Defenses against backdoors in federated learning (FL) are often evaluated with knowledge the server could not hold in deployment, such as the adversary's trigger phrase. We study federated spam filtering under a stricter, realizable threat model in which the server sees only submitted parameter vectors and a small clean validation set. Three trigger-agnostic detectors (robust coordinate outlier scoring, spectral signatures on the update matrix, and a closed-form trigger-reconstruction test for linear models), their ensemble, four robust aggregation rules, a similarity-based baseline and a trigger-aware oracle are compared on the Enron corpus. A single adversary raises the undefended attack success rate (ASR) to 0.953 at unchanged clean accuracy; the ensemble restores the 0.049 no-attack floor with perfect recall and no false positives, and trigger reconstruction recovers the trigger phrase and target label exactly. Our main finding is a failure case. Every trigger-agnostic statistic we test is comparative: it scores a client against its peers, and so presumes an honest majority. When three clients each carry a third of one backdoor, trigger-reconstruction recall falls from 1.00 to 0.00; with five of ten clients adversarial, the best ensemble reaches 0.22 recall at ASR 0.790, whereas the oracle, whose test is absolute, holds 1.00 recall at ASR 0.113. Headline recall should be reported with the adversarial fraction at which a comparative defense stops working. An absolute trigger-agnostic test remains open.

Federated Learning, Spam Detection, Backdoor Attack, Model Poisoning, Collusion, Anomaly Detection, Trigger Reconstruction, Machine Learning Security