PaperlayerView exact revision on arXiv

Source-linked AI summary

Backdoors Leave Structural Traces: FedMAST for Backdoor Detection and Containment in Federated Learning

Srinivasan Subramanian, Md. Abdullah Al Hafiz Khan, Kazi Aminul Islam

arXiv:2609.27760v2cs.LGcs.AI

TL;DR

Stealth-constrained backdoor attacks can adapt to defenses that rely on individual evidence sources, even as their updates retain residual traces. FedMAST combines structural, historical, and spectral evidence with paired-feature coherence and signed temporal spectral drift; across the evaluated attacks, it limited malicious-update selection to 0–7.7%, with zero selection in five of seven attacks while maintaining high main-task accuracy.

  • Problem

    Stealth-constrained attacks can suppress anomaly signals that defenses rely on, while retaining backdoors that are difficult to detect under regular evaluation.

    Source: §I · p. 1

  • Method

    FedMAST scores updates using complementary structural, historical, and spectral evidence, including squeeze-pair coherence and signed temporal spectral-drift features.

    Source: §I · p. 1

  • Results

    Across six stealth-constrained attacks and method-aware COVERTLAYERS, FedMAST limited malicious-update selection to 0–7.7%, with zero malicious selection in five of seven attacks while maintaining high main-task accuracy.

    Source: §VII · p. 8

  • Takeaways & Limitations

    The ablations show that FedMAST’s axes complement one another through coverage and precision.

    Source: F. Ablation Study · p. 7

    FedMAST requires stable pseudonymous identifiers, while identity-reset or Sybil behavior and attackers optimizing against its runtime spectral state remain unevaluated.

    Source: §VI · p. 8

Abstract

from arXiv · show

Federated learning enables distributed training without requiring clients to share their raw data. However, its reliance on the integrity of the client-submitted updates exposes the global model to stealthy backdoor poisoning. Existing defenses often rely on individual evidence sources, but stealth-constrained attacks can adapt to these signals. Such attacks can suppress anomaly signals they are optimized to evade, yet their poisoned updates still leave residual structural traces. We propose FedMAST, a Federated Multi-Axis Structural Tracing defense for backdoor detection in federated learning. FedMAST scores client updates using complementary structural, spectral, and historical evidence and then applies tiered filtering and round-level containment to limit adversarial influence. To capture traces that isolated signals may miss, FedMAST uses squeeze-pair coherence scoring to expose coupled feature distortions and signed spectral-drift tracking to reveal persistent directional changes over time. Across six backdoor attacks, FedMAST achieves lower attack success rate (ASR) than baseline defenses in all nine evaluated comparisons, averaging 1.51% ASR and 94.84% main-task accuracy (MTA) across the complete 200-round runs. Over the full 200-round method-aware CovertLayers run, FedMAST achieves 1.53% ASR and 92.26% MTA, compared with ASRs of 100.00%, 99.67%, 99.53%, and 32.84% for FedAvg, MultiKrum, AlignIns, and FLAME, respectively.

I. INTRODUCTION

Stealth-constrained attacks can evade defenses built around a single evidence source, motivating FedMAST’s use of complementary structural, historical, and spectral traces. Its design adds paired-feature coherence and signed temporal spectral drift, while its threat model assumes stable pseudonymous client identifiers and no trusted server dataset.

I. INTRODUCTION

  • Existing defenses use varied signals, but a defense centered on one evidence view can fail when an attacker optimizes against that view.The paper notes that attackers can shift their footprint into structural, historical, temporal, or spectral channels.Source: §I · p. 1
  • FedMAST scores client updates across structural, historical, and spectral evidence, then uses round-level containment and defense-state quarantine to limit adversarial influence.The defense is server-side.Source: §I · p. 1
  • Signed temporal spectral-drift features accumulate signed changes in singular-value concentration and spectral entropy across repeated appearances of each client partition.Separating these features from the unsigned structural bank preserves attack-direction information and exposes weak, persistent gradient-aligned drift.Source: §I · p. 1
  • Squeeze-pair coherence scoring evaluates joint coherence across structurally related properties to expose deviations hidden when metrics are considered independently..Source: §I · p. 1

II. RELATED WORK

  • FedMAST evaluates coherence among anomaly signals and their evolution across rounds, targeting residual inconsistencies that may persist when adaptive attackers suppress individual anomaly signals.Its signed spectral-drift trace preserves stage-wise direction, while squeeze-pair scoring models relationships between related features.Source: §II · p. 2

A. Problem Setup and Threat Model

  • The server observes submitted updates and protocol metadata, requires no trusted reference dataset, and assumes stable pseudonymous identifiers; method-aware attackers do not observe benign updates or runtime defense state.FedMAST can initialize from frozen history or build rolling history from low-risk accepted updates.Source: A. Problem Setup and Threat Model · p. 2

4 Compute structural zi,k using Eq. (2)

The listed scoring steps compute round-level structural distances, trajectory and momentum distances, and spectral scores.

4 Compute structural zi,k using Eq. (2)

  • The scoring procedure computes round, squeeze, historical, and anchor distances using Eqs. (3)–(6).Source: §4 · p. 3
  • Trajectory statistics and momentum are normalized before their corresponding distances are computed using Eqs. (7) and (8).Source: §4 · p. 3

7 Normalize spectral features to ˆzi,k using Eq. (2)

  • After spectral-feature normalization, the procedure computes the signed appearance score and Dspec(pi).Source: §7 · p. 3

B. Multi-Axis Evidence Extraction

FedMAST combines structural-family scores with squeeze-pair coherence and historical context, while tracking signed spectral evidence separately. These axes distinguish round-level feature patterns from persistent changes and deviations from accepted historical structure.

B. Multi-Axis Evidence Extraction

  • FedMAST scores a 22-feature structural bank and reserves six additional layer-2–4 spectral features for signed temporal scoring.Keeping spectral features separate preserves their directional information.Source: B. Multi-Axis Evidence Extraction · p. 3
  • Structural evidence is organized into five feature families, with client scores computed for each family after round-wise feature normalization.Source: B. Multi-Axis Evidence Extraction · p. 3

C. Squeeze-Pair Tracing

  • Squeeze-pair tracing tests whether structurally related features remain coherent, including displacement versus late-layer change and directional alignment versus head structure.The four pairs couple distance to the historical baseline with layer-4 norm, cosine alignment with head spectral entropy, head/total norm with head top-SV ratio, and classifier/backbone norm with backbone kurtosis.Source: C. Squeeze-Pair Tracing · p. 3

D. Historical and Temporal Context

  • Historical scoring re-standardizes structural evidence against previously accepted updates; its threshold uses a second MAD pass and is bounded below by half the first-pass threshold.This addresses distortions in single-round statistics from non-IID heterogeneity or coordinated malicious clients.Source: D. Historical and Temporal Context · p. 3
  • Dhist measures per-client historical inconsistency, whereas Danchor measures raw-feature distance from the accepted historical center for bisection, inversion checks, and re-selection.Anchor-dependent decisions are disabled when the sampled population is collectively far from that reference.Source: D. Historical and Temporal Context · p. 3
  • Client trajectories track five feature measures using EMA deviation, volatility, absolute trend, and successive-change consistency, while ranking momentum activates after five appearances.These history-dependent scores affect ranking but do not independently trigger rejection.Source: D. Historical and Temporal Context · p. 4

E. Signed Temporal Spectral Drift

FedMAST accumulates signed spectral changes across repeated appearances of each client partition to expose persistent directional drift. Spectral decisions require sufficient appearances, while historical-anchor distance supports round-level inversion checks and client re-selection.

E. Signed Temporal Spectral Drift

  • Signed spectral scores accumulate changes in stage-resolved singular-value concentration and spectral entropy across repeated appearances of each client partition.Spectral evidence is valid when at least two top-SV and two entropy features are available.Source: E. Signed Temporal Spectral Drift · p. 4
  • Fig. 2 flags inversion when the accepted set's mean anchor distance exceeds the rejected set's, then reselects by anchor distance while excluding spectral-flagged clients.Reselection keeps at least nfloor clients and admits further clients up to θanchor.Source: Figure 2 · p. 4
  • The spectral moving-average decay is α, and spectral decisions are enabled only after sufficient appearances.Source: E. Signed Temporal Spectral Drift · p. 4

F. Client Scoring and Round-Level Containment

FedMAST combines consensus-based client scoring, historical validation, and round-level containment; COVERTLAYERS tests it with an adaptive attack that preserves the backdoor objective while reducing detectable update traces.

F. Client Scoring and Round-Level Containment

  • Hard-axis consensus, independent spectral flags, historical validation, and round-level containment determine whether FedMAST accepts updates or treats a round as suspicious.Hard axes use 2-of-3 consensus; accepted coalitions are checked using inversion and aggregate drift, with suspicious rounds triggering anchor-based re-selection or containment.Source: F. Client Scoring and Round-Level… · p. 4
  • Reliable rounds use FedAvg on the accepted set, while suspicious rounds use the configured containment policy and retain the prior model if too few clients remain.Anchor re-selection excludes spectral-flagged clients, meets the minimum accepted-set size, and admits additional clients only below the anchor-distance threshold.Source: F. Client Scoring and Round-Level… · p. 4

G. FedMAST-Aware Adaptive Attack

  • COVERTLAYERS preserves BC-Layers’ trigger-critical modifications while targeting the magnitude, direction, and layer-concentration evidence visible to FedMAST.It estimates benign update structure with local proxy models and identifies critical layers through layer-substitution analysis.Source: G. FedMAST-Aware Adaptive Attack · pp. 4–5
  • The adaptive attack smooths non-critical layer energies with calibrated noise and blends its crafted update direction toward the mean benign proxy update.It also projects its norm toward the median benign proxy norm.Source: G. FedMAST-Aware Adaptive Attack · p. 5
  • If evasion reduces backdoor success below a minimum fraction of the full malicious model’s success, the attacker relaxes constraints in stages, strengthening the BC-layer injection and potentially adding a critical layer.The staged relaxation also reduces directional blending, non-critical-layer smoothing, and norm matching.Source: G. FedMAST-Aware Adaptive Attack · p. 5

A. Federated Setup and Training

The evaluation tests FedMAST on CIFAR-10 across 200 rounds, reporting clean-task accuracy and backdoor success against attack-matched baselines. FedMAST suppresses persistent backdoor success across six attacks, including a method-aware adaptive attack.

A. Federated Setup and Training

  • The CIFAR-10 evaluation uses 100 clients, samples 10 per round, runs for 200 rounds, and partitions client data with Dirichlet non-IID sampling at α = 0.9.The setup uses a Tiny ResNet-18 and a frozen 50-round history checkpoint for primary CIFAR-10 evaluations.Source: A. Federated Setup and Training · p. 5

B. Evaluation Metrics

  • ASR is measured on trigger-poisoned test samples whose true label is not the target, and reported MTA and ASR summarize the final 100 rounds as µ ± σ.Global models are centrally evaluated after each communication round on clean samples for MTA and trigger-poisoned samples for ASR.Source: B. Evaluation Metrics · pp. 5–6

C. Baselines

  • The attack suite is compared with baselines selected to match the attack mechanisms they are designed to address.Table II summarizes the attack suite and matched baseline defenses.Source: C. Baselines · p. 6, Table II · p. 6

A. Defense Effectiveness

  • Across six attacks, FedMAST suppresses persistent backdoor success while maintaining high MTA and low malicious selection, whereas baseline defenses leave sufficient malicious influence for the backdoor to persist.Figure 3 shows round-wise ASR trajectories; Table III reports final-100-round MTA and ASR.Source: A. Defense Effectiveness · p. 6, Figure 3 · p. 6

B. Effectiveness against adaptive attacker

  • Against COVERTLAYERS, FedMAST rejects all malicious updates and reduces ASR below 1% while preserving the highest MTA; FLAME partially suppresses the attack, while FedAvg, MultiKrum, and AlignIns do not.COVERTLAYERS constrains FedMAST’s structural traces while preserving BC-Layers’ layer-critical backdoor objective.Source: B. Effectiveness against adaptive… · p. 6

C. False Positives and Detection Tradeoff

Across the reported evaluations, FedMAST detects attacks through complementary evidence but incurs benign-rejection and runtime costs. Its findings also have stated deployment and evaluation boundaries.

C. False Positives and Detection Tradeoff

  • Across six experiments, five partitions accounted for 33.2% of benign rejections despite 6.5% of benign appearances, with 69.2% FPR versus 13.5% overall.Under LGA (α = 0.3), five recurrent benign clients accounted for 28.26% of false positives despite 8.27% of benign appearances; their rejection rate was 82.98% versus 19.00% otherwise, while MTA changed from 95.74% before the attack window to 95.26% in the final round.Source: C. False Positives and Detection… · p. 6

D. Sensitivity to Malicious Client Budget

  • Across 1–5 LGA attackers, MTA ranged from 95.87% to 96.19%, while ASR rose from 1.27% and 1.17% at 1–2 attackers to 8.15% at five.Final-round ASR increased from 0.71% and 1.13% at 1–2 attackers to 14.32% at five.Source: D. Sensitivity to Malicious Client… · p. 7

E. Runtime Overhead and Deployability

  • FedMAST added 9.1% end-to-end runtime overhead, increasing average execution from 98.5 to 107.4 minutes, or about 2.7 seconds per round.The server-side defense does not change client training, communication, or model architecture.Source: E. Runtime Overhead and Deployability · p. 7

F. Ablation Study

  • LGA was detected primarily by the spectral axis (89.0% versus ≤ 1.8% on the others), while 3DFed showed 100% structural/historical coverage and 0% spectral coverage.Neurotoxin, BC-Layers, and COVERTLAYERS had 99.5–100% coverage across the structural and historical signals.Source: F. Ablation Study · p. 7
  • Removing signed temporal spectral drift weakened LGA containment, while removing an axis weakened consensus for C&S and DBA.With C&S poisoning active from round 1 and no frozen history, two warmup rounds accepted malicious updates; from round 3 onward, all 98 subsequent malicious updates were rejected, yielding 100% post-warmup recall (98% overall).Source: F. Ablation Study · p. 7

G. Heterogeneity and Cross-Dataset Generalization

  • Across LGA non-IID settings with α ∈ {0.3, 0.5, 0.7}, MTA stayed between 95.55% and 95.93%, ASR between 1.74% and 2.21%, and FPR between 24.36% and 29.37%.On EMNIST-Balanced under LGA, FedMAST achieved 93.01±1.12% MTA and 0.22±0.18% ASR; on FEMNIST with COVERTLAYERS, it achieved 85.15±2.25% MTA and 0.14±0.08% ASR.Source: G. Heterogeneity and Cross-Dataset… · pp. 7–8

VI. DISCUSSION AND LIMITATIONS

  • FedMAST requires stable pseudonymous partition identifiers; identity-reset/Sybil behavior and attackers directly optimizing against its runtime spectral state remain unevaluated.The paper also calls for broader validation across modalities, larger models, stronger non-IID regimes, and longer-horizon adaptive attackers.Source: §VI · p. 8

VII. CONCLUSION

  • Malicious-update selection stayed between 0–7.7%, with zero malicious selection in five of seven attacks while maintaining high main-task accuracy.This is the conclusion’s cross-attack result for six stealth-constrained attacks and method-aware COVERTLAYERS.Source: §VII · p. 8

APPENDIX A. Update Representation and Feature Bank

FedMAST derives structural and spectral evidence from trainable model parameters, then combines hard and soft evidence to score client updates. Its historical baselines can use either prior attack-free history or accepted updates.

APPENDIX A. Update Representation and Feature Bank

  • FedMAST computes features from trainable parameters; the Tiny ResNet-18 is divided into six stages: stem, layer1, layer2, layer3, layer4, and head.The structural feature bank contains 22 features, with historical-baseline quantities based on available historical statistics.Source: Appendix A · p. 9
  • The primary experiments initialize historical baselines from a previous 50-round attack-free history; without it, FedMAST builds baselines from accepted updates during training.The hyperparameter values are configurable and are not requirements of the scoring procedure.Source: Appendix A · p. 9, B. FedMAST Hyperparameters · p. 9
  • The signed spectral-drift path adds six quantities and keeps them separate from the structural bank so their direction is preserved.Examples include top-singular-value ratio and spectral entropy from layers 2, 3, and 4; stage-level quantities are combined with Frobenius-norm weighting when a stage contains multiple weight tensors.Source: Appendix A · p. 9
  • FedMAST uses four predefined squeeze pairs, requiring at least two valid layer values for each term.The listed pairs include baseline displacement with layer-4 energy, and round-mean alignment with head spectral entropy.Source: Appendix A · p. 9

B. FedMAST Hyperparameters

  • A client is hard-flagged when at least two of Dround, Dsqueeze, and Dhist exceed their independent robust thresholds; Dspectral is evaluated separately.Dtraj, Dmomentum, and Danchor are soft evidence for ranking, historical checks, and re-selection, but do not independently trigger ordinary hard rejection; an active spectral flag is not eligible for minimum-acceptance rescue.Source: B. FedMAST Hyperparameters · p. 9

C. Historical State

FedMAST initializes historical scoring from a frozen attack-free history or, when that is unavailable, from accepted low-risk updates after warmup. The CIFAR-10 experiments standardize model initialization and evaluation across defenses.

C. Historical State

  • The primary CIFAR-10 experiments use a frozen 50-round attack-free FedAvg history, but FedMAST can instead build rolling baselines from accepted low-risk updates after a two-round warmup.Only reliable rounds update the rolling history, and rounds marked suspicious or with elevated spectral risk are quarantined.Source: C. Historical State · p. 9

D. Initialization, Trigger, and Evaluation

  • Primary CIFAR-10 runs use the same Tiny ResNet-18 initialization and client partitions across defenses, with main-task accuracy measured on the standard test split each round.The common trigger is an 8 × 8 orange patch in the bottom-right corner with target label 2; standard poisoned-data training replaces 20 examples per poisoned minibatch, and ASR excludes examples whose true class is already the target.Source: D. Initialization, Trigger, and… · p. 9
  • DBA uses four persistent attackers, each trained on a separate six-pixel local trigger; the evaluated global trigger is the union of the four patterns, totaling 24 pixels.DBA ASR is evaluated using this assembled global trigger.Source: D. Initialization, Trigger, and… · p. 9

E. Primary Attack Configurations

  • DBA begins its attack only after the simulator identifies all four fixed attacker partitions.The reported start round is configured as attack-start; Table X summarizes the primary CIFAR-10 attack configurations.Source: E. Primary Attack Configurations · p. 10

F. Baseline Configurations

  • Baseline defenses use the same sampled clients, partitions, attack configuration, and global-model initialization as the corresponding FedMAST experiment.Table VIII lists the aggregation settings used for the baselines.Source: F. Baseline Configurations · p. 10, Table VIII · p. 10

G. Axis Coverage

Axis coverage varies by attack, and client-level recall does not always translate into rounds that reject every attacker without collateral benign rejection. FedMAST also uses aggregation policies that change with round reliability.

G. Axis Coverage

  • Before consensus, LGA mainly exceeds Dspec, while other attacks expose multiple structural traces, motivating multi-axis evidence rather than reliance on a single anomaly signal.Source: G. Axis Coverage · p. 10

H. Round-Level Detection Stability

I. Containment Statistics

  • On reliable rounds, FedMAST uses FedAvg over accepted updates; on suspicious rounds, the primary experiments use coordinate-median aggregation over accepted updates.The paper reports that this containment policy is active and visible on LGA and DBA.Source: §I · pp. 10–11, Table XII · p. 11

J. Predefined Squeeze Pairs

  • Four of six retained traces placed their strongest predefined squeeze pair above the 90th percentile of all candidate pairs, and the strongest pair varied by attack.The pair comparison ranked candidate pairs by pooled-covariance two-dimensional separation between benign and malicious updates; the authors use this to support several fixed pairs rather than one universal pair.Source: J. Predefined Squeeze Pairs · p. 11, Table XIII · p. 11
Loading 2609.27760v2…