PaperlayerView exact revision on arXiv

Source-linked AI summary

Model-Consistent Byzantine-Resilient Decentralized Federated Learning for Collaborative Missions

Yue Li, Sudip Bhujel, Cameron Lira, Ning Wang, Yang Xiao

arXiv:2608.22552v1cs.DCcs.CRcs.LG

TL;DR

Existing decentralized federated learning lacks global model consistency and is vulnerable to Byzantine equivocation and model poisoning in asynchronous networks. DFL-C integrates asynchronous common subset consensus with dual-domain trust scoring to coordinate robust aggregation. It maintains model accuracy and consistency with moderate consensus overhead, outperforming BALANCE against untargeted poisoning and widening its advantage under non-IID data.

  • Problem

    Existing decentralized federated learning does not guarantee global model consistency and is vulnerable to Byzantine equivocation and model poisoning in asynchronous networks.

  • Method

    DFL-C integrates asynchronous common subset consensus with dual-domain trust scoring to establish uniform aggregation and mitigate Byzantine behaviors.

  • Results

    DFL-C maintains model accuracy while achieving global model consistency under Byzantine behaviors with moderate consensus overhead, and outperforms BALANCE against untargeted poisoning.

  • Takeaways & Limitations

    DFL-C’s accuracy advantage over BALANCE widens when local data becomes more non-IID.

Abstract

from arXiv · show

Decentralized federated learning (DFL) is a promising paradigm for autonomous nodes to collaboratively train AI models without relying on a central server. However, existing DFL solutions do not guarantee global model consistency, a critical requirement for collaborative mission-critical scenarios where model divergence undermines decision uniformity and safety. This lack of consistency also amplifies vulnerability to Byzantine adversaries, who exploit the decentralized network topology and weak synchrony to perform equivocation and model poisoning attacks against individual victims. This paper introduces DFL-C, a novel Byzantine-resilient DFL architecture that enables decentralized nodes to perform collaborative training with global model consistency. At its core, DFL-C integrates an asynchronous common subset (ACS) consensus protocol into the DFL workflow to ensure all nodes aggregate a uniform set of model updates to establish global model consistency, despite individual Byzantine equivocation. DFL-C further implements a dual-domain trust scoring mechanism to provide resilience against data-domain Byzantine manipulations including model poisoning attacks. This mechanism complements the consensus protocol, significantly reducing the latter's runtime. Our experimental results demonstrate that DFL-C maintains model accuracy while achieving global model consistency under Byzantine behaviors with moderate consensus overhead. Notably, when compared with the state-of-the-art DFL solution BALANCE (Fang et al.) that does not provide model consistency, DFL-C achieves better model accuracy against untargeted model poisoning attacks and comparable resilience against backdoor attacks, with the advantage widened under non-IID scenarios.

I. INTRODUCTION

Existing peer-to-peer DFL can diverge across nodes, weakening decision integrity and increasing exposure to Byzantine attacks and asynchrony. DFL-C addresses these challenges with consensus, dual-domain trust scoring, and efficiency mechanisms while retaining accuracy.

  • Peer-to-peer DFL may forfeit global model consistency, allowing local models to diverge and undermining mission-wide decision integrity and safety.
  • Localized aggregation increases vulnerability to Byzantine equivocation and model poisoning because adversaries can target individual neighbors.
  • Existing peer-to-peer DFL commonly assumes synchronous updates, despite communication delays and heterogeneous training speeds causing systematic asynchrony.
  • DFL-C integrates common subset consensus so nodes aggregate a common set of model updates and enforce global model consistency.
  • DFL-C uses dual-domain trust scoring to assess consensus behavior and model-update quality, mitigating equivocation and model poisoning.
  • Evaluation across 4–13-node LeNet and ResNet networks shows global consistency, equivocation resistance, moderate consensus runtime, and higher accuracy than BALANCE under untargeted poisoning.The accuracy advantage widens with more non-IID local data.

II. BACKGROUND AND RELATED WORK

Background work shows that decentralized neighbor aggregation can produce inconsistent models and uneven Byzantine exposure. Existing asynchronous or Byzantine-resilient methods address parts of the problem but do not jointly provide the required guarantees.

  • In established DFL, nodes train locally and aggregate neighbor updates, so resulting models may differ across the network.
  • Model heterogeneity creates utility and safety risks in mission-critical settings, while semi-decentralized consistency approaches rely on rotating aggregators or blockchains.
  • AEDFL assumes bounded update delays, whereas SWIFT and DRACO tolerate full asynchrony but do not enforce model consistency.
  • Classic federated-learning Byzantine defenses have limited efficacy in DFL because nodes aggregate from limited neighborhoods rather than the global population.
  • CLIPPEDCOSSIP provides consistency but not model-poisoning protection or equivocation handling, while BALANCE addresses known poisoning attacks without consistent models or equivocation.

III. SYSTEM MODEL

The system model considers authenticated, fully asynchronous communication among nodes collaboratively training supervised models from local data. It requires consistency, accuracy, Byzantine resilience, asynchrony tolerance, and practical communication overhead.

  • Nodes communicate over authenticated asynchronous channels in a network where messages may be arbitrarily delayed but eventually arrive.
  • Each node locally accumulates labeled data and participates in round-based training from the previous round’s common initial model.
  • The system requires all honest nodes to obtain the same model at the end of each round.
  • The converged model should achieve inference accuracy comparable to centralized federated learning.
  • The objectives must remain guaranteed under Byzantine equivocation or model manipulation and must not degrade under communication or update asynchrony.
  • The threat model allows up to F Byzantine nodes among N nodes, with 3F + 1 ≤ N; privacy attacks are outside scope.

IV. DFL-C SYSTEM DESIGN

DFL-C combines common subset consensus with dual-domain trust scoring to produce a consistent, robust aggregation set in an asynchronous network. Trust scores also prioritize later consensus sessions, while ACS supplies the Byzantine-consensus foundation.

  • DFL-C uses consensus to obtain a common subset of at least N −F model updates for local aggregation, supporting consistency and Byzantine resilience.
  • Each round trains locally, proposes updates through T-ACS, and finalizes a common subset of N −F or more updates.
  • After consensus, D2TS scores nodes across consensus behavior and model quality before weighted aggregation produces the next model.
  • D2TS trust scores inform the priority list for the next round’s T-ACS consensus.
  • ACS enables nodes to agree on a common subset under full asynchrony and up to F < 1/3N Byzantine nodes.
  • ACS combines reliable broadcast, which disseminates consistent proposals, with binary agreement, which finalizes valid proposals.

B. T-ACS: Trust-informed ACS Consensus

T-ACS accelerates ACS consensus by using preceding-round trust scores to prioritize higher-trust updates without excluding lower-trust nodes. Its protocol organizes RBC and BA processing around this soft priority signal.

  • Trust-informed prioritization: T-ACS uses preceding-round trust scores to prioritize higher-scored model updates during ACS consensus.Nodes sort RBC tasks by proposers’ trust scores and process them according to the resulting priority list.
  • Trust-informed prioritization: Higher-trust RBC instances receive earlier forwarding, echoing, and readiness processing, while low-trust nodes remain eligible for delivery.Trust changes timing rather than excluding low-trust proposers outright.
  • Protocol operation: Equivocation can be detected when RBC messages cannot be verified as the same original message, using signatures or coded-fragment non-reconstructability.These signals support detection in the READY phase and in baseline ACS’s erasure-coded RBC.
  • Protocol operation: T-ACS applies trust-informed ordering to both RBC processing and BA message handling.The pseudocode sorts message buffers by the local priority order before processing RBC or BA messages.

C. D2TS: Dual-Domain Trust Scoring

D2TS scores node reliability across consensus behavior and model-update quality. It combines spatial consistency, temporal stability, and historical penalties to guide weighted aggregation while retaining explicit scope limitations.

  • Dual-domain design: D2TS evaluates reliability in consensus and data domains, penalizing equivocation or non-responsiveness alongside low-quality model updates.Consensus-domain signals include common-subset inclusion and equivocation; data-domain signals assess update quality.
  • Data-domain scores: Spatial consistency measures an update’s closeness to its K = N −F −2 closest peer models, helping identify anomalous updates.The score is based on average squared Euclidean distance to the nearest peer models.
  • Data-domain scores: Temporal stability evaluates average update variation over W previous rounds, but abrupt legitimate distribution shifts may temporarily lower the score.The metric is most suitable when honest update trajectories evolve sufficiently smoothly over the observation window.
  • Trust aggregation: The instant trust score combines spatial consistency and temporal stability, with α controlling their relative emphasis; evaluation uses α = 0.5.Systematic sensitivity analysis under different data dynamics remains future work.
  • Trust aggregation: Historical equivocation triggers strict exclusion from aggregation, whereas late or missing updates receive gradual trust decay and can recover in later rounds.This distinction combines a permanent equivocation penalty with smoothing for temporary delays.
  • Scope and limitations: The evaluation heuristically sets κ = 0.2, while systematic parameter sensitivity and formal trust-score stability under adaptive attacks remain unexamined.Each round’s instant score receives 20% weight and historical trust retains 80%.

D. Adaptive Waiting for Practical Efficiency amid Asynchrony

DFL-C uses an adaptive waiting policy to coordinate the next consensus round under predictable asynchrony. Nodes propose training-time-based delays, and consensus selects a common trigger that reduces cumulative consensus time without extra communication or reduced safety.

  • Adaptive waiting policy: Nodes estimate next-round delays from compute load and training time, embed proposals in RBC messages, and process them through T-ACS.The proposals allow consensus to coordinate waiting across heterogeneous training speeds.
  • Adaptive waiting policy: All honest nodes agree on a common start delay Dt by selecting the r-th smallest proposed delay.Each node schedules the next round from its local consensus end time plus Dt.
  • Efficiency outcome: The adaptive policy reduces cumulative consensus time without additional communication costs or compromised consensus safety.Fast nodes can use the freed processor time for other operations or energy saving.

V. ANALYSES

DFL-C guarantees a common global model among honest nodes despite asynchrony and equivocation, while maintaining an honest majority in aggregation under N ≥ 3F + 1. Its T-ACS consensus adds communication overhead, and scalability remains primarily demonstrated for networks up to 13 nodes.

  • Global model consistency: DFL-C guarantees all honest nodes obtain the same global model at the end of each round despite network asynchrony and equivocation.T-ACS gives honest nodes the same common subset of updates for local aggregation.
  • Byzantine tolerance: Under N ≥ 3F + 1, the common subset contains at least N − F updates and maintains an honest majority during aggregation.The Byzantine proportion is bounded below one-half.
  • Byzantine tolerance: The honest-majority threshold is also a precondition commonly used by Byzantine-robust aggregation methods for classic FL.
  • Consensus efficiency: T-ACS introduces O(N^2) messages per node in theory, although optimized ACS primitives can achieve O(1) expected clock time.Communication cost still grows rapidly with N, and consensus latency increases with model payload size.
  • Consensus efficiency: The prototype establishes practicality mainly for relatively small collaborative networks up to N = 13, while larger-scale scalability remains future work.

VI. IMPLEMENTATION AND EVALUATION

The evaluation uses a proof-of-concept DFL-C implementation and compares its accuracy and consensus latency across heterogeneous network platforms and Byzantine attack settings.

  • Implementation: The authors implemented a proof-of-concept DFL-C system in roughly 1200 lines of Python code.They also implemented D-FedAvg without D2TS and BALANCE for benchmark comparison.
  • Experimental setup: Experiments ran on a local GPU cluster and Raspberry Pi 4 nodes, with one independent DFL-C instance executing the full training pipeline per node.
  • Evaluation goals: The study evaluated model accuracy under varying Byzantine influence and the consensus-latency overhead attributed to T-ACS.
  • Attack settings: Byzantine behaviors included equivocation, label-flipping untargeted poisoning, and Badnets backdoor poisoning.Badnets injects trigger patterns into selected samples and assigns them a fixed incorrect label.

A. Data-plane Performance and Comparison

Across fMNIST and CIFAR-10 evaluations, DFL-C preserves global consistency while remaining competitive against Byzantine attacks, with stronger advantages over BALANCE under non-IID data.

  • Attack resilience: Under equivocation, DFL-C converges near the centralized benchmark while preserving a common model across honest nodes.This behavior appears on both fMNIST/LeNet-5 and the longer CIFAR-10/ResNet-50 evaluation.
  • Attack resilience: Under label-flipping, DFL-C maintains competitive accuracy against BALANCE and clearly outperforms D-FedAvg while preserving global consistency.
  • Attack resilience: Both DFL-C and BALANCE suppress backdoor attack success rates to near zero, whereas D-FedAvg shows substantially higher early ASR.The same pattern holds in the CIFAR-10 incremental-data setting.
  • Design interpretation: DFL-C couples robust aggregation with common-subset consensus so honest nodes use the same agreed update set while filtering equivocation.
  • Non-IID performance: IID data yields the highest DFL-C accuracy, stronger non-IID conditions reduce accuracy, and increasing nodes from 7 to 10 generally improves non-IID performance.The results cover LeNet-5 on fMNIST and CIFAR-10 with and without label-flipping Byzantine nodes.
  • Non-IID performance: With Byzantine nodes under increasing non-IID degree, DFL-C achieves significantly better accuracy than BALANCE.BALANCE exhibits accuracy spread because nodes aggregate from different effective neighbor distributions.

B. Consensus Latency Overhead

DFL-C adds consensus overhead through T-ACS, but its latency remains lower than baseline ACS across model payloads and network sizes. Adaptive waiting further reduces idle time as training-time heterogeneity increases, while future work targets larger networks and heavier payloads.

  • DFL-C’s primary measured runtime overhead relative to existing DFL schemes is its T-ACS consensus mechanism.
  • T-ACS consistently achieves lower consensus latency than baseline ACS across LeNet-5-, ResNet-18-, and ResNet-50-scale payloads and node counts N = 4, 7, 10, and 13.The latency reduction becomes more pronounced as N grows.
  • Consensus latency increases with both model payload size and node count, ranging from tens of milliseconds for LeNet-5-scale payloads to seconds or tens of seconds for heavier models.
  • The adaptive waiting policy saves per-node idle time, with savings increasing as training-time heterogeneity rises from 10% to 50%.Training times are sampled from U(T, T · (1 + ∆)).
  • Future work includes more efficient consensus for larger networks and heavier model payloads, plus systematic D2TS parameter sensitivity analysis under adaptive attacks.
Loading 2608.22552v1…