Byzantine-Robust Federated Learning

Krum selects a single client update as the new global model by choosing the vector that is most similar to its nearest neighbors, effectively discarding outliers. It calculates the sum of squared distances to the k closest updates among the n received, where k = n - f - 2 and f is the maximum number of tolerated malicious clients. The update with the smallest sum is chosen.

• Mechanism: Multi-round distance-based scoring and selection.
• Robustness: Proven to converge under a bounded fraction of Byzantine clients.
• Limitation: Utilizes only one client's update per round, wasting benign contributions and slowing convergence, especially under high statistical heterogeneity.

Multi-Krum is an extension of Krum that averages a subset of the most reliable client updates instead of selecting just one. After scoring all updates similarly to Krum, it averages the m updates with the best (lowest) scores.

• Mechanism: Scores updates via neighbor distances, then averages the top-m.
• Advantage: More statistically efficient than Krum as it incorporates multiple benign updates, leading to better convergence rates.
• Trade-off: The choice of m is a hyperparameter that balances robustness and statistical efficiency.

The Coordinate-wise Median aggregation rule computes the median value independently for each parameter (coordinate) across all client updates. For a given model parameter, it sorts all values submitted by clients and selects the middle value.

• Mechanism: Per-parameter median calculation.
• Robustness: Highly robust to extreme outliers in any coordinate, as the median is not skewed by arbitrarily large malicious values.
• Characteristic: Produces a component-wise robust estimate but may output a vector not originally submitted by any client.

Trimmed Mean removes a fraction of the most extreme values before averaging. For each model parameter, it sorts the client-submitted values, discards the top and bottom β fraction (e.g., 10%), and computes the mean of the remaining values.

• Mechanism: Per-parameter trimming of extremes, then averaging.
• Robustness: Tolerates a known fraction β of Byzantine clients per coordinate.
• Consideration: Requires setting the trimming fraction β, which should be an upper bound on the expected Byzantine ratio. Performance degrades if the actual malicious count exceeds β * n.

Bulyan is a meta-aggregation method that combines Krum or Multi-Krum with Trimmed Mean for enhanced robustness. It first uses Multi-Krum to select a set of candidate updates, then applies the Trimmed Mean rule on that candidate set.

• Mechanism: Two-stage filtering: 1) Select reliable updates via distance (Multi-Krum), 2) Further refine via coordinate-wise trimming.
• Robustness: Provides strong guarantees, even against sophisticated adaptive attacks that target a single aggregation rule.
• Cost: Higher computational overhead due to the two-stage process.

Non-IID data is the primary confounder for Byzantine-robust aggregation. Benign updates from clients with highly divergent local data distributions can appear statistically as outliers, resembling malicious updates.

• Core Problem: Aggregation rules must distinguish between malicious divergence (Byzantine) and benign divergence (statistical heterogeneity).
• Consequence: Overly aggressive robust methods (like high-trimming Krum) can mistakenly filter out useful updates from legitimate but non-representative clients, harming model accuracy.
• Research Direction: Modern methods aim to be tolerant to heterogeneity, often by incorporating trust scores, clustering, or comparing update directions over time.

A rigorous mathematical framework for quantifying and limiting the privacy loss incurred when an individual's data is used in a computation. In federated learning, local differential privacy can be applied by clients before sending updates.

• Core Mechanism: Adds calibrated noise (e.g., Gaussian, Laplacian) to gradients or updates.

• Relationship to Byzantine Robustness: DP and Byzantine robustness address orthogonal threats. DP mitigates privacy leakage from the aggregated output, while Byzantine robustness mitigates integrity attacks on the aggregation process itself. A malicious client could attempt to infer other clients' data from the global model, a threat DP helps address.

An adversarial attack where a malicious actor manipulates the training data to cause a machine learning model to learn incorrect or harmful behaviors. In federated learning, this is executed by Byzantine clients submitting poisoned model updates.

• Attack Vectors: Include label flipping, backdoor injection, and gradient manipulation.
• Defensive Target: Byzantine-robust aggregation rules (Krum, Median, etc.) are the primary defense against update-based data poisoning in federated settings, as they filter out or diminish the influence of malicious updates.

An attack where an adversary, with query access to a trained model, attempts to reconstruct representative features of the training data or infer membership of specific records. In federated learning, the server or other clients could be the adversary.

• Core Risk: Breaches model privacy by revealing properties of the training distribution.
• Relationship to Byzantine Robustness: While Byzantine robustness focuses on integrity, model inversion is a privacy attack. However, a Byzantine client could use its position to perform a more potent model inversion attack by influencing the global model's parameters to become more revealing.

A specific Byzantine-robust aggregation rule that selects the single client update that is most similar to its nearest neighbors, effectively filtering out outliers. It is designed to tolerate f malicious clients out of n total, provided n > 2f + 3.

• Mechanism: For each candidate update, it sums the Euclidean distances to its n-f-2 closest neighbors. The update with the smallest sum is selected as the new global model.
• Limitation: Highly sensitive to the chosen f and can discard benign but divergent updates from clients with highly Non-IID data, leading to convergence issues.

A class of robust statistical aggregation rules applied per parameter dimension (coordinate-wise). Trimmed Mean discards a fraction of the largest and smallest values for each parameter before averaging the rest. Median takes the middle value.

• Robustness: These methods are highly resistant to value-based outliers, which are common in simple poisoning attacks.
• Challenge with Non-IID Data: Like Krum, they can be misled by sign-based attacks where malicious updates are crafted to be within the range of benign values but with flipped signs. Furthermore, the statistical dispersion caused by genuine Non-IID data can be mistaken for malice.