Research map / Federated learning and privacy / Privacy attacks and secure learning
MARS: A Malignity-Aware Backdoor Defense in Federated Learning
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes MARS, a federated learning backdoor defense that scores neurons by a Lipschitz-based backdoor energy, keeps the top values per layer as a concentrated backdoor energy vector, and clusters clients with a Wasserstein-distance K-means variant.
Problem
Existing FL backdoor defenses rely on empirical statistics (norm, OOD distance, cosine consistency) that are loosely coupled with backdoor intent, so SOTA attacks such as 3DFed, CerP and DarkFed evade them.
Approach
Measure each neuron's backdoor energy via an upper bound equal to its Lipschitz constant (computable from weights alone, no data or trigger), keep the top-κ% values per layer as a concentrated backdoor energy vector, and cluster these vectors with K-means under Wasserstein distance, which is insensitive to element order; cluster selection uses center norm and an inter-cluster distance threshold.
Key results
- Across MNIST, CIFAR-10 and CIFAR-100 under MRA, CerP and 3DFed, MARS reports TPR 100% and FPR 0% in the main table with CAD about 93-97%, while baselines like FLAME, FoolsGold and FedCLP show high ASR, high FPR or large accuracy loss.
- Under 3DFed on CIFAR-10 with ACC 85.07%, MARS achieves ASR 9.86% versus 97.27% for Multi-Krum and 95.20% for FLDetector, while BackdoorIndicator attains CAD below half of MARS under 3DFed.
- With an adaptive attack that minimizes backdoor energy, plain MARS fails at regularization lambda of 0.05 or higher (CAD about 3%), while the majority-selection variant MARS* keeps CAD near 94%.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| use MARS instead of FedCLP | CIFAR-10 federated learning under 3DFed · CIFAR-10, 3DFed | CAD: 80.85 -> 93.80 | Helped |
| use MARS instead of FedCLP | MNIST federated learning under 3DFed · MNIST, 3DFed | CAD: 84.43 -> 96.45 | Helped |
| use MARS instead of FedCLP | CIFAR-100 federated learning under 3DFed · CIFAR-100, 3DFed | CAD: 88.37 -> 94.60 | Helped |
| replace Wasserstein distance with Euclidean distance for clustering (ablation) | MARS · CIFAR-10, CerP | CAD: close to 94% -> around 44% | Hurt |
| replace Wasserstein distance with cosine distance for clustering (ablation) | MARS · CIFAR-10, CerP | CAD: close to 94% -> around 44% | Hurt |
| replace smaller-center-norm cluster selection with majority-based selection (ablation) | MARS under adaptive attack with λ=0.05 · CIFAR-10, adaptive attack, λ=0.05 | CAD: 3.13 -> 93.96 | Helped |
| replace smaller-center-norm cluster selection with majority-based selection (ablation) | MARS under adaptive attack with λ=0.1 · CIFAR-10, adaptive attack, λ=0.1 | CAD: 2.66 -> 93.96 | Helped |
| increase adaptive-attack regularization coefficient to 0.05 or higher while retaining the original cluster selection | MARS · CIFAR-10, adaptive attack | CAD: 93.92 -> 3.13; 93.92 -> 2.66 | Hurt |
| increase the attacker proportion from 20 to 95 | MARS · CIFAR-10, 3DFed | CAD: 93.80 -> 92.89 | Hurt |
Surprising findings
- Norm-based and cosine-based statistics of 3DFed backdoor updates are indistinguishable from or even lower than those of benign updates, so common defenses fail.
- FLDetector performs worse under IID data than under non-IID data for 3DFed, attributed to backdoor and predicted models becoming more similar.
Limitations
- Designed specifically for backdoor attacks; does not address free-rider or gradient inversion privacy attacks.
- Plain cluster-selection rule fails under adaptive attacks with strong backdoor-energy regularization (lambda at least 0.05); requires the MARS* majority variant to recover.
- Evaluated only on image classification with small CNN and ResNet-18 models in the main text.
Experimental setup
Datasets: MNIST CIFAR-10 CIFAR-100
Benchmarks: MNIST CIFAR-10 CIFAR-100
Metrics: ACC ASR TPR FPR CAD
Baselines: FedAvg Multi-Krum RFLBAT FLAME FoolsGold FLDetector DeepSight FedCLP BackdoorIndicator
Builds on: CLP 3DFed FLAME Multi-Krum FedAvg
Closest papers by meaning
- SPMC: Self-Purifying Federated Backdoor Defense via Margin Contribution (ICML 2025 · similarity 0.90)
- Backdoor Federated Learning by Poisoning Backdoor-Critical Layers (ICLR 2024 · similarity 0.90)
- Parameter Disparities Dissection for Backdoor Defense in Heterogeneous Federated Learning (NeurIPS 2024 · similarity 0.89)
- Resisting Backdoor Attacks in Federated Learning via Bidirectional Elections and Individual Perspective (AAAI 2024 · similarity 0.89)
- Beyond Traditional Threats: A Persistent Backdoor Attack on Federated Learning (AAAI 2024 · similarity 0.89)
- Infighting in the Dark: Multi-Label Backdoor Attack in Federated Learning (CVPR 2025 · similarity 0.88)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.