FedCleanse: Cleanse the backdoor attacks in federated learning system

Federated learning (FL) enables multiple clients to collaboratively train an efficient deep-learning model without sharing their local data. However, due to its privacy-preserving nature, FL is vulnerable to backdoor attack, which manipulates the model behaviors on the adversary-chosen input. Existing defense methods are ineffective against sophisticated stealthy backdoors, suffering from either a low benign performance or being too specific to certain assumptions and attacks. To handle the aforementioned issues, we present FedCleanse, a novel defense mechanism to address the backdoor attack in federated learning. In this work, we study the pruning-based approach, which has been proven effective but with the need for additional data for validation and suffers from high non-IID scenarios. This paper proposes a post-aggregation approach, namely FedCleanse, to neutralize backdoor effects without needing additional clean data. Our approach identifies suspicious neurons using “neuron conductance” and subsequently suppresses them after the aggregation operation, which imposes minimal impact on benign neurons. Additionally, FedCleanse is complemented by strategic perturbations to prevent backdoor transfer. Through extensive experiments, our method demonstrates superior defense capabilities across various attack types and non-IID settings, surpassing the state-of-the-art by a large margin without compromising the main task’s performance.