FedPurify: Knowledge-Preserving Backdoor Defense with Data-Free Purification in Federated Learning

Abstract

Federated Learning (FL) facilitates distributed training while preserving privacy, yet remains highly vulnerable to backdoor attacks. Existing defenses primarily address these threats via robust aggregation, which reduces the influence of malicious contributions (e.g., pruning, reweighting), or through detection-based filtering that discards anomalous updates prior to aggregation. Nevertheless, existing defenses primarily suppress or discard malicious updates, inevitably sacrificing task-relevant knowledge and leading to reduced clean-task accuracy. To this end, we propose FedPurify, a framework that performs post-training data-free purification to remove malicious backdoors while preserving task-relevant knowledge. Specifically, following global convergence without loss of task-relevant knowledge, FedPurify proposes a fully data-free sample synthesis scheme to generate diverse and representative samples from the converged global model, thereby inherently preserving client privacy in FL. Building upon these synthetic samples, FedPurify further leverages data-free trigger inversion to effectively expose latent backdoor behaviors. Finally, FedPurify combines contrastive feature alignment with knowledge-preserving self-distillation to remove backdoor effects while preserving benign task performance. Extensive experiments verify that FedPurify effectively removes backdoors from the global model with negligible impact on clean performance, outperforming existing defense methods.