# FLGQM: Robust Federated Learning Based on Geometric and Qualitative Metrics
## 2 Materials and Methods
### Flgom
#### 2.2.2 Aggregation Rule  
Our proposed FLGQM is shown in Figure 1. It is considered in two aspects simultaneously: model quality and model geometry aspects. Firstly, the server receives all the local models. It will use cosine similarity and Euclidean distance to perform the geometric metric on each local model to obtain the geometric metric score (GMS). Then, the server will send the received local models down to the union client set for quality metrics to obtain the quality metric score (QMS), and finally, a new round of global models is obtained by weighted average of the two scores. Next, we describe each step of the algorithm in detail. **Geometric Metric Score (GMS). ** The adversary can arbitrarily control the direction and size of the malicious client's local model. Therefore, we consider constraining the behavior of all uploaded local models prior to aggregation. The whole process is shown in Figure 2. For each uploaded model weight, we vectorize it to the vector space, and it is easy to know that each model corresponds to a vector in the vector space, i.e., it has a size and direction. Obviously, the more similar two vectors are, the more similar their corresponding sizes and directions should be. Based on this, we distinguish benign local models from malicious local models. A malicious local model should be far from a benign model in terms of direction and size. And we know that cosine similarity can be used to determine whether two vectors are similar in direction and Euclidean distance can be used to determine whether two vectors are similar in size, so we use cosine similarity and Euclidean distance for geometric metrics. The specific steps of the algorithm will be described in detail below. Under the federal learning framework, we assume that the current set of clients selected to participate in this round of training is \(C^{t}=c_{1},\dots,c_{p},\dots,c_{p}\subseteq C\). First, we constrain the direction of the local model using cosine similarity, which is reflected in two similarity measures. Here, we use the \(p\)th client, i.e., \(c_{p}\in C^{t}\) as an example. The first measure is a cosine similarity measure between the local model uploaded in this round \(w_{p}^{t}\) and its local model uploaded in the previous round \(w_{p}^{t-1}\), and the second measure is a cosine similarity measure between the local model uploaded in this round \(w_{p}^{t}\) and the global model in the previous round \(w^{t-1}\). Based on the results obtained from the first measure, we will reject the local models with negative similarity, i.e., rejecting their participation in this aggregation because their models in this upload are too different from their models in the last upload. Based on the results obtained from the second measure, we  
Figure 1: Robust federated learning method based on geometric and qualitative metrics. Figure 2: Geometric metrics score calculation process. The right is the detailed GMS calculation process, and the left is the spatial state of the model after each calculation. further eliminate the local models with negative similarity because their uploaded model in this current round \(w^{t}_{p}\) is too different from the global model \(w^{t-1}\). Then, we score the remaining local models using the second measure. Specifically, the server stores a model set \(\mathcal{V}\ =\left\{w^{t-1}_{1},\ldots,w^{t-1}_{p},\ldots,w^{t-1}_{p}\right\}\) containing the local models for round \(t-1\) of the clients that participate in training. Considering the arbitrary nature of the malicious local model, we first use the cosine similarity to detect the clients that have the model \(w^{t}_{p}\) far removed from the model \(w^{t-1}_{p}\) in the direction, and then eliminate the detected clients. This process is formally as follows. \[cs_{p}= \begin{cases}0,&\ Cos(w^{t-1}_{p},w^{t}_{p})<0,\\ 1,&\ Cos(w^{t-1}_{p},w^{t}_{p})\geq 0\end{cases}