{"id":"c8fca0fc-e7fe-479d-b8f6-d53ab2fc1679","arxiv_id":"2508.03579","paper_version":2,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":4,"one_line_summary":"Horus makes federated learning robust to poisoning under extreme client heterogeneity by aggregating only LoRA adapters and detecting attackers from the spectral structure of the LoRA-A component.","lead":"This paper introduces Horus, a federated learning defense that shares only small low-rank adapter matrices and uses their input-projection parts to spot poisoned clients. It is a candidate recipe for keeping federated training robust when clients have very different data, communication budgets, and neural architectures.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Algorithm 1's 95th-percentile threshold cannot remove the specified 20% attackers with 10 clients: at most one client exceeds it, so one poisoned client survives every round.","rationale":"The reader identified LoRA-A stability under heterogeneity and poisoning as the weakest assumption, and explicitly stated that no mechanical flaw was found. My analysis finds a concrete mechanical flaw in the central detection algorithm: with 10 clients and p=95, the 95th-percentile threshold can flag at most one client, so it cannot remove the two poisoned clients that constitute 20% of participants. This is an internal inconsistency between the algorithm specification and the experimental setup, making the described detection mechanism incapable of achieving the claimed poisoning filtering. The issue is settled by a simple simulation or a mathematical argument about order statistics. It does not necessarily invalidate the empirical results, because the implementation may have used a different threshold than reported, but it does mean the paper as written does not describe a procedure that matches the experiments. The verdict remains CONDITIONAL, but the condition should be to correct the detection threshold specification and re-validate the experiments; if the authors cannot explain how 20% attackers are filtered with p=95, the central contribution is unsupported.","tokens_in":16933,"tokens_out":8142,"duration_ms":95782,"concrete_test":"Simulate one round of Algorithm 1 with 10 clients (8 benign, 2 poisoned) in the paper's CIFAR-10 LIE α=0.5 setup. Compute HOPS scores and apply θ_t = Percentile_95; count how many poisoned clients have S > θ_t. Mathematically the count must be 0 or 1. If the released code is available, inspect the threshold implementation to check whether a different percentile or a fixed removal count was used; if the code flags both attackers, the paper's algorithm description is incorrect.","verdict_should_be":"CONDITIONAL","load_bearing_attack":"The detection rule in Algorithm 1 (line 11) sets θ_t = Percentile_95({S_c,t}) and flags clients with S_c,t > θ_t. With N=10 clients per round (stated in §VI-A) and 20% attackers, two clients are malicious. For any sample of 10 scores, the 95th percentile is the 0.55-interpolation between the 9th and 10th order statistics; strict inequality means only the maximum score (if unique) can exceed it. Therefore at most one client is removed, and one of the two poisoned clients remains in every round. This contradicts the central claim that HOPS filters poisoned clients and that Horus consistently outperforms baselines. If the experiments actually removed both attackers, the implementation must use a different threshold (e.g., p=80 or a fixed count of removals) than the one specified; as written, the algorithm cannot achieve the stated 20% filtering. The robustness gains in Table I thus cannot be attributed to the described detection mechanism without additional explanation.","agreement_with_reader":"disagree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes Horus, a federated learning framework for hyper-heterogeneous clients (varying data distributions, architectures, and communication capabilities) that is intended to be robust to poisoning attacks. Clients insert LoRAs into two empirically stable layers, share only the LoRA-A and LoRA-B matrices, and the server computes a Heterogeneity-Oblivious Poisoning Score (HOPS) from spectral features of LoRA-A to filter poisoned clients. Remaining updates are aligned via zero-padding and aggregated with projection-guided weights based on alignment with global principal directions. The authors report that Horus outperforms state-of-the-art robust and heterogeneous FL baselines in 49 of 54 dataset/attack/heterogeneity settings.","tokens_in":17105,"tokens_out":4930,"duration_ms":59958,"significance":"If the claims hold, the paper addresses a real gap: robust FL under simultaneous data, architecture, and communication heterogeneity. The core design—decoupling LoRA-A from LoRA-B and using shape-agnostic spectral features for detection—is novel and potentially useful in practical federated systems. The ablations are informative and support the value of layer selection, LoRA-A-only detection, and projection-guided weighting. However, the central empirical premise (stability and discriminative power of LoRA-A) is supported mainly by example curves, and the quantitative comparisons lack error bars, so the strength of the claimed advantage is not yet established.","major_comments":[{"comment":"The stated detection rule cannot remove the stated attack fraction. The text sets the threshold as θ_t = Percentile_p({S_c}) with p=95, and §VI-A states that 20% of clients are poisoned each round; with N=10, that is two poisoned clients. For any 10 scores, the 95th percentile lies strictly between the 9th and 10th order statistics, so the condition S_c > θ_t flags at most the unique maximum score. Therefore one of the two poisoned clients survives every round, contradicting the claim that HOPS filters poisoned clients and undermining the 49/54 robustness result. Please specify the exact percentile or removal rule used in the experiments, and reconcile the pseudocode with the reported 20% attacker setting.","section":"§V-B2, Algorithm 1, and §VI-A"},{"comment":"The load-bearing premise that LoRA-A remains stable and discriminative between benign and poisoned clients is supported only by a small set of example curves from one setting (CIFAR-10, LIE, α=0.5, one benign and two poisoned clients). No quantitative aggregate evidence is provided, such as the distribution of HOPS scores for benign versus poisoned clients, detection ROC/AUC, or false-positive/true-positive rates averaged over datasets, attacks, and architectures. Because the entire HOPS detector and projection-guided aggregation rest on this observation, the paper should provide a quantitative validation of the separation, or substantially temper the universality of the claim.","section":"§III, Observation 2, Fig. 2"},{"comment":"The two hyperparameters that control the detection score, λ in Eq. (4) and the LoRA rank r, are tuned on the same benchmarks used for the headline comparisons, and all reported accuracy numbers appear to be single runs without error bars or significance tests. Figure 7b shows that the optimal λ differs by attack type (0.3 for dispersive, 0.7 for directional), which makes the fixed-λ results in Table I hard to interpret. Please report mean±std over multiple seeds, select λ and r on a validation split, and state the percentile p used in the robustness tables so that the claimed consistent advantage can be assessed.","section":"§VI-G, §VI-H, Tables I and II"},{"comment":"The comparison protocol applies zero-padding dimensional alignment to all baselines before aggregation, but robust aggregation methods such as Krum, Median, and Trimmed Mean are defined for a shared parameter space and may be systematically disadvantaged when the parameter space contains many padded, meaningless dimensions. The paper should clarify whether the baseline numbers are obtained in their native homogeneous setting or after the padding protocol, and justify that the comparison does not bias the results against the baselines.","section":"§VI-B, §VI-C"}],"minor_comments":[{"comment":"The pseudocode contains two nested 'for round t=1 to T do' loops (lines 1 and 8) that should be a single loop over rounds; as written, the control flow is ambiguous.","section":"Algorithm 1"},{"comment":"Several entries in the FMNIST block run together without separators (e.g., '60.8451.68' and '47.9753.66'), making the table hard to read; please insert proper delimiters.","section":"Table I"},{"comment":"The sentence '20% of clients are selected in each round to perform poisoning attacks' is ambiguous: it should state whether 20% of the 10 participating clients (i.e., 2 clients) are poisoned in every round.","section":"§VI-A"},{"comment":"The paper says the choice of k=5 'follows the paper [9]', but reference [9] is the Eckart-Young theorem, which does not specify a value of k; please either correct the citation or justify k=5 directly.","section":"§V-B2 and §VI-H"},{"comment":"There are several naming inconsistencies, including 'FLDetecter' vs 'FLDetector', 'Dnc' vs 'DnC', and 'FedHeLLo' vs 'FedHello'; please standardize.","section":"Throughout"},{"comment":"The caption of Fig. 7b does not identify which curve corresponds to the dispersive attack and which to the directional attack, and the text refers to 'CIFAR10-LIE-min-max' as a single example; please make the figure legend and text consistent.","section":"Fig. 7b"}],"recommendation":"major_revision","confidential_remarks":"The percentile-threshold issue is the most serious point: if the authors respond that they used p=80 or a count-based removal rule, the problem may be resolvable, but as written the algorithm does not match the experimental claim. I would also ask the editor to verify that the 'first robust framework for hyper-heterogeneous FL' claim is appropriately scoped relative to existing heterogeneous-LoRA methods such as FedHello, which the paper cites but does not position against in the robustness comparison."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"First thing you should know: the headline claim is built on a detection rule that, as written, cannot work in the stated setup. Algorithm 1 sets the threshold at the 95th percentile of HOPS scores. With 10 clients and 20% attackers, that is two malicious clients, but the 95th percentile of 10 scores sits just below the maximum, so the strict inequality S_c > θ_t flags at most one client per round. One poisoned client survives every round. The authors would need a lower percentile or a fixed removal count to get the reported filtering. This is a concrete inconsistency, not a deep theoretical flaw, but it means the experimental results cannot be attributed to the described detection mechanism without clarification or correction.\n\nWhat is actually new: the empirical observation that LoRA-A (the input projection) remains markedly more stable than LoRA-B under both heterogeneity and poisoning, and the design of a poisoning score based purely on LoRA-A spectral features. That is a genuine insight, and the ablation shows that using A alone beats using B or both. The projection-aware aggregation weighting is a reasonable addition to the standard LoRA aggregation idea.\n\nThe experiments are broad: three datasets, two very different architectures (CNN and RNN), six attacks, and 54 dataset/attack/α configurations. Horus wins 49 of those. The ablation study is useful, especially the layer-selection analysis.\n\nSoft spots worth naming: there are no error bars anywhere, so a 2–3% accuracy gap could be noise. The hyperparameters λ and rank are tuned on the same benchmark family, so the quantitative claims are somewhat circular. The load-bearing premise—LoRA-A stability—is supported by one example figure and a statement that the trend holds elsewhere; there is no aggregate quantitative test across settings. The communication comparison only reports per-round payload, not total bytes to reach a target accuracy, which overstates the savings.\n\nThe strength of the LoRA-A stability insight and the breadth of the empirical evaluation justify sending this to serious review, even though the detection-rule bug is a clear red light for the present version. The authors should fix or clarify the threshold mechanism, add variance estimates, and ideally release code so independent evaluators can stress-test against adaptive attackers. With those changes, the framework could be a solid contribution.\n\nFor a reading group, I would bring it up as a thought-provoking but flawed paper; the core discussion would be about the detection rule and the stability evidence.","headline":"Promising LoRA-A stability insight, but the detection rule as written cannot remove the stated 20% attackers with 10 clients; needs revision before the results can be fully trusted.","tokens_in":17663,"tokens_out":3837,"would_cite":false,"duration_ms":47940,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Horus claims the first robust federated learning framework for hyper-heterogeneous clients, using only LoRA-A spectral features for poisoning detection and projection-guided LoRA aggregation.","keywords":["federated learning","poisoning attacks","hyper-heterogeneity","low-rank adaptation","LoRA","robust aggregation","spectral detection"],"falsifier":"Run Horus with an adaptive adversary that optimizes poisoned clients' LoRA-A matrices so their spectral entropy and top-k energy ratio match the benign round-wise statistics; if HOPS scores then fail to separate poisoned from benign clients, the detection core collapses. A simpler check: measure the top-5 energy ratio of LoRA-A across many heterogeneous clients and attacks; if benign-client variance overlaps the poisoned-client shift on a new architecture or attack family, the method's detection margin is not general.","tokens_in":16723,"feed_emoji":"🛡️","tokens_out":7671,"duration_ms":79542,"temperature":0.7,"pith_summary":"This paper claims that federated learning can be made robust to poisoning attacks even when clients differ wildly in data, communication, and model architecture. The proposed Horus framework inserts LoRA adapters into two stable layers of every client, shares only those adapters, and uses the spectral features of the input projection (LoRA-A) to score and filter poisoned clients. A projection-guided aggregation then reweights the remaining updates by how well they align with the previous global direction. Across three datasets, six attacks, and multiple baselines, Horus reports the best global accuracy in 49 of 54 settings, with communication payloads in the sub-megabyte range. If true, robust federated learning no longer needs homogeneous architectures, balanced communication, or full-model exchange.","feed_headline":"One adapter half catches poison in 49 of 54 heterogeneous FL tests","feed_subtitle":"Horus filters poisoned clients using singular values of the LoRA-A half, beating robust and heterogeneous baselines on accuracy.","key_machinery":"The load-bearing object is the LoRA adapter, a low-rank update $\\Delta W = BA$ wrapped around a frozen backbone layer, with $A$ the input projection and $B$ the output projection. LoRA functions as an architecture-agnostic plug-in, so clients with different backbones, such as CNN versus RNN, can exchange updates of consistent low-rank form. Horus inserts LoRAs only in the first feature layer and classifier, the two layers whose top-$k$ singular value energy ratio is empirically stable across clients. Detection uses only LoRA-A's singular values via HOPS, a shape-agnostic score combining spectral entropy and top-$k$ energy ratio with round-wise normalization; aggregation uses masked zero-padding to align shapes and projection-guided weighting by the inner product of each client's leading right singular vector with the previous global direction.","core_discovery":"On the paper's own terms, the central discovery is that the input projection of a LoRA adapter, LoRA-A, is markedly more stable than the output projection LoRA-B under hyper-heterogeneity and poisoning, and its singular-value spectrum separates poisoned from benign clients cleanly enough to drive both detection and aggregation. Based on this, Horus builds a Heterogeneity-Oblivious Poisoning Score (HOPS) from spectral entropy and top-k energy ratio of LoRA-A singular values, flags clients whose scores deviate from round-wise percentiles, and then aggregates only LoRA updates from benign clients, masked and zero-padded to a common shape and weighted by projection onto the global dominant direction. The paper positions this as the first robust FL framework for hyper-heterogeneous settings and supports it with experiments where Horus attains the best global accuracy in 49 of 54 dataset-attack-heterogeneity configurations, with the remaining five as runner-up.","pith_inferences":["The paper leaves open whether LoRA-A stability transfers to transformer-based clients or cross-modal architectures; that is a testable claim, not one the experiments cover.","Because HOPS normalizes against the current round's client statistics, a coordinated set of attackers that shifts the round-wise mean could anchor the score; the paper does not analyze this collusion regime.","Projection-guided weighting relies on the previous global direction; if that direction is corrupted early, the weighting could amplify rather than suppress drift, a failure mode the paper does not address."],"forward_implications":["Robust federated learning can work across clients with fundamentally different architectures, such as CNN versus RNN, and imbalanced communication, because only low-rank LoRA updates are exchanged.","Poisoning detection becomes architecture- and shape-agnostic: HOPS uses only singular values of LoRA-A, so clients with different layer shapes can be compared in one score.","Aggregation can suppress adversarial drift while preserving benign diversity by reweighting updates by their projection onto the previous global direction.","Per-round communication payload drops to the sub-megabyte range, with up to a 420x reduction versus full-model heterogeneous baselines, without sacrificing accuracy.","Using LoRA-A alone for detection outperforms using LoRA-B or both, because the less stable B introduces false positives."],"supporting_citations":[{"why":"It supplies the LoRA formulation, frozen backbone plus low-rank BA updates, that the whole framework builds on.","marker":"[15]"},{"why":"It provides the Min-Max and Min-Sum attacks Horus defends against and the percentile-threshold detection convention.","marker":"[24]"},{"why":"It supplies the low-rank approximation rationale behind the top-k singular value energy ratio.","marker":"[9]"},{"why":"It supplies the LIE attack, one of the six poisoning attacks used in evaluation.","marker":"[4]"},{"why":"It supplies the Fang local model poisoning attack used in evaluation and ablations.","marker":"[11]"},{"why":"It defines FedAvg, the aggregation rule used by the no-weighting ablation variant.","marker":"[22]"},{"why":"It defines HeteroFL, a heterogeneous-FL baseline Horus compares against.","marker":"[8]"},{"why":"It defines FedRolex, a heterogeneous-FL baseline used in the aggregation comparison.","marker":"[1]"},{"why":"It defines FedHello, a heterogeneous LoRA-based baseline used for aggregation and communication comparison.","marker":"[35]"},{"why":"It provides LASA, the strongest robust-FL baseline in the robustness comparison.","marker":"[29]"}],"fun_headline_variants":["LoRA-A singular values expose poison in federated learning","Federated poisoning caught by the stable half of LoRA","Horus: Heterogeneity-agnostic defense against FL poisoning","Singular values of LoRA-A filter poisoned clients in FL","49/54 wins: Robust FL via LoRA-A stability check"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The paper's method stands or falls on the empirical claim that the input-side part of the low-rank adapter stays stable and tells poisoned clients apart from benign ones across all the heterogeneity the framework allows, a claim illustrated with a few example curves rather than proved or stress-tested.","fun_headline_variants_meta":{"raw":{"variants":["LoRA-A singular values expose poison in federated learning","Federated poisoning caught by the stable half of LoRA","Horus: Heterogeneity-agnostic defense against FL poisoning","Singular values of LoRA-A filter poisoned clients in FL","49/54 wins: Robust FL via LoRA-A stability check"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000556,"raw_usage":{"total_tokens":2651,"prompt_tokens":953,"completion_tokens":1698,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":569,"completion_tokens_details":{"reasoning_tokens":1622}},"tokens_in":569,"tokens_out":1698,"duration_ms":14762,"temperature":1.0,"reasoning_tokens":1622,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-06T04:20:35.962923+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run Horus with an adaptive adversary that optimizes poisoned clients' LoRA-A matrices so their spectral entropy and top-k energy ratio match the benign round-wise statistics; if HOPS scores then fail to separate poisoned from benign clients, the detection core collapses. A simpler check: measure the top-5 energy ratio of LoRA-A across many heterogeneous clients and attacks; if benign-client variance overlaps the poisoned-client shift on a new architecture or attack family, the method's detection margin is not general.","supporting_citations":[{"cited_title":"Shejwalkar and A","cited_arxiv_id":null,"evidence_quote":"It provides the Min-Max and Min-Sum attacks Horus defends against and the percentile-threshold detection convention."},{"cited_title":"Eckart and G","cited_arxiv_id":null,"evidence_quote":"It supplies the low-rank approximation rationale behind the top-k singular value energy ratio."},{"cited_title":"Baruch, M","cited_arxiv_id":null,"evidence_quote":"It supplies the LIE attack, one of the six poisoning attacks used in evaluation."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"It supplies the Fang local model poisoning attack used in evaluation and ablations."},{"cited_title":"McMahan, E","cited_arxiv_id":null,"evidence_quote":"It defines FedAvg, the aggregation rule used by the no-weighting ablation variant."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"It defines HeteroFL, a heterogeneous-FL baseline Horus compares against."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"It defines FedRolex, a heterogeneous-FL baseline used in the aggregation comparison."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"It provides LASA, the strongest robust-FL baseline in the robustness comparison."}],"review_version":1}