FedSweep: Unlearning Backdoors in Federated Learning
摘要
Federated learning faces significant security challenges, particularly backdoor attacks. In this work, we develop the FedSweep defense framework, which leverages machine unlearning to tackle the shortcomings of existing methods. Unlike current approaches that require prior knowledge of malicious clients, maintaining a history of update parameters, and ignoring benign feature updates from malicious clients, our method overcomes these limitations. Using a small set of clean data, we generate simulated poisoned data through reverse engineering of triggers. We identify malicious clients by examining the entropy of logits across all clients for the simulated poisoned data, identifying those with lower entropy as potentially malicious. We then align the feature vectors from malicious models on both clean and simulated poisoned datasets, and match the models’ predictions on simulated poisoned data with their ground-truth labels. This alignment subtly shifts the features of simulated poisoned data towards those of clean data, thereby neutralizing backdoors without compromising model accuracy. Our results show that FedSweep not only accurately identifies malicious clients but also reduces backdoor attack success rates (ASRs) to below 13%.