FedVIB–AGP: defending against distributed backdoor attacks in federated learning via variational information bottleneck and activation-gap pruning

Counts differ because each database indexes a different set of publications. We treat OpenAlex as the canonical count; Google Scholar is not shown (no API, and crawling it violates its ToS).

A distributed backdoor attack (DBA) decomposes a global trigger into local components injected by multiple compromised clients, allowing a strong assembled-trigger response to emerge in the global model after federated aggregation. Existing defenses primarily analyze submitted client updates or apply generic repair criteria, and ma22y therefore leave trigger-sensitive internal pathways in the aggregated model insufficiently addressed. We propose FedVIB–AGP, a trigger-aware post-aggregation repair framework for non-independent and non-identically distributed (non-IID) horizontal federated learning (FL) under DBA that preserves the standard Federated Averaging (FedAvg) pipeline. During benign local training, a variational information bottleneck (VIB) regularizer constrains stochastic latent representations and is intended to discourage the retention of redundant trigger-correlated information. At repair rounds, under a setting in which the server has access to non-test clean samples and an assembled-trigger transform, activation-gap targeted pruning (AGP) compares channel responses on paired clean and assembled-trigger inputs, masks channels exhibiting disproportionate trigger-induced amplification, and performs clean fine-tuning for utility recovery. Experiments on CIFAR-10, Fashion-MNIST, MNIST, and SVHN yield attack success rates (ASR) of 2.16, 2.56, 0.81, and 0.60%, respectively, while retaining clean accuracies of 73.27, 75.93, 92.45, and 90.38%. Relative to Certifiably Robust Federated Learning(CRFL), the lowest-ASR competing baseline in the reported comparisons, FedVIB–AGP reduces ASR by up to 10.29% and improves clean accuracy by up to 11.16%. These results demonstrate that coupling representation-level regularization with trigger-conditioned structural repair can effectively suppress DBA-induced backdoor behavior while preserving benign-task utility in federated learning.