arXiv:2505.10297cs.LGcs.AI2025-05被引 1

提出新型注意力防御机制,有效识别联邦学习中的隐蔽后门攻击

Defending the Edge: Representative-Attention Defense against Backdoor Attacks in Federated Learning

  • 通过一致性分析与范数膨胀双重机制检测恶意客户端
  • 在非独立同分布设置下后门准确率低至1.67%,保持高纯净准确率
  • 适合关注联邦学习安全、对抗隐蔽攻击的研究者使用

联邦学习(FL)仍易受自适应后门攻击威胁,此类攻击通过模仿良性更新统计特性实现隐蔽。现有防御多依赖参数或梯度空间的异常检测,忽视了后门攻击为保证触发可靠而必须满足的行为约束。这些以异常为中心的方法对能归一化更新幅度并模仿良性统计模式的自适应攻击失效,造成根本性检测盲区。为此,本文提出FeRA(Federated Representative Attention)——一种基于注意力的新型防御机制,将检测范式从异常中心转向一致性中心分析。FeRA利用后门在训练轮次中需持续存在的内在需求,通过抑制表示空间方差这一与传统幅值统计正交的属性识别恶意客户端。该框架结合谱注意力与空间注意力、方向对齐、互相似性及范数膨胀,构建了两种互补检测机制:一致性分析与范数膨胀检测。通过该机制,可分离出一致性低或幅值放大特征的恶意客户端。在六个数据集、九种攻击及三种模型架构下,无论独立同分布(IID)或非独立同分布(non-IID)设置,均验证了其优越的后门缓解能力。在不同non-IID设置下,平均后门准确率最低达约1.67%,同时维持高纯净准确率。代码已开源。

原文摘要 · Abstract (English)

Federated learning (FL) remains highly vulnerable to adaptive backdoor attacks that preserve stealth by closely imitating benign update statistics. Existing defenses predominantly rely on anomaly detection in parameter or gradient space, overlooking behavioral constraints that backdoor attacks must satisfy to ensure reliable trigger activation. These anomaly-centric methods fail against adaptive attacks that normalize update magnitudes and mimic benign statistical patterns while preserving backdoor functionality, creating a fundamental detection gap. To address this limitation, this paper introduces FeRA (Federated Representative Attention) -- a novel attention-driven defense that shifts the detection paradigm from anomaly-centric to consistency-centric analysis. FeRA exploits the intrinsic need for backdoor persistence across training rounds, identifying malicious clients through suppressed representation-space variance, an orthogonal property to traditional magnitude-based statistics. The framework conducts multi-dimensional behavioral analysis combining spectral and spatial attention, directional alignment, mutual similarity, and norm inflation across two complementary detection mechanisms: consistency analysis and norm-inflation detection. Through this mechanism, FeRA isolates malicious clients that exhibit low-variance consistency or magnitude amplification. Extensive evaluation across six datasets, nine attacks, and three model architectures under both Independent and Identically Distributed (IID) and non-IID settings confirm FeRA achieves superior backdoor mitigation. Under different non-IID settings, FeRA achieved the lowest average Backdoor Accuracy (BA), about 1.67% while maintaining high clean accuracy compared to other state-of-the-art defenses. The code is available at https://github.com/Peatech/FeRA_defense.git.

联邦学习后门攻击安全防御注意力机制

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。