Mitigating Backdoor Attacks in Federated Learning Using PPA and MiniMax Game Theory

Osama Wehbi; Sarhad Arisdakessian; Omar Abdel Wahab; Anderson Avila; Azzam Mourad; Hadi Otrok

cs.LGMar 30, 2026

Mitigating Backdoor Attacks in Federated Learning Using PPA and MiniMax Game Theory

Authors: Osama Wehbi, Sarhad Arisdakessian, Omar Abdel Wahab, Anderson Avila, Azzam Mourad, Hadi Otrok

Organizations: Department of Computer and Software Engineering, Polytechnique Montréal, Montreal, Quebec, Canada · Institut national de la recherche scientifique (INRS-EMT), Montréal, Canada · Department of Computer Science, Khalifa University, Abu Dhabi, UAE · Artificial Intelligence & Cyber Systems Research Center, Department of CSM, Lebanese American University

Abstract

Federated Learning (FL) is witnessing wider adoption due to its ability to benefit from large amounts of scattered data while preserving privacy. However, despite its advantages, federated learning suffers from several setbacks that directly impact the accuracy, and the integrity of the global model it produces. One of these setbacks is the presence of malicious clients who actively try to harm the global model by injecting backdoor data into their local models while trying to evade detection. The objective of such clients is to trick the global model into making false predictions during inference, thereby compromising the integrity and trustworthiness of the global model on which honest stakeholders rely. To mitigate such mischievous behavior, we propose FedBBA (Federated Backdoor and Behavior Analysis). The proposed model aims to dampen the effect of such clients on the final accuracy, creating more resilient federated learning environments. We engineer our approach through the combination of (1) a reputation system to evaluate and track client behavior, (2) an incentive mechanism to reward honest participation and penalize malicious behavior, and (3) game theoretical models with projection pursuit analysis (PPA) to dynamically identify and minimize the impact of malicious clients on the global model. Extensive simulations on the German Traffic Sign Recognition Benchmark (GTSRB) and Belgium Traffic Sign Classification (BTSC) datasets demonstrate that FedBBA reduces the backdoor attack success rate to approximately 1.1%--11% across various attack scenarios, significantly outperforming state-of-the-art defenses like RDFL and RoPE, which yielded attack success rates between 23% and 76%, while maintaining high normal task accuracy (~95%--98%).

Figures & tables

Symbol	Description
$N$	Number of participating clients.
$T$	Total communication rounds.
$t$	Current round index.
$\mathcal{D}_{i}$	Local dataset of client $i$ .
$\mathcal{D}_{i}^{\prime}$	Poisoned dataset of client $i$ .
$x_{j},y_{j}$	Input sample and true label.

TABLE I: Notation Summary

Panel of Figure 2 — Fig. 1: Comparison of model clustering using PPA vs. PCA. PPA shows clearer separation between benign (black) and backdoored (blue) models.

Fig. 2: Architectural workflow of the proposed Minimax game.

Fig. 3: Normal task accuracy comparison of RDFL, Vanilla, FedBBA, and RoPE across datasets and attack settings over 100 communication rounds.

Fig. 4: Backdoor success rate comparison of RDFL, Vanilla, FedBBA, and RoPE across datasets and attack scenarios over 100 communication rounds.

$\alpha$	$\beta$	Accuracy (%)	Backdoor Success Rate (%)
0.1	0.9	96.6	25.0
0.2	0.8	95.4	28.0
0.3	0.7	96.9	21.0
0.4	0.6	96.2	33.0
0.5	0.5	96.8	16.0
0.6	0.4	96.2	22.0

TABLE II: Impact of

\alpha

and

\beta

on Model Accuracy and Backdoor Success Rate using GTSRB dataset over 100 rounds

Osama Wehbi is a Ph.D. candidate in the Department of Computer and Software Engineering at Polytechnique Montreal, Canada. His primary research areas include cybersecurity, federated learning, and game theory.

Table 7

Sarhad Arisdakessian is a Ph.D. candidate in the Department of Computer and Software Engineering at Polytechnique Montreal, Canada. His research interests lie in federated learning and game theory.

Table 8

Omar Abdel Wahab holds an assistant professor position with the Department of Computer and Software Engineering, Polytechnique Montreal, Canada. His research activities focus on cybersecurity, Internet of Things, and artificial intelligence.

Table 9

Anderson R. Avila is a Ph.D. candidate at the Institut National de la Recherche Scientifique (INRS), Canada. His research interests include speaker and emotion recognition, pattern recognition, and multimodal signal processing for biometric applications.

Table 10

Azzam Mourad is a Professor of Computer Science with Khalifa University, UAE. His research interests include cloud computing, artificial intelligence, and cybersecurity.

Table 11

Hadi Otrok is a Professor and Chair of the Department of Electrical Engineering and Computer Science at Khalifa University, UAE. His research interests include computer and network security, crowd sensing and sourcing, ad hoc networks, and cloud security.

Table 12

Explore similar work

FL-PBM: Pre-Training Backdoor Mitigation for Federated Learning
Mar 30, 2026Osama Wehbi, Sarhad Arisdakessian, Omar Abdel Wahab +3Backdoor Attacks in Federated Learning Federated Learning
Department of Computer and Software Engineering, Polytechnique Montréal, Montreal, Quebec, Canada · Department of Computer Science, Khalifa University, Abu Dhabi, UAE · Artificial Intelligence & Cyber Systems Research Center, Department of CSM, Lebanese American University +2
Exploiting Layer-Specific Vulnerabilities to Backdoor Attack in Federated Learning
Feb 16, 2026Mohammad Hadi Foroughi, Seyed Hamed Rastegar, Mohammad Sabokrou +1Backdoor Attacks Backdoor Attacks in Federated Learning
School of Electrical and Computer Engineering, University of Tehran, Tehran, Iran. · School of Computer Science, Institute for Research in Fundamental Sciences (IPM), Tehran, Iran. · School of Electrical and Computer Engineering, Shiraz University, Shiraz, Iran. +1
SCRUB-FL: Sanitizing and Cleansing Representations via Unlearning of Backdoors
Jun 21, 2026Osama Wehbi, Sarhad Arisdakessian, Omar Abdel Wahab +2Backdoor Attacks in Federated Learning Federated Learning
Department of Computer and Software Engineering, Polytechnique Montréal, Montreal, Quebec, Canada · Department of Computer Science, Khalifa University, Abu Dhabi, UAE

Mar 30, 2026J/K move · Enter open · S save

FL-PBM: Pre-Training Backdoor Mitigation for Federated Learning

Osama Wehbi, Sarhad Arisdakessian, Omar Abdel Wahab, Azzam Mourad+2

Department of Computer and Software Engineering, Polytechnique Montréal, Montreal, Quebec, Canada · Department of Computer Science, Khalifa University, Abu Dhabi, UAE · Artificial Intelligence & Cyber Systems Research Center, Department of CSM, Lebanese American University+2

Backdoor Attacks in Federated Learning Federated Learning

Open paper AskPDF arXiv

Backdoor attacks pose a significant threat to the integrity and reliability of Artificial Intelligence (AI) models, enabling adversaries to manipulate model behavior by injecting poisoned data with hidden triggers. These attacks can lead to severe consequences, especially in critical applications such as autonomous driving, healthcare, and finance. Detecting and mitigating backdoor attacks is crucial across the lifespan of model's phases, including pre-training, in-training, and post-training. In this paper, we propose Pre-Training Backdoor Mitigation for Federated Learning (FL-PBM), a novel defense mechanism that proactively filters poisoned data on the client side before model training in a federated learning (FL) environment. The approach consists of three stages: (1) inserting a benign trigger into the data to establish a controlled baseline, (2) applying Principal Component Analysis (PCA) to extract discriminative features and assess the separability of the data, (3) performing Gaussian Mixture Model (GMM) clustering to identify potentially malicious data samples based on their distribution in the PCA-transformed space, and (4) applying a targeted blurring technique to disrupt potential backdoor triggers. Together, these steps ensure that suspicious data is detected early and sanitized effectively, thereby minimizing the influence of backdoor triggers on the global model. Experimental evaluations on image-based datasets demonstrate that FL-PBM reduces attack success rates by up to 95% compared to baseline federated learning (FedAvg) and by 30 to 80% relative to state-of-the-art defenses (RDFL and LPSF). At the same time, it maintains over 90% clean model accuracy in most experiments, achieving better mitigation without degrading model performance.

Abstract

Explore similar work

FL-PBM: Pre-Training Backdoor Mitigation for Federated Learning

Exploiting Layer-Specific Vulnerabilities to Backdoor Attack in Federated Learning

SCRUB-FL: Sanitizing and Cleansing Representations via Unlearning of Backdoors