ML Security PapersByzantine-Robust Federated Learning with Learnable Aggregation Weights
Javad Parsa 1, Amir Hossein Daghestani 2, André M. H. Teixeira 1, Mikael Johansson 2
Published on arXiv
2511.03529
Data Poisoning Attack
OWASP ML Top 10 — ML02
Key Finding
Proposed adaptive-weight aggregation consistently outperforms state-of-the-art Byzantine-robust FL methods, especially under high data heterogeneity and large fractions of malicious clients
Federated Learning (FL) enables clients to collaboratively train a global model without sharing their private data. However, the presence of malicious (Byzantine) clients poses significant challenges to the robustness of FL, particularly when data distributions across clients are heterogeneous. In this paper, we propose a novel Byzantine-robust FL optimization problem that incorporates adaptive weighting into the aggregation process. Unlike conventional approaches, our formulation treats aggregation weights as learnable parameters, jointly optimizing them alongside the global model parameters. To solve this optimization problem, we develop an alternating minimization algorithm with strong convergence guarantees under adversarial attack. We analyze the Byzantine resilience of the proposed objective. We evaluate the performance of our algorithm against state-of-the-art Byzantine-robust FL approaches across various datasets and attack scenarios. Experimental results demonstrate that our method consistently outperforms existing approaches, particularly in settings with highly heterogeneous data and a large proportion of malicious clients.
Key Contributions
- Novel Byzantine-robust FL optimization problem that treats aggregation weights as learnable parameters jointly optimized alongside global model parameters
- Alternating minimization algorithm with convergence guarantees under adversarial Byzantine attacks
- Empirical demonstration that adaptive weighting outperforms uniform-weight robust aggregators (Krum, Median, Trimmedmean, Bulyan) under heterogeneous data and high proportions of malicious clients
🛡️ Threat Analysis
Byzantine clients send malicious model updates to degrade the global model's performance — this is the FL Byzantine poisoning threat. The paper proposes a robust aggregation defense (learnable adaptive weights) evaluated against various Byzantine attack scenarios. The goal of the attackers is general model degradation (not a targeted backdoor), placing this squarely in ML02.