Ilmu Komputer & AI editorial
SWB-DM: A Calibrated Sliced-Wasserstein-Barycenter Aggregator with Delayed-Momentum Caching for Byzantine-Robust Federated Learning under Partial Participation
The core problem
Robust aggregation for federated learning (FL) has quietly inherited an assumption it cannot defend: that the clients sampled in any given round are a fair, representative sample of the full population. Under partial participation, this assumption fails routinely. When only a handful of clients report per round, even a modest fraction of adversaries can dominate the sampled cohort and invalidate the finite-sample guarantees on which coordinate-wise median, Krum, Bulyan, and trimmed mean all rely.
The paper introduces **SWB-DM** to address this gap directly. Its two components are:
1. **SWB (Sliced-Wasserstein Barycenter)** — a robust aggregator that treats each slice of a client update as a one-dimensional distribution, computes a *trimmed* Wasserstein barycenter across clients, and recovers coordinate identity through a medoid-based gauge-fixing step. The authors explicitly flag gauge-fixing as a heuristic they developed and do not claim it belongs to standard optimal-transport theory.
2. **DeMoA-style delayed momentum (DM)** — a cache that accumulates updates across the *full* client population each round, decoupling robustness from whoever happened to be sampled.
A central de
Innovation
The empirical program covers 448 CIFAR-10 configurations, plus CIFAR-100, FEMNIST, and a 500-client scalability run. Several mechanistically distinct failure modes emerge in prior defenses:
- **Even-sample coordinate-wise median** degrades to a deterministic wrong answer.
- **Krum** silently violates its own precondition and diverges without warning.
- **Bulyan's** threshold produces a sharp pass/fail boundary.
On attacks, **IPM defeats order-statistic defenses — including SWB — more reliably than ALIE**, confirmed through delta-space measurements against a convergence bound. This is a notable negative result for the SWB component in isolation.
SWB-DM's cache carries a real warm-up cost, but extending all baselines to the same round budget shows its CIFAR-10 gains are disproportionately large. On CIFAR-100, **FLTrust benefits more** — for reasons entirely unrelated to caching. The 500-client scalability run tests whether the cache's warm-up cost is amortized at scale, and the paper reports the outcome as part of the same evaluation suite.
Why it matters
The paper's contribution is best read as a structural correction rather than a new attack-specific defense. Order-statistic aggregators (median, Krum, Bulyan, trimmed mean) inherit finite-sample guarantees that are only valid under a fair-sample assumption. Under partial participation, that assumption is violated, and the paper shows the consequences are not graceful degradation but qualitatively different failure modes: deterministic wrong answers, silent precondition violations, and sharp pass/fail boundaries.
SWB-DM's response is to move robustness from the round level to the population level. The delayed-momentum cache accumulates information across all clients, so a round with few participants no longer determines the robustness profile. This is why the authors frame the cache as decoupling robustness from whoever happened to be sampled.
The trim-ratio calibration result is the most operationally important finding: under-trimming causes collapse at corruption levels a properly calibrated model survives. Practitioners deploying trimmed aggregators should treat the trim ratio as a first-class hyperparameter, not a cosmetic setting.
The IPM result is a caution against over-claiming. IPM defeats order-statistic defenses — including SWB — more reliably than ALIE, confirmed through delta-space measurements against a convergence bound. SWB-DM's gains are therefore not universal; they are conditional on the attack model and on the calibration of the trim ratio.
The CIFAR-100 result — FLTrust benefiting more, for reasons unrelated to caching — is a reminder that cross-dataset transfer of robustness claims is not automatic. The 500-client scalability run and the equal-round-budget comparison are the paper's main defenses against the objection that SWB-DM simply spends more computation.
Who should read this
Opening member content…