SCRUB-FL: Sanitizing and Cleansing Representations via Unlearning of Backdoors

Research Question and Approach

Federated Learning (FL) is vulnerable to backdoor attacks, where malicious clients inject hidden triggers into their local training data to manipulate global model predictions. Existing defenses often struggle to remove these behaviors after the model has converged, either because they require access to private data, prior knowledge of the trigger, or because they rely on aggressive neuron pruning that degrades the model's overall accuracy.

SCRUB-FL (Sanitizing and Cleansing Representations via Unlearning of Backdoors) addresses this by introducing a two-phase, privacy-preserving framework. During the standard federated training process, clients use spectral analysis and activation clustering to identify suspicious samples. They then train a lightweight Wasserstein Generative Adversarial Network (WGAN-GP) to capture the distribution of these suspicious patterns. The server aggregates these generator parameters to create a global generative model, which is then used to synthesize trigger-approximating samples. After convergence, the server applies machine unlearning to these samples, forcing the model to redistribute its predictions toward a uniform distribution, effectively erasing the backdoor association without damaging the model's legitimate functionality.

Experimental evaluations on CIFAR-10 and GTSRB datasets demonstrate that SCRUB-FL significantly reduces the backdoor attack success rate to as low as 3.88% across various attack types, including One-to-One, One-to-N, and N-to-One scenarios. Notably, the framework maintains over 91% accuracy on clean, benign tasks. By avoiding structural modifications like neuron pruning, the method prevents the 'neuron entanglement' problem, where the removal of malicious features inadvertently harms legitimate model performance. The framework remains effective even with up to 40% malicious client participation.

This research provides a practical, privacy-compliant solution for securing federated models against persistent backdoor threats. By leveraging information collected during the training process rather than relying on external, potentially unavailable resources like large clean datasets, SCRUB-FL offers a scalable defense that aligns with the decentralized nature of federated learning. It demonstrates that post-training sanitization can be both robust and accurate, bridging a critical gap in current AI security literature.