Robust Aggregation

A foundational defense that replaces the arithmetic mean with the coordinate-wise median of all client updates. For each model parameter, the server sorts the values submitted by clients and selects the middle one. This single-dimensional approach is highly effective against label-flipping attacks and outlier injection, but struggles when attackers collude to shift the median itself by controlling a large fraction of clients.

Krum selects a single client update that is closest to its n-f-2 neighbors in vector space, where n is the total number of clients and f is the estimated number of Byzantine adversaries. By computing pairwise Euclidean distances between all submitted gradients, Krum identifies the update that lies in the densest region of the distribution. This geometric approach tolerates up to f < (n-2)/2 malicious clients without requiring any prior knowledge of the honest data distribution.

The trimmed mean independently sorts each coordinate of the gradient vectors, discards the largest and smallest β fraction of values, and averages the remainder. This approach explicitly removes extreme outliers that could skew the aggregate. The trimming parameter β must be set to exceed the expected fraction of adversaries. While computationally efficient, coordinate-wise trimming can be circumvented by attackers who craft updates that are extreme in different coordinates for different clients.

FoolsGold identifies Sybil attacks by analyzing the historical gradient similarity between clients. Malicious actors controlling multiple fake identities tend to produce highly correlated updates, while honest clients exhibit natural diversity due to their distinct local data distributions. By adaptively reducing the learning rate for clients with low inter-update diversity, FoolsGold neutralizes coordinated poisoning without requiring a known upper bound on the number of adversaries.

Multi-Krum extends the original Krum algorithm by iteratively selecting multiple trusted updates and averaging them, improving statistical efficiency. Bulyan combines Krum's selection with a trimmed mean on the chosen subset, providing stronger guarantees against a specific class of attacks that exploit high-dimensional spaces. These meta-aggregators demonstrate that chaining multiple robust rules can close vulnerabilities that any single method leaves exposed.