Communication-Efficient Byzantine-Robust Federated Conformal Prediction via Partial Model Sharing

Technical Summary: PRISM-FCP – Communication-Efficient Byzantine-Robust Federated Conformal Prediction via Partial Model Sharing

Problem Statement
Federated Learning (FL) enables collaborative model training without sharing raw data but introduces vulnerabilities to Byzantine (malicious) clients who can poison updates during training or manipulate calibration data. While existing methods address these threats in isolation, a critical gap remains: current defenses are typically stage-specific. Robust aggregation rules protect the training phase but ignore calibration manipulation, while robust conformal calibration (e.g., Rob-FCP) assumes a secure training phase. This separation is insufficient because a poorly trained global model (due to training-phase poisoning) produces unstable residuals, which widens benign nonconformity score distributions and reduces the separability between benign and Byzantine clients during calibration. Consequently, existing approaches fail to provide an end-to-end solution that ensures both accurate point predictions and calibrated uncertainty quantification under adversarial conditions, often at the cost of high communication overhead.

Methodology: PRISM-FCP
The authors propose PRISM-FCP (Partial shaRing and robust calIbration with Statistical Margins for Federated Conformal Prediction), a framework that integrates partial model sharing with robust histogram-based calibration to mitigate Byzantine attacks across both training and calibration phases.

1. Training Phase (Partial Model Sharing):
   Instead of transmitting full model updates, clients exchange only a randomly selected subset of $M$ parameters out of $D$ total parameters per round. This mechanism, originally designed for communication efficiency, acts as a stochastic filter against model-poisoning attacks. When a Byzantine client injects an adversarial perturbation, the random masking attenuates the expected energy of the perturbation entering the aggregated update by a factor of $M/D$. This reduces the Byzantine-induced component of the steady-state Mean Square Error (MSE), leading to a more accurate global model and tighter residual distributions for benign clients.

2. Calibration Phase (Histogram-Based Filtering):
   Clients compute nonconformity scores (absolute residuals) on local calibration sets. To preserve privacy and reduce communication, clients convert these scores into characterization vectors (histograms of normalized scores) rather than sharing raw scores or individual values.

   • The server computes pairwise $\ell_2$ distances between these vectors.
   • A "maliciousness score" is assigned to each client based on the sum of distances to its $K_b - 1$ farthest neighbors (where $K_b$ is the number of benign clients).
   • Clients with the highest maliciousness scores (suspected Byzantine) are filtered out.
   • The conformal quantile is estimated using only the secure score summaries from the remaining benign clients.

Key Contributions

• End-to-End Robustness: The paper demonstrates that partial sharing is not merely a communication-saving technique but a principled defense mechanism. By attenuating training-phase perturbations, it indirectly strengthens calibration-phase robustness.
• Theoretical Analysis:
  • The authors prove that partial sharing attenuates injected Byzantine perturbation energy by a factor proportional to $M/D$.
  • They derive bounds showing that reduced training error leads to tighter residual distributions, which in turn reduces the deviation of the conformal quantile and narrows prediction intervals.
  • The analysis establishes that reduced training error concentrates benign characterization vectors, increasing the separation margin from Byzantine outliers and improving the reliability of distance-based filtering.
• Communication Efficiency: The framework significantly reduces communication overhead (by transmitting only $M/D$ of the parameters) while maintaining or improving robustness compared to full-sharing baselines.

Experimental Results
Extensive experiments were conducted on synthetic data and the UCI Superconductivity dataset under three attack scenarios: efficiency attacks (deflating scores), coverage attacks (inflating scores), and random attacks (adding noise).

• Coverage and Interval Width: PRISM-FCP maintained near-nominal empirical coverage (approx. 90%) across all attack types. In contrast, standard Federated Conformal Prediction (FCP) suffered from significant interval inflation (e.g., 4.4x wider intervals under coverage attacks) or undercoverage.
• Comparison with Rob-FCP: While Rob-FCP (which uses full sharing with calibration filtering) maintained correct coverage, PRISM-FCP produced significantly tighter prediction intervals (e.g., 1.2x narrower in synthetic experiments). This improvement is attributed to the reduced training error achieved via partial sharing.
• Robustness to Unknown Attack Size: The method remained effective even when the number of Byzantine clients was unknown, utilizing a Median Absolute Deviation (MAD) based outlier rule.
• Nonlinear Models: The approach was successfully extended to nonlinear regression using a Multi-Layer Perceptron (MLP) with a layer-wise partial sharing mechanism, demonstrating applicability beyond linear models.
• Stealth Attacks: PRISM-FCP showed resilience against adaptive "ALIE" attacks, maintaining near-nominal coverage where other robust aggregation baselines (like Krum) struggled.

Significance and Claims
The paper claims that PRISM-FCP offers a robust and communication-efficient approach to federated uncertainty quantification. Its primary significance lies in the joint treatment of training and calibration phases. The authors argue that robust training and robust calibration are interdependent; by mitigating Byzantine influence during training via partial sharing, the framework naturally improves the separability of benign and malicious clients during calibration. This coupling allows PRISM-FCP to achieve tighter prediction intervals than methods that only filter during calibration, all while reducing communication costs. The work positions partial model sharing as a dual-purpose tool: a mechanism for efficiency and a stochastic defense against adversarial perturbations.

Limitations and Future Work
The authors note that their theoretical analysis relies on a linear regression model and a stochastic Gaussian perturbation model for training attacks. They acknowledge that extending the theory to fully adaptive adversaries who might exploit the random selection masks is an open direction. Furthermore, while the method was tested on nonlinear MLPs, a comprehensive theoretical framework for deep networks remains future work. The paper also notes that extending the approach to classification tasks would require specific nonconformity scores and set-valued prediction rules.