Pith. sign in

REVIEW 3 major objections 6 minor 35 references

ProDiGy: Proximity- and Dissimilarity-Based Byzantine-Robust Federated Learning

T0 review · 3 major / 6 minor · reviewed 2026-08-04 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read ProDiGy pairs proximity and variance scores to keep federated learning working when data diverge and clients collude.

desk verdict New heuristic aggregation rule that does well empirically against ALIE/FOE in non-IID FL, with an honest account of its Sign-Flip weakness; worth a serious referee but needs reproducibility fixes and a tempered abstract. read the letter →

arxiv 2509.09534 v1 pith:573KORMI submitted 2025-09-11 cs.LG cs.DC

Sena Ergisi , Luis Ma{ss}ny , Rawad Bitar This is my paper
classification cs.LGcs.DC
keywords federatedlearningByzantinerobustnessrobustaggregationnon-IIDdatagradientproximitydissimilarityscoringcolludingadversariesimageclassification
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper proposes ProDiGy, a robust aggregation rule for federated learning that assigns each client a trust score by multiplying two complementary statistics: a proximity score based on ordered pairwise gradient distances, and a dissimilarity score equal to the coefficient of variation of the client's nearest-neighbor gradient set. The central claim is that this dual scoring keeps the global model accurate under strongly non-IID data and colluding Byzantine attacks — ALIE and Fall of Empires — where standard defenses such as median, trimmed mean, geometric median, Krum, and centered clipping collapse to near random-guessing accuracy. In the paper's non-IID CIFAR-10 experiments with 30% Byzantine clients, ProDiGy reaches 66% accuracy under ALIE while the strongest NNM-augmented baseline reaches at most 25%; on FEMNIST, ProDiGy stays above 77% worst-case accuracy under all tested attacks. A sympathetic reader would care because data heterogeneity is the realistic condition for federated learning, and this is a parameter-free aggregation scheme that does not require a clean validation set.

What carries the argument

The load-bearing object is the composite trust score s(k) = s_p(k) · s_d(k). s_p is an inverse sum over the 'middle window' of ordered pairwise squared distances (excluding the f−1 nearest and f farthest neighbors), which gives honest clients high scores while preventing colluding clients from gaining excessive proximity by clustering. s_d is the coefficient of variation of the f-nearest-neighbor set, which penalizes gradients that are suspiciously uniform. The threshold s_th is taken as the f-th smallest composite score, so exactly the f lowest-scoring clients are set to zero weight; the remaining updates are mixed linearly. This combination implements the two design principles: penalize ov

What would settle it

Run ProDiGy under a Sign-Flip attack on non-IID CIFAR-10 with FedAVG, local momentum β=0.9, N=10, f=3 (Table I): the reported accuracy is 46.65%, below No Defense's 63.96%. Reproducing that configuration and observing the per-round selected gradient sets would show the threshold choosing honest clients as Byzantine; alternatively, a synthetic experiment with honest gradients spread widely and Byzantine gradients placed inside the honest convex hull would test the same separability assumption directly.

Watch

Extended reading notes

Core claim

The paper's discovery is that a Byzantine-robust aggregation rule can succeed under heterogeneity by simultaneously rewarding proximity to honest gradients and penalizing suspicious uniformity among neighboring gradients. Concretely, for each client k the server computes s_p(k) as the reciprocal of the sum of squared distances to clients ranked between the f-th and the (N-f-1)-th nearest neighbors, and s_d(k) as the standard deviation of the f-nearest-neighbor gradient set divided by its mean norm (the coefficient of variation). The composite s(k) = s_p(k)*s_d(k) is then thresholded by the f-th smallest composite score, and the server returns a weighted average of the surviving gradients. Th

Load-bearing premise

The method assumes the f clients with the lowest composite scores are exactly the Byzantine clients; if a malicious update lies close to honest updates — as happens under Sign-Flip in the paper's own non-IID experiments — the threshold misclassifies honest clients and the defense underperforms simple averaging.

Editorial extensions

If this is right

  • Under strong label-distribution skew (Dirichlet α=0.1) with 30% Byzantine clients, ProDiGy maintains useful accuracy under ALIE and FOE where NNM-augmented median/trimmed-mean/geometric-median/Krum/CClip fall to chance-level accuracy.
  • Penalizing uniformity via the coefficient of variation is sufficient to blunt colluding attacks that craft nearly identical malicious gradients to bypass similarity-based defenses.
  • The method requires no clean validation dataset at the server and only assumes knowledge of N and f, so it applies in standard cross-device FL settings.
  • The expected complexity is O(N^2 d), matching Krum and pairwise-distance defenses, so the robustness gain does not come with an asymptotic computational penalty.
  • Sign-Flip remains the hardest attack for ProDiGy: in the non-IID FedAVG+momentum setting, simple averaging outperforms it, indicating a residual vulnerability to attacks that keep Byzantine updates inside the honest gradient cloud.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A natural extension is to treat the two scores as separate signals — e.g., a client flagged by only one score could be marked as suspicious rather than excluded, potentially recovering honest clients under Sign-Flip where both scores misfire together.
  • The dissimilarity score's dependence on the nearest-neighbor set size f suggests a testable trade-off: using a neighborhood larger than f might make the score more robust to imperfect estimates of the Byzantine count, at the cost of less sensitivity to tight colluding clusters.
  • Because the proximity score uses a middle window of distances, it resembles a trimmed-distance estimator; an adversary aware of the window could try to place updates at the window's boundary, which suggests probing ProDiGy with attacks that optimize the resulting aggregation's distance to the honest mean — the same objective used to tune ALIE/FOE parameters.
  • The failure under Sign-Flip hints that a defense combining ProDiGy with history or momentum at the server side could close the gap, since the paper already observes that momentum stabilizes learning under SF.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 6 minor

Summary. The paper proposes ProDiGy, a Byzantine-robust federated learning aggregation rule that assigns each client a composite trust score equal to the product of a proximity score (the inverse sum of middle-order pairwise squared distances) and a dissimilarity score (the coefficient of variation of the f-nearest-neighbor set). The server zeroes out the f lowest-scoring clients and returns a score-weighted average. The authors evaluate on CIFAR-10 and FEMNIST under ALIE, FOE, label-flip, and sign-flip attacks, comparing against NNM-augmented median, trimmed mean, geometric median, Krum, and centered clipping. They report worst-case accuracies and claim that ProDiGy maintains utility in non-IID settings where other defenses fail.

Significance. The dual-scoring idea is a plausible and interesting addition to distance-based Byzantine defenses, and the paper has several strengths: it is evaluated on a wide range of client counts and Byzantine fractions, it reports worst-case accuracy, it provides code, and it openly identifies sign-flip as a difficult case. The method also has essentially no tunable hyperparameters beyond the Byzantine count f. However, the central claim as stated in the abstract is stronger than what the evidence supports: the evaluated attacks are not adaptive to ProDiGy's scoring rule, the f-lowest-score separability is assumed without proof and is visibly violated under sign-flip, and no theoretical robustness guarantee is provided. These are load-bearing gaps for the advertised robustness claim.

major comments (3)
  1. [Section III-B and V-A] The paper assumes the strongest adversarial model, where each Byzantine client has full knowledge of the aggregation rule and honest updates, yet none of the evaluated attacks is designed against ProDiGy. ALIE and FOE optimize only a scalar (z or epsilon) for maximum L2 distance of the crafted gradient from the honest mean; SF and LF are fixed transformations. None of them attempts to manipulate s_p(k), s_d(k), or the threshold s_th in Eq. (1). Consequently, Tables I-V demonstrate robustness against particular generic attacks, not against the full-knowledge adversary the paper claims to address. The conclusion's statement that optimal attack strategies are future work confirms this gap. To support the central claim, the authors should either add adaptive attacks targeting the composite score or weaken the adversarial-model claim.
  2. [Section IV, Eq. (1), and Section V-D, Fig. 1, Table I] The algorithm's filtering rule, which sets s(k)=0 for the f smallest composite scores, is equivalent to assuming that the f lowest-scoring clients are exactly the Byzantine clients. No theoretical or empirical justification is given for this separability under data heterogeneity. The paper itself shows the opposite under sign-flip: Fig. 1 displays a Byzantine gradient that is closer to an honest gradient than another honest gradient is, and in Table I (non-IID, beta=0.9, FedAVG, SF) ProDiGy reaches only 46.65% while NNM+CClip reaches 61.91% and No Defense reaches 63.96%. This directly contradicts the abstract's claim that ProDiGy maintains strong defense where other defenses fail. The authors should either provide conditions under which the score ordering holds or explicitly scope the robustness claim away from sign-flip in non-IID settings.
  3. [Section VI] The paper defers any theoretical guarantee for ProDiGy. Because the central robustness claim rests on a non-obvious score-order property, and because the scoring is heuristic, a convergence or error-bound statement under explicit assumptions on honest gradient dispersion and Byzantine score separation is needed to justify the term 'Byzantine-robust' in the title and abstract. Without it, the paper is an empirical study of a heuristic, and the claims should be scaled accordingly.
minor comments (6)
  1. [Table I] Table I reports no standard deviations and no number of seeds, unlike Tables II-V. Add these for reproducibility, especially since Table I is the main CIFAR-10 evidence.
  2. [Algorithm 2, line 8] The denominator in the returned weighted average is written as sum over i in [N] of s(k); it should be sum over k in [N] of s(k).
  3. [Section IV, Eq. (2)] The notation for the index range in Eq. (2) should be made precise: after defining k_i as the i-th closest neighbor, state that the sum runs from i=f to i=N-f-1 and that this leaves N-2f terms in the window.
  4. [Section IV] The composite score is denoted s'(j_i) in the threshold description, while Eq. (1) uses s_p(k)*s_d(k). Align the notation to avoid confusion.
  5. [Fig. 1 caption] The sentence describing pairwise distances is hard to parse. Clarify which client IDs are Byzantine and what the reader should conclude from the example.
  6. [Section V-A] State explicitly how many random seeds are used for Table I; currently seed counts appear only in the captions of Tables II-V.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: ProDiGy is an empirical defense evaluated on external benchmarks; its scoring rule is a fixed algorithm, not fitted to the reported results.

full rationale

The paper proposes an aggregation rule defined by Eqs. (1)-(3) and evaluates it by final held-out test accuracy on CIFAR-10 and FEMNIST under fixed attack types. The composite score s(k) is not fitted to, or defined in terms of, the reported accuracies; no parameter is calibrated on the benchmark outcomes. The threshold s_th is set to the f-th smallest composite score, which enforces that exactly f clients are zero-weighted, but this is a design choice of the algorithm with f assumed known, not a prediction derived from the experimental results. The authors' explicit observation that Sign-Flip can break the low-score separability (Sec. V-D, Fig. 1) is an admission of a failure mode, demonstrating that the method's assumptions are empirically falsifiable rather than true by construction. There are no load-bearing self-citations, no imported uniqueness theorem, and no ansatz smuggled in through prior work. The skeptical concerns about adversary modeling and the need to know f are robustness/validity concerns, not circularity. No circular step can be quoted because the central claim rests on external experimental comparisons, not on an equation that reduces to its own inputs.

Assumptions & free parameters 0 free parameters · 4 assumptions · 0 invented entities

ProDiGy introduces no new physical entities or mediators; it is an algorithm that computes scores from gradient vectors already available to the server. No free parameters are fitted to data in ProDiGy itself; the main premises are domain assumptions about gradient geometry and the known Byzantine count, all stated in Section IV and Section VI.

assumptions (4)
  • domain assumption Honest gradients are more mutually proximate than Byzantine outliers, so discarding the f farthest neighbors in s_p removes only attackers.
    Section IV design principle (i) and Eq. (2) exclude the f farthest distances; if Byzantine updates are not outliers, the score is misled.
  • domain assumption The f nearest neighbors N_f(k) of an honest client are mostly honest, so the coefficient of variation in Eq. (3) is a valid dissimilarity signal.
    Eq. (3) and the surrounding text assume colluding Byzantine clients appear as a highly similar cluster; if honest gradients are more scattered than the Byzantine cluster, the score can invert.
  • domain assumption The server knows the exact number of Byzantine clients f.
    Algorithm 2 takes f as input; Section VI states 'The best defense performance is achieved when the number of Byzantine clients, f, is accurately estimated.'
  • domain assumption The mean of the neighbor set has nonzero norm, so s_d is finite.
    Eq. (3) divides by ||mu(N_f(k))||; zero-mean neighborhoods are not handled or discussed.

how reviews work

0 comments
Cite this review

Pith. "Pith review of ProDiGy: Proximity- and Dissimilarity-Based Byzantine-Robust Federated Learning." pith.science (2026). https://pith.science/paper/573KORMI

@misc{pith2026250909534,
  author       = {Pith},
  title        = {Pith review of: ProDiGy: Proximity- and Dissimilarity-Based Byzantine-Robust Federated Learning},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/573KORMI}},
  note         = {Machine review of arXiv:2509.09534}
}
read the original abstract

Federated Learning (FL) emerged as a widely studied paradigm for distributed learning. Despite its many advantages, FL remains vulnerable to adversarial attacks, especially under data heterogeneity. We propose a new Byzantine-robust FL algorithm called ProDiGy. The key novelty lies in evaluating the client gradients using a joint dual scoring system based on the gradients' proximity and dissimilarity. We demonstrate through extensive numerical experiments that ProDiGy outperforms existing defenses in various scenarios. In particular, when the clients' data do not follow an IID distribution, while other defense mechanisms fail, ProDiGy maintains strong defense capabilities and model accuracy. These findings highlight the effectiveness of a dual perspective approach that promotes natural similarity among honest clients while detecting suspicious uniformity as a potential indicator of an attack.

Figures

Figures reproduced from arXiv: 2509.09534 by the authors.

Figure 1
Figure 1. In the pairwise distance matrix a malicious gradient [PITH_FULL_IMAGE:figures/full_fig_p007_1.png] view at source ↗

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

35 extracted references · 1 linked inside Pith

  1. [1]

    Communication-Efficient Learning of Deep Networks from Decentral- ized Data,

    B. McMahan, E. Moore, D. Ramage, S. Hampson, and B. A. y. Arcas, “Communication-Efficient Learning of Deep Networks from Decentral- ized Data,” inProceedings of the 20th International Conference on Artificial Intelligence and Statistics, 2017, pp. 1273–1282

    2017

  2. [2]

    Advances and open problems in federated learning,

    P. Kairouz, H. B. McMahan, B. Avent, A. Bellet, M. Bennis, A. N. Bhagoji, K. Bonawitz, Z. Charles, G. Cormode, R. Cummingset al., “Advances and open problems in federated learning,”Foundations and Trends® in Machine Learning, vol. 14, no. 1–2, pp. 1–210, 2021

    2021

  3. [3]

    Survey on federated learning threats: Concepts, taxonomy on attacks and defences, experimental study and challenges,

    N. Rodr ´ıguez-Barroso, D. Jim ´enez-L´opez, M. V . Luz´on, F. Herrera, and E. Mart ´ınez-C´amara, “Survey on federated learning threats: Concepts, taxonomy on attacks and defences, experimental study and challenges,” Inf. Fusion, vol. 90, pp. 148–173, 2023

    2023

  4. [4]

    Heterogeneous federated learning: State-of-the-art and research challenges,

    M. Ye, X. Fang, B. Du, P. Yuen, and D. Tao, “Heterogeneous federated learning: State-of-the-art and research challenges,”ACM Computing Surveys, vol. 56, pp. 1 – 44, 2023

    2023

  5. [5]

    The byzantine generals prob- lem,

    L. Lamport, R. Shostak, and M. Pease, “The byzantine generals prob- lem,”ACM Trans. Program. Lang. Syst., vol. 4, no. 3, p. 382–401, Jul. 1982

    1982

  6. [6]

    Machine learning with adversaries: Byzantine tolerant gradient descent,

    P. Blanchard, E. M. El Mhamdi, R. Guerraoui, and J. Stainer, “Machine learning with adversaries: Byzantine tolerant gradient descent,” inAd- vances in Neural Information Processing Systems, vol. 30, 2017, pp. 118–128

    2017

  7. [7]

    Byzantine-robust dis- tributed learning: Towards optimal statistical rates,

    D. Yin, Y . Chen, R. Kannan, and P. Bartlett, “Byzantine-robust dis- tributed learning: Towards optimal statistical rates,” inProceedings of the 35th International Conference on Machine Learning, vol. 80, 2018, pp. 5650–5659

    2018

  8. [8]

    Distributed statistical machine learning in adversarial settings: Byzantine gradient descent,

    Y . Chen, L. Su, and J. Xu, “Distributed statistical machine learning in adversarial settings: Byzantine gradient descent,” inAbstracts of the 2018 ACM International Conference on Measurement and Modeling of Computer Systems, 2017

    2018

Show all 35 references
  1. [9]

    Robust aggregation for federated learning,

    K. Pillutla, S. M. Kakade, and Z. Harchaoui, “Robust aggregation for federated learning,”IEEE Transactions on Signal Processing, vol. 70, pp. 1142–1154, 2022

    2022

  2. [10]

    Learning from history for byzantine robust optimization,

    S. P. Karimireddy, L. He, and M. Jaggi, “Learning from history for byzantine robust optimization,” inInternational Conference on Machine Learning, 2020

    2020

  3. [11]

    The hidden vulnera- bility of distributed learning in byzantium,

    E. M. E. Mhamdi, R. Guerraoui, and S. Rouault, “The hidden vulnera- bility of distributed learning in byzantium,” inInternational Conference on Machine Learning, 2018

    2018

  4. [12]

    Faba: An algorithm for fast aggregation against byzantine attacks in distributed neural networks,

    Q. Xia, Z. Tao, Z. Hao, and Q. Li, “Faba: An algorithm for fast aggregation against byzantine attacks in distributed neural networks,” inProceedings of the Twenty-Eighth International Joint Conference on Artificial Intelligence, IJCAI-19, 2019, pp. 4824–4830

    2019

  5. [13]

    Understanding distributed poisoning attack in federated learning,

    D. Cao, S. Chang, Z. Lin, G. Liu, and D. Sun, “Understanding distributed poisoning attack in federated learning,” in2019 IEEE 25th International Conference on Parallel and Distributed Systems (ICPADS), 2019, pp. 233–239

    2019

  6. [14]

    Byzantine-robust federated learning through spatial-temporal analysis of local model updates,

    Z. Li, L. Liu, J. Zhang, and J. Liu, “Byzantine-robust federated learning through spatial-temporal analysis of local model updates,” in2021 IEEE 27th International Conference on Parallel and Distributed Systems (ICPADS), 2021, pp. 372–379

    2021

  7. [15]

    On the byzantine robustness of clustered federated learning,

    F. Sattler, K.-R. M ¨uller, T. Wiegand, and W. Samek, “On the byzantine robustness of clustered federated learning,” inIEEE International Con- ference on Acoustics, Speech and Signal Processing (ICASSP), 2020, pp. 8861–8865

    2020

  8. [16]

    An experimental study of byzantine- robust aggregation schemes in federated learning,

    S. Li, E. C. H. Ngai, and T. V oigt, “An experimental study of byzantine- robust aggregation schemes in federated learning,”IEEE Transactions on Big Data, vol. 10, pp. 975–988, 2023

    2023

  9. [17]

    Zeno: Distributed stochastic gradient descent with suspicion-based fault-tolerance,

    C. Xie, S. Koyejo, and I. Gupta, “Zeno: Distributed stochastic gradient descent with suspicion-based fault-tolerance,” inProceedings of the 36th International Conference on Machine Learning, vol. 97, 2019, pp. 6893– 6901

    2019

  10. [18]

    Fltrust: Byzantine-robust federated learning via trust bootstrapping,

    X. Cao, M. Fang, J. Liu, and N. Gong, “Fltrust: Byzantine-robust federated learning via trust bootstrapping,” inNetwork and Distributed System Security Symposium, 2021

    2021

  11. [19]

    Fedgt: Identification of malicious clients in federated learning with secure aggregation,

    M. Xhemrishi, J. ¨Ostman, A. Wachter-Zeh, and A. G. i. Amat, “Fedgt: Identification of malicious clients in federated learning with secure aggregation,”IEEE Transactions on Information Forensics and Security, vol. 20, pp. 2577–2592, 2025

    2025

  12. [20]

    Fixing by mixing: A recipe for optimal byzantine ml under heterogeneity,

    Y . Allouah, S. Farhadkhani, R. Guerraoui, N. Gupta, R. Pinot, and J. Stephan, “Fixing by mixing: A recipe for optimal byzantine ml under heterogeneity,” inAISTATS, 2023

    2023

  13. [21]

    Byzantine-robust learning on heterogeneous datasets via bucketing,

    S. P. Karimireddy, L. He, and M. Jaggi, “Byzantine-robust learning on heterogeneous datasets via bucketing,” inInternational Conference on Learning Representations, 2022

    2022

  14. [22]

    Distributed momentum for byzantine-resilient stochastic gradient descent,

    E. M. E. Mhamdi, R. Guerraoui, and S. Rouault, “Distributed momentum for byzantine-resilient stochastic gradient descent,” inInternational Conference on Learning Representations, 2021

    2021

  15. [23]

    A little is enough: Circumvent- ing defenses for distributed learning,

    G. Baruch, M. Baruch, and Y . Goldberg, “A little is enough: Circumvent- ing defenses for distributed learning,” inAdvances in Neural Information Processing Systems, vol. 32, 2019

    2019

  16. [24]

    Fall of empires: Breaking byzantine- tolerant sgd by inner product manipulation,

    C. Xie, O. Koyejo, and I. Gupta, “Fall of empires: Breaking byzantine- tolerant sgd by inner product manipulation,” inProceedings of The 35th Uncertainty in Artificial Intelligence Conference, vol. 115, 2020, pp. 261–270

    2020

  17. [25]

    Challenges and Approaches for Mitigating Byzantine Attacks in Federated Learning ,

    J. Shi, W. Wan, S. Hu, J. Lu, and L. Yu Zhang, “ Challenges and Approaches for Mitigating Byzantine Attacks in Federated Learning ,” inIEEE International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom), 2022, pp. 139–146

    2022

  18. [26]

    The sybil attack,

    J. R. Douceur, “The sybil attack,” inRevised Papers from the First In- ternational Workshop on Peer-to-Peer Systems, ser. IPTPS ’01. Berlin, Heidelberg: Springer-Verlag, 2002, p. 251–260

    2002

  19. [27]

    Mitigating sybils in federated learning poisoning,

    C. Fung, C. J. M. Yoon, and I. Beschastnikh, “Mitigating sybils in federated learning poisoning,”ArXiv preprint arXiv:1808.04866, 2018

    2018 arXiv

  20. [28]

    Federated optimization in heterogeneous networks,

    T. Li, A. K. Sahu, M. Zaheer, M. Sanjabi, A. Talwalkar, and V . Smith, “Federated optimization in heterogeneous networks,” inProceedings of Machine Learning and Systems, vol. 2, 2020, pp. 429–450

    2020

  21. [29]

    Scaffold: Stochastic controlled averaging for federated learning,

    S. P. Karimireddy, S. Kale, M. Mohri, S. J. Reddi, S. U. Stich, and A. T. Suresh, “Scaffold: Stochastic controlled averaging for federated learning,” inInternational Conference on Machine Learning, 2019

    2019

  22. [30]

    Learning multiple layers of features from tiny images,

    A. Krizhevsky, “Learning multiple layers of features from tiny images,” University of Toronto, Tech. Rep., 2009

    2009

  23. [31]

    Leaf: A benchmark for federated settings,

    S. Caldas, S. M. K. Duddu, P. Wu, T. Li, J. Kone ˇcn´y, H. B. McMahan, V . Smith, and A. Talwalkar, “Leaf: A benchmark for federated settings,” inWorkshop on Federated Learning for Data Privacy and Confidential- ity, 2019

    2019

  24. [32]

    Ensemble distillation for robust model fusion in federated learning,

    T. Lin, L. Kong, S. U. Stich, and M. Jaggi, “Ensemble distillation for robust model fusion in federated learning,” inAdvances in Neural Information Processing Systems, vol. 33, 2020, pp. 2351–2363

    2020

  25. [33]

    Adaptive gradient clipping for robust federated learning,

    Y . Allouah, R. Guerraoui, N. Gupta, A. Jellouli, G. Rizk, and J. Stephan, “Adaptive gradient clipping for robust federated learning,” inProceed- ings of the 2025 International Conference on Learning Representations (ICLR), 2025

    2025

  26. [34]

    Byzantine- resilient non-convex stochastic gradient descent,

    Z. Allen-Zhu, F. Ebrahimian, J. Z. Li, and D. Alistarh, “Byzantine- resilient non-convex stochastic gradient descent,” inInternational Con- ference on Learning Representations, 2020

    2020

  27. [35]

    Manipulating the byzantine: Op- timizing model poisoning attacks and defenses for federated learning,

    V . Shejwalkar and A. Houmansadr, “Manipulating the byzantine: Op- timizing model poisoning attacks and defenses for federated learning,” NDSS, 2021

    2021

Pith tools

Reviewed August 4, 2026 · model on record in the stance chip above.