SCRUB-FL: Sanitizing and Cleansing Representations via Unlearning of Backdoors

2026-06-21

AI Summary

This work addresses the challenge of persistent backdoors in federated learning, which remain difficult to eliminate after model convergence and often evade existing defenses due to the absence of trigger priors or clean data, leading to either residual backdoors or degraded main-task performance. The authors propose a two-stage post-training sanitization framework: clients jointly employ spectral analysis and activation clustering to identify suspicious samples and train a lightweight WGAN-GP to model the trigger distribution; the server then aggregates generator parameters to construct a global trigger representation, synthesizes approximate trigger samples, and applies machine unlearning to redistribute model predictions uniformly, thereby severing the backdoor association. Requiring neither server-side prior knowledge nor large-scale clean data, this approach is the first to integrate generative modeling with machine unlearning for effective backdoor erasure in federated settings. Evaluated on CIFAR-10 and GTSRB against three attack types and up to 40% malicious clients, it reduces backdoor success rates to below 3.88% while preserving over 91% main-task accuracy, significantly outperforming current defenses.

Abstract

Federated Learning (FL) enables collaborative model training without sharing raw data, making it a promising paradigm for privacy-sensitive applications. However, its decentralized nature makes it inherently vulnerable to backdoor attacks, where malicious clients embed hidden triggers into local training data to manipulate model predictions. Existing defenses mainly operate during before and during aggregation cannot fully eliminate backdoor behaviors that persist in the converged global model. Moreover, the effectiveness of post-training sanitization is often limited by the server's lack of knowledge of trigger patterns or poisoned clients after convergence, resulting in residual backdoor behaviors or accuracy degradation due to neuron entanglement. To address this limitation, we propose SCRUB-FL (Sanitizing and Cleansing Representations via Unlearning of Backdoors), a two-phase solution for post-training backdoor removal in FL. During training, clients identify suspicious samples using spectral analysis and activation clustering, then train lightweight Wasserstein Generative Adversarial Network with Gradient Penalty (WGAN-GP) models to capture trigger-related distributions. The generator parameters are aggregated server-side to construct a global representation of suspicious patterns without exposing raw data. After convergence, the server synthesizes trigger-approximating samples and applies machine unlearning to erase the trigger-target association by redistributing predictions toward a uniform distribution. Experimental evaluations on CIFAR-10 and GTSRB across three attack types and up to 40% malicious participation demonstrate that SCRUB-FL reduces the backdoor attack success rate to as low as 3.88% while maintaining over 91% normal task accuracy, outperforming state-of-the-art defenses without requiring prior trigger knowledge or a large clean proxy dataset at the server.

Problem

• Backdoor Attacks
• Federated Learning
• Post-training Sanitization
• Neuron Entanglement
• Trigger Patterns

Innovation

• Federated Learning
• Backdoor Unlearning
• WGAN-GP
• Post-training Sanitization
• Trigger Synthesis