In a federated learning (FL) system, decentralized data owners (clients) could upload their locally trained models to a central server, to jointly train a global model. Malicious clients may plant backdoors into the global model through uploading poisoned local models, causing misclassification to a target class when encountering attacker-defined triggers. Existing backdoor defenses show inconsistent performance under different system and adversarial settings, especially when the malicious updates are made statistically close to the benign ones. In this paper, we first reveal the fact that planting subsequent backdoors with the same target label could significantly help to maintain the accuracy of previously planted backdoors, and then propose a novel proactive backdoor detection mechanism for FL named BackdoorIndicator, which has the server inject indicator tasks into the global model leveraging out-of-distribution (OOD) data, and then utilizing the fact that any backdoor samples are OOD samples with respect to benign samples, the server, who is completely agnostic of the potential backdoor types and target labels, can accurately detect the presence of backdoors in uploaded models, via evaluating the indicator tasks. We perform systematic and extensive empirical studies to demonstrate the consistently superior performance and practicality of BackdoorIndicator over baseline defenses, across a wide range of system and adversarial settings.

翻译：在联邦学习（FL）系统中，分散的数据所有者（客户端）可将其本地训练的模型上传至中央服务器，以联合训练全局模型。恶意客户端可能通过上传被投毒（poisoned）的本地模型，在全局模型中植入后门，导致模型在遇到攻击者定义的触发器时对目标类别产生误分类。现有的后门防御方法在不同系统与对抗设置下表现出不一致的性能，尤其在恶意更新被统计上接近良性更新时更为明显。本文首先揭示了植入具有相同目标标签的后续后门可显著帮助维持先前植入后门的准确性这一事实，进而提出一种名为BackdoorIndicator的新型联邦学习主动后门检测机制。该机制使服务器利用分布外（OOD）数据将指示器任务注入全局模型，随后基于“任何后门样本相对于良性样本均为分布外样本”这一特性，使完全不了解潜在后门类型与目标标签的服务器能够通过评估指示器任务，准确检测上传模型中是否存在后门。我们通过系统且广泛的实证研究证明，在多种系统与对抗设置下，BackdoorIndicator相较于基线防御方法始终具有更优越的性能与实用性。