FL-PLAS: Federated Learning with Partial Layer Aggregation for Backdoor Defense Against High-Ratio Malicious Clients

TL;DR

FL-PLAS introduces partial layer aggregation for backdoor defense in federated learning by aggregating only the feature extractor (FE) layers at the server while preserving each client’s classifier (CL). This isolation prevents backdoor neurons from propagating across benign clients and eliminates the need for auxiliary server data. Across MNIST, CIFAR-10, and CIFAR-100, FL-PLAS achieves strong robustness against trigger, semantic, and edge-case attacks, maintaining high main-task accuracy even with up to 90% malicious clients. The approach offers privacy-preserving, efficient defense with practical applicability in distributed, non-IID settings, and opens avenues for extending to other modalities and personalized learning contexts.

Abstract

Federated learning (FL) is gaining increasing attention as an emerging collaborative machine learning approach, particularly in the context of large-scale computing and data systems. However, the fundamental algorithm of FL, Federated Averaging (FedAvg), is susceptible to backdoor attacks. Although researchers have proposed numerous defense algorithms, two significant challenges remain. The attack is becoming more stealthy and harder to detect, and current defense methods are unable to handle 50\% or more malicious users or assume an auxiliary server dataset. To address these challenges, we propose a novel defense algorithm, FL-PLAS, \textbf{F}ederated \textbf{L}earning based on \textbf{P}artial\textbf{ L}ayer \textbf{A}ggregation \textbf{S}trategy. In particular, we divide the local model into a feature extractor and a classifier. In each iteration, the clients only upload the parameters of a feature extractor after local training. The server then aggregates these local parameters and returns the results to the clients. Each client retains its own classifier layer, ensuring that the backdoor labels do not impact other clients. We assess the effectiveness of FL-PLAS against state-of-the-art (SOTA) backdoor attacks on three image datasets and compare our approach to six defense strategies. The results of the experiment demonstrate that our methods can effectively protect local models from backdoor attacks. Without requiring any auxiliary dataset for the server, our method achieves a high main-task accuracy with a lower backdoor accuracy even under the condition of 90\% malicious users with the attacks of trigger, semantic and edge-case.

Figures (8)

• Figure 1: Illustration of the three steps in one iteration of FL. There are $N$ clients and a server. Each client has different classes and sizes of data, representing the heterogeneous distribution of client data.
• Figure 2: Illustration of FL-PLAS workflow in round $t$.
• Figure 3: BA of various datasets under the trigger attack. \ref{['fig:bamnist']} depicts how the BA of MNIST changes against different ratios of malicious clients; \ref{['fig:baCIFAR10']} depicts how the BA of CIFAR-10 changes; and \ref{['fig:baCIFAR100']} depicts how the BA of CIFAR-100 changes.
• Figure 4: BA of CIFAR-10 in two new types of attacks. \ref{['fig:baseman']} shows semantic attack, \ref{['fig:baedge']} shows edge-case attack.
• Figure 5: MA of datasets in trigger attacks. \ref{['fig:mamnist']} shows how the MA of MNIST changes, \ref{['fig:maCIFAR10']} shows how MA of CIFAR-10 changes, and \ref{['fig:maCIFAR100']} shows how MA of CIFAR-100 changes.