SPMC: Self-Purifying Federated Backdoor Defense via Margin Contribution
Authors: Wenwen He
Wenke Huang
Bin Yang
ShuKan Liu
Mang Ye
Venue: ICML 2025 poster (2025)
Keywords: Backdoor Defense
Federated Learning
Game Theory
Primary area: deep_learning->robustness
TL;DR: SPMC: Self-Purifying Federated Backdoor Defense via Margin Contribution

Abstract: Federated Learning (FL) enables collaborative training with privacy preservation but is vulnerable to backdoor attacks, where malicious clients degrade model performance on targeted inputs. These attacks exploit FL decentralized nature, while existing defenses, based on isolated behaviors and fixed rules, can be bypassed by adaptive attackers. To address these limitations, we propose **SPMC**, a marginal collaboration defense mechanism that leverages intrinsic consistency across clients to estimate inter-client marginal contributions. This allows the system to dynamically reduce the influence of clients whose behavior deviates from the collaborative norm, thus maintaining robustness even as the number of attackers changes. In addition to overcoming proxy-dependent purification's weaknesses, we introduce a self-purification process that locally adjusts suspicious gradients. By aligning them with margin-based model updates, we mitigate the effect of local poisoning. Together, these two modules significantly improve the adaptability and resilience of FL systems, both at the client and server levels. Experimental results on a variety of classification benchmarks demonstrate that SPMC achieves strong defense performance against sophisticated backdoor attacks without sacrificing accuracy on benign tasks. The code is posted at: https://github.com/WenddHe0119/SPMC.

SPMC: Self-Purifying Federated Backdoor Defense via Margin Contribution
Wenwen He 12
Wenke Huang
Bin Yang'
Shukan Liu
Mang Ye
Abstract
(a) Individual
Serven-side
Margin Coalition
Federated Learning (FL) enables collaborative training with privacy preservation but is vulnera- ble to backdoor attacks, where malicious clients degrade model performance on targeted inputs. These attacks exploit FL decentralized nature, while existing defenses, based on isolated behav- iors and fixed rules, can be bypassed by adaptive attackers. To address these limitations, we pro- pose SPMC, marginal collaboration defense mechanism that leverages intrinsic consistency across clients to estimate inter-client marginal contributions. This allows the system to dynam- ically reduce the influence of clients whose be- havior deviates from the collaborative norm, thus maintaining robustness even as the number of at- tackers changes. In addition to overcoming proxy- dependent purification's 's weaknesses, we intro- duce a self- purificacia process that locally ad- justs suspicious gradients. By aligning them with margin-based model updates, we mitigate the ef- fect of local poisoning. Together, these two mod- ules significantly improve the adaptability and resilience of FL systems, both the client and server levels. Experimental results on a variety of classification benchmarks demonstrate that SPMC achieves strong defense performance against so- phisticated backdoor attacks without sacrificing accuracy on benign tasks. The code posted at: https://gitan ttup:: com/ W 9/SMCC.
Aggregated Weight
Action
Ours
Out! 0
(b) Predefine Scale:
No scale rule
Client-side
Detect
Ours
Purify
No- No-proxy Purification
(c) Proxy Assistance
Drawback
Distance
Statisties
Target
Ours
(a) Only Individual Action
(b) Predefined Scale Requirement Proxy Assistance
X
Figure I. Motivation. Illustration of the limitations of existing defenses and the advantages of the proposed method from both server-side client-side. The comparison table highlights that our method uniquely avoids reliance on three drawbacks. de- notes attacker and denotes benign client.
ables multiple devices collaboratively train global model while preserving data privacy by storing data locally end devices. The general approaches (McMahan et al., 2017; Blanchard et al., 2017) aggregate parameters from participat- ing devices and subsequently redistribute the global model (averaged parameters) for further training, aiming to learn a high-quality model without centralizing private data. How- ever, this distributed learning framework complicates the verification of each participant's 's trustworthiness, rendering it vulnerable to backdoor attacks (Chen et al.. 2017; Gu et al., 2019; Li et al., 2022; Fung et al., 2020). In such attacks, an attacker may insert triggers into one or more local models, causing the global model to exhibit specific malicious behaviors when these triggers are activated. For instance, in the context of autonomous driving, an attacker could place special stickers (e.g., smiley faces) on stop sign, misleading the system into interpreting the stop sign as speed limit, thereby exemplifying backdoor attack in a real-world scenario (Gu et al., 2019). Therefore, effectively addressing backdoor attacks essential for ensuring the reliability of federated learning in real-time applications.
1. Introduction
Federated Learning (FL.), as a decentralized machine learn- ing paradigm (McMahan et al., 2016; Bonawitz, 2019),
"Equal contribution 'National Engincering Research Center for Multimedia Software, School of Computer Science, Wuhan University, Wuhan, China "School of National Cyber Security, Wuhan University. Wuhan, China 'School of Electronic Engi- neering, Naval University of Engineering, Wuhan, China. Corre- spondence to: Bin Yang <yangbin.coo cvriiineeeeee whu. shu.edu.en>>, Mang Ye <yemang@ whu.edu.en..
Proceedings of the 42nd International Conference Machine Learning. Vancouver, Canada. PMLR 267, 2025. Copyright 2025 by the author(s).

---

SPMC: Self-Purifying Federated Backdoor Defense via Margin Contribution
Existing defenses against backdoor attacks can be catego- rized into server-side defenses (Nguyen et al., 2024) and client-side defenses (Zhu et al., 2023b; Huang et al., 2024a). Both strategies either leverage individual distance differ- ences (Blanchard et al., 2017; Fung et al., 2018; Shejwalkar & Houmansadr, 2021), focus on outlier resilience by the overall statistical characteristics of local updates (Guerraoui et al., 2018: Yin et al., 2018), or optimize local updates based on target thresholds (Li et al., 2019; Ozdayi et al., 2021; Xie et al., 2021). However, these approaches rely on two primary assumptions: individual behavior and passive purifi- cation. Individual action regarding client-to-whole distances overlooks the behavioral communication between clients. Passive purification, which relies on predefined scaling rules or an additional clean dataset, can easily compromise data privacy and overlook biases in poisoned participant num- bers (Li et al., 2020b; Ye et al., 2025b; Fang et al., 2025).
2023a) to realize self-purifying. This gradient measures the discrepancy between local model predictions and the knowl- edge communicated by the coalition model, thereby pre- venting overfitting to poisoned samples (Wang et al., 2023; Rame et al., 2022; McMahan et al., 2017; Shi et al., 2021; Yang et al., 2024). Extensive experiments demonstrate that our defense method maintains high model performance and robustness simultaneously. a feat not previously achieved.
Our main contributions are follows:
We concentrate on the backdoor robustness in federated learning and reveal that existing approaches only focus on individual action and overly depend on the prede- fined scale with proxy assistance to enhance backdoor attack defenses, resulting in the global model's vulner- ability against changes in the number of attackers. We address the lack of flexible purification of malicious impacts through client margin difference contributions, realizing non-proxy distillate for local model guidance.
Inspired by the Shapley value (SV) from game theory (Ghor- bani et al., 2020; Jiang et al., 2023), we observe an important phenomenon in FL. The contribution made by a backdoor attacker differs significantly from that of a coalition that excludes the attacker. This difference can serve as a reliable indicator for identifying malicious clients. To quantify this, we define the inter-client margin contribution, which mea- sures the impact of a client's 's participation by comparing its local model parameters with those of the corresponding coalition model. This approach addresses the limitations of existing assumptions and enhances system robustness by ef- fectively capturing and mitigating abnormal client behavior.
To establish a clear distinction between the malicious and benign participants in the global model, we intro- duce a self-purifying margin difference contribution de- fense (SPMC). In server aggregation, our method quan- tifies parameter differences between the local model and the margin coalition model, governing server ag- gregation without any predefined scale. On the client side, we realize non-proxy distillation to guide local gradients to align with the margin models' direction, preserving all local gradients in a benign direction.
We conduct experiments various datasets, including CIFAR-10/100, MNIST, and FashionMNIST, under backdoor attack conditions. The effectiveness of the proposed SPMC is validated, confirming the indispens- ability of the foundational module.
Motivated by the perspective of margin contribution in game theory, we introduce a Self-purifying Backdoor Defense via Margin Contribution (SPMC), including client gradient op- timization and server aggregation for active purification. Specifically, the server receives malicious gradient orienta- tions markedly different from those of benign participants, resulting in a substantial margin difference. We argue that the difference in model parameters with the contribution of the margin is crucial to accurately identify attackers. Conse- quently, we propose margin difference aggregation, wherein, for each client, we measure the margin contribution by the cosine similarity based on the parameter differences be- tween that client and other clients (the coalition), allowing the purification of poisoning effects without predefined scale. We adaptively adjust the importance of each partici- pant according to their margin contribution, assigning lower aggregation weights to distorted clients with significant mar- gin differences while encouraging participants with smaller margin differences to contribute more to the collaborative effort. In the client-side scenario, to mitigate the impact of attackers continuously influencing the global model with toxic data, we further align the direction of the participants local model gradients with the direction of the gradient rep- resenting general knowledge (Guo et al., 2022; Zhu et al.,
2. Related work
2.1. Overview of Federated learning
Federated Learning (Huang et al., 2024b; Wan et al., 2025) has become a popular Machine Learning framework be- cause it allows clients to train models in decentralized manner without having to share any private datasets. In the FL framework, data for learning tasks is acquired and processed locally at the edge node, and only the updated Ma- chine Learning parameters are transmitted to the central or- chestration server for aggregation. It consists of four phases: FL initialization, local model training, local model updating, and aggregation. If we make certain assumptions about the type of attack and limit the number of malicious clients. Aggregation techniques can produce robust training models in some cases (Huang et al., 2023b; 2022). Fedavg (McMa- han et al., 2016) is widely used in FL for both attack and defense scenarios, especially in work on backdoor attacks and defences (Bagdasaryan et al., 2020; Nguyen et al., 2022:
2

---

SPMC: Self-Purifying Federated Backdoor Defense via Margin Contribution
Shen et al., 2016; Nguyen et al., 2020; Muñoz-Gonzälez et al., 2019; Fung et al., 2020). While the algorithm also allows for weighting the contributions of different clients, this also makes the system more susceptible to manipulation, as malicious users can use this to increase their impact.
above methods require appropriate thresholds to regulate the benign update of global paradigms.
The above defenses mainly rely on individual action, the predefined rule, and proxy assistance, as shown in Fig. 1. These rules are crucial to ensure the difference between benign and malicious updates and the correctness of the overall direction of the client's local updates, which are serious rule challenges for different realistic settings.
2.2. Defense Against the Backdoor Attack
Malicious backdoor attacks pose serious threat to fed- eral systems. Existing backdoor defense schemes against backdoor attackers can be classified into three categories:
3. Preliminaries
Distance Differential Defence (Blanchard et al., 2017: Fung et al., 2018; Tian et al., 2021; Zheng et al., 2021; Han et al., 2023; Fereidooni et al., 2024). Mainly through the difference in distance between local updates and server aggregated updates, clients with obviously far from the overall direction are considered evil and excluded from the aggregation process. For example, Sageflow (Park et al., 2021) combines entropy filtering and loss to measure the difference between the local model and the ideal distribution weighting of the server model. FLTrrstt (Cao al., 202 aa) collects a clean, small training dataset and thus introduces Relu-clipper cosine similarity to allocate high trust scores for those reliable clients. Distance discrepancy defense mostly focuses on -eeerver-errerreeee exchanges, thus neglecting inter-local edge exchanges. In addition, the security of the agent dataset determines whether the ideal distribution is fitted to the benign update, aggregating the robust model.
Threat Model:
Backdoor attacks have been extensively studied against centralized learning to manipulate the cen- tralized model by inserting some triggers during training. Specifically, we define T as the trigger pattern and m as the trigger location mask. The modified backdoor instance is represented as & = (ū, Ø). For T. we apply the formula I = (1 m) O x + 7 @ T, incorporating the trigger pattern T into the original instance æ at locations specified by the mask m (Liao et al., 2018). We then alter the original label y to the predefined attack target ÿ. For any input x, the kth client dataset D&has the following output:
D(E. 3x E
D&-
(1)
v) vr #
where D denotes the compromised dataset that exploits the flip-flop label attack or proportionally increases the weight of the malicious model (Xie et al., 2020).
Statistical Distribution Defence (Yin et al., 2018; Guer- raoui et al., 2018; Pillutla et al., 2022; Zhang et al., 2022b; Cao et al., 2023) constructs different statistical criteria to select and exclude bad users. For example, RFA (Pillutla et al., 2022) calculates the geometric median with an al- ternating minimization function. FLDetector (Zhang et al., 2022b) considers the historical client updates and votes for those with large discrepancies between the predicted and received client updates as attackers. However, the above two approaches require complex hyper-parameter configurations to adapt to heterogencous federation scenarios, striking a blow to the generalization and robustness of backdoor de- fense in terms of generalization and robustness.
In each iteration of FL, each client updates the local model based its local dataset (Li al., 2020a). We denote D2 as the keth client's 's local dataset. Under hetero- geneous federated learning, the kth client's 's model parameter distribution T in the /th epoch:
Local Update:
1 < w 1-1 VV DD).
(2)
where 17 denotes the learning rate and I is determined by the local dataset DR. global parameter w and updates model parameters by the loss function L.
Server Aggregation: In federated learning, the central server receives the updated model parameters from the lo- cal and updates the global model according to a certain aggregation strategy (usually federated aggregation (McMa- han et al., 2017)). The global model parameters in the tth epoch can be expressed as: w = Σ aulf, where ag denotes the weight of the keth client, which must satisfy D
Objective Optimized Defence (Wu al., 2020; Li al., 2019; Ozdayi et al., 2021; Cao et al., 2021b; El-Mhamdi et al., 2021; Panda et al., 2022) locally sets threshold ob- jectives to regulate the global paradigm and weed out bad users. For example, RLR (Ozdayi et al., 2021) adjusts the learning rate considering the agent update direction and slows down the learning rate for potentially malicious par- ticipants with large number of locally conflicting update directions. CRFL (Xie et al., 2021) sets pruning thresholds for the global model paradigm, scales the model scrub cu- calyptus tree of bad users proportionally, and adds noise to reduce the malicious influence of bad users. However, the
4. Methodology
4.1. SPMC: Self-Purifying Margin Contribution
Motivation. Most existing defenses to backdoor attacks focus on individual actions that reward clients based on global distribution but ignore inter-client communications,
3

---

SPMC: Self-Purifying Federated Backdoor Defense via Margin Contribution
Clients-side
Attacker
Self-Purification
Server Aggregation
Attocker's
Coulition Model
Grocalgrad
tionn
Attacker
Cos Mwy
Ga
Decrease
Sample Label
Lk
x Chasen
CE
Coalition Predict
Other cllienss
Aggregate Model
0.72 0.59
Aggregated
Increase
Weight
Benign client's Coalition Model
Benign
Cos
Distribute
Predict probability
Benign client
Chosen
client
Figure Overview Self-Purifying Margin Contribution (SPMC). See Sec. On client side, we utilize the coalition aggregation model for gradient alignment, wherein the updated local model parameters sent to the server side. On the server side, margin differences among these parameters are assigned appropriate weights facilitate the aggregation of the global model.
To address these problems, our idea is to estimate each client's contribution other clients, and further use the contribution to guide the direction of local updates and identify malicious attackers (Jiang et al., 2022). This idea is inspired by the Shapley Value, a classical method to quantify participants' contributions in cooperative game theory. Our research is the first to apply SV for backdoor defense.
where Φk is our proposed function to measure the margin contribution of client k. We focus on verifying whether a new client contributes benignly to the existing client. Sup- pose the new client differs significantly from the existing client in terms of the target goal; in that case, we believe that the federation resulting from the new client joining the existing client will produce a malicious contribution. Back- door defense in federated learning aims to penalize clients whose coalitions generate malicious contributions.
For N clients, we have / {Tx) as the set of local client distributions. According to Eq. the distribution 47 supported on space D2 X' x y, X and y is input and output respectively. The coalition S ~ DM is set of clients, such that ||S||| M, where M denotes the number of clients in the coalition. Let I E [0, 1] denote the utility function, and ((S) represents the value of S coalition. We express I' as the target I' + min ED.-DM (S(((g Dx)) for each coalition. We define SV as below:
In the rest part of this section, investigate how to apply margin contribution on both the server-side and client-side for attacker identification and self-purification Fig. 2).
4.2. Margin Contribution Aggregration
Margin Aggregation: According Eq. 4, we first compute the coalition r (S)(k)) on the server side standard to measure the likelihood of potential attackers. The attacker trains malicious local model parameters due to poisoned private datasets. Therefore, we secondly similarly utilize coalition r (S) (k)) as a standard for updating local model parameters the client side. Since the global model over- need to store the up-
Φx D)
E M-IN [T' USU (b)) - (S)), (3)
From this definition, the SV of a client is its expected margin contribution in I' to a set of client coalitions S. To calcu- late SV, we need to consider all possible client coalitions, i.e., all subsets of N clients. The cost will be exponen- tially increased with respect to the number of clients N, that is, O(2 Such computation is extremely expensive, even with a small number of clients. Therefore, it is crit- ical to find an efficient solution for client valuation. By analyzing the SV definition, we notice that the key is to measure the value with and without a certain client with respect to all possible combinations of other clients (shown in Fig. 1). Therefore, we propose an efficient approximation, by directly measuring the contribution of client & to others (N) ((K)). We define our new value Φ& as:
writes the local model in round dated local model parameters for round ( - 1 and recalculate the kth coalition. We define Is, as a simplistic modelling description of the coalition I (5" (kk) in the Ith epoch:
Sx.
Is, T (N((A))
Σ
a
a
(5)
Client
Server
where S₁ = without the keth client and ar means the keth client's aggre- gation weight reconstructed via margin contribution.
\ (k)) represents a coalition
Difference Computation: According to Eq. 4, under Fed- erated Learning (FL), the margin contribution of client & is quantified as the discrepancy in model parameters between
du
= T-DN (N ((+)) I((k))] T((#)) It,
(4)

---

SPMC: Self-Purifying Federated Backdoor Defense via Margin Contribution
client k and the coalition excluding that client. We employ the cosine similarity measure evaluate the alignment be- tween the local client and the margin aggregation model (the coalition model) (Huang et al., 2023a), as it focuses on directional alignment rather than magnitude, making it more robust in high-dimensional, heterogeneous FL settings. We further compare cosine similarity with Euclidean and Wasserstein distances, with results reported in Table 5 in Appendix C. Consequently, the Equation can be simplified as: ox (k: F D; N) = Jsy Jags, |x
2022), encouraging the attacker to extend the malicious impact once again. We propose an effective self-purifying updates paradigm that aligns local malicious gradient direc- tion with the general knowledge of margin coalition models.
Non-proxy Distillation. Due to the great success of knowl- edge distillation in catastrophic forgetting (Phuong & Laa- pert, 2019; Hinton et al.. 2015; Kirkpatrick et al., 2017), researchers have applied knowledge distillation in backdoor attacks, expecting the model to be more discriminative to the attacker. We hope to leverage margin contributions to distill agentless datasets for self- self-purification. We utilize the mar- gin coalition model predictions as general knowledge and compare the model predictions to the general knowledge to align the local gradient direction. Specifically, we obtain the domain-specific direction by calculating the cross-entropy Lee( (w) between the local model prediction p(t,) |at) and the true target y. and the general knowledge direction based on the Kullback-Leible (KL) divergence between p(t;) (z)) and the marginal model union prediction ps, (4:]zz):
As indicated by the for- mula, high level of similarity suggests that the potential attacker is significantly distant from the parameters of the coalition model for accurately identifying that attacker.
Reweighted Aggregation: We note that the existing ag- gregation weights ag are typically based on data scale: ag- Σ N2 or participant size or- = K We argue that popular aggregation methods ignore the reliability of the margin contribution and assign higher weights to potential attackers that are far from their corresponding margin coali- tion. Therefore, we reconfigure the aggregation weights of the clients via the margin contribution set Φ::
Ps, La(w) = = - ps, (t,(2)) x log p(4//z) ps. (t,lz)
(8)
Φ = [T (NV(1)) (((1))..... I. (m))))) - ([n])] Cosine 4 He E max- obx
We denote the gradients of Lu((w) and Lce(u) as Gg = V (w) and G. = VCCE(W), respectively. The relations between Gg and Ga are twofold. Firstly, the fact that their angle less than 90º indicates that the local knowledge pos- sessed by the local client does not conflict with the general knowledge, In this case, we safely set the updated gradient direction Glocgrad as Ga- Secondly, their angle is greater than 90', which indicates that the local knowledge conflicts with the general knowledge. In this case, we project the Ga to the orthogonal direction of Gg to optimize the classi- fication model, which avoids increasing the KL loss. Our LocGrad strategy is mathematically formulated as:
T = 131...., Te....,G.b
(6)
o((6))
ag- = Ev )-
Specifically, for local models, the impact of their model parameters is highlighted when the similarity between their model parameters and the coalition model parameters is high, and their impact is penalized when it's low.
4.3. Local Gradient Alignment
Ga.
if Ga G. 2 0,
Motivation. The central server broadcasts Wy to each par- ticipant in the form of W/ + Wgg. Participants perform the local optimal function to fit the local distribution according to their private dataset Dr. From Eqs. 1 and 2, benign and malicious fit different distributions and naturally hold dif- ferent gradient directions (Rame et al., 2022). Specifically, malicious changes the original label y to an attack target y by trigger pattern т, resulting in a gradient direction that deviates significantly from the benign participants' direction to influence the global model subtly:
Gioegrad
Go X. Ga G.-Goo Gg:
(9)
otherwise,
[G
where À is a scaling factor for adjusting the projection. In- stead of updating the local parameter vectors using Ga, we optimize the local parameter vectors using Gioegrad. which prevents the gradient direction from overfitting to poisoned samples when the participant is malicious.
5. Experiment
5.1. Experiment Setup
Ce(wt, Dw) 1d.1 CCE,. (CE(Z,N) M) EEED. Cas(E,
Dataset. Following (Li et al., 2021; Mu et al., 2021), we experiment on four federated scenarios.
Benign
Backdoor
where E = (ž. T) denotes the modified backdoor trigger. LCE +- - ----ye y,log (p (1,]2)) is the loss function typically used by traditional methods, optimizing the model param- eter by minimizing the negative log-likelihood. But LoE relies heavily on anti-overfiting techniques (Zhou et al.,
MNIST (LeCun et al., 1998) is a handwritten digit dataset of 10 digits class (19) with 70, 000 images.
CIFAR- 10 (Krizhevsky & Hinton, 2009) has 10 seman- tics with 50k, 10k images for training, validation.
CIFAR- 100 a collection of 60,000 32x32 color im-
5

---

SPMC: Self-Purifying Federated Backdoor Defense via Margin Contribution
100
y-0.2
100
y=3
100
85.32
R8.14
80.14
85.98
85.32
43.0
50
F
65.83
65.25
10
72.98
50
15
75.62
60
76.01
25
75.16
10 15
20
25
Figure 3. Comparison of difffrent lambda X for backdoor failure rate R on CIFAR-IO with malicious ratio 7 = {0.2, 0.3}. We set À = 1.0 for the next experiments. See Sec. 5.2.
Figure 4. Ablation local epoch on CIFAR-10 (3 0.5)
with = 0.3 for the federated benign performance A (Green line), backdoor failure rate (Orange line) and the trade-off V (Right Table). More details see Sec. 5.2.
Table Ablation on key components SPMC MNIST and CIFAR-10 with 3 = 0.5 and
(0.2, 0.3). The À (Eq. 9) for GradReg experiment setting is 1.0. See Sec. 5.2.
UDaC
MNIST
DSPMC
LGAlign MCAgg
= 0.2
Y 0.3
50
Sec. 4.3
Sec. 4.2
R
A
R
V
99.25
2.20
50.73
99.17
1.27
50.22
98.85
27.92
63.38
98.94
18.78
58.86
10
20
25
30
10
1.5
20
30
99.27
2.11
50.69
99.19
0.52
49.85
Federaied Beaign Perforasince
Backdoor
98.79
42.73
70.76
98.72
55.95
77.34
V
N DnC
10
15
20
30
CIFAR-10 10
61.67
57.11
52.37
53.51
49.72
LGAlign
MCAgg
7
0.2
0.3
Sec. 4.3 Sec. 4.2
.4
R
V
A
R
V
Ours
72.98
67.67
61.51
60.46
61.77
65.03
50.62
57.83
64.82
36.12
50.47
Figure 5. Ablation Client num /N on CIFAR- (3 0.5.7
66.66
81.90
74.28
65.13
77.57
71.35
0.3) with the popular counterpart. See See. 5.2.
48.18
56.57
63.81
37.17
50.49
66.78
85.32
76.05
65.83
80.14
72.98
ii) Statistics Distribution Defense:
Bulyan (ICMC118) (Guerraoui et al., 2018): Agree on coordinates by principal component vectors, chosen via Byzantinc-resillent aggregations algorithms.
ages in 100 classes, with 600 images per class, com- monly used for image classification tasks in machine learning and computer vision.
RFA [TSP (Pillutla et al., 2022): Leverage the geo- metric median and the smoothed Wciszfeld algorithm.
FashionMNIST (Xiao et al., 2017) is dataset of 70,000 grayscale images of 10 fashion categories.
iii) Objective Optimized Defense:
As for the data heterogeneity simulation, we utilize the
RSA (AAAF19] (Li al., 2019): Norm regularization and random subgradient aggregation against Byzantine.
Dirichlet distribution 3 to simulate the label skew, as pre- vious methods (Li et al., 2020a; 2021; Zhang et al., 2022a: Huang et al., 2023c), where
RLR [AAAT2I] (Ozdayi et al., 2021): Adjust the server learning rate with dimension and communication.
is the concentration pa- rameter adjust the class-wise skew level. We set 3 0.5 to simulate the heterogeneous federated network for follow- ing experiments.
CRFL ICMU211 (Xie et al., 2021): Exploit clipping and smoothing operations to train federated learning model. Backdoor Attacks. We demonstrate the effectiveness of the proposed method under the popular paradigm (Gu et al., 2019; Han al., 2023). The size of the trigger pattern is 2 x 6 and its location is in the top-left corner of the images. We convert the attacked label to the second class (i.c., 2 in Digits). We set the malicious client ratio as {0.2, 0.3}. The local data poisoned portion default set as 0.3.
Counterparts. We compare three types of backdoor defense solutions. The details are as follows:
Distance Difference Defense:
FoolsGold [a= (Fung et al., 2018): Analysing similarity updates to mitigate malicious clients.
DnC' [NDSS (Shejwalkar & Houmansadr, 2021): Downgrading peacekeeping and outlier removal against model poisoning attacks in federated learning. Sageflow (Ne (Park al., 2021): Combine tropy filtering and loss dynamically adjusting weights. Finetuning [[bokffonDL199 (Quinn et al., 2019): Directly optimizes the aggregated global model on vaidation.
Evaluation Metric. Given that the backdoored model fwr is anticipated to misclassify poisoned dataset D V. the Backdoor Failure Rate R 11 I Exe { (z = 7) based on the Attack Success Rate (ASR) (Han et al., 2023; Krizhevsky & Hinton, 2009; Ye et al., 2025a). Addition- ally, the trained model fw should produce normal outputs
[D]
6

---

SPMC: Self-Purifyin Federated Backdoor Defense via Margin Contribution
Table Comparison with the state-of-the -ferr-t--rrttt backdoor robust solutions in the FashionMNIST, CIPAR-10, and CTFAR- 100 dataset with y {0.2, 0.33. Up anows indicate advancements in the given metric compared to FedAvg, while down arrows denote regressions. The bolded number is the best result the irregular case, and means failure optimization. Refer to Sec. 5.3 for detailed explanations.
Methods
FashionMNIST
CIFAR-I0
CTFAR-106 100
0.2
R
V
A
R
V
A
R
V
FedAvg
87,89
4.73
46.31
65.03
50.62
57.83
57.82
15.75
36.78
Predefined Scale Requirement
DnC.
87.25
88.70
87.97
59.79
80.93
70.36
57.52
15.91
36.72
Sageflow
88.15
9.48
48.81
64.55
51.88
58.22
57.49
17.87
37.68
Bulyan
38. 12
99.94
69.03
10.61
100.0
55.30
51.64
13.23
32.43
RFA
85.66
42.92
64.33
72.47
68.40
57.15
8.09
RLR
87.69
7.48
47.58
64.32
45.59
$4.96
45.94
25.85
35.89
CRFI.
84,19
1.04
42.62
49.45
64.22
56.8
26.50
60.41
43,46
No Predefined Scale Requirement
FoolsGold
82.92
0.27
41.60
54.28
94.01
74.15
24.92
68.63
46.77
RSA
10.00
99.99
54.99
10.00
100.00
55.00
Finetuning
87.15
16.71
51.93
59.70
59.17
59.44
41.43
37.93
39.68
Ours
82.19
70.07
76.45
130
66. 1.
33.
76.05
64.52
49.87
49.87
57.20
Methods
FashionMNIST
CIFAR-I0
CIFAR-100
0.3
A
R
V
A
R
V
A
R
V
FedAvg
83.13
0.95
44.54
64.82
36.12
S0.47
$6.06
11.86
33,96
Predefined Scale Requirement
DnC. 87.09
34.49
60.79
59.99
63.35
61.67
56.14
11.01
33.58
Sageflow
87.84
0.47
44.16
64.87
36.88
50.88
56.07
11.03
33.69
Bulyan
45.05
86.67
65.86
10.00
80.00
51.77
3.92
27.84
RFA
0.06
63.64
$4.74
4.67
29.71
RLR 87.52
0.83
44.17
63.63
36.84
50.24
$2.68
11.68
32.18
CRFL
78.62
0.10
39.36
45,10
49.83
47.47
25.99
$7.75
41.87
No Predefined Scale Requirement
FoolsGold
79.98
0.04
40.01
56.94
37.17
47.06
22.90
$5.40
39.15
RSA
10.20
86.19
48.20
10.00
100.00
55.00
Finetuning
87.16
2.48
44.82
57.36
54.11
55.74
38.60
41.07
39.83
Ours
85.14 84.14_2.10
60.52
72.83
128.3
65.83
80. 14
44..0
72.98
66,
10.12210.000
19.02 16
42.57
55
25
25
(y-0.2
(y-0
(y-0.)
(y-33)
Figure Comparison of federated benign performance backdoor failure rate R CIFAR- with (0.2, SPMC appears to have stable convergence speed and satisfying performance.
on benign samples (e.g., images without triggers). The model's 's accuracy on these samples can be measured us- ing the metric called Main Task Accuracy (MTA) (Xie et al., 2020) on benign samples. This is calculated as A= [D] Exen(fu(r)
Training Set. For model efficiency and algorithmic con- vergence consideration, we conduct communication epochs for F = 50 for three datasets. We set local updating round T = 10, where federated learning approaches have little or no accuracy gain with more communications. We use the SGD optimizer with the learning rate r 0.01 for all approaches. The corresponding weight decay is 1e 5 and momentum is 0.9. The training batch size is 64.
y}. where denotes the val- idation dataset without malicious trigger pattern. Further- more, we define the to measure the heterogeneity and robustness trade-off as: V A+R All three of these met- rics are proportional to model performance. We utilize the mean performance value of the last five communication epochs as the final evaluation results.
5.2. Diagnostic Experiments
For thorough analysis, we perform set of ablative studies MNIST and CIFAR-10 with label skew B 0.5 and malicious ratio 7 selected by {0.2, 0.3).
Network Structure. Following (Huang et al., 2023c; et al., 2021), we utilize CNN as the backbone. Specifically, we use simple CNN structure on FashionMNIST, MNIST, and CIFAR-10. 10. Moreover, we use resnet- 18 the backbone on CIFAR-100 1-0 dataset.
Control Hyper-Parameter À in Eq 9. Fig. quantifies the effect of the hyperparameter X, which measures the strength
7

---

SPMC: Self-Purifying Federated Backdoor Defense via Margin Contribution
Original Image
SPMC
DnC
5.3. Comparison to State-of-the-Arts
Tab. 2 plots the final metric by the end of the federated learning process with popular backdoor defense methods. Despite the handwritten dataset with simple features, SPMC demonstrates robustness when compared to other methods vulnerability on handwritten datasets. Moreover, although DnC demonstrates superior performance in scenarios with a low attacker ratio (v = 0.2), the limitations of the pre- defined rules become evident as the number of attackers varies. It shows that our method achieves a more satisfy- ing performance than our different counterparts on different evaluation metrics, which confirms that SPMC effectively enhances the backdoor robustness in heterogeneous feder- ated learning. Take the result of CIFAR- 100 with ? = 0.2 as an example, our method outperforms the best counterpart with a gap of 10.43% on the V metric. Furthermore, exist- ing backdoor defensive methods appear fragile Backdoor Failure Rate R under either the large malicious client ratio
Figure 7. Comparison of heat maps for SPMC and DnC with and without the trigger. Final models are trained with 7 = 0.3.
of the gradient alignment in different scenarios. Specifically, the proportion of malicious attackers does not affect the effect of the hyperparameter À on the model. As can be seen from the figure, the effect is not significant when À exceeds 1.0 or is less than 1.0. This is because when the alignment criterion is less than À = 1.0, some benign participants are forced to learn a part of the malicious knowledge. If the alignment criterion is greater than 1.0, the malingerers are prone keep the original update direction. As a result, under strict regularization stiffness, the alignment gradient is effective for method improvement. In the next experiments, we choose À= = 1.0 for different scenarios.
7 0.3. It reveals that existing solutions fail to conduct client-wise discrimination selection under large-scale evils. The expanded experiment on the MNIST dataset is shown in Appendix C.2.
We further plot both the Federated Benign Performance A and Backdoor Failure Rate R during the communication pro- CIFAR- 10 setting in Fig. 6. We observe that SDFC presents faster and stabler convergence speed than others with different malicious ratios. We utilize Grad-CAM (Sel- varaju et al., 2017; He et al., 2023) to visualize the network attention with or without the trigger (Fan et al., 2025). Com- pared to DnC, SPMC prefers to extract key features despite attacks (Fig. 7). We visualize the learned features using t-SNE in Appendix C.3. Results shows SPMC effectively purifies poisoned samples, mitigating their influence and substantially lowering the attack success rate.
Target Objective. We quantitatively analyze the proposed SPMC. In Table 1, although Local Gradient Alignment (LGAlign) has good performance, it still performs poorly with a high percentage of malicious clients with complex images input. Even in the case of a high percentage of malicious clients, combining Local Gradient Alignment (LGAllgg)) and Margin Contribution Aggregation (MCAgg) acquires satisfying federated benign task and backdoor re- moval performance, which is consistent with the fact that we utilize the margin coalition model for Local Gradient Alignment and Server Aggregation motivation.
6. Conclusion
We present self-purifyinn backdoor defense via margin con- tribution (SPMC). the first work to implement backdoor ro- bustness in heterogeneous federated learning based on mar- gin contributions. We argue that existing backdoor defenses either focus only on individual behaviors, rely on predefined scales, or utilize proxy data to design well-designed client selection mechanisms. However, malicious clients can adapt their adversarial strategies to bypass these defense proto- cols. Therefore, we utilize margin contributions to quantify the discrepancy between the local parameter distribution and its coalition model parameter distribution, enabling the system to self-purify malicious impacts. The effectiveness and robustness of our method are validated against common backdoor attacks involving varying numbers of adversaries. We hope this work offers novel perspective and paves the way for future research in this domain.
Local Updating Rounds Furthermore, we analyze the effect of local updating rounds in Fig. 4. SPMC maintains stable performance under different local rounds, indicating that SPMC achieves fast convergence in limited epochs and possesses the ability to resist client drift under various local rounds (Zhang et al., 2023; Moreno-Torree al., 2012). We choose T 10 as the updating round.
Client Scale N. We evaluate the performance with var- ious participating client scales N' in Fig. 5. Our SPMC achieves competitive heterogeneity and robustness trade-off performances, demonstrating that our method is capable of dealing with the high client scale in the federated system.
8

---

SPMC: Self-Purifying Federated Backdoor Defense via Margin Contribution
Acknowledgement
Transactions on Pattern Analysis and Machine Intelli- gence, 2025.
This work supported by the National Natural Science Foundation of China under Grant (62361 166629, 62176188, 623B2080), the Hubei Provincial Natural Science Founda- tion of China (2025AFB219). The supercomputing system at the Supercomputing Center of Wuhan University sup- ported the numerical calculations in this paper.
Fereidooni, H., Pegoraro, A., Rieger, P., Dmitrienko, A., and Sadeghi, A.-R. Freqfed: A frequency analysis- based approach for mitigating poisoning attacks in federated learning, In NDSS, 2024.
Fung, C., Yoon, C. J., and Beschastnikh, I. Mitigating sybils in federated learning poisoning. arXiv preprint arXiv: 04866, 2018.
Impact Statement
This paper presents work whose goal advance the field of Machine Learning. There are many potential societal consequences of our work, none of which we feel must be
Fung, C., Yoon, C. J., and Beschastnikh, I. The limitations of federated learning in sybil settings. In RAID, pp. 301- 316, 2020.
specifically highlighted here.
Ghorbani, A., Kim, M., and Zou, J. A distributional frame- work for data valuation. In ICML, pp. 3535-3544. PMLR, 2020.
References
Bagdasaryan, E., Veit, A., Hua, Y., Estrin, D., and Shmatikov, V. How to backdoor federated learning. In AISTATS, pp. 2938-2948, 2020.
Gu, T., Liu, K., Dolan-Gavitt, B., and Garg, S. Badnets: Evaluating backdooring attacks on deep neural networks. IEEE Access, 7:47230-47244 2019.
Blanchard, P., El Mhamdi, E. M., Guerraoui, R., and Stainer, J. Machine learning with adversaries: Byzantine tolerant gradient descent. In NeurIPS, 2017.
Guerraoui, R., Rouault, S., et al. The hidden vulnerability distributed learning in byzantium. In JCML, pp. 3521- 3530, 2018.
Bonawitz, K. Towards federated learning scale: Syste design. arXiv preprint arXiv: 1902::1900001446 2019.
Guo, K., Zhou, K., Hu, X., Li, Y., Chang, Y., and Wang, X. Orthogonal graph neural networks. In AAAI, pp. 3996- 4004, 2022.
Cao, X., Fang, M., Liu, J., and Gong, N. Z. Fltrust: Byzantine-robust federated learning via trust bootstrap- ping. In NDSS, 2021a.
Han, S., Park, S., Wu, F., Kim, S., Zhu, B., Xie, X., and Cha, M. Towards attack-tolerant federated learning via critical parameter analysis. In ICCV, 2023.
Cao, X., Jia, J., and Gong, Z. Provably secure federated learning against malicious clients. In AAAI, pp. 6885- 6893, 2021b.
He, W., Fei, L., Zhao. S., Zhang, W., Teng. S., and Rida, I. Rrfae-net: Robust rgb-d facial age estimation network. In Chinese Conference Biometric Recognition, pp. 119- 128. Springer, 2023.
Cao, X., Jia, J., Zhang, Z., and Gong, N. Z. Fedrecover: Recovering from poisoning attacks in federated learning using historical information. In IEEE S&P, pp. 1366- 1383. IEEF, 2023.
Hinton, G.. Vinyals, O., and Dean, J. Distilling the knowledge in neural network. arXiv preprint arXiv: 15ti::55000000 150300253,,, 2015.
Chen, X., Liu, C., Li, B., Lu, K., and Song, D. Targeted backdoor attacks on deep learning systems using data poisoning. arXiv preprint arXiv:1712.05522 2017.
Huang, S., Li, Y., Chen, C., Shi, L., and Gao, Y. Multi- metrics adaptively identifies backdoors in federated learn- ing. In ICCV, pp. 4652-46666 2023a.
El-Mhamdi, E. M., Farhadkhani, S., Guerraoui, R., Guirguis, A., Hoang, L.-N., and Rouault, S. Collaborative learning in the jungle (decentralized, byzantine, heterogeneous, asynchronous and nonconvex learning). In NeurlPS, vol- ume 34, pp. 25044 -5055, 2021.
Huang, W., Ye, M., and Du, B. Learn from others and be
yourself in heterogeneous federated learning. In CVPR, 2022.
Huang, W., Ye, M., Shi, Z., and Du, B. Generalizable heterogeneous federated cross-correlation and instance similarity learning. IEEE PAMI, 2023b.
Fan, M., Hu, Z., Wang, F., and Chen, Bad-pfi: Exploring backdoor attacks against personalized federated learning. In Proc. of ICLR, 2025.
Huang, W., Ye, M., Shi, Z., Li, H., and Du, B. Rethinking federated learning with domain shift: A prototype view. CVPR, pp. 16312-16322, 2023c.
Fang, X., Ye, M., and Du, B. Robust asymmetric hetero- geneous federated learning with corrupted clients. IEEE

---

SPMC: Self-Purifying Federated Backdoor Defense via Margin Contribution
Huang, W. Ye, M., Shi, Z.., Du, B., and Tao, D. Fisher calibration for backdoor-robust heterogeneous federated learning. In ECCV, 2024a.
McMahan, H. B., Moore, E., Ramage, D., and y Arcas, B. A. Federated learning of deep networks using model averaging. arXiv preprint
2(2), 2016.
Huang, W., Ye, M., Shi, Z., Wan, G., Li, H., Du, B., and Yang, Q. A federated learning for generalization, robust- ness, faimess: A survey and benchmark. TPAMI, 2024b.
Moreno-Torres, J. G., Raeder, T., Alaiz-Rodríguez, R., Chawla, N. V., and Herrera, F. A unifying view dataset shift in classification. PR, (5(1):521-530 2012.
Jiang, J., Burkhalter, L., Fu, F., Ding. B., Du, B., Hithnawi, A., Li, B., and Zhang. C. Vf-ps: How select important participants in vertical federated learning, efficiently and securely? In NeurIPS, volume 35, pp. 2088-2101, 2022.
Mu, X., Shen, Y., Cheng, K., Geng, X., Fu, J., Zhang, T., and Zhang, 7. Fedproc: Prototypical contrastive federated learning on non-iid data. arXiv preprint urXiv:2109.12275: 2021.
Jiang. M., Roth, H. R., Li, W., Yang, D., Zhao, C., Nath, V., Xu, D., Dou, Q., and Xu, Z. Fair federated medical image segmentation via client contribution estimation. In CVPR, 2023.
Muñoz-GGnzzlez, I.., Co, K. T., and Lupu, E. C. Byzantine- robust federated machine learning through adaptive model averaging. arXiv preprint arXiv: 1wXi::/90.00525. 2019.
Kirkpatrick, J., Pascanu, R., Rabinowitz, N., Veness, Des- jardins, G., Rusu, A. A., Milan, K., Quan, J., Ramalho, T., Trabska-Barwinsker A., et al. Overcoming catastrophic forgetting in neural networks. PNAS, pp. 3521-3526, 2017.
Nguyen, T. D., Rieger, P., Miettinen, M., and Sadeghi, A.- Poisoning attacks on federated learning-based iot intrusion detection system. In DISS, volume 79, 2020.
Nguyen, T. D., Rieger, P., De Viti, R., Chen, H., Branden- burg, B. B., Yalame, H., Möllering, H., Fereidooni, H., Marchal, S., Miettinen, M., et (FLAME}: Taming backdoors in federated learning. In USENIX, pp. 1415- 1432, 2022.
Krizhevsky, A. and Hinton, G. Learning multiple layers of features from tiny images. Master's thesis, Department of Computer Science, University of Toronto, 2009.
LeCun, Y., Bottou, L., Bengio, Y., and Haffner, P. Gradient- based learning applied to document recognition. Proceed- ings of the IEEE, pp. -224,, 1998.
Nguyen, T. D., Nguyen, T., Le Nguyen, P., Pham, H. H., Doan, K. D., and Wong, K.-S. Backdoor attacks and defenses in federated learning: Survey, challenges and future research directions. EAAJ, 127:107166, 2024.
Li, I.., Xu, W., Chen, T., Giannakis, G. B., and Ling, Q- Rsa: Byzantine-robust stochastic aggregation methods for distributed learning from heterogeneous datasets. In AAAI, pp. 1544-1551, 2019.
Ozdayi, M. S., Kantarcioglu, M., and Gel, Y. R. Defend- ing against backdoors in federated learning with robust learning rate. In AAAI, pp. 9268-9276, 2021.
Li, Q., He, B., and Song, D. Model-contrastive federated learning. In CVPR. pp. 10713-10722, 2021.
Panda, A., Mahloujifar, S., Bhagoji, A. N., Chakraborty, S., and Mittal, P. Sparsefed: Mitigating model poisoning attacks in federated learning with sparsification. ICML, pp. 7587-7624. PMLR, 2022.
Li, T., Sahu, A. K., Zaheer, M.. Sanjabi, M., Talwalkar, A., and Smith, V. Federated optimization in heterogeneous networks. In MLSys, 2020a.
Li, T., Sanjabi, M., Beirami, A., and Smith, V. Fair resouree allocation in federated learning. In ICLR, 2020b.
Park, J.. Han, D.-J., Choi, M., and Moon, J. Sageflow: Robust federated learning against both stragglers and adversaries. In NeurlPS, pp. 840-851, 2021.
Li, Y., Jiang, Y., Li, Z., and Xia, S.-T. Backdoor learning: survey. IEEE TNNLS, 2022.
Phuong, M. and Lampert, C. Towards understanding knowl- edge distillation. In JCML, pp. 5142-5151, 2019.
Liao, C., Zhong, H., Squicciarini, A., Zhu, S., and Miller, D. Backdoor embedding in convolutional neural net- work models via invisible perturbation. arXiv preprint arXiv:1808. 10307, 2018.
Pillutla, K., Kakade, S. M., and Harchaoui, Z. Robust aggregation for federated learning. IEEE TSP, 70:1142- 1154, 2022.
McMahan, B., Moore, E., Ramage, D., Hampson, S., and Arcas, B. A. Communication--ffica learning of deep networks from decentralized data, In AISTATS, pp. 1273- 1282, 2017.
Quinn, J., McEachen, J., Fullan, M., Gardner, M., and Drummy, M. Dive into deep learning: Tools for en- gagement. Corwin Press, 2019.
10

---

SPMC: Self-Purifying Federated Backdoor Defense via Margin Contribution
Rame, A., Dancette, C., and Cord, M. Fishr: Invariant gradient variances for out-o--disti generalization. In ICML, pp. 18347-18377. PMLR, 2022.
Ye, M., Shen, W., Du, B., Snezhko, E., Kovalev, V., and Yuen, P. C. Vertical federated learning for effectiveness, security, applicability; A survey, ACM Computing Sur- veys, (7(9):1-733)) 2025b.
Selvaraju, R. R., Cogswell, M., Das, A., Vedantam, R., Parikh, D., and Batra, D. Grad-cam: Visual explanations from deep networks via gradient-basee localization. In ICCV, pp. 618-626, 2017.
Yin, D., Chen, Y., Kannan, R., and Bartlett, P. Byzantine- robust distributed learning: Towards optimal statistical rates. In ICML, pp. 5650-5659, 2018.
Shejwalkar, V. and Houmansadr. A. Manipulating the byzan- tine: Optimizing model poisoning attacks and defenses for federated learning. In NDSS, 2021.
Zhang, H., Jia, J., Chen, J., Lin, L.., and Wu, D. A3f1: Adver- sarially adaptive backdoor attacks federated learning. In NeurlPS, volume 36, 2023.
Shen, S., Tople, S., and Saxena, P. Auror: Defending against poisoning attacks in collaborative deep learning systems. In ACSAC, pp. 508-518819 2016.
Zhang, J., Li, Z., Li, B., Xu, J., Wu, S., Ding, S., and Wu, C. Federated learning with label distribution skew via logits calibration. In ICML, pp. 263 12112226,,, 2022a.
Shi, Y., Seely, J., Torr, P. H., Siddharth, N., Hannun, A., Usunier, N., and Synnaeve. G. Gradient matching for domain generalization. arXiv preprint arXiv:2/04.09937, 2021.
Zhang. Z., Cao, X., Jia, J., and Gong, N. Z. Fidetector:
Defending federated learning against model poisoning attacks via detecting malicious clients. In ACM SIGKDD, pp. 2545-2555, 2022b.
Tian, Y., Henaff, O. J., and van den Oord, Divide and contrast: Self-supervised learning from uncurated data. In ICCV, pp. 10063-10074, 2021.
Zheng, W., Yan, L., Gou, C., and Wang, F.-.. Federated meta-learning for fraudulent credit card detection. In IJCAI, pp. 4654-4660, 2021.
Wan, G., Shi, 7 Huang, W., Zhang, G., Tao, D., and Ye, M. Energy-based backdoor defense against federated graph learning. In International Conference on Learning Representations, 2025.
Zhou, K., Yang, J., Loy, C. C., and Liu, Z. Learning to prompt for vision laiguala models. IJV,, 130(9):2337 2348, 2022.
Zhu, B., NIu, Y., Han, Y., Wu, Y., and Zhang, H. Prompt- aligned gradient for prompt tuning. In ICCV, 15659 15669, 2023a.
Wang, P., Zhang. Z., Lei, Z., and Zhang, Sharpness-ave gradient matching for domain generalization. In CVPR, 2023.
Zhu, C., Roos, S., and Chen, L. Y. Leadfl: client self-defense against model poisoning in federated learning. In ICML, pp. 43158-43 180. PMLR, 2023b.
Wu, C., Yang, X., Zhu, S., and Mitra, P. Mitigating backdoor attacks in federated learning. arXiv preprint arXiv:2011.01767. 2020.
Xiao, H., Rasul, K., and Vollgraf, R. Fashion-mnist: A novel image dataset for benchmarking machine learning algorithms. arXiv preprint (00.::170.07710 2017.
Xie, C., Huang, K., Chen, P.-Y., and Li, B. Dba: Distributed backdoor attacks against federated learning. In ICLR, 2020.
Xie, C., Chen, M., Chen, P.-Y,, and Li, B. Crfl: Certifiably robust federated learning against backdoor attacks. ICML., pp. 11372-1133 11322. PMLR, 2021.
Yang, Y., Jia, C., Yan, D., Hu, M., Li, T., Xie, X., Wei, X., and Chen, M. Sampdetox: Black-bor backdoor defense via perturbation-base. sample detoxification. 2024.
Ye, M., Rong. X., Huang, W. Du, B., Yu, N., and Tao, D. A survey of safety on large vision-language mod- els: Attacks, defenses and evaluations. arXiv preprint arXiv:2502. /4881, 2025a.

---

SPMC: Self-Purifying Federated Backdoor Defense via Margin Contribution
APPENDIX
is chosen primarily because it effectively measures the di- rectional difference between vectors, rather than their magnitude (as in Euclidean distance) or the divergence be- tween probability distributions (as in Wasserstein distance), In the model parameter space, this allows for the evaluation of directional consistency among client updates, which is particularly important for identifying malicious attackers. Malicious clients often train their local models on poisoned datasets, resulting in update directions that deviate signifi- cantly from those of benign clients.
A. Notation Table
We provide the notation table in Tab. 3.
Table 3. Notations table.
Description
Description
Client index
N
All clients gather
AM client private data
D2
1.th client poisoned data
Data with trigger
M
Poisoned target
Shared global network
I
Model parameter distribation
Ath client's aggregation weight
t
Communication round index
Table 4. Comparison with evaluation metrics on the CIFAR- R-0 datasct with malicious proportion -=0.3. We use the trade-off to evaluate the performance of different evaluation metrics.
Local learning rale
S,
The coalition of 4th client
4k shupley value
T(k)
The value 1th client
The function of softmax
Gaongrad
Local update directioon
Cosine similarity
Faclidean distance
Wasserstein distance
Ga The direction of Cos
G,
The direction of fat
SPMC
72.98
45.30
69.09
B. Algorithm
C.2. Expanded experiment on MNIST dataset
We provide the algorithm description in Algorithm 1.
Table S. Comparison with the state-of of-teoof backdoor robust so- lutions in the MNIST dataset. Up arrows indicate advancements in the given metric compared to FedAvg, while down arrows denote regressions. The bolded number the best result.
Algorithm 1 SPMC
Data: The local dataset DD
Input:
Communication rounds T, participant N, A client private model Tg. learnahle aggregation weight og with updating epoch E and learning rate 1
0.2
0.3
Method
A
R
A
R
FodAvg
99.25
2.20
50.73
99.17
1,27
50.22
Output: The final global model Wy
Predefined
Scale Requirement
for = 2....... T do Participant Side
DaC
99.01
77.37
88.39
99.07
1.62
50.34
Sageflow
99.21
1.69
50.45
99.29
2.21
50.75
for 1, ..., K in parallel do
Bulyan
10.54
100.0
55.27
10.31
60.0
35.15
1 12 < LocalUpdating(ue, ox.)) end
RFA
99.09
0,26
49.68
99.27
0.15
49.71
RLR
99.07
1.71
50.39
99.11
0.91
50.01
CRFL
97.87
3.01
50.38
97.60
0.36
48.98
Server Side
No Predeflnned Scale Requirement
// Reweight by margin contribution [= N +- Eq. (6)
FoolsGold
96.13
0,37
48.25
81.56
9.48
45.52
RSA
30.25
88.18
59.22
35.29
79.70
57.49
" k= I
Finetuning
98.89
3.88
51.38
98.88
2.34
50.61
end
Ours
98.79
42.73 mm 70.76
pm
98.72
(n.c5 55.95
(595 77.33 pz)
LocalUpdating(w// 1-1
ou):
// Calculate the coalition model
C.3. Visualization of Feature Distributions on CIFAR-10
Is. <- Bq.(5)
No-defense
SPMC
for 1, E do
for B, = (2, CC, do
Year
11
// Calculatat local updated direction by projection
G. VLCE
Gg = VLH
Giocagrad + Eq. (9)
// Local Updating
14 + w Glocarrad
end
R: 33.07
R: 77.72
end
Figure 8. T-SNE visualization of the feature representations on the CIFAR-10 dataset. Blue point corresponds to henign samples and red point represents poisoned samples. In the absence of defense, the poisoned samples are elearly distinguishable and form clusters separate from the benign data, indicating that the backdoor attack successfully manipulates the feature space to achieve high attack success rates. However, after SPMC, these poisoned features become less distinguishable, blending into the henign distribution.
C. More experiments
C.1. The choice of metric on Margin Contribution
We used cosine similarity, Euclidean distance, and Wasser- stein distance as evaluation metrics to measure ((N - I [((n)). As shown in Table 5, cosine similarity proves to be the most suitable metric. In SPMC, cosine similarity
12


Reviews:
[{"review_id": "rtuwDQKKtY", "reviewer": "Reviewer_hJgY", "summary": "This paper presents a federated backdoor defense method named SPMC, which applies Shapley values to quantify the contribution differences among clients and implements margin contribution-based aggregation at the server side and gradient alignment technology at the client side. These measures work together to effectively improve the robustness and flexibility of federated learning systems, even when the number of attackers dynamically changes. Experimental results show that SPMC demonstrates superior defensive effects on multiple public datasets compared to existing methods.", "questions": "", "limitations": "", "rating": 4, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Dear Reviewer hJgY：\n\nThank you for your valuable feedback and for your time reviewing our work. We hope our responses below help clarify the issues and update the score.\n\n**Weaknesses**\n\n**W1: Missing an explanation why the combination of LGAlign and MCAgg leads to better performance.**\n\nA1: For our method, LGAlign represents the local update process. Specifically, it ensures that the update gradients of local clients remain aligned with the general knowledge of the edge federation, thereby preventing attackers from fitting malicious outcomes. As for MCAgg, it represents the server aggregation process. It encourages the positive influence of clients that contribute significantly to the edge federation, while suppressing the malicious impact of those with relatively small marginal contributions. The combination of LGAlign and MCAgg not only prevents local malicious gradients from steering the global update, but also promotes the influence of benign clients through inter-client interactions on the server side. We have rewritten this part to be more in line with your comments. We hope that the edited section clarifies the reason for the combination of LGAlign and MCAgg.\n\n**W2: The reason for choosing cosine similarity to measure Γ (N{n}) − Γ ({n}).** \n\nA2: Thank you for your helpful feedback. We have included a new table to further illustrate the effectiveness of cosine similarity. We used cosine similarity, Euclidean distance, and Wasserstein distance as evaluation metrics to measure Γ (N{n}) − Γ ({n}). As shown in Table 1, cosine similarity proves to be the most suitable metric. In SPMC, cosine similarity is chosen primarily because it effectively measures the directional difference between two vectors, rather than their magnitude (as in Euclidean distance) or the divergence between probability distributions (as in Wasserstein distance). In the model parameter space, this allows for the evaluation of directional consistency among client updates, which is particularly important for identifying malicious attackers. Malicious clients often train their local models on poisoned datasets, resulting in update directions that deviate significantly from those of benign clients. We will supplement this experiment along with the corresponding explanation in the final version. Thank you for your feedback again.\n\n*Table 1: Comparison with evaluation metrics on CIFAR-10 dataset with malicious proportion* *γ=0.3. We use the trade-off V to evaluate the performance of different evaluation metrics.*\n\n|   | Cosine similarity | Euclidean distance | Wasserstein distance |\n| ---- | :-------------------: | :----------------: | :------------------: |\n| SPMC |**72.98**|45.30|69.09|\n\n**W3: Explanation of hyperparameter λ** **in non-proxy distillation.** \n\nA3: We thank the reviewer for pointing out this issue. Specifically, Equation (9) in the paper is as follows:\n$$\nG_{locgrad} =\n\\begin{cases}\nG_d, & \\text{if } G_d \\cdot G_g \\geq 0, \\\\\\\\\nG_d - \\lambda \\cdot \\frac{G_d \\cdot G_g}{\\|G_g\\|^2} G_g, & \\text{otherwise}.\n\\end{cases}\n$$\nwhere $G_g$ represents the general knowledge between client and its marginal coalition, $G_d$ represents the local knowledge and $G_{locgrad}$ denotes the final local updated gradient.  Next, we analyze the role of hyperparameter λ when $G_d \\cdot G_g < 0$. When λ=1, the formula becomes $G_{locgrad} = G_d -\\frac{G_d \\cdot G_g}{\\|G_g\\|^2} G_g$.  At this point, $G_{\\text{locgrad}}$ is orthogonal to $G_g$, as shown by the following derivation:\n\n$$\n\\begin{aligned}\n G_{locgrad} \\cdot G_g &= (G_d - \\frac{G_d \\cdot G_g}{\\|G_g\\|_2} G_g) \\cdot G_g \\\\\\\\\n &= G_d \\cdot G_g - \\frac{G_d \\cdot G_g}{\\|G_g\\|_2} \\|G_g\\|_2^2 \\\\\\\\\n&= G_d \\cdot G_g - G_d \\cdot G_g \\\\\\\\\n&= 0.\n\\end{aligned}\n$$\n\nWhen λ>1, we have $G_{locgrad} \\cdot Gg>0$. This means the angle between$G_{locgrad}$ and $G_g$ is less than 90°, indicating that their directions are more closely aligned. In this case, the update gradient leans more toward general knowledge, potentially at the cost of missing important local knowledge. As for λ<1, we have $G_{locgrad} \\cdot Gg<0$. This means the angle between$G_{locgrad}$ and $G_g$ is more than 90°, indicating that a less noticeable adjustment toward general knowledge, causing the update gradient to stay closer to local malicious knowledge for attacker.  The reviewer might have overlooked **\"Figure 3. Comparison of different λ\"** in our original manuscript. To further clarify, we present a comparison of different λ values again in **Table 2**. We sincerely appreciate your constructive suggestion, and we will include the corresponding derivation and explanation in the revised version.\n\n*Table 2: Comparison with different lambda on CIFAR-10 dataset with malicious proportion γ={0.2, 0.3}. We use the trade-off V to evaluate the performance of different lambda.*\n\n| $\\lambda$ |  1.5  |    1.0    | 0.5  |\n| :-------: | :---: | :-------: | :--: |\n|   γ=0.2   | 60.99 | **85.32** | 2.50 |\n|   γ=0.3   | 51.87 | **80.14** | 3.53 |", "claims_and_evidence": "Yes.", "methods_and_evaluation_criteria": "Yes. The methods are well evaluated.", "theoretical_claims": "This paper provides a clear theoretical explanation of proxy-free distillation and utilizes the framework diagram to explain how to apply Shapley values.", "experimental_designs_or_analyses": "The experimental metrics are very comprehensive, with experiments demonstrating the robustness of the method under multiple settings.", "relation_to_broader_scientific_literature": "This paper innovatively applies Shapley values to proxy-free distillation, addressing the security issues associated with proxy datasets.", "essential_references_not_discussed": "None", "other_strengths_and_weaknesses": "Strengths:\n1. The authors effectively highlight the challenges posed by adaptive malicious clients and the need for more flexible and robust solutions. Then, the authors propose SPMC, enabling self-purification without the need for predefined rules.\n\n2. SPMC is novel and introduces an innovative approach to enhancing server-side aggregation and local gradient alignment. It’s easy to follow on other scenarios in the distributed system.\n\n3. The article implements non-proxy distillation, providing a new approach to ensuring the security of proxy datasets in knowledge distillation.\n\nWeakness: \n\n1. Although the experimental results in Table 1 demonstrate the effectiveness of combining the LGAlign and MCAgg modules, the author should present some discussion about why the combination of LGAlign and MCAgg leads to better performance.\n\n2. From the equation (6), the author adopts cosine similarity to measure Γ (N\\{n}) − Γ ({n}). The author needs to explain the reasoning behind using cosine similarity instead of other metrics. Are there any better metrics to measure this?\n\n3. In Figure 2, non-proxy distillation seems to be related to the angle. But the article does not provide an intuitive explanation for the values of the hyperparameter λ.\n\nIf the author can address all of my concerns, I am willing to increase my score. However, if the author does not address these concerns, I may consider lowering the score.", "other_comments_or_suggestions": "See weakness", "questions_for_authors": "See weakness", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "V60JUy8pF3", "reviewer": "Reviewer_7GF4", "summary": "Existing defenses rely on assumptions like individual behavior isolation and passive purification, which malicious clients can bypass. This paper proposes SPMC, inspired by the Shapley Value. It measures inter-client margin contributions to identify malicious attackers and self-purifies the parameter distribution of potential malicious actors. This is achieved through margin contribution aggregation on the server side and local gradient alignment on the client side.", "questions": "", "limitations": "", "rating": 4, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Dear Reviewer 7GF4：\n\nWe sincerely thank you for the valuable comments and suggestions. We hope our responses below address your concerns and provide a clearer understanding of our approach and results.\n\n**Question**\n\n**Q1: Theoretical** **description for shapley value.** (Theoretical Claims)\n\nA1: Inspired by the concept of the Shapley value, we define a client’s contribution to its marginal coalition as its marginal contribution. For client $k\\in\\ N$, the marginal contribution is denoted as $\\phi_k(k;\\ \\Gamma;\\ D;\\ N)=\\mathbb{E}_{\\Gamma\\sim D^N}[\\Gamma(N\\setminus{k})-\\Gamma({k})]$，where $D^N$ represents the collection of all clients' datasets, and $\\Gamma(N\\setminus{k})-\\Gamma({k})$ captures the model parameter difference between the marginal coalition and local client. We introduce the theorem to demonstrate the role of marginal contribution in identifying malicious clients. \n\nTheorem: Let parameter aggregation function $\\Gamma$ be B-Lipschitz with respect to Z. Suppose $D_k$ and $D_p$ are two data distribution over $Z$. Then, for client $k,p\\in N$,\n$$\n\\phi_k(k;\\ \\Gamma;\\ D_k;\\ N)-\\phi_p(p;\\ \\Gamma;\\ D_p;\\ N)\\le2NB·W(D_k,D_p),\n$$\nwhere $W$ denotes the distributional difference between two data distributions. This theorem measures the marginal contribution changes under two different data distributions. Due to the significant different distribution of malicious clients, the marginal contributions of malicious clients become easier to distinguish.\n\n**Q2: Evaluation on large-scale datasets and complex backbone.** (Experimental Designs Or Analyses&Other Strengths And Weaknesses)\n\nA2: Based on your suggestion, we have extended our experiments on the CIFAR-100 dataset using ResNet-18 as the backbone. As shown in Table 1, even in more complex models and task scenarios, both DnC and SPMC are able to maintain their defensive effectiveness. However, DnC struggles to achieve a stronger backdoor performance compared to SPMC because of the poor sub-dimensions' information. In addition, due to the increased model complexity and the difficulty of classification tasks, the gradient learning rate on local clients fails to converge, which significantly undermines the RLR's performance of the main task.\n\n*Table 1: Comparison with the state-of-the-art backdoor robust solutions on CIFAR-100 dataset using ResNet-18 as the backbone. The malicious proportion is  γ=0.3 and the local data poisoned portion is set as 0.3.*\n\n| Method | A↑| R↑| V↑|\n| ------ | ----- | ----- | --------- |\n| Fedavg|55.29|6.91|31.10|\n| DnC|54.44|11.31|32.88|\n| RLR| 50.94|7.86|29.40|\n| Ours| 55.14|35.26|**45.20**|\n\n**Weakness**\n\n**W1: Explanation for the self-purification part of local updates.**\n\nA3: Thank you for the constructive comments. We believe it is important to emphasize the importance of the self-purification. Malicious clients may inject trigger patterns $\\tau$ to alter original labels and distort gradient directions, deviating from those of benign clients. To counter this, SPMC introduces a self-purification update mechanism that adjusts local gradients using Equation (9), aligning them with the marginal federation model's knowledge while preserving useful benign local information;  As shown in Table 1 of our paper, the self-purification component of local updates effectively preserves benign information and achieves strong defense performance.\n\n**W2: What kinds of triggers did the authors use in the experiments?**\n\nA4: We use a trigger pattern located at the top-left corner of the image with a size of 2 × 6. The poisoned label is set to class 2. Thank you for your feedback and we will emphasize this point in the final version.\n\n**W3: The criteria for selecting Coalitions and the communication cost for the choice of Coalitions**. \n\nA5: We thank the reviewer for pointing out this issue. We have added the detailed clarification in our revised manuscript. In fact, each client is associated with a corresponding marginal coalition. For example, for client i, its marginal coalition $S_k$ consists of all online clients excluding client $i$. Therefore, we do not need to spend significant computational resources to select the marginal coalition. As shown in the table 3, SPMC does not introduce significant computational cost on either the server or client side. We will update the detailed discussion in the final version.\n\n*Table 3: Computation cost comparison. $n$ refers to the number of online client, $|w|$ represents the scale of network, $|w|_{sub}$ represents the scale of sub-network and $E$ indicates the iteration times of using SVD.*\n\n| Method |Server-side |Client-side|\n| ------ | :------------------------: | :----------------: |\n|Fedavg|$\\mathcal{O}(n\\times\\|w\\|\\)$|$\\mathcal{O}(\\|w\\|)$|\n|DnC|$\\mathcal{O}(n\\times\\|w\\|+E \\times\\|W\\|_{sub}) $ | $\\mathcal{O}(\\|w\\|)$|\n|RLR|$\\mathcal{O}(n\\times\\|w\\| )$|$\\mathcal{O}(\\|w\\| )$|\n|Ours|$\\mathcal{O}(n\\times\\|w\\|+n^2)$|$\\mathcal{O}(\\|w\\|$)|", "claims_and_evidence": "Yes. The authors categorize related work and introduce the crucial reference to induce their claims.", "methods_and_evaluation_criteria": "The method is well evaluated with clear criteria.", "theoretical_claims": "This article utilizes the Shapley value to defend against backdoor attacks. It needs further exploration of the Shapley value theoretical description in future work.", "experimental_designs_or_analyses": "The experiments are well-executed and comprehensive, and reasonable explanations are provided for the experimental results. \nBut the main results are summarized from small datasets and backbones, which could be evaluated in larger and more complex scenarios.", "relation_to_broader_scientific_literature": "This article innovatively applies the Shapley value to defend against backdoor attacks in federated learning, contributing to the broader scientific literature on enhancing distributed system security.", "essential_references_not_discussed": "N/A", "other_strengths_and_weaknesses": "Strengths\n1 SPMC draws inspiration from the Shapley value by employing inter-client margin contributions to effectively identify malicious attackers. This approach enables a more robust and accurate detection mechanism within federated learning environments. \n2 Furthermore, the experiments conducted are comprehensive, offering thorough and reasonable explanations for the observed outcomes, which validate the effectiveness of SPMC. The comparison between various defenses in different directions is interesting, showing that SPMC applies in many scenarios.\n\nWeakness\n1 The self-purification part in Figure 2 seems to be unclear, which confuses me about the details of local updates. Could you explain the content of this module to me?\n2 What kinds of triggers did the authors use in the experiments?\n3 The criteria for selecting Coalitions are not provided in the article; does the choice of Coalitions affect the communication cost?\n4 The complex extension to larger datasets and models is less explored and discussed in current version.", "other_comments_or_suggestions": "None", "questions_for_authors": "See above.", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "89WVltGyQe", "reviewer": "Reviewer_VbBm", "summary": "This paper introduces a technique named SPMC (Self-Purifying Federated Backdoor Defense via Margin Contribution), which aims to detect and mitigate backdoor attacks in federated learning systems by leveraging the concept of Shapley values. SPMC not only focuses on the behavior of individual clients but also emphasizes the interactions among clients and their impact on the overall coalition model.", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Dear Reviewer VbBm：\n\nThank you very much for your valuable suggestions—they have provided us with clear direction for further exploring the details of our method. We hope the following responses will address your concerns.\n\n**Question**\n\n**Q1: Lack of support from other experiments.** (Experimental Designs Or Analyses)\n\nA1: We will expand to more complex experimental settings and incorporate a wider range of attack types in the final version. Thank you for your suggestion. \n\n**Weakness**\n\n**W1:** **Evaluation on complex datasets.**\n\nA2: We agree with you and have incorporated this suggestion throughout our paper. We have extended our experiments on the CIFAR-100 dataset using ResNet-18 as the backbone. As shown in Table 1, even in more complex models and task scenarios, both DnC and SPMC are able to maintain their defensive effectiveness. However, DnC struggles to achieve a stronger backdoor performance compared to SPMC because of the poor sub-dimensions' information. In addition, due to the increased model complexity and the difficulty of classification tasks, the gradient learning rate on local clients fails to converge, which significantly undermines the RLR's performance of the main task.\n\n*Table 1: Comparison with the state-of-the-art backdoor robust solutions on CIFAR-100 dataset using ResNet-18 as the backbone. The malicious proportion is γ=0.3, and the local data poisoned portion is set as 0.3.*\n\n| Method | A↑| R↑| V↑|\n| ------ | ----- | ----- | --------- |\n| Fedavg|55.29|6.91|31.10|\n| DnC|54.44|11.31|32.88|\n| RLR| 50.94|7.86|29.40|\n| Ours| 55.14|35.26|**45.20**|\n\n**W2: Discussion the scenario with attack ratio set to 0.5.**\n\nA3: You have raised an interesting concern. We can compare the performance of SPMC under high attack ratio (i.e, γ=0.5) and low attack ratio (i.e, γ=0.3). As shown in Table 2, when the proportion of malicious clients increases to 0.5, it becomes more challenging to identify and mitigate the backdoor attack, as the probability that malicious clients have marginal contributions similar to those of the marginal coalition significantly increases. However, we believe that high attack ratio would be outside the scope of our paper. In real-world deployments of federated learning systems, the proportion of attackers is typically low [1]. Therefore, we focus on attack ratios of 0.2 and 0.3, which are more consistent with commonly observed threat models in practice. In this work, SPMC demonstrates reliable defense performance across multiple task settings, indicating its effectiveness in maintaining the robustness of real-world federated systems.\n\n*Table 2: Comparison with different malicious proportion γ on CIFAR-10 dataset with ResNet-18.*\n\n|        |             |     0.3     |             |             |     0.5     |             |\n| :----: | :---------: | :---------: | :---------: | :---------: | :---------: | :---------: |\n|        | A↑ | R↑ | V↑| A↑ | R↑ | V↑ |\n| Fedavg |    89.77    |    13.19    |    51.48    |    89.87    |    12.86    |    51.37    |\n|  Ours  |    90.32    |    31.69    |  **61.01**  |    87.83    |    18.68    |  **53.26**  |\n\n**W3: Explanation the concept of \"margin contribution\".**\n\nA4: Our method is inspired by the Shapley Value, using marginal contribution to measure each client’s impact on the overall federation in federated learning. In the SPMC approach, we estimate a client’s marginal contribution by simplifying the calculation of its influence on the coalition formed by the remaining clients. The server then reallocates aggregation weights based on these contributions, increasing the influence of benign clients while reducing that of malicious ones. On the client side, marginal contribution is used to guide local gradient adjustments, ensuring the update direction aligns with global knowledge and preventing interference from malicious data. This approach effectively identifies and mitigates the impact of attackers, enhancing the security and robustness of the federated learning system. We will add the detailed explanation this in our final version. Thank you for the comment. \n\n**W4: The color contrast in the article is not strong enough.**\n\nA5: We will make the necessary adjustments in the corresponding sections. Thank you for your feedback.\n\n[1] Back to the drawing board: A critical evaluation of poisoning attacks on federated learning. arXiv abs/2108.10241.", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "Yes", "theoretical_claims": "SPMC provides a comprehensive summary of federated defense methods and clearly describes the motivation and details of the proposed method.", "experimental_designs_or_analyses": "The experimental metrics are acceptable, but lacks support from other experiments.", "relation_to_broader_scientific_literature": "SPMC not only defends against backdoor attacks at the server side but also prevents malicious updates locally, thereby extending the robustness of federated learning systems beyond traditional server-centric defenses.", "essential_references_not_discussed": "No", "other_strengths_and_weaknesses": "The authors categorize existing defense methods into three types and summarize that these methods are primarily based on two assumptions. They provide a very clear motivation and introduce SPMC, a method that leverages margin contributions to defend against backdoor attacks. The paper clearly explains how SPMC is deployed on both the client and server sides, and experiments demonstrate the effectiveness of SPMC. The major strengths of this work are as follows:\n- The author's summary of the federated defense methods is very interesting. The motivation of the article is clear.\n- Experimental results (Figure 7) have shown that SPMC can extract key features from the image even though the attackers add triggers to images.\n\nWeakness\n\n- The experimental results on traditional datasets like CIFAR-10 and MNIST demonstrate promising performance of SPMC. However, CIFAR-10 and MNIST are commonly used simple datasets. Have the authors attempted testing on complex datasets to further validate the effectiveness of SPMC?\n- The article seems to only discuss the scenarios with attack ratios of 0.2 and 0.3. I am curious to know what would happen when the attack ratio is set to 0.5.\n- I am still a bit confused about the concept of margin contribution. Can you briefly explain the concept of \"margin contribution\" as used in this paper?\n- The color contrast in the article is not strong enough, making it difficult for me to focus on the key points in the figures.", "other_comments_or_suggestions": "The elements in the framework diagram of the article are somewhat redundant.", "questions_for_authors": "No", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "xbkd3Myrjg", "reviewer": "Reviewer_7qEv", "summary": "The authors proposed a new federated backdoor defense method named SPMC. SPMC employs Shapley value to assess the contribution of each client and then reweights their model updates (server side). Additionally, SPMC utilizes knowledge distillation to calibrate the direction of gradients (client side). The authors conducted several experiments to validate SPMC.", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Dear Reviewer 7qEv：\n\nThank you for your thoughtful review and for raising key concerns regarding our work. We hope the following responses will address your concerns and update the score.\n\n**Question**\n\n**Q1: Lack of substantiation and theoretical claims.** (Claims And Evidence&Theoretical Claims)\n\nA1: We sincerely apologize for the confusion. Inspired by the Shapley value, we define a client's contribution to its marginal coalition as the marginal contribution. Specifically, for client $k$, its contribution to the marginal coalition is denoted as $\\phi_k(k;\\ \\Gamma;\\ D;\\ N)=\\mathbb{E}_{\\Gamma\\sim D^N}[\\Gamma(N\\setminus{k})-\\Gamma({k})]$，where $D^N$ represents the collection of all clients' datasets, and $\\Gamma(N\\setminus{k})-\\Gamma({k})$ captures the model parameter difference between the marginal coalition and client k. Next, we introduce the theorem to demonstrate the role of marginal contribution in identifying malicious clients.\nTheorem: Let parameter aggregation function $\\Gamma$ be B-Lipschitz with respect to $Z$. Suppose $D_k$ and $D_p$ are two data distribution over $Z$. Then, for client $k,p\\in N$,\n$$\n\\phi_k(k;\\ \\Gamma;\\ D_k;\\ N)-\\phi_p(p;\\ \\Gamma;\\ D_p;\\ N)\\le2NB·W(D_k,D_p),\n$$\nwhere $W$ denotes the distributional difference between two data distributions. This theorem measures the marginal contribution changes under two different data distributions. Due to the significantly different distribution of malicious clients, the marginal contributions of malicious clients become easier to distinguish. We will add this theorem's derivation in final version. Thank you for the valuable comment. \n\n**Q2: Extended experiments on a new dataset.** (Methods And Evaluation Criteria)\n\nA2: We agree with you and have incorporated this suggestion throughout our paper. We extended our experiments on the CIFAR-100 dataset using ResNet-18. As shown in Table 1, even in more complex task scenarios, both DnC and SPMC maintain their defensive effectiveness. However, DnC struggles to match SPMC’s backdoor defense due to the limited information captured by its sub-dimensions. Moreover, the increased model complexity and task difficulty hinder convergence of the local gradient learning rate, significantly impacting RLR's main task performance.\n\n*Table 1: Comparison with the SOTA backdoor robust solutions on CIFAR-100 dataset using ResNet-18. The malicious proportion is  γ=0.3 and the local data poisoned portion is set as 0.3.*\n\n| Method | A↑| R↑| V↑|\n|-----|-----|----- |-----|\n|Fedavg|55.29|6.91|31.10|\n|DnC|54.44|11.31|32.88|\n|RLR| 50.94|7.86|29.40|\n|Ours| 55.14|35.26|**45.20**|\n\n**Q3: Lack of comparison to recent backdoor attack method under PFL.** (Essential References Not Discussed&Other Comments Or Suggestions&Other Strengths And Weaknesses)\n\nA3: Thank you for your suggestion. We would like to clarify that the attack method used in our approach is BadNet, not DBA. BadNet aims to poison the model by injecting whole static triggers into the local dataset. In contrast, DBA constructs a global trigger by combining local triggers across multiple clients.\n\nTo verify that SPMC can maintain the robustness of federated systems in the stronger attack, we followed your suggestion and introduced an attack method, Bad-PFL [1]. This method leverages natural data features as triggers, achieving both effectiveness and stealth in PFL method (i.e., FedProx [2]). As shown in Table 2, BadPFL achieves better attack performance compared to BadNet in PFL. \n\n*Table 2: Comparison with BadNet and Bad-PFL under PFL. The experiment is based on CIFAR-10 with malicious ratio of 0.3 and SimpleCNN.*\n\n||Fedavg||Fedprox||\n|:-----:|:-----:|:-----:|:-----:|:-----:|\n|Method|A↑|R↓|A↑|R↓|\n|BadNet|64.82|36.12|61.37|35.03|\n|Bad-PFL|**70.08**|**8.65**|**68.14**|**8.17**|\n\nTable 3 presents the resistance of two defense methods and one no-defense method (Equal) against the BadPFL attack in the context of personalized federated learning.\n\n*Table 3: Comparison with the SOTA backdoor defense with **Bad-PFL** attack under the PFL. The experiment is based on CIFAR-10 dataset with malicious ratio of 0.3 and SimpleCNN.*\n\n| | | Fedavg | | | Fedprox | |\n|:----:|:---:|:----:| :-----: | :---: | :-----: | :-----: |\n|Method|A↑|R↑|V↑| A↑|R↑|V↑|\n|Equal|70.08|8.65|39.37|68.14|8.17|38.16|\n|DnC|61.95|62.86|62.51|60.13|53.77|56.95|\n|Ours|67.72|71.87|**69.80**|58.65|61.58|**60.12**|\n\nAs shown in Table 3, although BadPFL achieves robust attack performance in personalized federated learning settings, it can still be effectively detected by defense methods such as DnC and SPMC. Moreover, SPMC demonstrates better defense effectiveness compared to DnC. Overall, even in the face of advanced attack strategies and PFL method, SPMC is able to maintain the security of the federated system to a considerable extent.\n\n[1] Bad-pfl: Exploring backdoor attacks against personalized federated learning.In Proc. of ICLR, 2025.\n\n[2] Federated optimization in heterogeneous networks. In MLSys, 2020a.", "claims_and_evidence": "Some claims lack formal substantiation. For instance, it is unclear why the federation resulting from a new client joining the existing client pool would produce a malicious contribution (right column, Lines 196-198).", "methods_and_evaluation_criteria": "The authors introduce a new method. This paper does not involve any new datasets.", "theoretical_claims": "The paper does not contain theoretical claims.", "experimental_designs_or_analyses": "The experiments are flawed as the authors have overlooked many recent backdoor attack methods.", "relation_to_broader_scientific_literature": "The proposed method is a new federated backdoor defense method, which could potentially enhance the robustness of federated learning.", "essential_references_not_discussed": "The authors have missed some federated backdoor attack methods [1].\n\n[1] Bad-PFL: Exploring Backdoor Attacks against Personalized Federated Learning, ICLR", "other_strengths_and_weaknesses": "The paper is well-written and easy to follow. The paper has a good motivation and intuition, but I believe the experiments are insufficient. The authors only validated the effectiveness of their method against DBA.", "other_comments_or_suggestions": "* It would be beneficial to present experimental results demonstrating the proposed method's effectiveness against more advanced attack methods.\n\n* Since FedAvg is hardly used in Non-IID scenarios, I recommend the authors consider incorporating some personalized federated learning methods.", "questions_for_authors": "See above.", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Meta-review: This paper is novel in its methodology design and provides a novel insight to understanding the malicious backdoor attacks in FL. The presentation is also clear and experiments are sufficient. However, the method requires extra the hyper-parameters, which limits the wide adoption.
Decision: Accept (poster)