FedRACE: A Hierarchical and Statistical Framework for Robust Federated Learning
Authors: Gang Yan
Sikai Yang
Wan Du
Venue: NeurIPS 2025 poster ()
Keywords: Federated Learning
Robustness
Poisoning Attacks
Generalized Linear Model
Statistical Detection
Primary area: social_and_economic_aspects_of_machine_learning
TL;DR: FedRACE secures partially fine-tuned federated learning by combining hierarchical representations with statistical deviance-based malicious client detection.

Abstract: Integrating large pre-trained models into federated learning (FL) can significantly improve generalization and convergence efficiency. A widely adopted strategy freezes the pre-trained backbone and fine-tunes a lightweight task head, thereby reducing computational and communication costs. However, this partial fine-tuning paradigm introduces new security risks, making the system vulnerable to poisoned updates and backdoor attacks. To address these challenges, we propose FedRACE, a unified framework for robust FL with partially frozen models. FedRACE comprises two core components: HStat-Net, a hierarchical network that refines frozen features into compact, linearly separable representations; and DevGuard, a server-side mechanism that detects malicious clients by evaluating statistical deviance in class-level predictions modeling generalized linear models (GLMs). DevGuard further incorporates adaptive thresholding based on theoretical misclassification bounds and employs randomized majority voting to enhance detection reliability. We implement FEDRACE on the FedScale platform and evaluate it on CIFAR-100, Food-101, and Tiny ImageNet under diverse attack scenarios. FedRACE achieves a true positive rate of up to 99.3% with a false positive rate below 1.2%, while preserving model accuracy and improving generalization.

FEDRACE:
A Hierarchical and Statistical Framework for Robust Federated Learning
Sikai Yang Wan Du University of California, Merced Merced, CA, United States {gyan5, syang126, ydu3)rucmeeccd. edu
Gang Yan
Abstract
Integrating large pre-trained models into federated learning (FL) can significantly improve generalization and convergence efficiency. A widely adopted strategy freezes the pre-trained backbone and fine-tunes a lightweight task head, thereby reducing computational and communication costs. However, this partial fine-tuning paradigm introduces new security risks, making the system vulnerable to poisoned updates and backdoor attacks. To address these challenges, we propose FEDRACE, unified framework for robust FL with partially frozen models. PEDRACE com- prises two core components: HStat-Net, hierarchical network that refines frozen features into compact, linearly separable representations; and DevGuard, a server- side mechanism that detects malicious clients by evaluating statistical deviance class-level predictions modeling generalized linear models (GLMs). Dev further incorporates adaptive thresholding based on theoretical misclassification bounds and employs randomized majority voting to enhance detection reliability. We implement FEDRACE on the FedScale platform and evaluate it on CIFAR- -00, Food-101, and Tiny ImageNet under diverse attack scenarios. FEDRACE achieves a true positive rate of up to 99.3% with a false positive rate below 1.2%, while preserving model accuracy and improving generalization.
Introduction
Federated learning (FL) 22 enables multiple clients to collaboratively train global model while keeping data on-device. By keeping raw data local, this decentralized approach preserves privacy, making it well-suited for privacy-sensitive applications such voice recognition, healthcare, and human activity monitoring [ 5 [ Recent advances have shown that integrating large pre-trained models into FL can significantly improve generalization and convergence speed. Models such as CLIP 7 and BERT [8] act as powerful feature extractors across various domains and tasks. Their ability encode rich, transferable knowledge particularly valuable in federated settings, where data distributions across clients are typically non-lII (Independent and Identically Distributed) 10]
While pre-trained models enhance generalization in federated learning, fine-tuning the entire model on each client often impractical due to limited computational and communication resources. To address this, widely adopted approach is to freeze the pre- pre-trained backbone and fine-tune only small, task-specific head [8] 11 13 This strategy maintains the utility of large models while reducing training overhead. However, this partial adaptation approach introduces
security risks. Since the backbone fixed and shared across clients, adversaries can exploit its stable representation space to introduce poisoned updates or embed backdoors [14] 15 [6] Our experiments reveal that untargeted attacks [17] can reduce model accuracy by over 11.7%, while distributed backdoor attacks [18 can achieve success rate exceeding 80% with minimal impact on clean model performance.
39th Conference on Neural Information Processing Systems (NcurIPS 2025).

---

Existing defenses such as Trimmed-Ment [9]. Multi-Krum [20]. and reputation appttdtion-bsed methods like FLShield [2T and FLAIR 22 often rely on gradient statistics or fixed heuristics. While these methods are effective in some settings, they struggle to detect subtle semantic manipulations,
especially when only the head is trainable 23 24 These limitations raise a key research question:
How can we integrate large pre-trained models into FL while enabling reliable and adaptive detection of malicious clients?
To answer this question, we propose FEDRACE, unified framework for Federated Representation- based Adaptive Client Evaluation. FEDRACE combines hierarchical representation learning with statistical client evaluation improve FL robustness. It consists of two main components: (1) HStat-Net, a Hierarchical Statistical Network that transforms fixed features into compact and linearly separable representations using triplet loss, and (2) DevGuard, server-side evaluation mechanism that uses a generalized linear model (GLM) to identify clients with abnormal semantic behavior through deviance analysis.
As illustrated Figure | HStat-Net composed of three parts: a frozen pre-trained feature ex- tractor d, trainable statistical projection layer and lightweight task head h implemented as
ISttat-Net
Local Data
Task
a GLM. This modular design supports efficient fine-tuning and enables interpretable predictions. DevGuard evaluates clients by comparing their prediction outputs to global class-wise embed- dings. It calculates log-likelihood deviations to assign deviance scores, providing principled and explainable measure of client reliability. To im- prove robustness, DevGuard uses adaptive thresh- olding informed by theoretical misclassification subsets to reduce the impact of noise and adversarial updates.
X1
Pre-trained
Trainable
Figure 1: HStat-Net architecture (w h o s c). supporting robust federated learning. Local Data samples from Tiny ImageNet [25].
bounds and applies majority voting over client
Our contributions are summarized as follows. First, we propose HStat-Net, hicrarchical architecture that enables secure and efficient federated learning by transforming frozen representations into features suitable for statistical detection and model training. Second, we design DevGuard, a deviance baaane client evaluation mechanism that leverages generalized linear modeling identify semantic inconsistencies and malicious behaviors in principled and interpretable manner. Finally, develop FEDRA CE, an integrated framework that combines representation refinement with adaptive client evaluation, offering strong security and generalization.
We also implement FEDRACE on the FedScale platform 26) and conduct extensive evaluations CIFAR- 100, Food- 101 (27). and Tiny ImageNet [25]. The experiments cover various attack types, including untargeted, targeted, and backdoor scenarios, under realistic conditions. Results show that FEDRACE achieves a true positive rate of up to 99.3% and a false positive rate below 1.2%, while maintaining high model accuracy and fast convergence.
2 Background and Motivation
2.1 Federated Learning and Pre-trained Models
Federated learning distributed training framework that enables multiple clients, denoted by N = {1, ...,. N), to collaboratively train global model without sharing raw data. The overall objective is to minimize the global loss:
D [D]
min L(w,
Σ 1=1
C.(w, D.).
(I)
where DD is the local dataset of client i, and denotes the global model parameters. commonly used optimization algorithm is FedAvg [[] which proceeds communication rounds. In each round, the server selects subset of clients A/01, distributes the current global model, and aggregates the returned updates through weighted averaging.

---

Recent work has shown that integrating large pre-trained models into FL can improve generalization and accelerate convergence. Models such as CLIP 77. which builds on the ViT-B/32 backbone .. provide strong and transferable representations. These models are particularly effective in federated
settings, even under non-IID data distributions
g 10
A typical deployment strategy to freeze the pre-trained fea- ture extractor & and train only lightweight, task-specific head h,
Table 1: Comparison of training strategies on CIFAR-100.
Trainable
Training
Testing
Method
Parameters
Time
Accuracy
Retrain
86.62M
0.0423
58.32%
forming a modular model w Φ We evaluate this strategy on the CIFAR-106 dataset [28] by
Fully Fine-Tuned
86.62M
0.0411 sec
68.04%
Partially Fine-Tuned
2 0.05M
0.0130 sec
75.99%
comparing three training modes: (1) training from scratch, (2) full fine-tuning of all parameters, and
(3) partial fine-tuning of only the task head h. As shown in Table partial fine-tuning achieves the highest test accuracy (75.99%) and reduces training time by 68. 68.37% compared to full fine-tuning. These results confirm that updating only the task head is both efficient and effective in FL settings. The effectiveness of partial fine-tuning is largely due to the stable and transferable representations provided by 6. By keeping & fixed, we reduce the risk of overfitting and lower the computational and communication overhead, which is critical for practical FL deployments.
2.2 Threat Models and Poisoning Strategies
Although federated learning keeps data local, it remains vulnerable to adversarial threats. Mali- cious clients can manipulate local computations degrade global performance or induce specific misbehavior. We consider three common attack types:
Untargeted attacks aim to reduce overall model accuracy without targeting specific inputs 17 23 29 30.
Their impact is measured by classification accuracy (ACC):
ACC E(x,))> [I (G(x) = y)].
where y is the true label, Gxx) is the model's prediction, and 1(-) indicates correctness.
Targeted attacks aim to misclassify selected inputs into attacker-speciffed labels while maintaining
clean accuracy [1 32 33 34]. Their success is measured by the Attack Success Rate (ASR):
ASR
E (xana)
[I (G(x) target
Backdoor attacks inject triggers into inputs control model outputs, while keeping performance on clean data unaffected 188 35 36 37 38). Effectiveness is measured by Backdoor Accuracy (BA):
BA E (xxx)) ((x.)) [II (G trigger (x)) y |
(4)
where (-ig applies the backdoor trigger to the input
In this work, adopt practical threat model where up M < 0.5N clients may be compromised.
This constraint aligns with assumptions in Byzantine-robust FL. [33 24
30
Compromised clients
may modify local data, manipulate gradients, or submit crafted updates 29 31
35
39 40) Unlike
stronger threat models [29] 30 41, we assume adversaries act independently and do not have access to global aggregation logic or benign clients' data.
2.3 Existing Defenses in Federated Learning
To address adversarial threats in federated learning, a range of defenses has been proposed to address adversarial threats in federated learning. Early methods such as Trimmed-Mean [19 40) and Multi- Krum (20 filter anomalous updates based on statistical or geometric criteria. More recent approaches incorporate dynamic analysis or auxiliary signals. For example, FedRoLA 42 measures layer-wist wise similarity to detect outliers, while FLShield (1 and FLAIR 22 leverage validation feedback and
client reputation. Additional methods like WPCRA 43), FedGT [44), and MAB-RF [5) apply
cross-round analysis, group testing, or adaptive client selection.
However, most existing defenses are designed for full-model training and do not address the challenges of partial fine-tuning. many practical deployments, the feature extractor frozen and only the task-specific head h is trained to reduce communication and computation overhead [15]. While
3

---

efficient, this setup exposes new vulnerabilities. The shared frozen representation space can be exploited to embed triggers or introduce structured deviations. As shown in [14], even few poisoned samples can achieve nearly 100% backdoor success with minimal impact on clean accuracy.
Our experiments confirm this risk. On CIFAR-IO0, untargeted attack 17 reduces accuracy from 75.99% to 64.24%, while a distributed backdoor attack [18] reaches over 80% backdoor accuracy without significantly affecting clean performance. These findings reveal key limitation in current FL defenses, which lack effective protection for systems using partial fine-tuning.
3 Proposed Design
To mitigate the security vulnerabilities introduced by partial fine-tuning in federated learning, we propose FEDRACE, unified framework that integrates robust representation learning with adaptive client evaluation. FEDRACE comprises two core components:
1. HStat-Net, a hierarchical statistical network that refines frozen features into compact, linearly separable representations adapted to the downstream task.
2. DevGuard, server-side detection mechanism that evaluates client updates based on semantic consistency and statistical deviance under generalized linear model.
By combining local representation refinement with global statistical evaluation, FEDRACE enhances robustness in non-IlD and adversarial federated settings. We now detail each component.
3.1 HStat-Net: Hierarchical Statistical Network
To mitigate the limitations of frozen representations partially fine-tuned FL. systems, HStat-Net refines features to improve task adaptation and enhance representation structure. As shown in Figure] adopts a modular architecture composed of three components:
1. Pre-trained Feature Extractor (ø): The extractor & maps raw input x to a feature vector z:
x(x).
(5)
This module is fixed during training to ensure consistency across clients and reduce compu- tation and communication overhead.
2. Statistical Net (s): The net transforms into a compact, linearly separable representation:
s=s(z),
where E RDD is projected to E Rd with d < D. This transformation reduces dimension- ality and abstracts feature information, which can help improve privacy 446 47 3. Task Net (h): The Task Net produces task-specific predictions from r:
h(r).
This component is lightweight and trained locally to support downstream tasks with minimal computational cost.
For each client the complete forward pipeline defined
d = (o(x)) = =x(o(x)),
(8)
where vi denotes the client-specific transformation applied after the shared extractor d.
Training Methodology. To effectively train the modular components of HStat-Net while preserving their distinct roles, adopt a two-stage training procedure that decouples the optimization of the
Statistical Net (s) and the Task Net (h). To promote discriminative feature space, the Statistical Net optimized using the Triplet Loss
49 which encourages intra-class compactness and inter-class
separation. The loss is defined as:
Triplet
Σ max (||r: r/11 ||| r 0)
(9)
IED
where is the representation of anchor Xt, xy is positive sample from the same class, r/ is negative sample from different class, and 8 margin parameter, empirically to 0.1.

---

The Task Net is trained to optimize pre- dictive performance using the standard Cross-Entropy Loss:
Clientz
Freeze Statistical Net
Freeze Task Net
LCR - Σ LEDEEAM
Σ
vi log vi (10)
hoo
Figure 2: Two-stage training procedure for HStat-Net.
where C' is the number of classes, yff is the one-hot ground-truth label, and of is the predicted probability for class During each communication round t, client initializes local training from the global model h s' As illustrated in Figure training proceeds in two steps:
Step 1: The Task Net is updated by minimizing Lce with s fixed.
Step 2: With hy fixed, the Statistical Net updated by minimizing Triplet.
After local updates, each client transmits the composed transformation u hξ st to the server, which performs uniform aggregation over the participating clients A/(1) obtain the global at This decoupled training strategy enables independent optimization of the Statistical Net and Task Net, mitigating objective interference and promoting stable convergence. also facilitates efficient onboarding of new clients, as fine-tuning only the Task Net h is typically sufficient to achieve strong performance, further reducing computational and communication overhead [50].
Experimental Validation. We eval- uate HStat-Net on the CIFAR-100 dataset (28) using 64 clients, where data is partitioned according to Dirichlet distribution Dirsa(ar) with
100
100
100
1.00
80
80
80
0.75
Class
80
60
80
40
40
40
0.25
20
0.00
0.5, representing moderate sta- tistical heterogeneity [5]
40 80 60 100
40 80
40 80
52). The CLIP model (ViT-B/32) [ is used as frozen feature extractor. We com-
Class ID
Class ID
Class ID (c) HStat-Net
(a) Raw Data
(b) CLIP
Figure 3: Visualization of class-wise cosine similarity.
pare three types of representations: raw inputs, CLIP features, and HStat-Net outputs. Figure shows the class-wise cosine similarity across these representations. As features progress through the architecture, class separation becomes more pronounced. The average inter-class similarity decreases from 0.976 (raw inputs) to 0.908 (CLIP) and further to 0.339 (HStat-Net), indicating improved discriminability.
To quantitatively assess the quality of learned features,
Table 2: Representation quality analysis.
we compute Fisher's Criterion and Mutual Information
Method
Raw
CLIP
HStat-Net
(MI) [53, 54 (55 for the three representation types. As shown in Table HStat-Net achieves the highest scores, yielding 3.34x improvement in Fisher's Criterion and
Fisher
0.149
0.480
1.602
MI
0.162
0.275
0.556
2.02x gain in MI compared to raw inputs. These results demonstrate that the hierarchical refinement introduced by HStat-Net produces a more structured and linearly separable feature space.
We further assess HStat-Net's generalization ability by simulating a deployment scenario in which ten previously unseen clients are in- troduced after initial training. These clients not involved in the original training with = 0.5 and receive data drawn from Dir with a E (0.1, 0.5, 0.9), reflecting different levels of non-IID heterogeneity. Each client fine-tunes only its Task Net for one local epoch. As shown in Table HStat-Net consistently outperforms the baseline h & across all settings.
Table 3: Performance new clients under differ- ent data distributions.
Method
0.1
0.5
0.9
Traditional
23.78%
12.90%
9.67%
HStat-Net
66.85%
55.64%
52.60%
3.2 DevGuard: Deviance-based Guard Mechanism
While HStat-Net improves task utility by producing structured and linearly separable representations, the resulting stable feature space may be exploited by adversaries to insert subtle manipulations that retain local accuracy but deviate from global semantics. To mitigate this, we propose DevGuard, server-side mechanism that detects semantic inconsistencies through statistical deviance analysis.
5

---

Unlike gradient- based defenses 20 42 56
DevGuard evaluates the alignment between client-level
features and global class-wise representations.
Representation-Drive DDiiven Evaluation. To capture semantic deviations introduced by malicious clients, each client computes class-wise feature centroids using its local Statistical Net s from the previous round and sends them to the server for aggregation:
n S (2),),
(11)
where zi, is the 1-th sample in class and ne is the number of local samples from that class. The server aggregates these vectors across clients using an element median to obtain the global class-level representation:
global median (or) | (EV())
(12)
which provides a robust estimate of the shared semantic structure while suppressing outlier effects [19] Given that HStat-Net produces linearly separable features, the Task Net h can be modeled generalized linear model (GLM) [57). Specifically, the probability for class e is computed as:
g(E R Wh.
R''n..
(13)
where R the input feature vector, Wh is the class-specific coefficient vector, and g is the inverse link function (e.g., softmax (58) ). GLMs are widely used in tasks such as multinomial regression and anomaly detection [59, 60). offering both interpretability and robustness. These properties are especially valuable for evaluating client-level consistency in federated settings.
Deviance-Based Client Evaluation. Given the linearly separable representations generated by HStat- Net, DevGuard evaluates client reliability by applying deviance analysis under the GLM framework. Each client models the conditional distribution P(Y R) using a linear transformation followed by softmax activation:
exp(r w())
(14)
Am exp(r w
where is the input feature (e.g., r )o wf, is the coefficient vector for class c, and C is the number of classes. Under this GLM formulation, compute the deviance, standard statistical metric that quantifies the goodness-of-ftt by measuring the discrepancy between predicted probabilities and true labels [59]. For client i, the global representation "glatal is passed through its Task Net produce Df. the predicted probability for class c. The true label is encoded indicator variable of, which equals if is the correct class and 0 otherwise. The log-likelihood for class e is given by:
L Σ vf log(
(15)
where of is the predicted probability produced by client's Task Net. In the saturated model, which represents perfect fit to the data, the prediction for the correct class is of 1, resulting in log-likelihood of L Saturated = log(1) (1) = 0. The class-wise deviance residual is thus computed as:
A 2 2 (L
L = log (DF).
(16)
To obtain a robust client-level reliability score, we aggregate the residuals across all classes using an entropy-inspiree formulation:
A Σ A log (A)).
(17)
This approach amplifies the impact of large residuals, ensuring that clients with strongly misaligned predictions are penalized more heavily. A high A, indicates that client i deviates significantly from the global semantic structure, suggesting possible poisoning or manipulation.
Adaptive Thresholding with Theoretical Guarantees. Building on the deviance scores {A, ) ivvo computed for each client, we now describe how DevGuard distinguishes malicious participants using an adaptive thresholding strategy grounded in statistical analysis. Specifically, the scores are first sorted in ascending order:
A < A2) S (m).
(18)

---

where n. = [ and Ag denotes the i-th smallest residual. Let B and M denote the sets of benign and malicious clients, respectively. We assume that the residuals from benign clients are centered around lower mean μsg. while those from malicious clients are centered around higher mean μ.M- where P. > jgg. This separation pattern can be expressed as:
PB + Op(1), i PM + O2(1, M,
(19)
where (1) denotes bounded variation due to random sampling or model variance. Our goal is to determine threshold index P such that all clients with Аμg > A flagged as suspicious. To guide the threshold selection, we establish the following theoretical result:
Theorem Assume the deviance residuals of benign and malicious clients are drawn from distribu- tions with means μu and pM, respectively, and bounded variance o², where P.M. 4B.. Then, the total misclassification rate (TMR) is bounded by:
4
TMR
(20)
(W 1B)2
This result provides theoretical guarantee for separating benign and malicious clients based on their deviance scores. Since the exact means jıg and μ.M unknown, approximate the optimal index P by evaluating all candidate indices p E {1,2...., n) and selecting the one that minimizes the empirical upper bound in Equation (20).
To enhance robustness against noise and outliers, DevGuard employs a multi-step voting procedure. In each of K steps, a random subset Ar(t)
suh C is sampled, and corresponding global representations are recalculated. Within each step k clients compute fresh residuals {A(*)), ), and the threshold Pı: is determined using the same optimization process. Clients with A A are flagged as suspicious that step. Final classification based on majority voting:
Votes; Σ
Σi(A[">
A Del
K
where I(.) is the indicator function. A client classified as malicious if it is flagged in more than half of the steps (see Algorithm []. This adaptive strategy combines statistical rigor with practical robustness, ensuring reliable detection under con-stationary or adversarial conditions.
3.3 Putting Everything Together
FEDRACE combines semantic representation learning on the client side with statistical evaluation on the server side to support reliable detection of malicious clients and robust model aggregation. The system is implemented using the FedScale platform (26) with PyTorch [61]. and leverages GPU acceleration for efficient training and inference. In each communication round, after receiving class-wise centroids and corresponding model updates from participating clients, the server initiates
K-step detection procedure. In each step k. a random subset of clients sub is selected. The server aggregates centroids from this subset using element-wise median to form global class-level representations. It then evaluates each client by computing class-wise deviance residuals from its Task Net predictions, which are aggregated into a client-level score A; to measure semantic consistency.
After calculating client scores, the server sorts the values and selects threshold index P that minimizes the empirical bound on the TMR, as defined Theorem [ Clients with scores greater than the threshold, A; [Aj) are flagged as suspicious in that step. This procedure is repeated across K steps. client ultimately classified as malicious if it flagged more than half of the steps. Only clients identified benign are included in the global aggregation. The server-side computational complexity per round Ó K (C + log N)). where N the number of clients and the number of classes. This ensures that FEDRACE is scalable for large federated learning deployments.
7

---

Table 4: Performance of defense methods against different attacks, evaluated across multiple metries.
Untargeted
Targeted
Dataset
Defense
Min-Max
IPMA
IIPA
FCC
DJA
ACC
ACC
ASR
ACC
BA
ACC
BA
ACC
Multi- krum
72.39
76. 76.16
1.52g.10
75.93u
20.05u.11
76.03u
23.20
75.688
Trimmed-mean
75.150.55
76. 23
1.799
75.83n.21
20
76.53
12.16g.29
76.656.24 25
FLAIR
73.07
75. 75.74
0.61o
34
1.300
76.21a.3
0.966 17
75.63g
CIFAR-100
FedRol A
76.05
76. 26.84..29
11.92a.2
74.88
39.28
a6.47
2.89g 28
77.040.a7
FLShield
76.86o.24
76. 660.6
2.270.29
75.63a.25
1.67o 26
76.81
1.460.2r
76.99
FEDRACE
76.690.32
76.99
0.070.10
77.02
0.06
76.98o
0.36,
77.21o.31
Multi-krum
52.31o.55
55. 700.27
2.07o
55.80n.27
20,22
55.87
13.13
56, 25,236..5
Trimmed- mean
54.377.33
56.37
2.34g a6
56.08u.25
56.22 56.22a.32 27.588
30.84,.2
56.544,2 29
Food-101
FLAIIR
53. 16..0
54.27o.a0
0.43o
52.09h.29
5.67o 30
55.24
1.48o 26
533.333.29
FedRoLA
56. 36.40g.e
55. $5.59g
12. 74g
54. 10
45.27
56, 16
8.14 28
56,511.
FI.Sheeld
56.24..29
56.07 56.07o.a1
14.02
74.76
6.360 29
26.25
1.440 28
56.655..2 27
FEDRACE
26
56.760.26
0.270.16
56.680.27
0,31
56.70o.2s
1.01o.31
56.72o.27
Multi-krum
31.04o.32
72. 22.38
0.633
72. 70
19.27g.12
72.85
45.7 29
72.
Trimmed-mean
71.96g.2s
72. 22
0.95g
72.74
33.06g.28
72.33
35,09
72.67a.25
Tiny
FLAIR
71.23
72. 72.59b.25
0.28 19
70.58
4.430 26
71.89
0.246 15
70.91,.30
ImageNet
FedRoLAA
73.36
T2. 72.788.29
4.87o.
71.922..9
47. 47.140.25
72. 12..33
4.75g
73. 13k
FLShiell
23.290.24
13.129.a2
0.850.25
71.84p.29
5.840 26
13.15
0.53g. 19
73.2 13.22
FEDRACE
73,06.
73
0.07a 10
73.24
0.08, 10
73.44. 29
0.13) 13
73.42
4 Experiments
4.1 Experimental Setup
Datasets and Models. We evaluate our framework on three widely used image classification
benchmarks: CIFAR- 100 (28), Food-101 (27]. and Tiny ImageNet [25]. CIFAR-100 contains 100
classes with 600 images per class, divided into 500 training and 100 testing samples. Food-101
includes 101 food categories with 750 training and 250 testing images per class, and presents
significant variation in appearance. Tiny ImageNet a subset of ImageNet (22, consisting of 200 classes with 500 training and 50 validation images per class, offering good trade-off between diversity and computational cost. For feature extraction, we use the CLIP model with a ViT-B/32 backbone and remove its final classification layer following standard transfer learning practice. The Statistical Net (s) and the Task Net (h) are implemented as single fully connected layers with output dimension d 256, resulting in representations r R 256 To evaluate scalability, we also experiment with ResNet- 152 663 as an alternative backbone for á.
Parameter Settings. We simulate FL system with N = 64 clients, selecting n = 16 clients randomly in each communication round. Following prior work 233
we assume M = 16 malicious clients, keeping the malicious ratio below 50%. These clients are randomly chosen in cach round to reflect dynamic adversarial behavior. Client datasets are partitioned in a non-lID manner using a Dirichlet distribution with concentration parameter rate of 0.001, batch size 128, and three epochs per round across all datasets. All experiments are conducted on NVIDIA RTX A4500 GPUs and repeated with four random seeds (1, 12, 123, 1234).
29 30,,
0.5. Local training uses a learning
Baseline Attacks. We evaluate FEDRACE under five representative attack scenarios in federated learning. The Min-Max Attack 23 generates updates that remain within acceptable bounds while introducing harmful behavior. The Inner Product Manipulation Attack (IPMA) [17] alters gradient
directions to disrupt learning. The Targeted Label Flipping Attack (TLFA) 34 modifies labels to influence specific classification outcomes. The Edge-Case Backdoor Attack (ECBA) (36) embeds hidden triggers by leveraging
atypical input patterns. The Distributed Backdoor Attack (DBA) [8] involves coordination among multiple malicious clients to implant consistent backdoors.
Baseline Defenses. We compare our framework against five defense baselines: FLShield [21]. FedRoLA (4). FLAIR [22], Trimmed-men -man (19 40], and Multi-Krum (20). FLShield verifies local models using a reference dataset. FedRoLA analyzes update similarity to identify anomalies. FLAIR maintains dynamic reputations to weigh client contributions. Trimmed-mes discards extreme values for robust aggregation. Multi-Krum selects a subset of updates with minimal pairwise distances to exclude outliers. We omit the Median aggregator since recent studies 42 56 report its performance is generally comparable to Trimmed-mean.
8

---

Table 5: Comparison of detection performance (TPR/FPR) under various scenarios.
Untargeted
Targeted ECBA
Dataset
Defense
Min-Max
IPMA
TLFA
DBA
Multi-krum
0.783/0.223
0.81770. 192
0.853/0. 148
0.80470. 197
0.732/0.265
FLAIR
0.847/0.352
0.882/0.318
0.943/0.357
0.912/0.383
0.867/0.342
FedRoLA
0,931/0.118
0,907/0.133
0.648/0.353
0.613/0.387
0,583/0.412
CIFAR-100
FLShield
0,935/0.188 183
0,927/0. 157
0.912/0. 173
0.887/0. 187
0.872/0.213
FEDRACE
0.987/0.072
0,983/0.018
0.973/0.012
0.977/0.032
0.968/0.10
Multi-krum
0.773/0.227
0.808/0.200 2044
0.842/0. 163
0.793/0.218
0.724X0.267
FLAIR
0.834/0.367
0.857/0.343
0.927/0.354
0.893/0.392
0.847/0.364
FedRoLA
0,934/0.127
0.893/0.144 147
0.634/0.373
0.578/0.422 .233
0,547/0.442 442
Food-101
FLShiell
0,922/0. 193
0.918/0. 168
0.904/0. 182
0.873/0.214
0.863/0.25 227
FCDRACE
0.992/0.063
0.987/0.023
0.988/0.018
0.983/0.024
0.978/0.112 122
Multi-krum
0.827/0. 0.787/0.214
0.857/0. 143
0,81 187
0,743/0.22
FLAIR
0.864/0.338
0.887/0.313
0,947/0.342
0. 0,883/0.334 0,923/0.368
Tiny ImageNet
A
0,948/0. 11
0.9
0.663/0.338
0.587/0.400 0.617/0.384
FLShicld
0.953/0.174
0,932/0.153
0.918/0.164
0.893/0.183
0. 1878/0.204
FEDRACE
0.993/0.048
0.988/0.013
0,987/0.028
0,992/0.023
0.983/0.085
4.2 Experimental Results
Main Results. Table 4 presents the performance of all defense methods under both untargeted and targeted attacks across 100. Food- 101, and Tiny ImageNet. For untargeted attacks, such as Min-Max and IPMA, traditional aggregation methods like Multi- Kruti-KKmmmmm and Trimmed -ean achieve moderate accuracy (e.g.. 72.59% and 75. 15% on CIFAR- 100 under Min-Max), while more recent defenses such as FL.Siell and FedRoLA offer improved results. FEDR ACE consistently achieves the highest accuracy under IPMA, with 76.99% on CIFAR- 56. 56%76% on Food-101, and 73. 40% on Tiny ImageNet. For targeted attacks, metrics such as ASR and BA reveal clearer differences. While FedRoLA yields an ASR of 11.199999 11.92% on CIFAR- 100 under TLFA, and FLShield reduces this to 2. 2.27%. both still allow some attack success. FLAIR lowers ASR further (e.g. 0.61% but at the cost of high FPR. In contrast, FEDRACE reduces ASR and BA to below 0.4% across most datasets and attacks, while maintaining competitive accuracy (e.g.. 77.21% % under DBA CIFAR-100).
Table reports the detection performance of all methods terms of true positive rate (TPR) and false positive rate (FPR). FEDRACE achieves the best balance, with TPRs consistently above 0.97 and FPRs below 0.1 in most scenarios. For instance, under TLFA on CIFAR-100, FEDRACE achieves TPR of 0.973 with FPR of only 0.012, significantly outperforming FedRoLA (TPR: 0.648, FPR: 0.353) and FLAIR (TPR: 0.943, FPR: 0.357). Similar trends hold across Food- 10od-101&o and Tiny ImageNet. These results demonstrate that FEDRACE not only enhances robustness against diverse attacks but also offers reliable detection with minimal false alarms. Beyond standard attack scenarios, additional tests against adaptive and stealthy attacks, including IBA (64), A3FL (65), and our Seaiistica--Ne-oofff variant, show that FEDRACE keeps attack success below 2.5% and true-positive rates above 93%, demonstrating robustness even under adaptive adversaries.
Evaluation of Detection Threshold. Theorem [ guides the selection of the detection threshold. Ta-
Table 6: Evaluation of threshold estimation.
Ip p'1
CIFAR-100
Food-101
ImageNet
6soos the error I p²| in threshold estimation under different attack types and datasets. For tar- geted attacks like ECBA, the error very small (at most 0.033). For untargeted attacks such as Min-Max and for DBA, the error is higher but still acceptable. These results show that TEDRACE can estimate the threshold accurately in most cases.
Min-Max
0.113g.20
0,102 26
0. 0.168p.24
IPMA
0.029b.12
0.043p 14
0.032
TLFA
0.041p:20
0.038 18
0.039..13
ECBA
0.024
0.033
0.022
DBA
0.148p
0.0644.11 18
0.192
Evaluation of Scalability. We evaluate the scalabil- ity of FEDRACE by replacing the CLIP feature ex-
Mi-Max
IPMA
TLFA
ECBA
DBA
1.0
0.12
tractor with R55 As shown in Figure 4 FE- DRACE maintains strong detection performance across
0.8
0.10
0.6
0.08
all datasets. For untargeted attacks, the TPR remains
0 0.06
0.4
above 0.98, while the FPR stays below 0.07. For tar- geted attacks such as TLFA and ECBA, TPR is consis- tently between 0.97 and 0.99, with FPR between 0.02 and 0.03. Even under the more challenging DBA at- tack, TPR stays above 0.97, with only a minor increase
0.04
0.2
0.02
0.0
CPAR Food Imageher
0.00
CFA F0 magehee
(3) True Positive Rate
(b) False Posilive Rate
Figure 4: FEDRACE under ResNet-152.

---

in FPR. These results confirm that HStat-Net ensures robust detection across different backbone models, making FEDRACE independent of specific feature extractors.
Evaluation of Parameters. Table 7 presents the impact of two key parame- ters in TEDRACE: the client subset size | and the number of voting steps K. The results show that smaller sub- sizes, such as n/4, generally lead to lower detection performance. For example, under the DBA attack with K = n/2, the TPR is 0.887 when [ n/4, while it improves to 0.968 when the subset size increases to n/2. Further increasing the subset size to 3 does not consistently yield better performance and sometimes re- sults in higher FPR. Across different attacks, the best trade-off achieved
Table 7: Detection performance of FEDRACE under differ-
ent parameter settings.
|
K
Min-Max
TLFA
DBA
TPR
FPR
TPR
FPR
TPR
FPR
n/4
0.883
0.167
0.862
0.178
0.843
0.192
n/3
0.902
0.152
0.887
0.156
0.868
0.173
n/1
n/2
0.923
0.128
0.901
0.143
0.887
0.165
2n/33
0.938
0.113
0.917
0.128
0,902
0.149
3n/4
0,942
0.108
0.922
0.122
0,908
0.142
n/4
0.943
0.103
0.921
0.087
0.903
0.142
n/3
0.968
0.084
0.952
0.043
0.941
0.118
n/2
n/2
0.987
0.072
0.973
0.012
0.101
2n/33
0.992
0.066
0.981
0.008
0.975
0.088
3n/4
0.994
0.063
0.984
0.007
0.978
0.082
n/4
0.932
0.142
0.913
0.092
0.892
0.157
n/3
0.958
0.112
0.937
0.063
0.923
0.138
3n/4
n/2 0.975
0.096
0.952
0.045
0.943
0.127
when both | and K are set to n//2, which provides high TPR and a low FPR. These findings indicate that a moderate subset size and a balanced number of detection steps sufficient ensure reliable performance without introducing unnecessary overhead.
2n/3
0.981
0.092
0.958
0.042
0.948
0.122
3n/4
0.983
0.088
0.961
0.038
0,951
0.118
Impact of Data Heterogeneity, We evaluate the effect of data heterogeneity by varying the Dirichlet concen- tration parameter & on Tiny ImageNet. As shown in Figure we consider three settings: extreme non-IID (a = 0.I), moderate non-IID (a 0.5), and near-IID (a 0.9). Across all settings and attack types, FE- DRACE consistently achieves true positive rate of least 0.968, indicating strong detection performance even under severe distribution shifts. Moreover, the false positive rate decreases as a increases, suggesting that more balanced data distributions improve detection precision by reducing semantic divergence across clients.
MinMMx
IPMA
TLFA
ECBA
DBA
1.0
0.12
0.8
0.10
0.6
x 0.08
0.08
0.4
0.04
0.2
0.02
0.0
0.00
D.s
(a) True Positive Rate
(b) False Positive Rate
Figure 5: Detection performance under dif- ferent non-IID settings.
Robustness to Attack Scale. To assess robustness un- der varying attack intensity, vary the number of mali- cious clients M on Tiny ImageNet, testing with M (12.5%), M = 16 (25%), and M 24 (37.5%) out of 64 total clients. As shown in Figure 6 ACDRACE maintains TPR above 0.97 across all scenarios and attack types. Although the FPR slightly increases with larger number of attackers, the overall performance remains stable. These results confirm that FEDRACE resilient changes in both data heterogeneity and ad- versarial scale, making it effective in diverse federated learning environments.
Mi-Max
IPMA
TLFA
ECBA
DBA
1.0
0.12
0.10
0.8
0.08
0.6
0.06
0.4
0.04
0.2
0.02
0.0
M=16
0.00
W=B
(a) True Positive Rate
(b) False Positive Rate
Figure 6: Detection performance under dif-
ferent numbers of malicious clients.
Conclusions and Limitations
In conclusion, FEDRACE is robust FL franework that integrates HStat-Net for representation learning with GLM-based deviance analysis for secure client evaluation. It leverages pre-trained models to improve generalization and identifies malicious clients through statistical residuals. While effective for classification tasks, extending this framework to domains such as text generation or retrieval requires strategies for semantic representation. Future work will focus on adapting the model to support broader tasks and enabling robust, multi-modal FL diverse settings.
10

---

References
[1] Brendan McMahan, Eider Moore, Daniel Ramage, Seth Hampson, and Blaise Aguera y Arcas. Communication- learning of deep networks from decentralized data. In Proceedings of the International Conference on Artificial Intelligence and Statistics (AISTATS), pages 1273- 1282, 2017.
[2] Dinh C. Nguyen, Ming Ding, Pubudu N. Pathirana, Aruna Seneviratne, Jun Li, and H. Vincent Poor. Federated learning for internet of things: A comprehensive survey, IEEE Communications Surveys & Tutorials, 23(3):1622-1658 2021.
[3] Leming Shen, Qiang Yang. Kaiyan Cui, Yuanqing Zheng, Xiao Yong Wei, Jianwei Liu, and Jinsong Han. Fedconv: A bearning-on-mont paradigm for heterogencous federated clients. In Proceedings of the Anmual International Conference Mobile Systems, Applications and Services (MobiSys), pages 398-411, 2024.
[4] Tianlong Yu, Tian Li, Yuqiong Sun, Susanta Nanda, Virginia Smith, Vyas Sekar, and Srinivasan Seshan. Learning context-aware policies from multiple smart homes via federated multi-tase learning. In Proceedings of the ACM/IEEE International Conference on Internet of Things Design and Implementation (IoTDI), pages 104-115, 2020.
[5] Latif U. Khan, Walid Saad, Zhu Han, Ekram Hossain, and Choong Seon Hong. Federated learning for internet of things: Recent advances, taxonomy, and open challenges. IEEE Communications Surveys & Tutorials, 23(3):1759-1799 2021.
[6] Xiaodong Cui, Songtao Lu, and Brian Kingsbury. Federated acoustic modeling for automatic speech recognition. In Proceedings of the IEEE International Conference on Acoustics, Speech, and Signal Processing (ICASSP), pages
2021.
[7] Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agar- wal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, Gretchen Krueger, and llya Sutskever. Learning transferable visual models from natural language supervision. In Pro- ceedings of the International Conference Machine Learning (ICML), pages 8748-8763, 2021.
[8] Jacob Devlin, Ming-Wei Chang, Kenton Lee, and Kristina Toutanova. Bert: Pre-training of deep bidirectional transformers for language understanding. In Proceedings of the Conference of the North American Chapter of the Association for Computational Linguistics (NAACL), pages 4171-4186. 2019.
[9] Dongqi Cai, Shangguang Wang. Yaozong Wu, Felix Xiaozhu Lin, and Mengwei Xu. Federated few-shot learning for mobile nlp. In Proceedings of the ACM International Conference on Mobile Computing and Networking (MobiCom), pages 1-17, 2023.
[10] Nguyen Anh Tu, Assanali Abu, Nartay Aikyn, Nursultan Makhanov, Min-Ho Lee, Khiem Le-Huy, and Kok-Seng Wong. Fedfslar: A federated learning framework for few-shot action recognition. In Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision Workshops (WACVW), pages 270-279. 2024.
[11] Alexey Dosovitskiy. An image is worth 16x16 words: Transformers for image recognition at scale. arXiv preprint arXiv:2010.1 1929, 2020.
[12] Gwen Legate, Nicolas Bernier, Lucas Page-Caccia, Edouard Oyallon, and Eugene Belilovsky. Guiding the last layer federated learning with pre-trained models. In Proceedings of the Advances in Neural Information Processing Systems (NeurIPS), pages 69832-69848, 2023.
[13] Gang Yan and Wan Du. Feddial: Adaptive federated learning with hierarchical discriminative network for large pre-trained models. In Proceedings of the ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD), pages 3461-3470, 2025.
[14] Keita Kurita, Paul Michel, and Graham Neubig. Weight poisoning attacks on pre-trained models. In Proceedings of the Annual Meeting of the Association for Computational Linguistics (ACL), pages 2793-2806, 2020.
11

---

[15] Linyang Li, Demin Song, Xiaonan Li, Jichang Zeng, Ruotian Ma, and Xipeng Qiu. Backdoor attacks on pre-trained models by layerwise weight poisoning. In Proceedings of the Conference on Empirical Methods in Natural Longuage Processing (EMNLP), pages 3023-3032, 2021.
[16] Yuanhao Ban and Yinpeng Dong. Pre-trained adversarial perturbations. In Proceedings of Advances in Neural Information Processing Systems (NeurIPS), pages 1196-1209, 2022.
[17] Cong Xie, Oluwasanmi Koyejo, and Indranil Gupta. Fall of empires: Breaking byzantine- tolerant sgd by inner product manipulation. In Proceedings of the Conference on Uncertainty in Artificial Intelligence (UAI), pages 261-270, 2020.
[18] Chulin Xie, Keli Huang, Pu Chen, and Bo Li. Dba: Distributed backdoor attacks against federated learning. In Proceedings of the International Conference on Learning Representations (ICLR), 2020.
[19] Dong Yin, Yudong Chen, Ramchandran Kannan, and Peter Bartlett. Byzantine-robust distributed learning: Towards optimal statistical rates. In Proceedings of the International Conference on Machine Learning (ICML), pages 5650-5659, 2018.
[20] Peva Blanchard, El Mahdi EI Mhamdi, Rachid Guerraoui, and Julien Stainer. Machine learning with adversaries: Byzantine tolerant gradient descent. In Proceedings of Advances in Neural Information P Processing Systems (NeurIPS), pages 118-128, 2017.
[21] Ehsanul Kabir, Zeyu Song, Md Rafi Ur Rashid, and Shagufta Mehnaz. Flshield: A validation- based federated learning framework defend against poisoning attacks. In Proceedings of the IEEE Symposium on Security and Privacy (S&P), pages 2572-2590, 2024.
[22] Atul Sharma, Wei Chen, Joshua Zhao, Qiang Qiu, Saurabh Bagchi, and Somali Chaterji. Flair: Defense against model poisoning attack in federated learning. In Proceedings of the ACM ASIA Conference on Computer and Communications Security (ASIACCS), pages 553-566, 2023.
[23] Virat Shejwalkar and Amir Houmansadr. Manipulating the byzantine: Optimizing model poisoning attacks and defenses for federated learning. In Proceedings of the Network and Distributed System Security (NDSS) Symposium, 2021.
[24] Gang Yan, Hao Wang, Xu Yuan, and Jian Li. Enhancing model poisoning attacks to byzantine- robust federated learning via critical learning periods. In Proceedings of the International Symposium on Research in Attacks, Intrusions and Defenses (RAID), pages 596-512, 2024.
[25] Yann Le and Xuan Yang. Tiny imagenet visual recognition challenge. CS 231N Course Project, 2015.
[26] Fan Lai, Yinwei Dai, Sanjay Singapuram, Jiachen Liu, Xiangfeng Zhu, Harsha Madhyastha, and Mosharaf Chowdhury. Fedscale: Benchmarking model and system performance of federated learning at scale. In Proceedings of the International Conference on Machine Learning (ICML), pages 11814 11827, 2022.
[27] Lukas Bossard, Matthieu Guillaumin, and Luc Van Gool. components with random forests. In Proceedings of the European Conference on Computer Vision (ECCV), pages 446-461, 2014.
discriminative
[28] Alex Krizhevsky and Geoffrey Hinton. Learning multiple layers of features from tiny images. Technical Report, University of Toronto, 2009.
[29] Gilad Baruch, Moran Baruch, and Yoav Goldberg. A little is enough: Circumventing defenses for distributed learning. In Proceedings of Advances in Neural Information Processing Systems (NeurIPS), 2019.
[30] Minghong Fang, Xiaoyu Cao, Jinyuan Jia, and Neil Gong. Local model poisoning attacks to byzantinerrobust federated learning. In Proceedings of the USENIX Security Symposium (USENIX Security), pages 1605-1622. 2020.
[31] Arjun Nitin Bhagoji, Supriyo Chakraborty, Prateek Mittal, and Seraphin Calo. Analyzing federated learning through an adversarial lens. In Proceedings of the International Conference on Machine Learning (ICML), pages 634-643, 2019.
12

---

[32] Ziteng Sun, Peter Kairouz, Ananda Theertha Suresh, and H. Brendan McMahan. Can you really backdoor federated learning? arXiv preprint, arXiv:1911.07963, 2019.
[33] Zheyi Chen, Pu Tian, Weixian Liao, and Wei Yu. Towards multi--arty targeted model poisoning attacks against federated learning systems. Highh-Cnnfdence Computing, 1(1), 2021.
[34] Vale Tolpegin, Stacey Truex, Mehmet Emre Gursoy, and Ling Liu. Data poisoning attacks against federated learning systems. In Proceedings of the European Symposium on Research in Computer Security (ESORICS), pages 480-501, 2020.
[35] Eugene Bagdasaryan, Andreas Veit, Yiqing Hua, Deborah Estrin, and Vitaly Shmatikov. How to backdoor federated learning. In Proceedings of the International Conference on Artificial Intelligence and Statistics (AISTATS), pages
2020.
[36] Hongyi Wang. Kartik Sreenivasan, Shashank Rajput, Harit Vishwakarma, Saurabh Agarwal, Jy-yong Sohn, Kangwook Lee, and Dimitris Papailiopoulos. Attack of the tails: Yes, you really can backdoor federated learning. In Proceedings of Advances in Neural Information Processing Systems (NeurIPS), pages 16070-16084, 2020.
[37] Thien Due Nguyen, Phillip Rieger, Huili Chen, Hossein Yalame, Helen Möllering, Hossein Fereidooni, et al. Flame: Taming backdoors in federated learning. In Proceedings of the USENIX Security Symposium (USENIX Security), pages 1415-1432, 2022.
[38] Eugene Bagdasaryan and Vitaly Shmatikov. Blind backdoors in deep learning models. In Proceedings of the USENIX Security Symposium (USENIX Security), pages 1505-1521, 2021.
[39] Lie He, Sai Praneeth Karimireddy, and Martin Jaggi. Byzantine-robust learning on heteroge- neous datasets via resampling. 2020.
[40] Cong Xie, Oluwasanmi Koyejo, and Indranil Gupta. Generalized byzantine-tolerant sgd. arXiv preprint, 10X.:v11002.10 16, 2018
[41] Matthew Jagielski, Alina Oprea, Battista Biggio, Chang Liu, Cristina Nita-Rotaru, and Bo Li. Manipulating machine learning: Poisoning attacks and countermeasures for regression learning. In Proceedings of the IEEE Symposium on Security and Privacy (S&P), pages 19-35, 2018.
[42] Gang Yan, Hao Wang, Xu Yuan, and Jian Li. Fedrola: Robust federated learning against model poisoning via layer-based aggregation. In Proceedings of the ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD), pages 3667-3678, 2024.
[43] Anqi Zhou, Yezheng Liu, Yidong Chai, Hongyi Zhu, Xinyue Ge, Yuanchun Jiang, and Meng Wang. A whole-process certifiably robust aggregation method against backdoor attacks in federated learning. arXiv preprint, arXiv:2407.00711 2024.
[44] Marvin Xhemrishi, Johan Östman, Antonia Wachter-Zeh, and Alexandre Graell Amat. Fedgt: Identification of malicious clients in federated learning with secure aggregation. IEEE Transac- tions on Information Forensics and Security, 2025.
[45] Wei Wan, Shengshan Hu, Jianrong Lu, Leo Yu Zhang, Hai Jin, and Yuanyuan He. Shielding federated learning: Robust aggregation with adaptive client selection. In Proceedings of the International Joint Conference Artificial Intelligence (IICAI), pages 753-760, 2022.
[46] Martin Abadi, Andy Chu, Ian Goodfellow, H Brendan McMahan, Ilya Mironov, Kunal Talwar. and Li Zhang. Deep learning with differential privacy. In Proceedings of the ACM SIGSAC Conference on Computer and Communications Security (CCS), pages 308-318. 2016.
[47] Peter Kairouz, H. Brendan McMahan, Brendan Avent, Aurélien Bellet, Mehdi Bennis, Ar- jun Nitin Bhagoji, et al. Advances and open problems in federated learning. Foundations and Trends in Machine Learning, 14(1):1-210, 2021.
[48] Florian Schroff, Dmitry Kalenichenko, and James Philbin. Facenet: A unified embedding for face recognition and clustering. In Proceedings of the IEEE/CVE Conference on Computer Vision and Pattern Recognition (CVPR), pages 815-823, 2015.
13

---

[49] Yandong Wen, Kaipeng Zhang, Zhifeng Li, and Yu Qiao. A discriminative feature learning approach for deep face recognition. In Proceedings of the European Conference on Computer Vision (ECCV), pages 499-515, 2016.
[50] Tian Li, Anit Kumar Sahu, Ameet Talwalkar, and Virginia Smith. Federated learning: Chal- lenges, methods, and future directions. IEEE Signal Processing Magazine, 37(3):50-60, 2020.
[51] Jaehoon Oh, Sangmook Kim, and Se- YouYoung Yun. Fedbabu: Toward enhanced representation for federated image classification. In Proceedings of the International Conference on Learning Representations (ICLR), 2022.
[52] Rong Dai, Li Shen, Fengxiang He, Xinmei Tian, and Dacheng Tao. Dispfi: Towards communication-effiicn personalized federated learning via decentralized sparse training. In Proceedings of the International Conference on Machine Learning (ICML), pages 4587 4604, 2022.
[53] R.A. Fisher. The use of multiple measurements in taxonomic problems. Annals of Eugenics, pages 179-188, 1936.
[54] Chandra Shekhar Dhir and Soo Young Lee. Hybrid feature selection: Combining fisher criterion and mutual information for efficient feature selection. In Proceedings of the International Conference on Neural Information (ICONIP), pages 613-620 2008.
[55] Pablo A. Estévez, Michel Tesmer, Claudio A. Perez, et al. Normalized mutual information feature selection. IEFE Transactions on Neural Networks, pages 189-201, 2009.
[56) Xiaoyu Cao, Minghong Fang, Jia Liu, and Neil Zhenqiang Gong. Fltrust: Byzantine-robust federated learning via trust bootstrapping. In Proceedings of the Network and Distributed System Security (NDSS) Symposium, 2021.
[57] MacCullagh and J. A. Nelder. Generalized Linear Models. Monographs on Statistics and Applied Probability, 1989.
[58] Christopher M. Bishop and Nasser M. Nasrabadi. Pattern Recognition and Machine Learning. Springer, 2006.
[59] Alan Agresti. Foundations of Linear and Generalized Linear Models. John Wiley & Sons, 2015.
[60] V. Chandola, A. Banerjee, and V. Kumar. Anomaly detection: A survey. ACM Computing Surveys (CSUR), 41(3):1-58, 2009.
[61] Adam Paszke, Sam Gross, Francisco Massa, Adam Lerer, Bradbury, et al. Pytorch: An imperative style, nigh-performance deep learning library. In Proceedings of Advances in Neural Information Processing Systems (NeurIPS), volume 32, pages 8026-8037, 2019,
[62] Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large-scale hierarchical image database. In Proceedings of the IEEF/CVE Conference Computer Vision and Pattern Recognition (CVPR), pages 248-28882 255, 2009.
[63] Kaiming He, Xiangyu Zhang. Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Proceedings of the IEEE/CVE Conference on Computer Vision and Puttern Recognition (CVPR), pages 770-778, 2016
[64] Dung Thuy Nguyen, Tuan Nguyen, Tuan Anh Tran, Khoa D. Doan, and Seng Wong. Iba: Towards inreversible backdoor attacks in federated learning. In Proceedings of Advances in Neural Information Processing Systems (NeurIPS), pages 66364-66376, 2023.
[65] Hangfan Zhang, Jinyuan Jia, Jinghui Chen, Lu Lin, and Dinghao Wu. A3f1: Adversarially adap- tive backdoor attacks to federated learning. In Proceedings of Advances in Neural Information Processing Systems (NeurIPS), pages 61213-61233 2023.
[66] Alan Agresti and David B. Hitchcock. Bayesian inference for categorical data analysis. Statisti- cal Methods and Applications, pages 297-330, 2005.
[67] Annette J. Dobson and Adrian G. Barnett, An Introduction to Generalized Linear Models. Chapman & Hall/CRC, 2018.
14

---

NeurIPS Paper Checklist
Claims
Question:
Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification: The abstract and introduction clearly state the contributions of the paper, including the integration of HStat-Net and DevGuard in unified framework for robust federated learning. These claims are supported by both theoretical analysis and empirical results (Sections)
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made in the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or
NA answer to this question will not perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results
be expected to generalize other settings.
is fine to include aspirational goals as motivation as long is clear that these goals are not attained by the paper.
2. Limitations
Question: Does the paper discuss the limitations of the work performed by the authors? Answer: [Yes]
Justification: The paper discusses limitations in the conclusion (Section noting challenges in extending the method beyond classification tasks and the need for future work broader modalities and tasks.
Guidelines:
The answer NA means that the paper has limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create separate "Limitations" section in their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect on the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution low or images are taken in low lighting. Or speech-to-text system might not be used reliably provide closed captions for online lectures because it fails handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and faimess.
While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, a worse outcome might be that reviewers discover limitations that aren't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an impor- tant role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.
3. Theory assumptions and proof's
15

---

Question: For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
Answer: [Yes]
Justification: Theoretical results, including the bound on misclassification rate in DevGuard, are stated with assumptions and proven in Appendix. All notations are defined and the derivation is correct.
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated or referenced the statement of any theorems.
The proofs can either appear in the main paper or the supplemental material, but they appear in the supplemental material, the authors are encouraged to provide short proof sketch to provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental result reproducibility
Question: Does the paper fully disclose all the information needed to reproduce the main ex- perimental results of the paper to the extent that affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?
Answer: [Yes]
Justification: The paper includes detailed descriptions of datasets, parameter settings, model architectures, and evaluation protocols in Section 4 enabling reproducibility.
Guidelines:
The answer NA means that the paper does not include experiments.
If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is a novel architecture, describing the architecture fully might suffice, or if the contribution a specific model and empirical evaluation, may be necessary to either make it possible for others to replicate the model with the same dataset, or provide access to model. In general. releasing code and data often one good way to accomplish this, but reproducibility instructions for how to replicate the results, access to a hosted model (c.g., in the case of large language model), releasing of a model checkpoint, other means that appropriate to the research performed.
also be provided via detailed
While NeurlPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) If the contribution is primarily a new algorithm, the paper should make clear how to reproduce that algorithm.
(b) If the contribution is primarily new model architecture, the paper should describe the architecture clearly and fully.
(c) If the contribution is a new model (e.g., a large language model), then there should either way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset or instructions for how to construct the dataset).
(d) We recognize that reproducibility may tricky in some cases, in which case authors are welcome describe the particular way they provide for reproducibility. the case of closed-source models, it may be that access to the model is limited in
16

---

some way (e.g., to registered users), but it should be possible for other researchers have some path reproducing or verifying the results.
5. Open access to data and code
Question: Does the paper provide open access to the data and code, with sufficient instruc- tions faithfully reproduce the main experimental results, described in supplemental material?
Answer: [Yes]
Justification: All datasets used in this study publicly available, including CIFAR- 100, Food-101, and Tiny ImageNet. Upon acceptance, we will release the source code, training scripts, and detailed instructions as part of the supplementary material. Replication procedures and dataset specifications are provided in the main paper.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurIPS code and data submission guidelines (https://nips... cc/
public/guides/ Statee///DooSSuuiisssoooooo.
for more details.
While encourage the release of code and data, we understand that this might not be possible, so "No" is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurIPS code and data submission guidelines (https
/ mtijps.cc/uullccgguicce
wttpSSubbbiiiioooooooooooo.o.o for more details.
The authors should provide instructions data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. only subset of experiments are reproducible, they should state which ones are omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information as possible in supplemental material (appended to the paper) recommended, but including URLs to data and code permitted.
6. Experimental setting/details
Question: Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary understand the results?
Answer: [Yes]
Justification: The paper specifies all hyperparameterss training settings, client configurations, data partitioning methods, and evaluation metrics Section 4
Guidelines:
The answer NA means that the paper does include experiments.
The experimental setting should be presented the core the paper to level of detail that is necessary to appreciate the results and make sense of them.
The full details can be provided either with the code, in appendix, supplemental material.
7. Experiment statistical significance
Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Answer: [Yes]
Justification: Results include standard deviations over multiple seeds (four runs) and are reported for each metric in Tables 4
Guidelines:
The answer NA means that the paper does not include experiments.
17

---

The authors should answer "Yes" if the results are accompanied by error bars, confi- dence intervals, or statistical significance tests, least for the experiments that support the main claims of the paper.
The factors of variability that the error bars capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall
with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
The assumptions made should be given (e.g., Normally distributed errors).
It should be clear whether the error bar is the standard deviation the standard error of the mean.
It is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful not to show in tables figures symmetric error bars that would yield results that are out range (e.g. negative error rates).
If error bars are reported in tables or plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables in the text.
8. Experiments compute resources
For each experiment, does the paper provide sufficient information on the com- puter resources (type of compute workers, memory, time execution) needed to reproduce the experiments?
Question:
Answer: [Yes]
Justification: The paper reports that experiments were run on NVIDIA RTX A4500 GPUs and deseribes the scale of experiments in Section
Guidelines:
The answer NA means that the paper does not include experiments.
The paper should indicate the type of compute workers CPU or GPU, internal cluster, or cloud provider, including relevant memory and storage.
The paper should provide the amount compute required for each of the individual experimental runs well estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't make into the paper).
9. Code ethics
Question: Does the research conducted the paper conform, in every respect, with the NeurlPS Code of Ethics :tttps://neurpps. hwtp:pp....ccc..c//ccccccccaaaaa
Answer: [Yes]
Justification: The work complies with the NeurIPS Code Ethics. It uses publicly available datasets and does not involve human subjects, sensitive content, or deployment.
Guidelines:
The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.
If the authors answer No, they should explain the special circumstances that require deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g., there a special consid- eration due to laws regulations in their jurisdiction).
10. Broader impacts
Question: Does the paper discuss both potential positive socictal impacts and negative societal impacts of the work performed?
Answer: [Yes]
Justification: While the main focus on system robustness, the paper includes discussion of potential societal implications, such as improving privacy and security in distributed systems and the risk of misuse for model manipulation.
18

---

Guidelines:
The answer NA means that there no societal impact of the work performed.
If the authors answer NA or No, they should explain why their work has no societal impact why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (c.g.. deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is a direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.
If there negative societal impacts, the authors could also discuss possible mitigation strategies (c.g., gated release models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms to monitor how system learns from feedback over time, improving the efficiency and accessibility of MI..
11. Safeguards
Does the paper describe safeguards that have been put in place for responsible release of data models that have high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Question:
Answer: [NA]
Justification: The paper does not release any new generative models or high-risk datasets that would require safeguards.
Guidelines:
The answer NA means that the paper poses no such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make best faith effort.
12. Licenses for existing assets
Question: Are the creators or original owners of assets (c.g.. code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?
Answer: [Yes]
Justification: All datasets (CIFAR-100, Food-101, Tiny ImageNet) and models (CLIP, ResNet-152) used the paper are publicly available and cited with proper attribution and licensing.
Guidelines:
The answer NA means that the paper does not use existing assets.
The authors should cite the original paper that produced the code package or dataset.
The authors should state which version of the asset is used and, if possible, include URL.
The name of the license (e.g., CC-BY 4.0) should be included for each asset.
19

---

For scraped data from a particular source (e.g., website). the copyright and terms of service of that souree should be provided.
assets are released, the license, copyright information, and terms use in the package should be provided. For popular datasets, paperssi thcode cwm datasets has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided. If this information is not available online, the authors are encouraged to reach out to the asset's 's creators.
13. New assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [NA]
Justification: The paper does not introduce new datasets or models; builds upon existing architectures and datasets.
Guidelines:
The answer NA means that the paper does not release new assets.
Researchers should communicate the details of the dataset/code/model as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent was obtained from people whose asset is used.
At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.
14. Crowdsourcing and research with human subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and sereenshots, if applicable, as well as details about compensation (if any)?
Answer: [NA]
Justification: The research does involve crowdsourcing human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with
human subjects.
Including this information the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then much detail as possible should be included the main paper.
According to the NeurIPS Code of Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional review board (IRB) approvals or equivalent for research with human subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?
Answer: [NA]
Justification: The work does not involve human subjects and thus does not require IRB approval.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Depending on the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
20

---

We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors adhere the NeurIPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.
16. Declaration of LLM usage
Question:
Does the paper describe the usage of LLMs if it is important, original, or non-standard component of the core methods this research? Note that the LLM used only for writing, editing, or formatting purposes and does not impact the core methodology, scientific rigorousness, or originality of the research, declaration is not required.
Answer: [NA]
Justification: LLMs were not used as part of the method development. They may have been used for minor writing support, but not for any scientific content or experiments.
Guidelines:
The answer NA means that the method development in this research does not involve LLMs as any important, original, or non stn-sttndard components.
Please refer to our LLM policy for what should or should be described.
21

---

A
Appendix
A.1 Algorithm Overview of the Multi-step Voting
Algorithm 1 Multi-step Voting
Require: Client set A((,) voting steps K, subset size
Ensure: Detection results indicating malicious clients
1: Initialize Votes <- zeros with | 1/1
2: for 1 to K do
3: sub RandomSelect(AV1)) I. subco
4: for each class c do
5: ggoobal + median (rg E
6:
end for
7:
for each client i E ((()) do
8:
for each class e do
9:
A +- 1--210 log (Df) end for
11:
A; + -E A; log 44)
12:
end for
13: Sort residuals: Ap S ... S [n)
14: For each candidate threshold {1...., n). compute estimates: JB,.z P.M.ps and o
4o²
15:
Select adaptive threshold pæ: < arg minp (HM
16:
for each client E (/(1) do if A A [a,] then
17:
18:
Votes i f- Votes ( +1
19: end
20: end for
21: end for
22: Declare clients malicious: M (i Votes[i] }
23: Perform global aggregation using benign clients:
1
Σ
|
iENTOM
A.2 Details for Equation 16
In this work, we treat the task net h in HStat-Net as Generalized Linear Model, where feature representations refined by the statistical net are linearly transformed and passed through softmax function to produce class probabilities. The linearly separable representation space generated by statistical net s renders the task net equivalent
multinomial logistic regression. Following previous works [57] 666 667, we analyze model fit using deviance residuals, which quantify the model's ss alignment with expected prediction.
For each aggregated global representation Global of class the true class label is denoted by the indicator variable yf:
1, if global representation belongs to class c;
of
(21)
0, otherwise.
The task net trained on client predicts the probability that representation global belongs to class c, denoted by oc. The likeiiild function of the trained task net for representation r global is:
C
L
Σ
of log((f)) log(ff))
(22)
1=1
22

---

which resembles the log- legeliklihood of multinomial logistic regression in the GLM framework. Assume saturated model that perfectly fits the representation, where the predicted probabilities match the observed labels, which are one-hot encoded:
Or saturatee Vrr
(23)
Then, the log-likelhhod for the saturated model is:
I saturated
Σ Ue log (are = log
(24)
Since yf is either or 1, and log(1) = O, only the terms where yf contribute, leading to a log-likelihood of zero for the saturated model:
L Sanurated
(25)
The deviance residual of is defined as twice the difference between the log-likelihoods of the saturated model and the task net:
a 2(L L -24
(26)
The deviance residual for each representation on task net is given by:
A = - log(Af)
(27)
This shows that the deviance residual for each observation depends solely on the predicted probability of the true class. A larger deviance residual indicates worse fit for that representation, potentially signaling malicious activity on client i's task net.
A.3 Proof of Theorem
Proof. Our detection algorithm sorts clients based on their deviance residuals A, We aim to determine threshold T such that clients with A, S are classified as benign, and clients with A; > T are classified as malicious. To analyze the misclassification rates, we define the following:
(i) The false positive rate (FPR) is the probability that benign client is misclassified malicious:
FPR = P(A, T E B).
(ii) The false negative rate (FNR) is the probability that malicious client is misclassified as benign:
FNR = P(A; T i M).
Our goal is to choose the threshold T that minimizes the total misclassification rate (TMR), defined as
TMR nT FPR πM FNR,
where πB = 1 TM is the proportion of benign clients.
Since we do not assume specific distribution for the deviation residuals, apply Chebyshev's inequality to bound the probabilities of misclassification, For any random variable X with expected value y and variance o², Chebyshev's inequality states that for any 5 > 0,
P( - μl 2 8) 82
Applying Chebyshev's inequality to the deviation residuals:
For benign clients:
d²
8² P(IA: 14l 2 δ B S
For malicious clients:
g² 82
P(IaM - A 1 <
We choose the threshold T as the midpoint between the expected residuals of benign and malicious clients:
T PB + μM
23

---

This choice sets 8 == MM Substituting d into the bounds:
40
FPR I
(HM - PB)2
40²
FNR <
(PM 1B8)
Therefore, the total misclassification rate is bounded by
4
TMR = TB FPR - TM ENR
(WM- PB)2
This bound shows that the total misclassification rate decreases as the square of the difference between the mean residuals increases. Specifically, as the separation μ.M Ag becomes larger relative to the variance o², the misclassification rate approaches zero.
24


Reviews:
[{"review_id": "lnLIB8dbeT", "reviewer": "Reviewer_Bboy", "summary": "This work aims to tackle the security gaps that arise when federated learning systems speed up training by freezing most parameters of large pre-trained models. While the partial fine-tuning strategy is efficient, it leaves current defenses unable to counter backdoor, data-poisoning, and untargeted attacks, especially under non-IID client data. To tackle such challenges, this work proposes FedRACE, which combines two complementary components to restore robustness without sacrificing accuracy or efficiency. On each client, the hierarchical HStat-Net refines the frozen features and enforces triplet-loss constraints so that legitimate representations cluster tightly and remain linearly separable from malicious ones. On the server, DevGuard performs generalized-linear-model deviance analysis with adaptive thresholds to spot and exclude adversarial updates. The authors conduct comprehensive experiments to demonstrate the effectiveness of the proposed approaches.", "questions": "See strengths and weaknesses.", "limitations": "See strengths and weaknesses.", "rating": 4, "confidence": 2, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "**Strengths**\n\n1. This work seems novel in integrating representation refinement and security filtering within one federated-learning pipeline, where HStat-Net compresses frozen-backbone activations into near-linearly separable embeddings on each client, curbing semantic drift.\n\n2. FedRACE is scalable and independent of the backbone model. It preserves almost the same detection performance when CLIP ViT is replaced by ResNet 152, and its server-side complexity grows only linearly with the number of clients.  \n\n3. This work provides a theoretical analysis of the error boundary.\n\n**Weaknesses**\n\n1. The work restricts itself to a two-stage triplet-loss training regime and omits comparisons with alternative representation-learning strategies; contemporary self-supervised methods such as SimCLR and Barlow Twins often yield superior feature separability without requiring hard-negative mining, so the absence of these baselines leaves the optimality of the chosen objective uncertain.\n\n2. Limited baseline comparison: The work does not compare the proposed FedRACE against recent model-output consistency detector approaches (e.g., FedDetect, FL-GPR) or hierarchical weight-auditing approaches, which may overstate its relative performance gains.\n\n3. The work provides neither a thorough discussion nor empirical evidence on privacy and communication overhead. DevGuard compels each client to transmit its class-centroid vectors, and these low-dimensional embeddings may leak information about the client’s label distribution while consuming additional bandwidth. Yet the authors do not quantify the resulting privacy risk or extra communication cost.", "was_revised": true, "final_justification": "The authors have addressed most of my concerns.", "rebuttal": "Thank you for your detailed and constructive feedback.\n\nQ1. … two-stage training…alternative representation-learning baselines…\n\nAnswer: In the paper, we show that the two-stage training of HStat Net improves feature quality, as measured by Fisher’s Criterion and Mutual Information. Table 2 reports a $3.34\\times$ improvement in Fisher’s Criterion and a $2.02\\times$ increase in Mutual Information. These results indicate that hierarchical refinement creates a more structured and linearly separable feature space. The two-stage procedure trains the Statistical Net s and the Task Net h in separate steps. This reduces interference between the two modules and supports stable convergence. It also allows new clients to join more easily, since in many cases fine-tuning only the Task Net h is sufficient to reach strong performance, as shown in Table 3.\n\nTo add a new baseline, we carried out an additional experiment with SimCLR. In this setting, clients pre-train a backbone with SimCLR augmentations, then fine-tune the task head and apply DevGuard under the DBA threat model on CIFAR 100. With HStat Net, FedRACE achieves 77.21% accuracy, 0.36% backdoor accuracy, a 96.8% true positive rate, and a 10.1% false positive rate. When HStat Net is replaced by SimCLR features, accuracy decreases to 75.36%, backdoor accuracy increases to 1.5%, and the true positive rate drops to 93.7%. These results confirm that HStat Net yields higher quality class features than SimCLR in this setting.\n\nQ2.  …comparison with model-output consistency detectors…\n\nAnswer: In the paper, we compare FedRACE with established defenses such as Multi-krum, Trimmed-mean, FedRoLA, FLAIR, and FLShield. Table 4 shows that FedRACE consistently outperforms these methods across multiple attack scenarios. To further evaluate recent consistency-based defenses, we conducted additional experiments with FL GPR and FedDetect under the DBA threat model on CIFAR 100. FedRACE achieves 77.21% accuracy with 0.36% backdoor accuracy. In comparison, FL GPR achieves 74.57% accuracy with 3.18% backdoor accuracy, and FedDetect achieves 75.82% accuracy with 2.33% backdoor accuracy. These results demonstrate that FedRACE provides stronger robustness than these consistency-based detectors.\n\nQ3. …privacy…communication cost….\n\nAnswer: In additional experiments we measured privacy leakage from class centroid sharing on CIFAR 100 using a membership inference attack. With partial fine tuning only, the attacker success rate was 63.82%. When using FedRACE, this rate decreased to 48.37%. This confirms that sharing class centroids exposes less information than sending raw weight updates.\nTwo design choices explain why FedRACE limits membership inference. First, class centroids aggregate feature vectors over all samples in a class, which dilutes the influence of any single example and removes individual patterns that an attacker could exploit. Second, HStat Net’s projection layer together with the frozen backbone produces features that capture global class structure rather than memorizing specific inputs. Because the Statistical Net sees only aggregated class data and the Task Net is not over optimized on individual samples, overfitting is reduced. As a result, membership inference, which relies on detecting overfitted or unique sample behaviors, becomes less effective under our framework.\n\nIn Section 3.1, we explain how HStat Net adds a compact projection layer on top of the frozen feature extractor to refine representations. In Section 3.2 we describe how DevGuard fits a generalized linear model to the Task Net outputs to compute deviance based consistency scores. This design keeps client computation light and avoids heavy on device processing. We also measured the communication cost per round. FedRACE requires each client to upload one centroid vector for each class it holds. In the worst case a client holds all 100 classes. Each centroid vector has 256 dimensions ($d = 256$ in Section 4.1) and each entry uses 4 bytes, which adds about 0.10MB. In practice most clients hold fewer classes, so the actual upload cost is lower. Even in the worst case the extra 0.10MB is small compared to typical uplink capacity.\n\nThank you again for your thoughtful comments."}, {"review_id": "fgrEmesRjj", "reviewer": "Reviewer_XaDr", "summary": "This paper addresses the security vulnerabilities that arise in federated learning when using a partial fine-tuning approach with large pre-trained models, where the model backbone is frozen and only a task head is trained. To counter these new risks, the authors propose FEDRACE, a hierarchical and statistical framework for robust FL. The framework consists of a client-side hierarchical network that uses a triplet loss to refine features from the frozen backbone into more compact and linearly separable representations, and a server-side mechanism that detects malicious clients by modeling the task head as a generalized linear model (GLM) and evaluating the statistical deviance of client predictions against global class representations. DevGuard's reliability is further enhanced by an adaptive thresholding strategy based on theoretical misclassification bounds and a randomized majority voting process. The authors evaluate their method on CIFAR-100, Food-101, and Tiny ImageNet against various attack scenarios, demonstrating its superiority.", "questions": "1. Sharing class-wise centroids could potentially leak information about local data distributions. Does this practice violate the privacy-preserving principles of federated learning or introduce additional privacy risks?\n\n2. While the proposed method improves robustness, it also increases computational overhead. Can the authors provide a quantitative comparison of FEDRACE's runtime against baseline defenses, especially regarding computational costs when scaling to large numbers of clients (e.g., N > 100)?\n\n3. Considering that attackers may gain partial knowledge of the DevGuard detection mechanism, how robust is DevGuard against adaptive attacks, such as malicious clients intentionally aligning their predictions with benign clients' semantic distributions, or colluding attackers coordinating their local centroids to evade detection?\n\n4. The paper selects d=256 as the output dimension of the statistical network. What is the rationale behind this choice? Have ablation studies been conducted with different dimensionalities to validate the effectiveness of this setting?", "limitations": "yes.", "rating": 4, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 2, "significance": 3, "originality": 3, "strengths_and_weaknesses": "### Strengths\n- The paper is exceptionally well-written and demonstrates outstanding clarity in presenting its technical contributions. The authors provide lucid explanations of both the HStat-Net architecture and DevGuard mechanism, effectively supported by rigorous mathematical formulations and well-designed visual aids.\n\n- This work makes significant conceptual contributions through its novel integration of hierarchical representation learning with statistical deviance analysis, explicitly addressing the unique security challenges of partially frozen models in federated learning. The innovative use of GLMs for semantic consistency evaluation, coupled with the theoretically grounded adaptive thresholding mechanism, represents a substantial advancement beyond conventional gradient-based defense approaches.\n\n- The evaluation encompasses multiple datasets, diverse attack types, and varying degrees of data heterogeneity, convincingly demonstrating the robustness of the proposed approach in realistic FL scenarios.\n\n### Weaknesses\n- The validity of this article is based on the assumption that there is a measurable prediction deviation between the poisoned model and the benign model. However, there are some well-designed attacks (especially backdoor attacks) whose goal is not to cause any behavioral deviation. This fact does challenge the core assumption of the paper. It is necessary for the author to demonstrate the validity of this assumption through some experimental or theoretical analysis.\n\n- The paper primarily compares with classic, relatively early backdoor attack methods, while omitting more recent state-of-the-art (SOTA) approaches, such as IBA and A3FL. These newer attack methods dynamically optimize triggers, which may preserve semantic consistency and thus present different challenges for defense mechanisms.\n\n- The proposed method introduces additional computational costs. On the client side, the two-stage training process involves an extra optimization step for the Statistical Nets using the Triplet Loss function. On the server side, DevGuard employs a K-step majority voting procedure, resulting in a per-round computational complexity of O(KN(C+logN)). While the authors argue that the approach is scalable, the overhead may become a practical concern in FL scenarios with very large numbers of clients (N) and voting steps (K).\n\n- Introducing a new network will inevitably bring new attack surfaces. If the attacker freezes the task network and only targets the statistical network, causing the statistical network to learn the trigger features associated with a specific target class, will this defense mechanism still be effective?\n\n- Moreover, the defense's robustness partially relies on the median for aggregating client-computed centroids, which is effective against uncoordinated outliers. However, it remains unclear how the system would perform against sophisticated attacks, such as malicious clients intentionally aligning their predictions with those of benign clients' semantic distributions, or colluding attackers coordinating their local centroids to evade detection.\n\n- Some hyperparameters, such as the output dimension of the statistical network, lack detailed motivation and empirical analysis. Additional ablation studies are needed to justify the choice of these parameters.", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for your detailed and constructive feedback.\n\nQ1. …privacy of class centroids…\n\nAnswer: In additional experiments we measured privacy leakage from class centroid sharing on CIFAR 100 using a membership inference attack. With partial fine tuning only, the attacker success rate was 63.82%. When using FedRACE, this rate decreased to 48.37%. This confirms that sharing class centroids exposes less information than sending raw weight updates.\nTwo design choices explain why FedRACE limits membership inference. First, class centroids aggregate feature vectors over all samples in a class, which dilutes the influence of any single example and removes individual patterns that an attacker could exploit. Second, HStat Net’s projection layer together with the frozen backbone produces features that capture global class structure rather than memorizing specific inputs. Because the Statistical Net sees only aggregated class data and the Task Net is not over optimized on individual samples, overfitting is reduced. As a result, membership inference, which relies on detecting overfitted or unique sample behaviors, becomes less effective under our framework.\n\nQ2. … computational overhead…large number of clients…\n\nAnswer: We ran new experiments on CIFAR 100 with 128 clients, measuring all runtimes on the same GPU (NVIDIA RTX 4500). For FedRACE, the full two stage local training takes 247ms per client per round on average. The server’s DevGuard step adds 34ms in total. By comparison, FLShield requires about 185ms per client per round for local model updates and 163ms per client per round for server validation on a held out set. These results show that FedRACE provides strong robustness while adding only modest extra computation on the client side and much lower server overhead than FLShield, making it more efficient at large scale. Full runtime results across different baselines will be included in the camera‑ready version.\n\nQ3. … partial knowledge by attackers…colluding attackers…\n\nAnswer: In additional experiments, we evaluated two recent adaptive attacks, IBA and A3FL, under the DBA threat model. Against IBA, FedRACE reduced attack success to 1.4% with a 94.5% true positive rate; against A3FL, attack success dropped to 1.6% with a 93.1% true positive rate.\n\nWe then simulated a stealth backdoor targeting only the Statistical Net ($s$). Each malicious client injected a fixed trigger pattern into a subset of training images, relabeled them with the target class, and updated only $s$ during local two-stage training while freezing the backbone and Task Net ($h$). This left clean accuracy unchanged but forced triggered inputs into feature regions mapped by $h$ to the attacker’s target class. With 25% malicious clients on CIFAR-100, FedRACE achieved a 94.3% true positive rate and a 2.47% attack success rate, while clean accuracy remained 76.95%, owing to the median-based design in Equation (12) and randomized majority voting. Without defense, this attack yielded a 59.6% success rate on triggered inputs.\n\nFinally, in collusion experiments where 25% of clients submitted identical poisoned centroids, randomized majority voting reduced attack success from 45.9% to 9.8%, with an 87.6% true positive rate. These results confirm that attackers cannot evade detection without severely compromising their effectiveness, even with partial knowledge of DevGuard or through collusion. Extended evaluations will be included in the camera ready version.\n\nQ4. …$d=256$…rational…ablation study…\n\nAnswer: We set the Statistical Net output dimension to $d = 256$ to balance representational power and computational cost. A larger dimension captures more class structure but increases centroid size and GLM fitting time, while a smaller dimension reduces overhead but weakens the deviance signal. To validate this choice we ran an additional ablation study on CIFAR 100 with d set to 64, 128, 256, and 512. At $d = 64$, global accuracy was 76.05% and the true positive rate was 94.0%. At $d = 128$, accuracy rose to 76.81% with a true positive rate of 95.5%. At $d = 256$, accuracy reached 77.21% and the true positive rate was 96.8%. At $d = 512$, accuracy was 77.25% and the true positive rate was 97.22%. The gain from 256 to 512 was marginal but doubled both the upload cost and the fitting time. Therefore, $d = 256$ provides the best trade off between robustness and efficiency. The camera ready version will include complete ablation results.\n\nQ5. …assumption…measurable prediction deviation…\n\nAnswer: Our core assumption is that any attack that causes misclassification must alter the model’s conditional class probabilities in a way that deviance residuals can detect. As shown in Tables 4 and 5, we tested this on CIFAR 100 with 64 clients, including 16 malicious clients (25% adversarial rate). We evaluated five backdoor attacks: Min Max, IPMA, TLFA, DBA, and ECBA. In all cases, DevGuard achieved over 95% true positive rate and kept attack success below 1%, while clean accuracy remained high.\nFrom a theoretical perspective, an attacker cannot keep the class wise output distributions for both clean and poisoned inputs identical without duplicating the benign model’s parameters exactly. This is impossible once the attack changes model behavior. As a result, any genuine backdoor necessarily produces nonzero class wise deviance, which supports our assumption.\n\n\nThank you again for your thoughtful comments."}, {"review_id": "KYhQgiR1hz", "reviewer": "Reviewer_LUAW", "summary": "The paper proposes FEDRACE, a federated learning framework designed to improve security of systems using large pre-trained models. Specifically, it targets vulnerabilities introduced by partial fine-tuning, where only a small task-specific head is trained while the backbone feature extractor remains frozen. This approach reduces computational and communication overhead but also makes the system susceptible to adversarial attacks such as poisoned updates and backdoor injections. FEDRACE integrates two core components: HStat-Net, a hierarchical network for refining frozen features, and DevGuard, a server-side mechanism that uses statistical deviance analysis to detect malicious clients. Experimental results show that FEDRACE enhances model robustness and achieves high accuracy while reducing false positive rates under various attack scenarios.", "questions": "1. There appears to be a gap between the problem statement and the proposed method in this paper？ According to the introduction and abstract, the authors focus on security risks in federated learning based on fine-tuning of specific task heads. However, the proposed solution is a federated learning framework that enhances feature extraction capabilities for such fine-tuning, followed by abnormal client detection. The problem section does not address the issues related to classification feature extraction in existing federated learning approaches. Moreover, the abnormal client detection method relies on the output of the trainable statistical projection layer, making it applicable only within the FEDRACE framework. Therefore, the method does not directly correspond to the problem as stated, and its applicability is limited.\n2. Is federated learning based on fine-tuning specific task heads still a mainstream approach? With the increasing size of models, more parameter-efficient fine-tuning techniques have emerged, such as adapter tuning—where a small number of adjustable parameters are inserted into the middle layers—or prompt tuning, which adjusts embedding information. Why does the paper focus exclusively on federated learning based on fine-tuning specific task heads, rather than considering these methods?\n3. How do existing federated learning defense methods operate? Although the authors mention that prior defenses target full-model training, their analysis lacks depth. Specifically, what requirements do existing methods fail to meet in the partial fine-tuning scenario? What are the characteristic constraints in this setting that prevent these methods from being applicable?\n4.On which datasets was the pre-trained model originally trained? The three datasets used in the experiments are common image datasets, raising concerns that the pre-trained model may have already been exposed to them. If this is the case, the fine-tuning process might lead to overfitting, potentially affecting the validity of the classification results.", "limitations": "The author only mentions in the conclusion that FEDRACE focuses on classification tasks, but does not discuss its applicability to regression or generative tasks. This discussion is insufficient. Can the proposed defense method be extended to other parameter-efficient fine-tuning approaches? Furthermore, can it be integrated into other existing federated learning frameworks that also rely on fine-tuning specific task heads? It is recommended that the paper include a discussion addressing these questions.", "rating": 4, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 2, "significance": 2, "originality": 3, "strengths_and_weaknesses": "Strengths:\n1. The paper is logically structured and clearly written. The overall quality of the manuscript meets the standards of a scientific research publication.\n2. The theoretical analysis is well-developed, and the experimental evaluation is comprehensive, providing sufficient empirical support for the proposed method.\n3. The paper identifies security risks in federated learning systems that rely on partial fine-tuning and proposes a new framework to defend against such attacks. This approach addresses a practical problem in real-world deployments.\nWeaknesses:\n1. The method's scope is somewhat narrow. While the paper focuses on federated learning systems that use task-specific heads for partial fine-tuning, many existing federated learning approaches based on large models primarily employ efficient parameter tuning methods, such as fine-tuning parameters in the middle or input layers. However, the paper does not discuss the applicability of the proposed method in these fine-tuning settings.\n2. The practical applicability of the method appears limited. The defense mechanism proposed in the paper is tightly coupled with the FEDRACE architecture, making it difficult to integrate into other federated learning frameworks that also utilize partial fine-tuning.\n3. The comparison with existing federated learning defense methods is insufficient. While the paper notes that most prior works assume full-model training, it lacks a deeper analysis of how these methods function and why their assumptions are incompatible with partial fine-tuning.\n4. Some parts of the paper suffer from stiff grammar. It is recommended that the manuscript undergo thorough language revision.", "was_revised": true, "final_justification": "The authors effectively addressed concerns regarding FedRACE's resilience in the face of distribution shifts and various attacks (such as backdoor and membership inference attacks). Through supplementary experiments like statistical control mechanism tests and ablation studies, they provided solid evidence validating the framework's robustness in non - iid data scenarios and adversarial environments. This significantly enhances the reliability of the proposed method. Queries about the hierarchical structure and the integration of statistical components were well - resolved. The authors clearly elucidated the interaction between the backbone and fine - tuning stages and how statistical metrics (e.g., KL divergence) reduce performance risks in federated learning settings. This clarity helps reviewers and readers better understand the inner workings of FedRACE.\n\nAlthough FedRACE shows potential in task - specific federated learning, the efficiency of the framework when dealing with very large foundation models (e.g., models with billions of parameters) remains ambiguous. The authors did not fully explore the scalability trade - offs for extremely large - scale models, which is a concern for its broader application. Considering the resolved issues that strongly prove the value of FedRACE and the fact that the unresolved issues are areas that can be further explored in future work rather than fundamental flaws, I will raise my score.", "rebuttal": "Thank you for your detailed and constructive feedback.\n\nQ1. … problem–method alignment…framework specificity…\n\nAnswer: We agree that the connection between the stated problem and our solution should be clearer. Freezing the backbone and fine tuning only the task head reduces computation and communication but creates a new attack surface: small and concentrated weight updates that standard defenses fail to detect. To address this issue we designed two components. HStat Net refines the frozen features so that malicious updates become separable from benign updates, and DevGuard detects abnormal clients by measuring class wise deviance in those refined features. We will make this connection more explicit in the camera ready version.\n\nAlthough our experiments focus on head only fine tuning, FedRACE can also support other parameter efficient methods. HStat Net can refine features produced by adapter or prompt tuning, and DevGuard can monitor any small trainable module. Standard defenses are not designed for such settings, as methods like Multi-krum and Trimmed-mean look for large, layer wide deviations, while head only tuning produces sparse, low dimensional updates. FedRACE instead evaluates class specific projections, which remain sensitive even to small perturbations in the head.\n\nFinally, while our experiments target classification, the same principles extend to other tasks. For regression, Gaussian deviance can be applied to the refined features. For generative tasks, output distribution comparison can be used. Because FedRACE operates on refined representations rather than on a fixed architecture, it can integrate into a broad range of parameter efficient federated learning frameworks.\n\nQ2. …task-head fine-tuning…parameter-effcient fine-tuning…\n\nAnswer: Fine tuning only the task head is a common federated learning workflow. It allows clients to personalize large pre trained models on edge devices with low overhead. By freezing the backbone, each client updates and transmits only the head weights, which keeps both computation and communication costs minimal and aligns with typical FL constraints such as limited bandwidth and computation. Adapter tuning and prompt tuning can reduce the number of trainable parameters further, but they introduce new modules or modify embeddings within the frozen layers. Our design focuses on the standard head only approach to highlight and secure the attack surface created when tuning a small subset of parameters.\n\nFedRACE’s two components can also support other fine tuning methods. HStat Net can refine features produced by adapters or prompts, and DevGuard can compute deviance on any small trainable subnetwork. We chose head only tuning as our case study because it is a widely used FL baseline, but the same principles extend to other parameter efficient techniques. We will clarify this generality in the camera ready version.\n\nQ3. … full model update assumptions… sparse head only constraints…\n\nAnswer: Most existing federated learning defenses, such as Trimmed-mean, Multi-krum and FLShield, are designed for full model updates. They assume that each client submits large, high dimensional weight deltas that can be filtered or reweighted. For example, Trimmed-mean discards extreme parameter values before averaging, and Multi-krum selects updates with minimal aggregate distance to others. FLShield instead validates each client’s updated model on a held out dataset to detect and remove malicious contributions.\n\nWhen clients fine tune only the task head, the backbone remains frozen and updates are sparse and low dimensional. These updates lack the variance and scale that full model defenses rely on. Distance based filters cannot capture subtle deviations in a few hundred parameters, and validation based methods become impractical because even small head updates require full model inference on a reference set, adding latency and computation that edge devices often cannot afford.\n\nFedRACE addresses these constraints by refining frozen backbone features into compact class aware embeddings using HStat Net, and then detecting abnormal clients through class wise deviance in DevGuard. By operating in a learned representation space rather than on raw weights, FedRACE remains sensitive to head only perturbations and avoids the high overhead of full model validation. We will emphasize this distinction more clearly in the camera ready version.\n\nThank you again for your thoughtful comments."}]

Author rebuttal:

Meta-review: This paper investigates the vulnerabilities of federated learning when using a partial fine-tuning approach with large pre-trained models. It introduced a hierarchical and statistical framework FEDRACE for robust FL based on a client-side hierarchical network and a server-side mechanism.

Strengths:
- The paper is logically structured and well-written. 
- FEDRACE integrates HStat-Net for representation learning with GLM-based deviance analysis for secure client evaluation.
- The scalability of FEDRACE is analyzed and validated.

Weaknesses:
- The optimality of the chosen objective is not well discussed.
- The trade-off between robustness and computational efficiency requires more empirical validation.
- The generalization of FEDRACE on parameter-efficient fine-tuning with flexible layer configurations could be further explored.

Recomendation

All reviewers provided positive ratings and found the contributions valuable. Acceptance is recommended. The authors are encouraged to carefully address all reviewer suggestions in the final version to strengthen the paper further.
Decision: Accept (poster)