## 3 Proposed Collaborative FL Framework
### Proposed Grouping Scheme
#### 3.5.2 The Number of Normal and Malicious Groups  
After classifying all participating clients into two categories, normal and malicious ones, the server begins to execute the grouping scheme for both client categories. However, according to the rules of the voting game, the player with the most votes wins the game. Hence, the grouping scheme should consider some constraints. First, we should ensure that the number of normal groups is larger than the number of malicious ones. Hence, the following equations should hold while grouping clients. Equation (1) represents the sum of clients in both categories being equal to the total number of clients. Equation (2) expresses the constraints we stated above. \[k_{m}N_{m}+k_{n}N_{n}=n \tag{1}\]  
\[N_{m}<N/2\text{, }N_{m}+N_{n}=N \tag{2}\]  
The Impact of a False Positive Rate of Classifying Edge Clients  
According to our design, a valid ID is selected from a normal distribution with mean \(\lambda\) and standard deviation \(\sigma\). We also assume that a malicious user may forge many malicious clients with randomly selected IDs. The grouping administrator distinguishes all participating clients based on the distinguishing principle. Hence, a malicious client with an ID falling in this range, \(\lambda\pm 4\sigma\), is misjudged as a normal one, which is called a false positive case. Now, we try to compute the probability of this event. First, we assume that D denotes the total number of all IDs. According to our ID assignment, D is significantly larger than \(4\sigma\). Equation (3) expresses the probability of a malicious client's ID falling in this range. \(C(n,\,m)\) represents all combinations while selecting \(n\) numbers from a set of \(m\) numbers. \[P_{m}=\frac{C(8\sigma,1)C(D-8\sigma,n_{m}-1)}{C(D,n_{m})} \tag{3}\]  
Because D >> \(8\sigma\), \(n_{m}\), we can simplify these equations for the ease of analysis. \[P_{m}=\frac{8\sigma n_{m}}{D} \tag{4}\]  
We can also obtain the upper bound of the number of malicious clients under a given \(P_{m}\). This upper bound gives the design rule for our collaborative FL framework. \[n_{m}=\frac{DP_{m}}{8\sigma} \tag{5}\]  
For instance, if the number of malicious clients is less than 2097, the bit length of D is 32 bits and \(\sigma=256\), then we can ensure that our FL architecture can resist poisoned attacks with \(P_{m}\) lower than 0.001. Hence, the probability that the number of the malicious clients' IDs exceeding 1 is close to 0. Hence, we assume the probability of having one malicious client misclassified into the normal group is low enough to ignore if we have well-designed parameters, D and \(\sigma\). The Impact of Prediction Accuracy of Global Models  
Here, we try to show the impact of the prediction accuracy of the global model in a group on our proposed grouping scheme. In essence, regardless of the FL mechanisms, each global model in a group has its prediction accuracy for the input. Here, \(p_{n}\) denotes the prediction accuracy of the global model in a normal group while \(p_{m}\) denotes it in a malicious group. In a collaborative FL framework, the voting result decides the prediction output. Therefore, ensuring the correctness of the voting result is the main object of this collaborative FL framework. In order to achieve the object of this collaborative FL framework, the number of positive answers should be larger than that of negative ones. A positive answer means the true answer for the input test and a negative one means a false answer. Therefore, the expected number of positive answers is shown in Equation (6), and the expected number of negative answers follows accordingly. \[N_{pe}=p_{n}N_{n}+p_{m}N_{m} \tag{6}\]  
\[N_{ne}=N-N_{pe} \tag{7}\]  
Moreover, we expect that \(N_{pe}>N_{ne}\), and we assume that \(N_{n}=N/2+N_{o}^{{}^{\prime}}\) and \(N_{m}=N/2-N_{o}^{{}^{\prime}}\), where \(N_{o}^{{}^{\prime}}\) is the offset between the numbers of normal and malicious groups. Accordingly, we can deduce the minimum value for \(N_{o}^{{}^{\prime}}\).