mlsanityData to 14 Oct 2026

An Experimental Study of Byzantine-Robust Aggregation Schemes in Federated Learning

arXiv 2302.07173 ↗First posted 14 Feb 2023cs.LGcited by 32

Not on the map. Why?

Abstract (arXiv)

Byzantine-robust federated learning aims at mitigating Byzantine failures during the federated training process, where malicious participants may upload arbitrary local updates to the central server to degrade the performance of the global model. In recent years, several robust aggregation schemes have been proposed to defend against malicious updates from Byzantine clients and improve the robustness of federated learning. These solutions were claimed to be Byzantine-robust, under certain assumptions. Other than that, new attack strategies are emerging, striving to circumvent the defense schemes. However, there is a lack of systematic comparison and empirical study thereof. In this paper, we conduct an experimental study of Byzantine-robust aggregation schemes under different attacks using two popular algorithms in federated learning, FedSGD and FedAvg . We first survey existing Byzantine attack strategies and Byzantine-robust aggregation schemes that aim to defend against Byzantine attacks. We also propose a new scheme, ClippedClustering , to enhance the robustness of a clustering-based scheme by automatically clipping the updates. Then we provide an experimental evaluation of eight aggregation schemes in the scenario of five different Byzantine attacks. Our results show that these aggregation schemes sustain relatively high accuracy in some cases but are ineffective in others. In particular, our proposed ClippedClustering successfully defends against most attacks under independent and IID local datasets. However, when the local datasets are Non-IID, the performance of all the aggregation schemes significantly decreases. With Non-IID data, some of these aggregation schemes fail even in the complete absence of Byzantine clients. We conclude that the robustness of all the aggregation schemes is limited, highlighting the need for new defense strategies, in particular for Non-IID datasets.

Key facts. Cited by 32 papers in the map (data through 14 Oct 2026). Builds on 40 of its 60 references that are in the map. First posted on arXiv 14 Feb 2023.

Builds on

40 of 60 references.

References · 40

  1. 2016Communication-Efficient Learning of Deep Networks from Decentralized Datacited by 7,669
  2. 2019Federated Learning: Challenges, Methods, and Future Directionscited by 1,538
  3. 2016Federated Learning: Strategies for Improving Communication Efficiencycited by 1,475
  4. 2019On the Convergence of FedAvg on Non-IID Datacited by 1,229
  5. 2018How To Backdoor Federated Learningcited by 765
  6. 2020Inverting Gradients -- How easy is it to break privacy in federated learning?cited by 712
  7. 2018Byzantine-Robust Distributed Learning: Towards Optimal Statistical Ratescited by 711
  8. 2020Ensemble Distillation for Robust Model Fusion in Federated Learningcited by 682
  9. 2020Ditto: Fair and Robust Federated Learning Through Personalizationcited by 672
  10. 2019Local Model Poisoning Attacks to Byzantine-Robust Federated Learningcited by 493
  11. 2020Adaptive Personalized Federated Learningcited by 358
  12. 2020FLTrust: Byzantine-robust Federated Learning via Trust Bootstrappingcited by 346
28 more
  1. 2018The Hidden Vulnerability of Distributed Learning in Byzantiumcited by 329
  2. 2019Robust Aggregation for Federated Learningcited by 317
  3. 2019A Little Is Enough: Circumventing Defenses For Distributed Learningcited by 288
  4. 2021Escaping the Big Data Paradigm with Compact Transformerscited by 264
  5. 2019Differentially Private Learning with Adaptive Clippingcited by 220
  6. 2021Evaluating Gradient Inversion Attacks and Defenses in Federated Learningcited by 196
  7. 2018RSA: Byzantine-Robust Stochastic Aggregation Methods for Distributed Learning from Heterogeneous Datasetscited by 149
  8. 2019Fall of Empires: Breaking Byzantine-tolerant SGD by Inner Product Manipulationcited by 141
  9. 2020Learning from History for Byzantine Robust Optimizationcited by 137
  10. 2021Back to the Drawing Board: A Critical Evaluation of Poisoning Attacks on Production Federated Learningcited by 118
  11. 2019Federated Variance-Reduced Stochastic Gradient Descent with Robustness to Byzantine Attackscited by 79
  12. 2018DRACO: Byzantine-resilient Distributed Training via Redundant Gradientscited by 75
  13. 2022MPAF: Model Poisoning Attacks to Federated Learning based on Fake Clientscited by 68
  14. 2021Provably Secure Federated Learning against Malicious Clientscited by 63
  15. 2015Communication Complexity of Distributed Convex Learning and Optimizationcited by 60
  16. 2020Free-rider Attacks on Model Aggregation in Federated Learningcited by 57
  17. 2020BaFFLe: Backdoor detection via Feedback-based Federated Learningcited by 53
  18. 2019Free-riders in Federated Learning: Attacks and Defensescited by 49
  19. 2021Challenges and Approaches for Mitigating Byzantine Attacks in Federated Learningcited by 47
  20. 2019DETOX: A Redundancy-based Framework for Faster and More Robust Gradient Aggregationcited by 44
  21. 2016Geometric Median in Nearly Linear Timecited by 39
  22. 2019Robust Federated Learning with Noisy Communicationcited by 34
  23. 2020A Study of Gradient Variance in Deep Learningcited by 28
  24. 2019Robust Learning from Untrusted Sourcescited by 27
  25. 2019Election Coding for Distributed Learning: Protecting SignSGD against Byzantine Attackscited by 20
  26. 2020AutoClip: Adaptive Gradient Clipping for Source Separation Networkscited by 12
  27. 2021Auto-weighted Robust Federated Learning with Corrupted Data Sourcescited by 12
  28. 2021Byzantine-robust Federated Learning through Spatial-temporal Analysis of Local Model Updatescited by 8

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2023: 3; 2024: 14; 2025: 11; 2026: 4.

32 papers.

Sort:

By area:

  1. 2023FedGT: Identification of Malicious Clients in Federated Learning with Secure Aggregationcited by 16
  2. 2024Synergizing Foundation Models and Federated Learning: A Surveycited by 14
  3. 2023Communication Compression for Byzantine Robust Learning: New Efficient Algorithms and Improved Ratescited by 12
  4. 2024Byzantine-Robust Aggregation for Securing Decentralized Federated Learningcited by 7
  5. 2024PEFT-as-an-Attack! Jailbreaking Language Models during Federated Parameter-Efficient Fine-Tuningcited by 5
  6. 2024Federated Graph Learning for EV Charging Demand Forecasting with Personalization Against Cyberattackscited by 4
  7. 2025Cellular Traffic Prediction via Byzantine-robust Asynchronous Federated Learningcited by 4
  8. 2024Foundation Models in Federated Learning: Assessing Backdoor Vulnerabilitiescited by 3
  9. 2024Securing Federated Learning against Backdoor Threats with Foundation Model Integrationcited by 3
  10. 2025FedGreed: A Byzantine-Robust Loss-Based Aggregation Method for Federated Learningcited by 3
  11. 2024Dealing Doubt: Unveiling Threat Models in Gradient Inversion Attacks under Federated Learning, A Survey and Taxonomycited by 2
  12. 2025Robust Federated Learning under Adversarial Attacks via Loss-Based Client Clusteringcited by 2
20 more
  1. 2025On the Security and Privacy of Federated Learning: A Survey with Attacks, Defenses, Frameworks, Applications, and Future Directionscited by 2
  2. 2023Adversarial Robustness Unhardening via Backdoor Attacks in Federated Learningcited by 1
  3. 2024Enhancing Security and Privacy in Federated Learning using Low-Dimensional Update Representation and Proximity-Based Defensecited by 1
  4. 2024FedCAP: Robust Federated Learning via Customized Aggregation and Personalizationcited by 1
  5. 2025Integrating Identity-Based Identification against Adaptive Adversaries in Federated Learningcited by 1
  6. 2025Fluid Democracy in Federated Data Aggregationcited by 1
  7. 2024Fed-Credit: Robust Federated Learning with Credibility Managementcited by 0
  8. 2024Impact of Network Topology on Byzantine Resilience in Decentralized Federated Learningcited by 0
  9. 2024BF-Meta: Secure Blockchain-enhanced Privacy-preserving Federated Learning for Metaversecited by 0
  10. 2024FedSECA: Sign Election and Coordinate-wise Aggregation of Gradients for Byzantine Tolerant Federated Learningcited by 0
  11. 2024Act in Collusion: Distributed Multi-Target Backdoor Attacks in Federated Learningcited by 0
  12. 2025Byzantine-Robust Federated Learning Using Generative Adversarial Networkscited by 0
  13. 2025Byzantine Outside, Curious Inside: Reconstructing Data Through Malicious Updatescited by 0
  14. 2025FedStrategist: A Meta-Learning Framework for Adaptive and Robust Aggregation in Federated Learningcited by 0
  15. 2025ProDiGy: Proximity- and Dissimilarity-Based Byzantine-Robust Federated Learningcited by 0
  16. 2025Trade-off in Estimating the Number of Byzantine Clients in Federated Learningcited by 0
  17. 2026XFED: Non-Collusive Model Poisoning Attack Against Byzantine-Robust Federated Classifierscited by 0
  18. 2026FedIDM: Achieving Fast and Stable Convergence in Byzantine Federated Learning through Iterative Distribution Matchingcited by 0
  19. 2026Privacy-Preserving and Verifiable Approximate Distributed Coded Computingcited by 0
  20. 2026Privacy, Robustness, and Fairness Trade-offs in Federated Intrusion Detection: Geometric Indistinguishability at the Aggregation Interfacecited by 0