Robust Federated Inference

## Abstract

Abstract Federated inference, in the form of one-shot federated learning, edge ensembles, or federated ensembles, has emerged as an attractive solution to combine predictions from multiple models. This paradigm enables each model to remain local and proprietary while a central server queries them and aggregates predictions.
Yet, the robustness of federated inference has been largely neglected, leaving them vulnerable to even simple attacks.
To address this critical gap, we formalize the problem of robust federated inference and provide the first robustness analysis of this class of methods.
Our analysis of averaging-based aggregators shows that the error of the aggregator is small either when the dissimilarity between honest responses is small or the margin between the two most probable classes is large.
Moving beyond linear averaging, we show that problem of robust federated inference with non-linear aggregators can be cast as an adversarial machine learning problem.
We then introduce an advanced technique using the DeepSet aggregation model, proposing a novel composition of adversarial training and test-time robust aggregation to robustify non-linear aggregators.
Our composition yields significant improvements, surpassing existing robust aggregation methods by 4.7 − 22.2 % 4.7-22.2\% in accuracy points across diverse benchmarks.

## 1 Introduction

Over the past several years, concepts such as *one-shot federated learning* (OFL) (Dai et al., 2024; Diao et al., 2023; Zhang et al., 2022; Guha et al., 2019), *edge ensembles* (Malka et al., 2025; Shlezinger et al., 2021), and *federated ensembles* (Allouah et al., 2024a; Hamer et al., 2020) have gained traction in collaboratively performing inference from several client-local models.
More recently, the availability of diverse open-source large language models (LLMs) has spurred interest in aggregating outputs from multiple models to answer a given query, giving rise to sophisticated *LLM ensembles* that leverage complementary strengths of individual models (Tekin et al., 2024; Wang et al., 2024; Jiang et al., 2023). Despite being introduced under different names, these techniques share a common principle: combining predictions from multiple client-held models to produce a single output. In this paper, we collectively refer to these approaches under the terminology of *federated inference*. In this setting, clients retain proprietary (locally trained) models, while a central server queries them for inference as illustrated in [Figure 1](https://arxiv.org/html/2510.00310v2#S1.F1). The individual predictions are then aggregated into a final prediction, either using averaging-based aggregations (Dai et al., 2024; Zhang et al., 2022; Gong et al., 2022) or server-side aggregator neural networks (Allouah et al., 2024a; Wang et al., 2024).

While federated inference is gaining traction, its robustness to model failures and poisoned outputs remains largely overlooked in the literature, despite some initial preliminary study (Liu et al., 2022). This gap is critical for two reasons: *(i)* failures and errors are practically unavoidable, and *(ii)* existing work in robust statistics and Byzantine-robust machine learning (ML) demonstrates that undefended models are inherently vulnerable, even to relatively simple attacks (Guerraoui et al., 2024; Diakonikolas & Kane, 2023). It is therefore of paramount importance to clearly define the potential threats that may arise in federated inference, so as to prevent a technological advantage from becoming a significant vulnerability.
In this paper, we take a step toward closing this gap by defining potential failure modes of federated inference and presenting the first robustness analysis of this class of schemes.

### 1.1 Main Contributions

Problem formulation and analysis of the averaging aggregator. We formalize the problem of robust federated inference for the first time. We consider a system of $n$ clients, each with a local data distribution and probit-valued classifier, where the outputs of up to $f<\tfrac{n}{2}$ clients may be arbitrarily corrupted at inference time.
Our goal is to design aggregation schemes that remain accurate with respect to the global data distribution despite the corruptions.
When the server uses an averaging-based aggregation (Dai et al., 2024; Zhang et al., 2022; Gong et al., 2022), a natural way to robustify is to substitute it with a robust averaging scheme (Allouah et al., 2023) which ensures that the output of the aggregator is an estimate of the average of the honest probits.
Prominent examples include coordinate-wise trimmed mean (CWTM), coordinate-wise median (CWMed), etc. (Guerraoui et al., 2024).
However, we show that robust averaging may prove insufficient since the aggregator’s output can be sufficiently close to the honest average, yet produce a misclassification.
Nevertheless, in the cases where averaging suffices, we derive formal robustness certificates for federated inference.
Our analysis shows that the error of the aggregator depends upon the fraction of corruptions $f/n$, the margin between the top two classes, and the dissimilarity between the outputs of different clients.

Robust inference as an adversarial ML problem. Beyond averaging, recent work has shown that non-linear trained aggregators (e.g.\xcommaneural networks) often outperform averaging-based aggregators in the uncorrupted setting (Allouah et al., 2024a; Wang et al., 2024).
When using such aggregators, we show that the problem of robust inference can be cast as an adversarial learning problem over the probit-vectors.
Encouragingly, contrary to the difficulty of standard adversarial ML problems in the image space (Goodfellow et al., 2014), we show that the adversarial problem on probit-vectors can be more reliably addressed, thanks to the structure of the input space where each corrupted vector is confined to a probability simplex over the number of classes.
Yet, naively leveraging adversarial training (Madry et al., 2018) to solve the problem remains computationally intractable due to the high cardinality of permuting through different choices of adversarial clients at training time, since any $f$ (unknown) clients out of $n$ can be malicious.

Figure: Figure 1: Federated Inference
Refer to caption: x1.png

Robust DeepSet Aggregator. To alleviate this issue, we propose to use a neural network aggregator based on the DeepSet model (Zaheer et al., 2017), an architecture which is invariant to the order of inputs.
Specifically, since the aggregator’s output can be independent to the order of clients, leveraging DeepSets enables us to reduce the search of choosing $f$ adversaries to $\binom{n}{f}$ instead of requiring to permute through them $\binom{n}{f}f!$.
In practice, we show that adversarial training by sampling any $N$ choices of adversaries where $N\ll\binom{n}{f}$ suffices to achieve good performance with DeepSet.
To further reduce the sensitivity of DeepSet to corrupted probits, we propose a composition of robust averaging with DeepSet at inference-time, which significantly boosts empirical performance.
In particular, we show that this composition may only be applied at inference-time, preventing any escalation of training costs during adversarial training.
By combining robust elements from both the adversarial ML and robust ML literature in our novel composition, we achieve the state-of-the-art (SOTA) performance for federated inference as illustrated in [Table 1](https://arxiv.org/html/2510.00310v2#S1.T1).

Empirical validation. To rigorously evaluate defenses, we design a new attack called the Strongest Inverted Attack (SIA) that challenges existing defenses. We conduct extensive experiments on three datasets (CIFAR-10, CIFAR-100, and AG-News) covering both vision and language modalities as well as diverse model families (ResNet-8, ViT-B/32, DistilBERT). Our approach yields a $4.7$–$22.2\%$ points improvement over existing methods across a suite of $6$ different attacks, including SIA.

### 1.2 Related Work

Federated Inference.
Collaborative inference through client ensembles has been explored in one-shot Federated Learning (FL) (Guha et al., 2019; Gong et al., 2022; Dai et al., 2024) and decentralized edge networks (Shlezinger et al., 2021; Malka et al., 2025), motivated by communication efficiency, reduced training cost, or proprietary nature of client models accessible only via black-box inference.
Another common scenario is when clients already possess trained models which are offered in model market scenarios (Li et al., 2021).
Yet, the robustness of federated inference has received limited attention.
An initial preliminary work was conducted by Liu et al. (2022) in the vertical federated learning setting, where they try to reconstruct the underlying uncorrupted responses using an autoencoder and a block-sparse optimization process.
Their method, CoPur, purifies responses before aggregation on the server.
However, purification alone is vulnerable to stronger attacks and highly sensitive to input magnitudes, since it operates in the logit space rather than probits.

Byzantine Distributed Learning. Byzantine robustness has become a central topic in distributed ML (Alistarh et al., 2018; Chen et al., 2017; Farhadkhani et al., 2022; Guerraoui et al., 2024), where malicious clients may send arbitrary updates during training. Our setting differs in focusing on inference rather than training, and in not assuming fixed Byzantine identities (cf.\xcomma (Dorfman et al., 2024)). While the objectives thus diverge, a key idea in Byzantine distributed learning, namely robust averaging, remains relevant to our analysis. Indeed, robust averaging techniques can be adapted to improve the resilience of federated inference in the presence of corrupted client outputs, at the cost of a some technicalities, as demonstrated in Section [3](https://arxiv.org/html/2510.00310v2#S3).

Federated Distillation and Robust Voting. In \AcFL, many works propose to share logits on a public dataset instead of gradients to improve communication efficiency and privacy (Fan et al., 2023; Gong et al., 2022; Sattler et al., 2021). Recent work addresses adversarial logits by proposing robust aggregation methods (Roux et al., 2025; Li et al., 2024; Mi et al., 2021), but these approaches rely on assumptions inapplicable to our setting. For example, ExpGuard (Roux et al., 2025) tracks client behavior across rounds, whereas in our case clients may act arbitrarily at each inference. Similarly, FedMDR (Mi et al., 2021) requires clients to report accuracy on a public dataset to weight contributions, information unavailable in our setup.
A parallel line of work studies robust voting, where voters/clients cast scores that are aggregated to resist malicious participants, either in general settings (Allouah et al., 2024b) or in federated learning specifically (Chu & Laoutaris, 2024; Cao et al., 2022). These approaches, however, typically assume fixed client identities or some control over the training process, assumptions which do not hold in our setting.

## 2 Problem of Robust Federated Inference

We consider a classification task, mapping an input space $\mathcal{X}$ to an output space $\mathcal{Y}=[K]:=\{1,\dots,K\}$, and a system comprising $n$ clients, each with a local data generating distribution $\mathcal{D}_{i}$ over $\mathcal{X}\times\mathcal{Y}$. For each client $i\in[n]$, we are given a probit-valued regressor $h_{i}$ mapping $\mathcal{X}$ to the simplex $\Delta^{K}:=\{z\in[0,1]^{K}\mid\sum_{k\in[K]}z_{k}=1\}$, which plays the role of a local classifier. In this context, the goal of a federated inference scheme is to design a mapping $\psi:\left(\Delta^{K}\right)^{n}\to[K]$ that aggregates clients’ local probits in order to minimize the expected prediction error on the mixture of distributions $\mathcal{D}\coloneqq\frac{1}{n}\sum_{i=1}^{n}\mathcal{D}_{i}$. Specifically, denoting $\mathbf{h}(x)\coloneqq(h_{1}(x),\ldots,h_{n}(x))$, we seek an aggregator $\psi_{\text{o}}$, from a set of candidate aggregators $\Psi$, that minimizes the *federated inference risk*

$$ $\displaystyle\mathcal{R}(\psi)\coloneqq\mathbb{E}_{(x,y)\sim\mathcal{D}}\left[\ell_{\psi}(x,y)\right],\quad\text{where}\quad\ell_{\psi}(x,y)\coloneqq\mathds{1}\left\{\psi\left(\mathbf{h}(x)\right)\neq y\right\}.$ (1) $$

A typical example of aggregation is $\psi\!\left(\mathbf{h}(x)\right)\coloneqq\arg\max_{k\in[K]}\left[\tfrac{1}{n}\sum_{i=1}^{n}h_{i}(x)\right]_{k}$, where $[\cdot]_{k}$ denotes the $k$-th coordinate of the vector and where the $\arg\max$ breaks ties arbitrarily. More generally, however, $\Psi$ may involve non-linear aggregation schemes.
In fact, prior work (Allouah et al., 2024a; Wang et al., 2024) has shown that such aggregation strategies yield higher accuracy expectation, compared to any individual classifier $h_{1},\ldots,h_{n}$.

Robust federated inference. We are interested in solving the problem of robust federated inference, wherein a fraction of the clients’ is subject to corruption prior to aggregation. Specifically, we consider a scenario wherein for each query $x\in\mathcal{X}$, up to $f<n/2$ of the $n$ clients (of hidden identity) can return arbitrarily corrupted vectors in the probit space $\Delta^{K}$. Our goal is to design an aggregation scheme that yields high accuracy, despite such corruptions. In what follows, for any input $x\in\mathcal{X}$, we denote by $\Gamma_{f}(x)$ the set of all possible probits after up to $f$ corruptions, i.e.,

$$ $\displaystyle\Gamma_{f}(x)\coloneqq\left\{\mathbf{z}=(z_{1},\dots,z_{n})\in(\Delta^{K})^{n}\,\middle|\,\exists\,H\subseteq[n],\,|H|\geq n-f,\;\forall i\in H,\;z_{i}=h_{i}(x)\right\}.$ (2) $$

Formally, we seek an aggregator $\psi_{\text{rob}}\in\Psi$ minimizing the *robust federated inference risk*, given by

$$ $\displaystyle\mathcal{R}_{\text{adv}}(\psi)\coloneqq\mathbb{E}_{(x,y)\sim\mathcal{D}}\left[\ell_{\psi}^{\text{adv}}(x,y)\right],\quad\text{where}\quad\ell^{\text{adv}}_{\psi}(x,y)\coloneqq\max_{\mathbf{z}\in\Gamma_{f}(x)}\mathds{1}\left\{\psi(\mathbf{z})\neq y\right\}.$ (3) $$

In the following, we show that robust federated inference risk can be upper bounded by federated inference risk and an overhead resulting from probit corruptions. Thereby we show that if an optimal aggregator (with respect to the original federated inference risk ([1](https://arxiv.org/html/2510.00310v2#S2.E1))) is apriori known, then robust ensembling can be achieved by designing an aggregator that aims to minimize disagreement with the optimal aggregator, in the presence of corruptions. In doing so, consider an aggregation scheme $\psi_{\text{o}}$ minimizing ([1](https://arxiv.org/html/2510.00310v2#S2.E1)), i.e., the expected learning error without corruption. This aggregator $\psi_{\text{o}}$ represents an oracular aggregator, i.e., optimal in the hypothetical scenario when we have access to the uncorrupted probits. Using $\psi_{\text{o}}$ as reference for robustness, we can bound robust federated inference risk for an aggregator $\psi_{\text{rob}}$ as per the following lemma (which we prove in [Appendix A](https://arxiv.org/html/2510.00310v2#A1)).

lemmalemmaDecomposition
For any $x\in\mathcal{X}$, let $\hat{y}_{\text{o}}=\psi_{\text{o}}(\mathbf{h}(x))$. Then,

$$ $\displaystyle\mathcal{R}_{\text{adv}}(\psi_{\text{rob}})\leq\mathcal{R}(\psi_{\text{o}})+\mathbb{E}_{(x,y)\sim\mathcal{D}}\left[\ell^{\text{adv}}_{\psi_{\text{rob}}}(x,\hat{y}_{\text{o}})\right].$ (4) $$

The overhead $\mathbb{E}_{(x,y)\sim\mathcal{D}}\left[\ell^{\text{adv}}_{\psi_{\text{rob}}}(x,\hat{y}_{\text{o}})\right]$, named the robustness gap, represents the excess error due to adversarial probit corruptions. This gap is the worst-case probability that $\psi_{\text{rob}}$ disagrees with the oracular aggregator under up to $f$ probits being corrupted.
In the following, we analyze the robustness gap in the case when the oracular aggregator is given by the averaging operation and the robust aggregator satisfies the property of $(f,\kappa)$-robust averaging Allouah et al. (2023).(^1^11The analysis can be easily extended to weighted averaging by simply re-scaling the inputs to the aggregator.)

## 3 Averaging as oracular aggregator

We first consider the case where the oracular aggregator $\psi_{\text{o}}$ is based on computing the average of the uncorrupted probits, i.e.,

$$ $\displaystyle\psi_{\text{o}}(\mathbf{h}(x))\coloneqq\mathop{\mathrm{argmax}}_{k\in[K]}\left[\overline{h}(x)\right]_{k},\quad\text{ where}~~\overline{h}(x)\coloneqq\sum_{i=1}^{n}h_{i}(x)$ $$

In this particular case, we robustify the aggregation against probit corruptions by substituting the averaging by a robust averaging $\textsc{RobAvg}:(\Delta^{K})^{n}\to\mathbb{R}^{K}$, taking inspiration from the literature of Byzantine-robust machine learning (Guerraoui et al., 2024) and robust mean estimation (Diakonikolas & Kane, 2023). Specifically, we set

$$ $\displaystyle\psi_{\text{rob}}(\mathbf{z})\coloneqq\mathop{\mathrm{argmax}}_{k\in[K]}\left[\textsc{RobAvg}\left(\mathbf{z}\right)\right]_{k}.$ (5) $$

Where RobAvg is a robust averaging aggregation rule. The concept of robust averaging, initially introduced by Allouah et al. (2023) can be defined as follows.

###### Definition 1 (Robust averaging) .

Let $\kappa\geq 0$. An aggregation rule RobAvg is $(f,\kappa)$-robust if, for any set of $n$ vectors $v_{1},...,v_{n}\in\mathbb{R}^{d}$ and any set $S\subseteq[n]$ of size $n-f$, the following holds true:

$$ $\left\lVert\textsc{RobAvg}(v_{1},...,v_{n})-\overline{v}_{S}\right\rVert^{2}_{2}\leq\frac{\kappa}{|S|}\sum_{i\in S}\left\lVert v_{i}-\overline{v}_{S}\right\rVert^{2}_{2},$ $$

where $\overline{v}_{S}\coloneqq\frac{1}{n-f}\sum_{i\in S}v_{i}$, and parameter $\kappa$ is called the robustness coefficient

Essentially, robust averaging ensures that despite up to $f$ inputs being arbitrarily corrupted the output of the aggregator is an estimate of the uncorrupted vectors’ average. The estimation error is bounded by the “empirical variance” of the uncorrupted input vectors, times a constant value $\kappa$. Examples of robust averaging include CWTM, CWMed and geometric median (GM) (Guerraoui et al., 2024, Chapter 4). Specifically, CWTM is $(f,\kappa)$-robust with $\kappa=\tfrac{6f}{n-2f}\left(1+\tfrac{f}{n-2f}\right)$. While robust averaging ensures proximity to the average of uncorrupted input vectors in $\ell_{2}$-norm, even a small estimation error can result in large prediction error due to the non-continuity of the $\mathop{\mathrm{argmax}}_{k}$ operator. We illustrate this insufficiency of robust averaging through the following counter example.

Counter example.
Let $\varepsilon>0$. Consider a point $x\in\mathcal{X}$ and three possible probit vectors for $x$, $h_{1}(x),h_{2}(x),h_{3}(x)\in\Delta^{3}$ defined as follows:

$$ $h_{1}(x)=(1,0,0),\quad h_{2}(x)=(0,1,0),\quad\text{and }h_{3}(x)=(1/2,1/2-\varepsilon,\varepsilon).$ $$

Note that $\overline{h}(x)=(1/2,1/2-\varepsilon,\varepsilon)$. Now, consider $\hat{v}=(1/2-\varepsilon,1/2,\varepsilon)$. We have $\left\lVert\overline{h}(x)-\hat{v}\right\rVert_{2}=\left(2\varepsilon^{2}\right)^{1/2}=2^{1/2}\varepsilon.$ Here, by taking small enough $\varepsilon$, we have that $\hat{v}$ can be arbitrarily close to $\overline{h}(x)$. However we still have $\mathop{\mathrm{argmax}}_{k\in[K]}\left[\overline{h}(x)\right]_{k}\neq\mathop{\mathrm{argmax}}_{k\in[K]}\left[\hat{v}\right]_{k}.$
Hence, demonstrating proximity under the euclidean norm does not guarantee preservation of the decision made by the $\mathop{\mathrm{argmax}}$.

From the above, we observe that in addition to proximity to the average, the robustness gap induced under robust averaging also depends on point-wise model dissimilarity at $x\in\mathcal{X}$, i.e.\xcomma,

$$ $\sigma^{2}_{x}=\max_{k\in[K]}\frac{1}{n}\sum_{i=1}^{n}\left(\left[h_{i}(x)\right]_{k}-\left[\overline{h}(x)\right]_{k}\right)^{2}.$ $$

We are now ready to present the robustness gap for the case when $\textsc{RobAvg}=\textsc{CWTM}$. Description of CWTM is deferred to Appendix [B.2](https://arxiv.org/html/2510.00310v2#A2.SS2). The reason for using CWTM is its simplicity and its proven optimality in the formal sense of robust averaging Allouah et al. (2023). To present the result, we introduce some additional notation. For a vector $z\in\Delta^{K}$, let $z^{(1)}$ and $z^{(2)}$ denote the largest and the 2nd-largest values in the set $\{[z]_{k}\}_{k=1}^{K}$. Then, we define $\textsc{margin}(z)=z^{(1)}-z^{(2)}$. If $[z]_{k}=[z]_{k^{\prime}}$ for all $k,k^{\prime}\in[K]$ (i.e., all the coordinates of the vector are equal) then $\textsc{margin}(z)=\infty$.

theoremmainavg
Consider $\psi_{\text{rob}}$ as defined in ([5](https://arxiv.org/html/2510.00310v2#S3.E5)) with $\textsc{RobAvg}=\textsc{CWTM}$. If the regressors $h_{1},\ldots,h_{n}$ are such that $\overline{h}(x)$ has a unique maximum coordinate almost everywhere, then the following holds:

$$ $\displaystyle\mathbb{E}_{(x,y)\sim\mathcal{D}}\left[{\ell^{\text{adv}}_{\psi_{\text{rob}}}(x,\hat{y}_{\text{o}})}\right]\leq\mathbb{P}_{(x,y)\sim\mathcal{D}}\left[\textsc{margin}\left(\overline{h}(x)\right)<2\left(\sqrt{\frac{\kappa\,n}{\,n-f\,}}+\sqrt{\frac{f}{\,n-f\,}}\right)\sigma_{x}\right],$ $$

where $\hat{y}_{\text{o}}=\psi_{\text{o}}(h_{1}(x),\dots,h_{n}(x))$ and $\kappa=\frac{6f}{n-2f}\,\left(1+\frac{f}{n-2f}\right)$.

The proof for this theorem is deferred to [Appendix B](https://arxiv.org/html/2510.00310v2#A2). This shows that the robustness gap for CWTM, when the oracular aggregator is given by the averaging operation, reduces with the fraction of corruptions $f/n$, the model dissimilarity and the inverse of the average probit’s margin. We validate this theoretical finding through an empirical study summarized in Figure [3](https://arxiv.org/html/2510.00310v2#A5.F3) (Appendix [E.1](https://arxiv.org/html/2510.00310v2#A5.SS1)).

###### Definition 1 (Robust averaging) .

## 4 DeepSet as oracular aggregator

In this section, we consider the case of more general non-linear trainable (i.e.\xcommadata dependent) oracular aggregator, inspired from recent work demonstrating the efficacy of such aggregation in context of ensembling (Allouah et al., 2024a; Wang et al., 2024).

Robust empirical federated inference risk minimization (RERM). In this case, since the oracular aggregator $\psi_{\text{o}}$ need not be a pre-determined linear combination of input probits (like averaging), we propose to design a robust aggregator
$\psi_{\text{rob}}$ by directly aiming to minimize the robust federated inference risk $\mathcal{R}_{\text{adv}}(\psi)$. In practice, we seek to minimize the following robust empirical federated inference risk:

$$ $\displaystyle\widehat{\mathcal{R}}_{\text{adv}}(\psi)\coloneqq\frac{1}{\left\lvert\mathcal{D}_{\text{train}}\right\rvert}\sum_{(x,y)\in\mathcal{D}_{\text{train}}}\ell_{\psi}^{\text{adv}}(x,y),\quad\text{where}\quad\ell^{\text{adv}}_{\psi}(x,y)\coloneqq\max_{\mathbf{z}\in\Gamma_{f}(x)}\mathds{1}\left\{\psi(\mathbf{z})\neq y\right\},$ (6) $$

where $\mathcal{D}_{\text{train}}$ comprises of a finite number of i.i.d. data points $(x,y)$ from the global distribution $\mathcal{D}$. In short, we refer to the optimization problem ([6](https://arxiv.org/html/2510.00310v2#S4.E6)) as RERM.

Connection to robustness to adversarial examples. The problem of RERM reduces to the problem of robustness against adversarial examples (Madry et al., 2018; Goodfellow et al., 2014), with the input space for the classifier (i.e.\xcommaaggregator $\psi$) being a $K\times n$ real-valued matrix with each column in $\Delta^{K}$ and the input perturbation being restricted to corruption of up to $f$ columns of the input matrix. Let $(\Delta^{K})^{n}$ denote the space such matrices, and for a matrix $M\in(\Delta^{K})^{n}$ let $\delta(M)$ denote the set of matrices from $\mathbb{R}^{K\times n}$ such that $M+V\in(\Delta^{K})^{n}$ for all $V\in\delta(M)$. For any matrix $V\in\mathbb{R}^{K\times n}$, we denote by $\left\lVert V\right\rVert_{0}$ the number of non-zero columns (i.e.\xcommacolumns with at least one non-zero entry). We can now formally express the RERM problem in ([6](https://arxiv.org/html/2510.00310v2#S4.E6)) as robustness to adversarial examples as follows:

$$ $\displaystyle\psi_{\text{rob}}\in\mathop{\mathrm{argmin}}_{\psi\in\Psi}\frac{1}{\left\lvert\mathcal{D}_{\text{train}}\right\rvert}\sum_{(x,y)\in\mathcal{D}_{\text{train}}}\max_{\begin{subarray}{c}V\in\delta(H(x))\\ \left\lVert V\right\rVert_{0}\leq f\end{subarray}}\mathds{1}\left\{\psi\left(H(x)+V\right)\neq y\right\},$ (7) $$

where $H(x)=[h_{1}(x),\ldots,h_{n}(x)]\in(\Delta^{K})^{n}$. By solving the above adversarial learning problem, we obtain an aggregator with minimum sensitivity against arbitrary perturbation to at most $f$ input probits while ensuring high learning accuracy at the same time. We propose to solve the RERM problem ([6](https://arxiv.org/html/2510.00310v2#S4.E6)) and the equivalent adversarial robustness problem ([7](https://arxiv.org/html/2510.00310v2#S4.E7))
for the space of aggregators $\Psi$ defined by a parameterized deep neural network.
However, the adversarial training still remains intractable due to high permutational cardinality of the input space of $H(x)$, totaling to the factor $\sum_{m=1}^{f}{}^{n}\!P_{m}$ since up to any $f$ columns can be perturbed (Liu et al., 2022) where ${}^{n}\!P_{m}=\frac{n!}{(n-m)!}$.
To alleviate this issue, we leverage the property that the output of the aggregator must be invariant to the order of columns in $H(x)$.
We thus exploit a specific neural network architecture which is permutation invariant to its inputs, as described below.

Robust DeepSet aggregator. Consider $\theta_{1}\in\mathbb{R}^{d_{1}}$ and $\theta_{2}\in\mathbb{R}^{d_{2}}$, and two mappings parameterized by these vectors: $\rho_{\theta_{1}}:\Delta^{K}\to\mathbb{R}^{p}$ and $\mu_{\theta_{2}}:\mathbb{R}^{p}\to\Delta^{K}$. Then, we define $\Psi$ by a set of parameterized mappings $\phi_{\theta}:(\Delta^{K})^{n}\to\Delta^{K}$ composed with the $\mathop{\mathrm{argmax}}$ operation, where $\theta=(\theta_{1},\theta_{2})$ and

$$ $\displaystyle\phi_{\theta}(\mathbf{z})\coloneqq\mu_{\theta_{2}}\left(\frac{1}{n}\sum_{i=1}^{n}\rho_{\theta_{1}}(z_{i})\right).$ (8) $$

This particular type of neural network is commonly known as DeepSet (Zaheer et al., 2017), in the case when there are no corruptions i.e.\xcomma$z_{i}=h_{i}(x),\forall i\in[n]$. Consequently, in this case, the RERM problem reduces to the following optimization problem:

$$ $\displaystyle\theta^{*}\in\mathop{\mathrm{argmin}}_{\theta\in\Theta}\frac{1}{\left\lvert\mathcal{D}_{\text{train}}\right\rvert}\sum_{(x,y)\in\mathcal{D}_{\text{train}}}\max_{\mathbf{z}\in\Gamma_{f}(x)}\mathds{1}\left\{\mathop{\mathrm{argmax}}_{k\in[K]}\left[\phi_{\theta}\left(z_{1},\ldots,z_{n}\right)\right]_{k}\neq y\right\}.$ (9) $$

Solving ([9](https://arxiv.org/html/2510.00310v2#S4.E9)) is still complex in practice due to the non-continuity of the indicator function.
We address this by changing the point-wise loss function from the indicator function to the cross-entropy loss function, denoted as $\ell(\phi_{\theta}\left(\mathbf{z}\right),y)$.
Finally, we still need to compute the maximum value of the point-wise loss at $(x,y)$ over all $\mathbf{z}\in\Gamma_{f}(x)$.
We address this challenge by approximating the maximum value of $\ell(\phi_{\theta}\left(\mathbf{z}\right),y)$ by searching over only a subset of $\mathbf{z}\in\Gamma_{f}(x)$.
Thanks to the permutation invariance property of DeepSet, the permutational cardinality of searching $f$ adversaries now reduces to $\sum_{m=1}^{f}\binom{n}{m}$ where $\binom{n}{m}=\frac{n!}{(n-m)!m!}$.
Specifically, in each training iteration, we select $m\leq f$ clients from the set $[n]$ to perturb their probits, repeated $N$ times.
We then obtain the perturbed probits and approximate maximum loss by using a multi-step variant of the fast gradient sign method (FGSM) for adversarial training (Madry et al., 2018).
The network parameters are then updated to correctly classify despite the perturbations.
In practice, we show that $N\ll\binom{n}{f}$ suffices to obtain a good approximation.
Our resulting algorithm is summarized in [Algorithm 1](https://arxiv.org/html/2510.00310v2#algorithm1).

Finally, we incorporate robust averaging
to further reduce the overall sensitivity of $\phi_{\theta^{*}}$ to probit corruptions. Specifically, with $\theta^{*}=(\theta^{*}_{1},\theta^{*}_{2})$, the robust DeepSet aggregator is defined as follows:

$$ $\displaystyle\psi_{\text{rob}}(\mathbf{z})\coloneqq\mathop{\mathrm{argmax}}_{k\in[K]}\left[\mu_{\theta_{2}^{*}}\left(\textsc{RobAvg}(\rho_{\theta^{*}_{1}}(z_{1}),\ldots,\rho_{\theta^{*}_{1}}(z_{n}))\right)\right]_{k}.$ (10) $$

Note that we only incorporate robust averaging at the inference time since incorporating at training time renders adversarial training more expensive due to the additional cost of RobAvg.

Figure: Algorithm 1 Training of DeepSet Aggregator $\phi_{\theta}$

## 5 Experiments

This section summarizes the key results of our experiments. In all that follows, we consider the RobAvg in the robust DeepSet aggregator ([10](https://arxiv.org/html/2510.00310v2#S4.E10)) to be CWTM, and we refer to the corresponding model as DeepSet-TM. We evaluate DeepSet-TM against robust aggregators like CWMed, against SOTA baselines, and perform a scalability study in [Section 5.2](https://arxiv.org/html/2510.00310v2#S5.SS2). We conduct an ablation study in [Section E.4](https://arxiv.org/html/2510.00310v2#A5.SS4), and a comparison with more adversarial defenses in [Section E.5](https://arxiv.org/html/2510.00310v2#A5.SS5).

### 5.1 Experimental Setup

Datasets.
We evaluate on CIFAR-10, CIFAR-100 (Krizhevsky, 2012), and AG-News (Zhang et al., 2015), covering vision and language tasks.
We reserve $10\%$ of training data as server-side validation data for aggregator training, and partition the rest
across clients using the Dirichlet distribution $\verb|Dir|_{n}(\alpha)$, in line with previous works (Roux et al., 2025; Dai et al., 2024).
Lower $\alpha$ indicates higher heterogeneity.
We experiment with $\alpha=\{0.3,0.5,0.8\}$.
In most of our evaluations, we consider $n=17$ following prior work (Allouah et al., 2023), except for our scalability study where we vary $n=\{10,17,25\}$.
Our choice of number of clients is inline with a typical cross-silo federated setting in real-world (Ogier du Terrail et al., 2022).

Models.
For CIFAR-10, clients train a ResNet-8 from scratch (He et al., 2016), while for CIFAR-100 and AG-News they fine-tune a ViT-B/32 (Dosovitskiy et al., 2021; Radford et al., 2021) and a DistilBERT (Sanh et al., 2019), respectively.
The DeepSet functions $\mu$ and $\rho$ are each two-layer MLPs with a ReLU non-linearity.
The AutoEncoder in CoPur consists of two-layer MLP encoders and decoders with a leaky ReLU, while the server model is a three-layer MLP (Liu et al., 2022).

Attacks. We evaluate on a total of $6$ attacks with varying difficulties depending upon the power of adversary.
We consider $4$ white-box and $2$ black-box attacks where the former assumes access to the server’s aggregation model.
We propose a new attack called SIA, in the white-box as well as the black-box setting which tries to flip the aggregation decision by exploiting the second most probable class.
The remaining attacks constitute the Logit Flipping Attack, Loss Maximization Attack (LMA), Class Prior Attack (CPA) and the Projected Gradient Descent (PGD) attack presented in prior work (Roux et al., 2025; Liu et al., 2022).
All attacks and their characteristics are detailed in [Section D.2](https://arxiv.org/html/2510.00310v2#A4.SS2), and summarized in [Table 4](https://arxiv.org/html/2510.00310v2#A4.T4) within.
We vary $f\in\{3,4,5\}$ across different setups.

Baselines. We compare the performance of DeepSet against several robust aggregators including CWTM (Yin et al., 2018), GM (Pillutla et al., 2022; Small, 1990) and CWMed (Yin et al., 2018) alongside simple averaging.
As the data-dependent baselines, we consider CoPur and manifold projection from Liu et al. (2022) where the latter simply projects the input probits onto a learned manifold using an AutoEncoder.
Additionally, we also report the performance of non-adversarially trained DeepSet model in our study of robust elements ([Section E.4](https://arxiv.org/html/2510.00310v2#A5.SS4)).

Reproducibility and reusability. We conduct each experiment with five random seeds, and report the mean and the standard deviation.
All details on the experimental setup and hyperparameters are included in [Appendix D](https://arxiv.org/html/2510.00310v2#A4).
All clean accuracy values (i.e.\xcommafor $f=0$) are reported in [Tables 11](https://arxiv.org/html/2510.00310v2#A5.T11) and [12](https://arxiv.org/html/2510.00310v2#A5.T12).

### 5.2 Results

**Table 2: Accuracy (%) of DeepSet-TM against static aggregations on the CIFAR-10, CIFAR-100 and AG-News datasets, with heterogeneity $\alpha=0.5$, $n=17$ clients and $f=4$ adversaries. Logit flipping uses an amplification factor of 2. Results with $\alpha=\{0.3,0.8\}$ are included in [Tables 6](https://arxiv.org/html/2510.00310v2#A5.T6) and [7](https://arxiv.org/html/2510.00310v2#A5.T7) and accuracy values in the no adversary case ($f=0$) are included in [Table 11](https://arxiv.org/html/2510.00310v2#A5.T11).**
|  | Aggregation | Logit flipping | SIA-bb | LMA | CPA | SIA | PGD-cw | Worst case |
| --- | --- | --- | --- | --- | --- | --- | --- | --- |
| CF-10 | Mean | $65.4\pm 2.1$ | $59.8\pm 1.1$ | $58.7\pm 3.2$ | $55.6\pm 4.0$ | $42.7\pm 3.9$ | $24.6\pm 4.9$ | $24.6\pm 4.9$ |
| CWMed | $56.7\pm 4.3$ | $53.3\pm 2.0$ | $53.8\pm 2.5$ | $52.3\pm 2.9$ | $49.3\pm 3.2$ | $27.8\pm 4.7$ | $27.8\pm 4.7$ |  |
| GM | $63.9\pm 2.3$ | $59.1\pm 1.4$ | $\mathbf{63.3\pm 2.3}$ | $\mathbf{59.7\pm 3.2}$ | $45.3\pm 3.7$ | $25.4\pm 4.8$ | $25.4\pm 4.8$ |  |
| CWTM | $63.3\pm 2.7$ | $59.4\pm 1.3$ | $62.5\pm 2.7$ | $\mathbf{59.7\pm 3.2}$ | $44.8\pm 3.7$ | $27.2\pm 5.1$ | $27.2\pm 5.1$ |  |
| DeepSet-TM | $\mathbf{67.6\pm 0.8}$ | $\mathbf{62.6\pm 1.6}$ | $61.0\pm 4.4$ | $59.4\pm 4.7$ | $\mathbf{51.4\pm 2.2}$ | $\mathbf{48.2\pm 4.2}$ | $48.2\pm 4.2$ |  |
| CF-100 | Mean | $\mathbf{78.8\pm 0.7}$ | $72.8\pm 1.0$ | $66.6\pm 0.3$ | $66.4\pm 0.3$ | $56.0\pm 1.0$ | $39.2\pm 1.2$ | $39.3\pm 1.3$ |
| CWMed | $65.8\pm 1.3$ | $62.3\pm 1.1$ | $66.1\pm 1.2$ | $66.1\pm 1.2$ | $62.9\pm 1.1$ | $41.7\pm 1.3$ | $41.7\pm 1.3$ |  |
| GM | $75.4\pm 0.9$ | $71.5\pm 1.3$ | $75.4\pm 0.8$ | $75.3\pm 0.8$ | $59.6\pm 1.0$ | $39.0\pm 1.3$ | $39.0\pm 1.3$ |  |
| CWTM | $74.8\pm 1.2$ | $71.5\pm 1.3$ | $74.9\pm 1.1$ | $74.8\pm 1.0$ | $60.8\pm 0.9$ | $44.9\pm 1.3$ | $44.9\pm 1.3$ |  |
| DeepSet-TM | $78.0\pm 0.3$ | $\mathbf{74.7\pm 0.8}$ | $\mathbf{76.0\pm 0.2}$ | $\mathbf{76.4\pm 0.5}$ | $\mathbf{63.7\pm 0.5}$ | $\mathbf{49.6\pm 0.5}$ | $49.6\pm 0.5$ |  |
| AG-News | Mean | $84.5\pm 0.9$ | $81.4\pm 2.2$ | $\mathbf{81.2\pm 2.2}$ | $76.4\pm 4.0$ | $72.6\pm 4.6$ | $54.9\pm 6.7$ | $54.9\pm 6.7$ |
| CWMed | $78.9\pm 3.0$ | $78.4\pm 3.7$ | $75.9\pm 5.0$ | $74.1\pm 4.5$ | $74.4\pm 4.4$ | $53.2\pm 7.0$ | $53.2\pm 7.0$ |  |
| GM | $83.0\pm 0.7$ | $80.7\pm 2.8$ | $80.9\pm 2.5$ | $76.6\pm 3.6$ | $74.0\pm 3.8$ | $52.6\pm 7.3$ | $52.6\pm 7.3$ |  |
| CWTM | $84.3\pm 1.0$ | $81.4\pm 2.2$ | $80.2\pm 2.7$ | $76.4\pm 4.0$ | $72.6\pm 4.6$ | $55.3\pm 7.5$ | $55.3\pm 7.5$ |  |
| DeepSet-TM | $\mathbf{85.7\pm 0.4}$ | $\mathbf{81.6\pm 1.6}$ | $79.2\pm 1.3$ | $\mathbf{77.5\pm 1.2}$ | $\mathbf{80.1\pm 1.6}$ | $\mathbf{83.2\pm 1.4}$ | $77.5\pm 1.2$ |  |

Performance comparison to Robust Aggregators. Across all datasets in [Table 2](https://arxiv.org/html/2510.00310v2#S5.T2), DeepSet-TM achieves substantially higher worst-case accuracy (minimum accuracy across attacks) than the robust aggregation baselines. Specifically, it improves over the strongest baseline by +4.7 to +22.2 percentage points depending on the dataset, demonstrating robustness even under the most challenging adversarial conditions. Beyond worst-case performance, DeepSet-TM also shows consistent gains across attacks: in 14 out of 18 dataset–attack combinations, it achieves the highest accuracy, with only small drops ($\leq 2.3\%$ points) in the remaining four cases.
The advantage of DeepSet-TM is particularly pronounced against stronger attacks (specifically SIA whitebox and PGD-cw). On CIFAR-10 and CIFAR-100, baseline accuracy drops by 35-40 points, while our approach limits the drop to 20-30. On AG-News, DeepSet-TM retains 83.2% accuracy under PGD-cw compared to 53-55% for the baselines. Notably, as we are working in probit space, giving more power to the adversary (i.e. conducting more PGD iterations during testing than for training) does not lead to performance degradation (see [Table 10](https://arxiv.org/html/2510.00310v2#A5.T10) in appendix).

Figure: Figure 2: DeepSet-TM vs. baselines under $\alpha=0.5$ and $n=17$ clients. In column 1, we have $f=1$ adversary; other columns use amplification factor $2$. See [Figure 4](https://arxiv.org/html/2510.00310v2#A5.F4) (App. [E.6](https://arxiv.org/html/2510.00310v2#A5.SS6)) for results with $\alpha=0.3$.
Refer to caption: x2.png

**Table 3: Scalability study on the CIFAR-100 dataset under $\alpha=0.3$.**
| $n$ | $f$ | Aggregation | Logit flipping | SIA-bb | LMA | CPA | SIA-wb | PGD-cw | Worst case |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| $10$ | $3$ | Mean | $\mathbf{75.1\pm 1.3}$ | $63.2\pm 2.5$ | $42.5\pm 2.9$ | $42.2\pm 2.8$ | $44.3\pm 1.7$ | $19.7\pm 2.2$ | $19.7\pm 2.2$ |
| CWMed | $45.6\pm 2.7$ | $44.5\pm 2.2$ | $52.4\pm 1.6$ | $50.9\pm 1.8$ | $50.5\pm 2.0$ | $16.5\pm 2.3$ | $16.5\pm 2.3$ |  |  |
| GM | $69.6\pm 1.3$ | $61.3\pm 1.6$ | $\mathbf{62.6\pm 2.2}$ | $\mathbf{62.2\pm 2.1}$ | $47.3\pm 1.5$ | $18.3\pm 2.6$ | $18.3\pm 2.6$ |  |  |
| CWTM | $69.5\pm 1.3$ | $62.4\pm 2.1$ | $45.2\pm 2.9$ | $44.9\pm 2.8$ | $46.4\pm 1.6$ | $24.0\pm 2.0$ | $24.0\pm 2.0$ |  |  |
| DeepSet-TM | $73.5\pm 1.3$ | $\mathbf{66.8\pm 2.0}$ | $56.3\pm 2.0$ | $60.0\pm 1.0$ | $\mathbf{56.5\pm 1.8}$ | $\mathbf{33.2\pm 2.5}$ | $33.2\pm 2.5$ |  |  |
| $17$ | $4$ | Mean | $75.6\pm 0.7$ | $69.1\pm 0.8$ | $57.0\pm 2.4$ | $56.8\pm 2.4$ | $44.5\pm 1.4$ | $25.8\pm 2.8$ | $25.8\pm 2.8$ |
| CWMed | $55.1\pm 2.1$ | $51.8\pm 2.6$ | $55.9\pm 2.2$ | $55.8\pm 2.2$ | $50.7\pm 1.8$ | $24.5\pm 1.9$ | $24.5\pm 1.9$ |  |  |
| GM | $71.2\pm 0.8$ | $66.3\pm 1.1$ | $70.2\pm 0.8$ | $70.0\pm 0.9$ | $48.3\pm 1.5$ | $23.8\pm 2.6$ | $23.8\pm 2.6$ |  |  |
| CWTM | $69.1\pm 1.1$ | $65.8\pm 1.2$ | $69.1\pm 1.2$ | $69.1\pm 1.2$ | $49.6\pm 1.1$ | $32.5\pm 2.4$ | $32.5\pm 2.4$ |  |  |
| DeepSet-TM | $\mathbf{75.7\pm 0.8}$ | $\mathbf{71.9\pm 1.1}$ | $7\mathbf{2.2\pm 1.9}$ | $\mathbf{72.5\pm 0.6}$ | $\mathbf{56.7\pm 1.0}$ | $\mathbf{38.6\pm 2.5}$ | $38.6\pm 2.5$ |  |  |
| $25$ | $5$ | Mean | $\mathbf{76.0\pm 1.1}$ | $71.1\pm 1.3$ | $59.7\pm 2.3$ | $59.4\pm 2.3$ | $40.1\pm 2.3$ | $24.1\pm 2.0$ | $24.1\pm 2.0$ |
| CWMed | $51.7\pm 2.9$ | $49.2\pm 2.0$ | $52.1\pm 2.3$ | $52.0\pm 2.3$ | $44.9\pm 1.8$ | $20.6\pm 2.9$ | $20.6\pm 2.9$ |  |  |
| GM | $70.8\pm 1.4$ | $67.3\pm 1.1$ | $\mathbf{70.7\pm 1.5}$ | $\mathbf{70.5\pm 1.5}$ | $44.2\pm 1.9$ | $21.3\pm 2.0$ | $21.3\pm 2.0$ |  |  |
| CWTM | $70.1\pm 1.7$ | $67.7\pm 1.4$ | $70.1\pm 1.7$ | $70.1\pm 1.7$ | $45.8\pm 2.0$ | $30.4\pm 2.2$ | $30.4\pm 2.2$ |  |  |
| DeepSet-TM | $72.8\pm 1.1$ | $\mathbf{72.8\pm 1.2}$ | $65.7\pm 2.3$ | $69.6\pm 1.6$ | $\mathbf{53.8\pm 1.5}$ | $\mathbf{50.7\pm 1.5}$ | $50.7\pm 1.5$ |  |  |

Performance comparison with SOTA baselines.
We compare DeepSet-TM with CoPur and manifold projection in [Figure 2](https://arxiv.org/html/2510.00310v2#S5.F2). Since CoPur operates in logit rather than probit space, it is highly sensitive to input magnitudes, leading to sharp performance degradation under even mild attacks. For instance, in the logit-flipping attack, increasing amplification from $1$ to $16$ or raising the number of adversarial clients from $1$ to $4$ reduces CoPur ’s accuracy on CIFAR-10 nearly to random chance, while DeepSet-TM remains stable due to its probit-space design and adversarial training. A similar trend holds under the SIA attack, where CoPur suffers large drops on CIFAR-10 and AG-News, though it shows relative robustness on CIFAR-100.
This is likely because CoPur leverages block-sparse structure of input probits where higher number of classes induce more sparsity, increasing its effectiveness.
Manifold projection performs even worse, as its autoencoder struggles with adversarial patterns spread across many classes. In contrast, DeepSet-TM consistently achieves substantially higher accuracy across all attacks, with only a minor accuracy loss in the no-adversary case ($f=0$), a known trade-off from adversarial training (Madry et al., 2018).

Scalability study.
To assess the generalizability of our approach, we conduct performance evaluations with varying the number of clients: $(n,f)\in\{(10,3),(17,4),(25,5)\}$ on CIFAR-100 under high heterogeneity ($\alpha=0.3$).
In [Table 3](https://arxiv.org/html/2510.00310v2#S5.T3), we observe that DeepSet-TM consistently provides the highest robustness as the system scales. It improves worst-case accuracy over the best baseline by 9.2%, 6.1% and 20.3% points respectively when increasing $n$ and $f$.
Beyond worst-case performance, DeepSet-TM notably achieves the highest performance in 12 out of 18 dataset–attack combinations.
While static aggregations occasionally remain competitive on milder attacks (e.g.\xcommaLMA), DeepSet-TM is never substantially worse and typically remains close to the highest accuracy across most scenarios.

## 6 Conclusion

We formalized the problem of robust federated inference and derived a certification for robust averaging under adversarial corruptions. For non-linear aggregation, we proposed DeepSet-TM, a permutation-invariant neural network trained adversarially and combined at test-time with robust averaging. Our experiments demonstrate that DeepSet-TM consistently improves accuracy across datasets and attack types, substantially outperforming prior methods.

#### Acknowledgments

Rafael is partially supported by the French National Research Agency and the French Ministry of Research and Higher Education. The joint work of Nirupam and Rafael is also supported in part by the CNRS through the International Emerging Action (IEA) program.

## References

- Alistarh et al. (2018)
Dan Alistarh, Zeyuan Allen-Zhu, and Jerry Li.
Byzantine stochastic gradient descent.
In *Proceedings of the 32nd International Conference on Neural
Information Processing Systems*, pp. 4618–4628, 2018.
- Allouah et al. (2023)
Youssef Allouah, Sadegh Farhadkhani, Rachid Guerraoui, Nirupam Gupta, Rafael
Pinot, and John Stephan.
Fixing by mixing: A recipe for optimal byzantine ml under
heterogeneity.
In Francisco Ruiz, Jennifer Dy, and Jan-Willem van de Meent (eds.),
*Proceedings of The 26th International Conference on Artificial
Intelligence and Statistics*, volume 206 of *Proceedings of Machine
Learning Research*, pp. 1232–1300. PMLR, 04 2023.
URL [https://proceedings.mlr.press/v206/allouah23a.html](https://proceedings.mlr.press/v206/allouah23a.html).
- Allouah et al. (2024a)
Youssef Allouah, Akash Dhasade, Rachid Guerraoui, Nirupam Gupta, Anne-Marie
Kermarrec, Rafael Pinot, Rafael Pires, and Rishi Sharma.
Revisiting ensembling in one-shot federated learning.
In *The Thirty-eighth Annual Conference on Neural Information
Processing Systems*, 2024a.
URL [https://openreview.net/forum?id=7rWTS2wuYX](https://openreview.net/forum?id=7rWTS2wuYX).
- Allouah et al. (2024b)
Youssef Allouah, Rachid Guerraoui, Lê-Nguyên Hoang, and Oscar
Villemaud.
Robust sparse voting.
In Sanjoy Dasgupta, Stephan Mandt, and Yingzhen Li (eds.),
*Proceedings of The 27th International Conference on Artificial
Intelligence and Statistics*, volume 238 of *Proceedings of Machine
Learning Research*, pp. 991–999. PMLR, 02–04 May 2024b.
URL [https://proceedings.mlr.press/v238/allouah24a.html](https://proceedings.mlr.press/v238/allouah24a.html).
- Cao et al. (2022)
Xiaoyu Cao, Zaixi Zhang, Jinyuan Jia, and Neil Zhenqiang Gong.
Flcert: Provably secure federated learning against poisoning attacks.
*Trans. Info. For. Sec.*, 17:3691–3705, January
2022.
ISSN 1556-6013.
doi: 10.1109/TIFS.2022.3212174.
URL [https://doi.org/10.1109/TIFS.2022.3212174](https://doi.org/10.1109/TIFS.2022.3212174).
- Carlini & Wagner (2017)
Nicholas Carlini and David Wagner.
Towards evaluating the robustness of neural networks.
In *2017 IEEE Symposium on Security and Privacy (SP)*, pp. 39–57, 2017.
doi: 10.1109/SP.2017.49.
- Chen et al. (2017)
Yudong Chen, Lili Su, and Jiaming Xu.
Distributed statistical machine learning in adversarial settings:
Byzantine gradient descent.
*Proceedings of the ACM on Measurement and Analysis of Computing
Systems*, 1(2):1–25, 2017.
- Chu & Laoutaris (2024)
Tianyue Chu and Nikolaos Laoutaris.
Fedqv: Leveraging quadratic voting in federated learning.
*SIGMETRICS Perform. Eval. Rev.*, 52(1):91–92, June 2024.
ISSN 0163-5999.
doi: 10.1145/3673660.3655055.
URL [https://doi.org/10.1145/3673660.3655055](https://doi.org/10.1145/3673660.3655055).
- Dai et al. (2024)
Rong Dai, Yonggang Zhang, Ang Li, Tongliang Liu, Xun Yang, and Bo Han.
Enhancing one-shot federated learning through data and ensemble
co-boosting.
In *The Twelfth International Conference on Learning
Representations*, 2024.
URL [https://openreview.net/forum?id=tm8s3696Ox](https://openreview.net/forum?id=tm8s3696Ox).
- Datar et al. (2022)
Arnhav Datar, Arun Rajkumar, and John Augustine.
Byzantine spectral ranking.
In S. Koyejo, S. Mohamed, A. Agarwal, D. Belgrave, K. Cho, and A. Oh
(eds.), *Advances in Neural Information Processing Systems*, volume 35,
pp. 27745–27756. Curran Associates, Inc., 2022.
URL
[https://proceedings.neurips.cc/paper_files/paper/2022/file/b1f7288854d3bd476c17725c2d85967f-Paper-Conference.pdf](https://proceedings.neurips.cc/paper_files/paper/2022/file/b1f7288854d3bd476c17725c2d85967f-Paper-Conference.pdf).
- Diakonikolas & Kane (2023)
Ilias Diakonikolas and Daniel M Kane.
*Algorithmic high-dimensional robust statistics*.
Cambridge university press, 2023.
- Diao et al. (2023)
Yiqun Diao, Qinbin Li, and Bingsheng He.
Towards addressing label skews in one-shot federated learning.
In *International Conference on Learning Representations*, 2023.
URL [https://openreview.net/forum?id=rzrqh85f4Sc](https://openreview.net/forum?id=rzrqh85f4Sc).
- Dorfman et al. (2024)
Ron Dorfman, Naseem Amin Yehya, and Kfir Yehuda Levy.
Dynamic Byzantine-robust learning: Adapting to switching
Byzantine workers.
In Ruslan Salakhutdinov, Zico Kolter, Katherine Heller, Adrian
Weller, Nuria Oliver, Jonathan Scarlett, and Felix Berkenkamp (eds.),
*Proceedings of the 41st International Conference on Machine Learning*,
volume 235 of *Proceedings of Machine Learning Research*, pp. 11501–11543. PMLR, 21–27 Jul 2024.
URL [https://proceedings.mlr.press/v235/dorfman24a.html](https://proceedings.mlr.press/v235/dorfman24a.html).
- Dosovitskiy et al. (2021)
Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn,
Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg
Heigold, Sylvain Gelly, Jakob Uszkoreit, and Neil Houlsby.
An image is worth 16x16 words: Transformers for image recognition at
scale.
In *International Conference on Learning Representations*, 2021.
URL [https://openreview.net/forum?id=YicbFdNTTy](https://openreview.net/forum?id=YicbFdNTTy).
- Fan et al. (2023)
Dongyang Fan, Celestine Mendler-Dünner, and Martin Jaggi.
Collaborative learning via prediction consensus.
In *Thirty-seventh Conference on Neural Information Processing
Systems*, 2023.
URL [https://openreview.net/forum?id=SGKbHXoLCI](https://openreview.net/forum?id=SGKbHXoLCI).
- Farhadkhani et al. (2022)
Sadegh Farhadkhani, Rachid Guerraoui, Nirupam Gupta, Rafael Pinot, and John
Stephan.
Byzantine machine learning made easy by resilient averaging of
momentums.
In *International Conference on Machine Learning*, pp. 6246–6283. PMLR, 2022.
- Gong et al. (2022)
Xuan Gong, Abhishek Sharma, Srikrishna Karanam, Ziyan Wu, Terrence Chen, David
Doermann, and Arun Innanje.
Preserving privacy in federated learning with ensemble cross-domain
knowledge distillation.
In *Proceedings of the AAAI Conference on Artificial
Intelligence*, volume 36, pp. 11891–11899, 2022.
- Goodfellow et al. (2014)
Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy.
Explaining and harnessing adversarial examples.
*arXiv preprint arXiv:1412.6572*, 2014.
- Guerraoui et al. (2024)
Rachid Guerraoui, Nirupam Gupta, and Rafael Pinot.
*Robust Machine Learning*.
Springer, 2024.
- Guha et al. (2019)
Neel Guha, Ameet Talwalkar, and Virginia Smith.
One-shot federated learning.
*arXiv preprint arXiv:1902.11175*, 2019.
- Hamer et al. (2020)
Jenny Hamer, Mehryar Mohri, and Ananda Theertha Suresh.
Fedboost: A communication-efficient algorithm for federated learning.
In *International Conference on Machine Learning*, pp. 3973–3983. PMLR, 2020.
- He et al. (2016)
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun.
Deep residual learning for image recognition.
In *2016 IEEE Conference on Computer Vision and Pattern
Recognition (CVPR)*, pp. 770–778, 2016.
doi: 10.1109/CVPR.2016.90.
- Jiang et al. (2023)
Dongfu Jiang, Xiang Ren, and Bill Yuchen Lin.
LLM-blender: Ensembling large language models with pairwise ranking
and generative fusion.
In Anna Rogers, Jordan Boyd-Graber, and Naoaki Okazaki (eds.),
*Proceedings of the 61st Annual Meeting of the Association for
Computational Linguistics (Volume 1: Long Papers)*, pp. 14165–14178,
Toronto, Canada, July 2023. Association for Computational Linguistics.
doi: 10.18653/v1/2023.acl-long.792.
URL [https://aclanthology.org/2023.acl-long.792/](https://aclanthology.org/2023.acl-long.792/).
- Krizhevsky (2012)
Alex Krizhevsky.
Learning multiple layers of features from tiny images.
*University of Toronto*, 05 2012.
- Levine & Feizi (2020)
Alexander Levine and Soheil Feizi.
Robustness certificates for sparse adversarial attacks by randomized
ablation.
*Proceedings of the AAAI Conference on Artificial Intelligence*,
34(04):4585–4593, Apr. 2020.
doi: 10.1609/aaai.v34i04.5888.
URL [https://ojs.aaai.org/index.php/AAAI/article/view/5888](https://ojs.aaai.org/index.php/AAAI/article/view/5888).
- Li et al. (2021)
Qinbin Li, Bingsheng He, and Dawn Song.
Practical one-shot federated learning for cross-silo setting.
In Zhi-Hua Zhou (ed.), *Proceedings of the Thirtieth
International Joint Conference on Artificial Intelligence, IJCAI-21*, pp. 1484–1490. International Joint Conferences on Artificial Intelligence
Organization, 8 2021.
doi: 10.24963/ijcai.2021/205.
URL [https://doi.org/10.24963/ijcai.2021/205](https://doi.org/10.24963/ijcai.2021/205).
Main Track.
- Li et al. (2024)
Wenrui Li, Hanlin Gu, Sheng Wan, Zhirong Luan, Wei Xi, Lixin Fan, Qiang Yang,
and Badong Chen.
Byzantine robust aggregation in federated distillation with
adversaries.
In *2024 IEEE 44th International Conference on Distributed
Computing Systems (ICDCS)*, pp. 881–890, 2024.
doi: 10.1109/ICDCS60910.2024.00086.
- Liu et al. (2022)
Jing Liu, Chulin Xie, Oluwasanmi O Koyejo, and Bo Li.
Copur: Certifiably robust collaborative inference via feature
purification.
In Alice H. Oh, Alekh Agarwal, Danielle Belgrave, and Kyunghyun Cho
(eds.), *Advances in Neural Information Processing Systems*, 2022.
URL [https://openreview.net/forum?id=r5rzV51GZx](https://openreview.net/forum?id=r5rzV51GZx).
- Madry et al. (2018)
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and
Adrian Vladu.
Towards deep learning models resistant to adversarial attacks.
In *International Conference on Learning Representations*, 2018.
URL [https://openreview.net/forum?id=rJzIBfZAb](https://openreview.net/forum?id=rJzIBfZAb).
- Malka et al. (2025)
May Malka, Erez Farhan, Hai Morgenstern, and Nir Shlezinger.
Decentralized low-latency collaborative inference via ensembles on
the edge.
*IEEE Transactions on Wireless Communications*, 24(1):598–614, 2025.
doi: 10.1109/TWC.2024.3497167.
- Melnyk et al. (2018)
Darya Melnyk, Yuyi Wang, and Roger Wattenhofer.
Byzantine preferential voting.
In George Christodoulou and Tobias Harks (eds.), *Web and
Internet Economics*, pp. 327–340, Cham, 2018. Springer International
Publishing.
ISBN 978-3-030-04612-5.
- Mi et al. (2021)
Yuxi Mi, Yutong Mu, Shuigeng Zhou, and Jihong Guan.
Fedmdr: Federated model distillation with robust aggregation.
In *Asia-Pacific Web (APWeb) and Web-Age Information Management
(WAIM) Joint International Conference on Web and Big Data*, pp. 18–32.
Springer, 2021.
- Ogier du Terrail et al. (2022)
Jean Ogier du Terrail, Samy-Safwan Ayed, Edwige Cyffers, Felix Grimberg,
Chaoyang He, Regis Loeb, Paul Mangold, Tanguy Marchand, Othmane Marfoq, Erum
Mushtaq, et al.
Flamby: Datasets and benchmarks for cross-silo federated learning in
realistic healthcare settings.
*Advances in Neural Information Processing Systems*,
35:5315–5334, 2022.
- Pillutla et al. (2022)
Krishna Pillutla, Sham M Kakade, and Zaid Harchaoui.
Robust aggregation for federated learning.
*IEEE Transactions on Signal Processing*, 70:1142–1154, 2022.
- Radford et al. (2021)
Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh,
Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark,
Gretchen Krueger, and Ilya Sutskever.
Learning transferable visual models from natural language
supervision.
In Marina Meila and Tong Zhang (eds.), *Proceedings of the 38th
International Conference on Machine Learning*, volume 139 of
*Proceedings of Machine Learning Research*, pp. 8748–8763. PMLR,
18–24 Jul 2021.
URL [https://proceedings.mlr.press/v139/radford21a.html](https://proceedings.mlr.press/v139/radford21a.html).
- Roux et al. (2025)
Christophe Roux, Max Zimmer, and Sebastian Pokutta.
On the byzantine-resilience of distillation-based federated learning.
In *The Thirteenth International Conference on Learning
Representations*, 2025.
URL [https://openreview.net/forum?id=of6EuHT7de](https://openreview.net/forum?id=of6EuHT7de).
- Sanh et al. (2019)
Victor Sanh, Lysandre Debut, Julien Chaumond, and Thomas Wolf.
Distilbert, a distilled version of bert: smaller, faster, cheaper and
lighter.
*ArXiv preprint*, abs/1910.01108, 2019.
- Sattler et al. (2021)
Felix Sattler, Arturo Marban, Roman Rischke, and Wojciech Samek.
Cfd: Communication-efficient federated distillation via soft-label
quantization and delta coding.
*IEEE Transactions on Network Science and Engineering*,
9(4):2025–2038, 2021.
- Shlezinger et al. (2021)
Nir Shlezinger, Erez Farhan, Hai Morgenstern, and Yonina C. Eldar.
Collaborative inference via ensembles on the edge.
In *ICASSP 2021 - 2021 IEEE International Conference on
Acoustics, Speech and Signal Processing (ICASSP)*, pp. 8478–8482, 2021.
doi: 10.1109/ICASSP39728.2021.9414740.
- Small (1990)
Christopher G Small.
A survey of multidimensional medians.
*International Statistical Review/Revue Internationale de
Statistique*, pp. 263–277, 1990.
- Tekin et al. (2024)
Selim Furkan Tekin, Fatih Ilhan, Tiansheng Huang, Sihao Hu, and Ling Liu.
LLM-TOPLA: Efficient LLM ensemble by maximising diversity.
In Yaser Al-Onaizan, Mohit Bansal, and Yun-Nung Chen (eds.),
*Findings of the Association for Computational Linguistics: EMNLP 2024*,
pp. 11951–11966, Miami, Florida, USA, November 2024. Association for
Computational Linguistics.
doi: 10.18653/v1/2024.findings-emnlp.698.
URL [https://aclanthology.org/2024.findings-emnlp.698/](https://aclanthology.org/2024.findings-emnlp.698/).
- Wang et al. (2024)
Hongyi Wang, Felipe Maia Polo, Yuekai Sun, Souvik Kundu, Eric Xing, and Mikhail
Yurochkin.
Fusing models with complementary expertise.
In *The Twelfth International Conference on Learning
Representations*, 2024.
URL [https://openreview.net/forum?id=PhMrGCMIRL](https://openreview.net/forum?id=PhMrGCMIRL).
- Yin et al. (2018)
Dong Yin, Yudong Chen, Ramchandran Kannan, and Peter Bartlett.
Byzantine-robust distributed learning: Towards optimal statistical
rates.
In *International conference on machine learning*, pp. 5650–5659. Pmlr, 2018.
- Zaheer et al. (2017)
Manzil Zaheer, Satwik Kottur, Siamak Ravanbakhsh, Barnabas Poczos, Russ R
Salakhutdinov, and Alexander J Smola.
Deep sets.
In I. Guyon, U. Von Luxburg, S. Bengio, H. Wallach, R. Fergus,
S. Vishwanathan, and R. Garnett (eds.), *Advances in Neural Information
Processing Systems*, volume 30. Curran Associates, Inc., 2017.
URL
[https://proceedings.neurips.cc/paper_files/paper/2017/file/f22e4747da1aa27e363d86d40ff442fe-Paper.pdf](https://proceedings.neurips.cc/paper_files/paper/2017/file/f22e4747da1aa27e363d86d40ff442fe-Paper.pdf).
- Zhang et al. (2022)
Jie Zhang, Chen Chen, Bo Li, Lingjuan Lyu, Shuang Wu, Shouhong Ding, Chunhua
Shen, and Chao Wu.
DENSE: Data-free one-shot federated learning.
In Alice H. Oh, Alekh Agarwal, Danielle Belgrave, and Kyunghyun Cho
(eds.), *Advances in Neural Information Processing Systems*, 2022.
URL [https://openreview.net/forum?id=QFQoxCFYEkA](https://openreview.net/forum?id=QFQoxCFYEkA).
- Zhang et al. (2015)
Xiang Zhang, Junbo Zhao, and Yann LeCun.
Character-level convolutional networks for text classification.
In *Proceedings of the 29th International Conference on Neural
Information Processing Systems - Volume 1*, NIPS’15, pp. 649–657,
Cambridge, MA, USA, 2015. MIT Press.

## Appendix A Proof of Section 2

We restate [Section 2](https://arxiv.org/html/2510.00310v2#S2) for convenience and then prove it below.

*

###### Proof.

We can decompose the robust ensemble risk ([3](https://arxiv.org/html/2510.00310v2#S2.E3)) for an aggregator $\psi_{\text{rob}}$ as follows:

$$ $\displaystyle\mathcal{R}_{\text{adv}}(\psi_{\text{rob}})=\mathcal{R}(\psi_{\text{o}})+\mathbb{E}_{(x,y)\sim\mathcal{D}}\left[\text{Gap}(x,y\mid\psi_{\text{o}},\psi_{\text{rob}})\right],$ (11) $$

where $\text{Gap}(x,y\mid\psi_{\text{o}},\psi_{\text{rob}})\coloneqq\ell^{\text{adv}}_{\psi_{\text{rob}}}(x,y)-\ell_{\psi_{\text{o}}}(x,y)$ .
Recall that we denote $\mathbf{h}(x)=(h_{1}(x),\ldots,h_{n}(x))$. Note that for any $x$ and any $\mathbf{z}=(z_{1},\dots,z_{n})\in(\Delta^{K})^{n}$, we have

$$ $\displaystyle\mathds{1}\left\{\psi_{\text{rob}}(\mathbf{z})\neq y\right\}-\mathds{1}\left\{\psi_{\text{o}}(\mathbf{h}(x))\neq y\right\}=\begin{cases}1&\text{if }\psi_{\text{o}}(\mathbf{h}(x))=y\text{ and }\psi_{\text{rob}}(\mathbf{z})\neq y,\\ -1&\text{if }\psi_{\text{o}}(\mathbf{h}(x))\neq y\text{ and }\psi_{\text{rob}}(\mathbf{z})=y,\\ 0&\text{otherwise}.\end{cases}$ $$

This implies that, for any $x$ and any $(z_{1},\dots,z_{n})\in(\Delta^{K})^{n}$,

$$ $\displaystyle\mathds{1}\left\{\psi_{\text{rob}}(\mathbf{z})\neq y\right\}-\mathds{1}\left\{\psi_{\text{o}}(\mathbf{h}(x))\neq y\right\}\leq\mathds{1}\left\{\psi_{\text{rob}}(\mathbf{z})\neq\psi_{\text{o}}(\mathbf{h}(x))\right\}.$ $$

Therefore, for any $x$,

$$ $\displaystyle\max_{\mathbf{z}\in\Gamma_{f}(x)}\mathds{1}\left\{\psi_{\text{rob}}(\mathbf{z})\neq y\right\}-\mathds{1}\left\{\psi_{\text{o}}(\mathbf{h}(x))\neq y\right\}\leq\max_{\mathbf{z}\in\Gamma_{f}(x)}\mathds{1}\left\{\psi_{\text{rob}}(\mathbf{z})\neq\psi_{\text{o}}(\mathbf{h}(x))\right\}.$ $$

Substituting from above in ([11](https://arxiv.org/html/2510.00310v2#A1.E11)) concludes the proof.
∎

###### Proof.

## Appendix B Proof of Definition 1

We decompose the proof of [Definition 1](https://arxiv.org/html/2510.00310v2#Thmdefinition1) into three steps for clarity purposes.

### B.1 Bounding the variance of a subset

We first state and prove a lemma that will guide us towards the proof of the main theorem.

###### Lemma 1 .

Let $v_{1},v_{2},\dots,v_{n}\in\mathbb{R}^{d}$ be a set of vectors. We denote by $\bar{v}_{n}=\tfrac{1}{n}\sum_{i=1}^{n}v_{i}$ the mean of these points. Let $S\subset[n]$ such that $|S|=n-f$, we denote by
$\bar{v}_{S}=\tfrac{1}{n-f}\sum_{i\in S}v_{i}$ the average of the vectors in $S$. Then the following holds true:

$$ $\tfrac{1}{n-f}\sum_{i\in S}\|v_{i}-\bar{v}_{S}\|^{2}\leq\tfrac{n}{n-f}\left(\tfrac{1}{n}\sum_{i=1}^{n}\|v_{i}-\bar{v}_{n}\|^{2}\right),$ $$

###### Proof.

Let $S\subset[n]$ such that $|S|=n-f$, and $T=[n]\backslash S$. We have

$$ $\displaystyle\sum_{i\in S}\|v_{i}-\bar{v}_{n}\|^{2}$ $\displaystyle=\sum_{i\in S}\|v_{i}-\bar{v}_{S}\|^{2}+\sum_{i\in S}\|\bar{v}_{S}-\bar{v}_{n}\|^{2}+2\sum_{i\in S}\langle v_{i}-\bar{v}_{S},\bar{v}_{S}-\bar{v}_{n}\rangle$ As, $\sum_{i\in S}\langle v_{i}-\bar{v}_{S},\bar{v}_{S}-\bar{v}_{n}\rangle=0$ , we get $\displaystyle\sum_{i\in S}\|v_{i}-\bar{v}_{n}\|^{2}$ $\displaystyle=(n-f)\,\zeta_{S}^{2}+(n-f)\|\bar{v}_{S}-\bar{v}_{n}\|^{2}$ $$

With $\zeta_{S}^{2}=\tfrac{1}{n-f}\sum_{i\in S}\|v_{i}-\bar{v}_{S}\|^{2}$. Similarly, we can show that

$$ $\sum_{i\in T}\|v_{i}-\bar{v}_{n}\|^{2}=f\,\zeta_{T}^{2}+f\|\bar{v}_{T}-\bar{v}_{n}\|^{2}.$ $$

From the above, we can simply rewrite

$$ $\displaystyle\sum_{i\in[n]}\|v_{i}-\bar{v}_{n}\|^{2}$ $\displaystyle=\sum_{i\in S}\|v_{i}-\bar{v}_{n}\|^{2}+\sum_{i\in T}\|v_{i}-\bar{v}_{n}\|^{2}$ $\displaystyle=(n-f)\,\zeta_{S}^{2}+(n-f)\|\bar{v}_{S}-\bar{v}_{n}\|^{2}+f\,\zeta_{T}^{2}+f\|\bar{v}_{T}-\bar{v}_{n}\|^{2}$ $$

Now we note that $\bar{v}_{n}=\tfrac{f\bar{v}_{T}+(n-f)\bar{v}_{S}}{n}$. Hence

$$ $\bar{v}_{S}-\bar{v}_{n}=\tfrac{f\left(\bar{v}_{S}-\bar{v}_{T}\right)}{n}~~~~~~~\text{and}~~~~~~~\bar{v}_{T}-\bar{v}_{n}=\tfrac{(n-f)\left(\bar{v}_{T}-\bar{v}_{S}\right)}{n.}$ $$

Substituting this in the above we get

$$ $\displaystyle\sum_{i\in[n]}\|v_{i}-\bar{v}_{n}\|^{2}$ $\displaystyle=(n-f)\,\zeta_{S}^{2}+\tfrac{(n-f)f^{2}}{n^{2}}\|\bar{v}_{S}-\bar{v}_{T}\|^{2}+f\,\zeta_{T}^{2}+\tfrac{(n-f)^{2}f}{n^{2}}\|\bar{v}_{T}-\bar{v}_{S}\|^{2}$ $\displaystyle=(n-f)\,\zeta_{S}^{2}+f\,\zeta_{T}^{2}+\tfrac{(n-f)f}{n}\|\bar{v}_{T}-\bar{v}_{S}\|^{2}$ $$

Simplifying the above and reorganizing the terms, we get

$$ $\tfrac{n}{n-f}\left(\tfrac{1}{n}\sum_{i\in[n]}\|v_{i}-\bar{v}_{n}\|^{2}\right)=\tfrac{1}{n-f}\sum_{i\in S}\|v_{i}-\bar{v}_{S}\|^{2}+\tfrac{f}{n-f}\,\zeta_{T}^{2}+\tfrac{f}{n}\|\bar{v}_{T}-\bar{v}_{S}\|^{2}.$ $$

As all the terms in the right-hand side are non-negative, the above concludes the proof.
∎

###### Lemma 1 .

###### Proof.

### B.2 Definition and properties of CWTM

As its name indicates, coordinate-wise trimmed mean, is based on a scalar protocol called trimmed mean. Given $n$ scalar values $v_{1},\ldots,\,v_{n}\in\mathbb{R}$, trimmed mean denoted by $\mathrm{TM}$, is defined to be

$$ $\displaystyle\mathrm{TM}\left(v_{1},\ldots,\,v_{n}\right)=\tfrac{1}{n-2f}\sum_{i=f+1}^{n-f}v_{(i)},$ (12) $$

where $v_{(i)},\cdots,v_{(n)}$ denote the order statistics of $v_{1},\cdots,v_{n}$, i.e., the sorting of the values in non-decreasing order (with ties broken arbitrarily)(^2^22More formally, let $\tau$ be the permutation on $[n]$ such that $v_{\tau(1)}\leq\cdots\leq v_{\tau(n)}$. The $i$-th order statistic of $v_{1},\cdots,v_{n}$ is simply $v_{(i)}=v_{\tau(i)}$ for all $i\in[n]$.). Using this primitive, we can define the coordinate-wise trimmed mean aggregation as follows. Given the input vectors $v_{1},\ldots,\,v_{n}\in\mathbb{R}^{d}$, the coordinate-wise trimmed mean of $v_{1},\ldots,\,v_{n}$, denoted by $\text{CWTM}(v_{1},\ldots,v_{n})$, is a vector in $\mathbb{R}^{d}$ whose $k$-th coordinate is defined as follows,

$$ $\left[\text{CWTM}(v_{1},\ldots,v_{n})\right]_{k}=\text{TM}([v_{1}]_{k},\ldots,[v_{n}]_{k}).$ $$

###### Definition 2 ( $(f,\kappa)$ -robustness).

Let $f<\tfrac{n}{2}$ and $\kappa\geq 0$. An aggregation rule RobAvg is said to be $(f,\kappa)$-robust if for any vectors $v_{1},\ldots,\,v_{n}\in\mathbb{R}^{d}$, and any set $S\subseteq[n]$ of size $n-f$,

$$ $\displaystyle\left\lVert\textsc{RobAvg}(v_{1},\ldots,\,v_{n})-\overline{v}_{S}\right\rVert^{2}\leq\tfrac{\kappa}{\left\lvert S\right\rvert}\sum_{i\in S}\left\lVert v_{i}-\overline{v}_{S}\right\rVert^{2}$ $$

where $\overline{v}_{S}=\tfrac{1}{\left\lvert S\right\rvert}\sum_{i\in S}v_{i}$. We refer to $\kappa$ as the robustness coefficient.

We will use the following lemma as part of the theorem proof. We refer to Allouah et al. (2023) for its proof.

###### Lemma 2 ( Allouah et al. ( 2023 ) ) .

Let $n\in\mathbb{N}^{*}$ and $f<\tfrac{n}{2}$. Then TM is $(f,\kappa)$-robust with $\kappa=\tfrac{6f}{n-2f}\,\left(1+\tfrac{f}{n-2f}\right)$.

###### Definition 2 ( ( f , κ ) (f,\kappa) -robustness).

###### Lemma 2 ( Allouah et al. ( 2023 ) ) .

### B.3 Proof of the theorem

Using the two lemmas presented above, we can now prove the main theorem, which we restate below for the reader’s convenience.

*

###### Proof.

Let us first recall that by definition

$$ $\ell^{\text{adv}}_{\psi_{\text{rob}}}(x,\hat{y}_{\text{o}})=\left\{\begin{array}[]{ll}0&\mbox{if }\psi_{\text{rob}}(\mathbf{z})=\hat{y}_{\text{o}},\forall\mathbf{z}\in\Gamma_{f}(x),\[6.0pt] 1&\mbox{otherwise.}\end{array}\right.$ $$

In particular, this means that

$$ $\mathbb{E}_{(x,y)\sim\mathcal{D}}\left[{\ell^{\text{adv}}_{\psi_{\text{rob}}}(x,\hat{y}_{\text{o}})}\right]=1-\mathbb{P}_{(x,y)\sim\mathcal{D}}\left[\psi_{\text{rob}}(\mathbf{z})=\hat{y}_{\text{o}},\forall\mathbf{z}\in\Gamma_{f}(x)\right].$ (13) $$

Now recall that, for any $x\in\mathcal{X}$, by definition

$$ $\hat{y}_{\text{o}}=\psi_{\text{o}}(\mathbf{h}(x)):=\mathop{\mathrm{argmax}}_{k\in[K]}\left[\bar{h}(x)\right]_{k},$ $$

where $\mathbf{h}(x)=(h_{1}(x),\dots,h_{n}(x))$. Furthermore, still by definition, we have

$$ $\psi_{\text{rob}}(\mathbf{z})=\mathop{\mathrm{argmax}}_{k\in[K]}\left[\text{CWTM}\left(\mathbf{z}\right)\right]_{k}\quad\forall\mathbf{z}\in\Gamma_{f}(x).$ $$

Hence, whenever $\overline{h}(x)$ has a unique maximum coordinate, to satisfy $\psi_{\text{rob}}(\mathbf{z})=\hat{y}_{\text{o}}$ for all $\mathbf{z}\in\Gamma_{f}(x)$, it suffices (see Appendix [B.4](https://arxiv.org/html/2510.00310v2#A2.SS4) for details) to have

$$ $\displaystyle\max_{k\in[K]}\left|\left[\text{CWTM}\left(\mathbf{z}\right)\right]_{k}-[\bar{h}(x)]_{k}\right|<\tfrac{\textsc{margin}\left(\bar{h}(x)\right)}{2},~\forall\mathbf{z}\in\Gamma_{f}(x)\text{ almost surely.}$ (14) $$

In the remaining of the proof, we show that ([14](https://arxiv.org/html/2510.00310v2#A2.E14)) holds as soon as

$$ $\textsc{margin}\left(\bar{h}(x)\right)>2\left(\sqrt{\tfrac{\kappa n}{\,n-f\,}}+\sqrt{\tfrac{f}{\,n-f\,}}\right)\sigma_{x}.$ $$

To do so, we first observe that for any $x\in\mathcal{X}$, $k\in[K]$, and $\mathbf{z}\in\Gamma_{f}(x)$ we have

$$ $\left|\left[\text{CWTM}(\mathbf{z})\right]_{k}-[\bar{h}(x)]_{k}\right|\leq\left|\left[\text{CWTM}(\mathbf{z})\right]_{k}-[\bar{h}_{H}(x)]_{k}\right|+\left|[\bar{h}_{H}(x)]_{k}-[\bar{h}(x)]_{k}\right|.$ $$

We then study each term of the right-hand side independently in (i) and (ii) below.

(i) First term.
By definition of CWTM and Lemma [2](https://arxiv.org/html/2510.00310v2#Thmlemma2), we know that for any $\mathbf{z}\in\Gamma_{f}(x)$ and $k\in[K]$, the following holds

$$ $\left|\left[\text{CWTM}\left(\mathbf{z}\right)\right]_{k}-[\bar{h}_{H}(x)]_{k}\right|^{2}\leq\tfrac{\kappa}{n-f}\sum_{i\in H}\left([h_{i}(x)]_{k}-[\bar{h}_{H}(x)]_{k}\right)^{2},$ $$

with $\kappa=\tfrac{6f}{n-2f}\,\left(1+\tfrac{f}{n-2f}\right)$.
Furthermore, using Lemma [1](https://arxiv.org/html/2510.00310v2#Thmlemma1), in the above we get

$$ $\left|\left[\text{CWTM}\left(\mathbf{z}\right)\right]_{k}-[\bar{h}_{H}(x)]_{k}\right|^{2}\leq\left(\tfrac{\kappa n}{n-f}\right)\,\tfrac{1}{n}\sum_{i=1}^{n}\left(\left[h_{i}(x)\right]_{k}-\left[\bar{h}(x)\right]_{k}\right)^{2}.$ $$

Finally, using the definition of $\sigma^{2}_{x}$, we obtain

$$ $\left|\left[\text{CWTM}\left(\mathbf{z}\right)\right]_{k}-[\bar{h}_{H}(x)]_{k}\right|^{2}\leq\tfrac{\kappa n}{n-f}\,\sigma^{2}_{x}.$ $$

(ii) Second term. Similar to the proof of Lemma [1](https://arxiv.org/html/2510.00310v2#Thmlemma1), we split $[n]$ in elements of $H$ and $T=[n]\backslash H$. Then we can rewrite for any $k\in[K]$

$$ $\tfrac{1}{n}\sum_{i=1}^{n}([h_{i}(x)]_{k}-[\bar{h}(x)]_{k})^{2}=\tfrac{1}{n}\left(\sum_{i\in H}([h_{i}(x)]_{k}-[\bar{h}(x)]_{k})^{2}+\sum_{i\in T}([h_{i}(x)]_{k}-[\bar{h}(x)]_{k})^{2}\right).$ $$

Furthermore, using Jensen’s inequality, we have

$$ $\sum_{i\in H}([h_{i}(x)]_{k}-[\bar{h}(x)]_{k})^{2}\geq(n-f)\left([\bar{h}_{H}(x)]_{k}-[\bar{h}(x)]_{k}\right)^{2}$ (15) $$

and

$$ $\sum_{i\in T}([h_{i}(x)]_{k}-[\bar{h}(x)]_{k})^{2}\geq f\left([\bar{h}_{T}(x)]_{k}-[\bar{h}(x)]_{k}\right)^{2},$ $$

with $\bar{h}_{T}(x)=\tfrac{1}{f}\sum_{i\in T}h_{i}(x)$. As $\bar{h}_{T}(x)=\tfrac{n\bar{h}(x)-(n-f)\bar{h}_{H}(x)}{f}$, the above also gives us

$$ $\sum_{i\in T}([h_{i}(x)]_{k}-[\bar{h}(x)]_{k})^{2}\geq\tfrac{(n-f)^{2}\left([\bar{h}_{H}(x)]_{k}-[\bar{h}(x)]_{k}\right)^{2}}{f}.$ (16) $$

Then, combining ([15](https://arxiv.org/html/2510.00310v2#A2.E15)) and ([16](https://arxiv.org/html/2510.00310v2#A2.E16)) and since $(n-f)+\tfrac{(n-f)^{2}}{f}=\tfrac{n(n-f)}{f}$ we get

$$ $\sum_{i=1}^{n}([h_{i}(x)]_{k}-[\bar{h}(x)]_{k})^{2}\;\geq\;\tfrac{n(n-f)}{f}\,\left([\bar{h}_{H}(x)]_{k}-[\bar{h}(x)]_{k}\right)^{2}.$ $$

Rearranging in the above we obtain

$$ $\left([\bar{h}_{H}(x)]_{k}-[\bar{h}(x)]_{k}\right)^{2}\leq\tfrac{f}{n-f}\,\tfrac{1}{n}\sum_{i=1}^{n}([h_{i}(x)]_{k}-[\bar{h}(x)]_{k})^{2}\leq\tfrac{f}{n-f}\sigma_{x}^{2}.$ $$

Combining. By substituting (i) and (ii) in the initial decomposition (applying $\sqrt{\cdot}$ on each), we get

$$ $\left|\left[\text{CWTM}(\mathbf{z})\right]_{k}-[\bar{h}(x)]_{k}\right|\leq\left(\sqrt{\tfrac{\kappa n}{\,n-f\,}}+\sqrt{\tfrac{f}{\,n-f\,}}\right)\sigma_{x}.$ $$

Thus, condition ([14](https://arxiv.org/html/2510.00310v2#A2.E14)) is satisfied whenever

$$ $\textsc{margin}(\bar{h}(x))\;>\;2\left(\sqrt{\tfrac{\kappa n}{\,n-f\,}}+\sqrt{\tfrac{f}{\,n-f\,}}\right)\sigma_{x}.$ $$

In particular, because we assumed $\overline{h}(x)$ has a unique maximum coordinate almost everywhere, the above implies that

$$ $\mathbb{P}_{(x,y)\sim\mathcal{D}}\left[\psi_{\text{rob}}(\mathbf{z})=\hat{y}_{\text{o}},\forall\mathbf{z}\in\Gamma_{f}(x)\right]\geq\mathbb{P}_{(x,y)\sim\mathcal{D}}\!\left[\textsc{margin}\left(\bar{h}(x)\right)\geq 2\left(\sqrt{\tfrac{\kappa n}{\,n-f\,}}+\sqrt{\tfrac{f}{\,n-f\,}}\right)\sigma_{x}\right].$ $$

Conclusion.
Plugging this into ([13](https://arxiv.org/html/2510.00310v2#A2.E13)) completes the proof, i.e.,

$$ $\mathbb{E}_{(x,y)\sim\mathcal{D}}\left[{\ell^{\text{adv}}_{\psi_{\text{rob}}}(x,\hat{y}_{\text{o}})}\right]\leq\mathbb{P}_{(x,y)\sim\mathcal{D}}\!\left[\textsc{margin}\left(\bar{h}(x)\right)<2\left(\sqrt{\tfrac{\kappa n}{\,n-f\,}}+\sqrt{\tfrac{f}{\,n-f\,}}\right)\sigma_{x}\right].$ $$

∎

###### Proof.

### B.4 Justification for ( 14 )

Here we prove that, whenever $\overline{h}(x)$ has a unique maximum coordinate, to satisfy $\psi_{\text{rob}}(\mathbf{z})=\hat{y}_{\text{o}}$ for all $\mathbf{z}\in\Gamma_{f}(x)$, it suffices to have

$$ $\displaystyle\max_{k\in[K]}\left|\left[\text{CWTM}\left(\mathbf{z}\right)\right]_{k}-[\bar{h}(x)]_{k}\right|<\tfrac{\textsc{margin}\left(\bar{h}(x)\right)}{2},~\forall\mathbf{z}\in\Gamma_{f}(x).$ $$

###### Proof.

Let $x\in\mathcal{X}$ and $\bar{h}:\mathcal{X}\rightarrow\Delta^{K}$ the average function. Let us assume that ([14](https://arxiv.org/html/2510.00310v2#A2.E14)) holds true. Then for any $\mathbf{z}\in\Gamma_{f}(x)$ and $k\in[K]$ we have

$$ $-\tfrac{\textsc{margin}\left(\bar{h}(x)\right)}{2}<\left[\text{CWTM}\left(\mathbf{z}\right)\right]_{k}-[\bar{h}(x)]_{k}<\tfrac{\textsc{margin}\left(\bar{h}(x)\right)}{2}.$ (17) $$

Let us denote by $k^{*}$ the coordinate such that $[\bar{h}(x)]_{k}=\bar{h}(x)^{(1)}$, i.e., the unique maximum of $\bar{h}(x)$.
Let us also consider $k\in[K]\backslash k^{*}$, and $\mathbf{z}\in\Gamma_{f}(x)$ we have

$$ $\displaystyle\left[\text{CWTM}\left(\mathbf{z}\right)\right]_{k^{*}}-\left[\text{CWTM}\left(\mathbf{z}\right)\right]_{k}$ $\displaystyle=$ $\displaystyle\left[\text{CWTM}\left(\mathbf{z}\right)\right]_{k^{*}}-[\bar{h}(x)]_{k^{*}}-\left(\left[\text{CWTM}\left(\mathbf{z}\right)\right]_{k}-[\bar{h}(x)]_{k}\right)+[\bar{h}(x)]_{k^{*}}-[\bar{h}(x)]_{k}.$ $$

Using ([17](https://arxiv.org/html/2510.00310v2#A2.E17)) on the first two terms and observing that $[\bar{h}(x)]_{k^{*}}-[\bar{h}(x)]_{k}\geq\textsc{margin}\left(\bar{h}(x)\right)$ by definition, we get

$$ $\displaystyle\left[\text{CWTM}\left(\mathbf{z}\right)\right]_{k^{*}}-\left[\text{CWTM}\left(\mathbf{z}\right)\right]_{k}>-\tfrac{\textsc{margin}\left(\bar{h}(x)\right)}{2}-\tfrac{\textsc{margin}\left(\bar{h}(x)\right)}{2}+\textsc{margin}\left(\bar{h}(x)\right)=0.$ $$

Since the above holds for any $k\in[K]\setminus k^{*}$ and $\mathbf{z}\in\Gamma_{f}(x)$, we get that $k^{*}$ is the unique maximum coordinate of $\text{CWTM}\left(\mathbf{z}\right)$ for any $\mathbf{z}\in\Gamma_{f}(x)$. Hence, we get

$$ $\psi_{\text{rob}}(\mathbf{z})=\mathop{\mathrm{argmax}}_{k\in[K]}\left[\text{CWTM}\left(\mathbf{z}\right)\right]_{k}=\mathop{\mathrm{argmax}}_{k\in[K]}\left[\bar{h}(x)\right]_{k}=\hat{y}_{\text{o}}\text{ for all }\mathbf{z}\in\Gamma_{f}(x).$ $$

∎

###### Proof.

## Appendix C Additional related work

In the context of robust voting within federated learning, Chu & Laoutaris (2024) propose FedQV, a quadratic voting scheme that allocates voting budgets based on client reputation. This presumes stable client identities and therefore does not transfer to our setting where malicious participants may change per query.
In contrast, the ensemble majority voting scheme introduced in Cao et al. (2022) does not apply because it requires central control over training to obtain several global models, each trained on a subset of clients. In our setting, however, training is fully local and independent.

Beyond federated learning, robust voting has also been studied in more general settings. Allouah et al. (2024b) propose Mehestan for robust sparse voting, but it requires normalization across voters, which assumes repeated score comparisons or stable voter behavior. This is not applicable to our per-query federated inference setting. Likewise, Melnyk et al. (2018) develop multi-round consensus for preference ranking and Datar et al. (2022) rely on repeated pairwise client comparisons. Both assume settings that are fundamentally different from our inference-time aggregation scenario.

## Appendix D Additional Experimental Details

### D.1 Hyperparameters

In this section, we report the hyperparameters used for our experiments, and which can be used to reproduce the results.
The local training/fine-tuning is conducted using SGD optimizer and a learning rate of $0.0025$ for CIFAR-10 and $0.01$ for both CIFAR-100 and AG-News.
The training runs for $100$ local epochs for CIFAR-10 while the fine-tuning of CIFAR-100 and AG-News runs for $20$ epochs.
The DeepSet model is trained using the Adam optimizer for $10$ epochs for each dataset using a learning rate of $5\times 10^{-5}$.
Our choices of parameters are based on prior work using similar setups (Allouah et al., 2024a; Gong et al., 2022).
We train the autoencoder in CoPur using the Adam optimizer and a learning rate of $1\times 10^{-3}$, and vary the epochs from $\{50,100,150\}$ depending on the dataset.
The server’s aggregator model in CoPur is also trained using Adam for $40$ epochs, and a learning rate of $1\times 10^{-3}$.
Finally, the number of optimization iterations for CoPur is varied from $10$ to $40$, while Liu et al. (2022) use a fixed value of $10$.
During adversarial training, we sample different choices of adversaries out of $[n]$ as their identify is unknown i.e.\xcommaparameter $N$ in [Algorithm 1](https://arxiv.org/html/2510.00310v2#algorithm1).
While the number of choices total to $\sum_{i=m}^{f}\binom{n}{m}$, we only sample $N=120,N=300$ and $N=5000$ for each of $n=10,17$ and $25$ respectively.
Lastly, we set $S=50$ and $E$ such that it corresponds to $5$ epochs over the corresponding training dataset.

### D.2 Description of attacks

**Table 4: Table listing all attacks for an input $x$ with its true label $y$. Here, $\psi$ is any aggregation in consideration which is employed at the server. We refer with $\Omega_{\textrm{benign}}$ the set of benign client indexes such that $\Omega_{\textrm{benign}}\subseteq[n]$ and $|\Omega_{\textrm{benign}}\rvert=n-f$.**
| Attack | Type | Definition |
| --- | --- | --- |
| Logit Flipping Liu et al. (2022) | Black-box | $z_{i}=-\textrm{amplification}*h_{i}(x)$ |
| SIA-bb (ours) | Black-box | $z_{i}^{j}=\begin{cases}1,&\text{if }j=\arg\max_{k\in[K]\backslash y}h_{i}(x)\\<br>0,&\textrm{otherwise}\end{cases}$ |
| LMA Roux et al. (2025) | White-box | $z_{i}^{j}=\begin{cases}1,&\text{if }j=\arg\min_{k\in[K]}\psi(h_{1}(x),\ldots,h_{n}(x))\\<br>0,&\textrm{otherwise}\end{cases}$ |
| CPA Roux et al. (2025) | White-box | $z_{i}^{j}=\begin{cases}1,&\text{if }j\text{ is least similar to }\arg\max_{k\in[K]}\frac{1}{n}\sum_{i=1}^{n}h_{i}(x)\\<br>0,&\textrm{otherwise}\end{cases}$ |
| SIA-wb (ours) | White-box | $z_{i}^{j}=\begin{cases}1,&\text{if }j=\arg\max_{k\in[K]\backslash y}\psi(h_{1}(x),\ldots,h_{n}(x))\\<br>0,&\textrm{otherwise}\end{cases}$ |
| PGD Liu et al. (2022) | White-box | $z_{1},\ldots,z_{f}=\arg\max_{(z_{1},\ldots,z_{f})}\ell(\psi(\{h_{\textrm{benign}},h_{\textrm{adv}}\}),y)$<br>where $h_{\textrm{benign}}=\{h_{i}(x)\mid i\in\Omega_{\textrm{benign}}\}$ and $h_{\textrm{adv}}=\{z_{1},\ldots,z_{f}\}$ |

We consider six adversarial attacks, designed to evaluate the robustness of the aggregator under varying levels of adversary knowledge and coordination. Beyond the mathematical definitions in [Table 4](https://arxiv.org/html/2510.00310v2#A4.T4), we provide a short intuitive description for each below:

- •
Logit flipping (*Black-box*).
Each adversary inverts its own probits by negating and scaling them, effectively pushing its prediction away from the true class without knowledge of the server’s aggregation or other clients’ predictions.
- •
Strongest Inverted Attack (SIA) [Our Proposed Attack].
–
*Black-box:* Adversaries independently change their prediction to the second-most probable class (second-largest local probit) that is not the true class.
–
*White-box:* Same as black-box except that the adversaries use the global aggregation output (before perturbation) to identify the second-most probable class.
- •
Loss Maximization attack (LMA, *White-box*).
Adversaries maximize the server’s loss by targeting the least likely class among the global aggregation output.
- •
Class Prior Attack (CPA, *White-box*).
Adversaries first identify the most likely class from the aggregation output. They then select the class least similar to it according to a pre-computed similarity matrix $S\in\mathbb{R}^{K\times K}$, derived from class embeddings of a pre-trained reference model.
- •
PGD Attack (*White-box*).
Adversaries iteratively optimize their output via gradient ascent to maximize the aggregator’s loss.
This requires specifying a loss function for the aggregator. Two natural choices are the standard cross-entropy loss and the Carlini-Wagner (CW) loss (Carlini & Wagner, 2017). We adopt the latter (PGD-cw) in our experiments as it produces stronger adversarial attacks: instead of penalizing all classes equally, it focuses on the two most likely classes, thereby targeting the decision boundary more effectively.

### D.3 Adapting SIA attack to the logit space

Since CoPur operates directly in logit space, we adapted the SIA definitions to ensure comparability with DeepSet-TM in [Section 5.2](https://arxiv.org/html/2510.00310v2#S5.SS2).

Proposed adaptation. Each adversary identifies the index of the second most probable class which is not the true class either from its own output (black-box) or from the aggregation output (white-box) as defined above. Let $M_{\textrm{max}}$ and $M_{\textrm{min}}$ be the largest and the smallest value in the corresponding honest logit respectively. For instance, when client $i$ is the adversary, $M_{\textrm{max}}=\max_{k\in[K]}[h_{i}(x)]_{k}$ and correspondingly $M_{\textrm{min}}$.
Given an amplification factor $a>0$, the adversary then sets its own logits $z_{i}$ as follows:

$$ $z_{i}^{j}=\begin{cases}\begin{cases}\;\;a\times M_{\textrm{max}}&\text{if $j$ is the 2nd-largest logit},\\ -a\times M_{\textrm{max}}&\text{otherwise,}\end{cases}&\text{if $M_{\textrm{max}}\geq 0$},\[12.0pt] \begin{cases}-a\times M_{\textrm{min}}&\text{if $j$ is the 2nd-largest logit},\\ \;\;a\times M_{\textrm{min}}&\text{otherwise,}\end{cases}&\text{if $M_{\textrm{max}}<0$}.\end{cases}$ $$

In our experiments, we set $a=2$ since we found the baseline CoPur to be highly negatively affected by larger values.

## Appendix E Additional Experimental Results

### E.1 Experimental validation of Theorem 1

Figure: Figure 3: Validating [Definition 1](https://arxiv.org/html/2510.00310v2#Thmdefinition1) in practice. As the ratio of $\nicefrac{{\textsc{margin}(\overline{h}(x))}}{{\sigma_{x}}}$ increases, we observe a notable decrease in the test error, aligning with [Definition 1](https://arxiv.org/html/2510.00310v2#Thmdefinition1). Adversaries use SIA white-box and LMA (see [Table 4](https://arxiv.org/html/2510.00310v2#A4.T4)).
Refer to caption: x3.png

We empirically validate the theoretical predictions of Theorem [1](https://arxiv.org/html/2510.00310v2#Thmdefinition1) by analyzing the evolution of test error as a function of $\nicefrac{{\textsc{margin}(\overline{h}(x))}}{{\sigma_{x}}}$. According to the theorem, larger values of this quantity translate into lower test error. [Figure 3](https://arxiv.org/html/2510.00310v2#A5.F3) is generated by varying the heterogeneity level $\alpha\in\{0.5,1,1000\}$ for each of the two datasets and computing the average $\nicefrac{{\textsc{margin}(\overline{h}(x))}}{{\sigma_{x}}}$ ratio on the testset of the respective dataset. Increasing $\alpha$ reduces the model dissimilarity $\sigma_{x}$, thereby increasing the ratio above. We then report test error for CWTM on each configuration to obtain the figure. As expected, a higher number of adversaries $f$ consistently leads to higher test error. The lower the heterogeneity, the less significant this effect is, since lower heterogeneity allows for more redundancy within client outputs.

### E.2 Performance against Robust Aggregators

#### E.2.1 Decreasing the number of adversaries

[Table 5](https://arxiv.org/html/2510.00310v2#A5.T5) shows the performance of DeepSet-TM and static aggregations as in [Table 2](https://arxiv.org/html/2510.00310v2#S5.T2), but decreasing the number of adversaries $f$ from 4 to 3.

**Table 5: Accuracy (%) of DeepSet-TM against static aggregations on the CIFAR-10, CIFAR-100 and AG-News datasets, with heterogeneity $\alpha=0.5$, $n=17$ clients and $f=3$ adversaries. Logit flipping uses an amplification factor of 2.**
|  | Aggregation | Logit flipping | SIA-bb | LMA | CPA | SIA-wb | PGD-cw | Worst case |
| --- | --- | --- | --- | --- | --- | --- | --- | --- |
| CF-10 | Mean | $66.7\pm 2.2$ | $62.5\pm 1.8$ | $66.7\pm 1.9$ | $64.7\pm 2.1$ | $49.7\pm 3.2$ | $35.8\pm 4.4$ | $35.8\pm 4.4$ |
| CWMed | $58.3\pm 5.2$ | $55.8\pm 3.0$ | $57.4\pm 4.0$ | $56.7\pm 4.2$ | $54.2\pm 3.1$ | $36.5\pm 4.1$ | $36.5\pm 4.1$ |  |
| GM | $65.0\pm 2.4$ | $61.5\pm 1.8$ | $65.6\pm 1.8$ | $64.2\pm 2.0$ | $51.5\pm 3.1$ | $36.0\pm 4.8$ | $36.0\pm 4.8$ |  |
| CWTM | $65.0\pm 2.5$ | $61.9\pm 1.7$ | $65.4\pm 2.0$ | $64.5\pm 2.0$ | $52.0\pm 2.9$ | $38.3\pm 4.2$ | $38.3\pm 4.2$ |  |
| DeepSet-TM | $\mathbf{68.5\pm 1.1}$ | $\mathbf{65.4\pm 1.8}$ | $\mathbf{67.8\pm 2.1}$ | $\mathbf{66.6\pm 2.1}$ | $\mathbf{57.2\pm 1.5}$ | $\mathbf{53.9\pm 3.2}$ | $53.9\pm 3.2$ |  |
| CF-100 | Mean | $\mathbf{79.3\pm 0.7}$ | $75.4\pm 0.8$ | $76.1\pm 0.7$ | $76.0\pm 0.8$ | $62.9\pm 0.9$ | $52.1\pm 1.1$ | $52.1\pm 1.1$ |
| CWMed | $68.9\pm 1.6$ | $66.9\pm 1.4$ | $68.9\pm 1.5$ | $68.9\pm 1.5$ | $66.2\pm 1.2$ | $52.4\pm 1.2$ | $52.4\pm 1.2$ |  |
| GM | $75.9\pm 1.0$ | $73.6\pm 1.2$ | $76.1\pm 1.0$ | $76.1\pm 0.9$ | $64.9\pm 1.1$ | $51.7\pm 1.3$ | $51.7\pm 1.3$ |  |
| CWTM | $75.9\pm 1.0$ | $73.7\pm 1.2$ | $75.9\pm 1.0$ | $75.9\pm 1.0$ | $66.5\pm 0.9$ | $56.2\pm 1.1$ | $56.2\pm 1.1$ |  |
| DeepSet-TM | $78.6\pm 0.3$ | $\mathbf{76.4\pm 0.4}$ | $\mathbf{78.2\pm 0.2}$ | $\mathbf{78.1\pm 0.3}$ | $\mathbf{68.3\pm 0.4}$ | $\mathbf{59.5\pm 0.5}$ | $59.5\pm 0.5$ |  |
| AG-News | Mean | $84.1\pm 1.1$ | $82.7\pm 2.4$ | $83.8\pm 1.4$ | $81.2\pm 2.3$ | $76.4\pm 3.7$ | $65.3\pm 6.2$ | $65.3\pm 6.2$ |
| CWMed | $80.3\pm 4.5$ | $81.3\pm 3.5$ | $81.3\pm 2.9$ | $80.1\pm 3.0$ | $77.5\pm 3.5$ | $63.5\pm 6.8$ | $63.5\pm 6.8$ |  |
| GM | $83.0\pm 1.5$ | $82.1\pm 2.7$ | $83.3\pm 1.6$ | $80.7\pm 2.4$ | $77.4\pm 3.1$ | $63.1\pm 6.9$ | $63.1\pm 6.9$ |  |
| CWTM | $83.9\pm 1.1$ | $82.6\pm 2.4$ | $83.5\pm 1.4$ | $81.2\pm 2.3$ | $76.4\pm 3.8$ | $65.4\pm 6.2$ | $65.4\pm 6.2$ |  |
| DeepSet-TM | $\mathbf{85.9\pm 0.2}$ | $\mathbf{83.8\pm 1.2}$ | $\mathbf{84.1\pm 0.5}$ | $\mathbf{82.7\pm 0.9}$ | $\mathbf{81.9\pm 1.2}$ | $\mathbf{83.5\pm 1.2}$ | $83.5\pm 1.2$ |  |

**Table 6: Accuracy (%) of DeepSet-TM against static aggregations on the CIFAR-10, CIFAR-100 and AG-News datasets, with heterogeneity $\alpha=0.3$, $n=17$ clients and $f=4$ adversaries. Logit flipping uses an amplification factor of 2.**
|  | Aggregation | Logit flipping | SIA-bb | LMA | CPA | SIA-wb | PGD-cw | Worst case |
| --- | --- | --- | --- | --- | --- | --- | --- | --- |
| CF-10 | Mean | $60.4\pm 4.0$ | $55.8\pm 4.3$ | $49.0\pm 3.9$ | $43.8\pm 4.6$ | $29.8\pm 3.8$ | $13.6\pm 2.8$ | $13.6\pm 2.8$ |
| CWMed | $47.1\pm 6.7$ | $45.8\pm 3.7$ | $45.9\pm 4.3$ | $42.4\pm 4.2$ | $38.4\pm 2.4$ | $14.1\pm 3.4$ | $14.1\pm 3.4$ |  |
| GM | $58.2\pm 4.3$ | $55.0\pm 4.3$ | $\mathbf{55.6\pm 4.1}$ | $\mathbf{49.7\pm 4.2}$ | $34.8\pm 2.8$ | $13.7\pm 2.9$ | $13.7\pm 2.9$ |  |
| CWTM | $57.6\pm 4.2$ | $54.6\pm 4.3$ | $54.2\pm 4.2$ | $49.4\pm 4.5$ | $32.1\pm 3.6$ | $16.4\pm 2.9$ | $16.4\pm 2.9$ |  |
| DeepSet-TM | $\mathbf{61.9\pm 3.1}$ | $\mathbf{57.9\pm 3.2}$ | $46.6\pm 3.6$ | $44.7\pm 6.0$ | $\mathbf{43.0\pm 2.2}$ | $\mathbf{44.9\pm 2.7}$ | $43.0\pm 2.2$ |  |
| CF-100 | Mean | $75.6\pm 0.7$ | $69.1\pm 0.8$ | $57.0\pm 2.4$ | $56.8\pm 2.4$ | $44.5\pm 1.4$ | $25.8\pm 2.8$ | $25.8\pm 2.8$ |
| CWMed | $55.1\pm 2.1$ | $51.8\pm 2.6$ | $55.9\pm 2.2$ | $55.8\pm 2.2$ | $50.7\pm 1.8$ | $24.5\pm 1.9$ | $24.5\pm 1.9$ |  |
| GM | $71.2\pm 0.8$ | $66.3\pm 1.1$ | $70.2\pm 0.8$ | $70.0\pm 0.9$ | $48.3\pm 1.5$ | $23.8\pm 2.6$ | $23.8\pm 2.6$ |  |
| CWTM | $69.1\pm 1.1$ | $65.8\pm 1.2$ | $69.1\pm 1.2$ | $69.1\pm 1.2$ | $49.6\pm 1.1$ | $32.5\pm 2.4$ | $32.5\pm 2.4$ |  |
| DeepSet-TM | $\mathbf{75.7\pm 0.8}$ | $\mathbf{71.9\pm 1.1}$ | $7\mathbf{2.2\pm 1.9}$ | $\mathbf{72.5\pm 0.6}$ | $\mathbf{56.7\pm 1.0}$ | $\mathbf{38.6\pm 2.5}$ | $38.6\pm 2.5$ |  |
| AG-News | Mean | $77.0\pm 4.6$ | $70.7\pm 6.2$ | $67.1\pm 8.1$ | $61.7\pm 7.7$ | $62.3\pm 7.7$ | $36.8\pm 9.7$ | $36.8\pm 9.7$ |
| CWMed | $60.9\pm 9.4$ | $62.6\pm 7.5$ | $54.4\pm 8.7$ | $52.3\pm 8.4$ | $66.0\pm 7.4$ | $32.7\pm 7.3$ | $32.7\pm 7.3$ |  |
| GM | $74.7\pm 4.9$ | $70.5\pm 6.1$ | $\mathbf{67.8\pm 7.8}$ | $62.6\pm 7.0$ | $64.7\pm 6.3$ | $33.2\pm 8.7$ | $33.2\pm 8.7$ |  |
| CWTM | $76.7\pm 4.6$ | $70.6\pm 6.2$ | $66.1\pm 8.1$ | $\mathbf{61.8\pm 7.7}$ | $62.6\pm 7.6$ | $37.3\pm 9.7$ | $37.3\pm 9.7$ |  |
| DeepSet-TM | $\mathbf{80.4\pm 3.5}$ | $\mathbf{73.6\pm 4.5}$ | $61.1\pm 8.9$ | $59.5\pm 9.1$ | $\mathbf{73.6\pm 3.8}$ | $\mathbf{72.0\pm 10.3}$ | $59.5\pm 9.1$ |  |

**Table 7: Accuracy (%) of DeepSet-TM against static aggregations on the CIFAR-10, CIFAR-100 and AG-News datasets, with heterogeneity $\alpha=0.8$, $n=17$ clients and $f=4$ adversaries. Logit flipping uses an amplification factor of 2.**
|  | Aggregation | Logit flipping | SIA | LMA | CPA | SIA-wb | PGD-cw | Worst case |
| --- | --- | --- | --- | --- | --- | --- | --- | --- |
| CF-10 | Mean | $69.5\pm 0.3$ | $64.6\pm 1.5$ | $65.1\pm 0.6$ | $63.1\pm 0.9$ | $50.1\pm 1.7$ | $33.5\pm 2.6$ | $33.5\pm 2.6$ |
| CWMed | $63.6\pm 2.4$ | $59.4\pm 2.0$ | $61.1\pm 1.4$ | $60.1\pm 1.4$ | $\mathbf{55.1\pm 1.3}$ | $36.9\pm 3.4$ | $36.9\pm 3.4$ |  |
| GM | $68.4\pm 0.4$ | $64.1\pm 1.5$ | $\mathbf{67.9\pm 0.6}$ | $\mathbf{66.1\pm 0.9}$ | $52.8\pm 1.2$ | $35.2\pm 3.0$ | $35.2\pm 3.0$ |  |
| CWTM | $68.3\pm 0.3$ | $64.1\pm 1.4$ | $67.8\pm 0.7$ | $\mathbf{66.1\pm 1.0}$ | $52.0\pm 1.6$ | $36.2\pm 2.6$ | $36.2\pm 2.6$ |  |
| DeepSet-TM | $\mathbf{69.9\pm 1.1}$ | $\mathbf{67.1\pm 1.3}$ | $67.0\pm 2.6$ | $\mathbf{66.1\pm 2.1}$ | $55.0\pm 2.2$ | $\mathbf{51.2\pm 1.2}$ | $51.2\pm 1.2$ |  |
| CF-100 | Mean | $\mathbf{80.5\pm 0.5}$ | $76.2\pm 0.7$ | $71.5\pm 1.2$ | $71.5\pm 1.2$ | $62.5\pm 1.1$ | $48.4\pm 1.5$ | $48.4\pm 1.5$ |
| CWMed | $72.9\pm 1.5$ | $70.8\pm 1.6$ | $73.0\pm 1.4$ | $73.0\pm 1.4$ | $\mathbf{69.0\pm 1.3}$ | $54.8\pm 1.7$ | $54.8\pm 1.7$ |  |
| GM | $78.3\pm 0.8$ | $75.5\pm 0.9$ | $\mathbf{78.5\pm 0.8}$ | $78.4\pm 0.8$ | $66.0\pm 1.1$ | $51.2\pm 1.7$ | $51.2\pm 1.7$ |  |
| CWTM | $78.1\pm 1.0$ | $75.6\pm 0.8$ | $78.1\pm 1.0$ | $78.1\pm 1.0$ | $67.1\pm 1.0$ | $54.1\pm 1.4$ | $54.1\pm 1.4$ |  |
| DeepSet-TM | $79.5\pm 0.4$ | $\mathbf{77.1\pm 0.5}$ | $78.4\pm 0.4$ | $\mathbf{78.6\pm 0.6}$ | $68.0\pm 0.8$ | $\mathbf{57.0\pm 1.3}$ | $57.0\pm 1.3$ |  |
| AG-News | Mean | $85.1\pm 0.9$ | $81.1\pm 2.8$ | $\mathbf{83.7\pm 2.4}$ | $81.0\pm 3.7$ | $77.8\pm 3.2$ | $65.6\pm 5.8$ | $65.6\pm 5.8$ |
| CWMed | $80.6\pm 3.2$ | $80.3\pm 2.6$ | $81.8\pm 2.4$ | $80.2\pm 2.8$ | $78.1\pm 2.6$ | $64.8\pm 5.8$ | $64.8\pm 5.8$ |  |
| GM | $84.3\pm 1.1$ | $80.8\pm 2.8$ | $83.6\pm 2.4$ | $81.0\pm 3.7$ | $78.2\pm 3.1$ | $64.5\pm 5.9$ | $64.5\pm 5.9$ |  |
| CWTM | $84.9\pm 0.9$ | $81.1\pm 2.8$ | $83.5\pm 2.6$ | $81.0\pm 3.7$ | $77.9\pm 3.2$ | $65.8\pm 5.7$ | $65.8\pm 5.7$ |  |
| DeepSet-TM | $\mathbf{85.9\pm 0.4}$ | $\mathbf{82.9\pm 1.0}$ | $83.5\pm 0.9$ | $\mathbf{82.1\pm 1.2}$ | $\mathbf{81.0\pm 1.7}$ | $\mathbf{83.0\pm 1.8}$ | $81.0\pm 1.7$ |  |

#### E.2.2 Varying the heterogeneity α \alpha

[Tables 6](https://arxiv.org/html/2510.00310v2#A5.T6) and [7](https://arxiv.org/html/2510.00310v2#A5.T7) show the accuracy of DeepSet-TM against static aggregation schemes on the three datasets of interest for $\alpha=0.3$ and $0.8$ respectively. This is similar to [Table 2](https://arxiv.org/html/2510.00310v2#S5.T2), which showed the same view for $\alpha=0.5$.

### E.3 Giving more compute to the adversary

[Table 8](https://arxiv.org/html/2510.00310v2#A5.T8) shows the performance of DeepSet-TM and static aggregation schemes on AG-News and under PGD-cw attack, when the adversaries are given more compute than during training. Specifically, training of DeepSet-TM is conducted with $S=50$ PGD iterations, and attackers are given up to 150 at inference time.
Since we operate in probit space, we do not see a performance drop.

**Table 8: Accuracy (%) of DeepSet-TM and static aggregations on AG-News ($\alpha=0.5$, $n=17$, $f=4$) against PGD-cw attack with various number of iterations. Training was conducted with $S=50$ iterations.**
|  | Test time $S$ | 50 | 100 | 150 |
| --- | --- | --- | --- | --- |
| AG-News | Mean | $54.9\pm 6.7$ | $54.9\pm 6.7$ | $54.9\pm 6.7$ |
| CWMed | $53.2\pm 7.0$ | $53.1\pm 6.4$ | $53.1\pm 6.4$ |  |
| GM | $52.6\pm 7.3$ | $52.6\pm 7.2$ | $52.6\pm 7.2$ |  |
| CWTM | $55.3\pm 7.5$ | $55.2\pm 6.7$ | $55.2\pm 6.7$ |  |
| DeepSet-TM | $83.2\pm 1.4$ | $83.0\pm 1.4$ | $83.0\pm 1.4$ |  |

### E.4 Effectiveness of robustness elements

In this section, we assess the improvement brought about by the two robustness elements – CWTM and adversarial training.
To evaluate this, we consider the worst case performance of the DeepSet aggregator across five attacks under different combinations of the robustness elements.
The results are reported in [Table 1](https://arxiv.org/html/2510.00310v2#S1.T1) for $\alpha=0.5$ and [Table 9](https://arxiv.org/html/2510.00310v2#A5.T9) for $\alpha=\{0.3,0.8\}$.
We specifically exclude PGD attack in computing the worst case as the adversarially trained model shows elevated performance by virtue of being trained on the same attack, rendering the comparison unfair to the non-adversarially trained cases.
We recall that the CWTM operator is applied to the DeepSet model only at inference time and incurs no additional cost during training.

**Table 9: Evaluation of robust elements in a setup with $n=17$ clients and $f=4$ adversaries. We report the worst-case test accuracy across $5$ different attacks.**
| DeepSet | CWTM | Adv. Tr. | $\alpha=0.3$ | $\alpha=0.8$ |  |  |
| --- | --- | --- | --- | --- | --- | --- |
| CIFAR-10 | CIFAR-100 | CIFAR-10 | CIFAR-100 |  |  |  |
| ✓ | ✗ | ✗ | $32.1\pm 2.6$ | $30.8\pm 4.3$ | $51.9\pm 1.3$ | $47.4\pm 3.1$ |
| ✓ | ✓ | ✗ | $35.5\pm 1.4$ | $55.0\pm 0.8$ | $53.7\pm 1.4$ | $67.0\pm 0.7$ |
| ✓ | ✗ | ✓ | $35.7\pm 2.8$ | $54.1\pm 1.0$ | $\mathbf{55.2\pm 2.8}$ | $65.1\pm 0.8$ |
| ✓ | ✓ | ✓ | $\mathbf{43.0\pm 2.2}$ | $\mathbf{56.7\pm 1.0}$ | $55.0\pm 2.2$ | $\mathbf{68.0\pm 0.8}$ |

In [Table 9](https://arxiv.org/html/2510.00310v2#A5.T9), the lowest performance is achieved by the DeepSet model without any robust element, as expected.
Interestingly, the improvements derived from enhancing DeepSet with either CWTM or adversarial training are comparable.
For instance, on the CIFAR-10 dataset with $\alpha=0.3$, CWTM results in $35.5\%$ test accuracy while adversarial training results in $35.7\%$.
Similarly, on CIFAR-100 with $\alpha=0.3$, they achieve $55.5\%$ and $54.1\%$ respectively, starting from $30.8\%$ when neither is applied.
However, the highest performance is achieved with both elements combined, resulting in $43.0\%$ on the CIFAR-10 and $56.7\%$ on CIFAR-100 in the above case.
Our results for $\alpha=0.5$ in [Table 1](https://arxiv.org/html/2510.00310v2#S1.T1) follow a similar trend.
Thus robustifying DeepSet with both CWTM and adversarial training brings the best from both worlds – Byzantine ML and adversarial ML.

### E.5 Performance of other adversarial defenses

**Table 10: Accuracy (%) of DeepSet-TM against randomized ablation on the CIFAR-100 dataset, with heterogeneity $\alpha=0.3$, $n=17$ clients and $f=4$ adversaries. Logit flipping uses an amplification factor of 2 and RA-CWTM trims 3 clients on each side. RA outputs are computed over 100 iterations.**
| Aggregation | Logit flipping | SIA-bb | LMA | CPA | SIA-wb | Worst case |
| --- | --- | --- | --- | --- | --- | --- |
| Mean | $75.6\pm 0.7$ | $69.1\pm 0.8$ | $57.0\pm 2.4$ | $56.8\pm 2.4$ | $44.5\pm 1.4$ | $44.5\pm 1.4$ |
| RA-Mean | $\mathbf{75.7\pm 0.7}$ | $69.0\pm 0.8$ | $55.8\pm 2.4$ | $56.5\pm 2.4$ | $49.1\pm 1.2$ | $49.1\pm 1.2$ |
| CWTM | $69.1\pm 1.1$ | $65.8\pm 1.2$ | $69.1\pm 1.2$ | $69.1\pm 1.2$ | $49.6\pm 1.1$ | $49.6\pm 1.1$ |
| RA-CWTM | $69.8\pm 1.1$ | $68.2\pm 0.9$ | $71.2\pm 0.7$ | $71.5\pm 0.7$ | $49.9\pm 1.2$ | $49.9\pm 1.2$ |
| CWMed | $55.1\pm 2.1$ | $51.8\pm 2.6$ | $55.9\pm 2.2$ | $55.8\pm 2.2$ | $50.7\pm 1.8$ | $50.7\pm 1.8$ |
| RA-CWMed | $54.7\pm 1.9$ | $49.9\pm 2.0$ | $53.4\pm 2.0$ | $54.8\pm 1.8$ | $53.9\pm 1.7$ | $49.9\pm 2.0$ |
| DS-RA | $69.2\pm 1.8$ | $68.4\pm 1.3$ | $59.5\pm 3.9$ | $59.3\pm 1.5$ | $54.2\pm 1.8$ | $54.2\pm 1.8$ |
| DeepSet-TM | $\mathbf{75.7\pm 0.8}$ | $\mathbf{71.9\pm 1.1}$ | $\mathbf{72.2\pm 1.9}$ | $\mathbf{72.5\pm 0.6}$ | $\mathbf{56.7\pm 1.0}$ | $56.7\pm 1.0$ |

We also evaluate our approach against Randomized ablation (RA) (Levine & Feizi, 2020), a certified adversarial defense method designed to improve robustness through repeated random subsampling of clients. Specifically, at each round, RA discards $f$ randomly chosen clients and aggregates the remaining ones (either via averaging (RA-Mean), CWTM (RA-CWTM) or CWMed (RA-CWMed)) to get a candidate classification. This procedure is repeated several times with different random subsets, and the final prediction is obtained by majority voting over the outcomes. Intuitively, robustness arises from averaging across multiple independent aggregations, which reduces the influence of any single malicious client.

[Table 10](https://arxiv.org/html/2510.00310v2#A5.T10) reports the accuracy of RA baselines and their non-RA counterparts against DeepSet-TM, when $\alpha=0.3$ and on CIFAR-100. We also report performance of the DeepSet-TM model without adversarial training but using RA instead under the name DS-RA.
Notably, DeepSet-TM outperforms all baselines under all 5 attack settings. In general, RA yields varying degrees of improvements and is only consistently better across all attacks in the case of CWTM.
On average, it improves accuracy by 0.5 points compared to the non-RA approach. This is inferior to DeepSet-TM, which yields an average improvement of 1.5 points over the strongest baseline for each attack.
We can also note that DeepSet-TM exhibits lower variance across runs, confirming greater stability.
In general, most certified adversarial defenses are highly dependent on the input space metric (usually the $\ell_{p}$ norm), hence are not directly applicable to our setting.

### E.6 Performance against SOTA baselines

[Figure 4](https://arxiv.org/html/2510.00310v2#A5.F4) shows a comparative view of DeepSet-TM, CoPur and Manifold projection with $\alpha=0.3$. The same results for $\alpha=0.5$ are available in [Figure 2](https://arxiv.org/html/2510.00310v2#S5.F2).

Figure: Figure 4: DeepSet-TM against baselines under heterogeneity $\alpha=0.3$ and $n=17$ clients. In the first column, we have $f=1$ adversary. In all remaining columns, we use an amplification factor of $2$ for the attacks. Clean accuracy (i.e.\xcomma$f=0$) is reported in [Table 12](https://arxiv.org/html/2510.00310v2#A5.T12).
Refer to caption: x4.png

### E.7 Clean accuracy of different methods

[Tables 11](https://arxiv.org/html/2510.00310v2#A5.T11) and [12](https://arxiv.org/html/2510.00310v2#A5.T12) report the clean accuracy for all aggregations i.e.\xcommaaccuracy in the absence of adversaries.

**Table 11: Accuracy (%) of robust aggregations with no adversaries ($f=0$) and $n=17$. DeepSet-TM achieves the highest accuracy in most scenarios.**
| Heterogeneity | Dataset | Mean | CWTM | GM | CWMed | DeepSet-TM |
| --- | --- | --- | --- | --- | --- | --- |
| $\alpha=0.3$ | CIFAR-10 | $63.6\pm 2.6$ | $61.4\pm 3.0$ | $61.5\pm 2.8$ | $54.9\pm 2.6$ | $\mathbf{66.2\pm 0.8}$ |
| CIFAR-100 | $\mathbf{77.9\pm 0.7}$ | $74.0\pm 0.8$ | $73.7\pm 0.4$ | $65.0\pm 1.6$ | $77.7\pm 0.7$ |  |
| AG-News | $82.8\pm 2.4$ | $82.7\pm 2.4$ | $82.2\pm 2.6$ | $82.1\pm 2.5$ | $\mathbf{84.5\pm 1.1}$ |  |
| $\alpha=0.5$ | CIFAR-10 | $69.3\pm 1.0$ | $68.4\pm 1.1$ | $68.2\pm 1.2$ | $64.3\pm 2.5$ | $\mathbf{70.5\pm 1.1}$ |
| CIFAR-100 | $\mathbf{80.0\pm 0.4}$ | $77.8\pm 0.7$ | $77.0\pm 0.7$ | $73.6\pm 1.4$ | $79.6\pm 0.4$ |  |
| AG-News | $84.7\pm 1.2$ | $84.7\pm 1.2$ | $84.4\pm 1.4$ | $84.5\pm 1.4$ | $\mathbf{86.2\pm 0.5}$ |  |
| $\alpha=0.8$ | CIFAR-10 | $70.8\pm 0.6$ | $70.2\pm 0.8$ | $69.9\pm 0.7$ | $67.8\pm 1.7$ | $\mathbf{72.0\pm 0.7}$ |
| CIFAR-100 | $\mathbf{81.4\pm 0.4}$ | $80.1\pm 0.6$ | $79.7\pm 0.5$ | $77.6\pm 0.8$ | $80.8\pm 0.4$ |  |
| AG-News | $85.6\pm 0.9$ | $85.6\pm 1.0$ | $85.3\pm 1.0$ | $85.3\pm 0.9$ | $\mathbf{86.3\pm 0.5}$ |  |

**Table 12: Accuracy (%) of baselines with no adversaries ($f=0$) and $n=17$. Manifold Projection, the least robust baseline, has the highest accuracy in most scenarios. Nevertheless, the gap between the three algorithms is rather small.**
| Heterogeneity | Dataset | CoPur | Manifold Projection | DeepSet-TM |
| --- | --- | --- | --- | --- |
| $\alpha=0.3$ | CIFAR-10 | $70.7\pm 1.4$ | $\mathbf{71.8\pm 0.8}$ | $66.2\pm 0.8$ |
| CIFAR-100 | $73.9\pm 1.3$ | $\mathbf{77.8\pm 0.4}$ | $77.7\pm 0.7$ |  |
| AG-News | $86.9\pm 0.5$ | $\mathbf{87.0\pm 0.5}$ | $84.5\pm 1.1$ |  |
| $\alpha=0.5$ | CIFAR-10 | $73.0\pm 1.2$ | $\mathbf{74.1\pm 0.8}$ | $70.5\pm 1.1$ |
| CIFAR-100 | $75.3\pm 1.1$ | $77.8\pm 0.3$ | $\mathbf{79.6\pm 0.4}$ |  |
| AG-News | $87.7\pm 0.2$ | $\mathbf{87.9\pm 0.3}$ | $86.2\pm 0.5$ |  |

## Peer Reviews

confidence: 4
contribution: 3
initial_rating: 4
presentation: 3
questions: See Weaknesses.

The authors should address the practical implications of theorem 1 and extending experiments / ablation studies.
soundness: 2
strengths: * Good writing, clear motivations
* Theoretically guaranteed proposal with outstanding performance.
summary: This paper addresses the problem of robust federated inference, where the goal is to design an aggregator capable of handling mixtures of clean and corrupted predictions from multiple clients in a federated setting. The authors propose a training paradigm that estimates the residual test error through an adversarial loss, enabling robustness against prediction corruption. The method is theoretically grounded and demonstrates strong empirical performance compared to existing baselines.
weaknesses: * Theorem 1: How can the bound be controlled or estimated in practice? Since the left-hand side represents a loss function with an arbitrary value, how can we ensure it remains smaller than 1, given that the bound is a probability? The authors should provide a discussion after the theorem to clarify its practical implications.
* Applicability to Regression: How can the proposed framework (loss function, training algorithm, and theoretical results) be extended to regression tasks?
* Ablation Study: The authors should include ablation studies on the DeepSet aggregator to justify its necessity. Why are recently published aggregator architectures [1,2] not suitable? Would the findings remain consistent if a stronger or alternative aggregator were used?
* Experimental Settings: The current experimental setup appears somewhat simplified. In realistic scenarios, different clients may face distinct types of attacks. Have the authors evaluated the proposed approach under heterogeneous corruption settings to demonstrate its robustness and practical applicability?

[1] IIse et al., “Attention-based Deep Multiple Instance Learning”, arxiv 2018

[2] Xiang et al., “Exploring low-rank property in multiple instance learning for whole slide image classification”, ICLR’23

---

confidence: 5
contribution: 3
initial_rating: 4
presentation: 3
questions: See weakness.
soundness: 3
strengths: 1. Systematically address robustness in federated inference (as opposed to training), with both theoretical and empirical contributions.
2. The DeepSet-based model with adversarial training and test-time robust aggregation is effective.
3. The consistent performance gains as the number of clients and adversaries increases
summary: The paper formally define and analyze the problem of robust federated inference, where a central server aggregates predictions from multiple local models in the presence of adversarial clients. They introduce a method combining adversarial training with test-time robust aggregation (e.g., trimmed mean), which improves robustness without increasing training cost. The proposed DeepSet-TM method outperforms existing robust aggregation techniques.
weaknesses: 1. Adversarial training with DeepSet, while more efficient than full combinatorial search, is still computationally intensive, especially as n grows.
2. The analysis assumes f < n/2, which is common but may not hold in highly adversarial real-world settings. 
3. Some privacy concerns. The work focuses on robustness but does not discuss potential privacy implications of sharing probits or using server-side models.

---

confidence: 4
contribution: 3
initial_rating: 8
presentation: 3
questions: Kindly refer to weaknesses
soundness: 3
strengths: * The paper makes aa original theoretical contribution by providing the first formal robustness framework for federated inference, a setting previously treated mainly empirically.
* the theoretical strength is the counterexample construction that demonstrates the argmax discontinuity problem, showing that even infinitesimal perturbations in averaged probits can cause misclassification
* non-linear aggregation as an adversarial learning problem over probit vectors is conceptually novel. By recognizing that the adversarial space is structured (the probability simplex), the authors identify a tractable route to robustness.
* The proposed DeepSet-based robust aggregator then builds on this insight to combine permutation invariance, adversarial training, and inference-time robust averaging, achieving both theoretical justification and strong empirical performance.
summary: This paper provides the first formal robustness analysis of federated inference, where a central server aggregates model predictions (probits) from multiple local clients to make a global decision. It shows that widely used averaging-based and trimmed-mean aggregators, though intuitively robust, can still fail even small deviations in logit (prob) space can flip the final argmax decision. The authors formally characterise the robustness gap and prove upper bounds showing that robustness depends on three key factors: the corruption fraction the inter-client dissimilarity of honest outputs, and the classification margin of the average prob vector. To go beyond linear aggregation, they cast robust federated inference as an adversarial learning problem over probability vectors, and propose a DeepSet-based neural aggregator that combines adversarial training with test-time robust averaging.
weaknesses: * In REERM, the inner maximization is combinatorial and non-differentiable, requiring heuristic relaxations that undermine its minimax semantics. 
* The adversarial model is overpowered and underspecified, leading to unrealistic robustness assumptions and potentially excessive conservatism.
* Moreover, the learned DeepSet aggregator, though effective empirically, lacks analytical interpretability or formal robustness guarantees. Thus, REERM advances the conceptual framing of robust federated inference but leaves open key challenges in tractable optimization, principled approximation, and theoretical certification.
* What about KRUM aggregation as the robust aggregator?

---

confidence: 4
contribution: 4
initial_rating: 8
presentation: 4
questions: 1.The paper states that "the DeepSet-TM aggregator incorporates robust averaging (CWTM) at the inference time." Could you please elaborate on the specific mechanism of this "incorporation"? How are the outputs of DeepSet-TM combined with or selected alongside the results of CWTM during the testing phase, and how does this combination synergistically enhance robustness?
2.Regarding the computational efficiency of the DeepSet-TM aggregator, could you provide a more detailed analysis? Specifically, how much do the training time and inference latency of DeepSet-TM increase after introducing adversarial training and robust averaging at the testing phase, compared to a pure DeepSet or other non-linear aggregators? In large-scale federated deployments, is this increase acceptable in practice?
3.The paper highlights experiments on federated heterogeneity (controlled by the Dirichlet distribution parameter α), using α={0.3, 0.5, 0.8}. Could you further investigate DeepSet-TM's performance under higher heterogeneity (e.g., smaller α values, or other means of introducing larger data distribution shifts)? Does the design of DeepSet-TM have inherent advantages or limitations when dealing with extreme data heterogeneity?
soundness: 4
strengths: This paper makes several substantial contributions in the field of robust federated inference, demonstrating high originality and significance. Firstly, the paper formally defines the critical problem of "robust federated inference" for the first time, clearly delineating the challenge of ensuring aggregator accuracy in the presence of malicious clients. This issue has long been overlooked in existing literature and possesses significant theoretical and practical value. Secondly, the paper conducts an in-depth theoretical analysis of averaging-based aggregators, revealing the complex relationship between their robustness, client output disparities, and prediction margins. This provides a solid theoretical foundation for understanding the limitations of existing methods and points the way towards more refined future designs. Most importantly, the proposed DeepSet-TM aggregator is highly original; it creatively reframes the robust inference problem as an adversarial machine learning problem and cleverly leverages the permutation invariance of the DeepSet model to address the computational complexity of adversarial training. This method, by combining adversarial training and robust averaging during the testing phase, effectively enhances robustness. The experimental section also demonstrates DeepSet-TM's superior performance across various datasets and attack types, with accuracy improvements ranging from 4.7% to 22.2%, thereby proving its strong potential and importance in practical applications.
summary: This paper systematically investigates a critical security issue in federated learning and edge computing: the robustness of federated inference. The authors point out that existing model ensemble and aggregation paradigms are highly vulnerable to simple attacks from malicious clients. They formally define the problem of "robust federated inference" for the first time, filling a gap in the field. Through an initial theoretical analysis of averaging-based aggregators, the paper reveals that the error of these methods depends not only on the proportion of malicious clients (corruption fraction) but also on the dissimilarity between honest client outputs and the prediction margin of the models for the two most probable classes. This analysis lays a solid theoretical foundation for subsequent method design.
To address the robustness problem in non-linear scenarios, the paper proposes a novel DeepSet-TM aggregator. This method ingeniously reframes the robust inference problem as an adversarial machine learning problem in the probit vector space and leverages the permutation invariance of the DeepSet architecture to significantly reduce the computational complexity of adversarial training. By introducing adversarial samples during the training phase and combining them with robust averaging (CWTM) mechanisms during the testing phase, DeepSet-TM ensures the aggregator's resilience to malicious inputs. The paper conducts rigorous empirical validation on multiple benchmarks, including image and text classification. The results demonstrate that DeepSet-TM achieves a significant improvement in worst-case accuracy, ranging from 4.7% to 22.2%, compared to existing techniques across various attacks (including the newly proposed SIA attack), strongly proving the practical utility and robustness of the proposed scheme.
weaknesses: Despite the paper's excellent performance in both conceptual and methodological aspects, there remain areas for improvement. Firstly, while the paper defines robust federated inference in the "Problem Formulation" section, some critical assumptions, such as those regarding the security of the client models themselves, could be elaborated upon in more detail. Currently, the paper primarily focuses on the robustness of the aggregation phase. However, if client models are susceptible to poisoning or backdoor attacks, this could impact the overall system robustness, a topic that receives relatively less discussion in the paper. Secondly, the computational cost and model complexity of the DeepSet-TM aggregator are potential weaknesses. Although the paper mentions leveraging permutation invariance to reduce the search space for adversaries, its actual overhead during training and inference (especially in large-scale federated deployments) still requires more detailed analysis and quantification compared to simpler averaging or median aggregators, such as providing end-to-end training time or inference latency comparisons for different aggregators. Furthermore, while the experimental results are impressive, it would be beneficial to further investigate DeepSet-TM's performance under varying degrees of federated heterogeneity (e.g., larger data distribution shifts among different clients) to comprehensively evaluate its generalization capabilities.

---

confidence: 4
contribution: 3
initial_rating: 4
presentation: 3
questions: (1) Why is the assumption in line 241 required, i.e., if $[z]\_k = [z]\_{k'}$ for all $k,k'$, then $MARGIN(z) = \infty$?

(2) Lines 321-322 show that robust averaging is only incorporated at the inference time. Will the added ROBAVG operator change the optimality of the robust DeepSet aggregator defined in Eq. (8)? Why does it reduce the overall sensitivity of $\phi\_{\theta^*}$? 

(3) Why does the proposed DeepSet-TM approach consistently achieve inferior robustness under Loss Maximization Attack (LMA) in Table 2?

(4) DeepSet-TM replaces the point-wise loss function from the indicator function with the cross-entropy loss. Will it better handle the counter examples in lines 222-225?

(5) How is the function $\bar{h}(x)$ calculated in the counter example?
soundness: 2
strengths: **Originality:** This work highlights the impact of the point-wise model dissimilarity and the probit’s margin on the robustness gap using linear averaging aggregation for federated inference. It also introduced a novel DeepSet-based framework to learn non-linear data-dependent robust aggregation function.

**Quality:** The provided counter example shows the prediction error induced by the non-continuity of the argmax operator. Theorem 1 theoretically analyzes the robustness gap of linear averaging aggregation for federated inference, followed by empirical validation in Figure 3. The robustness of the DeepSet-TM framework is also validated in the experiments using various attacks.

**Clarity:** The paper is well-written. The motivation behind robust federated inference is clearly discussed. The proofs of lemma and theorem are provided.

**Significance"** The problem of federated inference under potentially corrupted clients is highly significant in the context of real-world federated learning systems. A robust federated inference framework can largely improve the trustworthiness of the deployed systems.
summary: This paper investigates the adversarial robustness of federated inference in the presence of corrupted clients. It demonstrates that robust averaging may be insufficient due to the non-continuity of the argmax operator. It also introduced a DeepSet-TM approach for robust non-linear aggregation by formulating the robust inference as an adversarial training problem. Experimental results demonstrate the superior robustness of the proposed DeepSet-TM framework over baselines in various attacking scenarios.
weaknesses: (1) One major concern is the certification for DeepSet-TM under adversarial corruptions. Section 3 considers the linear averaging aggregation strategies and derives the theoretical result (Theorem 1) in shaping the robustness gap. Specifically, it highlights the impact of the corruption fraction, the model dissimilarity, and the probit’s margin. However, it is unclear how this robustness gap can be characterized in non-linear cases using DeepSet-TM. The highlighted potential factors, such as the point-wise model dissimilarity and the probit’s margin, are not explored in the non-linear aggregation of DeepSet-TM.

(2) Another concern is the computational efficiency of the proposed DeepSet-TM method in adversarial training (i.e., bi-level optimization problem). Though several simplification strategies are proposed, the running efficiency of DeepSet-TM is not well discussed compared to baselines.

(3) The impact of the simplification strategies for optimizing the robust DeepSet aggregator can be further discussed. With these simplification strategies (as well as ROBAVG operator in Eq. (10)), how will the derived solutions still approximate the optimal solution of the optimization problem in Eq. (9)?


Decision: Accept (Poster)