SlowGuess/NeurIPS_2023_OCR huggingface dataset:
Impact of Trigger Reverse Engineering. Our framework is compatible with any trigger reverse engineer methods. To study the impact of different trigger reverse engineering methods, we use FeatureRE [47] to substitute Neural Cleansse in FedGame. We adopt the public implementation of FeatureRE. Under the default setting, FedGame achieves a  $10.36\%$  ASR, which indicates that our framework is consistently effective with different trigger reverse engineering methods.
Besides, FedGame would still be effective even if the reverse-engineered backdoor trigger and target label are of low quality, as long as they can distinguish benign and compromised clients. We validate this by experiment. In particular, we use 20 iterations (originally, it's 100) when reverse engineering the trigger/target label under the default setting to obtain a low-quality trigger/target label. We find that genuine scores for malicious clients are still low. The final ASR is  $13.23\%$ , which means our FedGame is still effective.
Impact of the Total Number of Clients. We study the impact of the total number of clients for our FedGame under the default setting. In particular, we consider the total number of clients to be 10, 30,
50, 70, and 100, where the fraction of malicious clients is  $60\%$ . We show the experimental results in Table 5. Our experimental results show that our FedGame is effective for different number of clients on different datasets.
Table 5: ASRs of FedGame under different total number of clients on MNIST and CIFAR10. The fraction of compromised clients is  $60\%$ .
Dataset	Total Number of Clients
10	30	50	70	100
MNIST	9.72	9.95	10.03	10.01	9.89
CIFAR10	8.92	10.44	10.62	9.79	10.82
Impact of the Size of Server Clean Data. By default, we set the ratio between the number of clean examples of the server and the total number of examples of clients to be 0.1. We conduct experiments with different ratios: 0.01, 0.02, and 0.05 under the default setting. The corresponding ASRs are  $9.71\%$ ,  $12.38\%$ , and  $9.75\%$ , indicating that FedGame is effective even when the server only has  $1\%$  clean data.
Trigger Optimization. We consider an attacker optimizes trigger pattern such that a backdoored input is more likely to be predicted as the target class. We perform experiments under the default setting. The ASR is  $12.43\%$ , which indicates that our FedGame is consistently effective for trigger optimization.