Secure and Private Federated Learning: Achieving Adversarial Resilience through Robust Aggregation

Kun Yang; Neena Imam

REVIEW 5 major objections 5 minor 15 references

Secure and Private Federated Learning: Achieving Adversarial Resilience through Robust Aggregation

T0 review · 5 major / 5 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read ArKrum, a parameter-free aggregation rule, matches or exceeds Krum, mKrum, and rKrum in accuracy and stability across benchmark datasets and three Byzantine attack types.

desk verdict ArKrum's median-filter-plus-averaging idea is plausible, but the published pseudocode degenerates to Mean under Large Outlier, so the reported results are not reproducible from the paper. read the letter →

arxiv 2505.17226 v2 pith:SS6WDD3N submitted 2025-05-22 cs.LG cs.CR

Kun Yang , Neena Imam This is my paper · ORCID

classification cs.LGcs.CR

keywords federatedlearningByzantinerobustnessrobustaggregationKrumparameter-freemedianfilteringmulti-updateaveragingadversarialattacks

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Federated learning servers usually need to know how many clients are malicious before they can choose a robust aggregation rule; ArKrum removes that requirement. The paper argues that two changes to the earlier rKrum algorithm are enough: a median-based filter that discards extreme update distances before estimating the number of Byzantine clients, and a multi-update averaging step inspired by mKrum that averages several nearby updates instead of selecting one. In experiments on MNIST and Sentiment140 under large-outlier, noise-injection, and label-flipping attacks, ArKrum consistently matches or beats Krum, mKrum, and rKrum in accuracy and stability. If the claim holds, a server can stay resilient against malicious clients without a hard-coded threat model, with stability comparable to multi-Krum.

What carries the argument

The load-bearing mechanism is Algorithm 1, the median-based extreme-value filter, applied to each client's sorted array of squared Euclidean distances. For each client, the filter takes the median distance as a trustworthy reference, sets a threshold at the median plus the distance from the median to the smallest stored distance, and removes every distance above that threshold; the surviving distances are fed to the SSE-based change-point estimator of the Byzantine count $f$ from rKrum. That estimate then determines how many nearest updates are included in the multi-update average used as the final aggregated update.

What would settle it

Run ArKrum on MNIST with $f = 48$ Byzantine clients that flip labels and then scale their updates to the same average Euclidean norm as honest updates; if the median filter keeps those updates, the $f$-estimator returns a small value, and global accuracy collapses, the central claim is falsified.

Watch

Extended reading notes

Core claim

On the paper's own terms, the central discovery is that extreme-value filtering plus multi-update averaging makes a parameter-free Krum variant practical. ArKrum first computes pairwise squared Euclidean distances between client updates, then, for each client, applies a median-based threshold to remove the most distant updates before estimating the number of Byzantine clients with an SSE-based change-point method inherited from rKrum. It then selects the update with the lowest Krum score and averages the top $n$ minus estimated-$f$ updates nearest to it. Across the reported experiments, ArKrum attains accuracy and stability comparable to mKrum and superior to rKrum and Krum, except under label flipping, where the paper reports that all Krum-based methods fail because poisoned updates can no longer be distinguished by distance.

Load-bearing premise

The load-bearing premise is that Byzantine updates are statistical outliers in Euclidean distance, so a median-based distance threshold can separate them from honest updates before the number of attackers is estimated; the paper's own label-flipping experiments show this premise can fail.

Editorial extensions

If this is right

A federated learning server can deploy robust aggregation without specifying the number of Byzantine clients in advance, removing a major practical barrier.
Averaging multiple nearby updates instead of selecting one gives notably more stable convergence under Non-IID client data, as seen in the comparison between ArKrum and mKrum versus rKrum and Krum.
The median filter corrects rKrum's tendency to underestimate $f$ when extreme outliers are present, improving accuracy under large-outlier attacks.
Under label-flipping attacks, ArKrum inherits the failure mode of the Krum family: flipped-label updates can cluster with honest updates and be selected, so distance-based filtering alone is not sufficient.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

The paper does not test whether the median-based threshold remains reliable when Byzantine updates are crafted to be just inside the filter's cutoff; a natural extension is to replace the threshold with a robust scale estimator (such as median absolute deviation) and compare under adversarial tuning.
Because the reported failure mode is attack geometry rather than $f$-estimation, combining ArKrum with a clustering or norm-clipping step could resist label-flipping attacks where poisoned updates resemble honest ones; this combination is not evaluated here.
The filter is asymmetric, removing only distances above the median; an attacker who sends a block of small, mutually close updates just below the honest distances could exploit that asymmetry, which is a testable scenario the paper leaves open.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

You should know two things about this paper. The new idea is a simple, honest combination: a median-based pre-filter in front of the authors' own rKrum change-point estimator, followed by mKrum-style averaging of several updates. It is clearly written and they openly acknowledge that label flipping breaks all Krum variants. But I checked Algorithm 2 in the Large Outlier setting and the stress-test concern holds. The filter removes the Byzantine distances before ESTIMATE_F runs, so an honest client's filtered array contains only honest-honest distances; there is no outlier cluster left to detect, and f_hat comes out about zero. Then the Krum score in Step 3 sums over almost all other clients and Step 4 averages the top 100 updates, i.e., all of them. That is equivalent to Mean, yet Figures 2 and 5 report ArKrum as the best method. Either the pseudocode is wrong or ESTIMATE_F does something the paper does not state. On top of that, Section 3.2 defines tau = Δ_max + d'_i1, which equals the median, while Algorithm 1 line 3 uses tau = median + Δ_max. These are different thresholds, so the algorithm is not even internally consistent.

What is genuinely new is the specific combination of trimming before automatic f-estimation and averaging the estimated honest set. That is a reasonable engineering idea, and the experimental setup covers two datasets, IID/Non-IID splits, and three standard attacks. If the implementation actually matches the figures, the method probably does improve stability over rKrum. But that 'if' is doing all the work. There is no code, no error bars, no multiple seeds, and no ablation isolating the filter from the averaging. The abstract claims ArKrum 'consistently achieves high accuracy,' which their own label-flipping plots contradict. The core rKrum estimator is cited to an unpublished preprint, so the evaluation inherits machinery that no independent reader can check.

My recommendation: do not let this through peer review yet. The central empirical claim cannot be reconstructed from the published algorithm, and the missing code and seeds make it impossible to know whether the figures are real or a quirk of an unreported implementation. If the authors release code, fix the threshold inconsistency, and add basic statistics, this could be a minor but citable contribution for FL practitioners who want parameter-free robust aggregation. As it stands, I would not rely on it or cite it.

Referee Report

5 major / 5 minor

Summary. The manuscript proposes ArKrum, an aggregation rule for Byzantine-robust federated learning that extends the authors' earlier rKrum method. ArKrum first computes pairwise squared Euclidean distances between client updates, filters extreme distances using a median-based threshold (Algorithm 1), estimates the number of Byzantine clients f via an SSE-based change-point method inherited from rKrum, selects the update with the smallest Krum score, and then averages the n - f_hat updates closest to that update. The authors evaluate ArKrum against Mean, Krum, mKrum, and rKrum on MNIST and Sentiment140 under Large Outlier, Noise Injection, and Label Flipping attacks, with n = 100 and f = 48. The abstract and conclusion claim that ArKrum is parameter-free and consistently achieves high accuracy and stability.

Significance. The practical motivation is real: robust aggregation rules such as Krum require knowing f in advance, and an automatic, parameter-free estimator would be useful. Evaluating on two datasets and three canonical attack types is appropriate, and the instability of single-update Krum in Non-IID settings is a genuine problem that multi-update averaging addresses. However, the contribution as written is not reproducible: the core estimator ESTIMATE_F is only cited to an external preprint, the filtering rule is defined inconsistently between Section 3.2 and Algorithm 1, and the reported Large Outlier results appear incompatible with the published pseudocode. The paper also provides no error bars, no repeated-seed statistics, no quantitative tables, and no ablation, so the central empirical comparison is currently supported only by visual inspection of accuracy curves. If the algorithm were fully specified and the experiments made reproducible, the parameter-free f estimation would be a useful incremental contribution to the robust-aggregation literature.

major comments (5)

[Section 3.2 and Algorithm 1] The threshold rule is defined inconsistently. The text states τ = Δ_max + d'_i1, which equals median because Δ_max = median − d'_i1, while Algorithm 1 line 3 sets τ = median + Δ_max. These rules are different in general, and since the median filter is the first key contribution, this ambiguity prevents the reader from knowing which version was actually run.
[Algorithm 2, lines 10–11 and Step 4] Under the Large Outlier attack, the published pseudocode appears to make ArKrum reduce to Mean. Filtering with τ = median + (median − d'_i1) removes the very large Byzantine distances from D before ESTIMATE_F is called; the remaining D' then contains only honest distances, so the SSE change-point estimator has no Byzantine cluster to detect and returns f_hat_i ≈ 0. Consequently, Score_Krum is computed over n − 2 distances that include Byzantine outliers, and Step 4 averages the top n − 0 = n updates, i.e., all 100 updates including the 48 Byzantine ones. This contradicts the high Large Outlier accuracy reported in Figs. 2 and 5. The manuscript neither specifies an alternative behavior of ESTIMATE_F (e.g., identifying f_hat with n − n') nor shows that the implementation differs from the pseudocode.
[Section 4.2, Figs. 4 and 7] The label-flipping experiments show that all Krum-based methods, including ArKrum, fail to reach acceptable accuracy under both IID and Non-IID settings. This directly contradicts the abstract's statement that ArKrum "consistently achieves high accuracy" and the conclusion's claim that it "consistently matches or exceeds" existing methods. The claims should be qualified to the Large Outlier and Noise Injection settings.
[Section 4] The empirical evaluation is entirely qualitative. The results are reported only as accuracy curves with no error bars, no multiple-seed variance, no final accuracy tables, and no ablation separating the median-filter contribution from the multi-update averaging contribution. Given that the central claim is empirical ("as well as or better than" and "stability"), the lack of any quantitative summary makes the comparison unverifiable.
[Algorithm 2, line 11 and Section 3.2] The method's f estimation is delegated to ESTIMATE_F from reference [15], which is not described in this manuscript. Because the paper's core novelty is parameter-free f estimation, this black box means the algorithm is not self-contained or reproducible. The authors should either include a complete specification of ESTIMATE_F or clearly state its exact input-output behavior, including how it handles a filtered array whose Byzantine cluster has been removed.

minor comments (5)

[Title and Abstract] The title and abstract promise privacy, but no privacy mechanism (such as secure aggregation or differential privacy) is proposed or analyzed; recommend rephrasing to focus on Byzantine robustness.
[Section 4.1 and Reference [6]] The text says SENTIMENT140 contains 1,600,000 tweets, while the reference title says 160,000 tweets; please correct the inconsistency.
[Algorithm 1] Algorithm 1 does not state whether D'_i contains distances to the n − 1 other clients or includes the self-distance 0; this affects mid, median, and n' and should be clarified.
[Algorithm 2] The notation N_i is used both for the indices entering Score_Krum and for the set of updates averaged in Step 4; use two different symbols to avoid confusion.
[Section 3.1 and figure captions] There are missing spaces in phrases such as "areshowningreen" and "left Fig.7"; these appear to be formatting artifacts and should be corrected.

Circularity Check

1 steps flagged · score 4.0 of 10

ArKrum's external accuracy benchmarks are independent, but its central 'parameter-free' f-estimation is imported as a load-bearing self-citation from the authors' prior rKrum, without derivation or independent verification in this paper.

self citation load bearing [Algorithm 2, Step 2 (line 11); Section 3.2]
"Algorithm 2, Step 2: 'D′ ← FILTER_EXTREME_VALUES(D) # Alg.1' and 'ˆfi ← ESTIMATE_F(D′) # rKrum in [15]'. Section 3.2: 'we then pass the filtered array D∗i to our rKrum algorithm to obtain a more accurate estimate of fˆi for each client Ci.'"

ArKrum's headline property—automatically estimating the number of Byzantine clients so that no hard-coded f is needed—is not derived in this paper. Algorithm 2 obtains ˆfi by calling ESTIMATE_F, an undefined subroutine explicitly attributed to the authors' own prior work [15]; Section 3.2 likewise hands the filtered distances to 'our rKrum algorithm.' Thus the central mechanism of the claimed contribution is inherited from a same-author citation rather than established here. The external accuracy benchmarks are independent, so the paper is not entirely circular, but the 'parameter-free' claim reduces, at its load-bearing step, to the unverified prior estimator.

full rationale

ArKrum's empirical claims (high accuracy and stability on MNIST and SENTIMENT140 under three Byzantine attacks) are compared against external baselines, and no parameter is fitted to those test outcomes, so the core performance evaluation is not circular. The circularity concern is narrower but load-bearing: the entire 'parameter-free' property rests on ESTIMATE_F, an f-estimator imported from the authors' own prior rKrum [15] with no pseudocode, derivation, or independent verification in this paper. That warrants a score of 4 rather than 0-2. I also considered the Large Outlier/Algorithm-1 inconsistency mentioned by the skeptical reader: Section 3.2 says τ = Δ_max + d′_i1 while Algorithm 1 line 3 sets τ = median + Δ_max, and under Large Outlier the filter can plausibly delete all Byzantine distances so that f_hat ≈ 0. That is a correctness/reproducibility risk, not a circular reduction, so it does not raise the circularity score further. The paper honestly reports that Label Flipping defeats all Krum variants, which is an external falsifiable check and further supports the view that the accuracy results were not constructed to match the claim.

Assumptions & free parameters 1 free parameters · 5 assumptions · 0 invented entities

The central claim depends on a heuristic distance threshold, on the correctness of the authors' earlier rKrum estimator, and on the Euclidean-distance-as-maliciousness assumption. None of these is theoretically justified or independently verified here; the empirical evaluation is the only support.

free parameters (1)

Median filter threshold rule tau = tau = median + (median - d'_i1) in Algorithm 1
Hand-crafted heuristic, not derived or tuned; sensitivity not analyzed. The paper calls the method parameter-free, but this rule is a design choice with no theoretical justification.

assumptions (5)

domain assumption Fewer than half of all client updates are Byzantine, so the median distance is from an honest client.
Stated in Section 3.2 as the rationale for using the median as a central reference.
domain assumption rKrum's SSE-based change point estimation correctly estimates the number of Byzantine clients.
Invoked in Algorithm 2 line 11 via ESTIMATE_F from reference [15]; the method is not described or verified in this paper.
domain assumption Squared Euclidean distance between model updates is a meaningful measure of maliciousness.
Inherited from Krum; underlies all Krum-based algorithms and the median filter, but fails for label-flipping as the authors note.
domain assumption The federated learning setting satisfies 2 + 2f < n for n clients and f Byzantine clients.
Stated in Section 3.1; this is the Krum feasibility condition.
ad hoc to paper Dirichlet-distributed data partitions with alpha=10 and alpha=0.5 represent IID and Non-IID settings.
Experimental modeling choice, not a general guarantee; results may not transfer to other heterogeneity levels.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Secure and Private Federated Learning: Achieving Adversarial Resilience through Robust Aggregation." pith.science (2026). https://pith.science/paper/SS6WDD3N

@misc{pith2026250517226,
  author       = {Pith},
  title        = {Pith review of: Secure and Private Federated Learning: Achieving Adversarial Resilience through Robust Aggregation},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/SS6WDD3N}},
  note         = {Machine review of arXiv:2505.17226}
}

read the original abstract

Federated Learning (FL) enables collaborative machine learning across decentralized data sources without sharing raw data. It offers a promising approach to privacy-preserving AI. However, FL remains vulnerable to adversarial threats from malicious participants, referred to as Byzantine clients, who can send misleading updates to corrupt the global model. Traditional aggregation methods, such as simple averaging, are not robust to such attacks. More resilient approaches, like the Krum algorithm, require prior knowledge of the number of malicious clients, which is often unavailable in real-world scenarios. To address these limitations, we propose Average-rKrum (ArKrum), a novel aggregation strategy designed to enhance both the resilience and privacy guarantees of FL systems. Building on our previous work (rKrum), ArKrum introduces two key innovations. First, it includes a median-based filtering mechanism that removes extreme outliers before estimating the number of adversarial clients. Second, it applies a multi-update averaging scheme to improve stability and performance, particularly when client data distributions are not identical. We evaluate ArKrum on benchmark image and text datasets under three widely studied Byzantine attack types. Results show that ArKrum consistently achieves high accuracy and stability. It performs as well as or better than other robust aggregation methods. These findings demonstrate that ArKrum is an effective and practical solution for secure FL systems in adversarial environments.

Figures

Figures reproduced from arXiv: 2505.17226 by the authors.

**Figure 1.** Federated Learning Architecture. attacks because it relies on decentralized contributions, making it susceptible to poisoned or manipulated model updates from compromised participants [7]. The malicious participants in FL are referred to as Byzantine clients. The Byzantine clients, compromised and controlled by attackers, attempt to disrupt the FLbased applications by sending arbitrary or malicious model updates [1… view at source ↗

**Figure 2.** Performance comparison of five aggregation algorithms on IID vs. Non [PITH_FULL_IMAGE:figures/full_fig_p009_2.png] view at source ↗

**Figure 3.** Performance comparison of five aggregation algorithms on IID vs. Non [PITH_FULL_IMAGE:figures/full_fig_p010_3.png] view at source ↗

Figures from the paper (4 more)

**Figure 4.** Figure 4: Performance comparison of five aggregation algorithms on IID vs. Non [PITH_FULL_IMAGE:figures/full_fig_p011_4.png]

**Figure 5.** Figure 5: Performance comparison of five aggregation algorithms on IID vs. Non [PITH_FULL_IMAGE:figures/full_fig_p012_5.png]

**Figure 6.** Figure 6: Performance comparison of five aggregation algorithms on IID vs. Non [PITH_FULL_IMAGE:figures/full_fig_p013_6.png]

**Figure 7.** Figure 7: Performance comparison of five aggregation algorithms on IID vs. Non [PITH_FULL_IMAGE:figures/full_fig_p013_7.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

15 extracted references · 13 canonical work pages

[15]

Authorea Preprints (2025)

Yang, K., Imam, N.: Resilient privacy preserving machine learning for internet of things. Authorea Preprints (2025)

work page 2025
[1]

Advances in Neural Information Processing Systems30(2017)

Blanchard, P., El Mhamdi, E.M., Guerraoui, R., Stainer, J.: Machine learning with adversaries: Byzantine tolerant gradient descent. Advances in Neural Information Processing Systems30(2017)

work page 2017
[2]

In: Proceedings of the Int’l ACM Symposium on Mobility Management and Wireless Access

Colosimo, F., De Rango, F.: Median-krum: A joint distance-statistical based byzantine-robust algorithm in federated learning. In: Proceedings of the Int’l ACM Symposium on Mobility Management and Wireless Access. pp. 61–68 (2023)

work page 2023
[3]

In: Proceedings of the 2019 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, volume 1 (long and short papers)

Devlin, J., Chang, M.W., Lee, K., Toutanova, K.: Bert: Pre-training of deep bidi- rectional transformers for language understanding. In: Proceedings of the 2019 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, volume 1 (long and short papers). pp. 4171–4186 (2019)

work page 2019
[4]

IEEE Transactions on Consumer Electronics (2025)

Fahim-Ul-Islam, M., Chakrabarty, A., Alam, M.G.R., Maidin, S.S.: A resource- efficient federated learning framework for intrusion detection in IoMT networks. IEEE Transactions on Consumer Electronics (2025)

work page 2025
[5]

Krum Federated Chain (KFC): Using blockchain to defend against adversarial attacks in Federated Learning

García-Márquez, M., Rodríguez-Barroso, N., Luzón, M., Herrera, F.: Krum fed- erated chain (KFC): Using blockchain to defend against adversarial attacks in federated learning. arXiv preprint arXiv:2502.06917 (2025)

work page Pith review arXiv 2025
[6]

Go, A., Bhayani, R., Huang, L.: Sentiment140: A sentiment analysis dataset with 160,000 tweets.https://www.kaggle.com/datasets/kazanova/ sentiment140(2009), accessed: 2025-04-10

work page 2009
[7]

In: International Conference on Machine Learning

Karimireddy, S.P., He, L., Jaggi, M.: Learning from history for byzantine robust optimization. In: International Conference on Machine Learning. pp. 5311–5319. PMLR (2021)

work page 2021

Show all 15 references

[8]

Proceedings of the IEEE86(11), 2278–2324 (1998)

LeCun, Y., Bottou, L., Bengio, Y., Haffner, P.: Gradient-based learning applied to document recognition. Proceedings of the IEEE86(11), 2278–2324 (1998)

1998
[9]

In: Artificial intelligence and statistics

McMahan, B., Moore, E., Ramage, D., Hampson, S., y Arcas, B.A.: Communication-efficient learning of deep networks from decentralized data. In: Artificial intelligence and statistics. pp. 1273–1282. PMLR (2017)

2017
[10]

Electronics12(10), 2287 (2023)

Moshawrab, M., Adda, M., Bouzouane, A., Ibrahim, H., Raad, A.: Reviewing fed- erated learning aggregation algorithms; strategies, contributions, limitations and future perspectives. Electronics12(10), 2287 (2023)

2023
[11]

Ng, K.W., Tian, G.L., Tang, M.L.: Dirichlet and related distributions: Theory, methods and applications (2011)

2011
[12]

Southern Methodist University: O’donnell data science and research computing institute.https://www.smu.edu/provost/odonnell-institute/hpc/systems/mp (2025), accessed: 2025-01-18

2025
[13]

Digital Communications and Networks10(1), 126–134 (2024)

Wang, N., Yang, W., Wang, X., Wu, L., Guan, Z., Du, X., Guizani, M.: A blockchain based privacy-preserving federated learning scheme for internet of ve- hicles. Digital Communications and Networks10(1), 126–134 (2024)

2024
[14]

IEEE Transactions on Information Forensics and Security (2025)

Xhemrishi, M., Östman, J., Wachter-Zeh, A., i Amat, A.G.: Fedgt: Identification of malicious clients in federated learning with secure aggregation. IEEE Transactions on Information Forensics and Security (2025)

2025

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.

[1] [15]

Authorea Preprints (2025)

Yang, K., Imam, N.: Resilient privacy preserving machine learning for internet of things. Authorea Preprints (2025)

work page 2025

[2] [1]

Advances in Neural Information Processing Systems30(2017)

Blanchard, P., El Mhamdi, E.M., Guerraoui, R., Stainer, J.: Machine learning with adversaries: Byzantine tolerant gradient descent. Advances in Neural Information Processing Systems30(2017)

work page 2017

[3] [2]

In: Proceedings of the Int’l ACM Symposium on Mobility Management and Wireless Access

Colosimo, F., De Rango, F.: Median-krum: A joint distance-statistical based byzantine-robust algorithm in federated learning. In: Proceedings of the Int’l ACM Symposium on Mobility Management and Wireless Access. pp. 61–68 (2023)

work page 2023

[4] [3]

In: Proceedings of the 2019 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, volume 1 (long and short papers)

Devlin, J., Chang, M.W., Lee, K., Toutanova, K.: Bert: Pre-training of deep bidi- rectional transformers for language understanding. In: Proceedings of the 2019 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, volume 1 (long and short papers). pp. 4171–4186 (2019)

work page 2019

[5] [4]

IEEE Transactions on Consumer Electronics (2025)

Fahim-Ul-Islam, M., Chakrabarty, A., Alam, M.G.R., Maidin, S.S.: A resource- efficient federated learning framework for intrusion detection in IoMT networks. IEEE Transactions on Consumer Electronics (2025)

work page 2025

[6] [5]

Krum Federated Chain (KFC): Using blockchain to defend against adversarial attacks in Federated Learning

García-Márquez, M., Rodríguez-Barroso, N., Luzón, M., Herrera, F.: Krum fed- erated chain (KFC): Using blockchain to defend against adversarial attacks in federated learning. arXiv preprint arXiv:2502.06917 (2025)

work page Pith review arXiv 2025

[7] [6]

Go, A., Bhayani, R., Huang, L.: Sentiment140: A sentiment analysis dataset with 160,000 tweets.https://www.kaggle.com/datasets/kazanova/ sentiment140(2009), accessed: 2025-04-10

work page 2009

[8] [7]

In: International Conference on Machine Learning

Karimireddy, S.P., He, L., Jaggi, M.: Learning from history for byzantine robust optimization. In: International Conference on Machine Learning. pp. 5311–5319. PMLR (2021)

work page 2021