Pith. sign in

REVIEW 4 major objections 6 minor 1 cited by

GRANITE : a Byzantine-Resilient Dynamic Gossip Learning Framework

T0 review · 4 major / 6 minor · reviewed 2026-08-16 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read GRANITE claims that gossip learning can stay accurate with up to 30% Byzantine nodes by tracking encountered identifiers and adaptively filtering poisoned models, with the local Byzantine ratio decaying exponentially to the global fraction.

desk verdict Useful systems paper with a real dual-attack threat model and strong empirical results, but the exponential-decay proof rests on a mean-field arrival rate that ignores flooding, so the formal claims outrun the analysis. read the letter →

arxiv 2504.17471 v2 pith:YKCCZUOK submitted 2025-04-24 cs.LG cs.AIcs.DC

Yacine Belal , Mohamed Maouche , Sonia Ben Mokhtar This is my paper · ORCID
classification cs.LGcs.AIcs.DC
keywords gossiplearningByzantineresiliencerandompeersamplingmodelpoisoningrobustaggregationdynamicgraphsadaptivethresholdfloodingattack
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Gossip learning is a fully decentralized training scheme whose dynamic-graph variants rely on random peer sampling, and GRANITE tackles the attack that previous defenses missed: Byzantine nodes that poison models and simultaneously flood the peer-sampling layer with their identifiers. The paper's central claim is that this dual attack can be neutralized by giving each node a growing history of all identifiers it has encountered and using hash-based ranking to fill view slots, so the expected fraction of Byzantine nodes in local views decays exponentially to the global fraction $f$. On top of this, an adaptive probabilistic threshold converts the decaying estimate into a per-round filtering count for robust aggregators such as clipped summation and geometric trimmed summation. If these claims hold, gossip learning can stay accurate within about 5% of the non-Byzantine optimum under 30% Byzantine nodes while using up to 9 times sparser communication graphs than current theory demands.

What carries the argument

The machine that carries the argument is the pair (HaPS, APT). HaPS maintains, at every node, a history of every identifier it has ever received via push and pull exchanges; each of the $v$ view slots then selects the minimum under an independent ranking hash, so Byzantine flooding only adds identifiers that tend to lose the hash-based ranking against the accumulating honest history. The formal engine is the mean-field ODE $dC(t)/dt = \alpha(|H|-C(t))/|H|$ for the expected number of unique honest identifiers known, whose solution gives the exponential decay $B(t)$ of the expected Byzantine fraction in local views. APT then turns that decay into a concrete filtering budget: the Chernoff upper-tail inequality $P(X_t \ge (1+\delta)vB(t)) \le \exp(-\delta^2 vB(t)/(\delta+2))$ is inverted to find the smallest $\delta$ for failure probability $\kappa$, yielding $b(t)=(1+\delta)vB(t)$ capped at $v-1$. This is the identity that lets a robust aggregator designed for a static, bounded fraction of Byzantine neighbors keep its guarantee in a dynamic graph where the Byzantine density is initially high and then recedes.

What would settle it

Measure the empirical Byzantine fraction in honest local views ($f_{in}(t)$) during the first 50 rounds under $F=\infty$ flooding with $f=0.3$. The exponential-decay claim predicts $f_{in}(t)$ falls from its early spike toward roughly $f$ within about 20 rounds; if it stays materially above $f$ after the warm-up phase, the claim fails. A more mechanistic check is to instrument the arrival rate of honest identifiers $\alpha$ and verify that the growth of unique honest identifiers follows $dC(t)/dt = \alpha(|H|-C(t))/|H|$; a mismatch under flooding would falsify the ODE.

Watch

Extended reading notes

Core claim

Under GRANITE, each node's local view is refreshed from a monotonically growing history $h_i(t)$ using slot-specific ranking functions, so that a flood of Byzantine identifiers cannot permanently crowd out honest ones. Modeling the growth of the number of known honest identifiers $C(t)$ by the mean-field ODE $dC(t)/dt = \alpha(|H|-C(t))/|H|$, the paper obtains $C(t)=|H|-(|H|-C(0))\exp(-\alpha t/|H|)$ and hence the Corollary V.2 bound $B(t)=B/(B+|H|-(|H|-C(0))\exp(-\alpha t/|H|))$, i.e., the expected Byzantine fraction in local views decays exponentially to $f$ even for adversaries with unlimited flooding capability. This bound feeds an adaptive probabilistic threshold: treating each view slot as independently Byzantine with probability at most $B(t)$ and applying a Chernoff upper-tail bound, the node chooses the smallest $\delta>0$ such that $P(X_t \ge (1+\delta)vB(t)) \le \kappa$ and sets the filtering threshold $b(t)=\min((1+\delta)vB(t), v-1)$. The paper claims this gives robust aggregators a bounded per-round adversarial presence with probability at least $1-\kappa$, and that empirically GRANITE with CS or GTS converges to near-optimal F1 under FOE and ALIE attacks with up to 30% Byzantine nodes, whereas a state-of-the-art Byzantine-resilient peer sampling protocol diverges.

Load-bearing premise

The load-bearing premise is that honest identifiers arrive at a constant rate $\alpha$, which assumes that even under worst-case flooding a random push target is still selected approximately uniformly over all $n-1$ nodes; if flooding skews that selection toward Byzantine nodes, the exponential decay of $B(t)$ and the APT thresholds are not guaranteed.

Editorial extensions

If this is right

  • With probability at least $1-\kappa$ per round, the number of Byzantine models in a local view stays below $(1+\delta)vB(t)$, so clipped summation and geometric trimmed summation retain their correctness guarantees in a dynamic graph.
  • The expected Byzantine fraction in any honest node's view converges to the global fraction $f$, removing the need to know the per-view Byzantine count $b$ that static robust gossip theory requires.
  • Robust learning becomes viable on sparse dynamic graphs: for $n=300$ with 30% Byzantine nodes, GRANITE keeps view size $v=20$ where the nominal theory for clipped summation would command more than 180 neighbors, giving up to a 9x reduction in messages.
  • GRANITE maintains honest-subgraph connectivity near 1 at $f=0.3$, where a state-of-the-art Byzantine-resilient sampling protocol loses connectivity for roughly 60% of honest nodes after 40 rounds.
  • The adaptive threshold filters most aggressively in early rounds, when flooding makes Byzantine presence highest, and aggregates more models later, giving faster convergence than fixed conservative thresholds.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Editorial inference: the same $B(t)$-to-Chernoff pipeline should transfer to any robust aggregator with a known breakdown point, not just CS and GTS, making GRANITE a reusable robustness layer for decentralized optimization.
  • Editorial inference: the mean-field ODE assumes expectation-level arrivals; a stochastic-differential-equation version would reveal whether the exponential decay holds in probability and how large the early-round variance is, which is exactly the regime where the worst-case bound is loosest.
  • Editorial inference: feeding back the measured empirical Byzantine fraction in place of the theoretical $B(t)$ could relax the assumption that the total number of Byzantine nodes $B$ is known, at the price of losing the formal high-probability guarantee.
  • Editorial inference: because HaPS keeps every identifier ever seen, the protocol trades memory for robustness; the framework's practical ceiling is therefore set by how much stale honest history a node can store as the system grows.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. The paper proposes GRANITE, a gossip learning framework designed to resist Byzantine nodes that simultaneously poison models and manipulate the underlying random peer sampling protocol. GRANITE consists of HaPS, a history-aware peer sampling protocol that maintains a growing set of encountered identifiers, and APT, an adaptive probabilistic thresholding mechanism that sets the filtering threshold of a robust aggregator from a time-dependent estimate B(t) of the Byzantine fraction in local views. The authors derive an exponential decay formula for B(t) from a mean-field ODE, use this in a Chernoff-based threshold computation, and evaluate the framework on MNIST and Purchase100 under FOE and ALIE poisoning attacks combined with flooding attacks, comparing against BASALT and several robust aggregators. The paper claims convergence within 5% of non-Byzantine accuracy under 30% Byzantine nodes, faster convergence, and up to 9x lower communication cost compared with the connectivity requirements of existing robust gossip theory.

Significance. If the theoretical claims were fully supported, this would be a valuable contribution: it targets a realistic combined threat model that attacks both model aggregation and peer sampling, and it proposes a concrete mechanism for adapting aggregation thresholds in dynamic graphs. The empirical study is a genuine strength: it uses two datasets, two strong poisoning attacks, flooding at several strengths, comparisons with BASALT, multiple robust aggregators, and released code, and the reported convergence behavior appears credible. However, the formal centerpiece is not yet established: the exponential-decay bound in Corollary V.2 relies on arrival rates that are not worst-case lower bounds under flooding, and the APT guarantee in Lemma V.3 rests on independence assumptions that the protocol does not provide. These are load-bearing issues for the advertised formal guarantees, so the paper needs substantial revision rather than minor polishing.

major comments (4)
  1. [Section V.B.2, Eq. (5)] The derivation of alpha_push is not a conservative lower bound under the paper's own flooding model. Algorithm 1 (lines 6-7) has each honest node select a push recipient uniformly from its current view Nout(i)_{t-1}, not uniformly from all n-1 nodes. Under a flooding attack, an honest node's view can be dominated by Byzantine identifiers, so the probability that an honest push message reaches an honest recipient is far smaller than |H|/(n-1). The expression alpha_push = (|H|/(n-1)) * (C(0)/(C(0)+B)) * v therefore overestimates the true rate at which honest identifiers arrive via push messages in the flooded regime. Since Eq. (5) is the basis for Theorem V.1 and Corollary V.2, the claim that B(t) is a conservative upper bound on the Byzantine fraction is not supported by the proof as written.
  2. [Section V.C, Lemma V.3] The Chernoff argument assumes that each of the v view slots is independently Byzantine with probability at most B(t). However, view slots in HaPS are produced by min-wise independent permutations over a shared history, so they are not independent in general, and B(t) is an upper bound on the expected Byzantine fraction rather than a per-slot probability. The lemma therefore does not provide the stated high-probability guarantee for the actual protocol. The authors should either prove a suitable concentration bound under the protocol's sampling mechanism, or explicitly weaken Lemma V.3 to a heuristic statement.
  3. [Section V.C, Practical Consideration] The fallback that caps b(t) at v-1 is explicitly described as not backed by the Chernoff bound. This cap can bind precisely in early rounds, when B(t) is largest and the Byzantine presence in views is highest, so the high-probability correctness claim for robust aggregation does not extend to the regime where the cap is active. The formal claims should be scoped to the regime where the uncapped threshold applies, or the cap needs its own analysis.
  4. [Section VII.B, Table III] The 'communication cost multiplicative gain' compares a theoretical worst-case filtering threshold from the static-graph analysis of Gaucher et al. with GRANITE's empirical threshold b(t)<=19. Since the paper explicitly leaves 'extending theoretical convergence guarantees for GRANITE' to future work, the abstract's claim of operating on graphs 'up to 9x lower communication cost' is an empirical observation rather than a theoretically established property. This should be stated more carefully so as not to imply a proven robustness guarantee at these graph densities.
minor comments (6)
  1. [Section V.B.2] The worst-case scenario assumes every honest node's history already contains all Byzantine identifiers, while the initialization assumption in Section IV.B says the bootstrap set is sampled i.i.d. with initial Byzantine fraction f; please clarify how these two assumptions are reconciled and how C(0) is determined in the theorem.
  2. [Section VII.A] The text says 'for F = 0.1' when discussing Figures 1b and 2b; this should be f = 0.1, since F denotes the flooding force.
  3. [Table I] The table lists the same symbol Nout(i)t for both outgoing and incoming neighbors; the incoming neighbor notation should be distinct, presumably Nin(i)t, and the definition should match the usage in the body.
  4. [Section VII.D and Figure 5] The caption and text refer to B(t) as a 'higher bound' and to 'the higher bound approximation'; this should be 'upper bound' throughout.
  5. [Abstract and Section VII] The abstract's 'within 5% of non-Byzantine accuracy' claim is not directly visible in the figures, which plot F1-Score against an 'optimal' curve; please specify explicitly where this 5% figure is measured and how it is computed.
  6. [Section VI.A] The evaluation section does not state the number of independent runs or seeds used; since standard deviations are reported in the text, please specify the experimental repetitions used to compute them.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: B(t) is an analytical bound derived from an explicit ODE, not a fit to the empirical Byzantine fraction.

full rationale

The central derivation is not circular. B(t) is obtained analytically: assuming a mean-field arrival rate alpha = alpha_pull + alpha_push, the ODE dC/dt = alpha (|H|-C(t))/|H| is solved to give C(t) = |H| - (|H|-C(0)) exp(-alpha/|H| t), and B(t) = B/(B+C(t)) (Theorem V.1, Corollary V.2). alpha is expressed in terms of system parameters (|H|, n, v, B, C(0)); it is not fitted to the measured Byzantine fraction fin. The empirical section compares the a priori curve B(t) with fin and reports a gap (Fig. 5), i.e., B(t) is not calibrated to make the comparison succeed. APT's threshold b(t) = (1+delta) v B(t) is derived from B(t) and a Chernoff bound, with delta solved from kappa; it is a consequence of the analytical model, not a renamed empirical fit. Self-citations ([8], [9], [34]) appear only in related-work context (personalized neighborhoods, privacy, RPS), not as load-bearing support for the exponential-decay claim. The paper's own caveats—the mean-field assumption on alpha, the fallback b(t) = min(b(t), v-1) 'not theoretically backed by the Chernoff bound', and the statement 'Extending theoretical convergence guarantees for GRANITE is left as future work'—are rigor/limitation issues, not instances of deriving a result from its own conclusion. No equation in the paper reduces to its input by construction; hence no circular step.

Assumptions & free parameters 5 free parameters · 6 assumptions · 2 invented entities

The central guarantee rests on a small number of explicit assumptions: a known total Byzantine count B, an initial bootstrap sample with at least one honest identifier, no Sybil IDs, a mean-field ODE for honest identifier discovery, and slot-wise independence for the Chernoff bound. The first three are stated in the paper; the last two are ad hoc approximations that make the formal decay and threshold guarantees stronger than the proof supports.

free parameters (5)
  • B (number of Byzantine nodes) = assumed known, up to 0.3n in experiments
    Used to set APT thresholds via B(t). If the true number is higher, thresholds are too small. Listed as a system parameter in Section IV.B.
  • kappa (failure probability) = 10^-3 (Algorithm 1, line 24)
    Chosen by hand; controls the Chernoff bound and therefore the threshold b(t).
  • v (view size) = 20 (Table II)
    Fixed neighborhood size used in experiments; the theoretical requirements are avoided empirically.
  • C(0) (initial honest identifiers in bootstrap set) = depends on bootstrap size I, which is 30 or 60
    Initial condition for the ODE in Theorem V.1; affects the decay rate and the B(t) curve.
  • alpha (honest identifier arrival rate) = computed from C(0), B, v, |H|, and n
    The decay rate in Theorem V.1 is driven by alpha, which is a mean-field approximation rather than a measured value.
assumptions (6)
  • domain assumption Each node receives an initial set I of random identifiers sampled i.i.d., from which it selects v nodes.
    Section IV.B; needed for the initial honest fraction C(0)/(C(0)+B).
  • domain assumption Byzantine nodes cannot create arbitrary Sybil identifiers.
    Section IV.A explicitly excludes Sybil attacks; the history-based defense would fail against unlimited Sybil IDs.
  • ad hoc to paper The total number of Byzantine nodes B is known a priori as a system parameter.
    Section IV.B; required to compute B(t) and the adaptive threshold.
  • ad hoc to paper The mean-field ODE for the growth of known honest IDs is a valid worst-case lower bound.
    Section V.B.2 and Appendix A.1; the rates alpha_pull and alpha_push are averages, and the ODE is not a high-probability bound.
  • ad hoc to paper View slots are independent Bernoulli variables with Byzantine probability at most B(t) for the Chernoff bound.
    Lemma V.3; sampling without replacement and adversarial collusion are not independent, though negative dependence would be favorable.
  • domain assumption Robust aggregators CS/GTS guarantee correctness when the number of Byzantine nodes per view is below threshold b.
    From Gaucher et al. [23]; GRANITE relies on these prior guarantees.
invented entities (2)
  • HaPS (History-aware Peer Sampling protocol)
    purpose: Accumulates identifiers over time and selects neighbors via min-wise independent permutations to reduce Byzantine influence in local views.
    The only evidence is the paper's own experiments and mean-field analysis; no external benchmark or formal proof is provided.
  • APT (Adaptive Probabilistic Threshold)
    purpose: Maps the estimated Byzantine fraction B(t) to a filtering threshold b(t) using a Chernoff bound.
    This mechanism is validated only within the paper's own experiments; no independent falsifiable handle is offered.

how reviews work

0 comments
Cite this review

Pith. "Pith review of GRANITE : a Byzantine-Resilient Dynamic Gossip Learning Framework." pith.science (2026). https://pith.science/paper/YKCCZUOK

@misc{pith2026250417471,
  author       = {Pith},
  title        = {Pith review of: GRANITE : a Byzantine-Resilient Dynamic Gossip Learning Framework},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/YKCCZUOK}},
  note         = {Machine review of arXiv:2504.17471}
}
read the original abstract

Gossip Learning (GL) is a decentralized learning paradigm where users iteratively exchange and aggregate models with a small set of neighboring peers. Recent approaches rely on dynamic communication graphs built using Random Peer Sampling (RPS) protocols which have been proven to accelerate convergence. However, we show that these approaches are vulnerable to a dual attack: Byzantine nodes can poison models and manipulate peer sampling to amplify their influence. We address this combination of threats with GRANITE, a framework for robust learning over sparse, dynamic graphs in the presence of Byzantine nodes. GRANITE accumulates knowledge about encountered node identifiers over time and dynamically adjusts local aggregation thresholds based on estimated Byzantine density in the neighbourhood of each node. We demonstrate that under GRANITE, the Byzantine presence in local neighborhoods exhibits an exponential decay. We further derive the robustness conditions of the graphs generated by GRANITE. Empirically, our results indicate that GRANITE converges within 5% of non-Byzantine accuracy under 30% Byzantines nodes, offers faster convergence and operates on graphs with up to 9x lower communication cost.

Figures

Figures reproduced from arXiv: 2504.17471 by the authors.

Figure 1
Figure 1. F1-Score comparison between GRANITE and three flavors of BASALT under [PITH_FULL_IMAGE:figures/full_fig_p010_1.png] view at source ↗
Figure 2
Figure 2. F1-Score comparison between GRANITE and three flavors of BASALT under [PITH_FULL_IMAGE:figures/full_fig_p010_2.png] view at source ↗
Figure 3
Figure 3. F1-Score analysis of GRANITE under FOE and ALIE attacks with different robust aggregators on the MNIST dataset. [PITH_FULL_IMAGE:figures/full_fig_p011_3.png] view at source ↗
Figures from the paper (3 more)
Figure 4
Figure 4. Figure 4: F1-Score analysis of GRANITE under FOE and ALIE attacks with different robust aggregators on the Purchase100 [PITH_FULL_IMAGE:figures/full_fig_p011_4.png]
Figure 5
Figure 5. Figure 5: illustrates the evolution of fin over rounds for different attack forces F. We observe that HaPS effectively re￾duces the proportion of Byzantine nodes fin to a neighborhood of f within approximately 20 rounds. Moreover, B(t) follows the expected exponential decay. How…
Figure 7
Figure 7. Figure 7: HSSR measurement in GRANITE and BASALT for [PITH_FULL_IMAGE:figures/full_fig_p012_7.png]

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. Efficient and Robust Online Learning to Rank in Decentralized Systems

    cs.DC 2026-06 conditional novelty 7.0 of 10

    RankGuard is a decentralized OLTR system that filters model updates using local click data for poisoning resistance and supplies the first formal convergence guarantee for decentralized OLTR.

Reference graph

Works this paper leans on

58 extracted references · 36 canonical work pages · cited by 1 Pith paper

  1. [1]

    Gossip learning as a decentral- ized alternative to federated learning,

    I. Heged ˝us, G. Danner, and M. Jelasity, “Gossip learning as a decentral- ized alternative to federated learning,” in 19th IFIP International Con- ference on Distributed Applications and Interoperable Systems (DAIS) . Springer International Publishing, 2019, pp. 74–90

    work page 2019

  2. [2]

    Communication-efficient learning of deep networks from decentralized data,

    B. McMahan, E. Moore, D. Ramage, S. Hampson, and B. A. y Arcas, “Communication-efficient learning of deep networks from decentralized data,” in Artificial intelligence and statistics . PMLR, 2017, pp. 1273– 1282

    2017

  3. [3]

    Decentralized learning works: An empirical comparison of gossip learning and federated learning,

    I. Heged ˝us, G. Danner, and M. Jelasity, “Decentralized learning works: An empirical comparison of gossip learning and federated learning,” Journal of Parallel and Distributed Computing , vol. 148, pp. 109–124, 2021

    2021

  4. [4]

    Muffliato: Peer-to- peer privacy amplification for decentralized optimization and averag- ing,

    E. Cyffers, M. Even, A. Bellet, and L. Massouli ´e, “Muffliato: Peer-to- peer privacy amplification for decentralized optimization and averag- ing,” Advances in Neural Information Processing Systems , vol. 35, pp. 15 889–15 902, 2022

    work page 2022

  5. [5]

    Cyclon: Inexpensive membership management for unstructured p2p overlays,

    S. V oulgaris, D. Gavidia, and M. Van Steen, “Cyclon: Inexpensive membership management for unstructured p2p overlays,” Journal of Network and systems Management , vol. 13, pp. 197–217, 2005

    work page 2005

  6. [6]

    Communication-efficient topologies for decentralized learning with o(1) consensus rate,

    Z. Song, W. Li, K. Jin, L. Shi, M. Yan, W. Yin, and K. Yuan, “Communication-efficient topologies for decentralized learning with o(1) consensus rate,” Advances in Neural Information Processing Sys- tems, vol. 35, pp. 1073–1085, 2022

    work page 2022

  7. [7]

    Exponential graph is provably efficient for decentralized deep training,

    B. Ying, K. Yuan, Y . Chen, H. Hu, P. Pan, and W. Yin, “Exponential graph is provably efficient for decentralized deep training,” Advances in Neural Information Processing Systems , vol. 34, pp. 13 975–13 987, 2021

    work page 2021

  8. [8]

    In- ferring communities of interest in collaborative learning-based recom- mender systems,

    Y . Belal, M. Maouche, S. B. Mokhtar, and A. Simonet-Boulogne, “In- ferring communities of interest in collaborative learning-based recom- mender systems,” in IEEE 45th International Conference on Distributed Computing Systems (ICDCS) , 2025

    work page 2025

Show all 58 references
  1. [9]

    Scrutinizing the vulnerability of decentralized learning to membership inference attacks,

    O. Touat, J. Brunon, Y . Belal, J. Nicolas, M. Maouche, C. Sabater, and S. B. Mokhtar, “Scrutinizing the vulnerability of decentralized learning to membership inference attacks,” arXiv preprint arXiv:2412.12837 , 2024

    2024

  2. [10]

    Fall of empires: Breaking byzantine- tolerant sgd by inner product manipulation,

    C. Xie, O. Koyejo, and I. Gupta, “Fall of empires: Breaking byzantine- tolerant sgd by inner product manipulation,” in Uncertainty in Artificial Intelligence. PMLR, 2020, pp. 261–270

    2020

  3. [11]

    A little is enough: Circumvent- ing defenses for distributed learning,

    G. Baruch, M. Baruch, and Y . Goldberg, “A little is enough: Circumvent- ing defenses for distributed learning,” Advances in Neural Information Processing Systems, vol. 32, 2019

    2019

  4. [12]

    Automatic adversarial adaption for stealthy poisoning attacks in federated learning,

    T. Krauß, J. K ¨onig, A. Dmitrienko, and C. Kanzow, “Automatic adversarial adaption for stealthy poisoning attacks in federated learning,” in 31st Annual Network and Distributed System Security Symposium, NDSS 2024, San Diego, California, USA, February 26 - March 1, 2024 . The...

    2024

  5. [13]

    Crowdguard: Federated backdoor detection in federated learning,

    P. Rieger, T. Krauß, M. Miettinen, A. Dmitrienko, and A. Sadeghi, “Crowdguard: Federated backdoor detection in federated learning,” in 31st Annual Network and Distributed System Security Symposium, NDSS 2024, San Diego, California, USA, February 26 - March 1, 2024 . The Intern...

    2024

  6. [14]

    Fundamentals of robust machine learning,

    R. Guerraoui, N. Gupta, and R. Pinot, “Fundamentals of robust machine learning,” in Robust Machine Learning: Distributed Methods for Safe AI. Springer, 2024, pp. 55–92

    2024

  7. [15]

    Interpretable deep learning under fire,

    X. Zhang, N. Wang, H. Shen, S. Ji, X. Luo, and T. Wang, “Interpretable deep learning under fire,” in Proceedings of the 29th USENIX Confer- ence on Security Symposium , 2020, pp. 1659–1676

    2020

  8. [16]

    Fixing by mixing: A recipe for optimal byzantine ml under heterogeneity,

    Y . Allouah, S. Farhadkhani, R. Guerraoui, N. Gupta, R. Pinot, and J. Stephan, “Fixing by mixing: A recipe for optimal byzantine ml under heterogeneity,” in International Conference on Artificial Intelligence and Statistics. PMLR, 2023, pp. 1232–1300

    2023

  9. [17]

    Byzantine machine learning: A primer,

    R. Guerraoui, N. Gupta, and R. Pinot, “Byzantine machine learning: A primer,” ACM Computing Surveys , 2023

    2023

  10. [18]

    Robust distributed learning: Tight error bounds and breakdown point under data heterogeneity,

    Y . Allouah, R. Guerraoui, N. Gupta, R. Pinot, and G. Rizk, “Robust distributed learning: Tight error bounds and breakdown point under data heterogeneity,” Advances in Neural Information Processing Systems , vol. 36, pp. 45 744–45 776, 2023

    2023

  11. [19]

    Manipulating the byzantine: Opti- mizing model poisoning attacks and defenses for federated learning,

    V . Shejwalkar and A. Houmansadr, “Manipulating the byzantine: Opti- mizing model poisoning attacks and defenses for federated learning,” in NDSS, 2021

    2021

  12. [20]

    Learning from history for byzantine robust optimization,

    S. P. Karimireddy, L. He, and M. Jaggi, “Learning from history for byzantine robust optimization,” in International Conference on Machine Learning. PMLR, 2021, pp. 5311–5319

    2021

  13. [21]

    Fltrust: Byzantine-robust federated learning via trust bootstrapping,

    X. Cao, M. Fang, J. Liu, and N. Z. Gong, “Fltrust: Byzantine-robust federated learning via trust bootstrapping,” in 28th Annual Network and Distributed System Security Symposium, NDSS 2021, virtually, February 21-25, 2021. The Internet Society, 2021. [Online]. Available: https...

    2021

  14. [22]

    Byzantine-resilient stochastic gradient descent for distributed learning: A lipschitz-inspired coordinate- wise median approach,

    H. Yang, X. Zhang, M. Fang, and J. Liu, “Byzantine-resilient stochastic gradient descent for distributed learning: A lipschitz-inspired coordinate- wise median approach,” in 2019 IEEE 58th Conference on Decision and Control (CDC). IEEE, 2019, pp. 5832–5837

    2019

  15. [24]

    Byzantine-resilient decentralized stochas- tic optimization with robust aggregation rules,

    Z. Wu, T. Chen, and Q. Ling, “Byzantine-resilient decentralized stochas- tic optimization with robust aggregation rules,” IEEE Transactions on Signal Processing, 2023

    2023

  16. [25]

    Byzantine-robust decentralized learning via clippedgossip,

    L. He, S. P. Karimireddy, and M. Jaggi, “Byzantine-robust decentralized learning via clippedgossip,” arXiv preprint arXiv:2202.01545 , 2022

    2022 arXiv

  17. [26]

    Byzantine-resilient distributed hypothesis testing with time-varying network topology,

    B. Wu, S. Carr, S. Bharadwaj, Z. Xu, and U. Topcu, “Byzantine-resilient distributed hypothesis testing with time-varying network topology,” IEEE Transactions on Automatic Control, vol. 67, no. 7, pp. 3243–3258, 2021

    2021

  18. [27]

    Byzantine-robust decentralized stochastic optimization over static and time-varying networks,

    J. Peng, W. Li, and Q. Ling, “Byzantine-robust decentralized stochastic optimization over static and time-varying networks,” Signal Processing, vol. 183, p. 108020, 2021

    2021

  19. [28]

    Secure peer sampling,

    G. P. Jesi, A. Montresor, and M. van Steen, “Secure peer sampling,” Computer Networks, vol. 54, no. 12, pp. 2086–2098, 2010

    2010

  20. [29]

    Eclipse attacks on bitcoin’s peer-to-peer network,

    E. Heilman, A. Kendler, A. Zohar, and S. Goldberg, “Eclipse attacks on bitcoin’s peer-to-peer network,” in 24th USENIX security symposium (USENIX security 15) , 2015, pp. 129–144

    2015

  21. [30]

    Eclipse attacks on overlay networks: Threats and defenses,

    A. Singh, T.-W. Ngan, P. Druschel, D. S. Wallach et al., “Eclipse attacks on overlay networks: Threats and defenses,” 2006

    2006

  22. [31]

    Basalt: A rock-solid byzantine-tolerant peer sampling for very large decentral- ized networks,

    A. Auvolat, Y .-D. Bromberg, D. Frey, D. Mvondo, and F. Ta¨ıani, “Basalt: A rock-solid byzantine-tolerant peer sampling for very large decentral- ized networks,” in Proceedings of the 24th International Middleware Conference, 2023, pp. 111–123

    2023

  23. [32]

    Brahms: Byzantine resilient random membership sampling,

    E. Bortnikov, M. Gurevich, I. Keidar, G. Kliot, and A. Shraer, “Brahms: Byzantine resilient random membership sampling,” inProceedings of the twenty-seventh ACM symposium on Principles of distributed computing , 2008, pp. 145–154

    2008

  24. [33]

    A measure of asymptotic efficiency for tests of a hypoth- esis based on the sum of observations,

    H. Chernoff, “A measure of asymptotic efficiency for tests of a hypoth- esis based on the sum of observations,” The Annals of Mathematical Statistics, pp. 493–507, 1952

    1952

  25. [34]

    Pepper: Empowering user-centric recommender systems over gossip learning,

    Y . Belal, A. Bellet, S. B. Mokhtar, and V . Nitu, “Pepper: Empowering user-centric recommender systems over gossip learning,” Proceedings of the ACM on Interactive, Mobile, Wearable and Ubiquitous Technologies, vol. 6, no. 3, pp. 1–27, 2022

    2022

  26. [35]

    Robust aggregation for federated learning,

    K. Pillutla, S. M. Kakade, and Z. Harchaoui, “Robust aggregation for federated learning,” IEEE Transactions on Signal Processing , vol. 70, pp. 1142–1154, 2022

    2022

  27. [36]

    Byzantine-robust dis- tributed learning: Towards optimal statistical rates,

    D. Yin, Y . Chen, R. Kannan, and P. Bartlett, “Byzantine-robust dis- tributed learning: Towards optimal statistical rates,” in International Conference on Machine Learning . Pmlr, 2018, pp. 5650–5659

    2018

  28. [37]

    Bridge: Byzantine-resilient decen- tralized gradient descent,

    C. Fang, Z. Yang, and W. U. Bajwa, “Bridge: Byzantine-resilient decen- tralized gradient descent,” IEEE Transactions on Signal and Information Processing over Networks , vol. 8, pp. 610–626, 2022

    2022

  29. [38]

    Byzantine-tolerant machine learning,

    P. Blanchard, E. M. E. Mhamdi, R. Guerraoui, and J. Stainer, “Byzantine-tolerant machine learning,” arXiv preprint arXiv:1703.02757, 2017

    2017 arXiv

  30. [39]

    Byrdie: Byzantine-resilient distributed coordinate descent for decentralized learning,

    Z. Yang and W. U. Bajwa, “Byrdie: Byzantine-resilient distributed coordinate descent for decentralized learning,” IEEE Transactions on Signal and Information Processing over Networks , vol. 5, no. 4, pp. 611–627, 2019

    2019

  31. [40]

    Byzantine-robust decentralized federated learning,

    M. Fang, Z. Zhang, Hairi, P. Khanduri, J. Liu, S. Lu, Y . Liu, and N. Gong, “Byzantine-robust decentralized federated learning,” in Pro- ceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security, 2024, pp. 2874–2888

    2024

  32. [41]

    Zenops: A distributed learning system integrating communication efficiency and security,

    C. Xie, O. Koyejo, and I. Gupta, “Zenops: A distributed learning system integrating communication efficiency and security,” Algorithms, vol. 15, no. 7, p. 233, 2022

    2022

  33. [42]

    Unraveling the connections between privacy and certified robustness in federated learning against poisoning attacks,

    C. Xie, Y . Long, P.-Y . Chen, Q. Li, S. Koyejo, and B. Li, “Unraveling the connections between privacy and certified robustness in federated learning against poisoning attacks,” in Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security , 2023, p...

    2023

  34. [43]

    Min- wise independent permutations,

    A. Z. Broder, M. Charikar, A. M. Frieze, and M. Mitzenmacher, “Min- wise independent permutations,” in Proceedings of the thirtieth annual ACM symposium on Theory of computing , 1998, pp. 327–336

    1998

  35. [44]

    Efficient P2P ensemble learning with linear models on fully distributed data,

    R. Orm ´andi, I. Heged ¨us, and M. Jelasity, “Efficient P2P ensemble learning with linear models on fully distributed data,” CoRR, vol. abs/1109.1396, 2011. [Online]. Available: http://arxiv.org/abs/1109.1396

    2011 arXiv

  36. [45]

    Fast linear iterations for distributed averaging,

    L. Xiao and S. Boyd, “Fast linear iterations for distributed averaging,” Systems & Control Letters , vol. 53, no. 1, pp. 65–78, 2004

    2004

  37. [46]

    On the uniformity of peer sampling based on view shuffling,

    Y . Busnel, R. Beraldi, and R. Baldoni, “On the uniformity of peer sampling based on view shuffling,” Journal of Parallel and Distributed Computing, vol. 71, no. 8, pp. 1165–1176, 2011

    2011

  38. [47]

    The peer sampling service: Experimental evaluation of unstructured gossip- based implementations,

    M. Jelasity, R. Guerraoui, A.-M. Kermarrec, and M. Van Steen, “The peer sampling service: Experimental evaluation of unstructured gossip- based implementations,” in Middleware 2004: ACM/IFIP/USENIX In- ternational Middleware Conference, Toronto, Canada, October 18-22,

    2004

  39. [48]

    Correctness of a gossip based membership protocol,

    A. Allavena, A. Demers, and J. E. Hopcroft, “Correctness of a gossip based membership protocol,” in Proceedings of the twenty-fourth annual ACM symposium on Principles of distributed computing, 2005, pp. 292– 301

    2005

  40. [49]

    Approximate byzantine fault- tolerance in distributed optimization,

    S. Liu, N. Gupta, and N. H. Vaidya, “Approximate byzantine fault- tolerance in distributed optimization,” in Proceedings of the 2021 ACM Symposium on Principles of Distributed Computing , 2021, pp. 379–389

    2021

  41. [50]

    Unified breakdown analysis for byzantine robust gossip,

    R. Gaucher, A. Dieuleveut, and H. Hendrikx, “Unified breakdown analysis for byzantine robust gossip,” 2025. [Online]. Available: https://arxiv.org/abs/2410.10418

    2025 arXiv

  42. [51]

    Mitzenmacher and E

    M. Mitzenmacher and E. Upfal, Probability and computing: Random- ization and probabilistic techniques in algorithms and data analysis . Cambridge university press, 2017

    2017

  43. [52]

    Pytorch,

    S. Imambi, K. B. Prakash, and G. Kanagachidambaresan, “Pytorch,” Programming with TensorFlow: solution for edge computing applica- tions, pp. 87–104, 2021

    2021

  44. [53]

    The mnist database of handwritten digits,

    Y . LeCun, “The mnist database of handwritten digits,” http://yann. lecun. com/exdb/mnist/, 1998

    1998

  45. [54]

    Membership inference attacks against machine learning models,

    R. Shokri, M. Stronati, C. Song, and V . Shmatikov, “Membership inference attacks against machine learning models,” in 2017 IEEE symposium on security and privacy (SP) . IEEE, 2017, pp. 3–18

    2017

  46. [55]

    Comprehensive privacy analysis of deep learning: Passive and active white-box inference attacks against centralized and federated learning,

    M. Nasr, R. Shokri, and A. Houmansadr, “Comprehensive privacy analysis of deep learning: Passive and active white-box inference attacks against centralized and federated learning,” in 2019 IEEE symposium on security and privacy (SP) . IEEE, 2019, pp. 739–753

    2019

  47. [56]

    Federated learning on non-iid data silos: An experimental study,

    Q. Li, Y . Diao, Q. Chen, and B. He, “Federated learning on non-iid data silos: An experimental study,” in 2022 IEEE 38th international conference on data engineering (ICDE) . IEEE, 2022, pp. 965–978

    2022

  48. [57]

    A unified theory of decentralized sgd with changing topology and local updates,

    A. Koloskova, N. Loizou, S. Boreiri, M. Jaggi, and S. Stich, “A unified theory of decentralized sgd with changing topology and local updates,” in International conference on machine learning . PMLR, 2020, pp. 5381–5393

    2020

  49. [58]

    Gossip-based peer sampling,

    M. Jelasity, S. V oulgaris, R. Guerraoui, A.-M. Kermarrec, and M. Van Steen, “Gossip-based peer sampling,” ACM Transactions on Computer Systems (TOCS) , vol. 25, no. 3, pp. 8–es, 2007. APPENDIX A.1. Differential Equation Setup At time t, suppose a node’s local history contains...

    2007

  50. [2004]

    Springer, 2004, pp

    Proceedings 5 . Springer, 2004, pp. 79–98

    2004

Pith tools

Reviewed August 16, 2026 · model on record in the stance chip above.