The outlier defense that rewards an attacker for looking average

In federated learning, many clients train locally and send model updates to a server. The server never sees their raw data. That privacy-friendly separation creates a security problem: one client can submit a poisoned update that implants a backdoor—a hidden behavior activated by a special input pattern.

Krum is a robust aggregator built to reject such outliers. It scores each update by how close it is to the majority, then keeps the smallest score. Subramanian, Khan, and Islam reverse that logic: if closeness decides admission, a defense-aware attacker should shape its update to look unusually central.

Suppose the server receives n vectors and assumes at most f are Byzantine, meaning arbitrarily faulty or malicious. For each update, Krum finds its n − f − 2nearest neighbors and averages their squared Euclidean distances. The update with the lowest score wins. Multi-Krum keeps several low scorers and averages them.

def krum_scores(updates, byzantine_count):
    neighbor_count = len(updates) - byzantine_count - 2
    scores = []
    for i, update in enumerate(updates):
        distances = sorted(
            sum((a - b) ** 2 for a, b in zip(update, other))
            for j, other in enumerate(updates) if j != i
        )
        scores.append(sum(distances[:neighbor_count]) / neighbor_count)
    return scores

The site runs the validated TypeScript version; Python and C++ are direct translations of the same loop. This selector sees only whole-vector distance. It does not ask which coordinates carry a backdoor or whether an update behaves safely on triggered inputs.

The deterministic toy below contains six benign two-dimensional updates and one candidate. Its second coordinate is an illustrative attack signal, not a trained backdoor. At zero or 0.03, the candidate sits inside the cluster and Krum selects it. At 0.50, its distance gives it away. All scores and selections come from the tested core implementation.

A real attacker does not observe the server's benign updates. The paper therefore trains six clean local reference updates with varied learning rates, epochs, and data partitions. For a candidate, its proxy score averages the innermost half of a reference neighborhood. In our tiny reference set, the centered candidate scores 0.0014, while the distant candidate scores 0.2242.

Training happens in two stages. Stage one learns the backdoor with cross-entropy. Stage two retains that task loss while pulling the update toward a blend of the two densest references, matching a benign norm, and minimizing the proxy score. A final projection moves an update toward the densest reference, but caps that pull so at least 25% of the learned adversarial direction remains.

The naïve scaled backdoor demonstrates what Krum was designed to stop: attack success falls from 98.52% under ordinary averaging to 7.91%. Krum-Proxy reverses that result. The paper also reports malicious selection in 29 Krum rounds versus nine for its baseline, and a Multi-Krum inclusion rate of 58.3% versus 20.7%.

The evaluation fixes three malicious clients in each sampled group of ten, sets Krum's assumed Byzantine count equal to the true count, and tunes hyperparameters in preliminary runs before reusing them across the reported settings. Those choices establish a controlled attack demonstration; they do not measure how often an attacker gets that participation, reference quality, or defense knowledge in deployment.

The method also costs 1.29× the end-to-end runtime of constrain-and-scale, and its objective is tailored to distance-based selection. A reported transfer to trimmed mean is empirical, not evidence that the proxy directly models coordinate-wise defenses.

• Hide the server's assumed Byzantine count and vary client participation.
• Measure attack success as reference distributions drift away from benign clients.
• Score updates per layer and across rounds instead of with one global distance.
• Report confidence intervals across seeds for selection and attack-success rates.

Krum reduces a cloud of updates to distances, much as a nearest-neighbor rule reduces data to geometry. Explore how nonlinear partitions use different structure on the decision-tree page.