Paper deep dive
Defending Against Backdoor Attacks via Alignment Checking in Model-Contrastive Federated Learning
Hongliang Zhang, Zhongyuan Yu, Guijuan Wang, Tianqing He, Wenshuo Ma, Xiaosong Zhang, Jiguo Yu
Intelligence
Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 92%
Last extracted: 8/4/2026, 11:20:13 AM
Summary
The paper proposes FedDAB, a defense mechanism against backdoor attacks in Federated Learning (FL) that addresses the limitations of existing methods by handling statistical heterogeneity and stealthy attacks. FedDAB utilizes a two-phase approach: first, it applies local contrastive regularization to enhance direction and magnitude consistency among benign local updates; second, it employs an alignment checking strategy to evaluate updates based on overall-direction and parameter-level alignment with historical information, filtering out suspicious updates before global aggregation. The method is theoretically proven to have a convergence rate of O(1/T) and demonstrates superior robustness in experiments.
Entities (8)
Relation Signals (7)
FedDAB → defendsagainst → Backdoor Attacks
confidence 95% · we propose FedDAB... to defend against backdoor attacks.
FedDAB → usestechnique → Alignment Checking
confidence 93% · FedDAB employs an alignment checking strategy to evaluate each local update
FedDAB → usestechnique → Local Contrastive Regularization
confidence 92% · FedDAB introduces a novel model-contrastive term into the local objective
Alignment Checking → filters → Suspicious Updates
confidence 91% · excluding updates that exhibit abnormal alignment patterns from global aggregation
Local Contrastive Regularization → enhancesconsistency → Benign Updates
confidence 90% · enhance direction and magnitude consistency among benign updates
Statistical Heterogeneity → causes → Benign Update Deviations
confidence 89% · overlook the deviations among benign local updates caused by statistical heterogeneity
FedDAB → hasproperty → Convergence rate O(1/√T)
confidence 88% · We theoretically prove FedDAB's robustness with a convergence rate of O(1/T).
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Federated Learning (FL) is vulnerable to backdoor attacks because of its distributed nature in edge computing scenarios. Existing defense methods show limited efficacy as they overlook the deviations among benign local updates caused by statistical heterogeneity and the stealthiness of backdoor attacks. To tackle these issues, we propose FedDAB, a two-phase method that combines local contrastive regularization with alignment checking, to defend against backdoor attacks. In the first phase, FedDAB introduces a novel model-contrastive term into the local objective to enhance direction and magnitude consistency among benign updates. In the second phase, FedDAB employs an alignment checking strategy to evaluate each local update in terms of overall-direction alignment and parameter-level alignment with historical information, excluding updates that exhibit abnormal alignment patterns from global aggregation. We theoretically prove FedDAB's robustness with a convergence rate of $\mathcal{O}(1/T)$. Extensive experiments show that FedDAB outperforms existing defense methods against backdoor attacks.
Tags
Links
- Source: https://arxiv.org/abs/2607.26933v1
- Canonical: https://arxiv.org/abs/2607.26933v1
Trouble viewing inline? Open PDF directly →
Full Text
86,946 characters extracted from source content.
Expand or collapse full text
Defending Against Backdoor Attacks via Alignment Checking in Model-Contrastive Federated Learning Hongliang Zhang, Zhongyuan Yu, Guijuan Wang, Tianqing He, Wenshuo Ma, Xiaosong Zhang, Jiguo Yu This work was partially supported by NSF of China under Grants 62272256 and 62202250, and the Shandong Province Youth Innovation Team Project under Grant 2024KJH032. (Corresponding author: Jiguo Yu)H. Zhang, W. Ma, and G. Wang are with the Key Laboratory of Computing Power Network and Information Security, Ministry of Education, Shandong Computer Science Center, Qilu University of Technology (Shandong Academy of Sciences), Jinan, 250353, China, Email: b1043123004@stu.qlu.edu.cn, guijuan_\_wang@126.com, weimws@foxmail.com.Z. Yu is with the College of computer science and technology, China University of Petroleum, Qingdao, 266580, China, Email: yuzhy24601@gmail.com.T. He, and X. Zhang are with School of Computer Science and Engineering, University of Electronic Science and Technology of China, Chengdu, 611731, China, Email: sunny.he@std.uestc.edu.cn, johnsonzxs@uestc.edu.cn.J. Yu is with School of Computer Science and Engineering, University of Electronic Science and Technology of China, Chengdu, 611731, China, and also with the Big Data Institute, Qilu University of Technology, Jinan, 250353, China, Email: jiguoyu@sina.com; jiguoyu17@uestc.edu.cn. Abstract Federated Learning (FL) is vulnerable to backdoor attacks because of its distributed nature in edge computing scenarios. Existing defense methods show limited efficacy as they overlook the deviations among benign local updates caused by statistical heterogeneity and the stealthiness of backdoor attacks. To tackle these issues, we propose FedDAB, a two-phase method that combines local contrastive regularization with alignment checking, to defend against backdoor attacks. In the first phase, FedDAB introduces a novel model-contrastive term into the local objective to enhance direction and magnitude consistency among benign updates. In the second phase, FedDAB employs an alignment checking strategy to evaluate each local update in terms of overall-direction alignment and parameter-level alignment with historical information, excluding updates that exhibit abnormal alignment patterns from global aggregation. We theoretically prove FedDAB’s robustness with a convergence rate of (1/T)O(1/T). Extensive experiments show that FedDAB outperforms existing defense methods against backdoor attacks. I INTRODUCTION Edge Computing (EC) pushes computation and storage resources from a centralized server closer to edge nodes, thereby enabling tasks to be processed locally. Building on this paradigm, federated learning allows multiple edge nodes to collaboratively train a high-performance global model without sharing their raw data [5]. However, the distributed nature of FL inherently makes it vulnerable to backdoor attacks in EC [16]. Such attacks maintain the global model’s accuracy on clean samples (i.e., main task) while inducing samples with specific features to be misclassified into an attacker-chosen target class (i.e., backdoor task). This vulnerability stems from the server’s inability to directly monitor each node’s data or training process. Thus, an attacker may hijack a subset of nodes to poison their data or manipulate their training processes, causing them to submit malicious updates that compromise the optimization of the global model. To identify malicious updates, existing defense methods primarily focus on magnitude-based or direction-based strategies. Specifically, the methods in [3, 10, 12, 44] employ Euclidean distance to quantify the magnitude deviations among local updates, whereas those in [7, 19, 35, 47] adopt cosine similarity to capture their directional relationships. Nevertheless, these methods only capture the overall information of each local update, while overlooking the parameter-level details. Concretely, since each local update is high-dimensional, malicious nodes can launch stealthy poisoning attacks by perturbing a small number of parameters (e.g., flipping signs or amplifying magnitudes) without noticeably changing the overall direction or magnitude of their updates, thereby bypassing the aforementioned defense methods. Furthermore, since data in FL exhibit statistical heterogeneity, i.e., the data is Non-Independent and Identically Distributed (Non-IID), the effectiveness of these methods is further limited. This is because benign updates exhibit significant deviations under Non-IID data [15][22][31], thereby blurring the boundary between malicious and benign updates [19][38][4]. Since each update is inherently a vector characterized by both direction and magnitude, the deviations among updates are also reflected in both aspects. Thus, improving the consistency of benign updates in both direction and magnitude is crucial for defending against stealthy poisoning attacks in FL under Non-IID data. To improve update consistency, several studies [14, 25, 18, 24, 42, 9] incorporate contrastive learning [6] into the local training objective as a regularization term, thereby reducing the directional deviation among local updates in FL. However, these studies overlook the magnitude deviation, resulting in residual inconsistency among benign updates. This limitation motivates us to pose the question: Is there a solution that uses contrastive learning to enhance the directional and magnitude consistency, while checking local updates from both overall-direction and parameter-level perspectives? In this paper, we propose FedDAB, a Federated learning defense method designed to Defend Against Backdoor attacks. The method integrates local contrastive regularization to enhance the consistency of local updates among benign nodes, and leverages alignment checking to exclude suspicious updates from nodes. Its novelties are as follows: (i) A novel model-contrastive term is incorporated into the local optimization objective based on contrastive learning. It regularizes benign local updates in both direction and magnitude, mitigating the inconsistency among benign updates caused by Non-IID data. (i) We examine local updates through both overall-direction checking and parameter-level checking to filter out updates exhibiting abnormal alignment patterns. (i) We incorporate each node’s historical behaviors into the parameter-level checking, instead of using only the information from the current round. Our contributions are three-fold. • To the best of our knowledge, FedDAB is the first FL defense method that combines local contrastive regularization with alignment checking, to defend against backdoor attacks under varying data distributions. • We prove that FedDAB satisfies a convergence rate of (1/T)O(1/T). Furthermore, we provide a theoretical analysis of the robustness and propagation error of FedDAB. • We conduct extensive experiments on multiple datasets under Non-IID settings to evaluate the performance of FedDAB against various backdoor attacks. Compared to existing defense methods, FedDAB exhibits superior effectiveness and robustness. I Related Works Federated Learning: A typical FL system consists of a central server and K nodes indexed by k∈k , each of which holds its private training dataset kD_k. The nodes can cooperatively learn a global model W∈ℝdW ^d for the main task. The global optimization problem of FL can be formulated as: minWF(W)=∑k∈akFk(W,k), _WF(W)= _k a_kF_k(W,D_k), where ak:=|k|/∑k∈|k|a_k:=|D_k|/ _k |D_k| is the data proportion of node k, and Fk(⋅)F_k(·) is the local objective function. However, FL is vulnerable to backdoor attacks, where an attacker can poison the training data by embedding backdoor triggers into training samples with specific features. To improve the attack stealthiness, the works in [26][46] propose the variants of backdoor attacks that align malicious updates with historical global updates, making them less distinguishable from benign updates and enabling them to evade detection. These stealthy backdoor attacks further increase the difficulty of identifying malicious updates in FL. Defending against Backdoor Attacks: Regardless of whether existing defense works are magnitude-based or direction-based, they generally mitigate the adverse impact of malicious nodes by assigning lower weights to suspicious updates or filtering them out before aggregation. Specifically, the works in [7][35] [23][20] retain all local updates but assign lower aggregation weights to those identified as malicious, thereby limiting their influence on the global model. For example, Yang et al. observe that updates from malicious nodes exhibit higher pairwise similarity than those from benign nodes [35]. Leveraging this property, they use adaptive clustering to group highly similar updates, aggregates updates within each cluster, and applies projection-based dimensionality reduction to extract a plausible clean update, thereby reducing the contribution of malicious updates. In contrast, the works in [3, 10, 12, 47] detect and remove malicious updates before updating the global model. Notably, the aforementioned rely on evaluating the deviations among updates in terms of magnitude or direction. However, FL inevitably suffers from statistical heterogeneity, i.e., Non-IID data, which leads to significant deviations in both direction and magnitude among benign updates [37]. Thus, these defense works [3, 10, 12, 7, 35, 47, 23, 20] struggle to distinguish whether the deviations stem from Non-IID data or backdoor attacks, thereby undermining their effectiveness. Moreover, since backdoor attacks aim to maintain high accuracy on the main task while maximizing the success rate of the backdoor task, malicious updates are crafted to appear plausible in both magnitude and direction. Thus, the works in [7, 19, 35, 47] provide limited robustness because they capture only overall-direction information of local updates while overlooking parameter-level details. To address these limitations, our FedDAB incorporates both overall-direction and parameter-level information into the aggregation process to detect malicious updates. Contrastive Learning in FL: Contrastive learning is a self-supervised representation learning that learns effective data representations by contrasting positive and negative pairs [6]. Its core idea is to reduce the distance between the representations of different augmented views of the same sample (i.e., positive pairs), and increase the distance between the representations of augmented views of different samples (i.e., negative pairs). To improve FL performance under Non-IID data, Yang et al. first introduce a model-contrastive term into the FL objective to regularize local updates via contrastive learning [14]. Subsequently, several variants based on the work in [14] have been proposed [41, 40, 36]. These works enhance the directional consistency among local updates while neglecting the magnitude deviation, leaving residual inconsistency among benign nodes. To this end, we design a novel model-contrastive term within the local objective to enhance both directional and magnitude consistency among benign updates, thereby making malicious updates easier to detect. I The Detailed Design of FedDAB Since FedDAB combines local regularization with alignment checking, the design of both phases is presented. I-A Local Contrastive Regularization Due to the statistical heterogeneity of data, benign nodes optimize their local models toward their respective optima [15][22], resulting in deviations among benign local updates in both direction and magnitude. These deviations cause defense methods [3, 10, 12, 35, 47] struggle to distinguish malicious updates from benign ones. To eliminate the deviations caused by Non-IID data, the works in [14, 42, 41, 36] incorporate contrastive learning [6] into the local objective to improve the directional consistency among local updates. However, they overlook the magnitude deviation among updates. Thus, we introduce a magnitude regularization into the model-contrastive term, jointly aligning the direction and magnitude among benign updates. In the following, we present the network architecture and local objective. Network Architecture: The network consists of two components: an encoder and a classifier. The encoder extracts a representation vector from an input, and the classifier maps this representation vector to a probability distribution over classes. For simplicity, for any model W, we use ExtW(⋅)Ext_W(·) to denote the encoder output produced by model W. Local Objective: In FedDAB, the local optimization function consists of a classification term ℒCla(⋅)L_Cla(·) and a model-contrastive term ℒCon(⋅)L_Con(·). The former is used to compute the main task loss, while the latter is used to compute the contrastive loss between the feature representations learned by the local and global models. Specifically, in the t-th round, for every input x, given the global model WtW^t, the current local model wktw_k^t, and the previous local model wkt−1w_k^t-1, we extract the global representation vector zgt:=ExtWt(x)z_g^t:=Ext_W^t(x) , the current local representation zkt:=Extwkt(x)z_k^t:=Ext_w_k^t(x) , and the previous local representation zkt−1:=Extwkt−1(x)z_k^t-1:=Ext_w_k^t-1(x) . Since the global model provides better representations than local models, we aim to decrease the distance between zktz_k^t and zgtz_g^t , and increase the distance between zktz_k^t and zkt−1z_k^t-1 . Thus, similar to works [14] [42], the model-contrastive term ℒCon(⋅)L_Con(·) is defined as: ℒCon(Wt,wkt−1,wkt,x)=−logexp(sim(zgt,zkt)q1)exp(sim(zgt,zkt)q1)+exp(sim(zkt−1,zkt)q1)−logexp(‖zkt−1−zkt‖1q2)exp(‖zgt−zkt‖1q2)+exp(‖zkt−1−zkt‖1q2), aligned &L_Con(W^t,w^t-1_k,w^t_k,x)=\\ &- ( sim(z_g^t,z_k^t)q_1) ( sim(z_g^t,z_k^t)q_1)+ ( sim(z_k^t-1,z_k^t)q_1)- ( \|z_k^t-1-z_k^t\|_1q_2) ( \|z_g^t-z_k^t\|_1q_2)+ ( \|z_k^t-1-z_k^t\|_1q_2), aligned where sim(⋅)sim(·) is the cosine similarity function, ∥⋅∥1\|·\|_1 is the ℓ1 _1-norm, and q1q_1 and q2q_2 are used to rescale the distances. In the above formula, the first term, termed the direction-alignment term, encourages the current local representation to match the global representation in direction, rather than the previous local representation. The second term, termed the magnitude-alignment term, enforces the current local representation to be closer to the global representation and pushes it away from the previous local representation in magnitude. Combining the terms ℒCla(⋅)L_Cla(·) and ℒCon(⋅)L_Con(·), the loss for an input sample (x,y)(x,y) is given by: ℒ=ℒCla(wkt,(x,y))+μℒCon(Wt,wkt−1,wkt,x),L=L_Cla(w^t_k,(x,y))+ _Con(W^t,w^t-1_k,w^t_k,x), where μ is the trade-off parameter. Thus, the local objective of node k is minwk(x,y)∼k[ℒ] _w_kE_(x,y) _k[L] , which minimizes the classification loss while aligning the current local representation with the global representation. After completing E local SGD iterations, benign node k obtains wkt+1w^t+1_k and uploads the local update Δkt:=wkt+1−Wt ^t_k:=w^t+1_k-W^t to the server. In contrast, malicious nodes violate the predefined training rules and submit manipulated updates to the server. I-B Alignment Checking The alignment checking phase consists of two key modules: Update Evaluation and Update Aggregation, and its core steps are shown in Algorithm 1. Concretely, Update Evaluation module is used to evaluate and filter the suspicious updates submitted by nodes. Update Aggregation module is applied to compute the global model. Each module is presented in below. Input: Δktk∈,r,H,λDSS,λSAS\ _k^t\_k ,r,H, _DSS, _SAS ⊳ Δktk∈\ _k^t\_k is the local update set, r is the selection ratio, H is the buffer length, λDSS _DSS and λSAS _SAS are thresholds. Output: Wt+1W^t+1 1 Initialize retained node set t←∅K^t← ; 2 // Update\ Evaluation // 3 αktk∈←\ _k^t\_k ← Direction_Check(Δkt)k∈;\Direction\_Check( _k^t)\_k ; 4 Pt←P^t← Sgn(∑k∈Sgn(Δkt)+∑h=1HPt−h);Sgn ( _k Sgn ( ^t_k )+ _h=1^HP^t-h ); 5 pkt←Sgn(Sgn(Δkt)+∑h=1Hpkt−h);p_k^t (Sgn( _k^t)+ _h=1^Hp_k^t-h); 6 βktk∈←\ _k^t\_k ← Param_Check(Δkt,Pt,pkt,r)k∈;\Param\_Check( _k^t,P^t,p^t_k,r)\_k ; 7 for each node k∈k do 8 mk,1t←MZ_score(αktk∈);m_k,1^t \_score(\ _k^t\_k ); 9 mk,2t←MZ_score(βktk∈);m_k,2^t \_score(\ _k^t\_k ); 10 if mk,1t<λDSSm_k,1^t _DSS and mk,2t<λSASm_k,2^t _SAS then 11 t←t∪kK^t ^t∪\k\; 12 13// Update\ Aggregation // 14 c←Med(‖Δkt‖2k∈t);c (\\| _k^t\|_2\_k ^t); 15 Δgt←1|t|∑k∈t(Δkt⋅min1,c‖Δkt‖2); _g^t← 1|K^t| _k ^t ( _k^t· \1, c\| _k^t\|_2 \ ); Wt+1←Wt−ηgΔgt;W^t+1← W^t- _g _g^t; Algorithm 1 Alignment_Checking I-B1 Update Evaluation Existing defense methods mainly inspect local updates using magnitude-based metrics (e.g., Euclidean/Manhattan distance) or direction-based metrics (e.g., cosine similarity). As the global model tends to converge, the magnitude of local updates gradually decreases, making the magnitude gap between benign and malicious updates less pronounced. Thus, magnitude-based detection is unreliable for identifying malicious updates. To this end, we evaluate the alignment patterns of local updates via overall-direction checking and parameter-level checking, and then filter out updates with abnormal patterns. Therefore, the Update Evaluation module consists of Overall-Direction Checking, Parameter-Level Checking, and Anomaly Score Detection. Overall-Direction Checking: The local objective of FedDAB is designed to enhance the consistency of local updates among benign nodes in both direction and magnitude. However, in typical backdoor attacks[8][30], malicious nodes optimize both the main task and the backdoor task, which may cause their updates to deviate in direction from those of benign nodes [33]. Thus, the overall-direction information of each local update is informative for identifying malicious updates. Motivated by this insight, the Overall-Direction Checking step evaluates the Direction Similarity Score (DSSDSS) of each node based on its update direction. Formally, the DSSDSS value αkt _k^t of local update Δkt ^t_k is defined as: αkt:=(1/(K−1))∑j∈,j≠kSkjt, _k^t:=(1/(K-1)) _j ,j≠ kS_kj^t, where Skjt:=⟨Δkt,Δjt⟩/(‖Δkt‖⋅‖Δjt‖)S_kj^t:= _k^t, _j^t /(\| _k^t\|·\| _j^t\|) . The DSSDSS value αkt _k^t captures the average cosine similarity between Δkt ^t_k and the other local updates, reflecting its overall-direction alignment. Benign nodes typically have consistent DSSDSS values, whereas malicious nodes exhibit DSSDSS values that are markedly offset from those of benign nodes. Notably, since DSSDSS value is computed from update directions rather than magnitudes, its variability during federated training continues to be utilized for identifying malicious updates. Parameter-Level Checking: In stealthy backdoor attacks [26][46], malicious nodes can manipulate the signs and magnitudes of certain parameters within their local updates without changing the update direction. Although the DSSDSS value captures the directional information, its detection ability is weakened under such attacks. This motivates us to examine parameter-wise signs and magnitudes for fine-grained evaluation. Notably, the works in [20][34][11] leverage parameter-sign information to identify malicious updates. Although they utilize the sign information, parameters with very small magnitudes (i.e., unimportant parameters) may weaken their defense effectiveness. In addition, since benign nodes honestly follow the FL protocol in each round, their historical behaviors can provide reliable evidence for detecting malicious updates. However, the above defense methods only utilize local updates from the current round, ignoring the node’s historical behaviors. Thus, the checking step evaluates local updates by combining the signs and magnitudes of important parameters from both the current and historical updates of each node. To effectively resist stealthy backdoor attacks, we examine sign alignment between each node’s update and the global sign vector at the coordinates with large absolute magnitudes. The global sign vector represents the dominant sign at each coordinate across all local updates. Thus, the global sign vector is defined as: Pt=Sgn(∑k∈Sgn(Δkt)),P^t=Sgn( _k Sgn( _k^t)), where Sgn(⋅)Sgn(·) denotes the element-wise sign operator that returns −1-1, 0, or +1+1 for negative, zero, and positive elements, respectively. Since benign nodes follow the FL protocol across all rounds, incorporating historical information can better reflect their stable behavior. Thus, the server maintains a global sign buffer gS_g that stores the most recent H global sign vectors for computing PtP^t, which is reformulated as: Pt=Sgn(∑k∈Sgn(Δkt)+∑h=1HPt−h),P^t=Sgn( _k Sgn( ^t_k)+ _h=1^HP^t-h), where H denotes the length of buffer gS_g. Based on the global sign vector PtP^t, the sign alignment degree of each node can be evaluated. To reduce interference from unimportant parameters, we evaluate the sign alignment on the top-r%r\% of coordinates ranked by absolute value within each local update, where r denotes the selection ratio. To identify these coordinates, we use the indicator Topr(⋅)Top_r(·) to mark them, which is defined as follows. Definition 1. (Indicator Topr(⋅)Top_r(·)). Given a vector Y∈ℝdY ^d, and a selection ratio r∈[0,1]r∈[0,1], we define the function Topr(⋅):ℝd→0,1dTop_r(·):R^d→\0,1\^d as follows: [Topr(Y)]j=1,if |Yj|∈|Yπ(1)|,…,|Yπ(⌈r×d⌉)|,0,otherwise,[Top_r(Y)]_j= cases1,&if |Y_j|∈\|Y_π(1)|,…,|Y_π( r× d )|\,\\[2.0pt] 0,&otherwise, cases where [Topr(Y)]j[Top_r(Y)]_j denotes the j-th element of the indicator vector Topr(Y)Top_r(Y), and π(⋅)π(·) is a permutation of the index set 1,2,⋯,d\1,2,·s,d\ such that: |Yπ(1)|≥|Yπ(2)|≥⋯≥|Yπ(d)|,|Y_π(1)|≥|Y_π(2)|≥·s≥|Y_π(d)|, where π(d)π(d) is the index of the element in vector Y that ranks the d-th largest in absolute value. The indicator Topr(Δkt)Top_r( ^t_k) outputs a binary vector of the same size as the local update Δkt ^t_k, where each element is either 1 or 0. The coordinates with a value 1 indicate the top-r%r\% coordinates in Δkt ^t_k with the largest absolute magnitudes. Using these coordinates, the checking step measures each node’s Sign Alignment Score (SASSAS), which is defined as follows. Definition 2. (Sign Alignment Score). For vectors Y1,Y2∈ℝdY_1,Y_2 ^d, the sign alignment score value β of Y1Y_1 and Y2Y_2 is defined as: β=1−‖Sgn(Y1)−Sgn(Y2)‖0d,β=1- \|Sgn(Y_1)-Sgn(Y_2)\|_0d, where ∥⋅∥0\|·\|_0 denotes the ℓ0 _0-norm that counts non-zero elements. A larger β means stronger coordinate-wise sign alignment between Y1Y_1 and Y2Y_2. According to Definition 2, each node’s SASSAS value βkt _k^t is computed at the server by comparing its local sign vector pktp^t_k with the global sign vector PtP^t. Hence, the server constructs pktp_k^t for each node before computing its SASSAS value. Since PtP^t incorporates historical information, each node’s local sign vector likewise incorporates its own historical information. Thus, the server maintains a local sign buffer lS_l that stores the most recent H local sign vectors for each node, based on which pktp_k^t is defined as: pkt=Sgn(Sgn(Δkt)+∑h=1Hpkt−h),p_k^t=Sgn(Sgn( _k^t)+ _h=1^Hp_k^t-h), where H denotes the length of buffer lS_l, set equal to that of buffer gS_g. To focus on the coordinates with the largest absolute magnitudes, we use the Topr(⋅)Top_r(·) indicator to select the top-r%r\% coordinates of each local update. Thus, the SASSAS value βkt _k^t for node k is computed as follows: βkt=1−‖(pkt−Pt)⊙Topr(Δkt)‖0/⌈r×d⌉, _k^t=1- \| (p_k^t-P^t ) _r( _k^t) \|_0/ r× d , where ⊙ is the Hadamard product, ∥⋅∥0\|·\|_0 is the ℓ0 _0-norm, (pkt−Pt)(p_k^t-P^t) captures the coordinate-wise discrepancy between the local and the global sign vectors, and ⌈r×d⌉ r× d (with ⌈⋅⌉ · being the ceiling operator) denotes the number of selected coordinates. After computing each node’s SASSAS value, the server stores the global sign vector PtP^t in gS_g and each node’s local sign vector pktp_k^t in lS_l. Once the buffer reaches its capacity, the oldest sign vector is replaced by the newly computed one. Anomaly Score Detection: After Overall Direction Checking and Parameter-Level Checking, a Median-based Z-score is introduced to remove the local updates with abnormal DSSDSS and SASSAS values. The Anomaly Score Detection step is detailed below. Since malicious nodes perturb their local updates to launch backdoor tasks, their DSSDSS and SASSAS values exhibit noticeable offsets from those of benign nodes. Assuming that most nodes are benign, nodes whose DSSDSS and SASSAS values lie close to the medians of αktk∈\ _k^t\_k and βktk∈\ _k^t\_k are regarded as benign, while those that are far from the medians are considered suspicious. Thus, the median offsets of node k are defined as mk,1t:=|αkt−Med(αktk∈)|,m_k,1^t:=| _k^t-Med(\ _k^t\_k )|, and mk,2t:=|βkt−Med(βktk∈)|,m_k,2^t:=| _k^t-Med(\ _k^t\_k )|, where Med(⋅)Med(·) is the median operator. We use the thresholds λDSS _DSS and λSAS _SAS to identify nodes whose median offsets exceed these bounds. However, since the ranges of median offsets vary substantially across rounds, fixed thresholds λDSS _DSS and λSAS _SAS may cause all nodes’ offsets to fall within these bounds, thereby failing to filter out anomalous updates. To address this, inspired by the standardization method Z-score, we introduce a robust variant named median-based Z-score MZ_score(⋅)MZ\_score(·) to recalculate the median offsets, adapting to changes in the DSSDSS and SASSAS ranges during federated training. Definition 3. (Median-based Z-score MZ_score(⋅)MZ\_score(·)). Let X be a set of scalars with median Med(X)Med(X) and standard deviation Std(X)Std(X). For any s∈Xs∈ X, its offset is defined by: MZ_score(s,X)=(|s−Med(X)|)/Std(X),MZ\_score(s,X)=( |s-Med(X) |)/Std(X), which measures the standardized distance of scalar s from Med(X)Med(X). By applying MZ_score(⋅)MZ\_score(·) function to the sets αktk∈\ _k^t\_k and βktk∈\ _k^t\_k , we recompute each node’s median offsets mk,1tm_k,1^t and mk,2tm_k,2^t . Based on these offsets, nodes whose offsets exceed the thresholds are filtered out. Specifically, if mk,1t≥λDSSm_k,1^t≥ _DSS or mk,2t≥λSASm_k,2^t≥ _SAS , its update Δkt _k^t is identified as suspicious, and node k is excluded from aggregation in the t-th round. Thus, the retained node set tK^t is defined as: t=k∈|(mk,1t<λDSS)∧(mk,2t<λSAS).K^t=\k |(m_k,1^t _DSS) (m_k,2^t _SAS)\. Notably, λDSS _DSS and λSAS _SAS are fixed thresholds. The server aggregates updates from tK^t to compute the global model. I-B2 Update Aggregation After filtering, the remaining nodes are treated as benign, and their updates are used to calculate the global update Δgt _g^t. However, the Update Evaluation module is unable to detect malicious updates with abnormally large magnitudes. If update magnitudes are not considered, malicious updates may bypass Update Evaluation, enabling malicious nodes to compromise the global model via amplifying update magnitudes. To this end, FedDAB employs the median ℓ2 _2-norm of the retained updates in tK^t as the clipping threshold, rescaling these updates. Formally, the aggregation process is expressed as: Δgt=1|t|∑k∈t(Δkt⋅min1,c‖Δkt‖2), _g^t= 1|K^t| _k ^t ( _k^t· \1, c\| _k^t\|_2 \ ), where c denotes the clipping bound, defined as c:=Med(‖Δkt‖2k∈t).c:=Med(\\| _k^t\|_2\_k ^t). The global model WtW^t is updated as Wt+1:=Wt−ηgΔgt,W^t+1:=W^t- _g _g^t, where ηg _g is the global learning rate. IV Robustness Analysis of FedDAB This section provides the theoretical analysis of FedDAB. Before presenting the theoretical results, we state the following assumptions. Note that Assumption 1 and 2 have been widely adopted in the theoretical analysis of FL [34][43]. Assumption 3 provides a standard measure for the deviations caused by data heterogeneity among nodes [32] [1]. Such heterogeneity complicates the problem of FL with backdoor attacks, as it may cause the server to confuse malicious updates with benign ones. The proofs of all theorems are provided in Appendix. Assumption 1. (L1L_1-smoothness). Let ℬK_B be the set of benign nodes. For each benign node k∈ℬk _B, its objective function Fk(⋅)F_k(·) is assumed to be L1L_1-Lipschitz smooth with L1>0L_1 0. Formally, for any Y1,Y2∈ℝdY_1,Y_2 ^d, the following inequality holds: ‖∇Fk(Y1)−∇Fk(Y2)‖2≤L1‖Y1−Y2‖2.\|∇ F_k(Y_1)-∇ F_k(Y_2)\|_2≤ L_1\|Y_1-Y_2\|_2. Moreover, this condition implies the following inequality: Fk(Y1)−Fk(Y2)≤∇Fk(Y1)⊤(Y2−Y1)+L12‖Y1−Y2‖22.F_k(Y_1)-F_k(Y_2)≤∇ F_k(Y_1) (Y_2-Y_1)+ L_12\|Y_1-Y_2\|^2_2. Assumption 2. (Bounded Gradient and Variance). For each benign node k∈ℬk _B, the stochastic gradient gkg_k is an unbiased and bounded-variance estimator of the gradient. Specifically, for any Y∈ℝdY ^d, it holds that [gk]=∇Fk(Y)E[g_k]=∇ F_k(Y), ‖∇Fk(Y)‖22≤Z2\|∇ F_k(Y)\|^2_2≤ Z^2, and ‖gk−∇Fk(Y)‖22≤ξk2E\|g_k-∇ F_k(Y)\|^2_2≤ _k^2 for all benign nodes, where the expectation is taken over local mini-batches. For convenience, the average variance bound is denoted as ξ¯:=1|ℬ|∑k∈ℬξk2 ξ:= 1|K_B| _k _B _k^2. Assumption 3. (Bounded Heterogeneity). For a constant L2L_2≥ 0, it holds that 1|ℬ|∑k∈ℬ‖∇Fk(Y)−∇Fℬ(Y)‖22≤L2 1|K_B| _k _B\|∇ F_k(Y)-∇ F_K_B(Y)\|^2_2≤ L_2 for all Y∈ℝdR^d , where the mean gradient over the benign node set is defined as ∇Fℬ(Y):=1|ℬ|∑k∈ℬ∇Fk(Y)∇ F_K_B(Y):= 1|K_B| _k _B∇ F_k(Y) . Beyond the above assumptions, to facilitate the theoretical analysis of FedDAB, we define the robustness concept, namely κ-secure aggregation, as presented in Definition 4. The definition is commonly adopted in the analysis of FL defense methods [1][2]. Definition 4. (κ-Secure Aggregation) Given the set of model updates Δkk∈\ _k\_k and benign node set ℬ⊂K_B , the aggregation rule G(⋅)G(·): ℝd×K→ℝdR^d× K ^d is called κ-secure aggregation when its aggregated global update Δg:=G(Δkk∈) _g:=G(\ _k\_k ) satisfies ‖Δg−Δℬ‖22≤κ\| _g- _K_B\|^2_2≤κ, where Δℬ:=(1/|ℬ|)∑k∈ℬΔk _K_B:=(1/|K_B|) _k _B _k, K is the number of nodes, and κ≥0κ≥ 0 denotes the robustness coefficient of G(⋅)G(·). This definition quantifies a constant bound, denoted by κ, that constrains the deviation between the global update output by FedDAB and the average of all benign updates. A smaller κ indicates that the aggregation function G(⋅)G(·) produces the global update closer to the average of benign updates, which represents the optimal output. In other words, when G(⋅)G(·) identifies and removes all malicious updates while preserving all benign ones, we have κ=0κ=0, indicating that FedDAB achieves the highest level of κ-secure aggregation. Theorem 1 (Bounded Local Deviation). In the t-th round, let Δℬt:=(1/|ℬ|)∑k∈ℬΔkt _K_B^t:=(1/|K_B|) _k _B _k^t be the average of benign updates. If local learning rate ηl _l and local iterations E satisfy ηl≤12E _l≤ 12E, under Assumption 2 and 3, the local deviation is bounded as: 1|ℬ|∑k∈ℬ‖Δkt−Δℬt‖22≤2ξ¯+L2. 1|K_B| _k _BE \| _k^t- _K_B^t \|^2_2≤ 2 ξ+L_2. Remark 1. When the condition ηl≤1/(2E) _l≤ 1/(2E) holds, mitigating the deviation L2L_2 induced by data heterogeneity can constrain the local deviation (2ξ¯+L2)(2 ξ+L_2). Thus, in FedDAB, the model-contrastive term is incorporated into the local objective to align both the magnitude and direction of benign updates, thereby reducing the deviation L2L_2. Theorem 2 (κ-robustness of FedDAB). Let Assumption 2 and Assumption 3 hold. Suppose that the total number of nodes is K>1K>1, and that there are KmK_m malicious nodes satisfying 0≤Km<K/(3+ϵ)0≤ K_m<K/(3+ε) for a positive constant ϵε. In the t-th round, if the relations ηl≤12E _l≤ 12E and |t|≥K−2Km|K^t|≥ K-2K_m holds, FedDAB achieves κ-secure aggregation, where κ is defined by: κ=(1+Km/(K−2Km))((2/ϵ+1)(2ξ¯+L2)+8c2)=(1+Km/(K−2Km)). aligned κ&= (1+K_m/ (K-2K_m ) ) ( (2/ε+1 ) (2 ξ+L_2 )+8c^2 )\\ &=O (1+K_m/ (K-2K_m ) ). aligned Remark 2. The relation emphasizes the importance of preserving a sufficient number of remaining nodes. Moreover, the clipping bound c can mitigate the deviation caused by overly large-magnitude local updates. In addition, [34][21] have demonstrated the effectiveness of the clipping in mitigating the impact of malicious updates. We argue that FedDAB achieves comparable robustness to defense methods, i.e., RFA [23] ((1+Km/(K−2Km))2)(O(1+K_m/(K-2K_m))^2) and Krum [3] ((1+Km/(K−2Km))O(1+K_m/(K-2K_m))). The results for RFA and Krum are taken from [1]. Since the coefficient κ is bounded by a constant, we incorporate these results into our discussion without losing generality. Theorem 3 (Propagation Error Bound). Let Assumption 1 to Assumption 3 hold, and let the local learning rate satisfying ηl≤1/(2E) _l≤ 1/(2E). Let WTW^T denote the global model trained over all nodes in the T-th round, and WT,∗W^T,* denote the clean global model trained only on benign node set ℬK_B. Under backdoor attacks, the propagation error of FedDAB is bounded by: ‖WT−WT,∗‖2≤4τηg(κ+2ξ¯)((1+1/τ)T−1), aligned \|W^T-W^T,* \|^2≤ 4τ _g(κ+2 ξ)((1+1/τ)^T-1), aligned where κ is given in Theorem 2, and τ:=1/(1+3ηg2L12)τ:=1/(1+3η^2_gL_1^2). Remark 3. The error bound reflects the deviation between the clean model WT,∗W^T,* and the actual model WTW^T. When the global learning rate ηg _g is fixed, this error bound increases as the number of rounds T grows. To mitigate the propagation error, the global learning rate is scheduled to decay over rounds, i.e., ηgt _g^t gradually decreases as t increases. Thus, FedDAB can be integrated with decaying global learning rate schedule [28] to achieve stable convergence. Theorem 4 (Convergence Rate). Suppose Assumptions 1 and 2 hold. Let W⋆W denote the global optimum. After T rounds of FedDAB, the following bound holds: 1T∑t=1T‖∇F(Wt)‖22≤4|t|TηgΦ+4H2−4H1+2|t|L1H1ηg, 1T _t=1^TE \|∇ F (W^t ) \|^2_2≤ 4|K^t|T _g +4H_2-4H_1+ 2|K^t|L_1H_1 _g, where H1=(ηlEZ|t|)2H_1=( _lEZ|K^t|)^2 , H2=2Z2(12+|t|)2+4Z2|t|2+4H1H_2=2Z^2 ( 12+|K^t| )^2+4Z^2|K^t|^2+4H_1 , Φ=F(W0)−F(W⋆) =F(W^0)-F(W ) , and ηl _l is the local learning rate. Remark 4. The bound indicates that the gradient norm of FedDAB decreases as the number of rounds T increases. If all other parameters are fixed with respect to T, the convergence rate of FedDAB is (1/T)O(1/T). V Experimental Details V-A Experimental Settings V-A1 Hyper-parameter Configuration Similar to existing FL works [44][35][27], we evaluate the defense methods on FMNIST [29], CIFAR10 [13], and CIFAR100 [13]. We simulate a FL system with 20 edge nodes, where all nodes participate in each training round. Notably, we further evaluate the scalability of FedDAB under larger-scale node settings in Section V-B4. Unless otherwise specified, we use the following default settings. The thresholds λDSS _DSS and λSAS _SAS are set to 1.01.0. The trade-off parameter μ is set to 0.5, and the buffer length H for both lS_l and gS_g is set to 3. The selection ratio r is set as 30%, meaning that the Top-30% of model parameters are used for the parameter-level checking. The global learning rate ηg _g is set to 11, the local learning rate ηl _l to 0.050.05, the number of local iterations E to 22, and the temperature parameters q1q_1 and q2q_2 to 11. The number of rounds T is set to 5050 for FMNIST, 100100 for CIFAR10, and 120120 for CIFAR100. For the model architectures, we use ResNet9 for FMNIST and CIFAR10, and VGG9 for CIFAR100. To simulate the Non-IID setting, we partition each dataset among nodes using a Dirichlet distribution Dir(Ψ)Dir( ), where a larger concentration parameter Ψ indicates a more uniform class allocation across nodes. V-A2 Evaluation Metrics We use the following metrics to evaluate the defense methods. Test Accuracy (TA) is the proportion of clean samples correctly classified by the global model. Attack Success Rate (ASR) is the proportion of triggered samples misclassified into the target label. Robustness Rate (R) is the proportion of triggered samples correctly classified into their true labels. An effective defense method should achieve high TA and R, while maintaining a low ASR. V-A3 Attack Settings The attacker is assumed to control a proportion v (default 30%) of all nodes as malicious nodes. These malicious nodes poison their local training data by embedding a “plus” trigger into clean images. Typical backdoor attacks include BadNet [8] and Distributed Backdoor Attack (DBA) [30]. To improve attack stealthiness, more advanced attacks such as Neurotoxin attacks [46] and Projected Gradient Descent (PGD)-based attacks [26] have been further proposed. 1. BadNet Attacks. Malicious nodes add uniform “plus” triggers to clean samples to construct poisoned data. 2. DBA Attacks. The “plus” trigger is decomposed into four sub-triggers, and each malicious node uses only one of these sub-triggers. 3. Neurotoxin Attacks. Malicious nodes project their local updates onto the coordinate set defined by the top 75%75\% largest-magnitude parameters of the previous global model, and sets the update in other coordinates to zero. 4. PGD Attacks. The malicious local update is projected onto a sphere to form the tampered update, where the sphere’s radius is set to the ℓ2 _2-norm of the previous-round global model. V-A4 Evaluated Defense Methods We compare our FedDAB with the non-robust FedAvg [17] and eight defense methods: MKrum [3], Foolsgold [7], RLR [20], RFA [23], MMetric [10], RoseAgg [35], AlignIns [32], and EndPCA [45]. V-B Experimental Results TABLE I: The ASR and R results of baselines and FedDAB on the Dir(1.0)Dir(1.0) setting of FMNIST, CIFAR10, and CIFAR100. The best and second-best results are shown in bold and underlined, respectively. Dataset (Model) Methods BadNet DBA Neurotoxin PGD Avg. ASR↓ Avg. R↑ ASR(%)↓ R(%)↑ ASR(%)↓ R(%)↑ ASR(%)↓ R(%)↑ ASR(%)↓ R(%)↑ v=0.30 v=0.40 v=0.50 v=0.30 v=0.40 v=0.50 v=0.30 v=0.40 v=0.50 v=0.30 v=0.40 v=0.50 v=0.30 v=0.40 v=0.50 v=0.30 v=0.40 v=0.50 v=0.30 v=0.40 v=0.50 v=0.30 v=0.40 v=0.50 FMNIST (ResNet9) FedAvg 92.38 95.28 98.32 6.84 4.26 1.56 74.14 22.52 61.06 21.74 52.67 29.46 77.07 83.01 88.30 20.22 15.39 10.71 92.38 95.28 98.32 6.84 4.26 1.56 81.50 14.62 MKrum 2.82 5.46 10.50 71.49 56.20 45.95 2.24 3.49 12.54 68.22 59.38 40.90 2.82 2.78 12.21 71.49 57.04 46.51 2.80 5.46 13.08 71.53 56.20 37.90 6.35 56.89 Foolsgold 2.90 3.18 2.96 65.79 67.86 65.49 6.44 8.25 8.42 63.32 61.81 60.41 2.12 3.52 6.54 68.46 62.35 76.42 4.53 4.63 6.26 66.34 72.63 77.47 4.97 67.36 RLR 64.91 51.76 30.50 22.56 21.36 14.80 54.13 60.67 62.96 20.06 18.53 15.82 0.73 21.54 99.87 72.99 10.41 0.11 64.91 45.67 30.50 22.56 21.36 14.80 49.01 21.28 RFA 36.41 41.07 45.60 49.77 47.53 40.63 5.31 14.83 34.51 60.19 52.51 37.87 3.73 3.13 9.25 64.36 71.74 59.51 36.41 41.07 48.51 49.77 47.53 37.49 26.65 51.57 MMetric 48.13 82.20 84.91 40.67 14.77 13.90 19.62 11.40 91.44 50.34 45.43 7.67 91.44 71.99 84.13 7.67 24.19 14.33 48.13 82.20 84.91 40.67 14.77 13.90 66.70 24.02 RoseAgg 91.43 95.47 96.31 7.62 4.00 2.14 69.73 39.86 50.49 25.01 40.48 29.14 74.61 81.44 89.20 22.30 16.63 7.06 41.80 54.64 59.54 56.94 42.67 36.50 70.37 24.20 AlignIns 2.68 4.03 8.44 68.11 68.50 50.84 2.83 3.79 6.73 67.21 68.12 47.69 2.78 3.53 7.49 66.83 68.50 53.18 3.23 4.52 7.98 66.11 67.50 54.04 4.83 62.21 EndPCA 2.03 5.64 8.24 65.42 62.40 57.63 3.88 5.43 7.75 63.67 61.09 58.33 2.16 4.12 9.87 66.49 63.34 57.51 3.92 6.89 7.79 65.18 62.93 59.89 5.64 61.98 FedDAB 2.91 2.56 4.17 71.01 69.02 63.68 3.44 2.91 3.22 66.53 66.79 64.13 3.58 2.86 3.44 66.22 68.58 68.20 2.88 2.46 3.62 66.88 62.43 58.83 3.17 66.02 CIFAR10 (ResNet9) FedAvg 99.96 99.94 100 0.02 0.02 0.00 91.58 78.99 98.31 7.18 19.52 1.62 99.82 99.67 99.96 0.17 0.27 0.04 99.96 99.94 100 0.02 0.02 0.00 97.34 2.40 MKrum 99.77 99.98 100 0.21 0.01 0.00 85.73 97.87 100 10.53 1.44 0.00 98.73 99.99 100 0.89 0.01 0.00 99.84 99.98 100 0.17 0.00 0.00 98.49 1.10 Foolsgold 3.70 3.99 5.78 76.98 75.62 71.36 3.66 5.96 63.21 77.06 75.07 71.21 3.15 4.25 6.25 77.27 74.83 71.22 3.47 4.90 6.61 78.87 73.65 70.13 9.57 74.43 RLR 80.64 85.17 87.65 17.63 13.20 10.18 11.54 15.61 30.51 29.98 22.58 14.04 8.54 13.00 14.15 30.60 24.94 16.49 76.35 88.80 95.34 22.30 9.35 2.09 50.60 17.78 RFA 73.73 100 100 7.51 0.00 0.00 84.22 100 100 6.27 0.00 0.00 93.60 100 100 1.39 0.00 0.00 78.41 100 100 5.09 0.00 0.00 94.16 1.68 MMetric 93.70 93.49 99.63 5.22 4.84 0.32 53.90 23.61 67.23 35.79 53.99 27.59 99.37 99.96 99.87 0.36 0.04 0.13 91.73 89.74 98.42 7.52 9.53 0.57 84.22 12.15 RoseAgg 97.31 99.36 100 0.07 0.01 0.00 92.54 94.27 98.65 6.51 4.36 0.98 72.64 78.40 85.83 25.71 20.96 13.25 84.69 90.10 91.63 14.02 8.53 8.02 90.45 8.53 AlignIns 2.88 3.20 5.71 79.99 80.13 72.19 3.17 3.07 6.97 79.67 79.74 75.64 3.11 2.99 6.02 79.94 79.87 76.57 3.32 4.12 8.69 77.64 76.17 70.49 4.43 77.33 EndPCA 2.73 4.21 6.26 78.96 76.20 73.54 3.76 3.31 5.43 77.78 77.16 75.90 4.64 5.31 7.19 76.82 75.03 74.74 3.85 5.47 8.64 78.02 76.86 75.15 5.06 76.34 FedDAB 3.22 2.97 3.02 78.91 78.93 78.26 2.99 3.09 3.87 79.59 78.83 77.08 2.82 3.02 3.73 79.67 78.97 78.08 3.10 2.93 3.66 79.07 79.19 77.90 3.20 78.71 CIFAR100 (VGG) FedAvg 81.94 96.64 98.14 6.51 2.47 0.54 64.63 69.23 71.32 16.90 15.27 14.80 62.75 72.73 75.61 16.83 10.55 8.18 79.05 96.76 98.15 7.56 2.29 0.37 80.57 8.52 MKrum 66.48 94.47 98.74 14.64 3.48 0.27 54.66 93.65 97.40 21.33 4.29 0.57 86.46 94.47 96.16 4.79 3.48 2.90 82.62 95.00 98.37 9.66 4.07 1.80 88.20 5.93 Foolsgold 3.75 1.96 4.25 45.65 43.41 40.62 5.25 2.46 8.15 45.03 43.87 35.97 0.72 0.94 1.08 46.11 43.61 42.90 35.00 1.15 10.83 9.53 44.61 30.66 6.29 39.33 RLR 63.37 100 100 0.49 0.00 0.00 11.54 32.67 40.74 32.98 11.58 4.04 8.54 60.50 81.10 30.60 14.94 6.49 21.95 29.63 36.00 22.61 10.35 5.09 48.83 11.59 RFA 73.73 85.50 87.64 7.51 5.36 5.17 67.31 84.22 90.43 6.27 2.61 2.29 75.31 84.42 87.06 1.63 1.27 0.95 52.81 89.92 93.15 5.09 0.62 0.31 80.95 3.25 MMetric 92.14 99.98 100 5.22 0.00 0.00 99.63 99.83 100 0.32 0.25 0.00 24.53 43.80 46.80 16.44 9.63 1.54 64.99 70.64 72.97 10.33 5.47 3.99 76.27 4.43 RoseAgg 95.48 99.64 100 0.67 0.30 0.00 92.61 95.37 99.70 1.32 0.77 0.37 74.66 86.16 99.54 2.74 1.60 0.13 79.73 85.80 96.74 2.87 1.65 0.96 92.11 1.12 AlignIns 1.45 2.98 100 45.45 44.03 0.00 1.35 1.40 1.87 47.44 44.97 43.20 1.13 1.28 1.59 45.26 44.29 42.61 0.81 1.25 1.41 45.80 44.66 42.30 9.71 40.83 EndPCA 1.74 3.15 9.53 45.10 42.48 39.29 1.95 1.82 7.27 45.56 44.70 41.19 0.82 2.86 8.59 46.42 43.78 38.50 2.77 3.69 6.08 44.01 43.85 40.67 4.18 42.96 FedDAB 0.67 0.26 0.42 47.69 46.33 44.61 0.71 0.32 0.41 47.91 46.24 44.64 0.70 0.29 0.43 47.91 46.38 44.63 0.73 0.23 0.42 48.15 46.33 44.61 0.46 46.28 V-B1 Comparison with Existing Methods Table I reports the performance of FedDAB and existing defense methods against backdoor attacks under the Dir(1.0)Dir(1.0) setting. The ASR and R values are recorded at the round with the highest Top-1 test accuracy. Overall, FedDAB demonstrates superior defense performance under four backdoor attacks. Specifically, on FMNIST, Foolsgold achieves the highest R (67.36%), but its ASR remains higher than that of FedDAB. This is because Foolsgold cannot filter out malicious updates and can only reduce their weights in global aggregation. Consequently, malicious updates are incorporated into the aggregation process, resulting in a relatively high ASR. In addition, RoseAgg exhibits the highest ASR. This is because RoseAgg evaluates local updates based on their directions, making its assessment susceptible to deviations among benign update directions induced by Non-IID data, preventing it from assigning low aggregation weights to malicious updates. The defense effectiveness of the other methods is also impaired by statistical heterogeneity, making them less robust than FedDAB against these backdoor attacks. More specifically, on CIFAR10, FedDAB reduces the ASR by 1.23 % and improves the R by 1.38 % over the second-best method. Similarly, on CIFAR100, FedDAB outperforms all existing methods in terms of both ASR and R. The performance advantages of FedDAB can be attributed to two key designs. (i)(i) The model-contrastive term improves the consistency of benign updates in both direction and magnitude, enabling the alignment checking to distinguish benign updates from malicious ones more accurately. (i)(i) FedDAB employs both overall-direction checking and parameter-level checking to evaluate local updates from complementary perspectives, making it more difficult for malicious updates to evade detection. TABLE I: The ASR (%) results of FedDAB on various Non-IID settings of FMNIST, CIFAR10, and CIFAR100. Dataset (Model) Dir(Ψ)Dir( ) BadNet DBA Neurotoxin PGD Avg. ASR↓ v=0.30 v=0.40 v=0.50 v=0.30 v=0.40 v=0.50 v=0.30 v=0.40 v=0.50 v=0.30 v=0.40 v=0.50 FMNIST (ResNet9) Ψ=0.8 =0.8 3.91 6.97 3.79 4.77 4.23 3.81 3.59 3.57 4.41 2.72 4.03 4.22 4.17 Ψ=0.5 =0.5 8.70 4.63 4.52 3.68 3.86 3.12 6.21 4.79 4.67 5.10 4.46 3.96 4.81 Ψ=0.3 =0.3 10.14 3.08 4.49 8.15 7.24 3.16 4.03 2.14 3.24 4.64 1.76 8.03 5.01 CIFAR10 (ResNet9) Ψ=0.8 =0.8 3.82 3.07 3.94 3.91 3.77 3.44 3.91 4.52 3.59 3.67 3.09 3.50 3.69 Ψ=0.5 =0.5 3.98 4.17 6.23 4.10 4.01 6.30 4.48 3.89 6.14 4.12 4.24 6.27 4.83 Ψ=0.3 =0.3 2.56 3.16 6.06 2.51 3.17 5.29 3.90 4.04 5.74 2.59 3.81 6.60 4.12 CIFAR100 (VGG) Ψ=0.8 =0.8 0.58 1.18 0.84 0.98 1.17 0.92 0.42 1.40 0.96 0.53 1.30 0.82 0.93 Ψ=0.5 =0.5 1.05 0.76 0.69 0.89 0.82 0.90 0.98 0.82 0.85 0.97 0.75 0.93 0.87 Ψ=0.3 =0.3 0.15 0.49 0.87 0.19 0.90 0.86 0.14 0.56 0.76 0.04 0.49 0.94 0.53 V-B2 Effectiveness of FedDAB in Varying Non-IID Settings To evaluate the performance of FedDAB under different data distributions, we conduct experiments under three Non-IID settings: Dir(0.8)Dir(0.8), Dir(0.5)Dir(0.5), and Dir(0.3)Dir(0.3). Table I reports the ASR achieved by FedDAB. Across the four backdoor attacks, the ASR exhibits some fluctuations as statistical heterogeneity increases. Nevertheless, FedDAB maintains its effectiveness across different Non-IID settings. Furthermore, FedDAB achieves lower ASR on CIFAR-10/100 than on FMNIST. This can be attributed to the more complex sample characteristics of CIFAR-10/100, which make it harder for malicious nodes to manipulate the global model toward their backdoor objectives. Moreover, on CIFAR-10/100, the ASR changes marginally when the proportion of malicious nodes increases from 30% to 50%, indicating that FedDAB is robust to variations in the proportion of malicious nodes. This conclusion is further supported by the convergence curves in Fig. 3. To evaluate the performance of FedDAB under extreme Non-IID settings, we conduct experiments under the Dir(0.1)Dir(0.1) setting, using the relatively moderate Dir(0.5)Dir(0.5) setting as a reference. The results are reported in Table I. We observe that, despite the higher degree of statistical heterogeneity under Dir(0.1)Dir(0.1), the ASR of FedDAB remains comparable to that under Dir(0.5)Dir(0.5), without any noticeable increase. These results demonstrate that FedDAB can effectively mitigate backdoor attacks even under extreme Non-IID conditions. TABLE I: Performance of FedDAB with extreme Non-IID Settings. Dataset v BadNet DBA Dir(0.5)Dir(0.5) Dir(0.1)Dir(0.1) Dir(0.5)Dir(0.5) Dir(0.1)Dir(0.1) ASR↓ R↑ ASR↓ R↑ ASR↓ R↑ ASR↓ R↑ CIFAR10 20% 3.64 74.15 2.17 70.71 2.65 75.84 3.58 68.19 30% 4.58 72.99 4.01 68.19 3.32 73.11 5.64 67.42 40% 4.23 71.01 5.84 68.92 2.83 70.66 3.45 65.40 CIFAR100 20% 0.43 42.83 0.19 35.88 0.54 43.46 0.59 38.48 30% 0.15 41.91 0.86 33.42 0.58 43.87 0.97 36.68 40% 0.29 40.62 1.10 32.40 0.71 41.27 0.93 33.45 TABLE IV: Impact of each component in FedDAB under CIFAR100. Configuration Attack Success Rate (%) ↓ Avg. ASR↓ BadNet DBA Neurotoxin PGD Dir(1.0)Dir(1.0) Dir(0.5)Dir(0.5) Dir(1.0)Dir(1.0) Dir(0.5)Dir(0.5) Dir(1.0)Dir(1.0) Dir(0.5)Dir(0.5) Dir(1.0)Dir(1.0) Dir(0.5)Dir(0.5) DSSDSS 2.24 20.95 2.61 31.60 2.70 25.78 2.48 33.35 15.21 +MCT 3.99994pt 0.4pt5.0pt 3.00003pt 8.00003pt0.4pt+MCT 1.95 12.30 1.77 21.84 2.09 17.63 2.15 13.77 9.18 SAS(TopSAS(Top-30%)30\%) 1.65 12.65 1.48 12.31 1.26 11.97 1.01 12.92 6.90 +MCT 3.99994pt 0.4pt5.0pt 3.00003pt 8.00003pt0.4pt+MCT 1.21 9.18 1.83 8.90 1.55 10.24 1.58 12.37 5.85 DSS+SAS(TopDSS+SAS(Top-100%)100\%) 1.77 5.70 1.63 6.40 2.04 5.35 1.75 8.50 4.14 +MCT 3.99994pt 0.4pt5.0pt 3.00003pt 8.00003pt0.4pt+MCT 0.82 2.18 0.96 1.91 0.89 2.24 0.84 2.37 1.52 DSS+SAS(TopDSS+SAS(Top-50%)50\%) 1.40 1.44 1.38 1.29 1.07 1.13 0.92 1.10 1.21 +MCT 3.99994pt 0.4pt5.0pt 3.00003pt 8.00003pt0.4pt+MCT 0.83 1.08 0.65 0.95 0.72 0.84 0.68 0.98 0.84 FedDAB (H=0)(H=0) 1.24 1.30 1.08 1.14 1.15 1.06 0.84 1.25 1.13 FedDAB (H=3)(H=3) 0.67 1.05 0.71 0.89 0.70 0.98 0.73 0.94 0.83 V-B3 Ablation Study FedDAB incorporates a model-contrastive term (MCTMCT) into the local training objective and computes the DSSDSS and SASSAS of each node to identify and filter malicious updates. To investigate the contribution of each component, we conduct comprehensive ablation studies on CIFAR100 with 30% malicious nodes. The results are reported in Table IV, where SASSAS (Top-r%) indicates that the top r%r\% of model parameters are used for parameter-level checking. (i) Component ablation. We observe that under the Dir(1.0)Dir(1.0) setting, either DSSDSS or SASSAS alone achieves ASR comparable to that of FedDAB. This is because the relatively balanced data distribution induced by Dir(1.0)Dir(1.0) leads to consistent benign updates, making a single check sufficient to provide strong robustness. However, under the Dir(0.5)Dir(0.5) setting, benign updates exhibit substantial deviation, which significantly reduces the effectiveness of relying on either DSSDSS or SASSAS alone. When the two components are combined, DSS+SASDSS+SAS (Top-100%100\%) reduces the average ASR to 4.14%, demonstrating their complementary strengths. In addition, incorporating MCTMCT consistently reduces the ASR across different configurations. This improvement can be attributed to the model-contrastive term, which enhances the consistency of benign updates, improving the robustness of alignment checking process. (i) Important parameter ablation. To examine the effect of selecting important parameters, we evaluate DSS+SASDSS+SAS using either all parameters (Top-100%) or only important parameters (Top-50%). When only the top-50% of parameters are used, the ASR is reduced compared with the top-100% setting, regardless of whether MCTMCT is applied. These results indicate that restricting SASSAS to the important parameters of local updates can improve the accuracy of filtering malicious updates. (i) Historical information ablation. Since benign nodes generally exhibit consistent and honest behavior across training rounds, FedDAB incorporates their historical information into parameter-level checking. Specifically, we set the length of the global sign buffer gS_g and the local sign buffer lS_l to H, , where H=0H=0 indicates that no historical information is used. Under both the Dir(0.5)Dir(0.5) and Dir(1.0)Dir(1.0) settings, FedDAB (H=33) achieves a lower ASR than FedDAB (H=0). This result indicates that leveraging historical behaviors improves FedDAB’s robustness against backdoor attacks. ((a)) Neurotoxin Attacks. ((b)) Neurotoxin Attacks. ((c)) Neurotoxin Attacks. ((d)) PGD Attacks. ((e)) PGD Attacks. ((f)) PGD Attacks. Figure 1: Test performance of FedDAB on CIFAR10 with different numbers of nodes under Neurotoxin and PGD attacks. V-B4 FedDAB with Varying Numbers of Nodes In real-world federated learning scenarios, the number of participating nodes is often not fixed. Therefore, it is essential to evaluate the scalability of FedDAB under different system scales. To this end, we evaluate FedDAB’s ASR, R, and TA metrics on CIFAR10 with 20, 30, 40, 50, 60, and 70 nodes, where 30% of the nodes are malicious. Notably, as the number of nodes increases, the default number of rounds T becomes insufficient to ensure model convergence at larger scales. To ensure model convergence across all system scales, we set the number of rounds T to 300. The experimental results are shown in Fig. 1. Under both the Dir(1.0)Dir(1.0) and Dir(0.5)Dir(0.5) settings, the ASR does not increase as the number of nodes grows. The results indicate that FedDAB effectively prevents malicious nodes from achieving their attack objectives, demonstrating its strong scalability across different system scales. In addition, the R and TA decrease slightly with the number of participating nodes. This is primarily because a larger number of nodes leads to more dispersed data distributions, which negatively impacts the global model’s performance. Notably, this phenomenon is common in large-scale federated learning systems. Overall, FedDAB maintains robust defensive capability across FL systems of different scales. V-B5 Stability of FedDAB with Varying Backdoor Attacks ((a)) Dir(1.0)Dir(1.0). ((b)) Dir(0.5)Dir(0.5). ((c)) Dir(1.0)Dir(1.0). ((d)) Dir(0.5)Dir(0.5). Figure 2: Box plots of the stability of FedDAB against various backdoor attacks under CIFAR10 dataset with Dir(1.0)Dir(1.0) and Dir(0.5)Dir(0.5) settings. Ensuring the stability of results across repeated experiments is particularly important in federated learning systems. To this end, we conduct ten repeated experiments on the CIFAR10 under both Dir(1.0)Dir(1.0) and Dir(0.5)Dir(0.5) settings to evaluate the ASR and TA of FedDAB against different backdoor attacks. All hyper-parameters are kept at their default values. The results are presented in Fig. 2. FedDAB maintains high stability across various backdoor attacks. The ASR fluctuations are consistently controlled within 0.5%, and the TA fluctuations are consistently controlled within 1% over repeated runs. These variations primarily result from the inherent randomness of gradient descent algorithms, leading to differences in the learned global model. Thus, the results demonstrate that FedDAB maintains stable defense performance across multiple independent runs. V-B6 Convergence of FedDAB under Different Malicious Proportions ((a)) BadNet Attacks. ((b)) DBA Attacks. ((c)) Neurotoxin Attacks. ((d)) PGD Attacks. Figure 3: Convergence of FedDAB under Dir(1.0)Dir(1.0) and Dir(0.5)Dir(0.5) settings on the CIFAR10 against various backdoor attacks. To evaluate the convergence performance of FedDAB, we conduct experiments under both the Dir(1.0)Dir(1.0) and Dir(0.5)Dir(0.5) settings with different proportions of malicious nodes (i.e., v∈0%,30%,40%,50%v∈\0\%,30\%,40\%,50\%\). As illustrated in Fig. 3, the convergence curves under various malicious ratios exhibit trends similar to that of the no-attack case, indicating that FedDAB does not hinder the convergence of the global model. In other words, FedDAB achieves convergence within approximately the same number of training rounds as in the no-attack setting, thereby avoiding additional communication and computation overhead for the nodes. Thus, our FedDAB maintains stable convergence performance across different proportions of malicious nodes. V-B7 Performance of FedDAB under High Proportions of Malicious Nodes In FedDAB, a median-based Z-score is employed to filter out local updates exhibiting anomalous DSSDSS or SASSAS values. Thus, the effectiveness of this median-based scoring mechanism relies on the assumption that benign clients constitute the majority. However, this assumption may not always hold in real-world FL systems. Therefore, it is necessary to evaluate FedDAB’s defensive performance when the proportion of malicious nodes exceeds 50%. To this end, we set the proportion of malicious nodes to 50%, 60%, and 70%, using 40% as the reference setting. As shown in Table V, when the proportion of malicious nodes increases from 40% to 50%, FedDAB achieves an ASR value that is close to the baseline, indicating that FedDAB does not lose its defensive performance even with 50% malicious nodes. Specifically, the model-contrastive term enhances the consistency of benign updates, causing the DSS and SAS values of benign nodes to cluster more tightly. In other words, as long as a malicious update exhibits a significant offset in either DSS or SAS, FedDAB can identify it as suspicious and exclude it from the aggregation. Thus, even when malicious nodes account for 50% of all participating nodes, FedDAB remains effective. When the proportion of malicious nodes further increases to 70%, the ASR of FedDAB decreases significantly. This is because an excessively high proportion of malicious nodes causes malicious updates to dominate the aggregation process, shifting the medians of the DSS and SAS values toward those of malicious updates. Consequently, FedDAB may struggle to accurately distinguish between malicious and benign updates, resulting in some malicious updates being aggregated while some benign updates are erroneously excluded. These results reveal the limitations of FedDAB when malicious nodes constitute an overwhelming majority. TABLE V: Attack success rates of FedDAB under various attacks and high proportions of malicious nodes. Attack Type v Attack Success Rate (%)↓ Avg. ASR (%)↓ FMNIST CIFAR10 CIFAR100 Dir(1.0)Dir(1.0) Dir(0.5)Dir(0.5) Dir(1.0)Dir(1.0) Dir(0.5)Dir(0.5) Dir(1.0)Dir(1.0) Dir(0.5)Dir(0.5) Neurotoxin 40% 2.86 4.79 3.02 3.84 0.29 0.98 2.63 50% 2.92 3.07 4.83 3.95 4.61 0.47 3.31 60% 5.58 7.91 6.97 8.09 5.22 4.80 6.43 70% 13.25 15.38 8.03 23.94 14.26 7.41 13.71 PGD 40% 2.46 4.42 2.93 4.24 0.23 0.75 2.51 50% 4.39 6.71 5.02 2.44 3.83 0.96 3.89 60% 4.34 5.82 7.29 5.25 4.28 2.44 4.90 70% 23.80 15.46 12.26 10.68 16.49 5.98 14.11 V-B8 Consistency of FedDAB in Non-IID Settings To evaluate the effectiveness of our designed model-contrastive term in enhancing the consistency of local updates, we measure the deviations among local updates in both magnitude and direction. The magnitude deviation and directional deviation are defined as follows. Definition 5. (Magnitude Deviation) Given that in the t-th round, each benign node k∈ℬk _B submits its local update Δkt _k^t, the magnitude deviation among local updates is given by: DevMt=log(∑k∈ℬ‖Δkt−Δ¯t‖2),Dev^t_M= ( _k _B\| _k^t- ^t\|^2), where Δ¯t ^t denotes the mean of all local updates, and DevMtDev^t_M is the magnitude deviation among local updates in the t-th round. Definition 6. (Directional Deviation) Given that in the t-th round, each benign node k∈ℬk _B submits its local update Δkt _k^t, the direction deviation among local updates is given by: DevDt=∑k∈ℬ(1−cos(Δkt,Δ¯t)),Dev^t_D= _k _B(1-cos( _k^t, ^t)), where cos(⋅)cos(·) is the cosine similarity between two vectors, and DevDtDev^t_D measures the directional deviation among local updates in the t-th round. Remark 5. If all k1,k2∈ℬk_1,k_2 _B satisfy Δk1t=Δk2t _k_1^t= _k_2^t, then the relation Δ¯t=Δkt ^t= _k^t holds. In this case, the local updates are perfectly consistent, which implies DevMt=DevDt=0Dev^t_M=Dev^t_D=0. Conversely, a larger DevMtDev^t_M indicates a greater deviation in update magnitudes, while a larger DevDtDev^t_D reflects significant inconsistency in update directions. ((a)) CIFAR100, Dir(1.0)Dir(1.0). ((b)) CIFAR100, Dir(0.5)Dir(0.5). ((c)) CIFAR100, Dir(1.0)Dir(1.0). ((d)) CIFAR100, Dir(0.5)Dir(0.5). Figure 4: Comparison of magnitude deviation and directional deviation with CIFAR100 under both Dir(1.0)Dir(1.0) and Dir(0.5)Dir(0.5) settings. Following Definition 5, we measure the magnitude deviation among local updates generated by different nodes under FedDAB in the absence of backdoor attacks. For comparison, we evaluate an ablated variant of FedDAB in which the magnitude-alignment term is removed from the local objective (w/o MT). Experiments are conducted on CIFAR100 under Dir(1.0)Dir(1.0) and Dir(0.5)Dir(0.5) settings, and the results are reported in Fig. 4(a) and Fig. 4(b). We observe that the magnitude deviation under FedDAB is lower than that under w/o MT. This reduction is attributed to the magnitude-alignment term introduced in FedDAB’s local objective, which improves magnitude alignment between local and global models and reduces the impact of magnitude inconsistency among benign nodes on parameter-level checking step. Similarly, following Definition 6, we evaluate the directional deviation across nodes’ local updates, and compare FedDAB with an ablated variant that removes the direction-alignment term (w/o DT). As shown in Fig. 4(c) and Fig. 4(d), FedDAB exhibits a lower directional deviation than w/o DT, indicating that the direction-alignment term improves directional consistency among benign updates. V-B9 Impact of Parameters λDSS _DSS and λSAS _SAS on FedDAB ((a)) FMNIST, TA ↑ ((b)) CIFAR10, TA ↑ ((c)) CIFAR100, TA ↑ ((d)) FMNIST, ASR ↓ ((e)) CIFAR10, ASR ↓ ((f)) CIFAR100, ASR ↓ Figure 5: Test accuracy and attack success rate of FedDAB with varying hyper-parameters λDSS _DSS and λSAS _SAS. In FedDAB, the Anomaly Score Detection step computes the median offsets mk,1tm_k,1^t and mk,2tm_k,2^t for each node. A node is excluded from the current round if its offset exceeds the corresponding threshold λDSS _DSS or λSAS _SAS. Thus, a larger threshold allows more nodes to participate in aggregation, while a smaller threshold reduces the number of participating nodes. To evaluate the FedDAB’s sensitivity to λDSS _DSS and λSAS _SAS, we conduct experiments on FMNIST, CIFAR10, and CIFAR100. Specifically, λDSS _DSS is selected from 0.25,0.5,0.75,1.0,1.25,1.50\0.25,0.5,0.75,1.0,1.25,1.50\, and λSAS _SAS is varied over 0.5,0.75,1.0,1.25,1.50\0.5,0.75,1.0,1.25,1.50\. In the experiments, 30% of the nodes launched BadNet attacks, and the data distribution follows Dir(1.0)Dir(1.0). The results are presented in Fig. 5. We observe that FedDAB maintains stable performance across different threshold settings, except when the thresholds are extremely small (e.g., λDSS=0.25 _DSS=0.25 or λSAS=0.50 _SAS=0.50). This is because overly low thresholds filter out a large number of benign nodes, leaving insufficient local updates to compute the global model and causing the model to under-fit. Thus, to balance defense effectiveness and main-task performance, neither λDSS _DSS nor λSAS _SAS should be set too low. V-B10 Impact of Buffer Length H on FedDAB TABLE VI: The performance of FedDAB under various attacks with different buffer length H. Best rusults are in blod. Attack Types Buffer Length Test Accuracy (%)↑ Avg. ASR↓ Avg. TA↑ FMNIST CIFAR10 CIFAR100 ASR (↓)( ) TA (↑)( ) ASR (↓)( ) TA (↑)( ) ASR (↓)( ) TA (↑)( ) Neurotoxin H=0H=0 2.58 85.17 4.37 76.73 1.06 57.37 2.67 73.09 H=2H=2 15.82 71.20 3.68 78.04 0.85 57.94 6.78 74.39 H=3H=3 3.78 87.67 3.60 78.22 0.71 57.75 2.70 74.55 H=4H=4 3.14 87.71 3.42 76.88 0.78 57.47 2.45 74.02 H=5H=5 4.54 87.26 3.64 78.02 0.76 57.59 2.98 74.29 PGD H=0H=0 3.42 86.28 4.09 77.45 1.04 57.52 2.94 73.66 H=2H=2 2.50 87.87 4.42 78.81 0.85 57.48 2.59 74.72 H=3H=3 2.88 88.08 3.38 78.63 0.72 57.65 2.33 74.79 H=4H=4 2.07 87.98 3.23 78.89 0.61 57.57 1.97 74.81 H=5H=5 2.04 88.11 3.28 77.44 0.80 57.48 2.04 74.34 Since benign nodes can honestly follow the training protocol across all rounds, we incorporate nodes’ historical information into the parameter-level checking to better captures their stable behavior. To evaluate the impact of this mechanism, we set the buffer length to 0,2,3,4,50,2,3,4,5, where H=0H=0 indicates that no historical information is used. The experimental results are reported in Table VI. We observe that under PGD attacks, compared with H=0H=0, FedDAB reduces ASR by more than 1% on average when H=4H=4. Moreover, FedDAB achieves its highest TA when the buffer length is set to 3 or 4, whereas its TA is the lowest when H=0H=0. This is because incorporating more historical information improves the robustness of FedDAB. V-B11 FedDAB on NLP Tasks To validate the effectiveness of FedDAB on NLP tasks, we conduct experiments on the Sentiment140 using ResNet9. For the attack setting, poisoned samples are constructed by inserting the sentence “This is a backdoor trigger” into samples. The number of rounds T is set to 200, while other hyper-parameters follow the default settings. The results are reported in Table VII. Under different attack ratios, FedDAB achieves ASR values of 39.72%, 40.03%, and 45.39%, corresponding to relative reductions of 7.56%, 17.21%, and 40.36%, respectively, compared with AlignIns. In addition, FedDAB consistently attains the highest R, surpassing AlignIns by an average of 15.63%. These results verify the robustness of FedDAB on NLP dataset. TABLE VII: Performance under BadNet attacks on Sentiment140. Methods BadNet Attacks ASR(%)↓ R(%)↑ Avg. ASR ↓ Avg. R ↑ v=0.30 v=0.40 v=0.50 v=0.30 v=0.40 v=0.50 MKrum 82.48 87.23 99.88 11.46 7.24 0.17 89.86 6.29 Foolsgold 40.45 41.06 44.25 52.85 51.14 49.63 41.92 51.21 RoseAgg 63.09 67.05 79.54 29.89 29.15 24.63 69.89 27.89 AlignIns 42.97 48.35 76.10 51.03 48.55 9.34 55.81 36.31 FedDAB 39.72 40.03 45.39 54.35 52.63 48.83 41.71 51.94 V-B12 Time Cost To evaluate the efficiency of FedDAB, we measure both its aggregation time and training time. Specifically, we conduct experiments on the CIFAR10 using the ResNet9 architecture, and compare the aggregation time of FedDAB with that of other defense methods within a single round. All experiments are conducted on an NVIDIA A800 GPU. The results are presented in Fig. 6(a). We observe that FedAvg achieves the shortest aggregation time because it does not incorporate any defense mechanism. In contrast, other defense methods introduce additional detection steps, leading to higher time overhead. Notably, the aggregation time for RFA and MMetric is significantly higher than other methods, while RLR, MKrum, RoseAgg, AlignIns, and FedDAB maintain their aggregation times within the range of 0.4-0.5 seconds. This is because the network architecture typically contains a large number of parameters, leading to substantial computational overhead for RFA when calculating the geometric median of each parameter coordinate during aggregation. Meanwhile, MMetric incurs significant time costs by evaluating multiple metrics for each model update. Overall, FedDAB does not introduce noticeable aggregation overhead, and its time efficiency is comparable to that of most defense methods. Except for the aggregation time, we evaluate the local training time of FedDAB. Specifically, we measure the training time of FedDAB and FedAvg under different numbers of local iterations, as shown in Fig. 6(b). We observe that FedDAB’s training time is slightly higher than that of FedAvg. This is because FedDAB introduces a model-contrastive term in its optimization objective to enhance the consistency among benign local updates. Thus, it is reasonable for FedDAB to incur additional computational cost during local training. TABLE VIII: Memory overhead of local sign buffer in FedDAB. Number of Nodes 20 30 40 50 60 70 80 100 Memory overhead (GB) 1.17 1.76 2.33 3.01 3.54 4.11 4.70 5.90 V-B13 Memory overhead FedDAB requires maintaining per-node historical buffers lS_l, which introduces additional memory cost. To evaluate this overhead, we conduct experiments on CIFAR10 with ResNet9 with the historical buffer length set to 3. As reported in Table VIII, the server-side memory overhead grows linearly with the number of nodes. This overhead is acceptable in edge computing scenarios, as it is incurred only on the server side and does not impose additional storage burden on edge nodes. Notably, the server side has more sufficient storage resources than edge nodes. ((a)) Aggregation Time ((b)) Local Training Time Figure 6: Time costs in FL system. (a) Aggregation time per round for the defense methods. (b) Training time per round for all nodes. VI Conclusion We propose a two-phase method FedDAB to defend against backdoor attacks in FL systems. The method combines local contrastive regularization with server-side alignment checking. Experiments validate the effectiveness of FedDAB, and show that it outperforms existing defense methods. However, FedDAB still has certain limitations. Specifically, malicious nodes may abuse their access to the global model by copying or distributing it without authorization [39]. In future work, we will investigate the integration of intellectual property protection mechanisms into FL systems while preserving their robustness against backdoor attacks. References [1] Y. Allouah, S. Farhadkhani, R. Guerraoui, N. Gupta, R. Pinot, and J. Stephan (2023) Fixing by mixing: a recipe for optimal byzantine ml under heterogeneity. In Proceedings of AISTATS, p. 1232–1300. Cited by: §IV, §IV, Remark 2. [2] Y. Allouah, R. Guerraoui, N. Gupta, R. Pinot, and G. Rizk (2023) Robust distributed learning: tight error bounds and breakdown point under data heterogeneity. In Proceedings of NIPS, Vol. 36, p. 45744–45776. Cited by: §IV. [3] P. Blanchard, E. M. El Mhamdi, R. Guerraoui, and J. Stainer (2017) Machine learning with adversaries: byzantine tolerant gradient descent. In Proceedings of NIPS, Vol. 30. Cited by: §I, §I, §I-A, §V-A4, Remark 2. [4] X. Chang, M. S. Obaidat, X. Xue, and J. Ma (2026) GPAFed: gradient projection-guided adaptive aggregation strategy for federated learning under non-iid data. IEEE Transactions on Vehicular Technology 75 (2), p. 3312–3317. Cited by: §I. [5] J. Chen, H. Yan, Z. Liu, M. Zhang, H. Xiong, and S. Yu (2024) When federated learning meets privacy-preserving computation. ACM Computing Surveys 56 (12), p. 1–36. Cited by: §I. [6] T. Chen, S. Kornblith, M. Norouzi, and G. Hinton (2020) A simple framework for contrastive learning of visual representations. In Proceedings of ICML, p. 1597–1607. Cited by: §I, §I, §I-A. [7] C. Fung, C. J. Yoon, and I. Beschastnikh (2020) The limitations of federated learning in sybil settings. In Proceedings of RAID, p. 301–316. Cited by: §I, §I, §V-A4. [8] T. Gu, B. Dolan-Gavitt, and S. Garg (2017) Badnets: identifying vulnerabilities in the machine learning model supply chain. arXiv preprint arXiv:1708.06733. Cited by: §I-B1, §V-A3. [9] Q. Guo, D. Wu, Y. Qi, and S. Qi (2025) Dual class-aware contrastive federated semi-supervised learning. IEEE Transactions on Mobile Computing 24 (2), p. 1073–1089. External Links: Document Cited by: §I. [10] S. Huang, Y. Li, C. Chen, L. Shi, and Y. Gao (2023) Multi-metrics adaptively identifies backdoors in federated learning. In Proceedings of ICCV, p. 4652–4662. Cited by: §I, §I, §I-A, §V-A4. [11] R. Jin, Y. Liu, Y. Huang, X. He, T. Wu, and H. Dai (2025) Sign-based gradient descent with heterogeneous data: convergence and byzantine resilience. IEEE Transactions on Neural Networks and Learning Systems 36 (2), p. 3834–3846. Cited by: §I-B1. [12] T. Krauß and A. Dmitrienko (2023) Mesas: poisoning defense for federated learning resilient against adaptive attackers. In Proceedings of CCS, p. 1526–1540. Cited by: §I, §I, §I-A. [13] A. Krizhevsky, G. Hinton, et al. (2009) Learning multiple layers of features from tiny images. University of Toronto. Cited by: §V-A1. [14] Q. Li, B. He, and D. Song (2021) Model-contrastive federated learning. In Proceedings of CVPR, p. 10713–10722. Cited by: §I, §I, §I-A, §I-A. [15] T. Li, A. K. Sahu, M. Zaheer, M. Sanjabi, A. Talwalkar, and V. Smith (2020) Federated optimization in heterogeneous networks. In Proceedings of MLSys, Vol. 2, p. 429–450. Cited by: §I, §I-A. [16] Z. Li, J. Lan, Z. Yan, and E. Gelenbe (2025) Backdoor attacks and defense mechanisms in federated learning: a survey. Information Fusion (103248). Cited by: §I. [17] B. McMahan, E. Moore, D. Ramage, S. Hampson, and B. A. y Arcas (2017) Communication-efficient learning of deep networks from decentralized data. In Proceedings of AISTATS, p. 1273–1282. Cited by: §V-A4. [18] Y. Miao, W. Zheng, X. Li, H. Li, K. R. Choo, and R. H. Deng (2023) Secure model-contrastive federated learning with improved compressive sensing. IEEE Transactions on Information Forensics and Security 18 (), p. 3430–3444. Cited by: §I. [19] T. D. Nguyen, P. Rieger, H. Chen, H. Yalame, H. Möllering, H. Fereidooni, et al. (2022) FLAME: taming backdoors in federated learning. In Proceedings of USENIX Security, p. 1415–1432. Cited by: §I, §I. [20] M. S. Ozdayi, M. Kantarcioglu, and Y. R. Gel (2021) Defending against backdoors in federated learning with robust learning rate. In Proceedings of AAAI, Vol. 35, p. 9268–9276. Cited by: §I, §I-B1, §V-A4. [21] A. Panda, S. Mahloujifar, A. N. Bhagoji, S. Chakraborty, and P. Mittal (2022) Sparsefed: mitigating model poisoning attacks in federated learning with sparsification. In Proceedings of AISTATS, p. 7587–7624. Cited by: Remark 2. [22] R. Pi, W. Zhang, Y. Xie, J. Gao, X. Wang, S. Kim, and Q. Chen (2023) Dynafed: tackling client data heterogeneity with global dynamics. In Proceedings of CVPR, p. 12177–12186. Cited by: §I, §I-A. [23] K. Pillutla, S. M. Kakade, and Z. Harchaoui (2022) Robust aggregation for federated learning. IEEE Transactions on Signal Processing 70 (), p. 1142–1154. External Links: Document Cited by: §I, §V-A4, Remark 2. [24] S. Seo, J. Kim, G. Kim, and B. Han (2024) Relaxed contrastive learning for federated learning. In Proceedings of CVPR, p. 12279–12288. Cited by: §I. [25] H. M. Son, M. H. Kim, and T. Chung (2021) Compare where it matters: using layer-wise regularization to improve federated learning on heterogeneous data. arXiv preprint arXiv:2112.00407. Cited by: §I. [26] H. Wang, K. Sreenivasan, S. Rajput, H. Vishwakarma, S. Agarwal, J. Sohn, K. Lee, and D. Papailiopoulos (2020) Attack of the tails: yes, you really can backdoor federated learning. In Proceedings of NIPS, Vol. 33, p. 16070–16084. Cited by: §I, §I-B1, §V-A3. [27] X. Wang, Y. Wang, M. Yang, F. Li, X. Wu, L. Fan, and S. He (2025) FedSiam-da: dual-aggregated federated learning via siamese network for non-iid data. IEEE Transactions on Mobile Computing 24 (2), p. 985–998. External Links: Document Cited by: §V-A1. [28] Z. Wang, J. Wang, and A. Li (2024) Fedhyper: a universal and robust learning rate scheduler for federated learning with hypergradient descent. In Proceedings of ICLR, Cited by: Remark 3. [29] H. Xiao, K. Rasul, and R. Vollgraf (2017) Fashion-mnist: a novel image dataset for benchmarking machine learning algorithms. arXiv preprint arXiv:1708.07747. Cited by: §V-A1. [30] C. Xie, K. Huang, P. Chen, and B. Li (2019) Dba: distributed backdoor attacks against federated learning. In Proceedings of ICLR, Cited by: §I-B1, §V-A3. [31] B. Xu, L. Cheng, Q. Wen, Z. Zou, X. Hu, Z. Dong, and J. Qi (2025) Heterogeneous federated learning driven by multi-knowledge distillation. IEEE Transactions on Mobile Computing 24 (12), p. 13048–13061. External Links: Document Cited by: §I. [32] J. Xu, Z. Zhang, and R. Hu (2025) Detecting backdoor attacks in federated learning via direction alignment inspection. In Proceedings of CVPR, p. 20654–20664. Cited by: §IV, §V-A4. [33] J. Xu, Z. Zhang, and R. Hu (2025) Identify backdoored model in federated learning via individual unlearning. In Proceedings of WACVW, p. 7960–7969. Cited by: §I-B1. [34] J. Xu, S. Huang, L. Song, and T. Lan (2022) Byzantine-robust federated learning through collaborative malicious gradient filtering. In Proceedings of ICDCS, p. 1223–1235. Cited by: §I-B1, §IV, Remark 2. [35] H. Yang, W. Xi, Y. Shen, C. Wu, and J. Zhao (2024) RoseAgg: robust defense against targeted collusion attacks in federated learning. IEEE Transactions on Information Forensics and Security 19 (), p. 2951–2966. Cited by: §I, §I, §I-A, §V-A1, §V-A4. [36] Y. Yang, X. Liu, T. Gao, X. Xu, P. Zhang, and G. Wang (2024) Dense contrastive-based federated learning for dense prediction tasks on medical images. IEEE Journal of Biomedical and Health Informatics 28 (4), p. 2055–2066. Cited by: §I, §I-A. [37] M. Ye, X. Fang, B. Du, P. C. Yuen, and D. Tao (2023) Heterogeneous federated learning: state-of-the-art and research challenges. ACM Computing Surveys 56 (3), p. 1–44. Cited by: §I. [38] P. Ye, Y. Li, K. He, Q. Li, T. Qin, X. Wang, K. Yang, C. Zhang, and J. Chen (2025) Breaking the illusion: a critical study of backdoor defense in federated learning with non-iid data. IEEE Transactions on Information Forensics and Security 20 (), p. 13264–13279. Cited by: §I. [39] X. Yi, H. Zhang, H. Yu, G. Fan, and H. Zhu (2026) Guard against infringement: an anti-distillation federated learning watermarking framework. IEEE Transactions on Dependable and Secure Computing 23 (1), p. 49–65. External Links: Document Cited by: §VI. [40] Q. Yu, Y. Liu, Y. Wang, K. Xu, and J. Liu (2023) Multimodal federated learning via contrastive representation ensemble. In Proceedings of ICLR, Cited by: §I. [41] X. Yu, D. Wang, M. J. McKeown, and Z. J. Wang (2024) Contrastive-enhanced domain generalization with federated learning. IEEE Transactions on Artificial Intelligence 5 (4), p. 1525–1532. Cited by: §I, §I-A. [42] H. Zhang, R. Chen, S. Wen, and X. Bian (2025) SWIM: sliding-window model contrast for federated learning. Future Generation Computer Systems 164. Cited by: §I, §I-A, §I-A. [43] H. Zhang, J. Yu, F. Xu, C. Hu, Y. Zhang, X. Wang, Z. Yu, and X. Zhang (2025) PPFPL: cross-silo privacy-preserving federated prototype learning against data poisoning attacks. IEEE Transactions on Artificial Intelligence (), p. 1–16. Cited by: §IV. [44] H. Zhang, Z. Yu, G. Wang, et al. (2025) Towards model-contrastive federated learning with lightweight privacy preservation and poisoning attack detection. IEEE Transactions on Dependable and Secure Computing (), p. 1–17. Cited by: §I, §V-A1. [45] M. Zhang, C. Hu, X. Cao, A. Sajjanhar, Z. Yang, M. U. Hassan, Z. Jin, and J. Li (2026) EndPCA: ensemble defense with provably convergent aggregation against poisoning attacks in federated learning. IEEE Transactions on Information Forensics and Security 21 (), p. 1438–1453. Cited by: §V-A4. [46] Z. Zhang, A. Panda, L. Song, Y. Yang, M. Mahoney, P. Mittal, R. Kannan, and J. Gonzalez (2022) Neurotoxin: durable backdoors in federated learning. In Proceedings of ICML, p. 26429–26446. Cited by: §I, §I-B1, §V-A3. [47] Z. Zhang, L. Wu, D. He, J. Li, N. Lu, and X. Wei (2024) Using third-party auditor to help federated learning: an efficient byzantine-robust federated learning. IEEE Transactions on Sustainable Computing 9 (6), p. 848–861. Cited by: §I, §I, §I-A.