## 1 Introduction  
Recently, Machine Learning has provided intelligent online automation control in various fields, especially in IoT and industrial automation. In such environments, there are many sensors deployed for collecting sensed data. However, the sensed data of these sensors is often private and need to be protected. Yet, in online collecting of these data sets, their large volume in transit make them easily vulnerable to hijacking by malicious users, leading to data leakage, which is unacceptable to both users and the industry managers. Hence, a new paradigm, the federated learning (FL) framework, is proposed, which is a secure machine learning framework ensuring privacy protection and providing a flexible architecture [1]. In such an emerging learning paradigm, the edge client executes a specified function that is different from the previous one, just transferring its local dataset to the central server. In the FL framework, the edge client trains its learning model locally using its own dataset. Then the server collects all the learning model weights from the edge clients and generates a global learning model based on an FL algorithm. Upon receiving this global model, the edge client replaces its local learning model with this newly received one. Then it trains this model again and repeats the aforementioned processes. This workflow is also called the single-global-model paradigm. This paradigm has been suggested to be deployed in several fields, including IoT applications [2; 3; 4], industry applications [5], network applications [6] and so on. While FL offers significant advantages in distributed environments, it concurrently faces substantial security challenges [7; 8], particularly from malicious clients. Among these, the poisoning attack is a critical threat. In a poisoning attack, malicious clients intentionally skew the training data or manipulate the learning process by injecting false information or models, which results in a significantly compromised global model. Such compromised models can lead to erroneous decisions or actions, undermining the integrity and reliability of the entire FL system. Recently, numerous studies have concentrated on developing robust defense mechanisms to detect and mitigate the effects of these attacks. These include techniques for identifying anomalous data contributions and enhancing the aggregation algorithms to resist the influence of malicious updates. Recently, the authors of [9] proposed an idea for breaking the single-global-model framework, called a collaborative federated learning (FL) framework. The key idea in this learning framework is to divide the edge clients into several groups. There are two types of groups in this framework, the normal group and the malicious group. The latter one involves the malicious clients. Each group performs the fundamental FL mechanism and generates its corresponding global model. Each edge client receives all global models from all the groups and employs them to predict the output prediction via a voting strategy. Thus, the edge client generates the final output based on the majority consensus of the global models. In this collaborative FL framework, grouping enables the segregation of edge clients into manageable subsets. This becomes crucial in large-scale deployments. By categorizing nodes into groups, isolating potentially malicious clients and minimizing their impact on the prediction output can be achieved in a collaborative FL framework. This approach is particularly effective in mitigating the risk of a malicious node influencing the global learning outcome. It is observed that the accuracy of this voting scheme varies significantly according to the ratio of the number of the normal groups to that of malicious ones. Based on the above observation, we here develop our proposed collaborative FL framework with a robust grouping scheme based on our early work [10]. In our proposed framework, each edge client initially obtains an ID assigned by the administrator. These IDs form a specified distribution.