# FLGQM: Robust Federated Learning Based on Geometric and Qualitative Metrics
## 3 Results and Discussion
### Experimental Results  
#### 3.2.1 FLGQM Can Achieve Two Defensive Goals. Table 3 shows the accuracy of different federated learning algorithms on two datasets under different attacks. The results show that FLGQM can achieve two defense goals: fidelity and robustness. **Fidelity. ** As evident from Table 3, FLGQM achieves fidelity as the accuracy in the non-adversarial setting is comparable to the baseline (FedAvg) on both datasets. However, the existing robust federated learning methods are less accurate in the absence of attacks. For example, the accuracy of median, Trim_mean, Krum, FLTrust, and MAB-RFL on MNIST differed from FedAvg by 0.26%, 0.29%, 3.50%, 0.67%, and 0.56%, respectively. However, the accuracy of FLGQM is close to that of FedAvg, with only 0.12% difference. Compared with FedAvg, the accuracy of median, Trim_mean, and Krum decreased by 0.20%, 0.45%, and 6.67%, with Krum possessing a lower accuracy. And the accuracy of FLGQM differs from FedAvg by only 0.13%. The results show that FLGQM has high accuracy, i.e., has better fidelity, than the existing robust federated learning method in a non-adversarial setting. This is due to the fact that the current FL method discards some of the parameter updates while aggregating local parameter updates and considers a single perspective, so the test accuracy will be lower. In contrast, our approach takes into account model updates from two perspectives and is able to \begin{table}
\begin{tabular}{c c c} \hline
**Explanation** & **MNIST** & **CIFAR-10** \\ \hline \(K\) & Number of clients & 100 & 40 \\ \hline \(\tau\) & Number of clients selected per global round & \(K\) & \\ \hline \(\tau_{a}\) & Proportion of clients selected as training clients each global round & 0.8 & \\ \hline \(\tau_{u}\) & Proportion of clients selected as union clients each global round & 0.2 & \\ \hline \(E_{l}\) & Local epoch & 5 & \\ \hline \(E_{g}\) & Global epoch & 300 & \\ \hline \(b\) & Batch size & 16 & 64 \\ \hline \(\beta\) & Learning rate & 0.01 & 0.001 \\ \hline \(\mathcal{M}\) & Number of malicious clients & 20 & 8 \\ \hline \(f\) & Parameter of Krum [11] & \(\mathcal{M}\) & \\ \hline \(\mathcal{K}\) & Parameter of trimmed mean [15] & \(\mathcal{M}\) & \\ \hline \end{tabular}
\end{table} 
Table 2: Federated learning parameter settings in our experiment. \begin{table}
\begin{tabular}{c c c c c c c c c} \hline
**Dataset** & **Attacks** & **FedAvg** & **Median** & **Trim\_mean** & **Krum** & **FLTrust** & **MAB-RFL** & **FLGQM** \\ \hline \multirow{4}{*}{MNIST} & No attack & 98.51 & 98.25 & 98.22 & 95.01 & 97.84 & 97.95 & 98.39 \\  & LF attack & - & 97.79 & 97.41 & 93.51 & 97.40 & 96.60 & **98.03** \\  & LIE attack & - & 96.25 & 88.62 & 94.49 & 97.14 & 97.44 & **98.05** \\  & Fang attack & - & 96.17 & 95.64 & 94.75 & 97.10 & 97.45 & **97.97** \\  & AGRT attack & - & 95.18 & 95.84 & 74.19 & 97.03 & 97.14 & **97.63** \\ \hline \multirow{4}{*}{CIFAR-10} & No attack & 73.68 & 72.83 & 72.58 & 66.36 & 73.29 & 73.70 & 73.55 \\  & LF attack & - & 69.59 & 69.35 & 57.63 & 73.21 & **73.66** & 73.53 \\ \cline{1-1}  & LIE attack & - & 48.38 & 35.77 & 41.68 & 72.95 & 72.62 & **73.30** \\ \cline{1-1}  & Fang attack & - & 58.73 & 66.57 & 42.43 & 73.19 & 72.18 & **73.39** \\ \cline{1-1}  & AGRT attack & - & 23.06 & 53.77 & 10.00 & 72.52 & 70.55 & **72.63** \\ \hline \end{tabular}
\end{table} 
Table 3: Accuracy of compared federated learning algorithms on MNIST and CIFAR-10 with different attacks. differences between benign clients and malicious clients, allowing us to effectively leverage all available local model information. **Robustness. ** As can be seen from Table 3, FLGQM achieves robustness as its accuracy under all attacks has very little change compared to the baseline (FedAvg) on both datasets. Specifically, FLGQM can have comparable accuracy compared to FedAvg on both datasets, with a maximum difference of only 0.88%. Meanwhile, other existing robust federated learning methods possess worse accuracy. Especially in the case of untargeted attacks, their performance drops sharply.