<p>Backdoor attacks poison client data to implant backdoor neurons into local models, thereby infecting the federated global model during aggregation. Recent research indicates that backdoor models exhibit high similarity, which facilitates their detection through clustering of local models. However, this similarity intensity correlates with the poisoned data rates (PDR). A higher PDR leads to stronger similarity among backdoored models, making them easier to identify. In contrast, attackers can easily evade defenses by lowering the PDR, exposing the global model to significant infection risks. To address this problem, we propose FedNAC, a neuron-level defense mechanism against backdoor attacks. We first observe that backdoor neurons consistently maintain remarkably high activation regardless of PDR variations. Based on this characteristic, the Neuron Filtering Algorithm (NFA) in FedNAC clusters the neurons of the local model, flags neurons exhibiting abnormally high activation as backdoor neurons. However, a small number of backdoor neurons may evade NFA filtering, and adversaries could amplify the influence of these neurons by increasing the magnitude of model updates. Therefore, we also designed the Adaptive Scaling Algorithm (ASA) and the Update Direction Correction Algorithm (UDCA). ASA constrains the magnitude of all local updates to the same level. UDCA attempts to reduce the learning rate for dimensions associated with the backdoor task, leading to parameter dissipation of these residual backdoor during global aggregation. Comprehensive evaluations on three benchmark datasets demonstrate FedNAC’s superior defense capability against backdoor attacks under varying PDR. When PDR is low, FedNAC reduces the backdoor task accuracy to between 2.44 and 4.33%, significantly outperforming other defenses. When PDR is high, FedNAC shows only a 1–2 percentage point gap compared to these defenses.</p>