SuperFedGuard: A New Axis of Defense Against Backdoors in Federated Learning

Super-Federated Learning (SuperFL) trains a single weight-shared SuperNet across many clients, where each client receives a different subnetwork slice every round. It was designed to make federated learning cheaper and more accurate — but we found it also quietly changes the security picture, in both directions.

The bad news: poisoning hits harder, and defenses stop working. Counterintuitively, a data-poisoning backdoor that plateaus and decays in traditional federated learning converges to nearly 100% attack success in SuperFL. The poison isn't trapped in whatever subnetwork the attacker held in a given round — it accumulates into the larger subnetworks that contain it. Worse, classical FL defenses (FLAME, FoolsGold, Auror) assume every client's update lives in the same parameter space. Under subnetwork rotation, two honest clients that trained disjoint slices look dissimilar while two sybils that shared a large subnetwork look alike — so clustering and similarity signals are dominated by which subnetwork a client happened to draw, not what it tried to learn. Even after rebuilding each defense specifically for the SuperFL setting, the best one removed under a quarter of the attack.

The key insight: the server holds a lever it never had before. In traditional FL, the server's only post-round control is how it aggregates updates. In SuperFL, the server also chooses which subnetwork each client trains next. SuperFedGuard (SFG) turns that scheduling freedom into a defense, built from five composable mechanisms:

• Overlap-exclusive cosine similarity — compare two clients only on the parameters they both actually trained, recovering the trust signal that subnetwork rotation destroys.
• Quarantine to the core — rank clients by trust and route the least-trusted onto the MinNet, the small shared core contained in every subnetwork, so any poison they produce is confined and never written into the wider model.
• Sticky suspicion — remember recent flags so an attacker can't launder its way back to trust by briefly lying low.
• Rank-proportional down-weighting — dampen suspect contributions smoothly instead of making brittle binary bans that silence honest clients.
• Adaptive core clipping — a detection-free backstop that clips every client's core update to a robust median norm, bounding the damage even when the trust signal fades.

Results. On CIFAR-10, SFG cuts the deployed model's backdoor attack success rate from 0.96 to 0.30, and on MNIST from 1.00 to 0.30 — a ~70% relative reduction, roughly 3× better than the strongest classical defense adapted to the setting — with benign accuracy statistically unchanged and without being told how many clients are compromised. The methodology applies to any weight-shared collaborative training system with nested subnetworks, not just the SuperNets we evaluated.

Paper currently under review — official publication coming soon.