1
SCRUB-FL: Sanitizing and Cleansing Representations via Unlearning of Backdoors
arXiv:2606.22700v1 [cs.LG] 21 Jun 2026
Osama Wehbi, Sarhad Arisdakessian, Omar Abdel Wahab, Azzam Mourad, Hadi Otrok
Abstract—Federated Learning (FL) enables collaborative model training without sharing raw data, making it a promising paradigm for privacy-sensitive applications. However, its decentralized nature makes it inherently vulnerable to backdoor attacks, where malicious clients embed hidden triggers into local training data to manipulate model predictions. Existing defenses mainly operate during before and during aggregation cannot fully eliminate backdoor behaviors that persist in the converged global model. Moreover, the effectiveness of post-training sanitization is often limited by the server’s lack of knowledge of trigger patterns or poisoned clients after convergence, resulting in residual backdoor behaviors or accuracy degradation due to neuron entanglement. To address this limitation, we propose SCRUBFL (Sanitizing and Cleansing Representations via Unlearning of Backdoors), a two-phase solution for post-training backdoor removal in FL. During training, clients identify suspicious samples using spectral analysis and activation clustering, then train lightweight Wasserstein Generative Adversarial Network with Gradient Penalty (WGAN-GP) models to capture triggerrelated distributions. The generator parameters are aggregated server-side to construct a global representation of suspicious patterns without exposing raw data. After convergence, the server synthesizes trigger-approximating samples and applies machine unlearning to erase the trigger-target association by redistributing predictions toward a uniform distribution. Experimental evaluations on CIFAR-10 and GTSRB across three attack types and up to 40% malicious participation demonstrate that SCRUB-FL reduces the backdoor attack success rate to as low as 3.88% while maintaining over 91% normal task accuracy, outperforming state-of-the-art defenses without requiring prior trigger knowledge or a large clean proxy dataset at the server. Impact Statement—Federated Learning (FL) is increasingly deployed in privacy-sensitive applications, yet backdoor attacks remain a major threat because malicious behaviors can persist in the global model after training. Existing post-training defenses often require large labeled reference datasets, prior trigger knowledge, or extensive model modification, limiting their effectiveness. This work demonstrates that effective post-training backdoor removal can be achieved without access to client data, prior trigger knowledge, or a large clean server-side dataset. More importantly, it shows that information collected during distributed training can be leveraged to support the mitigation of backdoor attacks after model convergence. Experimental results indicate that backdoor attack success rates can be reduced below 3.88% while maintaining over 91% clean-task accuracy. Osama Wehbi is with the Department of Computer and Software Engineering, Polytechnique Montréal, Montreal, Quebec, Canada (e-mail: [email protected]). Sarhad Arisdakessian is with the Department of Computer and Software Engineering, Polytechnique Montréal, Montreal, Quebec, Canada (e-mails: [email protected]). Omar Abdel Wahab is with the Department of Computer and Software Engineering, Polytechnique Montréal, Montreal, Quebec, Canada (e-mails: [email protected]). Azzam Mourad is with the Department of Computer Science, Khalifa University, Abu Dhabi, UAE (e-mails: [email protected]). Hadi Otrok is with the Department of Computer Science, Khalifa University, Abu Dhabi, UAE (e-mails: [email protected]).
The proposed solution contributes to the emerging intersection of federated learning, artificial intelligence (AI) security, and machine unlearning by providing a practical mechanism for removing adversarially embedded behaviors from trained models. Index Terms—Federated Learning, Backdoor Attacks, PostTraining Sanitization, Generative Adversarial Networks, Machine Unlearning, Cybersecurity
I. I NTRODUCTION Federated Learning (FL) is a decentralized paradigm that enables multiple clients to collaboratively train a shared global model without exchanging raw data [1]. Clients perform local training on private datasets and transmit only model updates to a central server for aggregation, preserving data locality. Despite this advantage, the decentralized and partially trusted structure of FL introduces serious security vulnerabilities, since the server has no direct access to the client-side datasets, the system is inherently susceptible to adversarial exploitation. Among these threats, backdoor attacks have emerged as one of the most critical and difficult-to-address [2]. In a backdoor attack, malicious clients poison their local training data by embedding carefully crafted hidden triggers, such as pixel-level patches, frequency-domain perturbations, or semantic feature modifications, into a subset of samples while relabeling them to an attacker-designated target class. The resulting global model operates normally under standard inputs, successfully passing routine accuracy evaluations, yet produces attacker-controlled predictions whenever the trigger pattern is present at inference time. The severity of this threat is formally recognized by MITRE ATLAS (Adversarial Threat Landscape for Artificial-Intelligence Systems), which catalogues backdoor attacks on machine learning models as a high-priority adversarial tactic under technique AML.T0018, explicitly highlighting their applicability to collaborative and federated learning pipelines [3]. This institutional recognition underscores that backdoor attacks are not merely a theoretical concern but an actively tracked, real-world threat to deployed AI systems. This stealthy coexistence of normal functionality and embedded malicious behavior makes backdoor attacks particularly dangerous and resistant to detection through conventional model monitoring methods. Existing defense strategies against backdoor attacks in FL can be broadly categorized into three classes: pre-training, in-training, and post-training defenses. Pre-training defenses sanitize or inspect client data before federated training begins. However, they are inherently static, relying on prior knowledge of known attack patterns and applying filtering only once before training commences, making them ineffective against
2
adaptive or evolving backdoor strategies that emerge dynamically across training rounds. In-training defenses, such as robust aggregation [4] and anomaly-based filtering [5], identify and downweight suspicious updates during aggregation. While promising, they remain vulnerable to sophisticated types of attacks, tend to destabilize model convergence, degrade normal task accuracy due to the exclusion of legitimate updates, and cannot guarantee the complete elimination of backdoor patterns that gradually accumulate across training rounds. Post-training defenses operate on the converged global model but typically rely on a limited clean proxy dataset at the server and lack direct knowledge of trigger patterns or poisoned clients after convergence. Consequently, they often fail to fully eliminate backdoor behaviors, either leaving residual malicious patterns through incomplete sanitization or causing unnecessary accuracy degradation through aggressive neuron pruning, a problem known as neuron entanglement, wherein backdoorsensitive neurons also encode legitimate semantic features, making their removal harmful to normal task performance. Therefore, despite the progress achieved by existing defenses, effective post-training sanitization in federated learning remains challenging due to the lack of sufficient knowledge about trigger patterns and malicious behaviors needed to act effectively in a federated setting. These challenges are further compounded by the trade-off between backdoor removal and accuracy preservation, the diversity of attack types considered in the defense literature, and the need for extensive retraining or fine-tuning after convergence. To bridge this critical gap, we propose SCRUB-FL (Sanitizing and Cleansing Representations via Unlearning of Backdoors), a novel and privacy-compliant framework for detecting and neutralizing backdoor attacks in a converged federated model. Rather than intervening before or during aggregation, SCRUB-FL operates after training has been accomplished, targeting the residual malicious behaviors embedded in the global model’s parameters. The key insight driving our approach is that backdoor triggers induce characteristic activation anomalies in specific neurons, which can be exposed by feeding the model with synthetically generated suspicious samples that approximate the trigger distribution. To produce these samples without accessing raw client data, each client trains a lightweight Generative Adversarial Network (GAN) on a locally extracted subset of suspicious samples, identified through spectral signature analysis and per class activation clustering. These complementary techniques enable the detection of both dominant poisoning directions in the feature space and anomalous neuron activation patterns that may not appear as strong spectral outliers. SCRUB-FL assumes a protocolcompliant adversary commonly adopted in federated learning security literature. Although malicious clients may poison local training data, they continue to follow the prescribed training protocol, including the lightweight GAN training step, to avoid detection and exclusion from the federation. The resulting generator parameters are communicated alongside model updates and aggregated server-side to form a global generative model. This global generator is then used to synthesize suspicious inputs, which are passed through the global classifier. Rather than pruning neurons that may
encode both backdoor and legitimate features, SCRUB-FL applies machine unlearning, where the model is trained to produce a uniform, non-committal output distribution over all classes when presented with trigger-approximating inputs, while simultaneously preserving correct predictions on clean reference samples. This simultaneous forgetting preservation objective, with an amplified unlearning signal, erases the backdoor mapping without any permanent structural modification to the network, producing a sanitized model that retains high utility on benign tasks. The main contributions of this work are summarized as follows: 1) Proposing SCRUB-FL, a post-training backdoor sanitization framework for federated learning that operates on the converged global model without requiring access to raw client data or a large labelled clean proxy dataset at the server. 2) Designing a privacy-preserving suspicious pattern extraction pipeline in which each client identifies locally anomalous samples using spectral signatures and perclass clustering, and trains a lightweight GAN to capture their distributional characteristics. 3) Developing a server-side machine unlearning mechanism that synthesizes trigger-approximating samples from the aggregated global generator and applies a simultaneous forgetting-preservation objective with an amplified unlearning signal to erase trigger-to-target mappings, avoiding the neuron entanglement problem that causes accuracy degradation in pruning-based posttraining defenses. 4) Demonstrating through extensive experiments on CIFAR-10 and GTSRB that SCRUB-FL effectively suppresses backdoor attack success rates to as low as 3.88% across diverse attack scenarios, including One-toOne, One-to-N, and N-to-One attacks under up to 40% malicious participation, while maintaining high normal task accuracy, outperforming both aggregation-phase and post-training defens baselines. The remainder of this paper is structured as follows. Section II reviews related work on backdoor attacks and defense mechanisms in federated learning. Section III introduces the background concepts underpinning our framework. Section IV formally defines the backdoor threat model considered in this work. Section V presents the SCRUB-FL architecture and its core components. Section VI reports experimental results and comparative analysis. Finally, Section VII concludes the paper and outlines directions for future research. II. R ELATED W ORK In this section, we review representative works across these phases, examine their methodological contributions and limitations, and identify the gaps that motivate the design of SCRUB-FL. The authors of [6] propose a defense where each client searches for a path in the model weight space between the received global model and its own locally trained model, selecting an intermediate point that reduces backdoor influence
3
while preserving normal task performance. However, this process is computationally expensive for edge devices and forces a trade-off between security and accuracy, with the defense breaking down when most clients are malicious. To move detection to the server side, the authors of [7] propose inspecting client gradients directly using a local reference dataset, with the detection logic hidden to prevent attackers from bypassing it. While promising, the method produces a high number of false alarms, up to 51.5%, when the reference dataset is small, and assumes that attackers cannot reverseengineer the hidden detection code, which may not hold against advanced adversaries. The authors of [8] propose a server-side defense that uses a reinforcement learning agent to assign trust scores to client updates by comparing them against a reference built from a small clean dataset. Although the method adapts well to moderate attack scenarios, it requires the server to hold clean data, which conflicts with the privacy goals of federated learning, and its performance drops significantly when the number of malicious clients is high. The authors of [9] use clustering to group client updates and select the most trustworthy ones, then apply knowledge distillation to improve the global model using an unlabeled dataset on the server. Despite its effectiveness, the method requires a large amount of server-side data and runs clustering and distillation every training round, making it too costly for large-scale federated systems. The authors of [10] detect suspicious client updates by checking whether their outputs fall outside the normal data distribution, then apply privacy noise to further reduce backdoor influence. However, the added noise consistently hurts normal task accuracy, and the method fails against attacks that are designed to look like normal data and thus avoid detection. The authors of [11] evaluate each client’s behavior across multiple metrics such as how much their updates align with the global model direction and how consistent they are across rounds, filtering out updates that appear coordinated or abnormally large. Despite covering many attack patterns, the method needs a clean reference dataset on the server and works poorly on small or simple network architectures. The authors of [12] split the model into two parts: a feature extractor trained using self-supervised learning to avoid linking trigger patterns to target labels, and a classifier aggregated by the server. While effective, this design requires all clients to change how they train their models, which adds significant cost and slows down learning in the early training rounds. Several works have also focused on cleaning the global model after training is complete. The authors of [13] ask clients to vote on which neurons are most important for the main task, and the server uses these votes to suppress neurons that may be linked to backdoor behavior. However, suppressing too many neurons accidentally removes useful ones, hurting accuracy and making the model vulnerable to attacks that spread the backdoor across many neurons to avoid detection. The authors of [14] remove a known attacker’s past updates from the global model by subtracting them directly, then use knowledge distillation to recover normal performance. The main drawback is that the server must already know which clients were malicious and must have access to a clean dataset for distillation, both of which are strong assumptions that are
hard to satisfy in practice. The authors of [15] limit the size of neuron activations in the trained global model to cut off the unusually large responses caused by poisoned inputs. While this confirms that acting on the model after training can work, the method depends on high-quality synthetic data to identify the right thresholds, and poor-quality data leads to either overpruning or leaving the backdoor in place. The authors of [16] train a GAN on the server to generate samples that reflect backdoor patterns in the global model, relabel them using a clean reference model, and use knowledge distillation to remove the backdoor. However, the method requires the server to hold labeled clean data, which goes against the privacy principles of federated learning, and the quality of the defense depends entirely on whether the GAN successfully learns the backdoor pattern. The works reviewed above reveal two clear gaps in the existing literature. First, most defenses focus on filtering or adjusting client updates during training, but they cannot remove backdoor patterns that have already been built into the model over many training rounds, and they often hurt normal accuracy or add too much computational cost. Second, defenses that act after training is complete typically rely on having clean data at the server, knowing which clients were malicious, or having some prior knowledge of the backdoor trigger, none of which can be assumed in a real federated learning setting. These limitations highlight the need for a post-training defense that works without any clean data at the server, without knowing what the trigger looks like, and without changing how clients train their models. This is exactly what SCRUB-FL aims to achieve by collecting information about suspicious patterns during training in a privacy-preserving way, and using it to erase the backdoor mapping through machine unlearning after training is done, without requiring neuron removal or structural modification to the network. III. S YSTEM P RELIMINARIES In this section, we introduce the core concepts and techniques that form the foundation of our proposed framework. Starting by describing the standard federated learning process, followed by an overview of Generative Adversarial Networks and their role in our approach, and conclude with a description of the two client-side anomaly detection techniques used to identify suspicious local samples. For clarity and consistency throughout this paper, Table I summarizes the key symbols and notation used in our formulation. A. Federated Learning Federated learning is a distributed machine learning framework that allows a group of N clients to jointly train a shared global model without sharing their raw data [1]. Each client i i holds a private local dataset Di = {(xj , yj )}nj=1 , where xj denotes an input sample and yj its corresponding class label. Training proceeds over T communication rounds. At the start of each round t, the server broadcasts the current global model parameters W t to all participating clients. Each client i
4
TABLE I: Summary of Key Symbols and Notation Symbol
Description
N T t Di Dis Dip ni x y y∗ τ xτ ρ Im W Wit Wt η L Gϕ Dψ Gtϕ Ḡϕ xg fW (·) u λu ηu Eu Lforget Lpreserve Lunlearn Ŵ
Total number of clients in the federation Total number of federated training rounds Index of the current training round Local dataset of client i Suspicious sample subset extracted by client i Poisoned local dataset of a malicious client i Number of samples in Di Input data sample True class label of x Attacker’s target class label Backdoor trigger pattern Triggered sample, x ⊕ τ Poisoning ratio in Dip Set of malicious client indices Global model parameters Local model of client i at round t Global model at round t Local learning rate Training loss function Generator with parameters ϕ Discriminator with parameters ψ Local generator of client i at round t Aggregated global generator Generated suspicious sample Global classifier 1 Uniform soft label vector, C 1 ∈ RC Unlearning amplification multiplier Unlearning learning rate Number of unlearning epochs Forgetting loss over generated suspicious samples Preservation loss over clean reference inputs Combined unlearning objective Sanitized global model parameters
the target distribution or a synthetic sample from the generator, and tries to distinguish between the two. The two networks are trained simultaneously by optimizing the following minimax objective:
min max Ex∼pdata [log Dψ (x)]+Ez∼p(z) [log (1 − Dψ (Gϕ (z)))] ϕ
(3) As training progresses, the generator learns to produce increasingly realistic samples that the discriminator can no longer distinguish from real ones. In SCRUB-FL, we use a Wasserstein GAN with Gradient Penalty (WGAN-GP) [18], a more stable variant of the standard GAN that replaces the original loss with a Wasserstein distance-based objective:
min max Ex∼pdata [Dψ (x)] − Ez∼p(z) [Dψ (Gϕ (z))] ϕ
N X i=1
ni PN
j=1 nj
Wit
(4)
C. Spectral Signature Analysis
(1)
where η is the local learning rate and L is the training loss function. Once local training is complete, each client sends its updated parameters Wit back to the server. The server aggregates all received updates using a weighted average to produce the next global model: W t+1 =
∥ψ∥L ≤1
where the discriminator Dψ is constrained to be a 1Lipschitz function enforced via gradient penalty. This formulation provides more stable training gradients and converges reliably even when trained on small datasets, making it wellsuited for learning from the limited suspicious subsets available at each client.
then performs local training by minimizing the following local objective: Wit = W t − η ∇L W t ; Di
ψ
(2)
This process repeats for T rounds until the global model converges. The key privacy property of this framework is that raw data Di never leaves the client device; only model parameters are communicated. B. Generative Adversarial Networks A Generative Adversarial Network (GAN) is a generative model composed of two neural networks that are trained together through a competitive process [17]. The first network, called the generator Gϕ , takes a random noise vector z ∼ p(z) as input and produces a synthetic sample Gϕ (z) that resembles samples from a target data distribution. The second network, called the discriminator Dψ , receives either a real sample from
Spectral signature analysis is a technique used to identify potentially poisoned samples within a dataset by examining the statistical structure of their feature representations [19]. The core idea is that backdoor triggers introduce a shared consistent feature across poisoned samples. As the model learns to associate this trigger with the attacker’s target label, the latent representations of poisoned samples become more aligned with one another than with clean samples from the same class. This creates a dominant outlier direction in the feature covariance structure, making poisoned samples statistically distinguishable through spectral analysis. Given the feature representations of all samples in a class, extracted from an intermediate layer of the model, we compute the covariance matrix of these representations and apply Singular Value Decomposition (SVD) to identify the top principal directions of variation. For each sample xj , its spectral signature score is computed as its projection onto the top singular vector v1 : ⊤ sj = hj − h̄ v1
(5)
where hj is the feature representation of sample xj and h̄ is the mean feature representation of all samples in the class. Samples with spectral scores that fall significantly above the mean are flagged as potentially poisoned, as they align strongly with the dominant outlier direction introduced by the trigger. In SCRUB-FL, this analysis is performed locally on each client’s dataset to extract the suspicious subset Dis before GAN training begins.
5
D. Activation Clustering
B. Backdoor Attack Model
Activation clustering is a complementary anomaly detection technique that identifies suspicious samples by analyzing how they group in the activation space of a neural network [19]. The intuition behind adopting this technique into our solution is that poisoned samples, despite carrying the same label as clean samples of the target class, activate a distinct set of neurons due to the presence of the trigger, causing them to form a separate cluster in the model’s internal representation space. Given a set of samples from class c, we extract their activation vectors {a(xj )} from a target layer of the local model and apply a clustering algorithm such as K-Means to partition them into two groups. The smaller or more isolated cluster is considered the suspicious group, as it corresponds to samples whose internal representations deviate from the majority of clean samples in that class. Formally, for each class c, we partition the activation vectors into two clusters C1c and C2c by solving:
A backdoor attack aims to embed a hidden malicious behavior into the global model such that the model performs normally on clean inputs but produces attacker-controlled predictions whenever a specific trigger pattern is present in the input. We first define the poisoning process used by malicious clients, followed by the different backdoor attack types considered in this work. 1) Data Poisoning: Each malicious client i ∈ I m constructs a poisoned local dataset Dip by injecting trigger-bearing samples into a fraction ρ of its clean data. Formally, the poisoned dataset is defined as:
arg min C1c , C2c
X
X
∥aj − µck ∥
2
(6)
k∈{1,2} aj ∈Ckc
where µck is the centroid of cluster k for class c. The cluster with fewer members is taken as the suspicious subset for that class. In SCRUB-FL, activation clustering is applied in parallel with spectral signature analysis, and the union of samples flagged by both methods forms the final suspicious subset Dis used to train the local GAN. IV. P ROBLEM F ORMULATION In this section, we formally define the federated learning setting considered in this work, describe the backdoor attack models that SCRUB-FL is designed to defend against, and specify the capabilities and limitations assumed for both the attacker and the defender. A clear threat model is essential to understanding the scope of our defense and the conditions under which it is expected to operate.
A. Federated Learning Setting We consider a standard federated learning system consisting of one central server and N clients. Each client i holds a private local dataset Di that is never shared with the server or with other clients. Training proceeds over T communication rounds as described in Section III. Among the N participating clients, a subset I m ⊂ {1, . . . , N } are malicious, meaning they actively attempt to embed backdoor behaviors into the global model during local training. The remaining clients {1, . . . , N } \ I m are honest and train on clean, unmodified local datasets. We assume that the fraction of malicious clients satisfies |I m |/N < 0.5, meaning that honest clients constitute the majority of participants, which is a standard and widely adopted assumption in the federated learning security literature [20].
Dip = Diclean ∪ Ditrigger
(7)
where Diclean contains the unmodified samples and Ditrigger contains the poisoned samples, with |Ditrigger | = ρ · |Di |. Each poisoned sample is constructed by applying a trigger pattern τ to a clean input x and replacing its true label y with the attacker’s target label y ∗ : Ditrigger = {(x ⊕ τ, y ∗ ) : (x, y) ∈ Di , y ̸= y ∗ }
(8)
where ⊕ denotes the trigger application operation, which may represent pixel-level overlay, frequency-domain perturbation, or any other method of embedding the trigger into the input sample. 2) Attack Types: Depending on how the trigger is structured and how many target behaviors are involved, we distinguish between the following three attack types, all of which SCRUBFL is designed to handle: One-to-One Attack. A single trigger τ is applied to samples from one or more source classes to cause the model to predict a single fixed target label y ∗ . This is the most common and well-studied form of backdoor attack: fW (x ⊕ τ ) = y ∗ ,
∀ (x, y) ∈ Di , y ̸= y ∗
(9)
One-to-N Attack. Multiple trigger variants {τ1 , τ2 , . . . , τK } are used, each mapping triggered inputs to a different target label. This makes detection harder as the attack spans multiple output behaviors: fW (x ⊕ τk ) = yk∗ ,
k = 1, 2, . . . , K
(10)
N-to-One Attack. Multiple triggers {τ1 , τ2 , . . . , τK } must all be present simultaneously in the input to activate the backdoor. No individual trigger alone causes a misclassification, making this attack particularly difficult to detect: ! K M fW x ⊕ τk = y ∗ (11) k=1
3) Attack Objective: The objective of the attacker is to craft local model updates that, when aggregated with honest client updates, cause the global model to satisfy two conditions simultaneously. First, the model must behave normally on clean inputs, maintaining high classification accuracy on the main task to avoid basic detection. Second, the model must
6
produce the target label y ∗ whenever the trigger is present. This dual objective can be expressed as the following local training problem solved by each malicious client: trigger t clean t (12) L W ; D + λ · L W ; D min a i i i i t Wi
where λa > 0 is a scaling factor that controls the relative weight given to the backdoor task versus the main task during malicious local training. A higher λa produces stronger backdoor injection but may increase the detectability of the malicious update. C. Attacker Capabilities and Assumptions The attacker is assumed to have control over a subset of compromised clients I m , including the ability to modify local training data (e.g., via data poisoning). The attacker can also coordinate across malicious clients to distribute the backdoor trigger and improve its effectiveness while reducing per-client detectability. However, the attacker has no access to the server-side aggregation process, cannot directly modify the global model, and has no prior knowledge of the server’s defense mechanism. Furthermore, the attacker cannot observe or interfere with the local training of honest clients. These assumptions reflect a realistic and widely adopted threat model in federated learning backdoor attack literature, where malicious clients are compromised while the server and benign clients remain trusted [2], [5]. The client has no visibility into which samples are flagged, and therefore has no mechanism to selectively manipulate the composition of the subset used to train the local WGAN-GP. The attacker’s control ends at data submission; everything downstream is handled internally by the pipeline. The adversary is further assumed to be protocolcompliant during training. Malicious clients can manipulate their local data but cannot alter the server-mandated training process or directly modify the global aggregation procedure. To avoid detection and exclusion, compromised clients follow the training protocol, including the GAN training step, which appears as a standard task. D. Defender Capabilities and Assumptions The server performs standard federated aggregation as defined in Equation (2) and has access to all client model updates {Wit }N i=1 in each round. Critically, the server has no access to any client’s raw data Di , no prior knowledge of the trigger pattern τ , a small labeled clean proxy dataset, and no information about which clients belong to I m . These constraints reflect the strict privacy and trust assumptions that define the federated learning setting and distinguish our problem from centralized backdoor defense scenarios. The server does, however, receive the generator parameters Gtϕi from each client alongside the classifier updates, as described in Section V, which are the only additional information required by SCRUB-FL beyond the standard federated protocol. E. Defense Goal Given the federated setting and threat model described above, the goal of SCRUB-FL is to produce a sanitized global
model Ŵ after training has converged such that the following two conditions hold: Backdoor Elimination. The sanitized model no longer produces the attacker’s target label when presented with triggered inputs. Formally, for all attack types defined in Equations (9– 11): fŴ (x ⊕ τ ) ̸= y ∗ ,
∀ (x, y) ∈ Dtest
(13)
Utility Preservation. The sanitized model maintains high classification accuracy on clean inputs, comparable to the performance of a model trained without any malicious participants: Acc fŴ − Acc(fW ∗ ) ≤ ϵ
(14)
where fW ∗ denotes an ideally trained clean global model and ϵ > 0 is a small acceptable accuracy tolerance. Achieving both conditions simultaneously, without access to clean serverside data or knowledge of the trigger, is the central challenge that SCRUB-FL is designed to address.
V. T HE SCRUB-FL F RAMEWORK In this section, we present the full architecture of SCRUBFL (Sanitizing and Cleansing Representations via Unlearning of Backdoors). SCRUB-FL operates in two sequential phases that together address the knowledge gap described in Section IV. The first phase runs concurrently with the standard federated training process and is responsible for capturing a compact, privacy-preserving representation of suspicious pattern distributions at each client. The second phase executes once after the global model has fully converged. It uses the captured knowledge to identify and neutralize backdoorsensitive neurons in the global model. Figure 1 provides a high-level overview of the SCRUB-FL architecture, illustrating how the two phases interact with the standard federated pipeline. The remainder of this section describes each component of the framework in detail, following the order in which they execute during a full training run.
A. Phase 1. Suspicious Pattern Capture During Training The first phase of SCRUB-FL augments the standard federated training pipeline with three additional steps performed locally at each client before transmitting updates to the server: suspicious sample extraction, local GAN training, and dual update transmission. These steps add no burden to the server and require no changes to the aggregation protocol beyond receiving the additional generator parameters. 1) Step 1. Local Classifier Update: At each training round t, each client i performs standard local training by minimizing Equation (1), producing updated parameters Wit that are used both for the subsequent detection step, and for transmission to the server.
7
Phase 1. During federated training Clients (each round t)
Server (each round t)
Step 1. Local classifier update Wᵢᵗ ← Wᵗ⁻¹ − η ∇L(Wᵗ⁻¹; Dᵢ)
Classifier aggregation FedAvg → Wᵗ
Step 2. Suspicious sample extraction Spectral signatures + activation clustering → Dᵢˢ
Generator aggregation Average φᵢᵗ → φ̄t
Step 3. Local WGAN-GP training Train G_φᵢ on Dᵢˢ → local generator φᵢᵗ
Broadcast global model Send Wᵗ and φ̄t to all clients
Step 4. Dual upload to server Transmit { Wᵢᵗ , φᵢᵗ } to server
Store φ̄t Saved for Phase 2
Training converges after T rounds — global model Wᵗ and global generator φ̄t are ready Phase 2. Post-training sanitization (server only) Step 5. Generate X_g = Ḡ_φ(z), z~N(0,I) Clean reference inputs X_ref → L_preserve (true labels y)
Step 6. Machine Unlearning L_unlearn = λu.L_forget + L_preserve SGD for Eu epochs
Sanitized global model Ŵ Backdoor-free, high utility preserved
Fig. 1: Overview of the SCRUB-FL framework, illustrating the federated training phase with local anomaly detection and GAN-based modeling, followed by post-training server-side sanitization via machine unlearning.
2) Step 2. Local Suspicious Sample Extraction: At each training round t, after performing the standard local model update defined in Equation (1), a locally executed anomaly detection routine is applied on each client i runs to identify a subset of its data Dis ⊆ Di that may contain trigger-embedded samples. This is done using two complementary techniques: spectral signature analysis and activation clustering, both introduced in Section III. Since this extraction runs as an internal pipeline step on the client’s submitted dataset, the client, whether honest or malicious, has no mechanism to observe or influence which samples are flagged. Spectral signature analysis is applied per class. For each class c in client i’s local dataset, the client extracts the feature representations {hj } of all samples belonging to class c from an intermediate layer of its local model fWit . It then computes the spectral score of each sample using Equation (5) and flags samples whose scores exceed a class-specific threshold as suspicious: Sispec,c = {xj ∈ Dic : sj > s̄c + κ · σsc }
(15)
where s̄c and σsc are the mean and standard deviation of the spectral scores within class c, and κ > 0 is a sensitivity
parameter that controls how aggressively samples are flagged. In parallel, activation clustering is applied by extracting the activation vectors {a(xj )} of all samples in class c from the same intermediate layer and partitioning them into two clusters using K-Means as defined in Equation (6). The smaller cluster is taken as the suspicious group for that class: Siclus,c = arg min |Ckc | k∈{1,2}
(16)
The final suspicious subset for client i is formed by taking the union of flagged samples across both methods and all classes: [ spec,c Dis = Si ∪ Siclus,c (17) c
Using the union of both methods ensures that triggerbearing samples missed by one technique are still captured by the other, improving the coverage of the suspicious subset without requiring either method to work perfectly on its own. 3) Step 3. Local GAN Training on Suspicious Samples: Once the suspicious subset Dis has been identified, client i trains a lightweight WGAN-GP on this subset to learn the underlying distribution of potential trigger patterns. The
8
generator Gϕi takes a random noise vector z ∼ N (0, I) as input and produces a synthetic sample Gϕi (z) that resembles samples in Dis . The discriminator Dψi is trained to distinguish between real samples from Dis and synthetic samples from Gϕi . Following the WGAN-GP formulation introduced in Equation (4), the local training objective for client i’s GAN is:
C. Phase 2. Post-Training Backdoor Sanitization via Machine Unlearning
min max Ex∼Dis [Dψi (x)] ϕi
ψi
− Ez∼N (0,I) [Dψi (Gϕi (z))] h 2 i + λgp · Ex̂ ∥∇x̂ Dψi (x̂)∥2 − 1
(18)
where x̂ is sampled uniformly along straight lines between real and generated samples, and λgp > 0 is the gradient penalty coefficient. Once training converges, the generator Gϕi encodes the distributional characteristics of the suspicious samples in Dis without storing or transmitting any raw samples, thereby preserving data privacy. To keep the computational overhead manageable, the generator architecture is intentionally kept lightweight, consisting of a small number of transposed convolutional layers followed by a batch normalization and activation layer. The GAN is trained for a fixed number of local epochs Eg , which is a hyperparameter set independently of the main classifier training epochs E. 4) Step 4. Dual Update Transmission: After completing both local classifier training and local GAN training, client i transmits two sets of parameters to the server at the end of round t: Uploadti = Wit , ϕti
(19)
where Wit are the standard local classifier parameters and ϕti are the local generator parameters. The discriminator parameters ψit are discarded after local training as they are not needed server-side. This keeps the additional communication overhead limited to the size of the generator, which is significantly smaller than the main classifier. B. Server-Side Dual Aggregation Upon receiving the uploads from all N clients at the end of round t, the server performs two separate aggregation steps. 1) Classifier Aggregation: The classifier parameters are aggregated using the standard weighted average defined in Equation (2), producing the updated global classifier W t+1 . This step is identical to standard FedAvg and requires no modification. 2) Generator Aggregation: The generator parameters from all clients are aggregated using a simple average to produce the global generator Ḡϕ : N
ϕ̄t =
1 X t ϕ N i=1 i
Since both honest and malicious clients contribute to this aggregation, the global generator captures a broad representation of patterns that appeared statistically anomalous across the federation. Crucially, the global generator is not used during training for any classification or aggregation decision. It is stored server-side and only activated after training has fully converged to support the post-training sanitization phase.
(20)
The resulting global generator Ḡϕ encodes the collective suspicious pattern knowledge from all participating clients.
Once the global classifier fW T has converged after T rounds, SCRUB-FL enters its second phase. Rather than applying neuron pruning, which risks removing neurons that encode both backdoor and legitimate features, a phenomenon that is known as neuron entanglement, SCRUB-FL employs machine unlearning to erase the trigger-to-target mapping through gradient-based optimization, preserving all network parameters while eliminating malicious behavior. 1) Step 5. Trigger-Approximating Sample Generation: The server uses the converged global generator ḠTϕ to produce M synthetic suspicious samples: n o T (m) (m) Xg = x(m) = Ḡ (z ) : z ∼ N (0, I), m = 1, . . . , M g ϕ (21) These samples approximate the distribution of triggerembedded inputs learned collectively from all clients during training, and serve as probe inputs for the unlearning phase. 2) Step 6. Machine Unlearning via Trigger Distribution Flattening: The unlearning objective operates on two simultaneous losses. The forgetting loss trains the model to produce a uniform output distribution over all C classes when presented with generated suspicious samples, erasing the specific triggerto-target mapping without removing any neuron weights: Lforget (W) =
1 X H(fW (xg ), u) |Xg |
(22)
xg ∈Xg
where H denotes the cross-entropy function and u = C1 1 ∈ R is a uniform soft label vector assigning equal probability to all classes. The preservation loss ensures normal task accuracy is maintained by training on clean reference samples with their true labels: C
Lpreserve (W) =
1 |Xref |
X
H(fW (x), y)
(23)
(x,y)∈Xref
To prevent the preservation loss from suppressing the forgetting signal, the forgetting loss is amplified by scalar multiplier λu > 1: Lunlearn (W) = λu · Lforget (W) + Lpreserve (W)
(24)
where λu = 3.0 is determined empirically to balance forgetting speed against accuracy retention. The model is updated via SGD for Eu unlearning epochs: Ŵ ← W T − ηu ∇W Lunlearn (W T )
(25)
9
where ηu is the unlearning learning rate. This ensures the model converges toward a state where triggered inputs produce flat, non-committal outputs while clean inputs retain their original classification behavior, achieving both sanitization conditions stated in Equations (13) and (14) through the combined objective of Equations (22–25), without any permanent structural modification to the network. D. Complete SCRUB-FL Algorithm Algorithm 1 summarizes the complete execution of SCRUB-FL across all T federated training rounds and the subsequent post-training sanitization phase. The overall complexity of SCRUB-FL is dominated by three components, namely federated training, local GAN optimization, and post-training unlearning. During each communication round, the cost is O(N · Clocal ), where Clocal includes local model updates, spectral analysis, and activation clustering. The WGAN-GP training introduces an additional complexity of O(N · Eg · CGAN ) per round, where Eg is the number of GAN epochs. In the post-training phase, the unlearning procedure incurs a cost of O(Eu ·Cbatch ), where Eu is the number of unlearning epochs and Cbatch corresponds to forward-backward passes over generated and reference samples. Overall, SCRUB-FL maintains linear scalability with respect to the number of clients and communication rounds, while introducing moderate overhead due to the generative and unlearning components. E. Discussion 1) Privacy Preservation: SCRUB-FL strictly preserves the privacy of client data throughout both phases. In Phase 1, no raw samples from Di or Dis are transmitted to the server. The generator parameters ϕti encode only the distributional characteristics of the suspicious subset, not individual samples. In Phase 2, the sanitization is performed entirely server-side using only the aggregated global generator and the converged classifier, with no further client involvement. This design ensures that SCRUB-FL remains fully compatible with the privacy guarantees of the standard federated learning framework. 2) Compatibility with Standard FL: SCRUB-FL introduces no changes to the standard federated aggregation protocol for the classifier. The only modification to the training pipeline is the addition of the suspicious sample extraction and local GAN training steps at each client, and the corresponding generator aggregation at the server. This makes SCRUB-FL modular and compatible with any existing FL system. 3) Computational Overhead: The additional computational cost introduced by SCRUB-FL is limited to two components. At the client level, the cost of suspicious sample extraction using spectral analysis and activation clustering is linear in the size of the local dataset and adds negligible overhead relative to the main training step. The WGAN-GP is trained on the small suspicious subset Dis rather than the full local dataset, and its lightweight architecture keeps the training cost proportional to |Dis | · Eg , which is significantly smaller than
Algorithm 1 SCRUB-FL: Sanitizing and Cleansing Representations via Unlearning of Backdoors Require: Number of clients N , rounds T , learning rate η, GAN epochs Eg , sensitivity κ, gradient penalty λgp , generated samples M , reference inputs Xref , unlearning amplification multiplier λu , unlearning learning rate ηu , unlearning epochs Eu Ensure: Sanitized global model Ŵ 1: Server: Initialize global model W 0 and global generator ϕ̄0 2: for each round t = 1 to T do 3: Server broadcasts W t−1 and ϕ̄t−1 to all clients 4: for each client i = 1 to N do in parallel 5: // Step 1: Local classifier update 6: Wit ← W t−1 − η∇L(W t−1 ; Di ) 7: // Step 2: Suspicious sample extraction 8: Compute spectral scores using Eq. 5 and flag samples using Eq. 15 9: Apply activation clustering using Eq. 6 and identify suspicious cluster using Eq. 16 10: Dis ← union of flagged samples using Eq. 17 11: // Step 3: Local GAN training 12: Train WGAN-GP on Dis for Eg epochs using Eq. 18 13: Obtain local generator parameters ϕti 14: // Step 4: Dual upload 15: Transmit {Wit , ϕti } to server 16: end for 17: // Step P 5: Server-side dual aggregation N (Eq. 2) 18: W t ← i=1 Pninj Wit PN jt 1 t 19: ϕ̄ ← N i=1 ϕi (Eq. 20) 20: end for 21: // Post-Training Sanitization Phase 22: Server: Generate suspicious samples Xg from ḠT ϕ using Eq. 21 1 23: Build uniform targets u = C 1 24: for each unlearning epoch e = 1 to Eu do 25: for each batch (xg , u) from Xg and (x, y) from Xref do 26: Compute Lforget via Eq. 22 27: Compute Lpreserve via Eq. 23 28: Update W via Eqs. 24–25 29: end for 30: end for 31: Obtain sanitized model Ŵ 32: return Ŵ
the main classifier training cost. At the server level, the posttraining sanitization phase is a one-time operation performed after training terminates, adding no per-round overhead to the federated process. 4) Neuron Entanglement and the Case for Machine Unlearning: A critical practical limitation of pruning-based posttraining defenses is the neuron entanglement problem, where neurons sensitive to backdoor triggers in deep networks also participate in encoding legitimate semantic features for clean
10
inputs. Removing these neurons therefore, produces a direct trade-off between sanitization effectiveness and normal task accuracy. SCRUB-FL avoids this trade-off by employing machine unlearning, which modifies the mapping learned by the neurons rather than removing the neurons themselves, preserving model utility while eliminating the backdoor behavior. 5) Generalization Across Attack Types: SCRUB-FL is designed to generalize across all three attack types defined in Section IV. The spectral signature and activation clustering steps do not assume any specific trigger structure, operating purely on statistical deviations in the feature space. The WGAN-GP learns from whatever patterns appear anomalous in the local data, regardless of whether they correspond to a single trigger, multiple trigger variants, or a combination of triggers. Similarly, the machine unlearning objective in Phase 2 makes no assumption about trigger structure; it flattens model outputs on whatever the generator produces, generalizing across One-to-One, One-to-N, and N-to-One attack configurations without requiring any modification to the framework. This generality is a key advantage of SCRUB-FL over existing defenses that are designed and tuned for specific attack configurations. VI. E XPERIMENTAL E VALUATION In this section, we present a comprehensive evaluation of SCRUB-FL against five baseline methods across two benchmark datasets, three backdoor attack types, and three malicious client fractions. We describe the experimental setup, report quantitative results, analyze the impact of varying attack conditions, and assess the contribution of each SCRUB-FL component through an ablation study. A. Experimental Setup 1) Datasets: We evaluate SCRUB-FL on two standard benchmark datasets. CIFAR-10 [21] consists of 60,000 color images across 10 classes, split into 50,000 training and 10,000 test samples. GTSRB (German Traffic Sign Recognition Benchmark) [22] is a real-world traffic sign classification dataset comprising over 50,000 training images and 12,630 test images across 43 traffic sign classes. Both datasets present distinct challenges, where CIFAR-10 offers diverse object categories with relatively balanced class distributions, while GTSRB provides a safety-critical application context with finegrained visual similarity across classes. 2) Federated Learning Configuration: We simulate a federated learning environment consisting of N = 100 clients, of which c = 20 are selected uniformly at random in each communication round. To simulate realistic heterogeneous data distributions, client datasets are partitioned using a Dirichlet distribution with concentration parameter α = 0.5, resulting in a non-IID data assignment that reflects practical federated deployments. Training is conducted for T = 300 rounds on CIFAR-10 and T = 200 rounds on GTSRB, with each client performing E = 10 local training epochs per round using Stochastic Gradient Descent (SGD) with a learning rate of η = 0.01.
3) Attack Configuration: We evaluate all methods under three types of backdoor attacks, as formally defined in Section IV, namely One-to-One (a single trigger maps to a fixed target class), One-to-N (multiple trigger variants each map to a different target), and N-to-One (multiple triggers must appear simultaneously to activate the backdoor). For each attack type, malicious clients constitute 20%, 30%, and 40% of the total client population, covering a range of threat intensities from moderate to severe. Each malicious client poisons 30% of its local training data (ρ = 0.3) using pixel-level patch triggers. 4) SCRUB-FL Configuration: The local WGAN-GP is trained for Eg = 20 epochs on each client’s suspicious subset, which is identified using spectral signature analysis with sensitivity κ = 1.5 and K-Means activation clustering with K = 2. The machine unlearning phase in Phase 2 uses M = 1,000 generated suspicious samples, B = 500 clean reference inputs drawn from the test set, an unlearning amplification multiplier λu = 3.0, and a learning rate of ηu = 0.001 over Eu = 10 unlearning epochs. 5) Baselines: We compare SCRUB-FL against five baselines spanning both aggregation-phase and post-training defense categories: • Vanilla FL [1]: Standard FedAvg with no defense, used to quantify the severity of the backdoor threat in an unprotected setting. • FLAME [5]: An aggregation-phase defense that applies adaptive clipping and noise injection to client updates based on cosine similarity clustering. • FLTrust [4]: An aggregation-phase defense that assigns trust scores to client updates by comparing them against a clean root dataset maintained at the server. • Fine-Pruning [23]: A post-training defense that prunes dormant neurons on clean data and fine-tunes the pruned model to recover accuracy. Requires a labeled clean dataset at the server. • Neural Cleanse [24]: A post-training defense that reverse-engineers a minimal trigger for each class and applies targeted unlearning to remove the detected backdoor. Also requires clean labeled data at the server. We compare SCRUB-FL with both aggregation-phase and post-training defenses. Aggregation-phase methods are included because they represent the most common approach for defending against backdoor attacks in FL. Their inclusion allows us to evaluate SCRUB-FL’s main motivation that aggregation-based filtering cannot completely remove backdoors that have already been embedded in the final global model. Post-training methods serve as the most direct competitors because they also target the trained model. However, unlike SCRUB-FL, these methods do not leverage attackspecific information collected during the FL process, which may reduce their effectiveness in locating and removing backdoor behavior. 6) Evaluation Metrics: We report two primary metrics: Normal Task Accuracy (Acc), the percentage of correctly classified clean test samples, and Backdoor Attack Success Rate (ASR), the percentage of triggered test samples that are misclassified to the attacker’s target label. For SCRUB-FL and all post-training baselines, both metrics are measured on the
11
TABLE II: Average normal task accuracy and backdoor ASR across all attack types and malicious fractions. Bold = best, Underline = second best. CIFAR-10
GTSRB
Method
Acc (%)
ASR (%)
Acc (%)
ASR (%)
Vanilla FL FLAME FLTrust Fine-Pruning Neural Cleanse
81.67 56.96 65.16 72.65 66.98
98.39 67.94 68.43 8.67 12.70
96.18 65.21 70.87 42.43 37.26
99.08 47.22 54.78 9.78 8.62
SCRUB-FL (Ours)
77.88
4.04
91.23
3.88
sanitized model. A strong defense achieves high Acc and low ASR simultaneously. B. Results Discussion Table II reports the average normal task accuracy and backdoor ASR for all methods, averaged over all three attack types and all three malicious fractions on both datasets. Figure 2 provides a detailed breakdown of accuracy and ASR on CIFAR-10 across all nine experimental conditions. 1) Comparison with Aggregation-Phase Defenses: Vanilla FL, included as an undefended baseline, confirms the severity of the backdoor threat, with ASR reaching 98.39% on CIFAR10 and 99.08% on GTSRB, demonstrating that without any protection, the global model is fully compromised across all attack scenarios. Both FLAME and FLTrust partially reduce the ASR, but at the cost of normal task accuracy. FLAME achieves only 56.96% accuracy on CIFAR-10 and 65.21% on GTSRB, while still yielding ASR values of 67.94% and 47.22%, respectively, indicating that noise injection during aggregation damages the model without fully removing the backdoor. FLTrust performs similarly, reducing ASR to 68.43% and 54.78% while degrading accuracy to 65.16% and 70.87%. These results are consistent with the fundamental limitation of aggregation-phase defences, where they can reduce the influence of malicious updates per round but cannot retroactively eliminate backdoor patterns that have already accumulated in the global model over many training rounds. 2) Comparison with Post-Training Defenses: Fine-Pruning reduces the average ASR to 8.67% on CIFAR-10, the secondbest result on that dataset, but at a significant accuracy cost of 72.65%, which represents a drop of nearly 9% relative to the undefended Vanilla FL baseline. On GTSRB, this accuracy cost becomes substantial, with Fine-Pruning achieves only 42.43% accuracy, a reduction of over 53%, illustrating the neuron entanglement problem in a dataset with more complex visual features where backdoor neurons are deeply entangled with legitimate feature representations. Neural Cleanse achieves a similarly low ASR of 12.70% on CIFAR-10 but suffers comparable accuracy degradation to Fine-Pruning and its reverse-engineering process. SCRUB-FL outperforms all baselines across both primary metrics and both datasets. On CIFAR-10, SCRUB-FL achieves an average accuracy of 77.88% and reduces ASR to just
4.04%, the lowest among all methods. On GTSRB, the advantage of SCRUB-FL is even more evident by achieving 91.23% accuracy, more than twice the accuracy of FinePruning (42.43%) and Neural Cleanse (37.26%), while simultaneously achieving the lowest ASR of 3.88%. This result directly validates the core design motivation of SCRUB-FL by avoiding structural neuron removal and instead applying machine unlearning with a forgetting-preservation objective. The framework erases backdoor behaviors without damaging the legitimate feature representations that post-training pruning methods inadvertently destroy. 3) Attack-Type Breakdown: Figure 2 shows the per-attack results on CIFAR-10. SCRUB-FL maintains consistently low ASR across all three attack types, with values ranging from approximately 3.5% to 5.1% regardless of whether the attack uses a single trigger, multiple trigger variants, or a combined multi-trigger structure. In contrast, Fine-Pruning and Neural Cleanse show higher variance across attack types, with ASR climbing to over 36% for Neural Cleanse under One-to-One attacks at 40% malicious participation. The aggregation-phase methods FLAME and FLTrust fail to eliminate any attack type effectively, consistently yielding ASR values above 50%. Notably, SCRUB-FL also preserves accuracy consistently across all attack types, maintaining values between 74% and 80% across all nine CIFAR-10 conditions, while all baseline methods show substantially wider performance fluctuations.
C. Robustness to Malicious Fraction Figure 3 shows how each method’s average accuracy and ASR evolve as the malicious fraction increases from 20% to 40%, averaged over all three attack types on both datasets. On CIFAR-10, SCRUB-FL maintains a stable average accuracy between 77% and 80% across all three malicious fractions, showing no degradation as the attack becomes more intense. Its average ASR remains flat and consistently near 4% regardless of the corruption level, demonstrating strong resilience to increasing adversarial participation. In contrast, FLAME and FLTrust exhibit declining accuracy at higher fractions while still failing to reduce the ASR, indicating that their filtering mechanisms are overwhelmed when a larger proportion of updates are poisoned. Fine-Pruning and Neural Cleanse maintain low ASR values but their accuracy degrades further as the malicious fraction increases, suggesting that stronger poisoning embeds the backdoor more deeply into neurons that overlap with legitimate features, making pruning increasingly destructive. On GTSRB, the advantage of SCRUB-FL becomes even clearer under high corruption. At 40% malicious participation, SCRUB-FL maintains 91–96% accuracy while all other defenses either fail to mitigate the ASR or sacrifice over half of the model’s clean accuracy. This consistent behavior across both datasets and all malicious fractions confirms that SCRUBFL’s two-phase design, capturing suspicious pattern knowledge during training and applying targeted machine unlearning after convergence, remains effective even as the attack intensity scales up.
12
Fig. 2: Normal task accuracy (top row) and backdoor attack success rate (bottom row) on CIFAR-10 across all three attack types (One-to-One, One-to-N, N-to-One) and malicious fractions (20%, 30%, 40%). SCRUB-FL consistently achieves the lowest ASR across all conditions while maintaining the highest accuracy among all defense methods.
D. Accuracy–ASR Trade-off Analysis
E. Ablation Study
Figure 4 presents the accuracy–ASR trade-off for all methods, where each method is represented as a single point with coordinates equal to its average accuracy and average ASR across all attack types and malicious fractions. The ideal position in this plot is the top-left corner, corresponding to high accuracy and low ASR simultaneously. On both CIFAR-10 and GTSRB, SCRUB-FL occupies the top-left corner of the trade-off plot, clearly separated from all competing methods. On CIFAR-10, SCRUB-FL achieves the best combination of accuracy (77.88%) and ASR neutralization (4.04%), while Fine-Pruning achieves a slightly lower ASR but at a substantially lower accuracy. This confirms that SCRUB-FL is the only method that simultaneously achieves strong backdoor elimination and high utility preservation. On GTSRB, the separation is even more notable, as SCRUB-FL is positioned at (3.88%, 91.23%) while the next-closest method, FLTrust, sits at approximately (54.78%, 70.87%), more than 50% worse on ASR and 20% worse on accuracy. Vanilla FL, despite achieving the highest raw accuracy, is positioned at the far right of the plot due to its near-perfect ASR, confirming that high accuracy without backdoor elimination is meaningless from a security standpoint.
To assess the individual contribution of each component in the SCRUB-FL detection pipeline, we conduct an ablation study on CIFAR-10 by evaluating two reduced variants of the framework: • w/o Spectral Signatures: Suspicious sample extraction uses only activation clustering, with spectral signature analysis disabled. • w/o Activation Clustering: Suspicious sample extraction uses only spectral signature analysis, with activation clustering disabled. • Full SCRUB-FL: Both detection methods are enabled, forming the complete union-based suspicious subset as defined in Equation (17). Results are reported in Table III across all three attack types and malicious fractions. The ablation results reveal two complementary findings. First, removing spectral signature analysis causes a significant and consistent drop in both accuracy and ASR suppression across all conditions. Without spectral signatures, the suspicious subset identified by clustering alone is less precise, causing the WGAN-GP to learn a noisier approximation of the trigger distribution. This directly degrades the quality of
13
TABLE III: Ablation study on CIFAR-10. Acc (%) and ASR (%) reported for each configuration. Bold = best, Underline = second best. Variant
Fig. 3: Impact of malicious client fraction on average normal task accuracy (top) and backdoor ASR (bottom) on CIFAR10 (left) and GTSRB (right), averaged over all three attack types. SCRUB-FL (solid red) maintains stable accuracy and consistently low ASR as malicious participation increases from 20% to 40%, while all competing methods show either degrading accuracy or rising ASR.
Frac.
One-to-One
One-to-N
N-to-One
Acc
ASR
Acc
ASR
Acc
ASR
w/o Spectral Sig.
20% 30% 40%
65.00 76.71 69.08
3.72 5.11 9.76
62.95 65.50 78.06
8.01 4.83 8.46
72.84 67.65 78.20
4.37 2.43 5.58
w/o Act. Clustering
20% 30% 40%
78.04 79.11 78.39
9.34 4.49 5.01
76.88 78.77 68.52
6.22 4.54 4.68
75.33 78.11 80.20
4.06 3.91 5.39
Full SCRUB-FL
20% 30% 40%
76.89 78.71 76.96
3.48 3.44 3.88
78.29 79.76 78.58
5.02 3.93 3.83
74.52 77.72 79.50
4.17 3.49 5.08
more indistinguishably within the class distribution. Activation clustering captures these samples by detecting their distinct grouping in the model’s internal representation space, and its removal therefore leaves a completely suspicious subset for GAN training. Across all nine conditions, Full SCRUBFL achieves the lowest ASR in six out of nine cases and the second-lowest in the remaining three, confirming that the union-based detection strategy in Equation (17) consistently outperforms either method used alone. These results confirm that both components make meaningful and complementary contributions to SCRUB-FL, where spectral signatures provide coverage of the dominant trigger pattern structure, while activation clustering captures harderto-detect poisoned samples that spectral analysis misses. Their combination maximizes the quality of the suspicious subset fed to the GAN, which in turn maximizes the effectiveness of the post-training unlearning phase. VII. C ONCLUSION
Fig. 4: Accuracy–ASR trade-off on CIFAR-10 (left) and GTSRB (right). Each point represents a method’s average accuracy and ASR across all attack types and malicious fractions. The ideal position is the top-left corner (high accuracy, low ASR). SCRUB-FL (red star) is the closest to the ideal position on both datasets, uniquely achieving both strong backdoor mitigation and high normal task utility.
the generated suspicious samples used in Phase 2, reducing the effectiveness of the machine unlearning step. The impact is most visible at high malicious fractions, particularly at 40% malicious participation under One-to-One attacks, removing spectral signatures causes accuracy to drop to 38.08% (reported in the full data) compared to 68.96% for Full SCRUBFL, and ASR to climb to 9.76%. Second, removing activation clustering while retaining spectral signatures generally preserves accuracy but slightly increases ASR compared to the full framework. This is because spectral analysis alone captures the dominant outlier direction in the feature space, but may miss poisoned samples that blend
In this paper, we presented SCRUB-FL, a two-phase framework for post-training backdoor sanitization in federated learning. Unlike existing defenses that rely on trigger knowledge or a large labelled clean proxy dataset, SCRUB-FL enables posttraining mitigation by capturing suspicious pattern information during training via privacy-preserving generator aggregation, followed by machine unlearning at the server. In the first phase, clients detect suspicious samples using spectral signature analysis and activation clustering, and train local WGANGP models whose parameters are aggregated to form a global generator. In the second phase, the server generates triggerapproximating samples and applies an unlearning objective that suppresses backdoor behavior while preserving clean accuracy. Extensive experiments on CIFAR-10 and GTSRB under One-to-One, One-to-N, and N-to-One attacks show that SCRUB-FL consistently achieves state-of-the-art performance. It reduces the average attack success rate to 4.04% on CIFAR10 and 3.88% on GTSRB, while maintaining strong clean accuracy of 77.88% and 91.23%, respectively. These results confirm its effectiveness compared to existing post-training defenses. The ablation study further validates the complementary role of spectral signatures and activation clustering in improving detection quality. Future work will focus on
14
extending SCRUB-FL to other data modalities such as NLP and IoT time-series data, reducing reliance on clean reference samples, and improving the communication efficiency of generator aggregation. R EFERENCES [1] B. McMahan, E. Moore, D. Ramage, S. Hampson, and B. A. y Arcas, “Communication-efficient learning of deep networks from decentralized data,” in Artificial intelligence and statistics. PMLR, 2017, pp. 1273– 1282. [2] Y. Feng, Y. Guo, Y. Hou, Y. Wu, M. Lao, T. Yu, and G. Liu, “A survey of security threats in federated learning,” Complex & Intelligent Systems, vol. 11, no. 2, p. 165, 2025. [3] MITRE Corporation, “MITRE ATLAS: Adversarial Threat Landscape for Artificial-Intelligence Systems,” https://atlas.mitre.org, 2023, technique AML.T0018: Backdoor ML Model. [4] X. Cao, M. Fang, J. Liu, and N. Z. Gong, “Fltrust: Byzantinerobust federated learning via trust bootstrapping,” arXiv preprint arXiv:2012.13995, 2020. [5] T. D. Nguyen, P. Rieger, H. Chen, H. Yalame, H. Möllering, H. Fereidooni, S. Marchal, M. Miettinen, A. Mirhoseini, S. Zeitouni et al., “{FLAME}: Taming backdoors in federated learning,” in 31st USENIX security symposium (USENIX Security 22), 2022, pp. 1415–1432. [6] Z. Wang, Z. Zhang, Z. Li, Y. Wu, Y. Liu, M. Li, X. Li, Y. Liu, J. An, W. Liang et al., “Resisting poisoning attacks in federated learning via dual-domain distance and trust assessment,” IEEE Transactions on Information Forensics and Security, 2025. [7] E. Alharbi, L. S. Marcolino, Q. Ni, and A. Gouglidis, “Robust knowledge distillation in federated learning: Counteracting backdoor attacks,” in 2025 IEEE Conference on Secure and Trustworthy Machine Learning (SaTML). IEEE, 2025, pp. 189–202. [8] Q. Tan, Y. Li, and B.-S. Shin, “Defending against backdoor attacks in federated learning by using differential privacy and ood data attributes,” Computer Modeling in Engineering & Sciences, vol. 143, no. 2, pp. 2417–2428, 2025. [9] C. P. Obioma, Y. Sun, and M. A. Mustafa, “Defending the edge: Representative-attention defense against backdoor attacks in federated learning,” arXiv preprint arXiv:2505.10297, 2025. [10] X. Bi and X. Li, “Securing federated learning against backdoor threats with foundation model integration,” in 2025 IEEE International Conference on Information Reuse and Integration and Data Science (IRI). IEEE, 2025, pp. 184–189. [11] J. Zhang, C. Zhu, X. Sun, C. Ge, B. Chen, W. Susilo, and S. Yu, “Flpurifier: Backdoor defense in federated learning via decoupled contrastive training,” IEEE Transactions on Information Forensics and Security, vol. 19, pp. 4752–4766, 2024. [12] C. Wu, S. Zhu, P. Mitra, and W. Wang, “Unlearning backdoor attacks in federated learning,” in 2024 IEEE Conference on Communications and Network Security (CNS). IEEE, 2024, pp. 1–9. [13] S. Huang, Y. Li, C. Chen, L. Shi, W. Cai, and Y. Gao, “Fedcleanse: Cleanse the backdoor attacks in federated learning system,” KnowledgeBased Systems, p. 114494, 2025. [14] K. Wang, L. Wang, Z. Liu, Y. Luo, K. Zhang, and W. Li, “Shift: Enhancing federated learning robustness through client-side backdoor detection,” Information Fusion, p. 104144, 2026. [15] C. Zhu, J. Zhang, X. Sun, B. Chen, and W. Meng, “Adfl: Defending backdoor attacks in federated learning via adversarial distillation,” Computers & Security, vol. 132, p. 103366, 2023. [16] K. Walter, M. Mohammady, S. Nepal, and S. S. Kanhere, “Mitigating distributed backdoor attack in federated learning through mode connectivity,” in Proceedings of the 19th ACM Asia Conference on Computer and Communications Security, 2024, pp. 1287–1298. [17] I. J. Goodfellow, J. Pouget-Abadie, M. Mirza, B. Xu, D. Warde-Farley, S. Ozair, A. Courville, and Y. Bengio, “Generative adversarial nets,” Advances in neural information processing systems, vol. 27, 2014. [18] I. Gulrajani, F. Ahmed, M. Arjovsky, V. Dumoulin, and A. C. Courville, “Improved training of wasserstein gans,” Advances in neural information processing systems, vol. 30, 2017. [19] B. Chen, W. Carvalho, N. Baracaldo, H. Ludwig, B. Edwards, T. Lee, I. Molloy, and B. Srivastava, “Detecting backdoor attacks on deep neural networks by activation clustering,” arXiv preprint arXiv:1811.03728, 2018.
[20] R. Wang, X. Wang, H. Chen, J. Decouchant, S. Picek, N. Laoutaris, and K. Liang, “Mudguard: Taming malicious majorities in federated learning using privacy-preserving byzantine-robust clustering,” Proceedings of the ACM on Measurement and Analysis of Computing Systems, vol. 8, no. 3, pp. 1–41, 2024. [21] A. Krizhevsky, G. Hinton et al., “Learning multiple layers of features from tiny images,” 2009. [22] J. Stallkamp, M. Schlipsing, J. Salmen, and C. Igel, “The german traffic sign recognition benchmark: a multi-class classification competition,” in The 2011 international joint conference on neural networks. IEEE, 2011, pp. 1453–1460. [23] K. Liu, B. Dolan-Gavitt, and S. Garg, “Fine-pruning: Defending against backdooring attacks on deep neural networks,” in International symposium on research in attacks, intrusions, and defenses. Springer, 2018, pp. 273–294. [24] B. Wang, Y. Yao, S. Shan, H. Li, B. Viswanath, H. Zheng, and B. Y. Zhao, “Neural cleanse: Identifying and mitigating backdoor attacks in neural networks,” in 2019 IEEE symposium on security and privacy (SP). IEEE, 2019, pp. 707–723.