{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,10,10]],"date-time":"2025-10-10T01:40:48Z","timestamp":1760060448242,"version":"build-2065373602"},"reference-count":51,"publisher":"MDPI AG","issue":"9","license":[{"start":{"date-parts":[[2025,8,27]],"date-time":"2025-08-27T00:00:00Z","timestamp":1756252800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"name":"Open Foundation of Key Laboratory of Cyberspace Security, Ministry of Education","award":["KLCS20240210","3282023012","3282025041"],"award-info":[{"award-number":["KLCS20240210","3282023012","3282025041"]}]},{"name":"Fundamental Research Funds for the Central Universities","award":["KLCS20240210","3282023012","3282025041"],"award-info":[{"award-number":["KLCS20240210","3282023012","3282025041"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Symmetry"],"abstract":"<jats:p>Federated learning (FL) enables collaborative model training across distributed clients while preserving data privacy by sharing only local parameters. However, this decentralized setup, while preserving data privacy, also introduces new vulnerabilities, particularly to backdoor attacks, in which compromised clients inject poisoned data or gradients to manipulate the global model. Existing defenses rely on the global server to inspect model parameters, while mitigating backdoor effects locally remains underexplored. To address this, we propose a decoupled contrastive learning\u2013based defense. We first train a backdoor model using poisoned data, then extract intermediate features from both the local and backdoor models, and apply a contrastive objective to reduce their similarity, encouraging the local model to focus on clean patterns and suppress backdoor behaviors. Crucially, we leverage an implicit symmetry between clean and poisoned representations\u2014structurally similar but semantically different. Disrupting this symmetry helps disentangle benign and malicious components. Our approach requires no prior attack knowledge or clean validation data, making it suitable for practical FL deployments.<\/jats:p>","DOI":"10.3390\/sym17091398","type":"journal-article","created":{"date-parts":[[2025,8,27]],"date-time":"2025-08-27T15:49:34Z","timestamp":1756309774000},"page":"1398","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["A Decoupled Contrastive Learning Framework for Backdoor Defense in Federated Learning"],"prefix":"10.3390","volume":"17","author":[{"given":"Jiahao","family":"Cheng","sequence":"first","affiliation":[{"name":"Department of Cyberspace Security, Beijing Electronic Science and Technology Institute, Beijing 100070, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Tingrui","family":"Zhang","sequence":"additional","affiliation":[{"name":"Faculty of Engineering, The University of New South Wales, Sydney, NSW 2052, Australia"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Meijiao","family":"Li","sequence":"additional","affiliation":[{"name":"Department of Cyberspace Security, Beijing Electronic Science and Technology Institute, Beijing 100070, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Wenbin","family":"Wang","sequence":"additional","affiliation":[{"name":"School of Cyberspace Security, Beijing University of Posts and Telecommunications, Beijing 100088, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Jun","family":"Wang","sequence":"additional","affiliation":[{"name":"Department of Cyberspace Security, Beijing Electronic Science and Technology Institute, Beijing 100070, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Ying","family":"Zhang","sequence":"additional","affiliation":[{"name":"Department of Cyberspace Security, Beijing Electronic Science and Technology Institute, Beijing 100070, China"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"1968","published-online":{"date-parts":[[2025,8,27]]},"reference":[{"key":"ref_1","unstructured":"Kone\u010dn\u00fd, J., McMahan, H.B., Yu, F.X., Richt\u00e1rik, P., Suresh, A.T., and Bacon, D. (2016). Federated learning: Strategies for improving communication efficiency. arXiv."},{"key":"ref_2","unstructured":"Xie, C., Huang, K., Chen, P.Y., and Li, B. (2019, January 6\u20139). DBA: Distributed backdoor attacks against federated learning. Proceedings of the International Conference on Learning Representations (ICLR), New Orleans, LA, USA."},{"key":"ref_3","doi-asserted-by":"crossref","unstructured":"Tolpegin, V., Truex, S., Gursoy, M.E., and Liu, L. (2020, January 14\u201318). Data poisoning attacks against federated learning systems. Proceedings of the European Symposium on Research in Computer Security (ESORICS), Guildford, UK.","DOI":"10.1007\/978-3-030-58951-6_24"},{"key":"ref_4","doi-asserted-by":"crossref","unstructured":"Shejwalkar, V., Houmansadr, A., Kairouz, P., and Ramage, D. (2022, January 22\u201326). Back to the drawing board: A critical evaluation of poisoning attacks on production federated learning. Proceedings of the 2022 IEEE Symposium on Security and Privacy (SP), San Francisco, CA, USA.","DOI":"10.1109\/SP46214.2022.9833647"},{"key":"ref_5","unstructured":"Bagdasaryan, E., Veit, A., Hua, Y., Estrin, D., and Shmatikov, V. (2020, January 3\u20135). How to backdoor federated learning. Proceedings of the International Conference on Artificial Intelligence and Statistics (AISTATS 2020), Palermo, Italy."},{"key":"ref_6","unstructured":"Fang, M., Cao, X., Jia, J., and Gong, N. (2020, January 12\u201314). Local model poisoning attacks to Byzantine-robust federated learning. Proceedings of the 29th USENIX Security Symposium (USENIX Security 20), Boston, MA, USA."},{"key":"ref_7","doi-asserted-by":"crossref","unstructured":"Sun, Y., Ochiai, H., and Sakuma, J. (2022, January 18\u201323). Semi-targeted model poisoning attack on federated learning via backward error analysis. Proceedings of the 2022 International Joint Conference on Neural Networks (IJCNN), Padua, Italy.","DOI":"10.1109\/IJCNN55064.2022.9891990"},{"key":"ref_8","unstructured":"Bhagoji, A.N., Chakraborty, S., Mittal, P., and Calo, S.B. (2019, January 9\u201315). Analyzing federated learning through an adversarial lens. Proceedings of the International Conference on Machine Learning (ICML), Long Beach, CA, USA."},{"key":"ref_9","unstructured":"Yin, D., Chen, Y., Kannan, R., and Bartlett, P. (2018, January 10\u201315). Byzantine-Robust Distributed Learning: Towards Optimal Statistical Rates. Proceedings of the International Conference on Machine Learning (ICML), Stockholm, Sweden."},{"key":"ref_10","doi-asserted-by":"crossref","first-page":"1142","DOI":"10.1109\/TSP.2022.3153135","article-title":"Robust aggregation for federated learning","volume":"70","author":"Pillutla","year":"2022","journal-title":"IEEE Trans. Signal Process."},{"key":"ref_11","first-page":"118","article-title":"Machine learning with adversaries: Byzantine tolerant gradient descent","volume":"30","author":"Blanchard","year":"2017","journal-title":"Adv. Neural Inf. Process. Syst."},{"key":"ref_12","unstructured":"Shen, S., Tople, S., and Saxena, P. (2016, January 5\u20139). Auror: Defending against poisoning attacks in collaborative deep learning systems. Proceedings of the 32nd Annual Conference on Computer Security Applications (ACSAC 2016), Los Angeles, CA, USA."},{"key":"ref_13","unstructured":"Fung, C., Yoon, C.J.M., and Beschastnikh, I. (2020, January 14\u201318). The limitations of federated learning in sybil settings. Proceedings of the 23rd International Symposium on Research in Attacks, Intrusions and Defenses (RAID 2020), San Sebasti\u00e1n, Spain."},{"key":"ref_14","unstructured":"Mu\u00f1oz-Gonz\u00e1lez, L., Co, K.T., and Lupu, E.C. (2019). Byzantine-robust federated machine learning through adaptive model averaging. arXiv."},{"key":"ref_15","doi-asserted-by":"crossref","unstructured":"Wang, N., Xiao, Y., Chen, Y., Zheng, Z., and Zhang, Q. (2022, January 17\u201321). FLARE: Defending federated learning against model poisoning attacks via latent space representations. Proceedings of the 2022 ACM Asia Conference on Computer and Communications Security (ASIA CCS 2022), Taipei, Taiwan.","DOI":"10.1145\/3488932.3517395"},{"key":"ref_16","doi-asserted-by":"crossref","unstructured":"Huang, W., Ye, M., Shi, Z., Chen, W., and Zhang, Y. (2024, January 23\u201327). Fisher calibration for backdoor-robust heterogeneous federated learning. Proceedings of the European Conference on Computer Vision (ECCV 2024), Zurich, Switzerland.","DOI":"10.1007\/978-3-031-72633-0_14"},{"key":"ref_17","doi-asserted-by":"crossref","unstructured":"Ding, B., Yang, P., and Huang, S.J. (2025, January 15\u201319). FLAIN: Mitigating backdoor attacks in federated learning via flipping weight updates of low-activation input neurons. Proceedings of the 2025 International Conference on Multimedia Retrieval (ICMR 2025), Tokyo, Japan.","DOI":"10.1145\/3731715.3733342"},{"key":"ref_18","doi-asserted-by":"crossref","first-page":"5661","DOI":"10.1109\/TKDE.2024.3420778","article-title":"BADFL: Backdoor attack defense in federated learning from local model perspective","volume":"36","author":"Zhang","year":"2024","journal-title":"IEEE Trans. Knowl. Data Eng."},{"key":"ref_19","doi-asserted-by":"crossref","unstructured":"Lin, Y., Liao, Y., Wu, Z., and Chen, Y. (2024, January 12\u201314). Mitigating backdoors in federated learning with FLD. Proceedings of the 2024 5th International Seminar on Artificial Intelligence, Networking and Information Technology (AINIT), Shanghai, China.","DOI":"10.1109\/AINIT61980.2024.10581839"},{"key":"ref_20","doi-asserted-by":"crossref","unstructured":"Cao, X., Fang, M., Liu, J., Chen, T., and Yu, J. (2020). FLTrust: Byzantine-robust federated learning via trust bootstrapping. arXiv.","DOI":"10.14722\/ndss.2021.24434"},{"key":"ref_21","first-page":"14747","article-title":"Deep leakage from gradients","volume":"32","author":"Zhu","year":"2019","journal-title":"Adv. Neural Inf. Process. Syst."},{"key":"ref_22","doi-asserted-by":"crossref","unstructured":"Li, Z., Zhang, J., Liu, L., Yang, Z., and Chen, H. (2022, January 18\u201324). Auditing privacy defenses in federated learning via generative gradient leakage. Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition (CVPR 2022), New Orleans, LA, USA.","DOI":"10.1109\/CVPR52688.2022.00989"},{"key":"ref_23","doi-asserted-by":"crossref","first-page":"e253","DOI":"10.1017\/S0140525X16001837","article-title":"Building machines that learn and think like people","volume":"40","author":"Lake","year":"2017","journal-title":"Behav. Brain Sci."},{"key":"ref_24","doi-asserted-by":"crossref","unstructured":"Hamaguchi, R., Sakurada, K., and Nakamura, R. (2019, January 15\u201320). Rare event detection using disentangled representation learning. Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition (CVPR 2019), Long Beach, CA, USA.","DOI":"10.1109\/CVPR.2019.00955"},{"key":"ref_25","doi-asserted-by":"crossref","unstructured":"Liu, D., Cheng, P., Zhu, H., Zhao, J., and Liu, X. (October, January 27). Mitigating confounding bias in recommendation via information bottleneck. Proceedings of the 15th ACM Conference on Recommender Systems (RecSys 2021), Amsterdam, The Netherlands.","DOI":"10.1145\/3460231.3474263"},{"key":"ref_26","doi-asserted-by":"crossref","unstructured":"Wang, G., Han, H., Shan, S., and Chen, X. (2020, January 13\u201319). Cross-domain face presentation attack detection via multi-domain disentangled representation learning. Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition (CVPR 2020), Seattle, WA, USA.","DOI":"10.1109\/CVPR42600.2020.00671"},{"key":"ref_27","unstructured":"Oord, A., Li, Y., and Vinyals, O. (2018). Representation learning with contrastive predictive coding. arXiv."},{"key":"ref_28","first-page":"21271","article-title":"Bootstrap your own latent\u2014A new approach to self-supervised learning","volume":"33","author":"Grill","year":"2020","journal-title":"Adv. Neural Inf. Process. Syst."},{"key":"ref_29","doi-asserted-by":"crossref","unstructured":"Wang, D., Ding, N., Li, P., and Zheng, H.T. (2021). Cline: Contrastive learning with semantic negative examples for natural language understanding. arXiv.","DOI":"10.18653\/v1\/2021.acl-long.181"},{"key":"ref_30","unstructured":"Chen, T., Kornblith, S., Norouzi, M., and Hinton, G. (2020, January 13\u201318). A simple framework for contrastive learning of visual representations. Proceedings of the International Conference on Machine Learning (ICML 2020), Vienna, Austria."},{"key":"ref_31","doi-asserted-by":"crossref","unstructured":"He, K., Fan, H., Wu, Y., Xie, S., and Girshick, R. (2020, January 13\u201319). Momentum contrast for unsupervised visual representation learning. Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition (CVPR 2020), Seattle, WA, USA.","DOI":"10.1109\/CVPR42600.2020.00975"},{"key":"ref_32","doi-asserted-by":"crossref","unstructured":"Gao, T., Yao, X., and Chen, D. (2021). SimCSE: Simple contrastive learning of sentence embeddings. arXiv.","DOI":"10.18653\/v1\/2021.emnlp-main.552"},{"key":"ref_33","unstructured":"Jiang, T. (2025, January 20\u201326). Learn from failure: Causality-guided contrastive learning for generalizable implicit hate speech detection. Proceedings of the 31st International Conference on Computational Linguistics (COLING 2025), Tokyo, Japan."},{"key":"ref_34","doi-asserted-by":"crossref","unstructured":"Jin, X., Wang, J., Ou, X., Li, Y., and Chen, Z. (2025). Time-series contrastive learning against false negatives and class imbalance. IEEE Trans. Neural Netw. Learn. Syst., in press.","DOI":"10.1109\/TNNLS.2025.3568387"},{"key":"ref_35","unstructured":"Xuan, S., and Zhang, S. (2024, January 2\u20139). Decoupled contrastive learning for long-tailed recognition. Proceedings of the AAAI Conference on Artificial Intelligence (AAAI 2024), Vancouver, BC, Canada."},{"key":"ref_36","first-page":"14900","article-title":"Anti-backdoor learning: Training clean models on poisoned data","volume":"34","author":"Li","year":"2021","journal-title":"Adv. Neural Inf. Process. Syst."},{"key":"ref_37","doi-asserted-by":"crossref","unstructured":"Huang, Z., Lin, X., Wang, H., Chen, Y., and Li, M. (2021, January 14\u201318). DisenQNet: Disentangled representation learning for educational questions. Proceedings of the 27th ACM SIGKDD Conference on Knowledge Discovery & Data Mining (KDD 2021), Virtual Event, Singapore.","DOI":"10.1145\/3447548.3467347"},{"key":"ref_38","unstructured":"Alemi, A.A., Fischer, I., Dillon, J.V., and Murphy, K. (2016). Deep variational information bottleneck. arXiv."},{"key":"ref_39","unstructured":"Poole, B., Ozair, S., Van Den Oord, A., Alemi, A., and Tucker, G. (2019, January 9\u201315). On variational bounds of mutual information. Proceedings of the International Conference on Machine Learning (ICML 2019), Long Beach, CA, USA."},{"key":"ref_40","unstructured":"Tschannen, M., Djolonga, J., Rubenstein, P.K., and Hofmann, T. (2019). On mutual information maximization for representation learning. arXiv."},{"key":"ref_41","unstructured":"Wang, T., and Isola, P. (2020, January 13\u201318). Understanding contrastive representation learning through alignment and uniformity on the hypersphere. Proceedings of the International Conference on Machine Learning (ICML 2020), Vienna, Austria."},{"key":"ref_42","doi-asserted-by":"crossref","unstructured":"Shejwalkar, V., and Houmansadr, A. (2021, January 21\u201324). Manipulating the Byzantine: Optimizing model poisoning attacks and defenses for federated learning. Proceedings of the Network and Distributed System Security Symposium (NDSS 2021), San Diego, CA, USA.","DOI":"10.14722\/ndss.2021.24498"},{"key":"ref_43","doi-asserted-by":"crossref","unstructured":"Zhou, X., Chen, X., Liu, S., Li, J., and Wang, Y. (2025). FLGuardian: Defending against model poisoning attacks via fine-grained detection in federated learning. IEEE Trans. Inf. Forensics Secur., in press.","DOI":"10.1109\/TIFS.2025.3570119"},{"key":"ref_44","doi-asserted-by":"crossref","first-page":"2278","DOI":"10.1109\/5.726791","article-title":"Gradient-based learning applied to document recognition","volume":"86","author":"LeCun","year":"1998","journal-title":"Proc. IEEE"},{"key":"ref_45","unstructured":"Xiao, H., Rasul, K., and Vollgraf, R. (2017). Fashion-MNIST: A novel image dataset for benchmarking machine learning algorithms. arXiv."},{"key":"ref_46","unstructured":"Krizhevsky, A., and Hinton, G. (2009). Learning Multiple Layers of Features from Tiny Images, University of Toronto. Technical Report."},{"key":"ref_47","unstructured":"Hasanpour, S.H., Rouhani, M., Fayyaz, M., Sabokrou, M., and Fathy, M. (2016). Let\u2019s keep it simple, using simple architectures to outperform deeper and more complex architectures. arXiv."},{"key":"ref_48","doi-asserted-by":"crossref","unstructured":"He, K., Zhang, X., Ren, S., and Sun, J. (2016, January 27\u201330). Deep residual learning for image recognition. Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR 2016), Las Vegas, NV, USA.","DOI":"10.1109\/CVPR.2016.90"},{"key":"ref_49","unstructured":"Minka, T. (2025, August 17). Estimating a Dirichlet Distribution. Technical Report. 15 November 2000. Available online: https:\/\/tminka.github.io\/papers\/dirichlet\/minka-dirichlet.pdf."},{"key":"ref_50","unstructured":"Gu, T., Dolan-Gavitt, B., and Garg, S. (2017). BadNets: Identifying vulnerabilities in the machine learning model supply chain. arXiv."},{"key":"ref_51","first-page":"2579","article-title":"Visualizing data using t-SNE","volume":"9","author":"Maaten","year":"2008","journal-title":"J. Mach. Learn. Res."}],"container-title":["Symmetry"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/2073-8994\/17\/9\/1398\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,9]],"date-time":"2025-10-09T18:33:37Z","timestamp":1760034817000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/2073-8994\/17\/9\/1398"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,8,27]]},"references-count":51,"journal-issue":{"issue":"9","published-online":{"date-parts":[[2025,9]]}},"alternative-id":["sym17091398"],"URL":"https:\/\/doi.org\/10.3390\/sym17091398","relation":{},"ISSN":["2073-8994"],"issn-type":[{"type":"electronic","value":"2073-8994"}],"subject":[],"published":{"date-parts":[[2025,8,27]]}}}