Governance-Aware Federated Learning for Multi-Agent AI Systems: A Policy-Driven Framework for Trustworthy Collaborative AI

1 Introduction

• Enterprise FL must address governance, accountability, fairness, explainability, trust, anomaly detection, and runtime policy enforcement alongside privacy-preserving collaboration.The paper identifies these concerns as especially important for semi-trusted participants operating across organizational boundaries.Source: §1 · pp. 1–2
• GAFL places runtime governance in a dedicated control plane that validates participants, evaluates trust, assesses fairness and explainability, detects anomalies, enforces policy, and coordinates audits.It conditions aggregation influence on independently verified governance behaviour and separates predictive-model training from governance evaluation and decision-making.Source: §1 · p. 2
• Here, “multi-agent AI systems” means coordinated participant and governance agents around federated models, not autonomous generative or large-language-model agents.Source: §1 · p. 2
• The work contributes round-level governance, non-negative normalized aggregation, bounded temporal trust, independent evidence verification, and evaluation across seven participant and threat conditions.The conditions include honest, non-IID, biased, malicious, non-compliant, falsified-evidence, and mixed-threat settings.Source: §1 · p. 2

2 Related Work

• Prior federated-learning work addresses communication, privacy, secure aggregation, heterogeneity, and adversarial robustness, while SHAP and LIME provide feature-level interpretations.Source: §2 · p. 2
• Trust-weighted and Byzantine-robust methods address narrower problems, and GAFL does not claim to replace optimization or Byzantine-robust aggregation methods.The cited examples include FLTrust, q-FFL, Krum, and coordinate-wise median and trimmed-mean methods.Source: §2 · p. 2
• GAFL integrates independently verified governance evidence, trust, protected-group fairness and explanation assessment, policy enforcement, and tamper-evident decision records into a round-level architecture.Source: §2 · pp. 2–3

3.1 System Architecture

• The architecture authenticates governance evidence, binds it to each model update, and independently recomputes required metrics before the control plane assigns a decision.Participants may be accepted, down-weighted, or quarantined; eligible updates proceed to aggregation, with decisions and weights recorded in the audit layer.Source: §3.1 · p. 3, Figure 1 · p. 4
• The control plane evaluates verified compliance, fairness, explanation consistency, anomaly risk, and historical trust to decide whether updates are accepted, down-weighted, or quarantined.The audit layer records governance decisions, verified scores, trust transitions, and aggregation outcomes.Source: §3.1 · p. 3
• Explanation consistency measures attribution stability across rounds, but does not establish causal correctness or guarantee correct model predictions.For a participant’s first evaluated round, its explanation is compared with the global model’s explanation on the same governance-validation sample.Source: §3.1 · p. 6
• Anomaly risk is measured against a robust reference from same-round updates, and an isolated flag prompts monitoring or reduced influence rather than automatic exclusion.Persistent anomalies or a mandatory identity, integrity, evidence, or policy failure can trigger quarantine.Source: §3.1 · pp. 6–7

3.2 Governance-Aware Aggregation

• GAFL combines eligible participants’ dataset sizes with bounded temporal trust to produce non-negative raw contribution scores and normalized aggregation weights.The resulting global model is a convex combination of eligible participant models; if no participant is eligible, aggregation is skipped and the round is escalated for governance review.Source: §3.2 · pp. 8–9

4 Threat Model and Governance Mechanisms

• GAFL treats participants as semi-trusted but trusts the verifier, control plane, policy repository, validation dataset, aggregation server, and audit layer.Signatures, nonces, timestamps, round and policy identifiers, and update-hash binding protect evidence integrity and freshness.Source: §4 · p. 9
• The threat model covers malicious updates, biased but non-malicious data, governance non-compliance, potentially benign anomalies, and falsified governance evidence.Non-IID data, class imbalance, optimization instability, and distribution shift may produce unusual updates, so statistical deviation alone is not treated as proof of maliciousness.Source: §4 · p. 9
• The control plane combines independently recomputed governance metrics, anomaly risk, and temporal trust to accept, down-weight, or quarantine updates before eligible updates enter aggregation.Mandatory identity, integrity, freshness, or evidence failures cause quarantine; fairness violations and isolated anomalies normally lead to monitoring or down-weighting.Source: §4 · p. 9
• GAFL does not guarantee identification of malicious intent and does not address compromised trusted components, strong collusion, unrepresentative validation data, or model-update privacy leakage.These boundaries qualify the threat coverage of the proposed workflow.Source: §4 · p. 9

5 Prototype Implementation and Experimental Methodology

• The prototype simulates 10 cross-silo participants and evaluates predictive performance, fairness, threat detection, trust, policy enforcement, convergence, and governance overhead across seven conditions.Participants retain local data; the verifier authenticates evidence and recomputes selected measurements before the control layer makes governance decisions and eligible updates are aggregated.Source: §5 · pp. 9–10

5.1 Dataset and Preprocessing

• Adult Income records were preprocessed for binary classification, with sex retained as the protected attribute and data split 70:15:15 into training, governance-validation, and test partitions.The validation partition supports metric recomputation and threshold calibration, while the test partition is reserved for final model evaluation.Source: §5.1 · p. 10

5.2 Federated Learning Configuration

• Ten participants trained logistic-regression models for 25 rounds using identical settings across five seeds; benign non-IID data used joint label–sex Dirichlet allocation with concentration 0.5.The non-IID condition was designed to isolate statistical heterogeneity from malicious behavior.Source: §5.2 · p. 10

5.3 Participant and Threat Scenarios

• Seven scenarios covered honest, benign non-IID, biased, malicious-update, non-compliant, falsified-evidence, and mixed-threat participants, with quarantine reserved for mandatory failures.The malicious updates were sign-reversed and scaled by three; the mixed-threat scenario combined one participant from each threat category with six honest participants.Source: §5.3 · p. 11

5.4 Governance Validation Workflow

• Before aggregation each round, the verifier checked signed evidence, freshness, policy and round identifiers, completeness, and update-hash binding, then recomputed fairness and explanation metrics.Reported and verified values differing by more than τV=0.0241 were classified as falsified; invalid, stale, replayed, or falsified evidence triggered quarantine. Trust and anomaly risk informed decisions, and eligible updates received non-negative normalized weights while quarantined updates contributed nothing.Source: §5.4 · p. 12

6 Results and Discussion

• 0.0037 versus FedAvg’s 0.1000 mean malicious-participant aggregation weight (96.3% reduction); under malicious updates, GAFL-Full macro-F1 was 0.7733 ± 0.0032 versus FedAvg’s 0.7734 ± 0.0018.Under non-compliance, GAFL-Full macro-F1 was 0.7731 ± 0.0033 versus FedAvg’s 0.7734 ± 0.0018.Source: §6 · p. 14
• In the falsified-evidence scenario, GAFL-Full identified and quarantined all 250 falsified participant-round claims, while GAFL-NoVerify identified none because it relied on self-reported governance values without independent recomputation.Under the biased-data scenario, demographic-parity difference was 0.1810 ± 0.0059 for GAFL-Full versus 0.1859 ± 0.0023 for FedAvg; the honest-scenario disparity was 0.1754 ± 0.0024.Source: §6 · p. 14
• 173.67 ± 26.94 ms per round for GAFL-Full governance processing versus 3.82 ± 0.79 ms for FedAvg; fairness and explanation recomputation accounted for 97.9% of GAFL-Full latency.All 140 primary-run audit hash chains passed integrity verification, but audit-writing latency was not separately measured.Source: §6 · p. 15
• Findings are limited to the implemented cross-silo simulation, selected dataset, model, threat configurations, and governance-validation partition.The study also notes no direct experimental comparisons with FLTrust, q-FFL, Krum, or coordinate-wise trimmed mean.Source: §6 · p. 15

• GAFL-Full intervened on all affected participants at the final round, detected all 250 falsified participant-round claims, and reduced malicious-participant aggregation weight by 96.3%.Predictive performance remained broadly similar to FedAvg.Source: §7 · p. 15
• GAFL-Full required 173.67 ± 26.94 ms per round, approximately 45.4 times the FedAvg latency.Source: §7 · p. 15
• Frequent interventions for honest participants exposed sensitivity to the fairness threshold and verifier tolerance.Source: §7 · p. 15
• Future work should combine governance enforcement with fairness-aware training, improve evidence-verification calibration, reduce explanation-computation overhead, and evaluate larger participant populations and stronger attacks.Source: §7 · p. 15