## 5 Proposed Approach and System
### Local Computation
### Defense Effectiveness

To assess the defensive effectiveness of our PPBFL, we conducted simulations of both non-targeted and targeted attacks on the PathMNIST and OCTMNIST datasets. The experiments were analyzed from the perspective of varying attack proportions and different iterations. Additionally, we provide an accuracy comparison with the baseline scheme (SL) [10], as well as state-of-the-art methods such as Krum [17]. Figures 5 and 6 illustrate the training processes over 50 iterations for the PathMNIST and OCTMNIST datasets, respectively. Specifically, despite varying numbers of attackers, our PP-BFL maintained an accuracy rate consistent with that of the baseline under both non-targeted and targeted attacks, thereby achieving robustness alongside high accuracy. \begin{table}
\begin{tabular}{c c} \hline \hline
**Parameter** & **Value** \\ \hline No. of iterations & 1500 \\ \hline No. of epochs & 1 \\ \hline Learning rate & 0.5 \\ \hline Minimal batch size & 64 \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Training configuration. ### Overhead of Our Scheme

The computational efficiency of PPBFL is closely tied to its operational performance. We evaluated its resource consumption by measuring computational and communication demands, tracking how these metrics evolve as more devices join the network. Figure 7 demonstrates substantially reduced processing requirements on devices compared to edge servers--a difference stemming from their distinct operational roles. While devices primarily distribute gradient shares, edge nodes shoulder the majority of secure computational tasks. Communication patterns reveal similar disparities, as illustrated in Figure 8. Devices maintain leaner communication channels, mainly transmitting gradient shares to edge nodes and receiving aggregated weight updates. Conversely, edge infrastructure manages denser data exchanges to facilitate effective similarity calculations, requiring multiple coordination steps between network components. In parallel, we conducted comparative analyses between our PPBFL framework and the MPC-based PPML approach [16], evaluating computational and communication costs across device and edge node operations. The experimental results presented in Figure 7 reveal that PPBFL demonstrated superior performance in terms of computational efficiency, which was particularly noticeable on devices. Notably, our solution maintained stable computational demand regardless of growth in the quantity of devices, while PPML exhibited a quadratic growth pattern in resource consumption with an increasing number, as can be seen from Figure 7a. Corresponding server-side analyses, as shown in Figure 7b, confirmed analogous efficiency advantages. This performance gap stems from PPBFL's optimized computational architecture, compared to PPML's more complex operational requirements. The communication metrics illustrated in Figure 8 further highlight PPBFL's

Figure 5: Accuracies of our scheme and other schemes when implementing un-targeted attack over PathMINST data, where \(Att\) denotes the percentage of attackers. Figure 6: Accuracies of our scheme and other schemes when implementing label-flipping attack over OCTMNIST data, where \(Att\) denotes the percentage of attackers. technical superiority, achieving reduced data transmission requirements through minimized interaction rounds between devices and edge nodes. Unlike PPML's intensive communication protocols requiring multi-party coordination and cloud server mediation, our framework implements streamlined data exchange mechanisms. Additionally, PPML's architecture demands supplementary communication resources to handle device disconnections, whereas PPBFL inherently maintains operational stability without requiring such compensatory measures. Operations executed through the smart contract were processed as Ethereum transactions, prompting us to quantify computational expenses through analyzing the gas units consumed during EVM instruction execution.