{"id":"5bef0cfe-7b7f-448a-a4d8-805ccd9b10f7","arxiv_id":"2412.19354","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":2,"one_line_summary":"FedBAT combines hybrid adversarial training with augmentation-invariant self-distillation to improve both clean and robust accuracy in federated learning under non-IID data.","lead":"FedBAT is a federated learning method that mixes regular and adversarial training on each device and then aligns each device's adversarial image features with an average of clean features across devices. It aims to keep models accurate on normal images while defending against adversarial attacks in decentralized, non-IID settings.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The global distillation target in Eqs. 10-12 is underspecified for missing classes and is not written class-conditionally, so the claimed clean/robust gains may depend on undocumented implementation choices.","rationale":"Reading in good faith, the paper proposes a coherent two-part method: hybrid adversarial training to balance clean and robust accuracy, and self-adversarial distillation to align local adversarial features with global clean features. The reported tables are internally consistent, the ablation study supports both components, and the comparisons across five datasets strengthen the empirical claim. My concern is not that the authors are dishonest, but that the load-bearing premise of an 'unbiased global representation' is asserted rather than demonstrated, and the formal specification of that representation is incomplete precisely where non-IID data makes it fragile. The missing-class problem in Eq. 11, the non-class-conditional form of Eq. 12, and the absent model-aggregation step in Algorithm 1 mean that a reader cannot reconstruct the exact method from the manuscript. This does not disprove the method; a corrected implementation might still deliver the reported gains. It does, however, make the central claim conditional on implementation details that are not presently specified, which is exactly the reader's conditional verdict. I therefore recommend no change to the reader's verdict: CONDITIONAL pending code, corrected algorithm pseudocode, and a robustly defined global feature target.","tokens_in":24500,"tokens_out":6995,"duration_ms":71285,"concrete_test":"Re-run FedBAT on Fashion-MNIST with the hyperparameters of Section V-A (Dir(0.5), 5 clients, 10% data) using the class-conditional MSE L_ASD = ||f_e_i(hat x_adv_i) - \\bar{X}_{y_i}||^2, and compare three missing-class conventions for Eq. 11: zero-fill absent classes, average only over present clients, and count-weighted averaging. If clean or robust accuracy moves by more than about 1% across conventions, or the reported 73.40% clean / 53.44% robust numbers are not reproduced, the central claim is not robust to the unspecified target definition.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The empirical case for FedBAT rests on the ASD regularizer, whose target \\bar{X} is asserted in Section IV-D (citing [21], [22], [37], [74]) to be 'less biased' than local representations. The paper never defines how Eq. 11 handles a client with no samples of class j, which is common under Dir(0.5) with 5 clients and 10 classes. Eq. 10 defines X_i,j by averaging over S_i,j samples; if S_i,j = 0, X_i,j is undefined. Zero-filling would shrink and skew \\bar{X}_j; averaging only over present clients would make it a subset average rather than a global average. Algorithm 1 compounds this: line 5 calls LocalUpdate(θ_t) without passing \\bar{X}, line 8 computes \\bar{X} only after local updates, and no model-parameter aggregation step appears before the next round. Eq. 12 also aligns f_e_i(hat x_adv_i) with the whole set \\bar{X}, although the text says alignment is with the semantically matching class. The reported gains, e.g., +5.40% clean and +4.58% robust on Fashion-MNIST over FedPGD, may therefore depend on undocumented choices for the distillation target and the missing aggregation step.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes FedBAT, a federated adversarial training framework that combines a hybrid adversarial training loss (FHA) with an augmentation-invariant self-adversarial distillation (ASD) regularizer. FHA interpolates between clean cross-entropy loss and adversarial cross-entropy loss via a trade-off coefficient λ, while ASD aligns local adversarial feature embeddings with class-wise global clean feature averages computed by averaging per-client augmented features at the server. The paper claims that this joint design simultaneously improves clean accuracy and robust accuracy under non-IID data and adversarial attacks. Experiments on MNIST, Fashion-MNIST, SVHN, Office-Amazon, and CIFAR-10 compare FedBAT against FedPGD, MixFAT, CalFAT, DBFAT, and other baselines, reporting gains in both clean and robust accuracy. An ablation study attributes the gains to the combination of hybrid-AT and ASD.","tokens_in":24763,"tokens_out":5197,"duration_ms":47827,"significance":"The empirical scope is a strength: the paper evaluates five datasets, six attack types, several Dirichlet heterogeneity levels, client counts up to 40, a 100-client scalability setting, and a four-configuration ablation. The core idea of using global clean feature prototypes as distillation targets for local adversarial features is well motivated and worth pursuing. However, the paper does not provide code, error bars, or a validation-based hyperparameter selection protocol, and the algorithmic specification contains sequencing gaps that prevent reproduction as stated. The central empirical claim is defensible, but the current presentation does not yet establish it rigorously.","major_comments":[{"comment":"The pseudocode is not executable as written. At line 5, LocalUpdate(θ_t) is called without the global feature set \\bar{X}, but line 8 computes \\bar{X} only after all local updates have finished, and line 21 inside LocalUpdate uses \\bar{X} to compute L_ASD. Therefore the current round's global features are never available to the clients. Furthermore, there is no model-parameter aggregation step: line 10 computes only the scalar loss L_adv, not an updated global parameter vector θ_{t+1} from the returned θ_t^i. The prose in Section IV-E states that line 10 aggregates model parameters, which contradicts the content of line 10. This sequencing issue is load-bearing because the reported results depend on when \\bar{X} is computed and how the global model is updated.","section":"Section IV-E, Algorithm 1"},{"comment":"Equation (12) defines L_ASD as the squared ℓ2 distance between the local adversarial feature f_e_i(hat{x}_adv_i) and the entire set \\bar{X}, but the surrounding text says that alignment is with the semantically matching class. If the loss is truly computed against the whole set, it is not a class-conditional distillation objective and could mix class information; if it is class-conditional, the equation must be written with \\bar{X}_{y_i}. In addition, Eq. (10) is undefined when S_i,j = 0, which is common under a Dir(0.5) partition with 5 clients and 10 classes. The manuscript does not state how absent classes are handled in the client average or in the server-side average. These are not minor notation choices: they change the numerical values in Tables III-VII and affect the validity of the reported gains.","section":"Section IV-D, Eqs. (10)-(12)"},{"comment":"The hyperparameter λ is selected per task by inspecting the test-accuracy and test-robustness curves in Fig. 9 and marking a red star. This is selection on the test set, so the reported clean and robust accuracies are optimistically biased relative to an honest model-selection protocol. The observation that the curves plateau after ρ=1.0 provides some reassurance, but it does not replace a validation-based or nested selection procedure. The paper should either report results for a fixed λ across tasks, use a validation split for choosing λ, or provide a sensitivity table showing that the qualitative conclusions are unchanged over a range of λ values.","section":"Section V-F, Fig. 9"},{"comment":"All reported metrics are single runs, averaged over the last 5 iterations, with no standard deviations or multiple seeds and no multiple data partitions. In non-IID federated learning, variance across client partitions and random seeds is substantial. Several reported gains are small, for example +0.66% RA on CIFAR-10 in Table VIII, and may be within noise. The manuscript should report mean ± std over at least 3-5 seeds, or otherwise justify that the differences are statistically meaningful. Without this, the claim that FedBAT 'consistently outperforms' the baselines is not fully supported.","section":"Tables III-VIII and Figs. 5-8"},{"comment":"The claim that global clean features are 'less biased' than local features is the foundation of the ASD regularizer, but it is supported only by citations to [21], [22], [37], [74] rather than by analysis or measurement in the proposed framework. The target \\bar{X}_j is itself computed from the local models, so the regularizer is self-referential in the sense that the distillation target is derived from the same global model's own local features under non-IID participation. To make the argument load-bearing, the paper should provide a concrete justification, for example an empirical check that \\bar{X}_j approximates the true global class mean as the number of clients grows, or a demonstration that the regularization does not degrade performance under extreme heterogeneity where the averaged target is skewed.","section":"Section IV-D"}],"minor_comments":[{"comment":"The section heading 'Proposed FedBAFT Framework' uses 'FedBAFT', while the rest of the paper uses 'FedBAT'. The abbreviation should be made consistent.","section":"Section IV"},{"comment":"The caption refers to a coefficient α balancing the trade-off between L_adv_i and L_i, but Eq. (9) uses λ. The notation should be unified.","section":"Figure 2 caption"},{"comment":"The subsection title 'Implementaion Details' contains a typo; it should be 'Implementation Details'.","section":"Section V-A"},{"comment":"The caption says the selected parameter is 'highlighted with 8', which appears to be a rendering artifact; it should say 'highlighted with a red star'.","section":"Figure 9 caption"},{"comment":"The text says the entire dataset is partitioned into 100 clients 'using the default Dirichlet parameter value'; to be self-contained, the numerical value 0.5 should be restated here rather than referring back to the setup section.","section":"Section V-D"},{"comment":"The function signature at line 12 reads LocalUpdate(θ_t, \\bar{X}), but the call at line 5 passes only θ_t. The algorithm should either pass \\bar{X} to the clients or make clear that the feature exchange happens at a different point in the round.","section":"Section IV-E, Algorithm 1"}],"recommendation":"major_revision","confidential_remarks":null},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"FedBAT is a plausible, incremental contribution. The new bit is the specific pairing: aligning local adversarial features of augmented images with class-wise global clean features via MSE, on top of a weighted clean+adversarial loss. The components are known, but I don't think this exact combination appears in the cited literature.\n\nWhat the paper does well is the experimental sweep: five datasets, six attacks, Dirichlet heterogeneity levels, client counts, a 100-client scalability test, and ablations. The reported gains are consistent across tables, and they hold for both clean and robust accuracy—e.g., +5.40% CA and +4.58% RA on Fashion-MNIST over FedPGD. That's real evidence, even if the improvements are modest and the baselines are reasonable.\n\nThe soft spots are mostly about reproducibility. Algorithm 1 uses \\bar{X} inside LocalUpdate before the server computes it, and no model-parameter aggregation step appears anywhere. Eq. 12 aligns a feature vector with the whole set \\bar{X}, which is undefined; the prose says alignment is with the semantically matching class, but the equation doesn't say how that selection happens. Under Dir(0.5) with 5 clients, some clients will have zero samples of a class, and Eq. 10 divides by S_{i,j}, so X_{i,j} is undefined. The paper never states the fallback. That's a genuine gap, not a nitpick.\n\nThe 'less biased global average' premise is cited from MOON/FedProto et al. rather than demonstrated. I don't consider that fatal—it's a reasonable heuristic—but a convergence or bias analysis would have helped. Also, λ is chosen per task from test-set curves (Fig. 9), and there are no error bars or multiple seeds, so the magnitude of the gains could be optimistic.\n\nCitation pattern looks fine; self-citations are to the authors' earlier work and are relevant.\n\nBottom line: this is a useful incremental result for people in robust FL. It deserves a serious referee, but the authors need to fix the algorithm listing, specify the class-conditional alignment, handle missing classes, and ideally release code. I'd send it to review expecting major revision.","headline":"A plausible incremental combo of hybrid AT and feature distillation for robust FL, with consistent but under-supported empirical gains and a few reproducibility gaps.","tokens_in":25336,"tokens_out":3534,"would_cite":false,"duration_ms":30834,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"A two-branch hybrid adversarial loss plus a global feature alignment term lets federated models defend against adversarial examples while keeping clean accuracy near standard-training levels.","keywords":["federated learning","adversarial training","knowledge distillation","non-IID data","robustness","edge computing"],"falsifier":"Train FedBAT but in each round compute the global feature mean $\\bar{X}$ from a single randomly chosen client's local features instead of the full average. If the reported clean and robust accuracy gains vanish, the less-biased-global-mean assumption is falsified.","tokens_in":1395,"feed_emoji":"🛡️","tokens_out":8016,"duration_ms":90722,"temperature":0.7,"pith_summary":"This paper tries to establish that a federated model can be made resistant to adversarial attacks without paying the usual steep penalty in clean accuracy, by combining two local-training modifications. The first is hybrid adversarial training, which treats adversarial examples as an extra data augmentation stream and weights the clean and adversarial losses. The second is augmentation-invariant self-adversarial distillation, which pulls each client's adversarial features toward an averaged global clean feature for the same class. On MNIST, Fashion-MNIST, SVHN, Office-Amazon, and CIFAR-10 under non-IID splits, FedBAT reports higher clean and robust accuracy than the compared federated adversarial-training baselines. If correct, it gives edge deployments a way to defend against attacks while keeping the model usable on ordinary inputs.","feed_headline":"FedBAT wins on clean and robust accuracy in federated non-IID settings","feed_subtitle":"A hybrid adversarial loss plus a global feature alignment target beats standard federated defenses on five datasets.","key_machinery":"The load-bearing mechanism is the pairing of two local objectives with a server-side averaging step. The hybrid adversarial loss $\\mathcal{L}_{\\mathrm{FHA}}=(1-\\lambda)\\mathcal{L}_i+\\lambda\\mathcal{L}_i^{\\mathrm{adv}}$ treats adversarial examples as an augmentation branch that balances clean accuracy and robustness. The self-adversarial distillation loss $\\mathcal{L}_{\\mathrm{ASD}}=\\|f^e_i(\\hat{\\boldsymbol{x}}_i^{\\mathrm{adv}})-\\bar{X}\\|_2^2$ measures the squared distance between a client's adversarial augmented features and the global augmented clean representation $\\bar{X}$, which is the mean over clients of per-class averaged local augmented features. The global average is what is supposed to supply the less-biased distillation target.","core_discovery":"The central claim is that the accuracy-robustness trade-off in federated adversarial training can be shifted by connecting adversarial training to data augmentation and by regularizing local adversarial features with a global, class-wise clean-feature target. Concretely, FedBAT minimizes $\\mathcal{L}_i^{\\mathrm{adv}} = (1-\\lambda)\\mathcal{L}_i + \\lambda\\mathcal{L}_i^{\\mathrm{adv}} + \\|f^e_i(\\hat{\\boldsymbol{x}}_i^{\\mathrm{adv}}) - \\bar{X}\\|_2^2$, where the first two terms form the hybrid adversarial loss and the last term aligns local adversarial augmented features with the global averaged clean augmented representation of the same semantic class. The paper argues this alignment makes local updates less biased under non-IID data and makes adversarial representations consistent with clean ones, and reports consistent gains over several federated defense baselines across five datasets, for example $+5.40\\%$ clean and $+4.58\\%$ robust accuracy over FedPGD on Fashion-MNIST.","pith_inferences":["The global feature average in Eq. (11) is a potentially weak link under partial participation: if only a few clients report features for a class in a given round, the 'global' target is really a small-sample average, so the benefit may depend on participation frequency. A testable extension is to weight or robustly aggregate the local feature means.","Because the distillation target is a per-class mean of augmented clean features, the method is effectively doing variance reduction around a shared anchor; this suggests it could be combined with other non-IID remedies such as prototype anchoring or logit calibration, and its gains would be expected to grow when client feature drift is large.","The paper's trade-off curves plateau for loss ratio $\\rho \\ge 1$, implying the method is insensitive to the balance hyperparameter once robustness dominates; a practical implication is that $\\lambda$ needs little per-task tuning beyond the plateau region."],"forward_implications":["On Fashion-MNIST with Dir(0.5), FedBAT reports +5.40% clean accuracy and +4.58% robust accuracy over FedPGD, showing the hybrid loss can recover much of the clean-accuracy drop from adversarial training.","Across five datasets, FedBAT reports the best clean and robust accuracy among the compared methods under six attack types, including AutoAttack.","FedBAT remains ahead of baselines as data heterogeneity varies (Dirichlet parameter 0.1 to 3.0) and as client count grows to 40, suggesting the gains are not tied to one heterogeneity level.","Robustness gains persist in a large-scale setting with 100 clients and 10% participation per round, indicating the method scales to partial participation."],"supporting_citations":[{"why":"Supplies the standard federated averaging objective that all compared methods build on.","marker":"[9]"},{"why":"Formulates federated adversarial training from local adversarial examples, which FedBAT modifies through its hybrid loss.","marker":"[11]"},{"why":"Provides the PGD attack-and-defense loop used to generate adversarial examples and to define FedPGD.","marker":"[18]"},{"why":"Cited for the claim that shared global representations are less biased than local representations in non-IID data.","marker":"[21]"},{"why":"Supports the idea of exchanging per-class prototype-like representations to guide local training.","marker":"[37]"},{"why":"Reinforces the premise that global prototypes are less biased, grounding the distillation target's design.","marker":"[74]"},{"why":"Serves as an adversarial-distillation baseline that constrains local adversarial features or logits.","marker":"[55]"},{"why":"Supplies AutoAttack, the strongest attack used to compare robust accuracy across methods.","marker":"[20]"}],"fun_headline_variants":["FedBAT: hybrid adversarial training for robust federated learning","Adversarial feature alignment improves federated robustness","Robustness without accuracy loss in federated non-IID","Self-adversarial distillation stabilizes federated training"],"cache_read_input_tokens":27392,"weakest_assumption_plain":"The load-bearing premise is that the global augmented clean representation, obtained by averaging local per-class features across clients, is less biased than each client's local representation and thus a reliable distillation target for local adversarial features.","fun_headline_variants_meta":{"raw":{"variants":["FedBAT: hybrid adversarial training for robust federated learning","Adversarial feature alignment improves federated robustness","Robustness without accuracy loss in federated non-IID","Self-adversarial distillation stabilizes federated training"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.00041,"raw_usage":{"total_tokens":2140,"prompt_tokens":973,"completion_tokens":1167,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":589,"completion_tokens_details":{"reasoning_tokens":1113}},"tokens_in":589,"tokens_out":1167,"duration_ms":7774,"temperature":1.0,"reasoning_tokens":1113,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-11T00:40:21.052350+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Train FedBAT but in each round compute the global feature mean $\\bar{X}$ from a single randomly chosen client's local features instead of the full average. If the reported clean and robust accuracy gains vanish, the less-biased-global-mean assumption is falsified.","supporting_citations":[{"cited_title":"Communication-efficient learning of deep networks from decentralized data,","cited_arxiv_id":null,"evidence_quote":"Supplies the standard federated averaging objective that all compared methods build on."},{"cited_title":"Fat: Federated adversarial training,","cited_arxiv_id":null,"evidence_quote":"Formulates federated adversarial training from local adversarial examples, which FedBAT modifies through its hybrid loss."},{"cited_title":"Towards deep learning models resistant to adversarial attacks,","cited_arxiv_id":null,"evidence_quote":"Provides the PGD attack-and-defense loop used to generate adversarial examples and to define FedPGD."},{"cited_title":"Model-contrastive federated learning,","cited_arxiv_id":null,"evidence_quote":"Cited for the claim that shared global representations are less biased than local representations in non-IID data."},{"cited_title":"Fedproto: Federated prototype learning across heterogeneous clients,","cited_arxiv_id":null,"evidence_quote":"Supports the idea of exchanging per-class prototype-like representations to guide local training."},{"cited_title":"Fedproc: Prototypical contrastive federated learning on non-iid data,","cited_arxiv_id":null,"evidence_quote":"Reinforces the premise that global prototypes are less biased, grounding the distillation target's design."},{"cited_title":"Delving into the adversarial robustness of federated learning,","cited_arxiv_id":null,"evidence_quote":"Serves as an adversarial-distillation baseline that constrains local adversarial features or logits."},{"cited_title":"Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks,","cited_arxiv_id":null,"evidence_quote":"Supplies AutoAttack, the strongest attack used to compare robust accuracy across methods."}],"review_version":1}