REVIEW 4 major objections 4 minor 18 references
Robust Federated Learning against Model Perturbation in Edge Networks
T0 review · 4 major / 4 minor · reviewed 2026-08-07 · deepseek-v4-flash
Pith's one-line read SMRFL replaces empirical risk minimization with sharpness-aware minimization in each local update, so the federated model converges to a flat minimum that tolerates bounded perturbations in the shared weights.
desk verdict The paper's central rate claim doesn't survive its own scalings, and the method is FedSAM relabeled; the empirical study is reasonable but the theory needs major work. read the letter →
The pith
A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.
The reading
What carries the argument
The mechanism is the sharpness-aware local update (equations 15-16), a distributed adaptation of sharpness-aware minimization. In each local step the client first computes the worst-case model in an rho-ball around the current parameters, using the normalized gradient direction, and then takes a gradient step at that worst-case point; this converts the min-max objective (9) into a finite-sum objective (14) that can be optimized with the standard federated averaging loop. The perturbation model (equation 1) is deliberately agnostic to the perturbation distribution, only bounding its $\ell^2$ norm by rho, which is what lets the same method cover channel noise, quantization error, and DP noise.
What would settle it
Evaluate the quantity 1/2 - $8eE^{2}$$L^{2}$ $eta_l^{2}$ for any fixed E >= 1, L > 0, and eta_l satisfying the paper's condition eta_l < 1/(4EL); since this quantity is always negative, no positive constant C can satisfy the inequality 1/2 - $8eE^{2}$$L^{2}$ $eta_l^{2}$ > C > 0 required by Theorem 1, which would invalidate the stated bound in Equation (17).
Extended reading notes
Core claim
The central claim is that by solving, in each local update, the min-max problem min_w max_{||delta_i||<=rho} (1/N) sum_i F_i(w+delta_i) and approximating the inner maximization with a first-order Taylor step, the resulting algorithm SMRFL drives the global model toward a flat minimum. At such a minimum, any perturbed model w+epsilon with ||epsilon||<=rho continues to enjoy a low loss, which is precisely the robustness property needed for perturbed model exchange. The paper's Theorem 1 asserts that with smooth, bounded-variance non-convex loss functions and suitable learning rates, the averaged squared gradient norm of the global objective decreases as O(1/sqrt(R)) over R communication rounds, matching the rate of unperturbed federated averaging; Remark 4 spells out the parameter choices that yield this rate. The experimental sections corroborate the robustness gain on MNIST and CIFAR-10 across uplink, downlink, and combined perturbations, and show that a larger neighborhood radius rho yields flatter minima.
Load-bearing premise
The proof of the main convergence theorem requires a helper constant C to exist under the stated step-size regime, and the paper's own condition on the local learning rate may be too narrow to guarantee any positive C.
Editorial extensions
If this is right
- With rho chosen as O(1/sqrt(R)) and the local learning rate set to O(1/(sqrt(R)EL)), SMRFL converges at the same O(1/sqrt(R)) rate as federated learning without perturbations under general non-convex losses.
- Models trained by SMRFL sit at flat minima, so perturbed copies of the global model in the rho-neighborhood retain low loss; this is what makes the method robust to both uplink and downlink perturbations without knowing the perturbation distribution.
- SMRFL outperforms FedAvg, SCAFFOLD, and FedDyn on MNIST and CIFAR-10 in IID and non-IID settings across downlink, uplink, and combined perturbation scenarios, as reported in Table I and Fig. 4.
- The neighborhood radius rho controls the flatness-accuracy trade-off; the paper reports that rho=0.3 works best on MNIST and rho=0.5 on CIFAR-10, so the radius is a tunable hyperparameter.
- The proof structure follows the standard non-convex FL analysis template of bounding client drift and one-step progress, then summing over communication rounds, extended to account for the SAM-style perturbed update.
Reading between the lines
- Because the perturbation model only assumes an l2-bounded additive disturbance, the same robustness argument could extend to other corruptions with bounded energy, such as bounded Byzantine perturbations, though the paper explicitly targets non-malicious ones; testing SMRFL against malicious model poisoning would be a natural next experiment.
- The convergence claim depends on a constant C whose existence requires 1/2 - 8eE^2 L^2 eta_l^2 to be positive; the paper's step-size condition eta_l < 1/(4EL) may make this impossible, so the proof as written would need adjustment even if the algorithmic idea stands.
- The method's reliance on the normalized gradient direction in the inner maximization means that near-zero gradients could make the step unstable; adding a small epsilon to the denominator, as in standard SAM implementations, would be a practical fix the paper does not discuss.
- The flat-minimum perspective suggests a bridge to generalization: SAM-based FL may also improve out-of-distribution performance on heterogeneous client data, not just robustness to weight perturbations; this is not tested in the paper.
Editorial analysis
A structured set of objections, weighed in public.
Referee Report
Summary. The paper proposes SMRFL, a federated learning method that replaces empirical risk minimization with sharpness-aware minimization (SAM) in each local update, aiming to make the global model robust against non-malicious model perturbations in edge networks. The authors formulate a min-max problem over a rho-neighborhood of the model, approximate the inner maximization via a first-order Taylor expansion, and present Algorithm 1. The main theoretical claim (Theorem 1, Eq. (17)) is an O(1/sqrt(R)) convergence rate for general non-convex losses, said to match FL without perturbations. Experiments on MNIST and CIFAR-10 compare SMRFL with FedAvg, Scaffold, and Feddyn under uplink, downlink, and combined perturbations.
Significance. If the convergence claim were correct and the algorithm were actually analyzed under the stated perturbation model, the result would be a useful robustness guarantee for federated learning over lossy channels and with system-side perturbations. The experimental results are suggestive, particularly in showing consistent accuracy gains over FedAvg under several perturbation strengths. However, the theoretical result is the load-bearing contribution, and it has serious mathematical and modeling gaps described in the major comments. The paper does not currently provide a sound theoretical basis for its central claim, so the significance is not established.
major comments (4)
- [Section IV, Eq. (17)-(18), Remark 4] The claimed O(1/sqrt(R)) rate does not follow from Theorem 1 under the scalings in Remark 4. The last term inside Omega, after the prefactor 1/(C E eta_g eta_l), is L^3 rho^2 sigma_l^2/(C eta_g^3 eta_l^3 N). Substituting eta_l = c/(sqrt(R) E L), eta_g = d sqrt(E N), rho = a/sqrt(R) gives E^{3/2} L^6 a^2 sigma_l^2 sqrt(R)/(C d^3 c^3 N^{5/2}), which grows as sqrt(R). Hence Omega = O(sqrt(R)), not a vanishing or bounded higher-order term, and Eq. (18) cannot be derived from Eq. (17). This invalidates the paper's central theoretical claim.
- [Section IV, Theorem 1] The condition on C in Theorem 1, namely 1/2 - 8e E^2 L^2 eta_l^2 > C > 0, is not guaranteed by the stated step-size bound eta_l < 1/(4 E L). For eta_l just below 1/(4 E L), the left-hand side is approximately 1/2 - e/2 < 0, so no positive C exists. The theorem needs the stricter condition eta_l < 1/(4 E L sqrt(e)) or an explicit lower bound on R to ensure the interval for C is nonempty. As stated, the assumptions of Theorem 1 are internally inconsistent.
- [Section II.B, Section III, Algorithm 1, Theorem 1] The convergence analysis is for an algorithm that does not include the perturbations defined in the system model. Equations (2) and (6) define perturbed broadcast and upload, and Eq. (7) aggregates the perturbed local models, but Algorithm 1 lines 4, 10, and 12 use the unperturbed w_r, w_i,r, and aggregate the unperturbed w_i,r. Theorem 1 therefore bounds the gradient norm of the SAM objective (14) in an ideal channel setting; it does not establish convergence under the perturbed model-sharing process the paper is about. This is a load-bearing gap between the problem formulation and the theoretical result.
- [Section IV, Remark 2] The proof of Theorem 1 is only an outline, as Remark 2 states. Since the theorem is the central contribution and Eq. (17) has a complicated Omega term with specific constants, a full proof is necessary to verify the derivation, the C condition, and the claimed rate. The outline does not allow the reader to check the steps leading to Eq. (17), especially in light of the scaling inconsistency noted above.
minor comments (4)
- [Section IV, Assumption 3] Assumption 3 bounds the variance of the normalized stochastic gradient direction, which is non-standard and is not implied by the usual bounded variance of stochastic gradients. Its validity for losses with near-zero gradients (e.g., cross-entropy) is not discussed, and the paper should specify the norm when the gradient is zero.
- [Section IV, Eq. (17)] The notation \hat{w}_0 and \hat{w}^* is not defined in the theorem; the authors should clarify whether these are perturbed or unperturbed model parameters and how they relate to the optimization problem in Eq. (14).
- [Section IV, Remark 3] Remark 3 states that the first four terms in Omega reduce to eta_l^2/(C E)[...], but the third term in Eq. (17) is proportional to eta_l^5 and does not contain eta_g, so the stated simplification does not match the displayed formula.
- [Section V, Table I and Fig. 4] The experimental results are reported without standard deviations or multiple runs, and no statistical significance tests are provided; conclusions about the relative performance of SMRFL and the baselines should be tempered accordingly.
Circularity Check
No significant circularity: the convergence claim is an application of the standard FedSAM analysis under stated assumptions, not a fitted parameter relabeled as a prediction.
full rationale
The paper's derivation chain is: formulate a min-max robustness objective (Eq. 9), approximate the inner maximization by a normalized-gradient perturbation (Eqs. 11-13), adopt SAM-style local updates (Eqs. 15-16), and then state a convergence bound (Eq. 17) under standard smoothness and bounded-variance assumptions. The regularity assumptions are external and standard; Assumption 3 is explicitly attributed to Qu et al. [15], not to the present authors. The paper's own earlier references [1]-[3] are cited only as background on federated edge intelligence and are not load-bearing in the proof. The claimed O(1/sqrt R) rate in Remark 4 follows, if it follows, by substituting the stated hyperparameter scalings into Eq. (17). Reusing the FedSAM framework and its proof technique is a legitimate use of prior work, not a circular reduction: the theorem is not defined in terms of its conclusion, and no fitted quantity is renamed as a prediction. The empirical selection of rho on each dataset is ordinary hyperparameter tuning, not a fitted input called a prediction. The reader and skeptic raise a serious mathematical concern that the last term in Omega in Eq. (17) may scale as sqrt(R) under the Remark 4 scalings, making Eq. (18) unsupported. That is a correctness or proof-validity issue, not circularity, because it does not identify an equation that is true by construction or a conclusion that restates its own assumptions. Likewise, the existence condition on C in Theorem 1 is a technical condition in the proof, not a definitional equivalence. Accordingly, no specific circular step can be quoted and exhibited, and the honest finding is no significant circularity.
Assumptions & free parameters
free parameters (1)
- neighborhood radius rho =
0.3 (MNIST), 0.5 (CIFAR-10)
assumptions (4)
- standard math Each local loss function F_i is L-smooth (Assumption 1).
- domain assumption Bounded variance of local gradients relative to global gradient sigma_g^2 (Assumption 2).
- ad hoc to paper The stochastic gradient direction variance is bounded by sigma_l^2 (Assumption 3).
- domain assumption The perturbation is additive with l2 norm bounded by rho.
Cite this review
Pith. "Pith review of Robust Federated Learning against Model Perturbation in Edge Networks." pith.science (2026). https://pith.science/paper/2R36W7G5
@misc{pith2026250524728,
author = {Pith},
title = {Pith review of: Robust Federated Learning against Model Perturbation in Edge Networks},
year = {2026},
howpublished = {\url{https://pith.science/paper/2R36W7G5}},
note = {Machine review of arXiv:2505.24728}
}
read the original abstract
Federated Learning (FL) is a promising paradigm for realizing edge intelligence, allowing collaborative learning among distributed edge devices by sharing models instead of raw data. However, the shared models are often assumed to be ideal, which would be inevitably violated in practice due to various perturbations, leading to significant performance degradation. To overcome this challenge, we propose a novel method, termed Sharpness-Aware Minimization-based Robust Federated Learning (SMRFL), which aims to improve model robustness against perturbations by exploring the geometrical property of the model landscape. Specifically, SMRFL solves a min-max optimization problem that promotes model convergence towards a flat minimum by minimizing the maximum loss within a neighborhood of the model parameters. In this way, model sensitivity to perturbations is reduced, and robustness is enhanced since models in the neighborhood of the flat minimum also enjoy low loss values. The theoretical result proves that SMRFL can converge at the same rate as FL without perturbations. Extensive experimental results show that SMRFL significantly enhances robustness against perturbations compared to three baseline methods on two real-world datasets under three perturbation scenarios.
Figures
Figures from the paper (2 more)
Reference graph
Works this paper leans on
-
[1]
Time-sensitive learning for heterogeneous federated edge intelligence,
Y . Xiaoet al., “Time-sensitive learning for heterogeneous federated edge intelligence,”IEEE Transactions on Mobile Computing, vol. 23, no. 2, pp. 1382–1400, Feb. 2024
work page 2024
-
[2]
——, “Distributed traffic synthesis and classification in edge networks: A federated self-supervised learning approach,”IEEE Transactions on Mobile Computing, vol. 23, no. 2, pp. 1815–1829, Feb. 2024
work page 2024
-
[3]
Federated generative learning for digital twin network modeling,
D. Jin, Y . Li, and Y . Xiao, “Federated generative learning for digital twin network modeling,” in2024 IEEE 99th V ehicular Technology Conference, Singapore, Singapore, Jun. 2024
work page 2024
-
[4]
Robust design of federated learning for edge- intelligent networks,
Q. Qi and X. Chen, “Robust design of federated learning for edge- intelligent networks,”IEEE Trans. Commun., vol. 70, no. 7, pp. 4469– 4481, Jul. 2022
work page 2022
-
[5]
R. Hu, Y . Guo, and Y . Gong, “Federated learning with sparsified model perturbation: Improving accuracy under client-level differential privacy,” IEEE Trans. Mob. Comput., vol. 23, no. 8, pp. 8242–8255, Aug. 2024
work page 2024
-
[6]
Byzantine-resilient secure federated learning,
J. So, B. G ¨uler, and A. S. Avestimehr, “Byzantine-resilient secure federated learning,”IEEE J. Sel. Areas Commun., vol. 39, no. 7, pp. 2168–2181, Jul. 2021
work page 2021
-
[7]
J. Sun, A. Li, L. DiValentin, A. Hassanzadeh, Y . Chen, and H. Li, “Fl- wbc: Enhancing robustness against model poisoning attacks in federated learning from a client perspective,” inNIPS, Virtual, Dec. 2021
work page 2021
-
[8]
Fedinv: Byzantine-robust federated learning by inversing local model updates,
B. Zhao, P. Sun, T. Wang, and K. Jiang, “Fedinv: Byzantine-robust federated learning by inversing local model updates,” inAAAI, Virtual, Feb. 2022
work page 2022
Show all 18 references
-
[9]
DAdaQuant: Doubly-adaptive quantization for communication-efficient federated learning,
R. H ¨onig, Y . Zhao, and R. Mullins, “DAdaQuant: Doubly-adaptive quantization for communication-efficient federated learning,” inICML, Baltimore, Maryland, USA, Jul. 2022
2022
-
[10]
Federated learning over noisy channels: Conver- gence analysis and design examples,
X. Wei and C. Shen, “Federated learning over noisy channels: Conver- gence analysis and design examples,”IEEE Trans. Cognit. Commun. Networking, vol. 8, no. 2, pp. 1253–1268, Jun. 2022
2022
-
[11]
Sharpness-aware minimization for efficiently improving generalization,
P. Foret, A. Kleiner, H. Mobahi, and B. Neyshabur, “Sharpness-aware minimization for efficiently improving generalization,” inICLR, Virtual, May 2021
2021
-
[12]
Convergence of federated learning over a noisy downlink,
M. M. Amiri, D. G ¨und¨uz, S. R. Kulkarni, and H. V . Poor, “Convergence of federated learning over a noisy downlink,”IEEE Trans. Wireless Commun., vol. 21, no. 3, pp. 1422–1437, Mar. 2022
2022
-
[13]
Uveqfed: Universal vector quantization for federated learning,
N. Shlezinger, M. Chen, Y . C. Eldar, H. V . Poor, and S. Cui, “Uveqfed: Universal vector quantization for federated learning,”IEEE Trans. Signal Process., vol. 69, pp. 500–514, Dec. 2021
2021
-
[14]
SCAFFOLD: Stochastic controlled averaging for federated learning,
S. P. Karimireddy, S. Kale, M. Mohri, S. Reddi, S. Stich, and A. T. Suresh, “SCAFFOLD: Stochastic controlled averaging for federated learning,” inICML, Virtual, Jul. 2020
2020
-
[15]
Generalized feder- ated learning via sharpness aware minimization,
Z. Qu, X. Li, R. Duan, Y . Liu, B. Tang, and Z. Lu, “Generalized feder- ated learning via sharpness aware minimization,” inICML, Baltimore, Maryland, USA, Jul. 2022
2022
-
[16]
Communication-efficient learning of deep networks from decentralized data,
B. McMahan, E. Moore, D. Ramage, S. Hampson, and B. A. y Arcas, “Communication-efficient learning of deep networks from decentralized data,” inAISTATS, Ft. Lauderdale, FL, USA, Apr. 2017
2017
-
[17]
Federated learning based on dynamic regularization,
D. A. E. Acar, Y . Zhao, R. Matas, M. Mattina, P. Whatmough, and V . Saligrama, “Federated learning based on dynamic regularization,” in ICLR, Virtual, May 2021
2021
-
[18]
Visualizing the loss landscape of neural nets,
H. Li, Z. Xu, G. Taylor, C. Studer, and T. Goldstein, “Visualizing the loss landscape of neural nets,” inNIPS, Montreal Canada, Dec. 2018
2018
Reviewed August 7, 2026 · model on record in the stance chip above.
Discussion (0). Sign in to comment.