FedPCAN: Robust mitigation of dynamic black-box backdoor attacks in federated learning

The decentralized structure of federated learning exposes it to backdoor threats, especially dynamic black-box attacks. These attacks employ multiple evasion mechanisms within malicious updates, rendering many existing defenses ineffective. To address this threat, this paper proposes a three-stage defense algorithm. First, it performs neuron parameter analysis on PCA-reduced gradients to identify and remove decoy models injected by malicious clients. Second, a novel backdoor detection method is designed, where the central server generates random inputs to compare neuron activation differences across clients, thereby distinguishing between benign and backdoor gradients. Finally, Gaussian noise is added to disrupt the accuracy of the attacker’s feedback indicators. Compared to other defense algorithms, the proposed algorithm defends against each evasion module of dynamic black-box attacks while rendering the attacker’s feedback indicators ineffective. We evaluate the performance under different attack scenarios on four datasets, and the results show that the proposed algorithm effectively defends against various backdoor attacks and outperforms state-of-the-art methods.