Byzantine-Robust Federated Learning

Follow this topic Ask about this topic

Byzantine-robust federated learning studies how to train a shared model when some participating clients may be faulty or malicious, without centralizing their data. Common defenses replace simple averaging with coordinate medians or trimmed means, Krum-style distance selection, geometric-median or clustering methods, and trust, anomaly, or history-based screening; newer systems also combine these with secure aggregation, differential privacy, or proofs of correct computation. Methods are tested on non-IID image and text benchmarks, intrusion detection and medical data, and increasingly decentralized, asynchronous, or edge settings, where partial participation and client diversity complicate detection. The central tension is separating malicious updates from legitimate variation while retaining accuracy and convergence: adaptive or coordinated attacks can evade filters, and guarantees often depend on assumptions about attacker numbers, honest-client structure, or available reference data.

Latest papers

84 papers15 papers in the last four weeks, up 7% on the four weeks before. 0.1% of all new papers.

Apr 16, 2026

FedIDM: Achieving Fast and Stable Convergence in Byzantine Federated Learning through Iterative Distribution Matching

Most existing Byzantine-robust federated learning (FL) methods suffer from slow and unstable convergence. Moreover, when handling a substantial proportion of colluded malicious clients, achieving robustness typically entails compromising model utility. To address these issues, this work introduces FedIDM, which employs distribution matching to construct trustworthy condensed data for identifying and filtering abnormal clients. FedIDM consists of two main components: (1) attack-tolerant condensed data generation, and (2) robust aggregation with negative contribution-based rejection. These components exclude local updates that (1) deviate from the update direction derived from condensed data, or (2) cause a significant loss on the condensed dataset. Comprehensive evaluations on three benchmark datasets demonstrate that FedIDM achieves fast and stable convergence while maintaining acceptable model utility, under multiple state-of-the-art Byzantine attacks involving a large number of malicious clients.

He Yang, Dongyi Lv, Wei Xi +3

Federated Learning Aggregation Byzantine-Robust Federated Learning Dataset Condensation

Apr 10, 2026

XFED: Non-Collusive Model Poisoning Attack Against Byzantine-Robust Federated Classifiers

Model poisoning attacks pose a significant security threat to Federated Learning (FL). Most existing model poisoning attacks rely on collusion, requiring adversarial clients to coordinate by exchanging local benign models and synchronizing the generation of their poisoned updates. However, sustaining such coordination is increasingly impractical in real-world FL deployments, as it effectively requires botnet-like control over many devices. This approach is costly to maintain and highly vulnerable to detection. This context raises a fundamental question: Can model poisoning attacks remain effective without any communication between attackers? To address this challenge, we introduce and formalize the non-collusive attack model, in which all compromised clients share a common adversarial objective but operate independently. Under this model, each attacker generates its malicious update without communicating with other adversaries, accessing other clients' updates, or relying on any knowledge of server-side defenses. To demonstrate the feasibility of this threat model, we propose XFED, the first aggregation-agnostic, non-collusive model poisoning attack. Our empirical evaluation across six benchmark datasets shows that XFED bypasses eight state-of-the-art defenses and outperforms six existing model poisoning attacks. These findings indicate that FL systems are substantially less secure than previously believed and underscore the urgent need for more robust and practical defense mechanisms.

Israt Jahan Mouri, Muhammad Ridowan, Muhammad Abdullah Adnan

Bangladesh University of Engineering and Technology (BUET), Dhaka, Bangladesh · TigerIT Bangladesh Ltd., Dhaka, Bangladesh

Federated Learning Byzantine-Robust Federated Learning

Apr 4, 2026

SecureAFL: Secure Asynchronous Federated Learning

Federated learning (FL) enables multiple clients to collaboratively train a global machine learning model via a server without sharing their private training data. In traditional FL, the system follows a synchronous approach, where the server waits for model updates from numerous clients before aggregating them to update the global model. However, synchronous FL is hindered by the straggler problem. To address this, the asynchronous FL architecture allows the server to update the global model immediately upon receiving any client's local model update. Despite its advantages, the decentralized nature of asynchronous FL makes it vulnerable to poisoning attacks. Several defenses tailored for asynchronous FL have been proposed, but these mechanisms remain susceptible to advanced attacks or rely on unrealistic server assumptions. In this paper, we introduce SecureAFL, an innovative framework designed to secure asynchronous FL against poisoning attacks. SecureAFL improves the robustness of asynchronous FL by detecting and discarding anomalous updates while estimating the contributions of missing clients. Additionally, it utilizes Byzantine-robust aggregation techniques, such as coordinate-wise median, to integrate the received and estimated updates. Extensive experiments on various real-world datasets demonstrate the effectiveness of SecureAFL.

Anjun Gao, Feng Wang, Zhenglin Wan +3

University of Louisville, Louisville, USA · Northeastern University, Shenyang, China · National University of Singapore, Singapore, Singapore +1

Federated Learning Asynchronous Federated Learning Federated Learning Aggregation Byzantine-Robust Federated Learning

Apr 3, 2026

Enhancing Robustness of Federated Learning via Server Learning

This paper explores the use of server learning for enhancing the robustness of federated learning against malicious attacks even when clients' training data are not independent and identically distributed. We propose a heuristic algorithm that uses server learning and client update filtering in combination with geometric median aggregation. We demonstrate via experiments that this approach can achieve significant improvement in model accuracy even when the fraction of malicious clients is high, even more than

50\%

in some cases, and the dataset utilized by the server is small and could be synthetic with its distribution not necessarily close to that of the clients' aggregated data.

Van Sy Mai, Kushal Chakrabarti, Richard J. La +1

National Institute of Standards and Technology (NIST), Gaithersburg, MD 20899, USA · Tata Consultancy Services Research, Mumbai, Maharashtra 400607, India · the University of Maryland, College Park, MD 20742, USA +1

Federated Learning Byzantine-Robust Federated Learning Federated Learning Aggregation Non-IID Federated Learning

Mar 30, 2026

FedFG: Privacy-Preserving and Robust Federated Learning via Flow-Matching Generation

Federated learning (FL) enables distributed clients to collaboratively train a global model using local private data. Nevertheless, recent studies show that conventional FL algorithms still exhibit deficiencies in privacy protection, and the server lacks a reliable and stable aggregation rule for updating the global model. This situation creates opportunities for adversaries: on the one hand, they may eavesdrop on uploaded gradients or model parameters, potentially leaking benign clients' private data; on the other hand, they may compromise clients to launch poisoning attacks that corrupt the global model. To balance accuracy and security, we propose FedFG, a robust FL framework based on flow-matching generation that simultaneously preserves client privacy and resists sophisticated poisoning attacks. On the client side, each local network is decoupled into a private feature extractor and a public classifier. Each client is further equipped with a flow-matching generator that replaces the extractor when interacting with the server, thereby protecting private features while learning an approximation of the underlying data distribution. Complementing the client-side design, the server employs a client-update verification scheme and a novel robust aggregation mechanism driven by synthetic samples produced by the flow-matching generator. Experiments on MNIST, FMNIST, and CIFAR-10 demonstrate that, compared with prior work, our approach adapts to multiple attack strategies and achieves higher accuracy while maintaining strong privacy protection.

Ruiyang Wang, Rong Pan, Zhengan Yao

School of Mathematics, Sun Yat-sen University, Guangzhou 510275, China · School of Computer Science and Engineering, Sun Yat-sen University, Guangzhou 510006, China · Institute of Advanced Studies Hong Kong, Sun Yat-sen University, Hong Kong

Privacy-Preserving Federated Learning Federated Learning Byzantine-Robust Federated Learning

Mar 26, 2026

Agentic Trust Coordination for Federated Learning through Adaptive Thresholding and Autonomous Decision Making in Sustainable and Resilient Industrial Networks

Distributed intelligence in industrial networks increasingly integrates sensing, communication, and computation across heterogeneous and resource constrained devices. Federated learning (FL) enables collaborative model training in such environments, but its reliability is affected by inconsistent client behaviour, noisy sensing conditions, and the presence of faulty or adversarial updates. Trust based mechanisms are commonly used to mitigate these effects, yet most remain statistical and heuristic, relying on fixed parameters or simple adaptive rules that struggle to accommodate changing operating conditions. This paper presents a lightweight agentic trust coordination approach for FL in sustainable and resilient industrial networks. The proposed Agentic Trust Control Layer operates as a server side control loop that observes trust related and system level signals, interprets their evolution over time, and applies targeted trust adjustments when instability is detected. The approach extends prior adaptive trust mechanisms by enabling context aware intervention decisions, rather than relying on fixed or purely reactive parameter updates. By explicitly separating observation, reasoning, and action, the proposed framework supports stable FL operation without modifying client side training or increasing communication overhead.

Paul Shepherd, Tasos Dagiuklas, Bugra Alkan +1

London South Bank University, London, UK. · Instituto de Telecomunica¸c˜oes, Aveiro, Portugal.

Trust-Aware Federated Learning Industrial Internet of Things Federated Learning Byzantine-Robust Federated Learning

Mar 24, 2026

Byzantine-Robust and Differentially Private Federated Optimization under Weaker Assumptions

Federated Learning (FL) enables heterogeneous clients to collaboratively train a shared model without centralizing their raw data, offering an inherent level of privacy. However, gradients and model updates can still leak sensitive information, while malicious servers may mount adversarial attacks such as Byzantine manipulation. These vulnerabilities highlight the need to address differential privacy (DP) and Byzantine robustness within a unified framework. Existing approaches, however, often rely on unrealistic assumptions such as bounded gradients, require auxiliary server-side datasets, or fail to provide convergence guarantees. We address these limitations by proposing Byz-Clip21-SGD2M, a new algorithm that integrates robust aggregation with double momentum and carefully designed clipping. We prove high-probability convergence guarantees under standard

L

-smoothness and

σ

-sub-Gaussian gradient noise assumptions, thereby relaxing conditions that dominate prior work. Our analysis recovers state-of-the-art convergence rates in the absence of adversaries and improves utility guarantees under Byzantine and DP settings. Empirical evaluations on CNN and MLP models trained on MNIST further validate the effectiveness of our approach.

Rustem Islamov, Grigory Malinovsky, Alexander Gaponov +3

University of Basel, Switzerland · KAUST, Saudi Arabia · MBZUAI, UAE

Byzantine-Robust Federated Learning Differentially Private Federated Learning Federated Learning Aggregation Differentially Private Stochastic Gradient Descent

Mar 19, 2026

FedAgain: A Trust-Based and Robust Federated Learning Strategy for an Automated Kidney Stone Identification in Ureteroscopy

The reliability of artificial intelligence (AI) in medical imaging critically depends on its robustness to heterogeneous and corrupted images acquired with diverse devices across different hospitals which is highly challenging. Therefore, this paper introduces FedAgain, a trust-based Federated Learning (Federated Learning) strategy designed to enhance robustness and generalization for automated kidney stone identification from endoscopic images. FedAgain integrates a dual trust mechanism that combines benchmark reliability and model divergence to dynamically weight client contributions, mitigating the impact of noisy or adversarial updates during aggregation. The framework enables the training of collaborative models across multiple institutions while preserving data privacy and promoting stable convergence under real-world conditions. Extensive experiments across five datasets, including two canonical benchmarks (MNIST and CIFAR-10), two private multi-institutional kidney stone datasets, and one public dataset (MyStone), demonstrate that FedAgain consistently outperforms standard Federated Learning baselines under non-identically and independently distributed (non-IID) data and corrupted-client scenarios. By maintaining diagnostic accuracy and performance stability under varying conditions, FedAgain represents a practical advance toward reliable, privacy-preserving, and clinically deployable federated AI for medical imaging.

Ivan Reyes-Amezcua, Francisco Lopez-Tiro, Clément Larose +3

Centro de Investigación y de Estudios Avanzados del IPN (CINVESTAV), Departamento de Ciencias Computacionales, Guadalajara, 45017, Jalisco, Mexico · Escuela de Ingeniería y Ciencias, Tecnológico de Monterrey, Monterrey, 64849, N.L., Mexico · CRAN UMR 7039, Université de Lorraine and CNRS, Vandœuvre-lès-Nancy, France +1

Trust-Aware Federated Learning Federated Learning Federated Learning Aggregation Non-IID Federated Learning Byzantine-Robust Federated Learning Endoscopy

Mar 17, 2026

Dynamic Meta-Layer Aggregation for Byzantine-Robust Federated Learning

Federated Learning (FL) is increasingly applied in sectors like healthcare, finance, and IoT, enabling collaborative model training while safeguarding user privacy. However, FL systems are susceptible to Byzantine adversaries that inject malicious updates, which can severely compromise global model performance. Existing defenses tend to focus on specific attack types and fail against untargeted strategies, such as multi-label flipping or combinations of noise and backdoor patterns. To overcome these limitations, we propose FedAOT-a novel defense mechanism that counters multi-label flipping and untargeted poisoning attacks using a metalearning-inspired adaptive aggregation framework. FedAOT dynamically weights client updates based on their reliability, suppressing adversarial influence without relying on predefined thresholds or restrictive attack assumptions. Notably, FedAOT generalizes effectively across diverse datasets and a wide range of attack types, maintaining robust performance even in previously unseen scenarios. Experimental results demonstrate that FedAOT substantially improves model accuracy and resilience while maintaining computational efficiency, offering a scalable and practical solution for secure federated learning.

Reek Das, Biplab Kanti Sen

APC Roy Government College · Assistant Professor, Department of Computer Science P.R. Thakur Government College

Byzantine-Robust Federated Learning Federated Learning Aggregation Federated Learning

Mar 12, 2026

Byzantine-Robust Optimization under $(L_0, L_1)$ -Smoothness

We consider distributed optimization under Byzantine attacks in the presence of

(L_0,L_1)

-smoothness, a generalization of standard

L

-smoothness that captures functions with state-dependent gradient Lipschitz constants. We propose Byz-NSGDM, a normalized stochastic gradient descent method with momentum that achieves robustness against Byzantine workers while maintaining convergence guarantees. Our algorithm combines momentum normalization with Byzantine-robust aggregation enhanced by Nearest Neighbor Mixing (NNM) to handle both the challenges posed by

(L_0,L_1)

-smoothness and Byzantine adversaries. We prove that Byz-NSGDM achieves a convergence rate of

O(K^{-1/4})

up to a Byzantine bias floor proportional to the robustness coefficient and gradient heterogeneity. Experimental validation on heterogeneous MNIST classification, synthetic

(L_0,L_1)

-smooth optimization, and character-level language modeling with a small GPT model demonstrates the effectiveness of our approach against various Byzantine attack strategies. An ablation study further shows that Byz-NSGDM is robust across a wide range of momentum and learning rate choices.

Arman Bolatov, Samuel Horváth, Martin Takáč +1

Mohamed bin Zayed University of Artificial Intelligence, UAE

Distributed Optimization Byzantine-Robust Federated Learning Stochastic Gradient Descent

Mar 12, 2026

Decentralized Orchestration Architecture for Fluid Computing: A Secure Distributed AI Use Case

Distributed AI and IoT applications increasingly execute across heterogeneous resources spanning end devices, edge/fog infrastructure, and cloud platforms, often under different administrative domains. Fluid Computing has emerged as a promising paradigm for enhancing massive resource management across the computing continuum by treating such resources as a unified fabric, enabling optimal service-agnostic deployments driven by application requirements. However, existing solutions remain largely centralized and often do not explicitly address multi-domain considerations. This paper proposes an agnostic multi-domain orchestration architecture for fluid computing environments. The orchestration plane enables decentralized coordination among domains that maintain local autonomy while jointly realizing intent-based deployment requests from tenants, ensuring end-to-end placement and execution. To this end, the architecture elevates domain-side control services as first-class capabilities to support application-level enhancement at runtime. As a representative proof of concept, we instantiate the architecture through a distributed AI use case; specifically, we consider a multi-domain Decentralized Federated Learning (DFL) deployment under Byzantine threats. Under this setting, we leverage domain-side capabilities to enhance Byzantine security by introducing FU-HST, an SDN-enabled multi-domain anomaly detection mechanism that complements Byzantine-robust aggregation. We validate the use-case workflow via simulation in single- and multi-domain settings, evaluating anomaly detection, DFL performance, and computation/communication overhead.

Diego Cajaraville-Aboy, Ana Fernández-Vilas, Rebeca P. Díaz-Redondo +2

atlanTTic Research Center – ICLAB – Universidade de Vigo, Vigo, 36310, Spain

Byzantine-Robust Federated Learning Edge-Cloud Computing Federated Learning

Mar 3, 2026

Zero-Knowledge Federated Learning with Lattice-Based Hybrid Encryption for Quantum-Resilient Medical AI

Federated Learning (FL) enables collaborative training of medical AI models across hospitals without centralizing patient data. However, the exchange of model updates exposes critical vulnerabilities: gradient inversion attacks can reconstruct patient information, Byzantine clients can poison the global model, and the Harvest Now, Decrypt Later (HNDL) threat renders today's encrypted traffic vulnerable to future quantum adversaries.We introduce ZKFL-PQ (Zero-Knowledge Federated Learning, Post-Quantum), a three-tiered cryptographic protocol that hybridizes (i) ML-KEM (FIPS~203) for quantum-resistant key encapsulation, (ii) lattice-based Zero-Knowledge Proofs for verifiable norm-constrained gradient integrity, and (iii) BFV homomorphic encryption for privacy-preserving aggregation. We formalize the security model and prove correctness and zero-knowledge properties under the Module-LWE, Ring-LWE, and SIS assumptions in the classical random oracle model. We evaluate ZKFL-PQ on synthetic medical imaging data across 5 federated clients over 10 training rounds. Our protocol achieves 100% rejection of norm-violating updates while maintaining model accuracy at 100%, compared to a catastrophic drop to 23% under standard FL. The computational overhead (factor

\sim

20

\times

) is analyzed and shown to be compatible with clinical research workflows operating on daily or weekly training cycles. We emphasize that the current defense guarantees rejection of large-norm malicious updates; robustness against subtle low-norm or directional poisoning remains future work.

Edouard Lansiaux

Department of Emergency Medicine & STaR-AI Research Group, CHU de Lille, Université de Lille, Lille, France

Quantum Federated Learning Privacy-Preserving Federated Learning Federated Learning Zero-Knowledge ML Byzantine-Robust Federated Learning Zero-Knowledge Proofs

Feb 27, 2026

Trust Aware Federated Learning for Secure Bone Healing Stage Interpretation in e-Health

This paper presents a trust aware federated learning (FL) framework for interpreting bone healing stages using spectral features derived from frequency response data. The primary objective is to address the challenge posed by either unreliable or adversarial participants in distributed medical sensing environments. The framework employs a multi-layer perceptron model trained across simulated clients using the Flower FL framework. The proposed approach integrates an Adaptive Trust Score Scaling and Filtering (ATSSSF) mechanism with exponential moving average (EMA) smoothing to assess, validate and filter client contributions.Two trust score smoothing strategies have been investigated, one with a fixed factor and another that adapts according to trust score variability. Clients with low trust are excluded from aggregation and readmitted once their reliability improves, ensuring model integrity while maintaining inclusivity. Standard classification metrics have been used to compare the performance of ATSSSF with the baseline Federated Averaging strategy. Experimental results demonstrate that adaptive trust management can improve both training stability and predictive performance by mitigating the negative effects of compromised clients while retaining robust detection capabilities. The work establishes the feasibility for adaptive trust mechanisms in federated medical sensing and identifies extension to clinical cross silo aggregation as a future research direction.

Paul Shepherd, Tasos Dagiuklas, Bugra Alkan +2

London South Bank University, London, UK · Instituto de Telecomunica¸c˜oes, Aveiro, Portugal

Trust-Aware Federated Learning Federated Learning Federated Learning Aggregation Byzantine-Robust Federated Learning

Feb 25, 2026

CQSA: Byzantine-robust Clustered Quantum Secure Aggregation in Federated Learning

Federated Learning (FL) enables collaborative model training without sharing raw data. However, shared local model updates remain vulnerable to inference and poisoning attacks. Secure aggregation schemes have been proposed to mitigate these attacks. In this work, we aim to understand how these techniques are implemented in quantum-assisted FL. Quantum Secure Aggregation (QSA) has been proposed, offering information-theoretic privacy by encoding client updates into the global phase of multipartite entangled states. Existing QSA protocols, however, rely on a single global Greenberger-Horne-Zeilinger (GHZ) state shared among all participating clients. This design poses fundamental challenges: fidelity of large-scale GHZ states deteriorates rapidly with the increasing number of clients; and (ii) the global aggregation prevents the detection of Byzantine clients. We propose Clustered Quantum Secure Aggregation (CQSA), a modular aggregation framework that reconciles the physical constraints of near-term quantum hardware along with the need for Byzantine-robustness in FL. CQSA randomly partitions the clients into small clusters, each performing local quantum aggregation using high-fidelity, low-qubit GHZ states. The server analyzes statistical relationships between cluster-level aggregates employing common statistical measures such as cosine similarity and Euclidean distance to identify malicious contributions. Through theoretical analysis and simulations under depolarizing noise, we demonstrate that CQSA ensures stable model convergence, achieves superior state fidelity over global QSA.

Arnab Nath, Harsh Kasyap

Indian Institute of Technology (BHU), Varanasi, India

Federated Learning Aggregation Byzantine-Robust Federated Learning

Feb 23, 2026

A Secure and Private Distributed Bayesian Federated Learning Design

Distributed Federated Learning (DFL) enables decentralized model training across large-scale systems without a central parameter server. However, DFL faces three critical challenges: privacy leakage from honest-but-curious neighbors, slow convergence due to the lack of central coordination, and vulnerability to Byzantine adversaries aiming to degrade model accuracy. To address these issues, we propose a novel DFL framework that integrates Byzantine robustness, privacy preservation, and convergence acceleration. Within this framework, each device trains a local model using a Bayesian approach and independently selects an optimal subset of neighbors for posterior exchange. We formulate this neighbor selection as an optimization problem to minimize the global loss function under security and privacy constraints. Solving this problem is challenging because devices only possess partial network information, and the complex coupling between topology, security, and convergence remains unclear. To bridge this gap, we first analytically characterize the trade-offs between dynamic connectivity, Byzantine detection, privacy levels, and convergence speed. Leveraging these insights, we develop a fully distributed Graph Neural Network (GNN)-based Reinforcement Learning (RL) algorithm. This approach enables devices to make autonomous connection decisions based on local observations. Simulation results demonstrate that our method achieves superior robustness and efficiency with significantly lower overhead compared to traditional security and privacy schemes.

Nuocheng Yang, Sihua Wang, Zhaohui Yang +3

Beijing Laboratory of Advanced Information Network, and the Beijing Key Laboratory of Network System Architecture and Convergence, Beijing University of Posts and Telecommunications, Beijing 100876, China · College of Information Science and Electronic Engineering, Zhejiang University, Hangzhou 310027, China, and Zhejiang Provincial Key Lab of Information Processing, Communication and Networking (IPCAN), Hangzhou 310007, China · Department of Electrical and Computer Engineering and Institute for Data Science and Computing, University of Miami, Coral Gables, FL, 33146 USA +1

Federated Learning Decentralized Learning Byzantine-Robust Federated Learning Client Selection in Federated Learning

Feb 20, 2026

Communication-Efficient Byzantine-Robust Federated Conformal Prediction via Partial Sharing

We propose PRISM-FCP (Partial shaRing and robust calIbration with Statistical Margins for Federated Conformal Prediction), a communication-efficient Byzantine-robust federated conformal prediction framework that uses partial model sharing to mitigate stochastic model-poisoning attacks during training and histogram-based filtering to mitigate adversarial calibration submissions. Existing robust FCP approaches primarily address adversarial behavior during calibration, leaving training-stage poisoning to separate robust-training mechanisms. PRISM-FCP instead considers the coupling between the two stages. During training, clients partially share updates by transmitting only

M

of

D

parameters per round. Under the stated stochastic attack model, this attenuates the expected energy of each Byzantine client's perturbation contribution to the aggregate by a factor of

M/D

relative to full sharing. When this benefit outweighs the optimization slowdown caused by partial updates, it can reduce training error and improve interval efficiency. During calibration, the server uses client-provided characterization vectors to filter suspected Byzantine clients before estimating the conformal quantile from the retained clients. Experiments on synthetic benchmarks and the UCI Superconductivity and YearPredictionMSD datasets, including Gaussian, ALIE, and sign-flipping training-stage attacks, demonstrate near-nominal empirical coverage and favorable communication--performance tradeoffs in the studied settings.

Ehsan Lari, Reza Arablouei, Stefan Werner

Department of Electronic Systems, Norwegian University of Science and Technology, 7491 Trondheim, Norway · Commonwealth Scientific and Industrial Research Organisation, Pullenvale, QLD 4069, Australia · Department of Information and Communications Engineering, Aalto University, 00076, Finland

Federated Conformal Prediction Federated Learning Aggregation Byzantine-Robust Federated Learning Conformal Prediction Federated Learning

Feb 20, 2026

PenTiDef: Decentralized Federated Intrusion Detection System with Differential Privacy and Latent-Space Defense via Blockchain Coordination in IIoT

This paper proposes PenTiDef, a fully decentralized, privacy-preserving, and poisoning-resilient framework for decentralized federated IDS (DFL-IDS). PenTiDef synergistically integrates three key components: (i) client-side Distributed Differential Privacy (DDP) with stochastic Gaussian noise to protect gradient leakage, (ii) a lightweight latent-space defense module that extracts and compresses penultimate-layer representations (PLRs) into stable Latent Semantic Representations (LSRs) via AutoEncoder, followed by Centered Kernel Alignment (CKA) and K-Means clustering for robust malicious update detection without auxiliary datasets, and (iii) a permissioned blockchain layer with smart contracts that orchestrates on-chain validation, secure FedAvg aggregation, and immutable auditability, eliminating any central server. Extensive experiments on CIC-IDS2018 and Edge-IIoTSet under both IID and realistic non-IID settings, with adversary ratios up to 40%, demonstrate that PenTiDef consistently outperforms state-of-the-art baselines (FLARE and FedCC) in detection accuracy and F1-score while maintaining lower training overhead. By jointly addressing privacy, robustness, and decentralization in a unified secure aggregation protocol, PenTiDef provides a practical and scalable solution for trustworthy collaborative intrusion detection in heterogeneous, adversarial IIoT environments.

Phan The Duy, Nghi Hoang Khoa, Nguyen Tran Anh Quan +3

Information Security Lab, University of Information Technology, Ho Chi Minh City, Vietnam. · Vietnam National University, Ho Chi Minh City, Vietnam. · VNU-HCM Information Security Center, Ho Chi Minh City, Vietnam.

Blockchain-Based Federated Learning IoT Intrusion Detection Federated Learning Byzantine-Robust Federated Learning Federated Learning Aggregation Differentially Private Federated Learning

Nov 4, 2025

A Byzantine-Robust Federated Learning with Nesterov Momentum

We investigate robust federated learning, where a group of workers collaboratively train a shared model under the orchestration of a central server in the presence of Byzantine adversaries capable of arbitrary and potentially malicious behaviors. To improve communication efficiency while retaining resilience against such adversaries, we propose a Byzantine-resilient Nesterov-augmented federated learning (Byrd-NAFL) algorithm. Byrd-NAFL applies Nesterov's momentum at the server to the output of any soft

γ

-Byzantine resilient aggregation rule, while each worker only computes and uploads a stochastic gradient, which keeps the workers stateless, as desired for intermittently participating Internet of Things devices. For smooth non-convex losses, we establish a finite-time convergence guarantee for all momentum factors

β\in[0,1)

without requiring the aggregated gradient to be unbiased or bounded; the bound reduces to that of Byzantine-resilient stochastic gradient descent at

β=0

and is tighter than that of server-side heavy-ball momentum. Experiments on MNIST, CIFAR-10, and Sentiment140 show that Byrd-NAFL converges faster and attains higher accuracy than existing benchmarks in most i.i.d. and non-i.i.d. setups under diverse attacks, while its resilience is bounded by that of the underlying aggregation rule.

Lihan Xu, Xiaoyi Fan, Gang Wang +3

School of Cyber Science and Engineering, Xi’an Jiaotong University, Xi’an 710049, China. · the Artificial Intelligence Research Institute and Guangdong-Hong Kong-Macao Joint Laboratory for Emotional Intelligence and Pervasive Computing, Shenzhen MSU-BIT University, Shenzhen 518172, China. · the State Key Laboratory of Autonomous Intelligent Unmanned Systems, Beijing Institute of Technology, Beijing 100081, China.

Federated Learning Aggregation Byzantine-Robust Federated Learning Communication-Efficient Distributed Training Gradient Descent Federated Learning

Jun 22, 2025

Tight Stability Bounds for Robust Distributed Learning: Byzantine Failures Hurt Generalization More than Data Poisoning

Robust distributed learning algorithms aim to maintain reliable performance despite the presence of misbehaving workers. Such misbehaviors are commonly modeled as Byzantine failures, allowing arbitrarily corrupted communication, or as data poisoning, a weaker form of corruption restricted to local training data. While prior work shows similar optimization guarantees for both models, an important question remains: How do these threat models impact generalization? We show, for the first time, a fundamental gap in generalization guarantees between the two threat models: Byzantine failures yield strictly worse rates than those achievable under data poisoning. Our findings are based upon a tight algorithmic stability analysis of robust distributed learning. Specifically, with

f

out of

n

workers misbehaving, we prove that: (i) under data poisoning, the uniform algorithmic stability of a robust distributed learning algorithm

Thomas Boudou, Batiste Le Bars, Nirupam Gupta +1

PreMeDICaL team, Inria, Idesp, Inserm, Université de Montpellier, Montpellier, France · Univ. Lille, Inria, CNRS, Centrale Lille, UMR 9189, CRIStAL, F-59000 Lille, France · Department of Computer Science, University of Copenhagen, Copenhagen, Danemark

Byzantine-Robust Federated Learning Algorithmic Stability Fault-Tolerant Distributed Training Corruption Robustness Distributed Training Data Poisoning Attacks+1

May 26, 2025

Federated Independent Component Analysis via Spectral Alignment and Robust Aggregation

This paper studies robust estimation for Independent Component Analysis (ICA) in the federated learning setting, where data are locally distributed across clients and may exhibit substantial heterogeneity. The goal is to recover a common global mixing matrix by aggregating local estimators computed by individual clients. The main difficulty is that local ICA estimators are identifiable only up to sign flips and column permutations and may have highly heterogeneous estimation quality. We propose a novel three-step aggregation method that first aligns the permutations across all local estimators via a particular spectral clustering approach, then aligns the signs within each estimated cluster via another tailored spectral approach, and finally applies the geometric median for robust aggregation. The proposed estimator is shown to remain accurate even when a substantial fraction of local estimators are of low quality or inconsistent, as long as each cluster contains a majority of accurate estimators. This contrasts with its analogue based on simple averaging, whose performance is determined by the worst local estimator. In the homogeneous setting, the robust estimator is also shown to be minimax optimal, up to a logarithmic factor, both when the number of clients remains fixed and when it diverges. The theoretical findings are corroborated by simulation studies and a real-data analysis.

Xin Bing, Dian Jin, Yuqian Zhang

University of Toronto · National University of Singapore · Rutgers University

Federated Learning Aggregation Independent Component Analysis Byzantine-Robust Federated Learning Federated Learning Heterogeneous Federated Learning

Sep 26, 2024

Byzantine-Robust Aggregation for Securing Decentralized Federated Learning

Federated Learning (FL) emerges as a distributed machine learning approach that addresses privacy concerns by training AI models locally on devices. Decentralized Federated Learning (DFL) extends the FL paradigm by eliminating the central server, thereby enhancing scalability and robustness through the avoidance of a single point of failure. However, DFL faces significant challenges in optimizing security, as most Byzantine-robust algorithms proposed in the literature are designed for centralized scenarios. In this paper, we present a novel Byzantine-robust aggregation algorithm to enhance the security of Decentralized Federated Learning environments, coined WFAgg. This proposal handles adverse conditions and strengthens the robustness of dynamic decentralized topologies at the same time by employing multiple filters to identify and mitigate Byzantine attacks. Experimental results demonstrate the effectiveness of the proposed algorithm in maintaining model accuracy and convergence in the presence of various Byzantine attack scenarios, outperforming state-of-the-art centralized Byzantine-robust aggregation schemes (such as Multi-Krum or Clustering). These algorithms are evaluated on an IID image classification problem in both centralized and decentralized scenarios.

Diego Cajaraville-Aboy, Ana Fernández-Vilas, Rebeca P. Díaz-Redondo +1

atlanTTic Research Center – ICLAB – Universidade de Vigo, Vigo, 36310, Spain

Federated Learning Aggregation Byzantine-Robust Federated Learning Decentralized Learning

Apr 30, 2024

Federated Graph Learning for EV Charging Demand Forecasting with Personalization Against Cyberattacks

Mitigating cybersecurity risk in electric vehicle (EV) charging demand forecasting plays a crucial role in the safe operation of collective EV chargings, the stability of the power grid, and the cost-effective infrastructure expansion. However, existing methods either suffer from the data privacy issue and the susceptibility to cyberattacks or fail to consider the spatial correlation among different stations. To address these challenges, a federated graph learning approach involving multiple charging stations is proposed to collaboratively train a more generalized deep learning model for demand forecasting while capturing spatial correlations among various stations and enhancing robustness against potential attacks. Firstly, for better model performance, a Graph Neural Network (GNN) model is leveraged to characterize the geographic correlation among different charging stations in a federated manner. Secondly, to ensure robustness and deal with the data heterogeneity in a federated setting, a message passing that utilizes a global attention mechanism to aggregate personalized models for each client is proposed. Thirdly, by concerning cyberattacks, a special credit-based function is designed to mitigate potential threats from malicious clients or unwanted attacks. Extensive experiments on a public EV charging dataset are conducted using various deep learning techniques and federated learning methods to demonstrate the prediction accuracy and robustness of the proposed approach.

Yi Li, Renyou Xie, Chaojie Li +2

College of Electronic and Information Engineering, Southwest University · Department of Electrical Engineering, City University of Hong Kong, Hong Kong · Department of Electrical and Electronic Engineering, the University of Hong Kong, Hong Kong

Byzantine-Robust Federated Learning Electric Vehicle Charging Federated Graph Learning Spatiotemporal Forecasting Federated Learning

Feb 26, 2024

FedReview: Review and Dispose Poisoned Updates without Validation Datasets or Historic Knowledge

Federated learning has emerged as a decentralized approach for training high-performance models without accessing user data. Despite its effectiveness, it is vulnerable to poisoning attacks, where malicious users manipulate the global model by uploading poisoned updates. In this paper, we propose FedReview, a review-based mechanism to identify and dispose the potential poisoned updates in federated learning. Under FedReview, the server randomly assigns a subset of clients as reviewers to evaluate model updates on their training datasets in each round. The reviewers rank the updates based on evaluation results and estimate the number of low-quality updates as potential poisoned ones. Based on the review reports, the server applies a majority voting mechanism to aggregate rankings, which tolerates wrong rankings from malicious reviewers and guides the removal of suspicious updates during model aggregation. In contrast to prior works such as FLTrust, FedReview does not require a server-side validation dataset or prior knowledge of clients, allowing flexible client participation. Extensive experiments demonstrate that FedReview enables the server to learn a well-performing global model in adversarial environments.

Tianhang Zheng, Yanlu Li, Bohan Deng +1

University of Missouri-Kansas City · University of Toronto

Federated Learning Aggregation Byzantine-Robust Federated Learning Federated Learning

Oct 6, 2023

Kick Bad Guys Out! Conditionally Activated Anomaly Detection in Federated Learning with Zero-Knowledge Proof Verification

Federated Learning (FL) systems are susceptible to adversarial attacks, such as model poisoning attacks and backdoor attacks. Existing defense mechanisms face critical limitations in deployments, such as relying on impractical assumptions (e.g., adversaries acknowledging the presence of attacks before attacking) or undermining accuracy in model training, even in benign scenarios. To address these challenges, we propose CustodianFL, a two-staged anomaly detection method specifically designed for FL deployments. In the first stage, it flags suspicious client activities. In the second stage that is activated only when needed, it further examines these candidates using Three-Sigma Rule to identify and exclude truly malicious local models from FL training. To ensure integrity and transparency within the FL system, CustodianFL integrates zero-knowledge proofs, enabling clients to cryptographically verify the server's detection process without relying on the server's goodwill. CustodianFL operates without unrealistic assumptions and avoids interfering with FL training in attack-free scenarios. It bridges the gap between theoretical advances in FL security and the practical demands of real FL systems. Experimental results demonstrate that CustodianFL consistently delivers performance comparable to benign cases, highlighting its effectiveness in identifying and eliminating malicious models with high accuracy.

Shanshan Han, Wenxuan Wu, Baturalp Buyukates +4

University of California, Irvine · Texas A&M University · University of Birmingham +3

Byzantine-Robust Federated Learning Adversarial Attacks Federated Learning