🤖 AI

Coward: Collision-based OOD Watermarking for Practical Proactive Federated Backdoor Detection

The paper introduces Coward, a novel proactive federated backdoor detection method that leverages multi-backdoor collision effects to inject a carefully designed watermark, effectively overcoming the limitations of existing techniques caused by non-i.i.d. data distributions and out-of-distribution biases.

Original authors: Wenjie Li, Siying Gu, Yiming Li, Shuxin Li, Zhili Chen, Tianwei Zhang, Shu-Tao Xia

Published 2026-05-07

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Wenjie Li, Siying Gu, Yiming Li, Shuxin Li, Zhili Chen, Tianwei Zhang, Shu-Tao Xia

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine a group of neighbors trying to build a single, giant community map together without ever showing each other their private photos. This is Federated Learning (FL). Everyone keeps their photos on their own phone, sends only the "lessons" they learned to a central server, and the server combines them to make a better map for everyone.

The problem? A few "bad neighbors" (malicious clients) might try to sneak in a secret trick. They want the map to work perfectly for everyone else, but if you show it a picture of a cat with a tiny, invisible sticker on it, the map should suddenly scream, "That's a dog!" This is called a Backdoor Attack.

The Old Ways of Catching the Bad Neighbors

The paper explains that previous methods to catch these bad neighbors had two main flaws:

The "Outlier" Method (Passive): This method assumed that bad neighbors would look weird compared to the good ones. It was like a bouncer looking for someone wearing a clown nose in a crowd of people in suits.
- The Flaw: In real life, neighbors have very different photos (some have only cats, some only dogs). This natural difference made the good neighbors look "weird" too, causing the bouncer to kick out innocent people by mistake.
The "Trap" Method (Proactive - e.g., BackdoorIndicator): This method tried to be smarter. The server would plant a "trap" in the map using weird, random pictures (Out-of-Distribution or OOD data). The idea was: "If a neighbor remembers this weird trap, they are probably bad."
- The Flaw: Deep learning models are weirdly confident about things they don't understand. Even good neighbors would accidentally guess the right answer for the weird trap just by luck, thinking, "Oh, this looks like a dog!" This caused the server to falsely accuse innocent neighbors.

The New Solution: "Coward"

The authors introduce a new method called Coward. The name is a bit of a joke: it's a "coward" because it relies on the bad guys being too aggressive and tripping over their own feet.

Here is how it works, using a simple analogy:

1. The Setup: Planting a "Watermark"

Instead of planting a random trap, the server plants a very specific Watermark on the map.

Imagine the server takes a bunch of random, weird pictures (like a cat with a blue filter).
It teaches the map: "If you see a Blue Filter Cat, you must say '8'."
Crucially, the server also teaches the map: "If you see a Blue Filter Cat with a Red Sticker, you must say '1'."

2. The Collision (The "Aha!" Moment)

The paper discovered a funny phenomenon called the Multi-Backdoor Collision Effect.

If a bad neighbor tries to install their own secret trick (Backdoor) that says "Blue Filter Cat = 0," it fights with the server's trick that says "Blue Filter Cat = 1."
Because the bad neighbor's trick is fighting the server's trick, the bad neighbor's trick gets erased or weakened. It's like two people trying to push a heavy door in opposite directions; the door doesn't move, or one person gets pushed out.
The good neighbors, who aren't trying to install a secret trick, just gently learn the server's rule. They remember the "Blue Filter Cat = 1" rule perfectly.

3. The Detection: Who Forgot the Rule?

After the neighbors update the map, the server checks them:

Good Neighbor: "Hey, what does a Blue Filter Cat with a Red Sticker say?"
- Answer: "It says 1!" (They kept the server's rule). -> Safe.
Bad Neighbor: "Hey, what does a Blue Filter Cat with a Red Sticker say?"
- Answer: "It says 0!" (They tried to overwrite the rule, but in doing so, they messed up the server's rule so badly that the signal is weak or gone). -> Caught.

Why is "Coward" Better?

The paper claims this method solves the two big problems:

It ignores the "Weirdness" of neighbors: Since it checks if they kept a specific rule rather than looking for "weird" updates, it doesn't get confused by neighbors having different types of photos.
It beats the "Confidence" problem: The old "Trap" method failed because models were too confident guessing random things. "Coward" works differently:
- If a model is too confident about a random weird picture (a sign of the old problem), it actually helps "Coward" in this case.
- The bad neighbor has to destroy the server's specific rule to hide their own. This "collision" is so strong that even if the model is confident about random things, it can't hide the fact that it broke the specific server rule.

The Results

The authors tested this on standard image datasets (like CIFAR-10 and EMNIST). They found that:

Coward catches almost all bad neighbors (high True Positive Rate).
Coward rarely kicks out good neighbors (very low False Positive Rate), even when the neighbors have very different data.
Even if the bad neighbors try to adapt and guess the server's trick, they end up destroying their own attack in the process.

In short, Coward is a clever way of saying: "I'm going to teach you a specific rule. If you try to break it to hide your secret, you'll fail so hard that I'll know you're the bad guy. If you're a good neighbor, you'll just learn the rule and stay safe."

Technical Summary: Coward – Collision-Based OOD Watermarking for Practical Proactive Federated Backdoor Detection

1. Problem Statement

Federated Learning (FL) enables privacy-preserving collaborative training but introduces significant vulnerabilities to backdoor attacks, where malicious clients inject triggers to manipulate the global model. Existing defense mechanisms face two critical practical limitations:

Passive Detection Limitations (Non-IID Divergence): Traditional passive methods identify malicious clients by detecting outliers in model parameters or gradients. However, these methods are highly susceptible to the inherent non-independent and identically distributed (non-i.i.d.) data distributions and random client participation in FL. These factors cause benign local models to exhibit high variance, often mimicking the statistical signatures of malicious updates, leading to high false-positive rates or missed detections.
Proactive Detection Limitations (OOD Prediction Bias): Recent proactive methods, such as BackdoorIndicator, attempt to intervene in training by injecting Out-of-Distribution (OOD) patterns. They rely on the "coexistence effect," where malicious models retain these patterns better than benign ones. However, these methods are undermined by the inherent OOD prediction bias of Deep Neural Networks (DNNs). DNNs tend to classify OOD samples into arbitrary classes with high confidence. This bias causes benign clients to exhibit unexpectedly high retention of OOD patterns, leading to frequent misjudgments (false positives) that render current proactive methods unreliable.

2. Methodology: Coward

The authors propose Coward (Collision-based OOD WAtermarking for Robust federated backdoor Detection), a proactive detection framework inspired by the discovery of a multi-backdoor collision effect.

2.1 Core Insight: The Collision Effect

While existing work observed that backdoors targeting the same label coexist, the authors discovered that consecutively planted backdoors targeting different labels significantly interfere with and suppress one another. This "collision effect" forms the basis of the new detection paradigm.

2.2 The Detection Paradigm: Inverted Logic

Coward inverts the logic of existing proactive methods:

Existing (Coexistence): High retention of an injected pattern = Malicious.
Coward (Collision): High retention of an injected watermark = Benign. Low retention (erasure) = Malicious.

In this inverted paradigm, the high-confidence predictions caused by OOD bias in benign clients (which previously caused false positives) become beneficial, as they indicate the preservation of the watermark.

2.3 Technical Implementation

The method operates in three stages:

Watermark Injection (Server-Side):
- The server constructs a regulated dual-mapping on OOD data (e.g., EMNIST for a CIFAR-10 task).
- Regulated Base Mapping ( $\pi_1$ ): A fixed, one-to-one mapping from OOD labels to task labels is established to stabilize the OOD space and reduce ambiguity. This contrasts with the random mappings used in BackdoorIndicator.
- Targeted Watermark Mapping ( $\pi_2$ ): A specific subset of OOD samples is assigned a trigger pattern and mapped to a fixed target class ( $y_m$ ).
- The global model is fine-tuned on this OOD data with a regularization term to preserve the original task performance while embedding the watermark.
Watermark Interaction (Client-Side):
- Clients perform local training on their private data.
- Benign Clients: Optimize only for the task loss. They may slightly forget the OOD watermark due to non-i.i.d. data but generally preserve the trigger-to-target mapping.
- Malicious Clients: Optimize for both the task and their specific backdoor objective. Because their backdoor targets a different class than the watermark, the collision effect occurs: the malicious backdoor actively suppresses or erases the server-injected watermark during local training.
Watermark Detection (Server-Side):
- The server evaluates the local models using the watermarked OOD dataset.
- It measures the accuracy of the specific trigger-to-target mapping.
- Decision Rule: Clients with watermark accuracy below a threshold $\beta$ are flagged as malicious (indicating the watermark was suppressed by a collision). Clients with high accuracy are considered benign.

3. Key Contributions

Identification of Limitations: The paper rigorously analyzes and demonstrates how non-i.i.d. data heterogeneity undermines passive detection and how OOD prediction bias fundamentally limits current proactive detection methods.
Discovery of Multi-Backdoor Collision: The authors identify and characterize the phenomenon where distinct backdoors targeting different labels interfere with each other, suppressing previously planted effects.
Coward Framework: A novel proactive detection method that leverages this collision effect to create an inverted detection paradigm. This design naturally counteracts OOD bias, as high-confidence benign predictions (a source of error in prior work) now correctly signal benign behavior.
Robustness: The method introduces a low-disruptive training intervention that inherently limits the strength of OOD bias, significantly reducing misjudgments compared to state-of-the-art baselines.

4. Experimental Results

Extensive experiments were conducted on benchmark datasets (CIFAR-10, CIFAR-100, EMNIST) under various settings:

Non-IID Resilience: Coward consistently achieved True Positive Rates (TPR) above 95% and False Positive Rates (FPR) below 10.5% across varying degrees of data heterogeneity ( $\alpha = 0.3$ to $0.9$). In contrast, passive methods (e.g., MultiKrum, Flame) saw TPRs drop significantly (often below 10%) under severe heterogeneity.
Advanced Attacks: The method maintained high performance against stealthy attacks (e.g., Neurotoxin, Chameleon) and various trigger types (visible, invisible, semantic), whereas passive methods suffered substantial degradation.
Multi-Attacker Scenarios: Coward remained effective even when up to 70% of clients were malicious, a scenario where outlier-based passive methods failed completely.
OOD Bias Mitigation: Compared to BackdoorIndicator, Coward significantly reduced the OOD bias level and the resulting false positive rate, even when using diverse or synthetic OOD datasets.
Adaptive Attacks: The method demonstrated resilience against adaptive attackers attempting to guess the watermark target. Such attempts often induced a "local collision contradiction," weakening the attacker's own backdoor and failing to bypass detection.

5. Significance and Claims

The paper claims that Coward represents a significant step toward practical, proactive backdoor detection in Federated Learning. By shifting the detection basis from "pattern preservation" (which is vulnerable to OOD bias) to "pattern collision," the method:

Solves the OOD Bias Challenge: It transforms the inherent high-confidence bias of DNNs on OOD data from a liability into a reliable signal for benign behavior.
Overcomes Non-IID Sensitivity: It decouples detection from parameter-space outliers, making it robust to the data heterogeneity that plagues passive methods.
Provides a New Paradigm: It establishes a new direction for FL security that utilizes the interference between multiple backdoors rather than relying on their coexistence.

The authors conclude that Coward effectively alleviates the OOD bias challenge, achieving state-of-the-art performance while maintaining the integrity of the global model's primary functionality.