# Securing Federated Learning Against Novel and Classic Backdoor Threats During Foundation Model Integration

**Authors:** Xiaohuan Bi, Xi Li  
**arXiv:** [2410.17573](https://arxiv.org/abs/2410.17573)  
**Date:** 2024-10-23  
**Summary page:** https://www.summarizepaper.com/en/paper/2410.17573v1/

## Key points

- Federated learning (FL) revolutionizes decentralized model training by preserving privacy
- Integration of Foundation Models (FMs) into FL introduces backdoor attack threats
- Backdoor attacks exploit FMs to embed backdoors into synthetic data during model fusion
- Existing FL backdoor defenses struggle to detect anomalies among client updates under this attack
- Proposed novel data-free defense strategy involves constraining abnormal activations in hidden feature space during model aggregation on server
- Defense strategy optimizes activation constraints using synthetic data alongside FL training to mitigate attacks without impacting model performance significantly
- Extensive experiments demonstrate effectiveness of defense strategy against both novel and classic backdoor attacks, outperforming existing defenses while maintaining model performance
- Defense strategy is the first data-free approach against novel backdoor attacks resulting from FM integration into FL
- Vulnerabilities introduced by FM-integrated FL are discussed, emphasizing the need for robust defenses to safeguard federated learning systems against evolving security threats.

## Summary

Federated learning (FL) has revolutionized decentralized model training by preserving privacy. However, the integration of Foundation Models (FMs) into FL has introduced a new threat in the form of backdoor attacks. These attacks can exploit the capabilities of FMs to embed backdoors into synthetic data generated during model fusion, infecting all client models through knowledge sharing without participating in the FL process. This poses a significant challenge as existing FL backdoor defenses struggle to detect anomalies among client updates that may appear uniformly malicious under this attack. To address this issue, a novel data-free defense strategy is proposed in this paper. The defense involves constraining abnormal activations in the hidden feature space during model aggregation on the server. By optimizing activation constraints using synthetic data alongside FL training, the attack can be mitigated without significantly impacting model performance since the parameters remain untouched. Extensive experiments have demonstrated the effectiveness of this defense strategy against both novel and classic backdoor attacks, outperforming existing defenses while maintaining model performance. In summary, this paper makes significant contributions by introducing the first data-free defense strategy against novel backdoor attacks resulting from FM integration into FL. The extensive experiments conducted across diverse FL scenarios validate the efficacy of this defense strategy against both novel and classic backdoor threats within a unified framework. Additionally, vulnerabilities introduced by FM-integrated FL are discussed, highlighting how FMs enhance various aspects of FL but also introduce new attack vectors. The interaction between FMs and FL can lead to inference-time poisoning and susceptibility to malicious prompts that embed backdoors in LLM-generated synthetic data. This underscores the importance of robust defenses like the one proposed in this paper to safeguard federated learning systems against evolving security threats.