{"id":"346617de-2e03-4f22-a581-a717f6b4a46d","arxiv_id":"2411.10673","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":4,"one_line_summary":"VERT defends federated learning against large-scale model poisoning by selecting, in each round, the users whose gradients best match an autoregressive prediction from each user's own history.","lead":"This paper proposes VERT, a defense for federated learning that predicts what each user's gradient should look like from past rounds, then aggregates only users whose actual gradients match the prediction. It targets the regime where 80 to 90 percent of users are malicious, a setting where standard defenses such as Krum and Median collapse.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"VERT's predictability-gap assumption is vulnerable to adaptive attackers within its own threat model: malicious users can copy or slightly perturb honest gradients, making them look predictable and pass the top-k cosine-similarity selection.","rationale":"The reader's weakest_assumption correctly identified the predictability gap as load-bearing, and I agree. I sharpen it: the paper's own threat model (Section 3.2) gives the attacker honest-user gradients and training code, so defeating VERT does not require knowing its internal parameters—copying or slightly perturbing a real honest gradient is enough to make a malicious gradient look predictable. The four evaluated attacks (Gaussian noise, model replacement, Min-Max, ALIE) are all non-adaptive and do not exploit this. The empirical results are credible evidence for those specific attacks, and the runtime/memory comparison with FLANDERS is reasonable, but the broad claim of defense under ≥80% poisoning without unrealistic assumptions is not supported against adaptive attackers. I would not reject outright because the core idea is testable and the non-adaptive empirical support is real; a revision that adds an adaptive-attack evaluation and either fixes the selection or narrows the threat model could satisfy the claim. The theoretical derivation in Appendix B (Eq. 9/10) also appears dimensionally invalid, but I did not make it the primary concern because the implementation uses gradient descent rather than the closed-form solution. The reader's CONDITIONAL verdict remains appropriate; no change is needed beyond keeping that condition explicit.","tokens_in":21468,"tokens_out":9758,"duration_ms":101022,"concrete_test":"Implement an adaptive attack within the Section 3.2 threat model: for each round t and each malicious user k, set g^t_k = g^t_{h(k)} + ε·v, where g^t_{h(k)} is a randomly selected honest user's gradient (known to the attacker) and v is a fixed unit vector toward a target label; tune ε so that cos(g^t_k, f_pred(A⊙g^{t-1}_k + B⊙g^{t-1})) stays above the median honest-user similarity. Run the full VERT pipeline (MNIST, |Ct|=80, pr=80%, κ=15, same hyperparameters as Section 6.1) and report the fraction of malicious gradients in C^t_opt and the best global accuracy. If the malicious fraction in C^t_opt rises substantially or the best accuracy falls materially below the Table 2 VERT rows, then the predictability-gap assumption fails and the conditional acceptance requires an adaptive-attack qualification.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim depends on the Section 2.2/4.1 assumption that honest gradients satisfy g_t^k = f_infer(g_{t-1}^k, g_{t-1}) while malicious gradients are unpredictable, so the Section 4.2.2 cosine-similarity top-k selection separates them. This assumption is not robust against the adaptive attackers the paper itself allows. Section 3.2 grants the attacker knowledge of other honest users' gradients and training code. Under that threat model, a malicious user can submit g^t_k = g^t_h + ε·v, where g^t_h is an honest gradient available to the attacker and v is a fixed poisoning direction. For small ε, this gradient follows the same autoregressive trajectory as honest gradients, so its cosine similarity with VERT's predicted gradient is comparable to that of honest users. If 80–90% of users are malicious, the top-κ selector (κ=15 or 8) will necessarily include many such malicious gradients, and the aggregated model is poisoned. Even simpler, if the attacker can replicate VERT's public predictor, it can set its gradient equal to the predictor output for that user, achieving ρ=1 by construction. The paper evaluates only four non-adaptive attacks (GN, MR, AGR, ALIE); none of them optimizes against the predictor or copies honest trajectories. Therefore the headline '≥80% defense' is not established for attackers within the stated threat model. The self-reported gap (honest similarity ≈1.0 vs. malicious ≈0.86–0.88, Section 6.2.1) also shows the separation is quantitatively small, and the appendix plots for MR/AGR indicate malicious similarity can approach 1, making the top-k separation fragile.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes VERT, a defense for federated learning against large-scale model poisoning attacks. Unlike horizontal defenses that aggregate from current-round gradients (Krum, Median, FLTrust), VERT uses a vertical perspective: for each user it trains an autoregressive predictor on the user's historical gradients and the global gradient, projects gradients to a low-dimensional space, and in each round selects the top-κ users whose predicted gradient has the highest cosine similarity to the actual gradient. The selected gradients are then aggregated by FedAvg or Krum. Experiments on MNIST, CIFAR10, and CIFAR100 under Gaussian noise, model replacement, Min-Max, and 'a little is enough' attacks with 80% and 90% compromised users report that VERT achieves the highest peak global-model accuracy compared with FedAvg, Krum, Median, and FLDetector. A complexity analysis claims a reduction from O(d^2) to O(ds) with s << d.","tokens_in":21831,"tokens_out":5042,"duration_ms":52033,"significance":"The vertical-solution idea is a worthwhile conceptual departure: it decouples the defense from the current-round majority, which is the fundamental failure mode of horizontal defenses, and the low-dimensional projector addresses a real scalability problem of gradient-prediction defenses. The paper also reports a broad benchmark across three datasets, four attacks, two data distributions, and two compromise rates, and it claims to release code. These strengths make the work potentially useful if the central predictability assumption is validated under the stated threat model. However, the validation as presented is not yet convincing: the evaluated attacks are non-adaptive, the reported metric is peak accuracy without variance or seeds, and the training procedure contains a circular dependence on the defense's own selections. The significance of the claimed '≥80% defense' therefore remains conditional.","major_comments":[{"comment":"The threat model in Section 3.2 grants the attacker all knowledge about compromised users, including training code, and 'even knows the user gradient of other honest users.' Sections 2.2 and 4.1 assume honest gradients satisfy g_t^k = f_infer(g_{t-1}^k, g_{t-1}) while malicious gradients 'lack predictability.' Under this threat model, an attacker can submit g_t^k = g_t^h + ε·v, where g_t^h is an honest gradient the attacker already knows and v is a fixed poisoning direction. For small ε this gradient follows the same autoregressive trajectory as honest gradients, so its cosine similarity ρ_k to the VERT prediction in Section 4.2.2 will be comparable to that of honest users, and the top-κ selection in Eq. (2) will admit it at the tested compromise rates (κ=15 out of 80 or κ=8 out of 90). None of the four evaluated attacks (GN, MR, AGR, ALIE) optimizes against the predictor or copies honest trajectories. Thus the headline claim of effective defense at 80–90% compromise is not established for attackers within the paper's own threat model. The self-reported separation in Figure 3 and Section 6.2.1 (honest similarity ≈1.0 vs. malicious ≈0.86–0.88) is also small enough that a tailored attack could close it.","section":"Section 3.2; Sections 2.2 and 4.1; Section 4.2.2"},{"comment":"The exception-handling step replaces any user gradient not in C_t^opt with the global gradient before training the predictor. Since C_t^opt is the output of VERT's own cosine-similarity ranking, the predictor's training labels depend on the defense's previous selections. The similarity separation reported in Section 6.2.1 is therefore not an independent measure of honest-vs-malicious predictability; it may partly reflect that the training set has already been filtered by VERT. This circularity should be addressed by an ablation: train the predictor on raw historical gradients without replacement, or on a held-out set of known honest gradients, and report whether the separation persists. Without this, the claimed mechanism for why VERT separates honest from malicious gradients is not fully supported.","section":"Section 4.2.2; Pseudocode 1, line 7"},{"comment":"The reported metric is the highest global-model accuracy over 200 rounds, with no error bars, no number of seeds, and no final-round accuracy. Because a defense that eventually diverges can still have a high transient peak, the comparison is not statistically grounded. The MNIST GN results are also non-monotonic in the compromise rate (58.29% at pr=80% vs. 81.11% at pr=90%, Table 2), which is counterintuitive and should be explained or verified with repeated trials. Please report mean ± std over at least five seeds, the accuracy at the final communication round, and representative learning curves for the main comparisons.","section":"Tables 2 and 4; Section 6.2.2"},{"comment":"The closed-form solution for the coefficient matrices is not derived correctly. Setting the product (2X−2Y) f'_pred f'_proj g^this_k to zero in Eq. (17) only yields X=Y under the additional assumption that the activation derivatives are nonzero; the product also vanishes when f'_pred or f'_proj is zero, and the denominator √(X^TX − X^TY − Y^TX + Y^TY) in Eq. (16) depends on X and Y and cannot be discarded without justification. Moreover, Eq. (20) divides by the vector g^this_k, which is not well-defined for arbitrary gradient entries. As written, Section 5.2 does not prove that the optimization objective in Eq. (6) is minimized; this section should be corrected or replaced with a heuristic justification.","section":"Section 5.2; Appendix B, Eqs. (16)–(20)"}],"minor_comments":[{"comment":"The claim that 'the optimal aggregation gradients selected by VERT only contains a few or even no malicious gradients' is not directly verified; reporting a selection-precision metric (e.g., the fraction of top-κ selections that are honest users) would make the defense mechanism transparent.","section":"Section 6.2.2"},{"comment":"The contributions state that implementation code is released, but the manuscript does not provide a repository link or an availability statement; please add one so the claim is verifiable.","section":"Contributions; Section 6.1"},{"comment":"There are typographical issues in the definition: 'C t}' should be 'C^t', and 'g can obtain the k gradients' should read 'top-κ can obtain the κ gradients with the highest probability.'","section":"Definition 4.3"},{"comment":"The similarity curves for compromised users stay in a narrow band (0.86–0.88), and the discussion speculates that the predictor captures the distribution of malicious gradients; this speculation should be tested, for example by reporting similarity on a held-out set of never-seen malicious gradients.","section":"Section 6.2.1; Figure 3"},{"comment":"The runtime for FLANDERS is estimated by scaling VERT's runtime by the number of optimized parameters rather than measured; this should be stated more prominently in the main text so the comparison is not mistaken for an empirical benchmark.","section":"Section 6.2.3; Table 3"}],"recommendation":"major_revision","confidential_remarks":"The central vertical-solution idea is worth pursuing, but the current manuscript overclaims robustness against attackers that the threat model itself permits. I would ask the authors to either narrow the threat-model claims, add adaptive-attack experiments, and fix the training circularity, or explicitly position VERT as a defense against non-adaptive poisoning attacks. The theoretical analysis in Section 5.2 also needs correction before the paper can be considered for publication."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The core idea is a vertical defense: predict each user's current gradient from its own history and the global gradient, then select the top-k by cosine similarity. That is a reasonable extension of FLDetector and FLANDERS, and the main tables show VERT beating the baselines in most cells. But the headline claim of defending against 80–90% poisoning is not convincingly supported. The evaluation reports peak accuracy over 200 rounds with no error bars or seeds, and the threat model allows attackers who can copy honest gradients, which undermines the separation the defense relies on.\n\nWhat is actually new: per-element learned coefficient matrices A and B for fusing user and global gradients, a trainable low-dimensional projector that cuts the computational cost from O(d^2) to O(ds), and top-k cosine selection. The complexity analysis is useful, and the runtime comparison with FLANDERS, though estimated, makes the scalability point. The experiments cover three datasets and four standard attacks under IID and non-IID splits, which is a decent effort. The paper also honestly reports that malicious gradients still achieve 0.86–0.88 cosine similarity, which is a narrower gap than you would want.\n\nThe main soft spot is the predictable-trajectory assumption in Sections 2.2 and 4.1. The threat model in Section 3.2 grants the attacker knowledge of other honest gradients and training code, so a malicious user can submit a slightly perturbed honest gradient, or simply replicate the predictor's output for that user. The cosine-similarity gap would collapse, and with 80–90% malicious, the top-k selector would necessarily include many of them. The paper only evaluates four non-adaptive attacks, none of which optimizes against the predictor. The stress-test note holds up on reading: this attack is within the stated threat model. Two smaller issues: Section 5.2's closed-form derivation uses the future gradient as the label, which is acceptable for training a predictor, but the exception handling in Section 4.2.2 replaces flagged malicious gradients with the global gradient, making training labels depend on the defense's prior selections; and the code is said to be released, but no link appears in the text.\n\nThis paper is for researchers working on Byzantine-robust federated learning who want a different angle than coordinate-wise trimming. It deserves a serious referee, but the current version needs major revision: add adaptive-attacker experiments, report means and variances over multiple seeds, release the code, and either relax or re-scope the headline claim. I would not cite it as it stands.","headline":"VERT's vertical prediction idea is plausible and the experiments are extensive, but the 80–90% robustness claim rests on a predictability assumption that adaptive attackers can break, and the evaluation lacks variance reporting.","tokens_in":22363,"tokens_out":1890,"would_cite":false,"duration_ms":19891,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"This paper claims that federated learning can be defended against model poisoning even when 80–90% of participating users are compromised, by predicting each user's gradient from historical rounds and aggregating only the users whose…","keywords":["federated learning","model poisoning attack","gradient prediction","autoregressive model","vertical defense","non-IID data","malicious gradient detection","Byzantine-tolerant aggregation"],"falsifier":"Run the paper's MNIST setup with 90% compromised users, but let malicious users train the same autoregressive predictor VERT uses on the public global-gradient history and set their malicious gradient to the predictor's current-round output, as the paper's threat model grants the attacker full knowledge of honest gradients; if VERT's top-k selection then lets global-model accuracy fall to the no-defense level (roughly 10–15% under Gaussian noise), the predictability-gap claim is falsified.","tokens_in":21261,"feed_emoji":"🛡️","tokens_out":7847,"duration_ms":65767,"temperature":0.7,"pith_summary":"Federated learning is vulnerable to model poisoning because its aggregation server must trust the gradients uploaded by users. The paper argues that existing defenses reason 'horizontally,' comparing all users' gradients within a single communication round, and that this approach collapses when more than half the users are malicious because the malicious gradients dominate the comparison. VERT instead reasons 'vertically': it treats each user's gradient sequence across rounds as a predictable trajectory, trains an autoregressive predictor on historical user and global gradients, and keeps for aggregation only the top-k users whose current gradient is most similar to the predicted one. The paper's central claim is that honest gradients are predictable while malicious ones are not, and its experiments report that this gap makes VERT effective against four model-poisoning attacks on MNIST, CIFAR10, and CIFAR100 when 80–90% of users are compromised, under both IID and non-IID data, without assuming a clean server dataset or knowledge of the attacker. A low-dimensional projector keeps the added computational cost at O(ds) with s << d, so the defense scales to models with tens of millions of parameters.","feed_headline":"Gradient prediction defeats 90% poisoning in federated learning","feed_subtitle":"VERT keeps global accuracy high when 80–90% of participants are malicious, without assuming a clean server dataset.","key_machinery":"The central object is the 'vertical solution' (Definition 4.3): using global communication rounds as the vertical axis so that each user's gradient is judged against its own history and the global gradient history, not against other users' current gradients, thereby bypassing the malicious-gradient dominance problem (Definition 4.2) that breaks horizontal solutions. The carrying mechanism is an autoregressive predictor f_pred, fed with the optimizable combination A⊙g_{t-1}^k + B⊙g_{t-1} of the user's previous gradient and the previous global gradient, trained to minimize the squared distance to the projected next gradient, followed by cosine-similarity ranking rho_k = cos(tilde_p_t^k, f_proj(g_t^k)) and top-k selection. A low-dimensional vector projector f_proj maps gradients from dimension d to s with s << d, reducing the predictor's parameter count and runtime from O($d^{2}$) to O(ds).","core_discovery":"VERT establishes, on the paper's own terms, that the convergence process of a federated model is highly predictable: the gradient of user k in round t can be inferred from the user's own previous gradient and the previous global gradient, g_t^k = f_infer(g_{t-1}^k, g_{t-1}). The defense trains an autoregressive predictor f_pred, with element-wise learnable coefficient matrices A and B, to approximate f_infer, projects all gradients through a low-dimensional linear projector f_proj, and ranks users by the cosine similarity between predicted and actual projected gradients, selecting the top-k as the aggregation set. The paper reports the best global model accuracy on MNIST, CIFAR10, and CIFAR100 under Gaussian noise, model replacement, Min-Max distance, and 'a little is enough' attacks at 80% and 90% compromise rates, including in non-IID settings, and reports a computational cost orders of magnitude below the closest vertical defense.","pith_inferences":["Editorial inference: an adaptive attacker who trains the same autoregressive predictor on the public global-gradient history and emits gradients that follow the predicted honest trajectory could erode the cosine-similarity gap; the paper does not analyze such an attack.","Editorial inference: because under large-scale attack the global gradient itself is poisoned, feeding it to the predictor may bias what VERT learns to call 'honest'; the paper's replacement of suspicious gradients with the global gradient could propagate that bias rather than remove it.","Editorial inference: the vertical-axis principle transfers to other settings with smooth convergent trajectories, such as decentralized or personalized training, where the same predictability check could serve as an anomaly detector."],"forward_implications":["At 80–90% compromise rates, where Krum, Median, and FedAvg degrade to near-random accuracy, VERT maintains usable global model accuracy on MNIST, CIFAR10, and CIFAR100, showing the regime of large-scale poisoning is not inherently undefendable.","The defense imposes no assumption of a clean server dataset, no requirement to know the number of compromised users, and no restriction on the attacker's knowledge; only the server-side deployment of VERT is needed.","The low-dimensional projector makes the defense feasible for large models: the paper estimates a naive predictor for ResNet would require about 400,000 GB of memory, while VERT's projected version runs in seconds.","The successive aggregation method matters: VERT+Krum handles Min-Max and ALIE attacks better, while VERT+FedAvg handles Gaussian noise better, so VERT can be combined with existing robust aggregators."],"supporting_citations":[{"why":"Defines the FedAvg protocol that VERT protects and provides the aggregation baseline used throughout the experiments.","marker":"[1]"},{"why":"Supplies the model replacement attack (MR) that is one of the four poisoning attacks in the evaluation.","marker":"[10]"},{"why":"Supplies the Min-Max distance attack (AGR) that is one of the four poisoning attacks in the evaluation.","marker":"[11]"},{"why":"Krum is the horizontal defense VERT must beat and the successive aggregation method in VERT+Krum.","marker":"[12]"},{"why":"Median is another horizontal baseline defense the paper compares against.","marker":"[13]"},{"why":"FLANDERS provides evidence that honest gradients have higher predictability than malicious ones and is the closest vertical defense for comparison.","marker":"[19]"},{"why":"FLDetector is the earliest vertical solution and a baseline that fails when attacks begin early.","marker":"[20]"},{"why":"The cited convergence analysis grounds the claim that model parameter updates follow a predictable convergence pattern.","marker":"[24]"},{"why":"Supplies the 'a little is enough' attack (ALIE) that is one of the four poisoning attacks in the evaluation.","marker":"[34]"}],"fun_headline_variants":["Predicting gradients defeats 90% poisoning in federated learning","Vertical defense thwarts 90% model poisoning in federated learning","Federated learning: predict gradients to block 90% poisoning","Gradient prediction defense scales to 90% malicious clients"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The defense rests on the assumption that honest gradients follow a learnable trajectory across communication rounds while malicious gradients do not; if an attacker crafts gradients that match that trajectory, or poisons the global gradient fed to the predictor, the cosine-similarity ranking no longer separates honest from malicious users.","fun_headline_variants_meta":{"raw":{"variants":["Predicting gradients defeats 90% poisoning in federated learning","Vertical defense thwarts 90% model poisoning in federated learning","Federated learning: predict gradients to block 90% poisoning","Gradient prediction defense scales to 90% malicious clients"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000206,"raw_usage":{"total_tokens":1411,"prompt_tokens":974,"completion_tokens":437,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":590,"completion_tokens_details":{"reasoning_tokens":365}},"tokens_in":590,"tokens_out":437,"duration_ms":5078,"temperature":1.0,"reasoning_tokens":365,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-12T19:26:27.841737+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run the paper's MNIST setup with 90% compromised users, but let malicious users train the same autoregressive predictor VERT uses on the public global-gradient history and set their malicious gradient to the predictor's current-round output, as the paper's threat model grants the attacker full knowledge of honest gradients; if VERT's top-k selection then lets global-model accuracy fall to the no-defense level (roughly 10–15% under Gaussian noise), the predictability-gap claim is falsified.","supporting_citations":[{"cited_title":"Convergence analysis of two-layer neural net- works with relu activation,","cited_arxiv_id":null,"evidence_quote":"The cited convergence analysis grounds the claim that model parameter updates follow a predictable convergence pattern."},{"cited_title":"Baruch, G","cited_arxiv_id":null,"evidence_quote":"Supplies the 'a little is enough' attack (ALIE) that is one of the four poisoning attacks in the evaluation."}],"review_version":1}