A Supplementary Material 463 A.1 Implementation Details

We use Erd os-Rényi Kernel (ERK) (Evci et al., 2020), an empirical (l 1) In the mask searching process, we use parameter's magnitude to guide the Following (Evci et al., 2020), we use Labels of poison samples are manipulated to the target label (e.g., a horse). " corresponds to be applicable while " " corresponds to be not applicable. BadNet is the earliest, and also the simplest backdoor attack first proposed in (Gu et al., DBA. DBA (Xie et al., 2019) is a backdoor attack specifically targeted on FL. Sinusoidal attack (Barni et al., 2019) shares a similar perspective with BadNet, The basic idea of Scaling (Bagdasaryan et al., 2020) is to enlarge the gradient update FixMask is an adaptive attack method specifically targeting Lockdown.