Robust Federated Inference
Authors: Akash Dhasade
Sadegh Farhadkhani
Rachid Guerraoui
Nirupam Gupta
Maxime Jacovella
Anne-Marie Kermarrec
Rafael Pinot
Venue: ICLR 2026 Poster (2026)
Keywords: Collaborative Inference
Robust Ensembles
Federated Ensembles
Primary area: other topics in machine learning (i.e., none of the above)

Abstract: Federated inference, in the form of one-shot federated learning, edge ensembles, or federated ensembles, has emerged as an attractive solution to combine predictions from multiple models. This paradigm enables each model to remain local and proprietary while a central server queries them and aggregates predictions. Yet, the robustness of federated inference has been largely neglected, leaving them vulnerable to even simple attacks. To address this critical gap, we formalize the problem of robust federated inference and provide the first robustness analysis of this class of methods. Our analysis of averaging-based aggregators shows that the error of the aggregator is small either when the dissimilarity between honest responses is small or the margin between the two most probable classes is large. Moving beyond linear averaging, we show that the problem of robust federated inference with non-linear aggregators can be cast as an adversarial machine learning problem. We then introduce an advanced technique using the DeepSet aggregation model, proposing a novel composition of adversarial training and test-time robust aggregation to robustify non-linear aggregators. Our composition yields significant improvements, surpassing existing robust aggregation methods by 4.7 - 22.2% in accuracy points across diverse benchmarks.

Published as a conference paper at ICLR 2026
ROBUST FEDERATED INFERENCE
Akash Dhasade', Sadegh Farhadkhani', Rachid Guerraoui' Nirupam Gupta', Maxime Jacovella', Anne-Marie Kermarrec' Rafael Pinot EPPF. Switzerland ?University of Copenhagen, Denmark 3 SSrrbonne Université and Université Paris Cité, CNRS, LPSM, France akash. dhasade@epfl. niguêdi ku. dk pinotélpsm.paril
ABSTRACT
Federated inference, in the form of one-shot federated learning, edge ensembles, or federated ensembles, has emerged from multiple models. This paradigm enables each model to remain local and proprietary while central server queries them and aggregates predictions. Yet, the robustness of federated inference has been largely neglected, leaving them vulnerable to even simple attacks. To address this critical gap. we formalize the problem of robust federated inference and provide the first robustness analysis of this class of methods. Our analysis of averaging- based aggregators shows that the error of the aggregator is small either when the dissimilarity between honest responses is small or the margin between the two most probable classes is large. Moving beyond linear averaging, we show that the problem of robust federated inference with non-linear aggregators can be cast as an adversarial machine learning problem. We then introduce an advanced technique using the DeepSet aggregation model, proposing a novel composition adversarial training and test-time robust aggregation to robustify non-linear aggregators. Our composition yields significant improvements, surpassing existing robust aggregation methods by 4.7 22.2% accuracy points across diverse benchmarks.
attractive solution to combine predictions
INTRODUCTION
Over the past several years, concepts such as one-shot federated learning (OFL) DDi et al. 2024 Diao
2023 Zhang et al., 2022, Guha et al.) 2019), edge ensembles (Malka al. 2025 Shlezinger et al. 1021). and federated ensembles (Allouah et al. 2024a Hamer et al. 2020) have gained traction collaboratively performing inference from several client-local models. More recently, the availability of diverse open-source large language models (LLMs) has spurred interest in aggregating outputs from multiple models to answer a given query, giving rise to sophisticated LLM ensembles
al.
that leverage complementary strengths of individual models (Tekin et al.) 22244 Wang al. 2024
Jiang et al. 2023). Despite being introduced under different names, these techniques share a common principle: combining predictions from multiple client-held models to produce single output. In this paper, we collectively refer to these approaches under the terminology of federated inference. In this setting, clients retain proprietary (locally trained) models, while central server queries them for inference as illustrated in Figure [ The individual predictions are then aggregated into a final prediction, either using averaging-baan based aggregations (Dai et al. 2024 Zhang al.] 2022 Gong et al. 2022 or server-side aggregator neural networks (Allouah et al. 2024a Wang et al.) (2024).
While federated inference is gaining traction, its robustness model failures and poisoned outputs remains largely overlooked in the literature, despite some initial preliminary study (Liu et al., (022).
This gap critical for two reasons: (i) failures and errors are practically unavoidable, and (i) existing work in robust statistics and Byzantine-robust machine learning (ML) demonstrates that undefended models are inherently vulnerable, even to relatively simple attacks (Guerraoui et al., 2024 Diakonikolas & Kane, 2023). It is therefore of paramount importance to clearly define the potential threats that may arise in federated inference, so as to prevent a technological advantage from becoming significant vulnerability. In this paper, take step toward closing this gap by defining potential failure modes of federated inference and presenting the first robustness analysis of this class of schemes.

---

Published as a conference paper at ICLR 2026
m
BR
DeepSet
CWTM Adv. Tr.
CIFAR-10
CIFAR 100
AG News
46.0 + 3.9
47.4
76.4 1.9
x
17.0 = 3.8
67.0
76.7 2.2 76.7
65.1
User
Glent Models
51.4 1 2.2
68.0 1 0.8
77.5 1 1.2
Server angrenpsttss
respprtesss
ROD
Table 1: Evaluation of robust elements in setup with n = 1 = 4. We report the worst-case accuracy across 5 different attacks (see Appendix G.4 details).
Figure 1: Federated Inference
1.1 MAIN CONTRIBUTIONS
Problem formulation and analysis of the averaging aggregator. We formalize the problem of robust federated inference for the first time. We consider system of clients, each with local data distribution and probit-valued classifier, where the outputs of up to f < 2 clients may be arbitrarily corrupted at inference time. Our goal is to design aggregation schemes that remain accurate with respect to the global data distribution despite the corruptions. When the server uses an averaging- based aggregation (Dai et al., 2024] Zhang al., 2022] Gong al. 2022), natural way to robustify is to substitute it with robust averaging scheme (Allouah et al. (2023) which ensures that the output of the aggregator is an estimate of the average of the honest probits. Prominent examples include coordinate-wist trimmed mean (CWTM), coordinate-wis wise median (CWMMdd). etc. (Guerraoui et al., 2024). However, we show that robust averaging may prove insufficient since the aggregator's output can be sufficiently close to the honest average, yet produce a misclassification. Nevertheless, in the cases where averaging suffices, we derive formal robustness certificates for federated inference. Our analysis shows that the error of the aggregator depends upon the fraction of corruptions f/n, the margin between the top two classes, and the dissimilarity between the outputs of different clients.
vdvessarial ML problem. Beyond averaging, recent work has shown that non-linear trained aggregators (e.g., neural networks) often outperform averaging-basee aggregators in the uncorrupted setting (Allouah et al. 2024a; Wang et al. 2024). When using such aggregators, we show that the problem of robust inference can be cast as an adversarial learning problem over the probit- vectors. Encouragingly, contrary the difficulty of standard adversarial ML problems in the image space (Goodfellow et al. 2014). we show that the adversarial problem on probit-vecton can be more reliably addressed, thanks to the structure of the input space where each corrupted vector is confined to probability simplex over the number of classes. Yet, naively leveraging ad adversarial training (Madry al. 2018) to solve the problem remains computationally intractable due to the high cardinality of permuting through different choices of adversarial clients at training time, since any (unknown) clients out of n can be malicious.
Robust Inference
Robust DeepSet Aggregator. To alleviate this issue, we propose to use neural network aggregator based on the DeepSet model (Zaheer et al., 2017), an architecture which invariant to the order of inputs. Specifically, since the aggregator's output can be independent to the order of clients, leveraging DeepSets enables us to reduce the search of choosing f adversaries to (?) instead of
requiring to permute through them i.e., (7) fl. In practice, we show that adversarial training by sampling any N choices of adversaries where N << (") suffices to achieve good performance with DeepSet. To further reduce the sensitivity of DeepSet to corrupted probits, we propose composition of robust averaging with DeepSet at inference-time which significantly boosts empirical performance. In particular, we show that this composition may only be applied at inference-time, preventing any escalation of training costs during adversarial training. By combining robust elements from both the adversarial ML and robust ML literature in novel composition. we achieve the state-of-ther -ftth-ar- (SOTA) performance for federated inference as illustrated in Table [
Empirical validation. To rigorously evaluate defenses, we design a new attack called the Strongest Inverted Attack (SIA) that challenges existing defenses. We conduct extensive experiments on three datasets (CIFAR-10 10, CIFAR-100, and AG-News) covering both vision and language modalities as well as diverse model families (ResNet-8, ViT-B/32, DistilBERT), Our approach yields a 4.7222.2% points improvement over existing methods across suite of 6 different attacks, including SIA.
2

---

Published as a conference paper at ICLR 2026
1.2 RELATED WORK
Federated Inference. Collaborative inference through client ensembles has been explored in one-shot
Federated Learning (FL) (Guha et al. 2019 Gong et al. 2022 Dai et al. 2024) and decentralized
edge networks (Shlezinger et al. 202 Malka et al. 2025 motivated by communication efficiency, reduced training cost, or proprictary nature of client models accessible only via black-box inference. Another common scenario is when clients already possess trained models which are offered in model market scenarios (Li et al., 202T). Yet, the robustness of federated inference has received limited attention. An initial preliminary work was conducted by [Lu et al. (2022) in the vertical federated learning setting, where they try to reconstruct the underlying uncorrupted responses using an autoencoder and a block-sparse optimization process. Their method, COPUR, purifies responses before aggregation on the server. However, purification alone is vulnerable to stronger attacks and highly sensitive to input magnitudes, since it operates in the logit space rather than probits.
Byzantine Distributed Learning. Byzantine robustness has become a central topic in distributed ML (Alistarh et al.) 2018: Chen et al., 2017] Farhadkhani et al.,, 2022 Guerraoui et al. 2024), , where malicious clients may send arbitrary updates during training. Our setting differs in focusing on inference rather than training, and in not assuming fixed Byzantine identities (cf., (Dorfman et al., 2024)). While the objectives thus diverge, a key idea in Byzantine distributed learning, namely robust averaging, remains relevant our analysis. Indeed, robust averaging techniques can be adapted to improve the resilience of federated inference in the presence of corrupted client outputs, at the cost of some technicalities, as demonstrated in Section
Federated Distillation and Robust Voting, In FL, many works propose to share logits on a public dataset instead of gradients to improve communication efficiency and privacy (Fan et al. 2023 Gong et al., 2022, Sattler et al.] (022)) Recent work addresses adversarial logits by proposing robust aggregation methods (Roux et al. 2025 Li et al. 2024 Mi et al. 202I). but these approaches rely on assumptions inapplicable to our setting. For example, EXPGUARD (Roux et al., 2025) tracks client behavior across rounds, whereas in our case clients may act arbitrarily at each inference. Similarly. FEDMDR (Mi et al. (02I) requires clients report accuracy contributions, information unavailable in our setup. A parallel line of work studies robust voting, where voters/clients cast scores that are aggregated to resist malicious participants, either in general settings (Allouah et al., (024b) or in federated learning specifically (Chu & Laoutaris] (2024) Cao al. 2022). These approaches, however, typically assume fixed client identities or some control over the training process, assumptions which do not hold in our setting.
public dataset to weigh
2 PROBLEM OF ROBUST FEDERATED INFERENCE
We consider a classification task, mapping an input space X' to an output space y = [K] {1...., K}. and a system comprising n clients, each with local data generating distribution D; over X' x V. For each client E [n], we are given a probit-valued regressor h; mapping X to the simplex A : (= E [0, 1K ΣkETK] 2 = 1}. which plays the role of local classifier. In this
context, the goal of federated inference scheme is to design mapping v : (A + [K] that aggregates clients' local probits in order to minimize the expected prediction error on the mixture of distributions D 1 Σ' 'D.- Specifically, denoting h(xx) == (h₃
we seek an aggregator vo. from a set of candidate aggregators V, that minimizes the federated inference risk
R(V)= = E [e v)], where f v) = 1 Esb (b(z)) + v).
(I)
A typical example of aggregation is v (h(x)) = arg ma 1 Σm hxx where [- denotes the k-thh coordinate of the vector and where the arg max breaks ties arbitrarily. More generally, however, V may involve non-linear aggregation schemes. In fact, prior work (Allouah et al.) 2024a Wang et al. 2024) has shown that such aggregation strategies yield higher accuracy expectation, compared to any individual classifier hi...., hnn
k..
Robust federated inference. We are interested in solving the problem of robust federated inference, wherein fraction of the clients" is subject to comrpttion prior to aggregation. Specifically, consider a scenario wherein for each query x E X. up to f < n/2 of the n clients (of hidden identity) can return arbitrarily corrupted vectors in the probit space A K Our goal is to design an aggregation
3

---

Published as a conference paper at ICLR 2026
scheme that yields high accuracy, despite such corruptions. In what follows, for any input X, denote by (2) the set of all possible probits after up to f corruptions, i.c,
(2(x) = {z = (........ 2n) (A K 3 S [m], H 2n n H. 2-; (2)
Formally, we seek an aggregator Wio E minimizing the robust federated inference risk, given by
Raav (bb) = B(x,))> [ea (xr v), where gady cal (x.1)
max =ET)(²)
11 (1)(()) + 4
(3)
In the following, we show that robust federated inference risk can be upper bounded by federated inference risk and an overhead resulting from probit corruptions. Thereby we show that if an optimal aggregator (with respect the original federated inference risk (T] apriori known, then robust ensembling can be achieved by designing aggregator that aims minimize disagreement with the optimal aggregator, the presence of corruptions. In doing so, consider an aggregation scheme vo minimizing ( i..., the expected learning error without corruption. This aggregator 4. represents an oracular aggregator, i.c., optimal in the hypothetical scenario when we have access to the uncorrupted can bound robust federated inference risk for an
probits. Using 1o. reference for robustness, aggregator rhbb as per the following lemma (which we prove Appendix A
Lemma 1. For any X, let Uo = (h (x)). Then,
Rudi (vmob) & ((v)) + E(..))) Lewte (x, [o)]
The overhead (a.y)) pady (z,, Bu)] named the robustness gap, represents the excess enror due to adversarial probit corruptions. This gap is the worst-case probability that thrbb disagrees with the oracular aggregator under up to probits being corrupted. In the following, analyze the robustness gap in the case when the oracular aggregator given by the averaging operation and the robust aggregator satisfies the property of (f. ro)-bbustt averaging (Allouah et al. 2023
AVERAGING AS ORACULAR AGGREGATOR
We first consider the case where the oracular aggregator vo is based on computing the average of the uncorrupted probits, i.e.,
1 hz(2).
do (h(z)) = argmaa [h(z)]++ where R(x)=
kE(K]
In this particular case, we robustify the aggregation against probit corruptions by substituting the averaging by robust averaging ROBAVG (A IR taking inspiration from the literature of rozast machine learning (Guerraoui et al. 2024) and robust mean estimation (Diakonikolas
Kane 2023). Specifically, we set
(lrch(2) (z) argmax [ROBAva (z))a- kE[K]
Where RoBAVG is a robust averaging aggregation rule. The concept of robust averaging, initially introduced by Allouah et al. (2023) can be defined follows.
Definition 1 (Robust averaging). Let k 2 O. An aggregation rule ROBAVG is (f, robust if. for any set of vectors ",, Un Rdd and any set C [n] size n - f, the following holds true:
[RoRAvG(E),.... -.. vn) Fsl
S
where Ug := n Eies Vi and parameter k is called the robustness coefficient.
Essentially, robust averaging ensures that despite up to f inputs being arbitrarily corrupted the output of the aggregator is an estimate of the uncorrupted vectors' average. The estimation error is bounded by the "empirical variance" of the uncorrupted input vectors, times constant value
'hhe analysis he easily extended to weighted averaging by simply re-scaling the inputs the aggregator.
4

---

Published as a conference paper at ICLR 2026
Examples of robust averaging include CWTM, CWMed and geometric median (GM) (Guerraoui et al. 2024, Chapter 4), Specifically, CWTM is (f, k--bbustt with A.
n-2f 1 n-2f While
6f
robust averaging ensures proximity to the average of uncorrupted input vectors fz-norm, even a small estimation error can result in large prediction enror due to the non-continuity of the argmax; operator. We illustrate this insufficiency of robust averaging through the following counter example.
Counter example. Let E 1/6). Consider point & E X and three possible probit vectors for h (x),,, h2 (x), ha(x)) E A defined as follows:
h1 (1) (1, h2(x) (0, 1,0), and h₂(x) -1/2:1122333,, - 33)
Note that F((x) = (1/2, - s) Now, consider i (1/2 e, s)2, We have [T<(2)) 611l2 (20²)1/2 21/2g. Here, by taking small enough s, we have that 0 can be arbitrarily close to T((x)). However we still have [e(] [h(x)] à A argmax4<[K]] [6]. Hence, demonstrating proximity under the euclidean norm does not guarantee preservation of the decision made by the argmax.
From the above, we observe that in addition to proximity to the average, the robustness gap induced under robust averaging also depends point-wise model dissimilarity x E X, i.e.,
(Ihr(t))a [T(x)]
max RE [ P
We are now ready to present the robustness gap for the case when ROBAVG CWTM. Description of CWTM is deferred to Appendix B.2 The reason for using CWTM is its simplicity and its proven
optimality in the formal sense of robust averaging (Allouah et al.) 2023 To present the result,
introduce some additional notation. For vector E A let ( and z ( denote the largest and the
2nd 2nd-largest values in the set [[])]]< Then, we define MARGIN(+) = 21)) (2)) If [2] = [a]a< for all k, k' E [K] (i.e., all the coordinates of the vector are equal) then MARGIN(>) = 00.
Theorem 1. Consider bo defined in ( with ROBAVG CWTM. If the regressors h1...., hn
are such that T(()) has a unique maximum coordinate almost everywhere, then the following holds:
(xx,)) [ (z., [o)] < ((..))D
MARGIN (f(z)) <2
kn
n2
12
where do = (.,(t))))......(11.)) and k=
hn,())
68 n-2f
(1
The proof for this theorem is deferred to Appendix B This shows that the robustness gap for CWTM, when the oracular aggregator is given by the averaging operation, reduces with the fraction of corruptions f/n. the model dissimilarity and the inverse of the average probit's 's margin. We validate this theoretical finding through an empirical study summarized in Figure (Appendix G.I).
DEEPSET AS ORACULAR AGGREGATOR
In this section, consider the case of more general non-linear trainable (i.e., data dependent) oracular aggregators, inspired by recent work demonstrating the efficacy of such aggregation in context of ensembling (Allouah et al. 2024a Wang et al. 2024)).
Robust empirical federated inference risk minimization (RERM). In this case, since the oracular aggregator vo need not be a pre-determined linear combination of input probits (like averaging), we propose to design robust aggregator thob by directly aiming to minimize the robust federated inference risk Radv (1b). In practice, we seek to minimize the following robust fiprrical.eddratte inference risk:
Rudi (16)
pady (x, v), where pady (z. y) = max 1 (v(Z)) $y}. (6)
[Driin
zET
EDiis
where D Dimin comprises of a finite number of i...d. data points (z.y) from the global distribution D. In short, refer to the optimization problem (6) RERM.
5

---

Published as a conference paper at ICLR 2026
Connection to robustness to adversarial examples. The problem of RERM reduces to the problem of robustness against adversarial examples (Madry et al.) 2018 Goodfellow et al. 2014). with the input space for the classifier (i.e., aggregator ()) being K x real-valued matrix with each column in A K and the input perturbation being restricted to corruption of up to f columns of the input matrix. Let (AKy yrs denote the space of such matrices, and for a matrix M E (A K let 8(M) denote the set of matrices from IR x such that M + V E (A*)" for all V E 6(M). For any matrix V E R x**,, we denote by [| the number of non-zero columns (i.e., columns with least one non-zero entry). We can now formally express the RERM problem in 6 as robustness to adversarial examples as follows:
do E argmin NEW
Σ
max 1 1 (H())++VV +V) t),
(7)
[Duiin]
(e)( IIVISS
(2.n)
Nn (x)) E (A*)". By solving the above adversarial learning problem, we obtain an aggregator with minimum sensitivity against arbitrary perturbation to at most f input probits while ensuring high learning accuracy the same time. We propose to solve the RERM problem (6) and the equivalent adversarial robustness problem 7 for the space of aggregators V defined by parameterized deep neural network. However, the adversarial training still remains intractable due to high permutational cardinality of the input space (x)), totaling to the factor a! E "Pm since up to any / columns can be perturbed (Liu et al. 2022) where "P... [n-m]! To alleviate this issue, we leverage the property that the output of the aggregator must be invariant to the order of columns in (x). We thus exploit a specific neural network architecture which is permutation invariant to its inputs, as described below.
where ((x) -
Robust DeepSet aggregator. Consider 01 E Rdd and 02 E RR,, and two mappings parameterized by these vectors: Pe, : A RP and (tez TRP A Then, define v by set of parameterized mappings de (A (A*)n A composed with the argmax operation, where 0 = (01, 02) and
Φ0(2) M0z
Σ Pa, (2i) i=1
(8)
This particular type of neural network commonly known as DeepSet (Zaheer et al. 2017). in the case when there are no corruptions i.e., z; = h4 (z), Vi E [n.. Consequently, in this case, the RERM problem reduces to the following optimization problem:
0r E argmin PEO
Σ
max (x)
1
{
argiaxx (she (Z1,..., 2n)1 $ y RE[K]
|Pirain
(D.
Solving ( still complex in practice due to the non-continuity of the indicator function. We address this by changing the point-wise loss function from the indicator function to the cross-entropy loss function, denoted as (Øo (z), y). Finally, we still need to compute the maximum value the point- wise loss at (z, 3) over all E I' (z). We address this challenge by approximating the maximum value of E(db (z) y) by searching over only a subset of z E (z). Thanks to the permutation invariance property of DeepSet, the permutational cardinality of searching ff adversaries now reduces Eí (?) where (*)) (n-m)lm! Specifically. in each training iteration, we randomly select m S clients from the set [n] to perturb their probits, repeated N times. We then obtain the perturbed probits and approximate maximum loss by using multi-step variant of the fast gradient sign method (FGSM) for adversarial training (Madry et al. 2018). The network parameters are then updated to correctly classify despite the perturbations. In practice, we show that N << (?) suffices to obtain good approximation. Our resulting algorithm summarized in Algorithm
Finally, we incorporate robust averaging to further reduce the overall sensitivity of da- to probit corruptions. Specifically, with =0; 03), the robust DeepSet aggregator defined as follows:
Drob (z) = argmax [Mog (RoBAvG(pe) (z1), (z1)...., Po- (o.((n))) (zn))))
(10)
kE(K]
Note that we only incorporate robust averaging at the inference time since incorporating at training time renders adversarial training more expensive due the additional cost of ROBAVG.

---

Published as a conference paper at ICLR 2026
Algorithm 1: Training of DeepSet Aggregator dog
Input:
Training Steps E, sampling count N, learning rates 7 and r), adversarial sample
generation steps S, dataset Dirinn number of adversaries f and training loss function l
begin
for 1 to E' do
Sample y, Duain'
for 1 to do
Choose m E [1, with probability proportional (m)
Randomly initialize = (UI...., Um) ) (R*)
Sample random permutation x of {1.....m} for to S do
For selecting adversaries
softmax Vi [m]]
Enforce each vi be in A K & Last m are adversarial v Perturb probits using FGSM Final projection of us to A
x (~+(1)22),... (x(nnm) (z), ....... fm)
v + v 7/gu vv (0o (z) ,))
13
+ voftmax((:)... Vi [m]]
(1) ,.... (m) (I), ......: 0m)
0 0 7 (0o
Approximated maximum loss
return Trained aggregator da
In practice we sample mini-batches.
Robustness gap of robust DeepSet aggregator. In the theorem below, we present an upper bound on the robustness gap of the robust DeepSet aggregator (10), extending Theorem Ito non-linear oracular aggregation. In what follows, make some Lipschitz continuity assumptions. Specifically, there exists real values Lp, Ly such that, for all 2,
2' E A v' E I2 and & E [K],
|l (z)]{- (2')l S Lp 1|= 2112 and [Mog (u)] (uoz (v')lx I 4μ 1/ v'l12.
Let h(x))()))))))))))) ...)...... hn (x)). Recall that o² max 1 Eizz (Ih,()))
[T(x)]
n Theorem Consider nob as defined in (TO) with ROBAVG = CWTM. the regressors h1...., hn are such that (g- (h(z)) has a unique maximum coordinate almost everywhere, then the following holds:
((,,)) [eady (x. Ho9]
<
P F(ag)/DD
MARGIN (cx- (h(x))) < 2222L
+ ( n
An
f
min {I, VKo.}
n1 n-
where Jo argmax (00- (h(x:)) and
68 (1 n223)) 2-
The proof for this theorem is deferred to Appendix C adapting Theorem to the case of a non-linear aggregation. The theorem shows that the robustness gap of the robust DeepSet aggregator is controlled by the same three quantities as the linear (averaging) case: the corruption fraction f /nn, the model dissimilarity σg, and the inverse margin of the aggregated probit de- (h(x)). The only difference is multiplicative sensitivity term LnL,, which quantifies how much the non-linear aggregator amplifies perturbations the inputs. Appendix additionally includes formal reasoning on the benefits of using ROBAVG within DeepSet, proving that it removes the dependence on the degree of probits' corruption compared to using the original DeepSet (with simple averaging).
5
EXPERIMENTS
This section summarizes the key results of our experiments. In all that follows, we consider the ROBAvG in the robust DeepSet aggregator (10) be CWTM, and refer the corresponding
7

---

Published as a conference paper at ICLR 2026
model as DeepSet-TM. TM. We evaluate DeepSet-TM against robust aggregators like CWMed, against SOTA baselines, and perform a scalability study in Section [.2 We conduct an ablation study in Appendix G.4. and comparison with more adversarial defenses in Appendix G.3
5.1 EXPERIMENTAL SETUP
Datasets. We evaluate on CIFAR-10, 10, CIFAR-100 (Krizhevsky 2012). and AG-News (Zhang et al. 2015). covering vision and language tasks. We reserve 10% of training data as server-side validation data for aggregator training, and partition the rest across clients using the Dirichlet distribution Di (ir line with previous works (Roux et al. 2025 Dai et al. 2024p. Lower a indicates higher heterogeneity. We experiment with
10.3. 0.5, 0.83. In most of our evaluations, we consider n = 17 following prior work (Allouah et al. 2023). except for our scalability study where we vary (10, 17, 25). Our choice of number of chents is in line with typical cross-silo federated setting in real-world (Ogier du Terrail et al. 2022).
Models. For CIFAR-10, clients train R from scratch (He et al. 2016). while for CIFAR- 100 and AG-News they fine-tune a ViT-B/32 (Dosovitskiy et al., 2021; Radford et al.] 202I) and a DistilBERT (Sanh et al., 2019), respectively. The DeepSet functions 1s and p are each two-layer MLPs with a ReL.U nin-riie.rity. The AutoEncoder in COPUR consists of two-layer MIP encoders and decoders with leaky ReLU, while the server model is a three-layer MLP (Liu et al.) 2022).
Attacks. We evaluate on total of 6 attacks with varying difficulties depending upon the power of adversary. We consider white-box and 2 black-box attacks where the former assumes access to the server's aggregation model. We propose a new attack called SIA, in the white-box as well as the black-box setting which tries to flip the aggregation decision by exploiting the second most probable class. The remaining attacks constitute the Logit Flipping Attack, Loss Maximization Attack (LMA),, Class Prior Attack (CPA) and the Projected Gradient Descent (PGD) attack presented in prior work (Roux et al. [025 Liu et al. 2022). All attacks and their characteristics are detailed in Appendix F.2 and summarized in Table within. We vary f E {3, 4, 5} across different setups.
Baselines. We compare the performance of DeepSet against several robust aggregators including CWTM (Yin et al., 2018). GM (Pillutla et al., 2022; [mmll] 1990) and CWMed (Yin et al. 2018) alongside simple averaging. As the data-dependent baselines,
consider COPUR and manifold projection from Liu et al. (2022) where the latter simply projects the input probits onto a learned manifold using AutoEncoder. Additionally, we also report the performance of the non-adversyrially trained DeepSet model in our study of robust elements (Appendix G.4). We include considerations on adversarial training cost and inference latency for the static aggregations and the two DeepSet variants in Appendix G.8
Reproducibility and reusability. We conduct each experiment with five random seeds, and report the mean and the standard deviation. Our code is also available for reproducibility and reusability? 2 We include additional details on the experimental setup and hyperparameters in Appendix All
clean accuracy values (i.e., for f 0) are included in Tables 12 and 13 (Appendix G.7
5.2 RESULTS
Performance comparison to Robust Aggregators. Across all datasets in Table 2 DeepSet-TMM TM achieves substantially higher worst-case accuracy (minimum accuracy across attacks) than the robust aggregation baselines. Specifically, it improves over the strongest baseline by +4.7 to +22.2 percentage points depending the dataset, demonstrating robustness even under the most challenging adversarial conditions. Beyond worst-case performance, DeepSet-TIV also shows consistent gains across attacks: in 14 out of 18 dataset-attack combinations, achieves the highest accuracy, with only small drops (S 2.3% points) in the remaining four cases. The advantage of DeepSet-TMe particularly pronounced against stronger attacks (specifically SIA whitebox and PGD-cw) On CIFAR- 10 and CIFAR- 100. baseline accuracy drops by 35-40 points, while our approach limits the drop to 20-30. On AG-News, DeepSet-TM retains 83.2% accuracy under PGD--w compared to 53-55% for the baselines. Notably, as we are working in probit space, giving more power to the adversary (i.e., conducting more PGD iterations during testing than for training) does not lead to performance degradation (see Table II in appendix).
8

---

Published as a conference paper at ICLR 2026
Aggregation
Logit lipping
SIA-bb
LMA
Msan
2.1
59.8
1.1
58.7
55.6
12.7 3.9
24.6
4.9
24.6 4.9
CWMed
36.7 4
53.3
= 2.0
53.8
2.9
49.3
3.2
27.8
4.7
27.8 1
CF-10
GM
63.9 1..9.:2.33 2.3
59.1
1.4
63.3 1: 2.3
59.7
1 3.2
45.3
3.1
25.4
4.8
25.4
4.8
CWTM
63.3
59.4
1.3
2.7
59.7
44.8
27.2
27.2
PoopSet-TM
67.6 0.8
62.6
1.6
61.044
59.1
51.+222
48.2
112422
4.2
18.2
Mean
78.8 1.7
72.8
1.0
0.3
6.34
56.0
1.00 1.0
39.2
1.2 1.2
39.3
1.3
65.8 1.3
62.3
1.2
CF-100
GM
0.9
715
1.5=1.5
7.8
75.3
0.8
59.6
39.0
1.3
39.0
CWTM
74.8
71.5 71.11.
1.
74.8
14.8100
0.9 60.8
44.9
1.3
44.9
DeepSet-TM
0.3
0.8
76.0 0.2
76.4
0.5
63.7
49.6
0.55
49.6 4
Msan
0.9
2.2
8
72.6 7.
54.9
54.9
CWMed
7.0
75.9 7.7
74. 4.5
74.4 4.4
53.2
1 7.0
53.2 7.0
AG-News
80.7
CWTM
84.3 1.0
81.4
80.2
76.4
72.6
4.6
55.3
7.5
55.3 + 7.5
DeepSet TM
85.7 0.4
81.8
1.6
79.2
1121111
77.5
1
1.2
80.1
1
1.6
83.2
1.4
77.5
Table 2: Accuracy (%) of DeepSet-TM against static aggregations on the CIFAR-IO, CIFAR-I00 and AG-News datasets, with heterogeneity 0.5, 17 clients and 4 adversaries. Logit flipping uses an amplification factor of Results with
{0.3, 0.8) are included Tables and 7
CoPur
Manifold Projection
DeepSet SIA Whitebox
Logit Flipping
Logit Flipping
SIA Blackbox
0.7
CIFAR-10
0.5
0.3
0.1
Test Accuracy
0.8
AG-News
0.6
0.4
0.2
0.8
CIFAR-100
0.6
0.4
0.2
0.0
12 4
16
0
1
3
1
2
4
0
2
3
Amplification Factor
Byzantine Clients (f)
# Byzantine Clients
Byzantine
Clients (f)
Figure 2: DeepSet-TM vs. baselines under = 0.5 and adversary; other columns use amplification factor 2. See Figure (App. G.6 for results with a 0.3.
17 clients. In column 1, we have f f=
Performance comparison with SOTA baselines. We compare DeepSet-TM with COPUR and manifold projection in Figure Since COPUR operates in logit rather than probit space, it is highly sensitive to input magnitudes, leading to sharp performance degradation under even mild attacks. For instance, in the logit-fipping attack, increasing amplification from 1 to 16 raising the number of adversarial clients from to reduces COPUR 's accuracy on CIFAR- -00 nearly to random chance, while DeepSet-TM remains stable due to its probit-space design and adversarial training. similar trend holds under the SIA attack, where COPUR suffers large drops on CIFAR- 10 and AG-News, though it shows relative robustness on CIFAR-I00. This likely because COPUR leverages block- sparse structure of input probits where higher number of classes induce more sparsity, increasing its effectiveness. Manifold projection performs even worse, as its autoencoder struggles with adversarial patterns spread across many classes. In contrast, Dee consistently achieves substantially higher accuracy across all attacks, with only minor accuracy loss the no-adversary case (f = 0), known trade-off from adversarial training (Madry al. 2018).

---

Published as a conference paper at ICLR 2026
Aggregation
Logit lipping
LMA
CPA
SLAwbb
Mean
75.1 + 1.3
63.2 - 2.5
12.5
= 2.9
12.2
+ 2.8
413
1.7
19.7
2.2
19.7
2.2
CWMed
45.6 2.7
44.5 4 2.2
52.4
16
50.9
1.8
50.5
2.0
16.5
16.5
2.3
GM
69.6 1: 1.3
61.3 1.8
62.6
2.3
62.2
1:
2.1
47.3
1.5
18.3
2.6
18.3
2.6
CWTM
69.5 1.3
62.4
46.2
2.9
44.9
2.8
46.4
24.0
2.0
24.0
2.0
DeepSet-TM
73.5 = 1.3
66.8
06.8200
50.3
60.0
1.0
56.5
1.8
33.
2
33.2
2.5
Mean
75.6 75.6 0.7
69.1 0.110..
57.0 2.4
56.8
2.4
44.5
1.4
25.8
2.8
25.8
2.8
55.1
50.7
1.8
24.5
GM
71.2 0.8
66.3 + 1.1
70
0.8
70.0
0.9
48.3
+
1.5
23.8
2.6
25.8
2.6
CWTM
69.1 69.1 1.1
65.8
1.2
69.1
12
69.1
1 1.2
49.6
1.1
32.5
2.4
32.5
2.4
De
75.77 0.8
71.9 - 1.1
72.2
72.5
56.7
1.0
38.6
1
2.5
38.6
2.5
Mcan
76.0 1.1
71.1 +
59.7
2.3
59.1 2.3
40.1
2.3
21.1
2.0
CWMed
51.7 2:77:229
49.2 + 2.0
52.1
2.3
52.0 + 2.3
44.9 + 1.8
20.6
2.9
20.6 2.9
70.8
70.7
CWTM
70.1 + 1.7
67.7 + 1.4
70.1
1.7
70.1
+
1.7
45.8
2.0
30.4
2.2
30.4
2.2
DeepSet TM
72.8
1.1
72.8
1.2
65.7
2.3
69.6
1
1.6
53.8
1.5
50.7
1.5
50.7
1.3
Table 3: Scalability study on the CIFAR-100 dataset under a 0.3.
Scalability study. To assess the generalizability of our approach, we conduct performance evaluations with varying the number of clients: (n, E {(10, 3), (17, 4). (25, 5)) on CIFAR-100 under high heterogeneity (a = 0.3). In Table 3 we observe that DeepSet-TM consistently provides the highest robustness as the system scales. improves worst-case accuracy over the best baseline by 9.2%, 6. % and 20.3% points respectively when increasing and f. Beyond worst-case performance, DeepSet- out of 18 datasct-attack combinations. While static aggregations occasionally remain competitive milder attacks (e.g., LMA), DeepSet-TMM is never substantially worse and typically remains close to the highest accuracy across most scenarios.
TM notably achieves the highest performance
CONCLUSION
We formalized the problem of robust federated inference and derived a certification for robust averaging under adversarial corruptions. For non-linear aggregation, proposed DeepSet-Te -M,, permutation-invaria neural network trained adversarially and combined at test-time with robust averaging. Our experiments demonstrate that DeepSet-TM consistently improves accuracy across datasets and attack types, substantially outperforming prior methods.
ACKNOWLEDGMENTS
Rafael is partially supported by the French National Research Agency and the French Ministry of Research and Higher Education. The joint work of Nirupam and Rafael is also supported in part by the CNRS through the International Emerging Action (IEA) program and the French National Research Agency through the ANR TuLIP. This work has also been partly supported by the Swiss National Science Foundation, under the project "FRIDAY: Frugal, Privacy-Aware and Practical Decentralized Learning", SNSF proposal No. 10.001.796.
REPRODUCIBILITY STATEMENT
We provide all the necessary details to reproduce our experiments in Section 5.1 and in Appendix F Furthermore, we release our complete codebase at httts:// com/ caom/sacs-een epcc----f
Sebusst-fedderatedd---ffee
REFERENCES
Dan Alistarh, Zeyuan Allen-Zhu, and Jerry Li. Byzantine stochastic gradient descent. In Proceedings of the 32nd International Conference on Neural Information Processing Systems, pp. 6618-4628, 2018.
Youssef Allouah, Sadegh Farhadkhani, Rachid Guerraoui, Nirupam Gupta, Rafael Pinot, and John Stephan. Fixing by mixing: A recipe for optimal byzantine ml under heterogeneity. Francisco Ruiz, Jennifer Dy, and Jan-Willem de Meent (eds.), Proceedings of The 26th International
10

---

Published as a conference paper at ICLR 2026
Conference Artificial Intelligence and Staristics, volume 206 of Proceedings of Machine Learning Research, pp. 1232-1300. PMLR, 04 2023. URL http::://proceeiinnnnte mlr
ptess/v200/allouahh22. html
Youssef Allouah, Akash Dhasade, Rachid Guerraoui, Nirupam Gupta, Anne-Marie Kermarrec, Rafael Pinot, Rafael Pires, and Rishi Sharma. Revisiting ensembling in one-shot federated learning. In The Thirty-eighth Ammual Conference on Neural Information Processing Systems, 2024a. URL net t
Youssef Allouah, Rachid Guerraoui, Lê-Nguyên Hoang, and Oscar Villemaud. Robust sparse voting. Sanjoy Dasgupta, Stephan Mandt, and Yingzhen (eds.), Proceedings The 27th International Conference on Artificial Intelligence and Statistics, volume 238 of Proceedings of Machine Learning Research, pp. 991-999, PMLR, 02-04 May 2024b. URL https://
proceedings.co ml prw.s. hatp///lloooaahaaa html
Xiaoyu Cao, Zaixi Zhang, Jinyuan Jia, and Neil Zhenqiang Gong. Flcert: Provably secure federated learning against poisoning attacks. Trans. Info. For Sec., 17:3691-3705, January 2022. ISSN 1556-6013. doi: 202.33211. URL https: /ww. http//oi.ooogg..// 1109//IFS 1002.321210
Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In 2017 IEEE Symposium on Security and Privacy (SP), pp. 39-57, 2017. doi: 10.1109/SP.2017.99.
Yudong Chen, Lili Su, and Jiaming Xu. Distributed statistical machine learning in adversarial settings: Byzantine gradient descent. Proceedings of the ACM on Measurement and Analysis of Computing Systems, 122):122,, 2017.
Tianyue Chu and Nikolaos Laoutaris. Fedqv: Leveraging quadratic voting in federated learning. SIGMETRICS Perform. Eval. Rev., 52(1):91-92, June 2024. ISSN 0163-5999, doi: 10.1 3673660.3655055.
3655055
Rong Dai, Yonggang Zhang, Ang Li, Tongliang Liu, Xun Yang, and Bo Han. Enhancing one- shot federated learning through data and ensemble co-boosting. In The Twelfth International Conference on Learning Representations, 2024. URL BtLhhttp::// /ttpass///peeevieeee net forum? idd=tm8339960m
Arnhav Datar, Arun Rajkumar, and John Augustine. Byzantine spectral ranking. In S. Koyejo, S. Mohamed, A. Agarwal, D. Belgrave, K. Cho, and A. Oh (eds.), Advances in Neu- ral Information Processing Systems, volume 35, pp. 27745 Curran Associates, Inc.. newr cc/ httpeerrfiileeeeae/////000 Sore pddf
2022. URL
Ilias Diakonikolas and Daniel M Kane. Algorithmic high-dimensionul robust statistics. Cambridge university press, 2023.
Yiqun Diao, Qinbin Li, and Bingsheng He. Towards addressing label skews in one-shot federated learning. In International Conference on Learning Representations, 2023. URL https:// openreview net. forum? wttprummmiddr22rhh845555
Ron Dorfman, Naseem Amin Yehya, and Kfir Yehuda Levy. Dynamic Byzantinc-robust learning: Adapting switching Byzantine workers. In Ruslan Salakhutdinov, Zico Kolter, Katherine Heller, Adrian Weller. Nuria Oliver, Jonathan Scarlett, and Felix Berkenkamp (eds.), Proceedings of the 4/st International Conference on Machine Learning, volume 235 of Proceedings of Machine Learning Research, pp. 11501-11543. PMLR, 21-27 Jul 2024. htt.tttps:::/prccddngg mlr. wwr.press//2..... wwt.pppsssv235ddo.rsse
.tmll
Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, Jakob Uszkoreit, and Neil Houlsby. An image is worth 16x16 words: Transformers for image recognition at scale. In International Conference on Learning Representations, 2021. URL https: /ttp:///oppeeeieeeeee
net.
11

---

Published as a conference paper at ICLR 2026
Dongyang Fan, Celestine Mendler-Düinne. and Martin Jaggi. Collaborative learning via prediction consensus, In sevenhh Conference on Neural Information Processing Systems, 2023. URL
net. 2twp:///wwweeeeeeouuueeeee.e.... Foormmidd-Sae forummii==SCKbiXoLLCC
Sadegh Farhadkhani, Rachid Guerraoui, Nirupam Gupta, Rafael Pinot, and John Stephan. Byzantine machine learning made easy by resilient averaging of momentums. In International Conference on Machine Learning, pp.
PMLR, 2022.
Xuan Gong, Abhishek Sharma, Srikrishna Karanam, Ziyan Wu, Terrence Chen, David Doermann, and Arun Innanje. Preserving privacy in federated learning with ensemble cross-domain knowledge distillation. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 36, pp.
11891-11899, 2022.
Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572 2014.
Rachid Guerraoui, Nirupam Gupta, and Rafael Pinot. Robust Machine Learning. Springer, 2024.
Neel Guha, Ameet Talwalkar, and Virginia Smith. One-shot federated learning, arXiv preprint arXivv1902.11175. 2019.
Jenny Hamer, Mehryar Mohri, and Ananda Theertha Suresh. Fedboost: A communication-effiiieenn algorithm for federated learning. In International Conference Machine Learning, pp. 3973-3983.
PMLR, 2020.
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pp. 770-778, 2016. doi: 10. 109/CVPR.2006..00
Dongfu Jiang, Xiang Ren, and Bill Yuchen Lin. LLM-blender: Ensembling large language mod- els with pairwise ranking and generative fusion. In Anna Rogers, Jordan Boyd-Graber, and Naoaki Okazaki (eds.), Proceedings of the 61st Annual Meeting of the Association for Com- putational Linguistics (Volume 1: Long Papers), pp. 14165-14178, Toronto, Canada, July 2023, Association for Computational Linguistics. doi: 10. 10.11853/v1/000 act-ooog... URL https: http::::/aallanhhloogg.. wwwphhhwwg..ogggo.eeoooooooooo.. 2023. aww.0..l.1.................e...e acl-nn.clllnnn.. 7927|
Alex Krizhevsky. Learning multiple layers of features from tiny images. University Toronto, 05
2012.
Alexander Levine and Soheil Feizi. Robustness certificates for sparse adversarial attacks by random- ized ablation. Proceedings the AAAI Conference Artificial Intelligence, 34(04))4585-455 4593, Apr. 2020. doi: 10.1609/aaai, http:////aaai.344.....3.33
v34i04.5888. URL
aaai www.aaaaa..r...aaaaaaaaaaaaaaaee wwr.oor//iin... wotg/index....oo php/
AAAT/article/vieer
Qinbin Li, Bingsheng He, and Dawn Song. Practical one-shot federated learning for cross-silo setting. In Zui-Hua Zhou (ed.), Proceedings of the Thirtieth International Joint Conference on Artificial Intelligence, IJCAI-21, pp. 1484-1490. International Joint Conferences on Artificial Intelligence Organization, 8 2021. doi: 10.249 /tto6///ccai.222222000 URL http::ttt///t/ http:////./ooo.o...2000022 wo..org//.....9.. ijcci.. 225
Main Track.
Wenrui Li. Hanlin Gu, Sheng Wan, Zhirong Luan, Wei Xi, Lixin Fan, Qiang Yang, and Badong Chen. Byzantine robust aggregation in federated distillation with adversaries. In 2024 IEEE 44th International Conference on Distributed Computing Systems (ICDCS), pp. 881-890, 2024. doi: 10.1 N0.11090CDDSS60100200000000
Jing Liu, Chulin Xie, Oluwasanmi O Koyejo, and Bo Li. Copur: Certifiably robust collaborative inference via feature purification. In Alice H. Oh, Alekh Agarwal, Danielle Belgrave, and Kyunghyun Cho (eds.), Advances Neural Information Processing Systems, 2022. URI. https //openreviens ew net. wttffoormmooooooo 2oroummdd==5r255555 G7X
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt. Dimitris Tsipras, and Adrian Vladu. To- wards deep learning models resistant to adversarial attacks. In International Conference on Learn- ing Representations, 2018.
12

---

Published as a conference paper at ICLR 2026
May Malka, Erez Farhan, Hai Morgenstem, and Nir Shlezinger. Decentralized low low-latency collabora- tive inference via ensembles on the edge. IEEE Transactions on Wireless Communications, 24(1): 598-614, 2025. doi: 10. 10.109/TWC.224:3499161)
Darya Melnyk, Yuyi Wang, and Roger Wattenhofer. Byzantine preferential voting. In George Christodoulou and Tobias Harks (eds.), Web and Internet Economics, pp. 327-340, Cham, 2018. Springer International Publishing. ISBN -78-3-030-0466125.
Yuxi Mi, Yutong Mu, Shuigeng Zhou, and Jihong Guan. Fedmdr: Federated model distillation with robust aggregation. Assia-Pacite Web (APWeb) and Web-Age Information Management (WAIM) Joint International Conference Web and Big Data, pp. 18-32. Springer, 2021.
Jean Ogier du Terrail, Samy-Safwan Ayed, Edwige Cyffers, Felix Grimberg, Chaoyang He, Regis Loeb, Paul Mangold, Tanguy Marchand, Othmane Marfoq, Erum Mushtaq, et Flamby: Datasets and benchmarks for cross-silo federated learning in realistic healthcare settings. Advances in Neural Information Processing Systems, 35:5315-5334, 2022.
Krishna Pillutla, Sham M Kakade, and Zaid Harchaoui. Robust aggregation for federated learning. IEEE Transactions on Signal Processing, 70: 10:1112-1154, 2022.
Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, Gretchen Krueger, and Ilya Sutskever. Learning transferable visual models from natural language supervision. In Marina Meila and Tong Zhang (eds.), Proceedings of the 38th International Conference on Machine Learning, volume 139 of Proceedings of Machine Learning Research, pp. 8748 8763. PMLR, 28-24 Jul 2021. URL httpps://prosti
ngs. m www..press/ee v 39/radford2la.ttt.
Christophe Roux, Max Zimmer, and Sebastian Pokutta. On the rexiittnneresillinnce of distillation- based federated learming. In The Thirteenth International Conference on Learning Representations, 2025.
net/ forum? fd 6EuT777666
Victor Sanh, Lysandre Debut, Julien Chaumond, and Thomas Wolf. Distilbert, a distilled version of bert: smaller, faster, cheaper and lighter. ArXiv preprint, abs/ 108, 2019.
Felix Sattler, Arturo Marban, Roman Rischke, and Wojeiech Samek. Cfd: Communication--fficieee federated distillation via soft-label quantization and delta coding. IEEE Transactions on Network Science and Engineering. 9(4):2025-2033 2021.
Nir Shlezinger, Erez Farhan, Hai Morgenstern, and Yonina C. Eldar. Collaborative inference via ensembles on the edge. In ICASSP 2021 202/ IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pp. 8478-8482, 2021. doi: 10.109//CASSSP99772.001 9414740.
Christopher G Small. A survey of multidimensional medians. International Statistical Review/Revue Internationale de Statistique, pp. 263-277, 1990.
Selim Furkan Tekin, Fatih Ilhan, Tiansheng Huang, Sihao Hu, and Ling Liu. LLM-TOPLA: Ef- ficient LLM ensemble by maximising diversity. In Yaser Al-Onaizan, Mohit Bansal, and Yun- Nung Chen (eds.), Findings of the Association for Computational Linguistics: EMNLP 2024, pp. 11951-1 1196., Miami, Florida, USA, November 2024. Association for Computational Linguistics. 222/2024
doi: 18.13/ 1/2024. iindings-emnll.6666 emnlp.698. URL
Findings emnlp. 698/
Hongyi Wang, Felipe Maia Polo, Yuekai Sun, Souvik Kundu, Eric Xing, and Mikhail Yurochkin. Fusing models with complementary expertise. In The Twelfth International Conference on Learning Representations, 2024. URL URLlhtttss://ppeeeriiii
net /ttt:/oruuumii--PPMMMMMMMMM
Dong Yin, Yudong Chen, Ramchandran Kannan, and Peter Bartlett. Byzantine-robus distributed learning: Towards optimal statistical rates. In International conference on machine learning, pp. 5650-5659. Pmlr, 2018.
13

---

Published as a conference paper at ICLR 2026
Manzil Zaheer, Satwik Kottur, Siamak Ravanbakhsh, Barnabas Poczos, Russ R Salakhut- dinov, and Alexander J Smola. Deep sets. In Guyon, U. Von Luxburg, S. Bengio, H. Wallach, R. Fergus, S. Vishwanathan, and R. Garnett (eds.), Ad- vances in Neural Information Processing Systems, volume 30. Curran Associates, Inc., 2017. URL httpss:/pproceeeddeee
wwwrips.cc//ppp....e. Paper-app.e.. pdf
forrfflless p//pppe///pp
Jie Zhang, Chen Chen, Bo Li, Lingjuan Lyu, Shuang Wu, Shouhong Ding, Chunhua Shen, and Chao Wu. DENSE: Data-free one-shot federated learning. Alice H. Oh, Alekh Agarwal, Danielle Belgrave, and Kyunghyun Cho (eds.), Advances in Neural Information Processing Systems, 2022.
URL httpps:/ net forum? i QF QoxCFYEKA.
Xiang Zhang, Junbo Zhao, and Yann LeCun. Character-level convolutional networks for text classifi- cation. In Proceedings of the 29th International Conference on Neural Information Processing Systems - Volume 1, NIPS 15, pp. 649-657, Cambridge, MA, USA, 2015. MIT Press.
14

---

Published as a conference paper at ICLR 2026
A
PROOF OF LEMMA I
We restate Lemma
I for convenience and then prove it below.
Lemma 1. For any E X, let Do = (h(()))) Then,
Rud (Uoob)) S R(v,)) E(z,))> Lewty (z, Bo)]
(4)
Proof. We can decompose the robust ensemble risk for an aggregator Whob as follows:
Radv (V/rot) R(vo)) + B(r,y)> [Gap(ær y v/. (mmb)),
(11)
where Gap(a, y No 4'bob) gudv (z. 3)) (2, (Z)...., zn) E (A*)", we have (z1( (x)).. Note that for any and any z =
Recall that we denote h(x)
if to (h(z)) y and @irbb + y if t (h(()) * and (zob(z) = y: otherwise.
{or
(2) サン (1)a((()))))))))))))))))()))())) *
This implies that, for any x and any (21,...,, kn) E (A y".
1 (1roo(2) (2) * y) 1 (h(()) # y} s (v)bb(z) + vo(((2)))
Therefore, for any x,
max 1 (V)ob(z) + y) - {v. (b(x)) # w) S max (Vrb(Zz) o (b((()))) (x)
zEly(*)
Substituting from above in II concludes the proof.
B PROOF OF THEOREM
We decompose the proof of Theorem |
into three steps for clarity purposes.
B. BOUNDING THE VARIANCE OF A SUBSET
We first state and prove a lemma that will guide us towards the proof of the main theorem. Lemma 2. Let U1, U
, Un E Rdd be set of vectors. We denote by Ün "EE Vs the mean of
these points. Let S C [n] such that |S] n-f, f. we denote by üg n Eies 0i the average of the vectors in S. Then the following holds true:
Σ ||u 1 = f- iES
1
||u 8.1l
f f
Proof. Let S [n]] such that |S| = f, and T = [n]],S. We have
Σ l0 - 11
Σ
|0 usll + Σ
|0g Fn 11 + 2 Σ
(c;
Ug. Us o,)
iES
iES
FES
SES
As, Eves Üs. 0g Un) = 0. we get
Σ
||; - 12 = (n f) 3 + (n f)lles - -
iEs
With 3 =
1 n-3 Eieg |1 - Us| Similarly, we can show that
Σ b J 12 f c7 + fl 0 12.
15

---

Published as a conference paper at ICLR 2026
From the above, we can simply rewrite
Σ ||u - e.112 Σ
||0 - En112 + Σ 1/2/ Tx 1xl
iES
iET
(n f) c3 + (n f) - Unl 22 + 1
+ fT - 8,
Now note that
für (n- Bs
Hence
11
Us On [Bg Fr)
and
0T Un
(n- (xr Es)
Substituting this the above we get
Σ |l E.l1² (n f)(3 + (n- f)-
[sS eт + SC7
(a f)
in-f"" 10 0s|l²
n
n
kE(N)
= -n-ff f) + + f (n-S8 10y Bg|12
Simplifying the above and reorganizing the terms, get
ΣV
1
TA 112
Σ
n-7
1
G + A 0s|1?
AE(n]
EES
As all the terms the right-hand side are non-negative, the above concludes the proof.
B.2 DEFINITION AND PROPERTIES OF CWTM
As its name indicates, coordinate-wise trimmed mean, based on a scalar protocol called trimmed mean. Given scalar values u,,.... Un E I, trimmed mean denoted by TM, is defined to be
TM (VI,..., vn) n-27
6())
(12)
i=++1
where "(z).". "" (()) denote the order statistics of "1.... Uns i.e., the sorting of the values in non- decreasing order (with ties broken arbitrarily Using this primitive. we can define the coordinate- wise trimmed mean aggregation follows. Given the input vectors 01,--.3 Un Rd the coordinate- wise trimmed mean of U1,..., Une denoted by CWTM(11.... vn). a vector IRd whose k-th coordinate is defined follows,
(WT.( P.))& =
Definition ((f, (oobustess) Let f 2 and x 2 aggregation rule ROBAVG is said be (f, roobuus for any vectors U1,...: Un E Rd,, and any set S S [m] of size n - f.
[OOAAVGEE,..... vn)) Ugll
where Ug = [s| Eies Us We refer to x as the robustness coefficient.
We will use the following lemma as part the theorem proof. We refer to Allouah et al. (2023) for its proof.
Lemma
3 (Allouah 2.23)). Let E No and f n. Then TM is ()rbuu with
6f n-2f (1+ -=222)
Moor formally, let he the permutation on [n] such that 1. S Vr(n)- The i-th order statistic of 01.t11 Un is simply vay) 0.(9) for all [n).
16

---

Published as a conference paper at ICLR 2026
B.3 PROOF OF THE THEOREM
Using the two lemmas presented above, we can now prove the main theorem, which we restate below for the reader's convenience.
Theorem 1. Consider who defined in S with ROBAVG CWTM. If the regressors h1,- hn are such that h(x) has a unique maximum coordinate almost everywhere, then the following holds:
(xza)) ( (x., Bo)l S (2..))D
MARGIN (T(x))
<
kn n n
+1
Ox
n2 n
where do (1( Nn (x)) and
68 n-
1 (1+
2-
Proof. Let first recall that by definition
0 if (2) = No. Vz E (
gadty oim
(z, (o)
otherwise.
In particular, this means that
(a.y)) padv (z. [o]]
P (x.,))D (mmn(z) No. vz [x)]]
(13)
Now recall that, for any E X. by definition
go = vo (b())) = argmax [(x))
AE[K]
where h(x) (hr (x), ..... hn (x)). Furthermore, still by definition, we have
Drob (z) argmax Argmax/CWTMMne (z)lı kE[K]
Vz E (z)
Hence, whenever M(x) has a unique maximum coordinate, to satisfy (lrb(z) = Go for all z E (x)x), it suffices (see Appendix B.4 for details) have
[CWTM (z)], - [T(x)]& < MARGIN h(z))
max KE[K]
Vz E (T)) almost surely.
(14)
2
In the remaining of the proof, we show that (14 holds as soon
MARGIN (h(x)) 2 n-f n- Ox-
To do we first observe that for any K. E []. and E I (z) we have |[CTT(Z)]] - [h(=)]a| < [CWTM(Z)), (x)] (x))a [h(=))+]
We then study each term of the right-hand side independently in (i) and (ii) below.
(i) First term. By definition of CWTM and Lemma 3 we know that for any [5(x)) and & [K], the following holds
[CWTM (2)lk (x))))) n-f
Σ
(Iha(z))e
[T (x))))
iEH
with x 2- (1+ (1+
Furthermore, using Lemma in the above we get
|[CWTM (z)).- (2) <
(x), [h(x)]a)²
Finally, using the definition of oz, we obtain
[CWTM (z)]e [T (x)]ae
n-7 o²
17

---

Published as a conference paper at ICLR 2026
(ii) Second term. Similar to the proof of Lemma 2 split [n] in elements of H and T [n])H.
Then we can rewrite for any lo E [K]
E (()())) (Tx)) n
((M( (M()))))² + -(ba()))e- [
VEE
Furthermore, using Jensen's inequality, have
Σ ([u((>) [A(x))a)² 2 (n f1n-f) (1 [h(x)la)²
(15)
and
((1b(<)))= [1(x0))))2 -M))))))-(()))))+>>> ([bT(x))s ([ir(=))=-[h())))) (h(x))a)²
with hr(()) = Eier hx(x). As hr(x)= -n(x))(n-ffill) ((-()((s))) the above also gives us
Σ
([ha(=)l [b(x))a)? (n- (I-D)(((x())))-MMM)))
(16)
KE
15 and 16) and since (n- + (m-11²= =(n=1) f) get
Then, combining
n
Σ
(b)())) - (+()))a) 2 m(n-1) ([h(())) (
Rearranging in the above obtain
n
((hn(z)) (xx)))) - n- Σ
(h(())] - (T()))a) s n
Combining. By substituting (i) and (ii) in the initial decomposition (applying v on each), we get
[[WTM(Z)] [h())le) s
(V.m
n-
or-
Thus, condition 14 is satisfied whenever
MARGIN (M()))
Gz. In particular, because we assumed Ti(x) has unique maximum coordinate almost everywhere, the above implies that
n-
((ra)) (Z) No, Vz E [)(x)) > P (x.))/D MARGIN (h(x:) 2 (
Kn n-
x
Conclusion. Plugging this into 13 completes the proof, i.e.,
(xxg)>> Lady (x, [o)] < IP (x.g)>D MARGIN (h(z)) < (v n- + V n-
B.4 JUSTIFICATION FOR 14
Here we prove that, whenever T((x) has a unique maximum coordinate, to satisfy (lr = 3o for all E I (x), it suffices to have
MARGIN (h(x))
max k
(CWTM (2))a- - [h(x)]a|
Vz EZ
18

---

Published as a conference paper at ICLR 2026
Proof. Let x E X and h X - A K the average function. Let assume that 14) holds true. Then for any z E (2) and l E [K] we have
MARG)N(((z))
[CWTM (z)le- [M(x]]e MARGIN(((s))
(17)
Let us denote by h" the coordinate such that [](x)]{= = h()) i.e., the unique maximum of h(x)) Let us also consider &o [K]]k*, and a E (T) have
[CWTM (z)]e- (CWTM (z)]a
= =[CWTM (z)] [h(x)]== ((CWTM (z)), - [b()))a) + [M(x)] [R(a)]e-
Using 117) on the first two terms and observing that [h(x)] [h(x)] 2 MARGIN (h(x)) by definition, we get
(ARG)N(R(W)) MARGIN (h(z)) = [CWTM (z)] [CWTM (z))a MARGIN(R(Z)
\\ k and z E [2(2),, we get that k the unique maximum coordinate of CWTM (z) for any z E (x). Hence, we get
Since the above holds for any & [K]]
(z) = argmax (CWTM (z)la argmax [M(x)] do for all E (())). *E[K]
KE[K]
C PROOF OF THEOREM 2
In this appendix, we give proof for Theorem 2 which we restate below for the reader's convenience. Theorem Consider umb as defined in (I0) with ROBAVG CWTM. the regressors h1..... hn are such that dg. (h(z)) has unique maximum coordinate almost everywhere, then the following holds:
B(r,))D
[eads (x., Ho)]
$ P ((aN)~D MARGIN (Øg- (h(x))) < 22V2L
( n- +
kn
/
n-
f
min {1, VKo
where Vo = argmaNke[K]] (p0- (h(z))) and K
6f
(1+
5
n-25
Proof. Recall that
Φe (h(z)) = μa;
Σ poz (hx(z)) 71
In the following, we denote 11-1|2 (i.e., the Euclidean norm) simply by |I-I|- Consider an arbitrary l E [K] Due to Lipschitz continuity of pay (-) we obtain that
Σ poz (ha(x)) )]
[mo] (ROBAVG (po: (21), ..., po; (zn 5))]]
Σ (M)(a)))
n
< L, ROBAVG (po:
(zm))
po;
(18)
n
Consider any j E [K] Since ROBAVG CWTM is coordinate- wise aggregator, we have ROBAAG (por (21)..... .op (zn))], ROBAVG (Ipo;(Ei)l, ..... [pv; (em)l
Therefore,
ROBAVG (.o (z)))], - Σ pa; (ha(x))
ROBAVG (1po) ..... [oo (Zx (zm)l;)
pog (z))))
19

---

Published as a conference paper at ICLR 2026
Therefore, by the robustness property of CWTM, we obtain that for all [K],
ROBBAGG (po; (21) po; (zn))],
E po; (nr(1)) n
1
2
Kn
(por (Ix(()))} [oog (x))1))
+ V
(19)
n2
f
where pot (x) 1 "
Di=1 tot (h,(z)). Applying Jensen's incquality, we obtain that
Σ (Pee (h,(z))] - [oo] (m)),,) 2 = Σ
(Loo (h.(z))], - [pe; (hr(=))),)
i,/=1
Therefore, due to Lipschitz continuity of po; (-), we have
n
2
Σ (pe: (ba(x)))) 1oor (v)1,)
( [m(())))))
11
24 p
Σ (Iu(=)),, - -m(x)),)
Therefore, for all j [K].
1 n (lpoz (ba(+)),, 1oo (o)),))
2L n
(1r(z)), - [A(=)),)
n
Using this in 19p we obtain that
ROBAVG (po ..... p0; Pe9 (2x))
1
Σ pez (hx(z))
n
2
< 21
kn
+
1
|x(()) - =((x011
n
n
n
Substituting from above in (18), obtain that
1 n
po: (ha(x)) ]
[mog (ROBAVG (21),......... poz (zn)))]
Σ
-
148
n
kn + V n n (V==*) Vn
< V2Luup
[l((x) - =((z)|12
(20)
Note that for any E Rd, if |ررحع|| < then ||a|| < ||0l| = E)= |P This, together with the fact that hy (x) E A for all i, implics that
[(((() T((
- < Σ [14((x)) < 1
[h((x)]l= =
n
Moreover, recalling that o² = max
Ei ([h(())) [T(x))] )² we also have
K =
T((z)|
([h(x)), - [[+()));-<((<))))))))))))))) < K o²
7
1=1
20

---

Published as a conference paper at ICLR 2026
Using the above in (20) yields,
]
[oo] (ROBAVG (poz (21)........... ................................ Poz (2n)))]
1 Σ toz (bx(2)))
Moz
Kn (V
( +
nー min(1, vKoa).
Note that the above holds true for any k E [K]. Hence, similar to poz CH po; (hi(x))) has unique minimum coordinate almost everywhere, if
14
whenever
Σ poz (nloo)) 2V2Lphp i=1
(Va" kn n-ff)
f
MARGIN
Moj
+ ( n
min(1, VKozh,
then
Por argmax Goag (ROBAVG (o (2n)))]
argmax
Moz
1
Σ por (ha(()))
The rest of the proof follows the same reasoning as in the final steps of the proof of Theorem
D SENSITIVITY OF DEEPSET AGGREGATOR WITHOUT ROBUST AVERAGING
In this appendix, we show how the use of robust averaging enhances the robustness the DeepSet aggregator. Specifically, we analyze the robustness gap of the following aggregator and compare with that of robust aggregator defined in (TO). The robustness gap of the latter is characterized in Theorem
robob (z) = argmnax
1
pej (zi) Σ
a
)
(21)
kE[K]
Throughout this appendix, we work under the same assumptions and notations as those in Appendix C Consider arbitrary A: E [K]. Due to Lipschitz continuity of Mag (-) we obtain that
]],
)]
po; (zi)
Pot (ba(z))
(po; - po; (bx(x)))
seg
71
7i
Due to Lipschitz continuity of po: (-), for any j E [K], we have
Lp
[po; (zi) p8; (h.(z))),
<
[pe; (zi) pe; (hu(=))),
Σ | - h.(x))
1=1
Note that 2; = hx(x) for at least n f indices i E [m]] (corresponding to honest uncorrupted probits).
That is, there exists B. [n] with [B such that z; (1(2) for all [m] Bz. Therefore,
L
(oo (zi) po; (h (x))))
Σ |= ha(x))
n
n B.
Let = max ||2 h (z(2)) . be the degree of probits' corruption. Then, for all E [K].
S Tip f n
[pog (2:) po; (hr(z))),
This implies that
(poz (zx) Poz (h+(2)))
5 SVKL
21

---

Published as a conference paper at ICLR 2026
Therefore, have for all & [K],
]
1
par (zi)
Moz E pot (u(()))
v VKIT
14g
Hence, argmaxkeix k (z)li-
argmax Lo0 (h(z))]a whenever
MARGIN (Øg- (p(xx)))) > 2V L
Under the assumption that Φa- (h(r)) has unique maximum coordinate almost everywhere, the above yields the following bound on the robustness gap for the aggregator defined in (2T).
(x gady (x,, [o)l S P ((,))))
MARGIN (Øp. (h(x))) < 2V K
(22)
Comparison to Theorem 2
Comparing (2 the robustness gap shown in Theorem for the robust aggregator defined in 10 we note a key difference:
While the robustness gap without robust averaging depends upon the degree of corruption 6, it is rendered independent of this degree of corruption when we use a robust averaging scheme like CWTM.
In fact, when the variance between honest probits is small, the robustness gap under robust averaging much smaller compared to the case without robust averaging, For instance, consider the case when (x)) = (a)))) for all i, E [n] and all x. While the robustness gap when using CWTM is 0, as per Theorem that need not be the case without robust averaging as is evident by (22)
E ADDITIONAL RELATED WORK
In the context of robust voting within federated learning, Chu & Laoutaris (024 propose FedQV, quadratic voting scheme that allocates voting budgets based on client reputation. This presumes stable client identities and therefore does not transfer our setting where malicious participants may change per query. In contrast, the ensemble majority voting scheme introduced in Cao et al. (2022) does not apply because it requires central control over training to obtain several global models, each trained on a subset of clients. In our setting, however, training is fully local and independent.
Beyond federated learning, robust voting has also been studied in more general settings. Allouah al. 2024b) propose Mchestan for robust sparse voting, but it requires normalization across voters, which assumes repeated score comparisons or stable voter behavior. This is not applicable to our per-query federated inference setting. Likewise, Melnyk et al. (2018) develop multi-round consensus for preference ranking and Datar et al. (2022) rely on repeated pairwise client comparisons. Both assume settings that are fundamentally different from our inference-time aggregation scenario.
F ADDITIONAL EXPERIMENTAL DETAILS
F.1 HYPERPARAMETERS
In this section, we report the hyperparameters used for our experiments, and which can be used to reproduce the results. The local training/ine-tuinng is conducted using SGD optimizer and learning rate of 0.0025 for CIFAR-10 and 0.01 for both CIFAR- 100 and AG-News. The training runs for 100 local epochs for CIFAR-10 while the fine-tuning of CIFAR- 1000 and AG-News runs for 20 epochs. The DeepSet model is trained using the Adam optimizer for 10 epochs for each dataset using a learning rate of 5 x 10-5 Our choices of parameters are based on prior work using similar setups (Allouah et al. 2024a Gong et al. 2022). We train the autoencoder in COPUR using the Adam optimizer and a learning rate of x 10 and vary the epochs from (50, 100, 150} depending on the dataset. The server's aggregator model in CoPUR is also trained using Adam for 40 epochs, and learning rate of x 10 2 Finally, the number of optimization iterations for COPUR is varied from 10 to 40, while Liu al. (2022) fixed value of 10. During adversarial training, sample different
22

---

Published as a conference paper at ICLR 2026
choices of adversaries out of [n] as their identify is unknown i.e., parameter N in Algorithm While the number of choices total Eí=m (m)) we only sample 120, .N- 300 and 5000 for each of n = 10, 17 and 25 respectively. Lastly, we set 5 50 and E such that it corresponds to 5 epochs over the corresponding training dataset.
F.2 DESCRIPTION OF ATTACKS
Attack
Type Black-box
Definition
Logit Flipping Liu et al. 2022
2;
amplification ha(a))
1,
j arg maxa (.
SIA-bb (ours)
Black-box
2
0,
otherwise
1, if arg minse (h (1)....... hn(x))
LMA Roux et al.
2025
White-box
of
0,
otherwise
1, if is least similar to arg maxee[A]] Eim ha(ar)
CPA Roux 2025
White-box
x
0, otherwise
1.
if arg Baggaaeee (h) hn()))
SIA-wb (ours)
White-box
2
0,
otherwise
21, 21.-..: 2j = arg max E(10 (hhenggn Made H, v)
PGD Liu al. 2022
White-hox
where heenign [a) i E Ppeniga) and havv = {21,- , 25}
Table 4: Table listing all attacks for input with its true label y. Here, to is any aggregation in consideration which is employed at the server. We refer with Qnenign the set of benign client indexes such that Spenign [nx] and [Stnnnnn J.
We consider six adversarial attacks, designed to evaluate the robustness of the aggregator under varying levels of adversary knowledge and coordination. Beyond the mathematical definitions in Table 4 we provide short intuitive description for each below:
Logit flipping (Black-box).
Each adversary inverts its own probits by negating and scaling them, effectively pushing its prediction away from the true class without knowledge of the server's aggregation or other clients' predictions.
Strongest Inverted Attack (SIA) [Our Proposed Attack).
Black-box: Adversaries independently change their prediction the second-most probable class (second-larged local probit) that is not the true class.
White-box: Same as black-box except that the adversaries use the global aggregation output (before perturbation) identify the second-most probable class.
Loss Maximization attack (LMA, White-box).
Adversaries maximize the server's is loss by targeting the least likely class among the global aggregation output.
Class Prior Attack (CPA, White-box).
Adversaries first identify the most likely class from the aggregation output. They then select the class least similar to it according to a pre-computed similarity matrix S E R derived from class embeddings of a pre-trained reference model.
PGD Attack (White-box).
Adversaries iteratively optimize their output via gradient ascent to maximize the aggregator's loss. This requires specifying a loss function for the aggregator: Two natural choices are the standard cross- cross-entropy loss and the Carlini-Wagner (CW) loss (Carlini & Wagner 2017). We adopt the latter (PGD-ew) in our experiments it produces stronger adversarial attacks: instead penalizing all classes equally, it focuses on the two most likely classes, thereby targeting the decision boundary more effectively.
23

---

Published as a conference paper at ICLR 2026
F.3 ADAPTING SIA ATTACK THE LOGIT SPACE
Since COPUR operates directly in logit space, adapted the SIA definitions to ensure comparability with DeepSet- Section 5.2
Proposed adaptation. Each adversary identifies the largest logit M either from its output (black-box) or from the aggregation output (white-box). Given an amplification factor & > 0, the adversary then sets its own logits (())E(R)) as such:
e M if is the index of the second-largest logit O.W.
14 = X M
using -m instead of if < (where m the smallest logit).
In our experiments, we set é = 2 since we found the baseline CoPUR to be highly negatively affected by larger values.
G ADDITIONAL EXPERIMENTAL RESULTS
G.1 EXPERIMENTAL VALIDATION OF THEOREM !
f=2
f=3
f=4
(a) SIA-wb Attack
(b) LMA Attack
CIFAR-10
AG-News
CIFAR-10
AG-News
0.6
0.30
0.40
0.22
Test Error
0.25
0.35
0.19
0.20
0.16
0.30
0.15
0.13
0.25
10
10
10
10
10
10
10
10a
10
10
10
10
100
10
10
10
Margin(h(x)Mox (log scale)
Figure 3: Validating Theorem iin practice. As the ratio of MARO)(((())/0 increases, we observe notable decrease in the test error, aligning with Theorem Adversaries use SIA white-box and LMA (see Table 4).
We empirically validate the theoretical predictions of Theorem by analyzing the evolution of test eгrоr as function of MARGIN(((==)/.... According to the theorem, larger values of this quantity translate into lower test error. 3 generated by varying the heterogeneity level E (0.5, 1000) for each of the datasets and computing the average MARGIN(((=))fa ratio the testset of the respective dataset. Increasing a reduces the model dissimilarity oa. thereby increasing the ratio above. We then report test eитоr for CWTM on each configuration obtain the figure. As expected, a higher number of adversaries f consistently leads to higher test error. The lower the heterogeneity. the less significant this effect is, since lower heterogeneity allows for more redundancy within client outputs.
G.2 PERFORMANCE AGAINST ROBUST AGGREGATORS
G.2.1 DECREASING THE NUMBER OF ADVERSARIES
Table shows the performance of DeepSet-TM and static aggregations as in Table 2 but decreasing the number of adversaries from 4 to 3.
24

---

Published as a conference paper at ICLR 2026
Aggregation
Logit lipping
SIA-bb
LMA
Msan
66.7
62.5
1.8
66.7
61.7
19.7
00.7300 3.2
35.8
4.1
35.8 4.4
CWMed
3.2
55.8 3.0
4.04
56.7 4.2
54.2
54.23311
36.5
1 4.1
36.5
1
CF-10
GM
65.0 35.0.:2.44 2.4
61.5
1.8
65.6
6.22
51.5
0.51311
3.1
36.0
4.8
36.0
4.8
CWTM
2.5
61.9
2.04
2.0
2.
38.3
DcopSet-IM
68.5 1.1
65.11188
67.8
66.
57.2
53.9
3.2
03.9
3.2
Mean
79.3 1: 0.7 0.7
75.4 0.8
76.1
7..0
52.1
1.1 1.1
52.1
+..1-00 1.1
66.9
CF-100
GM
1.09
1.
76.1
76.1
64.9
51.7
+ 1.3
51.7
CWTM
1.0
73.7 1.2
75.9 1.09
75.9
66.3
0.9
56.2
1.1
56.2
DeepSet-TM
0.3
76.4
78.2 0.2
78.1
1 0.3
68.3
0.4
59.5
0.5
59.5 4
Msan
81.
82
83.8
81.2
3.7
6.2
05.3
CWMed
80.3 4.5
3.5
81.3 2.9
80.1
3.0
77.5 +
63.5
6.8
63.5 1 6.8
AG-News
CWTM
83.9 1.1
82.6
2.4
83.5 1.4
81.2 2
2.3
76.4 4
6.2
05.4 6.2
DeepSet TM
85.9
0.2
83.8
1.2
84.1
0.5
82.7
0.9
81.9
1
1.2
83.5
1.2
Table Accuracy (%) of DeepSet-TM against static aggregations on the CIFAR-IO, CIFAR-I00 and AG-News datasets, with heterogeneity = 0.5, 17 clients and uses an amplification factor of
3 adversaries. Logit flipping
Aggregation
Logit Bipping
S1A-bb
LMA
CPA
SLA-wb
PGD--w
Worst
55.8
CWMed
47.1 1:1::00 6.7
45.8 3.7
45.9
42.4 4.2
38.4 2.4
14.
3.4
14.1 + 3.4
CF-10
68.2 4.3
55.0
55.6
19.7#40
34
13.7
29
13.7
CWTM
4.2
54.6
4.3
4.2
4.54
3.6
16.4 2.9
16.4 2.9
DoepSet-TV TM
61.9 8.1
67.9 2 3.2
46.6 3.6
44.7
2.
44.9
2.7
83.0
2.2
Mean
0.7
69.1 0.8
5..0
26.8
11.
25.8 2.8
25.8 2.8
CWMed
2.11
50.7
CF-100
GM
7..2
66.3 1.1
70.2 0.8
7.9
48.3
1.5
23.8 + 2.6
23.8 2.8
1.11
65.8
09.1 +
1.2
49.0
32.5
2.4
32.6 2.4
DoepSet-TM
0.8
71.9111
72.2
12.2110
0.6
56.7 1.0
38.6 2.5
38.6 + 2.5
Mean
4.6
70.7
6.2
07.1881
7.7
7.7
36.8 9.7
36.8 9.7
CWMed
9..
62.6 7.5
8.7
52.3
66.0
32.7 7.3
32.7 7.3
AG-News
4.9
70.5
7.0
CWTM
4.6
70.6
= 6.2
66.1
8.1
618
62.6 7.6
37.3 1 9.7
37.3 1 9.7
DeepSet-TM
3.5
73.6 -
01.1
99.
73.6
72.0
59.6
Table 6: Accuracy (%) of TeepSet-TM against static aggregations on the CIFAR-IO, CIFAR-100 and
AG-News datasets, with heterogeneity a = 0.3, n 17 clients and = adversaries. Logit flipping uses an amplification factor of 2.
Aggregation
Logit flpppin
SIA
LMA
CPA
SIA-wb
PGD-ew
Worst
Mean
10.5:..33
64.6
50.1
33.5
CWMed
63.6 2.4
59.4 2.0
61.1 1.4
60.1 1.4
55.1
1 1.3
36.9
3.4
36.9
06.9..0
3.4
0.4
64.1 14.11.
0.6
6..1
52.8
3.0
35.2
CWTM
68.3
1.4
0.7
6.01
52.0
1.6
36.2
226
36.2 2.6
DeepSet- TM
1.1 69.9
67.1
1.3
67.0
2.1 66.1
55.0
2.2
51.2
1.2
51.2
Mean
80.5 1.5.1.0
76.2
1 0.7
71.5
122
71.5
71.111... 1.2
62.5
1.1
48.4
1.5
48.4
1.5
CWMed
1.6
CF-100
GM
78.3 0.8
75.5
1: 0.9
78.5 1
0.8
0.8
66.0
1.1
51.2
1 1.7
$1.2
CWTM
1.0
75.6
0.8
78.1
67.1
54.1
DeepSet-TM
0.4
77.1
0.5
78.4
0.4
78.6 0.6
68.0
0.8
57.0 + 1.3
SY.0
Mean
85.1 45.1
81.1
2.8
83.7
2.4
81.0 3.7
77.8 3.2
65.6 - 5.8
65.6
CWMed
1. 3.2 80.6
80.3
2.6
81.8
2.4
80.2
2.8
78.1
1 2.6
64.8
5.8
64.8
5.8
AG-News
GM
84.3
80.8
2.8
83.6
2.4
3.70
78.2
3.1
64.5
- 5.9
64.5
CWTM
84.9 11 0.9
81.1
1 2.8
83.5
266
$1.01.1 3.7
77.9 1 3.2
65.8 1 5.7
65.8
5.7
DeepSer-
Table 7: Accuracy (%) of DeepSet-The TM against static aggregations the CIFAR-10, CIFAR-100 and AG-News datasets, with heterogeneity a = 0.8, 17 clients and = advensaries. Logit flipping uses amplification factor of 2.
25

---

Published as a conference paper at ICLR 2026
G.2.2 VARYING THE HETEROGENEITY
Tables and show the accuracy DeepSet-TM against static aggregation schemes on the three datasets of interest for 0.3 and 0.8 respectively. This is similar to Table 2 which showed the same view for = 0.5.
G.2.3 LETTING DIFFERENT ADVERSARIES PERFORM DIFFERENT ATTACKS
While the Byzantine machine learning literature generally considers adversaries that coordinate their attacks (Alistarh et al. 2018 Chen et al. 2017| Farhadkhani et al. 2022). it remains relevant to consider settings in which attacks not the
Te and other static aggregations on the three datasets under "Mixed" attack, where each adversary performs different attack (among Logit-flipping I.MA, CPA and SIA-wb). Across CIFAR-10, CIFAR-100 and AG-News, DeepSet-TW still outperforms the baselines under this new attack (+4,1, +1.8 and +2.8 points respectively, compared the strongest baseline). These experiments show our method can generalize to heterogeneous adversaries and is relying on a single shared attack pattern.
Table shows the accuracy
Agyregation
CF-10
CF-100
Ag-News
Mean
3.0
73.1
0.4
81.0
+ 2.6
CWMed
61.6
65.7
= 2.0
78.0
5.1
Mixed attack
GM
2.88
71.7
= 0.8
81.1
- 233
CWTM
59.6 3.4
72.3
0.8
80.9
2.6
DeepSet-TM
6.5
0.9
Table 8: Accuracy (%) of DeepSet-TM against static aggregations on the CIFAR-IO, CIFAR-100 and AG-News datasets and under a "Mixed" attack (Logit-flipe LLogit-llpppig with amplification 2, LMA, CPA and SIA-wb), with heterogeneity 0.5, n 17 clients and f 4 adversaries.
G.3 GIVING MORE COMPUTE TO THE ADVERSARY
Table shows the performance of DeepSet-TM and static aggregation schemes AG-News and under PGD-ew attack, when the adversaries are given more compute than during training. Specifically, training of TeepSet-TM is conducted with 50 PGD iterations. and attackers are given up to 150 inference time. Since we operate in probit space, we do not see a performance drop.
time
Mean
54.9
6.7
54.9
6.7
54.9 6.7
CWMed
53.2 7.0
53.1
6.4
53.1
6.4
AG-News
GM
52.6 + 7.3
52.6
= 7.2
52.6
7.2
CWTM
55.3
7.5
55.2
6.7
55.2
6.7
DeepSet-TM
83.2
1.4
83.0
= 1.4 83.0
+
1.4
Table 9: Accuracy (%) DeepSet-TM and static aggregations on AG-News (a 0.5, n 17, 4) against PGD-cw attack with various number of iterations. Training conducted with 50 iterations.
G.4 EFFECTIVENESS OF ROBUSTNESS ELEMENTS
In this section, we assess the improvement brought about by the two robustness elements CWTM and adversarial training. To evaluate this, consider the worst case performance of the DeepSet aggregator across five attacks under different combinations of the robustness elements. The results 0.5 and Table 10 for a {0.3, 0.83. We specifically exclude PGD
reported in Table for attack in computing the worst case the adversarially trained model shows elevated performance by virtue of being trained on the same attack, rendering the comparison unfair to the con-avversarially trained cases. We recall that the CWTM operator is applied to the DeepSet model only at inference time and incurs no additional cost during training.
26

---

Published as a conference paper at ICLR 2026
In Table 10 the lowest per-
formance is achieved by
DeepSet CWIM Adv. Tr.
CIFAR-10
CHFRR-100
CI
CIFAR-100
0.8
the DeepSet model without
K
32.1 1: 2.6
30.8 1 4.3
51.9 1.3
4..4
any robust element, as ex- pected. Interestingly, the improvements derived from enhancing DeepSet with ei- ther CWTM or adversar- ial training are comparable. For instance, on the CIFAR- 10 dataset with a = 0.3,
/
35.5 +
55.0
03.7
0..0
x
35.7 2.8
54.1
1.0
55.2
65.1 +
43.0 =
2.2
56.7
1.0
55.0 2.2
68.0 + 0.8
Table 10: Evaluation robust elements a setup with n = 17 clients and f adversaries. We report the worst-case test accuracy across different attacks.
CWTM results in 35.5% test accuracy while adversarial training results in 35.7%. Similarly, on CIFAR- 100 with a = 0.3, they achieve 55.5% and 54.1% respectively, starting from 30.8% when neither is applied. However, the highest performance is achieved with both elements combined, resulting in 43.0% on the CIFAR-10 10 and 56.7% on CIFAR-10 in the above case. Our results for in Table follow similar trend. Thus robustifying DeepSet with both CWTM and adversarial training brings the best from both worlds - Byzantine ML and adversarial ML.
G.5 PERFORMANCE OF OTHER ADVERSARIAL DEFENSES
Ageregation
Logit flppiing
SIA-bb
LMA
CPA
SIA-wb
Worst
75.6 0.7
69.1 =
57.0 +
56.8
2.4
41.5
1.4
14.5
RA Mean
75.7 1 0.7
69.0 1 0.8
55.8 1 2.4
56.5 1 2.4
49.1 : 1.2
49.1 1 1.2
CWTM
69.1 1.1
06.8
09.1
69.1
19
49.6
RA-CWTM
69.8 1.1
68.2 = 0.9
71.2 0.7
71.5
49.9 = 1.2
49.9 + 1.2
CWMed
2.11
51.8
55.9 2.2
55.8 2.2
50.7
50.7 00.7:18
RA-CWMed
1.9
49.9 : 2.0
53.4 1 2.0
54.8 1: 1.8
53.9 = 1.7
49.9 2.0
69.2
59.3
59.3
+ 1.5
54.2
1.8
54.2
DeepSet-IM
75.7 1 0.8
71.9 +
1.1 72.2
1.9
72.5
= 0.6 58.7
1
1.0
56.7 + 1.0
Table 11: Accuracy (%) of DeepSet-TM against randomized ablation on the CIFAR- 100 dataset, with heterogeneity a 0.3, n 17 clients and adversaries. Logit flipping uses amplification factor of and RA-CWTN trims clients on each side. RA outputs are computed over 100 iterations.
We also evaluate our approach against Randomized ablation (RA) (Levine & Feizi, 2020). certified adversarial defense method designed improve robustness through repeated random subsampling of clients. Specifically, at each round, RA discards ff randomly chosen clients and aggregates the remaining ones (either via averaging (RA-Mean), CWTM (Ra-CWTM) or CWMed (eA-C to get a candidate classification. This procedure is repeated several times with different random subsets, and the final prediction is obtained by majority voting over the outcomes. Intuitively, robustness arises from averaging across multiple independent aggregations, which reduces the influence of any single malicious client.
Table II reports the accuracy of RA baselines and their non-RA counterparts against DeepSet-TM, when a 0.3 and on CIFAR- We also report performance of the DeepSet-TM TM model without adversarial training but using RA instead under the name DS-RA. Notably, DeepSet-TM outperforms all baselines under all 5 attack settings. In general, RA yields varying degrees improvements and only consistently better across all attacks in the case of CWTM. On average. it improves accuracy by 0.5 points compared to the non-RA approach. This is inferior to DeepSet-TMe which yields an average improvement of 1.5 points over the strongest baseline for each attack. We can also note that DeepSet-TM exhibits lower variance across runs, confirming greater stability. In general, most certified adversarial defenses are highly dependent on the input space metric (usually the lp norm), hence are not directly applicable to our setting.
G.6 PERFORMANCE AGAINST SOTA BASELINES
Figure 4 shows a comparative view of DeepSet- TM, CoPUR and Manifold projection with a = 0.3. The same results for 0.5 available in Figure
27

---

report the clean accuracy for all aggregations iee, accuracy in the absence of Published as a conference paper at ICLR 2026
CoPur Logit Flipping
Manifold Projection
DeepSet
Logit Flipping
SIA Blackbox
SIA Whitebox
0.7
CIFAR-10
0.5
0.3
0.1
Test Accuracy
0.8
AG-News
0.6
0.4
0.2
0.8
CIFAR-100
0.6
0.4
0.2
0.0
12 4
16
3
3
Amplification Factor
Byzantine Clients (f)
# Byzantine Clients
Byzantine Clients (f)
Figure 4: DeepSet-TMM against baselines under heterogeneity a = 0.3 and n = 17 clients. In the first column, have f 1 adversary. In all remaining columns, we use amplification factor of 2 for the attacks.
G.7 CLEAN ACCURACY OF DIFFERENT METHODS
Tables 12 and adversaries.
13
Heterogeneity
Dataset
Mean
CWTM
GM
CWMed
DeepSet- TM
CIFAR-10
61.4
6..5
54.9 2.6
0.3
CIFAR-100
74.0 0.7
7..7
66.0
1.6
77.7 0.7
AG-News
82.8=24
82.7
2.4
82.222.6
84.5 2..1
CIFAR-I0 10
69.3
68.4
1.1
08.2
0..
70.5 1.1
0 0.5
CIFAR-100
8..0+:04
77.8
7.7
7.. 7.
AG-News
84.7
84.7
1.2
8.
1.4
86.2
CIFAR-I0
70.8=0.0
70.2
0.7
6.78
7.70
0.8
CIFAR- 100
0.44
80.1
1
0.6
79.7
77.6
0.8
80.8 1 0.4
AG-News
85.6 2 0.9
85.6 + 1.0
85.3
1.0 85.3 + 0.9
86.3 + 0.5
Table 12: Accuracy (%) of robust aggregations with no adversaries (f 0) and 17. DeepSet-TM achieves the highest accuracy in most scenarios.
Heterogeneity
Dataset
CoPUR
Manifold Projection
DeepSet-
CIFAR-10
70.7
1.4
71.8 0.8
66.2 : 0.8
0.3
CIFAR-10 100
73.9 1: 1.3
77.8 0.4
77.7 1: 0.7
AG-News
86.9 - 0.5
87.0 - 0.5
84.5 + 1.1
CIFAR-I0
73.0
74.1 0.8
70.5 +
0.5
CIFAR-100
75.3 2 1.1
77.8 0.3
79.6 0.4
0.2
Table 13: Accuracy (%) of baselines with adversaries (f 0) and 17. Manifold Projection, the least robust baseline, has the highest accuracy in most scenarios. Nevertheless, the gap between the three algorithms is small in several cases.
28

---

Published as a conference paper at ICLR 2026
G.8 COMPUTATIONAL EFFICIENCY OF DEEPSET-TH TM
G.8.1 INFERENCE LATENCY
Table 14 shows the inference latency for each static aggregation and for the two DeepSet variants (with and without CWTM). It is reported in milliseconds on batch of 64 samples, and averaged across the whole test set. We believe the additional cost is very much acceptable in practice.
Dataset
Mean
CWMed
CWTM
GM
DeepSet
DeepSet-TM
CIFAR-10 0.06 + 0.01
0.11 + 0.04
0.14 0.03
0.009
0.26
0.05
0.31 + 0.03
CIFAR-100 0.05 = 0.01
0.11 + 0.01
0..3
3.2 +.200.00
0.25 = 0.03
0.32 + 0.02
AG-News
3.0 0.13
Table 14: Inference latency, in ms, for static aggregations, the standard DeepSet and DeepSet-TM on the CIFAR-10, CIFAR-100 and AG-News datasets. computed on batch of 64 samples and averaged across the test set.
G.8.2 ADVERSARIAL TRAINING COST
We also compare the wall-clock time needed train DeepSet model with and without adversarial training in the configuration from Table averaged over runs. Without adversarial training, DeepSet takes about 1min, 1inn40 and 3min to train on CIFAR-10, CIFAR-100 and AG-News respectively. When adding adversarial training (S = 50 inner steps and N = 300 adversary sets), this becomes 1h26m, 1 h229m and 1h40m. Our work specifically intended for cross-silo settings, and we thus believe that such one-time training cost is acceptable in real applications.
H LLM USAGE STATEMENT
We acknowledge the use of LLMs in this work, limited to coding assistance, identifying potentially relevant related work, and improving the clarity and grammar of the manuscript. All LLM-ggnerated content was reviewed and verified by the authors.
29


Reviews:
[{"review_id": "uNbNJ2X96S", "reviewer": "Reviewer_exau", "summary": "This paper addresses the problem of robust federated inference, where the goal is to design an aggregator capable of handling mixtures of clean and corrupted predictions from multiple clients in a federated setting. The authors propose a training paradigm that estimates the residual test error through an adversarial loss, enabling robustness against prediction corruption. The method is theoretically grounded and demonstrates strong empirical performance compared to existing baselines.", "questions": "See Weaknesses.\n\nThe authors should address the practical implications of theorem 1 and extending experiments / ablation studies.", "limitations": "", "rating": 4, "confidence": 4, "soundness": 2, "presentation": 3, "contribution": 3, "strengths": "* Good writing, clear motivations\n* Theoretically guaranteed proposal with outstanding performance.", "weaknesses": "* Theorem 1: How can the bound be controlled or estimated in practice? Since the left-hand side represents a loss function with an arbitrary value, how can we ensure it remains smaller than 1, given that the bound is a probability? The authors should provide a discussion after the theorem to clarify its practical implications.\n* Applicability to Regression: How can the proposed framework (loss function, training algorithm, and theoretical results) be extended to regression tasks?\n* Ablation Study: The authors should include ablation studies on the DeepSet aggregator to justify its necessity. Why are recently published aggregator architectures [1,2] not suitable? Would the findings remain consistent if a stronger or alternative aggregator were used?\n* Experimental Settings: The current experimental setup appears somewhat simplified. In realistic scenarios, different clients may face distinct types of attacks. Have the authors evaluated the proposed approach under heterogeneous corruption settings to demonstrate its robustness and practical applicability?\n\n[1] IIse et al., “Attention-based Deep Multiple Instance Learning”, arxiv 2018\n\n[2] Xiang et al., “Exploring low-rank property in multiple instance learning for whole slide image classification”, ICLR’23", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "TZgkxjGB42", "reviewer": "Reviewer_5CEW", "summary": "The paper formally define and analyze the problem of robust federated inference, where a central server aggregates predictions from multiple local models in the presence of adversarial clients. They introduce a method combining adversarial training with test-time robust aggregation (e.g., trimmed mean), which improves robustness without increasing training cost. The proposed DeepSet-TM method outperforms existing robust aggregation techniques.", "questions": "See weakness.", "limitations": "", "rating": 4, "confidence": 5, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. Systematically address robustness in federated inference (as opposed to training), with both theoretical and empirical contributions.\n2. The DeepSet-based model with adversarial training and test-time robust aggregation is effective.\n3. The consistent performance gains as the number of clients and adversaries increases", "weaknesses": "1. Adversarial training with DeepSet, while more efficient than full combinatorial search, is still computationally intensive, especially as n grows.\n2. The analysis assumes f < n/2, which is common but may not hold in highly adversarial real-world settings. \n3. Some privacy concerns. The work focuses on robustness but does not discuss potential privacy implications of sharing probits or using server-side models.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "wJg3c72mSM", "reviewer": "Reviewer_6LL3", "summary": "This paper provides the first formal robustness analysis of federated inference, where a central server aggregates model predictions (probits) from multiple local clients to make a global decision. It shows that widely used averaging-based and trimmed-mean aggregators, though intuitively robust, can still fail even small deviations in logit (prob) space can flip the final argmax decision. The authors formally characterise the robustness gap and prove upper bounds showing that robustness depends on three key factors: the corruption fraction the inter-client dissimilarity of honest outputs, and the classification margin of the average prob vector. To go beyond linear aggregation, they cast robust federated inference as an adversarial learning problem over probability vectors, and propose a DeepSet-based neural aggregator that combines adversarial training with test-time robust averaging.", "questions": "Kindly refer to weaknesses", "limitations": "", "rating": 8, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "* The paper makes aa original theoretical contribution by providing the first formal robustness framework for federated inference, a setting previously treated mainly empirically.\n* the theoretical strength is the counterexample construction that demonstrates the argmax discontinuity problem, showing that even infinitesimal perturbations in averaged probits can cause misclassification\n* non-linear aggregation as an adversarial learning problem over probit vectors is conceptually novel. By recognizing that the adversarial space is structured (the probability simplex), the authors identify a tractable route to robustness.\n* The proposed DeepSet-based robust aggregator then builds on this insight to combine permutation invariance, adversarial training, and inference-time robust averaging, achieving both theoretical justification and strong empirical performance.", "weaknesses": "* In REERM, the inner maximization is combinatorial and non-differentiable, requiring heuristic relaxations that undermine its minimax semantics. \n* The adversarial model is overpowered and underspecified, leading to unrealistic robustness assumptions and potentially excessive conservatism.\n* Moreover, the learned DeepSet aggregator, though effective empirically, lacks analytical interpretability or formal robustness guarantees. Thus, REERM advances the conceptual framing of robust federated inference but leaves open key challenges in tractable optimization, principled approximation, and theoretical certification.\n* What about KRUM aggregation as the robust aggregator?", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "wZuvLtEmho", "reviewer": "Reviewer_h5tr", "summary": "This paper systematically investigates a critical security issue in federated learning and edge computing: the robustness of federated inference. The authors point out that existing model ensemble and aggregation paradigms are highly vulnerable to simple attacks from malicious clients. They formally define the problem of \"robust federated inference\" for the first time, filling a gap in the field. Through an initial theoretical analysis of averaging-based aggregators, the paper reveals that the error of these methods depends not only on the proportion of malicious clients (corruption fraction) but also on the dissimilarity between honest client outputs and the prediction margin of the models for the two most probable classes. This analysis lays a solid theoretical foundation for subsequent method design.\nTo address the robustness problem in non-linear scenarios, the paper proposes a novel DeepSet-TM aggregator. This method ingeniously reframes the robust inference problem as an adversarial machine learning problem in the probit vector space and leverages the permutation invariance of the DeepSet architecture to significantly reduce the computational complexity of adversarial training. By introducing adversarial samples during the training phase and combining them with robust averaging (CWTM) mechanisms during the testing phase, DeepSet-TM ensures the aggregator's resilience to malicious inputs. The paper conducts rigorous empirical validation on multiple benchmarks, including image and text classification. The results demonstrate that DeepSet-TM achieves a significant improvement in worst-case accuracy, ranging from 4.7% to 22.2%, compared to existing techniques across various attacks (including the newly proposed SIA attack), strongly proving the practical utility and robustness of the proposed scheme.", "questions": "1.The paper states that \"the DeepSet-TM aggregator incorporates robust averaging (CWTM) at the inference time.\" Could you please elaborate on the specific mechanism of this \"incorporation\"? How are the outputs of DeepSet-TM combined with or selected alongside the results of CWTM during the testing phase, and how does this combination synergistically enhance robustness?\n2.Regarding the computational efficiency of the DeepSet-TM aggregator, could you provide a more detailed analysis? Specifically, how much do the training time and inference latency of DeepSet-TM increase after introducing adversarial training and robust averaging at the testing phase, compared to a pure DeepSet or other non-linear aggregators? In large-scale federated deployments, is this increase acceptable in practice?\n3.The paper highlights experiments on federated heterogeneity (controlled by the Dirichlet distribution parameter α), using α={0.3, 0.5, 0.8}. Could you further investigate DeepSet-TM's performance under higher heterogeneity (e.g., smaller α values, or other means of introducing larger data distribution shifts)? Does the design of DeepSet-TM have inherent advantages or limitations when dealing with extreme data heterogeneity?", "limitations": "", "rating": 8, "confidence": 4, "soundness": 4, "presentation": 4, "contribution": 4, "strengths": "This paper makes several substantial contributions in the field of robust federated inference, demonstrating high originality and significance. Firstly, the paper formally defines the critical problem of \"robust federated inference\" for the first time, clearly delineating the challenge of ensuring aggregator accuracy in the presence of malicious clients. This issue has long been overlooked in existing literature and possesses significant theoretical and practical value. Secondly, the paper conducts an in-depth theoretical analysis of averaging-based aggregators, revealing the complex relationship between their robustness, client output disparities, and prediction margins. This provides a solid theoretical foundation for understanding the limitations of existing methods and points the way towards more refined future designs. Most importantly, the proposed DeepSet-TM aggregator is highly original; it creatively reframes the robust inference problem as an adversarial machine learning problem and cleverly leverages the permutation invariance of the DeepSet model to address the computational complexity of adversarial training. This method, by combining adversarial training and robust averaging during the testing phase, effectively enhances robustness. The experimental section also demonstrates DeepSet-TM's superior performance across various datasets and attack types, with accuracy improvements ranging from 4.7% to 22.2%, thereby proving its strong potential and importance in practical applications.", "weaknesses": "Despite the paper's excellent performance in both conceptual and methodological aspects, there remain areas for improvement. Firstly, while the paper defines robust federated inference in the \"Problem Formulation\" section, some critical assumptions, such as those regarding the security of the client models themselves, could be elaborated upon in more detail. Currently, the paper primarily focuses on the robustness of the aggregation phase. However, if client models are susceptible to poisoning or backdoor attacks, this could impact the overall system robustness, a topic that receives relatively less discussion in the paper. Secondly, the computational cost and model complexity of the DeepSet-TM aggregator are potential weaknesses. Although the paper mentions leveraging permutation invariance to reduce the search space for adversaries, its actual overhead during training and inference (especially in large-scale federated deployments) still requires more detailed analysis and quantification compared to simpler averaging or median aggregators, such as providing end-to-end training time or inference latency comparisons for different aggregators. Furthermore, while the experimental results are impressive, it would be beneficial to further investigate DeepSet-TM's performance under varying degrees of federated heterogeneity (e.g., larger data distribution shifts among different clients) to comprehensively evaluate its generalization capabilities.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "LXqraLFLkD", "reviewer": "Reviewer_Dfp1", "summary": "This paper investigates the adversarial robustness of federated inference in the presence of corrupted clients. It demonstrates that robust averaging may be insufficient due to the non-continuity of the argmax operator. It also introduced a DeepSet-TM approach for robust non-linear aggregation by formulating the robust inference as an adversarial training problem. Experimental results demonstrate the superior robustness of the proposed DeepSet-TM framework over baselines in various attacking scenarios.", "questions": "(1) Why is the assumption in line 241 required, i.e., if $[z]\\_k = [z]\\_{k'}$ for all $k,k'$, then $MARGIN(z) = \\infty$?\n\n(2) Lines 321-322 show that robust averaging is only incorporated at the inference time. Will the added ROBAVG operator change the optimality of the robust DeepSet aggregator defined in Eq. (8)? Why does it reduce the overall sensitivity of $\\phi\\_{\\theta^*}$? \n\n(3) Why does the proposed DeepSet-TM approach consistently achieve inferior robustness under Loss Maximization Attack (LMA) in Table 2?\n\n(4) DeepSet-TM replaces the point-wise loss function from the indicator function with the cross-entropy loss. Will it better handle the counter examples in lines 222-225?\n\n(5) How is the function $\\bar{h}(x)$ calculated in the counter example?", "limitations": "", "rating": 4, "confidence": 4, "soundness": 2, "presentation": 3, "contribution": 3, "strengths": "**Originality:** This work highlights the impact of the point-wise model dissimilarity and the probit’s margin on the robustness gap using linear averaging aggregation for federated inference. It also introduced a novel DeepSet-based framework to learn non-linear data-dependent robust aggregation function.\n\n**Quality:** The provided counter example shows the prediction error induced by the non-continuity of the argmax operator. Theorem 1 theoretically analyzes the robustness gap of linear averaging aggregation for federated inference, followed by empirical validation in Figure 3. The robustness of the DeepSet-TM framework is also validated in the experiments using various attacks.\n\n**Clarity:** The paper is well-written. The motivation behind robust federated inference is clearly discussed. The proofs of lemma and theorem are provided.\n\n**Significance\"** The problem of federated inference under potentially corrupted clients is highly significant in the context of real-world federated learning systems. A robust federated inference framework can largely improve the trustworthiness of the deployed systems.", "weaknesses": "(1) One major concern is the certification for DeepSet-TM under adversarial corruptions. Section 3 considers the linear averaging aggregation strategies and derives the theoretical result (Theorem 1) in shaping the robustness gap. Specifically, it highlights the impact of the corruption fraction, the model dissimilarity, and the probit’s margin. However, it is unclear how this robustness gap can be characterized in non-linear cases using DeepSet-TM. The highlighted potential factors, such as the point-wise model dissimilarity and the probit’s margin, are not explored in the non-linear aggregation of DeepSet-TM.\n\n(2) Another concern is the computational efficiency of the proposed DeepSet-TM method in adversarial training (i.e., bi-level optimization problem). Though several simplification strategies are proposed, the running efficiency of DeepSet-TM is not well discussed compared to baselines.\n\n(3) The impact of the simplification strategies for optimizing the robust DeepSet aggregator can be further discussed. With these simplification strategies (as well as ROBAVG operator in Eq. (10)), how will the derived solutions still approximate the optimal solution of the optimization problem in Eq. (9)?", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)