Each of N clients holds private local data and sends only a gradient-style update vector gi ∈ ℝ² to the server every round — never raw data. A fraction f of clients are Byzantine: instead of an honest update they send an update scaled and flipped by the attack-strength factor, trying to drag the global model away from the true optimum.
FedAvg: g = (1/N) Σ g_i (mean — one bad vector shifts it a lot)
Median: g_k = median_i(g_i[k]) per-coordinate, k=1..2
Trimmed: g_k = mean of the middle N-2f values of g_i[k]
Krum: score(i) = Σ over the N-f-2 closest g_j to g_i of ||g_i-g_j||²
pick the g_i with the smallest score
Krum and the trimmed mean are provably robust as long as f < N/2 (Krum needs 2f+2 < N): an attacker can shift a coordinate-wise mean arbitrarily by sending one huge value, but a median or a score built from nearest-neighbour distances is barely moved by a small number of outliers.
- Run Round — each client computes an update toward the shared true optimum (gold dot) plus noise; malicious clients replace theirs with an attack vector; the chosen rule aggregates them and the global model (white dot) steps toward the result.
- Drift from truth — Euclidean distance between the current global model and the true optimum; under FedAvg with attackers this climbs, under a robust rule it stays low.
- Attackers filtered — for Krum/trimmed mean, how many of the malicious updates were excluded from the final aggregate this round.
This mirrors real defenses (Blanchard et al.'s Krum, coordinate-wise trimmed mean/median) used to keep a federated model safe when a subset of participating devices is compromised or actively poisoning training — a purely defensive statistics problem, not an attack recipe.
Drag the canvas to pan, scroll or pinch to zoom the parameter plane.