Abstract:Deep neural networks (DNNs) are susceptible to backdoor attacks, where adversaries poison datasets with adversary-specified triggers to implant hidden backdoors, enabling malicious manipulation of model predictions. Dataset purification serves as a proactive defense by removing malicious training samples to prevent backdoor injection at its source. We first reveal that the current advanced purification methods rely on a latent assumption that the backdoor connections between triggers and target labels in backdoor attacks are simpler to learn than the benign features. We demonstrate that this assumption, however, does not always hold, especially in all-to-all (A2A) and untargeted (UT) attacks. As a result, purification methods that analyze the separation between the poisoned and benign samples in the input-output space or the final hidden layer space are less effective. We observe that this separability is not confined to a single layer but varies across different hidden layers. Motivated by this understanding, we propose FLARE, a universal purification method to counter various backdoor attacks. FLARE aggregates abnormal activations from all hidden layers to construct representations for clustering. To enhance separation, FLARE develops an adaptive subspace selection algorithm to isolate the optimal space for dividing an entire dataset into two clusters. FLARE assesses the stability of each cluster and identifies the cluster with higher stability as poisoned. Extensive evaluations on benchmark datasets demonstrate the effectiveness of FLARE against 22 representative backdoor attacks, including all-to-one (A2O), all-to-all (A2A), and untargeted (UT) attacks, and its robustness to adaptive attacks.

DSBP: Data-free and Swift Backdoor Purification for Trustworthy Federated Learning via Multi-teacher Adversarial Distillation

Backdoor Attacks and Defenses in Federated Learning: State-of-the-Art, Taxonomy, and Future Directions

BadCleaner: Defending Backdoor Attacks in Federated Learning Via Attention-Based Multi-Teacher Distillation

Redeem Myself: Purifying Backdoors in Deep Learning Models Using Self Attention Distillation.

FLSAD: Defending Backdoor Attacks in Federated Learning via Self-Attention Distillation

SBPA: Sybil-Based Backdoor Poisoning Attacks for Distributed Big Data in AIoT-Based Federated Learning System

Anti-Distillation Backdoor Attacks: Backdoors Can Really Survive in Knowledge Distillation

A Robust Defense Algorithm for Backdoor Erasure Based on Attention Alignment in Federated Learning

Act in Collusion: A Persistent Distributed Multi-Target Backdoor in Federated Learning

SPFL: A Self-purified Federated Learning Method Against Poisoning Attacks

Unlearning Backdoor Attacks for LLMs with Weak-to-Strong Knowledge Distillation

FLARE: Towards Universal Dataset Purification against Backdoor Attacks

Backdoor Federated Learning by Poisoning Backdoor-Critical Layers

DABS: Data-Agnostic Backdoor attack at the Server in Federated Learning

Towards Practical Backdoor Attacks on Federated Learning Systems

From Toxic to Trustworthy: Using Self-Distillation and Semi-supervised Methods to Refine Neural Networks

Efficient and Secure Federated Learning Against Backdoor Attacks

SDBA: A Stealthy and Long-Lasting Durable Backdoor Attack in Federated Learning

DHBE: Data-free Holistic Backdoor Erasing in Deep Neural Networks via Restricted Adversarial Distillation

FLPurifier: Backdoor Defense in Federated Learning via Decoupled Contrastive Training

A Blockchain-Based Federated-Learning Framework for Defense against Backdoor Attacks