# FLGQM: Robust Federated Learning Based on Geometric and Qualitative Metrics
## 2 Materials and Methods
### Related Work
#### 2.1.3 Existing Robust Federated Learning  
Many defense mechanisms have been proposed to relieve the effects of poisoning attacks. They are mainly divided into two ideas. One type of defense method is to assume that all malicious models are geometrically far from benign models. For example, In Krum [15], the Euclidean distance is employed to score the local models, and subsequently, the highest-rated model is chosen as the global model. In Fast Aggregation algorithm against Byzantine Attacks (FABA) [23], local gradients that deviate significantly from the average gradient are discarded. However, both of these methods necessitate prior knowledge of malicious clients' number, which imposes certain limitations on their applicability. To overcome this limitation, [PERSON] [24] utilize cosine similarity to assign a low score to malicious clients, thereby minimizing malicious clients' impact. [PERSON] et al. [25] propose MAB-RFL, which employs graph theory to eliminate models that exhibit excessive similarity and then extracts key parameters from the models using principal component analysis as a way to distinguish benign and malicious clients. The median and trimmed mean [18] compute the trimmed mean and median of each dimension of the local model to circumvent models from malicious clients. Robust Federated Aggregation (RFA) [26] employs alternating minimization methods to calculate the geometric median. [PERSON] [6] trims the mean on the basis of Multi-Krum. Adaptive Federated Aggregation (AFA) [27] first calculates the similarity between the local model and the global model. It then identifies and removes underperforming local models according to the mean and median of these similarities. [PERSON] et al. [28] proposed SignGuard, which first processes the received gradients to generate relevant statistics related to similarity, sign, and magnitude. The malicious gradients are then eliminated by the filters utilized collaboratively before final aggregation. [PERSON] et al. [29] proposed FLEST. It proposes a trust synthesis mechanism that aggregates confidence scores and trust scores into a composite trust score (STS) through dynamic trust ratios, and uses the score as a weight for updating the aggregated local parameters. [PERSON] et al. [30] proposed FLEorest. Its primary focus is to assess the occurrence of an attack according to the magnitude of change in the global model update, accomplished by incorporating Isolation Forest. Another defense method involves maintaining a clean, small dataset on the server to filter out poorly performing local models. For example, [PERSON] [20] has a small dataset on the server and calculates a score for local models. Then, these scores are aggregated into a global model. [PERSON] et al. [31] proposed a distributed gradient algorithm that reduces the effect of malicious clients by computing noise gradients using a clean dataset. FLTrust [19] maintains a small training dataset on the server, trains a bootstrap model based on this dataset, and then utilizes cosine similarity between this model and the local model as a score for the local model. [PERSON] et al. [32] proposed Dynamic Defense Against Byzantine Attacks (DDaBA). The main idea is to judge the quality of individual clients by the clean dataset on the server and then score each client with a linguistic quantifier. [PERSON] et al. [33] proposed FLCert, which first groups all the clients and trains a global model separately. The method also needs to keep a clean dataset on the server to validate all the local models, and then an optimal global model is selected by a voting mechanism. Existing robust federated learning methods have a significant limitation: some poisoning attacks can simulate malicious models that are geometrically similar to benign models, thereby breaking this defense mechanism. At the same time, the method of keeping small datasets on the server is problematic as it goes against the idea of federated learning.