## 5 Proposed Approach and System
### Local Computation
Details regarding these datasets are presented in Table 2. The PathMNIST dataset comprises \(80,000\) non-overlapping image patches from hematoxylin and eosin-stained histological images, including a test dataset of \(10,000\) image patches from a different clinical center. The dataset is comprised of 9 types of tissues, and each image has dimensions of \(3\times 28\times 28\) pixels. The OCTMNIST dataset comprises \(90,000\) valid optical coherence tomography (OCT) images for retinal diseases. The dataset is comprised of four diagnosis categories, and each image is resized to \(1\times 28\times 28\) pixels. ### Poisoning Attacks

In this experiment, we considered both targeted and non-targeted attacks. For non-targeted attacks, our analysis presumed that adversarial devices transmit randomized parameter updates, designed to undermine the global model's reliability. Conversely, for targeted attacks--specifically assessing two prominent variants: class-redirection and covert-channel--we emulated class-redirection tactics by reassigning the original training labels and produced covert-channel instances through the deliberate insertion of activation patterns into unprocessed training data. Expanded methodological particulars are presented in the subsequent sections. * Label-flipping: We conducted a label-flipping attack on the PathMNIST dataset, where compromised devices relabeled the training dataset's labels from 2 to 4 to simulate this type of attack. * Backdoor: To construct backdoor examples, we reassigned labels for DRUSEN exhibiting white horizontal stripes as diabetic macular edema (DME) on the OCTMNIST dataset. \begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Dataset** & **Training Set** & **Class** & **Test Set** & **Data Type** \\ \hline PathMNIST & \(80,000\) & 9 & \(10,000\) & _image_ \\ \hline OCTMNIST & \(90,000\) & 4 & \(10,000\) & _image_ \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Descriptions of datasets. ### Evaluation Metrics

We utilized test accuracy and test error rate as indicators for models trained on various datasets. The primary objective of our approach was to enhance the accuracy of the global model. Swarm Learning (SL) [10] serves as a widely recognized method in non-adversarial settings within Blockchain Federated Learning (BFL). Consequently, we evaluated the SL scheme without attacks as a baseline comparison against Krum [17], while also presenting results from our proposed scheme under varying numbers of malicious devices. ### FL Settings

In our evaluation setup, we configured the number of devices at \(n=10\), selecting all devices during each iteration throughout training. Our training model was based on a Convolutional Neural Network (CNN) with the following architecture: \(Input\to Conv\to Maxpool\to FullyConnected\to Output\). The weight and bias parameters for each layer were defined as follows: for the Conv layer, \(w1=(10,1,3,3)\) and \(b1=(10,1)\); Fully Connected layer, \(w2=(1960,128)\) and \(b2=(1,128)\); and the Output layer, \(w3=(128,10)\) and \(b3=(1,10)\). Additional training parameters are summarized in Table 3.

Data allocation per device was performed equally, with each device containing 8000 uniformly distributed data points from the PathMNIST dataset and 9000 from the OCTMNIST dataset. We examined different scenarios regarding the proportion of malicious devices ranging from 10% to 50%. Our scheme was compared against both the SL and Krum methodologies. The batch size was set at \(b=128\). Furthermore, we observed that the loss function generally converged after approximately 50 rounds; thus, we established the number of training epochs at \(e=50\). ## 8 Experimental Results

In this section, based on extensive experimental results, we analyze the performance of our scheme from two perspectives: (1) Defensive effectiveness against both targeted and non-target attacks; and (2) computational and communication overheads.