{"id":"193dc74c-1bdb-4551-b390-329c04960879","arxiv_id":"2502.04890","paper_version":2,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":1,"one_line_summary":"A skew-aware Byzantine attack, STRIKE, exploits the tendency of honest non-IID gradients to form dense clusters away from their mean, hiding malicious gradients inside the cluster.","lead":"This paper finds that in non-IID federated learning, many honest local gradients can cluster together in a direction away from their average, and a new attack called STRIKE hides malicious gradients inside that skewed cluster to fool standard Byzantine defenses. A smart generalist should read it because it shows that defenses built on the assumption that 'dense means honest' can be systematically broken when client data is heterogeneous.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Stage-1 search for skewed gradients rests on an unproven high-dimensional extension of Pearson's formula; if the mode is not on the mean-to-median direction, STRIKE selects the wrong cluster and the central claim loses support.","rationale":"The central claim is that gradient skew makes density-based Byzantine defenses vulnerable. The most load-bearing link is the first-stage heuristic that locates the skewed cluster. The paper justifies this with Pearson's formula, a univariate empirical rule, and validates it only through LLE images and end-to-end attack success. That leaves open a real alternative explanation: the attack might succeed even when the search direction is wrong, or the reported success might come from the ν tuning (the paper reports the best test accuracy over ν ∈ {0.25,...,2}) rather than from the skew-aware selection. The reader's weakest_assumption correctly identifies this, and I agree. I do not see a reason to move the verdict to REJECT: the experiments are broad (3 datasets, 7 defenses, bucketing, NNM), the code is released, and the attack is genuinely novel. But the missing ablation of the search direction and the n−f versus n−2f inconsistency are concrete, checkable weaknesses. A CONDITIONAL verdict remains appropriate, with the condition being that the search stage is demonstrated to be necessary and the algorithm description is repaired.","tokens_in":16253,"tokens_out":6969,"duration_ms":66036,"concrete_test":"On the ImageNet-12 non-IID setup, run STRIKE with three variants of stage 1: (i) original usearch = gmed − ĝ; (ii) reversed direction ĝ − gmed; (iii) a random fixed unit vector. Keep stage 2 and ν=1 identical. If reversed or random directions give comparable attack accuracy, the mode-location assumption is not responsible for the reported effectiveness; if they degrade sharply, the assumption is validated on this benchmark. In addition, verify against the released code whether S is n−2f or n−f; if the code uses n−f, rerun the main tables with n−2f to confirm the published numbers.","verdict_should_be":"UNCHANGED","load_bearing_attack":"STRIKE's first stage assumes the coordinate-wise median direction gmed − ĝ points toward the dense cluster of honest gradients, invoking Karl Pearson's univariate formula that the mode and median lie on the same side of the mean. This is an empirical rule for scalar distributions; no analogue is proven for high-dimensional neural-network gradients. In non-IID FL, honest gradients can be multimodal (e.g., clusters tied to label partitions), and the mean-to-median direction may point between clusters rather than at the dominant one. If S is mis-selected, stage 2 hides Byzantine gradients in a non-dense region, and density-based defenses should not be fooled. The paper's only evidence for the skew is LLE visualizations (Figures 2 and 5), and it offers no quantitative skewness measure or ablation of the search direction. This is load-bearing because the novelty of STRIKE and the claimed vulnerability of density-based defenses both rest on this step. An additional internal inconsistency: Section 5 and Eq. (8) define S as the n−2f highest-projection gradients, but Algorithm 1 selects n−f; if the implementation followed Algorithm 1, the 'exclude f outlier honest gradients' mechanism described in the text is not what was evaluated.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper claims a new vulnerability of Byzantine-robust federated learning under non-IID data: honest local gradients can form a dense, skewed cluster that lies away from the mean honest gradient. It argues that robust aggregators that trust dense gradients will mistake this cluster for the honest majority and can be fooled. The proposed STRIKE attack has two stages: first, it identifies the skewed cluster by projecting honest gradients onto the direction from the mean to the coordinate-wise median; second, it crafts Byzantine gradients as a scaled, sign-aligned perturbation of the cluster mean, constrained to remain inside the cluster's diameter. Experiments compare STRIKE with six baselines against seven defenses on CIFAR-10, ImageNet-12, and FEMNIST, with additional experiments on bucketing and NNM variants.","tokens_in":16535,"tokens_out":6951,"duration_ms":62529,"significance":"If the phenomenon and attack work as described, this is a useful and timely contribution: it challenges the density-based inductive bias of popular Byzantine defenses, provides a concrete attack that exploits data heterogeneity, and releases code. The paper's strengths are the breadth of the evaluation (three datasets, seven defenses, two defense variants) and the clear two-stage attack formulation. However, the reported superiority of STRIKE is currently supported mainly by test-set selection of the attack-strength hyperparameter ν, and the stage-1 cluster search is validated only through nonlinear visualizations. These issues must be resolved before the central empirical claim can be taken at face value.","major_comments":[{"comment":"Appendix D.1 ('Other Setups') states that STRIKE is tested with ν ∈ {0.25,...,2.0} and that 'we report the lowest test accuracy (highest attack effectiveness).' Since the test accuracy is the evaluation metric, selecting ν per defense/dataset on that same metric makes Table 1 an oracle comparison: baseline attacks (e.g., LIE with z=1.5, IPM with ε=0.1) use fixed hyperparameters, while STRIKE receives the best test-set ν for each cell. The statement in §6.2 that 'simply setting ν=1 can beat almost all attacks' does not repair this, because Table 1 does not report which ν generated each number and the appendix only shows ν=1 results graphically for ImageNet-12. Please report main results with a fixed ν=1 (or with a defensible selection rule that does not use test accuracy) and/or clearly separate oracle-selection results from default-parameter results.","section":"Appendix D.1 ('Other Setups'); Table 1"},{"comment":"Algorithm 1 in Appendix B sets S to the n−f honest gradients with the highest scalar projection, whereas §5 (Eq. (8)) defines S as the n−2f gradients with the highest projection. With |H|=n−f, the former choice selects all honest gradients, making stage 2 trivial and inconsistent with the denominator n−2f used in the same algorithm to compute ¯gS. If the experiments followed Eq. (8), the algorithm as written does not describe the evaluated attack; if they followed Algorithm 1, the 'exclude f outlier honest gradients' mechanism is absent. Please correct the algorithm and state precisely which cardinality was used in the experiments.","section":"Algorithm 1 vs. §5, Eq. (8)"},{"comment":"The stage-1 search relies on the unproven assumption that the coordinate-wise mean-to-median direction points toward the dense skewed cluster. Karl Pearson's formula is a univariate empirical rule; no high-dimensional analogue is established for neural-network gradients. The only support is LLE visualization (Figures 1, 2, 5, 6), but LLE is a nonlinear embedding and does not preserve the relevant geometry in a way that certifies the mean-to-median direction, and no quantitative skewness metric or ablation of alternative search directions is provided. If honest gradients are multimodal or the mode is not on that direction, S will be mis-selected and the stage-2 hiding (Eq. (12)) will not place Byzantine gradients in a dense region. Please add a quantitative validation of the search (e.g., in the original gradient space, how often does the selected S contain the densest cluster?) or provide a theoretical justification.","section":"§5, Eq. (6)"}],"minor_comments":[{"comment":"The summation in Eq. (5) is over S, which is not defined in the definition; it should presumably be G. Please fix and clarify the role of κ.","section":"Definition 1, Eq. (5)"},{"comment":"Eq. (13) uses sign(¯gS), while Eq. (12) and Algorithm 1 use sign(¯gS − ¯g); the notation should be made consistent.","section":"Eq. (13)"},{"comment":"The header of Table 2 contains 'STRKE' instead of 'STRIKE'.","section":"Table 2"},{"comment":"The hardware descriptions are inconsistent: §6 says an NVIDIA Tesla V100 with 64GB RAM, Appendix C says 'a single A100 GPU', and Appendix D.1 says four GeForce GTX 1080Ti with a different CPU/RAM configuration. Please align the compute description.","section":"§6.1 and Appendix D.1"},{"comment":"Appendix D.1 lists 'LabelFlip' as a baseline attack, but Table 1 reports 'BitFlip'; please clarify whether LabelFlip was actually evaluated or whether this is a typo.","section":"Appendix D.1, baseline attacks"},{"comment":"Appendix C claims that f(α) has a unique zero point, but the listed facts (f(0)≤0, f→∞, continuity) do not by themselves imply uniqueness. Please provide a proof or weaken the claim to existence of a zero found by bisection.","section":"Appendix C"}],"recommendation":"major_revision","confidential_remarks":"The key concern is the test-set selection of ν; if the authors provide fixed-ν results and correct the Algorithm 1 inconsistency, I would be willing to support acceptance. The skew phenomenon itself is interesting and the experimental breadth is good. The paper fits the venue; no concerns about novelty or scope beyond the requested revisions."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Gradient skew is a real observation, and STRIKE is a genuinely new attack that exploits it. The paper is worth engaging with, though a few things need tightening.\n\nThe strongest part is the phenomenon: in non-IID FL, the dense mass of honest gradients can sit far from the average honest gradient. The authors show this clearly with LLE visualizations across three datasets, and they connect it to the inductive bias of density-based defenses. The attack is well engineered: stage-1 search toward the median, stage-2 constrained perturbation inside the skewed cluster. Experiments are extensive — seven defenses, three datasets, plus bucketing and NNM — and STRIKE is consistently the best or close to it. The code is public, which is a plus.\n\nThe soft spots are real but not fatal. First, the stage-1 search relies on Karl Pearson's univariate formula that the mode and median are on the same side of the mean, extended to high-dimensional gradients without proof. The stress-test note worries about multimodal honest gradients; that is a fair concern, and the paper's only evidence is visual. That said, the LLE pictures and the fact that STRIKE works across datasets and non-IID levels make the heuristic plausible. A quantitative skewness measure would have made this much stronger.\n\nSecond, the evaluation tunes ν per defense and per dataset using final test accuracy (Appendix D.2 reports 'the lowest test accuracy'), which inflates the reported gains. Figure 7 shows ν=1 is often competitive, so the weakness is minor, but the main-table numbers should be treated as best-case. The authors should report a fixed-rule version.\n\nThird, there is a concrete internal inconsistency: Section 5 and Eq. (8) define S as the n−2f highest-projection gradients, but Algorithm 1 selects n−f. The text says the goal is to have the AGR treat n−2f as honest and exclude f outliers; the algorithm contradicts that. The authors should say which one was actually run.\n\nAlso, the attack assumes knowledge of all honest gradients. That is shared with LIE and MinMax, so it is not a flaw per se, but it should be stated clearly in the abstract or threat model.\n\nOverall, the central phenomenon seems real and the attack is a solid contribution. I would send this to peer review with a request for revisions.","headline":"A genuinely new skew-aware attack with a credible core phenomenon; needs fixes on the search heuristic's evidence, ν selection, and an algorithm/text mismatch, but worth refereeing.","tokens_in":17011,"tokens_out":2501,"would_cite":true,"duration_ms":23693,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"The paper claims that under non-IID data the dense cluster of honest gradients skews away from the average honest gradient, and that Byzantine gradients placed inside that cluster defeat density-based robust aggregation.","keywords":["federated learning","Byzantine attacks","Byzantine robustness","gradient skew","non-IID data","model poisoning","robust aggregation","STRIKE attack"],"falsifier":"Record honest gradients from a non-IID federated learning run and test the search direction directly: compute the coordinate-wise median and the average of the honest gradients, project every honest gradient onto their difference, and examine whether the high-projection subset is in fact the dense cluster and whether its average lies far from the overall average. If the dense cluster is not recovered in this way, or if replacing the median by a different robust center changes the selected subset, the mechanism underlying STRIKE is not present in that setting.","tokens_in":16092,"feed_emoji":"🎯","tokens_out":7998,"duration_ms":70345,"temperature":0.7,"pith_summary":"Federated learning aggregates gradients from many clients, and Byzantine defenses commonly trust the gradient cluster that is densest, reasoning that honest clients must agree. This paper tries to establish that under non-IID data this assumption inverts: the honest gradients themselves form a dense cluster that is skewed away from the average honest gradient, so an attacker can put malicious gradients inside that dense cluster and be treated as honest. It names this phenomenon gradient skew and proposes STRIKE, a two-stage attack that finds the skewed cluster and then solves a constrained optimization to place Byzantine gradients within the cluster's diameter while pulling the aggregated gradient away from the true average. The paper reports that STRIKE outperforms six existing attacks against seven robust aggregation rules on three benchmark datasets, with the largest gains on the most heterogeneous data. If the claim is right, the practical lesson is that robustness to Byzantine clients is not achieved merely by trusting dense gradients; the shape of the honest gradient distribution matters.","feed_headline":"Hide Byzantine attacks in skewed honest gradients","feed_subtitle":"Non-IID data bend honest gradients away from their average, so density-based defenses trust the poisoned cluster.","key_machinery":"The machinery is the mean-to-median search direction $u_{\\mathrm{search}} = g_{\\mathrm{med}} - \\bar{g}$, justified by the classical statistics relation that for a skewed distribution the median lies between the mean and the mode, so moving from the mean toward the median points toward the dense skewed cluster. The first stage projects every honest gradient onto this direction and keeps the largest projections as the presumed skewed set. The second stage solves a one-dimensional optimization for $\\alpha$ using the bisection method, under the constraint that Byzantine gradients stay within the diameter of the skewed honest gradients, then emits $g_b = \\bar{g}_S + \\nu\\alpha \\, \\mathrm{sign}(\\bar{g}_S - \\bar{g}) \\odot \\sigma_S$. This construction is what lets the attack hide: coordinate-wise, Byzantine gradients are indistinguishable in scale from the skewed honest gradients, while the sign term pushes the aggregated result away from the honest average.","core_discovery":"The central discovery is a statistical fact about federated learning rather than a new defense: when client data are non-IID, the honest local gradients form a dense mass that is shifted away from their own average, and this shift persists across training rounds. Because robust aggregators formalize safety by bounding the distance from the aggregated gradient to the average of some candidate honest set, they are structurally biased toward the dense cluster; under gradient skew that cluster is the wrong target. STRIKE operationalizes this by selecting the honest gradients with the largest scalar projection onto $u_{\\mathrm{search}} = g_{\\mathrm{med}} - \\bar{g}$, i.e., the direction from the average toward the coordinate-wise median, which locates the skewed cluster. It then constructs each Byzantine gradient as $g_b = \\bar{g}_S + \\nu\\alpha \\, \\mathrm{sign}(\\bar{g}_S - \\bar{g}) \\odot \\sigma_S$, with $\\alpha$ chosen so that the Byzantine gradients stay within the diameter of the skewed cluster, and $\\nu$ an adjustable strength parameter. The paper's experiments show that this construction reliably lowers final model accuracy on CIFAR-10, ImageNet-12, and FEMNIST across Multi-Krum, Median, RFA, Aksel, CClip, DnC, and RBTM, and that the advantage over baselines grows with the degree of data heterogeneity.","pith_inferences":["A natural test of the core claim is to measure the actual skew direction in deployed FL systems: if the dense cluster is multimodal or does not sit on the mean-to-median line, Stage 1 of STRIKE picks the wrong gradients and the attack loses its hiding property.","Because STRIKE uses the coordinate-wise median of honest gradients, defenses that add noise to the median, subsample clients per round, or use a robust center other than the mean could blunt the search without changing the honest gradient distribution.","The paper measures attack success by final model accuracy; an inference worth checking is whether skew-aware attacks also corrupt downstream tasks like fairness or calibration, where the shift toward the dense cluster may have different harms.","STRIKE assumes the attacker knows which gradients are honest; a harder open question is whether the same hiding effect can be achieved when Byzantine clients must estimate the skew direction from their own local updates only."],"forward_implications":["Density-based Byzantine defenses such as Multi-Krum, Median, RFA, Aksel, CClip, DnC, and RBTM are all vulnerable to the same skew-aware hiding strategy in non-IID federated learning.","The attack needs no knowledge of the defense and only the honest gradients, so it applies to partial-knowledge threat models that previous omniscient attacks could not cover.","Effectiveness tracks heterogeneity: the paper reports larger accuracy drops on more skewed datasets and smaller gaps with lower non-IID levels, implying that skew-aware attacks matter most where federated learning is hardest.","Defenses that correct for skew rather than trust density, for example by recentering gradients or by weighting tail gradients, become necessary to restore robustness."],"supporting_citations":[{"why":"Defines the federated learning protocol in which clients send local gradients and the server aggregates them, the setting the attack targets.","marker":"McMahan et al. 2017"},{"why":"Introduces the LIE attack and the observation that honest-gradient variance is large enough to hide Byzantine gradients; STRIKE extends this hiding idea to skew.","marker":"Baruch, Baruch, and Goldberg 2019"},{"why":"Shows an inner-product manipulation attack that exploits gradient variance against a limited set of defenses, a baseline STRIKE must beat.","marker":"Xie, Koyejo, and Gupta 2020"},{"why":"Proposes Min-Max and Min-Sum attacks and the DnC defense, all used as baselines and as a strong target in the experiments.","marker":"Shejwalkar and Houmansadr 2021"},{"why":"Provides the Mimic attack, the bucketing scheme, and theoretical analysis of Byzantine robustness under data heterogeneity that STRIKE exploits.","marker":"Karimireddy, He, and Jaggi 2022"},{"why":"Supplies the (f, κ)-robustness definition used to formalize why robust aggregators are biased toward densely distributed gradients.","marker":"Allouah et al. 2023"},{"why":"Provides the LLE visualization technique used to observe and display the gradient-skew phenomenon.","marker":"Roweis and Saul 2000"},{"why":"Is the cited source for the mean-median-mode relation that guides the search direction in the first stage of STRIKE.","marker":"Knoke, Bohrnstedt, and Mee 2002"}],"fun_headline_variants":["Exploit gradient skew to bypass Byzantine defenses in FL","Skewed honest gradients hide Byzantine attackers from defenses","Non-IID data twists gradients to enable Byzantine attacks","Gradient skewness: the blind spot in Byzantine-robust FL"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The attack's first stage assumes that the dense cluster of honest gradients sits near the mode of the gradient distribution and that moving from the average toward the coordinate-wise median points to that mode in the high-dimensional space; if real honest-gradient distributions are multimodal or the mode is not on that line, STRIKE selects the wrong gradients and the hiding step fails.","fun_headline_variants_meta":{"raw":{"variants":["Exploit gradient skew to bypass Byzantine defenses in FL","Skewed honest gradients hide Byzantine attackers from defenses","Non-IID data twists gradients to enable Byzantine attacks","Gradient skewness: the blind spot in Byzantine-robust FL"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000363,"raw_usage":{"total_tokens":1971,"prompt_tokens":973,"completion_tokens":998,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":589,"completion_tokens_details":{"reasoning_tokens":931}},"tokens_in":589,"tokens_out":998,"duration_ms":10319,"temperature":1.0,"reasoning_tokens":931,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-08T21:05:26.351912+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Record honest gradients from a non-IID federated learning run and test the search direction directly: compute the coordinate-wise median and the average of the honest gradients, project every honest gradient onto their difference, and examine whether the high-projection subset is in fact the dense cluster and whether its average lies far from the overall average. If the dense cluster is not recovered in this way, or if replacing the median by a different robust center changes the selected subset, the mechanism underlying STRIKE is not present in that setting.","supporting_citations":[{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Introduces the LIE attack and the observation that honest-gradient variance is large enough to hide Byzantine gradients; STRIKE extends this hiding idea to skew."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Shows an inner-product manipulation attack that exploits gradient variance against a limited set of defenses, a baseline STRIKE must beat."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Proposes Min-Max and Min-Sum attacks and the DnC defense, all used as baselines and as a strong target in the experiments."},{"cited_title":"P.; He, L.; and Jaggi, M","cited_arxiv_id":null,"evidence_quote":"Provides the Mimic attack, the bucketing scheme, and theoretical analysis of Byzantine robustness under data heterogeneity that STRIKE exploits."},{"cited_title":"Fixing by Mixing: A Recipe for Optimal Byzantine ML under Heterogeneity","cited_arxiv_id":"2302.01772","evidence_quote":"Supplies the (f, κ)-robustness definition used to formalize why robust aggregators are biased toward densely distributed gradients."},{"cited_title":"T.; and Saul, L","cited_arxiv_id":null,"evidence_quote":"Provides the LLE visualization technique used to observe and display the gradient-skew phenomenon."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Is the cited source for the mean-median-mode relation that guides the search direction in the first stage of STRIKE."}],"review_version":1}