PaperlayerView exact revision on arXiv

Source-linked AI summary

FUSE: Fairness-aware Update Screening against Byzantine Exploitation in $q$-Fair Federated Learning

Tiantong Sun, Jinlin Liu, Xingru Wei, Zequan Fang, Wei Chen, Qiang Yang, Xiaojin Zhang

arXiv:2610.20264v1cs.LGcs.AI

TL;DR

Byzantine robustness for q-fair federated learning under an update-only interface is poorly understood, in part because legitimate fairness amplification can resemble malicious scaling. The paper models the geometry of honest updates under shared class-conditional label skew and proposes FUSE, which combines scale and cone-consistency screening. Across four benchmarks, FUSE improves seed-wise worst-attack accuracy over the strongest baseline on each by 3.9–30.1 percentage points.

  • Problem

    Robustness under the update-only interface is poorly understood, and magnitude screening cannot distinguish legitimate fairness-induced amplification from adversarial scaling.

    Source: §1 · p. 2

  • Method

    FUSE uses a small trusted labeled set to recover update coefficients, screens their mass and cone residual, and applies post-screening step-size control.

    Source: §1.1 · p. 2, §4 · p. 4

  • Results

    3.9–30.1 percentage points: FUSE improves seed-wise worst-attack accuracy over the strongest baseline on each of four benchmarks.

    Source: §1.1 · p. 2, §5.2 · p. 6

  • Takeaways & Limitations

    FUSE preserves the influence of high-loss honest clients, but can resist only deviations separated by its observable statistics.

    Source: §8 · p. 10

    Submissions inside the trusted cone with plausible recovered mass cannot be certified as malicious; an adaptive attack reaches 65.6% on CIFAR-10 versus 82.4% under clean training.

    Source: §6.4 · p. 9

Abstract

from arXiv · show

Client-level fair federated learning, in the form of $q$-fair federated learning ($q$-FFL), agnostic federated learning, or tilted empirical risk minimization, has emerged as an attractive solution to equalize utility across heterogeneous clients. This paradigm grants high-loss clients greater relative influence, while a central server aggregates their loss-weighted updates into a single shared model. Yet, the Byzantine robustness of $q$-fair federated learning has been largely neglected, leaving the server unable to tell legitimate fairness-induced amplification from malicious update scaling. To address this critical gap, we formalize the problem of Byzantine-robust $q$-fair federated learning under an \emph{update-only interface}, in which the server observes nothing but the fairness-scaled client updates. Our analysis under shared class-conditional label skew shows that fairness scaling preserves the nonnegative class-mixture structure of honest updates, while replacing their unit-sum constraint by a client-dependent radial scale. Moving beyond magnitude-based screening, we show that this warped geometry supplies two complementary tests, one radial and one structural, that a single norm cannot provide. We then introduce FUSE, a structure-aware robust aggregator that uses a small trusted labeled dataset for coefficient recovery, scale and cone-consistency screening, and post-screening step-size control. Across four benchmarks and seven Byzantine attacks, FUSE improves seed-wise worst-attack accuracy over the strongest baseline on each benchmark by 3.9--30.1 percentage points, while largely preserving the influence of the high-loss honest clients that fairness is meant to protect.

1 INTRODUCTION

Fairness-scaled updates make Byzantine screening difficult because legitimate high-loss amplification can resemble malicious scaling. The paper formalizes this update-only setting and introduces FUSE, which uses both scale and structure to screen submissions.

1 INTRODUCTION

  • Client-level fairness methods such as q-FFL, agnostic federated learning, and tilted empirical risk minimization seek to improve utility for disadvantaged clients.Implementations may incorporate loss-dependent weights locally, transform the client objective, or directly transmit a fairness-aware gradient.Source: §1 · p. 1
  • Under the update-only interface, the server sees a composite fairness-scaled update, while legitimate amplification of high-loss clients makes magnitude-only screening ambiguous.The interface avoids a separate loss report, which the passage notes can incur additional privacy cost.Source: §1 · pp. 1–2, Figure 1 · p. 2

1.1 MAIN CONTRIBUTIONS

  • Fairness scaling preserves nonnegative class-mixture structure but removes the unit-sum constraint, replacing the simplex with a radially varying cone.A magnitude test alone cannot distinguish legitimate radial growth from adversarial scaling.Source: §1.1 · p. 2
  • FUSE recovers latent coefficients from a small trusted labeled set, screens coefficient mass and cone residual in sequence, then rescales the retained mean using reconstructed client loss.The mass tests radial scale, while the residual tests structural incompatibility with the trusted cone.Source: §1.1 · p. 2
  • FUSE improves seed-wise worst-attack accuracy over the strongest baseline on each benchmark by 3.9–30.1 percentage points, while rejecting 0–9.7% of high-loss honest submissions.Evaluation covers four benchmarks, seven Byzantine attacks, and five registered seeds.Source: §1.1 · p. 2

2 PROBLEM OF ROBUST q-FAIR FEDERATED LEARNING

The section formulates robust q-fair federated learning as aggregation when clients may submit corrupted updates. The server sees only the fairness-weighted messages, not their loss and descent factors separately.

2 PROBLEM OF ROBUST q-FAIR FEDERATED LEARNING

  • The q-fair objective seeks one shared model while assigning greater relative influence to high-loss clients.The objective is defined for q ≥ 0.Source: §2 · p. 3
  • An honest client weights its one-step descent update by its loss raised to q and transmits only the resulting message.The server therefore observes the product, not the loss and update factors separately.Source: §2 · p. 3
  • At each round, up to f_t < |S_t|/2 submissions may be arbitrary coordinated Byzantine vectors, and the server receives a declared rejection budget.Screening uses restricted submission coordinates and a trusted reference, without side information identifying Byzantine clients.Source: §2 · p. 3

3 FROM SIMPLEX TO CONE

Under shared class-conditional label skew, q-fair weighting preserves honest updates as nonnegative class mixtures but changes their geometry from a simplex to a cone. The resulting radial variation makes magnitude alone ambiguous.

3.1 FAIRNESS SCALING BREAKS THE SIMPLEX

  • The update-only message does not identify fairness scale and descent magnitude separately, so magnitude alone cannot distinguish legitimate amplification from adversarial scaling.The ambiguity holds for F_i > 0 and q > 0.Source: §3.1 · p. 3
  • The guarantee assumes shared class-conditional distributions among honest clients; arbitrary violations of that assumption are not covered.Covariate shifts are evaluated empirically in Appendix E.13.Source: §3.1 · p. 3
  • Fairness scaling preserves nonnegative class-mixture coefficients but changes their mass from one to F_i^q, yielding a radially varying nonnegative cone.This replaces the unit-sum simplex used by prior structure-aware aggregation.Source: §3 · p. 3, §3.1 · p. 4

4 FUSE ROBUST AGGREGATOR

FUSE uses trusted class-conditioned references to recover coefficients for each submission, then screens radial scale and cone consistency. It reconstructs client loss from normalized coefficients to control the post-screening step size.

4 FUSE ROBUST AGGREGATOR

  • FUSE constructs class-conditioned reference directions and trusted class losses from a small labeled set, then recovers each submission’s coefficients by nonnegative least squares.This decomposition represents submissions against trusted directions.Source: §4 · p. 4, Figure 2 · p. 4
  • Recovered coefficient mass tests radial scale, while the cone residual tests structural incompatibility; FUSE rejects scale anomalies first and uses the remaining budget on the largest residuals.The figure describes the mass as L_i and the normalized residual as D_cone_i.Source: Figure 2 · p. 4, §4 · p. 5
  • Normalized coefficients estimate client class composition and loss, allowing FUSE to rescale the retained mean without changing its direction in the ideal model.The denominator only rescales the retained mean; it does not change its direction.Source: §4 · p. 5

5 EXPERIMENTS

The experiments evaluate FUSE against seven attacks and baselines on four benchmarks, using seed-wise worst-attack accuracy as the primary robustness measure. FUSE improves that measure over the strongest baseline on every benchmark while retaining most high-loss honest submissions.

5.1 EXPERIMENTAL SETUP

  • The evaluation uses CIFAR-10, MNIST, EMNIST-Balanced, and AGNews, with seven attacks, seven baselines, and five registered seeds.Each round samples 10 of 100 honest clients; FUSE uses 20 trusted labeled examples per class.Source: §5.1 · p. 5
  • The seed-wise worst-attack statistic takes each seed’s minimum accuracy across seven attacks, then averages those minima.Reported accuracy averages the final ten rounds; runs meeting the registered collapse criterion are not replaced by pre-collapse maxima.Source: §5.1 · p. 5

5.2 ROBUSTNESS UNDER BYZANTINE ATTACKS

  • 30.1, 3.9, 17.1, and 13.4 percentage points: FUSE improves seed-wise worst-attack global accuracy over the best baseline on CIFAR-10, MNIST, EMNIST-Balanced, and AGNews, respectively.FUSE also has the highest seed-wise worst-attack global and W10 accuracy on all four benchmarks.Source: §5.2 · p. 6, Table 1 · p. 6

5.3 PRESERVING HIGH-LOSS HONEST CLIENTS

  • On MNIST at q = 1, radial and structural attacks occupy different regions of the (Li, Dcone_i) plane, motivating sequential screening with two tests.Figure 3(a) shows fairness scaling moves the simplex residual off the diagonal while leaving the cone residual nearly unchanged.Source: Figure 3 · p. 7
  • FUSE rejects 0.0–9.7% of high-loss honest submissions while removing 85.7–99.8% of Byzantine submissions.H-nobs rejects 22.2–35.7% of the highest-loss honest submissions, up to 91.7% under its worst attack; BOBA removes 14.3–36.8% of Byzantine submissions and none under Sign Flip and ALIE.Source: §5.3 · pp. 6–7, Table 2 · p. 7

6 WHY DOES CONE GEOMETRY MATTER?

The section tests whether fairness scaling changes the geometry underlying FUSE and whether that geometry accounts for its screening behavior. It finds complementary roles for the radial and cone screens, with sensitivity to operating parameters and a stated boundary for adaptive attacks.

6.1 FAIRNESS SCALING BREAKS THE SIMPLEX IN PRACTICE

  • At q = 0, median cone/simplex residuals are 0.178/0.185; after q = 1 scaling, they are 0.178/1.077, while recovered coefficient mass tracks fairness scale with Pearson r = 0.940.Normalized coefficients reconstruct client losses with r = 0.923 and MAE 0.053.Source: §6.1 · p. 8

6.2 MATCHED TRAINING CONSEQUENCE OF THE SIMPLEX MISMATCH

  • Under IPM, Min-Max, and Min-Sum, replacing the cone score with a simplex score lowers Byzantine recall from 0.69/1.00/1.00 to 0.45/0.56/0.62 and raises honest FPR from 0.124/0.001/0.000 to 0.219/0.175/0.153.Sign Flip is a counterexample: the simplex score detects 0.92 against 0.58 for the cone score.Source: §6.2 · p. 8

6.3 WHICH COMPONENTS MATTER?

  • Removing the scale screen changes Magnitude Scaling’s worst-attack accuracy from 77.50 to 52.38, while removing the cone screen changes ALIE from 78.50 to 55.16, Min-Max from 79.28 to 36.71, and Min-Sum from 78.71 to 38.94.Removing both screens also breaks Gaussian (26.11); removing loss normalization lowers the floor from 77.50 to 70.06.Source: §6.3 · p. 8

6.4 SENSITIVITY TO q, κ, AND THE BYZANTINE BUDGET

  • Across tested q values, worst-attack global/W10 accuracy varies from 91.57/86.21 to 90.47/84.85; larger κ improves honest FPR and retained fair mass without materially changing accuracy.With declared f = 4 while true Byzantine submissions fall from 4 to 0, robustness is stable but worst retained fair mass drops from 84% to 61%. An adaptive attack reaches 65.6% on CIFAR-10 versus 82.4% under clean training.Source: Figure 4 · p. 8, §6.4 · p. 9

7 THEORETICAL ANALYSIS

The analysis asks when fairness-warped geometry can be recovered from finite-sample submissions and when two-stage screening exactly identifies honest clients. Its guarantees depend on trusted-basis conditioning, honest variation, and separation of Byzantine submissions from the honest geometry.

7.1 RECOVERABILITY OF THE FAIRNESS-WARPED GEOMETRY

  • Stable recovery of fairness scale depends on finite-sample representation error and trusted-basis conditioning, and holds when honest submissions stay close to the trusted cone.The analysis also gives stable composition and trusted-loss recovery.Source: §7.1 · p. 9

7.2 ROBUSTNESS OF TWO-STAGE SCREENING

  • If the trusted basis has full column rank, honest submissions are a strict majority, and every Byzantine submission meets a radial or structural separation condition, two-stage screening recovers the honest set exactly.The resulting post-screening aggregate matches the one obtained with oracle knowledge of honest identities.Source: §7.2 · p. 9
  • Stage I detects excessive radial scaling, while Stage II detects off-span energy or negative mixture mass beyond honest finite-sample variation.Screening depends on honest radial spread and cone variation as well as Byzantine deviation.Source: §7.2 · p. 9
  • When neither separation condition holds, the theorem provides no certificate of maliciousness; shared class-conditionals are also required for the stated geometry guarantees.The adaptive cone-preserving attack probes the observable boundary, and arbitrary violations of shared class-conditionals are not covered.Source: §7.2 · p. 9

8 CONCLUSION

The conclusion presents FUSE as a structure-aware aggregator built on the fairness-warped geometry of q-fair updates. Experiments show improved worst-attack accuracy while preserving high-loss honest clients, subject to the limits of what the observable statistics can separate.

8 CONCLUSION

  • Fairness scaling changes honest class mixtures from a unit-sum simplex to a nonnegative cone with client-dependent radial mass.The formulation is under an update-only interface.Source: §8 · p. 10
  • FUSE screens recovered coefficient mass and cone residual in sequence, then rescales the retained mean using reconstructed loss.The method uses a small trusted labeled dataset for coefficient recovery.Source: §8 · p. 10
  • The paper states that FUSE can resist only deviations separated by its observable statistics.The adaptive attack delimits this interface boundary.Source: §8 · p. 10
  • Reproducibility details include registered seeds, data partitions, hyperparameters, attacks, and the reporting protocol.Component, boundary, and geometry diagnostics are in Appendix E.Source: REPRODUCIBILITY STATEMENT · p. 10

AI USE STATEMENT

The paper situates FUSE against fairness-aware and Byzantine-robust aggregation work, then specifies its benchmark setup, attack model, implementation, and comparison baselines.

AI USE STATEMENT

  • The authors say generative AI assisted execution, debugging, and language polishing, and that they developed the research and verified assisted content and results.Source: AI USE STATEMENT · p. 10

A RELATED WORK

  • Prior fairness-aware Byzantine defenses use norm filters or distance-based weights, which do not model the F_i^q Δ_i amplification of high-loss honest clients.FUSE instead studies that ambiguity and uses class-mixture structure preserved by fairness scaling.Source: A RELATED WORK · p. 13

B.1 DATASETS, MODELS, AND OPTIMIZATION

  • The benchmark samples 10 of 100 honest clients per round under Dirichlet label skew with α = 1.0 and class-availability probability 0.7.Each honest client reserves 2% of local data for validation; runs use one local epoch, whole-client batches, SGD without momentum, and q = 1 unless stated otherwise.Source: §B.1 · p. 13

B.2 ATTACK DEFINITIONS AND ADVERSARIAL INFORMATION

  • The seven-attack suite includes Sign Flip, IPM, Gaussian, ALIE, Min-Max, Min-Sum, and Magnitude Scaling, with four Byzantine Sybils in attacked rounds.The adversary knows the learning rule, model, defense, and hyperparameters, but not trusted examples or trusted class losses; trusted server records are assumed clean.Source: §B.2 · p. 14

B.3 FUSE IMPLEMENTATION

  • FUSE screens fairness-scaled updates using 20 trusted examples per class, a scale threshold κ = 2.5, and a declared Byzantine budget matching attacked-round Sybils.Coefficient recovery uses a constrained solve in a retained at-most-C-dimensional Gram space, while inner-product formation still depends on the selected parameter dimension.Source: §B.3 · p. 14

B.4 BASELINES AND INFORMATION COMPATIBILITY

  • The baselines apply their methods to fairness-scaled submissions when applicable, while FLTrust additionally constructs a clean server root gradient.H-nobs removes the declared number of largest-ℓ2 fair gradients; DnC runs that collapse before reporting are excluded from main endpoint tables.Source: §B.4 · p. 14

B.5 BOBA IMPLEMENTATION AND FULL-SPACE FIDELITY CHECK

This block documents BOBA’s coordinate-space implementation and fidelity check, reporting conventions, and the scope of the three-component ablation.

B.5 BOBA IMPLEMENTATION AND FULL-SPACE FIDELITY CHECK

  • 30–47 GPU-hours per 1500-round ResNet-18 run motivated using classifier-coordinate BOBA for the matched five-seed benchmark rather than its full-parameter implementation.The classifier-coordinate fit uses 5,130 ResNet-18 coordinates; accepted clients’ remaining parameters are averaged.Source: §B.5 · p. 14
  • The full-parameter BOBA comparison is a seed-42 sensitivity check, not a statistical comparison; classifier-coordinate BOBA is not uniformly weaker, and both variants fail severely under IPM.The paper bases its comparison on the five-seed BOBA rows, while the full-space reproduction is available for one seed only.Source: §B.5 · p. 15, Table 6 · p. 15

B.6 METRICS AND REPORTING

  • Main-table metrics average final-ten-round seed means, while worst-attack accuracy takes each seed’s minimum across seven attacks before averaging completed seeds.Collapsed runs are not replaced by pre-collapse maxima, and endpoint counts indicate how many seeds completed.Source: §B.6 · p. 15

B.7 THREE-COMPONENT ABLATION PROTOCOL

  • The ablation tests all 2^3 combinations of scale screening, cone screening, and loss-normalized aggregation across four dataset/model pairs under matched partitions and attack realizations.The main text presents CIFAR-10 as a representative mechanism study; missing terminal windows remain missing when a registered collapse occurs.Source: §B.7 · p. 16

C.1 FULL FIVE-SEED ENDPOINT RESULTS

FUSE’s paired worst-attack global-accuracy gains over FLTrust are positive across the reported benchmarks, while the appendix supplies endpoint tables and worst-10% accuracy trajectories.

C.1 FULL FIVE-SEED ENDPOINT RESULTS

  • 30.07, 3.90, and 17.09 percentage points: FUSE’s seed-wise global worst-attack accuracy gains over FLTrust on CIFAR-10, MNIST, and EMNIST, respectively.The paired differences are positive on all five seeds and bootstrap 95% intervals exclude zero; AGNews has a four-seed floor of 77.84, 13.03 points above FLTrust.Source: §C.1 · p. 17, Table 12 · p. 19

C.2 TRAINING DYNAMICS

  • Figures 5–8 track worst-10% client accuracy over 1500 rounds for CIFAR-10 and 1000, 1000, and 2000 rounds for MNIST, EMNIST-Balanced, and AGNews, respectively.The trajectories include clean training and seven attacks; a cross marks a run ending before the registered horizon.Source: §C.2 · p. 17, Figure 5 · p. 18, Figure 6 · p. 19

C.1 FULL FIVE-SEED ENDPOINT RESULTS

  • Table 11 reports worst-10% client accuracy across datasets and attacks, with its worst-attack column defined as the per-seed minimum across seven attacks.Figures 5–8 show seed-42 worst-10% client-accuracy trajectories for each dataset/model pair, all seven attacks, and clean training.Source: §C.1 · p. 16, §C.2 · p. 17, Table 11 · p. 18

D EXPERIMENTAL VALIDATION OF THE GEOMETRIC ANALYSIS

MNIST diagnostics support the proposed geometry: recovered coefficient mass tracks fairness scale, while radial and structural deviations appear in different attacks. A controlled study explains why a fixed simplex is mismatched to fairness-scaled updates.

D EXPERIMENTAL VALIDATION OF THE GEOMETRIC ANALYSIS

  • Recovered coefficient mass correlates with fairness scale at r = 0.940, and trusted loss estimates correlate at r = 0.923 with MAE 0.053 over 76,457 retained honest submissions.Gaussian and Magnitude Scaling primarily yield large mass; ALIE, Min-Max, and Min-Sum primarily yield large cone residual, while Sign Flip and IPM overlap more with honest updates.Source: D EXPERIMENTAL VALIDATION OF THE… · p. 21
  • In the controlled simplex–cone study, the cone is invariant to legitimate radial fairness transformation, whereas a fixed unit-sum simplex is not.Source: D EXPERIMENTAL VALIDATION OF THE… · p. 21

E ABLATIONS AND DIAGNOSTIC EVIDENCE

  • The appendix groups diagnostics, fairness audits, sensitivity controls, trusted-geometry tests, computational cost, and robustness boundaries; diagnostic statistics generally use seed 42.These diagnostics are not presented as cross-seed uncertainty estimates.Source: E ABLATIONS AND DIAGNOSTIC EVIDENCE · p. 21

E.1 THREE-COMPONENT FACTORIAL ABLATION

The section evaluates FUSE’s component screens and operating choices, including screening behavior, fairness-scale recovery, local-step sensitivity, high-loss-client retention, and operational trade-offs. It also examines budget misspecification, covariate shift, adaptive attacks, and guarantees under explicit assumptions, with results showing robustness depends on what the screening representation can observe and fairness-related influence can be affected by the screening budget.

E.1 THREE-COMPONENT FACTORIAL ABLATION

  • 77.50%/68.37% versus 52.38%/40.25% on CIFAR-10 shows scale screening can prevent radial worst cases, while cone screening prevents structural failures across all four datasets.Adding scale screening never lowers paired worst-attack results, though gains outside CIFAR-10 are small and single-seed. Removing cone screening eliminates the IPM terminal window on CIFAR-10, MNIST, EMNIST-Balanced, and AGNews; loss normalization helps on CIFAR-10 and EMNIST, is neutral on MNIST, and trades off on AGNews.Source: §E.1 · pp. 21–22, Table 13 · p. 22, Table 16 · p. 23

E.2 STAGE-WISE SCREENING BEHAVIOR

  • Gaussian and Magnitude Scaling primarily consume scale-screening budget, whereas ALIE, Min-Max, and Min-Sum primarily consume cone-screening budget.Sign Flip and IPM are harder: Byzantine recall is about 59%, and the selector also rejects about 16% of honest observations.Source: §E.2 · p. 23

E.3 FROM SIMPLEX TO CONE: CONTROLLED FAIRNESS-WARP TESTS

  • The matched q = 1 test shows cone screening better handles invalid-mixture attacks, while simplex screening better detects Sign Flip, so the evidence does not establish universal cone superiority.For Min-Max and Min-Sum, cone recall is 1.00 with 0.00 honest FPR; for Sign Flip, simplex recall is 0.92 versus 0.58 for cone. The matched comparison changes only the Stage II score.Source: Table 19 · p. 24, Table 20 · p. 25, §E.3 · p. 26

E.4 LOSS-SCALE RECOVERY ACROSS FAIRNESS STRENGTHS

  • At q = 3, loss-scale recovery reaches Spearman ρ = 0.848 and MALE 0.070, while q = 0.1 is a failure regime because recovery error is amplified by 1/q.The fitted slope is within 0.02 of one for q ≥ 1; the diagnostic uses matched checkpoints and honest clients without Byzantine submissions.Source: §E.4 · p. 26, Figure 12 · p. 27

E.5 LOCAL-STEP SENSITIVITY

  • With E = 2 or 5 local steps, honest cone residuals rise to 0.246 and 0.358 from 0.139 at E = 1, while IPM remains the binding attack and its gap to clean widens.The scale identity remains correlated (0.981 at E = 2 and 0.976 at E = 5); the results support small-local-step use, with more local progress allowing greater drift from trusted class directions.Source: §E.5 · pp. 26–27, Table 22 · p. 27

E.7 HIGH-LOSS-CLIENT AUDIT

  • The high-loss-client audit finds that early-training retention is higher than full-horizon retention, while the ordering between methods is unchanged.FUSE retains 99.77/98.48/100.00/90.06% of highest-loss clients over the first 300 rounds on CIFAR-10/MNIST/EMNIST-Balanced/AGNews, versus 95.23/94.27/99.65/91.40% over the full horizon; the AGNews tail is least preserved.Source: §E.7 · p. 28, Table 25 · p. 28

E.8 AGGREGATION CONTROLS

  • Using a q + 1 denominator causes clean EMNIST training to collapse at chance level by round 123 through excessive step attenuation; the final exponent q completes training normally.At round 0, the q + 1 denominator is 148.74 versus 38.57 for exponent q, reducing aggregate-update norm from 3.47 × 10^-3 to 8.99 × 10^-4.Source: §E.8 · p. 29, Table 27 · p. 29

E.9 ATTACK STRENGTH AND BUDGET; E.11 COMPUTATION AND COMMUNICATION; E.12 OVER-DECLARED BUDGETS AND ALWAYS-ON SCREENING

  • Under-declaring the Byzantine budget is harmful under Gaussian perturbations, while over-declared fixed-budget screening preserves accuracy at a fairness cost; FUSE is approximately 2.9× slower than BOBA.With an over-declared budget, honest FPR is 40% and retained fair mass falls to 59–62%; an adaptive threshold lowers clean FPR to 2.8–5.7% and retains 94.4–98.3% of fair mass, but reduces attack recall.Source: §E.9 · p. 30, §E.11 · p. 30, §E.12 · p. 31

E.12 OVER-DECLARED BUDGETS AND ALWAYS-ON SCREENING

  • Accuracy stays within 0.7 points of matched-budget runs when f = 4 is declared but only 1–3 of 14 clients are Byzantine, while over-declaration reduces retained fair mass.With one actual attacker, honest false-rejection rises to 0.30–0.35 and high-loss-20% retained fair mass falls to 0.69–0.75; with three attackers these are 0.10–0.20 and 0.84–0.96. Sign Flip and IPM recall also degrades as surplus rejection slots are spent on honest clients.Source: §E.12 · p. 31, Table 37 · p. 31

E.13 COVARIATE-SHIFT STRESS TESTS

  • At severity 3, FUSE reaches 51.75% clean and 51.03% worst-attack accuracy, staying within one point of shifted-clean accuracy across tested shift conditions.Despite an unshifted trusted basis, shifted honest updates retain 95–96% total fair mass and 98.5–99.5% high-loss fair mass. Varying trusted examples from 5 to 50 per class changes four-attack worst-attack accuracy by at most 1.5 points; honest FPR falls from 3.2% to 0.9%. These tests do not guarantee robustness to arbitrary violations of shared class-conditionals.Source: §E.13 · p. 32

E.14 ADAPTIVE CONE-PRESERVING ATTACKS

  • Full-horizon adaptive-attack runs recover partially to 65.6% versus 82.4% clean, indicating severe transient degradation with a persistent terminal gap rather than universal permanent collapse.Cone-copy attacks remain within one to two points of clean accuracy; harmful adaptive attacks exploit allowed cone and radial degrees of freedom rather than merely duplicating an honest update. The 300-round diagnostic is not a terminal conclusion.Source: Table 38 · p. 32, §E.14 · p. 32

E.15 OTHER OBSERVABLE-BOUNDARY EXPERIMENTS

  • Parameter-selection attacks collapse FUSE when Byzantine updates are indistinguishable from honest ones in screened coordinates and carry the attack in unselected coordinates.On CIFAR-10/ResNet-18, both classifier-selected and full-parameter runs trigger the collapse criterion before the final window; screened MNIST/MLP and EMNIST/CNN collapse at rounds 539 and 889. In the cone-copy condition, FUSE records 78.32%/68.54% global/worst-10% accuracy versus 73.16%/63.55% for unscreened q-FFL-GD.Source: §E.15 · p. 32

F.2 FAIRNESS-WARPED GEOMETRY AND STABLE RECOVERY

  • Fairness-scaled honest updates preserve nonnegative class-mixture structure while fairness changes their radial scale, and finite-sample coefficient recovery supports stable scale and composition estimates.The recovered scale also enables trusted-loss reconstruction when coefficient error is small relative to the honest fairness scale; the conic hull is the nonnegative trusted cone, while the honest family generally occupies only a fairness-constrained subset.Source: §F.2 · pp. 33–34

F.3 TWO-STAGE SCREENING GUARANTEE

  • With a full-rank trusted basis, a strict honest majority, and stated separation conditions, the two-stage guarantee rejects Byzantine submissions without rejecting honest clients in Stage I.Stage I detects radial scale deviations and Stage II structural cone deviations; stronger fairness weighting widens the honest radial range and raises the separation margin required by a purely radial detector.Source: §F.3 · pp. 34–35

F.4 CONDITIONAL ONE-STEP DESCENT

  • Under smoothness and an alignment condition, the retained mean update yields one-step descent when it is nonzero and the step size satisfies the stated bound.The proposition is conditional: descent requires αt∥ū_t∥^2 < 2γt; a zero retained mean leaves the objective unchanged.Source: §F.4 · pp. 35–36

F.5 ATTACK IMPLICATIONS AND OBSERVABLE BOUNDARY

  • FUSE’s cone consistency is not a certificate of honesty: scale-plausible cone-preserving updates and attacks equivalent in selected coordinates may receive no distinguishing score.Positive magnitude copies change recovered scale but not normalized cone score; sign reversals violate nonnegative cone structure, while off-span perturbations are measured by their residual.Source: §F.5 · p. 36

Related papers

Loading 2610.20264v1…