## 3 Results
### Evaluation of Robustness in Federated Learning  
This section presents the experimental results aimed at rigorously and comprehensively evaluating the robustness of the proposed FL-QLMS technique. Specifically, a comprehensive threat model was assumed, encompassing not only random injection and adversarial loss attacks but also modern attack techniques such as data poisoning, model poisoning, and adversarial imitation learning, with a quantitative analysis of FL-QLMS's response performance. Firstly, data poisoning is an attack technique that contaminates the model by maliciously injecting designed samples into the training dataset [34]. In this experiment, two typical data poisoning methods were implemented: label flipping and backdoor trigger insertion. Label flipping randomly inverts the labels of training data [35], whereas backdoor trigger insertion assigns an attacker-specified label to samples containing a specific pattern, causing misclassification when that pattern appears later [36]. Figure 9 illustrates the impact of data poisoning attacks on the test accuracy of FL-QLMS. The graph shows that as the ratio of label flipping and the rate of backdoor trigger insertion increase, the test accuracy of the model decreases. However, FL-QLMS maintains a relatively high accuracy even under severe data poisoning conditions, demonstrating its robustness against such attacks. Another prominent threat is model poisoning, an attack that disrupts or distorts the learning model itself to degrade the performance of the global model, implemented through random parameter injection or scale manipulation [38]. Moreover, adversarial imitation learning is gaining attention as a sophisticated type of Byzantine attack [39]. It involves observing the models of legitimate clients and generating malicious models that appear legitimate to bypass the selection process. In this experiment, adversarial imitation attacks were implemented using the Generative Adversarial Imitation Learning (GAIL) framework [40]. Figure 10 compares the test accuracy of FL-QLMS and the conventional FedAvg method against model tampering and adversarial imitation attacks with varying attack intensities. The results show that FL-QLMS consistently outperforms FedAvg in terms of test accuracy under both types of attacks, especially as the attack intensity increases. This demonstrates the superior robustness of FL-QLMS against model poisoning and adversarial imitation learning attacks. Figure 10: Test Accuracy of Algorithms Against Model Poisoning and Adversarial Imitation Learning Attacks. These experimental results empirically support that the proposed FL-QLMS possesses robust resistance against modern Byzantine attacks and data poisoning techniques. Particularly, unlike conventional simple model averaging, the dynamic selection and weighting adjustment mechanism based on verification performance holds value as an adaptive algorithm capable of consistent defensive performance in evolving threat environments. However, the attacks applied in this experiment were relatively standardized scenarios, and a long-term perspective analysis of Byzantine behavior was omitted. In real situations, attackers might use cunning and adaptive strategies, such as delay attacks that act harmlessly at the beginning but cause critical disruption later, or stealth attacks that gradually accumulate subtle distortions over a long period [41]. For in-depth analysis of such sophisticated threats, it is necessary to observe the emergent behavior of the algorithm over long-term learning, beyond short-term scenario evaluations. Introducing modeling techniques such as multi-agent reinforcement learning or dynamic game theory [42] could be a promising approach to analyze the strategic interactions between FL-QLMS and Byzantine attacks from a long-term perspective.