In federated learning, n clients never share raw data — each sends only a local gradient update gi computed on its own data, and a central server aggregates them into the global model w. Every quantity below is a 2D vector (x,y); the underlying rule is coordinate-wise, so it behaves identically in 2D, 3D or any higher dimension — this view only drops the sim's cosmetic z-axis, not any of the math:
Naive mean (FedAvg):
w(t+1) = w(t) + η · (1/n) Σ g_i
Coordinate-wise median (Byzantine-robust):
w(t+1)_d = w(t) + η · median_i( g_i,d ) for each dimension d
A compromised or malicious client can send an arbitrary update instead of a real gradient — this is a model-poisoning attack. Under a naive mean, even one client with an unbounded update can drag the average anywhere, because the mean has no breakdown point. The coordinate-wise median tolerates up to (but not including) n/2 malicious clients per dimension: an outlier can shift a median by at most one rank position, so it gets outvoted by the honest majority instead of dominating the sum. Numerically verified against this exact 2D update rule: with n=6, 1 malicious client at 5× strength, 200 rounds converges to a residual distance of ≈0.26 under the median rule vs ≈1.75 under the naive mean; pushing malicious clients to 3 (=n/2, the median's own breakdown point) blows both rules up alike (≈8.8 and ≈16.8) — matching the "even median is compromised" status message below.
- Malicious clients — how many of the 6 clients send a poisoned update this round (an anti-gradient scaled away from the true optimum) instead of an honest local gradient.
- Attack strength — how large the poisoned update is relative to an honest one; a naive mean is dragged proportionally to this value, a median is not.
- Naive Mean / Robust Median — the aggregation rule the server applies each round; switch mid-run to see the same attack blocked or let through.
- Distance to optimum — Euclidean distance between the current global model and the shared true optimum; it should shrink under a working defense and grow under a successful attack.
Real-world relevance: this is the exact threat model behind Byzantine-robust aggregation rules used in production federated systems (coordinate-wise median, trimmed mean, Krum) to keep a single compromised device from poisoning a model shared by millions of participants, e.g. mobile keyboard prediction or cross-hospital medical AI.