FL-PBM: Pre-Training Backdoor Mitigation for Federated Learning

Osama Wehbi; Sarhad Arisdakessian; Omar Abdel Wahab; Azzam Mourad; Hadi Otrok; Jamal Bentahar

cs.LGMar 30, 2026

FL-PBM: Pre-Training Backdoor Mitigation for Federated Learning

Authors: Osama Wehbi, Sarhad Arisdakessian, Omar Abdel Wahab, Azzam Mourad, Hadi Otrok, Jamal Bentahar

Organizations: Department of Computer and Software Engineering, Polytechnique Montréal, Montreal, Quebec, Canada · Department of Computer Science, Khalifa University, Abu Dhabi, UAE · Artificial Intelligence & Cyber Systems Research Center, Department of CSM, Lebanese American University · KU 6G Research Center, Department of Computer Science, Khalifa University, Abu Dhabi, UAE · Concordia Institute for Information Systems Engineering, Concordia University, Montreal, Quebec, Canada

Abstract

Backdoor attacks pose a significant threat to the integrity and reliability of Artificial Intelligence (AI) models, enabling adversaries to manipulate model behavior by injecting poisoned data with hidden triggers. These attacks can lead to severe consequences, especially in critical applications such as autonomous driving, healthcare, and finance. Detecting and mitigating backdoor attacks is crucial across the lifespan of model's phases, including pre-training, in-training, and post-training. In this paper, we propose Pre-Training Backdoor Mitigation for Federated Learning (FL-PBM), a novel defense mechanism that proactively filters poisoned data on the client side before model training in a federated learning (FL) environment. The approach consists of three stages: (1) inserting a benign trigger into the data to establish a controlled baseline, (2) applying Principal Component Analysis (PCA) to extract discriminative features and assess the separability of the data, (3) performing Gaussian Mixture Model (GMM) clustering to identify potentially malicious data samples based on their distribution in the PCA-transformed space, and (4) applying a targeted blurring technique to disrupt potential backdoor triggers. Together, these steps ensure that suspicious data is detected early and sanitized effectively, thereby minimizing the influence of backdoor triggers on the global model. Experimental evaluations on image-based datasets demonstrate that FL-PBM reduces attack success rates by up to 95% compared to baseline federated learning (FedAvg) and by 30 to 80% relative to state-of-the-art defenses (RDFL and LPSF). At the same time, it maintains over 90% clean model accuracy in most experiments, achieving better mitigation without degrading model performance.

Figures & tables

Symbol	Description
$\mathcal{N}$	Number of participating clients
$\mathcal{D}_{i}$	Local dataset of client $i$
$\mathcal{G}^{t}$	Global model at communication round $t$
$\Lambda_{i}^{t}$	Local model of client $i$ at round $t$
$L(\cdot)$	Local loss function
$\eta$	Local learning rate

TABLE I: List of key symbols used in problem formulation.

Fig. 1: Overview of the proposed client-side preprocessing pipeline for backdoor mitigation in federated learning. The main components include dataset preprocessing, benign trigger augmentation, dimensionality reduction, clustering, and selective sanitization.

Panel of Figure 3 — Fig. 2: Model accuracy of different approaches over the normal task across datasets and distributions over 200 rounds. The color mapping for defense strategies is AVG (orange), LPSF (red), RDFL (green), FL-PBM (blue)

Panel of Figure 4 — Fig. 3: Model accuracy of different approaches over the malicious task across datasets and distributions for 200 rounds. The color mapping for defense strategies is AVG (orange), LPSF (red), RDFL (green), FL-PBM (blue)

Osama Wehbi is a Ph.D. candidate in the Department of Computer and Software Engineering at Polytechnique Montreal, Canada. His primary research areas include cybersecurity, federated learning, and game theory.

Table 5

Sarhad Arisdakessian is a PhD candidate in the Department of Computer and Software Engineering at Polytechnique Montreal, Canada. His primary research interests lie in the fields of Federated Learning and Game Theory.

Table 6

Omar Abdel Wahab holds an assistant professor position with the Department of Computer and Software Engineering, Polytechnique Montreal, Canada. His current research activities are in the areas of cybersecurity, Internet of Things and artificial intelligence.

Table 7

Azzam Mourad is a professor of Computer Science with Khalifa University Abu Dhabi, UAE. His research interests include the domains of cloud computing, Artificial intelligence, and Cybersecurity.

Table 8

Hadi Otrok is a professor and chair of the Department of EECS at Khalifa University, Abu Dhabi, UAE. His research interests include the domains of computer and network security, crowd sensing and sourcing, ad hoc networks, and cloud security.

Table 9

Jamal Bentahar is a professor of Computer Science with Khalifa University Abu Dhabi, UAE. His research interests include reinforcement and deep learning, multi-agent systems, computational logics, and service computing

Table 10

Explore similar work

Mitigating Backdoor Attacks in Federated Learning Using PPA and MiniMax Game Theory
Mar 30, 2026Osama Wehbi, Sarhad Arisdakessian, Omar Abdel Wahab +3Backdoor Attacks in Federated Learning Federated Learning
Department of Computer and Software Engineering, Polytechnique Montréal, Montreal, Quebec, Canada · Institut national de la recherche scientifique (INRS-EMT), Montréal, Canada · Department of Computer Science, Khalifa University, Abu Dhabi, UAE +1
SCRUB-FL: Sanitizing and Cleansing Representations via Unlearning of Backdoors
Jun 21, 2026Osama Wehbi, Sarhad Arisdakessian, Omar Abdel Wahab +2Backdoor Attacks in Federated Learning Federated Learning
Department of Computer and Software Engineering, Polytechnique Montréal, Montreal, Quebec, Canada · Department of Computer Science, Khalifa University, Abu Dhabi, UAE
Exploiting Layer-Specific Vulnerabilities to Backdoor Attack in Federated Learning
Feb 16, 2026Mohammad Hadi Foroughi, Seyed Hamed Rastegar, Mohammad Sabokrou +1Backdoor Attacks Backdoor Attacks in Federated Learning
School of Electrical and Computer Engineering, University of Tehran, Tehran, Iran. · School of Computer Science, Institute for Research in Fundamental Sciences (IPM), Tehran, Iran. · School of Electrical and Computer Engineering, Shiraz University, Shiraz, Iran. +1

Mar 30, 2026J/K move · Enter open · S save

Mitigating Backdoor Attacks in Federated Learning Using PPA and MiniMax Game Theory

Osama Wehbi, Sarhad Arisdakessian, Omar Abdel Wahab, Anderson Avila+2

Department of Computer and Software Engineering, Polytechnique Montréal, Montreal, Quebec, Canada · Institut national de la recherche scientifique (INRS-EMT), Montréal, Canada · Department of Computer Science, Khalifa University, Abu Dhabi, UAE+1

Backdoor Attacks in Federated Learning Federated Learning

Open paper AskPDF arXiv

Federated Learning (FL) is witnessing wider adoption due to its ability to benefit from large amounts of scattered data while preserving privacy. However, despite its advantages, federated learning suffers from several setbacks that directly impact the accuracy, and the integrity of the global model it produces. One of these setbacks is the presence of malicious clients who actively try to harm the global model by injecting backdoor data into their local models while trying to evade detection. The objective of such clients is to trick the global model into making false predictions during inference, thereby compromising the integrity and trustworthiness of the global model on which honest stakeholders rely. To mitigate such mischievous behavior, we propose FedBBA (Federated Backdoor and Behavior Analysis). The proposed model aims to dampen the effect of such clients on the final accuracy, creating more resilient federated learning environments. We engineer our approach through the combination of (1) a reputation system to evaluate and track client behavior, (2) an incentive mechanism to reward honest participation and penalize malicious behavior, and (3) game theoretical models with projection pursuit analysis (PPA) to dynamically identify and minimize the impact of malicious clients on the global model. Extensive simulations on the German Traffic Sign Recognition Benchmark (GTSRB) and Belgium Traffic Sign Classification (BTSC) datasets demonstrate that FedBBA reduces the backdoor attack success rate to approximately 1.1%--11% across various attack scenarios, significantly outperforming state-of-the-art defenses like RDFL and RoPE, which yielded attack success rates between 23% and 76%, while maintaining high normal task accuracy (~95%--98%).

Abstract

Explore similar work

Mitigating Backdoor Attacks in Federated Learning Using PPA and MiniMax Game Theory

SCRUB-FL: Sanitizing and Cleansing Representations via Unlearning of Backdoors

Exploiting Layer-Specific Vulnerabilities to Backdoor Attack in Federated Learning