Pith. sign in

REVIEW 3 major objections 4 minor 40 references

Federated learning can stay on course despite skewed data and Byzantine attackers, by dragging each local update toward a trusted reference direction.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

The paper proposes divergence-based update calibration (DRAG/BR-DRAG) with convergence theorems, but DRAG's theorem excludes the hyperparameter settings used in its own experiments.

T0 review reviewed 2026-08-03 challenge →

load-bearing objection DRAG/BR-DRAG has a genuinely neat drift-correction recipe, but Theorem 1's proof only supports c < ~0.095 while the experiments run c = 0.1 and 0.25, so the central convergence claim does not cover the evaluated regime. the 3 major comments →

arxiv 2601.06903 v2 pith:I5XSTABP submitted 2026-01-11 cs.DC

Divergence-Based Adaptive Aggregation for Byzantine Robust Federated Learning

Bingnan Xiao , Feng Zhu , Jingjing Zhang , Wei Ni , Xin Wang This is my paper
classification cs.DC
keywords federated learningclient driftByzantine robustnessadaptive aggregationnon-convex convergencedata heterogeneitycosine similaritytrusted root dataset
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper proposes two aggregation rules for federated learning that counter the two main obstacles to stable training: client drift from non-identical local data, and Byzantine workers who upload corrupted updates. DRAG measures how far each worker's update diverges from a momentum-based reference direction and then linearly calibrates the update toward that direction, with no extra communication. BR-DRAG strengthens this by deriving the reference direction from a small, trusted root dataset at the server and by normalizing every worker's update to the reference's norm, so malicious gradients cannot dominate by sheer magnitude. The authors prove convergence rates for non-convex objectives under partial participation, heterogeneity, and adversarial attacks, and they show empirically that the method withstands up to 60% malicious workers while existing robust aggregators fail. If correct, this gives a practical, low-overhead way to make federated learning both drift-resistant and Byzantine-robust without requiring a majority of honest workers.

Core claim

The central claim is that client drift and Byzantine corruption can be mitigated by a single geometric operation: rotating and scaling each local update toward a reference direction, with the amount of correction set by a 'degree of divergence' that is just a linear function of cosine similarity. In DRAG, the reference direction is an exponential moving average of past aggregate updates, so it tracks the global descent direction without needing server-side data. In BR-DRAG, the reference direction comes from running local SGD on a trusted root dataset, and the update rule v_t^m = (1 - λ_t^m) (||r_t|| / ||g_t^m||) g_t^m + λ_t^m r_t both projects each update onto the reference direction and no

What carries the argument

The key machinery is the 'degree of divergence' (DoD), defined as λ_t^m = c (1 - cos(g_t^m, r_t)) with c ∈ [0,1], a continuous, differentiable proxy for the angle between a worker's local update and the reference direction. This scalar is used in a convex combination that 'drags' the local gradient toward the reference while preserving its magnitude (in DRAG) or its direction after normalizing to the reference norm (in BR-DRAG). The reference direction r_t itself is the second pillar: in DRAG it is an exponential moving average of past global updates, and in BR-DRAG it is the difference between the global model and the model after U SGD steps on the trusted root dataset. Together, the DoD an

Load-bearing premise

The whole Byzantine-resilience claim rests on the assumption that the server's small trusted root dataset is representative enough that the benign workers' updates have a non-negative weighted average cosine similarity to the root-derived reference direction in every round (Assumption 4, Eq. 23); if the root data is skewed or the benign data distribution shifts, the reference direction can become an unreliable beacon and the convergence guarantee to the global objective colla

What would settle it

Run BR-DRAG with a root dataset deliberately constructed to be heavily biased toward one class (e.g., all samples from class 0) while the workers hold the full label distribution, and measure whether the global model converges to the accuracy achieved by a root dataset that is class-balanced; a clear accuracy gap in the balanced-versus-biased comparison would indicate that the reference direction is not a faithful proxy for ∇f, undermining the proof's premise.

Watch this falsifier. Get emailed when new claim-graph text bears on it.

If this is right

  • If the convergence theorems hold, federated learning can tolerate a majority of Byzantine workers in a round, a regime where prior robust aggregators (e.g., Krum, trimmed mean, geometric median) provably break down.
  • DRAG's per-worker calibration requires no extra communication, so it can be dropped into existing FedAvg-style systems with only a small hyperparameter (c and α) to tune.
  • BR-DRAG's use of a trusted root dataset gives a concrete mechanism to compute a reliable descent direction, making the server's role more than a simple averaging node.
  • The O(1/√T) rate matches standard non-convex FL without attacks, suggesting that robustness to Byzantine workers need not slow down the best-case convergence order.
  • The analysis relaxes the usual bounded-gradient assumption, replacing it with a bound on the ratio of reference-to-local gradient norms, which better fits non-IID data.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • The root-dataset assumption is the load-bearing element: if the server's small trusted dataset is not representative of the global data distribution, BR-DRAG's reference direction may point away from the true optimum, and the convergence guarantee to the global objective would fail even with no attacks.
  • One can treat BR-DRAG as a form of trust bootstrap: it converts a small amount of trusted data into a full defense against arbitrary client updates. An interesting extension would be to make the root dataset adapt over time as the model learns, or to use differentially private root data to protect it.
  • The DoD metric is essentially a linearized angle; a natural testable variant is to use the exact cosine or a higher-order polynomial, which might reduce the variance penalty that grows with c in the DRAG bound.
  • Because the proof allows an arbitrary fraction of malicious workers per round, but the experiments cap at 60%, a concrete stress test is to run BR-DRAG with 80-90% malicious workers and check whether the bound's constants (which depend on w_t) still permit convergence in practice.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

3 major / 4 minor

Summary. The paper proposes two federated-learning algorithms, DRAG and BR-DRAG, for heterogeneous and Byzantine-corrupted settings. DRAG defines a 'degree of divergence' between each client update and a momentum-based reference direction, then linearly calibrates local updates toward that direction. BR-DRAG replaces the reference direction with one computed from a trusted root dataset on the server, and normalizes updates before aggregation. The paper claims to prove fast convergence for non-convex objectives under partial participation, data heterogeneity, and Byzantine attacks (Theorems 1 and 2), and reports experiments on EMNIST, CIFAR-10, and CIFAR-100 under several attacks and heterogeneity levels.

Significance. If the convergence theorems were valid, the paper would offer a simple, communication-free drift-correction heuristic and a Byzantine-robust variant with a trusted-root-data reference, supported by extensive experiments. The DoD formulation is intuitive and the experiments cover a reasonable range of attacks and heterogeneity. However, the central theoretical claims are not supported by the proof as written: the DRAG descent coefficient is negative for the experimental values of c, and the BR-DRAG conditions require knowledge of unobservable attack statistics. The advertised 'fast convergence' and 'arbitrary proportion of malicious workers' guarantees therefore do not follow from the presented analysis.

major comments (3)
  1. [Appendix A, Eqs. (33)-(34); Section VI-A] The coefficient of E[||∇f(θ_t)||^2] in Eq. (33) is 1 - 3c/2 - (3c/U + ηL/2)(90U^3L^2η^2 + 3U) - 15(1-c)L^2U^2η^2. For fixed c and U, taking η→0 gives 1 - 3c/2 - 9c = 1 - 10.5c. Eq. (34) requires a positive γ smaller than this coefficient. For c=0.1 this limit is -0.05; for c=0.25 it is -1.625. Thus no positive γ exists for c > 1/10.5 ≈ 0.0952. Section VI-A uses c=0.1 and c=0.25, so the experiments are in a regime where Theorem 1's bound is vacuous. The theorem statement does not state any c restriction and is false as stated for those values. The sentence in Section VI-A claiming that the results 'validate Theorem 1' is therefore unsupported.
  2. [Section V-B, Theorem 2; Appendix B] The first bullet of Theorem 2 requires c_t = w_t/(w_t - x_t), where w_t is the Byzantine fraction and x_t = (1/S)∑_{m∈A_t} ⟨g_m^t,r^t⟩/(||g_m^t||||r^t||) is an averaged cosine similarity of the malicious updates. Both quantities are unobservable to the server and are not inputs to Algorithm 2. The second bullet imposes inequalities involving ρ^t, w_t, x_t, and y_t, again unverifiable in practice. Consequently, Theorem 2 does not give a convergence guarantee for an implementable algorithm. Moreover, the step-size condition contains a factor (1-w_t); when w_t=1 the step-size is non-positive, so the claim in Section V-C that 'BR-DRAG allows an arbitrary proportion of malicious workers in each round' is not established by the stated conditions.
  3. [Assumption 4, Eq. (23)] Assumption 4 is load-bearing: it postulates that the weighted cosine similarity between benign workers' updates and the trusted reference direction r^t lies in [0, (1-w_t)q]. This is exactly the alignment property that BR-DRAG is designed to produce. If the root dataset is not representative of the global objective, or if benign gradients drift, the assumed bound fails and the proof of Theorem 2 collapses. The theorem is therefore conditional on the mechanism it purports to establish, rather than demonstrating that BR-DRAG creates that alignment. This hidden dependence is not identified as a limitation in the paper.
minor comments (4)
  1. [Algorithm 1, lines 4-16] In round t=0 the workers first perform U local SGD steps and upload g_m to compute r_0, then are asked to perform U local SGD steps again to compute v_m. This doubles the local computation in the first round and is not described in the text. Please clarify the intended sequence or adjust the pseudocode.
  2. [Figures 3-17] The legend text in many figures appears as 'uni000...' substitution codes in the provided manuscript. The legends need to be rendered correctly for the experimental section to be interpretable.
  3. [Theorem 1 statement] The definition of V has unmatched parentheses, and the existence of γ is stated without specifying the required range of c. The theorem should state the condition on c (or otherwise correct the algebra) so that γ>0 is possible.
  4. [Section V-C, asymptotics] The text says that plugging η=O(1/√T) and U=O(1) gives O(1/√T) convergence, but Theorems 1 and 2 are stated with a fixed η and do not specify how η is scheduled with T. Please make the dependence on T explicit.

Circularity Check

0 steps flagged

No significant circularity: the convergence theorems are conditional statements with independent assumptions and external benchmarks, not predictions that reduce to fitted inputs or self-citations.

full rationale

I examined the derivation chain for self-definitional steps, fitted-input predictions, and load-bearing self-citations. None of the paper's central claims reduce to their own inputs by construction. DRAG's reference direction r_t is a momentum recurrence over the algorithm's own modified gradients (Eq. 5), and the modified gradients depend on r_t (Eq. 11); this is an algorithmic feedback loop, not a claim that a fitted quantity predicts itself. The convergence proof in Appendix A never assumes r_t equals the true gradient; it only uses norm and smoothness bounds, so the theorem is not defined in terms of its conclusion. BR-DRAG's Assumption 4 (Eq. 23) is a genuine data-alignment condition on benign workers relative to a root-dataset reference; Theorem 2 is conditional on that assumption. A strong or debatable assumption can limit applicability, but it is not circular because the theorem does not define the reference direction using the convergence claim, nor fit the claim into the assumption. There are no author self-citations: the cited lemmas ([40], etc.) are external and are not used to forbid alternatives or to smuggle in an ansatz. The paper is benchmarked against external methods (FedAvg, SCAFFOLD, FLTrust, RFA, etc.), and no fitted parameter is renamed as a prediction. Some correctness gaps exist, notably the proof of Theorem 1 asserts but does not demonstrate the existence of a positive gamma for the experimental c values (the small-stepsize coefficient in Eq. 33 becomes negative for c > 1/10.5 while experiments use c = 0.1 and 0.25). This is an internal algebraic/correctness risk, not a circularity, and I therefore do not count it as a circular step under the provided rules.

Axiom & Free-Parameter Ledger

2 free parameters · 6 axioms · 0 invented entities

No new physical or mathematical entities are introduced. The main additional ingredients beyond standard FL assumptions are Assumptions 3-4 and the trusted root dataset, which together guarantee the benign-references alignment that the paper's final claims depend on.

free parameters (2)
  • α (momentum weight) = 0.25
    Controls the EMA of reference direction r_t in Eq. (5); tuned per experiments; not constrained by the convergence theorem.
  • c (divergence strength) = 0.1 (β=0.5), 0.25 (β=0.1); c_t=0.5 in BR-DRAG
    Sets the drag strength in Eqs. (10)/(16); tuned per heterogeneity level; the proof of Theorem 1 requires c < ~0.095 (Eq. 34), but experiments use c=0.1–0.25.
axioms (6)
  • domain assumption Assumption 1: L-smoothness and lower boundedness of F_m
    Standard in non-convex FL analysis; used throughout Appendices A/B.
  • standard math Assumption 2: unbiased local gradients with bounded variance σ_L^2, σ_G^2
    Standard; defines heterogeneity measure and stochastic noise in the proofs.
  • domain assumption Assumption 3: norm ratio ρ_m^t = ||r_t||/||g_m^t|| ∈ [p,q]
    Bounds relative magnitudes of benign gradients vs root reference; invoked in Theorem 2.
  • domain assumption Assumption 4: weighted cosine-sum of benign updates is bounded in [0,(1-w_t)q]
    Load-bearing: asserts benign updates stay positively aligned with the trusted root reference each round; underlies the entire BR-DRAG convergence proof (Eq. 23).
  • domain assumption Root dataset D_root is vetted/trusted and representative
    BR-DRAG builds r_t from D_root (Eq. 12-13); convergence to global f presumes the root direction tracks ∇f.
  • domain assumption UAR worker selection with partial participation
    Used in proofs (Section II-A) to justify identical sampling distributions in Eq. (29).

reviewed 2026-08-03 · how reviews work

0 comments
Cite this review

Pith. "Pith review of Divergence-Based Adaptive Aggregation for Byzantine Robust Federated Learning." pith.science (2026). https://pith.science/paper/I5XSTABP

@misc{pith2026260106903,
  author       = {Pith},
  title        = {Pith review of: Divergence-Based Adaptive Aggregation for Byzantine Robust Federated Learning},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/I5XSTABP}},
  note         = {Machine review of arXiv:2601.06903}
}
Share X Bluesky LinkedIn Reddit HN
read the original abstract

Inherent client drifts caused by data heterogeneity, as well as vulnerability to Byzantine attacks within the system, hinder effective model training and convergence in federated learning (FL). This paper presents two new frameworks, named DiveRgence-based Adaptive aGgregation (DRAG) and Byzantine-Resilient DRAG (BR-DRAG), to mitigate client drifts and resist attacks while expediting training. DRAG designs a reference direction and a metric named divergence of degree to quantify the deviation of local updates. Accordingly, each worker can align its local update via linear calibration without extra communication cost. BR-DRAG refines DRAG under Byzantine attacks by maintaining a vetted root dataset at the server to produce trusted reference directions. The workers' updates can be then calibrated to mitigate divergence caused by malicious attacks. We analytically prove that DRAG and BR-DRAG achieve fast convergence for non-convex models under partial worker participation, data heterogeneity, and Byzantine attacks. Experiments validate the effectiveness of DRAG and its superior performance over state-of-the-art methods in handling client drifts, and highlight the robustness of BR-DRAG in maintaining resilience against data heterogeneity and diverse Byzantine attacks.

Figures

Figures reproduced from arXiv: 2601.06903 by Bingnan Xiao, Feng Zhu, Jingjing Zhang, Wei Ni, Xin Wang.

Figure 1
Figure 1. Figure 1: The architecture of a FL system with S selected workers in round t. For Byzantine FL systems, the attacked workers can upload arbitrary local updates to affect global model aggregation. CIFAR-100. DRAG effectively mitigates client drifts and accelerates convergence, and consistently outperforms state￾of-the-art baselines under heterogeneity and partial worker par￾ticipation. Under various Byzantine attacks… view at source ↗
Figure 2
Figure 2. Figure 2: Illustration of vector modification of DRAG. For workers with [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. Figure 3: Convergence performance of different algorithms on EMNIST. [PITH_FULL_IMAGE:figures/full_fig_p008_3.png] view at source ↗
Figure 4
Figure 4. Figure 4: Convergence performance of different algorithms on CIFAR-10. [PITH_FULL_IMAGE:figures/full_fig_p008_4.png] view at source ↗
Figure 5
Figure 5. Figure 5: Convergence performance of different algorithms on CIFAR-100. [PITH_FULL_IMAGE:figures/full_fig_p008_5.png] view at source ↗
Figure 6
Figure 6. Figure 6: Convergence performance of DRAG with different numbers of [PITH_FULL_IMAGE:figures/full_fig_p008_6.png] view at source ↗
Figure 9
Figure 9. Figure 9: Convergence performance of different algorithms on CIFAR-10 under [PITH_FULL_IMAGE:figures/full_fig_p009_9.png] view at source ↗
Figure 11
Figure 11. Figure 11: Convergence performance of different algorithms on CIFAR-10 under [PITH_FULL_IMAGE:figures/full_fig_p009_11.png] view at source ↗
Figure 12
Figure 12. Figure 12: Convergence performance of different algorithms on CIFAR-100 [PITH_FULL_IMAGE:figures/full_fig_p009_12.png] view at source ↗
Figure 13
Figure 13. Figure 13: Convergence performance of different algorithms on CIFAR-10 under [PITH_FULL_IMAGE:figures/full_fig_p009_13.png] view at source ↗
Figure 14
Figure 14. Figure 14: Convergence performance of different algorithms on CIFAR-100 [PITH_FULL_IMAGE:figures/full_fig_p010_14.png] view at source ↗
Figure 15
Figure 15. Figure 15: Convergence performance of different algorithms on CIFAR-10 under [PITH_FULL_IMAGE:figures/full_fig_p010_15.png] view at source ↗
Figure 16
Figure 16. Figure 16: Convergence performance of different algorithms on CIFAR-10 under [PITH_FULL_IMAGE:figures/full_fig_p010_16.png] view at source ↗
Figure 17
Figure 17. Figure 17: Convergence performance of different algorithms on CIFAR-10 under [PITH_FULL_IMAGE:figures/full_fig_p010_17.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

40 extracted references · 3 linked inside Pith

  1. [1]

    Communication-efficient learning of deep networks from decentralized data,

    B. McMahan, E. Moore, D. Ramage, S. Hampson, and B. A. y. Arcas, “Communication-efficient learning of deep networks from decentralized data,” inProc. Int. Conf. Artif. Intell. Stat. (AISTATS), vol. 54. PMLR, 2017, pp. 1273–1282

    2017

  2. [2]

    Federated learning with differential pri- vacy: Algorithms and performance analysis,

    K. Wei, J. Li, M. Ding, C. Ma, H. H. Yang, F. Farokhi, S. Jin, T. Q. S. Quek, and H. Vincent Poor, “Federated learning with differential pri- vacy: Algorithms and performance analysis,”IEEE Trans. Inf. Forensics Secur., vol. 15, pp. 3454–3469, 2020

    2020

  3. [3]

    Federated learning with non-iid data,

    Y . Zhao, M. Li, L. Lai, N. Suda, D. Civin, and V . Chandra, “Federated learning with non-iid data,” arXiv preprint arXiv:1806.00582, 2018

    Pith/arXiv arXiv 2018

  4. [4]

    Byzantine-resilient secure federated learning,

    J. So, B. G ¨uler, and A. S. Avestimehr, “Byzantine-resilient secure federated learning,”IEEE J. Sel. Areas Commun., vol. 39, no. 7, pp. 2168–2181, 2020

    2020

  5. [5]

    A robust privacy-preserving federated learning model against model poisoning attacks,

    A. Yazdinejad, A. Dehghantanha, H. Karimipour, G. Srivastava, and R. M. Parizi, “A robust privacy-preserving federated learning model against model poisoning attacks,”IEEE Trans. Inf. Forensics Secur., vol. 19, pp. 6693–6708, 2024

    2024

  6. [6]

    On the convergence of FedAvg on non-iid data,

    X. Li, K. Huang, W. Yang, S. Wang, and Z. Zhang, “On the convergence of FedAvg on non-iid data,” inProc Int. Conf. Learn. Representations (ICLR), 2020

    2020

  7. [7]

    From local SGD to local fixed-point methods for federated learning,

    G. Malinovskiy, D. Kovalev, E. Gasanov, L. Condat, and P. Richtarik, “From local SGD to local fixed-point methods for federated learning,” inProc. Int. Conf. Mach. Learn. (ICML), 2020, pp. 6692–6701

    2020

  8. [8]

    SAGA: A fast incremental gradient method with support for non-strongly convex composite objec- tives,

    A. Defazio, F. Bach, and S. Lacoste-Julien, “SAGA: A fast incremental gradient method with support for non-strongly convex composite objec- tives,” inProc. Neural Inf. Process. Syst. (NeurIPS), vol. 27, 2014

    2014

  9. [9]

    Variance re- duced local SGD with lower communication complexity,

    X. Liang, S. Shen, J. Liu, Z. Pan, E. Chen, and Y . Cheng, “Variance re- duced local SGD with lower communication complexity,” arXiv preprint arXiv:1912.12844, 2019

    Pith/arXiv arXiv 1912

  10. [10]

    FedDANE: A federated Newton-type method,

    T. Li, A. K. Sahu, M. Zaheer, M. Sanjabi, A. Talwalkar, and V . Smithy, “FedDANE: A federated Newton-type method,” inProc. Asilomar Conf. Signals, Syst., and Comput., 2019, pp. 1227–1231

    2019

  11. [11]

    FedSplit: An algorithmic framework for fast federated optimization,

    R. Pathak and M. J. Wainwright, “FedSplit: An algorithmic framework for fast federated optimization,” inProc. Neural Inf. Process. Syst. (NeurIPS), vol. 33, 2020, pp. 7057–7066

    2020

  12. [12]

    Linear convergence in federated learning: Tackling client heterogeneity and sparse gradients,

    A. Mitra, R. Jaafar, G. J. Pappas, and H. Hassani, “Linear convergence in federated learning: Tackling client heterogeneity and sparse gradients,” inProc. Neural Inf. Process. Syst. (NeurIPS), vol. 34, 2021, pp. 14 606– 14 619

    2021

  13. [13]

    SCAFFOLD: Stochastic controlled averaging for federated learning,

    S. P. Karimireddy, S. Kale, M. Mohri, S. Reddi, S. Stich, and A. T. Suresh, “SCAFFOLD: Stochastic controlled averaging for federated learning,” inProc. Int. Conf. Mach. Learn. (ICML), 2020, pp. 5132– 5143

    2020

  14. [14]

    Federated learning based on dynamic regularization,

    D. A. E. Acar, Y . Zhao, R. Matas, M. Mattina, P. Whatmough, and V . Saligrama, “Federated learning based on dynamic regularization,” in Proc Int. Conf. Learn. Representations (ICLR), 2021

    2021

  15. [15]

    MIME: Mimicking centralized stochastic algorithms in federated learning,

    S. P. Karimireddy, M. Jaggi, S. Kale, M. Mohri, S. J. Reddi, S. U. Stich, and A. T. Suresh, “MIME: Mimicking centralized stochastic algorithms in federated learning,” arXiv preprint arXiv:2008.03606, 2020

    Pith/arXiv arXiv 2008

  16. [16]

    Federated optimization in heterogeneous networks,

    T. Li, A. K. Sahu, M. Zaheer, M. Sanjabi, A. Talwalkar, and V . Smith, “Federated optimization in heterogeneous networks,” inProc. Mach. Learn. Syst. (MLSys), vol. 2, 2020, pp. 429–450

    2020

  17. [17]

    FedDC: Federated learning with non-iid data via local drift decoupling and correction,

    L. Gao, H. Fu, L. Li, Y . Chen, M. Xu, and C.-Z. Xu, “FedDC: Federated learning with non-iid data via local drift decoupling and correction,” in Proc. IEEE/CVF Conf. Comput. Vis. Pattern Recognit. (CVPR), 2022, pp. 10 112–10 121

    2022

  18. [18]

    Generalized federated learning via sharpness aware minimization,

    Z. Qu, X. Li, R. Duan, Y . Liu, B. Tang, and Z. Lu, “Generalized federated learning via sharpness aware minimization,” inProc. Int. Conf. Mach. Learn. (ICML), vol. 162. PMLR, 17–23 Jul 2022, pp. 18 250– 18 280

    2022

  19. [19]

    Enhancing sharpness-aware optimization through variance suppression,

    B. Li and G. Giannakis, “Enhancing sharpness-aware optimization through variance suppression,” inProc. Neural Inf. Process. Syst. (NeurIPS), vol. 36, 2023, pp. 70 861–70 879

    2023

  20. [20]

    FedExP: Speeding up federated averaging via extrapolation,

    D. Jhunjhunwala, S. Wang, and G. Joshi, “FedExP: Speeding up federated averaging via extrapolation,” inProc. Int. Conf. Learn. Rep- resentations (ICLR), 2023

    2023

  21. [21]

    Communication-efficient federated learning with accelerated client gradient,

    G. Kim, J. Kim, and B. Han, “Communication-efficient federated learning with accelerated client gradient,” inProc. IEEE/CVF Conf. Comput. Vis. Pattern Recognit. (CVPR), June 2024, pp. 12 385–12 394

    2024

  22. [22]

    LSFL: A lightweight and secure federated learning scheme for edge computing,

    Z. Zhang, L. Wu, C. Ma, J. Li, J. Wang, Q. Wang, and S. Yu, “LSFL: A lightweight and secure federated learning scheme for edge computing,” IEEE Trans. Inf. Forensics Secur., vol. 18, pp. 365–379, 2023

    2023

  23. [23]

    Byzantine-robust aggregation in federated learning empowered industrial IoT,

    S. Li, E. Ngai, and T. V oigt, “Byzantine-robust aggregation in federated learning empowered industrial IoT,”IEEE Trans. Ind. Informat., vol. 19, no. 2, pp. 1165–1175, 2023

    2023

  24. [24]

    RSA: Byzantine- robust stochastic aggregation methods for distributed learning from heterogeneous datasets,

    L. Li, W. Xu, T. Chen, G. B. Giannakis, and Q. Ling, “RSA: Byzantine- robust stochastic aggregation methods for distributed learning from heterogeneous datasets,” inProc. Conf. Artif. Intell. (AAAI), vol. 33, no. 01, 2019, pp. 1544–1551

    2019

  25. [25]

    Data quality detection mechanism against label flipping attacks in federated learning,

    Y . Jiang, W. Zhang, and Y . Chen, “Data quality detection mechanism against label flipping attacks in federated learning,”IEEE Trans. Inf. Forensics Secur., vol. 18, pp. 1625–1637, 2023

    2023

  26. [26]

    Machine learning with adversaries: Byzantine tolerant gradient descent,

    P. Blanchard, E. M. El Mhamdi, R. Guerraoui, and J. Stainer, “Machine learning with adversaries: Byzantine tolerant gradient descent,” inProc. Neural Inf. Process. Syst. (NeurIPS), vol. 30, 2017

    2017

  27. [27]

    Local model poisoning attacks to Byzantine-robust federated learning,

    M. Fang, X. Cao, J. Jia, and N. Gong, “Local model poisoning attacks to Byzantine-robust federated learning,” inProc. USENIX Secur. Symp. (USENIX Secur.), 2020, pp. 1605–1622

    2020

  28. [28]

    Byzantine-robust dis- tributed learning: Towards optimal statistical rates,

    D. Yin, Y . Chen, R. Kannan, and P. Bartlett, “Byzantine-robust dis- tributed learning: Towards optimal statistical rates,” inProc. Int. Conf. Mach. Learn. (ICML), 2018, pp. 5650–5659

    2018

  29. [29]

    FLTrust: Byzantine-robust federated learning via trust bootstrapping,

    X. Cao, M. Fang, J. Liu, and N. Z. Gong, “FLTrust: Byzantine-robust federated learning via trust bootstrapping,” inProc. Netw. Distrib. Syst. Secur. Symp. (NDSS), 2020, pp. 2938–2948

    2020

  30. [30]

    Robust aggregation for federated learning,

    K. Pillutla, S. M. Kakade, and Z. Harchaoui, “Robust aggregation for federated learning,”IEEE Trans. Signal Process., vol. 70, pp. 1142– 1154, 2022

    2022

  31. [31]

    Geometric median and robust estimation in banach spaces,

    S. MINSKER, “Geometric median and robust estimation in banach spaces,”Bernoulli, vol. 21, no. 4, pp. 2308–2335, 2015

    2015

  32. [32]

    Federated variance- reduced stochastic gradient descent with robustness to Byzantine at- tacks,

    Z. Wu, Q. Ling, T. Chen, and G. B. Giannakis, “Federated variance- reduced stochastic gradient descent with robustness to Byzantine at- tacks,”IEEE Trans. Signal Process., vol. 68, pp. 4583–4596, 2020

    2020

  33. [33]

    Byzantine-robust distributed learning with com- pression,

    H. Zhu and Q. Ling, “Byzantine-robust distributed learning with com- pression,”IEEE Trans. Signal Inf. Process. Networks, vol. 9, pp. 280– 294, 2023

    2023

  34. [34]

    Byzantine- resilient federated learning with adaptivity to data heterogeneity,

    S. Zuo, X. Yan, R. Fan, H. Hu, H. Shan, and T. Q. Quek, “Byzantine- resilient federated learning with adaptivity to data heterogeneity,” arXiv preprint arXiv:2403.13374, 2024

    arXiv 2024

  35. [35]

    Confident learning: Estimating uncertainty in dataset labels,

    C. Northcutt, L. Jiang, and I. Chuang, “Confident learning: Estimating uncertainty in dataset labels,”J. Artif. Intell. Res., vol. 70, pp. 1373– 1411, 2021

    2021

  36. [36]

    Olive: Oblivious federated learning on trusted execution environment against the risk of sparsification,

    F. Kato, Y . Cao, and M. Yoshikawa, “Olive: Oblivious federated learning on trusted execution environment against the risk of sparsification,”Proc. VLDB Endow., vol. 16, no. 10, p. 2404–2417, Jun. 2023

    2023

  37. [37]

    EMNIST: Ex- tending MNIST to handwritten letters,

    G. Cohen, S. Afshar, J. Tapson, and A. Van Schaik, “EMNIST: Ex- tending MNIST to handwritten letters,” inProc. Int. Joint Conf. Neural Netw. (IJCNN), 2017, pp. 2921–2926

    2017

  38. [38]

    Learning multiple layers of features from tiny images,

    A. Krizhevsky and G. Hinton, “Learning multiple layers of features from tiny images,” 2009

    2009

  39. [39]

    Weiszfeld’s method: Old and new results,

    A. Beck and S. Sabach, “Weiszfeld’s method: Old and new results,”J. Optim. Theory Appl., vol. 164, no. 1, pp. 1–40, 2015

    2015

  40. [40]

    Adaptive federated optimization,

    S. J. Reddi, Z. Charles, M. Zaheer, Z. Garrett, K. Rush, J. Kone ˇcn´y, S. Kumar, and H. B. McMahan, “Adaptive federated optimization,” in Proc. Int. Conf. Learn. Representations (ICLR), 2021

    2021

This paper was first reviewed by deepseek-v4-flash on August 3, 2026.