A Multi-Granularity Clustering Approach for Federated Backdoor Defense with the Adam Optimizer

1 Introduction

Federated learning (FL) [McMahan et al., 2017] is a distributed, privacy-preserving model that involves a trusted server and multiple participating clients, enabling collaborative training of a public model without compromising the clients' private data. Its compelling advantages have led to the adoption of FL in various privacy-sensitive domains, including image recognition [Chen et al., 2023], intelligent healthcare [Nguyen et al., 2022], and smart finance [Li et al., 2022].

However, in FL systems, the diversity and complexity of participants do not guarantee that every participant is honest and reliable. The decentralized nature of FL makes it particularly vulnerable to attacks, especially federated backdoor attacks (FBAs) [Gu et al., 2024], in which adversaries exploit the heterogeneity of training data to insert triggers into the raw data of malicious clients. These backdoors can be easily embedded into the shared public model, creating an urgent need for robust defense algorithms to enhance system reliability [Wang et al., 2020a].

→Corresponding Author

Most research on backdoor defenses in FL has been primarily focused on server-side strategies [Rodr´ıguez-Barroso et al., 2023]. In these approaches, the server evaluates each client model, excluding any anomalies or selecting only trusted clients to participate in the aggregation process [Sattler et al., 2020]. Many defense methods operate under the assumption of independent and identically distributed (IID) client data, relying on mean or median operations to construct global models [Yin et al., 2018]. However, these methods lose their effectiveness when faced with Non-IID data, as illustrated in Figure 1 (left).

Although recent clustering methods [Wang et al., 2023] enhance the efficacy of defenses, they struggle to address the non-stationary characteristics of client models. As demonstrated in Figure 1 (mid), in the FL attack environment, the objectives of each client are non-stationary, and their gradients exhibit noise across different FL iteration rounds. If the optimization method used, such as the commonly used stochastic gradient descent (SGD) [Wang et al., 2023], cannot effectively tackle these challenges, the robustness and efficiency of backdoor defense will be significantly undermined.

To effectively identify and eliminate suspected attacking clients in the FL process, we propose a backdoor defense method, FLAC, which core idea is to combine coarse-grained and fine-grained clustering methods to identify and remove malicious models in a Non-IID setting. For the coarsegrained approach, we employ a minimum spanning tree (MST) to differentiate between benign clients and potential attackers. For fine-grained clustering, we use a density-based strategy that computes distances using weighted local model parameters and the direction of their updates. To address the effects of nonstationary objectives and noisy gradients from clients, we leverage the Adam optimizer [Kingma, 2014] for federated model optimization, providing proof of its consistent convergence under FL conditions. As indicated in Figure 1 (right), the loss distributions between different clients using Adam optimizer are more stable compared to those using SGD. The lighter blue colours in the subfigure also suggest that Adam converges more quickly than SGD. The main contributions of this paper can be summarized as follows:

• To the best of our knowledge, we are the first to present the theoretical convergence of the Adam optimizer in the context of attack and defense within FL.
• We propose a multi-granularity clustering that effectively isolates attackers, ensuring robust performance in FL with malicious participants and Non-IID data.
• We evaluate the performance of FLAC on both time series and image datasets, demonstrating that FLAC is highly effective in mitigating backdoor attacks.

2 RelatedWork

2.1 Backdoor Attack

FL attacks can be categorized into data poisoning and model poisoning based on the attacker's targets [Gu and Bai, 2023]. Data Poisoning. Biggio et al. [Biggio et al., 2012] was the first to introduce data poisoning attacks in traditional machine learning. Sun et al. [Sun et al., 2019] examined the impact of backdoor attacks on federated systems' performance, employing simple label flipping to create adversarial data [Tolpegin et al., 2020; Wang et al., 2020a]. Zhang et al. [Zhang et al., 2019; Zhang et al., 2020] utilized adversarial networks to facilitate data poisoning attacks. While the aforementioned data poisoning models primarily focus on images, Jiang et al. [Jiang et al., 2023] proposed a generative approach for time series backdoor attacks. Chen et al. [Chen et al., 2024] combined time series shapelets with differential evolution to introduce local perturbations in time series data. Additionally, Kasyap and Tripathy [Kasyap and Tripathy, 2024] generate poisoned samples using hyper-dimensional computing to induce misclassification.

Model Poisoning. In the domain of model poisoning, Bagdasaryan et al. [Bagdasaryan et al., 2020] introduced a method that undermines the performance of the global model by submitting malicious updates to the server. Building on this foundation, Bhagoji et al. [Bhagoji et al., 2019] developed a strategy that enhances the attack's efficacy through alternating optimization of stealth and antitargeting. Conversely, Wang et al. [Wang et al., 2020a] executed a successful black-box attack on federated image classification, assuming the attacker has access to both the model's parameters and its structure. To improve attack effectiveness, Li et al. [Li et al., 2023a] proposed an adaptive, scalable, multi-layer FL attack model capable of launching covert model poisoning attacks under black-box conditions. Additionally, some strategies enhance backdoor attacks by distributing the backdoor triggers. This involves dividing the original backdoor triggers into smaller segments and assigning these new triggers to different attackers, allowing each attacker to utilize a distinct small trigger for the backdoor attack [Lyu et al., 2023]. Moreover, implementations of backdoor attacks have been explored using reinforcement learning and adversarial training techniques [Li et al., 2023b].

2.2 Defense Method

Federated defense methods can be categorized into three major types: server-side, client-side, and communication channel defenses [Rodr´ıguez-Barroso et al., 2023].

In server-side defenses, a common approach is to eliminate anomalous client-side updates by employing anomaly detection techniques to identify and exclude suspicious model distributions from aggregation. For instance, Sattler et al. [Sattler et al., 2020] utilize cosine distance to detect potential attack models, while Azulay et al. [Azulay et al., 2020] employ leave-out methods for the same purpose. Additionally, robust aggregation methods have been developed to statistically select estimates that are more stable than anomalies or extreme values, thereby enhancing the reliability of global models [Blanchard et al., 2017]. Recent research [Wang et al., 2023][Nguyen et al., 2021][Chen et al., 2023] has also introduced clustering-based frameworks and dynamic clipping strategies to further improve defense effectiveness.

Client-side defenses configure algorithms locally, making them robust as they ensure clients are benign and provide individual protection for each participant [Portnoy et al., 2022][Cao et al., 2021]. In contrast to these strategies, communication channel-based defenses focus on safeguarding user privacy. These approaches enable multiple participants to collaboratively train a global model while protecting the exchange of model parameters and gradient updates from unauthorized access and eavesdropping [Gu et al., 2024].

Despite their advantages, existing approaches fail to account for the non-stationary objectives of client models in the FBA setting. To address this issue, we introduce the Adam stochastic optimization method and demonstrate its theoretical convergence properties within the FL framework.

3 Preliminaries

The goal of FL is to minimize the average loss function L(w) of each participant's local model, defined as

where N denotes the number of participants, w represents the global model parameters, and Di indicates the private data of the i-th participant, such that D = D1 → ▷▷▷ → DN. The pair

(Xj i ↪ yj i ) represents the j-th instance of the i-th client with label yj i , and Li(w) is the loss function of the i-th participant.

In the t-th training round of FL, each participant receives a model wtg from the server, trains a local model using their data, and returns the updated model wt+1 i to the server for aggregation into a new global model wt+1 g . This updated model is then redistributed to participants for the next training round, continuing until convergence is achieved. Various aggregation strategies have been proposed for FL [Wang et al., 2020b]. We employ FedAvg [McMahan et al., 2017] to compute the average update value of the participating client set P for simplicity and efficiency.

Federated Backdoor Attack. FBA aims to poison the local data distribution X or manipulate model parameters in a way that adversely affects both benign models and the global model. To maintain stealthiness and robustness, FBA must balance the trade-off between the accuracy of each local model and the attack's success rate, formulated as

Here, Cb denotes the set of benign clients, and Cp the malicious clients. The target ω corresponds to the desired outcome of the poisoned or original data during training, and P(·) is the inference function used to evaluate the global model.

4 Method

As shown in Figure 2, FLAC's architecture consists of three primary parts: similarity calculation, multi-granularity clustering, and adaptive clipping. Additionally, the framework's convergence properties and computational overhead (time and memory consumption) are also analyzed.

4.1 Similarity Calculation

In FL, especially in Non-IID settings, client gradient updates often exhibit significant variations in magnitude. Relying solely on traditional distance metrics, such as Mahalanobis or Euclidean distance, may fail to capture the crucial information about the alignment of gradient directions. To address this, we propose the use of the cosine distance, which simultaneously considers both the magnitude and direction of updates. By comparing the parameter updates w and their corresponding direction vectors v, this dual approach enables a more comprehensive assessment of horizontal parameter differences and vertical gradient directions.

In the model parameter weighing strategy, the parameters of the initial layers in the local model substantially influence feature extraction, whereas the output layer plays a pivotal role in determining classification performance. Given that attackers aim to manipulate classification outcomes, when concatenating model parameters wi into a vector w↑i , the output layer's weights should be assigned a higher value compared to other parameters (e.g., 1.5 times).

Attackers share backdoor objectives leading to similar gradients, while honest clients optimize for local performance, creating directional differences. We track model update directions by measuring parameter changes across consecutive rounds to identify malicious behavior.

The sum of the similarity between the weighted model parameters and the update directions is used to compute the distance matrix between client models. This is given by

where w↑i represents the weighted vector of local model parameters for the i-th client, and vi = wt i ↑ wt↓3 i denotes the update direction for the i-th client. The coefficient ε lies within the interval (0, 1). This computation ensures that the elements of the matrix H ↓ Rp↔p lie between 0 and 2, with smaller cosine distances indicating higher similarity.

4.2 Multi-Granularity Clustering

To effectively identify and eliminate suspected malicious clients in Non-IID scenarios, we employ both coarse-grained and fine-grained clustering methods to detect and remove compromised models. Traditional density-based clustering algorithms tend to fail when the proportion of attackers is high; thus, we introduce the MST method as a coarse-grained approach. This method identifies the edge with the highest anomalous similarity value, thereby locating regions with potentially compromised models. For the fine-grained clustering, DBSCAN [Schubert et al., 2017] is employed, since the similarity distribution among clients is uneven and it can effectively identify boundaries in irregular cluster formations.

During the coarse-grained clustering process, Kruskal's algorithm [Kruskal, 1956] is employed to compute the MST, from which the largest edge is identified to partition the tree into two subtrees, resulting in two clusters, c1 and c2. According to the assumption in previous work [Wang et al., 2023], the similarity among benign clients is lower than that among attackers. This occurs because attackers typically share a common objective, resulting in a higher degree of similarity between their models, which places them closer in terms of distance. Consequently, we derive the relationship Hbenign, poison > Hbenign 1, benign 2 > Hpoison 1, poison 2. In contrast, the intra-cluster distance variation is significant, and the cluster with tighter intra-cluster distances is flagged as potentially containing attackers. For instance, if θc1 < θc2 , then clients in cluster c1 are likely to be identified as attackers.

For fine-grained clustering, the DBSCAN algorithm is employed, allowing nodes to self-organize into clusters while accommodating outliers. The clustering threshold is set at the 60th percentile of the similarity matrix H, and the resulting clusters are analyzed further. To handle cases where no attackers are present, the algorithm checks whether all participants cluster into a single group; if they do, it is inferred that no attackers are present. Otherwise, the participant with the highest variance within the cluster (e.g., c3) is identified as an attacker. Importantly, if the identified attackers exceed 50% of the total clients, the clustering process is bypassed, as such scenarios are unrealistic.

Given that FBA does not manifest obvious anomalies in normal input data, it is both covert and poses a significant threat. Therefore, the combination of coarse- and fine-grained methods (i.e., Cp = c1 → c3, Cb = [P] - Cp) is essential for ensuring robust detection and removal of malicious clients.

4.3 Adaptive Clipping

Some attackers may evade detection after the clustering step designed to eliminate suspicious clients. We employ adaptive clipping to mitigate the influence of remaining attackers on the global model. Previous works [Nguyen et al., 2021; Wang et al., 2023] have introduced clipping strategies, but these approaches often rely on fixed or heuristically determined thresholds. Selecting an appropriate clipping threshold remains a significant challenge.

During model training, the magnitude of updates from benign clients tends to decrease over time, due to constraints imposed by the optimization function [Nguyen et al., 2021]. Unlike prior approaches, our method eliminates the majority of suspicious clients during the clustering stage, leaving only a small number of malicious clients to be handled by the clipping process. Building on these insights, we propose a parameter statistics-based adaptive clipping strategy within our FLAC method. The mean (wθ = 1p ∑pi=1 wi) and variance (wω = 1p ∑pi=1 (wi ↑wθ)2 ) of model parameters from clients in the benign cluster are first calculated. Then the sum of wθ and 3↔wω forms the potential intermediate model wmid = wθ + 3↔wω.

Finally, the L2-norm of wmid is used as the clipping threshold. During aggregation, the clipping strategy from Eq. 5 is applied to mitigate outlier impacts:

Here, ϑt = ↗wtmid↗ is the clipping threshold for the t-th round.

4.4 Time andMemory Consumption Analysis

The time complexity of the training of each client is O(♣D♣ · Rtrain · Nparam), where Nparam represents the number of parameters in the model, Rtrain the training rounds. For our server-side defense FLAC, its time complexity is O(N 2 · Nparam). Since ♣D♣ · Rtrain ↘ N 2 in our setting, the computational time of FLAC is negligible. A detailed analysis of the time complexities can be found in Appendix C.

Regarding memory consumption, while Adam theoretically requires tripled memory compared to SGD due to storing two additional values per parameter [Shazeer and Stern, 2018], our empirical measurements show that the actual overhead ranges from 1.01! to 1.68! depending on model architecture, as shown in Appendix A2, which becomes negligible as communication bandwidth and computational costs dominate resource considerations by orders of magnitude.

4.5 Convergence Analysis

In our defense, each selected client employs the Adam optimizer for model updates, as described in Eq. 6:

where ϖ is the learning rate, mt represents the biased first moment estimate, and ˆ vt is the biased second raw moment estimate. The parameters ϱ1 and ϱ2 are the coefficients used for updating these moment estimates. Compared to the convergence analysis of SGD in FL, and following the conclusions of [Reddi et al., 2019], the key challenge for Adam lies in its denominator, which represents the biased second raw moment estimate. Establishing a lower bound for this term is critical. To address this, we adopt the proof concepts from [Chen et al., 2023], making several necessary assumptions. Theorem 1 outlines the resulting convergence analysis.

Assumption 1: For the expected loss function L(w) and any possible model parameter w, ˆw, L(w) is said to be ςsmooth if it satisfies

Assumption 2: For all w, let zj i be sampled uniformly at random from the local data Di of the i-th client, assuming that the variance of the stochastic gradient ≃Li(w; zj i ) in each client has an upper bound B2 , i.e., it satisfies

Assumption 3: In FL, both malicious and benign clients optimize their respective objectives independently. Therefore, the expectation-squared paradigm of the stochastic gradient is uniformly bounded. For all w, there exists an upper bound G on the gradient ≃Li(w).

Assumption 4: For all w, it is assumed that the diagonal elements of the squared stochastic gradient ≃Li(w) in each client have a uniform lower bound, i.e., they satisfy the following Eq.10 .

Lemma 1: For ⇑i↪ t↪ ↼ti =min¶1↪ εt ♣♣!wt i ♣♣ ♦, where i ↓ [pt] denotes the participant indexes in the aggregation rounds, and t ↓ [T] denotes the rounds. After clustering and removing suspicious models such that pt ⇒ p◁2, and assuming the clipping threshold ϑt is greater than the smallest local model paradigm, i.e., ϑt ⇒ min¶♣♣!wt i ♣♣♣♦ and 1 ↑ ↽t◁pt ⇐ Pri→[pt](♣♣!wt i ♣♣ ⇐ ϑt) ⇐ 1. Then we have 1 ↑ ↽t◁pt ⇐ Ei→[pt]↼ti ⇐ 1, where ↽t represents the number of attackers that evade the defense method at round t.

Theorem 1: According to the above Assumptions 1-4. after training T rounds, FLAC can converge to the global optimum w↗ g . Therefore, the convergence described by Eq.11 can be obtained.

where " = ∑Tt=1 ϑ2t , M = (1 ↑ ϱt1 ) ◁√1 ↑ ϱt2# and $ = ∑Tt=1 ↽t. The proof procedure of Lemma 1 and Theorem 1 are in Appendix A.

5 Experiments

In this section, we begin by detailing the experimental setup and demonstrate the effectiveness of our proposed FLAC method 1 by comparing it with classical defense approaches under various scenarios. Additionally, we assess the contribution of each individual module within our framework and provide an in-depth analysis of the method's performance through case studies.

1 The source code for FLAC is available at https://github.com/ catb62/FLAC

5.1 Experimental Setup

We conduct our experiments on both time series and image datasets within a simulated FL environment, implemented in PyTorch, with computations performed using CUDA 11.2.

We set 300 aggregation rounds as the convergence benchmark. As shown in Fig. 3, under non-attacking scenarios, all defense algorithms reach convergence by this point, ensuring a fair and consistent evaluation of their performance. Defense mechanisms are applied at each round to simulate realistic federated learning scenarios. Furthermore, to simulate Non-IID data distributions, the training data for each client was partitioned using a Dirichlet distribution, which allows for varying levels of data heterogeneity across clients.

Datasets. For the time series datasets, we adopt the settings from FLATS [Chen et al., 2024]. For image datasets, we evaluate our method on three common benchmark datasets: CIFAR-10 [Krizhevsky et al., 2009], MNIST [LeCun et al., 1998], and FMNIST [Xiao et al., 2017]. Additionally, we employ FCN [Yang et al., 2022] as the training model for time series datasets, while LeNet [LeCun et al., 1998] is utilized for image datasets. More dataset information can be found in Appendix D.

Baselines. We evaluate the effectiveness of our defense method by comparing it against five state-of-the-art defense methods: NDC [Sun et al., 2019], DP [Geyer et al., 2017], Krum [Blanchard et al., 2017], FoolsGold [Fung et al., 2018], and RFA [Pillutla et al., 2022].

For the FBA methods, we utilize FLATS [Chen et al., 2024] and its variants for time series datasets. For image datasets, we assess the performance of various defense methods under attacks from LF [Jebreel et al., 2023], MP [Bagdasaryan et al., 2020], and 3DFed [Li et al., 2023a].

Evaluation Metric. To assess the performance of our method and the baseline defenses, we measure the classification accuracy (ACC) of the aggregated model on the test dataset. Compared to the original method without defense (or under attack), the smaller the ACC drop, the more effective the defense method.

5.2 Experimental Results

In this section, we provide detailed experimental evidence to support the effectiveness of our defense method, FLAC.

No Attacker Case. Robust federated algorithms must maintain effectiveness without attackers. Figure 3 compares the performance of 6 defense algorithms on the MelbournePedestrian and ElectricDevices datasets. Both FLAC and RFA achieve ACC values comparable to FedAvg, with FLAC showing a more stable performance curve. In contrast, DP, NDC, and FoolsGold yield slightly lower ACC, while Krum's performance is significantly reduced due to its exclusion of many clients to mitigate attacker influence. These results indicate that FLAC maintains global model convergence, aligning with the convergence analysis.

Time Series Attack Table 1 presents a comparison of FLAC's performance against other defense baselines when the federated system is under attack by FLATS. The symbol "⇓" denotes a drop in ACC after applying defense mechanisms. As shown in bold in Table 1, FLAC achieves the best defense performance across 7 out of 8 datasets. Notably, on the TwoPatterns dataset, the ACC increased from 83.19% w/o Attack to 84.33% after implementing FLAC, further demonstrating its superior ability to mitigate the attacker's influence compared to other methods. The presence of "⇓" for both NDC and DP defense algorithms suggests that these approaches may hinder the contributions of benign clients to the global model. FLAC reached only 87.99% accuracy on the ECG5000 dataset, while NDC and RFA outperformed in this instance without an attack, likely because FLAC's clipping mechanism removed contributions from normal clients.

Figure 4 (left) illustrates the performance comparison of 6 defense algorithms on the FaceAll dataset. FLAC demonstrates greater stability with less fluctuation in ACC (red line), achieving an average value of 56.73%. In contrast, both the DP and FoolsGold algorithms exhibit limited performance during the first 200 iterations in the absence of attackers. Moreover, the NDC algorithm shows a continuous decline in ACC during the last 100 iterations when under attack, and the RFA algorithm results in significant fluctuations in ACC, indicating a lack of stability.

Additionally, we conducted defense experiments against various attack methods for the time series classification task in a FL scenario. The results, as presented in Table 2, demonstrate that FLAC effectively defends against all 4 different attacks. Notably, the "↑" symbol indicates an upward trend in ACC after applying the defense (w/ Def). The model's performance, particularly on the ElectricDevices and TwoPatterns datasets, shows minimal deviation compared to the w/o Attack scenarios, further underscoring the robustness and effectiveness of FLAC in mitigating the impact of these attacks.

UWaveGestureLibraryX 45.24 65.28 ≃ 49.70 71.33 ≃ 58.99 69.74 ≃ 68.51 69.29 ≃

Table 2: FLAC performance under 4 time series attack methods (%)

Figure 4 (right) illustrates the ACC curves for three scenarios on the TwoPatterns dataset: without attack (FedAvg), with attack (FLATS), and with both attack and defense (FLAC). The purple line indicates a sharp decline in ACC due to the FLATS attack, while the red line demonstrates that FLAC significantly restores ACC to levels comparable to the attackfree scenario, highlighting its effectiveness in enhancing system reliability under attack. Furthermore, in the 0-200 round range, where no attack occurs, FLAC maintains convergence and performance akin to the no-attack scenario, suggesting that its defense mechanism minimally impacts benign clients and preserves robust performance in the absence of attacks. Attack on Images To further validate the effectiveness of the proposed FLAC, we conduct experiments on 3 image datasets using 3 FBA algorithms and 6 defense methods. As shown in Table 3, FLAC achieves the best results in 8 out of 9 tests. Under various FBA scenarios (i.e., LF, MP, and 3DFed), FLAC attains an accuracy closer to the w/o Attack setting and shows a larger improvement compared to the w/o Def situation.

FMNIST 78.00 74.65 76.09 65.64 ↘ 77.60 43.40 ↘ 68.29

Table 3: FLAC performance on image datasets (%)

5.3 Ablation Experiment

This subsection presents ablation studies to verify the necessity of each component in the FLAC method. First, we assess the importance of parameter weighting and model update direction, denoted as FLAC-NW and FLAC-NV, respectively. Next, we evaluate FLAC-NT, which omits the MST algorithm, and FLAC-ND, which excludes the DBSCAN method. Additionally, we investigate the impact of clipping by introducing FLAC-NC, which removes the clipping component.

Lastly, to validate the effectiveness of the Adam optimizer, we replace it with SGD, referring to FLAC-NA.

Table 4 shows FLAC outperforms the second-best FLACNC by 1.64. Removing parameter weighting or update direction (FLAC-NW, FLAC-NV) results in worse defense, highlighting the importance of similarity calculation. Omit clustering (FLAC-NT, FLAC-ND) or replace Adam with SGD (FLAC-NA) leads to the poorest defense, stressing the role of clustering and Adam in identifying attackers.

Figure 5 presents the critical difference (CD) plot for the 7 evaluated strategies. FLAC ranks highest, followed closely by FLAC-NC, indicating effective identification and removal of most attackers during the multi-granularity clustering phase. The CD plot further reveals that FLAC significantly outperforms FLAC-NT, FLAC-NA, and FLAC-ND.

Figure 6 compares the performance of the Adam and SGD optimizers on the FaceAll dataset. In terms of ACC, the Adam optimizer (blue line) reaches higher levels in fewer rounds compared to the SGD (red line). Similarly, for loss, the Adam optimizer achieves lower values more quickly than SGD. These results demonstrate that the FLAC is more efficient and stable with the Adam optimizer in FL scenarios.

5.4 Case Study

To emphasize the role of clustering in the defense process, Figure 7 illustrates the cumulative number of attacker appearances (Attacker Number), the cumulative count of successfully identified attackers through our multi-granularity clustering (Identified Attackers), and the cumulative total of rejected clients (Rejected) over 300 communication rounds. The results of eight time series datasets demonstrate that the FLAC algorithm effectively rejects more than 90% of attackers while maintaining strong overall performance. This highlights the critical role of coarse and fine-grained clustering in identifying malicious participants, with few evading attackers emphasizing the necessity of clipping operations.

Furthermore, Figure 8 illustrates the complementary roles of MST and DBSCAN on the ElectricDevices dataset. The highlighted sections show the distinct contributions of each method, where MST identifies 170 attackers and DBSCAN identifies 165 ones. The overlapping areas represent the 122 attackers detected by both methods. This combination provides a robust and comprehensive elimination of suspicious clients, underscoring the importance of integrating both methods within the FLAC. As a further step, additional experiments can be found in Appendix E, which assess the impact of parameter selection and evaluate the robustness of FLAC against varying attacker proportions.

6 Conclusion

This paper proposes a robust federated backdoor defense algorithm leveraging Adam optimizer and multi-granularity clustering to accelerate learning and attacker detection. The approach integrates model parameter update magnitudes and gradient update directions for dual-level clustering analysis, enhanced by statistical pruning mechanisms to mitigate undetected adversarial influence. Theoretical analysis confirms convergence, while extensive experiments on time series and image datasets demonstrate stable defense performance. The future would combine server-side and client-side mechanisms for a more comprehensive defense system.

Acknowledgments

This work was supported by the Fundamental Research Funds for the Central Universities (No. 2024JBMC033), the National Natural Science Foundation of China (No. 62402031), and the Beijing Nova Program (No. 20240484620).