🤖 AI

SABRE-FL: Selective and Accurate Backdoor Rejection for Federated Prompt Learning

This paper introduces SABRE-FL, the first defense mechanism for Federated Prompt Learning that effectively detects and filters backdoor attacks by utilizing an offline-trained embedding-space anomaly detector, thereby securing global prompt models against malicious clients without requiring access to raw data.

Original authors: Momin Ahmad Khan, Yasra Chandio, Fatima Muhammad Anwar

Published 2026-01-28

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Momin Ahmad Khan, Yasra Chandio, Fatima Muhammad Anwar

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine a group of chefs (the clients) trying to create the perfect recipe for a new dish (the global model) without ever sharing their secret ingredients or leaving their own kitchens. This is Federated Learning. Usually, they just send the server a list of "tweaks" to the recipe, like "add a pinch more salt" or "cook for 2 minutes longer."

Now, imagine a new, super-efficient way to cook called Federated Prompt Learning. Instead of sending a whole new recipe, the chefs only send tiny, adjustable notes (called "prompts") that tell a giant, pre-trained AI how to taste the food. This saves a lot of time and keeps the big AI frozen and safe.

However, the paper SABRE-FL reveals a scary new problem: Backdoor Attacks.

The Problem: The Invisible Sticker

The researchers discovered that a malicious chef (a bad client) can slip a tiny, invisible sticker (a trigger) onto some of their ingredients. To the human eye, the ingredient looks normal. But to the AI, this sticker changes the "flavor profile" completely.

The Trick: The bad chef trains their AI to say, "If you see this invisible sticker, ignore what the food actually is and call it 'Dolphin' instead of 'Elephant'."
The Result: The global recipe becomes a master chef for normal food (high accuracy on clean dishes), but if you serve it a dish with that specific invisible sticker, it confidently misidentifies it as whatever the bad chef wants.

The scary part? The bad chefs don't need to take over the whole kitchen. Even if only 25% of the chefs are malicious, they can successfully poison the global recipe.

The Solution: SABRE-FL (The Flavor Detective)

The authors built a defense system called SABRE-FL. Think of it as a Flavor Detective sitting at the server's desk.

Here is how it works, using a simple analogy:

The Invisible Shift: Even though the sticker is invisible to our eyes, it forces the AI to "taste" the food differently. In the AI's internal language (called embedding space), a poisoned image doesn't just look like a normal image with a sticker; it looks like it belongs to a completely different neighborhood. It's like a normal apple that suddenly smells like a banana.
The Detective's Training: Before the cooking contest even starts, the server trains a special detector on a separate dataset. This detector learns to spot the "banana smell" in an apple. It doesn't need to see the raw ingredients or know the labels; it just looks at the "flavor profile" (the mathematical representation) of the updates coming from the chefs.
The Filter: When the chefs send their recipe tweaks back to the server, the detector checks them.
- If the tweak smells like a normal apple, it gets added to the global recipe.
- If the tweak smells like a "banana-apple" (poisoned), the detector flags it and throws it in the trash.

Why This is Special

The paper highlights three main reasons why this defense is a game-changer:

It's Blind to Privacy: The detector doesn't need to see the actual photos or know what the clients are cooking. It only looks at the mathematical "flavor" of the updates. This keeps everyone's privacy intact.
It's a Universal Detector: The detector was trained on one type of food (Caltech-101 dataset), but it successfully caught the poison in five completely different types of cooking tasks (like recognizing flowers, pets, or airplanes). It learned the pattern of the poison, not the specific food.
It Doesn't Break the Good Stuff: Unlike other defenses that might throw out good recipes just to be safe, SABRE-FL is precise. It keeps the global model's performance on normal food just as high as before, while almost completely eliminating the ability of the bad chefs to force misclassifications.

The Bottom Line

The paper proves that Federated Prompt Learning is vulnerable to these invisible "sticker" attacks, but it also proves that we can build a lightweight, privacy-friendly "Flavor Detective" (SABRE-FL) that spots the poison in the AI's internal language and filters it out, keeping the system safe and accurate.

Technical Summary: SABRE-FL

Problem Statement

Federated Prompt Learning (FPL) has emerged as an efficient paradigm for adapting large vision-language models (VLMs), such as CLIP, across decentralized clients. In FPL, clients optimize lightweight, learnable prompt vectors while keeping the model backbone frozen, sharing only these prompts with a central server. Despite its privacy-preserving and communication-efficient nature, the security implications of FPL remain underexplored.

This paper identifies a critical vulnerability: Federated Prompt Learning is highly susceptible to backdoor attacks. The authors demonstrate that malicious clients can inject visually imperceptible, learnable noise triggers into their local training data. These triggers are optimized to shift the image embeddings in CLIP's semantic space toward a specific target class. Consequently, the global prompt learner, when aggregated, becomes vulnerable to targeted misclassification on trigger-embedded inputs while maintaining high accuracy on clean, benign data. This attack is particularly insidious because it operates within the limited parameter space of prompt vectors, yet effectively compromises the global model's integrity without degrading its overall utility.

Methodology

1. The Backdoor Attack

The authors propose the first backdoor attack specifically targeting prompt learning in a federated setting.

Mechanism: Malicious clients (assumed to be a fraction of the total, e.g., 25%) inject a learnable additive noise trigger ( $t$ ) into a subset of their local images ( $x^* = x \oplus t$ ).
Optimization: The trigger is optimized jointly with the prompt learner to maximize the cosine similarity between the poisoned image embedding and the text embedding of a target class ( $y_{target}$ ), while minimizing similarity to the true label.
Threat Model: The attacker controls a subset of clients, has full knowledge of the model architecture (frozen CLIP backbone), and can relabel poisoned samples to the target class (dirty-label attack).
Outcome: The attack successfully implants a backdoor into the global prompt learner. At inference, any input containing the trigger is misclassified as the target class with high confidence, while clean inputs remain unaffected.

2. The Defense: SABRE-FL

To counter this vulnerability, the authors propose SABRE-FL (Selective and Accurate Backdoor Rejection for Federated Prompt Learning), a lightweight, server-side defense.

Core Insight: While the trigger is visually imperceptible, it induces a systematic and consistent shift in the image embeddings within the CLIP embedding space. This deviation creates a statistical signature that distinguishes poisoned updates from clean ones.
Detector Training:
- The defense utilizes an auxiliary dataset (Caltech-101) to generate a training set of embeddings.
- Clean images and images with injected triggers are passed through the frozen CLIP image encoder to produce embeddings.
- A binary classifier (detector) is trained offline on these embeddings to distinguish between "clean" and "poisoned" representations. Crucially, this detector requires no access to raw client data, labels, or gradients.
Inference and Filtering:
- During each federated round, the server receives prompt updates from clients.
- The server computes the mean detector score for the embeddings associated with each client's update.
- A rank-based heuristic is employed: the $m$ clients with the highest number of flagged (poisoned) embeddings are excluded from the aggregation process. This assumes an upper bound on the number of malicious clients.

Key Contributions

First Study of Backdoors in FPL: The paper presents the first investigation into backdoor attacks within federated prompt learning. It establishes that even with limited parameter updates (prompts only), the system is vulnerable to trigger-based attacks that achieve high success rates while preserving clean accuracy.
SABRE-FL Defense: The authors design a modular, generalizable defense that operates in the embedding space. It detects poisoned updates using an offline-trained detector, requiring no access to private client data.
Theoretical and Empirical Validation: The work provides theoretical conditions for the generalization of the detector and extensive empirical evaluations across five diverse datasets (Flowers, Pets, DTD, FGVC Aircraft, Food101) and four baseline defenses (Trimmed Mean, Median, Norm Bounding, FLAME).

Results

The evaluation demonstrates that SABRE-FL significantly outperforms existing robust aggregation baselines:

Backdoor Mitigation: SABRE-FL reduces backdoor accuracy to near-zero levels across all datasets (e.g., 1.1% on Flowers, 1.9% on Food101, 7.6% on FGVC Aircraft), whereas baseline methods often leave significant backdoor influence (e.g., FLAME leaves 16.4% on FGVC Aircraft).
Clean Accuracy Preservation: The defense maintains clean accuracy comparable to or better than baseline methods, proving that filtering poisoned clients does not impair the model's generalization on benign data.
Generalization: The detector, trained on Caltech-101, successfully generalizes to diverse domains including fine-grained object recognition and texture-based tasks without retraining.
Robustness to Shot Count: The defense remains effective even as the number of shots (samples per class) increases, a scenario where prompt learners typically become more susceptible to memorization-based attacks.
Visual Evidence: t-SNE visualizations confirm a clear separation between clean and backdoored embeddings in the CLIP space, validating the underlying mechanism of the defense.

Significance and Claims

The paper claims that Federated Prompt Learning, despite its efficiency and privacy benefits, introduces a new attack surface that is currently unaddressed. The significance of this work lies in:

Exposing a Critical Vulnerability: Demonstrating that the "lightweight" nature of prompt learning does not inherently protect against adversarial manipulation; in fact, the semantic alignment of prompts can be exploited to plant durable backdoors.
Providing a Practical Solution: SABRE-FL offers a feasible defense that aligns with the privacy constraints of federated learning (no raw data access) while effectively neutralizing the threat.
Highlighting the Need for Robustness: The authors underscore the necessity of integrating robust security measures into future federated systems, particularly as they adopt foundation models and prompt-based adaptation strategies.

The paper concludes that while backdoor attacks are a potent threat, the consistent statistical deviations they cause in embedding spaces can be leveraged to build effective, privacy-preserving defenses.