{"id":"1520deb9-c456-4ec7-b7d4-4bf29071c786","arxiv_id":"2504.15674","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":6,"one_line_summary":"TrojanDam defends federated learning against backdoors by having the server repeatedly train the global model on out-of-distribution images before sending it to clients.","lead":"This paper proposes a defense for federated learning that has the central server inject unrelated images into the global model each round to neutralize backdoor attacks. The authors report strong backdoor suppression across many settings, while acknowledging the defense needs a good source of extra images and careful tuning.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"TrojanDam's central guarantee collapses when OOD flood data lacks visual richness; Table V shows BA at 55-72% with EMNIST/noise, so the defense is contingent on an unstated data-quality assumption.","rationale":"I agree with the reader that the availability of visually rich OOD data is the weakest assumption. The paper's central claim is empirical and heavily supported across architectures, datasets, and attack types; that is a genuine strength. However, the mechanism is not robust to the quality of the auxiliary data. Table V is the clearest evidence: swapping CIFAR100 flood for EMNIST or noise erases the defense advantage, bringing BA from ~22% to 55–72%, roughly the level of the weakest baselines. Since the threat model assumes only that the server 'could collect a number of OOD samples,' with no restriction on their domain or complexity, the claim 'backdoor accuracy stays near random guess' is not generally true. A secondary concern is the alignment of defense start (round 400) with attack start (round 430), which means the server effectively has a warm-up period; an adversary starting earlier might not be suppressed, although the paper argues early attacks are weak. The missing formal proof of the redundant-neuron activation claim and missing error bars in the main tables are also worth fixing, but they are less load-bearing than the data-quality dependence, because the empirical performance is the core evidence. These issues do not invalidate the method when appropriate OOD data exists; they require the paper to state the condition explicitly. The reader's CONDITIONAL verdict is appropriate, so I recommend no change.","tokens_in":29230,"tokens_out":5360,"duration_ms":52886,"concrete_test":"Reproduce the Table V protocol for the blended-backdoor/Chameleon setting on CIFAR10, but replace the flood dataset with Fashion-MNIST (gray-scale, 28×28, visually simple) instead of EMNIST, keeping the noise-mask and label-resampling procedure identical. If the mean BA over the final 20 rounds exceeds 50% (or even 35%), while the CIFAR100 flood gives ≈22%, then the defense's effectiveness is contingent on OOD feature richness rather than on the robustification mechanism itself. A second confirmation: compute the mean per-sample gradient norm of each candidate flood dataset under the global model; check whether BA correlates with this richness proxy, and if so identify the threshold below which the defense stops providing near-random-backdoor performance.","verdict_should_be":"UNCHANGED","load_bearing_attack":"TrojanDam's advertised behavior—backdoor accuracy held near random guess without detecting malicious clients—depends on the server having OOD flood data that is 'visually rich' enough to activate redundant neurons. Table V demonstrates this dependence quantitatively: with EMNIST as the flood source and CIFAR100 as shadow, BA rises to 64.97±3.63%; with random noise as flood, BA reaches 55.65–63.31% depending on shadow; only CIFAR100 or 300KRANDOM flood keep BA near 22%. In other words, the defense mechanism's core enabler is not the aggregation or robustification procedure per se, but the feature quality of an auxiliary dataset whose availability is assumed in the threat model without qualification. The paper states the defender 'could collect a number of OOD samples from the public dataset' and does not constrain their visual complexity; yet the method fails for exactly the kinds of OOD sets (low-dimensional, binary-like, or noise) that are most likely to be publicly available in specialized FL deployments. Without a criterion for 'sufficiently rich' OOD data, the central claim is conditional on an unstated assumption that may be unsatisfiable in practice.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"This paper proposes TrojanDam, a server-side backdoor defense for federated learning that avoids detecting or filtering malicious client updates. Instead, the server proactively modifies the global model before each broadcast: it constructs a 'flood' dataset of OOD samples with random labels and noise masks and a 'shadow' dataset of OOD samples labeled by the current global model, selects a small fraction of convolution kernels and batch-normalization parameters as 'key kernels' using a gradient-difference heuristic, and performs several projected-gradient steps on those parameters with a regularization penalty. The authors argue that this activates redundant neurons so that backdoor updates no longer have a silent region in which to accumulate. The paper supports this with experiments on CIFAR10, CIFAR100, and EMNIST across multiple attack types (PGD, Neurotoxin, Chameleon, CerP, PFedBA, DBA) and compares against eight existing defenses, reporting that TrojanDam keeps backdoor accuracy near the random-guess level in most evaluated settings without substantially degrading main-task accuracy.","tokens_in":29526,"tokens_out":5851,"duration_ms":51691,"significance":"The paper introduces a genuinely different defense paradigm—proactive robustification instead of post-hoc detection—and the empirical coverage is unusually broad: nine baselines, five attack training algorithms, four backdoor types, three datasets, and three model architectures, with code released. The key mechanism is falsifiable: the authors' Table V demonstrates that the defense's effectiveness collapses when the flood dataset lacks visual richness, which is exactly the kind of conditional dependence a reader needs to see. If the mechanism were backed by a formal statement about when OOD mappings activate redundant neurons, and if the main comparison tables carried multiple-seed statistics, the contribution would be a strong candidate for a security venue. At present the evidence is suggestive but not conclusive: the central claim is contingent on data-quality assumptions, the defense onset is tuned to the attack schedule, and the abstract's 'prove' language is not supported by a proof.","major_comments":[{"comment":"The defense's central claim is conditional on the visual richness of the flood dataset, and the paper does not state this condition in the threat model. In Table V, replacing the default flood source (CIFAR100) with EMNIST raises backdoor accuracy to 64.97%–72.11%, and using random noise yields 55.65%–63.31%, even when the shadow source is the same. The threat model in §III-A only requires that the server 'could collect a number of OOD samples from the public dataset' with a disjoint label space, which is satisfied by EMNIST and by random noise. The advertised property that backdoor accuracy stays near random guess without detecting malicious clients is therefore not a property of the aggregation mechanism alone; it holds only when a sufficiently rich auxiliary dataset is available. This should be elevated to an explicit assumption with a quantifiable criterion, or the central claim must be weakened.","section":"§IV-C, Table V"},{"comment":"The server begins injecting OOD mappings at global round 400, exactly 30 rounds before the attack onset at round 430, with the justification that earlier rounds produce large benign updates. Under the stated threat model, the adversary 'could continuously participate in the FL training process starting from any global round' (§III-A), so the defense must be robust to attack starts that precede the chosen onset. No experiment varies the defense start round or considers an attack that begins at round 0. Without such an ablation, the reported near-random-guess backdoor accuracy cannot be separated from the favorable timing choice. This is a load-bearing gap for the claim of effective defense against continuous, long-term injection.","section":"§IV-A, TrojanDam settings"},{"comment":"The abstract states that the authors 'prove the feasibility of activating redundant neurons utilizing out-of-distribution (OOD) samples in centralized settings,' but the evidence provided is an empirical gradient histogram (Figure 4) and a number-of-active-neurons plot (Figure 5). No formal statement, theorem, or proof appears anywhere in the manuscript. Either a precise mathematical statement that can be checked must be added, or the wording should be changed to 'demonstrate empirically.' This matters because the entire method rests on the claim that mixing OOD and main-task data activates redundant neurons; an unproven assertion in the abstract overstates the result.","section":"Abstract and §III-C"},{"comment":"The headline comparison tables (Tables I–IV) report a single run per configuration, with no standard deviations or seed counts, while the hyperparameter analysis (Tables V–IX) reports mean±std. Given the high variance typical of backdoor benchmarks (e.g., Table V reports standard deviations of 2–4 percentage points), the claimed margins over the second-best defense in Tables I and II cannot be assessed for statistical significance. The paper should report at least three seeds with error bars for the main comparisons, or explicitly state that the headline tables are single-seed illustrative results.","section":"Tables I–IV vs. V–IX"}],"minor_comments":[{"comment":"There are typos: 'exitsing' should be 'existing', and 'SOAT' should be 'SOTA'.","section":"§I"},{"comment":"The two panels are labeled UPPER and LOWER, but the axes and legend do not make it immediately clear whether the orange line shows backdoor accuracy or detection percentage; add a legend entry for each line.","section":"Figure 1"},{"comment":"The shadow dataset labels are assigned using the current global model's predictions on OOD samples; since the paper itself notes these predictions are overconfident, a sentence on sensitivity to model calibration in early training rounds would help.","section":"§III-E, Algorithm 1"},{"comment":"The backdoor type is spelled 'TacT' in the table but 'TaCT' in the text and elsewhere; make the spelling consistent.","section":"Table II"},{"comment":"The abbreviation 'NCD' is used in the table but is not defined at first use; the text refers to 'norm-clipping component' earlier, so define NCD explicitly before Table IX.","section":"§V, Table IX"},{"comment":"The lower panel caption says '300 flood samples' but the figure shows several dataset sizes; clarify which curves correspond to which sizes in the legend.","section":"Figure 5"}],"recommendation":"major_revision","confidential_remarks":"The paper's central premise that backdoor samples are OOD data is supported only by a reference to the authors' own BackdoorIndicator paper (ref [31]); the editor may wish to encourage an independent test of that premise or a clear statement that the defense inherits this assumption. The fit with cs.CR is good, but the deployment dependence on the server's auxiliary data quality is likely to be the main point of contention in review."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"TrojanDam is a legitimate new idea: instead of trying to detect malicious updates, the server proactively robustifies redundant neurons by injecting OOD mappings before broadcasting. That is a real paradigm shift relative to BackdoorIndicator and other detection-based defenses, and the paper does a thorough job evaluating it across three datasets, four architectures, and a wide range of attack types and training algorithms. The code is released, and the adaptive-attack section (Tables VIII–IX) is a nice touch that most defenses omit.\n\nThe main caveat is exactly what Table V shows: the defense only holds together when the flood dataset is visually rich. With EMNIST or random noise as flood, backdoor accuracy climbs to 55–72%. The paper acknowledges this but does not offer a criterion for 'rich enough' OOD data, and the threat model simply assumes the server can collect suitable samples from a public dataset. In specialized FL deployments, that assumption may fail. This is not a hidden flaw—it is honestly reported—but it means the abstract's 'canceling the effect' language overstates the unconditional guarantee.\n\nTwo other issues matter. First, the abstract says 'prove' but the paper gives no formal proof; what we get is a convincing empirical demonstration. That language should be changed. Second, the defense starts at round 400, 30 rounds before the known attack onset at 430. In practice the server does not know when an attack will begin, so the paper should show sensitivity to starting round, or argue why starting earlier/later does not change the qualitative result. The main tables also lack error bars, though later tables include them, suggesting the authors can provide them.\n\nThe citation pattern is fine; the OOD premise is drawn from the authors' own BackdoorIndicator, which is published and legitimate, though independent validation would strengthen the paper.\n\nOverall, this is a serious paper with a plausible mechanism and unusually broad evaluation. It deserves a proper refereeing. My recommendation: major revision, with the flood-data dependency and the start-round tuning as the key points to address.","headline":"A genuinely new detection-free FL backdoor defense with strong experiments, but the flood-data quality dependence is real and should be central to the revision.","tokens_in":30016,"tokens_out":2774,"would_cite":true,"duration_ms":26748,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Federated learning backdoors can be neutralized without detecting malicious clients, by continually re-activating dormant neurons with out-of-distribution data.","keywords":["federated learning","backdoor attack","backdoor defense","out-of-distribution data","redundant neurons","proactive robustification","detection-free defense","TrojanDam"],"falsifier":"Run the CIFAR10 blended-backdoor Neurotoxin setting used in the paper's Table V but with the key-kernel selection replaced by a random selection of the same fraction of kernels; if backdoor accuracy stays near random-guess, then the paper's claim that identifying and robustifying the most backdoor-relevant redundant neurons is what cancels the attack would be falsified.","tokens_in":29057,"feed_emoji":"🛡️","tokens_out":9339,"duration_ms":81750,"temperature":0.7,"pith_summary":"Backdoor attacks in federated learning succeed because the neurons that carry the backdoor are rarely touched by ordinary training, so malicious updates can slip through aggregation without conflicting with benign ones. This paper argues that the fix is to make those dormant neurons active by having the server continuously train the global model on out-of-distribution data, a mechanism it calls TrojanDam. Each round, the server injects fresh OOD mappings into a small set of key convolution kernels, so that backdoor updates now collide with benign updates during aggregation and their effect is canceled. The defense never inspects or filters client updates, which matters for stealthy adversaries whose poisoned updates are statistically close to benign ones. If it holds, it gives FL servers a detection-free route to resisting long-term backdoor injection while keeping main-task accuracy close to its original level.","feed_headline":"Backdoor accuracy drops to ~10% in FL without flagging clients","feed_subtitle":"Server re-activates dormant neurons with OOD data, suppressing FL backdoors without screening clients.","key_machinery":"The load-bearing object is the redundant neuron: a unit, or in this paper a convolution kernel, that benign training leaves almost untouched and that therefore offers a conflict-free place for backdoor features to land. TrojanDam's mechanism has three parts. A flood dataset is built from OOD images plus fresh random noise masks and random labels, refreshed every round to keep the model learning new mappings. A shadow dataset is built from OOD images labeled by the current global model's own predictions, which the paper shows cluster with genuine main-task features, so it substitutes for the client data the server never sees. An identification step ranks convolution kernels by the difference between gradients computed on flood-plus-shadow data and gradients on shadow data alone, and the server updates only the top $\\epsilon$ fraction of those kernels, regularized toward the current global model, with batch-normalization statistics restored afterward. These projected OOD-mapping updates are what activate redundant neurons, and norm clipping at aggregation then lets the benign updates cancel the backdoor.","core_discovery":"The paper's central claim is that the durability of backdoors in federated learning comes from a lack of conflict: adversarial updates that exploit redundant neurons do not interfere with benign updates because those neurons are almost never updated by the main task. TrojanDam reverses this by robustifying the redundant neurons before each round of local training, using a mixture of two OOD datasets: flood data, which are OOD samples with fresh random noise masks and random labels from the main task's label space, and shadow data, which are OOD samples labeled by the current global model's predictions to stand in for the missing main-task data. The server computes gradients on this mixture and projects them onto the top fraction of convolution kernels ranked by their OOD sensitivity, then broadcasts the robustified model. The paper reports that across CIFAR10, CIFAR100 and EMNIST with several architectures, this continuous activation brings mean backdoor accuracy down to near random-guess levels for long-lasting attacks that defeat detection-based defenses.","pith_inferences":["The same redundant-neuron activation idea could be applied in centralized training as a general poison-robustness regularizer, periodically 'waking up' dormant units with OOD-like augmentations rather than only defending against backdoors in FL.","Because the mechanism depends on overparameterization, its effectiveness should shrink as models are compressed or pruned; testing on pruned or narrower networks would delimit the regime where the defense applies.","The shadow-data labeling technique, which uses the global model's own predictions on OOD samples to imitate the main-task distribution, is a reusable trick for server-side tasks that need a data proxy without seeing client data.","A natural next test is whether an adaptive adversary can align its backdoor updates with the OOD mappings during the server's robustification step, effectively 'hiding' the backdoor inside the activated neurons; the paper does not evaluate that alignment attack."],"forward_implications":["Long-term backdoor injection (600+ rounds) can be held near random-guess accuracy (roughly 10-30 percent BA in the evaluated settings) without any client-level detection.","The defense is robust across model architectures (VGG16, ResNet18, ResNet34), datasets (CIFAR10, CIFAR100, EMNIST), attack types (blended, semantic, edge-case, TaCT), training algorithms (PGD, Neurotoxin, Chameleon), and collaborative attacks (DBA).","Main-task accuracy decreases only mildly (about 1.5-3.5 percent in the reported flood-size study), and the drop can be tuned by the size of the flood dataset and the key-kernel ratio.","The source of OOD data is decisive: rich visual sources keep BA near 22-28 percent, while feature-poor sources (EMNIST, noise) push BA to 55-72 percent, showing the defense's practical reliance on auxiliary data quality."],"supporting_citations":[{"why":"Shows that planting backdoors on parameters rarely updated by benign clients (redundant neurons) yields durable, high-accuracy attacks; this is the premise TrojanDam targets.","marker":"[53]"},{"why":"Introduced server-side OOD-data use for proactive backdoor handling in FL, supplying the flood and shadow data ideas TrojanDam adapts.","marker":"[31]"},{"why":"Defined the model-replacement backdoor threat model in FL that the defense must withstand.","marker":"[1]"},{"why":"Provides the FedAvg aggregation rule that TrojanDam operates within and clips.","marker":"[34]"},{"why":"Supports the overparameterization assumption that redundant neurons exist and can carry backdoors without hurting main-task accuracy.","marker":"[40]"},{"why":"Documents the sparsity of SGD gradients, explaining why most parameters stay nearly untouched by benign updates.","marker":"[46]"},{"why":"Contributes the norm-clipping component TrojanDam depends on, and the PGD attack variant used in evaluation.","marker":"[47]"}],"fun_headline_variants":["Proactive OOD robustification defeats FL backdoors without detection","TrojanDam: No flagging needed to neutralize FL backdoors","OOD data re-awaken neurons to stop FL backdoor attacks","Backdoor defense without detection: OOD robustification in FL","Proactive model hardiness: OOD data blocks FL backdoors"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The decisive assumption is that the server can obtain out-of-distribution images with enough visual structure that repeatedly training the key kernels on them genuinely activates redundant neurons; when the OOD source is feature-poor, such as EMNIST or pure noise, backdoor accuracy climbs back to 55-72 percent.","fun_headline_variants_meta":{"raw":{"variants":["Proactive OOD robustification defeats FL backdoors without detection","TrojanDam: No flagging needed to neutralize FL backdoors","OOD data re-awaken neurons to stop FL backdoor attacks","Backdoor defense without detection: OOD robustification in FL","Proactive model hardiness: OOD data blocks FL backdoors"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.00083,"raw_usage":{"total_tokens":3660,"prompt_tokens":1016,"completion_tokens":2644,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":632,"completion_tokens_details":{"reasoning_tokens":2554}},"tokens_in":632,"tokens_out":2644,"duration_ms":17331,"temperature":1.0,"reasoning_tokens":2554,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-16T11:19:50.085097+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run the CIFAR10 blended-backdoor Neurotoxin setting used in the paper's Table V but with the key-kernel selection replaced by a random selection of the same fraction of kernels; if backdoor accuracy stays near random-guess, then the paper's claim that identifying and robustifying the most backdoor-relevant redundant neurons is what cancels the attack would be falsified.","supporting_citations":[{"cited_title":"Neurotoxin: Durable backdoors in federated learning","cited_arxiv_id":null,"evidence_quote":"Shows that planting backdoors on parameters rarely updated by benign clients (redundant neurons) yields durable, high-accuracy attacks; this is the premise TrojanDam targets."},{"cited_title":"BackdoorIndicator: Leveraging OOD data for proactive backdoor detection in federated learning","cited_arxiv_id":null,"evidence_quote":"Introduced server-side OOD-data use for proactive backdoor handling in FL, supplying the flood and shadow data ideas TrojanDam adapts."},{"cited_title":"Communication-efficient learning of deep networks from decentralized data","cited_arxiv_id":null,"evidence_quote":"Provides the FedAvg aggregation rule that TrojanDam operates within and clips."},{"cited_title":"Revisiting the assumption of latent separability for backdoor defenses","cited_arxiv_id":null,"evidence_quote":"Supports the overparameterization assumption that redundant neurons exist and can carry backdoors without hurting main-task accuracy."},{"cited_title":"Spar- sified sgd with memory","cited_arxiv_id":null,"evidence_quote":"Documents the sparsity of SGD gradients, explaining why most parameters stay nearly untouched by benign updates."}],"review_version":1}