SURA: Data-efficient backdoor detection based on forgetting in federated learning

1. 01What problem does this paper attempt to solve?

   Addresses the problem that forgetting-based backdoor detection performance degrades when server clean surrogate data is scarce in federated learning.

   Core problem: In federated learning (FL), unlearning-based backdoor detection degrades when clean server proxy data is scarce; how can malicious clients still be effectively screened under a low data budget?

   • Problem setting: In FL, the server cannot directly inspect clients' local training; malicious clients can poison data or manipulate updates to implant backdoors while maintaining performance on benign inputs, making them hard to detect (Introduction). The authors state that update-statistics methods based on distance, similarity, clustering, or robust aggregation have limited separation capability because backdoor updates can be statistically similar to benign updates.
   • Shortcomings of existing methods: Unlearning-based detection uses clean server data to perform loss-ascent probing on each client model and identifies suspicious clients by loss response; however, when proxy images are few, shallow probes lack discriminability, while deepening the probe updates BN running means and variances, so that the endpoint response mixes parameter changes, BN buffer drift, and their interaction (Introduction, Section 2.3).
   • Core observation: The authors exactly decompose the endpoint response into parameter, BN buffer, and interaction terms (Eqs. 2–5), and on this basis argue for decoupling the probing process from response measurement: deepen the probe to amplify weak responses while measuring under a common BN reference.
   • Proposed in the paper: SURA (Screening via Unlearning Response Analysis), which repeatedly reuses the same small proxy for K-step loss-ascent probing and restores the shared pre-probe BN state only at readout; it is evaluated on six backdoor attacks using only 10 clean server images.
   • Threat model (Section 2.1):
     • Goal: Implant a targeted backdoor while maintaining clean accuracy.
     • Knowledge and capability: The adversary controls some clients and can modify their data, training, and submitted updates; it does not know the exact server proxy.
     • Defender: The server holds a small labeled proxy set without triggers and does not know which clients are malicious, nor the trigger or target label; the goal is to reject malicious updates and limit false rejections of benign clients.

   Collapse this answer

2. 02What related research exists?

   Related work is divided into three categories: FL defenses based on update statistics, unlearning-based detection, and the attacks used; this paper is positioned as unlearning-based detection under low data.

   FL defenses based on update statistics and robust aggregation

   • Multi-Krum (Blanchard et al., 2017)—a Byzantine-tolerant gradient aggregation method.
   • FoolsGold (Fung et al., 2020)—a defense against FL limitations in Sybil settings; RFA (Pillutla et al., 2022)—robust aggregation; FLTrust (Cao et al., 2021)—Byzantine-robust FL based on trust bootstrapping, using 500 server images.
   • Multi-Metrics (Huang et al., ICCV 2023)—adaptively identifying FL backdoors; Lockdown (Huang et al., NeurIPS 2023)—a backdoor defense that isolates subspace training; AlignIns (Xu et al., CVPR 2025)—detecting backdoors via direction alignment checks. The paper notes that because backdoor updates can be statistically similar to benign updates, such update-based signals may have limited separation between benign and malicious clients (Introduction).

   Unlearning-based detection

   • MASA (Xu et al., WACV 2025)—identifying backdoored models in FL via individual unlearning; it is the direct comparison and improvement target of this paper; the paper notes that its detection performance degrades when proxy data is scarce (Abstract, Section 3.2).

   Attack methods (for evaluation)

   • Six attacks: BadNets (Gu et al., 2019), distributed backdoor attack DBA (Xie et al., 2020), Neurotoxin (Zhang et al., 2022), model replacement Scaling (Bagdasaryan et al., 2020), PGD poisoning (Wang et al., 2020), A Little Is Enough (LIE, Baruch et al., 2019); the adaptive attack evaluation follows the defense-aware attack of Bagdasaryan et al. (2020).

   Baselines and benchmarks: The baselines are FedAvg, oracle FedAvg excluding known malicious clients, and the defenses listed above; the benchmarks are CIFAR-100 with VGG16-BN and CIFAR-10 with ResNet18 (Sections 3.1, 3.5).

   The authors position this paper as: under a data budget of at most 10 server images, deepening the probe and state-restoration readout enable unlearning-based detection to approach the robustness of large-proxy (500 images) methods (Abstract, Section 3.2).

   Collapse this answer

3. 03How does the paper address this problem?

   SURA repeatedly reuses a small proxy for loss-ascent probing, restores the shared pre-probe BN state at readout, and then screens clients using MAD scores.

   Overall idea: decouple probe depth from response readout—repeatedly perform training-mode loss ascent on the same small proxy to amplify client responses, and restore the shared pre-probe BN state at measurement time so that all clients are compared under a common BN reference. The method is named SURA (Screening via Unlearning Response Analysis).

   Problem Setup and Probe Model

   • Setup: The global state is wt = (θt, bt), where θt is all trainable parameters (including BN affine parameters) and bt is the BN buffer (running mean, variance, batch counter); clients return update vectors relative to the full state. The server holds a labeled proxy set Dp without triggers.
   • Probe initialization: w̃_i^t = w_t + λδ_i^t + (1−λ)δ̄, i.e., the client update is fused with the round-average update using fusion weight λ; θi,0 takes only the fused trainable parameters, and bi,0 takes bt of the unfused global model rather than statistics estimated from the proxy.

   Repeated Clean-Loss Probing

   • Mechanism: Perform K steps of training-mode average cross-entropy loss ascent on the same proxy batch, reusing the same samples to deepen the probe without adding clean data; during probing, BN uses batch statistics and updates running statistics.
   • Parameters: step size η, momentum µ, gradient-norm cap cg; the experimental configuration is K = 12, η = 0.001, λ = 0.9, µ = 0.9, cg = 20 (Section 3.1).

   Response Measurement with State Restoration

   • Four-state decomposition: Define ℓ_i^x,y = ℒ_p^eval(θ_i,x, b_i,y) (x, y ∈ {0, K} mark the initial and final states of parameters and BN), and the endpoint response is exactly decomposed into the sum of a parameter term, a BN buffer term, and an interaction term (Eqs. 2–5).
   • State-restoration readout: Keep the post-probe parameters θi,K and restore only the shared pre-probe BN state bt at measurement time, yielding the SR response (Eq. 6); the authors note that it equals the parameter term, thereby removing BN drift and interaction without changing the probe trajectory.

   Client Screening and Aggregation

   • Normalized scoring: Normalize responses using the median and MAD (the Gaussian-consistent scale multiplied by 1.4826, falling back to the population standard deviation when MAD is zero), and take the upper-tail score zit (Eqs. 7–8).
   • Threshold and aggregation: The threshold τSR is calibrated once offline on benign-only development runs at the (1 − q) quantile (q = 0.02, τSR = 2.03) and fixed at deployment; clients with zit ≤ τSR are accepted, and only their original updates are aggregated (Eqs. 9–10); since τSR ≥ 0, clients at or below the median are all retained, so the acceptance set is non-empty.

   Collapse this answer

4. 04What experiments did the paper conduct?

   On CIFAR-100/VGG16-BN, SURA achieves 0.53% average ASR with 10 images, and ablation, efficiency, transfer and adaptive attack experiments were conducted.

   Experimental Setup

   • Models and data: CIFAR-100 with VGG16-BN (main experiments); CIFAR-10 with ResNet18 (generalization experiments, α = 0.5). Client data are partitioned by a Dirichlet distribution; the main experiments use α = 0.1.
   • Federated setup: 100 rounds, all 20 clients participate, 4 are malicious; local SGD for 2 epochs, batch size 64, weight decay 1e-4, initial learning rate 0.1 multiplied by 0.99 each round; where applicable, malicious clients poison 50% of local samples.
   • Attacks: six types: BadNets, DBA, Neurotoxin, Scaling, PGD, LIE.
   • Baselines: FedAvg, oracle FedAvg (excluding known malicious clients), MASA-P500/P10, FLTrust, RFA, Multi-Krum, FoolsGold, Multi-Metrics, Lockdown, AlignIns.
   • Metrics: main-task accuracy MA, target-label ASR (measured by default at the last round, i.e., round 100), malicious recall (proportion of malicious clients rejected), benign FPR; average ASR weights the six attacks equally.
   • SURA configuration: a clean proxy of 10 fixed images, K = 12, η = 0.001, λ = 0.9, µ = 0.9, cg = 20, τSR = 2.03 (calibrated once with q = 0.02; development and evaluation runs are disjoint).

   Main Results

   ASR (%, per Table 1; MA is clean accuracy) of each defense on CIFAR-100/VGG16-BN:

   Swipe horizontally to read the table

   Method	Number of images	MA↑	BadNets	DBA	Neurotoxin	Scaling	PGD	LIE	Average ASR↓
   FedAvg	–	53.27	99.69	99.20	97.70	99.90	99.76	99.68	99.32
   FedAvg (oracle)	–	52.71	0.29	0.29	0.29	0.29	0.29	0.29	0.29
   MASA-P500	500	52.52	0.33	0.36	0.38	0.32	0.37	0.35	0.35
   AlignIns	0	51.28	33.68	0.69	0.35	33.72	0.30	0.25	11.50
   MASA-P10	10	52.47	97.29	88.39	98.33	0.32	96.95	99.53	80.14
   SURA (ours)	10	52.43	0.38	0.25	0.51	0.35	0.31	1.36	0.53

   (Table 1 also reports FLTrust (500 images) average ASR 92.83, RFA 90.75, Multi-Krum 81.64, FoolsGold 50.58, Multi-Metrics 94.45, Lockdown 51.30 (excluding Scaling, whose released implementation does not support this operation; the average is over the remaining five attacks); omitted here.)

   • Authors' interpretation: Among defenses using at most 10 images, SURA has the lowest average ASR and is the only method that suppresses all six attacks to near-oracle levels; malicious recall is 95.2% and benign FPR is 1.65%.
   • Exception: The authors state that AlignIns is the strongest competitor but its protection is uneven, failing against BadNets and Scaling, with ASR varying greatly across seeds and some runs collapsing (in the table, BadNets 33.68±46.83, Scaling 33.72±46.81).
   • Comparison with a large proxy: The authors state that MASA-P500 is the only existing defense reaching an average ASR close to oracle, but it consumes 50 times as much clean server data; SURA is comparable with 10 images.

   Design Ablations: Probe Depth and Readout

   • Probe depth (Figure 2, 10 proxy images, curves are averages over three attacks): K from 4 to 16, the average ASR of endpoint readout drops from 96.49% to 16.02%, and that of restored readout drops from 66.18% to 0.49%; the authors note that the curves are not monotonic at intermediate depths, but the overall trend supports the effectiveness of repeated probing; under restored readout, K = 12 gives about 1.64% ASR (three-attack evaluation).
   • Readout (Table 2, K = 12, calibrated to matched benign FPR): cumulative readout ASR 81.70 / MA 53.07 / recall 42.03; endpoint readout 29.00 / 52.73 / 84.09; endpoint + BN restoration 0.83 / 52.54 / 93.77. The authors report that both drops exceed twice the seed-level standard error, supporting treating probe depth and readout as independent design choices.

   Proxy Sensitivity, Efficiency, and Generalization

   • Proxy sensitivity (Table 3): for four independently drawn 10-image proxies (thresholds not recalibrated), average ASR ranges from 0.437% to 0.968%, and MA ranges from 52.40% to 52.63%; the authors state that SURA performs stably under the proxy choices tested.
   • Data and compute efficiency (Table 4): MASA-P10 matched to SURA's ascent-step budget (12 epochs, 240 steps) has ASR 61.75; MASA-P120 (120 images) 25.57; MASA-P500 0.35. The authors report that SURA uses 3.33 times fewer ascent steps and 20.8 times fewer backpropagated proxy samples than MASA-P500, with a per-round relative time of 1.157× (FedAvg is 1.000×, MASA-P500 is 1.479×); BN restoration itself adds no gradient steps.
   • Generalization (Section 3.5, CIFAR-10/ResNet18, α = 0.5, configuration unchanged, no ResNet-specific recalibration): SURA average ASR 26.13%, MASA-P10 79.55%, MASA-P500 48.65% (Figure 3); MA is 87.96%, 87.70%, and 87.94%, respectively. The authors state that this zero-shot transfer with 10 proxy images outperforms MASA-P500.

   Adaptive Attacks

   • Setup (Section 3.6): defense-aware attacks are evaluated at K = 12, with three adaptations: scale-only (fixed direction, changed magnitude), direction-only (fixed magnitude, changed direction), and joint (both optimized).
   • When the proxy is unavailable: ASR for the three adaptations is 0.37%, 0.33%, and 0.37%, respectively.
   • After disclosing the exact proxy: direction-only adaptation gives ASR 0.73%, but joint direction-scale adaptation reaches 94.91%. The authors state that this contrast indicates that exact proxy disclosure is an important operational limitation of SURA.

   Other Ablations and Analyses

   • The threshold τSR is calibrated once on development data with q = 0.02 and fixed during evaluation (Section 3.1).
   • In the proxy sensitivity experiments, recall for the four draws ranges from 91.97% to 96.15%, and FPR from 1.41% to 2.05% (Table 3).

   Collapse this answer

5. 05What are some points that can be further explored?

   The authors state that the method is limited to models with BN running statistics, and that disclosing the exact proxy weakens the defense; experiments are limited to two vision settings.

   Limitations and Future Directions Noted by the Authors

   • Architecture applicability scope: The authors state that the method's scope is limited to models with BN running statistics, and extending this principle to architectures with stateless BN is future work (end of the introduction in Section 1).
   • Exact surrogate disclosure: In the adaptive attack experiments, after disclosing the exact server surrogate, the joint direction-scaling adaptation reached 94.91% ASR; the authors state that exact surrogate disclosure is an important operational limitation of SURA (Section 3.6).

   Experimental Coverage

   • The evaluated models are two vision architectures, VGG16-BN (CIFAR-100) and ResNet18 (CIFAR-10), both models with BN (Sections 3.1, 3.5).
   • Attacks cover six backdoor attacks (BadNets, DBA, Neurotoxin, Scaling, PGD, LIE) and three defense-aware adaptive attacks under K = 12 (Sections 3.1, 3.6).
   • The federated setting is 20 clients, 4 malicious, 100 rounds, with all clients participating each round; the non-IID degree is α = 0.1 (CIFAR-100) and α = 0.5 (CIFAR-10) (Sections 3.1, 3.5).
   • Surrogate sensitivity is evaluated with four independently drawn 10-image surrogates and three training seeds; the main results table reports means and standard deviations (± values), and the paper does not state the number of repetitions for each condition (Section 3.3, Table 1).
   • The generalization experiment is zero-shot transfer: the CIFAR-100 configuration is kept unchanged and used directly on CIFAR-10/ResNet18 without ResNet-specific recalibration (Section 3.5).

   Collapse this answer

6. 06Summarize the main content of the paper

   Through repeated probing and BN state restoration readout, SURA reduces the average ASR of six FL backdoor attacks to 0.53% with 10 clean images.

   A federated learning backdoor defense paper addressing the degradation of unlearning-based detection performance when clean server proxy data is scarce.

   • Problem: Malicious clients can implant backdoors while maintaining main-task performance; defenses based on update statistics have limited separation capability, unlearning-based detection has insufficient probe discriminability when proxy data is scarce, and deepening the probe introduces BN running-statistic drift.
   • Method: SURA performs K-step training-mode loss-ascent probing on the same small proxy to amplify client responses, restores the shared pre-probe BN state at measurement time (the authors' four-state decomposition shows that this readout equals the parameter term, removing BN drift and interaction), then screens clients using a median/MAD-normalized upper-tail score with a threshold calibrated once offline, and aggregates only the original updates of those that pass.
   • Main results: On CIFAR-100/VGG16-BN, SURA uses only 10 clean server images and achieves average ASR 0.53%, MA 52.43%, malicious recall 95.2%, and benign FPR 1.65% across six attacks (Table 1); MASA-P10 with the same budget has average ASR 80.14%, and MASA-P500 with 500 images has 0.35%.
   • Ablations: K from 4 to 16, average ASR under restored readout drops from 66.18% to 0.49% (Figure 2); at K = 12 with matched calibration, BN restoration reduces ASR from 29.00% under endpoint readout to 0.83% (Table 2).
   • Generalization and efficiency: Zero-shot transfer to CIFAR-10/ResNet18 gives average ASR 26.13%, better than MASA-P500's 48.65%; compared with MASA-P500, it uses 3.33 times fewer ascent steps and 20.8 times fewer backpropagated proxy samples (Table 4).
   • Authors' conclusions and limitations: The authors consider jointly controlling probe depth and readout state an effective principle for low-data backdoor screening; they also note that the method is limited to models with BN running statistics, and that after disclosing the exact proxy, the joint adaptive attack reaches ASR 94.91%, which is an important operational limitation.

   Collapse this answer

Related papers