arXiv:2603.28673cs.LGcs.CR2026-03

FL-PBM在联邦学习中提前过滤恶意数据,有效防住后门攻击。

FL-PBM: Pre-Training Backdoor Mitigation for Federated Learning

  • 在客户端用可控良性触发器建立基准,结合PCA与GMM识别异常数据。
  • 实验显示攻击成功率降低95%(对比FedAvg),且保持90%以上正常准确率。
  • 适合关注隐私保护与模型安全的开发者,尤其适用于医疗、自动驾驶等高风险场景。

后门攻击严重威胁人工智能模型的完整性与可靠性,攻击者通过注入带有隐藏触发器的污染数据操纵模型行为,可能引发严重后果,尤其在自动驾驶、医疗和金融等关键领域。检测与防御后门攻击需贯穿模型生命周期,包括预训练、训练中及训练后阶段。本文提出联邦学习中的预训练后门防御机制FL-PBM,该方法在联邦学习环境中客户端训练前主动过滤污染数据。流程包含四步:(1) 向数据插入良性触发器以建立可控基线;(2) 使用主成分分析(PCA)提取判别特征并评估数据可分性;(3) 在PCA变换空间中基于高斯混合模型(GMM)聚类,识别潜在恶意样本;(4) 对可疑样本应用定向模糊化技术以破坏潜在后门触发器。上述步骤确保可疑数据被早期发现并有效净化,从而显著降低后门触发器对全局模型的影响。在图像数据集上的实验表明,相比基线联邦学习(FedAvg),FL-PBM将攻击成功率降低高达95%;相较于最先进的防御方法(RDFL与LPSF),相对降低30%至80%。同时,大多数实验中仍保持超过90%的纯净模型准确率,实现高效防御而无需牺牲性能。

原文摘要 · Abstract (English)

Backdoor attacks pose a significant threat to the integrity and reliability of Artificial Intelligence (AI) models, enabling adversaries to manipulate model behavior by injecting poisoned data with hidden triggers. These attacks can lead to severe consequences, especially in critical applications such as autonomous driving, healthcare, and finance. Detecting and mitigating backdoor attacks is crucial across the lifespan of model's phases, including pre-training, in-training, and post-training. In this paper, we propose Pre-Training Backdoor Mitigation for Federated Learning (FL-PBM), a novel defense mechanism that proactively filters poisoned data on the client side before model training in a federated learning (FL) environment. The approach consists of three stages: (1) inserting a benign trigger into the data to establish a controlled baseline, (2) applying Principal Component Analysis (PCA) to extract discriminative features and assess the separability of the data, (3) performing Gaussian Mixture Model (GMM) clustering to identify potentially malicious data samples based on their distribution in the PCA-transformed space, and (4) applying a targeted blurring technique to disrupt potential backdoor triggers. Together, these steps ensure that suspicious data is detected early and sanitized effectively, thereby minimizing the influence of backdoor triggers on the global model. Experimental evaluations on image-based datasets demonstrate that FL-PBM reduces attack success rates by up to 95% compared to baseline federated learning (FedAvg) and by 30 to 80% relative to state-of-the-art defenses (RDFL and LPSF). At the same time, it maintains over 90% clean model accuracy in most experiments, achieving better mitigation without degrading model performance.

联邦学习后门防御数据清洗模型安全

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。