Byzantine-robust aggregation limits the influence of faulty or malicious updates during collaborative training. In decentralized federated learning, each node must make that decision using the information available in its neighborhood.
The problem
In centralized FL, the server can apply a defense before producing the global model. In DFL, each node may aggregate updates from neighbors. That makes poisoning more subtle because influence is local, repeated and topology-dependent.
The practical question is: how can a node decide whether to accept, reduce or reject a peer update?
Defense families
Three families are especially useful as a baseline:
- median-based aggregation,
- trimmed mean,
- trust-weighted aggregation.
They are not perfect. Their value is that they are understandable, cheap enough for many settings and useful for comparing more advanced defenses.
Interpretability
In cyberdefense, a defense mechanism should be explainable to an operator or researcher. If an update is down-weighted, the system should expose why: distance from neighbors, historical trust, abnormal parameter shift, delay pattern or disagreement with local validation.
Robust aggregation is not just math. It is part of the trust layer of DFL.
Key takeaway
Byzantine-resilient aggregation should be evaluated as both a statistical defense and an operational trust mechanism. A peer update is not only accepted or rejected; it should leave an auditable reason for that decision.
Open research question
How can a peer explain why it reduced or rejected another peer's update without exposing sensitive local validation data or creating a new attack surface?
Median, trimmed mean and trust: what changes
Coordinate-wise median selects the middle value of each parameter. Trimmed mean removes extremes in each coordinate and averages the remainder. Trust weighting retains contributions with different weights. These are different operations: none identifies a participant's intent by itself. Yin and colleagues, ICML 2018 analyze median and trimmed mean under specific statistical assumptions; transferring their guarantees to a DFL neighborhood requires checking those assumptions again.
Consider an arithmetic illustration, not a benchmark: for scalar contributions 0.9, 1.0, 1.1, 1.2, 20.0, the mean is 4.84, the median is 1.1, and trimming one value at each end also produces 1.1. Neural-network coordinates form a correlated vector, however. Combining central values does not guarantee a valid update or preserve a minority class.
The adversarial budget must be local
A federation may contain few malicious nodes, yet all of them may surround the same client. That client can receive a majority of harmful contributions. Record the number of received and accepted neighbors per round, the adversarial fraction within that neighborhood, and the fallback when filtering leaves insufficient support.
Measure the cost without an attack as well. Yang and colleagues, ICML 2025 analyze the tension between Byzantine tolerance and aggregation error without attackers. The experimental consequence is concrete: compare the defense enabled and disabled on both clean and attacked data, including legitimate non-IID clients.
For protocol design, continue with measuring DFL robustness and combining privacy with robust aggregation.
