TrojanDam: Detection-Free Backdoor Defense in Federated Learning through Proactive Model Robustification utilizing OOD Data

2025-04-22

AI Summary

In federated learning (FL), stealthy backdoor attacks evade existing detection-based defenses by crafting malicious model updates statistically indistinguishable from benign ones, enabling cumulative backdoor activation during aggregation. This work proposes a proactive defense paradigm that operates solely at the server without inspecting client updates: it continuously injects out-of-distribution (OOD) samples to activate redundant neurons in the global model, thereby inducing conflicts between benign and malicious updates on critical neurons and suppressing backdoor knowledge injection at its source. We theoretically establish, for the first time, that backdoor success stems from the absence of such benign–malicious update conflicts on redundant neurons, and we design a provably sound dynamic mapping and conflict-resolution mechanism. Experiments across diverse FL settings demonstrate that our method significantly outperforms state-of-the-art defenses against various stealthy backdoor attacks, with zero additional client-side overhead and no degradation in primary task accuracy.

Technology Category

• Machine Learning: Adversarial Learning & Robustness
• Multiagent Systems: Adversarial Agents
• Computer Vision: Adversarial Attacks & Robustness

Application Category

• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Search and Retrieval-Augmented AI: Web learning to rank, online learning, and counterfactual learning for ranking
• Graph Algorithms and Modeling for the Web: Foundation models and LLMs for Web-related graphs

Abstract

Federated learning (FL) systems allow decentralized data-owning clients to jointly train a global model through uploading their locally trained updates to a centralized server. The property of decentralization enables adversaries to craft carefully designed backdoor updates to make the global model misclassify only when encountering adversary-chosen triggers. Existing defense mechanisms mainly rely on post-training detection after receiving updates. These methods either fail to identify updates which are deliberately fabricated statistically close to benign ones, or show inconsistent performance in different FL training stages. The effect of unfiltered backdoor updates will accumulate in the global model, and eventually become functional. Given the difficulty of ruling out every backdoor update, we propose a backdoor defense paradigm, which focuses on proactive robustification on the global model against potential backdoor attacks. We first reveal that the successful launching of backdoor attacks in FL stems from the lack of conflict between malicious and benign updates on redundant neurons of ML models. We proceed to prove the feasibility of activating redundant neurons utilizing out-of-distribution (OOD) samples in centralized settings, and migrating to FL settings to propose a novel backdoor defense mechanism, TrojanDam. The proposed mechanism has the FL server continuously inject fresh OOD mappings into the global model to activate redundant neurons, canceling the effect of backdoor updates during aggregation. We conduct systematic and extensive experiments to illustrate the superior performance of TrojanDam, over several SOTA backdoor defense methods across a wide range of FL settings.

Problem

• Detects backdoor attacks in federated learning without post-training detection
• Proactively robustifies global model using out-of-distribution data
• Activates redundant neurons to neutralize backdoor update effects

Innovation

• Proactive robustification using OOD data
• Activates redundant neurons to counter backdoors
• Continuous OOD injection during FL aggregation