Some questions about Backdoor Bench

hello！
Recently，I found some issues when trying to reproduce the experiment in Revisiting Personalized Federated Learning: Robustness Against Backdoor Attacks.
The output is a complex number result, and the evaluator assesses the test_acc and poison_acc for each client. However, in the paper's charts, it appears that only one model was evaluated. Did you select specific clients or perform some kind of processing?
Thanks