pass filter to mitigate the impact of high-frequency signals introduced by backdoor samples. Additionally, we undergo homomorphic encryption on local updates to prevent the server from inferring user’s data. We also introduce a defense method against model backdoor attack named ciphertext field similarity detect differential privacy (CFSD-DP). CFSD-DP screens malicious updates using cosine similarity detection in the ciphertext domain. It perturbs the global model using differential privacy mechanism to mitigate the impact of model backdoor attack. It can effectively detect malicious updates and safeguard the privacy of the global model. Experimental results show that the proposed TSF and CFSD-DP have 73.8% degradation in backdoor accuracy while only 3% impact on the main task accuracy compared with state-of-the-art schemes. Code is available at <uri xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">https://github.com/whwh456/TSF</uri>.

Federated Learning (FL) is a decentralised approach to training statistical models, where training is performed across multiple clients, producing one global model. Since the training data remains with each local client and is not shared or exchanged with other clients the use of FL may reduce privacy and security risks (compared to methods where multiple data sources are pooled) and can also address data access and heterogeneity problems. Synthetic data is artificially generated data that has the same structure and statistical properties as the original but that does not contain any of the original data records, therefore minimising disclosure risk. Using FL to produce synthetic data (which we refer to as "federated synthesis") has the potential to combine data from multiple clients without compromising privacy, allowing access to data that may otherwise be inaccessible in its raw format. The objective was to review current research and practices for using FL to generate synthetic data and determine the extent to which research has been undertaken, the methods and evaluation practices used, and any research gaps. A scoping review was conducted to systematically map and describe the published literature on the use of FL to generate synthetic data. Relevant studies were identified through online databases and the findings are described, grouped, and summarised. Information extracted included article characteristics, documenting the type of data that is synthesised, the model architecture and the methods (if any) used to evaluate utility and privacy risk. A total of 69 articles were included in the scoping review; all were published between 2018 and 2023 with two thirds (46) in 2022. 30% (21) were focussed on synthetic data generation as the main model output (with 6 of these generating tabular data), whereas 59% (41) focussed on data augmentation. Of the 21 performing federated synthesis, all used deep learning methods (predominantly Generative Adversarial Networks) to generate the synthetic data. Federated synthesis is in its early days but shows promise as a method that can construct a global synthetic dataset without sharing any of the local client data. As a field in its infancy there are areas to explore in terms of the privacy risk associated with the various methods proposed, and more generally in how we measure those risks.

Artificial Intelligence (AI) systems based on traditional Deep Learning (DL) are expected to play a leading role in the early detection of various diseases in healthcare applications. However, there are two major drawbacks of these systems: protecting patient privacy and obtaining sufficiently large, high-quality datasets to train reliable models. In traditional DL, collecting data from different sources on a single central server increases system complexity and raises serious privacy and security concerns. Federated Learning (FL) makes it possible to train models locally at multiple data locations while collaboratively improving a global model without exposing raw data, making it a promising architectural solution for privacy preservation. Although previous studies have reported that FL can achieve performance comparable to centralized DL approaches, traditional FL approaches often struggle to maintain consistent performance across different settings. This limitation becomes more noticeable when heterogeneous data distributions, modalities, and domains are involved. In these situations, client drift, overfitting, and generalization capability of the global model arise as major challenges. Thus, this study presents FedCycle as an incremental improvement of the FedAvg algorithm. It modifies the aggregation frequency. It aims to overcome these drawbacks and make the global model more stable and efficient. The FedCycle eliminates centralized data collection, enhances data security, and effectively reduces client drift and overfitting by supporting model training across heterogeneous data distributions, modalities, and domains. The performance evaluation involves extensive experiments using various real-world breast cancer image datasets, namely BREAKHIS, ROBOFLOW, RSNA, BUSI, and BCFPP. The presented method is evaluated against both traditional DL and FL approaches using accuracy, precision, recall, F1-score, and AUC. The findings confirm that applying fine-tuning within FedCycle reduces overfitting during training. As a result, FedCycle achieves performance improvements of 7.75% and 4.65% in accuracy and F1-score on the RSNA and BCFPP datasets compared to traditional DL approaches, while also providing an average improvement of approximately 1.5% in accuracy and F1-score across BREAKHIS, ROBOFLOW, and BUSI datasets compared to FedAvg.