Federated learning (FL) enables multiple clients to collaboratively train a machine learning model without sharing their local data. However, the distributed nature of FL makes it vulnerable to backdoor attacks from malicious clients. Most existing attack methods often assume that attackers can inject backdoors in every training round - a scenario that is both unrealistic and inefficient in real-world FL deployment. In this paper, we investigate why backdoor attacks become less effective under low-frequency injection and propose a novel attack paradigm for FL, called REinforced Memorization-based INterval backDoor attack (REMIND). REMIND optimizes the backdoor trigger via task alignment and feature alignment. Task alignment aligns backdoor and main task objectives to resist benign update suppression during non-attack rounds, while feature alignment guides poisoned samples to match the activation trajectory of target-class samples. This dual alignment enhances the backdoor's persistence and narrows the divergence between malicious and benign updates. With strong attack success rates established, we further analyze the advantages of low-frequency backdoor attacks, particularly their ability to improve robustness against defense mechanisms. Extensive evaluations on four benchmark datasets show that REMIND consistently outperforms eight state-of-the-art attack baselines under nine defense strategies.

Single-channel spaceborne-maneuvering bistatic forward-looking synthetic aperture radar (SS-BFSAR) enables the maneuvering platform to achieve high-resolution forward-looking imaging without deploying additional antennas or transmitting the radar signal. Nevertheless, achieving the suppression of spatial variant clutter with only the single-channel configuration remains a critical challenge for the ground moving target imaging (GMTIm) mission of SS-BFSAR. This study proposes an enhanced clutter suppression and GMTIm algorithm for SS-BFSAR. First, the proposed modified deramp-keystone processing (DKP) completely decouples the echo signal in range and azimuth while avoiding the signal-to-clutter ratio (SCR) degradation caused by the azimuth spectrum aliasing. Subsequently, two pre-focusing approaches are developed with nonlinear chirp scaling (NCS), i.e., global NCS and block NCS, to achieve deep focusing of spatial variant clutter while introducing differences of Doppler frequency position (DFP) between the clutter and GMT. These approaches preserve the clutter consistency of the pre-focus results, thereby ensuring that the GMT signal exhibits high SCR following the image domain cancellation. Finally, a matched filter and the proposed monostatic-equivalent model are used to refocus the GMT and estimate its velocity. The proposed algorithm can simultaneously obtain the well-focused ground scene image and the GMTIm result without DFP drift caused by the target’s motion. Comparative experiments using simulation and real data demonstrate the effectiveness and superiority of the proposed algorithm.

Existing backdoor defense methods for federated learning (FL) usually try to distinguish between benign and malicious clients. The key insight is that benign clients are densely distributed, whereas malicious clients tend to be outliers outside this distribution. However, this only holds when data is independent and identically distributed (IID), and the effectiveness of these methods under non-IID data has not been systematically examined. In this paper, we present a comprehensive systematization of FL backdoor defense by breaking down its overall pipeline into three key components, i.e., metrics for evaluating clients, techniques for amplifying the difference between benign and malicious clients, and mechanisms for identifying malicious clients. We conduct an empirical study of FL backdoor defense methods under non-IID data settings to explore whether benign and malicious clients can be fully distinguished. Experimental results show that the defense performance degrades significantly when data is non-IID. Our results also reveal how evaluation metrics, amplification techniques and identification mechanisms perform under diverse settings. Contrary to the established belief, we further conclude that these defenses have inherent shortcomings, due to lack of stability and robustness in detecting malicious clients. We believe that our findings can better facilitate the development of FL backdoor defenses.