Byzantine-Robust Federated Learning with Learnable Aggregation Weights
Authors: Javad Parsa
Amir Hossein Daghestani
André M. H. Teixeira
Mikael Johansson
Venue: ICLR 2026 Poster (2026)
Keywords: Federated Learning
Byzantine Robustness
Distributed Optimization
Primary area: optimization
TL;DR: We propose a Byzantine-robust federated learning method that jointly learns aggregation weights and model parameters, outperforming existing methods under heterogeneous data and strong attacks.

Abstract: Federated Learning (FL) enables clients to collaboratively train a global model without sharing their private data. However, the presence of malicious (Byzantine) clients poses significant challenges to the robustness of FL, particularly when data distributions across clients are heterogeneous. In this paper, we propose a novel Byzantine-robust FL optimization problem that incorporates adaptive weighting into the aggregation process. Unlike conventional approaches, our formulation treats aggregation weights as learnable parameters, jointly optimizing them alongside the global model parameters. To solve this optimization problem, we develop an alternating minimization algorithm with strong convergence guarantees under adversarial attack. 
We analyze the Byzantine resilience of the proposed objective.
We evaluate the performance of our algorithm against state-of-the-art Byzantine-robust FL approaches across various datasets and attack scenarios. Experimental results demonstrate that our method consistently outperforms existing approaches, particularly in settings with highly heterogeneous data and a large proportion of malicious clients.

Published as a conference paper at ICLR 2026
BYZANTINE-ROBUST FEDERATED LEARNING WITH LEARNABLE AGGREGATION WEIGHTS
Javad Parsa"
Amir Hossein Daghestani" : KTH, Sweden
André M. H. Teixeira Uppsala University, Sweden
Mikael Johansson KTH, Sweden
Uppsala University, Sweden
ABSTRACT
Federated Learning (FL) enables clients to collaboratively train a global model without sharing their private data. However, the presence of malicious (Byzantine) clients poses significant challenges to the robustness of Fl., particularly when data distributions across clients are heterogeneous, In this paper, we propose novel Byzantine-robust FL optimization problem that incorporates adaptive weighting into the aggregation process. Unlike conventional approaches, our formulation treats aggregation weights as learnable parameters, jointly optimizing them alongside the global model parameters. To solve this optimization problem, we develop an alternating minimization algorithm with strong convergence guarantees under adversarial attack. We analyze the Byzantine resilience of the proposed objective. We evaluate the performance of our algorithm against state-of-the-arr Byzantine-robust FL approaches across various datasets and attack scenarios. Experimental results demonstrate that our method consistently outperforms existing approaches, particularly in settings with highly heterogeneous data and large proportion of malicious clients.
1 INTRODUCTION
Federated I Learning (FL.) is distributed machine learning framework that enables multiple clients to collaboratively train a shared global model without transferring their private data to central location (Li et al., 2020a Bonawitz et al. 2019 Li et al. 2020b McMahan et al.) 2017). Instead of centralizing data, FL only exchanges model updates such as gradients or parameters, between the clients and the central server. This architecture mitigates privacy risks and supports applications with distributed data that is too costly or too sensitive share (Li al. 2020a).. In this paper, we focus on cross-silo FL. where a moderate number of long-lived clients (e.g., hospitals or financial institutions) participate in each round.
In a typical FL. workflow, a central server initializes a global model and sends it to the clients. Each client trains the model locally its private dataset and transmits only the resulting updates back the server (Li et al.. 2020a McMahan et al. 2017). The server aggregates these updates to improve the global model, and this cycle repeats across multiple communication rounds. Federated Averaging (FedAvg), one of the most widely adopted FL algorithms, computes a weighted average of client updates, accounting for the size of each client's dataset (McMahan et al. 2017).
A significant challenge in FL arises from the presence of malicious clients, often referred to as Byzantine clients. Previous studies (Baruch et al. (2019) Fang et al. (0000) have highlighted that the global model trained using FedAvg can be compromised when malicious clients deliberately send malicious model updates. Detecting such malicious behavior is inherently challenging due to the decentralized nature of FL., where the server has limited visibility into individual clients' local data and training processes. This challenge is further exacerbated in scenarios with heterogeneous data distributions, where each client's 's local dataset may differ significantly from others in terms of represented classes, feature distributions, or data volumes. These variations in data distributions make difficult to differentiate between benign updates influenced by data heterogeneity and corrupted updates sent by malicious clients (Cao et al. 2021: Liu ct al. 2023b).
Various studies (Yin et al. 2018; Blanchard et al. 2017 Liu et al. 2023b Guerraoui et al.) 2018 Pillutla et al. 2022
Karimireddy et al. 2022 1 have proposed Byzantine-rohuss FL. strategies to defend against malicious clients. Generally, robust aggregation methods can be clustered in three categories: distance-based (Blanchard al. 2017). statistic-based (Yin et al. 2018): Farhadkhani et al., 2022: Liu et al.] 2023a). and performance-
approaches (Xie et al.) 2019).
Krum, which is distance-based method, filters outliers by selecting updates with the smallest cumulative Buclidean distance to their neighbors (Blanchard et al. 2017),, while Median is a statistical method that replaces the mean operator with the median when aggregating local updates (Yin et al. 2018). Trimmedmean removes fraction of the largest
"Equal contribution.

---

Published as a conference paper at ICLR 2026
FedLAW (Ours)
Bulyan Trimmed Mean
Bulyan Bucketing
Krum
Coordinate-wise Median
Benign Malicious
Huber Aggregator
Inverse Gradient Attack
FedLAW Inverse Gradient
0.2
Test acc, (%)
80
Client weight
0.15
60
0.1
40
0.05
20
0
50 100
150
200
20
40
60
80
100
Epoch (global model update)
Figure 1: Test accuracy and weight evolution on MNIST under the inverse gradient attack (setting: q = 0.9. 40% malicious; see Section(5), Left: Average test accuracy =1 std over 200 epochs and 5 runs, evaluated across multiple methods with 200 clients. Right: Aggregation weights of individual clients during the first 100 epochs (10 clients; MLP, batch size 64, local epochs). Benign clients quickly converge to stable, non-trivial weights, while malicious clients are consistently suppressed.
and smallest values for each parameter before computing the mean of the remaining values (Yin et al. 2018). Bulyan combines Krum select consistent updates and Median to refine them (Guerraoui et al. 2018).
Defending against Byzantine attacks in heterogeneous settings presents substantial challenges (Karimireddy et al, 2020 Liu et al. 2023b). To the best of our knowledge, all existing ryzzantine-rbbus FL methods typically follow similar approach: after identifying and removing malicious clients, they assign uniform aggregation weights to the benign clients, akin FedAvg (Blanchard al.. 2017, Whekwaalkrr& & Houmansadr] 2021 Karimireddy et al.) 2020 Liu et al. 2023b Mhhmdi et al. 2018).. While this approach simplifies the aggregation process, it poses a significant drawback in heterogeneous data settings. Specifically, after removing the malicious clients, the distribution of data examples with specific labels may become imbalanced among the remaining benign clients. Assigning uniform weights in such scenario fails adapt this imbalance, potentially degrading accuracy by not giving sufficient attention to all labels. This challenge becomes increasingly critical as the degree of data heterogeneity increases and label imbalance among benign clients becoming more pronounced. Addressing this challenge requires aggregation weights adjusted to the underlying data distribution. Figure|] [ illustraaes this phenomenon, showing how the aggregation weights of benign and malicious clients evolve under an inverse gradient attack and how adaptive weighting influences test accuracy.
We further demonstrate this relationship through empirical results in Section
Contributions. In this paper, we propose novel method for secure and robust FL that integrates adaptive weighting into the aggregation process. Unlike conventional methods, our approach treats aggregation weight selection as part of the learning procedure, akin to global model parameters.
First, we formulate the proposed optimization problem of jointly learning the global model parameters and the aggregation weights. Subsequently, we propose an algorithm to solve this problem using an alternating minimization approach that involves two key steps: first, minimizing the objective with respect to aggregation weights, and second, minimizing it with respect to the model parameters.
We provide theoretical analyses demonstrating both the Byzantine resilience and convergence properties of method. Theorem establish convergence guarantees for learning the aggregation weights step. In Theorem 3 we further prove that, under adversarial settings, the sequences generated by our algorithm, including both the aggregation weights and global model parameters, converge to neighborhood of the optimum of the cost function.
2 shows that the proposed objective is robust to malicious agents. In Theorem [1] we
We evaluate the performance of our method against state-of-the-we art Byzantine- robust FL approaches, consider- ing five types of attacks and two different datasets under varying levels of heterogeneity.
Structure of the paper. The remainder of this paper is organized as follows: Section introduces the notation and model framework used throughout. Section 3 presents our novel approach for Byzantine-robust FL, along with the corresponding solution algorithm. Section analyzes the Byzantine resilience of the proposed method and provides convergence results. Finally, Section eJvallatess our method through comprehensive numerical experiments comparing it against state-of-the-a art Byzantine-robug FL algorithms.
2

---

Published as a conference paper at ICLR 2026
2 NOTATION AND MODEL
2.1 NOTATION
Vectors and matrices are denoted by bold lowercase and uppercase letters, respectively. The support of a vector w, denoted by supp(w). is the set of indices corresponding the non-zero elements in w. The symbols ||w|]o and ||w||2 denote the lo pseudo-norm (i.e., the number of non-zero elements in w) and the & norm of w, respectively. The inner product of two vectors x and y is represented by y). Additionally, w denotes the gradient of the function f with respect to w. The vector XA is subset of the vector x, which contains only the elements indexed by the entries in the vector A. The i-th element of the vector x is denoted by z4. Finally, Ve,i denotes the vector associated with client at synchronous round k. Throughout the paper, (-) denotes expectation over the full-batch data distribution, while Exnch {-} denotes expectation with respect to mini-batch random sampling.
2.2 MODEL
We consider federated learning system with parameter server and clients, up to by of which may be Byzantine (acting arbitrarily). In each synchronous round k. the server broadcasts the global model parameters 02 E Rd to all clients. Each honest client computes a mini-batch gradient Vk,e := B Σ2Ee,, vofi(0x: where Ex,, C D; is a random sample of size B from its local dataset D. This mini-batch gradient is an unbiased estimate of the client's 's full batch population gradient, Vk,.. satisfying: Be.,, (V..) = Vk, Vofi(Ox) with Ep, { { gk, Each Byzantine client j may submit an arbitrary gradient vector b and loss fr.i. Attackers have full knowledge of the system and can collaborate [Lynch] 1996). The server receives n gradient vectors, applies a robust aggregation rule compute a single aggregated gradient F2. and updates the model via the rule 0x+1 = 02 - aa
3 BYZANTINE-ROBUST FEDERATED LEARNING WITH LEARNABLE WEIGHTS
3.1 PROBLEM FORMULATION
Traditional FL aims of finding set of global model parameters 0 IRd minimizing the training loss f(0)
Σ w. (.))
where n is the number of clients and fa R R represents the loss function of the i-th client. The aggregation weights Wy are fixed and satisfy w, 2 0 and Σi= W, = 1. Byzantine resilience is typically introduced by adding functionality for detecting malicious clients and removing them from the learning process, effectively setting the corresponding w, to zero.
The key idea our approach to transform the binary detection and removal of suspicious clients into a continuous weight optimization process, effectively embedding the Byzantine defense into the learning objective itself. We do so by treating the weights w = [wi,..., Wp] as decision variables and jointly optimize them with 0:
min DERd.WEAT 1.
wi)((()
where
Ate, (WE R R
Σ w; = w. 2 0, St, /wllo S s}.
(2)
Here Ate denotes a sparse unit-capped simplex, and the tn pseudo norm of w is utilized to achieve Byzantine f,o robustness. Notably, if we 1/(n - by) and n by. the only feasible weight vectors in A + are those
where by clients are excluded and all others are weighted equally in the objective (see Proposition 2 in $ A of the Supplementary).
3.2 PROPOSED ALGORITHM
Several techniques for solving (I) already exist, including the BSUM algorithm by Razaviyyayn et al. (2013) and the
prox-linear approach introduced in (Drusvyatskiy et al. 2019). These algorithms rely on alternating between updating the weights for fixed model parameters, and revising the model parameters for fixed weights. In our experience (see [ in the Supplementary), such updates tend to be too aggressive, and miss important couplings between the two variable
3

---

Published as a conference paper at ICLR 2026
blocks that are helpful for detecting malicious clients. To address these challenges, we propose a new algorithm based on rewriting ( as a nested optimization problem (Dempe 2002:
min w wEAT
min FER
80 f.())
(3)
To solve the inner optimization problem, we use quadratic approximation f((0) of f((0)
O() f((0)) (VeJ((0s); 02)
2a 0
(4)
Substituting this quadratic approximation into the inner optimization problem in 33) leads to:
0k+1 (w) argmin
w. f0 0x) - O2 wi V..(O)) O2. aG,
(5)
OERd
where o is a step size and G2 VaJi (0x).
vn Note that the model update depends on the aggregation weights. This dependence is accounted for in the outer optimization, which becomes
n
Wi+1 = argmin
w. w.Ji((z+1
argmin wEAT
Σ
wiJi(On aG&w),
(6)
wEAT
The optimization in O6 minimizes the global objective by adjusting the weights E A.e. considering the effect that they have on the parameter update (x+1(w) 02 aG,w. In particular, the weighted combination of client gradients in G2 shapes the parameter update, coupling the choice of weights to the losses fi(0x-(ww)) This formulation prioritizes clients whose gradients, represented by the columns of Gg. align with the descent direction of f((O; wG, as benign client gradients typically form a coherent cluster in the parameter space. In contrast, Byzantine clients tend to submit updates that deviate from this direction or behave inconsistently due to adversarial perturbations, making them outliers. The sparsity constraint A ensures that up to Byzantines, are excluded, enhancing robustness of the learning process (see $ B in the Supplementary).
misaligned clients, including
While 5 is a simple gradient descent step, the optimization in (6) is more challenging since both its objective and constraint set are non-convex. Nevertheless, it can be approached by first approximating
t (w)
( aG&w)
by the following quadratic function
1
Φ (w) = 4 (Wx) + 1w w We) + |w wx 11
2,
for some positive step-size B. We then replace (6) by
Wk+1 argmin (w) + 8s;10 (w)
(8)
where S2, (w) is the indicator function of the set A A... By completing the square and dropping constant terms, the above update is equivalent to
Wk+1 argmin 1 |w h4 88 (w) = prox At.o (h$),
and the final equality follows from the definition of the proximal mapping in (16) (see $ A in the Supplementary). Thus, Wk+1 is the projection of h2 onto the sparse unit capped simplex A Although this set is non-convex, the next result shows how the projection can be performed efficiently.
where h&- = W/
Theorem 1. Denote Pt, (ha) the operator selecting the largest elements of the vector his and let PAt be the
projection operator onto the unit-capped simplex A {w B Ei= w; 1, w; 2 0, w. S {}, which has efficient solution provided in Algorithm (see Section D in the Supplementury).
The problem 99 is exactly solved by the three-step projection method below:

---

Published as a conference paper at ICLR 2026
1. Sparsity enforcement h,. = PL. (h+)
2. Support selection: S = supp((>))
(10)
3. Unit capped simplex projection: Wk+lg. PP -Ar WH+1(S-)0 0.
Proof. See Section B in the Supplementary.
After having updated the weights Wa+1 based on (9). the parameter vector 0g can be updated by substituting w = Wk+1 into (5. yielding:
x++1 0₁ aG&
(11)
The pseudo-code of the final algorithm is summarized in Algorithm (see Supplementary).
To translate our algorithm procedure the FL framework, at epoch l + 1, the server broadcasts 0, to clients, who return Voli(Ox). The server constructs Gk. computes OR+1 = O2 G W., and sends 0x+11 to clients. Clients respond with Ve (0++1)] The server then updates Wk+1 via 10). with h2 = W& + ag Gk-1 1f and computes Q via This requires two communication rounds: for 0₂ and gradients, another for 0 and client responses.
fa+1 = [fi (....)........ (n (1++))) and Gk+1 ef
Remark 1. While our method requires two communication rounds per training epoch, this does not necessarily imply a doubling of total communication rounds compared standard FL. We highlight key factor that mitigate this cost. Introducing w as a decision variable offers additional flexibility in minimizing the loss (see (6)), which accelerates convergence of the global model parameters (see Figure in the Supplementary), To fairly compare methods, we evaluate performance based on total communication rounds. Figure shows that FedLAW achieves higher test accuracy within the same communication round. a result, the total number of rounds required reach a target accuracy by our method may be only marginally higher, or even lower than that of competing methods.
We conclude this section by discussing the server-side overhead relative to standard FL. The only extra step in our method is the aggregation weight update (1O), while the model update remains identical to that in standard FL. The following proposition quantifies the complexity of the extra step.
Proposition 1. The memory complexity of server-side aggregation weight update based on (10) is (dn) per round, and the computational complexity of the projection (10) in the server is O(n (n min(s, log s ²),, where is the number of model parameters, n is the number of clients, and is the sparsity level.
Proof. See Section 1.5 in the Supplementary.
4 THEORETICAL ANALYSES
4.1
BYZANTINE-RESILLI ANALYSIS
The main method proposed in is designed for Byzantine-resllintt federated learning through optimized aggregation weights. The following theorem establishes its resilience property, as formalized in Definition (Section A in the Supplementary).
The first step in our resilience analysis is to make the objective in (6) analytically tractable. We use Taylor's theorem with exact remainder to reformulate it, revealing that governed by the quadratic form w" G G. w. By denoting Vk.i = (ofx())., we can show this term is equivalent to an expression involving pairwise gradient distances:
wT
w" G G = Σ wi v
w.w, I -v
From here, the proof exploits the terms || V 12 with a novel, especially tailored approach to establish Byzantine resilience. Although gradient differences are exploited in other Byzantine-resilke resilient methods, here they appear naturally from the structure of (6) using our novel derivations. Note that the nested structure of (3) leading to 6 is an essential building block.
It is important to highlight that, unlike Definition 5 we consider a more general setting where population losses and gradients are non-iid. To improve practicality, our analysis also focuses on the case where the aggregator relies on mini-batch gradients rather than full-batch gradients, which is more realistic scenario.
5

---

Published as conference paper at ICLR 2026
We now state the formal assumptions for our theoretical analysis.
Assumption (Formal Setup for Theoretical Analysis). analyze the setting where each honest client E H provides mini-batch grudient VE,5 of size B. Let VR,i (aJi(On) be the full butch population gradient. We assume the following:
(A) Client loss functions
(AI) (Smoothness) Each client loss function (:(0) is Ly-smooth, with Lmax maxisisn Ii.
(A2) The weight objective function Qx (w) in ( with respect to w is Lm-oth.th.
(B) Step-size Schedule
(BI) Algorithm 2 employs a hybrid schedule where the step-size a a fixed constant < a < L/Lmxxx and
the weight step-size {3k] is an adaptive schedule satisfying the standard Robbins-Monro conditions (By 0, 1k + 0. Σ 3x oc, Σ 32 < 00) and 3y < <1/Lw.
(C) Stochastic Gradient Model
(CI) The deviation of any single-sample gradient from its full batch population is bounded by (V -v. Rg single data point
(D) Population Heterogeneity
(DI) We assume the population gradients and losses at round k, {f((0k), VASheN is E[vk.) gx, with
[ Eien Sk,ú Mig.i [B)} with mavy
Σ
Ma, and
SEH
Directional Heterogeneily:
[HT Σ NEH
|ga,i
g||² H
Magnitude Heterogeneity:
||gk, 2 |1g|1 - K2.
CliertClient Variance:
[[[[VR - 11:) S do 2
Loss Heterogeneity: [H ΣiEn [Ma,i Mavg) <
(E) Byzantine Clients and Aggregator
(EI) Attackers submit arbitrary gradients by. and non-negative losses fr. 2 0, subject to the norm constraint [|bx, I max (ix..ll2. JEH
Theorem 2 P Byzantine Resilience). Under Assumption (excluding A2 and Bf) and let assume by min-batch gradient updates Vk,5 are replaced with their Byzantine counterparts b at any round with 2by + S n. Let the aggregator be computed as follows
F
F=Ewa
+
Σ Wky Wk.bb.j
(12)
dEH
jEHD
where Wa represents the optimal weight vector obtained from (6). for step-size 0 < a S Omax in which
Omna = mminn { Lmaxx 2L lgg 1 Es
1
Chet
2R log(2d/6)
(13)
B
4K2b,
+ 2H2 + 2 bj 2)
2
Chet
+
n-b; by
n- by
by
Then, with probability at least 1 6, the aggregator F. is Byzantine-resilien Specifically, its expected bias with respect to the true global mean g bounded by:
[B(F] g S 1kk
(14)
where the error bound Tı is explicitly decomposed into the distinct sources of error:
[8k + Chr + (x 1Kk 2bg (Et
Ox(
H2
K2 2
+ do + El)) + Vn - b
2b H + ES
(15)
2
6

---

Published as a conference paper at ICLR 2026
Furthermore, if the signal-to-noise condition The Iggl holds. then the angle Ç between the expected aggregated gradient E, }) and the true global gradient g is bounded by sin lgel
Proof. See Section in the Supplementary.
Theorem provides comprehensive resilience guarantee for the proposed method. The key insight the error decomposition in Eq. (15), which shows that the total error Ví is sum of four distinct and well-characterized sources: loss heterogeneity, gradient heterogeneity, inter-client variance, and mini-batch sampling noise. The bound explicitly shows that the sampling noise is controllable, it vanishes when the mini-batch size B increases.
The assumptions underpinning this result are standard and practically justifiable. The condition ||ba,ill S max [| ll
JEW
is enforced in practice by standard gradient clipping mechanism on the server side: each incoming update is projected onto an fz-ball of radius C. Honest updates remain untouched when exceeds their typical norm, whereas malicious updates cannot exceed the threshold. This adds no extra communication and is already commonplace in FedAvg, DP-Fed, and similar protocols. Similarly, assuming bounded heterogeneity (H) K2) a standard prerequisite for any non-IID analysis. In addition, in practice Ex is typically very small even under a high heterogeneity, thereby mitigating the effect of the 1/a scaling in (5).. To support this empirically, we explicitly measured E under a large malicious fraction and extreme heterogeneity in Subsection I.6 which confirms this behavior. Additionally, Byzantine resilience under the scenario where both the losses and gradients are replaced with Byzantine versions is established separately in Theorem X (see Section in the Supplementary).
Remark 2. Theorem Dis is stated in probabilistic form because, in practice FedLAW operates mini-batch gradients rather than full-batch expectations. Mini-bate sampling introduces an additional source of randomness beyond the data distribution, and in an adversarial setting the attacker interacts with single realizations of these samples, not their expectation. brihh-probbbiiity bounds therefore provide a more realistic Byzantine- rexniine-essilencee guarantee than purely deterministic, full-batch analyses.
4.2 CONVERGENCE ANALYSIS
A key difficulty in Algorithm is the arbitrary behavior of the adversary, which complicates the convergence analysis of our alternating minimization scheme to optimize O and jointly. We tackle this by viewing the method through the lens of a hybrid step-size schedule. This perspective yields a strong stability guarantee: even under attack, the adaptive weights not only stabilize, but their limit is eritical point of the exact nnon-aprroximated) objective (6). Building on this result, the following theorem establishes convergence non-convex and strongly convex regimes under adversarial conditions.
neighborhood of the optimum of problem (I in both
Theorem 3. Let the sequences {(0x, ) be generated by Algorithm 2 Let the aggregator be Fi(w)) = G&w with bounded variance Var)F)(Wk)) S P. where Gg contain mini-batch honest gradients as well as arbitrary Byzantine gradients. Assume Assumption Tholds and suppose:
[[E(F((w<)) -gall S SN where gi = I Wp, WE
As k + oc, we have ÇK + Soc. of + o. and of + o2.-
Then, the aggregation weights satisfy Wk-1 + Wk as k - oo with limits point w", which is a critical point of 6 for k + Moreover, the following convergence guarantees hold:
1. (L-smooth, stationary point of the main loss function (T. In particular, with probability at least 1 - 8, the time-averaged squared gradient norm is bounded as:
Case) The sequence generated by our algorithm converges neighborhood of a
C2 Σ
1 T
lim sup T420
1B 1|
lim T-000
= 0 (C2 + 0,,000
T
TC
k=0
where Ci = {1 - at (xTmaax) > 0, E5
/
272 log(24/8)
and
B
( + +ox + ox Vod +0xx) + (2Gx+1 + C4 + 4C
C2,b = 25A-1 / K2 + do + +
4C1
7

---

Published as a conference paper at ICLR 2026
2. (Strongly Convex and L-smooth Case) If the client loss functions f. are p-strongly convex, then the algorithm converges to a neighborhood of the global optimun. Moreover, with probability at least we have
lim sup E{Q(Os, wa) Q*) < do + C2.00 = 7 + +200) 2pC1
1000
in which Q0,, w) denotes loss function in Also, Q* its global minimum when w", evaluated under honest gradients.
In addition, the bound See S Teoo holds, where Tec the upper bound from 14) in Theorem
representing the
Byzantine resilience guarantee of the update rule (6) as k 00.
Proof. See Section in the Supplementary.
Theorem 3 establishes that our algorithm converges a bounded neighborhood of the optimum, with the error radius scaling directly with the adversary's 's influence. The final error bound is determined by the asymptotic bias and variance of the aggregator (6oe; F.x)). ). highlighting a powerful property: as the aggregator improves (e.g.. Se - 0), the algorithm converges to increasingly precise solutions.
The key insight of our work lies in the formal link between these two results. Theorem 2 provides a per-iteration resilience guarantee (7²)) while Theorem 3 strengthens this by showing that the asymptotic bias is bounded by the same guarantee, (x S T/s- Together, they establish that the long-term bias of the converged system controlled by the same mechanism that ensures step-wise robustness. This unifies the static resilience of the aggregator with the dynamic convergence of the algorithm, demonstrating that robustness at the aggregation level directly translates into stability and convergence at the system level.
This theoretical foundation strongly supported by our empirical results. Our experiments (e.g.. Figs. and show the practical outcome of this theory: the algorithm effectively neutralizes attackers by learning to assign them zero weight, which is empirical evidence that the bias &a converges to zero. Furthermore, the theoretical insights in Section B explain the mechanism by which our objective function enables the detection of malicious clients, providing clear rationale for the algorithm's 's observed success.
Furthermore, in Appendix H3 show that if each is L--smooth and has bounded gradients with upper bound C, then V 2u (w) is -ipschitz continuous with
I S aC* a + anLmax + and Lmnaxl
2
where Vkl + Td with h: = [1/6] and r = - kl E (0,
5 NUMERICAL STUDY
In this section, we evaluate the performance of the proposed FedLAW algorithm, and compare it against state-of-the-arr Byzantineroobust FI. baselines diverse attack scenarios and datasets.
5.1 EXPERIMENTAL SETUP
Datasets and Models: We conduct experiments on the MNIST (LeCun & Cortes 2010) and CIFAR10 (Krizhevsky et al. 2009) datasets. We train 3-layer fully connected network MNIST, and a 4-yeeer convolutional neural network with group normalization on CIFAR10.
Data Distribution and Client Configuration: We simulate a federated setting with 200 clients and distribute the data in a non-III fashion using the method from Cao et al. (202I). To control the degree of data heterogeneity, we introduce concentration parameter q: each training example with label is assigned to the 1-th group with probability g, and to the remaining L. 1 groups with probability i-g. where L 10 is the total number of labels in our experiments. Within each group, data uniformly distributed to clients. We consider E {0.6, 0.9} to simulate moderate and high levels of data heterogeneity, respectively. The proportion of malicious clients varies across (0.1, 0.2, 0.4).
Attack Types and Baselines: We evaluate robustness under five adversarial attacks: label-fiipping nnverse-gradien backdoor, combined (double) attack, and the LIE (Little Is Enough) attack. For comparison, we consider several baseline defenses: Krum, Trimmed Mean, Bulyan, Coordinate-winn Median (CwMed), CCLIP (Centered CLIPping Karimireddy et al. 2020 ) RFA (Robust Federated Averaging (Pillutla et al., 2022)), Huber aggregator (Zhao et al.
8

---

Published as a conference paper at ICLR 2026
2024) and Bucketing combined with Bulyan, RFA, or CCLIP. As a non-robust reference, we also include FedAvg, the standard aggregation without defense.
Each dataset is split into 80% training, 10% validation, and 10% testing. We report average test accuracy and malicious client detection accuracy over five independent runs. Standard deviations are provided in tables (not included here) for completeness.
Evaluation Protocol:
Additional experimental details, including computational complexity, hyperparameter settings, and sensitivity analysis, are provided in Section | of the Supplementary.
5.2 EXPERIMENTAL RESULTS
Our experiments show that FedLAW delivers consistently strong results, typically surpassing robust baselines. The advantage is especially pronounced under severe contamination and heterogeneity; for example, under the inverse-gradice attack with 40% malicious clients, FedLAW attains a test accuracy 3.6% higher than the next-best defense. While several methods remain competitive at low attack rates, defenses such as RFA, RFA-bbcckting, CClip, and CClip-bucketing deteriorate markedly as the attacker fraction grows, with some even diverging. For example, under the double attack, the accuracy of RFA and RFA-bucketing decreases by more than 31 % with rising heterogeneity, and both CClip and CClip-bucketing diverge, whereas FedLAW maintains robustness.
Results on MNIST (see F a and T):
A defining strength of FedLAW is its stability. Whereas competing defenses degrade sharply, FedLAW's accuracy remains notably consistent across attacker fractions, exhibiting graceful degradation. This robustness stems from two-pronged design: it (i) identifies and removes malicious clients and (ii) adaptively reweights the remaining honest updates. Unlike traditional approaches that revert to uniform weights after filtering suspected clients, FedL.AW continuously learns optimal weights, enhancing both robustness and representational fairness.
Results on CIFARIO (see F and T) The more complex CIFAR 10 dataset presents additional challenges due to its higher dimensionality and visual diversity. Nevertheless, FedLAW consistently shows strong resilience across all attack types and configurations. Under label flipping with q = 0.6 and 40% adversaries, FedLAW reaches 70.5% accuracy, +8.3 percentage-point gain over the best baseline (Bulyan at 62.2%). For eiverse-gradien attacks with improvement over the best baseline (59.38% vs.
q = 0.9 and 40% adversaries, it delivers a +3.1 percentage-poit 56.24%), while RFA and CClip variants diverge. In the challenging Double attack, FedLAW delivers the best results among state-of-the -ftthe--- methods. Likewise, in Lie Attack, FedLAA performs on par with the strongest baselines, while substantially outperforming many others that suffer severe accuracy degradation.
A key observation is the rapid convergence of the weights. In our experiments, the weights w typically stabilize within the first 20 rounds, after which further updates have negligible effect.
6 CONCLUSION
This paper introduces FedLAW, Byzantine-robur Federated Learning framework that treats aggregation weights as learnable parameters, optimized alongside the global model. By enforcing a sparsity constraint, our method effectively neutralizes the influence of malicious clients while adaptively balancing contributions from benign clients. To solve the resulting joint optimization problem, we develop an alternating minimization algorithm that updates weights and model parameters in tandem. We prove convergence guarantees and establish theoretical resilience to adversarial behavior. Extensive empirical results on MNIST and CIFARIO 10 datasets under multiple attack scenarios demonstrate the robustness and effectiveness of FedLAW. Compared to existing Byzantine-robur algorithms, our method achieves consistently higher accuracy, especially in highly non-lII and adversarial environments. These findings highlight the benefits of integrating adaptive aggregation into the learning process, paving the way for more secure and equitable FL deployments.
REFERENCES
Hedy Attouch and Jérôme Bolte. On the convergence of the proximal algorithm for nonsmooth functions involving analytic features. Mathematical Programminng 1e1ig.:11::55 116:5-16, 2009.
Hedy Attouch, Jérôme Bolte, and Benar Svaiter. Convergence of descent methods for semi-algebraic and tame problems: Proximal algorithms, forward-backward splitting, and regularized gauss-seidel methods. Mathematical Programming, 137, 01 2011. doi: 1001107744000770011-444444
9

---

Published as conference paper at ICLR 2026
FedLAW (Ours)
Bulyan-
Bulyan + Bucketing
Krum
Trimmed Mcan
CClip
CClip Bucketing x
RFA
RFA Bucketing
Coordinate-wise Median - Huber Aggregator
No Defence
Flipping label, q 0.6
Flipping label, q 0.9
Flipping label, 0.6
Flipping label, q 0.9
90
60
60
40
80
40
60
20
0.3
Inverse gradient, = 0.6
Inverse gradient,
0.9
Inverse gradient, q = 0.6
Inverse gradient, = 0.9
100
80
80
60
60
40
40
20
Test Accuracy
0.1
0.2
0.3
0.4
0.1
0.2
0.3
0.4
0.1
0.2
0.3
0.4
0.1
0.2
0.3
0.4
Backdoor aftack, q
0.6
Backdoor attack, q
Backdoor attack, q
0.6
Backdoor attack, q 0.9
100
80
80
60
60
60
40
40
40
20
20
20
20
0.1
0.2
0.3
0.4
0.1
0.2
0.4
0.2
0.3
Double attack,
0.6
Double attack, q 0.9
Double attack,
0.6
Double attack,
0.9
80
80
60
90
60
40
40
20
20
80
0.1
0.2
0.3
0.4
0.1
0.2
0.3
0.4
0.1
0.3
0.4
0.1
0.2
0.3
0.4
LIE attack, q
LIE attack, q = 0.9
attack, q
LIE attack, q
80
60
60
40
40
40
20
40
0.1
0.2
0.3
0.4
0.1
0.2
0.3
0.4
0.1
0.2
0.3
0.4
0.1
0.2
0.3
0.4
Fraction Malicious Clients
MNIST: Defense performance (left two columns).
(b) CIFARIO: Defense performance (right two columns).
Figure 2: Defending against attacks on MNIST and CIFAR10
Gilad Baruch, Moran Baruch, and Yoav Goldberg. little is enough: Circumventing defenses for distributed learning. Advances in Neural Information Processing Systems, 32, 2019.
Peva Blanchard, El Mahdi El Mhamdi, Rachid Guerraoui. and Julien Stainer. Machine learning with adversaries: Byzantine tolerant gradient descent. Advances in neural information processing systems, 30, 2017.
Jerome Bolte, Shoham Sabach, and Mare Teboulle. Proximal alternating linearized minimization for nonconvex and nonsmooth problems. Mathematical Programming, 146(1-2):45949444 2014. doi: 10. 100000077,00000000010000011,,,,
URL hhtpa: :// /iiriiiaa hal.
10

---

Published as a conference paper at ICLR 2026
K. A. Bonawitz, Hubert Eichner, Wolfgang Grieskamp, Dzmitry Huba, Alex Ingerman, Vladimir Ivanov, Chloé M Kiddon, Jakub Konečný, Stefano Mazzocchi, Brendan McMahan, Timon Van Overveldt, David Petrou, Daniel Ramage, and Jason Roselander. Towards federated learning at scale: System design. In SysMI. 2019, 2019. URL To appear.
https://arx.v.org/ abs/ http://aaa//1/...000
902. 01046,
Xiaoyu Cao, Jinyuan Jia, and Neil Zhenqiang Gong. Provably secure federated learning against malicious clients. In Proceedings of the AAAI conference on artificial intelligence, volume 35, pp. 6885-6893, 2021.
Stephan Dempe. Foundations of Bilevel Programming, volume 61 of Nonconvex Optimization and Its Applications. Springer Science & Business Media, 2002. doi: 10.
Dmitriy Drusvyatskiy, Adrian S Lewis, and Catherine A Paquette. Efficiency of the prox-linear algorithm for composite optimization. Mathematical Programming, 178:503-558, 2019.
Minghong Fang. Xiaoyu Cao, Jinyuan Jia, and Neil Gong. Local model poisoning attacks to federated learning. In 29th USENIX security symposium ( (USENIX Security 20). pp. 1605-1622, 2020.
Sadegh Farhadkhani, Rachid Guerraoui, Nirupam Gupta, Rafael Pinot, and John Stephan. Byzantine machine learning made casy by resilient averaging of momentums, In International Conference on Machine Learning, pp. 6246-6283.
PMLR, 2022.
Rachid Guerraoui, Sébastien Rouault, et al. The hidden vulnerability of distributed learning in byzantium. In International Conference on Machine Learning, pp. 3521-3530. PMLR, 2018.
Sai Praneeth Karimireddy, Lie He, and Martin Jaggi. Byzantine robust learning on heterogeneous datasets via bucketing.
In International Conference on Learning Representutions, 2020. URL org/
Sai Praneeth Karimireddy, Lie He, and Martin Jaggi. Learning from history for byzantine robust optimization. Marina Meila and Tong Zhang (eds.), Proceedings of the 38th International Conference on Machine Learning, volume 139 of Proceedings of Machine Leurning Research, pp. 5311-5319. PMLR, 18-24 Jul 2021. URL https;
Ilproceedings mlr. http:smmr..r..s///mm www.ppessssvv... 9et.9//aaimiii.mm..m waw.aiiiiidyy211111 a html
Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. 2009.
Anastasios Kyrillidis, Stephen Becker, Volkan Cevher, and Christoph Koch. Sparse projections onto the simplex. In Proceedings of the 30th International Conference on Machine Learning Volume 28, ICML 13, pp. 11-235-11-244 JMLR.org, 2013.
Yann LeCun and Corinna Cortes. MNIST handwritten digit database. 2010. URL http::/yann, lecun. com/ exdb/ /mnss//]
Tian Li, Anit Kumar Sahu, Ameet Talwalkar, and Virginia Smith. Federated learning: Challenges, methods, and future directions. IEEE Signal Processing Magazine, 3703),0060, 2020a. doi: 10. 109/MSP22020.295574499
Tian Li, Anit Kumar Sahu, Manzil Zaheer, Maziar Sanjabi, Ameet Talwalkar, and Virginia Smith. Federated optimization in heterogeneous networks. Proceedings of Machine learning and systems, 2:429 450, 2020b.
Yuchen Liu, Chen Chen, Lingjuan Lyu, Fangzhao Wu, Sai Wu, and Gang Chen. Byzantine-robust learning on heterogeneous data via gradient splitting. In Proceedings of the 40th International Conference on Machine Learning, ICML'23. JMLR. org, 2023a.
Yuchen Liu, Chen Chen, Lingjuan Lyu, Fangzhao Wu, Sai Wu, and Gang Chen. Byzantinerrobust learning on heterogeneous data via gradient splitting. International Conference on Machine Learning, pp. 21404-21422 PMLR, 2023b.
Nancy A. Lynch. Distributed Algorithms. Morgan Kaufmann, 1st edition. 1996. ISBN 1558603484. URL
http:/ ///w/www www. www.am.aooo......
1558603444
Brendan McMahan, Eider Moore, Daniel Ramage, Seth Hampson, and Blaise Aguera y Arcas. Communication- Efficient Learning of Deep Networks from Decentralized Data. In Aarti Singh and Jerry Zhu (eds.), Proceedings of the 20th International Conference on Artificial Intelligence and Statistics, volume 54 of Proceedings of Machine Learning Research, pp. 1273-1282, PMIR, 20-22 Apr 2017. URL httphhtttt//////// v54 ht/mmmahannl 1aaann17a..l htmll
ngs ml .prsss

---

Published as a conference paper at ICLR 2026
El Mahdi EI Mhamdi, Rachid Guerraoui, and Sébastien Rouault. The hidden vulnerability of distributed learning in byzantium. International Conference on Machine Learning. 2018. URL.ttps:://app semant cscholar
org/ Cttp/orrruuaDaC :3:339997
N. Parikh and S. Boyd. Proximal algorithms. Foundations and Trends in Optimization, 1(3):123-23) 2014.
Krishna Pillutla, Sham M. Kakade, and Zaid Harchaoui. Robust aggregation for federated learning. IEEE Transactions on Signal Processing, 70:1 142-1154, 2022. doi: 10.10099T922222.335133...
Meisam Razaviyayn, Mingyi Hong, and Zhi-Quar Luo. A unified convergence analysis of block successive minimization methods for nonsmooth optimization. SIAM Journal on Optimization, 1222:1122-115,,, 2013.
Virat Shejwalkar and Amir Houmansadr. Manipulating the byzantine: Optimizing model poisoning attacks and defenses for federated learning. Proceedings 2021 Network and Distributed System Security Symposium, 2021. URL
https://apls http::://ap..aaaaaaaa.mm semant semanticsccolaa org http://oopsaa11:1111300
Weiran Wang and Canyi Lu. Projection onto the capped simplex, 2015. URL PRLL/ttpss//aaxxv.orr/aa///////
01002
Cong Xie, Sanmi Koyejo, and Indranil Gupta. Zeno:
Distributed stochastic gradient descent with suspicion- fault-tolerance. In International Conference on Machine Learning, pp. 6893-6901. PMLR, 2019.
Dong Yin, Yudong Chen, Ramchandran Kannan, and Peter Bartlett. Byzantine-robus: distributed learning: Towards optimal statistical rates. In International conference on machine learning, pp. 5650-5659, Pmlr, 2018.
Puning Zhao, Fei Yu, and Zhiguo Wan. A huber loss minimization approach to byzantine robust federated learning. In Proceedings of the Thirtt-Eighth AAAI Conference Artificial Intelligence and Thirty-Sixth Conference Innovative Applications of Artificial Intelligence and Fourteenth Symposium on Educational Advances in Artificial Intelligence, AAAAAA,AAAAAAAAAAAT AAAI Press, 2024, ISBN 978-1-777--7777 doi: 10. 10.1609/aaii, v38119. 30181. URL https: // org/ 10, 609 aaai v38119. 30181
12

---

Contents
Introduction
Notation and Model
3
2.
Notation
3
2.2
Model
Byzantine-Robust Federated Learning with Learnable Weights
3
Problem Formulation
3
3.2
Proposed Algorithm
Theoretical Analyses
5
4.1
Byzantine-resillen resilient Analysis
4.2
Convergence Analysis
Numerical Study
8
Experimental Setup
5.2
Experimental Results
Conclusion
Mathematical Foundations
B Optimizing the Joint Loss Function: FedLAW and BSUM
B.1 BSUM: A Baseline for Comparison
16
B.2 FedLAW vs. BSUM: Capturing Joint Optimization Dynamics
C Theoretical Analysis: A Multi-Layered Defense Against Strategic Attacks
18
D Projection onto the unit-capped simplex
22
Proof Theorem
23
Proof Theorem
23
E.1
Optimal solution of
23
R22
High-Probabile Bound via Hoeffding Inequality
................................
25
R.3
Decomposing the Error with the Triangle Inequality
26
G
Byzantine Resilience Against Adversarial Loss and Gradient
34
Proof Theorem and Determining Lipschitz Constant L.
35
H.1 Proof of Theorem for L-smooth (Item 1)
................................
35
H.2 Proof of Theorem for L-smooth and strongly convex (Item
42
H.3
Determining Lipschitz Constant Lyp
45
Additional Experimental Setups and Results
46
Experimental Framework Overview
46
1.2
Hyperparameter Settings
47
I.3
FedLAW: Client-weight dynamics under four adversarial settings.
50
1.4
Evaluation of Malicious Client Detection
50
1.5
Computational Complexity
55
1.6
Empirical size of Ek-
57
1.7
Additional experiments on CIFAR-T00 100
58
1.8
Empirical study of mimic-misalee misii-ems attack
61
13

---

Published as conference paper at ICLR 2026
Algorithm CLIENTUPDATE
Require: current global model 0; learning-rate or local epochs E; batch-size B; private data D;
initialize local model parameters > full local epochs
2: for e to E' do
for all mini-batches B Di of size B do 4: W; & t/ aV & (1r,
end for
end for
i -
7:
b gradient at 0
Ji t fc(( return (gi, fi)
Algorithm 2 FedLAW (Federated Learning with Learnable Aggregation Weights)
Require: initial model 0u: learning rates a, 33; total epochs T; local epochs E; batch-size B; sparsity level 8; cap t;
number of clients n
1:
initialize weights Wo <- 1
2: for k: = 0 to 1 do
collect client updates
3: broadcast 0% to all clients
for all clients 1:n in parallel do 5: (g:, fi) & CLIENTUPDATE(0.. E, B)
end for
11
server slep 1
11
Sagg Di=1 Wk, gi
8: OK+1 + 02 gagg
broadcast 0k+1 and collect (gi, fi) via CLIENTUPDATE
server step 2 (weight update)
10:
G= gi. gn.. G= BI, . B..]
11:
f= [i,...,
12:
h& + Wi + aB G Gw - 3F
13:
WK+1 t Projat (h&) with via
server step 3 (second model update)
14: gagg + Eim Wh+1.g
15:
OK+1 On gage
16:
end for
17:
return 0T
A MATHEMATICAL FOUNDATIONS
In this section, we first introduce key mathematical concepts used throughout the paper. We then present specific structural properties and feasibility results related to our proposed optimization framework.
We begin with the definition of proximal mapping.
Definition 1. Parikh & Boyd 2014) Let p: domp + (-o0, +ool be a proper and lower semi-continuous (PLSC) function. Then the proximal mapping of p at Rn is defined as
[ ull + p(u)
prox, p (x)
argminn uEdom,
(16)
Definition 2. Attouch et al. 2011) The subdifferential of a PLSC function at TR is defined as
0g(x) E 3xx + x, g(xx) + g(x); ; Sa + 0g()):)
where (xx) is the Fréchet subdifferential of X E RR, defined as
ag(xx) = { (
1
(g(v) g(x) - (v x, 5) 2 20]
RdD
lim inf vx
(17)
14

---

Published as a conference paper at ICLR 2026
Definition 3. Attouch et al.
2011) A point x" is called a critical point of PLSC function f(x) if E 0f(x').
Definition (Operator )t,). The operator Pt, (w) leaves the largest elements (based on their values, not magnitudes) of the vector w unaltered and sets all other entries to zero.
Lemma (Descent lemma (Bolte et al. 2014)). Let f : IR" -
R. be a continuously differentiable function whose f is L-Lipschitz continuous. Then,for for all x,y R
gradient f
f(y) S f(x) (Vf(x), x) + L x1e2.
(18)
Definition ((C, by)-Byyannine Resilience (Blanchard al., 2017). ) Let S be any angular value in the interval [0, 7/2), and by be any integer in {0, 1,.,1,.... .... Consider independent identically distributed (i.id.) random vectors Vi.-.., Vn in IRd with ~ G where E{G) = 9. and by random vectors bi...., bby in IR,, possibly dependent on the ve's. '. A choice function F is said to be (C, by) -Byzaniie resilient if. for any 1 S J1 < ... < Jbg S n, the vector
,....,1,,
F(vi,...... b............................... ......,byy"""................... Vn)
(19)
satisfies:
1. It maintains alignment with the expected gradient:
(E(F),9) 2 (1- algll
B[[F[()} (for r = 2,3, 4) satiates the following condition:
B[IFFI)) S C EB(GII where Er.=r.
Definition Sanndyka-tojasiewiic. Property AAttouhh Bolte 2009)). A function f : - (+oo)) satisfies the Kurdyka- Kurdyka-Lojasien Lojasiewicz (KL) property point &' E dom( there exist 1) 0, neighborhood U of I, and continuous concave function Φ |0, 11) + [0, +00) with (00) = 0, & difserentiable, and o' (8) > 0 E (0, 11), such
that for all U with [(+) (x) < [() + m.
o' df(((z) - f())) d, 0f(z)))) 2
where (f(()))))))))))))))))))))))))))) = [nf[l I (f)))) A function satisfying the Kl. property at all points in dom(Of) is called KL functionn Proposition 2. Consider the sparse-umit capped simplex
A 1.80
E
00 = 1, w. 2 w, St, // S
(20)
with n-b, and = n by. Then any weight vector w Atr has exactly n - by non-zero weights, each equal to n-b5' and the remaining by weights are zero.
Proof. Let w have k nn-b, by non-zero weights indexed by S. so Eies wi 1, < wi S n-6 for all i S. If
k < n- by, we have:
Wi k n by (n by)
n n-bj by
1=1
which cannot satisfy Σi= Wi- 1. Thus, is by. Suppose at least one weight, say wi
b- 1
Then:
n-b;
Σ
1
by
wi w1 71 by n by
The maximum sum for the remaining by - weights, each capped at nー is m- Since the required
n-
=- exceeds the maximum possible sum, this impossible. Thus, wi n- leads sum Ei-hy wi n-by I violates the upper bound w, n-b;" contradiction. Similarly, wa n-by
Hence, all n by non-zero weights must be n-
I and the remaining by weights are zero, satisfying all constraints. 7
15

---

Published as conference paper at ICLR 2026
In the following lemma, we determine when the sparse, unit-sum, t-capped simplex is con-empty, key condition for selecting valid sparsity and cap parameters in the proposed method ① We also compute an upper bound of the Euclidean distance between any two vectors in this set that we will use in later results.
Lemma 5 (Feasibility and Distance in Sparse Unit-Capped Simplex). Consider the sparse unit-cupped simplex which, n 2 2, 8 E (I,....n) n.), and E (0, 1). Then A,,, # 0 isf 2 1, and for any W1, W2 A 1,60
20 in
||
w2ll2 S V (kl +2)
(21)
where l: = [1/t] and r = kt t0. 1f/t e N, the bound simplifies to ||w1- - -W2l2 S V 2t.
Proof. [+ * 0, then there exists a t-capped, s-sparse vector summing to 1. Since each nonzero entry is at most f, we must have st 1.
(+) If st 1, construct feasible vector by setting |1/t|, = kt, and defining
r, .,,
times
which has most nonzero entries and sums 1, so A E.bu'
The maximum l norm in A i.eo is achieved by w [, trr, r, or., ,0 with ||w")
kt + r². For any
& times
W1, W2 A Tee have
|
W2
|w |
112 + W 2(W1, w2) 2(kt² + +
because (W1, W2) 2 0 (all entries are non-negative). Taking square roots yields the result.
B OPTIMIZING THE JOINT Loss FUNCTION: FEDLAW AND BSUM
A core contribution of this paper is address Byzantine-robust federated learning by formulating and solving the following joint optimization problem over global model parameters 0 E Rd and aggregation weights w = [wi,.... wn]
min OER4, wEAT 1. 1=1
ws)i
(22)
where A+ 6.60
[w E R
Σi= w. = 1, w. 2 0, w; <1, / < 8).
3.2 our primary solution to this problem the FedLAW algorithm, whose pseudocode is provided in Algorithm As another contribution, adapt the Block Successive Upper-bound Mininization (BSUM) method (Razaviyayn et al. 2013) to solve (22). providing a baseline for our novel algorithm. By comparing FedLAW and BSUM, we demonstrate that FedLAW's integrated of loss and gradient information results in robust and efficient learning under adversarial conditions. Below, we detail both methods and their comparative performance.
As detailed in Section
B.1 BSUM: A BASELINE FOR COMPARISON
BSUM alternates between updating the global model parameters 0 and client weights w, minimizing local upper bound upproximation of the objective for each block while fixing the other. At iteration performs the following operations:
Update 0: With w Wis solve:
min BER
(k))
(23)
Assuming differentiable (((0), we provide a quadratic upper bound fi(0) of f((0)
f( f((0x) + (Vof((xx). 0x) +
0 0x
(24)
2a
16

---

Published as a conference paper at ICLR 2026
where > 0 is a step size. Substituting this quadratic upper bound into 233 gives
0x+1 = argmin
w. w,)((0:0)) = =0, - aG
(25)
GRR
in which Ga [efi(Ok), .M. (oLn(
2. Update w: With 0 = 14+1.5olve
Σ wifi wifi(Ok+1).
WR+1 = argmin
(26)
wE
This is a linear program in w, constrained by the sparse unit-capped simplex A.to To ensure fair comparison with our method, which uses the most recent weights to update for enhanced robustness, we apply an extrapolation step, updating:
k++ - WG.
This extrapolation aligns BSUM's update with our method's strategy, using the latest weights Wi+11 optimized at 0x+1 reflect current client reliability assessments. By incorporating Wk+1, which downweights malicious clients via the sparse capped simplex, the update improves robustness against Byzantine attacks, ensuring that performance differences arise from the algorithm design rather than the precise ordering of updates.
B.2 FEDLAW vs. BSUM: CAPTURING JOINT OPTIMIZATION DYNAMICS
A key difference distinguishes our method (Equation (6) from BSUM. In BSUM, 0x+1 is fixed when updating simplifying (26) to linear objective. In contrast, our method minimizes:
w.f.(0x aG&w).
(27)
When the weight vector inside fo is fixed to Wk. method (Equation (6) reduces to BSUM's linear program (Equation (6)), revealing that BSUM is suboptimal approximation. This raises a key question: how does our method compare to BSUM in Byzantine-robust federated learning? BSUM updates w by minimizing Σ ( relying solely on client losses f+(0++1) to detect malicious clients. However, attacks like the inverse gradient attack, where malicious clients submit flipped gradients but benign losses, are not immediately detectable in losses, delaying BSUM's exclusion of malicious clients and slowing convergence. In contrast, our method optimizes >; f: aG, w), leveraging both losses and gradients to enhance robustness.
The objective in (27) finds the most internally coherent client subgroup, and the premise is not that the descent direction of a single client matters.
The objective in Eq. (7 can be understood an inner optimization problem. For candidate subgroup defined by weights w:
first computes a collective descent direction, d(w) G. w. This represents the consensus update direction proposed by the subgroup w.
2. It then evaluates the quality of this direction by measuring the post-update empirical loss, L(w) = Σ; fi
(w)). This step checks if the collective descent direction d(w) is actually effective for the same subgroup that proposed it.
The arg min in Eq. 5 operation therefore searches for the weight vector w that defines a subgroup whose collective descent direction most effective for itself.
A coherent subgroup (c.g., benign clients, which tend to align due to similar gradient directions) will propose a descent direction d(w) that is effective for all its members, achieving a low objective value.
Including malicious outlier poisons d(w), making a poor descent direction for the benign majority, thus penalizing that choice of w.
17

---

Published as a conference paper at ICLR 2026
Our algorithm solves ( via the projection in Equation (9) where Wx+1 = prox At
Wi + a&, ......... Vo aG,w;)] and f(O, (G, = f (0x- wG& (0x w&)l The vector hg incorporates two factors for de-
(hr) and h
G GR+IWA 0 @G& Here, GK-1 VoJi (O:
tecting malicious clients:
Losses (f(0; aG., )): This term, similar BSUM, assesses client losses. is effective against attacks like data poisoning, which directly alter losses, but is less reliable when losses remain benign despite malicious gradients.
2. Gradient Alignment (GT 11+1 This inner product quantifies the alignment between gradients at 0₂ and - - Wa across consecutive rounds. attacks such as the inverse gradient attack, malicious gradients typically misalign in direction relative to benign ones, enabling early detection and exclusion through the sparsity constraint ||w]]o S
To substantiate this comparison, we provide an empirical evaluation of our method against BSUM (labeled "FedLAW- BSUM" in the figures), offering evidence to support the theoretical advantages.
Empirical comparison. Figures and compare our method with BSUM under four adversarial attack scenarios on MNIST: flipping label, inverse gradient, backdoor, and double attack.
Figure 3 shows the test accuracy over 200 epochs. Across all attack settings, method (FedLAW, AWW dashed green) either matches or surpasses the performance of BSUM (solid blue), with the most significant improvements observed under gradient-based attacks. In particular, under the inverse gradient and double attack scenarios, FedLAW converges faster and reaches higher final accuracy, highlighting its enhanced robustness in detecting and mitigating subtle gradient manipulations.
Figure 4 further illustrates the client-weight evolution under these adversarial conditions. The top two rows correspond to Fedl_ LWW, and the bottom two rows BSUM. Each subplot displays how the aggregation weight of each client evolves across 100 epochs. While both methods eventually suppress malicious clients (red/orange), FedLAW consistently achieves this suppression earlier, especially under inverse gradient and double attacks, due to its reliance on both loss and gradient information. In contrast, BSUM, which only considers losses, fails to immediately detect malicious clients whose losses remain close to benign ones, delaying their exclusion.
These findings demonstrate that FedLAW more effectively captures the joint optimization dynamics in 22 by incorporating both loss and gradient- based alignment into the weight update process compared to BSUM. FedLAW not only detects malicious behavior earlier but also maintains better model accuracy and stability in the presence of sophisticated adversaries.
C THEORETICAL ANALYSIS: A MULTI-LAYERED DEFENSE AGAINST STRATEGIC ATTACKS
We address the critical question of whether strategic attacker can manipulate our weight-learning process to gain influence. In this section, we present a theoretical analysis our multi-layered defense: we study the dynamics of our method, design strategic attacks that attempt to deceive it, and examine how our approach responds to these mimicry attacks.
LAYER 1: FOUNDATIONAL CONSTRAINTS AND ATTACK MODEL.
Our defense is built upon set of foundational constraints that limit an attacker's power a priori.
Constraints.
Loss preprocessing. As a practical first line of defense, the server can filter naive attackers by detecting clients whose reported losses (fx+1,p) are statistical outliers (e.g., using a Median Absolute Deviation (MAD) test to flag anomalously low values).
2. Gradient norm bound. We assume & norm of Byzantine is bounded by & norm of honest mini-batch gradients, which can be handled by gradient clipping.
3. Weight Capping: The optimization constraint A ensures client weight can exceed the cap L. To exactly exclude the by clients, t = ,ー This provides hard limit on the influence of any single client, even in hypothetical worst-case scenario.
18

---

Published as conference paper at ICLR 2026
FedLAW
FedLAW-BSUM
Flipping label
Inverse gradient
100
100
90
90
80
80
70
70
60
60
50
Test accuracy (%)
40
40
30
30
50
100
150
200
0
50
100
150
200
Backdoor attack
Double attack
100
100
90
90
80
80
70
70
60
60
50
50
40
40
30
30
50
100
150
200
50
100
150
200
Epoch
Figure 3:
Test accuracy on MNIST for four attack settings (g=0.9, 10 clients, 40% malicious), contrasting
FeULAW-BSUM (solid blue) with FedLAW (dashed green).
The Layer preprocessing is fully aligned with Assumption 1 and our theoretical analysis. The latter two components are explicitly incorporated in Theorem 2 In addition, the loss-based filtering step is consistent with the assumptions in Theorem 2 where we assume that the loss heterogeneity S among honest clients is small; this is also supported by the numerical study in Section 1.5. Hence, honest clients are unlikely to be excluded by this preprocessing step. Moreover, this filtering helps tighten the bounds in our Byzantine analysis: in 93), the term
Remark 3.
Σ S(0
Σ1,002)
SEA"
JEAL
directly appears in the upper bound on the bias of our aggregator, and by removing extreme outliers, we prevent this quantity from becoming large.
We analyze the critical moment an attack begins. At round k. all clients are honest and weights are uniform (W;. _1).
round & + 1, clients in HC become Byzantine.
LAYER 2: THEORETICAL ANALYSIS OF THE CORE DETECTION MECHANISM
With the attacker's power constrained bounded by le norm of honest gradients, now analyze how our algorithm (Eq. (10)) is designed to detect malicious intent. The server computes 0 0 aG&wk, then collects gradients and losses 0 from honest clients (H) and Byzantine clients (HCC). Based these, it builds the pre-projection vector h2 with components:
Box (Vk.j.
Vi
bx²) (0x
(28)
In the next step, the server keeps the largest entries of h2 and sets all others to zero. For a Byzantine client j E HC to remain in the support, its score must dominate that of some honest client E H, i.e.
h 2 hg.5-
(29)
The above inequality can be written by
- A ji,b = 3 (hes he.s) = a (Vi. Vh VH + buu) + +f((0n-1) ((((041) 2 0
(30)
alignment
19

---

Published as conference paper at ICLR 2026
Benign
Malicious (Flipping label/Inverse gradient/Backdoor attack)
Malicious (Global parameter attack)
FedLAW Flipping label
FedLAW Inverse gradient
0.2
0.2
0.15
0.15
0.1
0.1
5 101
10
20
40
60
80
100
60
80
100
FedLAW Backdoor attack
FedLAW Double attack
0.2
0.2
0.15
0.15
0.1
0.1
5-10-2
5 10-2
Client weight
20
40
60
80
100
40
60
80
100
FedLAW-BSUM Flipping label
FedLAW-BSUM Inverse gradient
0.2
0.2
0.15
0.15
0.1
0.1
5 1-1
10-2
20
40
60
80
100
20
40
60
80
100
AW-BUUM- Backdoor attack
Double attack
0.2
0.2
0.15
0.15
0.1
0.1
5
10
10-2
0
20
40
60
80
100
20
40
60
80
100
Epoch
Figure 4: Clight-weight dynamics on MNIST under four adversarial settings (g=0.9, 10 clients, 40% malicious). Two top row: FedLAW. Two bottom row: AadLAW-BSUM, Each panel tracks the aggregation weight of every client during the first 100 global epochs a three-layer MLP (batch size 64, three local epochs). Across all attacks, benign clients (grey) quickly converge to stable weight, while malicious clients (red/orange) are pushed towards negligible influence. Notably, FedLAW suppresses attackers faster than BSUM, especially for the gradient-based attacks (inverse gradient, double attack), illustrating its stronger resilience.
20

---

Published as a conference paper at ICLR 2026
We intentionally evaluate FedLAW in the most challenging setting, where in the first attack round it may happen that k++1 our method can temporarily assign client j slightly larger weight (still strictly
jiik 2 O. Consequently, at round bounded by the cap I).
Crucially, FedLAW is adaptive and iterative: any temporary over-weighting of misaligned client strengthens its
contribution to the aggregated gradient in the next round, which in turn accentuates its misalignment signal. Because Wk+1. > wk.j and the weights at round k+1 are no longer uniform, the next pre-projection vector h&+1 takes the form
hg+1, = Wk+1j + a.(bb+1...
Σ
VK+12
Σ
U0+1,,b422.) -Bf, (0k+2)
iEH
JEMC
1R414 = Wk++1, (1
Σ
VE+1 +
Σ
Uettyba+2.) -38.(0k
(31)
iEM
JEHD
Then, we have
A AjA++1 (estij-w++1,tt (bx+1.j 1,+
Σ WK+1,
WK+t m -
JEHO
misalignment tern
(32)
Next, we define the following score
8 = a.bb+I. Ve+l, F) + 110 (0++2)
(33)
in which F EiEn WK+1 EjEne W is our aggregator.
Given (33). the loss difference and the misalignment tern are the two signals FedLAW uses to detect malicious clients. In data poisoning (e-g., label flipping, backdoor), the attacker changes its data distribution. For model 0 trained on clean data, this yields (i) a higher poisoned loss (0) (0) and (ii) gradient b&+1, that conflicts with the coherent honest cluster. Thus, both terms in Sji,+11 work against the Byzantine client. In a model attack, the data remain clean but the submitted gradient b&+1, corrupted (e.g., inverse gradient), so the loss is similar to honest clients, and the misalignment term in k is the main discriminator.
Mimic attacks: In the most challenging case, an adversary tries to cancel the negative misalignment term by slightly under-reporting its loss. It must choose f0x+++ < (0(0)+1) while still sending a misaligned gradient. If (0x+1) < (0x++)). this is easily caught by the loss preprocessing in Layer 1. The harder regime is when the reported loss is only slightly smaller than the honest level, so that f((0x=1) fz(00+1) partially offsets the alignment penalty in (30). In that first attack round, it may happen that jii 2 0, so at round k+11 FedLAW can temporarily assign client j somewhat larger weight (still bounded above by the cap l).
We leverage the proven Byzantine-resilienee of our aggregator (Theorem 2). This theorem guarantees that the mean of the aggregated gradient, F, maintains positive alignment with the true honest mean, i.e.
gk+1
1
Σ E(V++1,)
(34)
by NEH
An effective attack requires the malicious gradient be+1. to misaligned with this honest direction. The honest mini-batch gradient Ve+1,; is, by definition, coherent with the honest mean gs+1, which is guaranteed by Theorem 2 to be in the same general direction as F. Consequently, for effective attack
(ba+1.j Ve+1.i. F) < 0
(35)
So, in (33), although the loss difference is positive, the misalignment term above remains negative, which helps to neutralize the effect of the attack. In strong attack, this term becomes more negative, meaning the loss difference cannot be strongly positive; otherwise, the attack could be detected by loss preprocessing. Consequently, in this case the score sji,++1 becomes negative and the weight of the Byzantine client starts to decrease. In this mimic attack, due to its more sophisticated nature, FedLAW may require more epochs to reduce the weights malicious clients to zero compared to data poisoning and inverse-gradient attacks.
An adversary can try to weaken this effect by sending Byzantine gradients that are aligned with the average honest gradient, in which case the misalignment term in (32) becomes close to zero. However, such attack is inherently
21

---

Published as a conference paper at ICLR 2026
weak: since each client's weight is capped by t 1/(n -b-) by) (usually >> by) and the Byzantine gradients closely follow the honest direction, they cannot significantly steer the global model away from the benign trajectory. This behavior is consistent with our empirical results under the LIF attack in Fig. 2 In LIE, Byzantine gradients are generated from the mean and cross-correlation of honest gradients (Sec. [T). making them much more aligned with honest updates (so that the term (35) becomes close to zero) than in label-flippinn
inverse- inverse-gradient attacks. As consequence, even the no-defense baseline performs relatively well in this setting. Moreover, under this type of attack, FedLAW achieves strong performance compared other robust FL methods.
In summary, when the attacker uses misaligned gradients, the alignment term amplifies evidence against it and suppresses its weight; when the attacker aligns with honest gradients. the attack itself becomes too weak cause substantial damage. The objective is thus structured so that what is "good" for the optimizer (low marginal score) coincides with what is "good" for the global model.
LAYER 3: THE DETERMINISTIC ENFORCER THE SPARSE SIMPLEX
Ultimately, the optimizer's decision not heuristic. It solves constrained optimization problem by selecting the clients with the highest scores. Our analysis proves that under any effective attack, the score of a Byzantine client is mathematically driven to be lower than its honest peers, either immediately (for data poisoning and model attacks) within few iterations (for strategic mimiery attacks). The projection onto the sparse simplex is the deterministic mechanism that enforces this ranking, pruning the low-scoring clients and ensuring the system's 's integrity.
We complement this analysis with empirical study of mimic misallgeed model attack in App. L8 (Fig. (9) where we observe that strategic under-reporting the loss only delays, but does not prevent, the collapse of malicious weights to (near) zero.
D PROJECTION ONTO THE UNIT-CAPPED SIMPLEX
The purpose here is to solve the following optimization problem:
x at PAr (y) argmin 1 xEA
2 |x y12
(36)
where A {w E R" Di=1 = wi 0, w. < 1}. In Wang & Lu 2015) using Karush- KuhnhhKKuuh-T-kk (KKT)
conditions, a solution for the above projection is determined which is formulated in Algorithm
Algorithm Projection onto the unit capped simplex
Require: y IR" is sorted in ascending order: y1 U2 S ... Yn 1: Set Yo = - 0o and V-+1 = 00
2: Compute partial sums To = 0 and Te = = Σ for k = -1,1, 1,...,n
3: for a = 0......, do
if ( n a) and (Na+1 ya t) then
5:
Set b a break
end if for
+ 1...., n do Compute 7 ++bb-nt.--- -T--- TT
b-u
10: if (he Me + S 0) and
1at1 + 2 > 0) and (thh + 1) and
[Bh+1 2 1) then
11:
break
12: end if
13:
end for
14:
end for
15:
Output: 10....,0, 0,...,0,ue 1 + by...., yb 1y, 1,,,,...00
For more details this algorithm, see Wang & Lu (2015)
22

---

Published as a conference paper at ICLR 2026
E PROOF OF THEOREM
To prove Theorem 1 we draw inspiration from the analysis used in the proof of Theorem 2 in Kyrillidis et al. (2013). However, crucial to highlight a key difference: while Kynillidis al. (2013) establishes convergence for the sparse projection onto the unit simplex, our goal is to demonstrate the convergence of the proposed method for the sparse unit-capped simplex, which introduces additional constraints.
To prove Theorem use the following two steps.
STEP 1: THE S-LARGETT ELEMENTS SHOULD BE IN THE SOLUTION
Let w be an optimal projection of h& onto At,, and assume that there exists an index among the s-largest entries of h2 such that wi = O. Suppose also that there exists an index & supp(Pz, (hx)) where wy >> O. Define a new vector w by setting w and W, wy. while keeping all other entries unchanged. Consequently
|| 1 112 w h + 2w,(hj ke()
(37)
Since wy (h - nº))= 2 O, it follows that ||w - h 112 2 | h2ll2. contradicting the assumption that w is the optimal projection. Thus, the s-largest coordinates w should be the solution.
STEP 2: ENSURING THE SIMPLEX CONSTRAINT IS SATISFIED
Once the support set S" (of size s) in 100 is determined, the optimal solution is obtained by projecting w.- onto the unit-capped simplex. For the projection we utilized the proposed method in Wang & Lu (2015) and established in Algorithm S Since the proposed method used the KKT conditions for this projection, using (10) and (36), we have
W - hxs- ll I ||w hxs ll,, VW E E
(38)
This guarantees that Wk-15s- is the optimal projection of hxs- onto A
the final step we show that solutions with support [S] = 5 are as good as any other solutions with |S| s. Suppose there exists solution with support [S] s. Consider extending |S] to set [S'] = by adding any elements and its protection onto unit-capped simplex results in W2. Since according to (38), the new solution satisfies ||w's s hys [| Ws hxsll2. This results in ||w' hxll2 || hxl/2-
F PROOF OF THEOREM 2
In this section, we present the proof of Theorem 2
To simplify the notation, we omit the iteration index l: throughout this proof, as the analysis holds for any arbitrary round k. We thus denote the true gradient of client as v; = (0x) (instead of Va.s) and its mini-batch estimate as v; (instead of Vx.)).
The proof has three main steps. First, apply Taylor's theorem with exact remainder to rewrite (6) into an analytically tractable form, where gradients are mini-batch based; the stochasticity from mini-batch sampling is then controlled via Hoeffding-type concentration. Second, we introduce full-batch aggregator F (replacing mini-batch by full gradients in aggregator F) and decompose the bias (F) gll into mini-batch term and full-batch term, bounding the former by concentration. Third, for the full-batch part, we define an auxiliary selector vector representing g and show that the bias can be bounded in terms of discrepancies ||v; wy:-byy bbil2 between honest and Byzantine gradients. Bounding these discrepancies via our heterogeneity quantities and combining both pieces yields the claimed high-probabee probability bound.
Proof roadmap:
F.1 OPTIMAL SOLUTION OF 66
To make the objective in O analytically tractable, our first step use Taylor's theorem with an exact remainder to reformulate the cost function. For any client i, we can express the projected loss as:
f( aG,w) = f.(Ox) + (V))())), -G + (,(w)
(39)
23

---

Published as a conference paper at ICLR 2026
where the remainder term (w) is bounded by:
R&(w)) - Lmax
Imax
|aG
a² G
2
2
Using 39 we have
wi f00x aG&w) =
Σ wifi(0m) a
Σ Wy Vf)0))), G&w) + Σ (w)
t=1
Σ
wi)s(0s) aw" G. + Σ (w).
(40)
Using G2 = [Vi,"" v.], in which v; voli(Ox), we have
v v
v
vf
V2 V2
V2 Vn
G =
(41)
v Vn
v Vn
Vn
Substituting v, ||vil1 ||v, |V, v:l12
in the above matrix yields
cm
1 cd
G G Gr
2 k/
(42)
in which TD and Gg are given by
[ v2l1
v1 Vn
||v1
v22l
V22 Vn
G
[lvv
Vn
11112
V
v2ll
2 v1
113
||
11 +
|
+
Vn
1|
2
G
(43)
|| l1
|| + v
2 11
By defining k = [|[v 11.
| and 1, = [1, .... ,1]= the matrix G can be written by
G 1n @ kT k@@ 1n
(44)
Using the above representation and the property Σ w, 1, we have
Tt 2
Σ wc 1l.1.
(45)
Replacing in 40 and using the above equation, we obtain
w/ S0 wG&w) WG
Σ w()((O))+ +
w G.GG
w
T G.
(wW)(w)
2
wif((On) + 2
w |v voll2
wi v..l + Σ w,R((w) (46)
Σ wi (f((Oz) all vollv
www, ||v:
v
wi R2; (w).
Let ((w) = En (00 aG w) be the true objective function and Jaypaux (w) Σn (x()((0x)) allv:l13) +
a >"
1 "y w.w I| vj [| be the approximate objective from (40) Consequently,
J(w) = Japprox ( (w) +
wi (w) = Japprox( (w) + Evaylor (w),
1=1
24

---

Published as a conference paper at ICLR 2026
where (w)) Ei=1 w;R:(w).
Substituting the cost function in (6) with the above expression, we obtain the following optimization problem
min
Σ 2=1
(f(((())) - alvv. - +
w II; vyll2 + Etaylor (w).
WEAT. 1.50
To improve practicality, analysis also focuses on the case where the aggregator relies on mini-batch gradients rather than full-batch gradients, which is a more realistic scenario. Replacing the full batch gradients and losses with mini-batch in above optimization problem results in
wo argmin WEA!
Σ (,(s(((0s) all + 1=1
wa VV, - v2512 Etaylor( (w).
(47)
2
j=1
where f()(0))) is the mini-batch loss and Beach ff ((x)) = f((0)). To exclude by clients, based on Proposition requires setting & n-by and s = n by in the constraint set A
2 it
n-by' if Aw
(48)
i
where A. supp(w wo) and its complement is denoted by AC The indices in A, corresponding to benign and Byzantine clients are denoted by A and A respectively.
Next, we need to check the first condition in Definition in which it is required to compute [|[{ g It is important to highlight that, unlike Definition we consider more general setting where population losses and gradients are non-iid. In this case, function F, which is weighted summation of the gradients with the obtained weight w from the optimization problem (47 when some gradients are replaced by their Byzantine counterparts in (47). is given by
F (V Vn-by, bj.... bb,) n by
Σ V $EA
Σb,). JEAD
(49)
where A, = AA It is important to note that in the above equation, v; is the mini-batch gradient of size for an honest client for i 1, .n....nn- by. To maintain consistency with the notation in Definition 5 denote the honest and Byzantine gradients as v, and bj, respectively. Also, the full batch aggregator, F. is a theoretical construct, which is given by
F(V1,' Vn-by; bi.".. bb, n by
Σ V Σb,). SEA=
(50)
JEA
F.2 HIGH-PROBABILITY BOUND VIA HOEFFDING'S S INEQUALITY
This section provides formal proof for the high-probabilitty bound on the intra-client sampling deviation.
Lemma 6 Piibb-Probbbility Sampling Deviation Bound). Let v; be the mini-butch grudient of size B for an honest client i, and let v; (0)) be the corresponding population gradient. We assume that the deviation of any single-sample gradient from its population mean is bounded:
Vof - v,ll S R4-
Then, for any failure probability (0, 1), the following bound on the sampling deviation holds with probability at least 8:
2R log(2d/o)
v vzll Ess,
where ES ==
B
Proof. The proof relies vector version of Hoeffding's ' inequality. We define the zero-mean random variable Vof 22) - v;. It is straightforward to show that (X(,) = The sampling deviation is the average of such independent random variables:
1 B
V
X
25

---

Published as a conference paper at ICLR 2026
Based on the bounded deviation assumption, we know [[x;)))) - -vill I Rg. Applying the Hoeffding's 's inequality for the average of B independent, zero-mean random vectors X, E RRd where ||X Rg for all j. states that for any t> >>0 0:
PP
1 B
x
x j=1
21
2d exp
B 2
In our case, the average is the sampling deviation, |]: vill. Substituting this into the general form gives:
Bt
P P( v.ll 2 t) S 2d exp
2R
We the failure probability to be most ō and solve for the bound Eg:
BE
8 M 2d exp
exp
2
Solving this inequality for Es:
8
Bsg
2 exp
2d
2R
2d
BE
log
S
5
2R
2 log (2d/5)
S <63
B
2R 1og(2d/6) Therefore, the bound holds with probability at least 1- 6.
This shows that if we choose Es
the probability of the deviation exceeding this value is at most 6.
F.3 DECOMPOSING THE ERROR WITH THE TRIANGLE INEQUALITY
We can relate the practical error to the full batch error by adding and subtracting the full batch aggregator, F (defined in 50 )
[[B(A] gll |IE - F F) gl
= [[(E(E) - E(F)) + FF g
< | + (
Perurbation Error
Ideal Heterogencity Error
We now bound each of these two terms separately.
Bounding the Perturbation Error: The first term, |BLF F}1| represents how much the mini-batch noise perturbs the output of the aggregator. Consequently,
F-F- 1
E(v: v.).
by ieAr
With high probability 1- 6, using Lemma 6 we have || vall S Es. This leads to bound on the perturbation:
|| Fll < AA
ES S ES,
n bj
Taking the expectation:
|IE[=- FF
SEIF F(1) ss.
(51)
26

---

Published as a conference paper at ICLR 2026
Bounding the Ideal Error: To compute the error [E{F] gll, we first define the vector s as follows
vi
Σ e
(52)
by iEA
11 by
in which oj is the j-elements in the set &, which is constructed as follows:
1. If | Z JA%, & is constructed by a random selection of |A^| elements from the set V =
2. If A < I. & is constructed as
& B.....D.P. D.P.
(53)
in which = [ and P is constructed as random selection of |A - ==|A| entries from V.
Taking the expectation from both sides of (52) results in
Aº
[{s) n2 by iEA=
B(vi n by 5=1
Σ
B(c,}+
1
Σ E(vi]
1
Σ E(vi}
(54)
n by !EN
n2 - by SEA"
in which Ad= {1, 2, .... n by) AS. Based on the definition of the set E, using [[[;) = Bi. |^ + |A4 = by.
and g- n- 2j=1 by
g, have
a by
A E(e,}
A
[(s) n1 by
gi
Σ sEAd
E(vi) +
gmap())
Σ gi.
bj
by
by
by
ieAd
(55)
i.c. in which each vector e, is mapped to one of the vectors v, for all s n by. i.c. e, = Vmaati- Now, we compute
[[[[] - glß.. Since B(s} + by ΣiEr gi - b. Enal Emap() = g.
A4
[B[F] - gl12 = [B[F] B{s} 1
g: +
Emapci ll2 5
by iEAd
bf ==1
A
|E[F - s)112
1
Σ
Ig. gl1 2 +
1
gmapt) gll2
(56)
12 by ieAd
72
bj
Since
1 Dn-by by Ig: gl2 H2, using Cauchy-Schwarz Schwarz inequality b-
1 n-b; EiEA' llg:
gg/2
Σ EsEad [1g,
-gll Avl <
by
Hy. have
bb
2b, H
[BF) gll2 < - +
(57)
Vn b
Substituting F' and s in the above inequality results in
AA41 Σ
Σ
Vi+
Σ
by
Σ
9
)11
|E
1
Σ
b
Σ e
}11.
(58)
by
in by JEA'
VEA-
JEAL
EEA
j=1
Using Jensen inequality, we have
1Aa1 B1|((2
BEF =)11 < E
1
11
(E
Σ bj
Σ9,
[3]
2
B
b
.))1 s
(n by)
(n b2)
JEA
j=1
barG) e,j 1
E
(59)
(n )2 JEAL
27

---

Published as a conference paper at ICLR 2026
Based on the definition of the set &, ej is one of the vectors in the set V which includes all vectors v, for all j E A Consequently,
|EFF - -3
|A4
Σ
ban()) - -0010]
-
|^4 (n b2)
E
Σ !EA JEA'
11, -
(n b,)
JEAL
A nn by)²
Σ iEA :EA-JEA
Σ
B [lvl - by1
(60)
Thus, to bound the squared error of the aggregation rule, - +).. we need to compute an upper bound for E v. -byl8] The remainder of the proof addresses this step.
Proof of Theorem It is crucial to note that, if some mini-batch gradients v; replaced by their Byzantine coun- terparts b, the optimization problem (47) involves a mixture of both Byzantine and mini-batch gradients. Furthermore, under the assumption stated in the above lemma, the aggregator has access all honest mini-batch losses (0.(
Without loss of generality, we assume that the last by gradient vectors have been replaced with their Byzantine versions. As a result, the gradient matrix can be expressed as:
G2 Mi, Vn- b bbyl.
(61)
In the above equation, we denote the honest mini-batch and Byzantine gradients by v, and by. respectively, for ,,...,,7. n by. From 49. and noting that w the minimizer of (47.
we obtain
Σ w (0x)))))))
Σ SEA
wfl v
Σ SEA
2
Σ $EA- SEA*
Σ
b
Rb
Σ
Σ
w V1; - val12 + Σ Σ
ugws b; - bb1l) + Euyyor (w)) 1
Σ
w
fir - a Σ
wfll V V
v
iEA SEA=
SEA"
i=1
n- n-b
Σ
v5112 + Emptor (w*)
(62)
in which w' is a feasible set of weights given by
b- if Sisin n n-hhh by
(63)
0, if
sisn. fnn
Based on the inequality (62 we have
by
(0x)) - Σ f(.((( + Σ
willi:l12 +
Σ
b
2 KEA
KEAb
jEAb
*EA=
b-
Q
v
w
1 || v,112 Enytor Fiay)orww') Eeayor (w=)
(64)
2
Replacing w/ and w³ based on (48 and 633 in the above inequality results in
Σ
Σ
1ive
by1l
Σ f(o(Ow) Σ fio(0s))
Σ |lb.11
2(n by)²
n by
(n by) SEAL
SEA" JEa
iEAR
JEA
n- n-bs
a (n by)
2(n - 2 Σ 1
a
|| v, + Easytor (wy)) Emuyhor (w0)
(65)
PEA
j=l
28

---

Published as a conference paper at ICLR 2026
in which A = fI.2...., - bb)) A implying |A4| = by |A4 = |A Using the assumption ||b,]| -
maxieR Vill, we have
oby
Σ
1 byllă v
Σ fco(Ox)
Σ f2o(Oh) +
(n by) |1 [/8mp(())1l
2(n b,)²
n ny
by BEAd
iEN jEN
SEAL
b- by
a
Σ
1 +
v - V, 1112 + Euylor (w') - Eraylor
(66)
[n (n- by)
2(n - by)
REA"
/=1
where map(k) that was selected by the optimizer.
FROM MINI-BATCH GRADIENT TO FULL-BATCH GRADIENTS
In 60 we deal with the full batch gradients v; while the above equation we have mini-batch gradient V,, so we need to formulate the hand side of the inequality (66) based on full batch gradients. Since the v; is unbiased estimator of mini-batch gradient V, over batches, i.e. Eaach V. v; (see Subsection 2.2). So, we have
Ebatc { v. - by [1 Ebarch (1;;; v.) + (v. - b
= Ebach V; - v:l12 + 2(V; vi, V - by) + [|; - -bil23
Ebach V;: - val13) + 2(Loaach {v: - vi.. - b1) + llv -b112
Ebuch V/: -v:1/3) + 2(v; Vi
- b5) + -lIv.-b,11. b,
Baach [|;: vv:12) 0 + Iv, - -byl12
||, by 112 + Epanch {lli; v.113).
Based on the above equation and Lemma
we have
||: by ll S Ebanch {1]v; - -by12) - ||v - -bbl2 + +
(67)
Similarly, we can write
Eauchh {1|v: V (1:] Baach (1((v; Vj) (v: vi) (v, 15)
|| - v2112 Eeacch {l]i; v. v.1l Eoachh {1 - v
2Bbarhh { (v: - vs, V, - vv
(68)
Since mini-batch samples for different clients are independent:
Ebach ( (iv V., V vyy} (Eeach (+: vz). Hoach ( vzl) O.
Using the results of Lemma 6 and above equation in (68) results in:
Ebatch [1 V; v S V. villž + 25
(69)
Similarly, we have
Bpatch [|:11 Eoach { V. + (V, v.)11
1|v. 2(v,, Branch (V: vz)) Fearch {1li; v.l13)
Based on the above equation and using Lemma 6 we have
||v: < Epanch ( [|.11]] < ||v:l12 + &
(70)
Taking the expectation over batches in (66). Eparch (fc,((x)) (0x) and replacing the expectation with the results
67
69 and (70) yields
Σ 15(0n)) + (n ab,
||;
- b,1
[1(0k)
b,) Bbaach { [/Vmap(p) [12)
2(n - )2) TEA JEAL
n1 by
"EA"JEA'
SEAR
JEA
n by b-
a
l|v:
a
lIv: vı11 + ac's + Ebatch & (w")) - Eraytor (wo)}
(71)
(n by)
2(n
by 2
iEAd
1=1
j=1
29

---

Published as conference paper at ICLR 2026
BOUNDING THE LOSS HETEROGENEITY TERM
The first term on the right-hand side of the above inequality captures the effect of non-IID losses. We take its expectation:
[Loss Term)
Σ
m
Σ
my
72 by
iEA"
JEN
Let my Mang + ou, where 8v: -
Marg.
Σ m, Σ
my
Σ
(movg + 0i)
Σ
(mavg + +oz)
REAd
JEA
iEAd
JENL
(IA4)
|A m
Σ
- 69
8
iEAM
JEA
Since | |A%), the Mavg terms cancel perfectly. We are left with bounding the sum of the deviations. Taking the absolute value:
Σ
8
Σ
5j
16
+
Σ
ارو
Σ
mm
Mavgl.
PEA"
JEAL
jE
REA"UA
Since the of selected and discarded clients subset of all honest clients, this sum is bounded by the total sum of deviations over all honest clients:
ma
Mangl
maogl-
KEAHUA
kEH
Using our new assumption, ΣNER mm mavg I (n - by) Therefore:
(n by)Ek Ek.
BiLoss Term}
Σ
Σ
59
(72)
by
by
HEAd
JEA
BOUNDING THE PAIRWISE DISTANCE TERM
First, we find an upper bound for the average expected squared distance between any two honest clients.
E[[lv; vy112)
EE (g: 83) ((v; - 8:) (v, 8
|g: - 1 E(l(vv; - gi) - (v. -g)
||g; 1 Var(v; - v2)
S ||g: B 4do
To bound the average of lig;
1... we add and subtract and note that Ee(8e g) = 0:
Ig: 10112
Σ b
(g:
g)
(g) gg
(n - b,) ijeH
(n - b1)²
11 b-
2(n by)
g g11
(n - (n-by) 2H.
(n by) )2
n by
Therefore, the average expected squared distance is bounded
1
Σ
Efllv
vo1l 2H
(4do by - 1)
(73)
by)²
by
ieEK
30

---

Published as a conference paper at ICLR 2026
BOUNDING THE
TERM
This section provides formal proof for the bound on the term D = EiEA' Bi -
which is -iEAA B(llve -
key component of the main resilience proof for the practical mini-batch aggregator.
Lemma (Bound on the Mini-Batch Norm-Difference Term). Under assumptions (1) and assume that ||by]| S maxigR Vrrll- lll
Then, with probability at least 1 - 5 (over the mini-batch sampling events), the norm-difference term D is bounded by: D S (2K + do + ES).
(74)
Proof. To prove the lemma, we begin with the definition of 'D. The attacker's gradient norm is bounded by maXte V/ Therefore, for each Byzantine client; E A its expected squared norm is bounded by the expected squared norm of some honest client 'map(k)" that was selected by the optimizer. This allows us to write:
D
Σ JEN
Σ iEAd
b map(k)
(12)
Σ
(75)
According to (71), we need to incorporate the expectation over batch for the expectation term [I map(k) (1) in the right hand side of the above inequality, so the expectation this term will be jointly over batch and data distribution. The mini-batch gradient VA an unbiased estimate of the population gradient vs. meaning Boach {vx} Vk. The total expectation taken over both the mini-batch sampling and the population distribution. We have:
11 v + (vx vx)
v 2(vR, V v&) V vx 1
The cross-term vanishes under the total expectation because the inner expectation over the batch is zero: E((vk, Vs. vx}} ((vv Beach v&]
E[ (Vv, V4 vx 0. Consequently,
E ( B [(2] + Efll v2
(76)
We now substitute
776 into 75 resulting in
D by (B(() VVll))) [2] Bel (12))
Σ
TEA"
where dev denotes the sampling deviation vector (v v). We first bound the population level. Using [[Il Igg 113 + Var(va) < 113 do
[(llv+ll3)) S
Σ
(1llgmmp do Ig
Emmpuull llg. (2) + dy
REAd
iEAd
REA
We now apply the Bounded Norm Deviation assumption (K²) to the difference of squared norms:
Emapttol -lg. = (1lgmapt l12 || (llg:
4a 112 |g|| + ||g. || $ 2Kk
This gives the final, igld-indeenn bound for the norm-difference term:
by
by
E V (a)
B (el
2k + bydo b, -do Σ
(77)
km1
Next, we bound the sampling deviation. The high-probability bound states that |/dev| < E for any client. To get upper bound on the difference, we have:
[llldev map 112) < =. Summing over the by clients, this entire term bounded by bye..
Finally, combining the bounds for the two separated terms, arrive at the final result. With probability at least 1 - 8:
S (by (2 + dot)) + (by=3) = by (2K + do + +3)).
This completes the proof of Lemma
31

---

Published as a conference paper at ICLR 2026
BOUNDING THE TAYLOR ERROR TERM
The new term introduced by the exact analysis is Enow = (Eeuylo(
- Euytor (w")). We now bound its magnitude.
Enew
Σ Cw/ Σ wi w(
u Σ (.(lR((w"))
Inmax
G| + G
2
(IG [[Gw'I2+|||www[]]]] [G
To get concrete bound, using the assumption |lb:l|2 I maxieæ Ville. and since w is in the simplex, [lb]l S n-o, Erens wy [a l12]
ErEn= 8++ +=EEEAe by)
11 I n- EiE
by
Similarly, |G n-bs
1
Σ EE
by lvall3) Consequently,
Lmaxa?
n-b
E Fnewll
Bill
12
+ by mmppas)
2(n2 - by)
A
a= 2
n n-bj by
$ 2(n
11 + Σ Bfllv (12) + Bf [iappw) + Imax
by using 76 (78)
by)
Rearranging and using the assumption that Var(v,) S do we get:
E [[llv = |lg. Var(v;) S |g:il do
We now sum the above result over all by honest clients:
by
Σ
BBIV,, S Σ (Ilg,)1 do =
Σ
|gil |
+ (n - (n-by)ddee by)
The final piece is to bound the sum of squared population gradients using the heterogeneity constant H and the mean gradient g. We use the "add and subtract g" trick:
R-by by
a n-b;
Σ
lg:
gi
-g gll
i=1
(llg: gl1 + +((g g.g) + 1|]|1)
a-by
n-
n by
Ig: gll 2 +2 Σ (g. g).g
+
Σ
|gl
|
t=1
i=1
i=1
The middle term is zero because
Σ
nn-by i=
(g:
g) = Σ gi) - (n - by)g = (n by)g
(n (n- (n-by)g =0. 0. This leaves
us with:
n n-by
n-h
Σ
Ig
Σ
g:
gl + (n - b
i=1
Using the heterogeneity assumption from your proof. sum:
||g. - =l s - by- we get our final bound on this
by
Σ llg 2 < (n - by) + (n - by) 1
(79)
To compute the upper bound for Eier- [[v [2]] + by || Mmpptoo 112] we have
Σ [1 + bE Vmppaa [12] s (n - by) + Σ
1l - lg + by
Emaxcoll -1gl
+ (n b |g
iEA=
NeAe
< (n by + (n br + (n b
(80)
32

---

Published as a conference paper at ICLR 2026
Replacing 79
and
80)
into 788 gives us:
H +
K2 2
B Enew |}
|
+ d + +
(81)
ASSEMBLING THE RESULT FOR IDEAL ERROR
We substitute the bounds from
and (1
into the expectation of the main inequality 71p.
(2 by 1) 2do
Σ
Bfllv; - bby12) S Ek +
a
(2K + do + +b))) +
2(n - bb)
n by
n n- by
JEA'
H
K2
2KEads ezabs
taHf (ado)) Sonnn-by by 2) +
HHZ + Imuxaa?
||8||2
d + ES
+
ace = Ek
2
2
n - by n n- by
n bj
[|g||2
+
H
+
K
+ d
+ +
+ aes.
2
Dividing the entire inequality by a.2, we obtain the final bound on the expected distance:
ΣV
Σ
E Bfllv;
by]l S
28k
[KKbb
203.b 21z 283
(2do²) O by 2)
by) (n-b
a
n by
n by
n m--bp by
iEA
H +
K2 + d + Es
2
[1g| 2
(82)
To eliminate the |lg|| 2 dependency and using a S
Lmuan we absorb the [m part of the Taylor error into the
same budget:
1
Chet
mmmax a || < Chet = a S min(
Limax
2 |||
where where the constant "absorption budget" Chei is defined as:
28 4K2by + +212 + 2daa - by 2) + n by
Cne = n by
n by
Using inequality (82) with a|gg|1 S Cher in 60 and noting that IAd < by results in
2ek S Vo
H² +
K2
[E 8) 3111
+ 2Che + 2I a
+ do + +x²))
(83)
a
Incorporating the above inequality in (57). we obtain
[BF)) - gll2 S
V
2b
Ck
+ Chet + Lmax
H
+
K2
+
do
+ =33)) +
2b, H4
(84)
2
2
/n -n-
Combining the above results with 51) gives us
|EELE3 g S 2bg
Ek + Ohet + L
H²
K2
do
+ 83))
+
26
H1 + Es
(85)
a
2
Vn by
By assumption, < -|1//2. i.c. E{F} belongs to a ball centered at g with radius r7. This implics
(E(F).g) 2 (1lg)12 l)lg (1 sin lgg
(86)
To finalize the proof, need to verify the second condition of Definition 5 using our method. To do this, have
Fl = by
Σ v.+
Σ b,)11=
1
Σ v.+ + Σ b
(87)
by
SEA-
"EA
iEA
JEA'
33

---

Published as a conference paper at ICLR 2026
Using the triangle inequality in the above equation and ||b:12 I maxeH 1Í results in
|| - n2 1--8 by
Σ
Villa
+
Σ
(byll)
S n by Σ
| by max
l|vall2)
(88)
IEH
VEN
JEN
Using maxte Vill S ELER V/l12. we have
FF n by Finally, using the inequality (a+ 6)" s 2 (a" + 6r) and the multinomial theorem, we have
Σ
Ville + by max |
$ n - by
1
Σ
Viillz + by Σ
|
1 by
Σ
1EH
n bs IEH
NEEA"
IEH
IEH
n-bs
|1F112 < (1 b1)
by)"
Σ
Vvvlle + (n b()=)))s)))))))))))))))))))
(n - br))
2 (1 + by)"
(12 (n b5)"
Σ
n!
V1 12 v222l2" ... \vvlll²))
(89)
(n bz)
r !!!r!!... Fn
Since GI...., Gn are independent, we obtain
B( 2- (1+1()
Σ
n!
a
22"
(90)
(n - by)
r1lr Tp
This concludes the proof of Theorem
G BYZANTINE RESILIENCE AGAINST ADVERSARIAL LOSS AND GRADIENT
Theorem 8. all the assumptions stated in Assumption Thold, and suppose by mini-batch gradient updates v; and the corresponding loss values fü are replaced with their Byzantine counterparts b, and fü respectively (e.g. data poisoning attack) with 2b + 2 S n. Then, for step-size O < a S Omnx in which Ornax = min Temax
Cse x
we have
2h
bf maog) Chr L [[B( gl12 / 2bs (= n by
H
K2 + do + EB3)
2bg
Hs + ES
Vn bj
(91)
and if < [1g||2, we have
(E(F).) g) 2 (lggl2 Iglll = (1 - sin a lgl
(92)
Proof. The proof of the above lemma closely follows the approach used in Theorem 2 However, unlike Theorem 2 which considers only the presence of Byzantine gradient updates, this theorem accounts for both Byzantine gradient updates and Byzantine loss values, requiring additional care in the analysis.
The main difference between the results of both loss and gradient attacks, compared to the model attack, is that some losses are replaced with their Byzantine versions. So, based on (66), we need to replace the losses of adversarial clients with the Byzantine version, resulting in
ΣΣ VEAR JEA'
||,
b
Σ ((0k))
Σ 1(00)
2 n by)
n by
EEAR
JEAL
n- by n by
a
b 2
a
Σ
1|vi
a
l|
v11 + Eustor Baylor(w") - Emyyor Fuylor(w") (w") (93)
nn by)
(n by) EEAd
2(n )2 2
YEAD
1=1 j=1
term 1
34

---

Published as a conference paper at ICLR 2026
Using the assumptions that we have
|b:12 I
max [ the byzantine losses fy are nonnegative, and using m. = B{f((0)), lER
Σ TEA JEA
Σ
[[[lv - by1ā) a(n by)
2
Σ
+ - [lerml].
(94)
(n by)²
EEA
term2
It is worth noting that termi is exactly the same the term following the loss difference in the right-hand side of the inequality (66). Using (82). we can write
2 [[term1] - by by
4kKbbs
2z +
2HH +
(2do)) by- -2) + 2 [18|12
H 2
+
+ do + E3
a
n by
2
(95)
Now we need to bound the term term2. Based on Assumption
we know
n- Eiz1"
|mm Maogl S ck and using
|A4| S by, we have
2
2
S (ex + by mang) (96)
m; - Mang + Mang S a(n - by)
Σ
m, - Mavgl + bybWaggg)
annn by)
a
n by
VEA"
Using
955 and 96 in 94
yields to
2
by
E [[[lv - byll2)
- (ex +
mavg) )
(n b2) YEA JEA
a
n bbb
by
4KZby
n- by +
2z
+ 2Hb
(2n by
2)
+ 2L
+
H2 2
+
K2
+ do + +E$) )
(97)
n by
by
2
The rest of the proof is the same as the one used in the proof of Theorem Consequently,
[B(F) gll2 s 2 (2 (5x + by by
H²
K2 + do + -5))
2b
-Mog)) + Chet Timax 0r
H + Eg
/n by
(98)
By assumption, 7j < |lg|2. i.e. [{F} belongs to a ball centered at g with radius vj. This implies
{E( (lgll22 7)) l|ll| sin a:) 1gl..
(99)
The remainder of the proof proceeds by following the same reasoning the argument presented after (86).
This concludes the proof of Theorem
H PROOF OF THEOREM 3 AND DETERMINING LIPSCHITZ CONSTANT L
H.1 PROOF OF THEOREM FOR L-SMOOTH (ITEM 1)
In this section, we provide the proof of Item 1 of Theorem Theorem 9, Consider the cost function ( under Assumption 1
The sequence (0x, wa generated by Algorithm 2
satisfies the corresponding result of Item of Theorem
Proof. To streamline notation and maintain consistency with Assumption I denote the true population gradient by Vk.i = (0xx), and the mini-batch gradient by Vg.s. It important to note that, in the optimality condition our method-sin it is solved the server side-we work with mini-batch gradients, whereas in the descent lemma analyze the true gradients.
Since each is continuously differentiable and its gradient Vofs is L,-Lipschitz continuous, Lemma that
4 directly implies
L; f. f((0)))) S f((e)) + (Vk,s. θ - 0x) + 1 0x11
(100)
35

---

Published as conference paper at ICLR 2026
Multiplying both sides of the above inequality by whes and summing over i = to we have:
Σ Wk Li
ww.il1(0x+1)
VR, Ou+1 02)
110++1 0x12.
(101)
important to note that the above inequality, all gradients {Vr..)?-1 are honest ones; otherwise, the descent lemma breaks. We use the notation (w:)) = Di=1 Wk, for the all honest gradients.
In the first step of our proposed method find the 0, utilize ( Since, Ok+1 aG =0x - -a-FFii (wa) is the minimizer of (5) when w w we can write
WkeVVa 5 +
Σ iEMO
wk wK. 0x+1 0&) 1
0x 5.
(102)
2a
iCH
Here, the term Σier Vk, + EiENo bk, accounts for both the contributions from the set of honest clients H and the complement set He Crucially, because the optimization problem (5) is solved at the server side, the gradients of Byzantine clients may be arbitrarily substituted by b This explains why the inequality above involves b rather than the true gradients.
Adding the above inequality to (101 gives us
1
wk.ifi (Fe(Wa), -oFA(WA)) + 10x+1 0x1
Wk (k
2a
1=1
Σ
Wkice;
-FF)
10++1 0x112-
(103)
2
n
Simplifying this inequality and using Σ Wk Li 5
Σ Wk Wkax I Liaxx we have
Σ wk.s (( & Σ Wh ((0s)
a ((FF(WF)) F[(w)), Fk((w)) + Lmax
1
)a² (we)))
(104)
2
2a
On the other hand using Lemma 4 for w f(0x aG&w) results in
1 aG&WA+1) Σ Wk ff(00 aaG
L -
VV w. aG&wG) W641 WK)
|h+1 - w
(105)
2
In terms of 0k+1 0₁ W4111 and 0x41 0: - -GG this inequality reads
L
WELLi Σ Wkis wk. + (V w w.T wk+1 ws) +
2 |k+1 - w
(106)
In the above inequality, since we are writing a descent lemma, all gradients are true. It is straightforward to show that the optimization problem equivalent to the following formulation:
Wk+1 = argmin
W..TT(( GG wx), w wx) + 2 ||w
wx 112 =5At
5 (w).
(107)
The term tn WT f(0, aG = f(0x+1) - aG G We in the above inequality. However, the similar term in (06) does not include Byzantine data, so we just replace H (1....,,,) nn in (06). using notation G instead of G
From (07). since Wk+1 minimizes the objective function, its corresponding objective value is less than or equal to that of any other feasible choice, including Wt. This yields the inequality:
wk.sf. Wh+1 - w + 23k+1 Wk+1
w
8 8
(Wk+1) S d dsieo (Wa)
(108)
36

---

Published as a conference paper at ICLR 2026
Adding the above inequality to (106) yields:
a
WK+1,f((0k+1) Est. (W&+1) Σ
Wki (100i(((0=1>>>>
(aG (G++1 G -G We+1 wk) +
Lu
1
||
- 2 - 82t00 (Wk)
(109)
23
It straightforward to show that the above inequality can be written
Wk+L.t + & (Wx+1) S Σ wr.afi(x++)++
L
a ((Fx(W++1) F& (Wx), F++1(WE)) F (wx)) +
- م (wx)
(110)
2 23x+1
Adding inequality (104) to the above inequality yields:
n
n
Σ Wk WK+1 +
wk (k.ifi(0k+1)) + &ALLe (Wk+1) Σ (k.sf((kk) + Σ Wki
(FFx (Wk-) (w&),, FKI1 (Wx) F (Wx)) + (F)((W))) Fi(ww),
L
Lmax
1
/| w 2
11
0 10x+1-10 0x11 + م (wa)
(111)
2 23x+1
20
Simplifying the above inequality results in:
Qk+1= S Qx + ((Fx( Fn(Wa), F FR4I(WE)
F F (www)) (WW))(W)) (w(Wa), Fa(wx)
EkI1
Ie
Lmax
1
Lw
a² (F
+
|Wk+1 wxll2.
(112)
2
2a
23x+1
Fk
where Qu+1 Ei= fi + t.e (Wk+1). To guarantee the exclusion of exactly by clients, we set 1/s and by (see proposition 2). With this choice, the nonzero weights become 1/(n2 by). ensuring that our algorithm removes precisely by clients.
To continue the proof, take the expectation of the above inequality all sources of randomness. We first focus deriving an upper bound for the expectation of the cross cooss-tim-sstep error term:
Eς+1 (wW++++)) (w(w)), F
Fi+1((s))
which formalized in the following lemma.
Lemma 10. Let Item B2 of Assumptions 7 holld. The expected error is bounded by:
E[E++1 & 2aCk+1
[|g*|] +
K2 + do + E
(113)
Proof. The proof proceeds by first separating the randomness from different time steps.
Let E& |]] denote the expectation conditioned on all information up step k. We rewrite the total expectation using the law of total expectation, E[:] = E& [Ex+ 1 [:]]. Let Bys FR+ (Wx) P (Wx).
E[E++1] = a E& (FL( FR (wx). Ex+ [E
The inner expectation is the bias of the aggregator at step k + 1 using the weights from step k. By our Bias Assumption, its norm is bounded by (x+1- Applying the
inequality:
E[E++1] S ac*+1 E ||| FFll]
(114)
where AF, = F& (w (w.). The problem is now reduced to finding an upper bound for B[[AFF
The change in the aggregator is AF; G (w w&). Let my be the number of clients whose weights swapped between iterations. Under the simplified weight structure, A AFr b-b; (Ere.eg Va,i + Eie bR. - EjER; Va.j
EjeRØ bx.)) in which Dr.j is Byzantine gradient of client j round k. The change in weights from W. W841 occurs because some clients are removed from the active set and replaced by others. We formally define these sets of swapped clients:
37

---

Published as conference paper at ICLR 2026
Let A = (w+p)
(upp(w>)) be the set of "added" clients.
Let R₂ = supp(wk)
supp(W*+>) be the set of "removed" clients.
Since the size of the active set is constant sets into honest (H) and Byzantine (HL) clients:
by. we have A |Rxl mg. We can further partition these
Added honest/yyzantine: A = Ab 0 H. A = As n n.
Removed honest/Byzantine: Ri R2 H. R R2 n HeC
Under the simplified weight structure where non-zero weights are 1/ by). the change in the aggregator A/, can be written explicitly as:
b ))
F2 by
Va.
Σ byy
VRJ
Σ
JERS
JER
To bound [I|| AF& we first bound the expected squared norm, E||| | [17], maxiER Vi, and then use Jensen's 's inequality.
using the assumption ||ba,]|
S
BIJ 17] S
2
E
Σ SEAAE
VE, +
Σ iE
b
+
Vist
(n b
EERS
ie VE
2 < (n - b,)
Σ iE
V 1, + |A | wmp.ppppplll1 + mp
Σ JER
& 113) +
| B1 V
v..mao l12)
where map(i) = argmax ll 122 The next step to bound the expected squared norm of an arbitrary client's gradient, v.. [|2]. For an honest client i, using (76). and [ =l. < ||gx| + K2 + do
V |g 2 K2 + do + E
Substituting this in:
4m (Igg 1 + K? + do + +53)
E1| []
(n-by) by)
Using Jensen's 's inequality, B[X]
E get the bound the expected norm:
4m² [l gk 2 + K2 do + =3))
B|A
(115)
(n
by)
The bound
[15) depends on ||gx|] To split it, we use the inequality
v + S Vx + / for x, 2 0.
gg 1 + K2 + do + + <
|g 12
K2 +
do + 2 |g + K + +
Let CK = / K dap + +5 Substituting this into the bound for [[[[| |]:
2m
BI
(llgal || CK).
using the above inequality from 114 and my S by, have:
E[E++]] $ acb+1 El| AF
2m
s acc+1 n-b (I|g*|l + Ck)
2aca+1llga -2cc++1CK
This completes the proof of Lemma
10
38

---

Published as conference paper at ICLR 2026
Next, we focus on deriving the upper bound of the expectation of Z in (12).
Lemma 11 (Bound on the Single-Step Bias Term). Let Assumplions 1 hold. Then, the expectation of the single-step bias term is bounded by:
Ea FR, F2) S (<el1Bx 1 + ch of + on vd t
(116)
Proof. The derivation proceeds by decomposing the inner product with respect to the true gradient gk- The constant can be handled at the end. We focus on finding an upper bound for I = Ex Fg. Fk)).
First, we have
Fg.
((Fx
gk)
(FF
gk), gk + (Fr -g))).
We can expand this inner product, which results four terms:
(FR
FE,
Fk)
(Fk gh.
gk)
F
ga:
Torm
Tomm
(FF
gk
gk
(FF
gk: Fi
8k
Term
Term
We now take the conditional expectation [x[-] of each of the four terms.
Term 1: Since ga is deterministic at step k. we have:
[x gt. gx)] (Ex [Fx] gk. gx).
By the Cauchy-S inequality and the bounded bias assumption:
(R [Fx]
gk: gx) S Ex [F]]
gxll
||gx
Cx gg
Term 2:
This is the Mean Squared Error (MSE) of our aggregator, which decomposes into squared bias and
variance:
Fx g [& Fv gx 1 Var (Fi) S C + oF
Term 3: Since the clean aggregator FG unbiased (E4 [AX] gx)). this term's expectation zero:
EE gk g+)] = [F] gk g&)
(g
gk g+)
Term 4: For the final cross-term, we use the Cauchy-Schwand inequality for random vectors, [[[(X,)) S
EAKEEE gk. Fb -g)) EFI(FE gk: Fk gg>ll
[& F5 - ge 18 .B. F3. Bal
v do V oz oz oo va(ci + o.
Summing these four bounds gives the result for Zz. Multiplying by completes the proof of Lemma 11
Next, we focus on deriving the lower bound of the expectation of Fg in 112
Lemma 12 (Bound on the Expected Squared Aggregator Norm). Let Assumptions 7 hold. Then, we have:
E. F |gg -2cx ||g
(117)
39

---

Published as a conference paper at ICLR 2026
Proof. We know
Ex [x = Vara + [[
(118)
Since Vara (Ba) 2 O, we can therefore drop this term, resulting in
Ex || Fi [1] 2 [|
(119)
Using the inequality ||a + b1l2 2 [Ilall - [[61)2 = |||| - 2 |||a||||||| + |bll we can write
| [F = llgx + [P - g: 312 ||
gg 2l2 [PPc]]]]] - galla + [Bx] gxll2-
We now use our aggregator's bias assumption, | [F gx|l - Ck- We can substitute this into the inequality:
[ 2
Ig 2 g 2a + || [Fx] 1x
Since the final term is non-negative, we can drop from the right-hand side. This gives us:
| [Fa]l
| 2Cx |/
(120)
Using (120) in (199) yields to
E 1
|g 12 -2Ck RCkl|gkl12 [&[FFIlE
This completes the proof of Lemma] 12
Now we return to (122. We take expectation B[.] and substitute the bounds for Ek+1, Is and FR from (113). and 117 respectively.
(166)
B[Qu+1] & E[Qa} + 205a+1 ||ga|| + / K2 + d + =²)
(from Eg)
+ [a(GallBull ll + Eh + , + xx dd 22 +
(from Ix)
Coa² (1g 11322 - 2ÇA BM ll2
(fromFFk)
Ca Ex || wx 122)
(Weight Descent)
Let Ca = ( Lenas 0 and Cs.-
1 Lue) > 0, resulting in Timax and B T. We group
28--1
terms by their dependence on ||ge||. Let B&a = a(2Gx+1 + Cb + 2C,a(z) be the coefficient of the rebound term. Let
Cerr,k+1 2(x+1v K d E + (cF + o ok Vo. /S2 22 + x which collects all constant error terms.
E(Q++1] s E[Qa} C Ig 11 BRallgul Cerr,k+ia CBuss E
W
The term Bxl|ge|| is positive and could counteract the main descent. We use Young's inequality, ab zza² + 112 B& ||
BLa²
BLa gg S ? ||::112
24
Here, is a free parameter. We make a standard strategic choice to ensure descent: we set the "rebound" from Young's inequality be half of the main descent, i.c., 1/ a² so Ca The combined coefficient of ||g+]2 becomes:
aaaa² +2 -C, C Ca
(
Limxx a
4
This is strictly negative for < 1/L guaranteeing descent. The other constant term from Young's inequality is ni Consequently,
E(Qu+1] & E{Qx} - Callla C2 - CB B[[ - w
(121)
where C₁ = 1 - (1 L.wa > 0 for 0 < < 1/ Lmax. and C2 is the constant that groups all bias and variance terms:
C2 = Cerr.k+1 + IC1.
Taking the total expectation from the above inequality, since ge is deterministic, and sum from k =
to -
T-1
C1a
gg
+
Co... Ell Wel - < (E[Qul E[Qr)) + Σ C2
(122)
k=0
k=
k=1
40

---

Published as a conference paper at ICLR 2026
Now, we keep the first term of the left hand side of the inequality (122). resulting in
C1a
gg - (B[Qo] B[Qr)) Σ
C2
k=1
Let Q- = iif0 Q00, w) be the minimum value of our objective, which we assume is bounded. By definition, for any k. QT 2 Q", and therefore:
E[Qal E[ - Qu -Q"
(123)
Substituting this back into main sum:
T
C
|gal1 S (Q0 - --- + Σ
C2
k=1
Dividing by Tojo:
T
Σ
C2
Q0 Q0-Q- Q TCia
T
gk
1|
k=1
TC1
Taking the limit as T + oo, the first term on the right-hand side vanishes, leaving the final bound on the average of the squared gradients:
Σ C2
lim
sup T
|g
1| <
lim T-200
(124)
2-000
TCi
k=U
Now, we provide detailed analysis of the order of this final error rate.
Since C₁ (1), the final error rate is determined by C2 Based on the definition of C2 k, we have
C2 25x+1 / K2 + dot + + (ct + o + to C + +
(2Gx+1 + Ca + a))
(125)
4C1
Carr.k+1
B2
4d1
As k oo, we have Soci R.. of. and of oz This implies the limits of the coefficients
lim Cernkt1 = 2500 V K2 + 2 + + (so + of + ox Va S2 + +z = O + o
100000
B
(26o0 + Soo + 4C )x0)) O((2)
lim
(126)
4C1
4C1
For the upper bound in (24).
we use fundamental result from analysis: if sequence converges to a limit L, then
its Cesàro mean (average) + Σ vg also converges to Since we established that C2, converges C2 Using 126).
we have
lim sup
Σ gg 2 s O + of.oo)
(127)
T-000
T
Now, we need to show that for the hybrid step-size schedule in Assumption
!
the aggregation weight W6+1 converges
to Wg + D0.
Lemma 13, Consider the inequality 122 with the hybrid step-size schedule in Assumption 7 The expected weight updates will vanish:
lim Blll B[]l W& 1 = 0.
Proof by Contradiction. Let 2% :=
W W& 13]. We begin from 122 with neglecting non non-negative term
Ci Σk- || from left hand side of inequality and using 123):
Li
26 S Qu Q*
C2
(128)
28x+1
k=
41

---

Published as a conference paper at ICLR 2026
Assume for contradiction that {r*} does not converge to O. This implies the existence of a constant e > and an infinite set of indices K such that 2i 2 for all & E K with Kr = K (o...., , 1}. Following the standard contradiction argument, this leads to the inequality:
Σ
Low
S Qu
Q' + a
T-1
Σ
C2
2
2
ke
Taking the limit of the above inequality when T + Do give us:
lim T-
Σ
Lu
lim
Qo Q T
lim
C2
T
kEKT 23x+1
2
T
The first term on the right-hand side the above inequality converges to zero as T - oc because Qu Q" is bounded. The second term is Cesàro mean of the sequence {C2,),, and as shown converges C2 The key step is to analyze the asymptotic growth of both sides. So, we have
c. lim
Σ KEKT
Law 2
S 2C
T T-000
T
23k+1
Since 3x+1 + O, the terms (1/(28x41) - L// 2) + 0o. The Cesàro mean (average) of a sequence that diverges to infinity also diverges infinity. Thus, the left-hand side is infinite, leading the contradiction aC2, The assumption must be false, and therefore lims-+oc Ik = 0. This concludes the proof of Lemma 13
Now, we need to show that the aggregation weight wi converges to the critical point of (6 as k 0o. As we know
limg=aoo We = w", which a fixed point. Using (8), we have
( (w"), w w*) 1 w
w argmin T (w*)
w" 11 + :2at (w)
(129)
23
Using the optimality condition for the above equation gives
0 E V +
(w* - -w") + 36 2t0 (w*)
(130)
Box
where ô denotes subgradient. As k + 0a, 300 0,
300 (w* w") O. Using this point results in
0 E (wbx + 06 st.o (w"),
(131)
which is exactly the optimality condition for (6). Since this represents the optimal solution of (6 as k co, it also satisfies the Byzantine resilience bound (14) in the limit, Hence, we conclude that <oo S r7.
This concludes the proof of Theorem
9
H.2 PROOF OF THEOREM FOR L-SMOOTH AND STRONGLY CONVEX (ITEM 2)
We extend the previous analysis to the case where each loss function fi(0) is p-strongly convex.
Theorem 14. Consider the cost function (1] under the assumptions Theorem 3 and Item 2. The sequence (0x, wh generated by Algorithm 2 satisfies the corresponding result of Item of Theorem
Proof. To prove the above theorem, since f() is a strongly convex function, we need to show that the Q(0, w) is also pr strongly convex with respect 0, which is formulated in the following lemma.
Lemma 15. Let the function be Q(0, w) Ei wi (0) + +5st. (w). If each f((0) is p-strongly convex with respect to O and w is on the unit sparse capped simplex, then Q0, w) also p-strongly convex with respect to O.
(w) is constant with respect to and adding a constant does not affect the convexity or the strong convexity parameter of function. Therefore, (0,, w) is p-strongly convex with respect to 0 if the weighted sum H (0, w) Ein wi) is p-strongly convex.
Proof. The proof analyzes convexity with respect to for fixed, valid w. The term 5 مAدة
42

---

Published as a conference paper at ICLR 2026
We use the definition that a function h(0) is p-stroogly convex if h(0) 2/1011 is convex. We analyze this for W)):
H(0 w)
1110 1
Σ
W
M
1011
2
(f((0) " [101))) 2
By assumption, each function (i) is j-strongly convex, each term (f) う/2 010 is convex. Since the weights 2 O, the expression above is a non-negative weighted sum of convex functions, which is itself a convex function.
Thus, HO,, w) is p-strongly convex. As established, this implies that Q(O, w) is also j-strongly convex with respect to 0.
To continue the proof, we define:
F F(Or, Wx) Σ (((k) + +dste (wx), VoF(Ok, wx) Σ WKe Vof((Ok))
(132)
in which (() and (of( for all S S denote the honest losses and gradients. Additionally, according to Lemma 15 F w) is j-strongly convex with respect to 0.
Next, need to determine the variance of the global true gradients, which is formalized in the following lemma. Furthermore, as mentioned, we exclude by clients, so in our algorithm we have t = 1/s and = n by.
Lemma 16. Under Assumption the variance of the global true gradient is bounded:
9. == var Morr(VoF(F.) wi)) E [l w&) 12] S do
Proof. We start from the definition of og and substitute the definition of F(OO,, wk):
ww.sf((Ok) )
00 = E
V
Wk. (k((f(((x))
- E V Σ
112
E
Wket (0xx)
Σ Wk E ( 011
by linearity of V, E
= E
Whi (V))(0)) (( 13
We use the inequality
Σ
x 112
N Σ |x, 2/ and the property capped in At.0 i.e. wh, S1. 12, Here, N S 8.
g.k < E
( - ((V^(())) -
iESupp(wa)
st2
E (( EVS10.+)]13
by linearity of E
(w)))
st
Σ
var var (v.(()))))).
tesupp(wa)
Now, we apply the given bound var( var( (O)))))) S do
02 < st
(do
iesupp(w.))
< (
Replacing by and f. = 1/8 gives us the proof of Lemma
16
43

---

Published as conference paper at ICLR 2026
Since F w) in (32) is p-strongly function with respect to 0, applying this to generated sequence (0,, w by Algorithm yields to
2j((F(0,, Wx) F(O", wx)) Σ |v w
Since the adversary just replaces the honest gradients with Byzantine gradients, F(Ok, wa.) = Q(Ok, w&). Using this point and taking the expectation from both side of the above inequality yields to
24 B[Q(0s, wa) Q(o", wx)) = E [lV& wx)l
(133)
The term E F w can be written
[o wx) = | F(R,, W w + B [IVo wa) - EVVoF(Ok, wx)lll
= |gg 12 + var (Vo F(x,, wx))
= Igg 11 + o
(134)
Substituting the decomposition from 134) back into main inequality (13
2p (00k, wx) Q(0", wx)] I ||ga + 2
Using Lemma 16 bound of < dot. get lower bound |g:
(Q0 wx) Q(0", wk)) dot s 11
(135)
According by neglecting the negative term -EE CBa., E [[[[w++ wx wxll3) and replacing ||g: 12 by the
121
lower bound 135
we have
F (1 Fx ado + (B(()(ws) -Q*) C2
(136)
where Fx41 (Q x+: Wx+1) Q²} and Fgg = R(Q(Oxx wx) Q*) where Q' =Q(", w*) and w be limit point of the sequence, i.e. limg-+o W/ w
0 argmin F(0, w")
by using 132
This allows us analyze the asymptotic behavior of the recurrence (136). The inequality standard form of Robbins-Siegmund lemma, Ex+1 I (1 Ea + by. where:
a = a
by a (do + B(Q*(ww) - Q*}) + C2
The convergence of such sequence is determined by the asymptotic behavior of the error term by relative to the descent term a. Specifically, we analyze the limit of their ratio:
lim by
C2,k
lim k000
do + ((Q'(WE) Q²) +
2μc41
From Lemma 13 have established Wx+1 lime (wx) - Q*) = O. Consequently,
We with limit point w and using the continuity of Q, we have
b
Cz
lim sup 00 a
do +
2μC1
In this case, the optimization error converges to neighhorhood of the optimum, with the size of the error ball given by this limit:
C2
lim lim E S do2 +
0 (52 + 02.00 + 0z)
24C1
This completes the proof of Lemma
44

---

Published as a conference paper at ICLR 2026
H.3 DETERMINING LIPSCHITZ CONSTANT Lu
In the following lemma, we derive bound for the Lipschitz constant Lu assuming VaJi is Lipschitz continuous and (0)ll & C' for all 0.
Lemma 17. Let fe: : Id + R be continuously differentiable with Vali being Li-Lisschizz continuous and bounded, [V)]( for all 0 Rd and = I, ..... nb. Define:
h(w h(w)= = Σ wifi
0
w vo
(137)
i=1
j=1
for w E Aio, = fw E R
I t, wwllo S s) a 0, and fixed 0. Then, V vwh(w) is Σ, wi 1, wi 2 0, wy
L -ipLishchitz continuous with:
Lu S a0 (n2/2 + + anL + an? /mmxel
(138)
where Lmax
max Li and 0 = / (kt2 + 22) as defined in Equation 21 of Lemma i
Proof. Define z(w) = 0 aGw, where G = (V)/(00),... Voln(0)] Rdxn, Then:
h(w) = Σ wrf((((w).
The gradient is:
Vwh((w) = f(z) - aG G(w)w,
where f(z) =
and G(w)= =
E Rdxx We need to show that:
| (ww2)) voo((w1) S Lw w1ll2.
We compute
Vwh(w2) Twh(ww)= - f(z)) - aG -GG" (G(22))2 - G(wI)w1),
where 2j 0 aWw,.j 1,2. Thus:
(w)((22) - vwh((w)ll [f((z) f(z:)lla + all al|G (G(ws) G(W1)w:)ll..
(139)
First Term (lf((z)) - (122) Since Sa is L-smoothh, the descent lemma gives:
Li ||22 21 2/11.
f1(22) - f((21) s Voli(a)) F (ze 21) + 2
(140)
Since 22 21 = (G(w: w2), and | S vnC (as (o)( - C):
| - zıll s avnCC W2 will2-
Similarly, we can write
T Iz -2112-
fi(z)) - f((2)) < (Z2( (z) 22)
(141)
Since [oofi(z)lla < C. using (140). 141 and the result 21 in Lemma
||2 will2 where o
2 (k22 + +2) S 22:
Li0 na na) - w1ll2-
1f((z2) - fi(z)) s a(vi=
2
Thus:
Lie | -ill2
[[f(z)) f(21)ll2 5 Σ
11((2)) f(2)) Sa
Σ
Vni
1=1
1=1
Lmax!
2/2 3/2 + 22a
|22l(w2 - w1ll2
(142)
2
45

---

Published as conference paper at ICLR 2026
Second Term (||G" (GG((G)2)w2 - G(w1)w1)ll
G(w2)w22 G(w:) =
Σ Wiz (Voli(z)) voli(zi)) + Σ 1112 - w wx.1)ool(2z))
Using the Lipsehitz property of Vofi
[Vo)((z)) Voli(zi)le S L,1lz2 - 21ll2 S Lav/TC// w1ll2-
Utilizing the property Ei= Wi,sss S Lmax Ei=1 W122 Linx
Σ wa (Vofi(ze) Vefi(zi)) -Vef(t))-oo(iza)))
Σ
w,2LiavhCCll2 wille S aLmax VnC'|l will2.
(143)
Also, have
Σ w1s2 w Vo.i)()
w1.2 W;,1 S CVnllw2 -wil- wilk-
(144)
Combining (444)
and (143) gives us
G (G((2))
| (a VTC +CV)ll - wills
(aImaxnC2 + (2n)]lw2 w1ll2.
So, we have
a:l (GG"(G(W22w:: ( G(w))w1)l ala + (Rn)ll will2
(145)
Replacing
(42) and 145) in 139
Lo S (n + anLmax + an Lmaxe
(146)
2
Thus, Vwh((w) is -ipshhisci continuous.
The Lipschitz constant Lo can be determined in two ways. A more precise approach is compute Lw directly by analyzing the gradient of l((w) defined in (137). though this may computationally complex. Alternatively, when direct computation is challenging, Ln can be bounded as in (146) under the assumptions of Lemma 17
I ADDITIONAL EXPERIMENTAL SETUPS AND RESULTS
L.1 EXPERIMENTAL FRAMEWORK OVERVIEW
We implemented federated learning framework using Python 3.12.7 and Py'Torch as the primary deep learning library. All experiments were conducted on GPU-accelerated hardware to ensure efficient training and evaluation. Specifically,
Implementation Details:
utilized CUDA for GPU support and ran our models variety of high-performance GPUs, including NVIDIA A100, NVIDIA A40, and Tesla V100--XM2232GGB These resources allowed for large-scale parallelization and significantly reduced computation time during training. For further implementation details, have shared the complete source code.
Data Heterogeneity and Malicious clients: In this study, we utilize two datasets, MNIST and CIFARIO. both of which contain ten labels. As described in Subsection 5.T, the number of groups corresponds to the number of labels, which is ten. A training example with label / is assigned to group / with probability and to other groups with probability 1-s. Each group consists of subset of clients, and since this study involves 200 clients divided into ten groups, each group contains 20 clients.
For selecting malicious clients, we adopt a group-oriented approach. Specifically, we randomly select nym number malicious number of clients per group groups. Malicious clients are first chosen from within a single group. there are remaining malicious clients to be assigned, we select them from other groups, repeating this process until malicious clients have been selected.
46

---

Published as a conference paper at ICLR 2026
For example, for a fraction of malicious clients 0.3 in this study, the number of malicious clients is 60. Since the number of clients per group is 20, the malicious clients are selected from three random groups.
Now, question may arise: why is this methodology employed instead of randomly selecting malicious clients? In fact, this methodology is specific case of random selection and represents one of the most difficult and challenging cases. Assume the fraction of malicious clients is 0.3 and the selected random groups are i, j. and & (i + + k). it straightforward to show that the attack corrupts all datasets with labels i, j. and k with probability + 2 1- -/ + 7g which can be high probability, especially for non-III data with a high degree of non-IIDness, as considered in the numerical study (g- = (0.6, 0.9)).
In this case, if we cannot detect the malicious clients, they can significantly reduce the test accuracy. contrast, if the malicious clients are selected randomly, they may be distributed among all groups (for example, uniform selection). In this scenario, the attack may have a minor effect because the benign data dominates the malicious data.
Furthermore, we examine the effect of group-oriented malicious selection compared to random selection on FedAvg. We observed that the test accuracy of FedAvg drops significantly for group-oriented selection compared to random selection. In summary, this explanation demonstrates that group-oriented selection is one of the most difficult and challenging scenarios for detecting malicious clients. This allows us to compare the proposed method to statc-of-the-art Byzantine-robus FL. approaches in highly challenging setting.
Attacks:
Flipping label: Malicious clients train the model using a poisoned dataset, where the label of each class is changed to L / --1 1, where L represents the total number of labels (in our study L is 10).
Backdoor attack: Malicious clients train the model using poisoned dataset, where black square of size 8 x 8 pixels is added to the center of the image, and its label is randomly changed to a label between 0 and 1.
Inverse gradient: Malicious clients compute gradients based on their local datasets to minimize the loss function and then flip the sign of their gradients.
Global parameter attack: At each round, the server sends the global parameters to the clients. Malicious clients add Gaussian noise, ((1 u2a²), into the global parameters 0 where l represents the mean of the global parameters, denotes their standard deviation, V1 and 1/2 > 0 are arbitrary real-valued constants. In this study, we set V1 5 and 122 = 1.5.
Double attack: In this scenario, during a communication round, an attack targets a fraction of clients. In a subsequent communication round, different attack affects separate set of clients that were not impacted by the initial attack. Specifically, this study assumes that the first attack, an inverse gradient, takes place during the second communication round, targeting 50% of the malicious clients. Later, in the fifth communication round, a global random parameter attack is executed, affecting the remaining 50% of malicious clients who were not involved in the first attack. For instance, if the proportion of malicious clients is 40%, then 20% of the clients are impacted by the inverse gradient attack, while the random parameter attack targets the other 20%.
LIE (Little Is Enough) attack: Malicious clients first compute the coordinate-wist mean μık and standard deviation dg of the client updates in round k. They then submit forged updates of the form
b = p4 2 kk
Vjj E HC
where = 0 is small constant ensuring that the forged updates remain within a plausible range. In our experiments, we use the original stealth bound for as proposed in Baruch et al. (2019).
1.2 HYPERPARAMENE SETTINGS
We detail the hyperparameter configurations used for all state-of-the-art methods and our proposed algorithm. For Krum, the retained clients were set (1 fraction of malicious) total clients and for Trimmed Mean, the trimming fraction matched the fraction of malicious clients. All methods with tunable hyperparameters (e.g., Bulyan, FedLAW, CClip, Huber) were tuned via grid search using a dedicated validation split (80 % for training, 10 % for validation, and 10 % for testing). The chosen values corresponded to the settings that achieved the highest validation accuracy after 200 communication rounds on MNIST and 400 rounds on CIFAR- 10. All methods shared a common training configuration with the learning rate = 0.01, a batch size of 64 for the MNIST dataset and 16 for CIFAR-10, and 3 local epochs. The total number of communication rounds used to update the global model parameters was 200 for MNIST and 400 for CIFAR- 10. An overview of the selected hyperparameters for each method is summarized in Table
47

---

Published as conference paper at ICLR 2026
Table 1: Selected syper-parameters for all defences.
Method
Hyper-parameter(s)
Chosen value
Krum
Retained clients
(1 fraction of malicious) x -
Trimmed Mean
Trimming fraction
fraction malicious
Bulyan
Candidate pool size Inner aggregation size
grid: 20/40/50
(1 fraction of malicious) x n 2
FedLAW
8 Sparsity budget Client weight upper bound
grid: x 10-2 - 10-4
fraction of malicious) n
1/(s 10)
CClip
Clipping radius Fixed-point iterations
grid: 0.1,
CClip Bucketing
Clipping radius Fixed-point iterations Bucketing factor
grid: 0.1, 10
RFA (Geometric Median)
Smoothing y Iterations
10-6 6
RFA + Bucketing
Same as RFA Bucketing factor
10 R =
2
Huber
Threshold
grid: 0.12, 0.2
Coordinate-wiss Median
FedLAW: sensitivity to B. We evaluated the impact of the FedLAW hyperparameter under the flipping label attack with strongly non-IlI split (q 0.9) and 40 % malicious clients. The test accuracy (mean + standard deviation across runs) is reported in Table accuracy curves with error bars appear in Figs. and
For MNIST, accuracy remains consistently high across wide range of 3, staying above 86 % for all 3 > 6.3 10-4, Performance peaks around 87.7 % when 3 = 10-2, but values between 6.3 x 10-4 and 10-2 yield nearly indistinguishable results.
For CIFAR-10, accuracy generally stays in the 55-60% band, with some variance at a few values of 3. The best mean accuracy of 59.7 % is achieved
10 and most settings in the 10-3-10 range perform comparably.
Overall, FedLAW is robust to the choice of 3; near-optimal performance is obtained without extensive tuning, especially for in the 10 10-2 range.
Table 2: FedLAW B-sweep with 40 % flipping label attack (q=0.9). Reported values mean test accuracy + standard deviation across 5 runs.
MNIST Acc. (%)
CIFAR-10 Acc. (%)
x 10
87.67 0.97
59.66 0.77
6,3 x 10
86.80 + 0.97
57.83 + 1.80
10
86.54 0.46
58.91 0.01
1.6 x 10-3
86.43 4 0.64
59.12 0.42
1.0 x 10
4.627
54.23
6.3 10
86.97
58.03 - 0.24
4.0 10
5.35
39.11 2.08
1.0 10
4.612
55.17
6.3 10-5
82.49
55.27 0.39
10
85.19
55.50 1.43
1.6 10
83.67 1 5.00
58.00 + 1.80
1.0 10
84.50 1.99
53.90 4.44
sensitivity to inner aggregation size and candidate pool size. In our main experiments, we fix the inner aggregation size to (1 fraction of malicious) x total clients and tune only the candidate pool size. However, in
Bulyan:
48

---

Published as conference paper at ICLR 2026
100
80
Accuracy (%)
60
20
0
-5
10
3
10
Figure FedLAA sensitivity to on MNIST (g=0.9, 40% flipping label attack). Error bars denote +1 standard deviation across 5 runs.
70
60
4
50
Accuricy (%)
40
30
20
10
10
10-4
10-3
10
Figure 6: FedLAW sensitivity to 3 on CIFAR-I0 (g=0.9, 40% flipping label attack). Error bars denote +1 standard deviation across runs.
Fig. 7 sweep both hyperparameters study their joint effect. Under the flipping label attack with 40 % malicious clients and 9=0.9, we observe that inner aggregation size has limited impact, whereas performance is notably more sensitive to the candidate pool size. For the MNIST dataset, the best or near-best results are typically achieved when the candidate pool size is set to 40 or 50. It is important to note that these experiments violate Bulyan's theoretical guarantee, which requires the number of Byzantine clients to satisfy f (n 3)/4, where the total number of clients (Guerraoui et al. 2018). Theoretical results guarantee that, under this assumption, the deviation of each aggregated coordinate from any honest one is bounded by (( Vi). where is the variance among honest updates and the model dimension. Since the assumption violated our setting, the theoretical bound does formally apply. Nevertheless, shown in Fig. 7 Bulyan still achieves strong empirical robustness in highly adversarial conditions.
49

---

Published as conference paper at ICLR 2026
90
50
86.03
86.55
85.68
86.56
87.13
86.43
86.57
87.23
Candidate Pool Size
85
Accuracy (%
40
84.22
85.13
87.53
87.25
87.17
84.92
86.36
85.87
80
75
20
76.84
81.36
74.16
74.72
81.32
80.2
72.73
80.33
70
108
118
128
138
148
158
168
178
Inner Aggregation Size
Figure 7: Bulyan sensitivity to inner aggregation size and candidate pool size on MNIST under the flipping label attack (g=0.9, 40 % malicious clients).
Choosing the Sparsity Level s. In FedLAW, enforeing sparsity does not require exact knowledge of the number of Byzantine clients by. When an upper bound on by is available, we set to Lemma 5 with 2 1/s, selecting specific value via validation. When by unknown, a practical strategy initialize and gradually reduce it across epochs, which implements soft exclusion mechanism that avoids early over-pruning while still driving the weights of adversarial clients toward zero. this case, 8 can be treated as a tunable hyperparameter that controls the effective sparsity level and can be selected via cross-validation.
by and choose the cap t according
I.3 FEDLAW: CLIENT-WEIGHT DYNAMICS UNDER FOUR ADVERSARIAL SETTINGS.
To investigate how FedLAW responds to various adversarial behaviors during training, we analyze the evolution of client aggregation weights in four distinct attack settings: flipping label, inverse gradient, backdoor attack, and a double attack scenario. We conduct the experiments on the MNIST dataset with a non-iid partitioning factor of g = 0.9 across malicious. In the double attack setting, adversaries apply inverse
10 clients, of which 40% (i.e., clients) gradient manipulation while the other two send randomly perturbed global parameters. Each client trains three-layer fully connected MIP using batch size of 64 for three local epochs per round. The aggregation performed using FedLAW with sparse weighting.
Figure 4 displays the per-client weight trajectories over 100 global training epochs. Grey curves denote benign clients, red curves indicate malicious clients executing single-strategy attacks, and in the double attack panel, blue curves represent global parameter attackers while red curves indicate inverse gradient attackers. Across all settings, FedLAW effectively distinguishes between benign and malicious behavior. Benign clients consistently receive stable, high weights, while malicious clients are rapidly down- weighted, either immediately (in flip-label and inverse gradient attacks) gradually (in the backdoor and double attack settings). The results demonstrate FedLAW's ability to suppress diverse attack strategies in real-time during training.
I.4 EVALUATION OF MALICIOUS CLIENT DETECTION
To comprehensively evaluate the performance of our method in detecting malicious clients, report four standard classification metrics: Precision, Recall, FI Score, and Accuracy. We define the counts of true positives (TP), false positives (FP), false negatives (FN), and true negatives (TN) using the following strategy, where M represents the set of malicious clients.
Formally, for each client i, we define the following indicator variables:
TP: = { 1. if M and w,
(147)
0, otherwise,
50

---

Published as a conference paper at ICLR 2026
{ 1, if o M and wi S E,
FP.
(148)
0, otherwise,
FN; {
if MM and wy >E 0, otherwise,
(149)
TN; = {
1, if $ M and w; E, otherwise.
(150)
Here:
True Positives (TP): Counts the number of malicious clients that are correctly identified malicious by the method.
False Positives (FP): Counts the number of benign clients that are incorrectly flagged as malicious.
False Negatives (FN): Counts the number of malicious clients that are mistakenly identified as benign.
True Negatives (TN); Counts the number of benign clients that are correctly identified as benign.
The total counts are computed as:
TP =
Σ TP, FP
FP,
FN Σ FN, 1=1
TN = Σ TN.
Using these counts, we compute:
Precision:
TP TP + FP
Precision
which measures the proportion of clients flagged as malicious that are actually malicious.
Recall:
TP
Recall TP + FN'
which measures the proportion of actual malicious clients that are successfully detected.
F1 Score:
FI Score Precision Recall
Precision + Recall
providing balance between precision and recall. Accuracy:
TP TN
Accuracy
which measures the overall fraction of correctly classified clients (both malicious and benign), where n is the total number of clients.
We = - ensure that clients with very small aggregation weights are identified as malicious for evaluation. This threshold is appropriate, as fewer than 200 clients typically remain after excluding detected malicious ones. In the equal-weight case, benign clients receive weights above benign and malicious clients.
10 10-3 well above E, allowing clear distinction between
Table 7 summarizees FedLAW's performance detecting malicious clients on MNIST and CIFAR-10 10 under four attack types: Flipping Label, Inverse Gradient, Backdoor Attack, and Double Attack. We evaluate across different data heterogeneity levels (q 0.6 and g = 0.9) and malicious client fractions (0.1 to 0.4), using Precision, Recall, F1 Score, and Accuracy. Results reported as the mean standard deviation across five independent runs.
51

---

Published as a conference paper at ICLR 2026
Recall and Accuracy are especially important: high Recall ensures most malicious clients are caught, which boosts Accuracy. This is critical when the malicious fraction is high. Precision helps avoid false positives, but its impact less critical in practice when benign clients are the majority.
FedLAW consistently shows strong detection capabilities. For Flipping Label, Inverse Gradient, and Backdoor Attacks, often it achieves Recall values close to equal to 1.0, often resulting in high Accuracy (20.92). CIFAR-I0 generally yields better results than MNIST, likely due to its more complex features, which may help us in the detection procedure. Precision and Fl scores are also high (typically 2 0.9), confirming robust overall performance.
The Double Attack poses greater challenge due to its hybrid and dynamic nature. On CIFAR-10 with g = 0.9 and 40% malicious clients. FedLAW still secures solid Recall (0.899). but lower Precision (0.848) and F1 (0.872) pull Accuracy down to 0.897. On MNIST with = 0.6 and 10% malicious clients, Recall falls to 0.7 and Accuracy to 0.940. At low malicious fractions, even minor misclassifications can significantly affect metrics, though their practical impact remains limited due to the low number of malicious. is important to note that FedLAW's performance under the double attack is slightly lower compared other attack types, reflecting the increased complexity of this scenario. The double attack is used specifically to assess the method's robustness in the most demanding settings.
In summary, FedLAW provides reliable and accurate detection of malicious clients across all four attack types and under highly heterogencous data distributions, conditions that closely resemble real real-world federated learning settings. Its consistently high Recall and Accuracy make an effective and practical defense mechanism for secure federated learning systems.
Table 3:
Test accuracy (%) on MNIST under five attack types, two non-IID levels (q) and varying fractions of malicious clients. Reported as mean + std over five runs and are also depicted in Figure a.
Algorithm
Fraction of Malicious Clients
9
0.6
q
0.9
0.1
0.2
0.3
0.4
0.1
0.2
0.3
0.4
Attack: Flipping Label
FedLAW
92.63
92.71100.05
92.39-10.07
92.22:10.20
89.60-10.24
89.55
88.30
87.45:10.2
Bulyan
9.006++0.04
91.86++0.22
91.68+0.20
91.14++0.45
89.01
87.59
07.03-0.66
87.53++0.35
92.18+00.2
01.89+0..55
91.69+0.36
91.22++0.28
88.61
87.41=1.09
85.99=0.38
85.36+1.377
Krum
86.08=0.21
86.29+0.80
86.37=0.56
86.43+0.24
76.46=0.88
76.72=1.22 1.26
76.16=0.96
75.55++0.00
Trimmed Mean
92.15::0.29
91.58+00.17
91.02-+0.32
90.13
88.54+00.34
86.54-10.06
82.13
71.21
CClip
92.44
91.89
88.9740.54
72.70+22.3
87.00+t0.49
78.31
66.36=0068
54.45++..97
CClip- CClip-Bucketing
92.46=:0.05
91.55=+0.39
89.51=0.75
73.56+3.36
86.72=0034
19.11=0.69
63.50=1.92
54.00+2.45
RFA
92.60=:0.16
92.34+0.24
92.06=#0.38
89.90=1.41
88.60:10.47
86.22=0.82
72.43=3.79
55.20+2.16
RFA-Bucketing
92.6
9..84+00.73
92.16+0.46
88.29+22.99
89.00++0.27
86.17
71.12+2.49
54.82+1.41
CwMed
92.09
91.03+0.14 91.64+0.20
90.25
18.1244..45
86.09=0.32
82.68=0.54
72.82+3.87
Huber Aggregator
92.48-10.17
91.55=0.49 92.17=0.36
1..35+1.42
87.31
18.66=1..75
65.22=1.99
54.84+2.56
FedAVG
92.65:10.03
92.23+1.113
89.56:10.19
77.71
88.05=0..29
80.04
67.74=0.88
56.11
Attack: Inverse Gradient
FedLAW
92.40=0.119
91.88+0.46
91.83+0..3
91.62+0..3
88.5
88.45=0.18 18
86.86=0.15
87.41 11.39
Bulyan
91.59+1.38
91.26::0.16
90.29:0.27
0..1
87.09:10.06
0..83
02.54=0.96
83.80+1
Bucketn
91.3111..27
91.1810.14
90.3910.55
88.4411.41
85.89:0.997
85.97
82.06=:4005
81.4412.81
Krum
81.9913.34
80.4314.33
15.72.11.59
7..88
1..89
65.25
64.3993.56
61.93
Trimmed Mean
9..38
90.63+0.08
88,49=11.00
84.3
84.49=0.775
77.76=22.00
66.53#3.91
12.38
CClip
34.9813.19
73.78
10.00=1..00
10.0010.00
10.00=1..00
10.00=1.000
10.00=0.00
10.0011.00
"Clip-Bucketing
83.02.11.36 13.73110.18
10.00
10.0010.00
10.00110.00
10.00
10.00
10.00.1..00
RFA
91.82.10.29
90.70.10.15
87.85
60.88
84.92-1.088
1.01
65.85
10.00.10.00
RFA- Buccketuingg
18.
90.32
89.14
59.05
84.54
76.69=1.118
67.39-0.94
10,00+0.00
Continued on next page
52

---

Published as a conference paper at ICLR 2026
Table 3 (continued) from previous page
Algorithm
Fraction Malicious Clients
0.6
g
0.9
0.1
0.3
0.4
0.1
0.2
0.3
0.4
CwMed
91.4110.229
90.66110.44
88.90110.61
83.89
85.3311041
80.72.12.19
68.27
52.11112.89
Huber Aggregator
91.71
84.8143.37
1.16
57.09-11.55
82.08
73.28:11.22
64.00-00.4
55.40:11.30
FedAVG
84.1611.05
74.06:10.44
10.00=0.000
10.0010.00
10.00
10.00=0.000
10.00=0.00
10.00110.00
Attack: Backdoor
FedLAW
92.32.1.114
92.64
92.1911.113
92.46.10.27
89.69.10.42
89.17.1..77
88.81
87.88
Bulyan
92.1540.07
91.7344.22
69.23+11.95
59.66:1..32
88.79:10.04
83.28:42.40
51.79-8.79
33.89-11.80
92.1110.116
91.62:10.27
90.17:0.09
88.5410.44
88.27:10119
85.22:11.69
79.39
72.1713.84
Krum
27.6013.99
28.16.10.97
15.8314.34
22.64.1.544
15.21
16.36.12.40
18.38
16.90.1..69
Trimmed Mean
91.74:10.07
91.244:.21
90.40:1..16
88.77:1..00
88.51
86.84
81,08 1.04
74.45
CClip
92.21
91.66++0.17
90.89+0.46
90.36+0.19
88.35++0222
87.87=11003
84.94-0.83
81.45+1.111
CClip-Bucketing
92.1510.15
91.3110.12
91.15.1.18
90.3810.31
88.57.10.84
87.17
8..5
80.52.10.73
RTA
93.72.10.27
12.54
91.22:10.42
90.51
89.27-10.53
87.42.10.43
86.53
79.33
RFA-Bucketing
93.48+00.37
92.30
90.99+0.22
90.51+0.11
89.55++0.41
86.97+
84.31=0.60
80.17443.38
CwMed
91.61
91.02++0.30
90.40+0.33
88.4440.69
87.78+0.48
86.23+#041
81.17=2.18
67.89++4.39
Huber Aggregator
92.40.10.08
90.7311.39 91.48
89.93
88.79.10.43
87.42.10.29
84.94
80.80.12.65
FedAVG
91.99
91.3440.19
91.03-10.16
09.9
88.43-40.63
17.13
85.00
79.7442.65
Attack: Double Attack
FedLAW
92.57+0.05
92.39++0.02
0..34
92.31
89.93+0.21
09.76
89.35=0022
87.47+0..5
Bulyan
91.98=0.11 91.69+0.08
91.22=#0.13
90.79::.22
88.80=0.22
87.50=0..33
87.01=1.13
85.47+0.31
Bulyan-Bucketing
9..3
91.59++0.23
91.49+0.03
90.57
88.84-10.68
0..83++0668
84.91=0.69
83.50+3.44
Krum
82.24
80.82+2.03
79.28+1.60
80.77+2..15
71.20
71.83++2.64
71.25
62.43++5.90
Trimmed Mean
92.00=1..44
91.61=00.40
90.68
89.7440.26
88.32::0.45
85.02=1.05
82.01=2.83
76.10
CClip
92.08=:.112
91.67=0.08
90.78=00.2
82.99:4.99
89.12:0:29
80.84=11.00
18.1273.87
10.0000.00
CClip-Bucketing
92.27+0.118
91.72++0.21
90.47+0.38
86.45+4.14
87.97+
82.27+22.20
74.48=2268
10.00+00.00
RFA
14.37
94.29+0.21
94.13=0.117
93.5
91.59:0.500
83.74=t..85
85.23=2.65
1..1
RFA-Bucketing
94.94110.23
94.78=0..25
94.07=1.53
91.5045.75
11.13
89.97=0.14
76.23=5.72
60.54::4.33
CwMed
91.92:10.22
91.03=1.110
90.77=0.58
89.63
87.5
86.18
82.78=2.90
76.71
Huber Aggregator
91.97+0.31
91.28+00.51
9..0
85.00+2.90
1..0
78.47=22.2
66. 66.62=0095
0..96
FedAVG
92.294:.21
91.62++.11
90.83=0.40
8..68
89.42:00.66
86.79=11.44
71.49=6.16
68.28+3.67
Attack: Lie Attack
FedLAW
92.72:1004
92.24:1.02
90.7010.08
86.8814.002
90.1511.005
89.51-0.11
86.30-0.14
70.1012.17
Bulyan
92.16+0.02
91.44
89.41+1.36
50.15+33.52
88.80
86.16=1.92
58.92++22.98
21.23++3.09
Delyan-Buckettng
92.211:0116
91.88+0.03
90.40=0.05
86.94+0.05
19.14
87.53
81.73=2.54
29.98
Krum
92.32:10.17
90.9240:40
88.06220.53
39.53=11.36
89.49=10.33
83.84=1.01
26.561
11.62:10.33
Trimmed Mean
92.21110.25
92.07-1.220
90.66110.01
87.5810.23
88.9410.11
88.42.10.15
81.7810.49
56.70.14.70
CClip
92.57+0.09
92.56+0.11
92.09-1.333
90.60+0.12
89.90=00.22
88.85=00118
86.47=1.21
81.63+2.68
(Clip-Bucketing
92.76:10.14 92.76=10.07
92.11=0.114
90.6410.09
89.9110.277
89.13-0.22
17.96=1.11
82.69+1.09
RFA
92.2511.110
91.7011.18
90.9411.12
89.15
89.6910.44
86.76-10.28
82.25
55.5013.14
RFA--Bucketing
92.52.1..19 91.7410.12
91.0311.21
89.2910.599
89.13110.47
87.35
1..16-11663
57.39.17.07
CwMed
92.311:.11 91.5640.15
90.12+0.15
07.0
87.96=0.41
86.36=1103
79.07=2.32
56.03:+2.68
Huber Aggregator
92.45110.13
92.0411.002
92.0911.300
90.6910.12
90.08:10.44
89.34-10.48
1..19-1.03
08.83+14.550
Continued on next page
53

---

Published as a conference paper at ICLR 2026
Table 3 (continued) from previous page
Algorithm
Fraction Malicious Clients
0.6
9
0.9
0.1
0.3
0.4
0.2
0.3
0.4
FedAVG
92.6710.11
92.6111.21
91.91100033
90.1610.001
90.06.10.69
88.54.1..J1
86.92_0.88
84.22.12.34
Table 4: Test accuracy (%) on CIFAR-10 under five attack types, two non-lID levels (g) and varying fractions of malicious clients. Reported as mean + std five runs and are also depicted in Figure 2 b.
Algorithm
Fraction of Malicious Clients
0.6
9
0.9
0.1
0.2
0.3
0.4
0.1
0.2
0.3
0.4
Attack: Flipping Label
FedLAW
74.59+0.54
73.21=0.09
72.43=0.23
10
66.86+0.50
64.85=0024
62.39=00.51
58.86+2.22
Bulyan
73.53=0.71
70.55=0.77
68.60=20.53
62.20=1.97
64.93+0.57
61.84=0.92
60.00:0.94
13.57=10.37
Bulyan-Bucketing
70.62+3.66
71.56+00.68
67.17+3.08
45.86+12.96
59.48
58.33+6.53
58.56+6.54
47.82+5542
Krum
27.66+44551
24.77+2.19
27.19=#0445
24.99
21.23++0.00
17.6442.69
11.94+0.00
15.97=0.18
Trimmed Mean
73.12=00.03
71.72=00.3
67.39=0.30
51.18
62.24+00.3
59.27=0.29
53.02=1.97
43.45=2.09
CClip
72.42=t0.44
19:1111.13
60.12:1..6
39.98
61.93:0.91
1..58
47.93=2.25
42.22
CClip-Bucketing
72.31+00377
66.89-0..7
55.85-6.599
41.97-+9.59
61.65+0.81
54.95+1.17
49.94+2.21
41.34+2.04
RFA
72.61=#0.75
69.70+2.22
64.16=3.89
50.96=4.01
62.66+1.07
57.76=20666
51.4222.16
42.11
RFA-Bucketing
73.81=00.3
71.45=1.69
67.51
53.38
63.10=10.78
17.10=1.05
49.06=2.86
40.19=0.62
CwMed
73.50:10.42
68.66 71.03+0.31
52.441...28
63.91
19.80
53.40=1.68
44.92
Huber Aggregator
03.50+0.54
70.80+1.04
06.15
55.77+
62.66-0..66
57.13=0.24
51.06=#5.03
38.95+1.61
FedAVG
72.1940.64
67.63+0.61
52.23+7.76
51.21
61.70.10.3
54.91=0078
48.59=1.52
41.24
Attack: Inverse Gradient
FedLAW
74.45
13.16:10.63
72.05
70.3211.24
66.26:10.67
64.41
62.95+1.113
59.3811.14
Bulyan
72.62+0.66
70.56+0.30
67.62240.7
65.98
64.55+1..1
60.46
1..53
16.24+1.19
72.42:10.35
71.50:0.26
68.01
52.84#3.32
64.13:0.34
61.57=1.111
59.58
47.20=0.63
Krum
29.6810.71
30.11::.998
29.15::2.62
24.4811.44
19.2343.51
17.59:2.44
21.32:13.50
17.03
Trimmed Mean
71.0511.225
67.1810..39
59.22.10.86
42.44.1..84
61.56.11.73
55.27
18.16.11.34
18.17
CClip
71.40:10.29
67.61=10447
17.09
10.0010.00
61.17:10.73
55.01
53.53=5.57
10.00+0.00
CClip-Bucketing
71.44:10.6
67.39:11009
67.20
10.0010.00
62.89:11.58
56.77=1.31
52.0913.76
10.0010.00
RFA
70.61:10.61
6..37
10.00.1..00
10.00.1.000
60.98112.00
10.0010.00
10.00110.00
10.00+0.00
RFA-Bucketing
71.77
66.71111.17
10.00
10.00
61.26:11.18
10.00
10.00
10.00
CwMed
71.93:10.78
68.08:10.40
60.4811.74
42.89+1.86
62.08:10.36
56.74=1167
49.29
34.1014.47
Huber Aggregator
72.00-10.78
67.56.10.16
65.55
10.0010.000
6.696:11.68
56.37-10.76
47.93-1.93
10.0010.00
FedAVG
1..8
10.00.10.00
10.00.10.00
10.00
10.00-10.00
10.00.10.00
10.00.10.00
10.00
Attack: Backdoor
FedLAW
74.21+00.55
72.89+0.14
71.77+0..1
70.10++0.38
66.53+4..2
64.73++0.0
63.07++0.43
59.90+t0.17
Bulyan
73.0510.27
6..66111.16
47.46.10.07
30.9311..2
62.85110.21
54.52.10.4
35.38.12.69
18.62-12.53
Bulyan-Bucketing
71.61
69.73
67.02
60.39.10.48
63.53-10.33
18.58
53.70.10.91
48.04410.84
Krum
25.36+:1.17
16.47-L0.35
1..18
12.12+3.10
13:20::3.32
13.76:+5.08
9.79-10.29
10.06+00.08
Trimmed Mean
74.69+00.39
73.11+00229
70.72+11.24
66.07=00.6
65.66+40.20
64.05++0.18
59.45-
52.92+2.76
CClip
73.61110.48
72.94.10.47
71.32.10.24
68.59.10.50
65.91
64.13
60.60.1
56.54.1..9
Continued on next page
54

---

Published as a conference paper at ICLR 2026
Table 4 (continued) from previous page
Algorithm
Fraction of Malicious Clients
0.6
g 0.9
0.1
0.2
0.3
0.4
0.2
0.3
0.4
CClip-Bucketing
74.1610..50
73.0910.31
71.24.1..29
69.33.10.74
63.94_10.65
63.45.0.22
60.30.10.00
56.31
RFA
04.15
73.00-10.15
71.90:1.44
69.87110.66
66.22:10.41
64.00:10.65
62.05:10.49
59.04:10.63
RFA-Bucketing
73.80110.33
72.56:1..49
71.67:0.46
69.6910.45
66.10:10.73
63.70=1.225
62.3910.16
59.6910.50
CwMee
73.83:10.44
72.07110333
69.7910.64
65.50.1.22
65.44-10.64
63.66.11.22
1..91
52.14
Huber Aggregator
74.07:1..14
71.73:0.225
69.15
6..30
65.12:10.70
0..19
60.26:10.30
55.30
FedAVG
74.36+0.118
72.88+0.37
71.24
69.71
66.35-+0.23
63.21
60.62 1.92
55.9441..6
Attack: Double Attack
FedLAW
74.0910.31
72.89-0.228
71.6310.29
70.5410.70
66.45.10.08
64.9510.14
62.8910.557
59.98 1.25
Bulyan
73.56:10.53
70.60
69.4440.34
69.01
64.86:10.36
1..14
60.15:1..44
59.02.1 1.02
Bulyan-Bucketing
0..1
72.09+0.31
71.20+0.41
64.51
64.47-t0.19
64.10+0.51
61.77+00.55
53.64+1.19
Krum
1..31
29.35
23.43.12.81
2..55
18.94
18.02.13.86
17.60
17.95
Trimmed Mean
72.72:10.67
69.81
67.26
62.76110.06
63.30-10.13
60.16:1.111
56.54
50.95
CClip
72.49++0.29
70.71+0.35
67.77+00.6
63.34
63.27-+0.86
59.31
52.72:+0.48
46.01+2.03
CClip-Bucketing
02.8
69.91=0032
67.43++1001
63.02+1.23
63.27++1446
59.48=0088
1..14
45.99+1.49
RFA
58.99
64.97.2.37
55.80
10.00.1.000
66.1942.77
19.29
46.31
10.00
RFA-Bucketing
6..33+33.61
70.75++3.30
57.1441..17
10.00+
66.90+11.67
60.26
10.00=
10.00+0.000
CwMed
73.22+00.1
70,79+0.47
66.95++0.77
62.99+0.77
64.65+00.99
61.84+00779
57.28++0.99
52.12+1.44
Huber Aggregator
73.11=00005
70.1040.06
67.61=0.47
03.06+0.86
64.06=00.51
20.20=2.26
53,12
1..73+1.73
FedAVG
7..98:
68.7340.15
65.74
58.39 1.36
62.11+1.110
56.41
46.83 1.30
39.48
Attack: Lie Attack
FedLAW
0..30
01.96++0.26
60.91+0.37
41.56+3.22
66.49+0.19
61.79+00.50
46.22+ 1.76
28.34+0.44
Bulyan
73.52+0.20
50.18+0.61
31.19+2.30
10.00+0.01
65.57::0.33
40.99+1.13
13.82=3.44
10.00+0.00
73.19::0.27
64.14=0.51
42.53+2.28
2..45=1.14
64.99:0:21
51.49=0.31
32.16=1141
11.69=2.99
Krum
65.43+0..76
45.04++..09
28.70+:1.52
10.00+0.00
52.68++0.60
35.39
13.32-+3.13
10.01+0.02
Trimmed Mcan
0..6
6..01
45.98+1.211
27.65=0040
67.00
57.22=#0441
35.47=1.48
10.00
CClip
74.07=0.117
72.78=0.117
63.91
42.54:0.27
66.35:10.14
04.09
49.48=00225
1..11
74.10:10.64
72.80:0.32
64.3112.118
43.05
66.75-10.7
64.3910.01
52.47=0.18
31.59
RFA
74.27+0.11
65.25+00.46
50.53+0.62
33.52+2.06
66.18:0006
12.98
1.04
1..
RFA-Bucketing
74.47=00.04
66.18
50.92=0.15
35.05=11112
66.18:0.54
54.56
40.71
25.56+0.28
CwMed
72.04:10.08
58.5620.777
43.48
21.37+2.06
60.80:10.19
47.00
31.23:1.98
10.00+0.01
Huber Aggregator
70.3 68.0810.118
51.6510.29
36.16111998
67.08110.91
61.23:1.14
45.5811.22
26.4912.58
FedAVG
74.30=:0.06
73.51=0.20
64.0440.88
44.70+2.87
66.54
64.30=0041
51.71
33.04+2.57
1.5 COMPUTATIONAL COMPLEXITY
Communication Overhead between Server and Clients: As demonstrated in Table state-of-the-art Byzantine- robust federated learning methods typically do not update aggregation weights, incurring zero communication rounds for this step. In contrast, our proposed method, FedLAW, optimizes the aggregation weights w alongside the global model parameters 0, requiring an additional 20 communication rounds for w updates. Since Byzantine attacks are assumed to occur early in training and w converges quickly, we restrict its updates to the first 20 rounds, ensuring a fixed and limited communicatin overhead.
To ensure a fair comparison with existing methods and maintain standardized benchmark, align the number of communication rounds for updating 9 with those used by sfate-of-the-ar approaches our numerical study. This setup allows for direct evaluation of FedLAW's performance under equivalent conditions for 0 updates. However,
55

---

Published as conference paper at ICLR 2026
FedLAW (Ours)
Bulyan
Bulyan + Bucketing
Krum Trimmed Mean Coordinate-wel wise Median
Huber Aggregator
CClip
CClip Bucketing
RFA
RFA Bucketing
Inverse gradient
Backdoor
60
60
Test acc. (%)
40
40
20
20
0
0
100
200
300
400
100
200
300
400
Comm. round
Comm round
Figure 8: Convergence CIFAR-10 under adversarial settings 0.9, 40% malicious clients; Section for details). Each panel shows the average test accuracy over 5 independent runs; shaded regions denote 1td. FedL.AW uses communication rounds per model update, so 400 rounds correspond 200 global epochs. All other methods run for 400 global epochs. We report results for one data poisoning attack (backdoor) and one model attack (inverse gradient), which are representative of the broader attack space. Methods excluded from the inverse gradient plot did not converge.
highlighted in Remark [ and illustrated in Figure 8 FedLAW achieves the target accuracy with fewer 0-update rounds compared to other methods, owing to the joint optimization of and O. This flexibility enhances convergence speed, effectively offsetting the additional rounds for w updates and potentially reducing the total communication cost in practical settings.
Empirically, we observe that the learned weights change most during the early phase (roughly the first 10-20% of communication rounds); after this, they remain essentially stable, so fixing w has negligible impact robustness accuracy while keeping FedLAW's long-term communication cost close to that of FedAvg. When continued adaptivity is desired (e.g., under non-stationary data late-onset attacks), can be updated beyond this warm-up up phase periodically refreshed, at the price of a modest additional communication cost.
Finally, note that the CIFAR-10 10 dataset requires more 0-update rounds than MNIST due to its higher complexity, which necessitates additional training effort to achieve robust convergence across all methods.
Memory Complexity of Server-Side Weight Update: In method, the server updates both the global model parameters and the aggregation weights. The weight update involves computing the vector
h = W. + B.GG G++1 We (ff(0x+1)
(151)
where Wk E F" are the aggregation weights, G₁ = [Vefi(Ox), (ef) E Rdx= G = [off(( Vofn(0 gdxn are gradient matrices, and f(0x-1) E R" denotes the losses of all clients. The vector h2 is then projected onto the sparse unit-capped simplex.
To analyze the memory requirements for computing hg, summarize the necessary data stored on the server in Table
The dominant memory cost arises from storing the two gradient matrices G2 and G each of size O(d)). The other components contribute lower-order terms, resulting in an overall memory complexity of (dn).
Note that forming the product G7 G ww naively would require constructing an O(n²) matrix. However, this can avoided by computing it in two steps:
1. Compute G W. with cost (dn).
2. Then compute G. with cost (dd))
56

---

Published as conference paper at ICLR 2026
Algorithm
Dataset
Rounds Update
Rounds Update w
FedLAW (ours)
MNIST
200
20
CIFARIO
400
20
Bulyan
MNIST
200
CIFARIO
400
Krum
MNIST
200
CIFARIO
400
0
Trimmed Mcan
MNIST
200
CIFARIO
400
FedAVG
MNIST
200
CIFARIO
400
Table 5: Number of communication rounds for updating 0 and w in each algorithm.
Symbol
Shape
Purpose
Memory Cost
Wi
n
Aggregation weights
((n)
G
d x n
Previous round gradients
(dn)
G
d x n
Current round gradients
O(dn)
f(0+41)
client losses
((n)
Intermediate z G Wk Projection buffer
d
Matrix-vector product scratch
O
n
Sparse simplex projection
(
Table 6: Memory components required for computing aggregation weights.
In summary, the memory required for server-side weight updates scales linearly with both the number of model parameters and the number of clients. Therefore, the total memory requirement per round is O(d)).
Computational Complexity of Projection onto the sparse unit capped simplex: According to (10) the projection onto the sparse unit-capped simplex involves the following steps:
Sparsity enforcement: by Py, (hx), selecting the top-s elements from h; R". This step be performed in Onn (s, (Kyrillidis et al. 2013).
Support selection: S* supp(hx), identifying the indices of the top-s elements, which requires O(n) time.
Unit-capped simplex projection: Wi+1g- = PAs (hxs:), unit-capped simplex has computational complexity of O(s²)
W = 0. This projection onto the
Wang & Lu 2015
The total complexity of the projection step is O(nmin(s, logn) + s²).
I.6 EMPIRICAL SIZE OF Ek-
In this part, we explicitly measured in Theorem under high malicious fraction and extreme heterogeneity (malicious client fraction 0.4, non-IIID parameter y = 0.9, backdoor attack). For each communication round & over the course of training (up to 400 epochs), we computed and aggregated the results over five random seeds.
57

---

Published as a conference paper at ICLR 2026
MNIST
CIFAR-10
Attack Type
q
Frac. Mal.
Prec.
Rec.
Acc.
Pree.
Rec.
F1
Ace.
0.6
0.4
0.990 = 0.010
0.998 = 0.006
0.994 a 0.006
0.995 0.005
0.976 = 0.055
1,000
0,987 = 0.029
0.989 2 0.025
0.3
0,990 0.022
1,000
0.995 0.011
0.997
0.007
0,971 = 0.065
1,000
0,984 = 0.035
0.990 0.023
0.963 0.051
0,980 0.027
0.992 0.011
0.959 =
1,000
0.051
0.990 0.023
0.982 0.041
1,000
0.990 0.021
0,998 0.005
0,964
1,000
0.979 0.059
0.995 0.014
Flipping Label
0.9
0.4
0.921 0.052
0.948 + 0.072
0.934 + 0.060
0.946 = 0.049
0.954 = 0.048
0.950 + 0.054
0,952 = 0.081
0.961 + 0.041
0.3
0,963 0.045
0,966
0.047
0.965 0.046
0.979 = 0.028
0.937 = 0.058
0.987 + 0.014
0,960 0.026
0.975 + 0.017
0.2
0,970 0.021
0.975
0,025
0.972 0.023
0,989 0.009
0,932 0.073
0.965 0.029
0,947 0.044
0.978 0.019
0.972 0.041
0.986
0.997
0.064
0.939 0.082
0,944
0.073
0.014
0.6
0.4
0.880 + 0.045
0.874 +: 0.052
0.877 + 0.049
0.902 = 0.039
0,956 = 0.063
0.973 + 0.061
0,964 = 0.060
0.971 + 0.048
0.3
0,824 + 166
0.823 = 166
0.824 16665
0,895 0.098
0,975 = 0,037
1,000
0,987 0.019
0,992 + 0.012
0.2
0,913 + 0.140
0,917 0.138
0.915 0.139
0.965 0.056
0,963 0,082
1.000
0,980 0.045
0.991 0.020
0.913 0.194
0,930 0.157
0.921 0.177
0.983 0.039
= 0.092
1,000
0,981 0.053
0.996 0.012
Inverse Gradient
0.9
0.4
0.899 + 0.072
0.904 =: 0.064
0.902 # 0.068
0,922 = 0.054
0,997 = 0.006
0.997 # 0.006
0.997
0.006
0.998 0.005
0,3
0.833 + 0.071
0.833 0.071
0.833 à 0.071
0,899 = 0.043
0.969 = 0.048
0.997 + 0.008
0,982 = 0.029
0,989 + 0.018
0.2
0,825 0.071
0.825 0.071
0,825 0.071
0.929 0.029
0,943 = 0.087
0,985 + 0.034
0,963
0.061
0.984 + 0.026
0.707 0.033
0.857 0.131
0.774 0.073
0.953 0.008
0.901 0.140
0.990 0.022
0,939 0.088
0,986 0.021
0.6
0.4
0.979 = 0.018
1.000
0,989 1 0.009
0,991 = 0.008
0,968 = 0.068
1,000
0.983
0.037
0.985 0.033
0.3
0.980 a 0.030
1.000
0.990 a 0.015
0.994 = 0.010
1,000
1,000
1.000
1,000
0.2
0,970 0.023
1.000
0.985
0.012
0.994 0.005
0.963 = 0.090
1,000
0,979
0.050
0.991 1 0.023
0.1
0,900 0.039
1.000
0.947
0.022
0,989 0.005
1,000
1.000
1,000
1.000
Backdoor Attack
0.9
0.997 0.006
1.000
0.998 0.003
0,999
0.003
0 = 0.064
1.000
0
0.035
0.984 + 0.031
0.3
0.988 0.016
1.000
0.994 + 0.008
0.996 0.005
0.972 = 0.061
1.000
0.985 = 0.033
0.990 + 0.022
0.2
0.959 0.035
1.000
0.979 a 0.018
0.991 = 0.008
0.968 = 0.095
1,000
0,981 = 0.056
0.991 a 0.027
0.1
0,915 0,085
1.000
0.954 0.048
0,990 0.011
1.000
1,000
1,000
1.000
0.6
0.4
0.874 = 0.010
0.874 0.010
0.874
0.010
0.899
0.008
0.855 = 0.093
0.897 + 0.130
0.875 = 0.111
0.899
0.088
0.3
0.825 0.026
0.825 = 0.026
0.825 + 0.026
0.896 0.015
0.856 = 0.042
0.909 + 0.070
0,881 = 0.054
0.927 + 0.032
0.2
0.807 0.028
0.800
0.025
0,803 0.026
0.921 = 0.011
0.826 = 0.029
0.960 + 0.065
0,887 = 0.041
0.952 a 0.017
0.1
0.696 0.037
0,707 0,027
0.701 0.031
0,940 0.008
0 0.015
0.990 0.022
0,807 0.018
0,952 0.005
Double Attack
0.804 0.133
0.810=0.13
0.807
0.132
0,845
0.848 = 0.100
0.141
0.872 0.119
0.897 0.095
0.3
0.804 0.039
0.804
0.039
0.804 0.039
0,882 = 0.025
0.848 = 0.129
0.888 + 0.162
0.867
0.145
0.920 : 0.086
0.2
0.756 + 0.039
0.750 = 0.043
0.753 a 0.041
0.901 = 0.016
0.776 = 0.121
0.823 + 0.164
0,799 = 0.141
0.918 + 0.057
0.1
0.697 0.133
0.697 0.133
0.697 0.133
0.939 0.027
0.764 = 0.082
0.970 0.045
0,852 0.055
0.966 0.015
Table 7: Precision, recall, Fl score, and accuracy of FEDLAW under different attack types, values of g, and fractions of malicious clients on MNIST and CIFAR-10. Results are reported as the mean + standard deviation over 5 independent runs.
CIFAR-10 (400 global epochs), the average value of Eg over training is approximately 0.010, with median 0.003. The per-round mean E always lies in the interval [0.001, 0.065]: about 96.5% of the rounds satisfy 6 < 0.05 and all rounds satisfy & < 0.1.
MNIST (200 global epochs), the average Eg is approximately 0.040, with median 0.034. Here the per-round mean Ex lies in [0.028, 0.155]: around 85.5% of the rounds satisfy EN < 0.05 and 99% satisfy Ex < 0.1. Individual runs can exhibit a short transient in the very first rounds where En reaches up to R 0.33, but this effect quickly decays and does not persist.
Overall, these measurements show that, even under high malicious fraction and extreme data heterogeneity, E& remains the order of 10-22-10 throughout training (c.g., means & 0.01 on CIFAR- 10 and zs 0.04 on MNIST), with almost all rounds below 0.05-0.1. This is one to two orders of magnitude smaller than the typical training loss values (which are (1)), and is thus consistent with treating E lower-order term in our analysis.
1.7 ADDITIONAL EXPERIMENTS ON CIFAR-
We further evaluate FedLAW on a more challenging image-classification benchmark with many classes. We consider CIFAR-100 (100 classes) with n = 200 clients, using the same model architecture and training protocol as in the CIFAR-10 10 experiments. The data are split in strongly IID manner using two heterogeneity levels, q = 0.6 and y = 0.9, and we vary the fraction of malicious clients from 10% to 40%. As representative attacks, we consider flipping label, inverse gradient, backdoor, double attack, and Lie attack, applied to all aggregators under comparison. The detailed results are summarized in Table g
58

---

Published as a conference paper at ICLR 2026
Under the flipping label attack with 0.6, FedLAW remains stable as the malicious fraction increases, decreasing moderately from 27% + 0.27 (10%) to 37. 37.50% + 0.15 (40%), while several robust baselines degrade substantially and some collapse close to random guessing (Rz 1% on 100 classes). For the more extreme non-III setting 9 = 0.9, all methods degrade, and FedLAA drops from 32.12% 0.70 (10%) to 21.49% + 0.81 (40%).
Under the inverse-gradient attack with q == 0.6, FedLAW consistently attains test accuracies around 38-43% across malicious fractions, while several robust baselines degrade substantially and, some cases, collapse close to random guessing (+v 1% on 100 classes). For example, at 40% malicious clients and q 0.6, FedLAW reaches 38.02% = 0.12, whereas several baselines suffer dramatic degradation and, in some cases, even collapse to accuracies close random guessing (== 1% 100 classes). For the more extreme non-llD setting 9 0.9, the inverse- gradient attack is significantly more destructive for all methods; FAd remains competitive for moderate malicious fractions (up to 20%), but performance deteriorates for very high malicious rates (e.g.. 30-40%).
inverse-gradient
Under the backdoor attack, FedLAW remains accurate and stable across all configurations. For q = 0.6, its accuracy stays around 38-43% even 40% malicious clients, and for q 0.9 remains best near-best among all baselines. For the double attack, FedLAW remains stable for q = 0.6 (about 38-42% across all malicious fractions) and is best or near-best for q 0.9 up to 30% malicious clients, but drops at 40% malicious clients.
The Lie attack is the most challenging setting for all methods: accuracies drop sharply as the malicious fraction increases, and several baselines collapse near-random performance. FedLAW also degrades substantially under Lie at high malicious rates (c.g.. from 40.94% + 0.30 at 10% to 7.51% + 0.30 at 40% for 0.6, and to se 1% at 40% for q 0.9). Overall, these experiments indicate that FedLAW continues to provide strong robustmess on harder, high-class dataset with strong data heterogeneity and large fractions of adversarial clients.
Table 8: Test accuracy (%) on CIFAR-100 under five attack types, two non-IID levels (g) and varying fractions of malicious clients. Reported mean + std over five runs.
Algorithm
Fraction of Malicious Clients
9
0.6
==
0.1
0.2
0.3
0.4
0.1
0.2
0.3
0,4
Attack: Flipping Label
FedLAW
4..27=0027
40.60=t0.32
39.42=0.25
37.50=0.11
32.12
30.74+0.68
25.25++1.2
21.49=0.81
Bulyan
41.32:40.99
38.46=0.09
36.35=#0.22
34.12=0.24
27.35:+0.04
14.77:40.24
7.52:00.5
5.98+0.11
Bulyan-Bond Bucketin
40.61:10.49
40.3111.22
37.85=0.006
31.83=0.08
24.38:10.13
23.15::.225
21.51
19.06=0.59
Krum
4.73:10.95
1.00.1..00
4.50
1.00
1.0011.000
1.0010.000
1,0011.00
1.00
Trimmed Mean
40.71=10.1
38.65=0.73
35.14=0.33
28.04=0:52
30.10
25.83+0.36
23.62+0.39
18.55=1.76
CClip
40.88:10.13
38.27:0.49
34.36:10.33
28.11
31.5810.94
28.26::.:22
24.52+40.3
19.81
CClip-Bucketing
41.01
38.4511.28
34.36110.58
28.41
31.25110.76
27.1510.119
24.8710.88
20.17:0.63
RFA
41.58
39.0010.39
34.92.1.700
28.11
31.85.0.799
30.0710.52
24.7910.43
20.95
RFA-Bucketing
41.54:10.24 39.07=0.55
35.20=0.35
27.86=0.67
31.33110.4
28.71+1001
24.92+0.50
19.70=1.16
CwMed
40.93
38.2610.20
34.40.10.43
28.4710.36
25.1911.66
24.6010.55
21.53:0.72
18.22-0.38
Huber Aggregator
40.9510.22
39.4511.22
35.63.1.110
27.8910.57
31.0910.25
27.8110.43
23.3211.66
18.20.10.35
FedAVG
40.92+10.27
38.2540.112
33.91
26.90-10.30
31.1240.118
27.20
23.75:10.88
19.50
Attack: Inverse Gradient
FedLAW
12.51
41.39.10.49
40.0510.22
38.02-1.112
30.51
27.4811441
21.4511008
18.42-1 1.89
Bulyan
36.90
35.1940.51
34.8711.28
32.04
7.33
5,4910.73
3.86.1.112
2.61-10.17
Bulyan-Bucketing
39.28
38.53+0.27
35.06:1041
25.58-1007
22.77+40.22
20.95-10.58
17.66+1.06
12.90-10.90
Krum
4.2911140
4.90
3.00
4.21
1.00:1..00
1.00
1.00:10000
1.00+10.00
Trimmed Mean
37.90.10.35
33.13110.18
27.7810.440
20.45
28.04.10.13
22.61
19.12.1..5
12.92.1..06
CClip
37.03
31.84410.2
29.47-1.88
23.40-10.09
27.08-L0.19
1.00+0.000
1.00-10.00
1.00-10.00
CClip-Bucketing
38.16++0.41
32.62++..29
28.9940078
23.80+1.225
28.33-+0.93
1.00+00.00
1.00++0.00
1.00++0.00
RFA
39.21-10.48
34.1911.02
30.1410.53
1.00
31.31-11100
1.00
1.00-10.00
1.00.10.00
Continued on next page
59

---

Published as a conference paper at ICLR 2026
Table 8 (continued) from previous page
Algorithm
Fraction Malicious Clients
9
0.6
9 0.9
0.1
0.3
0.1
0.3
RFFABBucketing
39.10.10.33
35.19110.52
30.0311.31
1.00
29.50.10.28
1.00110.00
1.00.10.00
1.00.10.00
CwMed
39.07
33.43:10.19
27.40.10.34
21.23:10.35
22.60:10.52
19.80-10.82
16.70:10.88
11.19:11.99
Huber Aggregator
39.25:10.69
34.16:1.200
29.8610.18
1.00=0.00
29.32:10.09
26.92:10.00
1.00:1.00
1.0010.00
FedAVG
37.56.1..25
31.46.0.43
1.00-1.00
1.00
1.00.1..00
1.00.00000
1,00110.00
1.00.10.00
Attack: Backdoor
FedLAW
43.4340.64
41.95:10.4
40.02:1.11
38.22
31.92:0.12
30.83
28.61
26.37=10.68
Bulyan
39.61
31.59:1.22
7.63
1.82:10.29
25.57
1.2910.08
1,00
1.0010.00
Bulyan-Bucketing
39.0810.31
36.74.10.26
33.21
27.77-0.87
22.2710.67
12.17.1..3
4.52.0..6
1.44.10110
Krum
1.00:10.00
1.00+0.000
1.00
1.00
1.00
1.00
1,00
1,00
Trimmed Mean
42.32++0110
40.87+0.10
37.14
30.07+2.64
30.20++0.30
25.23++0611
12.31
2.14+00.08
CClip
41.88.1.41
40.2110.54
37.38
32.7343.21
30.99.10.46
28.58
25.58
2.63
CClip-Bucketing
41.85110.20
40.63:10.3
37.44.1.000
34.15-2.59
31.48:10.88
29.23111.20
26.76.11.32
21.73:12.15
RFA
42.18
40.87+0.27
39.65+0.39
37.50=
32.72++0.29
31.09+0..3
28.33++0.54
25.00++1008
RFA-Bucketing
4..76
41.23+0.25
39.73+0.65
37.49=0.27
31.75++0.28
29.24
18.1299.5
25.47=00.99
CwMed
41.28.10.55
39.25
32.76.11.20
28.47:1.22
21.12.11.14
12.85
3.50.12.24
2.14
Huber Aggregator
42.45
40.29+40.8
36.52+11.21
31.16+2.91
31.32++.122
28.20
25.09
20.60=00.56
FedAVG
41.39+00.6
39.14+0.30
37.66+0.32
35.92++088
30.91+0.300
28.80+0.377
26.78++102
24.35-
Attack: Double Attack
FedLAW
02.1
01.
39.98=0.19
38.02=0.16
35.44
31.24
19.30
20.39=0.74
Bulyan
09.92
35.01+00.85
29.28+0.11
24.79-0.51
26.66
15.78
7.62+0.54
1.63+
Bulyan-Bucketing
19.
37.85++0110
34.20++0.35
29.89=0.46
25.32
23.63++0.10
23.15+0.11
20.86++0.37
Krum
5.03:+0.07
3.89+1.05
3.40=0.80
5.22=#0.16
1.00
1.00
1.00
1.00
Trimmed Mean
39.74::0.42
36.55=00.23
33.23:10.39
29.17
29.18
25.91
21.63::044
18.29
CClip
40.33++0447
37.12+00.06
34.60+0.36
30.74-0.19
30.46:+0.35
27.31+00.3
24.19+0.46
1.00++0.00
CCtip-Buckettng
00.20
07.
33.95+#0.33
30.25=0.27
30.87+00.11
27.33+0.37
23.71#0041
1.00+00.00
RFA
40.79:10.71
33.73:0.88
1.00
1.00=0.00
35.61
31.66100.6
20.11
1.00
RFA-Bucketing
39.01
33.61=0.47
1.00=0.00
1.00=0.00
35.42:10.30
31,2311118
27.46110.00
1.00+00000
CwMed
00.46
37.53+00.76
33.84+0.09
29.25=0.52
25.34
23.17::0.84
20.01
16.81=1.31
Huber Aggregator
00.23
37.29+0.01
34.21
29.75-0.19
29.9
26.63+0.15
22.93
1.00++0.00
FedAVG
39.43110.35
34.02:10.19
29.07=0.69
23.64=0.64
29.14:10.94
25.04:0.85
18.95:0.533
1.00+10.00
Attack: Lie Attack
FedLAW
40.94+0.30
36.86+0.71
20.33+0.43
0.30
29.7440..3
16.59+1.41
8.85+
1.00+:0.00
Bulyan
41.10
12.26+0.14
1.00
1.00=0.00
26.91
1.00
1.00
1.00+0000
Bollann-uuckete
40.48:10.16
23.07+1.05
7.34
1.00=0.00
22.02:10.23
1.4310.63
1.00+0.000
1.00:10.00
Krum
27.68110.2
8.9710.84
1.00-1.00
1.00
1.00100000
1.0010.000
1.00.10.00
1.00-10000
Trimmed Mean
42.44+10.22
30.50+0.32
8.07=0.52
1.00=0.01
30.187
9.63#11114
1.00
1.00+:0.00
CClip
42.35110.37
37.21
23.07=8.44
9.34=0.81
32.16:42.08
23.8917.91
14.42:10.59
1.00+10.00
CClip-Bucketing
41.84.1.72
37.0011.33
22.5918.34
5.80
31.90.11.49
23.35118.43
9.50+7..36
1.00-10.00
RFA
41.5811032
30.81110.74
16.8810.31
1.00
29.69.10.47
15.70.11.05
1.24.10.24
1.00-10.00
RFA-Bucketing
42.52:10.49
31.32+0.39
17.0940..5
1.01
30.34:1.73
15.9640.13
1.32+0053
1.00:10.00
CwMed
35.37:10.16
14.52-10.54
5.1811..7
1.00=0.000
15.94.10.18
2.57-10.27
1.00+10.00
1.00-10.00
Continued on next page
60

---

Published as conference paper at ICLR 2026
5-10
0.1 0.3
4-10-2
Mean malicious weight
3-10-a
2-10-
1-10-a
Global round
Figure 9: Evolution of the average malicious aggregation weight under the mimic-min minniiiei attack on MNIST with three-layer network, 200 clients, y = 0.9, and 40% malicious clients, for different values of the loss under-reporting parameter p. Curves show the mean over five runs, with error bars indicating + one standard deviation. Increasing p raises malicious weights slightly in the early rounds but only mildly delays their collapse to zero.
Table 8 (continued) from previous page
Algorithm
Fraction of Malicious Clients
4
0.6
4 ==
0.1
0.2
0.3
0,4
0.1
0.2
0.3
0.4
Huber Aggregator
0.44
28.39-10.32
11.96:10.38
1.00-+0.01
31.60-L0.84
17.91
1.03:10.02
1.00+10.00
FedAVG
43.08
40.85++0.12
28.25-00588
9.01+00.4
+2.36
29.16+00.78
16.06+0064
1.00++0.00
I.8 EMPIRICAL STUDY OF MIMIC- MISALIIEED ATTACK
We evaluate FedLAW under model-poisoning "mimic-misaligned"" attack on the MNIST dataset using a three-layer network, with 200 clients, highly non-IID data (q 0.9), and malicious fraction of 0.4. For each malicious client j. we replace its update by- 9j + mug. where U, is random unit vector and = 0.1, and we under-report its loss as - 14 f with E {0, 0.1, 0.3, 1}. where μu and o denote the mean and standard deviation of the honest clients' losses. We restrict to p S 1, which keeps the cheated losses within one standard deviation of the honest mean, and thus in regime where attacker remains plausibly stealthy. Larger values (e.g., 1.5 or 2) correspond to losses more than 1.5-2 standard deviations below mean and can be easily filtered by a simple z-score or MAD-based preprocessing at the server. All other training hyperparameters follow the configuration in Table [
Figure 2 shows the evolution of the mean malicious aggregation weight over the global rounds. In all cases, the mean weight rapidly decays from the initial uniform value (approximately x 10 10-3) to below 10 4 and then remains essentially at zero. Increasing P raises malicious weights slightly in the early rounds and only delays this collapse by few rounds (from roughly round 22 for p to about round 28 for p 0.3 and p 1). but does prevent the malicious weights from converging to zero. This is consistent with the Layer 2 analysis: mild loss under-reporting can temporarily compensate for the misalignment penalty, but the weights adapt and reinforce misaligned clients' contribution to the aggregated gradient, their misalignment signal grows and their weights are eventually driven to zero.
61


Reviews:
[{"review_id": "AGPZSY1Mrl", "reviewer": "Reviewer_oBSd", "summary": "This paper studies proposes an algorithm that can learn the aggregation weights for benign clients in Byzantine attack environment. The idea is novel and is effective in enhancing accuracy after data in Byzantine attackers are ignored. The contributions include both new algorithm in robust federated learning and theoretical analyses for Byzantine resilience and algorithm convergence.", "questions": "1. Did you consider removing the malicious client identify step and automatically learning/assigning low weights to Byzantine clients?", "limitations": "", "rating": 8, "confidence": 4, "soundness": 4, "presentation": 3, "contribution": 3, "strengths": "1. The paper studies Byzantine adversarial tolerance, which is an important problem in federated learning. \n2. The paper is well written and easy to follow.\n3. The theoretical analysis is rigorous and the experiments are extensive to support the effectiveness of the proposed algorithm.", "weaknesses": "1. Figure 1 is not clear, with confusing color to denote different algorithms. \n2. How to enforce sparsity is not discussed, i.e., how to determine how many clients are malicious?", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "CpS1STT3UO", "reviewer": "Reviewer_8DwE", "summary": "This paper proposes FedLAW, a Byzantine-robust federated learning method that treats client aggregation weights as learnable parameters, jointly optimized with the global model. The key contributions are:\n\nA novel optimization problem formulation incorporating adaptive aggregation weights with sparsity constraints to exclude malicious clients.\n\nAn alternating minimization algorithm with theoretical convergence guarantees under adversarial settings.\n\nComprehensive theoretical analyses demonstrating Byzantine resilience and convergence properties.\n\nExtensive experiments on MNIST and CIFAR-10 under various attack scenarios and non-IID data settings, showing FedLAW outperforms state-of-the-art methods, especially under high heterogeneity and malicious client ratios.", "questions": "Communication Efficiency: Could the two-round communication be optimized? Can you provide a standardized comparison of total communication rounds versus accuracy?\n\nPracticality of Assumptions: How realistic are assumptions C1 and D1 in real non-IID settings? Are there methods to verify or relax them?\n\nScalability: How does FedLAW perform with a very large number of clients (e.g., >1000)? Are there distributed optimization strategies to improve efficiency?\n\nHyperparameter Tuning: Does the selection of $s$ and $t$ rely on prior knowledge of the malicious client ratio? Can these parameters be adapted dynamically?\n\nIntegration with Privacy Techniques: Can FedLAW be combined with differential privacy or cryptographic methods to enhance privacy protection?", "limitations": "", "rating": 8, "confidence": 4, "soundness": 4, "presentation": 3, "contribution": 4, "strengths": "The paper presents a genuinely novel approach to Byzantine-robust federated learning by treating aggregation weights as learnable parameters. This isn't just a minor tweak to existing methods—it represents a meaningful shift in how we approach the aggregation problem. The theoretical foundation is particularly impressive, providing not just convergence guarantees but also a detailed Byzantine resilience analysis that clearly explains why the method works. What makes the contribution stand out is how well the empirical results support the theory; the method maintains strong performance even under challenging conditions like 40% malicious clients and high data heterogeneity, which is exactly where many existing methods struggle. The writing is clear and the figures effectively illustrate the method's behavior, especially the weight evolution plots that show how it dynamically identifies and suppresses malicious clients.", "weaknesses": "While the method is compelling, it does come with some practical trade-offs. The two-round communication per update is a noticeable overhead, and while the authors argue that faster convergence might compensate for this, the paper doesn't provide a conclusive analysis of the total communication cost compared to alternatives. Some of the theoretical assumptions, like the bounded gradient deviation and heterogeneity bounds, feel somewhat idealistic—in real-world non-IID settings, these assumptions might not hold as neatly. The experimental validation, while thorough on standard datasets, leaves me wondering how the method would scale to more complex problems or different data domains. The hyperparameter selection also seems non-trivial, particularly the sparsity level, which appears to require some knowledge of the malicious client ratio.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "ZtOYKB6U4C", "reviewer": "Reviewer_LuYw", "summary": "This paper proposes a Byzantine robust federated learning algorithm where aggregation weights are learnt jointly with the model parameters via a nested optimization formulation. A Byzantine resilience analysis is provided, along with a convergence analysis. Experiments on MNIST and CIFAR-10 datasets show that the method outperforms baselines robust aggregations under varying heterogeneity scenarios, and for different Byzantine attacks.", "questions": "1. Is there any reason why the probabilistic framework is necessary for the resilience results ?\n2. It is not clear to me what the $g_i$s represent. The expectation on $v_{i,t}$ is taken with respect to what ?\n3. In 170, the authors claim that the method conceptually favors clients whose gradients align with the descent direction of $f_i(\\theta_k - \\alpha  G_k w)$. I believe this intuition needs to be explained further, as it is not clear why this should be the case ? Why does the descent direction of one single client matter ?\n4. In the experiments, why is the performance in the case of no defense almost the same as the other robust aggregation rules for many attacks and heterogeneity levels (and sometimes it is even better than some defenses)?\n5. As multiple local steps are shown to improve the performance in FL (including Byzantine robustness), can the method be extended to support multiple local steps ?\n\n**Minor questions**\n- Isn’t it possible to link $L_w$, the smoothness coefficient of $\\Phi_k$ to $L_{max}$ ?\n- What is the point of Theorem 7 ?\n- 270 $G_k^i$ is not defined. $v_{k,i}$ is defined in 253 as the full batch gradient", "limitations": "", "rating": 2, "confidence": 3, "soundness": 2, "presentation": 2, "contribution": 3, "strengths": "- The method seems novel and provides a new avenue for research on Byzantine robustness. \n- The algorithm intuition is clearly described, and many details are given on how to implement the algorithm in practice. \n- The added computation and communication complexities are discussed in details, which is appreciated. \n- The theoretical analysis is provided for the both the cases when only the sent gradients are corrupted and when also the sent loss evaluations are corrupted (even though only the latter truly matters).", "weaknesses": "1. It seems to me there is something conceptually wrong with the proof, precisely when decomposing the error in part E3. The bound between $F$ and $\\tilde{F}$ assumes that the same byzantine clients will be selected by the aggregation for either the mini-batch or full gradients. This is wrong.\n2. It also seems that the proof uses the exact minimum of equation (6), whereas the algorithm provides an approximation through the first order decomposition. \n3. The theoretical results are not compared with baseline methods. Previous works such as [1] show robust methods that achieve the lower bounds, it is not clear how the presented method improves on those.\n4. I do not agree with Remark 1 of the authors. Comparing the performance based on the total number of communication rounds is not fair.\n5. Assumption (C) on Stochastic Gradient Model is not standard. Why isn’t the standard upper bound on the variance of the SGD noise (which seems to be used as inter-client variance in D1) enough for the guarantees ?\n6. The Byzantine resilience guarantees are given probabilistically, which is highly non-standard in the literature. Compared to state-of-the-art Byzantine robust methods, no fundamental randomization is added by the FedLAW algorithm that would justify probabilistic bounds.\n7. 321  “in practice $\\epsilon_k$ is typically very small even under a high heterogeneity” the authors do not provide any justification for this statement.\n8. 320 “Similarly, assuming bounded heterogeneity is a standard prerequisite for any non-IID analysis.” Can the authors please provide references for this ? The Magnitude Heterogeneity part does not look standard.\n9. In Table 7, the accuracy scores on CIFAR-10 seem abnormally high (reaching even 100% with backdoor attacks). \n\n**Minor issues**\n\n- Theorem 2 does not specify the choice of s and t (which are specified only in the proof in the appendix)\n- Shouldn’t the sparse unit capped operator be noted $\\Delta_{t,s}$ instead ?", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "uuGcx2zLxi", "reviewer": "Reviewer_YUPN", "summary": "This paper uses an alternating minimization algorithm with strong convergence guarantees to address Byzantine attacks in FL. This method treats aggregate weights as learnable parameters and optimizes them jointly with global model parameters. Furthermore, the paper conducts experiments on various datasets and attack scenarios, and provides theoretical and convergence analysis of the method.", "questions": "1. I'd like to know the specific experimental results of the algorithm on more complex datasets, such as CIFAR100 and TinyImageNet, which contain more classes.\n2. Would learnable aggregation weights exacerbate attacks by byzantine clients tricking the server into learning higher weights? I recommend that the paper provide theoretical analysis of this scenario.", "limitations": "", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. The paper is highly clear. The methods section provides sufficient proof and comprehensive theoretical analysis.\n2. The appendix provides detailed information and experimental results supplementing the main text. The paper is highly comprehensive and logically organized. The experimental setting includes five different attack methods and various heterogeneous conditions.\n3. The paper proposes learnable aggregation weights, providing a new approach to addressing the convergence problem of equal-weighted average damage.", "weaknesses": "1. Whether learnable aggregation weights increase the weight of byzantine clients and thus increase attack risk is lacking theoretical analysis and experimental proof.\n2. The experimental datasets used are MNIST and CIFAR10. Both datasets contain only 10 classes, which cannot demonstrate the effectiveness of the method on more complex dataset.\n3. In the main text, the method and theoretical analysis section of the paper lacks a figure explaining the pipeline, which increases the reading difficulty.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)