Backdoor Signal-to-Noise Ratio

• Backdoor Signal-to-Noise Ratio is a framework that measures the power of a weak, coherently aggregated backdoor signal relative to main task noise in federated instruction tuning.
• It decomposes client updates into task gradients and a backdoor component by projecting aggregated updates onto an estimated common backdoor direction.
• Empirical findings reveal that BSNR follows a Rise-Peak-Decay pattern correlating with attack success rates while minimally affecting primary task performance.

Searching arXiv for the cited paper to ground the article and citation. Backdoor Signal-to-Noise Ratio (BSNR) is a quantitative framework for analyzing backdoor implantation in federated instruction tuning (FIT) from a signal-aggregation perspective. It was introduced in “Revisiting Backdoor Threat in Federated Instruction Tuning from a Signal Aggregation Perspective” (Zhao et al., 17 Feb 2026) to characterize how low-concentration poisoned data, when distributed across benign clients, can generate a statistically coherent backdoor direction in the aggregated model update while preserving primary-task performance. In this formulation, the backdoor effect is treated as a weak but aligned signal embedded in task gradients and residual noise, and BSNR measures the power of that aligned component relative to the orthogonal remainder.

1. Definition and formal construction

In the formulation of (Zhao et al., 17 Feb 2026), let $w_t$ be the global adapter parameters at round $t$, and let each client’s update be

$\Delta_k = w_{\text{local},k} - w_t.$

For an affected client $k$, meaning one that unknowingly holds a small fraction of backdoor examples, the update is decomposed as

$$\Delta_k^{\text{aff}} \approx (1-\lambda') \cdot \Delta_k^{\text{task}} + \lambda' \cdot \Delta_k^{\text{bd}} + \epsilon_k.$$

Here, $\Delta_k^{\text{task}}$ is the main task gradient component, $\Delta_k^{\text{bd}}$ is the backdoor gradient component, and $\epsilon_k$ is residual noise (Zhao et al., 17 Feb 2026).

The framework posits that all affected clients share a common backdoor direction $v_{bd}$, with unit norm, in parameter space. Because this direction is not known a priori, it is estimated each round by contrasting the mean of affected clients’ updates with that of clean clients:

$$\hat v_{bd} = \frac{\bar \Delta_{\text{aff}} - \bar \Delta_{\text{clean}}}{\| \bar \Delta_{\text{aff}} - \bar \Delta_{\text{clean}} \|_2}.$$

The empirical BSNR of the global update $t$0, produced by server aggregation, is then defined as

$t$1

Equivalently, if $t$2, then the numerator is $t$3 and the denominator is $t$4 (Zhao et al., 17 Feb 2026).

This definition makes BSNR a power ratio: the numerator is the squared $t$5 norm of the projection of the global update onto the estimated backdoor direction, and the denominator is the squared $t$6 norm of the orthogonal residual. The quantity is therefore not merely a heuristic scalar but an explicit decomposition of the aggregated update into a putative backdoor-aligned component and a complementary component.

2. Computation within federated instruction tuning

In a typical FIT round, the procedure described in (Zhao et al., 17 Feb 2026) is as follows. The server sends the current adapter $t$7 to all clients. Each client $t$8 fine-tunes on its local instruction dataset $t$9, which for an affected client contains a small fraction $\Delta_k = w_{\text{local},k} - w_t.$0 of poisoned examples. The client computes the adapter update $\Delta_k = w_{\text{local},k} - w_t.$1 and sends it back. The server averages all $\Delta_k = w_{\text{local},k} - w_t.$2 to form $\Delta_k = w_{\text{local},k} - w_t.$3.

Within that workflow, the numerator of BSNR is the backdoor signal. It is obtained by projecting $\Delta_k = w_{\text{local},k} - w_t.$4 onto the estimated backdoor direction $\Delta_k = w_{\text{local},k} - w_t.$5. The intended interpretation is that each affected client’s $\Delta_k = w_{\text{local},k} - w_t.$6 aligns with $\Delta_k = w_{\text{local},k} - w_t.$7, so the backdoor components add coherently during averaging (Zhao et al., 17 Feb 2026).

The denominator is the noise term. It is the part of $\Delta_k = w_{\text{local},k} - w_t.$8 orthogonal to $\Delta_k = w_{\text{local},k} - w_t.$9 and captures gradients from the main QA task plus random residuals $k$0. Because clean clients contribute only task-oriented gradients, this orthogonal subspace is described as being dominated by the main task noise. By squaring $k$1 norms, the framework obtains scalar measures of signal power and noise power.

This decomposition is specific to federated aggregation rather than to isolated client behavior. A plausible implication is that BSNR is designed to detect threats that are individually weak at the client level but become consequential after averaging.

3. Signal-aggregation interpretation

The motivation for BSNR is explicitly borrowed from classical signal processing, where one asks how strong a desired signal is relative to background noise (Zhao et al., 17 Feb 2026). In the FIT backdoor setting, each affected client’s small $k$2 is modeled as a weak backdoor signal. When such weak signals are distributed across many clients, they nevertheless point in the same direction $k$3. During aggregation, these coherent components superimpose and grow roughly in proportion to $k$4, the fraction of affected clients.

By contrast, the main-task gradients are assumed to span a high-dimensional orthogonal subspace and to behave like isotropic noise. The distinction between coherent alignment and high-dimensional dispersion is central to the BSNR framework: the backdoor succeeds not because any individual update is extreme, but because many weak updates share a directional component that survives averaging.

The paper identifies several theoretical predictions that are later empirically confirmed. First, backdoor learning exhibits Rise, Peak, and Decay phases. Second, BSNR has a non-monotonic dependence on $k$5. In Regime 1, where $k$6, $k$7, corresponding to signal-dominated growth. In Regime 2, where $k$8, measured BSNR declines because of reference degradation, although the true signal may still be strong (Zhao et al., 17 Feb 2026).

This signal-aggregation perspective reframes the threat model. Rather than assuming a minority of overtly malicious clients, it focuses on low-concentration poisoned data distributed across benign clients. This suggests that the relevant unit of analysis is not anomalous client behavior but the aggregate directional coherence of otherwise ordinary updates.

4. Trigger types and their effect on BSNR dynamics

The paper studies two trigger forms: natural triggers and adversary-injected triggers (Zhao et al., 17 Feb 2026). Natural triggers are described as inherent features serving as implicit triggers, with the adverb “Firstly” given as an example. Adversary-injected triggers are explicitly inserted strings, such as “tq” and “cf” in the Badnets style.

The reported observations distinguish the gradient dynamics induced by these trigger classes. Adversary-injected triggers induce sharper, higher-magnitude gradients $k$9 because they never occur in clean text, so the model rapidly learns the mapping. This is associated with higher, earlier BSNR peaks. Natural triggers, by contrast, exist in benign data but at lower frequency, so $$\Delta_k^{\text{aff}} \approx (1-\lambda') \cdot \Delta_k^{\text{task}} + \lambda' \cdot \Delta_k^{\text{bd}} + \epsilon_k.$$0 is smaller and BSNR grows more slowly. At the same time, because the trigger is common, the backdoor remains stealthy (Zhao et al., 17 Feb 2026).

In practice, both trigger types reach comparable peak BSNR and yield greater than 95% attack success rate (ASR), although the BSNR-versus-round curves differ, with a faster rise for Badnets-style triggers. This comparison matters because it separates detectability from effectiveness. Injected triggers produce stronger early directional signatures, while natural triggers are more difficult to distinguish from ordinary data patterns.

A common misconception is that only artificial or rare trigger tokens can produce a robust federated backdoor. The observations summarized in (Zhao et al., 17 Feb 2026) directly contradict that assumption by showing that natural triggers also achieve high ASR, albeit with slower BSNR growth.

5. Empirical behavior and observed regimes

The empirical results in (Zhao et al., 17 Feb 2026) characterize the relationship among poison ratio per client, affected-client fraction, attack success, and BSNR dynamics.

For poison ratio $$\Delta_k^{\text{aff}} \approx (1-\lambda') \cdot \Delta_k^{\text{task}} + \lambda' \cdot \Delta_k^{\text{bd}} + \epsilon_k.$$1 per client, the paper reports that $$\Delta_k^{\text{aff}} \approx (1-\lambda') \cdot \Delta_k^{\text{task}} + \lambda' \cdot \Delta_k^{\text{bd}} + \epsilon_k.$$2 as low as 2% yields ASR greater than 70%, while $$\Delta_k^{\text{aff}} \approx (1-\lambda') \cdot \Delta_k^{\text{task}} + \lambda' \cdot \Delta_k^{\text{bd}} + \epsilon_k.$$3 saturates ASR around 95% and Main Accuracy (MA) drops by at most approximately 2%. For the affected-client fraction $$\Delta_k^{\text{aff}} \approx (1-\lambda') \cdot \Delta_k^{\text{task}} + \lambda' \cdot \Delta_k^{\text{bd}} + \epsilon_k.$$4, with $$\Delta_k^{\text{aff}} \approx (1-\lambda') \cdot \Delta_k^{\text{task}} + \lambda' \cdot \Delta_k^{\text{bd}} + \epsilon_k.$$5, ASR climbs above 60% by $$\Delta_k^{\text{aff}} \approx (1-\lambda') \cdot \Delta_k^{\text{task}} + \lambda' \cdot \Delta_k^{\text{bd}} + \epsilon_k.$$6 and nears 100% for $$\Delta_k^{\text{aff}} \approx (1-\lambda') \cdot \Delta_k^{\text{task}} + \lambda' \cdot \Delta_k^{\text{bd}} + \epsilon_k.$$7. The minimum $$\Delta_k^{\text{aff}} \approx (1-\lambda') \cdot \Delta_k^{\text{task}} + \lambda' \cdot \Delta_k^{\text{bd}} + \epsilon_k.$$8 needed for ASR = 60% falls as $$\Delta_k^{\text{aff}} \approx (1-\lambda') \cdot \Delta_k^{\text{task}} + \lambda' \cdot \Delta_k^{\text{bd}} + \epsilon_k.$$9 increases (Zhao et al., 17 Feb 2026).

The reported BSNR dynamics have three phases: rapid Rise, clear Peak, and slow Decay. The round at which maximum BSNR occurs decreases nearly linearly in $\Delta_k^{\text{task}}$0. The peak BSNR versus $\Delta_k^{\text{task}}$1 curve is roughly V-shaped, peaking around $\Delta_k^{\text{task}}$2, which the paper states confirms the two-regime theory (Zhao et al., 17 Feb 2026).

The numerical ranges given for the 7B-parameter experiments are also specific. Peak BSNR values typically lie between 0.1 and 0.5, although the exact scale depends on adapter norm. The attack becomes reliably greater than 85% ASR once BSNR exceeds $\Delta_k^{\text{task}}$3 in early rounds. Throughout the experiments, MA on clean QA remains within 1–2% of the undefended baseline, which the paper interprets as demonstrating stealth.

Quantity	Reported observation
$\Delta_k^{\text{task}}$4	2% gives ASR > 70%
$\Delta_k^{\text{task}}$5	$\Delta_k^{\text{task}}$6 saturates ASR around 95%
MA	Drop $\Delta_k^{\text{task}}$7 at high ASR
$\Delta_k^{\text{task}}$8 with $\Delta_k^{\text{task}}$9	ASR > 60% by $\Delta_k^{\text{bd}}$0
$\Delta_k^{\text{bd}}$1 with $\Delta_k^{\text{bd}}$2	ASR nears 100% for $\Delta_k^{\text{bd}}$3
Peak BSNR	Typically between 0.1 and 0.5
Early-round threshold	BSNR exceeding $\Delta_k^{\text{bd}}$4 corresponds to reliably >85% ASR

Taken together, these findings indicate that backdoor strength is not confined to large poison concentrations. Instead, distributed low-concentration poisoning can produce a sufficiently large aggregate directional signal while leaving primary-task behavior largely intact.

6. Consequences for defense and monitoring

The defense analysis in (Zhao et al., 17 Feb 2026) evaluates Krum, FreqFed, and FoundationFL, with Byzantine-robust aggregation. The central result is that defenses designed for attacks from malicious clients are ineffective against the distributed low-BSNR-to-high-BSNR threat pattern considered here.

In low-BSNR regimes, where $\Delta_k^{\text{bd}}$5, defenses such as Krum and FreqFed detect and filter the few abnormal updates, driving ASR toward zero. In high-BSNR regimes, around $\Delta_k^{\text{bd}}$6 to $\Delta_k^{\text{bd}}$7, BSNR is large enough that backdoor-bearing updates no longer appear anomalous, and all defenses fail while ASR remains approximately 100%. When $\Delta_k^{\text{bd}}$8, defenses again partially recover because clean clients are scarce, but reference estimates degrade and measured BSNR falls, even though the true backdoor effect remains (Zhao et al., 17 Feb 2026).

The reason given for this failure is structural. Existing defenses assume either a small number of malicious clients or a large-magnitude anomaly in a few updates. In the scenario modeled by BSNR, thousands of clients each carry a tiny, statistically coherent backdoor signal that lies below per-update anomaly thresholds but becomes strong in aggregate.

The paper gives several design recommendations. These include client-side data screening or anomaly detection to remove poisoned examples before training; aggregators that incorporate directional tests, such as monitoring the growth of BSNR itself, rather than magnitude thresholds; collaborative defenses that estimate $\Delta_k^{\text{bd}}$9 over many rounds and subtract its projection from updates; and frequency-space filtering, inspired by FreqFed, extended to text embeddings or adapter weight-space (Zhao et al., 17 Feb 2026).

These recommendations imply a change in defense philosophy. Instead of focusing only on outlier rejection at the client-update level, a BSNR-oriented defense would monitor the evolution of cross-client directional coherence over multiple rounds. The paper summarizes this with the idea that BSNR can serve both as a quantitative alarm signal, expressed as “BSNR $\epsilon_k$0,” and as a design guideline for new defenses (Zhao et al., 17 Feb 2026).