Technical Summary: Detecting and Mitigating Backdoor Attacks in OTA-FL Systems

1. Problem Statement

Over-the-Air Federated Learning (OTA-FL) leverages the superposition property of wireless channels to achieve communication-efficient model aggregation, offering theoretically scale-free overhead for mobile edge networks. However, this efficiency introduces a critical security vulnerability: the Parameter Server (PS) receives only the aggregated signal, not individual client updates. Consequently, the PS cannot verify the correctness of specific local updates, rendering standard defense mechanisms inapplicable.

This vulnerability is particularly acute against backdoor attacks, where adversaries manipulate a subset of clients to embed hidden malicious behaviors (trigger-target mappings) into the global model while maintaining high accuracy on benign inputs. The challenge is exacerbated by:

• Stealthy Constraints: Sophisticated adversaries can craft poisoned gradients constrained by specific metrics (e.g., Euclidean distance or Cosine similarity) to mimic benign gradient drift, evading detection methods that rely on single metrics.
• Non-IID Data: In realistic settings with non-independent and identically distributed (Non-IID) data, benign clients naturally exhibit gradient drift due to data heterogeneity. This makes it difficult for the PS to distinguish between statistical heterogeneity and carefully crafted malicious updates.
• Infeasibility of Per-Client Inspection: Unlike traditional FL, OTA-FL prevents the PS from individually inspecting or filtering client updates prior to aggregation.

Existing defenses for OTA-FL often rely on resource-intensive strategies (e.g., dedicated resource blocks, dummy symbols) or architectural changes that compromise system efficiency. There is a need for a defense mechanism that minimizes overhead while effectively identifying stealthy, metric-constrained backdoor attacks.

2. Methodology: Trust-Then-Inspect (TTI)

The paper proposes Trust-Then-Inspect (TTI), a two-stage robust aggregation framework designed to detect and mitigate backdoor attacks in OTA-FL systems. The core philosophy is to confine additional communication and computational overhead exclusively to "suspicious" clients, preserving the efficiency of OTA aggregation for the majority of trusted participants.

Stage I: Client Tiering via Modality-Aware Trust Score

The first stage performs a lightweight, client-side preliminary screening to categorize clients into three tiers: Trusted, Suspicious, and Malicious.

• Modality-Aware Multi-Indicator Trust Score: Instead of relying on a single metric, the framework computes a composite trust score ($TS$) based on multiple indicators selected according to the data modality (e.g., waveform, text, image) and model architecture.
  • Geometric Indicators: Includes Temporal Direction Alignment (TDA), Relative $\ell_2$ Norm, and Spikiness (concentration of gradient energy).
  • Modality-Specific Indicators: Additional indicators are tailored to specific tasks (e.g., text-specific features for AG News).
  • Weight Optimization: The weights for these indicators are not manually tuned but learned via Bayesian Optimization (BO). The BO process optimizes a trade-off objective function ($J$) that maximizes Main Task Accuracy (MTA) while minimizing Attack Success Rate (ASR) during an offline calibration phase.
• Tiering Strategy: Based on the computed trust scores, clients are partitioned.
  • Trusted: Proceed directly to OTA aggregation.
  • Malicious: Immediately excluded.
  • Suspicious: Forwarded to Stage II for deeper inspection.

Stage II: PS-Side Layer-Wise Inspection

Clients in the "Suspicious" tier undergo fine-grained inspection at the Parameter Server to distinguish between benign drift and malicious updates.

• Layer-Wise Decomposition: The PS decomposes the suspicious client's model update into individual neural network layer gradients.
• Feature Extraction & Clustering: For each layer, the PS extracts features including sign structure, distribution shape (kurtosis/skewness), inter-client distance, reference deviation, magnitude, and directional similarity.
• Agglomerative Hierarchical Clustering (AHC): The PS clusters the suspicious clients at each layer into two groups. The "benign" cluster is identified based on alignment with a trusted reference gradient and historical reputation, prioritizing alignment over internal consistency (acknowledging that benign updates under Non-IID data may be highly variable).
• Majority Voting: A client is accepted if the fraction of layers classified as "benign" exceeds a threshold $\rho$.
• Reputation Score (RS) Mechanism: To provide long-term defense, the PS maintains a persistent reputation score for each client. Clients participating in successful aggregations increment their score. After a warm-up period, a filter based on the Median Absolute Deviation (MAD) of reputation scores is applied to exclude clients with persistently low scores, even if they occasionally evade layer-wise inspection.

Overall Workflow

The framework integrates these stages into an iterative process:

1. Clients compute local indicators and report them to the PS.
2. The PS calculates trust scores and tiers clients.
3. Trusted clients perform OTA aggregation; suspicious clients upload updates individually.
4. The PS performs layer-wise inspection and reputation filtering.
5. The global model is updated using the final set of accepted clients.

3. Key Contributions

The paper claims the following specific contributions:

1. Modality-Aware Multi-Indicator Trust Scoring: A client-side mechanism that uses a composite score of task-specific indicators, with weights optimized via Bayesian Optimization. This approach offers robustness against metric-constrained attacks that evade single-metric defenses.
2. PS-Side Layer-Wise Inspection: A detection module that operates at the granularity of individual neural network layers rather than the global model. This addresses the limitation of global metrics, which often fail to detect sparse or localized backdoor perturbations (e.g., Neurotoxin attacks).
3. Long-Term Reputation Mechanism: A dynamic scoring system that accumulates behavioral evidence over time, allowing the system to progressively identify malicious clients and eventually rely on reputation filtering to reduce long-term computational overhead.
4. Comprehensive Validation: Extensive experiments demonstrating that the framework effectively suppresses various backdoor attacks (Bounded-scaling, Euclidean-constrained, Cosine-constrained, and Neurotoxin) while maintaining competitive Main Task Accuracy.

4. Experimental Results

The authors evaluated TTI on three datasets (RML2016.10A, AG News, CIFAR-10) with different model architectures (1D CNN, Text CNN, ResNet9) under Non-IID settings.

• Attack Suppression: Without defense, backdoor attacks achieved high Attack Success Rates (ASR), often exceeding 80-99%. The TTI framework consistently reduced ASR to near chance-level (e.g., ~10% for 10-class CIFAR-10) across all attack types.
• Main Task Accuracy (MTA): The framework maintained competitive MTA, showing only marginal degradation compared to the no-attack baseline.
• Ablation Studies:
  • Single-Indicator vs. Multi-Indicator: Single-indicator tiering (e.g., using only $\ell_2$ norm) was shown to be vulnerable to attacks specifically designed to evade that metric. The multi-indicator approach proved necessary for robustness.
  • Layer-wise vs. Model-wise: Replacing layer-wise inspection with whole-model inspection significantly degraded performance against Neurotoxin attacks, validating the necessity of fine-grained inspection.
• Efficiency: While TTI incurs slightly higher runtime per round than baselines like Best-Effort Voting (BEV) or FedSAC, this overhead is limited to the "suspicious" tier (approx. 30% of clients in the tested setup). The trade-off yields a significantly lower ASR, demonstrating a favorable robustness-efficiency balance.

5. Significance and Claims

The paper positions TTI as a solution to the "open question" of defending OTA-FL against backdoor attacks without compromising the communication efficiency that makes OTA-FL attractive.

• Addressing the Superposition Limitation: The framework acknowledges the fundamental constraint that the PS cannot see individual updates initially. TTI works around this by using lightweight client-side reporting for screening and reserving the expensive individual upload/inspection only for ambiguous cases.
• Robustness to Stealthy Attacks: The authors emphasize that their method is specifically effective against "metric-constrained" attacks (Euclidean/Cosine) and "sparse" attacks (Neurotoxin), which are known to defeat conventional norm-based or direction-based defenses.
• Scalability and Adaptability: By using Bayesian Optimization for weight tuning and modality-aware indicators, the framework is designed to be adaptable to different data types and model structures without requiring manual re-tuning for every new scenario.
• Long-Term Viability: The inclusion of the Reputation Score mechanism is highlighted as a way to amortize the computational cost of inspection over time, allowing the system to become more efficient as it learns the behavior of the participating clients.

The authors conclude that TTI successfully balances the competing demands of security (low ASR), utility (high MTA), and efficiency (minimal overhead), providing a practical defense strategy for the next generation of wireless federated learning systems.