MARS: Malignity-Aware Backdoor Defense

• MARS is a federated learning defense that uses neuron-level Backdoor Energy to detect trigger-induced deviations from uploaded model parameters.
• It filters malicious client updates by concentrating top energy values and applying 1-Wasserstein distance clustering to separate benign from adversarial behaviors.
• Experimental evaluations show MARS achieves high true positive rates and low false positive rates while preserving clean accuracy under adaptive backdoor attacks.

Searching arXiv for the MARS paper and closely related federated backdoor-defense work.

Malignity-Aware Backdoor Defense, abbreviated MARS, is a server-side defense for federated learning (FL) that is designed to detect and filter backdoored client models using only uploaded model parameters, without access to client data, triggers, gradient histories, or a clean validation set. It was introduced as a response to adaptive FL backdoor attacks, particularly 3DFed, which uses an indicator mechanism with decoy models and noise masks to evade defenses based on empirical statistics such as norms, out-of-distribution behavior, or pairwise consistency. MARS replaces those loosely coupled heuristics with a malignity-oriented signal: neuron-level Backdoor Energy (BE), a data-free approximation of how strongly a neuron can contribute to trigger-induced deviations, together with Concentrated Backdoor Energy (CBE) and 1-Wasserstein-distance clustering to separate benign and malicious client updates (Wan et al., 21 Sep 2025).

1. Problem setting and design rationale

MARS is situated in synchronous cross-device FL with a central server. In each round, the server samples a subset of clients, clients perform local training and upload model parameters, and the server aggregates accepted models by weighted averaging. The defense assumes a strong adversary: attackers can optimize a compound loss to balance stealth and backdoor efficacy, collude by sharing data and parameters, exploit server behavior such as 3DFed’s acceptance indicator, and even outnumber benign participants. The defender, by contrast, is explicitly data-free and model-only: it observes uploaded model parameters only, does not require trusted clients, and does not rely on a clean validation set (Wan et al., 21 Sep 2025).

The central diagnosis motivating MARS is that existing defenses fail because they employ empirical statistical measures that are loosely coupled with backdoor attacks. In the formulation summarized for MARS, norm constraints can be neutralized because modern attacks keep malicious updates near the prior global model; out-of-distribution and projection-based methods can be confused by decoy outliers or by deliberate alignment of cosine and Euclidean statistics to benign distributions; and consistency-based defenses are disrupted by noise masks and by the intrinsic variability induced by non-IID data. MARS therefore shifts the decision criterion from apparent benignness to what the paper treats as backdoor intent: the capacity of neurons to amplify trigger-induced changes.

This suggests a conceptual distinction between two classes of FL defense. One class measures update geometry or inter-client similarity; the other, represented by MARS, attempts to estimate the latent functional role of model components in implementing backdoor behavior. The paper argues that adaptive attacks such as 3DFed are especially effective against the first class because their acceptance logic is exposed indirectly through server decisions, whereas MARS aims to judge malignity using a quantity more tightly coupled to backdoor behavior itself.

2. Backdoor Energy as a malignity measure

The formal object at the center of MARS is Backdoor Energy. Let the global model be written as a composition of sub-networks,

$$F = f^{(L)} \circ f^{(L-1)} \circ \cdots \circ f^{(1)},$$

with parameters $\theta$. Let $F_k^{(l)}(\cdot)$ denote the output of neuron or channel $k$ at layer $l$, let $\delta(x)$ denote an unknown backdoor trigger generator, and let $n_l$ be the number of neurons or channels in layer $l$. The initial definition of the true BE for neuron $k$ in layer $l$ is

$\theta$0

Under a Lipschitz-smoothness assumption, MARS derives the upper bound

$\theta$1

Because the defender only needs relative magnitudes within the same layer, the common multiplicative factor can be dropped, yielding the data-free approximation

$\theta$2

In MARS, this approximation is the practical malignity score assigned to each neuron or channel (Wan et al., 21 Sep 2025).

The corresponding parameter-level estimators are architecture-aware but simple. For a linear sub-network $\theta$3, the Lipschitz constant is the spectral norm $\theta$4. For convolutional layers, the kernel tensor is reshaped into a 2D matrix and the spectral norm is approximated using SVD or power iteration. For batch normalization,

$\theta$5

the Lipschitz constant is approximated by the maximal scale factor $\theta$6. The implementation guidance further states that, for speed, BE is computed for convolutional and BN layers, while fully connected layers can be omitted without hurting detection efficacy.

The intended interpretation is direct: high-BE neurons are treated as those most capable of enacting trigger-induced deviations. Because this score is derived from model parameters rather than empirical server-side statistics, the paper positions it as more resistant to attacks that mimic benign update distributions.

3. Concentrated Backdoor Energy and Wasserstein clustering

MARS does not use all BE values equally. It assumes that backdoor logic is sparse, so only a small subset of neurons carries the trigger pathway. To amplify the relevant signal, it forms Concentrated Backdoor Energy by taking the per-layer top-$\theta$7 BE values and concatenating them:

$\theta$8

The default setting is $\theta$9, and the recommended range is $F_k^{(l)}(\cdot)$0.

Each client model is thus represented by a one-dimensional CBE vector consisting of high-BE values across layers. MARS then treats the CBE vector as an empirical probability distribution with uniform weights and compares clients using the 1-Wasserstein distance. For empirical 1D distributions with equal weights, if the sorted CBE entries of two clients are $F_k^{(l)}(\cdot)$1 and $F_k^{(l)}(\cdot)$2, then

$F_k^{(l)}(\cdot)$3

Clustering is performed with $F_k^{(l)}(\cdot)$4 using Wasserstein distance as the metric. After clustering, the centroids of the two clusters are computed as the mean CBE vectors within each cluster. By default, the accepted cluster is the one with the smaller centroid $F_k^{(l)}(\cdot)$5 norm, based on the premise that backdoored models concentrate larger BE values. MARS also includes an “innocent rounds” guard: if the inter-centroid Wasserstein distance is below a threshold $F_k^{(l)}(\cdot)$6, with default $F_k^{(l)}(\cdot)$7, both clusters are accepted because the round is interpreted as all-benign or near-identical in CBE distribution. Against adaptive BE-minimizing attacks that invert the centroid-norm relation, a fallback variant, MARS*, selects by cluster size rather than centroid norm (Wan et al., 21 Sep 2025).

A key empirical claim in the paper is that the choice of metric is decisive. Replacing $F_k^{(l)}(\cdot)$8 with Euclidean or cosine distance severely degrades detection, with CAD reported at approximately $F_k^{(l)}(\cdot)$9 instead of approximately $k$0. The stated reason is that Euclidean and cosine distances are sensitive to coordinate order, whereas Wasserstein distance compares value distributions. This matters because the exact neuron indices that carry backdoor-related energy can vary across clients even when the overall distribution of high-energy neurons remains discriminative.

4. Server-side workflow, parameters, and computational profile

The per-round MARS pipeline is explicit. For each selected client, the server computes BE for each neuron or channel in each relevant layer, forms the client’s CBE vector by concatenating per-layer top-$k$1 BE values, clusters all participating clients’ CBE vectors into two groups with K-WMeans under $k$2, computes cluster centroids, applies the $k$3 guard, selects either the lower-centroid-norm cluster or both clusters, and finally aggregates the accepted models by FedAvg:

$k$4

The hyperparameter recommendations are narrow. For $k$5, the default is $k$6, with $k$7 yielding TPR approximately $k$8 and FPR approximately $k$9, while larger $l$0 above $l$1 can slightly reduce TPR and increase occasional FPR. For $l$2, the default is $l$3, with recommended values in $l$4; with attackers present, TPR remains $l$5 and FPR $l$6 as long as $l$7, and in benign-only rounds $l$8 avoids false rejections.

The method is described as architecture-agnostic because it depends on Lipschitz constants of sub-networks and channels rather than on a specific model family. Reported compatibility includes CNNs and ResNets for MNIST and CIFAR-10/100, an LSTM for IMDB, a ViT-base patch16 model for CIFAR-10, and ReXNet for ImageNet-level experiments. It is also presented as robust under both IID and non-IID data and applicable across image classification and text sentiment tasks.

The computational overhead is moderate and entirely server-side. Communication overhead is unchanged from standard FL because MARS requests no auxiliary metadata. The major cost components are spectral norm estimation for BE, per-layer sorting for top-$l$9 selection, and K-WMeans under Wasserstein distance. For CIFAR-10 with ResNet-18 and $\delta(x)$0 selected clients per round, the empirical runtime is reported as $\delta(x)$1 s per round, compared with $\delta(x)$2 s for FedAvg, $\delta(x)$3 s for FLAME, $\delta(x)$4 s for Multi-Krum, and $\delta(x)$5 s for DeepSight. The paper attributes the comparatively low overhead to concentrating on top-$\delta(x)$6 CBEs and skipping fully connected layers (Wan et al., 21 Sep 2025).

5. Experimental evaluation and quantitative results

The main experimental setup uses $\delta(x)$7 clients, $\delta(x)$8 attackers overall, and $\delta(x)$9 sampled clients per round with $n_l$0 attackers guaranteed. Non-IID data are generated using a Dirichlet parameter $n_l$1, with additional tests at $n_l$2. Reported datasets and models are MNIST with a simple CNN, CIFAR-10/100 with ResNet-18, ImageNet with ReXNet, IMDB with an LSTM, and CIFAR-10 with a ViT. Attacks include MRA, CerP, 3DFed, and an adaptive BE-minimization attack; ablations additionally mention A3FL, Chameleon, semantic triggers, and partial-layer attacks. Metrics are Accuracy (ACC), Attack Success Rate (ASR), True Positive Rate (TPR), False Positive Rate (FPR), and

$n_l$3

The reported headline results emphasize resistance to adaptive attacks. Against 3DFed on CIFAR-10, MARS achieves ACC approximately $n_l$4, ASR approximately $n_l$5, TPR $n_l$6, FPR $n_l$7, and CAD approximately $n_l$8, whereas baseline defenses are reported to have ASR above $n_l$9, including FLAME at approximately $l$0, FoolsGold at approximately $l$1, and FLDetector at approximately $l$2. On MNIST against 3DFed, MARS yields ACC approximately $l$3, ASR approximately $l$4, TPR $l$5, and FPR approximately $l$6. On CIFAR-100 against 3DFed, it yields ACC approximately $l$7, ASR approximately $l$8, TPR $l$9, and FPR $k$0 (Wan et al., 21 Sep 2025).

Against CerP on CIFAR-10, MARS reports ACC approximately $k$1, ASR approximately $k$2, TPR $k$3, FPR $k$4, and CAD approximately $k$5. Under the same attack, BackdoorIndicator with GTSRB or CIFAR-100 indicators yields ASR near $k$6. Against MRA on CIFAR-10, MARS reports ACC approximately $k$7, ASR approximately $k$8, TPR $k$9, FPR $l$0, and CAD approximately $l$1.

The adaptive BE-minimization attack augments the attacker objective as

$l$2

For $l$3, MARS maintains CAD approximately $l$4. For $l$5, the paper states that attackers invert centroid norms, and MARS* restores CAD approximately $l$6 with ACC approximately $l$7 and ASR approximately $l$8–$l$9.

The paper also reports robustness at very high attacker ratios. From $\theta$00 to $\theta$01 attackers, MARS consistently achieves TPR $\theta$02 and FPR $\theta$03, with CAD above $\theta$04 even at $\theta$05 attackers. On ImageNet with ReXNet under MRA, across rounds $\theta$06–$\theta$07, MARS maintains ACC approximately $\theta$08–$\theta$09 and ASR approximately $\theta$10, while FedAvg’s ASR increases to approximately $\theta$11.

Setting	Reported MARS outcome	Comparator outcome
CIFAR-10, 3DFed	ACC $\theta$12, ASR $\theta$13	FLAME ASR $\theta$14
CIFAR-10, CerP	ACC $\theta$15, ASR $\theta$16	BackdoorIndicator ASR $\theta$17
ImageNet/ReXNet, MRA	ACC $\theta$18–$\theta$19, ASR $\theta$20	FedAvg ASR $\theta$21

These results are presented as evidence that MARS preserves near-baseline clean accuracy while sharply reducing ASR, rather than merely trading one objective against the other. A plausible implication is that the defense is not only separating malicious from benign models, but doing so with sufficient fidelity to avoid the accuracy collapse that often accompanies aggressive filtering.

6. Robustness analysis, limitations, and practical use

The ablation studies frame the principal robustness claim in terms of coupling. Prior defenses are described as loosely coupled with actual backdoor behavior because they monitor quantities that can be imitated or perturbed by adaptive attackers. By contrast, BE is described as measuring a neuron’s capacity to amplify trigger-induced change, and CBE as concentrating the sparse subset of neurons responsible for backdoor behavior. The paper further reports that MARS maintains CAD at or above $\theta$22 across $\theta$23, indicating robustness under substantial data heterogeneity. It also reports that when attackers modify only fully connected layers, the attack itself fails with ASR near $\theta$24 while MARS using partial layers may not detect; once attackers modify at least one convolutional block, MARS detects with TPR $\theta$25 and FPR $\theta$26.

Practical guidance in the paper is correspondingly specific. MARS is the default choice, using centroid $\theta$27-norm selection, while MARS* should be used when there is evidence of adaptive BE minimization, such as centroid-norm inversion accompanied by poor separation. Recommended parameter choices are $\theta$28 in $\theta$29 with default $\theta$30, and $\theta$31 in $\theta$32 with default $\theta$33. No special tuning is required for non-IID settings, and no trusted subset is needed.

The stated limitations are equally clear. MARS targets backdoor attacks and is not designed for threats that do not degrade performance or alter neuron outputs, including free-rider behavior and privacy-stealing or gradient-inversion attacks. BE estimation relies on approximations through spectral norms and BN scaling, so highly structured architectures or complex normalization may perturb BE rankings. Runtime is higher than FedAvg, although lower than several state-of-the-art defenses. Finally, if attackers successfully minimize BE below benign levels and shape both clusters similarly, detection may become harder even though MARS* alleviates centroid-norm inversion (Wan et al., 21 Sep 2025).

In that sense, MARS occupies a specific place in the FL defense landscape. It is not a general robust aggregation method for arbitrary Byzantine behavior; it is a backdoor-specific filter that attempts to infer malignity from the internal energetic profile of a model. The paper’s contribution lies in making that inference data-free, architecture-compatible, and operational at the server level, while explicitly addressing the adaptive feedback loop exploited by attacks such as 3DFed.