Byzantine-Robust Aggregation

Krum selects a single client's update as the global update, chosen for its proximity to its nearest neighbors. For each candidate update vector, it calculates the sum of squared distances to its n - f - 2 closest neighbors (where n is total clients and f is the maximum tolerated malicious clients). The vector with the smallest sum is selected.

• Mechanism: Distance-based outlier rejection.
• Guarantee: Proven convergence under bounded variance, assuming the fraction of malicious clients is less than 50%.
• Weakness: Highly inefficient, as it discards all updates except one, wasting the contributions of honest clients.

The Coordinate-wise Median (or simply Median) algorithm aggregates updates by computing the median value independently for each parameter (coordinate) of the model. For a given parameter index, it takes the values from all client updates, sorts them, and selects the middle value.

• Mechanism: Non-linear, robust statistical aggregation.
• Robustness: Highly resistant to extreme outliers in any single parameter, as the median is not skewed by arbitrarily large or small malicious values.
• Use Case: Effective for high-dimensional updates where attacks may target specific model parameters. It assumes the honest updates form a majority (>50%) in each coordinate.

Trimmed Mean removes a fraction of the most extreme values before averaging. For each model parameter, it sorts the values from all clients, discards the top and bottom β fraction (e.g., 10%), and computes the mean of the remaining values.

• Mechanism: Statistical trimming to exclude outliers.
• Parameter: The trimming fraction β is typically set slightly above the expected fraction of malicious clients f.
• Advantage: More statistically efficient than Median, as it uses more of the honest data. It provides a good balance between robustness and utility when the malicious updates are not colluding perfectly.

Bulyan is a meta-aggregation rule that combines Krum and Trimmed Mean for enhanced security. It first uses Krum to select a subset of n - 2f candidate updates that are likely to be honest. Then, it applies Trimmed Mean on this filtered subset to aggregate the final update.

• Mechanism: Multi-stage filtering (distance-based, then statistical).
• Guarantee: Provides strong robustness guarantees, even against colluding attacks where malicious clients coordinate. It can tolerate f malicious clients where n > 4f.
• Trade-off: Computationally more expensive due to the two-stage process.

Multi-Krum is a variant of the base Krum algorithm designed to improve statistical efficiency. Instead of selecting just one client's update, it selects a committee of m updates with the best (lowest) Krum scores and averages them.

• Mechanism: Committee-based averaging after outlier scoring.
• Improvement: Mitigates the primary weakness of standard Krum by incorporating multiple honest-looking updates, leading to faster and more stable convergence.
• Consideration: The choice of committee size m is a trade-off between robustness (smaller m) and efficiency (larger m).

Choosing an algorithm depends on the threat model, computational budget, and desired convergence properties.

• Robustness vs. Utility: Median and Trimmed Mean offer good utility; Krum/Bulyan offer stronger robustness guarantees against coordinated attacks.
• Communication Cost: All algorithms require clients to send full model updates. Some, like FoolsGold (not shown), use cosine similarity to detect sybils with lower overhead.
• Attack Vectors:
  • Random Noise: Handled well by Median/Trimmed Mean.
  • Label-Flipping Backdoor: May require Bulyan-level defense.
  • Sybil Attack: Requires reputation-based methods like FoolsGold.
• Key Assumption: All algorithms require an upper bound f on the number of malicious clients, typically f < n/2.

Banks and financial institutions can train fraud detection models on transaction data that never leaves their private silos. Aggregation rules such as Median or Bulyan are essential here, as they can tolerate a malicious actor (e.g., a compromised bank or an insider threat) attempting to skew the global model to miss specific fraudulent patterns or create false positives for competitors.

Manufacturers can use federated learning to improve perception models across a global fleet of vehicles. Each car learns from local driving data, and only model updates are shared. Byzantine-robust aggregation is vital to defend against:

• Sensor spoofing attacks that corrupt a vehicle's local training data.
• Malicious updates from a compromised vehicle attempting to create a blind spot in the global model. Robust aggregation ensures safety-critical model integrity.

Factories with sensitive operational data can federate training of models that predict machine failure. Devices on the factory floor train locally on vibration, temperature, and acoustic data. Robust aggregation protects the global model from:

• Faulty sensors generating pathological data.
• Cyber-physical attacks where an adversary gains control of an IoT gateway and sends updates designed to cause premature maintenance or hide impending failures.

In Cross-Silo Federated Learning, competing businesses in a consortium (e.g., retail chains) might collaborate on a demand forecasting model without sharing sales data. Byzantine-robust techniques are crucial for ensuring no single participant can manipulate the aggregated model to gain a competitive advantage or degrade its performance for others, enforcing fair collaboration.

A security attack in federated learning where a malicious client submits crafted model updates designed to corrupt the global model. Attack goals include:

• Performance Degradation: Reducing overall model accuracy.
• Backdoor Injection: Creating a hidden trigger that causes specific, targeted misclassifications.
• Bias Introduction: Skewing the model toward particular outputs. Byzantine-Robust Aggregation rules are specifically designed to detect and mitigate such poisoned updates.

A cryptographic protocol that ensures the central server in federated learning can compute the sum of client updates without learning any individual client's contribution. It protects data privacy from the server itself. This is complementary to Byzantine-Robust Aggregation:

• Secure Aggregation protects client privacy from a curious server.
• Byzantine-Robust Aggregation protects model integrity from malicious clients. They are often used in conjunction for comprehensive security.

Refers to data that is Not Independently and Identically Distributed across clients. This is the norm, not the exception, in federated learning (e.g., typing habits differ per user). Non-IID data presents a major challenge for aggregation:

• It causes client updates to be naturally divergent.
• Byzantine-robust rules must distinguish between benign divergence due to Non-IID data and malicious divergence from attackers. Advanced rules like Krum and Multi-Krum are designed with this challenge in mind.

A secure, isolated area within a main processor (e.g., Intel SGX, ARM TrustZone) that guarantees code and data confidentiality and integrity. TEEs offer an alternative hardware-based approach to secure aggregation and can assist Byzantine robustness:

• Client updates can be computed and verified within a TEE on the device.
• The server's aggregation logic can run within a TEE, ensuring it executes correctly without tampering. This provides a root of trust that can simplify or enhance cryptographic and algorithmic defenses.