Robust Federated Learning
Robust Federated Learning (Byzantine-Tolerant Distributed Training) · Also known as: Byzantine-robust federated learning, fault-tolerant federated learning, robust FL, Byzantine-tolerant distributed learning
Robust Federated Learning extends standard federated learning with Byzantine-tolerant aggregation rules that protect the global model against malicious, corrupted, or unreliable clients. Instead of naively averaging client gradients, robust aggregation methods such as coordinate-wise median or Krum filter out harmful updates so that a minority of adversarial participants cannot derail training.
Read the full method
Sign in with a free account to read this section.
Method map
The neighbourhood of related methods — select a node to explore.
When to use it
Use Robust Federated Learning when data cannot leave client devices or institutions due to privacy, regulatory, or bandwidth constraints, AND when the client population may include unreliable, compromised, or adversarial participants — for example in cross-device mobile applications, hospital consortia, or IoT deployments. It is the right choice when the threat model includes data poisoning or Byzantine faults affecting a minority of clients. Do not use it when all clients are trusted and data can be pooled centrally — centralized training is simpler, faster, and easier to validate. Avoid it when the fraction of Byzantine clients is unknown and may exceed the tolerance threshold of the chosen aggregation rule (typically less than half), as robustness guarantees break down in that regime.
Strengths & limitations
- Provably tolerates a bounded fraction of Byzantine or malicious clients without compromising the global model.
- Preserves client data privacy: raw data never leaves the client, only gradient updates are shared.
- Compatible with differential privacy mechanisms (gradient clipping and noise addition) for additional privacy guarantees.
- Applicable to highly heterogeneous, non-IID data distributions across clients.
- Modular: the robust aggregation rule can be swapped (median, Krum, Bulyan, trimmed mean) to match the threat model.
- Scales to large numbers of clients with asynchronous or partial participation protocols.
- Robust aggregation rules reduce effective signal and slow convergence compared to standard FedAvg.
- Robustness guarantees hold only up to a threshold fraction of Byzantine clients; if adversaries exceed this fraction, the model can still be corrupted.
- Non-IID data distributions across clients degrade accuracy even in the absence of attacks, and robust aggregation does not fully resolve this heterogeneity problem.
- Communication overhead per round is high; adding compression or sparsification can interact poorly with robustness guarantees.
- Evaluating model quality is difficult: there is no centralized validation set that reflects the true data distribution across all clients.
Frequently asked
What fraction of Byzantine clients can Robust FL tolerate?
Most robust aggregation rules (Krum, coordinate-wise median, trimmed mean) provide guarantees when fewer than half the clients are Byzantine. The exact threshold depends on the rule: Krum tolerates up to (n-2)/2 Byzantine clients among n participants. If adversaries exceed the tolerance threshold, robustness guarantees no longer hold.
Does Robust FL protect privacy as well as Byzantine clients?
Byzantine robustness and privacy are orthogonal properties. Robust aggregation defends against corrupted gradient updates but does not prevent an honest-but-curious server from inferring private information from the updates. Differential privacy (gradient clipping and noise) must be added separately to achieve privacy guarantees.
How does it differ from standard FedAvg?
Standard FedAvg (McMahan et al., 2017) uses a weighted average of client model updates, which a single malicious client can arbitrarily distort. Robust FL replaces the average with a Byzantine-tolerant aggregation rule (e.g., coordinate-wise median or Krum) that limits the influence any one client can have on the global model, at some cost to convergence speed.
What is the main convergence challenge?
Non-IID client data is the primary convergence challenge even without Byzantine clients: when clients have very different local distributions, local gradients point in different directions, slowing global convergence. Robust aggregation rules are designed for Byzantine tolerance, not for resolving statistical heterogeneity, so both problems need separate mitigation strategies.
Which aggregation rule should I choose?
Coordinate-wise median is simple and achieves near-optimal statistical rates (Yin et al., 2018). Krum is computationally heavier but provides stronger per-round selection guarantees. Trimmed mean offers a balance. Bulyan combines Krum selection with trimmed aggregation for higher robustness. The choice should match your threat model and the proportion of clients you expect to be malicious.
Sources
- Blanchard, P., El Mhamdi, E. M., Guerraoui, R., & Stainer, J. (2017). Machine Learning with Adversaries: Byzantine Tolerant Gradient Descent. Advances in Neural Information Processing Systems, 30. link ↗
- Yin, D., Chen, Y., Kannan, R., & Bartlett, P. (2018). Byzantine-Robust Distributed Learning: Towards Optimal Statistical Rates. Proceedings of the 35th International Conference on Machine Learning (ICML), PMLR 80:5650–5659. link ↗
How to cite this page
ScholarGate. (2026, June 3). Robust Federated Learning (Byzantine-Tolerant Distributed Training). ScholarGate. https://scholargate.app/en/machine-learning/robust-federated-learning
Which method?
Set this method beside its closest kin and read them side by side — the library lays the books on the table; the choice is yours.
- Bayesian Federated LearningMachine learning↔ compare
- Federated LearningPrivacy↔ compare
- Online Federated LearningMachine learning↔ compare
- Robust Gradient BoostingMachine learning↔ compare
- Semi-supervised Federated learningMachine learning↔ compare
- Transfer LearningMachine learning↔ compare