Resilient Federated Chain: Transforming Blockchain Consensus into an Active Defense Layer for Federated Learning

Mario García-Márquez; Nuria Rodríguez-Barroso; M. Victoria Luzón; Francisco Herrera

cs.CRFeb 25, 2026

Resilient Federated Chain: Transforming Blockchain Consensus into an Active Defense Layer for Federated Learning

Authors: Mario García-Márquez, Nuria Rodríguez-Barroso, M. Victoria Luzón, Francisco Herrera

Organizations: Department of Computer Science and Artificial Intelligence, Andalusian Research Institute in Data Science and Computational Intelligence (DaSCI) University of Granada Granada · Department of Software Engineering, Andalusian Research Institute in Data Science and Computational Intelligence (DaSCI) University of Granada Granada

Abstract

Federated Learning (FL) has emerged as a key paradigm for building Trustworthy AI systems by enabling privacy-preserving, decentralized model training. However, FL is highly susceptible to adversarial attacks that compromise model integrity and data confidentiality, a vulnerability exacerbated by the fact that conventional data inspection methods are incompatible with its decentralized design. While integrating FL with Blockchain technology has been proposed to address some limitations, its potential for mitigating adversarial attacks remains largely unexplored. This paper introduces Resilient Federated Chain (RFC), a novel blockchain-enabled FL framework designed specifically to enhance resilience against such threats. RFC builds upon the existing Proof of Federated Learning architecture by repurposing the redundancy of its Pooled Mining mechanism as an active defense layer that can be combined with robust aggregation rules. Furthermore, the framework introduces a flexible evaluation function in its consensus mechanism, allowing for adaptive defense against different attack strategies. Extensive experimental evaluation on image classification tasks under various adversarial scenarios, demonstrates that RFC significantly improves robustness compared to baseline methods, providing a viable solution for securing decentralized learning environments.

Figures & tables

Figure 1: Descriptive diagram showing the architecture of a FL system. Source: [ 17 ] .

Figure 2: Schematic of the pooled mining architecture. By clustering clients into independent pools, this framework enhances system scalability and reduces blockchain communication overhead. Furthermore, the accuracy-based selection mechanism incentivizes the contribution of high quality model updates, ensuring the robustness of the global model against low-quality or malicious local contributions.

Figure 3: Diagram showing the architecture of the proposed RFC framework. Components diverging from the PoFL structure are marked in red. More precisely, the aggregation algorithm employed and the metric used to select the best model in the consensus are treated as hyperparameters, allowing for a more flexible and robust architecture.

L^{t}_{i}\leftarrow\mathcal{R}(\{\hat{L}_{i,j}^{t}\}_{j})

Algorithm 1 Resilient Federated Chain (RFC) Training Procedure

Dataset	Data Description	Classes
CIFAR-10	32 $\times$ 32 Color	10
Fashion MNIST	28 $\times$ 28 Grayscale	10
EMNIST	28 $\times$ 28 Grayscale	10
Celeba-S	High-resolution Color	2 (Binary)

Table 1: Overview of the experimental datasets and their key characteristics.

		Loss based						Accuracy based
		Accuracy			Loss			Accuracy			Loss
Dataset	Aggregator	Final	Mean	Max	Final	Mean	Min	Final	Mean	Max	Final	Mean	Min
			Last 10			Last 10			Last 10			Last 10
Celeba-S	B-RFC	0.91	0.92	0.92	0.26	0.26	0.25	0.88	0.87	0.89	0.66	0.60	0.45
	Bulyan	0.92	0.92	0.92	0.27	0.27	0.27	0.87	0.85	0.87	0.55	0.57	0.45
	G-RFC	0.91	0.92	0.92	0.27	0.27	0.25	0.89	0.89	0.90	0.59	0.46	0.30

Table 2: Results obtained in the no attack scenario, showing both results from the loss and accuracy based.

Panel of Figure 4 — Figure 4: Performance of the proposal under the no attack scenario. We see how RFC variants are superior to their baselines both in Figures 4(a) and 4(b) . Non robust aggregation operators obtain the better accuracy, which is an expected result.

		Loss based						Accuracy based
		Accuracy			Loss			Accuracy			Loss
		Final	Mean	Max	Final	Mean	Min	Final	Mean	Max	Final	Mean	Min
Dataset	Aggregator		Last 10			Last 10			Last 10			Last 10
Celeba-S	B-RFC	0.89	0.88	0.89	0.72	0.56	0.36	0.88	0.88	0.90	0.41	0.60	0.34
	Bulyan	0.87	0.80	0.88	0.41	0.68	0.38	0.85	0.78	0.89	0.43	0.85	0.34
	G-RFC	0.89	0.88	0.89	0.28	0.41	0.28	–	–	–	–	–	–

Table 3: One-client scenario with Labelflip attack: loss-based and accuracy-based evaluations.

		Accuracy			Loss			Backdoor Accuracy			Backdoor Loss
		Final	Mean	Max	Final	Mean	Min	Final	Mean	Max	Final	Mean	Min
Dataset	Aggregator		Last 10			Last 10			Last 10			Last 10
Celeba-S	B-RFC	0.84	0.87	0.88	0.55	0.44	0.32	0.75	0.76	0.78	1.52	1.37	0.71
	Bulyan	0.78	0.84	0.89	1.07	0.61	0.39	0.76	0.75	0.78	1.40	1.42	0.79
	G-RFC	0.86	0.88	0.90	0.36	0.39	0.32	0.73	0.76	0.79	0.86	1.16	0.80
	GeoMed	0.85	0.87	0.90	0.56	0.46	0.33	0.79	0.76	0.79	1.12	1.30	0.84

Table 4: One-client scenario with Backdoor attack, using loss-based evaluation.

		Accuracy			Loss			Backdoor Accuracy			Backdoor Loss
		Final	Mean	Max	Final	Mean	Min	Final	Mean	Max	Final	Mean	Min
Dataset	Aggregator		Last 10			Last 10			Last 10			Last 10
Celeba-S	B-RFC	0.84	0.87	0.89	2.20	0.83	0.35	0.72	0.76	0.78	3.62	2.11	0.67
	Bulyan	0.83	0.80	0.88	0.46	0.74	0.38	0.72	0.71	0.77	0.94	1.36	0.69
	GeoMed	0.88	0.87	0.90	0.48	0.45	0.33	0.78	0.77	0.79	1.10	1.22	0.69
	K-RFC	0.89	0.89	0.90	0.44	0.46	0.34	0.79	0.78	0.79	1.44	1.47	0.82

Table 5: One-client scenario with Backdoor attack, using accuracy-based evaluation.

Panel of Figure 5 — Figure 5: Performance of the proposal under the one pool attack scenario. Figure 5(a) and 5(c) shows how the PoFL framework effectively mitigates both backdoor and labelflip attacks while FedAvg fails to do so. Figure 5(b) illustrates the overfitting issue observed with Krum and GeoMed in the labelflip attack, which is mitigated by their RFC variants.

		Loss based						Accuracy based
		Accuracy			Loss			Accuracy			Loss
		Final	Mean	Max	Final	Mean	Min	Final	Mean	Max	Final	Mean	Min
Dataset	Aggregator		Last 10			Last 10			Last 10			Last 10
Celeba-S	B-RFC	0.84	0.84	0.88	0.60	0.55	0.39	0.87	0.88	0.90	0.48	0.64	0.40
	Bulyan	0.73	0.83	0.89	1.36	0.70	0.42	0.89	0.84	0.89	0.37	0.53	0.37
	G-RFC	0.88	0.87	0.89	0.34	0.40	0.31	0.89	0.88	0.90	0.41	0.46	0.32

Table 6: Multi-client scenario with Labelflip attack: a comparison of loss-based and accuracy-based evaluations.

		Accuracy			Loss			Backdoor Accuracy			Backdoor Loss
		Final	Mean	Max	Final	Mean	Min	Final	Mean	Max	Final	Mean	Min
Dataset	Aggregator		Last 10			Last 10			Last 10			Last 10
Celeba-S	B-RFC	0.85	0.86	0.89	0.42	0.72	0.36	0.77	0.76	0.79	1.23	1.41	0.74
	Bulyan	0.85	0.83	0.87	0.42	0.65	0.42	0.72	0.73	0.78	1.20	1.55	0.76
	G-RFC	0.84	0.85	0.90	0.41	0.43	0.31	0.75	0.74	0.79	1.04	1.14	0.68
	GeoMed	0.86	0.86	0.89	0.55	0.53	0.31	0.77	0.75	0.79	1.14	1.33	0.73

Table 7: Multi-client scenario with Backdoor attack, using loss-based evaluation.

		Accuracy			Loss			Backdoor Accuracy			Backdoor Loss
		Final	Mean	Max	Final	Mean	Min	Final	Mean	Max	Final	Mean	Min
Dataset	Aggregator		Last 10			Last 10			Last 10			Last 10
Celeba-S	B-RFC	0.88	0.87	0.90	0.44	0.83	0.36	0.77	0.76	0.79	1.38	1.97	0.86
	Bulyan	0.80	0.83	0.89	1.45	0.68	0.42	0.73	0.74	0.78	1.88	1.49	0.88
	G-RFC	0.90	0.88	0.91	0.36	0.40	0.27	0.77	0.76	0.80	1.61	1.39	0.60
	GeoMed	0.86	0.87	0.89	0.42	0.42	0.33	0.73	0.76	0.80	1.21	1.27	0.78

Table 8: Multi-client scenario with Backdoor attack, using accuracy-based evaluation.

Panel of Figure 6 — Figure 6: Performance of the proposal under the multiple attack scenario. In Figure 6(a) , we observe how K-RFC is able to mitigate the backdoor attack, while PoFL and FedAvg fails to do so. In Figure 6(b) , we see how RFC is able to keep the loss low despite the presence of labelflip attacks, while other robust aggregators fail to do so.

Blockchain-Based Federated Learning

See all 9 papers

Dynamic Meta-Layer Aggregation for Byzantine-Robust Federated Learning
Mar 17, 2026Reek Das, Biplab Kanti SenByzantine-Robust Federated Learning Federated Learning Aggregation
APC Roy Government College · Assistant Professor, Department of Computer Science P.R. Thakur Government College
Kick Bad Guys Out! Conditionally Activated Anomaly Detection in Federated Learning with Zero-Knowledge Proof Verification
Oct 6, 2023Shanshan Han, Wenxuan Wu, Baturalp Buyukates +4Byzantine-Robust Federated Learning Adversarial Attacks
University of California, Irvine · Texas A&M University · University of Birmingham +3
AdaBFL: Multi-Layer Defensive Adaptive Aggregation for Bzantine-Robust Federated Learning
Apr 30, 2026Zehui Tang, Yuchen Liu, Feihu HuangFederated Learning Aggregation Byzantine-Robust Federated Learning
College of Computer Science and Technology, Nanjing University of Aeronautics and Astronautics, Nanjing, China · MIIT Key Laboratory of Pattern Analysis and Machine Intelligence, Nanjing, China.

Mar 17, 2026J/K move · Enter open · S save

Dynamic Meta-Layer Aggregation for Byzantine-Robust Federated Learning

Reek Das, Biplab Kanti Sen

APC Roy Government College · Assistant Professor, Department of Computer Science P.R. Thakur Government College

Byzantine-Robust Federated Learning Federated Learning Aggregation Federated Learning

Open paper AskPDF arXiv

Federated Learning (FL) is increasingly applied in sectors like healthcare, finance, and IoT, enabling collaborative model training while safeguarding user privacy. However, FL systems are susceptible to Byzantine adversaries that inject malicious updates, which can severely compromise global model performance. Existing defenses tend to focus on specific attack types and fail against untargeted strategies, such as multi-label flipping or combinations of noise and backdoor patterns. To overcome these limitations, we propose FedAOT-a novel defense mechanism that counters multi-label flipping and untargeted poisoning attacks using a metalearning-inspired adaptive aggregation framework. FedAOT dynamically weights client updates based on their reliability, suppressing adversarial influence without relying on predefined thresholds or restrictive attack assumptions. Notably, FedAOT generalizes effectively across diverse datasets and a wide range of attack types, maintaining robust performance even in previously unseen scenarios. Experimental results demonstrate that FedAOT substantially improves model accuracy and resilience while maintaining computational efficiency, offering a scalable and practical solution for secure federated learning.

Abstract

Blockchain-Based Federated Learning

Explore similar work

Dynamic Meta-Layer Aggregation for Byzantine-Robust Federated Learning

Kick Bad Guys Out! Conditionally Activated Anomaly Detection in Federated Learning with Zero-Knowledge Proof Verification

AdaBFL: Multi-Layer Defensive Adaptive Aggregation for Bzantine-Robust Federated Learning