Search papers, labs, and topics across Lattice.
SCRUB-FL introduces a two-phase solution for mitigating backdoor attacks in Federated Learning by employing spectral analysis and activation clustering to identify suspicious samples during training. This method utilizes lightweight Wasserstein Generative Adversarial Networks to capture trigger-related distributions, allowing the server to synthesize trigger-approximating samples post-training. Experimental results show that SCRUB-FL effectively reduces backdoor attack success rates to as low as 3.88% while preserving over 91% accuracy on normal tasks, outperforming existing defenses without needing prior knowledge of triggers or extensive clean datasets.
Backdoor attack success rates plummet to 3.88% with SCRUB-FL, all while maintaining over 91% accuracy on legitimate tasks.
Federated Learning (FL) enables collaborative model training without sharing raw data, making it a promising paradigm for privacy-sensitive applications. However, its decentralized nature makes it inherently vulnerable to backdoor attacks, where malicious clients embed hidden triggers into local training data to manipulate model predictions. Existing defenses mainly operate during before and during aggregation cannot fully eliminate backdoor behaviors that persist in the converged global model. Moreover, the effectiveness of post-training sanitization is often limited by the server's lack of knowledge of trigger patterns or poisoned clients after convergence, resulting in residual backdoor behaviors or accuracy degradation due to neuron entanglement. To address this limitation, we propose SCRUB-FL (Sanitizing and Cleansing Representations via Unlearning of Backdoors), a two-phase solution for post-training backdoor removal in FL. During training, clients identify suspicious samples using spectral analysis and activation clustering, then train lightweight Wasserstein Generative Adversarial Network with Gradient Penalty (WGAN-GP) models to capture trigger-related distributions. The generator parameters are aggregated server-side to construct a global representation of suspicious patterns without exposing raw data. After convergence, the server synthesizes trigger-approximating samples and applies machine unlearning to erase the trigger-target association by redistributing predictions toward a uniform distribution. Experimental evaluations on CIFAR-10 and GTSRB across three attack types and up to 40% malicious participation demonstrate that SCRUB-FL reduces the backdoor attack success rate to as low as 3.88% while maintaining over 91% normal task accuracy, outperforming state-of-the-art defenses without requiring prior trigger knowledge or a large clean proxy dataset at the server.
