FUSE: Fairness-aware Update Screening against Byzantine Exploitation in $q$-Fair Federated Learning

Tiantong Sun; Jinlin Liu; Xingru Wei; Zequan Fang; Wei Chen; Qiang Yang; Xiaojin Zhang

cs.LGOct 14, 2026

FUSE: Fairness-aware Update Screening against Byzantine Exploitation in $q$ -Fair Federated Learning

Authors: Tiantong Sun, Jinlin Liu, Xingru Wei, Zequan Fang, Wei Chen, Qiang Yang, Xiaojin Zhang

Organizations: George Mason University · The University of Hong Kong · Huazhong University of Science and Technology · The Chinese University of Hong Kong, Shenzhen ·

Abstract

Client-level fair federated learning, in the form of $q$ -fair federated learning ( $q$ -FFL), agnostic federated learning, or tilted empirical risk minimization, has emerged as an attractive solution to equalize utility across heterogeneous clients. This paradigm grants high-loss clients greater relative influence, while a central server aggregates their loss-weighted updates into a single shared model. Yet, the Byzantine robustness of $q$ -fair federated learning has been largely neglected, leaving the server unable to tell legitimate fairness-induced amplification from malicious update scaling. To address this critical gap, we formalize the problem of Byzantine-robust $q$ -fair federated learning under an update-only interface, in which the server observes nothing but the fairness-scaled client updates. Our analysis under shared class-conditional label skew shows that fairness scaling preserves the nonnegative class-mixture structure of honest updates, while replacing their unit-sum constraint by a client-dependent radial scale. Moving beyond magnitude-based screening, we show that this warped geometry supplies two complementary tests, one radial and one structural, that a single norm cannot provide. We then introduce FUSE, a structure-aware robust aggregator that uses a small trusted labeled dataset for coefficient recovery, scale and cone-consistency screening, and post-screening step-size control. Across four benchmarks and seven Byzantine attacks, FUSE improves seed-wise worst-attack accuracy over the strongest baseline on each benchmark by 3.9--30.1 percentage points, while largely preserving the influence of the high-loss honest clients that fairness is meant to protect.

Figures & tables

Figure 1: Update-only Byzantine-robust $q$ -fair federated learning. Honest clients submit loss-scaled updates $u_{i}=F_{i}^{q}\Delta_{i}$ , Byzantine clients may submit arbitrary vectors, and the server aggregates them into $w_{t+1}$ with the help of a small trusted labeled dataset. Because $q$ -fair learning legitimately enlarges the updates of high-loss honest clients, update magnitude alone cannot distinguish fairness-induced amplification from malicious scaling.

Figure 2: FUSE overview. Each fair update is decomposed over trusted class-conditioned directions by nonnegative least squares. The recovered mass $L_{i}=\|\widehat{a}_{i}\|_{1}$ tests for anomalous radial scaling; the normalized cone residual $D_{i}^{\rm cone}$ detects updates inconsistent with any nonnegative class mixture. FUSE removes scale outliers first, spends the remaining budget on the largest cone residuals, and reconstructs the client loss from the normalized coefficients for post-screening step-size control.

		High-loss honest rejected $\downarrow$		Byzantine rejected $\uparrow$
Dataset/model	Method	Pooled	Worst	Pooled	Worst
CIFAR-10/ResNet-18	H-nobs	$34.95_{\scriptscriptstyle\pm 1.62}$	$90.67_{\scriptscriptstyle\pm 2.53}$	$\underline{63.31}_{\scriptscriptstyle\pm 1.09}$	$\underline{0.00}_{\scriptscriptstyle\pm 0.00}$
	BOBA (cls.)	$\underline{0.33}_{\scriptscriptstyle\pm 0.27}$	$\underline{1.67}_{\scriptscriptstyle\pm 1.18}$	$27.12_{\scriptscriptstyle\pm 0.79}$	$\underline{0.00}_{\scriptscriptstyle\pm 0.00}$
	FUSE	$\mathbf{0.19}_{\scriptscriptstyle\pm 0.20}$	$\mathbf{1.00}_{\scriptscriptstyle\pm 0.91}$	$\mathbf{98.71}_{\scriptscriptstyle\pm 0.70}$	$\mathbf{94.83}_{\scriptscriptstyle\pm 2.16}$
MNIST/MLP	H-nobs	$35.71_{\scriptscriptstyle\pm 1.40}$	$91.67_{\scriptscriptstyle\pm 3.33}$	$\underline{61.07}_{\scriptscriptstyle\pm 1.43}$	$\underline{0.00}_{\scriptscriptstyle\pm 0.00}$
	BOBA (cls.)	$\underline{5.62}_{\scriptscriptstyle\pm 0.87}$	$\underline{21.67}_{\scriptscriptstyle\pm 2.04}$	$36.81_{\scriptscriptstyle\pm 2.40}$	$\underline{0.00}_{\scriptscriptstyle\pm 0.00}$

Table 2: Whom each screen actually rejects, five seeds. Left: the fraction (%) of the highest-loss 20% of honest submissions rejected, which fairness wants low. Right: the fraction (%) of Byzantine submissions rejected, which robustness wants high. Both pool the first 300 rounds and the seven attacks within a seed, reported as mean

{}_{\pm\text{std}}

over seeds 40–44; “worst” is the attack at which that column is worst in each seed. Best in bold, runner-up underlined.

Panel of Figure 3 — Figure 3: Fairness-warped geometry in practice. (a) Fairness scaling moves the simplex residual off the diagonal while leaving the cone residual nearly unchanged; hollow and filled points are $q=0$ and $q=1$ . (b) On MNIST (seed 42, $q=1$ ), radial and structural attacks occupy different regions of the $(L_{i},D_{i}^{\rm cone})$ plane, which is what motivates screening the two in sequence rather than with one test ( Sections E.3 and E.2 ).

Variant	Scale	Cone	Loss norm.	Clean	Magnitude	Sign	IPM λ=3	Gauss.	ALIE	Min-Max	Min-Sum	Worst attack
FUSE	✓	✓	✓	79.03	78.97	77.50	77.83	78.82	78.50	79.28	78.71	77.50 / 68.37
w/o scale	–	✓	✓	79.03	52.38	78.20	76.08	78.82	78.97	79.00	79.03	52.38/40.25
w/o cone	✓	–	✓	79.03	78.67	69.95	–	78.82	55.16	36.71	38.94	–
w/o scale and cone	–	–	✓	79.03	63.23	70.16	–	26.11	63.20	34.07	35.66	–
w/o loss norm.	✓	✓	–	78.04	70.06	73.33	74.01	77.89	76.98	76.04	76.02	70.06 / 59.88
cone only	–	✓	–	78.04	10.89	71.59	75.30	77.65	76.87	78.04	78.04	10.89/0.05

Table 3: Component ablation of FUSE. CIFAR-10/ResNet-18, seed 42, 1000 rounds. Attack columns give global accuracy (%) over the final ten rounds; the worst-attack column gives global / worst-10% client accuracy and is the componentwise minimum over the seven attacks. Clean uses

f=0

; “–” marks a run with no terminal window.

Figure 4: Sensitivity and budget misspecification on MNIST/MLP, seed 42. (a) Worst-attack accuracy over

q

. (b) Larger

\kappa

lowers honest FPR and raises retained fair mass, with accuracy within 91.18–91.20%. (c) When the declared budget stays at

f=4

while the true number of Byzantine submissions falls from 4 to 0, robustness is stable, but the surplus rejection budget is spent on honest clients: the worst retained fair mass drops from 84% to 61%. Over-declaring

f

therefore costs fairness rather than accuracy ( Appendix E ).

Appendix figures & tables42 assets

Supplementary material from the paper’s appendix.

Appendix

Dataset	Model	LR	Rounds	Classes	Batch	Weight decay
CIFAR-10	ResNet-18	0.03	1500	10	whole client	0
MNIST	MLP (784–200–10)	0.10	1000	10	whole client	$5\times 10^{-4}$
EMNIST-Balanced	five-layer CNN	0.03	1000	47	whole client	$5\times 10^{-4}$
AGNews	one-layer GRU	0.05	2000	4	whole client	$5\times 10^{-4}$

Appendix

Table 4: Dataset, model, and optimization settings used by the main comparison.

Method	Same fair update $u_{i}$	Extra trusted server data	Output	Uses declared $f$
q-FFL-GD (mean)	Yes	No	Shared global	No
H-nobs	Yes	No	Shared global	Yes
Trimmed Mean	Yes	No	Shared global	–
Median	Yes	No	Shared global	No documented dependence
Krum	Yes	No	Shared global	–
Multi-Krum	Yes	No	Shared global	–

Appendix

Table 5: Baseline information compatibility. “Same fair update” indicates whether the method is applied to the fairness-scaled client submission

u_{i}=F_{i}^{q}\Delta_{i}

used in our benchmark. A dash indicates that the corresponding detail is not documented or cannot be verified from the current manuscript repository.

Dataset	Clean	Sign	IPM	Gauss.	ALIE	Min-Max	Min-Sum	Mag.	Worst attack
CIFAR-10 / ResNet-18	78.34/68.84	11.01/0.30	collapsed (18)	76.29/66.97	24.27/11.68	45.57/33.37	65.26/53.62	62.50/51.41	11.01/0.30
MNIST / MLP	n/a	92.57/87.26	collapsed (17)	n/a	collapsed (779)	n/a	n/a	94.73/90.52	–
EMNIST-Balanced / CNN	n/a	n/a	2.69/0.17	n/a	n/a	n/a	n/a	n/a	–
AGNews / GRU	n/a	n/a	incomplete (1047)	n/a	n/a	n/a	n/a	n/a	–

Appendix

Table 6: Full-parameter BOBA, seed 42 (fidelity check). Affine subspace and simplex fitted in the full parameter space; global / worst-10% accuracy (%) over the registered final window. “collapsed (

r

)” = terminated by the registered collapse rule at round

r

; “n/a” = not run; “incomplete” = did not reach the endpoint within the compute budget.

Method	Clean	Sign	IPM λ=3	Gauss.	ALIE	Min-Max	Min-Sum	Magnitude	Worst attack
q-FFL-GD (mean)	$76.96_{\scriptscriptstyle\pm 8.6}$ / $67.34_{\scriptscriptstyle\pm 9.9}$	$76.47_{\scriptscriptstyle\pm 2.1}$ / $66.94_{\scriptscriptstyle\pm 2.7}$	-	$13.81_{\scriptscriptstyle\pm 3.3}$ / $4.71_{\scriptscriptstyle\pm 4.2}$ (3)	$63.43_{\scriptscriptstyle\pm 13.4}$ / $51.90_{\scriptscriptstyle\pm 14.7}$	$14.76_{\scriptscriptstyle\pm 1.4}$ / $2.24_{\scriptscriptstyle\pm 0.6}$ (4)	$14.05_{\scriptscriptstyle\pm 1.9}$ / $2.04_{\scriptscriptstyle\pm 0.9}$	$43.45_{\scriptscriptstyle\pm 31.2}$ / $32.27_{\scriptscriptstyle\pm 31.3}$ (4)	-
H-nobs	$76.96_{\scriptscriptstyle\pm 8.6}$ / $67.34_{\scriptscriptstyle\pm 9.9}$	$12.19_{\scriptscriptstyle\pm 1.9}$ / $0.35_{\scriptscriptstyle\pm 0.5}$ (3)	$57.13_{\scriptscriptstyle\pm 24.6}$ / $46.25_{\scriptscriptstyle\pm 24.8}$	$79.28_{\scriptscriptstyle\pm 3.7}$ / $70.03_{\scriptscriptstyle\pm 4.4}$	$35.65_{\scriptscriptstyle\pm 20.3}$ / $23.39_{\scriptscriptstyle\pm 19.8}$	$42.86_{\scriptscriptstyle\pm 32.1}$ / $31.99_{\scriptscriptstyle\pm 33.3}$	$20.15_{\scriptscriptstyle\pm 11.2}$ / $8.34_{\scriptscriptstyle\pm 9.5}$	$76.96_{\scriptscriptstyle\pm 8.6}$ / $67.34_{\scriptscriptstyle\pm 9.9}$	$12.19_{\scriptscriptstyle\pm 1.9}$ / $0.35_{\scriptscriptstyle\pm 0.5}$ (3)
Trimmed Mean	$70.56_{\scriptscriptstyle\pm 18.4}$ / $60.32_{\scriptscriptstyle\pm 20.4}$	$59.66_{\scriptscriptstyle\pm 7.7}$ / $46.72_{\scriptscriptstyle\pm 9.3}$	$44.84_{\scriptscriptstyle\pm 13.6}$ / $31.29_{\scriptscriptstyle\pm 15.2}$	$79.45_{\scriptscriptstyle\pm 3.5}$ / $70.42_{\scriptscriptstyle\pm 3.4}$	$39.27_{\scriptscriptstyle\pm 9.6}$ / $25.86_{\scriptscriptstyle\pm 8.8}$	$13.37_{\scriptscriptstyle\pm 2.1}$ / $1.31_{\scriptscriptstyle\pm 1.2}$	$14.06_{\scriptscriptstyle\pm 1.8}$ / $2.08_{\scriptscriptstyle\pm 1.1}$	$74.35_{\scriptscriptstyle\pm 7.3}$ / $64.41_{\scriptscriptstyle\pm 8.6}$	$13.18_{\scriptscriptstyle\pm 1.9}$ / $1.28_{\scriptscriptstyle\pm 1.1}$
Median	$45.02_{\scriptscriptstyle\pm 16.4}$ / $31.89_{\scriptscriptstyle\pm 15.2}$	$27.99_{\scriptscriptstyle\pm 2.4}$ / $14.01_{\scriptscriptstyle\pm 2.4}$	$23.83_{\scriptscriptstyle\pm 2.5}$ / $10.14_{\scriptscriptstyle\pm 2.8}$	$41.65_{\scriptscriptstyle\pm 14.1}$ / $28.89_{\scriptscriptstyle\pm 13.2}$	$24.71_{\scriptscriptstyle\pm 10.7}$ / $12.87_{\scriptscriptstyle\pm 9.3}$	$12.85_{\scriptscriptstyle\pm 1.5}$ / $1.32_{\scriptscriptstyle\pm 0.8}$	$12.73_{\scriptscriptstyle\pm 2.5}$ / $1.22_{\scriptscriptstyle\pm 1.0}$	$47.89_{\scriptscriptstyle\pm 9.8}$ / $34.11_{\scriptscriptstyle\pm 10.1}$	$12.34_{\scriptscriptstyle\pm 1.9}$ / $1.10_{\scriptscriptstyle\pm 0.9}$
Krum	$63.66_{\scriptscriptstyle\pm 17.4}$ / $51.97_{\scriptscriptstyle\pm 19.3}$	$44.69_{\scriptscriptstyle\pm 7.9}$ / $29.35_{\scriptscriptstyle\pm 6.8}$	$62.78_{\scriptscriptstyle\pm 17.7}$ / $51.13_{\scriptscriptstyle\pm 19.6}$	$60.21_{\scriptscriptstyle\pm 20.7}$ / $48.53_{\scriptscriptstyle\pm 21.7}$	$22.24_{\scriptscriptstyle\pm 11.2}$ / $10.14_{\scriptscriptstyle\pm 10.2}$	$61.58_{\scriptscriptstyle\pm 18.0}$ / $50.09_{\scriptscriptstyle\pm 19.5}$	$45.62_{\scriptscriptstyle\pm 14.3}$ / $32.93_{\scriptscriptstyle\pm 15.0}$	$63.56_{\scriptscriptstyle\pm 17.3}$ / $51.66_{\scriptscriptstyle\pm 18.9}$	$21.67_{\scriptscriptstyle\pm 10.4}$ / $9.78_{\scriptscriptstyle\pm 9.7}$
Multi-Krum	$80.15_{\scriptscriptstyle\pm 3.6}$ / $71.05_{\scriptscriptstyle\pm 4.6}$	$15.49_{\scriptscriptstyle\pm 4.9}$ / $3.79_{\scriptscriptstyle\pm 3.3}$ (3)	$68.36_{\scriptscriptstyle\pm 3.1}$ / $57.04_{\scriptscriptstyle\pm 2.4}$	$81.90_{\scriptscriptstyle\pm 1.5}$ / $73.17_{\scriptscriptstyle\pm 1.8}$	$39.70_{\scriptscriptstyle\pm 10.9}$ / $27.01_{\scriptscriptstyle\pm 10.2}$	$17.25_{\scriptscriptstyle\pm 5.7}$ / $4.71_{\scriptscriptstyle\pm 4.7}$	$19.64_{\scriptscriptstyle\pm 4.9}$ / $7.13_{\scriptscriptstyle\pm 3.8}$	$80.15_{\scriptscriptstyle\pm 3.6}$ / $71.05_{\scriptscriptstyle\pm 4.6}$	$12.97_{\scriptscriptstyle\pm 2.6}$ / $1.48_{\scriptscriptstyle\pm 1.3}$ (3)

Appendix

Table 7: CIFAR-10 / ResNet-18, rounds 1490–1499. Entries are global / worst-10% client accuracy (%), mean over seeds 40, 41, 42, 43, 44 with the across-seed standard deviation as subscript; the worst-attack column is the seed-wise minimum over the seven attacks, also mean with std subscript, over seeds completing all seven attacks.

Method	Clean	Sign	IPM λ=3	Gauss.	ALIE	Min-Max	Min-Sum	Magnitude	Worst attack
q-FFL-GD (mean)	$94.90_{\scriptscriptstyle\pm 1.3}$ / $90.72_{\scriptscriptstyle\pm 2.1}$	$93.24_{\scriptscriptstyle\pm 1.1}$ / $88.31_{\scriptscriptstyle\pm 1.5}$	-	$62.99_{\scriptscriptstyle\pm 42.5}$ / $54.32_{\scriptscriptstyle\pm 45.8}$ (3)	$94.29_{\scriptscriptstyle\pm 1.1}$ / $89.66_{\scriptscriptstyle\pm 1.6}$	$48.54_{\scriptscriptstyle\pm 33.0}$ / $37.24_{\scriptscriptstyle\pm 32.5}$ (3)	$56.03_{\scriptscriptstyle\pm 40.0}$ / $46.60_{\scriptscriptstyle\pm 40.4}$ (3)	$68.76_{\scriptscriptstyle\pm 49.7}$ / $63.08_{\scriptscriptstyle\pm 54.6}$ (3)	-
H-nobs	$94.90_{\scriptscriptstyle\pm 1.3}$ / $90.72_{\scriptscriptstyle\pm 2.1}$	$14.82_{\scriptscriptstyle\pm 4.0}$ / $1.91_{\scriptscriptstyle\pm 2.1}$ (3)	$91.09_{\scriptscriptstyle\pm 1.2}$ / $84.66_{\scriptscriptstyle\pm 2.3}$	$94.90_{\scriptscriptstyle\pm 1.3}$ / $90.72_{\scriptscriptstyle\pm 2.1}$	$93.45_{\scriptscriptstyle\pm 1.0}$ / $88.26_{\scriptscriptstyle\pm 1.3}$	$94.80_{\scriptscriptstyle\pm 1.4}$ / $90.59_{\scriptscriptstyle\pm 2.0}$	$65.54_{\scriptscriptstyle\pm 44.3}$ / $56.83_{\scriptscriptstyle\pm 49.0}$ (3)	$94.90_{\scriptscriptstyle\pm 1.3}$ / $90.72_{\scriptscriptstyle\pm 2.1}$	$14.82_{\scriptscriptstyle\pm 4.0}$ / $1.91_{\scriptscriptstyle\pm 2.1}$ (3)
Trimmed Mean	$94.90_{\scriptscriptstyle\pm 1.3}$ / $90.71_{\scriptscriptstyle\pm 2.1}$	$85.77_{\scriptscriptstyle\pm 4.4}$ / $75.80_{\scriptscriptstyle\pm 7.0}$	$87.30_{\scriptscriptstyle\pm 3.6}$ / $78.31_{\scriptscriptstyle\pm 6.1}$ (4)	$94.84_{\scriptscriptstyle\pm 1.4}$ / $90.46_{\scriptscriptstyle\pm 2.3}$	$65.65_{\scriptscriptstyle\pm 48.6}$ / $59.07_{\scriptscriptstyle\pm 51.2}$ (3)	$48.61_{\scriptscriptstyle\pm 34.4}$ / $37.79_{\scriptscriptstyle\pm 32.7}$ (3)	$48.74_{\scriptscriptstyle\pm 33.7}$ / $37.52_{\scriptscriptstyle\pm 32.5}$ (3)	$95.33_{\scriptscriptstyle\pm 1.3}$ / $91.29_{\scriptscriptstyle\pm 1.9}$	$48.24_{\scriptscriptstyle\pm 34.1}$ / $37.25_{\scriptscriptstyle\pm 32.3}$ (3)
Median	$66.04_{\scriptscriptstyle\pm 39.1}$ / $55.57_{\scriptscriptstyle\pm 42.6}$ (4)	$61.37_{\scriptscriptstyle\pm 44.3}$ / $51.79_{\scriptscriptstyle\pm 45.0}$ (3)	$86.33_{\scriptscriptstyle\pm 5.0}$ / $78.61_{\scriptscriptstyle\pm 6.5}$ (3)	$66.10_{\scriptscriptstyle\pm 48.8}$ / $59.72_{\scriptscriptstyle\pm 51.7}$ (3)	$67.35_{\scriptscriptstyle\pm 41.2}$ / $58.41_{\scriptscriptstyle\pm 47.1}$ (3)	$47.54_{\scriptscriptstyle\pm 32.9}$ / $36.27_{\scriptscriptstyle\pm 31.4}$ (3)	$47.25_{\scriptscriptstyle\pm 32.3}$ / $35.64_{\scriptscriptstyle\pm 30.9}$ (3)	$73.93_{\scriptscriptstyle\pm 42.4}$ / $68.19_{\scriptscriptstyle\pm 45.5}$ (4)	$65.88_{\scriptscriptstyle\pm 0.4}$ / $53.38_{\scriptscriptstyle\pm 0.6}$ (2)
Krum	$93.99_{\scriptscriptstyle\pm 1.4}$ / $89.24_{\scriptscriptstyle\pm 2.5}$	$90.45_{\scriptscriptstyle\pm 1.5}$ / $83.30_{\scriptscriptstyle\pm 2.7}$	$93.42_{\scriptscriptstyle\pm 1.3}$ / $88.42_{\scriptscriptstyle\pm 2.3}$	$93.99_{\scriptscriptstyle\pm 1.4}$ / $89.24_{\scriptscriptstyle\pm 2.5}$	$63.99_{\scriptscriptstyle\pm 46.7}$ / $56.77_{\scriptscriptstyle\pm 49.2}$ (3)	$94.00_{\scriptscriptstyle\pm 1.5}$ / $89.24_{\scriptscriptstyle\pm 2.6}$	$93.76_{\scriptscriptstyle\pm 1.2}$ / $88.61_{\scriptscriptstyle\pm 1.7}$	$93.99_{\scriptscriptstyle\pm 1.4}$ / $89.24_{\scriptscriptstyle\pm 2.5}$	$63.99_{\scriptscriptstyle\pm 46.7}$ / $56.14_{\scriptscriptstyle\pm 48.6}$ (3)
Multi-Krum	$94.72_{\scriptscriptstyle\pm 1.4}$ / $90.39_{\scriptscriptstyle\pm 2.3}$	$59.90_{\scriptscriptstyle\pm 43.4}$ / $46.41_{\scriptscriptstyle\pm 40.2}$ (3)	$90.27_{\scriptscriptstyle\pm 0.5}$ / $83.57_{\scriptscriptstyle\pm 1.1}$	$94.72_{\scriptscriptstyle\pm 1.4}$ / $90.39_{\scriptscriptstyle\pm 2.3}$	$66.22_{\scriptscriptstyle\pm 48.9}$ / $59.88_{\scriptscriptstyle\pm 51.9}$ (3)	$94.16_{\scriptscriptstyle\pm 1.0}$ / $89.52_{\scriptscriptstyle\pm 1.4}$	$61.54_{\scriptscriptstyle\pm 44.4}$ / $54.29_{\scriptscriptstyle\pm 47.1}$ (3)	$94.72_{\scriptscriptstyle\pm 1.4}$ / $90.39_{\scriptscriptstyle\pm 2.3}$	$59.90_{\scriptscriptstyle\pm 43.4}$ / $46.41_{\scriptscriptstyle\pm 40.2}$ (3)

Appendix

Table 8: MNIST / MLP, rounds 990–999. Entries are global / worst-10% client accuracy (%), mean over seeds 40, 41, 42, 43, 44 with the across-seed standard deviation as subscript; the worst-attack column is the seed-wise minimum over the seven attacks, also mean with std subscript, over seeds completing all seven attacks.

Method	Clean	Sign	IPM λ=3	Gauss.	ALIE	Min-Max	Min-Sum	Magnitude	Worst attack
q-FFL-GD (mean)	$63.79_{\scriptscriptstyle\pm 34.5}$ / $57.08_{\scriptscriptstyle\pm 32.0}$	$74.93_{\scriptscriptstyle\pm 2.5}$ / $66.23_{\scriptscriptstyle\pm 3.0}$	-	$2.13_{\scriptscriptstyle\pm 0.0}$ / $0.00_{\scriptscriptstyle\pm 0.0}$ (1)	$53.66_{\scriptscriptstyle\pm 44.6}$ / $46.71_{\scriptscriptstyle\pm 40.4}$ (3)	$44.08_{\scriptscriptstyle\pm 36.5}$ / $36.43_{\scriptscriptstyle\pm 31.8}$ (3)	$27.01_{\scriptscriptstyle\pm 38.2}$ / $21.24_{\scriptscriptstyle\pm 34.3}$ (3)	$65.81_{\scriptscriptstyle\pm 35.6}$ / $58.92_{\scriptscriptstyle\pm 33.0}$	-
H-nobs	$63.79_{\scriptscriptstyle\pm 34.5}$ / $57.08_{\scriptscriptstyle\pm 32.0}$	$28.70_{\scriptscriptstyle\pm 37.6}$ / $21.64_{\scriptscriptstyle\pm 30.6}$ (2)	$78.66_{\scriptscriptstyle\pm 1.5}$ / $70.66_{\scriptscriptstyle\pm 1.5}$	$63.79_{\scriptscriptstyle\pm 34.5}$ / $57.08_{\scriptscriptstyle\pm 32.0}$	$78.55_{\scriptscriptstyle\pm 0.6}$ / $69.11_{\scriptscriptstyle\pm 0.4}$ (3)	$52.75_{\scriptscriptstyle\pm 43.8}$ / $45.63_{\scriptscriptstyle\pm 39.5}$ (3)	$50.65_{\scriptscriptstyle\pm 42.0}$ / $43.19_{\scriptscriptstyle\pm 37.4}$ (3)	$63.79_{\scriptscriptstyle\pm 34.5}$ / $57.08_{\scriptscriptstyle\pm 32.0}$	$28.70_{\scriptscriptstyle\pm 37.6}$ / $21.64_{\scriptscriptstyle\pm 30.6}$ (2)
Trimmed Mean	$80.30_{\scriptscriptstyle\pm 0.5}$ / $72.43_{\scriptscriptstyle\pm 0.6}$	$63.17_{\scriptscriptstyle\pm 1.7}$ / $52.69_{\scriptscriptstyle\pm 2.0}$	$54.93_{\scriptscriptstyle\pm 4.5}$ / $44.44_{\scriptscriptstyle\pm 3.9}$ (4)	$63.28_{\scriptscriptstyle\pm 34.3}$ / $56.28_{\scriptscriptstyle\pm 31.6}$	$66.82_{\scriptscriptstyle\pm 18.7}$ / $57.29_{\scriptscriptstyle\pm 18.9}$ (4)	$25.45_{\scriptscriptstyle\pm 20.2}$ / $17.89_{\scriptscriptstyle\pm 15.6}$ (3)	$34.35_{\scriptscriptstyle\pm 29.2}$ / $26.51_{\scriptscriptstyle\pm 24.6}$ (3)	$64.13_{\scriptscriptstyle\pm 34.7}$ / $56.61_{\scriptscriptstyle\pm 31.7}$	$37.11_{\scriptscriptstyle\pm 1.8}$ / $26.83_{\scriptscriptstyle\pm 2.4}$ (2)
Median	$71.43_{\scriptscriptstyle\pm 10.3}$ / $60.98_{\scriptscriptstyle\pm 11.1}$ (4)	$45.35_{\scriptscriptstyle\pm 21.3}$ / $34.82_{\scriptscriptstyle\pm 19.9}$	$58.80_{\scriptscriptstyle\pm 6.6}$ / $47.41_{\scriptscriptstyle\pm 7.3}$	$59.14_{\scriptscriptstyle\pm 30.2}$ / $49.74_{\scriptscriptstyle\pm 29.3}$ (3)	$65.63_{\scriptscriptstyle\pm 9.7}$ / $56.19_{\scriptscriptstyle\pm 9.3}$ (4)	$17.57_{\scriptscriptstyle\pm 26.8}$ / $12.35_{\scriptscriptstyle\pm 21.4}$ (3)	$30.96_{\scriptscriptstyle\pm 25.1}$ / $22.84_{\scriptscriptstyle\pm 20.0}$ (3)	$78.51_{\scriptscriptstyle\pm 0.5}$ / $68.41_{\scriptscriptstyle\pm 0.1}$ (3)	$15.72_{\scriptscriptstyle\pm 23.6}$ / $10.51_{\scriptscriptstyle\pm 18.2}$ (3)
Krum	$78.49_{\scriptscriptstyle\pm 0.8}$ / $70.12_{\scriptscriptstyle\pm 0.7}$	$7.35_{\scriptscriptstyle\pm 2.5}$ / $1.24_{\scriptscriptstyle\pm 1.0}$ (2)	$78.64_{\scriptscriptstyle\pm 0.7}$ / $70.15_{\scriptscriptstyle\pm 0.7}$	$78.49_{\scriptscriptstyle\pm 0.8}$ / $70.12_{\scriptscriptstyle\pm 0.7}$	$71.34_{\scriptscriptstyle\pm 4.5}$ / $60.74_{\scriptscriptstyle\pm 4.7}$ (3)	$47.92_{\scriptscriptstyle\pm 39.7}$ / $39.93_{\scriptscriptstyle\pm 34.6}$ (3)	$4.12_{\scriptscriptstyle\pm 3.5}$ / $1.02_{\scriptscriptstyle\pm 1.8}$ (3)	$78.49_{\scriptscriptstyle\pm 0.8}$ / $70.12_{\scriptscriptstyle\pm 0.7}$	$5.12_{\scriptscriptstyle\pm 4.2}$ / $0.97_{\scriptscriptstyle\pm 1.4}$ (2)
Multi-Krum	$80.49_{\scriptscriptstyle\pm 0.5}$ / $72.46_{\scriptscriptstyle\pm 0.6}$	$62.69_{\scriptscriptstyle\pm 2.9}$ / $52.43_{\scriptscriptstyle\pm 3.1}$ (3)	$78.71_{\scriptscriptstyle\pm 1.3}$ / $70.46_{\scriptscriptstyle\pm 1.2}$ (4)	$80.49_{\scriptscriptstyle\pm 0.5}$ / $72.46_{\scriptscriptstyle\pm 0.6}$	$60.16_{\scriptscriptstyle\pm 22.1}$ / $49.78_{\scriptscriptstyle\pm 23.1}$ (4)	$38.19_{\scriptscriptstyle\pm 31.3}$ / $30.24_{\scriptscriptstyle\pm 26.3}$ (3)	$38.14_{\scriptscriptstyle\pm 31.2}$ / $30.05_{\scriptscriptstyle\pm 26.1}$ (3)	$80.49_{\scriptscriptstyle\pm 0.5}$ / $72.46_{\scriptscriptstyle\pm 0.6}$	38.14/30.05

Appendix

Table 9: EMNIST-Balanced / CNN, rounds 990–999. Entries are global / worst-10% client accuracy (%), mean over seeds 40, 41, 42, 43, 44 with the across-seed standard deviation as subscript; the worst-attack column is the seed-wise minimum over the seven attacks, also mean with std subscript, over seeds completing all seven attacks.

Method	Clean	Sign	IPM λ=3	Gauss.	ALIE	Min-Max	Min-Sum	Magnitude	Worst attack
q-FFL-GD (mean)	$81.52_{\scriptscriptstyle\pm 3.0}$ / $68.95_{\scriptscriptstyle\pm 2.7}$	$64.00_{\scriptscriptstyle\pm 2.0}$ / $49.40_{\scriptscriptstyle\pm 4.7}$	-	$27.06_{\scriptscriptstyle\pm 0.7}$ / $16.92_{\scriptscriptstyle\pm 1.0}$ (4)	$73.23_{\scriptscriptstyle\pm 9.0}$ / $59.00_{\scriptscriptstyle\pm 8.9}$	$40.49_{\scriptscriptstyle\pm 15.2}$ / $23.90_{\scriptscriptstyle\pm 11.6}$	$45.40_{\scriptscriptstyle\pm 18.0}$ / $29.31_{\scriptscriptstyle\pm 16.8}$ (4)	$76.35_{\scriptscriptstyle\pm 22.8}$ / $64.38_{\scriptscriptstyle\pm 26.1}$	-
H-nobs	$81.52_{\scriptscriptstyle\pm 3.0}$ / $68.95_{\scriptscriptstyle\pm 2.7}$	$26.69_{\scriptscriptstyle\pm 1.4}$ / $0.56_{\scriptscriptstyle\pm 0.9}$ (3)	$81.62_{\scriptscriptstyle\pm 2.6}$ / $67.99_{\scriptscriptstyle\pm 3.4}$	$81.52_{\scriptscriptstyle\pm 3.0}$ / $68.95_{\scriptscriptstyle\pm 2.7}$	$77.53_{\scriptscriptstyle\pm 0.5}$ / $62.83_{\scriptscriptstyle\pm 2.2}$	$72.91_{\scriptscriptstyle\pm 13.2}$ / $58.16_{\scriptscriptstyle\pm 13.7}$	$73.71_{\scriptscriptstyle\pm 1.5}$ / $58.29_{\scriptscriptstyle\pm 2.0}$	$81.52_{\scriptscriptstyle\pm 3.0}$ / $68.95_{\scriptscriptstyle\pm 2.7}$	$26.69_{\scriptscriptstyle\pm 1.4}$ / $0.56_{\scriptscriptstyle\pm 0.9}$ (3)
Trimmed Mean	$81.57_{\scriptscriptstyle\pm 2.9}$ / $69.06_{\scriptscriptstyle\pm 2.5}$	$36.61_{\scriptscriptstyle\pm 2.9}$ / $8.79_{\scriptscriptstyle\pm 6.4}$	$35.88_{\scriptscriptstyle\pm 2.7}$ / $6.90_{\scriptscriptstyle\pm 6.6}$	$79.67_{\scriptscriptstyle\pm 5.9}$ / $66.55_{\scriptscriptstyle\pm 7.0}$	$74.76_{\scriptscriptstyle\pm 0.9}$ / $59.20_{\scriptscriptstyle\pm 2.3}$	$38.63_{\scriptscriptstyle\pm 13.4}$ / $19.84_{\scriptscriptstyle\pm 9.6}$	$39.37_{\scriptscriptstyle\pm 13.5}$ / $22.11_{\scriptscriptstyle\pm 8.3}$	$79.89_{\scriptscriptstyle\pm 3.0}$ / $67.29_{\scriptscriptstyle\pm 2.2}$	$30.85_{\scriptscriptstyle\pm 2.9}$ / $5.71_{\scriptscriptstyle\pm 4.7}$
Median	$66.83_{\scriptscriptstyle\pm 4.0}$ / $46.50_{\scriptscriptstyle\pm 7.0}$	$40.53_{\scriptscriptstyle\pm 3.8}$ / $15.32_{\scriptscriptstyle\pm 5.6}$	$37.58_{\scriptscriptstyle\pm 4.7}$ / $12.00_{\scriptscriptstyle\pm 9.2}$	$72.53_{\scriptscriptstyle\pm 1.6}$ / $54.11_{\scriptscriptstyle\pm 3.7}$	$70.64_{\scriptscriptstyle\pm 1.3}$ / $55.17_{\scriptscriptstyle\pm 1.7}$	$49.33_{\scriptscriptstyle\pm 11.0}$ / $30.59_{\scriptscriptstyle\pm 9.1}$	$49.01_{\scriptscriptstyle\pm 10.7}$ / $29.42_{\scriptscriptstyle\pm 9.9}$	$64.82_{\scriptscriptstyle\pm 18.3}$ / $48.88_{\scriptscriptstyle\pm 17.5}$	$33.50_{\scriptscriptstyle\pm 3.8}$ / $9.20_{\scriptscriptstyle\pm 4.8}$
Krum	$72.69_{\scriptscriptstyle\pm 10.1}$ / $56.90_{\scriptscriptstyle\pm 10.1}$	$77.17_{\scriptscriptstyle\pm 2.6}$ / $60.86_{\scriptscriptstyle\pm 5.0}$	$76.62_{\scriptscriptstyle\pm 6.7}$ / $58.96_{\scriptscriptstyle\pm 10.6}$	$72.69_{\scriptscriptstyle\pm 10.1}$ / $56.90_{\scriptscriptstyle\pm 10.1}$	$72.18_{\scriptscriptstyle\pm 1.6}$ / $56.64_{\scriptscriptstyle\pm 0.7}$	$77.42_{\scriptscriptstyle\pm 5.2}$ / $62.50_{\scriptscriptstyle\pm 6.7}$	$74.77_{\scriptscriptstyle\pm 13.3}$ / $59.40_{\scriptscriptstyle\pm 16.2}$	$72.69_{\scriptscriptstyle\pm 10.1}$ / $56.90_{\scriptscriptstyle\pm 10.1}$	$64.43_{\scriptscriptstyle\pm 9.9}$ / $48.20_{\scriptscriptstyle\pm 12.1}$
Multi-Krum	$76.02_{\scriptscriptstyle\pm 9.9}$ / $62.24_{\scriptscriptstyle\pm 10.6}$	$66.96_{\scriptscriptstyle\pm 11.5}$ / $46.28_{\scriptscriptstyle\pm 12.4}$	$73.08_{\scriptscriptstyle\pm 13.2}$ / $56.59_{\scriptscriptstyle\pm 17.9}$	$76.02_{\scriptscriptstyle\pm 9.9}$ / $62.24_{\scriptscriptstyle\pm 10.6}$	$74.87_{\scriptscriptstyle\pm 1.1}$ / $57.84_{\scriptscriptstyle\pm 2.0}$	$78.23_{\scriptscriptstyle\pm 4.6}$ / $64.39_{\scriptscriptstyle\pm 3.1}$	$66.27_{\scriptscriptstyle\pm 5.5}$ / $49.22_{\scriptscriptstyle\pm 5.5}$	$76.02_{\scriptscriptstyle\pm 9.9}$ / $62.24_{\scriptscriptstyle\pm 10.6}$	$58.34_{\scriptscriptstyle\pm 5.5}$ / $38.31_{\scriptscriptstyle\pm 8.0}$

Appendix

Table 10: AGNews / GRU, rounds 1990–1999. Entries are global / worst-10% client accuracy (%), mean over seeds 40, 41, 42, 43, 44 with the across-seed standard deviation as subscript; the worst-attack column is the seed-wise minimum over the seven attacks, also mean with std subscript, over seeds completing all seven attacks.

Dataset	Baseline	FUSE worst attack	Baseline worst attack	$\Delta$ [95% CI]	$p$ ( $n$ )
CIFAR-10 / ResNet-18	q-FFL-GD (mean)	73.88	-	-	-
CIFAR-10 / ResNet-18	H-nobs	73.88	12.19	+63.89 [+56.93, +67.83]	0.250 (3)
CIFAR-10 / ResNet-18	Trimmed Mean	73.88	13.18	+60.70 [+52.08, +67.62]	0.062 (5)
CIFAR-10 / ResNet-18	Median	73.88	12.34	+61.53 [+53.51, +68.25]	0.062 (5)
CIFAR-10 / ResNet-18	Krum	73.88	21.67	+52.21 [+43.96, +61.29]	0.062 (5)
CIFAR-10 / ResNet-18	Multi-Krum	73.88	12.97	+63.12 [+56.20, +66.92]	0.250 (3)

Appendix

Table 12: Seed-wise worst-attack accuracy of FUSE minus each baseline (global accuracy, percentage points). Worst-attack values are computed per seed as the minimum over the seven attacks; seeds in which either method collapsed under any attack are excluded from that pair (

n

is the number of paired seeds). CI: 95% percentile bootstrap over paired seeds;

p

: exact two-sided sign-flip test.

Figure 5: CIFAR-10/ResNet-18 training dynamics. Worst-10% client accuracy (%) over 1500 communication rounds.

Figure 6: MNIST/MLP training dynamics. Worst-10% client accuracy (%) over 1000 communication rounds.

Figure 7: EMNIST-Balanced/CNN training dynamics. Worst-10% client accuracy (%) over 1000 communication rounds.

Figure 8: AGNews/GRU training dynamics. Worst-10% client accuracy (%) over 2000 communication rounds.

Panel of Figure 9 — Figure 9: Experimental validation of the geometric analysis. Recovered mass tracks the fairness scale (a), normalized coefficients support loss reconstruction (b), and the two screening statistics separate complementary attack patterns (c).

Variant	Scale	Cone	Loss norm.	Clean	Magnitude	Sign	IPM λ=3	Gauss.	ALIE	Min-Max	Min-Sum	Worst attack
FUSE	✓	✓	✓	79.03 / 70.41	78.97 / 70.38	77.50 / 68.37	77.83 / 68.91	78.82 / 69.57	78.50 / 69.28	79.28 / 70.73	78.71 / 69.93	77.50 / 68.37
w/o scale	–	✓	✓	79.03 / 70.41	52.38/40.25	78.20 / 69.08	76.08 / 66.91	78.82 / 69.57	78.97 / 70.16	79.00 / 70.29	79.03 / 70.41	52.38/40.25
w/o cone	✓	–	✓	79.03 / 70.41	78.67 / 70.09	69.95/59.40	–	78.82 / 69.57	55.16/42.83	36.71/24.49	38.94/27.18	–
w/o scale and cone	–	–	✓	79.03 / 70.41	63.23/51.72	70.16/59.92	–	26.11/13.69	63.20/50.88	34.07/22.76	35.66/23.99	–
w/o loss norm.	✓	✓	–	78.04 / 69.52	70.06/59.88	73.33/63.97	74.01/64.70	77.89 / 68.61	76.98/67.90	76.04/67.28	76.02/67.30	70.06 / 59.88
cone only	–	✓	–	78.04 / 69.52	10.89/0.05	71.59/62.06	75.30/65.97	77.65/69.14	76.87/68.40	78.04/69.52	78.04/69.52	10.89/0.05

Appendix

Table 13: Component ablation of FUSE. CIFAR-10/ResNet-18, seed 42, 1000 rounds. Global / worst-10% client accuracy (%) over the final ten rounds; the worst-attack column is the componentwise minimum over the seven attacks. Clean uses

f=0

; “–” marks a run with no terminal window.

Variant	Scale	Cone	Loss norm.	Clean	Magnitude	Sign	IPM λ=3	Gauss.	ALIE	Min-Max	Min-Sum	Worst attack
FUSE	✓	✓	✓	93.95 / 89.26	93.94/89.23	93.20/88.09	92.35 / 87.01	93.95 / 89.26	93.94/89.14	93.94/89.23	93.96/89.26	92.35 / 87.01
w/o scale	–	✓	✓	93.95 / 89.26	94.40 / 89.91	93.22/88.23	91.83/86.29	93.95 / 89.26	93.95/89.27	93.95/89.26	93.95/89.26	91.83/86.29
w/o cone	✓	–	✓	93.95 / 89.26	93.96/89.27	92.43/87.07	–	93.95 / 89.26	93.97/89.38	89.06/83.15	55.42/41.64	–
w/o scale and cone	–	–	✓	93.95 / 89.26	95.14 / 89.63	92.39/87.11	–	52.87/39.71	93.96/89.21	89.78/84.07	79.52/69.42	–
w/o loss norm.	✓	✓	–	93.97 / 89.29	93.98/89.26	93.24 / 88.15	92.34 / 87.06	93.97 / 89.29	93.96/89.14	93.98 / 89.29	93.98 / 89.29	92.34 / 87.06
cone only	–	✓	–	93.97 / 89.29	–	93.27 / 88.25	92.09/86.73	93.97 / 89.29	93.98 / 89.29	93.97 / 89.29	93.97 / 89.29	–

Appendix

Table 14: Component ablation of FUSE. MNIST/MLP, seed 42, 1000 rounds. Global / worst-10% client accuracy (%) over the final ten rounds; the worst-attack column is the componentwise minimum over the seven attacks. Clean uses

f=0

; “–” marks a run with no terminal window.

Variant	Scale	Cone	Loss norm.	Clean	Magnitude	Sign	IPM λ=3	Gauss.	ALIE	Min-Max	Min-Sum	Worst attack
FUSE	✓	✓	✓	79.59 / 70.34	79.59/70.34	79.31 / 70.05	79.51 / 70.33	79.30 / 69.89	79.70 / 70.65	79.59 / 70.34	79.59 / 70.34	79.30 / 69.89
w/o scale	–	✓	✓	79.59 / 70.34	82.69 / 74.52	79.31 / 70.05	79.21 / 70.12	79.30 / 69.89	79.70 / 70.65	79.59 / 70.34	79.59 / 70.34	79.21 / 69.89
w/o cone	✓	–	✓	79.59 / 70.34	79.59/70.34	71.50/62.16	–	79.30 / 69.89	77.99/68.66	58.36/46.70	59.18/47.88	–
w/o scale and cone	–	–	✓	79.59 / 70.34	82.47 / 73.37	71.50/62.16	–	–	77.99/68.66	58.36/46.70	59.18/47.88	–
w/o loss norm.	✓	✓	–	80.34 / 71.73	80.34/71.73	–	–	20.01 / 11.20	58.01/48.11	80.34 / 71.73	80.34 / 71.73	–
cone only	–	✓	–	80.34 / 71.73	–	–	–	20.01 / 11.20	58.01/48.11	80.34 / 71.73	80.34 / 71.73	–

Appendix

Table 15: Component ablation of FUSE. EMNIST-Balanced/CNN, seed 42, 1000 rounds. Global / worst-10% client accuracy (%) over the final ten rounds; the worst-attack column is the componentwise minimum over the seven attacks. Clean uses

f=0

; “–” marks a run with no terminal window.

Variant	Scale	Cone	Loss norm.	Clean	Magnitude	Sign	IPM λ=3	Gauss.	ALIE	Min-Max	Min-Sum	Worst attack
FUSE	✓	✓	✓	83.66 / 68.09	83.65/68.09	79.45/62.86	81.56/65.49	83.35 / 67.62	81.31 / 68.09	83.14 / 67.13	82.94/66.88	79.45 / 62.86
w/o scale	–	✓	✓	83.64 / 68.03	86.53/73.99	83.64 / 68.03	83.64 / 68.03	83.65 / 68.06	80.44/66.99	83.64 / 68.03	83.70 / 68.16	80.44 / 66.99
w/o cone	✓	–	✓	83.66 / 68.09	83.66/68.09	–	–	28.34/17.87	80.53/67.12	40.94/16.66	55.80/37.26	–
w/o scale and cone	–	–	✓	83.66 / 68.09	86.90 / 75.05	–	–	28.41/16.32	81.26 / 67.35	43.55/21.00	56.08/36.75	–
w/o loss norm.	✓	✓	–	81.93/66.28	81.93/66.28	62.69/46.97	68.08/50.74	35.92/25.22	71.58/58.13	76.38/62.02	84.18 / 68.95	35.92/25.22
cone only	–	✓	–	81.93/66.28	67.41/46.86	81.93 / 66.28	81.93 / 66.28	81.93/66.33	77.01/63.68	81.93/66.28	79.36/62.37	67.41/46.86

Appendix

Table 16: Component ablation of FUSE. AGNews/GRU, seed 42, 2000 rounds. Global / worst-10% client accuracy (%) over the final ten rounds; the worst-attack column is the componentwise minimum over the seven attacks. Clean uses

f=0

; “–” marks a run with no terminal window.

Figure 10: Uncurated version of Figure 9 (c). MNIST, seed 42, $q=1$ , all 1000 rounds of the clean and seven attacked runs; a plain random subsample of 3,000 honest and 1,500 submissions per attack with no quantile filtering. The shaded box is bounded by $\kappa=2.5$ and the honest 95th-percentile cone residual (0.26); the gray dotted line and band are the median and interquartile range of the per-round Stage II cutoff (0.52, [0.24, 0.88]). Gaussian submissions are on the broken right axis. Sign Flip and IPM overlap the honest box in 69.8% and 68.4% of rounds; Min-Max and Min-Sum coincide.

Attack	Recall $\uparrow$	Honest FPR $\downarrow$	Fair mass $\uparrow$	Scale used	Cone used
Sign Flip	58.4	16.7	82.9	0.15	3.85
IPM ( $\lambda=3$ )	59.4	16.2	83.6	0.06	3.94
Gaussian	100.0	0.0	100.0	4.00	0.00
ALIE	94.9	2.0	97.3	0.17	3.83
Min-Max	99.6	0.2	99.8	0.01	3.98
Min-Sum	99.7	0.1	99.8	0.03	3.97

Appendix

Table 17: Stage-wise detection on MNIST, seed 42. Statistics are pooled over all 1000 rounds. Recall, honest FPR, and fair mass are percentages; fair mass is the retained fraction of honest

F_{i}^{q}

mass.

Dataset	Screened coords.	$q$	$F_{i}$ med. [p10, p90]	$\\|\hat{a}_{i}\\|_{1}$ med.	$D^{\rm cone}$ med. / p90	$D^{\rm simplex}$ med. / p90	gap med. / p90	$\Pr[D^{\rm simplex}>D^{\rm cone}]$
CIFAR-10 / ResNet-18	classifier (5,130)	0	0.92 [0.81, 1.18]	0.65	0.080 / 0.111	0.102 / 0.175	+0.024 / +0.066	1.00
		1	0.92 [0.81, 1.18]	0.59	0.080 / 0.111	0.111 / 0.223	+0.035 / +0.113	1.00
	full (11,173,962)	0	0.92 [0.81, 1.18]	0.28	0.823 / 0.890	1.242 / 1.660	+0.427 / +0.799	1.00
		1	0.92 [0.81, 1.18]	0.26	0.823 / 0.890	1.307 / 2.079	+0.502 / +1.267	1.00
MNIST / MLP	classifier (2,010)	0	0.24 [0.20, 0.30]	0.88	0.178 / 0.297	0.185 / 0.306	+0.008 / +0.047	1.00
		1	0.24 [0.20, 0.30]	0.21	0.178 / 0.297	1.077 / 3.247	+0.899 / +3.057	1.00

Appendix

Table 18: Unit-sum simplex versus nonnegative cone on identical inputs. For each dataset the FUSE run’s seed-43 checkpoint at round 600 is loaded, the next ten rounds’ honest clients are replayed with the production local step (10 clients per round, 100 submissions), and the production server basis

G

(20 trusted examples per class) is built once per round. Each honest update

\Delta_{i}

is submitted as

u_{i}=F_{i}^{q}\Delta_{i}

with

q=0

(plain update) and

q=1

(the paper’s fairness-scaled vector,

F_{i}

= start-of-round loss).

D^{\rm cone}=\min_{a\geq 0}\|Su_{i}-Ga\|^{2}/\|Su_{i}\|^{2}

and

D^{\rm simplex}=\min_{p\geq 0,\mathbf{1}^{\top}p=1}\|Su_{i}-Gp\|^{2}/\|Su_{i}\|^{2}

(energy ratios) are computed in the same screened coordinates

S

with the aggregator’s own solvers;

\|\hat{a}_{i}\|_{1}

is the mass of the cone fit. Medians over the 100 submissions; the gap is

D^{\rm simplex}-D^{\rm cone}

and is positive in every case. No optimizer, trajectory, attack or aggregation rule is involved.

Figure 11: Unit-sum versus cone residual for the same honest submissions. Each panel uses that dataset’s own screening coordinates (classifier block on the three vision benchmarks, all parameters on AGNews), seed-43 checkpoint at round 600, rounds 600–609 (100 submissions per dataset); plain updates ( $q=0$ , hollow) and fairness-scaled submissions ( $q=1$ , filled). Every point lies above the diagonal; log axes.

Structural model	$q$	Clean	Sign Flip	Magnitude	IPM	Min-Max	Min-Sum
No screening	1	93.95/89.26	92.39/87.11	95.20/90.06	n/a	n/a	n/a
Simplex screening	0	96.55/92.13	96.44/91.93	96.62/92.33	n/a	n/a	n/a
Simplex screening	1	93.95/89.26	93.85/89.08	93.95/89.26	89.91/83.98	92.91/87.46	92.83/87.40
Scale + cone	1	93.95/89.26	93.20/88.09	93.96/89.27	92.35/87.01	93.94/89.23	93.96/89.26

Appendix

Table 19: Controlled fairness-warp mechanism test on MNIST/MLP, seed 42, 1000 rounds. Entries are global / worst-10% client accuracy (%) over rounds 990–999; “n/a” = condition not run. The two

q=1

screening rows differ only in the Stage II score (unit-sum simplex distance versus nonnegative-cone distance); everything else, including Stage I and the loss-normalized aggregation, is identical.

	Simplex screening, $q=1$			Scale + cone, $q=1$
Attack	Recall	Honest FPR	Global acc.	Recall	Honest FPR	Global acc.
Sign Flip	0.92	0.03	93.85	0.58	0.17	93.20
Magnitude	0.99	0.00	93.95	0.99	0.00	93.96
IPM	0.45	0.22	89.91	0.62	0.15	92.35
Min-Max	0.56	0.18	92.91	1.00	0.00	93.94
Min-Sum	0.62	0.15	92.83	1.00	0.00	93.96

Appendix

Table 20: Screening behavior behind the two

q=1

rows of Table 19 : Byzantine recall and honest false-rejection rate, pooled over all 1000 rounds (4 Byzantine and 10 honest submissions per round).

Figure 12: Checkpoint recovery of client loss scale across $q$ . Each panel plots $x=\log F_{i}$ against $y=q^{-1}\log L_{i}=\log L_{i}^{1/q}$ for all 100 honest clients at the matched round-299 checkpoint; the diagonal is $y=x$ . Pearson $r$ , Spearman $\rho$ , ordinary-least-squares slope, and mean absolute log error (MALE) use all points. Axes retain equal scaling and show the central 98% only for visualization.

$q$	Pearson $r$	Spearman $\rho$	OLS slope	MALE
0.1	0.153	0.179	1.88	3.997
0.5	0.400	0.355	1.11	0.695
1.0	0.608	0.537	1.02	0.301
1.5	0.736	0.670	1.00	0.180
2.0	0.817	0.751	1.00	0.123
3.0	0.903	0.848	0.99	0.070

Appendix

Table 21: Numerical summary of Fig. 12 . Perfect loss-scale recovery has Pearson and Spearman correlation one, slope one, and zero mean absolute log error.

$E$	Clean	Sign	IPM λ=3	Gauss.	ALIE	Min-Max	Min-Sum	Magnitude	Worst	honest $D^{\rm cone}$ med/p90	$r(L_{i},F_{i}^{q})$	recall / FPR
1	93.95/89.26	93.20/88.09	92.35/87.01	93.95/89.26	93.94/89.14	93.94/89.23	93.96/89.26	93.96/89.27	92.35/87.01	0.139/0.238	0.944	0.88 / 0.05
2	94.98/90.37	92.85/87.57	91.33/85.96	94.98/90.37	94.95/90.22	95.01/90.41	95.01/90.45	94.98/90.37	91.33/85.96	0.246/0.391	0.981	0.81 / 0.08
5	96.06/91.42	94.07/89.02	91.45/85.78	96.06/91.42	96.03/91.49	96.04/91.47	96.05/91.52	96.06/91.42	91.45/85.78	0.358/0.530	0.976	0.79 / 0.08

Appendix

Table 22: Local-step sensitivity (MNIST/MLP, seed 42,

q=1

, 1000 rounds). Clients take

E

full-batch local steps and upload

F_{i}(w_{t})^{q}(w_{i}-w_{t})

with the start-of-round loss; server references use the same

E

steps. Accuracy is global / worst-10% over rounds 990–999; the worst attack is the minimum over the seven attacks. Honest cone residual and the Pearson correlation between

L_{i}=\|\hat{a}_{i}\|_{1}

and

F_{i}^{q}

are pooled over all rounds of the clean run; recall and honest FPR are pooled over the seven attacked runs.

$q$	0.5	1.0	1.5	2.0
Worst-attack global accuracy	91.57	91.18	90.84	90.47
Worst-attack worst-10% accuracy	86.21	85.62	85.16	84.85
$\kappa$	2.0	2.5	3.0	3.5
Worst-attack global / worst-10%	91.20 /85.60	91.18/ 85.62	91.19 / 85.61	91.18/ 85.61
Honest FPR	5.71	5.00	4.14	4.14
Retained fair mass	93.66	94.70	95.75	95.74

Appendix

Table 23: Final-method MNIST/MLP sensitivity, seed 42, rounds 290–299. Worst-attack results use all seven attacks; FPR and retained fair mass are pooled across attacked conditions. Entries are percentages.

Dataset	Honest loss quantile	Rejection rate	Retained fair mass	Rejection share
CIFAR-10/ResNet-18	0–50%	3.15%	97.45%	58.41%
	50–80%	1.44%	98.99%	16.05%
	80–100%	3.45%	96.64%	25.54%
MNIST	0–50%	4.74%	95.42%	46.82%
	50–80%	5.19%	95.20%	30.76%
	80–100%	5.67%	94.65%	22.41%

Appendix

Table 24: Honest-client rejection by within-round start-loss quantile, pooled over the seven attacked conditions. Rejection share is the fraction of all rejected honest observations contributed by the row.

Dataset/model	Sign	IPM λ=3	Gauss.	ALIE	Min-Max	Min-Sum	Magnitude	Pooled	All honest
CIFAR-10/ResNet-18	$89.09_{\scriptscriptstyle\pm 7.27}$	$99.17_{\scriptscriptstyle\pm 0.78}$	$100.00_{\scriptscriptstyle\pm 0.00}$	$81.43_{\scriptscriptstyle\pm 5.53}$	$98.22_{\scriptscriptstyle\pm 1.91}$	$99.86_{\scriptscriptstyle\pm 0.13}$	$100.00_{\scriptscriptstyle\pm 0.00}$	$95.23_{\scriptscriptstyle\pm 2.32}$	$97.63_{\scriptscriptstyle\pm 0.58}$
MNIST/MLP	$82.64_{\scriptscriptstyle\pm 5.71}$	$89.40_{\scriptscriptstyle\pm 2.91}$	$100.00_{\scriptscriptstyle\pm 0.00}$	$92.17_{\scriptscriptstyle\pm 5.93}$	$98.46_{\scriptscriptstyle\pm 3.24}$	$98.45_{\scriptscriptstyle\pm 3.47}$	$100.00_{\scriptscriptstyle\pm 0.00}$	$94.27_{\scriptscriptstyle\pm 2.87}$	$96.01_{\scriptscriptstyle\pm 1.07}$
EMNIST-Balanced/CNN	$99.18_{\scriptscriptstyle\pm 0.47}$	$99.26_{\scriptscriptstyle\pm 0.51}$	$100.00_{\scriptscriptstyle\pm 0.00}$	$99.13_{\scriptscriptstyle\pm 0.38}$	$100.00_{\scriptscriptstyle\pm 0.00}$	$100.00_{\scriptscriptstyle\pm 0.00}$	$100.00_{\scriptscriptstyle\pm 0.00}$	$99.65_{\scriptscriptstyle\pm 0.17}$	$99.21_{\scriptscriptstyle\pm 0.34}$
AGNews/GRU	$90.28_{\scriptscriptstyle\pm 10.73}$	$97.79_{\scriptscriptstyle\pm 2.34}$	$100.00_{\scriptscriptstyle\pm 0.00}$	$57.33_{\scriptscriptstyle\pm 6.03}$	$98.49_{\scriptscriptstyle\pm 2.00}$	$98.58_{\scriptscriptstyle\pm 1.82}$	$100.00_{\scriptscriptstyle\pm 0.00}$	$91.40_{\scriptscriptstyle\pm 1.92}$	$94.54_{\scriptscriptstyle\pm 0.66}$

Appendix

Table 25: Per-attack high-loss retention, five seeds. Retained fair mass (%) of the highest-loss 20% of honest clients, mean

{}_{\pm\text{std}}

over seeds 40–44, pooled over rounds

r

with

(r+1)\bmod 10=0

. The last column is the retained fair mass of all honest clients (pooled over attacks).

Dataset	Aggregation	Clean	Worst attack
CIFAR-10/ResNet-18	server-loss q-FFL	69.13/59.12	63.38 / 52.19
	mean- $u$	79.25 / 70.60	57.01/45.18
	loss-normalized	82.19 / 72.98	76.92 / 67.30
MNIST/MLP	server-loss q-FFL	95.54 / 91.46	93.86 / 88.96
	mean- $u$	93.98/89.29	92.81 / 87.69
	recovered q-FFL	95.56 / 91.47	–

Appendix

Table 26: Post-screening aggregation controls, seed 42. Entries are global / worst-10% client accuracy (%). Worst attack is the componentwise minimum across the available attacked conditions. A dash indicates that at least one required attack lacks a final window.

Dataset	Denominator exponent	Clean	Worst attack
CIFAR-10/CNN	$q+1$	39.80 / 27.55	39.70 / 27.45
CIFAR-10/CNN	$q$	46.53 / 34.15	46.35 / 33.93
MNIST/MLP	$q+1$	93.93 / 89.23	92.75 / 87.64
MNIST/MLP	$q$	93.95 / 89.26	92.77 / 87.60
EMNIST/CNN	$q+1$	–	–
EMNIST/CNN	$q$	79.55 / 70.28	78.68 / 69.37

Appendix

Table 27: Loss-normalization exponent control, seed 42. Entries are global / worst-10% client accuracy (%). CIFAR-10 uses the auxiliary five-layer CNN in this controlled comparison. A dash for EMNIST means that all eight conditions (Clean and seven attacks) met the registered collapse criterion.

Method	$\lambda=1$	$\lambda=2$	$\lambda=3$
FUSE	81.73 / 73.35	80.26 / 71.32	81.43 / 72.18
server-loss q-FFL aggregation	66.43/55.37	63.38/52.19	62.89/51.65
mean- $u$ aggregation	78.86 / 69.87	76.64 / 68.34	72.31 / 61.88

Appendix

Table 28: CIFAR-10/ResNet-18 sign-reversal strength, seed 42. Entries are global / worst-10% client accuracy (%).

Declared $f$	Worst attack (global / worst-10% accuracy, %)
2	81.91/74.58
4	92.35 / 87.01
6	92.86 / 87.63

Appendix

Table 29: Declared-budget sensitivity for final FUSE on MNIST, seed 42, with four actual Byzantine submissions.

Checkpoint	Classifier energy	Classifier overlap	Full energy	Full overlap
Round 299	0.892	0.978	0.249	0.703
Round 599	0.901	0.972	0.161	0.595
Round 899	0.918	0.967	0.120	0.461
Round 1499	0.852	0.975	0.051	0.337

Appendix

Table 30: Empirical validity of the trusted screening geometry at fixed CIFAR-10/ResNet-18 checkpoints. Captured energy is the fraction of honest update energy represented by the trusted class span; oracle overlap compares the trusted span with an all-client-data class-span oracle.

Repeats	Projection energy	Negative coefficient mass	Loss MAE	Time (s)
1	0.9223	14.5973	1.7817	0.408
6	0.9237	5.1632	1.2567	1.061
12	0.9234	7.6181	1.3797	1.793
24	0.9236	6.6128	1.4823	3.358
64	0.9236	7.0401	1.4833	8.584

Appendix

Table 31: Trusted augmentation repeats at fixed CIFAR-10/ResNet-18 checkpoints, classifier coordinates, seed 42.

Samples/class	Worst attack (global / worst-10% accuracy, %)
1	90.30/84.44
20	92.35 / 87.01
50	92.79 / 87.52

Appendix

Table 32: Trusted-size sensitivity for final FUSE on MNIST, seed 42.

Dirichlet $\alpha$	Worst attack (global / worst-10% accuracy, %)
0.1	92.70 /86.93
0.5	92.86 / 87.98
1.0	92.35/ 87.01

Appendix

Table 33: Label-skew sensitivity for final FUSE on MNIST, seed 42.

Dataset	Numerical rank	$\sigma_{\min}$	Condition number
CIFAR-10/ResNet-18	10 [10, 10]	0.0823 [0.0649, 0.0971]	6.78 [5.77, 9.22]
MNIST	10 [10, 10]	0.0590 [0.0529, 0.0785]	8.64 [7.60, 9.99]
EMNIST-Balanced	47 [47, 47]	0.0968 [0.0145, 0.1951]	14.26 [7.18, 34.02]
AGNews	4 [4, 4]	0.0286 [0.0157, 0.0456]	4.09 [1.73, 7.09]

Appendix

Table 34: Numerical identifiability of the trusted basis over completed rounds and conditions. Values are median [5th, 95th percentile].

Method	Server time/round	Client vectors	Extra client statistics
q-FFL-GD	1.71 ms	1	none
H-nobs	3.05 ms	1	none
BOBA	478.18 ms	1	none
FUSE	1387.10 ms	1	none

Appendix

Table 35: Measured server-side time per attacked round with 14 submissions. All listed methods communicate one model-shaped vector per client.

Dataset/model	Matched $f_{t}=0$	Always-on $f_{t}=4$
CIFAR-10/ResNet-18	82.25	79.68
MNIST/MLP	93.83	93.78
EMNIST-Balanced/CNN	79.12	80.06

Appendix

Table 36: Clean accuracy (%) with a matched budget (

f_{t}=0

) and an over-declared always-on budget (

f_{t}=4

), five seeds.

Actual Byzantine	Sign	IPM λ=3	Gauss.	ALIE	Min-Max	Min-Sum	Magnitude
1 of 14: accuracy	93.76/88.86	93.61/88.76	93.95/89.32	93.92/89.32	93.95/89.30	93.95/89.29	93.93/89.32
recall / honest FPR	0.77 / 0.32	0.78 / 0.32	1.00 / 0.30	0.49 / 0.35	1.00 / 0.30	1.00 / 0.30	1.00 / 0.30
retained top-20% fair mass	0.71	0.73	0.75	0.69	0.75	0.75	0.75
2 of 14: accuracy	93.58/88.67	93.28/88.37	93.97/89.21	93.92/89.28	93.97/89.26	93.97/89.22	93.97/89.21
recall / honest FPR	0.74 / 0.25	0.75 / 0.25	1.00 / 0.20	0.45 / 0.31	1.00 / 0.20	1.00 / 0.20	1.00 / 0.20
retained top-20% fair mass	0.80	0.79	0.85	0.73	0.84	0.85	0.85

Appendix

Table 37: Declared budget

f=4

with fewer actual Byzantine submissions (MNIST/MLP, seed 42,

q=1

, 1000 rounds). Global / worst-10% accuracy over rounds 990–999; below each block, Byzantine recall, honest false-rejection rate, and the retained fair mass of the highest-loss 20% of honest clients, pooled over all rounds. Actual

=0

is the over-declared clean run; actual

=4

is the matched main-table run.

Window	Clean	Surrogate	Oracle	Slack	Mixture
Rounds 200–299	54.1	20.9	13.6	12.7	19.3
Rounds 1490–1499	82.4	65.6	–	–	–

Appendix

Table 38: CIFAR-10 diagnostic accuracy (%) under adaptive cone-preserving attacks. The 300-round values describe the mid-training window and are not terminal 1500-round conclusions.

Federated Learning

Federated learning trains shared models across data holders without requiring them to pool their raw data.

See all 951 papers

Byzantine-Resilient Federated Learning via QUBO-Based Client Selection on Quantum Annealers
May 14, 2026Andras Ferenczi, Sutapa Samanta, Dagen Wang +1Federated Learning Aggregation Byzantine-Robust Federated Learning
American Express Co · American Express Co. · Columbia University
Enhanced Byzantine-Robust Federated Learning Via Truncated-Quadratic Loss for Heterogeneous Data
Jul 13, 2026Zhi-Yong Wang, Hao Nan Sheng, Werner Stefan +3Federated Learning Aggregation Byzantine-Robust Federated Learning
State Key Laboratory of Ocean Sensing, Ocean College, Zhejiang University, Hangzhou, China · Department of Electrical Engineering, City University of Hong Kong, Hong Kong, China · Department of Information and Communications Engineering, Aalto University, 02150 Espoo, Finland +1
FedIDM: Achieving Fast and Stable Convergence in Byzantine Federated Learning through Iterative Distribution Matching
Apr 16, 2026He Yang, Dongyi Lv, Wei Xi +3Federated Learning Aggregation Byzantine-Robust Federated Learning

May 14, 2026J/K move · Enter open · S save

Byzantine-Resilient Federated Learning via QUBO-Based Client Selection on Quantum Annealers

Andras Ferenczi, Sutapa Samanta, Dagen Wang, Jason Qizhe Qin

American Express Co · American Express Co. · Columbia University

Federated Learning Aggregation Byzantine-Robust Federated Learning Quantum Annealing Client Selection in Federated Learning Federated Learning

Open paper AskPDF arXiv

Federated Learning (FL) trains a global model across decentralized clients while preserving data privacy, but at scale it is vulnerable to malicious updates. Byzantine-resilient aggregation methods such as MultiKrum score gradients against their nearest neighbors and can miss malicious updates that preserve the statistical properties of honest ones. We propose a quantum annealing approach that reformulates client selection as a Quadratic Unconstrained Binary Optimization (QUBO) problem, encoding pairwise distances into a cost function solved by quantum annealers (QA). Unlike MultiKrum's greedy per-client scoring, the QUBO formulation jointly optimizes over all subsets to find the mutually closest group of

m

clients. At small scale (15 clients), QUBO outperforms MultiKrum on the most challenging Byzantine attacks: e.g., Advanced LIE is detected with 95.11% accuracy versus 81.33% on MNIST and 97.78% versus 75.56% on CIFAR-10. QUBO fares poorly on simpler attacks where MultiKrum excels, so the two methods are complementary. QUBO quality also degrades as the number of clients grows. To address this, we introduce a MultiSignal ensemble that uses a dual-feature routing gate based on Euclidean and cosine Krum score gaps to classify attacks into four regimes and routes evasion attacks to a suspicion-penalized QUBO with agreement voting. At 100 clients on MNIST, MultiSignal achieves 95.3% average detection accuracy versus 91.8% for classical MultiKrum, with the largest gains on Sparse Lie (72.0% to 95.2%, +23.2 points) and Advanced Lie (80.4% to 85.2%, +4.8 points). These results show that QUBO-based quantum annealing with MultiSignal is a principled and scalable defense against the most challenging Byzantine strategies in federated learning.

Abstract

Federated Learning

Explore similar work

Byzantine-Resilient Federated Learning via QUBO-Based Client Selection on Quantum Annealers

Enhanced Byzantine-Robust Federated Learning Via Truncated-Quadratic Loss for Heterogeneous Data

FedIDM: Achieving Fast and Stable Convergence in Byzantine Federated Learning through Iterative Distribution Matching