Hammer and Anvil: Backdoor Defense in Federated Learning

• Hammer and Anvil is a defense framework that partitions backdoor attacks by the ℓ2-norm magnitude of client updates, using robust aggregation (Hammer) for large deviations and fine-tuning (Anvil) for small ones.
• The framework concretely instantiates as Krum⁺, combining Krum's robust selection of benign updates with CSFT to ensure bounded byzantine robustness against adaptive attacks.
• Empirical evaluations on CIFAR-10 demonstrate that Hammer and Anvil maintains high benign accuracy while reducing attack success rates using a small, clean server-side dataset.

Hammer and Anvil is a defense framework for backdoor robustness in federated learning that combines a robust-aggregation stage, the “Hammer,” with a post-training fine-tuning removal stage, the “Anvil,” to ensure that no “size” of backdoor-inserting update can slip through (Fenaux et al., 9 Sep 2025). In the formulation introduced in “Hammer and Anvil: A Principled Defense Against Backdoors in Federated Learning,” the central object is the $\ell_2$-norm gap between expected benign and malicious updates, $$\Delta = \|E[\text{benign updates}] - E[\text{malicious updates}]\|_2$$, which partitions the attack space into large-magnitude updates that can be rejected or bounded by robust aggregation and small-magnitude updates that can be erased by clipped super-fine-tuning. The concrete instantiation Krum$^+$—Krum as Hammer and CSFT as Anvil—is presented as a defense with both a byzantine-robustness bound and empirical resilience against a new adaptive adversary and state-of-the-art attacks (Fenaux et al., 9 Sep 2025).

1. Federated-learning setting and backdoor threat model

The framework is defined in a standard federated-learning setting with $n$ clients indexed by $i = 1, \dots, n$, of which up to $m < n/2$ may be malicious (Fenaux et al., 9 Sep 2025). At round $t$, the server holds global model parameters $w_t \in \mathbb{R}^k$. Client $i$ holds private data $d_i \sim D$, while malicious clients may additionally hold backdoor data $$\Delta = \|E[\text{benign updates}] - E[\text{malicious updates}]\|_2$$0. Each client computes a local update

$$\Delta = \|E[\text{benign updates}] - E[\text{malicious updates}]\|_2$$1

although for malicious $$\Delta = \|E[\text{benign updates}] - E[\text{malicious updates}]\|_2$$2, $$\Delta = \|E[\text{benign updates}] - E[\text{malicious updates}]\|_2$$3 may train on $$\Delta = \|E[\text{benign updates}] - E[\text{malicious updates}]\|_2$$4 or directly craft $$\Delta = \|E[\text{benign updates}] - E[\text{malicious updates}]\|_2$$5 to embed a backdoor.

Under standard FedAvg aggregation, the update rule is

$$\Delta = \|E[\text{benign updates}] - E[\text{malicious updates}]\|_2$$6

where $$\Delta = \|E[\text{benign updates}] - E[\text{malicious updates}]\|_2$$7 is the set of $$\Delta = \|E[\text{benign updates}] - E[\text{malicious updates}]\|_2$$8 participating clients. The threat arises because the distributed setting allows malicious clients to participate in training while modifying the model’s behavior in a targeted manner.

A backdoor trigger is a small pattern $$\Delta = \|E[\text{benign updates}] - E[\text{malicious updates}]\|_2$$9 inserted into inputs $^+$0, so that the model labels $^+$1 as a target class $^+$2. The malicious objective is explicitly multi-objective:

$^+$3

so that the global model remains accurate on clean data but mis-classifies any $^+$4-triggered input as $^+$5 (Fenaux et al., 9 Sep 2025).

This construction makes the backdoor problem distinct from generic byzantine corruption. The attacker is not merely degrading utility; the attacker aims to preserve benign accuracy while inducing a trigger-conditional failure mode. The paper further emphasizes that no defense against backdoor attacks has stood the test of time, especially against adaptive attackers, and introduces a new adaptive adversary with stronger capabilities, yielding attacks that only require one or two malicious clients out of $^+$6 to break existing state-of-the-art defenses (Fenaux et al., 9 Sep 2025).

2. Magnitude-based decomposition: the Hammer and the Anvil principle

The key insight is that backdoor-inserting updates can be broadly split by their $^+$7-norm magnitude $^+$8 (Fenaux et al., 9 Sep 2025). Hammer and Anvil formalizes a two-regime defense strategy around this quantity.

The Hammer is a robust or clustering-based aggregator that excels at rejecting or bounding large-magnitude attacks. The examples given are Krum, median-of-means, and norm-bounding. The Anvil is a post-aggregation removal defense—“clipped super-fine-tuning” (CSFT)—that surgically removes small-magnitude backdoors by fine-tuning on a small clean dataset.

Two propositions structure the argument. Proposition 1 states that, as $^+$9 increases, Hammer detects malicious updates as outliers and either discards them or limits their influence. Therefore, there exists a threshold $n$0 such that any attack with $n$1 is neutralized by Hammer. Proposition 2 states that, as $n$2 decreases, the aggregated model converges ever closer to a clean-trained model, and a post-training fine-tune on a small clean set $n$3 plus gradient clipping will erase any residual backdoor. Therefore, there exists a threshold $n$4 such that any attack with $n$5 is removed by Anvil (Fenaux et al., 9 Sep 2025).

The resulting attack window is the interval $n$6. If $n$7, that window vanishes. This suggests that the defense is not tied to a single heuristic signal; instead, it is organized around complementary failure modes. Large deviations are filtered by robust aggregation, whereas small deviations are assumed to remain sufficiently close to the clean trajectory that post hoc benign fine-tuning can wash them out.

The approach is therefore described as principled because it combines two defenses orthogonal in their underlying principle to produce a combined defense that, given the right set of parameters, must succeed against any attack (Fenaux et al., 9 Sep 2025). The conceptual contribution is less a new isolated mechanism than a partition of the attack space by update magnitude.

3. Krum$n$8: concrete construction of the combined defense

The paper’s special case sets Hammer = Krum and Anvil = CSFT, yielding Krum$n$9 (Fenaux et al., 9 Sep 2025). Krum operates at each federated round on the set of updates $i = 1, \dots, n$0.

For each $i = 1, \dots, n$1, Krum computes the score

$i = 1, \dots, n$2

where $i = 1, \dots, n$3 is the set of the $i = 1, \dots, n$4 clients whose updates are closest to $i = 1, \dots, n$5 in Euclidean distance. Krum then selects

$i = 1, \dots, n$6

sets $i = 1, \dots, n$7, and updates

$i = 1, \dots, n$8

Operationally, the server computes pairwise distances $i = 1, \dots, n$9 for all $m < n/2$0, forms the nearest-neighbor set $m < n/2$1, evaluates the score for each candidate update, and returns the lowest-score update as the round update. The intended effect is to select an update embedded in the honest cluster rather than an outlier.

CSFT is applied after $m < n/2$2 federated rounds have produced $m < n/2$3. The server possesses a small clean fine-tuning set $m < n/2$4 of size $m < n/2$5, for example $m < n/2$6–$m < n/2$7 of total samples (Fenaux et al., 9 Sep 2025). Given hyper-parameters clip threshold $m < n/2$8 and a learning-rate schedule $m < n/2$9 over $t$0 epochs, CSFT initializes $t$1, computes the gradient $t$2, clips it as

$t$3

sets the learning rate according to the super-fine schedule, and updates

$t$4

After $t$5 epochs it returns $t$6.

The combined defense is correspondingly simple. At each round $t$7, the server distributes $t$8 to $t$9 clients, collects their updates $w_t \in \mathbb{R}^k$0, and sets

$w_t \in \mathbb{R}^k$1

After $w_t \in \mathbb{R}^k$2 rounds, the server applies

$w_t \in \mathbb{R}^k$3

This decomposition is significant because the two stages act on different objects. Krum is a round-wise aggregator over client updates, whereas CSFT is a post-training model repair procedure over server-held clean data. The orthogonality of these mechanisms is the basis for the claimed complementarity.

4. Formal guarantees, thresholds, and parameter effects

By design, Krum tolerates up to $w_t \in \mathbb{R}^k$4 Byzantine clients. Under the classical analysis cited in the paper, if at most $w_t \in \mathbb{R}^k$5 updates are arbitrary, Krum still selects one of the honest updates. Thus for large-$w_t \in \mathbb{R}^k$6 attacks with $w_t \in \mathbb{R}^k$7, Krum$w_t \in \mathbb{R}^k$8 has the same byzantine-robustness bound:

$w_t \in \mathbb{R}^k$9

For small-$i$0 attacks with $i$1, CSFT fine-tunes the model on purely benign data, and because $i$2 is the threshold below which the backdoor weight signature is smaller than the noise floor introduced by fine-tuning and clipping, the residual backdoor is erased in $i$3 epochs (Fenaux et al., 9 Sep 2025).

The combined statement is:

$i$4

The proof sketch in the paper is correspondingly bifurcated. If $i$5, the malicious updates lie far from the honest cluster, so Krum’s outlier detection discards them or fails to select them. If $i$6, then the final model after federated training is within $i$7 of a clean model, and CSFT with gradient clipping re-centers $i$8 at the honest optimum, washing out any backdoor (Fenaux et al., 9 Sep 2025).

The parameter choices are presented as follows. The number of malicious clients $i$9 must satisfy $d_i \sim D$0 for Krum’s guarantee. The size of the fine-tuning set $d_i \sim D$1 is stated as $d_i \sim D$2–$d_i \sim D$3 of total samples, yielding minimal benign-accuracy loss and full backdoor removal; fewer samples can suffice but may overfit, while more samples give diminishing returns. The clipping threshold $d_i \sim D$4 is typically $d_i \sim D$5–$d_i \sim D$6; too small degrades accuracy, too large lets backdoor gradients slip through. The CSFT duration is $d_i \sim D$7 epochs, after which accuracy stabilizes and ASR remains low. The learning-rate schedule is a cyclical sawtooth between $d_i \sim D$8 and $d_i \sim D$9, which helps escape local minima induced by the backdoor (Fenaux et al., 9 Sep 2025).

These thresholds and hyper-parameters define the operational regime of the method. A plausible implication is that the defense’s effectiveness depends not only on the existence of the Hammer/Anvil split, but also on whether practical parameter settings bring $$\Delta = \|E[\text{benign updates}] - E[\text{malicious updates}]\|_2$$00 and $$\Delta = \|E[\text{benign updates}] - E[\text{malicious updates}]\|_2$$01 sufficiently close that the intermediate window is negligible.

5. Experimental evaluation and empirical behavior

The reported experimental setup uses CIFAR-10 with $$\Delta = \|E[\text{benign updates}] - E[\text{malicious updates}]\|_2$$02k train and $$\Delta = \|E[\text{benign updates}] - E[\text{malicious updates}]\|_2$$03k test samples, $$\Delta = \|E[\text{benign updates}] - E[\text{malicious updates}]\|_2$$04 clients, and $$\Delta = \|E[\text{benign updates}] - E[\text{malicious updates}]\|_2$$05 participants per round (Fenaux et al., 9 Sep 2025). The number of malicious clients is varied over $$\Delta = \|E[\text{benign updates}] - E[\text{malicious updates}]\|_2$$06. Fine-tuning sets $$\Delta = \|E[\text{benign updates}] - E[\text{malicious updates}]\|_2$$07 have size $$\Delta = \|E[\text{benign updates}] - E[\text{malicious updates}]\|_2$$08 ($$\Delta = \|E[\text{benign updates}] - E[\text{malicious updates}]\|_2$$09) or $$\Delta = \|E[\text{benign updates}] - E[\text{malicious updates}]\|_2$$10 ($$\Delta = \|E[\text{benign updates}] - E[\text{malicious updates}]\|_2$$11). The attacks include artificial triggers—BadNet patch and blended whole-image triggers—together with adaptive attacks against Krum, MoM, and norm-bounding, plus state-of-the-art attacks DBA, Neurotoxin, and model-replacement. The metrics are benign accuracy on the CIFAR-10 test set and attack success rate (ASR), defined as the percentage of $$\Delta = \|E[\text{benign updates}] - E[\text{malicious updates}]\|_2$$12-triggered inputs classified as the target $$\Delta = \|E[\text{benign updates}] - E[\text{malicious updates}]\|_2$$13.

The core CIFAR-10 results are sharply differentiated across defense configurations. Hammer alone, instantiated as Krum, yields ASR $$\Delta = \|E[\text{benign updates}] - E[\text{malicious updates}]\|_2$$14 for $$\Delta = \|E[\text{benign updates}] - E[\text{malicious updates}]\|_2$$15. Anvil alone, instantiated as CSFT, fails for $$\Delta = \|E[\text{benign updates}] - E[\text{malicious updates}]\|_2$$16 large-$$\Delta = \|E[\text{benign updates}] - E[\text{malicious updates}]\|_2$$17 attacks with ASR $$\Delta = \|E[\text{benign updates}] - E[\text{malicious updates}]\|_2$$18. Krum$$\Delta = \|E[\text{benign updates}] - E[\text{malicious updates}]\|_2$$19 obtains ASR $$\Delta = \|E[\text{benign updates}] - E[\text{malicious updates}]\|_2$$20 in all $$\Delta = \|E[\text{benign updates}] - E[\text{malicious updates}]\|_2$$21 configurations formed by $$\Delta = \|E[\text{benign updates}] - E[\text{malicious updates}]\|_2$$22 and two trigger types, with $$\Delta = \|E[\text{benign updates}] - E[\text{malicious updates}]\|_2$$23 benign-accuracy loss. Against DBA, Neurotoxin, and model-replacement, Krum$$\Delta = \|E[\text{benign updates}] - E[\text{malicious updates}]\|_2$$24 defends with nearly zero ASR (Fenaux et al., 9 Sep 2025).

Additional studies characterize the hyper-parameter sensitivities. When varying $$\Delta = \|E[\text{benign updates}] - E[\text{malicious updates}]\|_2$$25, accuracy plateaus beyond $$\Delta = \|E[\text{benign updates}] - E[\text{malicious updates}]\|_2$$26 samples, and ASR falls below $$\Delta = \|E[\text{benign updates}] - E[\text{malicious updates}]\|_2$$27 for $$\Delta = \|E[\text{benign updates}] - E[\text{malicious updates}]\|_2$$28. When varying $$\Delta = \|E[\text{benign updates}] - E[\text{malicious updates}]\|_2$$29, the method needs approximately $$\Delta = \|E[\text{benign updates}] - E[\text{malicious updates}]\|_2$$30 fine-tuning epochs, and monitoring clean-accuracy convergence suffices to stop. Under non-IID data with Dirichlet $$\Delta = \|E[\text{benign updates}] - E[\text{malicious updates}]\|_2$$31 and on MNIST, Krum$$\Delta = \|E[\text{benign updates}] - E[\text{malicious updates}]\|_2$$32 remains effective with $$\Delta = \|E[\text{benign updates}] - E[\text{malicious updates}]\|_2$$33 accuracy loss (Fenaux et al., 9 Sep 2025).

These results support the central empirical claim that the two components cover regimes that each fails to handle in isolation. Krum alone does not prevent successful backdoors in the tested setting, while CSFT alone is insufficient for large-$$\Delta = \|E[\text{benign updates}] - E[\text{malicious updates}]\|_2$$34 attacks at higher attacker counts. The combined defense is presented as the first federated backdoor defense with both theory and practice aligned against adaptive attackers (Fenaux et al., 9 Sep 2025).

6. Trade-offs, limitations, and prospective extensions

The trade-offs are stated directly. Hammer and Anvil requires a small clean dataset $$\Delta = \|E[\text{benign updates}] - E[\text{malicious updates}]\|_2$$35 at the server, incurs extra computation through CSFT for $$\Delta = \|E[\text{benign updates}] - E[\text{malicious updates}]\|_2$$36 epochs, and relies on tuning hyper-parameters $$\Delta = \|E[\text{benign updates}] - E[\text{malicious updates}]\|_2$$37, although those hyper-parameters are described as robust over wide ranges (Fenaux et al., 9 Sep 2025). These costs are structurally tied to the Anvil stage: without server-side clean data and post-training compute, the second half of the defense cannot be instantiated.

The limitations are equally explicit. If the server has no clean data, Anvil is unavailable. Extremely stealthy attacks at $$\Delta = \|E[\text{benign updates}] - E[\text{malicious updates}]\|_2$$38 could in principle slip through if the two thresholds separate. As-is, Krum operates only when $$\Delta = \|E[\text{benign updates}] - E[\text{malicious updates}]\|_2$$39 (Fenaux et al., 9 Sep 2025). The theoretical framing therefore does not eliminate all adversarial possibilities; rather, it identifies the conditions under which large- and small-magnitude attacks are each covered.

The extensions proposed in the paper preserve the same architectural principle while changing one or both components. The Hammer could be replaced with a stronger Hammer, for example FLAME’s clustering. The Anvil could be improved by combining pruning or lottery-ticket fine-tuning. The framework could be adapted to other data modalities such as NLP and speech, and personalization could be explored by applying Anvil per-user (Fenaux et al., 9 Sep 2025).

Taken together, these points position Hammer and Anvil as a modular template rather than a single fixed algorithm. The broader significance lies in the claim that large updates are filtered by a robust aggregator and small updates are ground to dust by post-processing fine-tuning, with Krum$$\Delta = \|E[\text{benign updates}] - E[\text{malicious updates}]\|_2$$40 serving as the concrete demonstration that the two-stage construction can achieve provably bounded byzantine robustness plus empirical backdoor removal in every scenario studied (Fenaux et al., 9 Sep 2025).