# FLGQM: Robust Federated Learning Based on Geometric and Qualitative Metrics
## 3 Results and Discussion
### Experimental Results
#### 3.2.3 Impact of Malicious Clients' Number  
Table 5 presents the accuracy results of various robust federated learning methods on MNIST, considering different attacks and varying proportions of malicious clients (ranging from 0% to 50%). Since Trim_mean works by eliminating local model updates with twice the number of malicious clients, only 0-40% of the results are displayed for Trim_mean.  
It can be observed through Table 5 and Figure 4 that FLGQM is able to defend against 0-50% malicious clients in the presence of untargeted and targeted attacks. When there are 50% malicious clients, FLGQM is still able to have almost comparable performance to FedAvg, with a maximum error of only 1.19%. Nevertheless, alternative robust federated learning methods exhibit lower tolerance toward malicious clients. For example, under the LF attack, median and Krum almost fail when the malicious client reaches 50%, and Trim_mean's performance drops by 4.51% when the malicious client reaches 40%. Under the LIE attack, Krum fails when the malicious client reaches 40%; median fails when the malicious client reaches 50%; and the performance of Trim_mean drops by 18.55% when the malicious client reaches 40%. Under model poisoning attacks, such as Fang and AGRT, Trim_mean and Krum fail when the malicious clients reach 40%, and median fails when it reaches 50%. The most recent defense method, FLTrust, exhibits a decrease in accuracy under LF attack, Fang attack, and AGRT attack, especially when the malicious clients' proportion reaches 40%. Similarly, the latest defense method, MAB-FL, experiences a certain degree of accuracy reduction under LF attack when the malicious clients' proportion reaches 50% and under AGRT attack when the malicious clients' proportion reaches 30%. It can be seen that FLGQM is able to tolerate a much larger number of malicious clients.  
\begin{table}
\begin{tabular}{c c c c c c c c c} \hline \hline
**Attacks** & **Percentage of Malicious Clients** & **FedAvg** & **Median** & **Trim\_mean** & **Krum** & **FLTrust** & **MAB-REL** & **FLGQM** \\ \hline \multirow{6}{*}{LF attack} & 0\% & 98.51 & 98.25 & 98.22 & 95.01 & 97.84 & 97.95 & 98.39 \\  & 10\% & - & 98.04 & 98.01 & 94.81 & 97.69 & 97.42 & 98.22 \\  & 20\% & - & 97.79 & 97.41 & 93.51 & 97.40 & 96.60 & 98.03 \\  & 30\% & - & 96.96 & 96.54 & 93.27 & 97.42 & 97.28 & 98.01 \\  & 40\% & - & 94.14 & 93.71 & 93.14 & 95.78 & 97.12 & 97.87 \\  & 50\% & - & 17.44 & - & 23.55 & 95.23 & 95.32 & 97.86 \\ \hline \multirow{6}{*}{LIE attack} & 0\% & 98.51 & 98.25 & 98.22 & 95.01 & 97.84 & 97.95 & 98.39 \\  & 10\% & - & 98.01 & 97.95 & 94.63 & 97.57 & 97.42 & 98.26 \\  & 20\% & - & 96.25 & 88.62 & 94.49 & 97.14 & 97.44 & 98.05 \\  & 30\% & - & 96.06 & 84.77 & 94.46 & 97.25 & 97.22 & 98.02 \\  & 40\% & - & 95.96 & 79.67 & 30.43 & 97.04 & 96.94 & 97.89 \\  & 50\% & - & 16.80 & - & 11.22 & 97.10 & 96.86 & 97.64 \\ \hline \multirow{6}{*}{Fang attack} & 0\% & 98.51 & 98.25 & 98.22 & 95.01 & 97.84 & 97.95 & 98.39 \\  & 10\% & - & 96.35 & 96.69 & 94.79 & 97.38 & 97.86 & 98.33 \\  & 20\% & - & 96.25 & 96.54 & 94.75 & 97.10 & 97.45 & 97.97 \\  & 30\% & - & 96.17 & 95.36 & 94.19 & 96.27 & 97.57 & 97.77 \\  & 40\% & - & 95.31 & 9.80 & 10.00 & 94.58 & 97.42 & 97.68 \\  & 50\% & - & 10.30 & - & 9.90 & 94.20 & 97.37 & 97.59 \\ \hline \multirow{6}{*}{AGRT attack} & 0\% & 98.51 & 98.25 & 98.22 & 95.01 & 97.84 & 97.95 & 98.39 \\  & 10\% & - & 96.98 & 96.77 & 94.88 & 97.21 & 97.23 & 98.09 \\ \cline{1-1}  & 20\% & - & 95.18 & 95.84 & 74.19 & 97.03 & 97.14 & 97.63 \\ \cline{1-1}  & 30\% & - & 95.09 & 90.03 & 66.84 & 96.99 & 96.12 & 97.45 \\ \cline{1-1}  & 40\% & - & 94.98 & 9.80 & 10.00 & 96.37 & 96.10 & 97.41 \\ \cline{1-1}  & 50\% & - & 9.80 & - & 9.80 & 95.49 & 96.00 & 97.20 \\ \hline \hline \end{tabular}
\end{table}
Table 5: Accuracy of compared federated learning algorithms on MNIST with different attacks.