---
title: 'Hammer and Anvil: Backdoor Defense in Federated Learning'
url: https://www.emergentmind.com/topics/hammer-and-anvil
type: topic
---

# Hammer and Anvil: Backdoor Defense in Federated Learning

Hammer and Anvil is a defense framework for backdoor robustness in federated learning that combines a robust-aggregation stage, the “Hammer,” with a post-training fine-tuning removal stage, the “Anvil,” to ensure that no “size” of backdoor-inserting update can slip through [2509.08089]. In the formulation introduced in “Hammer and Anvil: A Principled Defense Against Backdoors in Federated Learning,” the central object is the $\ell_2$-norm gap between expected benign and malicious updates, $\Delta = \|E[\text{benign updates}] - E[\text{malicious updates}]\|_2$, which partitions the attack space into large-magnitude updates that can be rejected or bounded by robust aggregation and small-magnitude updates that can be erased by clipped super-fine-tuning. The concrete instantiation Krum$^+$—Krum as Hammer and CSFT as Anvil—is presented as a defense with both a byzantine-robustness bound and empirical resilience against a new adaptive adversary and state-of-the-art attacks [2509.08089].

## 1. Federated-learning setting and backdoor threat model

The framework is defined in a standard federated-learning setting with $n$ clients indexed by $i = 1, \dots, n$, of which up to $m < n/2$ may be malicious [2509.08089]. At round $t$, the server holds global model parameters $w_t \in \mathbb{R}^k$. Client $i$ holds private data $d_i \sim D$, while malicious clients may additionally hold backdoor data $b_i \sim B$. Each client computes a local update
$$
u_i = T(w_t, d_i),
$$
although for malicious $i$, $T$ may train on $d_i \cup b_i$ or directly craft $u_i$ to embed a backdoor.

Under standard FedAvg aggregation, the update rule is
$$
w_{t+1} = w_t + \frac{1}{s}\sum_{i \in S_t} u_i,
$$
where $S_t$ is the set of $s$ participating clients. The threat arises because the distributed setting allows malicious clients to participate in training while modifying the model’s behavior in a targeted manner.

A backdoor trigger is a small pattern $\sigma$ inserted into inputs $x$, so that the model labels $x \oplus \sigma$ as a target class $y^*$. The malicious objective is explicitly multi-objective:
$$
\min \sum_{(x,y)\in d_i} L(f_w(x), y) + \sum_{(x',y^*)\in b_i} L(f_w(x' \oplus \sigma), y^*),
$$
so that the global model remains accurate on clean data but mis-classifies any $\sigma$-triggered input as $y^*$ [2509.08089].

This construction makes the backdoor problem distinct from generic byzantine corruption. The attacker is not merely degrading utility; the attacker aims to preserve benign accuracy while inducing a trigger-conditional failure mode. The paper further emphasizes that no defense against backdoor attacks has stood the test of time, especially against adaptive attackers, and introduces a new adaptive adversary with stronger capabilities, yielding attacks that only require one or two malicious clients out of $20$ to break existing state-of-the-art defenses [2509.08089].

## 2. Magnitude-based decomposition: the Hammer and the Anvil principle

The key insight is that backdoor-inserting updates can be broadly split by their $\ell_2$-norm magnitude $\Delta = \|E[\text{benign updates}] - E[\text{malicious updates}]\|_2$ [2509.08089]. Hammer and Anvil formalizes a two-regime defense strategy around this quantity.

The Hammer is a robust or clustering-based aggregator that excels at rejecting or bounding large-magnitude attacks. The examples given are Krum, median-of-means, and norm-bounding. The Anvil is a post-aggregation removal defense—“clipped super-fine-tuning” (CSFT)—that surgically removes small-magnitude backdoors by fine-tuning on a small clean dataset.

Two propositions structure the argument. Proposition 1 states that, as $\Delta$ increases, Hammer detects malicious updates as outliers and either discards them or limits their influence. Therefore, there exists a threshold $\Delta_1$ such that any attack with $\Delta > \Delta_1$ is neutralized by Hammer. Proposition 2 states that, as $\Delta$ decreases, the aggregated model converges ever closer to a clean-trained model, and a post-training fine-tune on a small clean set $f \sim D$ plus gradient clipping will erase any residual backdoor. Therefore, there exists a threshold $\Delta_2$ such that any attack with $\Delta < \Delta_2$ is removed by Anvil [2509.08089].

The resulting attack window is the interval $\Delta \in [\Delta_2, \Delta_1]$. If $\Delta_1 \approx \Delta_2$, that window vanishes. This suggests that the defense is not tied to a single heuristic signal; instead, it is organized around complementary failure modes. Large deviations are filtered by robust aggregation, whereas small deviations are assumed to remain sufficiently close to the clean trajectory that post hoc benign fine-tuning can wash them out.

The approach is therefore described as principled because it combines two defenses orthogonal in their underlying principle to produce a combined defense that, given the right set of parameters, must succeed against any attack [2509.08089]. The conceptual contribution is less a new isolated mechanism than a partition of the attack space by update magnitude.

## 3. Krum$^+$: concrete construction of the combined defense

The paper’s special case sets Hammer = Krum and Anvil = CSFT, yielding Krum$^+$ [2509.08089]. Krum operates at each federated round on the set of updates $\{u_i\}_{i \in S_t}$.

For each $j \in S_t$, Krum computes the score
$$
\mathrm{score}(j) = \sum_{i \in N_j} \|u_j - u_i\|_2^2,
$$
where $N_j$ is the set of the $(|S_t| - m - 2)$ clients whose updates are closest to $u_j$ in Euclidean distance. Krum then selects
$$
j^* = \arg\min_j \mathrm{score}(j),
$$
sets $\Delta_t = u_{j^*}$, and updates
$$
w_{t+1} = w_t + \Delta_t.
$$

Operationally, the server computes pairwise distances $d_{j,i} = \|u_j - u_i\|_2$ for all $i \neq j$, forms the nearest-neighbor set $N_j$, evaluates the score for each candidate update, and returns the lowest-score update as the round update. The intended effect is to select an update embedded in the honest cluster rather than an outlier.

CSFT is applied after $T$ federated rounds have produced $w_T$. The server possesses a small clean fine-tuning set $F$ of size $r$, for example $1$–$4\%$ of total samples [2509.08089]. Given hyper-parameters clip threshold $C$ and a learning-rate schedule $\mathrm{LR\_BASE}, \mathrm{LR\_MAX}_1, \mathrm{LR\_MAX}_2$ over $E$ epochs, CSFT initializes $w \leftarrow w_T$, computes the gradient $g = \nabla_w L(w; F)$, clips it as
$$
g \leftarrow g \cdot \min(1, C/\|g\|_2),
$$
sets the learning rate according to the super-fine schedule, and updates
$$
w \leftarrow w - \mathrm{lr} \cdot g.
$$
After $E$ epochs it returns $w_{\text{final}}$.

The combined defense is correspondingly simple. At each round $t = 1, \dots, T$, the server distributes $w_t$ to $s$ clients, collects their updates $U_t$, and sets
$$
w_{t+1} = w_t + \mathrm{Krum}(U_t).
$$
After $T$ rounds, the server applies
$$
w_{\text{final}} = \mathrm{CSFT}(w_T; F, C, \dots).
$$

This decomposition is significant because the two stages act on different objects. Krum is a round-wise aggregator over client updates, whereas CSFT is a post-training model repair procedure over server-held clean data. The orthogonality of these mechanisms is the basis for the claimed complementarity.

## 4. Formal guarantees, thresholds, and parameter effects

By design, Krum tolerates up to $m < (|S_t| - 2)/2$ Byzantine clients. Under the classical analysis cited in the paper, if at most $m$ updates are arbitrary, Krum still selects one of the honest updates. Thus for large-$\Delta$ attacks with $\Delta > \Delta_1$, Krum$^+$ has the same byzantine-robustness bound:
$$
m \le \left\lfloor \frac{|S_t| - 2}{2} \right\rfloor - 1.
$$
For small-$\Delta$ attacks with $\Delta < \Delta_2$, CSFT fine-tunes the model on purely benign data, and because $\Delta_2$ is the threshold below which the backdoor weight signature is smaller than the noise floor introduced by fine-tuning and clipping, the residual backdoor is erased in $O(E)$ epochs [2509.08089].

The combined statement is:
$$
\forall \text{ attack updates } \Delta,\ \text{either } \Delta > \Delta_1 \Rightarrow \text{Hammer removes payload, or } \Delta < \Delta_2 \Rightarrow \text{Anvil removes payload}.
$$
The proof sketch in the paper is correspondingly bifurcated. If $\Delta > \Delta_1$, the malicious updates lie far from the honest cluster, so Krum’s outlier detection discards them or fails to select them. If $\Delta < \Delta_2$, then the final model after federated training is within $\|w_T - w_{\text{clean}}\|_2 < \epsilon$ of a clean model, and CSFT with gradient clipping re-centers $w$ at the honest optimum, washing out any backdoor [2509.08089].

The parameter choices are presented as follows. The number of malicious clients $m$ must satisfy $m < \lfloor (n - 2)/2 \rfloor$ for Krum’s guarantee. The size of the fine-tuning set $r$ is stated as $1\%$–$4\%$ of total samples, yielding minimal benign-accuracy loss and full backdoor removal; fewer samples can suffice but may overfit, while more samples give diminishing returns. The clipping threshold $C$ is typically $2$–$10$; too small degrades accuracy, too large lets backdoor gradients slip through. The CSFT duration is $O(20)$ epochs, after which accuracy stabilizes and ASR remains low. The learning-rate schedule is a cyclical sawtooth between $\mathrm{LR\_BASE}$ and $\mathrm{LR\_MAX}_1/\mathrm{LR\_MAX}_2$, which helps escape local minima induced by the backdoor [2509.08089].

These thresholds and hyper-parameters define the operational regime of the method. A plausible implication is that the defense’s effectiveness depends not only on the existence of the Hammer/Anvil split, but also on whether practical parameter settings bring $\Delta_1$ and $\Delta_2$ sufficiently close that the intermediate window is negligible.

## 5. Experimental evaluation and empirical behavior

The reported experimental setup uses CIFAR-10 with $50$k train and $10$k test samples, $n = 20$ clients, and $s = 20$ participants per round [2509.08089]. The number of malicious clients is varied over $m \in \{1,2,4,8\}$. Fine-tuning sets $F$ have size $500$ ($1\%$) or $2000$ ($4\%$). The attacks include artificial triggers—BadNet patch and blended whole-image triggers—together with adaptive attacks against Krum, MoM, and norm-bounding, plus state-of-the-art attacks DBA, Neurotoxin, and model-replacement. The metrics are benign accuracy on the CIFAR-10 test set and attack success rate (ASR), defined as the percentage of $\sigma$-triggered inputs classified as the target $y^*$.

The core CIFAR-10 results are sharply differentiated across defense configurations. Hammer alone, instantiated as Krum, yields ASR $\approx 100\%$ for $m \ge 1$. Anvil alone, instantiated as CSFT, fails for $m \ge 4$ large-$\Delta$ attacks with ASR $> 80\%$. Krum$^+$ obtains ASR $< 50\%$ in all $8$ configurations formed by $m \in \{1,2,4,8\}$ and two trigger types, with $\le 4\%$ benign-accuracy loss. Against DBA, Neurotoxin, and model-replacement, Krum$^+$ defends with nearly zero ASR [2509.08089].

Additional studies characterize the hyper-parameter sensitivities. When varying $r$, accuracy plateaus beyond $2000$ samples, and ASR falls below $50\%$ for $r \ge 300$. When varying $E$, the method needs approximately $20$ fine-tuning epochs, and monitoring clean-accuracy convergence suffices to stop. Under non-IID data with Dirichlet $\alpha = 0.5$ and on MNIST, Krum$^+$ remains effective with $< 1\%$ accuracy loss [2509.08089].

These results support the central empirical claim that the two components cover regimes that each fails to handle in isolation. Krum alone does not prevent successful backdoors in the tested setting, while CSFT alone is insufficient for large-$\Delta$ attacks at higher attacker counts. The combined defense is presented as the first federated backdoor defense with both theory and practice aligned against adaptive attackers [2509.08089].

## 6. Trade-offs, limitations, and prospective extensions

The trade-offs are stated directly. Hammer and Anvil requires a small clean dataset $F$ at the server, incurs extra computation through CSFT for $E$ epochs, and relies on tuning hyper-parameters $(C, E, r)$, although those hyper-parameters are described as robust over wide ranges [2509.08089]. These costs are structurally tied to the Anvil stage: without server-side clean data and post-training compute, the second half of the defense cannot be instantiated.

The limitations are equally explicit. If the server has no clean data, Anvil is unavailable. Extremely stealthy attacks at $\Delta \approx \Delta_1 \approx \Delta_2$ could in principle slip through if the two thresholds separate. As-is, Krum operates only when $m < \lfloor (n - 2)/2 \rfloor$ [2509.08089]. The theoretical framing therefore does not eliminate all adversarial possibilities; rather, it identifies the conditions under which large- and small-magnitude attacks are each covered.

The extensions proposed in the paper preserve the same architectural principle while changing one or both components. The Hammer could be replaced with a stronger Hammer, for example FLAME’s clustering. The Anvil could be improved by combining pruning or lottery-ticket fine-tuning. The framework could be adapted to other data modalities such as NLP and speech, and personalization could be explored by applying Anvil per-user [2509.08089].

Taken together, these points position Hammer and Anvil as a modular template rather than a single fixed algorithm. The broader significance lies in the claim that large updates are filtered by a robust aggregator and small updates are ground to dust by post-processing fine-tuning, with Krum$^+$ serving as the concrete demonstration that the two-stage construction can achieve provably bounded byzantine robustness plus empirical backdoor removal in every scenario studied [2509.08089].

Source: https://www.emergentmind.com/topics/hammer-and-anvil