Federated Learning (FL) is a distributed learning paradigm that enables different parties to train a model together for high quality and strong privacy protection. In this scenario, individual participants may get compromised and perform backdoor attacks by poisoning the data (or gradients). Existing work on robust aggregation and certified FL robustness does not study how hardening benign clients can affect the global model (and the malicious clients). In this work, we theoretically analyze the connection among cross-entropy loss, attack success rate, and clean accuracy in this setting. Moreover, we propose a trigger reverse engineering based defense and show that our method can achieve robustness improvement with guarantee (i.e., reducing the attack success rate) without affecting benign accuracy. We conduct comprehensive experiments across different datasets and attack settings. Our results on eight competing SOTA defense methods show the empirical superiority of our method on both single-shot and continuous FL backdoor attacks. Code is available at https://github.com/KaiyuanZh/FLIP.

翻译：联邦学习是一种分布式学习范式，使不同参与方能够协同训练模型，在实现高质量结果的同时提供强隐私保护。在该场景下，个体参与者可能被攻陷，通过投毒数据（或梯度）实施后门攻击。现有关于鲁棒聚合与可证联邦学习鲁棒性的研究，并未探讨加固良性客户端如何影响全局模型（及恶意客户端）。本文从理论上分析了在该设定下交叉熵损失、攻击成功率和干净准确率三者之间的联系。此外，我们提出了一种基于触发器逆向工程的防御方法，并证明该方法能够在保证良性准确率不受影响的前提下，实现有保证的鲁棒性提升（即降低攻击成功率）。我们在不同数据集和攻击设置下开展了全面实验。与八种现有最优防御方法的对比结果表明，我们方法在单次与连续联邦学习后门攻击中均展现出实证优越性。代码已开源至 https://github.com/KaiyuanZh/FLIP。