  Federated Learning (FL) offers collaborative model training without data
sharing but is vulnerable to backdoor attacks, where poisoned model weights
lead to compromised system integrity. Existing countermeasures, primarily based
on anomaly detection, are prone to erroneous rejections of normal weights while
accepting poisoned ones, largely due to shortcomings in quantifying
similarities among client models. Furthermore, other defenses demonstrate
effectiveness only when dealing with a limited number of malicious clients,
typically fewer than 10%. To alleviate these vulnerabilities, we present
G$^2$uardFL, a protective framework that reinterprets the identification of
malicious clients as an attributed graph clustering problem, thus safeguarding
FL systems. Specifically, this framework employs a client graph clustering
approach to identify malicious clients and integrates an adaptive mechanism to
amplify the discrepancy between the aggregated model and the poisoned ones,
effectively eliminating embedded backdoors. We also conduct a theoretical
analysis of convergence to confirm that G$^2$uardFL does not affect the
convergence of FL systems. Through empirical evaluation, comparing G$^2$uardFL
with cutting-edge defenses, such as FLAME (USENIX Security 2022) [28] and
DeepSight (NDSS 2022) [36], against various backdoor attacks including 3DFed
(SP 2023) [20], our results demonstrate its significant effectiveness in
mitigating backdoor attacks while having a negligible impact on the aggregated
model's performance on benign samples (i.e., the primary task performance). For
instance, in an FL system with 25% malicious clients, G$^2$uardFL reduces the
attack success rate to 10.61%, while maintaining a primary task performance of
73.05% on the CIFAR-10 dataset. This surpasses the performance of the
best-performing baseline, which merely achieves a primary task performance of
19.54%.
