Supplementary Material for "Characterizing the Maintaining Effect of Backdoors in Federated Learning"

Abstract

Sequential Backdoor Retention Experiments This repository studies whether an implanted backdoor remains detectable after subsequent training. Each experiment compares continued benign training with training that injects a second backdoor. Evaluation measures retention of the first backdoor using both current and restored BatchNorm (BN) statistics. Hardware and software The reference workstation configuration is: Component Configuration CPU AMD Ryzen 9 9950X3D Memory 32 GB RAM GPU NVIDIA GeForce RTX 5070 Ti Python 3.11 Training framework PyTorch with CUDA The supplied requirements.txt targets NVIDIA GPU training using PyTorch 2.12.0 and torchvision 0.27.0 CUDA 13.0 wheels. Use a compatible NVIDIA driver. Training selects CUDA when available; --device cpu selects the CPU. CUDA is the intended environment for the full experiment matrix. Plotting and result analysis do not require a GPU or trained model files. Create an environment and install the dependencies: python -m venv .venv# Windows: .venv\Scripts\activate# Linux/macOS: source .venv/bin/activatepython -m pip install -r requirements.txt For a CPU-only environment, install compatible CPU builds of PyTorch and torchvision instead of the CUDA-pinned entries, then install pandas and matplotlib at the versions specified in requirements.txt. The CPU and GPU runtimes can produce different numerical trajectories. Files Path Purpose main.py Run one experiment launcher.py Run the predefined 162-experiment matrix plots.py Generate figures from saved metrics analyze_results.py Summarize ASR and timing src/ Training, data, triggers, evaluation, caching, and output utilities requirements.txt Python dependency requirements Datasets are downloaded to data/ on first use. Experiment outputs are written to runs/ /; figures are written to plots/ / /. Experiment protocol Train a benign model for the configured number of updates. The final 2,000 benign updates are evaluated for the plots and are included in that total. Inject backdoor A, starting from the benign endpoint. Save the resulting weights and BN statistics. Start B-control from the post-A weights, restore benign BN statistics, and continue training without poisoning. Start B-maintain from the same post-A weights and benign BN statistics, and continue training with backdoor B. A and each B branch use a fresh optimizer. The B branches share their initial model, task sample order, and augmentation randomness. Evaluation preserves the training RNG state. Restored-BN A evaluation temporarily uses the saved post-A BN statistics, then restores the current statistics. The model is ResNet-18 with a 3x3 stride-1 input convolution and no initial max-pooling. Input channels and output classes follow the task dataset. Setting Default for the launcher matrix Datasets CIFAR-10, CIFAR-100, EMNIST Balanced Global seeds 42, 43, 44 Benign updates 40,000 or 120,000 A updates 2,000 B updates 8,000 per branch Training / evaluation batch size 256 / 2,048 Target labels A / B 0 / 0 Poisoning Approximately 10% of each A and B-maintain batch Benign learning rate 0.01 A / B learning rates 0.01; 0.005 and 0.05 in the LR comparison Optimizer SGD, momentum 0.9, weight decay 0.0005 Learning-rate schedule Constant Evaluation interval 50 updates, plus the final update Evaluation noise seed 0 Mixed precision Disabled Data-loader workers 0 The poisoned count is the batch size times the poison rate, rounded down, with at least one poisoned sample when the rate is positive. Smaller final batches are retained. B-control has no poisoned samples. Running experiments Run a single experiment: python main.py --dataset cifar10 --seed 42 --benign-steps 40000 --trigger-a gray_4x4_center --trigger-b gray_2x2_center Run the predefined matrix: python launcher.py The launcher executes 54 conditions for each dataset, in this order: CIFAR-10, CIFAR-100, EMNIST Balanced. For each of the six A/B pairs below, it runs 40,000 then 120,000 benign updates, using seeds 42, 43, 44 for each length. This gives 36 main experiments per dataset. Comparison Backdoor A Backdoor B Large to small patch Gray 4x4 center Gray 2x2 center Small to large patch Gray 2x2 center Gray 4x4 center Strong to weak noise Gaussian std 0.20 Gaussian std 0.10 Weak to strong noise Gaussian std 0.10 Gaussian std 0.20 Patch to noise Gray 4x4 center Gaussian std 0.20 Noise to patch Gaussian std 0.20 Gray 4x4 center The remaining 18 experiments use the large-to-small patch, strong-to-weak noise, and patch-to-noise pairs at 40,000 benign updates. For each pair, A and B learning rates are both 0.005 then both 0.05, with seeds 42, 43, 44 for each LR. The 0.01 cases are reused from the main comparison. START_RUN in launcher.py selects the first overall batch entry to execute, starting at 1. It skips earlier entries and reruns the selected experiment from its beginning. It does not resume an interrupted A/B stage. Saved run directory numbers are allocated after existing runs and can differ from matrix numbers. Use a fresh output directory when matrix-aligned directory numbering is needed. Use python main.py --help for all options. Always specify --benign-steps for the sequential protocol above. Omitting it selects the historical independent base-stage protocol, retained for compatibility with earlier experiments. Triggers and datasets Patches are applied after augmentation and normalization. Raw intensities are white 1.0, black 0.0, and gray 0.5; they are converted using the task dataset's mean and std before insertion. The main matrix uses centered gray patches. gaussian_noise_std0p10 and gaussian_noise_std0p20 sample fresh, independent zero-mean Gaussian noise for every poisoned image, including images in the same batch and repeated visits to an image. Noise std is measured in normalized input units. After addition, image values are clipped to [-3, 3]. Training noise uses separate A/B generators, seeded by global seed +50001 and +60001. Evaluation uses a fixed per-image bank with seed 0, independent of the global seed. A and B use the same underlying standard-normal evaluation draws, scaled by their respective std values. The bank is reused across checkpoints, branches, and BN conditions. --noise-train-seed-a/b and --noise-eval-seed provide explicit overrides. Historical noise_full_image_seed _std0p10 and std0p20 names retain their fixed-pattern semantics. Dataset Input Classes Normalization mean / std CIFAR-10 RGB, 32x32 10 (0.4914, 0.4822, 0.4465) / (0.2470, 0.2435, 0.2616) CIFAR-100 RGB, 32x32 100 (0.5071, 0.4867, 0.4408) / (0.2675, 0.2565, 0.2761) EMNIST Balanced Grayscale, 28x28 47 0.5 / 0.5 CIFAR training uses random crop with padding 4 and horizontal flip. EMNIST images are transposed to upright orientation and use no random augmentation. Other EMNIST splits are selectable with --emnist-split; letters labels are mapped from 1-26 to 0-25. OOD replacement is available separately from image triggers: python main.py --dataset cifar10 --benign-steps 40000 --backdoor-a ood --ood-source-a cifar100 --trigger-b gaussian_noise_std0p20 OOD sources must differ from the task dataset. Defaults are 800 unique training images and 1,000 held-out evaluation images. They are adapted to the task input shape and normalization, assigned the configured target label, and used to replace selected training images. Source selection uses global seed +10001 for A and +20001 for B. Configs record selected indices, seeds, and tensor hashes. OOD ASR is target prediction frequency on the held-out source subset; separate seen-subset metrics measure retention on injected images. Outputs and caching Each experiment contains config.json, timing.json, and four stage directories: base_stage/, a_stage/, b_control_stage/, b_maintain_stage/. Stage file Contents metrics.csv Scientific metrics and evaluation durations timing.csv Training durations for 50-step blocks and a final partial block last.pt and other .pt files Model, BN, and checkpoint state diagnostics/ Endpoint prediction/confusion counts and JSON metadata Benign trajectories are cached under runs/ /cache/. Compatible checkpoints preserve optimizer, RNG, and sampler position. A cache hit avoids retraining the prefix; the final plotted benign segment is replayed. Cache identity includes data, preprocessing, training settings, source code, and runtime metadata. Historical model-only caches are available only through --legacy-cache-dir and cannot supply exact continuous training resume. Reproducibility depends on a compatible runtime and device. Deterministic algorithms are enabled with warnings for unsupported operations; this does not guarantee bitwise equivalence across hardware or dependency versions. Result analysis python analyze_results.pypython analyze_results.py --dataset cifar10 --all --mode fullpython analyze_results.py --dataset cifar100 --run 1 --mode maintain Interactive mode offers Results or Timing. Results then offers Full comparison or Maintain only, with an explicit selection required. Full comparison requires complete, matching B-control and B-maintain evaluation checkpoints. For each checkpoint it calculates Delta = Maintain - Control, then reports control mean ASR, maintain mean ASR, mean Delta, and population SD of Delta, separately for current and restored BN. Positive Delta means greater A retention in B-maintain. ASRs are percentages; Delta and its SD are percentage points. SD describes variation along the difference trajectory, not variation across seeds. Interpretation columns remain blank. Missing restored-BN data are never replaced with current-BN values. The summary uses all-sample asr_a and asr_a_bn_restored. Additional non-target ASRs exclude images whose original label is the target. Maintain-only mode keeps the historica