# An Experimental Study of Byzantine-Robust Aggregation Schemes in Federated Learning

arXiv: https://arxiv.org/abs/2302.07173 · HTML: https://mlsanity.com/paper/2302.07173/

## Key facts

- Cited by 32 papers in the map (data through 14 Oct 2026).
- Builds on 40 of its 60 references that are in the map.
- First posted on arXiv 14 Feb 2023.

## Builds on (most cited first, 30 of 40)

- [Communication-Efficient Learning of Deep Networks from Decentralized Data](https://mlsanity.com/paper/1602.05629/) (2016)
- [Federated Learning: Challenges, Methods, and Future Directions](https://mlsanity.com/paper/1908.07873/) (2019)
- [Federated Learning: Strategies for Improving Communication Efficiency](https://mlsanity.com/paper/1610.05492/) (2016)
- [On the Convergence of FedAvg on Non-IID Data](https://mlsanity.com/paper/1907.02189/) (2019)
- [How To Backdoor Federated Learning](https://mlsanity.com/paper/1807.00459/) (2018)
- [Inverting Gradients -- How easy is it to break privacy in federated learning?](https://mlsanity.com/paper/2003.14053/) (2020)
- [Byzantine-Robust Distributed Learning: Towards Optimal Statistical Rates](https://mlsanity.com/paper/1803.01498/) (2018)
- [Ensemble Distillation for Robust Model Fusion in Federated Learning](https://mlsanity.com/paper/2006.07242/) (2020)
- [Ditto: Fair and Robust Federated Learning Through Personalization](https://mlsanity.com/paper/2012.04221/) (2020)
- [Local Model Poisoning Attacks to Byzantine-Robust Federated Learning](https://mlsanity.com/paper/1911.11815/) (2019)
- [Adaptive Personalized Federated Learning](https://mlsanity.com/paper/2003.13461/) (2020)
- [FLTrust: Byzantine-robust Federated Learning via Trust Bootstrapping](https://mlsanity.com/paper/2012.13995/) (2020)
- [The Hidden Vulnerability of Distributed Learning in Byzantium](https://mlsanity.com/paper/1802.07927/) (2018)
- [Robust Aggregation for Federated Learning](https://mlsanity.com/paper/1912.13445/) (2019)
- [A Little Is Enough: Circumventing Defenses For Distributed Learning](https://mlsanity.com/paper/1902.06156/) (2019)
- [Escaping the Big Data Paradigm with Compact Transformers](https://mlsanity.com/paper/2104.05704/) (2021)
- [Differentially Private Learning with Adaptive Clipping](https://mlsanity.com/paper/1905.03871/) (2019)
- [Evaluating Gradient Inversion Attacks and Defenses in Federated Learning](https://mlsanity.com/paper/2112.00059/) (2021)
- [RSA: Byzantine-Robust Stochastic Aggregation Methods for Distributed Learning from Heterogeneous Datasets](https://mlsanity.com/paper/1811.03761/) (2018)
- [Fall of Empires: Breaking Byzantine-tolerant SGD by Inner Product Manipulation](https://mlsanity.com/paper/1903.03936/) (2019)
- [Learning from History for Byzantine Robust Optimization](https://mlsanity.com/paper/2012.10333/) (2020)
- [Back to the Drawing Board: A Critical Evaluation of Poisoning Attacks on Production Federated Learning](https://mlsanity.com/paper/2108.10241/) (2021)
- [Federated Variance-Reduced Stochastic Gradient Descent with Robustness to Byzantine Attacks](https://mlsanity.com/paper/1912.12716/) (2019)
- [DRACO: Byzantine-resilient Distributed Training via Redundant Gradients](https://mlsanity.com/paper/1803.09877/) (2018)
- [MPAF: Model Poisoning Attacks to Federated Learning based on Fake Clients](https://mlsanity.com/paper/2203.08669/) (2022)
- [Provably Secure Federated Learning against Malicious Clients](https://mlsanity.com/paper/2102.01854/) (2021)
- [Communication Complexity of Distributed Convex Learning and Optimization](https://mlsanity.com/paper/1506.01900/) (2015)
- [Free-rider Attacks on Model Aggregation in Federated Learning](https://mlsanity.com/paper/2006.11901/) (2020)
- [BaFFLe: Backdoor detection via Feedback-based Federated Learning](https://mlsanity.com/paper/2011.02167/) (2020)
- [Free-riders in Federated Learning: Attacks and Defenses](https://mlsanity.com/paper/1911.12560/) (2019)

## Built on by (most cited first, 30 of 32)

- [FedGT: Identification of Malicious Clients in Federated Learning with Secure Aggregation](https://mlsanity.com/paper/2305.05506/) (2023)
- [Synergizing Foundation Models and Federated Learning: A Survey](https://mlsanity.com/paper/2406.12844/) (2024)
- [Communication Compression for Byzantine Robust Learning: New Efficient Algorithms and Improved Rates](https://mlsanity.com/paper/2310.09804/) (2023)
- [Byzantine-Robust Aggregation for Securing Decentralized Federated Learning](https://mlsanity.com/paper/2409.17754/) (2024)
- [PEFT-as-an-Attack! Jailbreaking Language Models during Federated Parameter-Efficient Fine-Tuning](https://mlsanity.com/paper/2411.19335/) (2024)
- [Federated Graph Learning for EV Charging Demand Forecasting with Personalization Against Cyberattacks](https://mlsanity.com/paper/2405.00742/) (2024)
- [Cellular Traffic Prediction via Byzantine-robust Asynchronous Federated Learning](https://mlsanity.com/paper/2505.19263/) (2025)
- [Foundation Models in Federated Learning: Assessing Backdoor Vulnerabilities](https://mlsanity.com/paper/2401.10375/) (2024)
- [Securing Federated Learning against Backdoor Threats with Foundation Model Integration](https://mlsanity.com/paper/2410.17573/) (2024)
- [FedGreed: A Byzantine-Robust Loss-Based Aggregation Method for Federated Learning](https://mlsanity.com/paper/2508.18060/) (2025)
- [Dealing Doubt: Unveiling Threat Models in Gradient Inversion Attacks under Federated Learning, A Survey and Taxonomy](https://mlsanity.com/paper/2405.10376/) (2024)
- [Robust Federated Learning under Adversarial Attacks via Loss-Based Client Clustering](https://mlsanity.com/paper/2508.12672/) (2025)
- [On the Security and Privacy of Federated Learning: A Survey with Attacks, Defenses, Frameworks, Applications, and Future Directions](https://mlsanity.com/paper/2508.13730/) (2025)
- [Adversarial Robustness Unhardening via Backdoor Attacks in Federated Learning](https://mlsanity.com/paper/2310.11594/) (2023)
- [Enhancing Security and Privacy in Federated Learning using Low-Dimensional Update Representation and Proximity-Based Defense](https://mlsanity.com/paper/2405.18802/) (2024)
- [FedCAP: Robust Federated Learning via Customized Aggregation and Personalization](https://mlsanity.com/paper/2410.13083/) (2024)
- [Integrating Identity-Based Identification against Adaptive Adversaries in Federated Learning](https://mlsanity.com/paper/2504.03077/) (2025)
- [Fluid Democracy in Federated Data Aggregation](https://mlsanity.com/paper/2507.02710/) (2025)
- [Fed-Credit: Robust Federated Learning with Credibility Management](https://mlsanity.com/paper/2405.11758/) (2024)
- [Impact of Network Topology on Byzantine Resilience in Decentralized Federated Learning](https://mlsanity.com/paper/2407.05141/) (2024)
- [BF-Meta: Secure Blockchain-enhanced Privacy-preserving Federated Learning for Metaverse](https://mlsanity.com/paper/2410.21675/) (2024)
- [FedSECA: Sign Election and Coordinate-wise Aggregation of Gradients for Byzantine Tolerant Federated Learning](https://mlsanity.com/paper/2411.03861/) (2024)
- [Act in Collusion: Distributed Multi-Target Backdoor Attacks in Federated Learning](https://mlsanity.com/paper/2411.03926/) (2024)
- [Byzantine-Robust Federated Learning Using Generative Adversarial Networks](https://mlsanity.com/paper/2503.20884/) (2025)
- [Byzantine Outside, Curious Inside: Reconstructing Data Through Malicious Updates](https://mlsanity.com/paper/2506.11413/) (2025)
- [FedStrategist: A Meta-Learning Framework for Adaptive and Robust Aggregation in Federated Learning](https://mlsanity.com/paper/2507.14322/) (2025)
- [ProDiGy: Proximity- and Dissimilarity-Based Byzantine-Robust Federated Learning](https://mlsanity.com/paper/2509.09534/) (2025)
- [Trade-off in Estimating the Number of Byzantine Clients in Federated Learning](https://mlsanity.com/paper/2510.04432/) (2025)
- [XFED: Non-Collusive Model Poisoning Attack Against Byzantine-Robust Federated Classifiers](https://mlsanity.com/paper/2604.09489/) (2026)
- [FedIDM: Achieving Fast and Stable Convergence in Byzantine Federated Learning through Iterative Distribution Matching](https://mlsanity.com/paper/2604.15115/) (2026)

## Abstract (arXiv)

Byzantine-robust federated learning aims at mitigating Byzantine failures during the federated training process, where malicious participants may upload arbitrary local updates to the central server to degrade the performance of the global model. In recent years, several robust aggregation schemes have been proposed to defend against malicious updates from Byzantine clients and improve the robustness of federated learning. These solutions were claimed to be Byzantine-robust, under certain assumptions. Other than that, new attack strategies are emerging, striving to circumvent the defense schemes. However, there is a lack of systematic comparison and empirical study thereof. In this paper, we conduct an experimental study of Byzantine-robust aggregation schemes under different attacks using two popular algorithms in federated learning, FedSGD and FedAvg . We first survey existing Byzantine attack strategies and Byzantine-robust aggregation schemes that aim to defend against Byzantine attacks. We also propose a new scheme, ClippedClustering , to enhance the robustness of a clustering-based scheme by automatically clipping the updates. Then we provide an experimental evaluation of eight aggregation schemes in the scenario of five different Byzantine attacks. Our results show that these aggregation schemes sustain relatively high accuracy in some cases but are ineffective in others. In particular, our proposed ClippedClustering successfully defends against most attacks under independent and IID local datasets. However, when the local datasets are Non-IID, the performance of all the aggregation schemes significantly decreases. With Non-IID data, some of these aggregation schemes fail even in the complete absence of Byzantine clients. We conclude that the robustness of all the aggregation schemes is limited, highlighting the need for new defense strategies, in particular for Non-IID datasets.