Federated Learning (FL) offers collaborative model training without data sharing but is vulnerable to backdoor attacks, where poisoned model weights lead to compromised system integrity. Existing countermeasures, primarily based on anomaly detection, are prone to erroneous rejections of normal weights while accepting poisoned ones, largely due to shortcomings in quantifying similarities among client models. Furthermore, other defenses demonstrate effectiveness only when dealing with a limited number of malicious clients, typically fewer than 10%. To alleviate these vulnerabilities, we present G$^2$uardFL, a protective framework that reinterprets the identification of malicious clients as an attributed graph clustering problem, thus safeguarding FL systems. Specifically, this framework employs a client graph clustering approach to identify malicious clients and integrates an adaptive mechanism to amplify the discrepancy between the aggregated model and the poisoned ones, effectively eliminating embedded backdoors. We also conduct a theoretical analysis of convergence to confirm that G$^2$uardFL does not affect the convergence of FL systems. Through empirical evaluation, comparing G$^2$uardFL with cutting-edge defenses, such as FLAME (USENIX Security 2022) [28] and DeepSight (NDSS 2022) [36], against various backdoor attacks including 3DFed (SP 2023) [20], our results demonstrate its significant effectiveness in mitigating backdoor attacks while having a negligible impact on the aggregated model's performance on benign samples (i.e., the primary task performance). For instance, in an FL system with 25% malicious clients, G$^2$uardFL reduces the attack success rate to 10.61%, while maintaining a primary task performance of 73.05% on the CIFAR-10 dataset. This surpasses the performance of the best-performing baseline, which merely achieves a primary task performance of 19.54%.

翻译：联邦学习（FL）通过协作训练模型而无需共享数据，但易受后门攻击，其中被投毒的模型权重会破坏系统完整性。现有防御措施主要基于异常检测，但由于量化客户端模型相似性的缺陷，容易错误拒绝正常权重并接受被投毒权重。此外，其他防御仅在恶意客户端数量有限（通常少于10%）时有效。为缓解这些漏洞，我们提出G$^2$uardFL，一种将恶意客户端识别重新解释为属性图聚类问题的保护框架，从而保障FL系统安全。具体而言，该框架采用客户端图聚类方法识别恶意客户端，并集成自适应机制以放大聚合模型与被投毒模型之间的差异，有效消除嵌入的后门。我们还进行了收敛性理论分析，确认G$^2$uardFL不影响FL系统的收敛性。通过实证评估，将G$^2$uardFL与前沿防御方法（如FLAME（USENIX Security 2022）[28]和DeepSight（NDSS 2022）[36]）在多种后门攻击（包括3DFed（SP 2023）[20]）下进行对比，结果表明其在缓解后门攻击方面具有显著有效性，同时对聚合模型在良性样本上的性能（即主任务性能）影响极小。例如，在包含25%恶意客户端的FL系统中，G$^2$uardFL将攻击成功率降至10.61%，同时在CIFAR-10数据集上保持主任务性能为73.05%，优于最佳基线方法（仅达到19.54%的主任务性能）。