SURA evaluates client updates in federated learning by probing their response to repeated unlearning on a small trusted image set. The technique aims to avoid expensive large-reference defenses while detecting poisoned client contributions. The authors reported near-zero attack success with ten private clean images on one CIFAR-100 configuration, but a…
Inspect the ClaimsCase · DiggingBeagle record
SURA backdoor screening failed when attackers learned its ten clean reference images
SURA evaluates client updates in federated learning by probing their response to repeated unlearning on a small trusted image set. The technique aims to avoid expensive large-reference defenses while detecting poisoned client contributions.
Scope
Synthetic federated-learning client poisoning and detector experiments; no identified field attacker.
Assessment profile
Assessment method- Setting
- evaluation
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- not applicable
- AI role
- AGAINST AI
Basis and provenance
Experimental adaptive attacker with knowledge of the exact trusted probe data defeats one defense configuration. No deployed federated poisoning is established. An impact band is not assigned because the available Claims do not establish a comparable verified severity or quantified harm.
Assessed Nov 12, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-R239-070-CORE · SURA 10-image trusted probes suppress federated-learning backdoors unless attacker knows exact repair set
At a glance
A screening method that relies on undisclosed data can lose its value once that data becomes predictable.
Read the implicationsRealistic colluding clients, private-set rotation and rejection of harmless updates need independent testing.
Limits and uncertaintyFull account
SURA evaluates client updates in federated learning by probing their response to repeated unlearning on a small trusted image set. The technique aims to avoid expensive large-reference defenses while detecting poisoned client contributions.
The authors reported near-zero attack success with ten private clean images on one CIFAR-100 configuration, but a strong adaptive attack that knew the same ten images raised attack success to 94.91%. These are experimental benchmarks, with different outcomes across datasets. The result does not show a compromise of a deployed federated network; it demonstrates that the reference set is a security secret, not just evaluation data.
A screening method that relies on undisclosed data can lose its value once that data becomes predictable.
The ten-image probe set acts as an implicit secret and security dependency. A small fixed probe can perform well against uninformed adversaries yet fail sharply when exposed to one adaptive client. The paper does not measure compromise of a deployed federated service, and results differ across dataset and architecture choices.
Mechanism and trust boundary
- 01
Federated-learning client updates are screened against a small private reference set.
- 02
An adaptive malicious client learns the exact images used by the screening mechanism.
- 03
A crafted update evades the screening condition and restores high measured backdoor success in the test setup.
Claims & evidence
CLM-R239-070-COREIn SURA’s tested adaptive condition, knowing the exact ten-image trusted probe set raised the reported backdoor attack-success rate to 94.91%.supported
Basis: reported finding
- supportsSURA 10-image trusted probes suppress federated-learning backdoors unless attacker knows exact repair setprimary disclosure
Section 3.6, adaptive attacker with known trusted set
Implications
A screening method that relies on undisclosed data can lose its value once that data becomes predictable.
Controls and mitigations
- Protect probe-set confidentiality, rotate clean references, audit update provenance and evaluate defenses under informed adversaries.
Unknowns and contradictions
- Realistic colluding clients, private-set rotation and rejection of harmless updates need independent testing.
Sources and citation
Material revision history
- Nov 12, 2026 · Published version · first publication · revision 241