Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

BackdoorIndicator: Leveraging OOD Data for Proactive Backdoor Detection in Federated Learning

Songze Li, Yanbo Dai

TL;DR

This work tackles the challenge of proactive backdoor detection in federated learning by exploiting the OOD nature of backdoor samples. It introduces BackdoorIndicator, which injects an indicator task trained on out-of-distribution data and uses BN-statistics correction to evaluate indicator accuracy on uploaded models; updates that maintain high indicator performance are flagged as suspicious. Through extensive experiments on CIFAR10/100 and EMNIST across multiple architectures and attack settings, BackdoorIndicator consistently achieves higher true positive rates and lower backdoor accuracy than state-of-the-art defenses, with modest computational overhead. The approach is complementary to existing defenses and demonstrates practical viability for real-world FL deployments, while also enabling future theoretical analysis of the indicator-based detection paradigm.

Abstract

In a federated learning (FL) system, decentralized data owners (clients) could upload their locally trained models to a central server, to jointly train a global model. Malicious clients may plant backdoors into the global model through uploading poisoned local models, causing misclassification to a target class when encountering attacker-defined triggers. Existing backdoor defenses show inconsistent performance under different system and adversarial settings, especially when the malicious updates are made statistically close to the benign ones. In this paper, we first reveal the fact that planting subsequent backdoors with the same target label could significantly help to maintain the accuracy of previously planted backdoors, and then propose a novel proactive backdoor detection mechanism for FL named BackdoorIndicator, which has the server inject indicator tasks into the global model leveraging out-of-distribution (OOD) data, and then utilizing the fact that any backdoor samples are OOD samples with respect to benign samples, the server, who is completely agnostic of the potential backdoor types and target labels, can accurately detect the presence of backdoors in uploaded models, via evaluating the indicator tasks. We perform systematic and extensive empirical studies to demonstrate the consistently superior performance and practicality of BackdoorIndicator over baseline defenses, across a wide range of system and adversarial settings.

BackdoorIndicator: Leveraging OOD Data for Proactive Backdoor Detection in Federated Learning

TL;DR

This work tackles the challenge of proactive backdoor detection in federated learning by exploiting the OOD nature of backdoor samples. It introduces BackdoorIndicator, which injects an indicator task trained on out-of-distribution data and uses BN-statistics correction to evaluate indicator accuracy on uploaded models; updates that maintain high indicator performance are flagged as suspicious. Through extensive experiments on CIFAR10/100 and EMNIST across multiple architectures and attack settings, BackdoorIndicator consistently achieves higher true positive rates and lower backdoor accuracy than state-of-the-art defenses, with modest computational overhead. The approach is complementary to existing defenses and demonstrates practical viability for real-world FL deployments, while also enabling future theoretical analysis of the indicator-based detection paradigm.

Abstract

In a federated learning (FL) system, decentralized data owners (clients) could upload their locally trained models to a central server, to jointly train a global model. Malicious clients may plant backdoors into the global model through uploading poisoned local models, causing misclassification to a target class when encountering attacker-defined triggers. Existing backdoor defenses show inconsistent performance under different system and adversarial settings, especially when the malicious updates are made statistically close to the benign ones. In this paper, we first reveal the fact that planting subsequent backdoors with the same target label could significantly help to maintain the accuracy of previously planted backdoors, and then propose a novel proactive backdoor detection mechanism for FL named BackdoorIndicator, which has the server inject indicator tasks into the global model leveraging out-of-distribution (OOD) data, and then utilizing the fact that any backdoor samples are OOD samples with respect to benign samples, the server, who is completely agnostic of the potential backdoor types and target labels, can accurately detect the presence of backdoors in uploaded models, via evaluating the indicator tasks. We perform systematic and extensive empirical studies to demonstrate the consistently superior performance and practicality of BackdoorIndicator over baseline defenses, across a wide range of system and adversarial settings.
Paper Structure (19 sections, 2 equations, 2 figures, 16 tables, 1 algorithm)

This paper contains 19 sections, 2 equations, 2 figures, 16 tables, 1 algorithm.

Table of Contents

  1. Introduction
  2. Background
  3. Federated Averaging
  4. Backdoor Training Algorithms in FL
  5. Backdoor Defenses in FL
  6. Motivation and Overview of Solution
  7. BackdoorIndicator
  8. Threat Model
  9. Key Intuition
  10. Detailed Methodology
  11. Evaluation
  12. Experiment Setup
  13. Detection Performance
  14. Impact of Hyper-parameters
  15. Resilience to Adaptive Attacks
  16. ...and 4 more sections

Figures (2)

  • Figure 1: Accuracy of backdoor $\mathcal{A}$ task with (Left) and without (Right) backdoor $\mathcal{B}$ task involved after iteration $t_\mathcal{B}$.
  • Figure 2: Accuracy of backdoor $\mathcal{A}$ with (Left) and without (Right) backdoor $\mathcal{B}$ involved after iteration $t_\mathcal{B}$. BN statistics are replaced with the estimated statistics in iteration $t_\mathcal{B}-1$.