## 5 Proposed Framework
### FL Framework
#### 5.2.2 Robust Aggregation  
Robust aggregation mechanisms play a pivotal role in mitigating model poisoning attacks within federated O-RAN environments. As shown in Table 8, we evaluate four prominent methods through the lens of O-RAN's unique constraints: maximum tolerable attackers, energy efficiency, latency impact, and computational overhead. The **Trimmed Mean** approach demonstrates superior suitability for O-RAN deployments by strategically discarding the top and bottom 15% of model updates during aggregation. This mechanism provides resilience against moderate poisoning attacks (up to 15% of malicious participants) while maintaining computational efficiency--a critical requirement given O-RAN's Near-Real-Time control loops. The 4.2% latency penalty stems primarily from sorting operations, which scale linearly (\(O(N\log N)\)) with the number of participants, making it 58% faster than geometric median approaches. Energy savings of 32% are achieved through reduced recomputation needs compared to more complex methods. In contrast, the **Median** method exhibits higher vulnerability to coordinated attacks due to its reliance on a single ordinal statistic. While theoretically robust to 10% attackers, colluding adversaries can systematically skew the median value with fewer compromised nodes. The 6.7% latency increase results from full sorting of all model parameters, becoming prohibitive for large-scale deployments with hundreds of Distributed Units (DUs). The **Krum** algorithm, despite tolerating 20% attackers through geometric consistency checks, proves impractical for O-RAN due to quadratic (\(O(N^{2})\)) pairwise distance calculations. While theoretically robust, the 9.1% latency penalty and 2.3\(\times\) computational overhead violate strict timing budgets for xApp control loops. Energy efficiency drops to 25% as GPU resources become saturated with vector distance computations. **FoolsGold** achieves the highest theoretical resilience (25% attackers) through historical contribution analysis but introduces prohibitive 12.4% latency overhead from long-term memory requirements. The method's 3.1\(\times\) computational overhead stems from continuous cosine similarity checks across training rounds, making it incompatible with O-RAN's dynamic topology changes and ephemeral xApp lifecycles. Three defensive validation layers complement our chosen trimmed mean approach: First, update sanity checks enforce gradient norm thresholds (\(\|\
abla L\|_{2}\leq 3.0\)) to detect anomalous parameter shifts. Second, statistical anomaly detection combines Kolmogorov-Smirnov tests (for distribution shifts) with interquartile range (IQR) analysis to identify outliers in update magnitudes. Finally, zero-trust principles are enforced through the continuous authentication of participating nodes and micro-segmentation of the aggregation service, reducing attack surfaces by 72% compared to conventional FL setups. The optimality of trimmed mean emerges from O-RAN's fundamental trade-off equation:  
\[\Psi=\underbrace{\alpha\cdot R}_{\text{Resilience}}-\underbrace{\beta\cdot L }_{\text{Latency}}-\underbrace{\gamma\cdot E}_{\text{Energy}},\quad\alpha, \beta,\gamma>0 \tag{10}\] \begin{table}
\begin{tabular}{l l l l l l} \hline \hline
**Method** & **Max Attackers** & **Energy Savings** & **Latency Impact** & **Comp. Overhead** & **Key Rationale** \\ \hline Trimmed Mean & 15\% & 32\% & +4.2\% & 1.2\(\times\) & Balanced; fast sorting \\ Median & 10\% & 28\% & +6.7\% & 1.5\(\times\) & Sensitive to collusion \\ Krum & 20\% & 25\% & +9.1\% & 2.3\(\times\) & High resilience, slow \\ FoolsGold & 25\% & 22\% & +12.4\% & 3.1\(\times\) & Poor fit for dynamic FL \\ \hline \hline \end{tabular}
\end{table} 
Table 8: Performance comparison of robust aggregation methods. where \(R\) represents attack resilience, \(L\) latency penalty, and \(E\) energy overhead.