Byzantine Fault Tolerance

Byzantine Fault Tolerant (BFT) systems are defined by two critical properties: Safety, which ensures that all non-faulty nodes agree on the same valid output and that nothing incorrect is ever finalized, and Liveness, which guarantees that the system continues to make progress and eventually produces an output despite failures. In a federated learning context, safety prevents a malicious hospital node from injecting a corrupted model update that poisons the global diagnostic model, while liveness ensures that the training round eventually completes even if some nodes drop out or submit garbage updates.

The foundational thought experiment where multiple divisions of an army, each led by a general, must coordinate an attack on a city by exchanging messengers. Some generals are traitors who may send conflicting or false messages to sabotage consensus. BFT protocols solve this by establishing algorithmic rules that allow the loyal generals to reach a unified decision despite the traitors' arbitrary deception. In a cross-silo medical imaging network, this maps directly to ensuring that a compromised hospital server cannot trick the aggregation server into accepting a backdoored model.

Standard Federated Averaging (FedAvg) is highly vulnerable to Byzantine attacks because a single malicious node can arbitrarily skew the weighted mean. BFT systems employ Robust Aggregation rules that are statistically resilient to outliers:

• Krum: Selects the single local update that is closest to its neighbors in vector space, ignoring outliers.
• Trimmed Mean: Sorts each parameter coordinate independently and discards the extreme values before averaging.
• Median: Uses the coordinate-wise median, which is inherently resistant to arbitrary corruption from a minority of nodes.

Classical BFT consensus algorithms like PBFT (Practical Byzantine Fault Tolerance) require all-to-all communication and are impractical for large-scale federated learning. Modern adaptations integrate BFT properties directly into the stochastic gradient descent aggregation phase. For example, the aggregation server can use high-dimensional robust statistics to detect and reject model updates that deviate anomalously from the expected distribution of honest gradients, effectively treating a data poisoning attempt as a Byzantine fault without needing full node-to-node consensus on every training step.

A critical distinction in distributed systems resilience:

• Crash Fault: A node simply stops responding or fails silently. This is the simpler failure model handled by standard redundancy.
• Byzantine Fault: A node exhibits arbitrary behavior—it may send conflicting information to different peers, deliberately lie about its computations, or act maliciously to maximize system damage. In a healthcare consortium, a crash fault is a server going offline; a Byzantine fault is an insider threat or compromised credential actively attempting to inject a model inversion backdoor into the diagnostic model.

BFT and Secure Aggregation (SecAgg) are complementary but distinct defenses. SecAgg uses cryptography to ensure the server cannot inspect any individual model update in plaintext, protecting client privacy. However, encryption alone does not prevent a malicious client from submitting a poisoned update. BFT robust aggregation must operate in conjunction with SecAgg, often requiring techniques like multi-party computation (MPC) to compute outlier-resistant statistics over encrypted updates, ensuring both privacy against an honest-but-curious server and resilience against actively malicious clients.

A class of aggregation rules designed to defend the global model against Byzantine failures or malicious data poisoning attacks. Unlike simple averaging, robust aggregators use statistical outlier detection to filter corrupted updates.

• Krum: Selects the single update that is geometrically closest to its neighbors, ignoring outliers
• Trimmed Mean: Sorts and discards extreme values from each coordinate before averaging
• Median: Replaces coordinate-wise averaging with the median to resist manipulation

These methods ensure that even if 33% of hospital nodes submit arbitrary gradients, the diagnostic model's accuracy remains stable.

The divergence of locally trained models from the optimal global objective caused by statistical heterogeneity across participating nodes. In medical imaging, a node with only pediatric chest X-rays will produce weight updates that conflict with a node specializing in geriatric scans.

• Manifests as increased local loss despite improving global performance
• Exacerbated by excessive local training epochs
• Mitigated through FedProx proximal terms that penalize large deviations

Unchecked client drift creates a fragile global model that performs poorly on rare disease presentations, directly undermining diagnostic reliability.

A cryptographic subfield enabling multiple hospitals to jointly compute an aggregation function over their private gradient updates while ensuring no party learns anything beyond the final aggregated result. SMPC replaces the need for a trusted central server.

• Uses secret sharing to split each update into fragments distributed across participants
• Computes sums and averages on encrypted shares without reconstruction
• Guarantees information-theoretic security against colluding adversaries

In a Byzantine context, SMPC prevents a malicious aggregator from isolating and inspecting a single hospital's model updates to infer patient data.

A hardware-enforced, isolated area within a main processor that protects the confidentiality and integrity of code and data loaded inside it. TEEs like Intel SGX or AMD SEV create an encrypted enclave where aggregation logic executes.

• Provides remote attestation: cryptographic proof that the correct, untampered code is running
• Protects against a compromised operating system or hypervisor
• Ensures even the infrastructure operator cannot inspect raw model updates

TEEs offer a practical defense against Byzantine servers by making the aggregation process verifiably trustworthy without the computational overhead of full SMPC.

A privacy breach where an adversary analyzes a trained model's parameters or gradients to reconstruct sensitive training data. In a Byzantine scenario, a malicious node participates in federated training solely to extract private medical images from shared gradient updates.

• Exploits the fact that gradients encode information about the data that generated them
• Can reconstruct recognizable faces from facial recognition models
• In medical imaging, can reveal patient anatomy from diagnostic model gradients

Defenses include gradient clipping, adding differential privacy noise, and using secure aggregation to prevent any single party from observing individual updates.

A quantifiable parameter, denoted by epsilon (ε), that controls the total privacy loss allowed over a series of federated training rounds. A lower epsilon enforces a stronger guarantee that an adversary cannot determine whether any single patient's data was included in training.

• ε < 1: Strong privacy, higher noise, potential accuracy trade-off
• ε 1-10: Moderate privacy, typical for medical research
• ε > 10: Weak privacy, approaching no formal guarantee

In Byzantine-resilient systems, the privacy budget must be tracked across all communication rounds to ensure a compromised aggregator cannot accumulate enough information over time to breach patient confidentiality.