## 6 Defenses against Model and Data Attacks
### Byzantine Robust Aggregation Techniques  
Byzantine robust aggregation techniques in FL are designed to ensure that the global model can learn effectively even when some clients send malicious updates, either intentionally or due to faults. These techniques aim to mitigate the influence of these byzantine clients and ensure the integrity and performance of the global model. The block diagram of byzantine robust aggregation is presented in Figure 9.  
One such technique is Krum [77], a robust algorithm for aggregating gradient vectors in distributed stochastic gradient descent (SGD). Krum selects the vector from clients with the smallest summed distance to its closest \(n-f\) other vectors, where \(f\) represents the maximum number of byzantine clients. This selection ensures that the aggregated vector  
Figure 8: Model pruning. aligns closely with the majority of the correct vectors, minimizing the impact of outliers or malicious updates. Krum satisfies the \((\alpha,f)\)-Byzantine resilience property, ensuring that the vector chosen aligns within an angle \(\alpha\) of the true gradient direction. Variants like Multi-Krum combine Krum and averaging to balance resilience against byzantine failures with convergence speed. Another approach, the trimmed mean [104], focuses on robust algorithms for distributed statistical learning in the presence of byzantine failures. It proposes two robust distributed gradient descent algorithms based on coordinate-wise median and trimmed mean operations, effectively handling arbitrary messages from byzantine machines. These algorithms achieve optimal statistical error rates across different loss function scenarios. A communication-efficient one-round algorithm based on a coordinate-wise median is also proposed for quadratic loss functions. The Bulyan algorithm [105] addresses challenges in high-dimensional settings like neural networks. Bulyan aggregates gradients by majority vote per coordinate, significantly enhancing robustness and limiting the attacker's influence to \(O(1/\sqrt{d})\). This approach ensures effective learning under attack scenarios, as validated by both the theoretical analysis and empirical results. RLR (Robust Learning Rate) [78] adjusts learning rates dynamically based on the signs of agent updates to counteract divergences caused by malicious agents with backdoors. By inverting the learning rate when necessary, RLR effectively reduces backdoor accuracy while maintaining overall model accuracy better than previous defenses. This approach enhances the collective impact of updates from honest agents on model predictions for compromised inputs. ZeKoC [106] enhances FL's resilience against poisoning attacks by using MaxMin initialization and a robust distance metric in K-means clustering. Before aggregation, the clusters are evaluated with a test dataset to exclude those degrading performance. This filtering detects and removes adversarial updates from compromised nodes while aggregating enough nodes for an effective global model. ShieldFL [107] introduces a defense strategy using secure cosine similarity over encrypted gradients to combat model poisoning attacks. It employs a two-trapdoor homomorphic encryption scheme to detect poisonous gradients. ShieldFL includes a byzantine-tolerance aggregation mechanism, ensuring robustness across diverse data distributions. Gradients are weighted by confidence values rather than discarding outliers outlerg with preserving privacy and minimizing the influence of malicious gradients on the final model update. The Adaptive Federated Averaging (AFA) algorithm [108] secures FL against faulty or malicious client updates with a robust aggregation rule. It detects and discards outlier updates by comparing their similarity to the median and standard deviation of the aggregated model update. A Bayesian Hidden Markov Model estimates each client's probability of providing beneficial updates over iterations, helping to identify and block consistently malicious clients.