  Existing approaches defend against backdoor attacks in federated learning
(FL) mainly through a) mitigating the impact of infected models, or b)
excluding infected models. The former negatively impacts model accuracy, while
the latter usually relies on globally clear boundaries between benign and
infected model updates. However, model updates are easy to be mixed and
scattered throughout in reality due to the diverse distributions of local data.
This work focuses on excluding infected models in FL. Unlike previous
perspectives from a global view, we propose Snowball, a novel anti-backdoor FL
framework through bidirectional elections from an individual perspective
inspired by one principle deduced by us and two principles in FL and deep
learning. It is characterized by a) bottom-up election, where each candidate
model update votes to several peer ones such that a few model updates are
elected as selectees for aggregation; and b) top-down election, where selectees
progressively enlarge themselves through picking up from the candidates. We
compare Snowball with state-of-the-art defenses to backdoor attacks in FL on
five real-world datasets, demonstrating its superior resistance to backdoor
attacks and slight impact on the accuracy of the global model.
