arXiv:2606.22700cs.LGcs.AI2026-06

提出一种无需先验触发知识的联邦学习后处理净化方法,有效清除后门并保持模型精度。

SCRUB-FL: Sanitizing and Cleansing Representations via Unlearning of Backdoors

论文配图:SCRUB-FL: Sanitizing and Cleansing Representations via Unlearning of Backdoors
图 1 · 摘自论文原文
  • 通过客户端谱分析与生成对抗网络捕捉可疑样本特征分布
  • 训练后合成近似触发样本,用机器遗忘消除后门关联性
  • 在40%恶意参与下仍能将攻击成功率降至3.88%,适合隐私敏感场景

联邦学习(FL)在不共享原始数据的前提下实现协同建模,适用于隐私敏感场景。然而其分布式特性使其易受后门攻击:恶意客户端在本地数据中嵌入隐藏触发器以操控模型预测。现有防御多在训练前或训练中进行,难以彻底清除收敛后全局模型中的后门行为。且事后净化效果受限于服务器对触发模式或中毒客户端缺乏认知,常导致残留后门或因神经元纠缠造成准确率下降。为此,我们提出SCRUB-FL(通过后门遗忘实现表示净化与清洗),一种两阶段的联邦学习后处理反制方案。训练阶段,客户端利用谱分析与激活聚类识别可疑样本,并训练轻量级带梯度惩罚的Wasserstein生成对抗网络(WGAN-GP)捕获触发相关分布;生成器参数在服务端聚合,构建全局可疑模式表征,不暴露原始数据。收敛后,服务器合成近似触发样本,通过机器遗忘机制重分配预测为均匀分布,消除触发-目标关联。在CIFAR-10和GTSRB上针对三种攻击类型、最高40%恶意参与度的实验表明,SCRUB-FL将后门攻击成功率降至最低3.88%,同时保持超过91%的正常任务准确率,优于现有最优防御方法,且无需预先知晓触发模式或大规模干净代理数据。

原文摘要 · Abstract (English)

Federated Learning (FL) enables collaborative model training without sharing raw data, making it a promising paradigm for privacy-sensitive applications. However, its decentralized nature makes it inherently vulnerable to backdoor attacks, where malicious clients embed hidden triggers into local training data to manipulate model predictions. Existing defenses mainly operate during before and during aggregation cannot fully eliminate backdoor behaviors that persist in the converged global model. Moreover, the effectiveness of post-training sanitization is often limited by the server's lack of knowledge of trigger patterns or poisoned clients after convergence, resulting in residual backdoor behaviors or accuracy degradation due to neuron entanglement. To address this limitation, we propose SCRUB-FL (Sanitizing and Cleansing Representations via Unlearning of Backdoors), a two-phase solution for post-training backdoor removal in FL. During training, clients identify suspicious samples using spectral analysis and activation clustering, then train lightweight Wasserstein Generative Adversarial Network with Gradient Penalty (WGAN-GP) models to capture trigger-related distributions. The generator parameters are aggregated server-side to construct a global representation of suspicious patterns without exposing raw data. After convergence, the server synthesizes trigger-approximating samples and applies machine unlearning to erase the trigger-target association by redistributing predictions toward a uniform distribution. Experimental evaluations on CIFAR-10 and GTSRB across three attack types and up to 40% malicious participation demonstrate that SCRUB-FL reduces the backdoor attack success rate to as low as 3.88% while maintaining over 91% normal task accuracy, outperforming state-of-the-art defenses without requiring prior trigger knowledge or a large clean proxy dataset at the server.

联邦学习后门防御机器遗忘生成模型

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。