SURA detects federated-learning backdoors with 10 clean images
Original title: Data-Efficient Unlearning-Based Backdoor Detection in Federated Learning
It reuses one small clean proxy across repeated loss-ascent probes and restores batch-norm state only at readout.
The paper presents Screening via Unlearning Response Analysis (SURA), a data-efficient detector for backdoored clients in federated learning. It reuses the same small clean server set across multiple train-mode loss-ascent steps. For vision models with batch normalization, it restores the shared pre-probe BN state only at readout so probing does not confound the measurement. Across six backdoor attacks, the authors say 10 clean images beat same-budget methods and approach much larger proxy sets.
Unconfirmed: Outperformance versus other detectors is stated by the authors and not independently verified in the item.
- Static update statistics can miss clients that keep main-task performance.
- SURA uses only 10 clean server images.
- BN running statistics are restored at readout while probed parameter changes remain.
- Results are reported across six backdoor attacks.
From the original article
1 min read at arxiv.orgDetecting backdoor attacks in federated learning (FL) is challenging because malicious clients can manipulate the global model while preserving main-task performance. Static model-update statistics may therefore fail to clearly distinguish malicious from benign clients.
By Dowon Kim · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.