MARS: A Malignity-Aware Backdoor Defense in Federated Learning
Authors: Wei Wan
Ning Yuxuan
Zhicong Huang
Cheng Hong
Shengshan Hu
Ziqi Zhou
Yechao Zhang
Tianqing Zhu
Wanlei Zhou
Leo Yu Zhang
Venue: NeurIPS 2025 poster ()
Keywords: federated learning
backdoor defense
backdoor attack
Primary area: deep_learning

Abstract: Federated Learning (FL) is a distributed paradigm aimed at protecting participant data privacy by exchanging model parameters to achieve high-quality model training. However, this distributed nature also makes FL highly vulnerable to backdoor attacks. Notably, the recently proposed state-of-the-art (SOTA) attack, 3DFed (SP2023), uses an indicator mechanism to determine whether the backdoor models have been accepted by the defender and adaptively optimizes backdoor models, rendering existing defenses ineffective. In this paper, we first reveal that the failure of existing defenses lies in the employment of empirical statistical measures that are loosely coupled with backdoor attacks. Motivated by this, we propose a Malignity-Aware backdooR defenSe (MARS) that leverages backdoor energy (BE) to indicate the malicious extent of each neuron. To amplify malignity, we further extract the most prominent BE values from each model to form a concentrated backdoor energy (CBE). Finally, a novel Wasserstein distance-based clustering method is introduced to effectively identify backdoor models. Extensive experiments demonstrate that MARS can defend against SOTA backdoor attacks and significantly outperforms existing defenses.

MARS: A Malignity-Aware Backdoor Defense in Federated Learning
Wei Wan
Yuxuan Ning Zhicong Huang?, Cheng Hong', Shengshan Hu',
Ziqi Zhou Yechao Zhang", Tianqing Zhu', Wanlei Zhou', Leo Yu Zhang?
Faculty of Data Science, City University of Macau
School of Computing, Australian National University 3 Ant Group
4 School of Cyber Science and Engineering, Huazhong University of Science and Technology
School of Computer Science and Technology, Huazhong University of Science and Technology
College of Computing and Data Science, Nanyang Technological University
7 School of Information and Communication Technology, Griffith University
{ueiwan, tqzhu, vlzhou)@cityy, edu. Yuzuan. Yuruan.Ning@anu, edu. au
{zhicong hzc, vince. hc)ttgggo com {zhouziqi, www.hhgssaa) hhu.eegggshannuuuteee.u.... wwc.uss.edu...... yech.zhaud wwang@gmail..como com s.o.zhang@griffithh edu. au
Abstract
Federated Learning (FL) is distributed paradigm aimed at protecting participant data privacy by exchanging model parameters to achieve high-quality model train- ing. However, this distributed nature also makes FL highly vulnerable to backdoor attacks. Notably, the recently proposed state-of-the-art (SOTA) attack, 3DFed (SP2023), uses indicator mechanism to determine whether the backdoor models have been accepted by the defender and adaptively optimizes backdoor models, rendering existing defenses ineffective. In this paper, we first reveal that the fail- ure of existing defenses lies in the employment of empirical statistical measures that are loosely coupled with backdoor attacks. Motivated by this, we propose a Malignity-A -eegmity-Awaee Aware backdooR defenSe (MARS) that leverages backdoor energy (BE) indicate the malicious extent of each neuron. To amplify malignity, we further extract the most prominent BE values from each model to form concentrated backdoor energy (CBE). Finally, a novel Wasserstein distance-bar clustering method is introduced to effectively identify backdoor models. Extensive exper- iments demonstrate that MARS can defend against SOTA backdoor attacks and significantly outperforms existing defenses.
Introduction
Federated Learning (FL) [26, 33, 29, 23] is a distributed machine learning paradigm that leverages data distributed across multiple clients to train high-quality global model without requiring data to be shared with third party. Due to its exceptional privacy-preserving features and efficient utilization of decentralized data, FL has found widespread applications in fields such healthcare [1], education [10], finance [7], and even the military [2]. However, the distributed nature also makes it highly susceptible to poisoning attacks [31, 36, 20, 24, 18]. Among these, Byzantine attacks aim to degrade the global model accuracy, while backdoor attacks trigger malicious behavior (e.g., classify any input as the attacker's desired target class) only under specific conditions (e.g., g., white patch in the bottom right corner of an image). Because backdoor attacks do not affect the model's 's performance
"These authors contributed equally to this work.
Work done during an internship at Ant Group "ooresppnndigg author.
39th Conference on Neural Information Processing Systems (NcurIPS 2025).

---

on clean samples, it is difficult for model users to realize that a backdoor has been implanted [45, 39]. This makes backdoor attacks a greater potential threat to FL.
To defend against backdoor attacks, the FI. community has made significant efforts. Certain defenses constrain the norm of local updates to prevent backdoor updates from dominating the global model [35, 38, 6, 34]. Other strategies employ out-of-distribution (OOD) detection techniques to eliminate local updates that significantly deviate from the overall distribution [27. 43, 40, 5]. Additionally, some defenses focus on detecting model consistency, such as the cosine similarity of updates, and assign lower aggregation weights to updates with high consistency (indicative of Sybil attacks) or remove them altogether [12, 30]. However, these defenses offer limited protection. Recently proposed ofute-of-the-eeee (SOTA) attacks can easily bypass these measures. For instance, 3DFed [17] uses an indicator mechanism to determine if backdoor updates are being aggregated, allowing for adaptive optimization of local models. DarkFed [19] and CerP [25] introduce several constraint terms that make backdoor updates resemble benign updates, exhibiting properties such as moderate magnitude, reasonable distribution, and limited consistency, making it difficult to distinguish between benign and backdoor updates. These sophisticated attacks pose significant threat to the security of FL, underscoring the urgent need for effective defenses.
In this paper, we first reveal through experimental observations that the primary statistical measures relied upon by existing defenses fail to distinguish between benign and backdoor updates when faced with SOTA attacks. We attribute this failure to the fundamental reason that these statistical measures are empirical and loosely coupled with backdoor attacks. In other words, these statistical metrics do not inherently reflect whether a local update has been compromised with backdoor. The lack of perceiving malicious intent in existing defenses provides attackers with the opportunity to mimic the statistical distribution of benign updates, thereby defeating these defenses. Motivated by this, we propose MARS, a Malignity- Aware backdooR defenSe. Specifically, we introduce the concept of backdoor energy (BE), which indicates the malignancy level of each neuron in the model (i.e., its relevance to backdoor intent), thereby achieving a strong coupling with backdoor attacks. To amplify the malignity, we further extract the most prominent BE values in each local model to form the concentrated backdoor energy (CBE), concentrating the backdoor information. Finally, a novel Wasserstein distance-basee clustering algorithm is proposed to detect backdoor models. This new clustering focuses on the probability density of elements in CBEs, thus avoiding the issues of element order sensitivity encountered by existing Euclidean and cosine distance- clustering methods. An overview of MARS is illustrated in Figure 1.
In summary, the contributions of this paper are as follows:
We identify the failure of existing FL backdoor defenses, attributing their failures reliance on empirical statistical measures that are loosely coupled with backdoor attacks. From a new perspective, we propose robust FL defense strategy with malignity-awar capabilities.
We introduce MARS, which detects potentially harmful neurons by incorporating the concept of backdoor energy, and we also propose Wasserstein distance-based clustering algorithm to enhance the precise identification of backdoor models.
We conduct extensive experiments to evaluate the effectiveness of MARS. The results demonstrate that MARS can counter SOTA backdoor attacks and consistently provide superior protection for FL compared to existing defenses.
2 Related Work
2.1 Backdoor Attacks in Federated Learning
Since its inception, FL has been a focal point for research on backdoor vulnerabilities. Model Replacement Attack (MRA) [3], the pioneering backdoor attack on FL, works by proportionally amplifying backdoor updates to ensure that even few malicious updates can dominate the global model. Wang et al. [38] later introduced the edge-case backdoor attack, leveraging rare samples from the dataset's tail to activate backdoors. Xie et al. [41] proposed DBA, which divides complete trigger into multiple sub-triggers assigned to different attackers to create backdoor samples, aiming to reduce the pairwise similarity of malicious updates. However, these carly attacks often neglected

---

① Get backdoor energy
2 Get the concentrated backdoor energy
X Wasserstein distanca-based clustering
1
Reject
Appregate
Figure 1: Overview of MARS. To facilitate understanding, we simplify the FL system to include only four clients. The first and third clients upload backdoor models, while the second and fourth clients upload benign models. Red circles represent higher backdoor energy, while green circles indicate lower backdoor energy.
the possibility of defensive measures, rendering them effective primarily against FL systems with no defenses or only weak ones.
To address this shortcoming, a new wave of sophisticated backdoor attacks has emerged. 3DFed [17], for instance, employs indicator mechanism to detect whether backdoor updates being ag- gregated and then adaptively optimizes the backdoor models evade existing defenses. Similarly, CerP [25] and DarkFed [19] share core strategy of adding constraints mimic the characteristics of benign updates-suee as moderate magnitudes and limited consistency-strikee a balance between stealth and efficacy. These advanced attacks significantly threaten the secure deployment of FL., necessitating the development of robust defenses.
2.2 Backdoor Defenses in FL
We broadly categorize existing defenses into three main types based the techniques they employ: norm constraint-based defenses, OOD detection- based defenses, and consistency detection-baag based defenses.
Norm constraint-based defenses posit that the optimal point for the backdoor task typically deviates significantly from the optimal point for the main task. This results in the norm of backdoor updates being much larger than that of benign updates. Consequently, these defenses constrain the norm of all local updates within reasonable range. Norm Clipping [38] serves representative example of such defenses. Additionally, some other defenses [35, 34, 6] also leverage this characteristic to prevent malicious updates from dominating the global model.
OOD detection-bard based defenses assert that backdoor updates and benign updates exhibit substantial differences in their distributions, with benign updates typically being densely distributed. In contrast, backdoor updates can be considered as outliers. Building on this premise, Multi-Krum [5] calculates an anomaly score for each local update based the sum of its distances to its neighboring nodes. higher score indicates greater deviation, making it more likely to discarded. RFLBAT [40] utilizes Principal Component Analysis (PCA) to project local updates into low-dimensional space. Subsequently. it employs a clustering algorithm to identify outliers, marking them as backdoor updates. FLAME [27] identifies updates that deviate significantly in direction from the overall trend as backdoor updates and excludes them from the aggregation queue. FLDetector [43] exploits the differences between the predicted model and the actual model to discover outliers.
Consistency detection-based defenses argue that all backdoor updates share the same objective, namely, to classify trigger-carrying samples as the target label. Therefore, these updates exhibit strong consistency, either in terms of update directions or neuron activations. On the other hand, diverse benign updates may display lower consistency due to data heterogeneity [22]. With this

---

understanding, FoolsGold [12] assigns lower aggregation weights to updates with high pairwise cosine similarities, thereby mitigating the impact of backdoor updates. DeepSight [30] uses the consistency on neuron activations in the backdoor model to detect malicious updates.
3
Threat Model
3.1
Attack Model
The primary objective of the attackers is to implant a backdoor into the global model by transmitting malicious model parameters to the central server. facilitate more sophisticated backdoor attacks, we assume the attackers possess substantial capabilities:
Flexible Local Optimization. Attackers can arbitrarily modify their local optimization objectives, achieving fine balance between stealth and effectiveness.
Collusion Capability. Attackers can collude, allowing full transparency of training data and model parameters among them. This transparency aids in dynamically adjusting backdoor models to evade defense mechanisms.
Dominant Presence. Attackers can constitute majority, with their proportion not restricted below 50% as typically assumed in existing research.
These powerful assumptions significantly heighten the challenge of defending against backdoor
attacks.
3.2 Defense Model
Our proposed defense is deployed at the central server to detect and filter out backdoor models from the local models uploaded by clients, resulting in high-performance, backdoor-fres global model. We assume the central server has minimal knowledge. Specifically, the server only has access to the model parameters of all local models in each round. It cannot access any client's training data or control the training process of any client's model. Moreover, the server does not make any assumptions about the proportion of attackers. Our proposed defense algorithm aims to achieve the following goals simultaneously:
Effectiveness. Regardless of the type of backdoor attack, the defense should effectively thwart the attackers' malicious activities, resulting in backdoor-free global model. Practicability. The defense should remain effective in challenging real-world scenarios, such when the proportion of attackers exceeds 50%. clients have heterogeneous data distributions, or clean auxiliary datasets are unavailable.
Fidelity. In mon-adversarre accuracy of the global model on clean samples should not degrade compared to FedAvg due to the deployment this defense.
scenarios (i.e., there are no attackers in the FL system), the
These objectives ensure that the defense is robust, practical, and reliable in both adversarial and non-adversarial environments.
MARS
4.1
Motivation
After reviewing the SOTA defenses, we find that they mainly rely on empirical statistical measures. Techniques such as norm constraint, OOD detection, and consistency detection extensively utilized by them. However, we demonstrate that these empirical statistical measures tend to fail when faced with advanced attacks.
Failure Norm Constraint. To prevent the norm (also known as magnitude) of backdoor updates from becoming excessively large, some advanced backdoor attacks [19, 17, 25] incorporate con- straint term to encourage finding backdoor models near the previous round's global model. The resulting backdoor updates, even without proportionally increasing their magnitude, can still achieve excellent attack efficacy. As shown Figure 2(a), the magnitude backdoor updates obtained this way be even smaller than that of benign updates. This indicates that when defender employs the

---

Backs Uppaae Upeace
0.6
Backidor Uodots
Bonign Updatee
0,4
0.2
-0.
-0.6
(a) Norm Comparison
(b) Distribution Comparison (c) Consistency Comparison
Figure 2: Comparison of statistical measures between backdoor and benign updates. We consider 20 clients, with the first 4 clients (indices to 3) heing malicious and conducting 3DFed attack, while the remaining clients (indices 4 to 19) are benign. (a) provides the norms of all local updates. (b) shows the distribution of all local updates projected into 2D space using PCA. (c) presents a heatmap of the similarities between local updates.
norm constraint, backdoor updates remain unaffected. Consequently, this type of statistical measure can be easily bypassed by these advanced backdoor attacks.
Failure of OOD Detection. To make backdoor updates appear less anomalous, several advanced backdoor attacks have devised innovative solutions. 3DFed [17] generates a series of outlier decoy updates, making the backdoor updates seem more benign in comparison, thus bypassing the detection by a defender. DarkFed [19] adds a constraint term to ensure that the cosine similarity between backdoor and benign updates is close that among benign updates themselves. CerP [25] employs a similar strategy to DarkFed but uses Euclidean distance for constraint. As shown in Figure 2(b), the backdoor updates crafted by 3DFed are indistinguishable from benign a 2-dimensional space. Moreover, Figure 2(c) provides new evidence from another perspective. It illustrates that the cosine similarity between backdoor and benign updates hovers around -0.08, which is even higher than the similarity among some benign updates (e.g., a cosine similarity of -0.54 between client 5 and client 19). Consequently, OOD detection fails to provide effective protection against these attacks.
when projected onto
Failure of Consistency Detection. To reduce the consistency of backdoor updates, 3DFed [17] adds carefully designed noise masks to each backdoor update, increasing the variability among them without diminishing the strength of the attack. DarkFed [19] and CerP [25] achieve similar effect by adding a constraint term to decrease the cosine similarity between pairs of backdoor updates. As shown in Figure 2(c), the cosine similarity between backdoor updates is only about -0.08, which is significantly lower than the cosine similarity among some benign updates (e.g. 0.77 between client 15 and client 17). This indicates that consistency detection also fails to differentiate between backdoor and benign updates.
We attribute all the aforementioned failures to fundamental reason: these empirical statistical measures are loosely coupled with backdoor attacks. In other words, they lack the capability to perceive malicious intent and do not fundamentally reflect whether an update has been compromised with backdoor. Consequently, attackers can easily mimic the statistical measures of benign updates, thereby bypassing existing defenses. This motivates us employ malignity-awar measure that can reflect the inherent maliciousness of the model, rather than relying on empirical intuitions.
4.2 Overview of MARS
Unlike existing schemes that directly detect abnormal statistical measures based on model parameters, we propose a Malignity-Awant Aware backdooR defenSe (MARS). As shown in Figure for each local model, we first calculate the backdoor energy (BE) of each neuron, which reflects how strongly a neuron is associated with backdoor attacks. Higher backdoor energy indicates higher level of malignity for that neuron. To further amplify the malignity, we extract the most prominent backdoor energies from each layer and concatenate them into a one-dimensional vector, which we call the concentrated backdoor energy (CBE). Note that CBE is not unique to backdoor models; it can also be calculated for benign models. Subsequently, we propose a novel Wasserstein-basee clustering method to effectively identify backdoor models and prevent them from participating in the aggregation.
5

---

4.3 Obtaining Backdoor Energy
Given an L-layer neural network F f(h) / f(t-=)) .... f()), clean dataset S X D. and backdoor trigger generator 8(.), straightforward way to evaluate the backdoor energy of the tth neuron in the 1th layer to compute the expected difference in neuron values between clean samples and backdoor samples:
BE
(1) (F) = ExEx (x)
where to the 1thh neuron in the 1th layer.
f fu o... ..... (() indicates the neuron function that maps an input sample
However, obtaining BE via equation faces two challenges. First, due to the privacy-preservee preserving nature of FL, the clean dataset D inaccessible to the defender. Furthermore, the trigger is very subtle and private to the attackers, making it difficult for the defender to obtain. A naive idea is to collect shadow dataset and employ reverse engineering [37] to reconstruct the trigger. However, the shadow dataset may significantly different from the real training dataset, leading to inaccurate BE calculations and impairing the detection of backdoor models. Moreover, reverse engineering requires reconstructing trigger for each class individually, which becomes very time- tinecconuuning when there are many classes (e.g., ImageNet with 1000 classes). Additionally, when the trigger is complex, the reconstructed trigger may significantly differ from the real one, also resulting in inaccurate BE calculations. Considering the above challenges, we turn to exploring the upper bound BE.
Theorem 4.1 (Upper Bound of Backdoor Energy). Suppose an L-layer neural network F' and its every sub-network f() E [L, L), are Lipschitz smooth. Then, the backdoor energy of the kth neuron in the th layer can be upper bounded by:
BE (F) 11 r.pp
[ |11ppeaa 8(x))12,
where 1|.| represents the Lipschitz constant of function. The detailed proof is provided in Appendix A.
On the one hand, we do not need the exact value BE for subsequent calculations, but only the relative magnitudes of BE among different neurons to detect anomalies. On the other hand, the upper bound of backdoor energy reasonably reflects the distribution of BE. Thus we can approximate B E' using its upper bound. Furthermore, as indicated by formula when considering different neurons j and k in the same layer I, the difference in their BE' upper bounds is solely in the first term, i.e., further approximate BE using only the first term of its
( [1zap and lI r.pp- Therefore,
upper bound:
BE)
Notably, equation does not rely the clean dataset the trigger. It allows for the easy calculation of BE for all neurons using only the model parameters. Equation aligns with the empirical findings reported in CLP [44]. The primary distinctions between MARS and CL.P are detailed in Appendix B. Appendix C provides more details about the calculation of Lipschitz constant.
4.4 Obtaining Concentrated Backdoor Energy
Since backdoor can be viewed as a shortcut [37], only small number of neurons are backdoor- related. Therefore, we extract the highest BE values from each layer (e.g., the top 5% by default in our paper) and concatenate them into one-dimensional vector. We call this vector the concentrated backdoor energy (CBE), as aggregates the most prominent backdoor energies in the model. This approach minimizes interference from neurons unrelated to the backdoor, aiding in the subsequent differentiation between backdoor and benign models. Formally, the CBE of a model can be obtained by:
CBE(F) Ü TopKes x (FB)((F)))
(4)
1=1
*We omit the model weights in F(:;0) for simplicity.

---

where L is the total number of layers, ny is the number of neurons in the 1th layer, TopK ()) denotes the top 1% values of set.
4.5 Identifying Backdoor Models
CBE can effectively capture each local model's backdoor information, in which backdoor and benign models are quite different, making clustering promising approach for identifying backdoor models. However, two challenges remain to be addressed. First, existing clustering methods primarily use Euclidean distance cosine distance metrics, which are highly sensitive to the order of elements rather than their overall distribution, leading to potential errors. Second, after clustering, it is challenging to decide which clusters trust and include in the final aggregation. Choosing the wrong clusters could result in the failure to exclude backdoor models. Compulsively discarding some clusters, in innocent scenario (i.e. all clients are benign), may slow down the convergence of the global model or even decrease its accuracy.
Wasserstein Distance- Based Clustering. We use K-Means partition the CBEs of all local models into two clusters. However, the default metric, Euclidean distance, or the widely used cosine distance". is sensitive to the order of elements and not suitable for our scenario. This is particularly true for FL. where the top BE values of different local backdoor models may appear in different neurons due to the distributed nature of training. As result, even though the elements in the CBEs of backdoor models are generally larger, both Fuclidean and cosine distances do not recognize these CBEs as similar. To focus on the distribution of elements in the CBE and avoid the influence of their order, we employ Wasserstein distance [28] as the metric for K-Means and call the clustering algorithm K-WMeans. Formally, for two probability distributions p and g, the Wasserstein distance between them is defined as:
W (p.
inf Ex - y/1 >~11(p)))
where II(p, q) denotes the set of all possible joint distributions between and q. Next, we use a toy example to demonstrate that Wasserstein distance is more suitable than Euclidean and cosine distances for identifying backdoor models in our case.
Toy Example: Assume L1 2,3,, and L2 [5, 2,, are the CBEs of backdoor models, and L3 = 1, 1, 1,11 is the CBE of benign model. This assumption is reasonable because neurons in backdoor models have higher BE values. As shown in Table I, when considering Euclidean distance, I11 and L.3 are deemed the closest. When using cosine distance as the metric, T.2 and L3 are considered the closest. Both metrics are not conducive to clustering backdoor models into single cluster. Notably, when considering Wasserstein distance, despite the significant differences in values across each dimension for L1 and L2, their distance is much smaller than the distances between L1 and L3 or L2 and L3. This favors the clustering of backdoor models together.
[1,,,,
Cluster Selection. After using K- K-MMesns to divide the CBEs into two clusters, the subsequent challenge is how to select the trusted cluster. Existing methods typically assume that benign clients are the majority and therefore accept the larger cluster. However, in some extreme scenar- ios, the number of attackers might exceed that of benign clients, leading to the unintended selection of backdoor models. To avoid this assumption, we use the norm of the cluster center as a more reliable metric for cluster selection. Specifically, the elements in the CBEs of attackers generally have higher values than those in the CBEs of benign clients. Therefore, we select the cluster with the smaller center norm, rather than relying on the majority.
Table 1: Metric comparison.
Metric
(L.1, L2)
(L1, L.3)
(1.2, L3)
Euc.
6.16
5.48
6.16
Cox.
0.31
0.10
0.07
Wass.
0.40
2.00
2.40
However, when there are no attackers in the FL system, blindly discarding the cluster with the larger center norm might slow down the global model's convergence even reduce its accuracy. To address this, we use the Wasserstein distance to measure the similarity between clusters. If the distance between the two clusters does not exceed threshold c, it indicates that the CBEs of all local models have similar distributions, corresponding to a scenario where all local models are either benign or malicious. Given that an FL system with only attackers meaningless, we assume that when the cluster distance is low, all local models are benign. Therefore, in this case, both clusters are selected. detailed algorithm description is provided in Appendix D.
One minus cosine similarity.
7

---

5 Experiments
5.1 Experimental Setup
We consider an FL. system with 100 clients, where 20 of them are designated as attackers. In each round, 20 clients are selected to participate in the FL process, with 4 of them guaranteed to be attackers. By default, MARS's hyperparameters e and are set to 5 and 0.03, respectively. We fix the random seed to ensure reproduction and conduct experiments on the NVIDIA 3090Ti.
Datasets, models, and codes. We evaluate the effectiveness of MARS on MNIST [16], CIFAR- 10 [15], and CIFAR-100 [15] datasets. To simulate realistic non-llD distributions, we use the Dirichlet distribution with a default sampling parameter a set to 0.9. For MNIST, a simple CNN is employed as the global model, while for CIFAR-I0 and CIFAR-10M 100, we use ResNet-18 [13] as the global model. The codes are available at http:://gihub..oo//unnnn
1 9200/MARS.
Evaluated attacks and defenses. We consider three SOTA backdoor attacks: MRA [3]. CerP [25], and 3DFed [17]. Additionally, we design a customized adaptive attack tailored specifically for MARS. On the defense side, we evaluate eight SOTA defense methods, including FedAvg [26], Multi-Krum [5], RFLBAT [40], FLAME [27], FoolsGold [12], FLDetector [43], Deepsight [30], and
FedCLP [44]. Notably, we also include the recently published backdoor defense, BackdoorIndica- tor [21], from Usenix Security 2024. Detailed descriptions of these attacks and defenses can be found
in Appendix E.
Evaluation metrics. We assess the performance of the defenses using several metrics, including model accuracy (ACC), attack success rate (ASR), true positive rate (TPR), false positive rate (FPR), and comprehensive ability of defense (CAD). Higher values of ACC, TPR, and CAD, along with lower values of ASR and FPR, indicate more effective defense. A more detailed description to these metrics can be found in Appendix F.
Table 2: Comparison of MARS and SOTA defenses under SOTA attacks.
MRA
CerP
3DFed
Dataset
Baselines
ACC
ASR
TPR
FPR
ACC
ASR
TPR
FPR
ACC
ASR
TPR
FPR
1
FedAig
98.46
99.67
0:00
3.000
49:70
99.08
88.52
0.00
01.00
52.69
98.96
77.17
(1.00
0.00
55.45
Multi-Krum
98.97
100.00
100.00
RFLBAT
98.98
9.71
100.00
19.38
92.47
90.84
21.00
90.00
16.38
85.74
99.13
74.53
0.00
18.75
51.46
FLAME
98.98
9.63
100.00
31:25
89:53
99.31
9.74
100.00
51.25
59:58
98.65
91.41
0.00
56.25
37.75
Fool
99.00
9.64
100.00
8.00
99.91 31
29.21
30.00
75.03
99.02
73.08
56.49
MNIST
FLDetector
96.61
94,20
0.00
46.10
98.75
74.01
56.18
DeepSight
98.92
22.83
0.00
6.25
67.16
99.29
9.75
100.00
37.50
55.01
98.74
62.30
0.00
6.25
57.55
FedCLEP
82.00
14.47
83.77
09.21
9.75
94.73
85.54
16.69
84.43
MARS
9.66
100.00
34
32
9.74
100.00
13
9.72
100.00
96.45
FedAvg
78.32
99.68
0:00
8.00
44.66 66
84.49
93.70
0:00
0.00
47.70
84.37
96.76
0.00
0.00
46.90
Multi-Krum
100.00
85.32
10:01
100.00
RFLBAT
85.13
9.33
97.50
1.25
93.01
85,20
10.39
100.00
93.70
84.30
92.02
0.00
5.00
46.82
FLAME
84.87
8.74
100.00
31.25
86.22
85.34
10.59
100.00
51.25
85 88
83.06
97.50
2.50
55.63
33.11
FoolGoold
85.06
9:71
100.00
12.50
90.71
85.00
91:00
0.00
0.00
48.55 50
84.11
96.29
0.00
0.25
46.89
CIFAR-10
FLDetector
85.16
100.00
85.18
88.64
62.39
84.24
95.20
35.00
DeepSight
83.99
99.94
0.00
6.25
44.45
85.22
74.15
10.00
40.00
45.27
84.80
98.85
0.00
6.25
44.93
FedCLP
75.01
10.88
82.07
78.52
11.00
83.76
69.25
7.55
30.85
MARS
85.16
100.00
85.37
100.00
100.00
93.80
FedAvg
77.97
100.00
0.00
0.00
44.45 49
78.87
99.97
0.00
0.00
44.73
78.89
100.00
0.00
0.00
44.72
Multi- Kram
79.34
100.00
94.59
79.67
1.14
100.00
78.36
100.00
25.00
RFLBAT
79.46
0.97
100.00
15:00
79.50
1.15
100.00
94.43
78.89
100.00
18.75
40.04
FLAME
79.63
0.95
100.00
31.25
86.86
79.56
1.20
100.00
31:25
96.78
79.27
1.00
100.00
51.25
87.76
FoobGold
79.54
0.98
100.00
0.00
91.61
79.59
1.15
100.00
0.00
91.61
79.01
100.00
0.00
0.00
44.75
CIFAR-100
Fl.Detector
78.10
DeepSight
78.85
61.30
0.00
6.25
52.83
79.18
1.20
97.50
56.39
79.65
78.91
10.59
20.00
25.00
65.83
FedCLP
77.96
0.91
88.53
78.36
1.19
$3.59
77.73
0.99
$8.37
MARS
79.53
79.73
1.15
100.00
79.37
100.00
5.2 Experimental Results
Comparison with SOTA defenses. Table compares the performance of MARS with SOTA defenses against 3 SOTA backdoor attacks across 5 evaluation metrics on 3 datasets. Overall, existing defenses fail to provide adequate protection, especially when confronted with advanced attacks like 3DFed. In contrast, proposed MARS consistently achieves the best performance across all
8

---

datasets and attack scenarios, demonstrating its robustness in maintaining model performance in the presence of backdoor attacks. Specifically, for the MRA attack, defenses such as Multi-Krum RFLBAT, FLAME, and FoolsGold achieve satisfactory ASR, but they suffer from excessive client exclusion. For instance, FLAME shows an FPR as high as 51.25% on the CIFAR-10 dataset. For the CerP attack, the effectiveness of existing defenses varies significantly across datasets. For example, FoolsGold can precisely detect all backdoor models on CIFAR- 100, but only a few on MNIST, while its ability to detect backdoors completely breaks down on CIFAR-10. For 3DFed, most defenses show consistently high ASR, with the only exception being FedCLP, which achieves a relatively lower ASR, indicating some level of backdoor mitigation. However, FedCLP's aggressive pruning of local models often leads to excessive removal, negatively impacting the model's utility. When benchmarked against MARS, FedCLP's ACC drops by 1.64% ~ 15.82% across different datasets, decline that is unacceptable for most real-world scenarios. We attribute MARS's superior defense ability to its detection of anomalies through BE, which is strongly correlated with backdoor attacks, fundamentally distinguishing it from existing defenses that rely on loosely coupled empirical metrics.
Resilience to adaptive attack. To further as- sess the robustness of MARS, we consider a more informed adversary, where attackers have prior knowledge that the central server employs MARS as the defense mechanism. Leveraging this insight, the attackers can craft adaptive strategies specif- ically designed to bypass MARS. Since MARS detects backdoor models through their relatively higher backdoor energy, a straightforward approach for executing an adaptive attack is to introduce a regularization term to minimize the backdoor en- ergy of each neuron in each backdoor model. For- mally, the attackers' optimization objective is de- fined as follow:
Table 3: Performance of MARS against adap- tive attack.
A
Defense ACC f ASR
TPR
FPR
CAD f
MARS
85.31
9.43
100.00
0.00
93.97
0.0001
MARS
85.45
9.86
100.00
0.00
93.90
MARS
85.18
9.75
100.00
0.00
93.86
0.001
MARS
85.05
9.44
100.00
0.00
93.90
MARS
85.26
9.57
100.00
0.00
93.92
0.01
MARS'
85.50
9.76
100.00
0.00
93.94
MARS
10.00
100.00
0.00
97.50
3.13
0.05
MARS
85.12
9.30
100.00
0.00
93.96
MARS
10.00
100.00
0.00
99.38
2.66
MARS'
85.14
9.31
100.00
0.00
93.96
min B (a [CEE
+
Σ
Σ BE (F(::)),
(6)
KELKEN)
where LCE denotes the cross-entropy loss function, D consists of both clean and backdoor samples, and À represents the regularization coefficient. As shown in Table 3, when À is set to 0.01 or lower, MARS can effectively defend against adaptive attacks, achieving a CAD of over 93%. We hypothesize that this is due to the small regularization coefficient, which provides limited constraint on the backdoor energy of neurons. However, when À is further increased to 0.05 or higher, the backdoor energy of malicious models becomes sufficiently constrained, even falling below that of benign models. This causes MARS to misclassify all benign models as malicious, and vice versa as indicated by TPR of 0% and an FPR close 100%. Nevertheless, these results also suggest that even with constrained backdoor energy. there remain significant differences between the CBE distributions of backdoor and benign models. Therefore, we modify MARS's 's cluster selection strategy from choosing the cluster with the smaller center norm to a majority- selection, which we refer to as MARS* We observe that regardless of the value, MARS* consistently and effectively defends against adaptive attacks.
Comparison with BackdoorIndicator: The most recently proposed defense BackdoorIndi- cator [21] identifies that subsequent backdoor injections significantly slow down the ASR de- cline of previously implanted backdoors. Build- ing on this observation, it employs an indicator task that uses OOD samples to detect and re- move backdoored models. As shown in Table 4, BackdoorIndicator effectively detects most back- door models under the MRA attack, maintaining a low ASR. However, when confronted with the CerP attack, it can only detect a limited number of backdoor models, resulting in an ASR close to 72%, indicating that BackdoorIndicator fails
Table 4: Comparison of MARS and BackdoorIndi- cator. G and C100 refer the of GTSRB and CIFAR- 100 as the indicator datasets of Back- doorIndicator, respectively.
Attack Defense
ACC1
ASR 1 TPR
FPR 1 CAD 1
Indicator (G)
85:28
97.50
93.37
MRA
Indicator (C100)
85.43
10.29
90.00
0.00
91.29
MARS
85.16
9.40
100.00
0.00
93.94
Indicator (G)
85.22
71.94
37.50
0.63
62.54
CerP
Indicator (C100)
84.89
71.98
47.50
64,95
MARS
85.37
10.03
100.00
93.84
Indicator (G)
83.77
96.65
0.00
53.75
33.34
3DFed
Indicator (C100)
84.39
97.93
0.00
17.50
42.24
MARS
85.07
9.86
100.00
0.00
93.80

---

to provide sufficient protection in this case. Against the 3DFed attack, similar to other evaluated SOTA defenses, BackdoorIndicator completely breaks down, achieving less than half the CAD of MARS. We hypothesize that this is because Backdoorr is a heuristic algorithm that validates its intuition based solely on unconstrained backdoor training. As a result, it performs well against attacks like MRA, which rely solely on data poisoning, finding supported by both the original paper and our experimental results. However, CerP and 3DFed introduce various constraints during the backdoor model training process, making the attacks more subtle and potent. These constraints likely lead to failures in BackdoorIndicator" 's underlying intuition, rendering less effective against these more sophisticated attacks.
Impact of attacker ratio on MARS. Previously, we demonstrated that
Table 5: Impact of attacker ratio on MARS.
Atk. Ratio ACC f
ASR 4
TPR f
FPR + CAD 1
MARS outperforms existing defenses
in terms of resilience to various at- tacks with a 20% attacker proportion (i.e., the effectiveness goal). To fur- ther investigate MARS's robustness, it is important to explore how it per- forms across a broader range of at- tacker proportions. Specifically, aim to examine if MARS mistakenly excludes benign models when there are no attackers (i.e., the fidelity goal) and whether can still provide effective defense when the attacker proportion exceeds 50% (i.e., the practicability goal). Table 5 presents the evaluation metrics of MARS as the attacker proportion increases from 0% to 95%. Remarkably, MARS consistently identifies all attackers with TPR of 100%. while ensuring no benign models are misclassified as malicious (FPR of 0%) across all settings. We attribute MARS's outstanding performance in extreme scenarios (e.g., 95% attacker presence) its carefully designed cluster selection strategy, which utilizes the cluster center norm to identify the trusted cluster and decides whether to discard cluster based on inter-cluster distance.
85.26
9.34
100.00
0.00
93,98
10
85.21
9.42
100.00
0.00
93.95
20
85.07
9.86
100.00
0.00
93.80
30
85.13
9.47
100.00
0.00
93.92
50
84.95
9.59
100.00
0.00
93.84
70
84.83
10.54
100.00
0.00
93.57
95
82.99
11.42
100.00
0.00
92.89
Other results. Due to space constraints, we have included additional results in the appendix. Specifi- cally, Appendix G evaluates the impact of data distribution the performance of existing defenses, Appendix H assesses MARS's s sensitivity to hyperparameters, and Appendix examines MARS's effectiveness larger datasets such ImageNet [9]. Appendix J evaluates the computational and communication overhead of MARS. Appendix K assesses the performance of MARS on NLP tasks, while Appendix L and Appendix M examines its defense capabilities against additional Backdoor attacks and Byzantine attacks respectively. Appendix N validates the effectiveness of MARS on ViT.
6 Conclusion and Limitation
We propose MARS, a malignity- backdoor defense. Unlike existing defenses that rely on loosely backdoor-coupled empirical statistical metrics, MARS directly focuses the core nature of backdoor attacks by detecting malignity through the backdoor energies of neurons. We further amplify this malignity by extracting the most prominent backdoor energies. A novel Wasserstein- based clustering method is then introduced to accurately detect backdoored models. Comprehensive comparisons across 3 datasets, 3 SOTA attacks, and 8 SOTA defenses demonstrate the superiority of MARS. Moreover, we validate the robustness of MARS against adaptive attack, further showcasing its effectiveness in backdoor defense. However, MARS is specifically designed for backdoor attacks; it is not well-suited to detect other types of threats that do not directly impact model performance. For instance, it is not designed to handle free-rider attacks [11]. where clients may behave lazily without degrading overall performance. Similarly, its defense mechanism does not extend to privacy-stealin attacks, such as gradient inversion [14], which aim to reconstruct training data from shared updates rather than corrupting the model's integrity.
Acknowledgements
Shengshan's work supported by the National Natural Science Foundation of China under Grant 62372196.
10

---

References
[1] Rodolfo Stoffel Antunes, Cristiano André da Costa, Arne Küderle, Imrana Abdullahi Yari, and Björn M. Eskofier. Federated learning for healthcare: Systematic review and architecture proposal. ACM Transactions on Intelligent Systems and Technology (TIST"22), 13(4):54:1- 54:23, 2022.
[2] Priya Arora, Vikas Khullar, Isha Kansal, Rajeev Kumar, and Renu Popli. Privacy-preseriing federated learning system (f-ppls) for military focused area classification. Multimedia Tools and Applications, pages 1- 2024.
[3] Eugene Bagdasaryan, Andreas Veit, Yiqing Hua, Deborah Estrin, and Vitaly Shmatikov. How to backdoor federated learning. Proceedings of the 23rd International Conference on Artificial Intelligence and Statistics (AISTATS 20), pages 2938 2948, 2020.
[4] Gilad Baruch, Moran Baruch, and Yoav Goldberg. A little is enough: Circumventing defenses for distributed learning. In Processings of the 33rd Annual Conference on Neural Information Processing Systems (NeurIPS' 19), pages 8632-8642, 2019.
[5] Peva Blanchard, EI Mahdi EI Mhamdi, Rachid Guerraoui, and Julien Stainer. Machine learning with adversaries: Byzantine tolerant gradient descent. In Proceedings of the 3 Annual Conference on Neural Information Processing Systems (NeurIPS' 17), pages 119-129, 2017.
[6] Xiaoyu Cao, Minghong Fang, Jia Liu, and Neil Zhenqiang Gong. Fitrust: Byzantine-robust federated learning via trust bootstrapping. In Proceedings of the 28th Annual Network and Distributed System Security Symposium (NDSS'21) 2021.
[7] Pushpita Chatterjee, Debashis Das, and Danda B. Rawat. Federated learning empowered recommendation model for financial consumer services. IEEE Transactions on Consumer Electronics (TCE'24) 70(1):2508 22150025116222. 2024.
[8] Yanbo Dai and Songze Li. Chameleon: Adapting to peer images for planting durable backdoors in federated learning. In International Conference Machine Learning (ICML' 22),, pages 67 6712-6725, 2023.
[9] Jia Deng. Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large-scale hierarchical image database. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR (09), pages 248-255, 2009.
[10] Christian Fachola, Agustín Tornaría, Paola Bermolen, Germán Capdehourat, Lorena Etcheverry, and María Inés Fariello. Federated learning for data analytics in education. Data, 8(2):43, 2023.
[11] Yann Fraboni, Richard Vidal, and Marco Lorenzi. Free-rider attacks model aggregation in federated learning. In The 24th International Conference on Artificial Intelligence and Statistics (AISTATS'21) 21), pages 1846-1854 2021.
[12] Clement Fung, Chris J. M. Yoon, and Ivan Beschastnikh. The limitations of federated learning in sybil settings. In Proceedings of the 23rd International Symposium on Research in Attacks, Intrusions and Defenses (RAID' 200), pages 301-316, 2020.
[13) Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Proceedings of the IEEE/CVE Conference on Computer Vision and Pattern Recognition (CVPR'IOM 16), pages 770-778, 2016.
[14] Yangsibo Huang, Samyak Gupta, Zhao Song, Kai Li, and Sanjeev Arora. Evaluating gradi- ent inversion attacks and defenses in federated learning. In Processings of the 35th Annual Conference on Neural Information Processing Systems (NeurIPS'2) pages 7232-7241, 2021.
[15] Alex Krizhevsky and Geoffrey Hinton. Learning multiple layers of features from tiny images. 2009.
[16) Yann LeCun, Léon Bottou, Yoshua Bengio, and Patrick Haffner. Gradient-based learning applied to document recognition. Proc. IEEE, 86(11):227--2324 1998.

---

[17] Haoyang Li, Qingqing Ye. Haibo Hu, Jin Li, Leixia Wang, Chengfang Fang, and Jie Shi. 3dfed: Adaptive and extensible framework for covert backdoor attack in federated learning. In Proceedings of the 44th IEEE Symposium on Security and Privacy (SP'23), pages 1893-1907, 2023.
[18] Minghui Li, Wei Wan, Jianrong Lu, Shengshan Hu, Junyu Shi, Leo Yu Zhang, Man Zhou, and Yifeng Zheng. Shielding federated learning: Mitigating byzantine attacks with less constraints. In Proceedings of 18th International Conference on Mobility, Sensing and Networking (MSN"22),
pages 185, 2022.
[19] Minghui Li, Wei Wan, Yuxuan Ning, Shengshan Hu, Lulu Xue, Leo Yu Zhang, and Yichen Wang. Darkfed: A data-free backdoor attack in federated learning, In Proceedings of the 33rd International Joint Conference on Artificial Intelligence (IJCAI'24, pages 4443-4451, 2024.
[20] Minghui Li, Hangtao Zhang, Yanjun Zhang, Li Zeng, Chao Chen, Qiyun Shao, Wei Wan, Shengshan Hu, and Leo Yu Zhang. Fine-grained poisoning framework against federated learning. IEEE Transactions on Dependable and Secure Computing (TDSC' 25), 2025.
[21] Songze Li and Yanbo Dai. Backdoorindicator: Leveraging OOD data for proactive backdoor detection in federated learning. In Proceedings of the 33rd USENIX Security Symposium, (USENIX Security 24), 2024.
[22] Tian Li, Anit Kumar Sahu, Manzil Zaheer, Maziar Sanjabi, Ameet Talwalkar, and Virginia Smith. Federated optimization in heterogeneous networks. In Proceedings of Machine Learning and Systems (MLSys 20), 2020.
[23] Jianrong Lu, Lulu Xue, Wei Wan, Minghui Li, Leo Yu Zhang, and Shengqing Hu. Preserving privacy of input features across all stages of collaborative learning. In Proceedings of the 21st IEEE International Symposium on Parallel and Distributed Processing with Applications (ISPA 23), pages 191-198, 2023.
[24] Jianrong Lu, Shengshan Hu, Wei Wan, Minghui Li, Leo Yu Zhang, Lulu Xue, and Hai Jin. Depriving the survival space of adversaries against poisoned gradients in federated learning. IEÉE Transactions on Information Forensics and Security (TIFS'24), 19:5405 99,5405-5488, 2024.
[25] Xiaoting Lyu, Yufei Han, Wei Wang, Jingkai Liu, Bin Wang, Jiqiang Liu, and Xiangliang Zhang. Poisoning with cerberus: Stealthy and colluded backdoor attack against federated learning. In Proceedings of the 37th AAAI Conference on Artificial Intelligence (AAAI 233), pages 9020-9028, 2023.
[26] Brendan McMahan, Eider Moore, Daniel Ramage, Seth Hampson, and Blaise Agtiera y Arcas. Communication--ffiiien learning of deep networks from decentralized data. In Proceedings of the 20th International Conference on Artificial Intelligence and Statistics (AISTATS'17 pages 1273-1282, 2017.
[27] Thien Due Nguyen, Phillip Rieger, Huili Chen, Hossein Yalame, Helen Möllering, Hossein Fereidooni, Samuel Marchal, Markus Miettinen, Azalia Mirhoseini, Shaza Zeitouni, Farinaz Koushanfar, Ahmad-Reza Sadeghi, and Thomas Schneider. FLAME: taming backdoors in fed- erated learning. In Proceedings of the 31 USENIX Security Symposium (USENIX Security'22) pages 1432, 2022.
[28] Victor M Panaretos and Yoav Zemel. Statistical aspects of wasserstein distances. Annual review of statistics and its application. 6(1):405-433 2019.
[29] Ashwinee Panda, Saeed Mahloujifar, Arjun Nitin Bhagoji, Supriyo Chakraborty, and Prateek Mittal. Sparsefed: Mitigating model poisoning attacks in federated learning with sparsification. In Proceedings of the 25th International Conference on Artificial Intelligence and Statistics (AISTATS') 22), pages 7587-7624, 2022.
[30] Phillip Rieger, Thien Due Nguyen, Markus Miettinen, and Ahmad- Rezad Sadeghi. Deepsight: Mitigating backdoor attacks in federated learning through deep model inspection. In Proceedings of the 29th Annual Network and Distributed System Security Symposium 22), 2022.
12

---

[31] Junyu Shi, Wei Wan, Shengshan Hu, Jianrong Lu, and Leo Yu Zhang. Challenges and ap- proaches for mitigating byzantine attacks in federated learning. In Proceedings of International Conference on Trust, Security and Privacy in Computing and Communicutions (TrusiCom 22), pages 139-146. IEEF, 2022.
[32] Vale Tolpegin, Stacey Truex, Mehmet Emre Gursoy, and Ling Liu. Data poisoning attacks against federated learning systems. In Proceedings of the 25th European Symposium on Research in Computer Security (ESORICS'20), pages 480-501, 2020.
[33] Wei Wan, Jianrong Lu, Shengshan Hu, Leo Yu Zhang, and Xiaobing Pei. Shielding fed- erated learning: A new attack approach and its defense. In Proceedings of IEEE Wireless Communications and Networking Conference (WCNC'21), pages 2021.
[34] Wei Wan, Shengshan Hu, Jianrong Lu, Leo Yu Zhang, Hai Jin, and Yuanyuan He. Shielding federated learning: Robust aggregation with adaptive client selection. In Proceedings of the 31t International Joint Conference on Artificial Intelligence (IJCAI'22) pages 753-760, 2022.
[35] Wei Wan, Shengshan Hu, Minghui Li, Jianrong Lu, Longling Zhang, Leo Yu Zhang, and Hai Jin. A four-pronged defense against byzantine attacks in federated learning. In Proceedings of
the 31st ACM International Conference on Multimedia 23), pages 7394-7402, 2023.
[36] Wei Wan, Yuxuan Ning, Shengshan Hu, Lulu Xue, Minghui Li, Leo Yu Zhang, and Hai Jin. Misa: Unveiling the vulnerabilities in split federated learning. In proceedings of the 2024 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP 24), pages 2024.
[37] Bolun Wang, Yuanshun Yao, Shawn Shan, Huiying Li, Bimal Viswanath, Haitao Zheng, and Ben Y. Zhao. Neural cleanse: Identifying and mitigating backdoor attacks in neural networks. In Proceedings of the 40th IEEE Symposium on Security and Privacy (SP' 19), pages 707-723, 2019.
[38] Hongyi Wang. Kartik Sreenivasan, Shashank Rajput, Harit Vishwakarma, Saurabh Agarwal, Jy-yong Sohn, Kangwook Lee, and Dimitris S. Papailiopoulos. Attack of the tails: Yes, you really can backdoor federated learning. In Annual Conference on Neural Information Processing Systems (NeurIPS'20) 20), 2020.
[39] Xianlong Wang. Hewen Pan, Hangtao Zhang, Minghui Li, Shengshan Hu, Ziqi Zhou, Lulu Xue, Peijin Guo, Yichen Wang, Wei Wan, Aishan Liu, and Leo Yu Zhang. Trojanrobot: Backdoor attacks against robotic manipulation in the physical world. arXiv preprint arXiv: 2411.11683, 2024.
[40] Yongkang Wang, Dihua Zhai Yufeng Zhan, and Yuanqing Xia. Rfibat: A robust federated learning algorithm against backdoor attack. arXiv preprint arXiv:2201.03772, 2022.
[41] Chulin Xie, Keli Huang, Pin-Yu Chen, and Bo Li. DBA: distributed backdoor attacks against fed- erated learning. In Proceedings of the 8th International Conference Learning Representations (ICLR 20), 2020.
[42] Hangfan Zhang, Jinyuan Jia, Jinghui Chen, Lu Lin, and Dinghao Wu. A3FL: adversarially adaptive backdoor attacks to federated learning. In Annual Conference on Neural Information Processing Systems (NurlPPS233) 2023.
[43] Zaixi Zhang, Xiaoyu Cao, Jinyuan Jia, and Neil Zhenqiang Gong. Fldetector: Defending feder- ated learning against model poisoning attacks via detecting malicious clients. In Proceedings of the 28th ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD 22), pages 2545-2555, 2022.
[44] Runkai Zheng, Rongjun Tang, Jianze Li, and Liu. Data-free backdoor removal based on channel lipschitzness. In Proceedings of the 17th European Conference on Computer Vision (ECCV'22), pages 175-191, 2022.
[45] Ziqi Zhou, Menghao Deng, Yufei Song, Hangtao Zhang, Wei Wan, Shengshan Hu, Minghui Li, Leo Yu Zhang, and Dezhong Yao. Darkhash: A data-free backdoor attack against deep hashing. IEEE Transactions on Information Forensics and Security (TIFS'25) 25), 2025.
13

---

NeurIPS Paper Checklist
The checklist is designed encourage best practices for responsible machine learning research, addressing issues of reproducibility, transparency, research ethics, and societal impact. Do not remove the checklist: The papers not including the checklist will be desk rejected. The checklist should follow the references and follow the (optional) supplemental material. The checklist does NOT count towards the page limit.
Please read the checklist guidelines carefully for information on how to answer these questions. For each question in the checklist:
You should answer [Yes], [No]. or [NA].
[NA] means either that the question Not Applicable for that particular paper or the relevant information is Not Available.
Please provide short (1-2 sentence) justification right after your answer (even for NA).
The checklist answers are an integral part of your paper submission. They are visible to the reviewers, area chairs, senior area chairs, and ethics reviewers. You will be asked to also include (after eventual revisions) with the final version of your paper, and its final version will published with the paper.
The reviewers of your paper will be asked use the checklist as one of the factors their evaluation. While "[Yes] is generally preferable to "[No]" ", it is perfectly acceptable to answer "[No] providedd proper justification is given (e.g.. "error bars are not reported because it would be too computationally expensive" or "we were unable to find the license for the dataset we used"). In general, answering binary way, we
"[No] or "[NA]" is not grounds for rejection. While the questions are phrased acknowledge that the true answer is often more nuanced, please just use your best judgment and write justification to elaborate. All supporting evidence can appear either in the main paper or the supplemental material, provided in appendix. If you answer [Yes] to a question, in the justification please point to the section(s) where related material for the question can be found.
IMPORTANT, please:
Delete this instruction block, but keep the section heading "NeurIPS Paper Checklist",
Keep the checklist subsection headings, questions/answers and guidelines below.
Do not modify the questions and only use the provided macros for your answers.
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification:
We included the paper's contributions in the abstract and introduction.
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made in the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or
NA answer to this question will not perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results be expected to generalize other settings.
is fine include aspirational goals as motivation long is clear that these goals are not attained by the paper.
2. Limitations
Question: Does the paper discuss the limitations of the work performed by the authors?
Answer: [Yes]
Justification: Please refer Sec. 6
14

---

Guidelines:
The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create a separate "Limitations" section their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on a few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect on the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution low or images are taken in low lighting. Or speech-to-tex system might not be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairesss.
While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, a worse outcome might be that reviewers discover limitations that aren't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an impor- tant role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.
3. Theory assumptions and proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
Answer: [Yes]
Justification: Please refer to Sec. 4.3.
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated or referenced the statement of any theorems.
The proofs can either appear in the main paper or the supplemental material, but if they appear in the supplemental material, the authors are encouraged to provide short proof sketch to provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental result reproducibility
Question: Does the paper fully disclose all the information needed to reproduce the main ex- perimental results the paper to the extent that affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?
Answer: [Yes]
Justification: We included the details of our algorithm in Appendix and experimental setup in Sec. 5.1.
Guidelines:
The answer NA means that the paper does not include experiments.
15

---

If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is a novel architecture, describing the architecture fully might suffice, or if the contribution is specific model and empirical evaluation, it may be necessary to either make it possible for others to replicate the model with the same dataset, or provide access the model. In general. releasing code and data is often one good way to accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access a hosted model (e.g., in the case of a large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.
While NeurlPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) If the contribution is primarily new algorithm, the paper should make it clear how to reproduce that algorithm. (b) the contribution is primarily a new model architecture, the paper should describe the architecture clearly and fully.
(c) If the contribution is new model (e.g., a large language model), then there should either be way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset instructions for how to construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome describe the particular way they provide for reproducibility. the case of closed-source models, it may be that access to the model is limited in some way (e.g., registered users), but it should be possible for other researchers to have some path to reproducing or verifying the results.
5. Open access to data and code
Question: Does the paper provide open access to the data and code, with sufficient instruc- tions to faithfully reproduce the main experimental results, as described in supplemental material?
Answer: [Yes]
Justification:
The code is included in supplementary.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurlPS code and data submission guidelines (https://nips. cc/
for more details.
While we encourage the release of code and data, we understand that this might not be possible, so "No" an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurlPS code and data submission guidelines (https: /Ct///oodmmmiiic SonddeeubmissiooPooo
/ //nips... //nips.cc/pput wttpccccccpppcccccccccocococccca
for more details.
The authors should provide instructions on data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. only subset of experiments are reproducible, they should state which ones are omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
16

---

Providing as much information as possible in supplemental material (appended to the paper) recommended, but including URLs to data and code permitted.
6. Experimental setting/details
Question: Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Answer: [Yes]
Justification:
Please refer to Sec. 5.1.
Guidelines:
The answer NA means that the paper does include experiments.
The experimental setting should be presented in the core the paper to level of detail that is necessary to appreciate the results and make sense of them.
The full details can be provided either with the code, in appendix, as supplemental material.
7. Experiment statistical significance
Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Answer:
[Yes]
Justification: We used the same random seed for all defense algorithms enable fair comparison of their performance.
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by error bars, confi- dence intervals, statistical significance tests, least for the experiments that support the main claims of the paper.
The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall run with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
The assumptions made should be given (e.g.. Normally distributed errors).
It should be clear whether the error bar is the standard deviation or the standard error of the mean.
is OK to report I-sigma error bars, but one should state it. The authors should preferably report a 2-simma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that out range (e.g. negative error rates).
If error bars are reported in tables or plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables the text.
8. Experiments compute resources
For each experiment, does the paper provide sufficient information on the com- puter resources (type of compute workers, memory, time exccution) needed to reproduce the experiments?
Question:
Answer: [Yes]
Justification: Please refer to Sec. 5.1.
Guidelines:
The answer NA means that the paper does include experiments.
The paper should indicate the type of compute workers CPU or GPU, internal cluster, or cloud provider, including relevant memory and storage.
17

---

The paper should provide the amount of compute required for each of the individual experimental runs as well estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't make into the paper).
9. Code of ethics
Question: Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics https: /ttt://nee....p.eee htt.ap......eepppppp cctpublic//eieecccccccccccc httppa/ii/tiiiicuuieeeeleeeeaeee
Answer: [Yes]
Justification:
We acknowledge the Code of Ethics and obey them in our paper.
Guidelines:
The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.
If the authors answer No, they should explain the special circumstances that require a deviation from the Code of Ethics.
The authors should make to preserve anonymity (e.g.. if there special consid- eration due to laws or regulations in their jurisdiction).
10. Broader impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [NA]
Justification: There is societal impact of the work performed.
Guidelines:
The answer NA means that there no societal impact of the work performed.
If the authors answer NA or No, they should explain why their work has no societal impact why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is a direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.
If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release models, providing defenses in addition attacks, mechanisms for monitoring misuse, mechanisms to monitor how system learns from feedback over time, improving the efficiency and accessibility ML).
11. Safeguards
Question: Does the paper describe safeguards that have been put in place for responsible release of data or models that have a high risk for misuse (e.g., pretrained language models, image generators, scraped datasets)?
Answer: [NA]
Justification: The paper poses no such risks.
Guidelines:
The answer NA means that the paper poses such risks.
18

---

Released models that have high risk for misuse or dual-use use should be released with necessary safeguards to allow for controlled use of the model. for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make best faith effort.
12. Licenses for existing assets
Are the creators or original owners of assets (e.g.. code, data, models), used in the paper, properly credited and the license and terms of use explicitly mentioned and properly respected?
Question:
Answer: [Yes]
Justification: We cited the datasets and models used in our paper. All datasets and models used in our paper are publicly available.
Guidelines:
The answer NA means that the paper does use existing assets.
The authors should cite the original paper that produced the code package dataset.
The authors should state which version asset used and, possible, include URL.
The name of the license (c.g.. CC-BY 4.0) should be included for each asset. For scraped data from a particular source (e.g., website). the copyright and terms of service of that source should be provided.
If assets are released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, paperswi thcode. com/ datasets has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.
If this information is not available online, the authors encouraged to reach out to the asset's 's creators.
13. New assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [NA]
Justification:
The paper does not release new assets.
Guidelines:
The answer NA means that the paper does not release new assets.
Researchers should communicate the details the dataset/code/model as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent was obtained from people whose asset used.
At submission time, remember to anonymize your assets (if applicable). You can either create anonymized URL or include an anonymized zip file.
14. Crowdsourcing and research with human subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well as details about compensation (if any)?
Answer: [NA]
Justification: The paper does not involve crowdsourcing research with human subjects.
19

---

Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Including this information the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then as much detail as possible should be included the main paper.
According to the NeurIPS Code of Ethics, workers involved in data collection, curation, other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional review board (IRB) approvals or equivalent for research with human subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?
Answer: [NA]
Justification: The paper does not involve crowdsourcing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Depending on the country in which research is conducted, IRB approval (or equivalent)
may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and expect authors to adhere to the NeurIPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.
16. Declaration of LLM usage
Question: Does the paper describe the usage of LLMs if it is an important, original, or non-standard component of the core methods this research? Note that if the L.M used only for writing, editing, or formatting purposes and does not impact the core methodology. scientific rigorousness, or originality the research, declaration is not required.
Answer: [NA]
Justification: the core method development in this research does not involve LLMs any important, original, or non-standard components.
Guidelines:
The answer NA
that the core method development in this research does involve LLMs as any important, original, or non-standard components.
Please refer to our LLM policy (https : //tperrpss...e/eee Cwterrisscc///oooo for what should or should be described.
/LLM)
20

---

A Proof of Theorem 1
Theorem (Upper Bound of Backdoor Energy). Suppose an L-layer neural network and its every sub-network f() , E [], are Lipschitz smooth. Then, the backdoor energy of the k neuron in the 1th layer can be upper bounded by:
1-1 HIl
BE (F) S
1lfk
Lip
Iliip
EEEx [||= 622)112),
where I1-llesp represents the Lipschitz constant of a function.
Proof:
Since each sub-network f E []
L]]s is Lipschitz smooth, for all 2, y, we have:
(x) - ft (y))l2 & (1 [| 1|=
yll2
Consider the difference in the k-th neuron of the /-th layer between clean and backdoor inputs:
|| (x) - F (8(x))l2 = 11fk o f(-1 ... (x) 1 f(l .... f(H
< ( |I (1
p() (x) - f(l ....o o (() || I| [ || (1-- (x)) (11- s ()
II I
I
|| 6(x)112
In the proof above, apply the Lipschitz smooth assumption layer by layer from the outermost the innermost layers of the network. When considering an outer layer, all remaining inner sub-networks treated as a single entity.
Taking the expectation over x ~ N::
(F) (F) Ex~x |1 (x) (x)
Ftth (6(2))11 s l Ip
T
I1
Ex~x ||| 8(x)112
Thus, we conclude the proof.
B Distinctions between MARS and CLP
Although CLP [44] also employs Lipschitz constant to identify suspicious neurons, MARS diverges from CLP in its fundamental approach. First, we derive a rigorous theoretical upper bound on the backdoor energy (BE), furnishing solid mathematical guarantee, whereas CLP merely uncov- ers thr-thr empirical observations- positive correlation between the UCLC Upper bound of Channel Lipschitz Constant) metric and TAC (Trigger-Active Activatted Change). Second, CLP's use of Lipschitz-based estimate for BE to prune high-energy neurons is inherently imprecise: overly aggres- sive pruning can degrade clean accuracy, while insufficient pruning allows high attack success rate, as evidenced by the results in Sec. 5.2. In contrast, MARS treats BE purely as feature-extractio tool for downstream clustering, enabling more reliable and accurate detection of backdoored models.
C Calculation of Lipschitz Constant
Assume that certain subnetwork f (for convenience, we omit the layer index 7) is linear, i.e., f(x:)
Wa b. According to the definition of the Lipschitz constant, || mar
[[((+ (x)- f(x)lla
Az
||=||
mar |Wrlrl Az70
The rightmost part of this equation is precisely the spectral norm of the matrix W.
[
21

---

which can be computed using Singular Value Decomposition (SVD). Specifically, we decompose matrix W into the product of three matrices: one orthogonal matrix, one diagonal matrix, and another orthogonal matrix. The largest element in the diagonal matrix is the spectral norm of W, i.e., |l. It
In PyTorch, the Lipschitz constant can be easily computed using torch.svd(weiggh)[1 J.maa)))))))) For fully-connected layers, we can directly apply the above method. For convolutional layers, we approximate them as linear, and then reshape the weight tensor into a matrix form. The spectral norm of the reshaped matrix is used as an approximation to the original spectral norm. For batch normalization (BN) layers (assuming the BN transformation is y = = + 5), we use || 3 || to estimate the Lipschitz constant, it reflects the maximum possible scaling of the input variation after passing through the BN layer, which aligns with the core purpose of the Lipschitz constant. Additionally, enhance the reproducibility of MARS, we will open-source the code as soon the paper is accepted.
D Algorithm Description
Algorithm 1 provides a detailed description of MARS. The central server first calculates the backdoor energy (BE) for all neurons in each local model (Lines 1-8), then extracts the most prominent BE values from each layer to form the concentrated backdoor energy (CBE), which is stored in a set clustering algorithm, the server clusters all local models' CBEs into two groups based on the CBEs in set A, storing the client indices of each cluster in S₁ and S2, respectively (Line 11). The centers A₁ and A2 of the two clusters are computed (Lines 12-13). If the Wasserstein distance between A₁ and A2 is within an acceptable threshold c, it indicates that the distributions of the two clusters are similar, and thus all local models are considered benign (Lines 14-15). Otherwise, the local models corresponding to the cluster with the smaller norm of the cluster center are used for aggregation (Lines 16-23).
A (Line 9). Using the Wasserstein
E Evaluated Attacks and Defenses
E.1
Attacks
MRA [3]. MRA (Model Replacement Attack) is the first backdoor attack specifically designed for FL. Its core idea is to amplify backdoor updates in proportion, allowing a small number of malicious updates to dominate the global model. MRA is widely used for assessing the robustness of backdoor defenses FL..
CerP [25]. CerP (Cerberus Poisoning) is an advanced backdoor attack algorithm for FL that has emerged in recent years. It simultaneously tunes the backdoor trigger while controlling the changes in the poisoned model for each malicious participant, enabling a stealthy yet effective backdoor attack against a wide range of FL defense mechanisms. By fine-tuning the trigger, CerP increases the compatibility between the backdoor model and the trigger, minimizing significant updates to the model parameters. Additionally, controlling the changes in the model reduces the disparity between the backdoor and benign models, making it more challenging for defenders to identify the backdoor models.
3DFed [17]. 3DFed is an adaptive and extensible framework designed for launching covert backdoor attacks in FL environments, particularly in black-box setting. It addresses the challenges posed by existing backdoor attacks, which often require extensive information about the victim FL system and typically optimize for a single objective, rendering them less effecttiv against sophisticated defense mechanisms. The core of 3DFed lies in its three evasion modules that effectively camouflage backdoor models: backdoor training with constrained loss, noise mask, and decoy model. These components work synergistically to implant indicators into the backdoor model, allowing 3DFed to capture attack feedback from the global model during the previous training epoch. This feedback enables dynamic adjustment of and efficacy of the attacks. To the best of our knowledge, MARS the first defense conduct a comprehensive evaluation of robustness against 3DFed.
within the evasion modules, enhancing the stealth
22

---

Algorithm MARS
Require: Set of selected clients in the current round: S; Set of corresponding local models: (P((:0,), S}; simplicity Top factor: n;
We omit round index t for
Inter-cluster threshold:
Ensure: Aggregated global model: F.::0)).
1: Initialize set A
Set A is used to preserve the CBE of local models
2: for E S do
3: 0 0,
4: for E do
5: for k E ny do
6:
BE BE (F(:O)) 115k Ile
Calculate each neuron via eq.
7:
end for
8:
end for
# Calculate CBE for each client 9: A(s] + U TopK, (F(:8))
via eq. 4
10: end for
11: S1, S2 K-WMeans
Divide client index into two clusters Si and Sa
12: A - Mean( [A[s], s E Si))
13: Ag f Mean (A(s), S2))
14: if (asss(1 A2) < then
15: Sunal
# All the global models used for aggregation
16: else
17:
if ||||||| |||l| then
18:
Preserve the cluster with lower norm of central CBE Sinal <- Si
19: else
20: Siial < S2
end if
22: end if
23: 0G
[Small EoeSim 02
Aggregate all the credible local model weights
24:
return F(::0))
E.2 Defenses
FedAvg [26]. FedAvg is the first aggregation algorithm for FL,, which constructs a high-performance global model by aggregating all local models through weighted averaging. Due its effective knowledge aggregation capabilities, FedAvg is widely utilized in real-world industrial applications. such as Google's 's GBoard. Consequently, existing works usually evaluate the resistance of FedAvg to backdoor attacks, making it critical baseline for comparison.
Multi-Krum [5]. Multi-Krum is defense algorithm based aut-of-distribution (OOD) detection. estimates whether local model deviates from the overall distribution by calculating the sum of distances between that model and its nearest f 2 neighbor models (n and represent the number of participants and the number of attackers, respectively). Subsequently, it excludes the models that are furthest from the overall distribution from the aggregation queue.
RFLBAT [40]. RELBAT is a cutting-edge defense mechanism designed to counteract backdoor attacks in FL systems. Unlike existing algorithms that often impose constraints the number of malicious attackers or assume independent and identically distributed (IID) data, RFLBAT operates effectively under realistic conditions where the number of attackers is unknown and the data distribu- tion typically non-IID. RFLBAT leverages principal component analysis (PCA) to identify and extract essential features from the model updates, followed by K-means clustering algorithm to group similar updates. This dual approach enables RELBAT to effectively filter out malicious updates without requiring additional auxiliary information beyond the learning process itself.
FLAME [27]. FLAME defense framework aimed at countering backdoor attacks FL.. The key implementation steps of FLAME are follows: Noise Estimation. FLAME estimates the
23

---

optimal amount of noise to inject, ensuring effective elimination of backdoors while preserving model performance. Model Chustering. The framework utilizes clustering approach to group similar models, which helps identify and isolate potentially malicious updates. Weight Clipping. FLAME applies weight clipping to the clustered models, mitigating the influence of adversarial updates and maintaining the integrity of the aggregated model. Through these steps, FLAME effectively defends against backdoor attacks with minimal impact on the performance of benign updates.
FoolsGold [12]. FoolsGold is a consistency detection-based defense that identifies poisoning updates based on the diversity of client updates in the distributed learning process. Specifically, Updates with excessively high pairwise cosine similarity are assigned lower aggregation weights. Unlike prior work, FoolsGold does not bound the expected number of attackers, requires no auxiliary information outside of the learning process, and makes fewer assumptions about clients and their data.
FL.eteecor [43]. FL.ettector is defense mechanism designed to address the challenge of model poisoning attacks in FL., particularly when there is a large number of malicious clients. The core insight behind FLDetector that model poisoning attacks lead to inconsistent updates from malicious clients across multiple iterations. To identify these inconsistencies, FLDetector predicts each client's s model update in subsequent iterations based on its historical updates and flags a client as malicious if its updates deviate from the predicted values across several iterations. This approach allows FLDetector to accurately detect and remove malicious clients, ensuring that existing robust FL methods can continue to function effectively even under strong attack scenarios.
SeghSight [30]. Deep is model filtering approach designed mitigate backdoor attacks in FL without removing benign models from clients with diverse data distributions. Unlike existing defenses that simply exclude deviating models, DeepSight introduces three novel techniques to better characterize the data distribution behind model updates and measure subtle differences in the internal structure and outputs of neural networks (NNs). These techniques allow DeepSight to detect suspicious model updates effectively, Additionally, it employs a clustering scheme to group models and identify clusters that contain poisoned updates with high attack impact. By combining these insights, DeehSight can eliminate harmful model clusters, while also mitigating any residual backdoor effects using weight clipping defenses.
FedCLP [44]. CLP (Lipschitzness based Pruning) is a novel approach designed to detect and remove backdoor channels in deep neural networks (DNNs) without requiring any data. It introduces the concept of the Channel Lipschitz Constant (CLC), which measures the Lipschitz constant of the mapping from input images the output of each channel. By analyzing the correlation between an upper bound of the CLC (UCLC) and the activation changes caused by a backdoor trigger, CLP identifies potential backdoor channels. Since UCLC can be directly computed from the network's weight matrices, CLP operates in a completely data-free manner. Once these infected channels are detected, CLP prunes them to repair the model. This method is fast, simple, and robust, making an efficient solution for backdoor defense with minimal dependency on the choice of the pruning threshold. We adapt CLP to the FL setting and name it FedCLP. Specifically, we prune each local model using CLP to remove mackdoor-related information before aggregating them with FedAvg.
BackdoorIndicaton [21]. BackdoorIndicator is proactive backdoor detection mechanism specifi- cally designed for FL systems. This mechanism operates on the insight that deploying subsequent backdoors with the same target label can enhance the accuracy of existing backdoors. BackdoorIndi- cator enables the server to inject indicator tasks into the global model using out-of-distribution (OOD) data. Since any backdoor samples are inherently OOD concerning benign samples, the server, unaware of the specific backdoor types or target labels, can effectively detect backdoor presence in uploaded models by evaluating the performance of these indicator tasks. Through comprehensive empirical evaluations, BackdoorIndicator demonstrates consistently superior performance and practi- cality compared to existing baseline defenses across various system configurations and adversarial scenarios.
F Evaluation Metrics
We evaluate the performance of a defense using four metries: ACC, ASR, TPR, and FPR, each providing distinct perspectives on the effectiveness of the defense. Additionally, based on these metries, we introduce a novel metric called CAD, which offers a comprehensive view of the overall effectiveness of the defense.
24

---

ACC. ACC (Model Accuracy) is calculated as the proportion of correctly identified clean samples to the total number of clean samples. In federated learning, maintaining high accuracy is crucial, as reflects the model's overall performance in making correct predictions across all clients.
ASR. ASR (Attack Success Rate) measures the proportion of samples with triggers that are classified as the target label. A lower ASR indicates that the defense mechanism is effective in identifying and mitigating backdoor attacks. In federated learning scenarios, minimizing ASR is essential to ensure the system remains resilient against adversarial manipulation. It is important to note that in our experiments, we do not exclude samples corresponding to the target label, As a result, even for a clean model, the ASR does not approach 0 but rather tends toward 1/c (c represents the total number of classes).
TPR. TPR (True Positive Rate) measures the proportion of backdoor models that are correctly identified by the defense algorithm malicious. High TPR is indicative of the defense algorithm's effectiveness in accurately detecting backdoor models. A robust defense mechanism should achieve high TPR minimize the risk of allowing backdoor attacks to compromise the integrity of the model. This is critical for maintaining trust and reliability in federated learning environments.
FPR. FPR (False Positive Rate) measures the proportion of legitimate models that are incorrectly classified by the defense algorithm as backdoored. A low FPR is crucial as it indicates that the defense algorithm does not mistakenly flag benign models backdoored. In the context of federated learning, minimizing FPR is essential to prevent unnecessary disruptions to legitimate model updates and to maintain the overall functionality of the system.
CAD. CAD (Comprohensive Abilisty of Defense) composite metric that integrates the four aforementioned indicators to provide an overall assessment of a defense algorithm's 's performance. It is calculated as follows:
CAD = ACC + (1 A TTP++ (1 (1- FPR) X 100%.
4
This formulation captures a balanced view of accuracy, attack resistance, true positive detection, and false positive minimization.
is important to note that FoolsGold does not directly discard local models but assigns lower aggregation weights to suspected models. When calculating its TPR and FPR, we consider local models with an aggregation weight greater than 0.5 as selected by FoolsGold, otherwise, the model is deemed rejected. Additionally, FedCLP does not distinguish between benign and backdoor models, instead pruning all local models before aggregation. Therefore, TPR and FPR cannot be calculated for FedCLP, and we denote the values of these metrics as "_". For the CAD calculation of FedCL.P, we only consider ACC and ASR, i.e., CAD ACC+(1 (1-4(1))))) x 100%.
2
G Impact of data distribution
The previous experiments conducted using Dirichlet sampling parameter of a 0.9, which is the default setting recommended by 3DFed. To assess the impact of a broader range of data distributions on the performance of existing defenses, we follow BackdoorIndicator by considering three non-lID data distributions with a values of 0.2, 0.5, and 0.9. Notably, a smaller a indicates a higher degree of data heterogeneity. Additionally, we examine an IID data distribution (a = 10), scenario often overlooked by existing defenses. Figure 3 illustrates the data distribution of each client under different values of alpha. As shown in Table 6, overall, the performance of existing defenses gradually deteriorates as data heterogeneity increases. For instance, FLAME effectively counters 3DFed attacks with CAD of 86.09% at a 10, but it completely fails non-IID scenarios, with CAD of only around 30% While FedCLP can mitigate backdoor attacks, it also leads to varying degrees of ACC reduction, with more significant drops in non-III settings. Interestingly, we observe a counterintuitive phenomenon where FLDetector performs worse in IID scenarios; we speculate that this is because 3DFed makes fewer modifications to the backdoor models in IID settings, making the predicted models and backdoor models more similar, which causes FL FeDetector to mistakenly classify benign models as backdoor models. MARS consistently performs excellently across all data distributions, with CAD always above 93%.
25

---

10:9
Number of Samples
820
1500
Number
200
20
70
90
1.0
50
70
90
Client Indix
Client Index
am0.9
Q=10
1.000
6:0
500
Number Samples
Number of Samples
400
300
403
Figure 3: Dirichlet sampling with different a.
Table 6: Impact of data distribution on the performance exitsting defenses under 3DFed attack on CIFAR-10.
Metric
FedAvg
MultiKrum
RELBAT
FLAME
FoolsGold
FT.Detector
DeepSight
FedCLP
MARS
ACC
83.38
82.47
82.82
80.08
82.66
82.04
76.65
60.87
83,26
ASR
97.37
99.44
95.75
97.22
93.97
93.48
98.32
4,72
9.38
0.2
TPR
0.00
17.50
0.00
0.00
30.00
0.00
0.00
100.00
FPR
0.00
20.63
0.00
$6.25
60.63
0.00
43.75
0.00
CAD
46.50
44.98
46.77
31.65
39.51
47.14
33.65
78.07
93.47
ACC
84.24
81.88
83.58
83.41
83.60
84,89
83.89
73.28
84.66
ASR
98.39
96.40
97.49
96.72
98.28
91.79
90.11
10.28
9.90
0.5
TPR
0.00
0.00
0.00
0.00
0.00
0.00
100.00
FPR
25.00
0.00
$6.25
68.75
0.00
6.25
0.00
CAD
40.62
46.52
32.61
29.14
81.50
93.69
ACC
84.37
84.07
84,30
83.06
84.11
84.24
84.80
69.25
85.07
ASR
96.76
97.27
92.02
97.50
96.29
95.20
98.85
7.55
9.86
0,9
TPR
0.00
0.00
2.50
0.00
0.00
0.00
100.00
ACC
84.60
84.51
85.19
85.28
84.64
83.82
84.67
76.20
85.30
ASR
95.68
98.54
76.18
9.67
8.75
9.49
31.25
CAD
47.23
41.81
54.44
86.09
47.07
21.17
$2.09
83.73
93.95
26

---

H Sensitivity to hyperparameters
H.1 Impact of distance metric
In Section 4.5, illustrate with toy example that Wasserstein distance is more suitable for MARS compared to traditional Euclidean and cosine distances. To further substantiate our claim, we replace MARS's distance metric with Euclidean distance and cosine distance, keeping all other components constant. As shown in Table 7, both Euclidean and cosine distances fail to accurately detect backdoor updates, resulting in CAD of only around 44%. In contrast, when using Wasserstein distance, MARS achieves optimal performance with a CAD close to 94%. This supports our hypothesis that Wasserstein distance, which is insensitive to the order of elements, is more effective for detecting backdoor models in our scenario.
Table 7: Impact of distance metric MARS under CerP attack CIFAR- 10.
Dist.
ACC
ASR
TPR
FPR
CAD
Euc.
83.93
88.15
35,00
51.25
44.88
Cus.
84.29
82.05
32.50
58.13
44.15
Wass.
85.37
10.03
100.00
0.00
93.84
H.2 Sensitivity to
In Section 4.5, to avoid blindly removing cluster in von-adversarial scenarios, which could degrade model accuracy, we propose using inter-cluster distance to decide whether to retain all clusters, with an acceptable threshold set to As shown in Table 8, in the presence of attackers, MARS accurately distinguishes between benign and malicious models as long as c does not exceed 1. In non-adversarial scenarios, when c is no less than 0.03, MARS does not mistakenly classify any benign models as backdoor models. Therefore, setting e between 0.03 and ensures optimal performance for MARS. The wide range of acceptable values indicates that MARS is not highly sensitive to this parameter, making it easy to select an appropriate in real-world scenarios.
Table 8: Impact of e on MARS under 3DFed attack on CIFAR-10.
Metric
0.01
0.02
0.03
0.04
0.05
0.10
0.50
1.00
3,00
5.00
TPR
100.00
100.00
100.00
100.00
100.00
100.00
100.00
100.00
63.64
18.18
w/ attack
FPR
0.00
0.00
0.00
0.00
0.00
0.00
0.00
0.00
0.00
0.00
w/o attack
FPR
42.73
0.00
0.00
H.3
Sensitivity to K
Review that in Section 4.4, in order to concentrate backdoor activity and facilitate subsequent detection of backdoor models, we extract the top %% of BE values from each layer of local models, forming a one-dimensional vector called CBE. As shown in Table 9, when k is set to 10 or less, MARS achieves TPR of 100% and an FPR of 0%. indicating that MARS can precisely detect all backdoor models without mistakenly discarding any benign models. However, when K exceeds 20, MARS begins to miss some backdoor models, and in some cases, even misidentifies few benign models as backdoor ones. In real-world deployments, setting & to 10 or below ensures optimal performance (with the default in this paper being 5), which is easily achievable. Therefore, MARS is not highly sensitive to the choice of K.
Table 9: Impact of x MARS under 3DFed attack on CIFAR-10.
Metric
2
5
10
20
40
60
80
100
TPR
100.00
100.00
100.00
100.00
94.44
87.10
83.33
91.67
77.42
FPR
0.00
0.00
0.00
0.00
0.35
0.00
0.42
0.52
0.00
27

---

I Performance on ImageNet
In the main text, we evaluate the effectiveness of MARS on MNIST, CIFAR-10, and CIFAR- following the common practice in existing defenses such BackdoorIndicator and FLDetector. However, real-world datasets are typically more complex and challenging. Hence, it is essential assess the performance of MARS benchmark dataset and ReXNet as the network architecture. Regarding attacks, due to the lack of open-source code compatible with ImageNet for 3DFed and CerP, and after several attempts adapt their parameters to work with ImageNet without success, we focus solely on the MRA attack. On the defense side, compare MARS with FedAvg in both adversarial and non-adversarial (referred as the Baseline) settings. As shown in Table 10, with FedAvg, ASR escalates from 0.14% to 98.54% as training progresses, highlighting the significant threat posed by MRA federated learning systems. However, when MARS is deployed on the central server, ACC remains consistently above 75%, and ASR is reduced around 0. 1,, comparable to the Baseline. This demonstrates that MARS is effective even when applied to large-scale datasets like ImageNet.
larger, more intricate datasets. We ImageNet as the
Table 10: Comparison of MARS under MRA attack on ImageNet.
Round
Defense
ACC
ASR +
TPR 1
FPR
CAD
FedAvg
69.54
0.14
0.00
0.00
67.35
MARS
75,87
0.10
100.00
0.00
93.94
Baseline
76.25
0.08
FedAvg
74.64
1.05
0.00
0.00
68.40
10
MARS
75.47
0.12
100.00
0.00
93.84
Baseline
75.85
0.08
FedAvg
73.81
19.94
0.00
0.00
63.47
MARS
75.44
0.12
100.00
0.00
93.83
Baseline
75.89
0.08
FedAvg
73.91
84.12
0.00
0.00
47.45
30
MARS
75.49
0.12
100.00
0.00
93.84
Baseline
75.59
0.08
FedAvg
74.19
95.59
0.00
0.00
44.65
40
MARS
75.22
0.12
100.00
0.00
93.78
Baseline
75.34
0.08
FedAvg
73.73
98.54
0.00
0.00
43.80
50
MARS
75.14
0.12
100.00
93.76
Baseline
75.26
0.08
Computational and Communication Overheads of MARS
MARS does not require clients upload anything other than model parameters, resulting in additional communication overhead compared to existing defenses such as FedAvg. In terms of computational overhead, the aggregation time required by MARS (including BE computation, CBE formation, Wasserstein- based clustering, and the final aggregation to obtain the new global model) is shorter than that of most existing defenses. Table 11 presents results on the CIFAR-I0 dataset with ResNet-18 model, a total of 100 clients, 20 of whom are attackers, with 20 clients randomly sampled per round. We recorded the average runtime per round for each defense method. As shown. MARS, FedAvg, and FLAME complete aggregation within 7 seconds, while the other six defenses require longer aggregation time, with DeepSight taking as much as 101.69 seconds. The rapid runtime of MARS is achieved through several key tricks. First, we extract the top-*% of BE values to form CBE, which significantly reduces the time needed for subsequent Wasserstein- estimate BE values only for convolutional and bn layers, ignoring the fully connected layers that
clustering. Second,
28

---

are the most time-consuming Third, inspired by the work "Rethinking Lipschitzness for Data-free Backdoor Defense" (submited ICLR 2025), we optimize the computation of the Lipschitz constant using dot product properties.
Table 11: Average runtime per round
Defense
Time per round (8)
FedAvg
2.07
MultiKrum
28.87
RFLBAT
39.19
FLAME
3.87
FoolsGold
7.05
FLDetector
18.91
DeepSight
101.69
FedCLP
38.81
MARS
6.57
K Performance on NLP Task
In this section, we add an evaluation MARS on the IMDB dataset, using LSTM as the model structure. As shown in Table 12, MARS is also applicable text data, achieving performance comparable to FedAvg in the non-adversarial scenario.
Table 12: Performance on IMDB dataset
Defense
ACC
ASR
TPR
FPR
CAD
FedAvg
73.89
100.00
0.00
0.00
43.47
FedAvg (non-adversarial scenario)
74.42
56.87
MARS
74.11
57.91
100.00
0.00
79.05
L Evaluation against More Attacks
In this section, evaluate four additional attacks. They are Dyn-Attack, A3FL [42], Chameleon [8]. sematic backdoor attack [3], and partial layer attack.
L.1 Performance on Dyn-Attack
We introduce a new attack method, named Dyn-Autakk. Specifically, each attacker randomly selects one of four strategies: 3DFed, CerP, MRA, attack. As shown in Table 13, MARS performs comparably to FedAvg in the non-adversarial scenario.
Table 13: Performance under Dyn-Attack
Defense
ACC
ASR
FedAvg (non- non-aadvesarial scenario)
85,26
9.34
MARS
85.10
10.19
L.2 Performance under A3FL
Recently, optimized backdoor attacks have gained widespread attention for enhancing stealth by refining triggers. A3FL stands out as notable example. Table 14 presents MARS's defense performance against A3FL, demonstrating its ability to effectively and completely neutralize the attack.
29

---

Table 14: Performance under A3FL
Defense
ACC
ASR
TPR
FPR
CAD
FedAvg
83.07
98.53
0.00
0.00
46.14
MARS
85.01
9.92
99.19
0.00
93.57
L.3 Performance under Chameleon
Recently, increasing attention has been given to the persistence of backdoor attacks. Once a backdoor successfully injected, the global model can maintain certain attack success rate even if the attacker does not participate in federated learning for multiple rounds. Chamelcon is prominent example of such attacks. To assess MARS's ability to defend against this type of threat, we evaluated its performance under Chameleon attacks. As shown in Table 15, MARS effectively mitigates Chameleon attacks.
Table 15: Performance under Chameleon
Defense
ACC
ASR
TPR
FPR
CAD
FedAvg
83.61
78.00
0.00
0.00
51.40
FedAvg inon-adversarial scenario)
85.29
10.15
MARS
85.22
11.08
98.89
0.28
93.19
L.4 Performance under semantic backdoor attack
We further evaluate MARS against semantic backdoor attack CIFAR-10. In this attack, with vertically striped walls in the background are misclassified as birds. As shown in Table 16, MARS effectively mitigates this semantic backdoor attack.
Table 16: Performance under semantic backdoor attack
Defense ACC
ASR
TPR
FPR
CAD
FedAvg
85.69
80.00
0.00
51.42
0.00
MARS
85.97
0.00
100.00
96.49
0.00
L.5 Performance under partial layer attack
For efficiency, our implementation of MARS omits detection on the most time-consuming fully- connected layers. This optimization, however, creates potential vuinerability where attacker might launch a "partial layer attack." " To analyze this threat, we specifically evaluate the following attack strategies.
FC-only
1Conv+FC
2C
3Convs+FC
4Convs+FC
All layers (i.e., full-parameter attacks)
As detailed in Table 17, when an attacker injects backdoor exclusively into the FC layer, MARS (partial-layery) fails to detect the malicious updates (TPR 0.00%, FPR 100.00%), since it ignores the manipulated layers. However, the attack itself unsuccessful: the ASR drops just 9. 9.86%, while clean accuracy also suffers. This suggests that injecting a backdoor using only the FC layers fails to achieve both stealth and effectiveness. We hypothesize that this is due the limited expressive capacity of isolated FC-layer tuning: the convolutional layers generate nearly identical features for
30

---

clean sample and the corresponding triggered sample, making it difficult for the final layer alone to simultancously satisfy both objectives (i.e., clean accuracy and attack success). When the attacker modifies one or two Conv blocks in addition to the FC layer, the resulting attack is still weak (e.g.. ASR 12.36% and 56. 56.60% respectively, under FedAvg). Nonetheless, both MARS (partial-layers) and MARS (all-layers) consistently achieve 100% TPR and 0% FPR, demonstrating strong resilience against these more involved but still low-intensity attacks. When more Conv blocks are compromised. and especially when all parameters are manipulated, the attack becomes significantly more effective (e.g., ASR = (9.68%) ). However, MARS still maintains perfect detection performance, with 100% TPR and 0% FPR in all such cases. This suggests that stronger malicious behavior actually makes detection easier for MARS, further validating its robustness.
Table 17: Performance uner partial layer attack
Attack Strategy
Defense
ACC f
ASR L
TPR
FPR
MARS (partial-layers)
82.74
9.86
0.00
100.00
FC only
MARS (all-layers)
85,29
9.25
100.00
25.00
FedAvg
85.33
9.91
0.00
0.00
MARS (partial-layers)
85.48
9.34
100.00
0.00
1Conv+FC
MARS (all-layers)
85.46
9.49
100.00
0.00
FedAvg
84.51
12.36
0.00
0.00
MARS (partial-layers)
85.51
9.55
100.00
0.00
2Convs+FC
MARS (all-layers)
85.57
9.32
100.00
0.00
FedAvg
84.32
56.60
0.00
0.00
MARS (partial-layers)
85.37
9.49
100.00
0.00
3Convs+FC
MARS (all-layers)
85.55
9.41
100.00
0.00
FedAvg
84.94
91.45
0.00
0.00
MARS (partial-layers)
85.54
9.23
100.00
0.00
4Convs+FC
MARS (all-layers)
85.56
9.14
100.00
0,00
FedAvg
85.32
96.17
0.00
0,00
MARS (partial-layers)
85.16
9.40
100.00
0.00
All layers
MARS (all-layers)
85.28
9.67
100.00
0.00
FedAvg
78.32
99.68
0.00
0.00
M
Evaluation against Byzantine Attacks
Although our paper primarily focuses on backdoor defense in federated learning, we believe MARS also holds promise for resisting Byzantine attacks. As illustrated in MAB-RFL [34], Byzantine defense is essentially an anomaly detection problem high-dimensional data. One common defense approach is to extract key information from local models to obtain oww-dimesiional representations, which facilitate the subsequent calculation of anomaly scores or clustering. In MARS, the process of calculating BE/CBE serves similar purpose by extracting discriminative representations that distinguish benign from malicious models. Intuitively, this suggests that MARS could be effective in mitigating Byzantine failures.
To further validate this intuition, we simulated CIFAR- 10 federated learning scenario with 100 clients, where 20% are attackers, and 20% of clients participate in each round over 100 rounds. We considered two typical Byzantine attacks:
Label Flipping Attack (LFA) [32]: a data poisoning attack.
Little Is Enough (LIE) [4]: a model poisoning attack known for its high stealth and destruc- tiveness.
For defense, we compared FedAvg (evaluated benign scenario as the baseline), Multi-Krum, and MARS.
31

---

In the LFA scenario (see Table 18), MARS achieved true positive rate (TPR) of 80% and false positive rate (FPR) 1.25%. slightly lower detection performance than Multi- However, both methods yielded similar global accuracy (ACC), because L.A's relatively low maliciousness means that missing few malicious updates does not significantly impact ACC.
Table 18: Performance under LFA
Defense
ACC
TPR
FPR
Baseline 63.47
MARS
60.56
80.00
1.25
FedAvg
53.57
0.00
0.00
Multi-Krum
60.73
100.00
0.00
In contrast, for the more potent and stealthy LIE scenario (see Table 19), Multi-Krum's TPR was 0%-it failed to detect malicious models, and its ACC dropped dramatically (even falling below FedAvg). Meanwhile, MARS achieved 100% TPR and 0% FPR, reliably distinguishing malicious models from benign ones in every round.
Table 19: Performance under LIE
Defense
ACC
TPR
FPR
Baseline
63.47
MARS
60.87
100.00
0.00
FedAvg
41.26
0.00
0.00
Kulti-Krum
34.17
0.00
25.00
worth noting that in both attack scenarios, MARS's ACC approximately 3% lower than the baseline FedAvg. This difference is expected, as the baseline was evaluated under attack-free conditions with a higher proportion of benign clients (approximately 25% more per round), which naturally results in better accuracy and faster convergence.
In summary, while MARS was designed for backdoor defense, its underlying representation- saseeettttio-baaeedd anomaly detection mechanism suggests that it can also serve as a robust defense against Byzantine adversaries.
Table 20: Performance on VIT
Round
Defense
ACC 1
ASR
TPR 1
FPR 1
FedAvg
24.79
8.24
0.00
0.00
1
MARS
96.98
9.93
100.00
0.00
Baseline
97.36
10.01
FedAvg
94.31
99.59
0.00
0.00
5
MARS
97.69
10.00
100.00
0.00
Baseline
97.91
10.02
FedAvg
96.03
99.89
0.00
0.00
10
MARS
97.88
9.98
100.00
0.00
Baseline
98.08
9.98
FedAvg
96.62
99.89
0.00
0.00
15
MARS
97.97
10.00
100.00
0.00
Baseline
98.11
9.99
FedAvg
96.82
99.85
0.00
0.00
20
MARS
97.93
9.99
100.00
0.00
Baseline
98.08
10.00
32

---

Performance on VIT
To demonstrate that MARS scales Vision Transformer architectures, we evaluated it on a pre-trained VIT model using the Hugging Face Transformers library. Specifically, we loaded
VATFor.laagClaassffaaaaoo.. num num__abels=10, ignore_mi aatoore_mimmatchheeeee wwt.://mmmmmccceeeseeeeeeeee
and fine-tuned on CIFAR-IO. This VIT contains very high proportion linear layers (99.09% of its parameters), MARS remains fully applicable. As shown in Table 20, MARS on ViT achieves detection performance comparable to Baseline (i.e., FedAvg in attack-fre scenario), confirming its effectiveness large-scale models.
33


Reviews:
[{"review_id": "MFbr8HLusW", "reviewer": "Reviewer_xx46", "summary": "This paper presents MARS, a novel defense mechanism against backdoor attacks in Federated Learning (FL). The core idea is to use a new metric called Backdoor Energy (BE), which captures the malignancy level of individual neurons, and to extract a Concentrated Backdoor Energy (CBE) vector for each model. Models are then clustered via Wasserstein distance-based K-means (K-WMeans), allowing the server to detect and exclude backdoored updates. Experimental results show strong defense performance against state-of-the-art attacks like 3DFed and CerP, with extensive evaluation and ablation experiments.", "questions": "How does MARS perform if benign updates contain high-magnitude neurons due to data heterogeneity? \n\nCould this lead to false positives?\n\nCould this method generalize to detecting other stealthy behaviors (e.g., model inversion or privacy leakage)?\n\nHow sensitive is the model performance to the percentage of top BE values (e.g., κ = 5%)? Are results robust to this choice?\n\nConsider including runtime/efficiency information.", "limitations": "Yes", "rating": 4, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "Strengths:\n•\tThe paper departs from conventional defenses relying on empirical statistics (e.g., norm, cosine similarity) and instead introduces a theoretically motivated malignity-aware metric (BE), leading to a more fundamental defense approach.\n•\tThe method does not require access to clean data or the backdoor trigger, solving a key practical limitation in existing defenses.\n•\tProvides a formal upper bound for BE under Lipschitz smoothness, offering a clean justification for using layer-wise Lipschitz norms.\n•\tThe use of Wasserstein distance in clustering CBEs overcomes limitations of Euclidean/cosine distances, particularly in handling unordered high-magnitude components across neurons.\nWeaknesses:\n•\tAlthough briefly referenced in the appendix, the computational cost of computing Lipschitz constants and Wasserstein distances for all neurons/models needs more discussion in the main paper. Can it scale to large models like ViT or LLMs?\n\n•\tWhile the paper justifies approximating BE with Lipschitz norms, the assumption that relative ordering is preserved may not always hold, especially in deep networks with normalization layers. Some discussion or empirical validation would be helpful.\n•\tThe definition of “Backdoor Energy” is somewhat abstract. A diagram or intuition about what a “malignant neuron” looks like (activation-wise) might help reader understand the intuition.", "was_revised": true, "final_justification": "After reading the rebuttal and I appreciate the authors' effort to address my concerns. I will keep my original score.", "rebuttal": "***We sincerely thank Reviewer xx46 for the thoughtful review and the positive rating. We hope our responses are helpful in addressing your concerns and would be happy to discuss if anything remains unclear.***\n\n>**Although briefly referenced in the appendix, the computational cost of computing Lipschitz constants and Wasserstein distances for all neurons/models needs more discussion in the main paper.**\n\nThank you for this valuable suggestion. We have added a discussion of the computational cost of computing Lipschitz constants and Wasserstein distances to the main text:\n\nCost of computing the Lipschitz constant\nFor an $m×n$ weight matrix, we approximate its Lipschitz constant via the power-iteration method. Each iteration involves one matrix–vector multiplication at cost $O(mn)$; after k iterations, the total complexity is $O(kmn)$.\nCost of computing the Wasserstein distance\nGiven two n-dimensional vectors, we first sort each in ascending order at cost O(nlogn), then compute and sum the absolute differences element-wise at cost $O(n)$. The overall complexity is therefore $O(nlogn)+O(n)=O(nlogn)$.\n\nIn the final manuscript, we will also report actual timing results from our experiments and include implementation details in the appendix, so that readers can clearly assess the efficiency of our approach. Thank you again for your insightful feedback.\n\n>**Can it scale to large models like ViT or LLMs?**\n\nThank you for raising this important point. To demonstrate that MARS scales to Vision Transformer architectures, we evaluated it on a pretrained ViT model using the Hugging Face Transformers library. Specifically, we loaded \n\n**ViTForImageClassification.from_pretrained( 'google/vit-base-patch16-224-in21k',num_labels=10,ignore_mismatched_sizes=True)**\n\nand fine-tuned it on CIFAR-10. This ViT contains a very high proportion of linear layers (99.09% of its parameters), so MARS remains fully applicable. As shown in Table 1.1, MARS on ViT achieves detection performance comparable to Baseline (i.e., FedAvg in attack-free scenario), confirming its effectiveness on large-scale models. We will include this experiment (and its detailed results) in the revised manuscript.\n\nTable 1.1 Performance on ViT\n| Round | Defense  | ACC    | ASR    | TPR    | FPR   |\n| ----- | -------- | ------ | ------ | ------ | ----- |\n| 1     | FedAvg   | 24.79  | 8.24   | 0.00   | 0.00  |\n|       | MARS     | 96.98  | 9.93  | 100.00 | 0.00 |\n|       | Baseline | 97.36 | 10.01 | -       | -      |\n| 5     | FedAvg   | 94.31  | 99.59  | 0.00   | 0.00  |\n|       | MARS     | 97.69  | 10.00  | 100.00 | 0.00  |\n|       | Baseline | 97.91  | 10.02 | -       | -      |\n| 10    | FedAvg   | 96.03  | 99.89  | 0.00  | 0.00  |\n|       | MARS     | 97.88  | 9.98   | 100.00 | 0.00 |\n|       | Baseline | 98.08 | 9.98   | -       | -      |\n| 15    | FedAvg   | 96.62  | 99.89  | 0.00  | 0.00  |\n|       | MARS     | 97.97  | 10.00  | 100.00 | 0.00 |\n|       | Baseline | 98.11  | 9.99   | -       | -      |\n| 20    | FedAvg   | 96.82  | 99.85  | 0.00   | 0.00  |\n|       | MARS     | 97.93  | 9.99   | 100.00 | 0.00 |\n|       | Baseline | 98.08  | 10.00  | -       | -      |\n\n>**While the paper justifies approximating BE with Lipschitz norms, the assumption that relative ordering is preserved may not always hold, especially in deep networks with normalization layers. Some discussion or empirical validation would be helpful.**\n\nThank you for pointing this out. We believe there may be a misunderstanding: our method does not rely on preserving the relative ordering of backdoor energies. Instead, by using Wasserstein distance based clustering, MARS is inherently order‐insensitive. For example, in our toy example(line 263) we show two CBE vectors,L₁ = [1, 2, 3, 4, 5], L₂ = [5, 5, 3, 2, 2], they differ greatly element-wise yet have nearly identical Wasserstein distances and are correctly assigned to the same cluster.\n\nMoreover, all of our main experiments on CIFAR-10 and CIFAR-100 use ResNet-18—an architecture with batch-normalization layers—and still demonstrate strong defense performance, confirming that MARS remains effective even when standard normalization may disrupt simple ordering assumptions. We will clarify this point in the revised manuscript.\n\n>**The definition of “Backdoor Energy” is somewhat abstract. A diagram or intuition about what a “malignant neuron” looks like (activation-wise) might help reader understand the intuition.**\n\nThank you for this helpful suggestion. We agree that a visual intuition can greatly aid understanding. In the revised manuscript, we will include a schematic illustration to show typical activation patterns of “malignant” versus benign neurons.\n\n>**How does MARS perform if benign updates contain high-magnitude neurons due to data heterogeneity? Could this lead to false positives?**\n\nThank you for raising this important concern. We have evaluated the impact of data heterogeneity on MARS in Appendix G (page 17). As shown in Fig. 3, when using a Dirichlet sampling parameter of $\\alpha = 0.2$—which induces extreme heterogeneity across client data distributions—existing defenses suffer dramatic performance degradation. In contrast, MARS maintains a true-positive rate (TPR) of 100% and a false-positive rate (FPR) of 0% under these highly heterogeneous conditions. This result demonstrates that MARS’s Wasserstein-distance–based clustering remains robust even when benign updates contain high-magnitude neurons due to non-IID data.\n\n>**Could this method generalize to detecting other stealthy behaviors (e.g., model inversion or privacy leakage)?**\n\nThank you for this insightful question. MARS is primarily designed to detect backdoor attacks, but in our experiments we also observed strong defense against Byzantine attacks (see Appendix M, page 22), successfully mitigating both data-poisoning and model-poisoning threats.\nHowever, the current version of MARS cannot directly detect other stealthy behaviors such as model inversion or privacy leakage. These threats are typically addressed on the client side—for example, by adding Gaussian noise, applying Top-kkk sparsification, or clipping sensitive parameters before uploads—whereas MARS operates on the server side and does not modify or inspect client-side parameter updates in that manner.\nExtending MARS to cover privacy-related attacks is an interesting direction for future work, and we plan to explore how MARS could be adapted or combined with client-side defenses to detect or mitigate such stealthy behaviors.\n\n>**How sensitive is the model performance to the percentage of top BE values (e.g., $\\kappa = 5%$)? Are results robust to this choice?**\n\nThank you for this valuable question. As shown in Table 9 (page 19), when $\\kappa$ varies between 1% and 10%, MARS consistently achieves a 100% true-positive rate (TPR) and 0% false-positive rate (FPR). However, when $\\kappa$ is increased to 20%, the TPR slightly decreases to 94.44% and the FPR rises to 0.35%. For even larger $\\kappa$, we observe further fluctuations in both TPR and FPR, never quite matching the optimal performance seen at lower values.\n\nThis behavior arises because including too many “irrelevant” backdoor energy values dilutes the Wasserstein-distance calculation and thus impairs the K-WMeans clustering. Crucially, since $\\kappa$ values from 1% to 10% all yield the best possible defense metrics, we conclude that MARS’s performance is indeed robust to the choice of $\\kappa$ within this range. We will clarify these findings in the revised manuscript.\n\n>**Consider including runtime/efficiency information.**\n\nThank you for the suggestion. We have empirically evaluated MARS’s runtime in Appendix J (page 20), demonstrating that it runs faster than existing defenses under the same experimental settings. Furthermore, as noted above, we will also add a dedicated discussion of the computational cost of computing Lipschitz constants and Wasserstein distances to the main paper to give readers a clear picture of our method’s efficiency."}, {"review_id": "TZAYPXw811", "reviewer": "Reviewer_oRiw", "summary": "The paper proposes MARS, a defense against backdoor attacks in federated learning. Unlike prior methods relying on weak statistical heuristics, MARS uses backdoor energy (BE) to quantify neuron-level malignancy and clusters models via Wasserstein distance on concentrated BE (CBE). It reliably detects backdoor models without clean data or attacker ratio assumptions. Experiments show MARS outperforms 8 SOTA defenses, including against adaptive and high-ratio attacks.", "questions": "1. The paper assumes an \"FL system with only attackers is meaningless\". However, a 100% attacker scenario is plausible (though rare) and falls within your threat model where attackers can constitute a majority. How does MARS ensure effectiveness in such a scenario, where all malicious models might be misclassified as benign?\n2. MARS fails against adaptive attacks with λ≥0.05. While MARS* uses a majority-based selection, this reintroduces the benign-majority assumption that MARS aims to avoid. Given the defender's minimal knowledge of attacker proportion and λ, how can the correct strategy (MARS vs. MARS*) be reliably chosen in practice?", "limitations": "The paper's threat model assumes a practical and challenging scenario where \"Attackers can constitute a majority, with their proportion not restricted to below 50% as typically assumed in existing research\". However, the proposed MARS defense, as detailed in the \"Weaknesses\" and \"Questions\" raised in the review, appears to have significant limitations in fully addressing this threat model:\n1. MARS's cluster selection strategy assumes that if the Wasserstein distance between clusters is low, \"all local models are considered benign\". This implicitly contradicts the threat model by assuming an \"meaningless\" system in an all-attacker scenario, potentially leading to a complete compromise if 100% of clients are malicious yet their CBEs are similar. This is a crucial gap given the majority attacker assumption.\n2. While MARS* is introduced to counter adaptive attacks with high λ values, its reliance on a majority-based selection reintroduces the very assumption the initial MARS design aimed to avoid. The defender's \"minimal knowledge\" about attacker proportion and λ means there's no clear mechanism for reliably switching between MARS and MARS* strategies. This leaves the defense's robustness compromised across the full range of adversarial scenarios outlined in the threat model.", "rating": 4, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 2, "clarity": 2, "significance": 2, "originality": 2, "strengths_and_weaknesses": "Strengths:\nIt proposes a novel and practical backdoor energy (BE) metric that avoids reliance on clean data.\nThe clustering method is well-suited to unordered representations via Wasserstein distance.\nThe method is validated through thorough experiments across datasets and challenging attack settings.\n\nWeaknesses:\n1. MARS relies on Lipschitz-based backdoor energy, which becomes unreliable in architectures like Vision Transformers due to the complex, input-dependent nature of self-attention and normalization layers.\n2. MARS assumes that all clients use structurally similar models, but in practice, heterogeneous client architectures may yield incomparable backdoor energy profiles.\n3. The paper states that if the Wasserstein distance between the two clusters does not exceed a threshold ϵ, \"all local models are considered benign\". This decision operates under the assumption that \"an FL system with only attackers is meaningless\". However, an FL system comprised solely of attackers is not necessarily \"meaningless\" in an adversarial context; it represents an extreme, albeit plausible, attack scenario where all participating clients are compromised. In such a situation, even if all clients in an FL system are malicious, it is plausible for their Concentrated Backdoor Energy (CBE) distributions to be sufficiently similar such that the inter-cluster distance falls below ϵ. In this scenario, where all local models are, in fact, malicious, MARS would mistakenly classify them all as benign, allowing a complete compromise. This directly contradicts the paper's own threat\nmodel, which explicitly states that \"Attackers can constitute a majority, with their proportion not restricted to below 50% as typically assumed in existing research\", as a 100% attacker scenario clearly falls within this majority condition.\n4. In the \"Resilience to adaptive attack\" section, MARS fails significantly (TPR 0%, FPR ~100%) when the adaptive attack's regularization coefficient λ is increased to 0.05 or higher. This indicates a critical failure of MARS when attackers effectively minimize their backdoor energy. While MARS* is introduced as a modification employing a majority-based cluster selection, this reintroduces the very assumption (implicit reliance on a benign majority) that the initial MARS design aimed to avoid. Given the threat model explicitly allows attackers to \"constitute a majority, with their proportion not restricted to below 50%” and the defender has \"minimal knowledge\" about the proportion of attackers, the defense faces a dilemma when λ is increased to 0.05 or higher. The defender cannot reliably determine when to switch strategies, nor can they consistently rely on a benign majority under the defined threat model. This compromises MARS's robustness across all adversarial scenarios outlined.", "was_revised": true, "final_justification": "The rebuttal addresses most of my concerns and I have elevate my rating accordingly. Thank you for your efforts!", "rebuttal": "***We sincerely thank Reviewer oRiw for the thoughtful review. We hope our responses are helpful in addressing your concerns and would be happy to discuss if anything remains unclear.***\n\n>**MARS relies on Lipschitz-based backdoor energy, which becomes unreliable in architectures like Vision Transformers due to the complex, input-dependent nature of self-attention and normalization layers.**\n\nThank you for raising this important point. To demonstrate that MARS scales to Vision Transformer architectures, we evaluated it on a pretrained ViT model using the Hugging Face Transformers library. Specifically, we loaded \n\n**ViTForImageClassification.from_pretrained( 'google/vit-base-patch16-224-in21k',num_labels=10,ignore_mismatched_sizes=True)**\n\nand fine-tuned it on CIFAR-10. This ViT contains a very high proportion of linear layers (99.09% of its parameters), so MARS remains fully applicable. As shown in Table 2.1, MARS on ViT achieves detection performance comparable to Baseline (i.e., FedAvg in attack-free scenario), confirming its effectiveness on large-scale models. We will include this experiment (and its detailed results) in the revised manuscript.\n\nTable 2.1 Performance on ViT\n| Round | Defense  | ACC    | ASR    | TPR    | FPR   |\n| ----- | -------- | ------ | ------ | ------ | ----- |\n| 1     | FedAvg   | 24.79  | 8.24   | 0.00   | 0.00  |\n|       | MARS     | 96.98  | 9.93  | 100.00 | 0.00 |\n|       | Baseline | 97.36 | 10.01 | -       | -      |\n| 5     | FedAvg   | 94.31  | 99.59  | 0.00   | 0.00  |\n|       | MARS     | 97.69  | 10.00  | 100.00 | 0.00  |\n|       | Baseline | 97.91  | 10.02 | -       | -      |\n| 10    | FedAvg   | 96.03  | 99.89  | 0.00  | 0.00  |\n|       | MARS     | 97.88  | 9.98   | 100.00 | 0.00 |\n|       | Baseline | 98.08 | 9.98   | -       | -      |\n| 15    | FedAvg   | 96.62  | 99.89  | 0.00  | 0.00  |\n|       | MARS     | 97.97  | 10.00  | 100.00 | 0.00 |\n|       | Baseline | 98.11  | 9.99   | -       | -      |\n| 20    | FedAvg   | 96.82  | 99.85  | 0.00   | 0.00  |\n|       | MARS     | 97.93  | 9.99   | 100.00 | 0.00 |\n|       | Baseline | 98.08  | 10.00  | -       | -      |\n\n>**MARS assumes that all clients use structurally similar models, but in practice, heterogeneous client architectures may yield incomparable backdoor energy profiles.**\n\nThank you for raising this important point. We would like to clarify that MARS does not require all clients to use the same network architecture. While many existing defenses—such as Multi-Krum (which computes pairwise Euclidean distances) or FoolsGold (which relies on cosine similarity)—indeed break down when models differ structurally, MARS operates on the distribution of backdoor energies rather than on raw parameter vectors. Specifically, in Eq. (5) we use the Wasserstein distance to compare each client’s CBE profile. Since the Wasserstein distance measures the distance between two distributions, it naturally accommodates vectors of differing lengths or supports. For instance, consider the toy example in the paper: assume that $L_1=[1,3,4,5]$ (originally [1,2,3,4,5] with one layer missin) and  $L_2=[5,5,2]$ (originally [5,5,4,3,2] with two layers missing) are the CBEs of backdoor models, while  $L_3=[1,1,1,1,1]$ (the complete model) is the CBE of a benign model. According to Eq. (5), we obtain $\\mathrm{Wass}(L_1, L_2) = 1.75$, $\\mathrm{Wass}(L_1, L_3) = 2.25$, $\\mathrm{Wass}(L_2, L_3) = 3.00$, allowing us to cluster the more similar $L_1$ and $L_2$ together. This demonstrates that MARS can effectively distinguish backdoored from benign clients even when their architectures—and thus the dimensionality of their BE vectors—differ. We will clarify this in the revised manuscript.\n\n>**The paper assumes an \"FL system with only attackers is meaningless\". However, a 100% attacker scenario is plausible (though rare) and falls within your threat model where attackers can constitute a majority. How does MARS ensure effectiveness in such a scenario, where all malicious models might be misclassified as benign?**\n\nThank you for highlighting this edge case. We acknowledge that MARS, like nearly all existing defenses, cannot recover a clean global model if all clients are malicious—an FL setting in which no honest update exists to guide aggregation. We consider a 100%–attacker scenario to be fundamentally impractical, because without any benign contributions an FL system cannot produce a useful model, irrespective of defense strategy. For context, FLTrust (NDSS ’21) evaluates up to 95% attackers and BackdoorIndicator (USENIX Security ’24) up to 60%, and both require external “trusted” or out-of-distribution data to function. In contrast, MARS can tolerate over 50% malicious clients without any auxiliary dataset—an advancement we believe represents a significant step forward. We will clarify in the revision that handling a 100%–attacker case lies outside the scope of our threat model and is shared by prior work.\n\n>**MARS fails against adaptive attacks with $\\lambda \\ge 0.05$. While MARS* uses a majority-based selection, this reintroduces the benign-majority assumption that MARS aims to avoid. Given the defender's minimal knowledge of attacker proportion and λ, how can the correct strategy (MARS vs. MARS *) be reliably chosen in practice?**\n\nThank you for this perceptive observation. As reported in Table 3 of our paper, when the adaptive attacker increases the regularization coefficient to $\\lambda \\ge 0.05$, MARS indeed swaps the labels of benign and malicious updates—but in that regime, the aggregated global model’s ACC plunges to just 10%. Such a collapse violates the key stealth requirement of backdoor attacks (i.e., remaining accurate on clean data while misbehaving only on triggered inputs), meaning the attack itself is no longer successful or realistic.\n\nMoreover, empirical studies in production‐scale federated learning—most notably “Back to the drawing board: A critical evaluation of poisoning attacks on production federated learning” (IEEE S&P ’22)—show that real‐world adversaries rarely control more than 10 % of clients. Under these practical conditions, MARS*’s majority‐based cluster selection is both justified and effective. We will clarify these points in the revised manuscript to emphasize that (1) overly aggressive minimization of backdoor energy undermines the attack’s stealth and (2) in realistic threat settings where attackers form a small minority, MARS* provides robust defense."}, {"review_id": "pXIITS2X6b", "reviewer": "Reviewer_hznG", "summary": "This paper introduces MARS, a novel defense mechanism against backdoor attacks in FL. The core problem addressed is the failure of existing defenses against adaptive attacks that mimic benign model updates. The authors propose a new metric, \"backdoor energy\" (BE), to quantify the maliciousness of individual neurons within client models. By concentrating the highest BE values into a \"concentrated backdoor energy\" (CBE) vector and employing Wasserstein distance-based clustering, MARS aims to effectively distinguish and exclude malicious updates from the global aggregation process. The experimental results, conducted on several standard datasets, show that MARS outperforms a wide range of state-of-the-art defenses, particularly against strong adaptive attacks.", "questions": "1. To substantiate the claim that K-WMeans effectively separates clients, could the authors provide a visualization (e.g., a heatmap) of a real, pairwise Wasserstein distance matrix computed on the CBE vectors from one of the main experimental settings (e.g., CIFAR-10)? This would provide more direct and compelling evidence of client separability than a toy example and greatly strengthen the justification for the core defense mechanism.\n2. Could the authors elaborate on the rationale for excluding fully connected layers from the BE calculation? To validate this design choice, could you provide an ablation study comparing the defense performance (both ACC and ASR) and computational cost when MARS is applied to (a) only convolutional/BN layers versus (b) all layers, including FC layers? Does this selective approach create an exploitable loophole for attackers to plant backdoors in the final layers of a network?", "limitations": "yes", "rating": 4, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 2, "originality": 3, "strengths_and_weaknesses": "Strengths\n- The paper correctly identifies a critical flaw in existing defenses: their reliance on statistical metrics (like model norm or cosine similarity) that advanced adaptive attacks can easily evade. The motivation for a new, \"malignity-aware\" approach is well-argued and empirically supported.\n- The introduction of \"backdoor energy\" (BE) as a metric sensitive to trigger-related neuron activity is innovative. The subsequent steps of forming a concentrated BE (CBE) vector to amplify the malicious signal and using Wasserstein distance for clustering are logical and effective. The choice of Wasserstein distance is particularly well-justified, as it provides a more robust measure for comparing the distributions found in CBE vectors compared to standard Euclidean or cosine metrics.\n- The paper presents a robust evaluation against eight SOTA defenses across multiple datasets and a diverse set of attacks, including challenging adaptive ones. The results consistently demonstrate MARS's superiority in maintaining high main task accuracy (ACC) while achieving a low attack success rate (ASR).\nWeaknesses\n- The paper argues for the use of Wasserstein distance and the K-WMeans algorithm but primarily supports this with final performance metrics (ACC/ASR). To make the core mechanism more transparent and convincing, the paper would benefit from showing direct evidence of separability. A toy example or a conceptual illustration is insufficient to prove its effectiveness in a real, complex scenario. The absence of a real Wasserstein distance matrix from the experiments leaves a gap between the method's description and its empirical validation.\n- The paper states that Backdoor Energy (BE) values are calculated only for convolutional and batch normalization layers, while ignoring the fully connected (FC) layers. This introduces a significant potential vulnerability: an attacker aware of this design could craft a backdoor that concentrates its malicious impact within the ignored FC layers, thereby evading detection entirely. While this choice might be motivated by reducing computational overhead (as FC layers can be time-consuming to analyze), the paper lacks a thorough justification or an ablation study to prove that this exclusion has a negligible impact on the defense's overall effectiveness. This selective strategy weakens the method's claim to general and robust protection.", "was_revised": true, "final_justification": "Most of the concerns raised during the review process have been adequately addressed. \nHowever, after careful consideration, I believe the significance and novelty of this work do not justify changing my original rating. Although important improvements have been made, the overall contribution remains modest within the context of the field.", "rebuttal": "***We sincerely thank Reviewer hznG for the thoughtful review and the positive rating. We hope our responses are helpful in addressing your concerns and would be happy to discuss if anything remains unclear.***\n\n>**To substantiate the claim that K-WMeans effectively separates clients, could the authors provide a visualization (e.g., a heatmap) of a real, pairwise Wasserstein distance matrix computed on the CBE vectors from one of the main experimental settings (e.g., CIFAR-10)? This would provide more direct and compelling evidence of client separability than a toy example and greatly strengthen the justification for the core defense mechanism.**\n\nThank you for this valuable suggestion. Below, we provide the pairwise Wasserstein distance matrix computed over the CBE vectors of 10 clients under the CIFAR-10 + 3DFed attack (clients 1–2 are malicious; clients 3–10 are benign). As shown in Table 3.1, intra-malicious and intra-benign distances remain very small (0.02–0.03), while malicious–benign distances are very large ( 5.95–5.98), which clearly justifies K-WMeans’ ability to separate the two groups. We will include this table in the revised manuscript to provide direct and compelling evidence for the separability that underpins our core defense mechanism.\n\nTable 3.1: Pairwise Wasserstein Distances (CIFAR-10, 3DFed)\n| Client | 1    | 2    | 3    | 4    | 5    | 6    | 7    | 8    | 9    | 10   |\n| ------ | ---- | ---- | ---- | ---- | ---- | ---- | ---- | ---- | ---- | ---- |\n| 1      | 0.00 | 0.00 | 5.97 | 5.95 | 5.97 | 5.97 | 5.96 | 5.96 | 5.96 | 5.98 |\n| 2      | 0.00 | 0.00 | 5.97 | 5.95 | 5.97 | 5.97 | 5.96 | 5.96 | 5.96 | 5.98 |\n| 3      | 5.97 | 5.97 | 0.00 | 0.03 | 0.03 | 0.02 | 0.02 | 0.03 | 0.02 | 0.02 |\n| 4      | 5.95 | 5.95 | 0.03 | 0.00 | 0.03 | 0.03 | 0.03 | 0.03 | 0.02 | 0.03 |\n| 5      | 5.97 | 5.97 | 0.03 | 0.03 | 0.00 | 0.02 | 0.03 | 0.02 | 0.03 | 0.03 |\n| 6      | 5.97 | 5.97 | 0.02 | 0.03 | 0.02 | 0.00 | 0.02 | 0.03 | 0.03 | 0.02 |\n| 7      | 5.96 | 5.96 | 0.02 | 0.03 | 0.03 | 0.02 | 0.00 | 0.02 | 0.03 | 0.03 |\n| 8      | 5.96 | 5.96 | 0.03 | 0.03 | 0.02 | 0.03 | 0.02 | 0.00 | 0.03 | 0.03 |\n| 9      | 5.96 | 5.96 | 0.02 | 0.02 | 0.03 | 0.02 | 0.02 | 0.03 | 0.00 | 0.02 |\n| 10     | 5.98 | 5.98 | 0.02 | 0.03 | 0.03 | 0.02 | 0.03 | 0.03 | 0.02 | 0.00 |\n\n>**Could the authors elaborate on the rationale for excluding fully connected layers from the BE calculation? To validate this design choice, could you provide an ablation study comparing the defense performance (both ACC and ASR) and computational cost when MARS is applied to (a) only convolutional/BN layers versus (b) all layers, including FC layers? Does this selective approach create an exploitable loophole for attackers to plant backdoors in the final layers of a network?**\n\nThank you for the insightful comment. We acknowledge the importance of justifying the design choice of excluding fully connected (FC) layers from the Backdoor Energy (BE) computation. To this end, we conducted a thorough ablation study comparing two variants of MARS: one that computes BE using only convolutional and batch normalization (BN) layers (\"partial-layers\"), and another that includes all layers, including FC layers (\"all-layers\").\nThe results in Table 3.2 demonstrate that both versions achieve nearly identical defense effectiveness under 3DFed attacks on CIFAR-10 with ResNet-18: the clean accuracy (ACC) and attack success rate (ASR) are virtually unchanged (e.g., ACC ≈ 85%, ASR ≈ 9%). However, including FC layers increases computational cost by approximately 13% per communication round. This validates our decision to focus on convolutional/BN layers as a practical tradeoff between performance and efficiency.\n\nTable 3.2 Partial-Layers vs. All-Layers Ablation\n| Defense               | ACC (%) | ASR (%) | Time per round (s) |\n| --------------------- | ------- | ------- | ------------------ |\n| MARS (partial-layers) | 85.07   | 9.86    | 6.57               |\n| MARS (all-layers)     | 85.11   | 9.79    | 7.43               |\n\nMore importantly, we also evaluated whether this selective layer choice introduces a potential vulnerability—for instance, if an attacker attempts to inject a backdoor exclusively through FC layers. To simulate this, we conducted an additional experiment where malicious clients freeze all parameters except the FC layers during local training in Table 3.3. In this case, MARS (partial-layers) fails to detect the malicious updates (TPR = 0%, FPR = 100%), since it ignores the manipulated layers. However, the attack itself is unsuccessful: the ASR drops to just 9.86%, while clean accuracy also suffers. This suggests that injecting a backdoor using only the FC layers fails to achieve both stealth and effectiveness. We hypothesize that this is due to the limited expressive capacity of isolated FC-layer tuning: the convolutional layers generate nearly identical features for a clean sample and  the corresponding triggered sample, making it difficult for the final layer alone to simultaneously satisfy both objectives (i.e., clean accuracy and attack success).\nFinally, we note that MARS (all-layers) can still detect such attacks, achieving 100% TPR even when malicious updates are limited to FC layers. Therefore, although our default implementation prioritizes efficiency by ignoring FC layers, MARS can be easily extended to handle such edge cases when needed, without compromising robustness.\n\nTable 3.3 FC Layers Tuning Attack\n| Defense                  | ACC (%) | ASR (%) | TPR (%) | FPR (%) |\n|--------------------------|---------|---------|---------|---------|\n| MARS (partial-layers)    | 82.74   | 9.86    | 0.00    | 100.00  |\n| MARS (all-layers)        | 85.29   | 9.25    | 100.00  | 25.00   |\n| FedAvg (attack-free)  | 85.26   | 9.34    | -      | -      |\n\nWe will include these ablation results and analysis in the revised manuscript to clarify both the rationale and empirical support for this design choice."}, {"review_id": "Cio1xv87Ds", "reviewer": "Reviewer_1dAU", "summary": "Current defenses often fail against attacks like 3DFed, which adaptively optimizes backdoor models, because they rely on empirical statistical measures not strongly linked to backdoor activity. This paper introduces MARS, a novel approach that uses \"backdoor energy\" (BE) to quantify the maliciousness of individual neurons. MARS further refines this by extracting the most significant BE values into a \"concentrated backdoor energy\" (CBE) to enhance the malicious signal. It then employs a new Wasserstein distance-based clustering technique to identify and isolate backdoor models. Experiments show MARS effectively defends against state-of-the-art backdoor attacks and surpasses existing defense mechanisms.", "questions": "See comments above.", "limitations": "Yes.", "rating": 5, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "Strengths\n- The paper addresses a meaningful topic in the field.\n- The paper highlights that other defenses are often loosely coupled with backdoor attacks, and this paper specifically addresses this issue through its method.\n- A series of experiments is conducted to prove the effectiveness of the method.\n\nWeaknesses\n- In the experiments, BackdoorIndicator is specifically selected to make comparisons and discussions. What is the reason? What is the major difference between other defenses, BackdoorIndicator, and MARS? Please provide more discussion on this.\n- In the experiments, hyperparameters $\\kappa$ and $\\epsilon$ are set to 5 and 0.03. In the appendix, the results indicate that these values fall within the optimal range for CIFAR-10. How can you make sure these values are still optimal for other datasets? Is there any theoretical discussion for setting these hyperparameters?\n- Why are the TPR and FPR results missing for FedCLP in Table 2?", "was_revised": true, "final_justification": "The rebuttal has addressed my concerns. I will keep the positive rating.", "rebuttal": "***We sincerely thank Reviewer 1dAU for the thoughtful review and the positive rating. We hope our responses are helpful in addressing your concerns and would be happy to discuss if anything remains unclear.***\n\n>**In the experiments, BackdoorIndicator is specifically selected to make comparisons and discussions. What is the reason? What is the major difference between other defenses, BackdoorIndicator, and MARS? Please provide more discussion on this.**\n\nThank you for raising this point. We selected BackdoorIndicator as our main point of comparison for three reasons. First, it was very recently published at USENIX Security ’24 and has already garnered strong community recognition. Second, like MARS, it departs from conventional FL defenses—such as norm-constraint, out-of-distribution detection, and consistency checks—and offers a fresh insight and mechanism. Third, it achieves robust empirical performance against standard backdoor attacks, making it a natural baseline for any new defense.\n\nHowever, MARS and BackdoorIndicator differ in a critical way:\n\n**Theoretical underpinnings vs. empirical observation:** BackdoorIndicator is motivated by the empirical finding that deploying repeated backdoors with the same target label amplifies the trigger effect. Importantly, this observation has only been validated under unconstrained attack settings; for constrained attacks like 3DFed, the assumption may no longer hold, as demonstrated by the sharp performance drops in Table 4 of our paper. In contrast, MARS derives a formal upper bound on backdoor energy via Lipschitz and Wasserstein metrics, providing a provable foundation for its clustering defense that remains valid regardless of attack constraints.\n\n**No reliance on external data:** BackdoorIndicator injects “indicator tasks” using an auxiliary OOD dataset and judges updates by the model’s accuracy on those tasks, making its effectiveness dependent on the availability and suitability of that data. MARS, by contrast, analyzes only the model parameters—specifically, neurons’ activation “energy”—and requires no external samples.\n\nThese distinctions highlight MARS’s practical advantages—strong theoretical guarantees and no need for trusted external data—which we will underscore in the revised manuscript.\n\n>**In the experiments, hyperparameters $\\kappa$  and $\\epsilon$  are set to 5 and 0.03. In the appendix, the results indicate that these values fall within the optimal range for CIFAR-10. How can you make sure these values are still optimal for other datasets? Is there any theoretical discussion for setting these hyperparameters?**\n\nThank you for this question. Frankly, our choices of both $\\kappa$ and $\\epsilon$ are guided primarily by practical intuition and empirical analysis rather than by a strict theoretical derivation:\n\n**Setting $\\kappa = 5%$:** We drew inspiration from pruning-based defenses—originally developed to mitigate gradient-inversion attacks—which commonly remove a small fraction of parameters (e.g., 5%) as a default that balances defense strength and model utility. For example, “Revisiting Gradient Pruning: A Dual Realization for Defending against Gradient Attacks” (AAAI ’24) uses 5% pruning with strong results. In our context, selecting the top 5% of neurons by backdoor energy similarly captures the most suspicious activity while preserving computational efficiency.\n\n**Setting $\\epsilon = 0.03$:** We examined pairwise Wasserstein‐distance matrices of Cumulative Backdoor Energy (CBE) vectors across multiple datasets (CIFAR-10, CIFAR-100, MNIST) and attack scenarios (including 3DFed). In every case, we observed a pronounced “gap” between intra‐group distances (malicious–malicious or benign–benign) and inter‐group distances, which offers a wide margin for threshold selection.\n\nFor example, Table 4.1 reports the distances for 10 clients on CIFAR-10 under a 3DFed attack (clients 1–2 malicious, 3–10 benign). All pairwise distances among malicious clients or among benign clients remain below 0.03, while every malicious–benign distance lies around 5.95–5.98. This clear separation means that setting $\\epsilon = 0.03$ places the threshold squarely in the middle of these two clusters. We observed the same pattern on CIFAR-100 and MNIST, making 0.03 a reliable, off-the-shelf default that requires no per-dataset tuning.\n\nTable 4.1: Pairwise Wasserstein Distances (CIFAR-10, 3DFed)\n| Client | 1    | 2    | 3    | 4    | 5    | 6    | 7    | 8    | 9    | 10   |\n| ------ | ---- | ---- | ---- | ---- | ---- | ---- | ---- | ---- | ---- | ---- |\n| 1      | 0.00 | 0.00 | 5.97 | 5.95 | 5.97 | 5.97 | 5.96 | 5.96 | 5.96 | 5.98 |\n| 2      | 0.00 | 0.00 | 5.97 | 5.95 | 5.97 | 5.97 | 5.96 | 5.96 | 5.96 | 5.98 |\n| 3      | 5.97 | 5.97 | 0.00 | 0.03 | 0.03 | 0.02 | 0.02 | 0.03 | 0.02 | 0.02 |\n| 4      | 5.95 | 5.95 | 0.03 | 0.00 | 0.03 | 0.03 | 0.03 | 0.03 | 0.02 | 0.03 |\n| 5      | 5.97 | 5.97 | 0.03 | 0.03 | 0.00 | 0.02 | 0.03 | 0.02 | 0.03 | 0.03 |\n| 6      | 5.97 | 5.97 | 0.02 | 0.03 | 0.02 | 0.00 | 0.02 | 0.03 | 0.03 | 0.02 |\n| 7      | 5.96 | 5.96 | 0.02 | 0.03 | 0.03 | 0.02 | 0.00 | 0.02 | 0.03 | 0.03 |\n| 8      | 5.96 | 5.96 | 0.03 | 0.03 | 0.02 | 0.03 | 0.02 | 0.00 | 0.03 | 0.03 |\n| 9      | 5.96 | 5.96 | 0.02 | 0.02 | 0.03 | 0.02 | 0.02 | 0.03 | 0.00 | 0.02 |\n| 10     | 5.98 | 5.98 | 0.02 | 0.03 | 0.03 | 0.02 | 0.03 | 0.03 | 0.02 | 0.00 |\n\nWhile these settings are ultimately empirical, they have proven stable across diverse tasks and architectures. We view $\\kappa = 5%$ and $\\epsilon = 0.03$ as sensible defaults for practitioners, with the understanding that one could perform a quick pre-deployment calibration—by inspecting the distance matrix on a small held-out validation set—to adjust them if a dramatically different data distribution or attack style is anticipated.\n\n>**Why are the TPR and FPR results missing for FedCLP in Table 2?**\n\nThank you for pointing this out. The reason TPR and FPR are not reported for FedCLP in Table 2 is that FedCLP treats every local update identically—pruning all client models before aggregation—rather than attempting to distinguish benign from malicious submissions. As a result, it does not produce per‐client labels and we cannot compute true‐positive or false‐positive rates. In our Appendix F (Lines 706–708) we clarify this and denote TPR/FPR as “–” for FedCLP. To avoid any confusion, we will move that explanation into the main text in the revised manuscript."}]

Author rebuttal:

Meta-review: The paper proposes a malicious-aware defense against backdoor attacks in Federated Learning (FL). The proposed defense, MARS, relies on quantifying the backdoor energy (BE) of malignant neurons (without clean data access) and clusters the models via Wasserstein distance. Extensive experiments show that MARS is effective against several FL backdoor attacks and exhibits better performance than several state-of-the-art backdoor defenses. 

There were initially concerns, including evaluation with more complex models (e.g., ViT), and questions about the Lipschitz/Wassertein distance usage. There are also questions about the clarity of the methodology. However, the authors have provided additional experiments and also clarified all the questions raised by the reviewers. The reviewers positively support the paper, and I encourage the authors to revise the paper accordingly in the final version.
Decision: Accept (poster)