Trimmed Mean

The algorithm operates independently on each parameter coordinate. For a given coordinate, it sorts the values received from all clients, removes the largest and smallest k values, and computes the mean of the remainder. This prevents a malicious update with an extreme value in just one dimension from corrupting the entire model update.

The breakdown point defines the maximum fraction of adversarial nodes a robust aggregator can tolerate before its estimate becomes arbitrarily skewed. For a trimmed mean with trimming parameter β (where β fraction is removed from each tail), the breakdown point is exactly β. If 30% of clients are malicious, a β of at least 0.3 is required.

Trimming provides robustness at the cost of statistical efficiency. By discarding valid data points along with outliers, the variance of the estimator increases, especially in high-dimensional spaces. The optimal trimming fraction balances the expected fraction of adversaries against the need to retain sufficient clean data for convergence.

The coordinate-wise median is a special case of trimmed mean where all but the middle value(s) are discarded. While the median offers a higher breakdown point (up to 50%), it discards significantly more information. Trimmed mean provides a tunable middle ground, retaining more sample information when the adversary count is known to be lower.

A sophisticated adversary aware of the trimming mechanism can launch a matching attack. By coordinating malicious nodes to all send values just inside the trimming boundary, they can shift the trimmed mean in a desired direction without being discarded. This highlights the need for complementary defenses like variance-based filtering.

In Federated Learning, the central server applies trimmed mean to aggregate client model updates before updating the global model. This defends against model poisoning where a compromised client sends a deliberately corrupted gradient. The technique is computationally lightweight, requiring only sorting and averaging, making it suitable for high-dimensional neural network parameters.

The property of a distributed system that guarantees convergence to a correct model even when an arbitrary subset of worker nodes behaves adversarially. Trimmed Mean is a specific algorithm that achieves this by assuming the server has access to a robust aggregation rule.

• Tolerates up to f faulty nodes out of n total
• Does not assume failures are random; assumes worst-case adversarial intent
• Critical for federated learning security postures

A defensive technique that caps the L2-norm of individual gradient vectors before they are applied to the model. This prevents maliciously large updates from dominating the learning process.

• Bounds the influence of any single client
• Often used in conjunction with differential privacy
• Simple to implement but can slow convergence if the clipping threshold is too tight

A class of algorithms designed to combine model updates while remaining resilient to a minority of corrupted contributions. Trimmed Mean is a foundational example.

• Includes Median, Geometric Median, and Multi-Krum
• Trade-off between statistical efficiency and breakdown point
• Essential for securing Federated Learning against model poisoning

The defensive process of filtering or removing suspicious training samples before training begins. While Trimmed Mean operates on gradients, sanitization operates on raw data.

• Uses anomaly scoring to flag outliers
• Prevents poisoned data from ever entering the pipeline
• Complements robust aggregation for defense-in-depth

A defense method that identifies poisoned data by analyzing the singular value decomposition of feature representations. It reveals the latent separability of corrupted samples from clean ones.

• Effective against clean-label backdoor attacks
• Detects the subtle statistical fingerprints left by poisoning
• Used to sanitize datasets before robust aggregation is applied