Backdoor attacks are dangerous and difficult to prevent in federated learning (FL), where training data is sourced from untrusted clients over long periods of time. These difficulties arise because: (a) defenders in FL do not have access to raw training data, and (b) a new phenomenon we identify called backdoor leakage causes models trained continuously to eventually suffer from backdoors due to cumulative errors in defense mechanisms. We propose shadow learning, a framework for defending against backdoor attacks in the FL setting under long-range training. Shadow learning trains two models in parallel: a backbone model and a shadow model. The backbone is trained without any defense mechanism to obtain good performance on the main task. The shadow model combines filtering of malicious clients with early-stopping to control the attack success rate even as the data distribution changes. We theoretically motivate our design and show experimentally that our framework significantly improves upon existing defenses against backdoor attacks.

翻译：后门攻击在联邦学习（FL）中具有危险性且难以防范，因为训练数据长期来自不可信的客户端。这些困难源于：（a）联邦学习中的防御者无法接触原始训练数据；（b）我们识别出一种称为"后门泄露"的新现象，该现象导致持续训练的模型因防御机制的累积误差而最终遭受后门攻击。我们提出影子学习框架，用于防御长期联邦学习场景中的后门攻击。影子学习并行训练两个模型：主干模型和影子模型。主干模型不采用任何防御机制进行训练，以在主任务上获得良好性能。影子模型则结合恶意客户端过滤与早停策略，即使数据分布发生变化也能控制攻击成功率。我们从理论上论证了设计动机，并通过实验表明，该框架显著优于现有的后门攻击防御方法。