Abstract: Aiming at the existing federated learning backdoor defense methods, which have the problems of misjudgment of abnormal client detection and are difficult to take into account the privacy protection of the client, we propose a federated learning backdoor defense approach based on adaptive Gaussian mixture model FedAGMM, which introduces Gaussian mixture model clustering at the server side, models the probability of gradient update of the client, and combines with the Bayesian information criterion to adaptively select the optimal number of clusters adaptively, so that the malicious model update is identified more accurately. Constructing a dynamic noise injection mechanism based on risk perception, adaptively adjusting the Gaussian noise intensity according to the client’s risk level.  This approach minimizes interference to normal clients while safeguarding privacy. Comparison experimental results with the latest defense methods show that in the face of three kinds of backdoor attacks, PGD, PGDEDGE, and MR, the success rate of the attack is reduced by 5.80, 3.27, and 1.00 percentage points, respectively, without decreasing the accuracy of the main task, and the theoretical analysis proves that FedAGMM meets the requirements of privacy protection while reducing overall noise injection, and significantly improves the detection accuracy and privacy security.

Key words: federated learning, backdoor defense, Gaussian mixture model, differential privacy, Bayesian information criterion

摘要： 针对现有联邦学习后门防御方法存在异常客户端检测误判且难以兼顾客户端隐私保护的问题，提出一种基于自适应高斯混合模型的联邦学习后门防御方法(FedAGMM).在服务器端引入高斯混合模型聚类，对客户端梯度更新概率建模，结合贝叶斯信息准则自适应选择最优聚类数，更准确地识别恶意模型更新；构建基于风险感知的动态噪声注入机制，根据客户端风险等级自适应调整高斯噪声强度，在保障隐私的同时减少对正常客户端的干扰.与最新防御方法对比实验结果表明，在面对PGD，PGDEDGE，MR这3种后门攻击不降低主任务准确率前提下，攻击成功率分别降低了5.80，3.27，1.00个百分点，并通过理论分析证明了FedAGMM在减少总噪声注入的同时满足隐私保护的要求，显著提高检测准确性和隐私安全性.

关键词: 联邦学习, 后门防御, 高斯混合模型, 差分隐私, 贝叶斯信息准则