Byzantine-Robust Federated Learning Defense

Attack

Malicious clients 1 / 6

Attack strength 5.0×

Server-Side Defense

Round speed 1.5 / s

Global Model State

round 0 — initializing…

Round

Distance to optimum

—

Poisoning impact on aggregate

Honest client

Malicious client

True optimum (target)

Global model

How it works

In federated learning, n clients never share raw data — each sends only a local gradient update g_i computed on its own data, and a central server aggregates them into the global model w:

Naive mean (FedAvg):
  w(t+1) = w(t) + η · (1/n) Σ g_i

Coordinate-wise median (Byzantine-robust):
  w(t+1)_d = w(t) + η · median_i( g_i,d )   for each dimension d

A compromised or malicious client can send an arbitrary update instead of a real gradient — this is a model-poisoning attack. Under a naive mean, even one client with an unbounded update can drag the average anywhere, because the mean has no breakdown point. The coordinate-wise median tolerates up to (but not including) n/2 malicious clients per dimension: an outlier can shift a median by at most one rank position, so it gets outvoted by the honest majority instead of dominating the sum.

Malicious clients — how many of the 6 clients send a poisoned update this round (an anti-gradient scaled away from the true optimum) instead of an honest local gradient.
Attack strength — how large the poisoned update is relative to an honest one; a naive mean is dragged proportionally to this value, a median is not.
Naive Mean / Robust Median — the aggregation rule the server applies each round; switch mid-run to see the same attack blocked or let through.
Distance to optimum — Euclidean distance between the current global model and the shared true optimum; it should shrink under a working defense and grow under a successful attack.

Real-world relevance: this is the exact threat model behind Byzantine-robust aggregation rules used in production federated systems (coordinate-wise median, trimmed mean, Krum) to keep a single compromised device from poisoning a model shared by millions of participants, e.g. mobile keyboard prediction or cross-hospital medical AI.

Honest gradient Poisoned gradient Global model trail

⚠ Couldn't load the 3D engineThree.js failed to load from the CDN. Check your connection and reload.