Byzantine Fault Tolerance (BFT)

Unlike simple crash-fault tolerance, BFT handles Byzantine failures where nodes may behave arbitrarily—sending conflicting information, lying about computations, or acting maliciously. In a federated healthcare network, a compromised hospital server might submit poisoned gradient updates designed to create backdoors in a tumor detection model. A BFT system must detect and neutralize these updates without knowing which nodes are compromised, ensuring the global model remains safe for clinical use.

A fundamental BFT theorem states that a system can tolerate up to f Byzantine nodes only if the total number of replicas is at least 3f + 1. This means:

• To survive 1 malicious node, you need at least 4 total nodes
• To survive 2 malicious nodes, you need at least 7 total nodes
• To survive 3 malicious nodes, you need at least 10 total nodes

This quorum requirement directly impacts federated learning architecture design, as cross-silo healthcare networks must provision sufficient participating institutions to maintain Byzantine resilience.

BFT protocols provide two critical guarantees:

• Safety: All non-faulty nodes agree on the same value. No two correct nodes will ever confirm conflicting model updates, preventing a scenario where one hospital's diagnostic model diverges dangerously from another's.
• Liveness: The system eventually makes progress and doesn't deadlock. Even under attack, the federated training round will eventually complete and produce a new global model.

These guarantees ensure that federated learning remains both correct and available, a non-negotiable requirement for life-critical medical AI systems.

Standard Federated Averaging (FedAvg) is vulnerable to Byzantine attacks because a single malicious update can arbitrarily skew the mean. Byzantine-robust aggregation rules replace simple averaging with statistical defenses:

• Krum: Selects the single update that minimizes the sum of distances to its closest neighbors, inherently discarding outliers
• Trimmed Mean: Sorts parameter values and discards the most extreme before averaging
• Median Aggregation: Uses coordinate-wise median instead of mean, making it impossible for a minority of attackers to shift the result
• Multi-Krum: Extends Krum to select multiple reliable updates for better convergence

BFT protocols operate under different timing assumptions:

• Synchronous BFT: Assumes messages arrive within a known bounded delay. Simpler to implement but vulnerable to network delays mimicking Byzantine behavior. Requires the 3f + 1 replica count.
• Asynchronous BFT: Makes no timing assumptions, tolerating arbitrarily long delays. More robust for real-world healthcare networks with variable latency, but requires 5f + 1 replicas and more complex consensus mechanisms like HoneyBadgerBFT.
• Partial Synchrony: A practical middle ground assuming the network is eventually synchronous, used by PBFT and most production systems.

BFT in federated learning relies on cryptographic identity to prevent Sybil attacks where an adversary creates fake nodes. Each participating hospital must:

• Sign model updates with a private key tied to a verified institutional identity
• Enable other nodes to verify signatures using a public key infrastructure (PKI)
• Maintain an immutable audit trail of all contributions for regulatory compliance

Without authenticated channels, a single attacker could simulate a majority of nodes and completely control the global model. This is why healthcare federated networks typically use cross-silo topologies with known, vetted participants rather than open cross-device architectures.

An attack where a single adversary creates and controls multiple fake client identities to subvert the aggregation logic. In a federated healthcare network, a malicious actor could simulate dozens of phantom hospitals to out-vote honest participants and steer the global model toward a poisoned state. BFT protocols must assume that a fraction of identities—not just nodes—are adversarial.

A class of aggregation rules designed to maintain global model convergence even when a fraction of clients submit corrupted or Byzantine updates. Unlike simple Federated Averaging, robust aggregators apply statistical outlier detection to weight vectors:

• Krum: Selects the update closest to its neighbors
• Trimmed Mean: Discards extreme values per coordinate
• Median: Uses coordinate-wise median to neutralize poison

A training-time integrity attack where an adversary injects malicious samples into a local dataset to manipulate model behavior. In healthcare, this could mean inserting mislabeled chest X-rays to cause systematic misdiagnosis. BFT aggregation alone cannot detect poisoning if the corrupted update appears statistically plausible, requiring redundant validation and differential privacy audits.

A cryptographic protocol enabling multiple hospitals to jointly compute an aggregation function over their private model updates without revealing those updates to each other or the central server. SMPC ensures that even if the aggregator is compromised, individual patient data gradients remain information-theoretically secure, directly complementing BFT's focus on availability and correctness.

An attack that reconstructs private local training data from shared model gradients. Even if a BFT protocol ensures correct aggregation, raw gradient sharing can expose patient MRI scans. Defenses include:

• Gradient compression to reduce information content
• Differential privacy noise injection before sharing
• Secure aggregation to hide individual contributions entirely

An immutable, cryptographically verifiable distributed ledger that logs every model update, aggregation round, and access request in a federated network. When a Byzantine fault is detected, the audit trail provides non-repudiable forensic evidence to identify the malicious node. This combines BFT's liveness guarantees with post-hoc accountability for regulated healthcare environments.