FUSE: Fairness-aware Update Screening against Byzantine Exploitation in $q$-Fair Federated Learning
Fairness-weighted federated learning deliberately inflates updates from high-loss clients, but under an update-only interface a server cannot tell legitimate amplification from adversarial scaling. This paper identifies that $q$-fair loss scaling preserves the class-mixture structure of honest updates while warping their coefficient constraint from a unit-sum simplex to a radial nonnegative cone. Building on this geometry, FUSE uses a small trusted labeled set to recover latent coefficients, screens submissions jointly for radial scale and cone consistency, and renormalizes the aggregate to protect both robustness and fairness.
The paper makes a clear conceptual advance by identifying that $q$-fair scaling breaks the simplex assumptions underlying prior structure-aware defenses, replacing them with a cone model that supplies two separable test statistics. FUSE is empirically strong: on four benchmarks it achieves the highest seed-wise worst-attack global accuracy, with gains of 3.9–30.1 percentage points over the best baseline per dataset, and it rejects only 0–9.7% of high-loss honest clients. The theoretical results are comparatively modest—stable recovery bounds and exact-recovery conditions under idealized geometric separation—but they are consistent with the mechanism and do not overclaim.
The geometric diagnosis is the strongest element. The controlled mismatch experiment in Figure 3(a) shows that fairness scaling leaves the cone residual nearly unchanged (0.178) while inflating the simplex residual from 0.185 to 1.077, confirming that the simplex is the wrong model. The $2^{3}$ factorial ablation in Table 3 isolates component roles cleanly: removing the scale screen exposes FUSE to Magnitude Scaling, while removing the cone screen breaks invalid-mixture attacks, and the two together are necessary for a high adversarial floor. The screening audit in Table 2 provides rare transparency about whom the defense actually rejects.
The strongest limitation is the reliance on Assumption 2 (shared class-conditional label skew), which guarantees the nonnegative cone structure. The paper admits that guarantees do not cover arbitrary violations of shared class-conditionals, leaving the method's reliability under general heterogeneity unclear. A second concern is the update-only interface itself: the server is assumed unable to receive the scalar loss separately, yet transmitting a single scalar carries negligible overhead and privacy risk compared with a full gradient, so the problem formulation, while technically valid, addresses a somewhat artificial constraint.
Practically, FUSE trades clean accuracy for robustness on some tasks—it trails the best clean baseline by 1.2–2.6 pp on MNIST, EMNIST-Balanced, and AGNews—raising the question of whether the trade-off is acceptable in non-adversarial settings. Finally, Theorem 2's exact-recovery guarantee requires strong separation that is not shown to hold generically in finite-sample training, and over-declaring the Byzantine budget causes the defense to discard honest high-loss clients.
The empirical evidence largely supports the central claim that cone geometry enables better screening than magnitude or simplex alternatives. However, the comparison to BOBA is weakened because the full-parameter baseline was computationally prohibitive and is reported for only one seed; the main comparison uses classifier-coordinate BOBA, which matches FUSE's coordinate choice for vision tasks but may not reflect the original method's intended behavior. The comparisons to FLTrust, Krum, and Trimmed Mean are fair in that they operate on the same fairness-scaled updates, yet these baselines were not designed for the update-only $q$-FFL interface and function as generic robust aggregators rather than direct competitors. The seven-attack suite is broad, but the adaptive cone-preserving attack in Appendix E.14 still achieves 65.6% accuracy on CIFAR-10 versus 82.4% clean, delineating a nontrivial but observable attack surface.
Experimental detail is unusually thorough: registered random seeds, exact hyperparameters, Dirichlet skew parameters, attack configurations, and a predefined collapse criterion are all documented in Appendix B. The three-component factorial ablation and geometry diagnostics add confidence. What blocks independent reproduction is the absence of any code repository, release link, or artifact appendix in the provided text. While the Reproducibility Statement asserts that all details needed are given, reproducing exact NNLS coefficient recovery, trusted cone construction, and 1500-round Byzantine simulations without source code would be labor-intensive and error-prone. The paper does not claim to release code.
Client-level fair federated learning, in the form of $q$-fair federated learning ($q$-FFL), agnostic federated learning, or tilted empirical risk minimization, has emerged as an attractive solution to equalize utility across heterogeneous clients. This paradigm grants high-loss clients greater relative influence, while a central server aggregates their loss-weighted updates into a single shared model. Yet, the Byzantine robustness of $q$-fair federated learning has been largely neglected, leaving the server unable to tell legitimate fairness-induced amplification from malicious update scaling. To address this critical gap, we formalize the problem of Byzantine-robust $q$-fair federated learning under an \emph{update-only interface}, in which the server observes nothing but the fairness-scaled client updates. Our analysis under shared class-conditional label skew shows that fairness scaling preserves the nonnegative class-mixture structure of honest updates, while replacing their unit-sum constraint by a client-dependent radial scale. Moving beyond magnitude-based screening, we show that this warped geometry supplies two complementary tests, one radial and one structural, that a single norm cannot provide. We then introduce FUSE, a structure-aware robust aggregator that uses a small trusted labeled dataset for coefficient recovery, scale and cone-consistency screening, and post-screening step-size control. Across four benchmarks and seven Byzantine attacks, FUSE improves seed-wise worst-attack accuracy over the strongest baseline on each benchmark by 3.9--30.1 percentage points, while largely preserving the influence of the high-loss honest clients that fairness is meant to protect.
Pick a starting point or write your own. Challenges run in the background, so you can keep reading while the AI investigates.
No challenges yet. Disagree with the review? Ask the AI to revisit a specific claim.