通过梯度分析快速识别并清除联邦学习中的后门攻击。
DeTrigger: A Gradient-Centric Approach to Backdoor Attack Mitigation in Federated Learning
- 基于梯度与温度缩放分析，定位后门触发器。
- 检测速度比传统方法快251倍，防御成功率高达98.9%。
- 适合部署在移动端的联邦学习系统，兼顾安全与性能。
联邦学习（FL）可在分布式设备间协同训练模型，同时保护本地数据隐私，适用于移动与嵌入式系统。然而，其去中心化特性也使模型易受投毒攻击，尤其是后门攻击——攻击者植入特定触发模式以操控预测结果。本文提出DeTrigger，一种可扩展、高效的抗后门联邦学习框架，借鉴对抗攻击方法的洞察。通过梯度分析结合温度缩放，DeTrigger能精准检测并隔离后门触发器，实现对后门激活部分的精确权重剪枝，而不会损害良性模型知识。在四个常用数据集上的广泛评估表明，DeTrigger的检测速度最高达传统方法的251倍，可将后门攻击缓解至98.9%以下，且对全局模型准确率影响极小。研究结果证明DeTrigger是应对复杂后门威胁的鲁棒且可扩展方案。
原文摘要 · Abstract (English)
Federated Learning (FL) enables collaborative model training across distributed devices while preserving local data privacy, making it ideal for mobile and embedded systems. However, the decentralized nature of FL also opens vulnerabilities to model poisoning attacks, particularly backdoor attacks, where adversaries implant trigger patterns to manipulate model predictions. In this paper, we propose DeTrigger, a scalable and efficient backdoor-robust federated learning framework that leverages insights from adversarial attack methodologies. By employing gradient analysis with temperature scaling, DeTrigger detects and isolates backdoor triggers, allowing for precise model weight pruning of backdoor activations without sacrificing benign model knowledge. Extensive evaluations across four widely used datasets demonstrate that DeTrigger achieves up to 251x faster detection than traditional methods and mitigates backdoor attacks by up to 98.9%, with minimal impact on global model accuracy. Our findings establish DeTrigger as a robust and scalable solution to protect federated learning environments against sophisticated backdoor threats.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。