Coward: Federated Backdoor Defense

• Coward is a proactive defense method in federated learning that uses collision-based OOD watermarking to detect and neutralize backdoor attacks.
• It exploits a multi-backdoor collision effect by sequentially implanting distinct triggers to suppress adversarial mappings in client updates.
• Experimental evaluations on benchmarks like CIFAR-10 demonstrate Coward’s high true-positive rates and low false-positive rates even under non-i.i.d conditions.

In federated learning, the integrity of the global model is threatened by backdoor attacks, in which adversarial clients upload poisoned model updates that induce the model to misclassify specific data containing malicious triggers. "Coward" is a practical, proactive defense method designed to robustly detect and neutralize such backdoor attacks in federated learning, particularly under realistic non-i.i.d. data distributions and adversarial adaptive strategies. Coward exploits a novel multi-backdoor collision effect, operationalized via collision-based out-of-distribution (OOD) watermarks systematically injected and evaluated during the federated training process (Li et al., 4 Aug 2025).

1. Threat Model and Prior Defense Limitations

Federated learning (FL) orchestrates learning over $K$ clients for $T$ rounds, using variants of FedAvg. In each round $t$, a subset $S^t$ of clients receives the current global model $w^t$, locally trains, and submits updates $\Delta w_k^t$. The server aggregates:

$$w^{t+1} = w^t + \sum_{k \in S^t} \frac{N_k}{\sum_{j \in S^t} N_j} \Delta w_k^t$$

Attackers, controlling a minority of clients, inject backdoors by partially poisoning their local data with a trigger $t_a$, inducing the mapping $x \oplus t_a \mapsto y_a \ne y_{\rm true}$. The defender (server) lacks access to private client data but is permitted to modify broadcasted models and perform OOD evaluations.

Limitations of passive defenses (clustering, outlier filtering: MultiKrum, Foolsgold, FLAME, etc.) are pronounced in realistic FL scenarios, as non-i.i.d. data and random participation amplify benign variability, causing high false-positive rates and sensitivity collapse ("non-i.i.d. blurring").

Existing proactive defenses (e.g., BackdoorIndicator) inject server-side OOD mappings and compare class-wise OOD prediction accuracy, but deep models exhibit extreme OOD-prediction bias, leading to benign clients breaching thresholds and unpredictable false positives.

2. Multi-Backdoor Collision Principle

The core empirical observation underlying Coward is that sequential implantation of two distinct backdoors (triggers $t_1$, $T$0 with targets $T$1) provokes a strong suppression of the earlier mapping by the latter—a "collision" effect far exceeding ordinary fine-tuning drift.

Formally, if $T$2 is the attack success rate for $T$3 after its placement, and $T$4 is the ASR after subsequent backdoor-2 injection, then:

$T$5

The effect is attributed to the superposition of conflicting gradient fields in the OOD feature region, resulting in rapid and robust erasure of prior backdoor mappings. This mechanism enables detection based on monitoring the fate of a global server-injected watermark under client-side updates.

3. Collision-Based OOD Watermarking Mechanism

Coward injects a global watermark—an OOD backdoor—whose persistence or erasure can be used to discriminate benign from malicious updates.

3.1 Regulated Base OOD Mapping

A deterministic mapping $T$6 is established between OOD and target class spaces. The server constructs a planting set $T$7 from OOD data, minimizing:

$T$8

where CE is cross-entropy loss, promoting stability and controllability of OOD predictions.

3.2 Targeted Watermark Mapping

A fraction $T$9 of $t$0 is selected; each sample is augmented with a trigger $t$1 and relabeled to a unique server-selected target $t$2. The server minimizes:

$t$3

Both losses are combined for a small number of OOD-only steps before each round:

$t$4

Here, $t$5 regularizes deviation from the current global state, and OOD-specific BatchNorm statistics are managed to isolate the operation.

4. Client-Side Dynamics and Watermark Collision

Benign clients minimize standard supervised cross-entropy over their local data:

$t$6

Malicious clients extend this with a backdoor loss on their poisoned partition:

$t$7

Critically, when $t$8, attacker-induced gradients conflict with the server’s watermark, rapidly erasing the watermark (empirically, watermark accuracy reduces to zero). Thus, the presence/absence of the watermark in returned models serves as a reliable indicator of attack.

5. Detection Framework and Aggregation Rule

After receiving a client model $t$9, the server evaluates the watermark prediction accuracy:

$S^t$0

Clients with $S^t$1 (recommended $S^t$2=5%) are deemed benign, while those below are flagged as malicious. Only benign clients contribute to the global update:

$S^t$3

This test statistic and thresholding scheme directly leverage the multi-backdoor collision mechanism.

6. Experimental Results and Comparative Evaluation

Coward has been comprehensively validated on CIFAR-10, CIFAR-100, and EMNIST, using ResNet-18, with 100 clients, and strong data heterogeneity (Dirichlet $S^t$4).

Metrics include true-positive rate (TPR), false-positive rate (FPR), attack success rate (ASR), and benign accuracy (BA). Key findings are summarized below:

Scenario	Coward	BackdoorIndicator	Best Passive Defenses
Non-IID (α=0.3)	TPR ≥ 99%, FPR ≤ 9.6%	TPR ≈ 93–94%, FPR ≈ 30%	TPR < 10%
Advanced Attacks	TPR ≈ 98–100%, FPR < 10%, ASR < 10%	TPR ≈ 87–93%, FPR 30–50%	TPR < 15%
Multi-Attacker (70%)	TPR ≥ 100%, FPR < 12%, ASR ≈ 10–11%	ASR up to 40% (>50% attackers)	Fail

Ablation studies show that Coward's FPR remains below 6% even with noise or highly dissimilar OOD sets, in contrast to FPR > 50% for BackdoorIndicator. Across multiple triggers and thresholds, Coward sustains TPR > 96.5% and practical FPR < 17.3%. One iteration of watermarking already achieves TPR = 100%, FPR ≈ 12%.

7. Adaptive Strategies, Overheads, and Extensions

Coward demonstrates resilience against adaptive attackers such as the Periodic Guessing Attack, in which adversaries attempt to preserve the watermark by guessing server triggers and targets. Even with maximal adaptivity (guessing every round), the global ASR remains below 25% (versus >90% without defense), and such attempts destabilize attacker performance due to local collision contradictions.

The method incurs negligible overhead, using only five OOD optimization iterations per round. Hyperparameters are robust to broad variation: planting set size = 1000, $S^t$5 = 20%, $S^t$6 = 0.3, $S^t$7 = 5%. Future directions include fine-grained or dynamic watermarks (class/sample-specific, per-round, or per-client), and multi-metric detection strategies that can integrate OOD base retention with collision erasure.

Coward establishes a robust, proactive, and practical line of defense against federated backdoor attacks, based on fundamental advances in characterizing and exploiting destructive interference among neural backdoors (Li et al., 4 Aug 2025).