Krum Aggregator

Krum acts as a direct countermeasure against data poisoning and model poisoning attacks. In these threats, an adversary manipulates local training data or directly crafts malicious gradient updates to corrupt the global model. By treating all updates as points in a high-dimensional space, Krum identifies the 'safest' point. It discards updates that are geometrically distant from the dense cluster of honest contributions, preventing a backdoor or targeted misclassification from being injected into the final model.

An extension of the original algorithm that improves convergence speed and resilience. Instead of selecting a single update, Multi-Krum selects the top-m candidates with the lowest outlier scores and averages them. This leverages the computational work of multiple honest clients rather than discarding it. The selection mechanism remains identical to standard Krum, but the final aggregation step combines the chosen vectors, providing a smoother and more stable global model update.

A significant limitation of Krum in modern deep learning. The algorithm relies on Euclidean distance to measure similarity between high-dimensional gradient vectors. In extremely high-dimensional spaces (millions of parameters), distance metrics become less meaningful as all points appear equally far apart. This can degrade Krum's ability to distinguish between honest and malicious updates, requiring dimensionality reduction techniques or alternative robust aggregation methods for very large models.

While Krum secures against Byzantine attacks, it does not inherently provide privacy guarantees. The selected update is still shared with the central server in plaintext, making it vulnerable to gradient leakage or model inversion attacks that reconstruct private training data. For a complete security posture, Krum must be combined with cryptographic techniques like Secure Aggregation or Differential Privacy to ensure the chosen update remains confidential.