EarlyShield: Early-Stage Screening for Robust Personalized Federated Learning

Backdoor attacks pose a serious threat to federated learning (FL). The challenge becomes even more pronounced in personalized FL (PFL), where model updates naturally exhibit high diversity across clients. Existing defenses such as clustering-based detection fail under PFL because benign updates appear highly heterogeneous. What’s worse, PFedBA, a recent backdoor on PFL, shows that it can easily bypass most defenses. To address these limitations, we propose EarlyShield, an effective and data-free defense tailored for both FL and PFL. Our intuition is that even under PFL, benign clients exhibit multi-view consistency, while malicious updates tend to deviate in similarity structure and low-dimensional representations. EarlyShield leverages this idea while focusing on enforcing stringent early screening: (i) client screening based on similarity and principal component analysis (PCA), and (ii) similarity-driven decay to further suppress suspicious updates before aggregation. Extensive experiments on various datasets across independent and identically distributed (IID) and non-IID settings show that EarlyShield reduces attack success rates with minimal accuracy drop, consistently outperforming existing defenses. We open source the code as well.