Home / Curated / Algorithms / FLAME Dynamic Clustering and Adaptive Clipping-Noising Backdoor Defense

FLAME Dynamic Clustering and Adaptive Clipping-Noising Backdoor Defense

Algorithms AIMech:FlameDynamicClusteringAndAdaptiveClippingNoisingBackdoorDefense DRAFT

Aliases: FLAME Taming Backdoors in Federated Learning, FLAME Federated Backdoor Defense Framework, FLAME HDBSCAN Cosine Clustering and Adaptive Clipping-Noising

A three-stage federated learning backdoor defense framework that (1) computes pairwise cosine distances c_ij = 1 - (W_i . W_j)/(||W_i||_2 ||W_j||_2) across all n client models and applies HDBSCAN density-based clustering with minimum cluster size floor(n/2) + 1 to admit the majority benign cluster while rejecting angularly deviating backdoor outliers, (2) clips admitted model updates W_bl^c = G_{t-1}^* + (W_bl - G_{t-1}^*) * min(1, S_t / e_bl) to the median Euclidean update norm S_t = MEDIAN(e_1, ..., e_n) across all n clients, and (3) injects adaptive Gaussian parameter noise N(0, sigma^2 I) with sigma = lambda * S_t and lambda = (1/varepsilon) * sqrt(2 ln(1.25/delta)) into the averaged model.

Identity Notes & Concept Scope Introduced by Nguyen et al. (USENIX Security 2022, pp. 1415-1432, arXiv:2101.02281). Distinct from fixed-two-cluster defenses such as Auror (Shen et al. 2016) and Krum, which fail when an attacker simultaneously injects multiple backdoors or honeypot outliers (pigeonhole principle), and from CRFL (AIMech:CrflCertifiablyRobustFederatedLearningViaParameterClippingAndSmoothing), which clips and perturbs the aggregated global model for randomized parameter smoothing rather than combining HDBSCAN pairwise cosine filtering with median-update-norm adaptive clipping before noise injection.

Claims & Grounded Evidence

4 Claims

Mechanism #c1-mechanism-hdbscan-pairwise-cosine-dynamic-clustering

FLAME computes the n x n pairwise cosine distance matrix c_ij = 1 - (W_i . W_j)/(||W_i|| ||W_j||) (Eq. 2) and runs HDBSCAN with min_cluster_size = floor(n/2) + 1 and min_samples = 1 to extract the single dense majority cluster (b_1, ..., b_L) while labeling all remaining models as individual outliers, preventing scale-boosted updates from altering angular distances and defeating simultaneous multi-backdoor or honeypot clustering attacks.

supports Source: FLAME: Taming Backdoors in Federated Learning · Locator: Section 3 Equation (2), Section 4.3.1, Algorithm 1 Lines 6-7, Figure 5, and Appendix E, pp. 4, 6, 19

Mechanism #c2-mechanism-median-euclidean-clipping-and-adaptive-dp-noise

FLAME computes Euclidean distances e_i = ||W_i - G_{t-1}^*||_2 across all n submitted models (including clustering-rejected models), sets the dynamic clipping bound S_t = MEDIAN(e_1, ..., e_n) so that S_t lies within the benign update norm range whenever k < n/2, scales each admitted model via W_bl^c = G_{t-1}^* + (W_bl - G_{t-1}^*) * min(1, S_t / e_bl), and adds Gaussian noise N(0, sigma_G^2 I) with sigma_G = (S_t / varepsilon) * sqrt(2 ln(1.25 / delta)) to the averaged model G_t = (1/L) sum_{l=1}^L W_bl^c.

supports Source: FLAME: Taming Backdoors in Federated Learning · Locator: Section 4.3.2, Algorithm 1 Lines 8-14, and Section 5.1 Theorem 1 & Equations (5)-(7), pp. 6-9

Application #c3-application-backdoor-mitigation-and-stpc-private-aggregation

FLAME eliminates constrain-and-scale, Distributed Backdoor Attack (DBA), Edge-Case, and PGD backdoors across Reddit LSTM word prediction, CIFAR-10/MNIST/Tiny-ImageNet image classification, and DIoT GRU network intrusion detection with less than 0.4% main-task accuracy drop, and supports Secure Two-Party Computation (STPC) over arithmetic shares between two non-colluding servers.

supports Source: FLAME: Taming Backdoors in Federated Learning · Locator: Section 7.1 Tables 3-4 and Section 8 Figure 10, pp. 10-14

Limitation #c4-limitation-honest-majority-assumption-and-stpc-overhead

FLAME requires a strict honest majority (Poisoned Model Rate PMR = k/n < 50%) so that the HDBSCAN minimum cluster size floor(n/2) + 1 and the median clipping bound S_t are dominated by benign updates, and its cryptographic STPC realization incurs up to three orders of magnitude server runtime overhead compared to plaintext FLAME.

supports Source: FLAME: Taming Backdoors in Federated Learning · Locator: Section 7.3 Figure 7 and Appendix G, pp. 12, 19-20

⚠️ Curated Limitations & Negative Results

Fails when the Poisoned Model Rate reaches or exceeds 50% (PMR >= 50%), because the majority cluster and median clipping norm can be controlled by malicious clients.
Realizing FLAME privately over Secure Two-Party Computation (STPC) increases server-side computation time by up to three orders of magnitude.

Artificial Intelligence Ontology (AIO) Grounding

Mapped AIO Classes

AIO Target Class	Mapping Relation	Mapping Rationale
`AIO:FederatedLearning` Federated Learning	broad_match	FLAME is a backdoor-resilient federated learning aggregation framework combining dynamic cosine-distance clustering, median-norm clipping, and adaptive Gaussian noise injection.
`AIO:Clustering` Clustering	related_match	FLAME uses HDBSCAN density-based clustering on pairwise cosine distances of client weight vectors to filter out angularly deviating backdoor updates.

Evidence Sources & Primary Literature

3 Sources

Source ID	Publication / Document	Type / Access	Reference & Checksum
`r530-primary-pdf`	FLAME: Taming Backdoors in Federated Learning Thien Duc Nguyen, Phillip Rieger, Huili Chen, Hossein Yalame, Helen Mollering, Hossein Fereidooni, Samuel Marchal, Markus Miettinen, Azalia Mirhoseini, Shaza Zeitouni, Farinaz Koushanfar, Ahmad-Reza Sadeghi, Thomas Schneider	primary paper full_text	ID: https://dblp.org/rec/conf/uss/NguyenRCYMFMMMZ22 sha256:196692594f1b…
`r530-arxiv-abs`	FLAME: Taming Backdoors in Federated Learning (arXiv abstract) Thien Duc Nguyen, Phillip Rieger, Huili Chen, Hossein Yalame, Helen Mollering, Hossein Fereidooni, Samuel Marchal, Markus Miettinen, Azalia Mirhoseini, Shaza Zeitouni, Farinaz Koushanfar, Ahmad-Reza Sadeghi, Thomas Schneider	primary paper abstract_only	ID: https://arxiv.org/abs/2101.02281 sha256:0d3116299eda…
`r530-metadata-cr`	FLAME: Taming Backdoors in Federated Learning (Crossref metadata) Thien Duc Nguyen, Phillip Rieger, Huili Chen, Hossein Yalame, Helen Mollering, Hossein Fereidooni, Samuel Marchal, Markus Miettinen, Azalia Mirhoseini, Shaza Zeitouni, Farinaz Koushanfar, Ahmad-Reza Sadeghi, Thomas Schneider	primary paper abstract_only	ID: https://dblp.org/rec/conf/uss/NguyenRCYMFMMMZ22 sha256:dc5a533c8bd0…

Ontology & Grounding Topology

Open in interactive network graph →

Curation Provenance

Curator: Antigravity

Method: ai_assisted

Model: Gemini

Created: 2026-10-19T10:13:00Z

Updated: 2026-10-19T10:13:00Z

Source File: data/curated/FlameDynamicClusteringAndAdaptiveClippingNoisingBackdoorDefense.yaml · Schema: curated_concept.yaml

Explore across X-Mech

Related computational & biological Mechs: Embedding Map Network Graph ProteinTraitsMech (ESM-2 pLM) DUFMech (Domain pLM) TraitMech CultureMech All 14 X-Mech Repositories