# BackdoorIndicator: Leveraging OOD Data for Proactive Backdoor Detection in Federated Learning

arXiv: https://arxiv.org/abs/2405.20862 · HTML: https://mlsanity.com/paper/2405.20862/

## Key facts

- Cited by 17 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 31 May 2024.

## Built on by (most cited first, 17 of 17)

- [MARS: A Malignity-Aware Backdoor Defense in Federated Learning](https://mlsanity.com/paper/2509.20383/) (2025)
- [DeBackdoor: A Deductive Framework for Detecting Backdoor Attacks on Deep Models with Limited Data](https://mlsanity.com/paper/2503.21305/) (2025)
- [Identify Backdoored Model in Federated Learning via Individual Unlearning](https://mlsanity.com/paper/2411.01040/) (2024)
- [Toward Malicious Clients Detection in Federated Learning](https://mlsanity.com/paper/2505.09110/) (2025)
- [Defending the Edge: Representative-Attention Defense against Backdoor Attacks in Federated Learning](https://mlsanity.com/paper/2505.10297/) (2025)
- [BackFed: An Efficient & Standardized Benchmark Suite for Backdoor Attacks in Federated Learning](https://mlsanity.com/paper/2507.04903/) (2025)
- [On the Out-of-Distribution Backdoor Attack for Federated Learning](https://mlsanity.com/paper/2509.13219/) (2025)
- [DEFEND: Poisoned Model Detection and Malicious Client Exclusion Mechanism for Secure Federated Learning-based Road Condition Classification](https://mlsanity.com/paper/2512.06172/) (2025)
- [Your Neighbors Know: Leveraging Local Neighborhoods for Backdoor Detection in Decentralized Learning](https://mlsanity.com/paper/2605.19969/) (2026)
- [TrojanDam: Detection-Free Backdoor Defense in Federated Learning through Proactive Model Robustification utilizing OOD Data](https://mlsanity.com/paper/2504.15674/) (2025)
- [On the Inference (In-)Security of Vertical Federated Learning: Efficient Auditing against Inference Tampering Attack](https://mlsanity.com/paper/2507.02376/) (2025)
- [FedBAP: Backdoor Defense via Benign Adversarial Perturbation in Federated Learning](https://mlsanity.com/paper/2507.21177/) (2025)
- [FLAT: Revealing Hidden Latent-Conditioned Backdoor Failures in Federated Learning](https://mlsanity.com/paper/2508.04064/) (2025)
- [Enhancing the Effectiveness and Durability of Backdoor Attacks in Federated Learning through Maximizing Task Distinction](https://mlsanity.com/paper/2509.18904/) (2025)
- [FedTrident: Resilient Road Condition Classification Against Poisoning Attacks in Federated Learning](https://mlsanity.com/paper/2603.19101/) (2026)
- [SecureAFL: Secure Asynchronous Federated Learning](https://mlsanity.com/paper/2604.03862/) (2026)
- [Securing Autonomous Vehicle Systems via Twin-Aware Federated Reinforcement Learning](https://mlsanity.com/paper/2607.08137/) (2026)

## Abstract (arXiv)

In a federated learning (FL) system, decentralized data owners (clients) could upload their locally trained models to a central server, to jointly train a global model. Malicious clients may plant backdoors into the global model through uploading poisoned local models, causing misclassification to a target class when encountering attacker-defined triggers. Existing backdoor defenses show inconsistent performance under different system and adversarial settings, especially when the malicious updates are made statistically close to the benign ones. In this paper, we first reveal the fact that planting subsequent backdoors with the same target label could significantly help to maintain the accuracy of previously planted backdoors, and then propose a novel proactive backdoor detection mechanism for FL named BackdoorIndicator, which has the server inject indicator tasks into the global model leveraging out-of-distribution (OOD) data, and then utilizing the fact that any backdoor samples are OOD samples with respect to benign samples, the server, who is completely agnostic of the potential backdoor types and target labels, can accurately detect the presence of backdoors in uploaded models, via evaluating the indicator tasks. We perform systematic and extensive empirical studies to demonstrate the consistently superior performance and practicality of BackdoorIndicator over baseline defenses, across a wide range of system and adversarial settings.