Mitigating Backdoor Attacks in Federated Learning Using PPA and MiniMax Game Theory

• URL: http://arxiv.org/abs/2603.28652v1
• Date: Mon, 30 Mar 2026 16:39:02 GMT
• Title: Mitigating Backdoor Attacks in Federated Learning Using PPA and MiniMax Game Theory
• Abstract summary: Malicious clients actively try to harm the global model by injecting backdoor data into their local models.<n>We propose FedBBA (Federated Backdoor and Behavior Analysis) to mitigate such mischievous behavior.<n>We show that FedBBA reduces the backdoor attack success rate to approximately 1.1%--11% across various attack scenarios.
• Score: 8.751986657630018
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Federated Learning (FL) is witnessing wider adoption due to its ability to benefit from large amounts of scattered data while preserving privacy. However, despite its advantages, federated learning suffers from several setbacks that directly impact the accuracy, and the integrity of the global model it produces. One of these setbacks is the presence of malicious clients who actively try to harm the global model by injecting backdoor data into their local models while trying to evade detection. The objective of such clients is to trick the global model into making false predictions during inference, thereby compromising the integrity and trustworthiness of the global model on which honest stakeholders rely. To mitigate such mischievous behavior, we propose FedBBA (Federated Backdoor and Behavior Analysis). The proposed model aims to dampen the effect of such clients on the final accuracy, creating more resilient federated learning environments. We engineer our approach through the combination of (1) a reputation system to evaluate and track client behavior, (2) an incentive mechanism to reward honest participation and penalize malicious behavior, and (3) game theoretical models with projection pursuit analysis (PPA) to dynamically identify and minimize the impact of malicious clients on the global model. Extensive simulations on the German Traffic Sign Recognition Benchmark (GTSRB) and Belgium Traffic Sign Classification (BTSC) datasets demonstrate that FedBBA reduces the backdoor attack success rate to approximately 1.1%--11% across various attack scenarios, significantly outperforming state-of-the-art defenses like RDFL and RoPE, which yielded attack success rates between 23% and 76%, while maintaining high normal task accuracy (~95%--98%).

Related papers

• FL-PBM: Pre-Training Backdoor Mitigation for Federated Learning [15.911410230033816]
  Backdoor attacks pose a significant threat to the integrity and reliability of Artificial Intelligence (AI) models.<n>In this paper, we propose Pre-Training Backdoor Mitigation for Federated Learning.<n>It proactively filters poisoned data on the client side before model training in a federated learning environment.
  arXiv  Detail & Related papers  (2026-03-30T16:56:38Z)
• FedTrident: Resilient Road Condition Classification Against Poisoning Attacks in Federated Learning [16.871281029100313]
  FL has emerged as a transformative paradigm for ITS, notably camera-based Road Condition Classification (RCC)<n>RCC exposes the system to adversarial participants launching Targeted Label-Flipping Attacks (TLFAs)<n>We propose FedTrident, which can effectively thwart TLFAs, achieving performance comparable to that in attack-free scenarios.
  arXiv  Detail & Related papers  (2026-03-19T16:26:13Z)
• MURIM: Multidimensional Reputation-based Incentive Mechanism for Federated Learning [3.8054072718666574]
  Federated Learning (FL) has emerged as a leading privacy-preserving machine learning paradigm.<n>FL continues to face key challenges, including weak client incentives, privacy risks, and resource constraints.<n>We propose MURIM, a Reputation-based Incentive Mechanism that jointly considers client reliability, privacy, resource capacity, and fairness.
  arXiv  Detail & Related papers  (2025-12-15T23:18:32Z)
• Client-side Gradient Inversion Against Federated Learning from Poisoning [59.74484221875662]
  Federated Learning (FL) enables distributed participants to train a global model without sharing data directly to a central server. Recent studies have revealed that FL is vulnerable to gradient inversion attack (GIA), which aims to reconstruct the original training samples. We propose Client-side poisoning Gradient Inversion (CGI), which is a novel attack method that can be launched from clients.
  arXiv  Detail & Related papers  (2023-09-14T03:48:27Z)
• G$^2$uardFL: Safeguarding Federated Learning Against Backdoor Attacks through Attributed Client Graph Clustering [116.4277292854053]
  Federated Learning (FL) offers collaborative model training without data sharing. FL is vulnerable to backdoor attacks, where poisoned model weights lead to compromised system integrity. We present G$2$uardFL, a protective framework that reinterprets the identification of malicious clients as an attributed graph clustering problem.
  arXiv  Detail & Related papers  (2023-06-08T07:15:04Z)
• Avoid Adversarial Adaption in Federated Learning by Multi-Metric Investigations [55.2480439325792]
  Federated Learning (FL) facilitates decentralized machine learning model training, preserving data privacy, lowering communication costs, and boosting model performance through diversified data sources. FL faces vulnerabilities such as poisoning attacks, undermining model integrity with both untargeted performance degradation and targeted backdoor attacks. We define a new notion of strong adaptive adversaries, capable of adapting to multiple objectives simultaneously. MESAS is the first defense robust against strong adaptive adversaries, effective in real-world data scenarios, with an average overhead of just 24.37 seconds.
  arXiv  Detail & Related papers  (2023-06-06T11:44:42Z)
• FLIP: A Provable Defense Framework for Backdoor Mitigation in Federated Learning [66.56240101249803]
  We study how hardening benign clients can affect the global model (and the malicious clients) We propose a trigger reverse engineering based defense and show that our method can achieve improvement with guarantee robustness. Our results on eight competing SOTA defense methods show the empirical superiority of our method on both single-shot and continuous FL backdoor attacks.
  arXiv  Detail & Related papers  (2022-10-23T22:24:03Z)
• CRFL: Certifiably Robust Federated Learning against Backdoor Attacks [59.61565692464579]
  This paper provides the first general framework, Certifiably Robust Federated Learning (CRFL), to train certifiably robust FL models against backdoors. Our method exploits clipping and smoothing on model parameters to control the global model smoothness, which yields a sample-wise robustness certification on backdoors with limited magnitude.
  arXiv  Detail & Related papers  (2021-06-15T16:50:54Z)
• Federated Learning with Unreliable Clients: Performance Analysis and Mechanism Design [76.29738151117583]
  Federated Learning (FL) has become a promising tool for training effective machine learning models among distributed clients. However, low quality models could be uploaded to the aggregator server by unreliable clients, leading to a degradation or even a collapse of training. We model these unreliable behaviors of clients and propose a defensive mechanism to mitigate such a security risk.
  arXiv  Detail & Related papers  (2021-05-10T08:02:27Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.