As a distributed machine learning paradigm, Federated Learning (FL) enables large-scale clients to collaboratively train a model without sharing their raw data. However, due to the lack of data auditing for untrusted clients, FL is vulnerable to poisoning attacks, especially backdoor attacks. By using poisoned data for local training or directly changing the model parameters, attackers can easily inject backdoors into the model, which can trigger the model to make misclassification of targeted patterns in images. To address these issues, we propose a novel data-free trigger-generation-based defense approach based on the two characteristics of backdoor attacks: i) triggers are learned faster than normal knowledge, and ii) trigger patterns have a greater effect on image classification than normal class patterns. Our approach generates the images with newly learned knowledge by identifying the differences between the old and new global models, and filters trigger images by evaluating the effect of these generated images. By using these trigger images, our approach eliminates poisoned models to ensure the updated global model is benign. Comprehensive experiments demonstrate that our approach can defend against almost all the existing types of backdoor attacks and outperform all the seven state-of-the-art defense methods with both IID and non-IID scenarios. Especially, our approach can successfully defend against the backdoor attack even when 80\% of the clients are malicious.

通过学习后门攻击的两个特征，即触发器比正常知识学习得更快，触发器模式对图像分类的影响比正常类模式更大，我们的方法通过生成具有新学习知识的图像，并通过评估这些生成的图像的效果来过滤触发器图像，以确保更新的全局模型是良性的，实验结果表明，我们的方法可以抵御几乎所有现有类型的后门攻击，并在IID和non-IID场景下优于所有七种最先进的防御方法，尤其是在80％的恶意客户端存在时依旧能够成功抵御后门攻击。

通过无需数据生成触发器来保护联邦学习防止后门攻击