{"id":"2e1d1cd9-da26-4f0a-af2e-27f47a655225","arxiv_id":"2505.02490","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":3,"one_line_summary":"A parameter-free Bayesian aggregation method, based on variational inference over latent honesty indicators, matches Krum's robustness on benchmark federated learning attacks without needing to know the number of malicious clients.","lead":"This paper proposes an aggregation rule for federated learning that weighs each client by an estimated probability of being honest, learned with Bayesian inference, so the system does not need to know how many clients are malicious. On image benchmarks it matches the robustness of the strong baseline Krum while adapting when the set of attackers changes across rounds.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Algorithm 1 has a degenerate fixed point at π=1: Eq. (15) cannot downweight any client from the stated full-benign initialization, so the claimed adaptive robustness is not present in the written procedure.","rationale":"Reading in good faith, the paper's central claim is that a parameter-free Bayesian aggregation can match Krum without knowing the number of malicious clients. The mechanism is the EM algorithm's soft responsibilities, so the single most load-bearing condition is that Eq. (15) can move π away from its initial vector and downweight outliers. Algebraic inspection shows it cannot when initialized as Algorithm 1 states: with π=1, ε=0, the outlier-suppression factor (K−Σπ_old)/Σπ_old vanishes and every subsequent update stays at the all-benign fixed point. The empirical section cannot rescue the written method because the experiments presumably use code that may differ; the manuscript as submitted omits the critical initialization detail. Even if the authors intended a nonzero ε, Eq. (12) sets ε from π, so the initialization must be specified. I also note that Proposition 2.1/Eq. (6) appears to drop the square on the left-hand side relative to Appendix Eq. (25), which is a minor typo but should be corrected. Given this, the current version should not be accepted as written; a revision must correct the update or initialization, re-run the experiments, and supply the missing derivation, or the claims must be moderated.","tokens_in":16012,"tokens_out":11233,"duration_ms":154135,"concrete_test":"Run Algorithm 1 exactly as listed on a one-round synthetic problem with K=20, 12 benign vectors at 0 and 8 malicious vectors at (100,0,...,0), logging Σπ_k, ε, and the output after each EM iteration. If Σπ stays 20 and the output is the unweighted mean, the degenerate fixed point is confirmed. Then initialize ε=0.2 (or π away from 1) and compare: if robustness appears only then, the manuscript must document and analyze the missing warm start.","verdict_should_be":"REJECT","load_bearing_attack":"Algorithm 1 initializes π_k=1 for all clients (line 2). With ε defined in Eq. (12) as ε=1−Σπ_k/K, the initial ε is 0. The π-update in Eq. (15), π_new = [1 + ((K−Σπ_old)/(Σπ_old)) · 1/p(w_k|w,σ²)]^{-1}, therefore has a multiplicative factor (K−Σπ_old)/Σπ_old = 0 at the first iteration, giving π_new=1 for every k regardless of the likelihood. The subsequent updates of w and σ² (lines 7–8) are then exactly the unweighted mean and variance, and the same argument repeats at every iteration: (1,...,1) is a fixed point of the EM map. Consequently, as written, Algorithm 1 reduces to FEDAVG and cannot adapt to any static or dynamic attack, contradicting the central robustness claim and the probabilities shown in Figure 1. The empirical results in Tables 2–4 therefore cannot be attributed to the procedure specified in the paper unless the implementation uses an unstated initialization (e.g., ε>0 or π≠1), which would be an essential undocumented component. This is more fundamental than the missing proof that the ELBO solution inherits the Proposition 2.1 guarantee: from the stated starting point, the algorithm never leaves the all-benign solution.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes a Bayesian robust aggregation rule for federated learning in which the global update is computed as a weighted average of client models, with weights interpreted as posterior probabilities of client honesty. The authors derive the method by first formulating robust aggregation as a hard subset-selection problem (Eq. 5), prove an (M,κ)-robustness bound for that problem (Proposition 2.1), and then relax it into a variational objective (ELBO) over latent Bernoulli indicators of honesty (Eqs. 9-11), optimized by the EM-style Algorithm 1. The paper claims the resulting method is adaptive to an unknown or varying number of malicious clients, requires no user-specified hyperparameter such as the number of adversaries, and matches Krum's accuracy and backdoor-attack resistance on MNIST, Fashion-MNIST, and CIFAR-10. The empirical section compares the method against FEDAVG, Median, Trimmed Mean, Geometric Median, and Krum under four attack types and static/dynamic adversary configurations.","tokens_in":16315,"tokens_out":10914,"duration_ms":117721,"significance":"If the algorithm worked as specified, the paper would make a valuable practical contribution: a Byzantine-robust aggregation rule that avoids the common requirement of knowing the number of compromised clients, has simple weighted-mean updates, is backed by a theoretical robustness bound, and is evaluated on a broad benchmark (three datasets, four attacks, static and dynamic adversaries). The paper also provides public code and an ablation study, and the careful comparison against multiple baselines is a clear strength. However, the significance is heavily contingent on the algorithm actually implementing the described inference; as written, the central algorithm does not do so, which substantially weakens the paper's claims.","major_comments":[{"comment":"Algorithm 1 as written is degenerate. It initializes π_k = 1 for all k (line 2), so Σπ_old = K and the factor (K − Σπ_old)/Σπ_old in the π-update of Eq. (15) equals 0 at the first iteration. Consequently, π_new_k = 1 for every k regardless of the likelihood p(w_k|w,σ²). The subsequent updates of w and σ² (lines 7–8) are then exactly the unweighted mean and variance, and the same argument repeats at every iteration: (1,...,1) is a fixed point of the EM map. Thus, Algorithm 1 as written reduces to FEDAVG and cannot adapt to any static or dynamic attack. This contradicts the central robustness claim and the probabilities shown in Figure 1. The empirical results in Tables 2–4 cannot be attributed to the procedure specified in the paper unless the implementation uses an unstated initialization (e.g., π_k < 1 or ε > 0), which would be an essential undocumented component. Please correct the algorithm or explicitly state the actual initialization and update scheme used to generate the reported results.","section":"Section 2, Algorithm 1, Eq. (15)"},{"comment":"The robustness guarantee in Proposition 2.1 is proven for the hard subset-selection estimator in Eq. (5), which enforces a hard cardinality constraint |S| = K − M. The actual algorithm optimizes the ELBO in Eq. (11), a variational relaxation with a soft prior over indicators and an empirically estimated ε given by Eq. (12). No argument is given that the solution of Eq. (11) inherits the (M,κ)-robustness of Proposition 2.1. The sentence following Eq. (13) only motivates the Gaussian likelihood by its appearance in Eq. (5); it does not establish that the variational estimator satisfies an analogous bound. The paper should either prove that the Algorithm 1 output satisfies a similar robustness guarantee with respect to a suitable set of benign clients, or clearly state that Proposition 2.1 applies only to the intermediate combinatorial problem and that the robustness of Algorithm 1 rests solely on the empirical evaluation.","section":"Section 2, Eqs. (9)–(11) and Proposition 2.1"},{"comment":"There is a technical inconsistency between the statement of Proposition 2.1 and its proof. The main-text bound in Eq. (6) involves a sum of norms, specifically (κ/(K−M)) Σ_{k∈B} ∥w_k − w_B∥₂, while the appendix proof concludes in Eq. (25) a bound with Σ_{k∈B} ∥w_k − w_B∥₂² (squared norms) and a different constant. In addition, Eq. (20) of the appendix appears to mix squared and unsquared norms. Please reconcile the theorem statement with the proof and verify which bound actually follows from the argument.","section":"Appendix C, Eq. (25) vs. main text Eq. (6)"}],"minor_comments":[{"comment":"The method is described as 'parameter-free' and 'hyperparameter-free', but Algorithm 1 depends on the initialization of π_k and σ², the EM convergence criterion, and the maximum number of iterations T. Please qualify this claim and state the exact values used in the experiments.","section":"Abstract, Section 2, Algorithm 1"},{"comment":"The lower heatmap in Figure 1 shows the estimated benign probabilities varying across clients and rounds, which is inconsistent with the all-ones posterior produced by Algorithm 1 as written. The figure and its caption should be updated to describe what the actual implementation computes.","section":"Figure 1"},{"comment":"The transition from Eq. (8) to Eq. (9) is described as a relaxation, but the expectation under the prior p(b) with ε = M/K is not equivalent to the cardinality-constrained maximum in Eq. (8). Please clarify the precise relationship between the two objectives.","section":"Section 2, Eq. (8) to Eq. (9)"},{"comment":"The claim that Algorithm 1 'converges to a local maximum of the ELBO' is not supported by a derivation of Eq. (15) as a coordinate-ascent step for the ELBO in Eq. (11); the update is simply cited to (Karakulev et al., 2024). Please provide the derivation or a precise reference to the convergence result.","section":"Section 2, Computational complexity"},{"comment":"The abstract states that the method 'consistently achieves state-of-the-art performance', but the appendix results show cases where the method is below Krum (e.g., FMNIST Random attack at 40% malicious, ACC 0.83 vs. 0.89) and otherwise at parity. Please align the abstract's claim with the reported results.","section":"Abstract, Tables 7–8"}],"recommendation":"major_revision","confidential_remarks":"The paper relies heavily on the authors' prior work (Karakulev et al., 2024) for the variational framework and the exact update equations, including Eq. (15), which is precisely where the degenerate-initialization issue arises. It would be worth checking the public code repository to see what initialization is actually used; if the implementation differs from Algorithm 1, the authors must disclose this and recompute the experiments. The 'state-of-the-art' phrasing in the abstract is stronger than the evidence, and the paper should be revised to present a more measured claim. If the authors cannot provide a non-degenerate version of Algorithm 1 that reproduces the reported tables, the manuscript should not be published in its current form."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Colleague,\n\nThe punchline: the algorithm in this paper, as written, is a degenerate fixed point. Algorithm 1 initializes π_k = 1 for all clients, which makes ε = 0 and (K−Σπ)/Σπ = 0 in Eq. (15). The first π-update returns π_k = 1 for every k, regardless of the likelihood, and the w and σ² updates are then exactly the unweighted mean and variance. That repeats, so the stated procedure is FedAvg with extra steps. The robustness results in Tables 2–4 cannot come from this procedure unless the implementation uses an unstated different initialization or update, which would be an undisclosed essential component.\n\nThat is a more fundamental problem than the reader's note about the proof gap. The paper does deserve some credit: the idea of adapting the authors' prior variational robust-likelihood work to FL aggregation is natural, the dynamic-attack setup is relevant, and Proposition 2.1's robustness bound for the hard subset-centroid problem is correctly stated and proved, even if it follows Allouah et al.'s technique. The writing is clear and the code is linked.\n\nThe other soft spots are secondary but real. The guarantee is for the hard subset rule, not for the ELBO relaxation that Algorithm 1 supposedly maximizes, and the paper does not even attempt to close that gap. The Gaussian likelihood on squared residual norms is presented as a modeling choice but is not justified beyond 'it gives the right bound.' The experiments have no error bars, the dynamic attack schedule is vague, and the paper claims 'parameter-free' while the EM iterations and convergence criterion are undocumented hyperparameters.\n\nBottom line: this is not ready for peer review in its current form. The degenerate fixed point is a concrete, checkable flaw; if it is a typo in the initialization or update, the paper could be fixed fairly quickly and then the experimental claims might be credible. But as submitted, the central algorithm does not do what the paper says. I would desk reject with a clear explanation, or at most invite a resubmission after the algorithm is corrected and the proof-gap is addressed.","headline":"The stated Algorithm 1 never leaves the all-benign fixed point, so the paper's central robustness claim is unsupported as written.","tokens_in":16851,"tokens_out":5296,"would_cite":false,"duration_ms":58795,"reading_group":"no","serious_thinker":"no","would_accept_peer_review":false},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"A Bayesian aggregation rule infers which federated-learning clients are honest, removing the need to specify the number of malicious clients.","keywords":["federated learning","robust aggregation","Byzantine attacks","Bayesian inference","variational inference","empirical Bayes","backdoor attack","adversarial robustness"],"falsifier":"Construct a communication round with $K=20$ fixed update vectors in which $M=4$ malicious vectors lie just inside the convex hull of the honest ones, run Algorithm 1, and check whether the learned probabilities $\\pi_k$ assign them near-zero weight and whether the output $w$ matches the honest mean. If the ELBO optimum is pulled toward the malicious vectors, then the variational solution is not $(M,\\kappa)$-robust even though Proposition 2.1 applies to the combinatorial estimator.","tokens_in":15803,"feed_emoji":"🛡️","tokens_out":9713,"duration_ms":100563,"temperature":0.7,"pith_summary":"The paper proposes an aggregation rule for federated learning in which every client update is assigned a posterior probability of being honest, and the global model is the weighted mean of the updates with those probabilities as weights. The key move is to marginalize over Bernoulli latent variables indicating honesty, through an evidence lower bound, so the method infers the fraction of malicious clients at each communication round instead of requiring it as input. The claim is that this Bayesian rule is as effective as Krum against strong attacks such as sign flipping and backdoors, while remaining as simple as the sample mean and adapting when attackers appear, disappear, or change behavior. A careful reader would care because existing robust aggregators either need a user-specified number of compromised clients or degrade on complex tasks exactly when the adversarial share is high and variable.","feed_headline":"Bayesian aggregation blocks poisoned updates without attacker count","feed_subtitle":"Variational Bayesian averaging matches Krum's defense and adapts on the fly to a changing share of malicious clients.","key_machinery":"The central object is the evidence lower bound of Equation (11): a Gaussian likelihood over the squared residual norms $\\lVert w_k - w\\rVert_2^2 / \\sigma^2$, latent Bernoulli variables $b_k$ for client honesty, and a KL-divergence term whose prior $\\varepsilon = M/K$ is itself optimized, making the procedure an empirical-Bayes estimate. The machinery is coordinate ascent: update per-client posterior probabilities $\\pi_k$ with Equation (15), then re-estimate $w$ and $\\sigma^2$ in closed form from Equations (14). This converts a combinatorial subset-selection problem, Equation (5), into $O(TK)$ iterations, and lets the posterior probabilities perform outlier rejection automatically, so the method adapts to a static or changing number of malicious clients without a user-supplied count.","core_discovery":"The central claim is that maximizing the marginalized likelihood, with each client's honesty represented by a latent Bernoulli variable, defines a robust mean update whose robustness does not depend on knowing the number of compromised clients. Algorithm 1 maximizes the corresponding ELBO by alternating closed-form updates: the posterior probability $\\pi_k$ for each client from Equation (15), the mean $w$ as the $\\pi$-weighted average of updates, and the scale $\\sigma^2$ as the $\\pi$-weighted mean squared residual. The paper proves that the hard subset-selection estimator being relaxed satisfies an $(M,\\kappa)$-robustness bound (Proposition 2.1), and it reports empirically that the variational solution matches or exceeds Krum's test accuracy and backdoor attack success rate on MNIST, Fashion-MNIST, and CIFAR-10, with malicious fractions up to $45\\%$ that may vary across rounds.","pith_inferences":["The paper proves the robustness bound only for the hard subset-selection estimator of Equation (5); a targeted test of whether the ELBO optimum still satisfies the bound when malicious updates sit just inside the convex hull of honest updates would settle this implicit transfer step.","Because the prior share $\\varepsilon$ is re-estimated every round, the method could double as an attack-monitoring tool by reporting the inferred fraction of compromised clients over time, a use the authors do not develop.","The scalar-residual Gaussian likelihood throws away per-coordinate information, so a structured extension that respects the KL scale issue noted in Section 4.3 may detect stealthy attacks localized in a few coordinates.","An untested stress direction is stronger data heterogeneity, since the experiments use Dirichlet $\\alpha = 1.0$ and $0.5$; much smaller values could break the single-cluster assumption about honest updates."],"forward_implications":["On CIFAR-10 under sign flipping and backdoor attacks with 40% malicious clients, the method keeps test accuracy within about 1% of the non-adversarial baseline, a level reached only by Krum among the compared defenses.","In all three configurations, the method suppresses backdoor attack success rate to at most 8% on CIFAR-10, while Median, Trimmed Mean, and Geometric Median leave attack success rates near 30–100%.","The method requires no hyperparameter for the number of malicious clients, unlike Krum's $L$ and Trimmed Mean's $\\beta$, and it tracks a dynamically changing adversarial share by estimating $\\varepsilon$ at every round.","In a fully benign setting the method's accuracy matches Federated Averaging, so robustness does not come at a measurable utility cost in the tested configurations.","Because each round only computes weighted means and scalar updates, the aggregation cost stays $O(TK)$ and remains comparable to coordinate-wise median."],"supporting_citations":[{"why":"Supplies the variational latent-Bernoulli framework and the ELBO objective that Algorithm 1 optimizes.","marker":"[Karakulev et al., 2024]"},{"why":"Defines the $(M,\\kappa)$-robustness criterion and the proof template used for Proposition 2.1.","marker":"[Allouah et al., 2023]"},{"why":"Provides Krum, the main baseline the method must match, and the robustness proof style it parallels.","marker":"[Blanchard et al., 2017]"},{"why":"Defines federated averaging, the standard aggregation the method generalizes and the benign-performance baseline.","marker":"[McMahan et al., 2017]"},{"why":"Supplies the contamination model that motivates treating a fraction of clients as malicious.","marker":"[Huber, 1996]"},{"why":"Grounds the empirical-Bayes optimization of the hyperparameter $\\varepsilon$ that makes the method adaptive.","marker":"[Murphy, 2012]"}],"fun_headline_variants":["Bayes beats poisoned federated updates without attacker count","Adaptive Bayesian aggregation fends off varying client attacks","Blind to attacker count: Bayesian robust FL aggregation","Variational Bayes locks out poisoned updates in federated learning","No attacker headcount needed: Bayesian FL aggregation"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that the variational ELBO solution computed by Algorithm 1 inherits the $(M,\\kappa)$-robustness that is proved only for the hard subset-selection estimator of Equation (5) in Appendix C; no proof of the transfer is given, and the Gaussian likelihood over squared residual norms is the heuristic that makes the transfer plausible.","fun_headline_variants_meta":{"raw":{"variants":["Bayes beats poisoned federated updates without attacker count","Adaptive Bayesian aggregation fends off varying client attacks","Blind to attacker count: Bayesian robust FL aggregation","Variational Bayes locks out poisoned updates in federated learning","No attacker headcount needed: Bayesian FL aggregation"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000598,"raw_usage":{"total_tokens":2773,"prompt_tokens":899,"completion_tokens":1874,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":515,"completion_tokens_details":{"reasoning_tokens":1798}},"tokens_in":515,"tokens_out":1874,"duration_ms":15083,"temperature":1.0,"reasoning_tokens":1798,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-16T00:50:18.783137+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Construct a communication round with $K=20$ fixed update vectors in which $M=4$ malicious vectors lie just inside the convex hull of the honest ones, run Algorithm 1, and check whether the learned probabilities $\\pi_k$ assign them near-zero weight and whether the output $w$ matches the honest mean. If the ELBO optimum is pulled toward the malicious vectors, then the variational solution is not $(M,\\kappa)$-robust even though Proposition 2.1 applies to the combinatorial estimator.","supporting_citations":[{"cited_title":"Adaptive robust learning using latent bernoulli variables","cited_arxiv_id":null,"evidence_quote":"Supplies the variational latent-Bernoulli framework and the ELBO objective that Algorithm 1 optimizes."},{"cited_title":"Fixing by mixing: A recipe for optimal byzantine ml under heterogeneity","cited_arxiv_id":null,"evidence_quote":"Defines the $(M,\\kappa)$-robustness criterion and the proof template used for Proposition 2.1."},{"cited_title":"M., Guerraoui, R., and Stainer, J","cited_arxiv_id":null,"evidence_quote":"Provides Krum, the main baseline the method must match, and the robustness proof style it parallels."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Supplies the contamination model that motivates treating a fraction of clients as malicious."}],"review_version":1}