Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Mitigating Backdoor Attacks in Federated Learning Using PPA and MiniMax Game Theory

Osama Wehbi, Sarhad Arisdakessian, Omar Abdel Wahab, Anderson Avila, Azzam Mourad, Hadi Otrok

Abstract

Federated Learning (FL) is witnessing wider adoption due to its ability to benefit from large amounts of scattered data while preserving privacy. However, despite its advantages, federated learning suffers from several setbacks that directly impact the accuracy, and the integrity of the global model it produces. One of these setbacks is the presence of malicious clients who actively try to harm the global model by injecting backdoor data into their local models while trying to evade detection. The objective of such clients is to trick the global model into making false predictions during inference, thereby compromising the integrity and trustworthiness of the global model on which honest stakeholders rely. To mitigate such mischievous behavior, we propose FedBBA (Federated Backdoor and Behavior Analysis). The proposed model aims to dampen the effect of such clients on the final accuracy, creating more resilient federated learning environments. We engineer our approach through the combination of (1) a reputation system to evaluate and track client behavior, (2) an incentive mechanism to reward honest participation and penalize malicious behavior, and (3) game theoretical models with projection pursuit analysis (PPA) to dynamically identify and minimize the impact of malicious clients on the global model. Extensive simulations on the German Traffic Sign Recognition Benchmark (GTSRB) and Belgium Traffic Sign Classification (BTSC) datasets demonstrate that FedBBA reduces the backdoor attack success rate to approximately 1.1%--11% across various attack scenarios, significantly outperforming state-of-the-art defenses like RDFL and RoPE, which yielded attack success rates between 23% and 76%, while maintaining high normal task accuracy (~95%--98%).

Mitigating Backdoor Attacks in Federated Learning Using PPA and MiniMax Game Theory

Abstract

Federated Learning (FL) is witnessing wider adoption due to its ability to benefit from large amounts of scattered data while preserving privacy. However, despite its advantages, federated learning suffers from several setbacks that directly impact the accuracy, and the integrity of the global model it produces. One of these setbacks is the presence of malicious clients who actively try to harm the global model by injecting backdoor data into their local models while trying to evade detection. The objective of such clients is to trick the global model into making false predictions during inference, thereby compromising the integrity and trustworthiness of the global model on which honest stakeholders rely. To mitigate such mischievous behavior, we propose FedBBA (Federated Backdoor and Behavior Analysis). The proposed model aims to dampen the effect of such clients on the final accuracy, creating more resilient federated learning environments. We engineer our approach through the combination of (1) a reputation system to evaluate and track client behavior, (2) an incentive mechanism to reward honest participation and penalize malicious behavior, and (3) game theoretical models with projection pursuit analysis (PPA) to dynamically identify and minimize the impact of malicious clients on the global model. Extensive simulations on the German Traffic Sign Recognition Benchmark (GTSRB) and Belgium Traffic Sign Classification (BTSC) datasets demonstrate that FedBBA reduces the backdoor attack success rate to approximately 1.1%--11% across various attack scenarios, significantly outperforming state-of-the-art defenses like RDFL and RoPE, which yielded attack success rates between 23% and 76%, while maintaining high normal task accuracy (~95%--98%).

Paper Structure

This paper contains 34 sections, 1 theorem, 32 equations, 4 figures, 2 tables, 2 algorithms.

Table of Contents

  1. Introduction
  2. Contributions
  3. Paper Outline
  4. Related Work
  5. SYSTEM PRELIMINARIES
  6. Federated Learning
  7. Projection Pursuit Analysis and Kurtosis
  8. Problem Formulation
  9. Backdoor Attack Models
  10. One-to-One Attack
  11. One-to-N Attack
  12. N-to-One Attack
  13. Attack Execution Strategies
  14. Multiple Rounds with Backdoored Updates
  15. Model Replacement
  16. ...and 19 more sections

Key Result

Theorem 1

The surrogate game $\tilde{\mathcal{G}}$ (see Remark 1) admits at least one Nash saddle-point equilibrium $(\lambda^*, \boldsymbol{\rho}^*)$, constituting an approximate equilibrium of the original game $\mathcal{G}$.

Figures (4)

  • Figure 1: Comparison of model clustering using PPA vs. PCA. PPA shows clearer separation between benign (black) and backdoored (blue) models.
  • Figure 2: Architectural workflow of the proposed Minimax game.
  • Figure 3: Normal task accuracy comparison of RDFL, Vanilla, FedBBA, and RoPE across datasets and attack settings over 100 communication rounds.
  • Figure 4: Backdoor success rate comparison of RDFL, Vanilla, FedBBA, and RoPE across datasets and attack scenarios over 100 communication rounds.

Theorems & Definitions (3)

  • Remark 1: Approximation and validity
  • Theorem 1: Existence of a Nash Saddle-Point Equilibrium
  • proof