FedSurrogate is a defense against backdoor attacks in federated learning—scenarios where malicious participants try to poison a shared model. Instead of simply removing suspected malicious updates (which causes accuracy loss when honest clients are misidentified), the system replaces confirmed malicious updates with downscaled versions from structurally similar benign clients, preserving useful gradient information while neutralizing the attack.
Main takeaways:
- Achieves below 10% false-positive rate across all datasets, compared to 31-32% for the next-best baseline, meaning it rarely misclassifies honest participants as attackers
- Uses layer-adaptive anomaly detection—it focuses on security-critical layers identified through directional divergence analysis rather than examining all parameters equally
- Keeps attack success rates below 2.1% while maintaining better main-task accuracy than existing defenses
- The bidirectional filtering stage both screens trusted clients for contamination and rescues false positives from the suspect pool