BackDFL: A Unified Benchmark For Backdoor Attacks and Defenses In Decentralized Federated Learning

# BackDFL: A Unified Benchmark For Backdoor Attacks and Defenses In Decentralized Federated Learning
Source: [https://arxiv.org/html/2608.21137](https://arxiv.org/html/2608.21137)
Mouhamed Amine BouchihaGregory BlancOrcID:[0000\-0001\-8150\-6617](https://orcid.org/0000-0001-8150-6617)Affiliation:SAMOVAR, Télécom SudParis, Institut Polytechnique de ParisYufei HanOrcID:[0000\-0002\-9035\-6718](https://orcid.org/0000-0002-9035-6718)Affiliation:PIRAT, INRIA Rennes, Rennes, France

###### Abstract

Decentralized Federated Learning \(DFL\) promises trust\-free collaborative learning by replacing the centralized parameter server with peer\-to\-peer model exchange\. However, this architectural shift fundamentally reshapes the threat landscape\. Without globally coordinated aggregation, DFL becomes particularly susceptible to backdoor attacks, in which malicious participants implant persistent hidden behaviors while maintaining high clean\-task performance\. In this paper, we argue that the robustness of DFL has been significantly overestimated\. Existing studies rely on simplified threat models, non\-adaptive adversaries, fragmented evaluation protocols, inconsistent communication topologies, and ad hoc training configurations, leading to an incomplete understanding of DFL security\. To address these limitations, we present BackDFL, a unified benchmark for systematically evaluating DFL under realistic and adaptive backdoor attacks\. Through extensive experiments, BackDFL exposes critical failure modes of decentralized learning\. Our results demonstrate that both state\-of\-the\-art Byzantine\-robust DFL methods and adapted FL backdoor defenses fail under modest malicious participation rates \(as low as 15%\), especially in heterogeneous settings, while their robustness varies substantially across communication graph topologies\.

###### Keywords:

Decentralized Federated Learning Backdoor Attacks Backdoor Defenses Unified Benchmark\.

## 1Introduction

Federated Learning \(FL\)\[[28](https://arxiv.org/html/2608.21137#bib.bib1)\]is a privacy\-preserving distributed learning paradigm in which multiple participants collaboratively train a shared model without exchanging their raw data\. Each client locally updates a copy of the current model using its private dataset and sends the resulting model update to a central server\. The server then aggregates these updates to produce a new global model, which is redistributed to clients in the next training round\. Despite its appeal, classical FL remains fundamentally centralized\. A single server coordinates the training process, collects local model updates and performs aggregation to maintain the global model\. This coordination introduces well\-known drawbacks, including a single point of failure, performance bottlenecks, and strong trust dependencies, which can expose the system to attacks and disruptions\. To address these limitations, recent work has shifted toward Decentralized Federated Learning \(DFL\)\[[4](https://arxiv.org/html/2608.21137#bib.bib2),[25](https://arxiv.org/html/2608.21137#bib.bib4),[12](https://arxiv.org/html/2608.21137#bib.bib34),[18](https://arxiv.org/html/2608.21137#bib.bib28),[27](https://arxiv.org/html/2608.21137#bib.bib41),[23](https://arxiv.org/html/2608.21137#bib.bib42),[20](https://arxiv.org/html/2608.21137#bib.bib46)\], where model aggregation is performed over peer\-to\-peer \(P2P\) or partially structured networks without relying on a central coordinator\. By eliminating the single point of failure and centralized trust, DFL provides improved fault tolerance and better matches the requirements of large\-scale, dynamic environments such as vehicular networks and IoT ecosystems\[[43](https://arxiv.org/html/2608.21137#bib.bib3)\]\. This paradigm has demonstrated promise across a wide range of applications\. In autonomous driving, for example, connected vehicles\[[9](https://arxiv.org/html/2608.21137#bib.bib33),[6](https://arxiv.org/html/2608.21137#bib.bib45),[8](https://arxiv.org/html/2608.21137#bib.bib35)\]can collaboratively learn perception models from locally captured images or videos to detect traffic signs, lanes, pedestrians, and other critical objects\. However, decentralization also removes global oversight mechanisms that traditionally support robust aggregation and coordinated attack detection\. As a result, under weaker trust assumptions, learning becomes vulnerable to adaptive and stealthy poisoning\.

In this context, adaptive backdoor attacks \(BAs\) become particularly insidious\[[45](https://arxiv.org/html/2608.21137#bib.bib11),[30](https://arxiv.org/html/2608.21137#bib.bib12),[16](https://arxiv.org/html/2608.21137#bib.bib13),[46](https://arxiv.org/html/2608.21137#bib.bib10)\]\. By crafting malicious local updates that survive decentralized aggregation, adversaries can implant hidden behaviors into each peer’s global model—preserving high accuracy on benign data while inducing strong targeted misclassification on trigger inputs\. Although several Byzantine\-robust DFL methods have been proposed\[[18](https://arxiv.org/html/2608.21137#bib.bib28),[19](https://arxiv.org/html/2608.21137#bib.bib29),[13](https://arxiv.org/html/2608.21137#bib.bib23),[35](https://arxiv.org/html/2608.21137#bib.bib37)\], most evaluate their defenses using naive backdoor scenarios\[[17](https://arxiv.org/html/2608.21137#bib.bib7)\],\[[2](https://arxiv.org/html/2608.21137#bib.bib8)\]that fail to capture realistic, adaptive threats\. In particular, these evaluations assume static triggers\[[15](https://arxiv.org/html/2608.21137#bib.bib32)\], stationary adversaries, and often ignore the underlying network topology\[[35](https://arxiv.org/html/2608.21137#bib.bib37)\], which significantly underestimates the potential of sophisticated attackers \(e\.g\., A3FL\[[45](https://arxiv.org/html/2608.21137#bib.bib11)\], IBA\[[30](https://arxiv.org/html/2608.21137#bib.bib12)\]\) who can craft updates that survive aggregation\. As a result, the reported robustness of existing methods may be overly optimistic, leaving critical vulnerabilities unaddressed\. Moreover, the broader DFL literature suffers from methodological inconsistencies that further complicate meaningful comparison\. Studies employ heterogeneous communication topologies \(ring, regular, small\-world,…\)\[[15](https://arxiv.org/html/2608.21137#bib.bib32)\],\[[19](https://arxiv.org/html/2608.21137#bib.bib29)\]and widely varying local training hyperparameters \(epochs, learning rates, optimizers, batch sizes\)\[[35](https://arxiv.org/html/2608.21137#bib.bib37)\],\[[18](https://arxiv.org/html/2608.21137#bib.bib28)\], even though both attack propagation and defense effectiveness are highly sensitive to these factors\. Compounding these issues, most DFL defenses lack publicly available and reproducible implementations \(e\.g\., BALANCE\[[15](https://arxiv.org/html/2608.21137#bib.bib32)\], UBAR\[[18](https://arxiv.org/html/2608.21137#bib.bib28)\], DFL\-Dual\[[35](https://arxiv.org/html/2608.21137#bib.bib37)\]\), with only a few exceptions such as LEARN\[[12](https://arxiv.org/html/2608.21137#bib.bib34)\]and SCCLIP\[[19](https://arxiv.org/html/2608.21137#bib.bib29)\]\.

In contrast to this fragmented state of DFL research, backdoor defense in centralized FL is far more mature and systematically studied\. Numerous defense mechanisms have been proposed for centralized FL \(e\.g\., FLAME\[[29](https://arxiv.org/html/2608.21137#bib.bib14)\], DeepSight\[[33](https://arxiv.org/html/2608.21137#bib.bib17)\], MMAD\[[22](https://arxiv.org/html/2608.21137#bib.bib19)\]\), benefitting from a parameter server that has global visibility over all selected client updates\. However, such server\-assisted defenses cannot be directly applied in fully DFL systems\[[15](https://arxiv.org/html/2608.21137#bib.bib32)\], where no participant has a global view\. This could make centralized strategies either inapplicable or highly inefficient when executed locally\. Thus, their effectiveness needs to be systematically evaluated when adapted to the DFL setting\. These fundamental inconsistencies and gaps motivate a deeper investigation into the security limits of DFL under BAs\. The maincontributionsof this paper are as follows:

1. 1\.
2. 2\.We conduct an extensive comparative evaluation of thirteen defenses showing their failure modes\.

The remainder of this paper is organized as follows\. Section[3](https://arxiv.org/html/2608.21137#S3)introduces the problem formulation and outlines the key motivations\. Section[2](https://arxiv.org/html/2608.21137#S2)presents the related work\. Section[4](https://arxiv.org/html/2608.21137#S4)defines the DFL system and threat models\. Section[5](https://arxiv.org/html/2608.21137#S5)presents the proposed BackDFL, a unified benchmark to assess the vulnerability of DFL to BAs\. Section[6](https://arxiv.org/html/2608.21137#S6)presents the evaluation methodology and discusses the results\. Section[7](https://arxiv.org/html/2608.21137#S7)concludes the paper\.

## 2Related Work

Backdoor attacks in FL have been extensively studied in the*centralized*setting\[[31](https://arxiv.org/html/2608.21137#bib.bib5),[11](https://arxiv.org/html/2608.21137#bib.bib22),[3](https://arxiv.org/html/2608.21137#bib.bib44)\], where a parameter server aggregates client updates\. For instance, Nguyen et al\.\[[31](https://arxiv.org/html/2608.21137#bib.bib5)\]offer focused overviews of attack strategies and defenses\. More recent efforts, such as BackFed\[[11](https://arxiv.org/html/2608.21137#bib.bib22)\], provide large\-scale benchmarking frameworks that highlight implementation pitfalls and evaluation inconsistencies\. Despite these advances, existing works remain fundamentally tied to the assumptions of centralized FL \(CFL\), where a trusted server orchestrates aggregation and often supports defense mechanisms \(e\.g\., server\-side validation, robust aggregation rules\)\. However,BAs in DFL remain largely underexplored from an evaluation perspective\. This gap is critical as insights derived from centralized FL cannot be directly extrapolated to DFL due to several fundamental differences: \(i\)*decentralized aggregation*, where each client performs local aggregation using its own reference model; \(ii\)*topology\-constrained communication*, which controls how poisoned updates propagate through the network; and \(iii\)*increased attack surface*, where adversaries can exploit graph structure\. These factors can amplify or suppress BA persistence in ways that are not yet studied\.

Beyond methodological gaps, prior studies employ heterogeneous experimental configurations that hinder reproducibility and comparability\. Works differ substantially in graph topology, local training schedules, optimizers, and hyperparameters\[[15](https://arxiv.org/html/2608.21137#bib.bib32),[19](https://arxiv.org/html/2608.21137#bib.bib29),[35](https://arxiv.org/html/2608.21137#bib.bib37),[18](https://arxiv.org/html/2608.21137#bib.bib28)\]\. Since both benign convergence and malicious diffusion are highly sensitive to these factors, reported robustness claims cannot be meaningfully contrasted across papers\. Threat models are also simplified\. Most evaluations rely on static triggers, fixed poisoned datasets, and non\-adaptive adversaries\[[15](https://arxiv.org/html/2608.21137#bib.bib32),[35](https://arxiv.org/html/2608.21137#bib.bib37)\], thereby underestimating the capabilities of realistic attackers in decentralized settings\.

## 3Problem Definition

The transition to fully DFL addresses the limitations of conventional centralized FL by replacing the parameter server with direct P2P model exchange over a communication graph for enhanced resilience and autonomy\. However, this design shift does not address persistent security challenges, particularly*backdoor attacks*, which remain largely unexplored\.

Research Questions\.There is a clear need for a rigorous, reproducible, and scientifically sound benchmark for evaluating BAs in DFL, which should\(1\) unify DFL configurations and training protocols, \(2\) harmonize attack definitions and threat models, \(3\) address implementation pitfalls and ensure consistent evaluation metrics, and \(4\) enable fair, comparable, and reproducible assessment of both attacks and defenses\. Guided by this scientific requirement, this work proposes BackDFL to address the following questions:

- •RQ1\.Which centralized FL defenses remain effective when adapted to DFL, and why do others fail?
- •RQ2\.How do established stealthy BAs \(e\.g\.,Neurotoxin,A3FL,IBA\) behave in DFL settings?
- •RQ3\.What is the impact of data and model characteristics on robustness?
- •RQ4\.What is the impact of the DFL graph topology?

![Refer to caption](https://arxiv.org/html/2608.21137v1/sokbadfl.png)Figure 1:Backdoor propagation in DFL through P2P model exchange\.
## 4System & Threat Models

This section defines the DFL system and threat models we adopt throughout this paper\.

### 4\.1System Model

We consider a DFL setting following prior work\[[15](https://arxiv.org/html/2608.21137#bib.bib32),[35](https://arxiv.org/html/2608.21137#bib.bib37),[32](https://arxiv.org/html/2608.21137#bib.bib30)\], where a set of clientsVVis connected through an undirected communication graphG=\(V,E\)G=\(V,E\), with\(i,j\)∈E\(i,j\)\\in Eindicating that clientsiiandjjcan directly exchange model parameters as depicted in Figure[1](https://arxiv.org/html/2608.21137#S3.F1)\. Each clienti∈Vi\\in Vholds a private local dataset𝒟i\\mathcal\{D\}\_\{i\}and jointly aims to learn a global model𝐰∈θ⊂ℝd\\mathbf\{w\}\\in\\theta\\subset\\mathbb\{R\}^\{d\}that minimizes the empirical risk:

𝐰∗=arg⁡min𝐰∈θ⁡F⁡\(𝐰\)=1\|𝒟\|​∑ζ∈𝒟f⁡\(𝐰,ζ\),\\mathbf\{w\}^\{\\ast\}=\\arg\\min\_\{\\mathbf\{w\}\\in\\theta\}F\(\\mathbf\{w\}\)=\\frac\{1\}\{\|\\mathcal\{D\}\|\}\\sum\_\{\\zeta\\in\\mathcal\{D\}\}f\(\\mathbf\{w\},\\zeta\),\(1\)where𝒟=⨄i∈V𝒟i\\mathcal\{D\}=\\biguplus\_\{i\\in V\}\\mathcal\{D\}\_\{i\}\.

Unlike classical federated learning, DFL operates*without a central server*\. Each client maintains a local model𝐰i\\mathbf\{w\}\_\{i\}and interacts only with its neighbors𝒩i=\{j∣\(i,j\)∈E\}\\mathcal\{N\}\_\{i\}=\\\{j\\mid\(i,j\)\\in E\\\}\. At roundtt, clientiifirst performs local optimization \(e\.g\., SGD\) using a learning rateη\\etato obtain

𝐰i,t\+12=LocalTraining​\(𝐰i,t,𝒟i,η\),\\mathbf\{w\}\_\{i,t\+\\frac\{1\}\{2\}\}=\\textsc\{LocalTraining\}\(\\mathbf\{w\}\_\{i,t\},\\mathcal\{D\}\_\{i\},\\eta\),\(2\)then aggregates neighbors’ models via

𝐰i,t\+1=α​𝐰i,t\+12\+\(1−α\)​AGG​\(\{𝐰j,t\+12∣j∈𝒩i\}\),\\mathbf\{w\}\_\{i,t\+1\}=\\alpha\\mathbf\{w\}\_\{i,t\+\\frac\{1\}\{2\}\}\+\(1\-\\alpha\)\\,\\textsc\{AGG\}\\left\(\\\{\\mathbf\{w\}\_\{j,t\+\\frac\{1\}\{2\}\}\\mid j\\in\\mathcal\{N\}\_\{i\}\\\}\\right\),\(3\)whereα∈\[0,1\]\\alpha\\in\[0,1\]controls the trade\-off between self\-reliance and consensus, andAGG​\(⋅\)\\textsc\{AGG\}\(\\cdot\)denotes the aggregation rule \(e\.g\., FedAvg\[[28](https://arxiv.org/html/2608.21137#bib.bib1)\], Median\[[42](https://arxiv.org/html/2608.21137#bib.bib21)\]\)\. Overall, each round consists of

\(i\)*local training and model exchange*using Eq\.\([2](https://arxiv.org/html/2608.21137#S4.E2)\), followed by\(ii\)*decentralized aggregation*using Eq\.\([3](https://arxiv.org/html/2608.21137#S4.E3)\)\.

![Refer to caption](https://arxiv.org/html/2608.21137v1/BADFLPipline.png)Figure 2:Overview of the backdoor attack workflow on theGTSRBdataset, thetraining\-timestage \(left\) \(sample selection, trigger injection, and local training on poisoned data\) and theinference\-timestage \(right\), where the trigger is inserted to activate the attack\.
### 4\.2Threat Model

Following prior work on DFL security\[[14](https://arxiv.org/html/2608.21137#bib.bib27),[18](https://arxiv.org/html/2608.21137#bib.bib28),[19](https://arxiv.org/html/2608.21137#bib.bib29),[32](https://arxiv.org/html/2608.21137#bib.bib30),[15](https://arxiv.org/html/2608.21137#bib.bib32)\], we consider an*active adversary*controlling a subset of clients in the decentralized network\.

Attacker Objective\.The attacker aims to poison the training process to implant*backdoors*\(as shown in Figure[2](https://arxiv.org/html/2608.21137#S4.F2)\) into model updates propagated to benign clients, while remaining stealthy\.

Attacker Capabilities\.We consider an adversarial scenario in which the attacker can compromise a fractionβM\\beta\_\{M\}\(default 15%\) of the client population\. Malicious clients can

\(i\)inject poisoned samples into their local datasets, and/or\(ii\)manipulate their model updates before sharing them with neighbors\.

The communication topologyGGis fixed and cannot be modified by the attacker, although benign clients may temporarily disconnect due to network instability\.

Attacker and Defender Knowledge\.We assume an*adaptive attacker*with full knowledge of

\(i\)the compromised clients’ training data,\(ii\)their aggregation rules and hyperparameters\.

The attacker has no prior knowledge of the communication graphGGor the neighborhood structure of individual clients, and can only operate based on locally observed information\. Both benign and malicious clients can naturally observe their neighbors’ shared model updates\. In contrast, the*defender*does not know which clients are malicious, has no visibility into the attack strategy, and lacks knowledge of both global and local malicious ratios\.

## 5Proposed BackDFL

We present a modular framework for evaluating BAs and BDs in centralized and decentralized FL\. Implemented in Python/PyTorch, it emphasizes reproducibility and configurability, enabling easy integration of new attacks, defenses, and datasets\. BackDFL’s design goals are:

- •Modularity:Each functional component—datasets, models, attacks, defenses, and experiment flows—is encapsulated in independent modules to enable seamless extension and integration\.
- •Reproducibility:The framework is built to replicate the results of this study while providing a stable base for future research\.
- •FL and DFL support:In addition to centralized FL, it supports fully decentralized FL with parallel training and configurable graphs\.
- •Configuration\-driven experiments:Experiments are defined via YAML configuration files to eliminate the need for repetitive boilerplate code\.
- •Rich algorithmic implementations:Includes well established BAs \(DBA,Scaling,Neurotoxin,A3FL,IBA\) and defenses \(BALANCE, SCCLIP, M\-Krum, Weak\-DP, FLAME, DeepSight,…\), several benchmark datasets \(MNIST,CIFAR\-10/100,GTSRB,FEMNIST,HAR, …\) along with their standard models\.

![Refer to caption](https://arxiv.org/html/2608.21137v1/BackDFL.png)Figure 3:BackDFL: A framework for BAs and BDs in DFL\. The architecture is modular, with configuration files feeding experiment flows, which interact with datasets, models, attack and defense modules\. Utility modules are shared\.#### Framework Overview\.

The framework follows a modular design \(Figure[3](https://arxiv.org/html/2608.21137#S5.F3)\) comprising

\(i\)aconfiguration layerwith YAML\-based experiment definitions feeding both CFL and DFL flows,\(ii\)adata & model layerhandling datasets and model architectures,\(iii\)anexperiment flow layerwith two parallel pipelines:centralizedflow for CFL anddecentralizedflow for DFL with topology management,\(iv\)anattack & defense layerimplementing BAs and defense mechanisms shared across both flows,\(v\)abase FL layerproviding foundational client and server code, and\(vi\)anoutput layercomputing performance metrics while offering utility logs for iterative experiments\.

BackDFL design encourages modular extension: new attacks, defenses, datasets and models can be plugged in without modifying core experiment flows\.

#### Implementation Scope\.

At the time of writing, BackDFL integratessixwell\-established targeted BAs \(fixed trigger\[[17](https://arxiv.org/html/2608.21137#bib.bib7),[41](https://arxiv.org/html/2608.21137#bib.bib9)\], optimized trigger\[[45](https://arxiv.org/html/2608.21137#bib.bib11),[30](https://arxiv.org/html/2608.21137#bib.bib12)\], gradient manipulation\[[46](https://arxiv.org/html/2608.21137#bib.bib10),[2](https://arxiv.org/html/2608.21137#bib.bib8)\]\),fiveclassical untargeted attacks, andfourteendefenses \(9 adapted FL BDs and 5 DFL\-specific robust methods\)\. BackDFL supports evaluation onsevendatasets\. Although the key focus of this work is the vulnerability of DFL to adaptive backdoors, we consider it important to include classical untargeted attacks as well, since Byzantine robustness encompasses both\. These include Label Flipping\[[34](https://arxiv.org/html/2608.21137#bib.bib6)\], Feature\[[37](https://arxiv.org/html/2608.21137#bib.bib40)\], Gauss\[[5](https://arxiv.org/html/2608.21137#bib.bib20)\], Krum and Trim\[[14](https://arxiv.org/html/2608.21137#bib.bib27)\]attacks\.

## 6Evaluation & Results

This section presents the empirical evaluation of several FL BDs and Byzantine\-robust DFL methods under several BAs using the proposed BackDFL\.

### 6\.1Experimental Setup

Datasets and models\.We use BackDFL to evaluate BAs and BDs on seven benchmark datasets:MNIST\[[26](https://arxiv.org/html/2608.21137#bib.bib38)\],FashionMNIST\[[40](https://arxiv.org/html/2608.21137#bib.bib39)\],FEMNIST\[[10](https://arxiv.org/html/2608.21137#bib.bib24)\],GTSRB\[[21](https://arxiv.org/html/2608.21137#bib.bib25)\],CIFAR\-10andCIFAR\-100\[[24](https://arxiv.org/html/2608.21137#bib.bib26)\], as well asHAR\[[1](https://arxiv.org/html/2608.21137#bib.bib31)\], using adapted neural network architectures under non\-IID settings\.

ForMNIST, we use a SimpleCNN model\. ForFashionMNIST\(28×\\times28 grayscale images\), we employ a lightweight convolutional neural network \(Fashion\-CNN\) composed of two convolutional blocks followed by two fully connected layers\. For theFEMNISTdataset \(28×\\times28 grayscale images\), we employ a LeNet\-5 model\. ForCIFAR\-10andCIFAR\-100\(32×\\times32 color images\), we use a ResNet18 model, and forGTSRB\(color traffic sign images\), we use a custom CNN\. ForHAR, which consists of 561\-dimensional feature vectors extracted from smartphone sensors, we adopt a multilayer perceptron \(MLP\) with two hidden layers \(256 and 128 units\)\. Appendix[0\.A](https://arxiv.org/html/2608.21137#Pt0.A1)provides the complete training configurations\. Attacks\.We evaluate sixwell\-establishedBAs selected to cover a diverse spectrum of strategies, including input\-space triggers, learned triggers, gradient manipulation, and scaling\-based model replacement\. This diversity ensures that our benchmark captures both classical\[[17](https://arxiv.org/html/2608.21137#bib.bib7),[2](https://arxiv.org/html/2608.21137#bib.bib8),[41](https://arxiv.org/html/2608.21137#bib.bib9)\]and adaptive attack behaviors\[[46](https://arxiv.org/html/2608.21137#bib.bib10),[45](https://arxiv.org/html/2608.21137#bib.bib11),[30](https://arxiv.org/html/2608.21137#bib.bib12)\]\. For all attacks, the poisoning rate is 25% of local data \(as inA3FL\[[45](https://arxiv.org/html/2608.21137#bib.bib11)\]\), the attacker fractionβM\\beta\_\{M\}is set to 15% of the population, and all poisoned samples are relabeled to the target class prior to training\. Defenses\. We evaluate both CFL and DFL defenses against these attacks\. The selection of FL defense methods is aligned with the DFL system model presented in Section[4](https://arxiv.org/html/2608.21137#S4)\. For CFL defenses, we focus onpre\-\[[29](https://arxiv.org/html/2608.21137#bib.bib14),[33](https://arxiv.org/html/2608.21137#bib.bib17),[22](https://arxiv.org/html/2608.21137#bib.bib19),[38](https://arxiv.org/html/2608.21137#bib.bib18)\],in\-\[[5](https://arxiv.org/html/2608.21137#bib.bib20),[42](https://arxiv.org/html/2608.21137#bib.bib21),[36](https://arxiv.org/html/2608.21137#bib.bib15)\], andpost\-aggregation\[[36](https://arxiv.org/html/2608.21137#bib.bib15),[29](https://arxiv.org/html/2608.21137#bib.bib14)\]methods that are compatible with DFL,i\.e\., they can be instantiated locally by each client acting as adefensive aggregator\. Methods that rely on global signals \(a root dataset\[[7](https://arxiv.org/html/2608.21137#bib.bib16)\]\) or post\-hoc model purification\[[39](https://arxiv.org/html/2608.21137#bib.bib36)\]are thus excluded, as their assumptions do not hold in DFL settings\. This ensures that the evaluation measures the effectiveness of defenses that can realistically be deployed in DFL\. For DFL\-specific defenses, we cover all three design paradigms: peer\-based trust assessment\[[35](https://arxiv.org/html/2608.21137#bib.bib37)\], filtering via distance\- or loss\-based acceptance tests\[[15](https://arxiv.org/html/2608.21137#bib.bib32),[18](https://arxiv.org/html/2608.21137#bib.bib28)\], and norm\-based update bounding\[[19](https://arxiv.org/html/2608.21137#bib.bib29)\]\. We exclude defenses such as BaDFL\[[44](https://arxiv.org/html/2608.21137#bib.bib43)\]and LEARN\[[12](https://arxiv.org/html/2608.21137#bib.bib34)\]from the evaluation since they directly modify the local training procedure or client optimization dynamics and therefore do not conform to our system model\. The final selected set includes:DFL methods—■\\blacksquareUBAR\[[18](https://arxiv.org/html/2608.21137#bib.bib28)\],■\\blacksquareSCCLIP\[[19](https://arxiv.org/html/2608.21137#bib.bib29)\],■\\blacksquareBALANCE\[[15](https://arxiv.org/html/2608.21137#bib.bib32)\],■\\blacksquareDFL\-Dual\[[35](https://arxiv.org/html/2608.21137#bib.bib37)\],■\\blacksquareABALANCE;CFL defenses—■\\blacksquareDeepSight\[[33](https://arxiv.org/html/2608.21137#bib.bib17)\],■\\blacksquareFLAME\[[29](https://arxiv.org/html/2608.21137#bib.bib14)\],■\\blacksquareSPP\[[38](https://arxiv.org/html/2608.21137#bib.bib18)\],■\\blacksquareMMAD\[[22](https://arxiv.org/html/2608.21137#bib.bib19)\],■\\blacksquareNorm\-Clip,■\\blacksquareWeak\-DP\[[36](https://arxiv.org/html/2608.21137#bib.bib15)\],■\\blacksquareM\-Krum\[[5](https://arxiv.org/html/2608.21137#bib.bib20)\], and■\\blacksquareTrim\[[42](https://arxiv.org/html/2608.21137#bib.bib21)\]\. Detailed descriptions are available in our public repository\.■\\blacksquareABALANCE extends■\\blacksquareBALANCE by replacing its acceptance rule with anadaptivethreshold that accounts for both the distribution of received updates and their temporal evolution:

τadaptive\(t\)=min⁡\(median⁡\(di​j\(t\)\)\+σ,τprev\)⋅11\+γ​σ​λ​\(t\),\\tau\_\{\\text\{adaptive\}\}^\{\(t\)\}=\\min\\\!\\left\(\\mathrm\{median\}\(d\_\{ij\}^\{\(t\)\}\)\+\\sigma,\\,\\tau\_\{\\text\{prev\}\}\\right\)\\cdot\\frac\{1\}\{1\+\\gamma\\sigma\\lambda\(t\)\},whereσ\\sigmadenotes the median absolute deviation \(MAD\) of the received distances andτprev\\tau\_\{\\text\{prev\}\}is the threshold from the previous round\. Compared with the original BALANCE, this adaptive criterion relaxes acceptance during early rounds under highly non\-IID data while progressively tightening the threshold through temporal consistency to improve robustness against stealthy BAs\.

Metrics\.Following prior work on FL and DFL security, we report both utility and attack effectiveness metrics:

- •Main\-task accuracy \(ACC\):the average \(Avg\.ACC\) and \(Min\.ACC\) accuracy on clean test data across all benign clients\[[45](https://arxiv.org/html/2608.21137#bib.bib11),[30](https://arxiv.org/html/2608.21137#bib.bib12)\]\.
- •Attack success rate \(ASR\):the maximum ASR \(Max\.ASR\) observed among all benign clients, defined as the fraction of triggered inputs \(i\.e\., poisoned test samples\) misclassified to the target label\[[15](https://arxiv.org/html/2608.21137#bib.bib32),[45](https://arxiv.org/html/2608.21137#bib.bib11)\]\.
- •Durability:we measure the maximal ASR achieved at the end of training \(Final\.ASR\), as well as the backdoor Lifespan, defined as the number of communication rounds required for Max\.ASR to drop below a predefined threshold \(e\.g\.,0\.50\.5\)\[[46](https://arxiv.org/html/2608.21137#bib.bib10),[45](https://arxiv.org/html/2608.21137#bib.bib11)\]\. In the default setting, the attack is activated for a fixed window \(\[tstart,tend\]\[t\_\{\\text\{start\}\},t\_\{\\text\{end\}\}\]\) in order to report both metrics consistently\.

Default Settings\.All experiments are conducted in a DFL setup, where clients exchange model updates exclusively with their neighbors according to a P2P communication topology \(Section[4](https://arxiv.org/html/2608.21137#S4)\)\. Following prior work on robust DFL\[[15](https://arxiv.org/html/2608.21137#bib.bib32),[32](https://arxiv.org/html/2608.21137#bib.bib30)\], we consider a regular communication graph with uniform degree, stable connectivity, and controlled spectral properties \(defaultregular\-\(20\-10\)\)\. Here,\|V\|=N=20,deg⁡\(v\)=k,∀v∈V\|V\|=N=20,\\quad\\deg\(v\)=k,\\ \\forall v\\in V, with all clients participating in every communication round\. We evaluate two local training regimes: \(i\) a*single\-epoch*mode with one epoch per round \(communication\-intensive\), and \(ii\) a*few\-epoch*mode with 5 local epochs per round \(communication\-efficient\)\.

Data heterogeneity is introduced via a Dirichlet partitioning with concentration parameterD​i​r​i​c​h​l​e​tDirichlet\-α=0\.5\\alpha=0\.5, a standard choice for DFL\. Clients train with mini\-batches of size 32, while model evaluation uses a batch size of 256\. Unless otherwise stated, all experiments adopt a learning rate of 0\.01 and, as in Fang et al\.\[[15](https://arxiv.org/html/2608.21137#bib.bib32)\], a mixing ratioα\\alphaof 0\.5 when aggregating incoming neighbor updates\. By default, we assume that all benign clients use the sameα\\alpha, but unlike Fang et al\.\[[15](https://arxiv.org/html/2608.21137#bib.bib32)\], we assume different initial models for different clients, as this is the most realistic setup\. Finally, we use a uniform environment \(two identical NVIDIA L40S GPUs\) to ensure consistent computational conditions\. The above configurations represent the default settings; any deliberate changes \(e\.g\., attack mode\) are indicated in the corresponding sections\.

### 6\.2Results and Analysis

We organize our evaluation in accordance with theRQsintroduced in Section[3](https://arxiv.org/html/2608.21137#S3)\. Sensitivity analyses with respect to key experimental factors including malicious rate, data heterogeneity, and mixing ratio are provided in Appendix[0\.B](https://arxiv.org/html/2608.21137#Pt0.A2)\.

\(a\)CFL; rand\-\(N,kN,k\) denotes random subsampling of k clients\.\(b\)DFL; regular\-\(N,kN,k\) denotes a random k\-regular graph\.
Figure 4:Impact of the FL setting \(CFL vs\. DFL\) on robustness with identical attack settings \(NeurotoxinonHAR, 15% malicious\)\.RQ1\. Which centralized FL defenses remain effective when adapted to DFL, and why do others fail?Figures[4a](https://arxiv.org/html/2608.21137#S6.F4.sf1)and[4b](https://arxiv.org/html/2608.21137#S6.F4.sf2)highlight a clear discrepancy between centralized and decentralized FL under identical attack settings\.

Centralized FL\.All methods maintain high accuracy \(≥0\.94\\geq 0\.94\), but robustness differs significantly\.■\\blacksquareM\-Krum,■\\blacksquareFLAME, and■\\blacksquareSPP effectively suppress the attack, achieving low ASR \(≈0\.16\\approx 0\.16–0\.210\.21\) and zero durability, indicating complete removal of malicious influence\. In contrast,■\\blacksquareNorm\-Clip,■\\blacksquareWeak\-DP, and■\\blacksquareDeepSight exhibit persistent vulnerabilities, with moderate to high ASR \(up to0\.840\.84\) and maximum durability, despite preserving accuracy\. Notably, performance remains stable across network scales with a stable effect of aggregation\.

Decentralized FL\.Robustness degrades substantially in all configurations\. While average accuracy remains acceptable, most defenses fail to control attack propagation\. Even strong centralized defenses \(■\\blacksquareM\-Krum,■\\blacksquareFLAME,■\\blacksquareMMAD\) show non\-negligible ASR and increased durability, especially in larger networks\. More critically,■\\blacksquareWeak\-DP,■\\blacksquareDeepSight, and■\\blacksquareSPP collapse entirely, reaching near\-perfect ASR \(≈1\.0\\approx 1\.0\) and maximal durability with uncontrolled diffusion of malicious updates\. This degradation arises from the fundamentally local nature of DFL:

\(i\)each client observes only a limited set of neighbors, preventing reliable statistical detection of anomalous updates and\(ii\)as malicious updates propagate, the local reference model itself becomes progressively contaminated, causing adversarial updates to appear consistent with the neighborhood\.

Takeaways\.Decentralization fundamentally alters the threat dynamics: local aggregation errors accumulate and propagate across neighbors, enabling persistent backdoor injection\. Consequently, defenses effective in centralized FL do not directly transfer to decentralized settings\.

Table 1:Per\-attack, per\-defense results onCIFAR\-10andGTSRBunder IID and non\-IID client partitions\. Each cell reportsMin\.ACC/Max\.ASR\. LowestASRper attack–dataset–partition block isbold; worstMin\.ACCper attack–dataset–partition block isunderlined\. Failure cases withMax\.ASR≥0\.500\\geq 0\.500areredshaded\.CIFAR\-10GTSRBIIDNon\-IIDIIDNon\-IIDAttackDefenseMin\.ACCMax\.ASRMin\.ACCMax\.ASRMin\.ACCMax\.ASRMin\.ACCMax\.ASRNeurotoxin■\\blacksquareNorm\-Clip0\.8470\.2450\.7890\.2580\.9440\.3570\.9370\.291■\\blacksquareM\-Krum0\.8410\.1280\.7450\.2050\.9280\.0600\.8990\.773■\\blacksquareTrim0\.8450\.1380\.7920\.2610\.9430\.1100\.9410\.115■\\blacksquareSCCLIP0\.8400\.6610\.7480\.6940\.9410\.6270\.9060\.832■\\blacksquareWeak\-DP0\.8420\.2540\.7780\.2690\.9440\.5660\.9400\.531■\\blacksquareABALANCE0\.8370\.1960\.7600\.4850\.9410\.0450\.9290\.095■\\blacksquareFLAME0\.8450\.1480\.7750\.2390\.9320\.1060\.9300\.064■\\blacksquareDeepSight0\.8100\.1550\.7570\.2230\.9340\.2950\.8840\.277■\\blacksquareBALANCE0\.8430\.5120\.7660\.5530\.9370\.0790\.8940\.511■\\blacksquareSPP0\.8320\.1290\.7570\.4260\.9420\.0430\.9390\.064■\\blacksquareMMAD0\.8520\.1420\.7900\.1780\.9340\.2860\.9120\.810■\\blacksquareUBAR0\.8230\.1280\.7190\.2260\.9290\.0530\.7950\.073■\\blacksquareDFL\-Dual0\.8390\.1310\.7810\.2130\.9340\.0550\.9120\.456A3FL■\\blacksquareNorm\-Clip0\.8460\.2350\.7750\.3880\.9400\.5820\.9360\.527■\\blacksquareM\-Krum0\.8320\.3700\.7300\.7760\.9410\.0490\.9250\.851■\\blacksquareTrim0\.8460\.2560\.7920\.4170\.9440\.4200\.9380\.390■\\blacksquareSCCLIP0\.8410\.3710\.7520\.3880\.9410\.6720\.9350\.898■\\blacksquareWeak\-DP0\.8430\.2240\.7810\.4080\.9410\.6500\.9350\.605■\\blacksquareABALANCE0\.8370\.4640\.7680\.4860\.9420\.0480\.9360\.074■\\blacksquareFLAME0\.8380\.4000\.7620\.4360\.9440\.0470\.9350\.364■\\blacksquareDeepSight0\.8080\.2210\.7470\.3860\.9420\.5600\.8670\.774■\\blacksquareBALANCE0\.8400\.4900\.7700\.5040\.9410\.4570\.8690\.457■\\blacksquareSPP0\.8350\.5250\.7490\.6890\.9430\.0480\.9310\.047■\\blacksquareMMAD0\.8530\.1840\.7640\.6250\.9430\.0670\.9230\.801■\\blacksquareUBAR0\.8130\.7990\.7240\.8190\.9400\.0480\.8250\.261■\\blacksquareDFL\-Dual0\.8340\.3850\.7700\.3430\.9420\.0510\.9200\.798IBA■\\blacksquareNorm\-Clip0\.8490\.7850\.7920\.8400\.9430\.8060\.9360\.746■\\blacksquareM\-Krum0\.8360\.7750\.7130\.7930\.9400\.0460\.9220\.841■\\blacksquareTrim0\.8490\.8100\.7880\.8700\.9450\.6670\.9410\.664■\\blacksquareSCCLIP0\.8280\.8090\.7470\.8100\.9440\.5880\.9270\.866■\\blacksquareWeak\-DP0\.8420\.8000\.7750\.8700\.9430\.8440\.9380\.804■\\blacksquareABALANCE0\.8330\.9040\.7580\.9120\.9350\.0820\.9290\.370■\\blacksquareFLAME0\.8480\.8740\.7620\.8820\.9340\.1000\.9370\.679■\\blacksquareDeepSight0\.8100\.6770\.7440\.7820\.9350\.4970\.8950\.554■\\blacksquareBALANCE0\.8350\.7270\.7700\.8060\.9400\.4650\.9100\.571■\\blacksquareSPP0\.8350\.9450\.7390\.9380\.9430\.2910\.9330\.397■\\blacksquareMMAD0\.8500\.6910\.7700\.7690\.9370\.0830\.9290\.833■\\blacksquareUBAR0\.8190\.7230\.7100\.8070\.9330\.0460\.8300\.402■\\blacksquareDFL\-Dual0\.8430\.7570\.7600\.8170\.9440\.0440\.9250\.765

RQ2\. How do established stealthy BAs \(A3FL, IBA, Neurotoxin\) behave in DFL settings?We evaluate these attacks against 13 DFL\-compatible defenses onCIFAR\-10andGTSRB, under IID and non\-IID client partitions\. Table[1](https://arxiv.org/html/2608.21137#S6.T1)summarizes our findings using a \[30,60\] attack window\.

Overall attack potency\.Across defenses and datasets, attack strength consistently ranksIBA\>\>A3FL\>\>Neurotoxin, with mean ASRs of0\.57/0\.33/0\.220\.57/0\.33/0\.22under IID and0\.74/0\.52/0\.350\.74/0\.52/0\.35under non\-IID, respectively\.IBAcauses an ASR≥0\.500\\geq 0\.500failure in 75% of defense–dataset–partition combinations, versus 35% forA3FLand 21% forNeurotoxin\.IBAandA3FLare more effective because their adaptive, optimized triggers are designed to evade filtering, whereasNeurotoxinrelies on a static, low\-magnitude gradient mask\. Static BAs \(BadNet, DBA, and Scaling\) are generally less effective in our setting and are omitted for brevity\.

IBAbreaks every defense onCIFAR\-10\.AgainstIBA, all defenses exceed0\.6770\.677ASR onCIFAR\-10inbothpartitions – including■\\blacksquareABALANCE and■\\blacksquareFLAME, which are otherwise the strongest defenses overall\. This is not primarily a heterogeneity effect: the same defenses that fail outright onCIFAR\-10IID recover onGTSRBIID, where■\\blacksquareM\-Krum,■\\blacksquareABALANCE,■\\blacksquareFLAME,■\\blacksquareMMAD,■\\blacksquareUBAR, and■\\blacksquareDFL\-Dual all holdIBAbelow0\.100\.10ASR\. The gap points to a dataset\-level vulnerability –CIFAR\-10’s lower per\-class margin under a 10\-way task – thatIBA’s optimized trigger exploits independently of the aggregation rule\. Under non\-IIDGTSRB, this protection narrows further: only■\\blacksquareABALANCE and■\\blacksquareUBAR remain below the failure threshold; every other defense, gives way\.

Defense effectiveness\.Averaged over all attacks, datasets, and partitions,■\\blacksquareABALANCE and■\\blacksquareFLAME remain the most consistent defenses \(mean ASR0\.3470\.347and0\.3410\.341\), but this is a story of consistency rather than IID dominance: under IID data alone,■\\blacksquareDFL\-Dual and■\\blacksquareM\-Krum are actually marginally lower than■\\blacksquareABALANCE/■\\blacksquareFLAME, aided by strongNeurotoxin/A3FLsuppression onGTSRB\. That IID advantage evaporates under non\-IID data, where■\\blacksquareM\-Krum and■\\blacksquareMMAD post the largest degradations of any defense, followed by■\\blacksquareDFL\-Dual, consistent with their reliance on inter\-client similarity or tightly clustered updates – an assumption that breaks down once benign updates diverge naturally\.■\\blacksquareSCCLIP is the weakest defense overall \(mean ASR0\.6850\.685\), confirming that self norm clipping alone is insufficient against adaptive triggers\.■\\blacksquareDeepSight,■\\blacksquareBALANCE, and■\\blacksquareSPP sit in a middle tier, with smaller IID\-to\-non\-IID increases but higher absolute non\-IID ASR than■\\blacksquareABALANCE/■\\blacksquareFLAME\.

Accuracy–robustness trade\-off\.Aggressive filtering does not consistently buy robustness\.■\\blacksquareDeepSight has the worst Min\. ACC onCIFAR\-10IID across all three attacks \(0\.8100\.810\) while its mean ASR \(0\.4500\.450\) is only mid\-tier, the weakest trade\-off of any defense\.■\\blacksquareUBAR shows the opposite pattern of*inconsistency*: it posts the worst Min\. ACC under non\-IID\.

Takeaways\.\(i\)IBAdefeats every evaluated defense onCIFAR\-10, regardless of aggregation rule or client partition \(min\. ASR0\.680\.68across all defenses\) – a dataset\-level vulnerability, not merely a non\-IID artifact\.\(ii\)■\\blacksquareABALANCEand■\\blacksquareFLAMEare the most consistent defenses on average, but their IID\-only edge over■\\blacksquareDFL\-Dual and■\\blacksquareM\-Krum is small and disappears onceIBA\-on\-CIFAR\-10is included\.\(iii\)Similarity\- and clustering\-based defenses are non\-IID brittle:■\\blacksquareM\-Krum,■\\blacksquareMMAD, and■\\blacksquareDFL\-Dual show the largest IID\-to\-non\-IID ASR increases\.

Figure 5:Impact of datasets and models under attacks\.RQ3\. What is the impact of data and model characteristics on robustness in DFL?We study the effectiveness of backdoor defenses across multiple datasets, pairing each with a distinct attack \(IBAonCIFAR\-10/CIFAR\-100,A3FLonFEMNIST/MNIST, andNeurotoxinonHAR/FASHION\) to probe how data and model properties, independent of the attack itself, shape robustness\. Figure[5](https://arxiv.org/html/2608.21137#S6.F5)visualizes the impact of each dataset\. We find that dataset characteristics fundamentally shape backdoor dynamics\.

First,simple, low\-dimensional datasets attacked withA3FLonMNISTexhibit limited backdoor persistence: nearly every defense drives durability to 0 and final ASR below 0\.22, with only■\\blacksquareWeak\-DP failing to suppress the attack\. In contrast,FEMNISTunder the same attack shows a sharp split: effective defenses \(■\\blacksquareM\-Krum,■\\blacksquareABALANCE,■\\blacksquareBALANCE,■\\blacksquareMMAD\) fully block the backdoor from round one \(durability = 0\), while clipping\- and similarity\-based defenses fail completely, leaving ASR pinned near 1\.00 for the full 49\-round window;■\\blacksquareFLAME,■\\blacksquareUBAR, and■\\blacksquareDFL\-Dual fall in between, eventually suppressing the attack only after a long delay\. This shows that dataset and task characteristics, beyond input dimensionality alone, governs how long a backdoor can persist once it evades early detection\. OnCIFAR\-100, attacked withIBA, most defenses lower Max\.ASR relative toCIFAR\-10yet durability remains high \(\>40\) for nearly all of them\.Second,HARsequences underNeurotoxinreveal a distinct vulnerability rooted in the temporal alignment of benign gradients: this alignment enables low\-norm, temporally consistent poisoning that bypasses■\\blacksquareSCCLIP \(Final\.ASR = 0\.74\),■\\blacksquareWeak\-DP \(0\.65\), and■\\blacksquareDeepSight \(0\.33\), all of which retain full durability, whereas■\\blacksquareTrim,■\\blacksquareBALANCE,■\\blacksquareMMAD, and■\\blacksquareDFL\-Dual suppress the same attack down to final ASR≤\\leq0\.20\. At the same time, the high false\-positive rate of■\\blacksquareUBAR degrades sharply Min\.ACC \(to 0\.76\) while still failing to fully contain the attack\.

Takeaways\.\(i\)Dataset properties fundamentally shape backdoor dynamics: onCIFAR\-100\(IBA\), defenses can reduce Max\.ASR while durability stays high, giving a misleading impression of robustness\.\(ii\)Attack\-dataset pairing matters as much as the defense:A3FLis fully contained by robust aggregation onMNIST/FEMNIST, whileIBAevades every defense onCIFAR\-10\.\(iii\)Temporal structure acts as a double\-edged system factor: onHAR, alignment of benign gradients aids convergence but also enablesNeurotoxinto reach high, durable ASR\.\(iv\)The cost of aggressive filteringin terms of Min\.ACC degradation varies substantially across datasets\.

\(a\)Regular\-\(20,7\)\(b\)Regular\-\(50,10\)\(c\)Ring\-\(20,7\)\(d\)Watts\-\(20,7\)\(e\)Barabasi\-\(20,7\)\(f\)Erdős\-\(20,7\)
Figure 6:Different communication graphs\.![Refer to caption](https://arxiv.org/html/2608.21137v1/heatmap_combined.png)Figure 7:Impact of the communication graph\.RQ4\. What is the impact of the DFL graph topology?We evaluate all defenses across different graph topologies \(Figure[6](https://arxiv.org/html/2608.21137#S6.F6)\) using 3 different seeds \(21, 42, 84\) to assess how the network structure influences the robustness of each defense\. The heat maps in Figure[7](https://arxiv.org/html/2608.21137#S6.F7)report the results ofHARunderNeurotoxin\(attack window = \[25,50\]\) to show the speed at which the global model recovers after contamination\. Without any defense, attack severity already depends strongly on topology: peak ASR ranges from 65\.3% onregular\-\(50\-10\)\(large, structured graph\) up to 97\.8% onring\(sparse graph\), withbarabasi,erdos, andwattsclustering around 88–95%\. Defense generalization is highly topology\-dependent even on this easiest setting:■\\blacksquareABALANCE and■\\blacksquareUBAR are the only defenses that suppress the backdoor \(in 0–6 rounds, final ASR≤\\leq21%\) on all six topologies, while distance\-based defenses such as■\\blacksquareTrim and■\\blacksquareM\-Krum succeed almost everywhere but fail on specific graphs,e\.g\.,■\\blacksquareTrim suppresses instantly \(0 rounds\) onbarabasi,erdos,regular\-\(20\-7\),regular\-\(50\-10\), andring, yet never recovers within the training horizon onwatts\(36\.3 rounds, censored, final ASR 43\.9%\)\. Conversely, CFL defenses \(■\\blacksquareNorm\-Clip,■\\blacksquareDeepSight,■\\blacksquareWeak\-DP,■\\blacksquareSPP\) and the DFL\-specific■\\blacksquareBALANCE/■\\blacksquareDFL\-Dual remain unsuppressed \(50\+ rounds, censored\) on the shortcut\-rich topologies \(barabasi,erdos,regular\-\(20\-7\),watts\) but recover on the sparseringtopology \(e\.g\.,■\\blacksquareNorm\-Clip: 24 rounds,■\\blacksquareDeepSight: 22 rounds,■\\blacksquareSPP: 16 rounds\), where the same defenses fail elsewhere\.

Takeaways\.\(i\) Graph topology governs both attack amplification and recovery: structured graphs can either localize an attack \(regular\-\(50\-10\), 65\.3% peak ASR\) or prolong it \(ring, 97\.8% peak ASR\), while shortcut\-rich topologies \(barabasi,erdos,watts\) both accelerate diffusion \(peak ASR≥\\geq88%\) and mitigation \(for effective defenses\)\.\(ii\) Defenses developed for both CFL and DFL fail to generalize across graph topologies: only■\\blacksquareABALANCE and■\\blacksquareUBAR suppress the backdoor on every topology tested\.\(iii\) These trends reflect a favorable setting:HARis one of the lightest tasks, paired withNeurotoxin, one of the least stealthy attacks\. Under stealthier attacks \(IBAinRQ2\) and on more challenging tasks \(GTSRBandCIFAR\-10\), all defenses fail regardless of topology, meaning robustness gains narrow as attack stealth and task difficulty increase\.

## 7Conclusion

In this paper, we presented BackDFL, a unified benchmark of backdoor attacks and defenses in decentralized federated learning \(DFL\) to adaptive backdoor attacks\. Using the proposed BackDFL reproducible suite, we show that robust peer\-to\-peer DFL is highly susceptible to backdoor contamination due to unrestricted diffusion of malicious updates\. State\-of\-the\-art Byzantine\-robust DFL methods fail even under modest malicious rates \(15%\) and realistic non\-IID distributions\. We further showed that adapting a lightweight defense such as BALANCE, by making its acceptance criterion responsive to the actual neighbor updates, can improve resilience while avoiding overly aggressive filtering, providing a practical, low\-computation alternative to more costly centralized defenses\. Finally, our analysis reveals that defenses developed for both FL and DFL fail to generalize across different graph topologies, highlighting the need for adaptive mechanisms that can maintain robustness under diverse networks\.

## References

- \[1\]D\. Anguita, A\. Ghio, L\. Oneto, X\. Parra, J\. L\. Reyes\-Ortiz,et al\.\(2013\)A public domain dataset for human activity recognition using smartphones\.\.InEsann,Vol\.3,pp\. 3–4\.Cited by:[§6\.1](https://arxiv.org/html/2608.21137#S6.SS1.p1.1)\.
- \[2\]E\. Bagdasaryan, A\. Veit, Y\. Hua, D\. Estrin, and V\. Shmatikov\(2020\)How to backdoor federated learning\.InProceedings of the 23rd International Conference on Artificial Intelligence and Statistics,pp\. 2938–2948\.Cited by:[§1](https://arxiv.org/html/2608.21137#S1.p2.1),[§5](https://arxiv.org/html/2608.21137#S5.SS0.SSSx2.p1.1),[§6\.1](https://arxiv.org/html/2608.21137#S6.SS1.p2.1)\.
- \[3\]A\. A\. Bellachia, M\. A\. Bouchiha, and Y\. Ghamri\-Doudane\(2026\)SoK: understanding backdoor attacks & defenses in federated learning\.Expert Systems with Applications,pp\. 132558\.Cited by:[§2](https://arxiv.org/html/2608.21137#S2.p1.1)\.
- \[4\]E\. T\. M\. Beltrán, M\. Q\. Pérez, P\. M\. S\. Sánchez, S\. L\. Bernal, G\. Bovet, M\. G\. Pérez, G\. M\. Pérez, and A\. H\. Celdrán\(2023\)Decentralized federated learning: fundamentals, state of the art, frameworks, trends, and challenges\.IEEE Communications Surveys & Tutorials25\(4\),pp\. 2983–3013\.Cited by:[§1](https://arxiv.org/html/2608.21137#S1.p1.1)\.
- \[5\]P\. Blanchard, E\. M\. El Mhamdi, R\. Guerraoui, and J\. Stainer\(2017\)Machine learning with adversaries: byzantine tolerant gradient descent\.Advances in neural information processing systems30\.Cited by:[§5](https://arxiv.org/html/2608.21137#S5.SS0.SSSx2.p1.1),[§6\.1](https://arxiv.org/html/2608.21137#S6.SS1.p2.1)\.
- \[6\]M\. A\. Bouchiha, A\. A\. Korba, and Y\. Ghamri\-Doudane\(2026\)Automated byzantine\-resilient clustered decentralized federated learning for battery intelligence in connected evs\.arXiv preprint arXiv:2605\.21115\.Cited by:[§1](https://arxiv.org/html/2608.21137#S1.p1.1)\.
- \[7\]X\. Cao, M\. Fang, J\. Liu, and N\. Z\. Gong\(2020\)Fltrust: byzantine\-robust federated learning via trust bootstrapping\.arXiv preprint arXiv:2012\.13995\.Cited by:[§6\.1](https://arxiv.org/html/2608.21137#S6.SS1.p2.1)\.
- \[8\]V\. P\. Chellapandi, L\. Yuan, C\. G\. Brinton, S\. H\. Żak, and Z\. Wang\(2023\)Federated learning for connected and automated vehicles: a survey of existing approaches and challenges\.IEEE Transactions on Intelligent Vehicles9\(1\),pp\. 119–137\.Cited by:[§1](https://arxiv.org/html/2608.21137#S1.p1.1)\.
- \[9\]J\. Chen, M\. Chen, G\. Zeng, and J\. Weng\(2021\)BDFL: a byzantine\-fault\-tolerance decentralized federated learning method for autonomous vehicle\.IEEE Transactions on Vehicular Technology70\(9\),pp\. 8639–8652\.Cited by:[§1](https://arxiv.org/html/2608.21137#S1.p1.1)\.
- \[10\]G\. Cohen, S\. Afshar, J\. Tapson, and A\. van Schaik\(2017\)EMNIST: an extension of mnist to handwritten letters\.arXiv preprint arXiv:1702\.05373\.Cited by:[§6\.1](https://arxiv.org/html/2608.21137#S6.SS1.p1.1)\.
- \[11\]T\. Dao, D\. T\. Nguyen, K\. D\. Doan, and K\. Wong\(2025\)BackFed: an efficient & standardized benchmark suite for backdoor attacks in federated learning\.arXiv preprint arXiv:2507\.04903\.Cited by:[§2](https://arxiv.org/html/2608.21137#S2.p1.1)\.
- \[12\]E\. M\. El\-Mhamdi, S\. Farhadkhani, R\. Guerraoui, A\. Guirguis, L\. Hoang, and S\. Rouault\(2021\)Collaborative learning in the jungle \(decentralized, byzantine, heterogeneous, asynchronous and nonconvex learning\)\.Advances in neural information processing systems34,pp\. 25044–25057\.Cited by:[§1](https://arxiv.org/html/2608.21137#S1.p1.1),[§1](https://arxiv.org/html/2608.21137#S1.p2.1),[§6\.1](https://arxiv.org/html/2608.21137#S6.SS1.p2.1)\.
- \[13\]M\. Fan, Z\. Hu, F\. Wang, and C\. Chen\(2025\)Bad\-pfl: exploring backdoor attacks against personalized federated learning\.arXiv preprint arXiv:2501\.12736\.Cited by:[§1](https://arxiv.org/html/2608.21137#S1.p2.1)\.
- \[14\]M\. Fang, X\. Cao, J\. Jia, and N\. Gong\(2020\)Local model poisoning attacks to\{\\\{byzantine\-robust\}\\\}federated learning\.In29th USENIX security symposium \(USENIX Security 20\),pp\. 1605–1622\.Cited by:[§4\.2](https://arxiv.org/html/2608.21137#S4.SS2.p1.1),[§5](https://arxiv.org/html/2608.21137#S5.SS0.SSSx2.p1.1)\.
- \[15\]M\. Fang, Z\. Zhang, Hairi, P\. Khanduri, J\. Liu, S\. Lu, Y\. Liu, and N\. Gong\(2024\)Byzantine\-robust decentralized federated learning\.InACM SIGSAC Conference on Computer and Communications Security \(CCS\),pp\. 2874–2888\.Cited by:[§1](https://arxiv.org/html/2608.21137#S1.p2.1),[§1](https://arxiv.org/html/2608.21137#S1.p3.1),[§2](https://arxiv.org/html/2608.21137#S2.p2.1),[§4\.1](https://arxiv.org/html/2608.21137#S4.SS1.p1.1),[§4\.2](https://arxiv.org/html/2608.21137#S4.SS2.p1.1),[2nd item](https://arxiv.org/html/2608.21137#S6.I1.i2.p1.1),[§6\.1](https://arxiv.org/html/2608.21137#S6.SS1.p2.1),[§6\.1](https://arxiv.org/html/2608.21137#S6.SS1.p4.1),[§6\.1](https://arxiv.org/html/2608.21137#S6.SS1.p5.1)\.
- \[16\]P\. Fang and J\. Chen\(2023\)On the vulnerability of backdoor defenses for federated learning\.InAAAI Conference on Artificial Intelligence,Vol\.37,pp\. 11800–11808\.Cited by:[§1](https://arxiv.org/html/2608.21137#S1.p2.1)\.
- \[17\]T\. Gu, K\. Liu, B\. Dolan\-Gavitt, and S\. Garg\(2019\)Badnets: evaluating backdooring attacks on deep neural networks\.Ieee Access7,pp\. 47230–47244\.Cited by:[§1](https://arxiv.org/html/2608.21137#S1.p2.1),[§5](https://arxiv.org/html/2608.21137#S5.SS0.SSSx2.p1.1),[§6\.1](https://arxiv.org/html/2608.21137#S6.SS1.p2.1)\.
- \[18\]S\. Guo, T\. Zhang, H\. Yu, X\. Xie, L\. Ma, T\. Xiang, and Y\. Liu\(2021\)Byzantine\-resilient decentralized stochastic gradient descent\.IEEE Transactions on Circuits and Systems for Video Technology32\(6\),pp\. 4096–4106\.Cited by:[§1](https://arxiv.org/html/2608.21137#S1.p1.1),[§1](https://arxiv.org/html/2608.21137#S1.p2.1),[§2](https://arxiv.org/html/2608.21137#S2.p2.1),[§4\.2](https://arxiv.org/html/2608.21137#S4.SS2.p1.1),[§6\.1](https://arxiv.org/html/2608.21137#S6.SS1.p2.1)\.
- \[19\]L\. He, S\. P\. Karimireddy, and M\. Jaggi\(2022\)Byzantine\-robust decentralized learning via clippedgossip\.arXiv preprint arXiv:2202\.01545\.Cited by:[§1](https://arxiv.org/html/2608.21137#S1.p2.1),[§2](https://arxiv.org/html/2608.21137#S2.p2.1),[§4\.2](https://arxiv.org/html/2608.21137#S4.SS2.p1.1),[§6\.1](https://arxiv.org/html/2608.21137#S6.SS1.p2.1)\.
- \[20\]I\. Hegedűs, G\. Danner, and M\. Jelasity\(2019\)Gossip learning as a decentralized alternative to federated learning\.InIFIP International Conference on Distributed Applications and Interoperable Systems,pp\. 74–90\.Cited by:[§1](https://arxiv.org/html/2608.21137#S1.p1.1)\.
- \[21\]S\. Houben, J\. Stallkamp, J\. Salmen, M\. Schlipsing, and C\. Igel\(2013\)Detection of traffic signs in real\-world images: the German Traffic Sign Detection Benchmark\.InInternational Joint Conference on Neural Networks,Cited by:[§6\.1](https://arxiv.org/html/2608.21137#S6.SS1.p1.1)\.
- \[22\]S\. Huang, Y\. Li, C\. Chen, L\. Shi, and Y\. Gao\(2023\)Multi\-metrics adaptively identifies backdoors in federated learning\.InIEEE/CVF International Conference on Computer Vision,pp\. 4652–4662\.Cited by:[§1](https://arxiv.org/html/2608.21137#S1.p3.1),[§6\.1](https://arxiv.org/html/2608.21137#S6.SS1.p2.1)\.
- \[23\]S\. Kalra, J\. Wen, J\. C\. Cresswell, M\. Volkovs, and H\. R\. Tizhoosh\(2023\)Decentralized federated learning through proxy model sharing\.Nature communications14\(1\),pp\. 2899\.Cited by:[§1](https://arxiv.org/html/2608.21137#S1.p1.1)\.
- \[24\]A\. Krizhevsky G\. Hintonet al\.\(2009\)Learning multiple layers of features from tiny images\.Cited by:[§6\.1](https://arxiv.org/html/2608.21137#S6.SS1.p1.1)\.
- \[25\]A\. Lalitha, S\. Shekhar, T\. Javidi, and F\. Koushanfar\(2018\)Fully decentralized federated learning\.InThird workshop on bayesian deep learning \(NeurIPS\),Vol\.12\.Cited by:[§1](https://arxiv.org/html/2608.21137#S1.p1.1)\.
- \[26\]Y\. LeCun\(1998\)The mnist database of handwritten digits\.http://yann\. lecun\. com/exdb/mnist/\.Cited by:[§6\.1](https://arxiv.org/html/2608.21137#S6.SS1.p1.1)\.
- \[27\]Z\. Liu, X\. Zhang, P\. Khanduri,et al\.\(2023\)Prometheus: taming sample and communication complexities in constrained decentralized stochastic bilevel learning\.InInternational conference on machine learning,pp\. 22420–22453\.Cited by:[§1](https://arxiv.org/html/2608.21137#S1.p1.1)\.
- \[28\]B\. McMahan, E\. Moore, D\. Ramage,et al\.\(2017\)Communication\-Efficient Learning of Deep Networks from Decentralized Data\.In20th International Conference on Artificial Intelligence and Statistics,pp\. 1273–1282\.Cited by:[§1](https://arxiv.org/html/2608.21137#S1.p1.1),[§4\.1](https://arxiv.org/html/2608.21137#S4.SS1.p2.3)\.
- \[29\]T\. D\. Nguyen, P\. Rieger, H\. Chen, H\. Yalame, H\. Möllering,et al\.\(2022\)FLAME: taming backdoors in federated learning\.In31st USENIX Security Symposium \(USENIX Security\),pp\. 1415–1432\.External Links:ISBN 978\-1\-939133\-31\-1Cited by:[§1](https://arxiv.org/html/2608.21137#S1.p3.1),[§6\.1](https://arxiv.org/html/2608.21137#S6.SS1.p2.1)\.
- \[30\]T\. D\. Nguyen, T\. A\. Nguyen, A\. Tran, K\. D\. Doan, and K\. Wong\(2023\)IBA: towards irreversible backdoor attacks in federated learning\.InAdvances in Neural Information Processing Systems,Vol\.36,pp\. 66364–66376\.Cited by:[§1](https://arxiv.org/html/2608.21137#S1.p2.1),[§5](https://arxiv.org/html/2608.21137#S5.SS0.SSSx2.p1.1),[1st item](https://arxiv.org/html/2608.21137#S6.I1.i1.p1.1),[§6\.1](https://arxiv.org/html/2608.21137#S6.SS1.p2.1)\.
- \[31\]T\. D\. Nguyen, T\. Nguyen, P\. Le Nguyen,et al\.\(2024\)Backdoor attacks and defenses in federated learning: survey, challenges and future research directions\.Engineering Applications of Artificial Intelligence127,pp\. 107166\.Cited by:[§2](https://arxiv.org/html/2608.21137#S2.p1.1)\.
- \[32\]D\. Pasquini, M\. Raynal, and C\. Troncoso\(2023\)On the \(in\) security of peer\-to\-peer decentralized machine learning\.In2023 IEEE Symposium on Security and Privacy \(SP\),pp\. 418–436\.Cited by:[§4\.1](https://arxiv.org/html/2608.21137#S4.SS1.p1.1),[§4\.2](https://arxiv.org/html/2608.21137#S4.SS2.p1.1),[§6\.1](https://arxiv.org/html/2608.21137#S6.SS1.p4.1)\.
- \[33\]P\. Rieger, T\. D\. Nguyen, M\. Miettinen, and A\. Sadeghi\(2022\)Deepsight: mitigating backdoor attacks in federated learning through deep model inspection\.arXiv preprint arXiv:2201\.00763\.Cited by:[§1](https://arxiv.org/html/2608.21137#S1.p3.1),[§6\.1](https://arxiv.org/html/2608.21137#S6.SS1.p2.1)\.
- \[34\]V\. Shejwalkar, A\. Houmansadr, P\. Kairouz, and D\. Ramage\(2022\)Back to the drawing board: a critical evaluation of poisoning attacks on production federated learning\.InIEEE Symposium on Security and Privacy,Vol\.,pp\. 1354–1371\.Cited by:[§5](https://arxiv.org/html/2608.21137#S5.SS0.SSSx2.p1.1)\.
- \[35\]P\. Sun, X\. Liu, Z\. Wang, and B\. Liu\(2024\)Byzantine\-robust decentralized federated learning via dual\-domain clustering and trust bootstrapping\.InIEEE/CVF conference on computer vision and pattern recognition,pp\. 24756–24765\.Cited by:[§1](https://arxiv.org/html/2608.21137#S1.p2.1),[§2](https://arxiv.org/html/2608.21137#S2.p2.1),[§4\.1](https://arxiv.org/html/2608.21137#S4.SS1.p1.1),[§6\.1](https://arxiv.org/html/2608.21137#S6.SS1.p2.1)\.
- \[36\]Z\. Sun, P\. Kairouz, A\. T\. Suresh, and H\. B\. McMahan\(2019\)Can you really backdoor federated learning?\.arXiv preprint arXiv:1911\.07963\.Cited by:[§6\.1](https://arxiv.org/html/2608.21137#S6.SS1.p2.1)\.
- \[37\]Z\. Wang, H\. Guo, Z\. Zhang,et al\.\(2021\)Feature importance\-aware transferable adversarial attacks\.InIEEE/CVF international conference on computer vision,pp\. 7639–7648\.Cited by:[§5](https://arxiv.org/html/2608.21137#S5.SS0.SSSx2.p1.1)\.
- \[38\]Z\. Wang, Q\. Hu, X\. Zou, P\. Hu, and X\. Cheng\(2025\)Can we trust the similarity measurement in federated learning?\.IEEE Transactions on Information Forensics and Security\.Cited by:[§6\.1](https://arxiv.org/html/2608.21137#S6.SS1.p2.1)\.
- \[39\]D\. Wu and Y\. Wang\(2021\)Adversarial neuron pruning purifies backdoored deep models\.Advances in Neural Information Processing Systems34,pp\. 16913–16925\.Cited by:[§6\.1](https://arxiv.org/html/2608.21137#S6.SS1.p2.1)\.
- \[40\]H\. Xiao, K\. Rasul, and R\. Vollgraf\(2017\)Fashion\-mnist: a novel image dataset for benchmarking machine learning algorithms\.arXiv preprint arXiv:1708\.07747\.Cited by:[§6\.1](https://arxiv.org/html/2608.21137#S6.SS1.p1.1)\.
- \[41\]C\. Xie, K\. Huang, P\. Chen, and B\. Li\(2020\)DBA: distributed backdoor attacks against federated learning\.InInternational Conference on Learning Representations,Cited by:[§5](https://arxiv.org/html/2608.21137#S5.SS0.SSSx2.p1.1),[§6\.1](https://arxiv.org/html/2608.21137#S6.SS1.p2.1)\.
- \[42\]D\. Yin, Y\. Chen, R\. Kannan, and P\. Bartlett\(2018\)Byzantine\-robust distributed learning: towards optimal statistical rates\.InInternational conference on machine learning,pp\. 5650–5659\.Cited by:[§4\.1](https://arxiv.org/html/2608.21137#S4.SS1.p2.3),[§6\.1](https://arxiv.org/html/2608.21137#S6.SS1.p2.1)\.
- \[43\]L\. Yuan, Z\. Wang, L\. Sun, P\. S\. Yu, and C\. G\. Brinton\(2024\)Decentralized federated learning: a survey and perspective\.IEEE Internet of Things Journal11\(21\),pp\. 34617–34638\.Cited by:[§1](https://arxiv.org/html/2608.21137#S1.p1.1)\.
- \[44\]Y\. Yuan, A\. Zhou, X\. Zhang, Y\. Zou,et al\.\(2025\)BaDFL: mitigating model poisoning in decentralized federated learning\.IEEE Transactions on Computers\.Cited by:[§6\.1](https://arxiv.org/html/2608.21137#S6.SS1.p2.1)\.
- \[45\]H\. Zhang, J\. Jia, J\. Chen, L\. Lin, and D\. Wu\(2023\)A3FL: adversarially adaptive backdoor attacks to federated learning\.InAdvances in Neural Information Processing Systems,Vol\.36,pp\. 61213–61233\.Cited by:[§1](https://arxiv.org/html/2608.21137#S1.p2.1),[§5](https://arxiv.org/html/2608.21137#S5.SS0.SSSx2.p1.1),[1st item](https://arxiv.org/html/2608.21137#S6.I1.i1.p1.1),[2nd item](https://arxiv.org/html/2608.21137#S6.I1.i2.p1.1),[3rd item](https://arxiv.org/html/2608.21137#S6.I1.i3.p1.1),[§6\.1](https://arxiv.org/html/2608.21137#S6.SS1.p2.1)\.
- \[46\]Z\. Zhang, A\. Panda, L\. Song, Y\. Yang, M\. Mahoney,et al\.\(2022\)Neurotoxin: durable backdoors in federated learning\.InProceedings of the 39th International Conference on Machine Learning,pp\. 26429–26446\.Cited by:[§1](https://arxiv.org/html/2608.21137#S1.p2.1),[§5](https://arxiv.org/html/2608.21137#S5.SS0.SSSx2.p1.1),[3rd item](https://arxiv.org/html/2608.21137#S6.I1.i3.p1.1),[§6\.1](https://arxiv.org/html/2608.21137#S6.SS1.p2.1)\.

## Appendix 0\.ADetailed Experimental Settings

The models listed in Table[2](https://arxiv.org/html/2608.21137#Pt0.A1.T2)are standard models adapted to each dataset’s characteristics\. ForMNIST, we use a SimpleCNN composed of two 5×\\times5 convolutional layers \(6 and 16 filters\), followed by ReLU activations, 2×\\times2 average pooling, and fully connected layers of sizes 120, 84, and 10\. ForFashionMNIST, we employ a lightweight convolutional neural network \(FashionCNN\) consisting of two convolutional blocks with 32 and 64 filters \(3×33\\times 3\), each followed by ReLU activation and2×22\\times 2max\-pooling, and two fully connected layers \(128 units and a 10\-class output\), with dropout \(0\.5\) applied before the final classification layer\. ForFEMNIST, we employ a LeNet\-5 consisting of two convolutional layers with 6 and 16 filters \(5×\\times5\), each followed by average pooling, and three fully connected layers with 120 and 84 hidden units before the final classification layer\. ForCIFAR\-10, we adopt a ResNet\-18 variant where all BatchNorm layers are replaced with GroupNorm; the first convolution is a 3×\\times3 stride\-1 layer without an initial max\-pooling stage, followed by a 10\-class classification head\. ForGTSRB, the GTSRB\-CNN consists of two convolutional blocks: the first with 32 filters \(5×\\times5, ReLU, max\-pooling, dropout 0\.25\), and the second with 64 filters \(3×\\times3, ReLU, max\-pooling, dropout 0\.25\), followed by a fully connected layer of size 512 with ReLU, dropout 0\.5, and a 43\-class output layer\. ForHAR, we employ a lightweight multilayer perceptron \(HAR\-MLP\) composed of two hidden fully connected layers with 256 and 128 units, respectively, each followed by ReLU activations, and a final 6\-class output layer, taking the 561\-dimensional feature vector as input\.

Table 2:Dataset, model, and training hyperparameter configurations\.DatasetModel\#ClassesInputOptimizer𝜼\\eta𝑩B𝑬ERoundsMNISTSimpleCNN101×28×281\\times 28\\times 28SGD0\.0132150FashionFashionCNN101×28×281\\times 28\\times 28SGD0\.0132550FEMNISTLeNet\-5621×28×281\\times 28\\times 28SGD0\.013210100CIFAR\-10ResNet18\-GN103×32×323\\times 32\\times 32SGD0\.01325100CIFAR\-100ResNet18\-GN1003×32×323\\times 32\\times 32SGD0\.01325600∗GTSRBGTSRB\-CNN433×32×323\\times 32\\times 32SGD0\.0132550–100HARHAR\-MLP6561SGD0\.0132550–300

∗500 benign rounds, followed by 100 rounds from the benign checkpoint with a scheduled attack\.

## Appendix 0\.BSensitivity Analysis

Figure 8:Impact of the malicious rate\.Impact of malicious rate\.We evaluate all defenses under increasing global malicious ratiosβM\\beta\_\{M\}\(15–50%\) and a short attack window\. Figure[8](https://arxiv.org/html/2608.21137#Pt0.A2.F8)shows results on three light tasks \(\(A3FLonMNIST/GTSRB,NeurotoxinonHAR\)\)\. Robust methods such as■\\blacksquareM\-Krum,■\\blacksquareABALANCE, and■\\blacksquareFLAME maintain low ASR at 15–25% malicious clients; onMNIST, their Final\.ASR remains at 0\.11–0\.12\. At 40%, they still achieve a Final\.ASR of 0\.20 onHAR, but degrade sharply beyond 33% onGTSRB\. Overall,■\\blacksquareABALANCE isthe most stable defenseacross datasets and malicious rates\.

Figure 9:Impact of mixing ratio \(Left\) and non\-IID degree \(Right\)\.Impact of the mixing ratio\.We evaluate all defenses under increasing mixing ratiosα\\alphain Eq\. \([3](https://arxiv.org/html/2608.21137#S4.E3)\) to study the effect of client reliance on neighbors versus self\-training\. Figure[9](https://arxiv.org/html/2608.21137#Pt0.A2.F9)\(Left\) reports the results onGTSRBunder a shortA3FLattack window of 6 rounds \. Asα\\alphadecreases \(i\.e\., stronger reliance on neighbor aggregation\), backdoor persistence grows for permissive defenses\. For example, atα=0\.3\\alpha=0\.3,■\\blacksquareSCCLIP,■\\blacksquareNorm\-Clip,■\\blacksquareWeak\-DP, and■\\blacksquareUBAR reach Max\.ASR values of 0\.39–0\.50\. In contrast, strong defenses such as■\\blacksquareFLAME and■\\blacksquareABALANCE maintain strong robustness \(Max\.ASR≤0\.07\\leq 0\.07\)\. However, like all methods, stronger self reliance decreases their utility\.

Impact of data heterogeneity\.We evaluate the robustness of all defenses under decreasing heterogeneityD​i​r​i​c​h​l​e​tDirichlet\-α\\alpha\(0\.3–1\.0\) onGTSRBwith only15%15\\%A3FLmalicious rate\. Figure[9](https://arxiv.org/html/2608.21137#Pt0.A2.F9)\(Right\) reports Max\.ASR and Avg\.ACC for all methods\. Robust defenses such as■\\blacksquareFLAME and■\\blacksquareMMAD maintain low Max\.ASR across heterogeneity levels \(0\.03–0\.06\) while preserving high Avg\.ACC \(0\.92–0\.95\)\. Similarly,■\\blacksquareABALANCE remains highly robust, with Max\.ASR≤\\leq0\.05 and minimal accuracy degradation\. In contrast, smoothing\-based defenses \(■\\blacksquareNorm\-Clip,■\\blacksquareSCCLIP,■\\blacksquareWeak\-DP\) deteriorate markedly under high data heterogeneity\.■\\blacksquareSPP and■\\blacksquareUBAR perform even worse, attaining Max\.ASR in the range of 0\.36–0\.46 with strong persistence\. Although■\\blacksquareUBAR uses a second\-stage filtering based on local loss signals, this provides little benefit under targeted BAs, whereloss separation becomes ineffective\.

Table 3:Impact of local epochs\.Min\.ACCMax\.ASRDatasetDefense15101510GTSRB■\\blacksquareFedAvg0\.9210\.9470\.9430\.7650\.5840\.464■\\blacksquareFLAME0\.9190\.9350\.9330\.1020\.3640\.478■\\blacksquareABALANCE0\.9230\.9320\.9350\.1270\.0740\.389HAR■\\blacksquareFedAvg0\.9740\.9710\.9700\.9990\.9810\.957■\\blacksquareFLAME0\.9620\.9600\.9540\.2180\.2390\.228■\\blacksquareABALANCE0\.9540\.9490\.9440\.2960\.2350\.231

Table 4:Impact of batch size\.Min\.ACCMax\.ASR16324864163248640\.9510\.9470\.9380\.9290\.6120\.5840\.5360\.5100\.9460\.9350\.9340\.9260\.5130\.3640\.3230\.1040\.9500\.9320\.9380\.9200\.5760\.0740\.2290\.1030\.9720\.9710\.9720\.9710\.8960\.9810\.9800\.9390\.9620\.9600\.9590\.9490\.2490\.2350\.2510\.2900\.9490\.9490\.9430\.9340\.2840\.2320\.2470\.307

Impact of local epochs\.We vary the number of local training epochs\(1,5,10\)\(1,5,10\)\(Table[4](https://arxiv.org/html/2608.21137#Pt0.A2.T4)\) onGTSRBandHAR\. Min\.ACC is largely stable across all defenses and epoch settings, with only small changes as epochs increase/decrease\. Thus, main\-task utility is not heavily affected by local training length\. Max\.ASR, however, is far more sensitive: onGTSRB,■\\blacksquareABALANCE shows more graceful degradation as local epochs increase, particularly onHAR, whereas■\\blacksquareFLAME’s robustness deteriorates more noticeably with longer local training\. Increasing the number of local training epochs benefits■\\blacksquareABALANCE more than■\\blacksquareFLAME as longer local training amplifies the magnitude and heterogeneity of benign updates, particularly under non\-IID data, making a less adaptive acceptance criterion more difficult to calibrate\. In contrast,■\\blacksquareABALANCE adapts its threshold to the empirical distribution of received deviations while retaining the previous threshold as a temporal constraint\.

Impact of batch size\.We vary the local batch size\(16,32,48,64\)\(16,32,48,64\)\(Table[4](https://arxiv.org/html/2608.21137#Pt0.A2.T4)\) onGTSRBandHARto assess robustness under different training batchs\. Across both datasets, Min\.ACC degrades only marginally as batch size increases \(e\.g\.,GTSRB■\\blacksquareFedAvg drops from 0\.951 to 0\.929;■\\blacksquareABALANCE from 0\.950 to 0\.920\)\. In contrast,Max\.ASRshows much larger fluctuations, especially without defense\. Both■\\blacksquareFLAME and■\\blacksquareABALANCE suppress ASR across large batch sizes, with■\\blacksquareABALANCE achieving the lowest ASR in mostGTSRBsettings while maintaining competitive accuracy\. On HAR,■\\blacksquareFLAME attains the overall lowest ASR values, but■\\blacksquareABALANCE remains close behind and consistently more stable in accuracy\.