⚡ electrical engineering

Partial Model Sharing Improves Byzantine Resilience in Federated Conformal Prediction

This paper proposes a Byzantine-resilient federated conformal prediction method that utilizes partial model sharing to secure both training and calibration phases, achieving robust uncertainty quantification with tighter prediction intervals and reduced communication overhead.

Original authors: Ehsan Lari, Reza Arablouei, Stefan Werner

Published 2026-05-13

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Ehsan Lari, Reza Arablouei, Stefan Werner

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine a group of students (the clients) trying to solve a complex math problem together without ever showing their homework to each other. They send their answers to a teacher (the server) who combines them to create a "global solution." This is Federated Learning.

However, some students are troublemakers (Byzantine clients). They might send wrong answers on purpose to mess up the final solution, or they might lie about how confident they are in their answers.

This paper proposes a new way for these students to work together that is both smarter and safer against these troublemakers. It does this in two main stages: Learning and Checking.

1. The Learning Stage: The "Partial Sharing" Trick

Usually, when students send their answers, they send the entire solution. If a troublemaker sends a bad answer, it can ruin the whole thing.

The authors suggest a new rule: Only share a few pieces of the puzzle at a time.

The Analogy: Imagine the students are sending a 50-piece puzzle to the teacher. Instead of sending all 50 pieces every time, they only send 15 random pieces.
Why it helps: If a troublemaker tries to poison the solution by sending a bad piece, they can only mess up those 15 pieces. The teacher can ignore the bad pieces because the other students are sending good ones for the rest of the puzzle. It also saves time and bandwidth because they aren't sending the whole puzzle every time.

2. The Checking Stage: The "Histogram" and "Distance" Test

After the students learn the solution, they need to check how accurate it is. In this field, they use something called Conformal Prediction to create a "safety net" (a prediction interval) around their answers. They need to agree on how wide this safety net should be.

Usually, students send their "error scores" (how wrong they were) to the teacher. Trouble-makers can lie and say, "I was perfect!" (making the safety net too small) or "I was terrible!" (making the safety net huge).

The authors' method fixes this by changing how students report their scores:

The Histogram: Instead of sending a list of raw numbers, students turn their scores into a simple bar chart (histogram). They just say, "10% of my answers were in this range, 20% in that range," etc. This hides the raw data (keeping privacy) but shows the general shape of their performance.
The Distance Test: The teacher looks at everyone's bar charts.
- The Good Students: Their charts look very similar to each other.
- The Trouble-makers: Their charts look weird and very different from the group.
The Result: The teacher calculates a "suspicion score" based on how far a student's chart is from the others. The students with the highest suspicion scores are kicked out of the final calculation. The teacher then builds the safety net using only the honest students' data.

The Big Win

The paper tested this against three types of troublemakers:

The "Efficiency" Attacker: Tries to make the safety net too small (dangerous).
The "Coverage" Attacker: Tries to make the safety net huge (wasteful).
The "Random" Attacker: Just throws random numbers at the teacher.

The Results:

Standard methods failed: They either let the troublemakers ruin the safety net or let the bad training data make the whole model weak.
This new method succeeded: By only sharing partial pieces during learning and using the "bar chart distance test" during checking, the system:
1. Kept the safety net at the correct size (neither too big nor too small).
2. Made the safety net much tighter (more precise) than previous methods.
3. Saved communication time because they weren't sending full data sets.

In short, the authors built a system where the group can learn together and check their work accurately, even if a significant portion of the group is trying to sabotage them, all while sending less data back and forth.

Technical Summary: Partial Model Sharing Improves Byzantine Resilience in Federated Conformal Prediction

Problem Statement
Federated Learning (FL) enables collaborative model training across decentralized devices without sharing raw data, yet it remains vulnerable to Byzantine adversaries. These malicious clients can manipulate the learning process by submitting corrupted gradients or misleading information, degrading the global model. While Federated Conformal Prediction (FCP) offers distribution-free uncertainty quantification with statistical coverage guarantees, standard FCP inherits FL's vulnerabilities. Existing robust approaches, such as Rob-FCP, primarily focus on hardening the calibration phase by detecting malicious clients based on non-conformity scores. However, they fail to address poisoning during the federated training phase, where adversaries can already corrupt the learned model, thereby propagating errors into the conformal intervals. Furthermore, robust calibration methods often incur additional communication overhead.

Methodology
The authors propose a Byzantine-resilient FCP framework that integrates Partial Sharing Online Federated Learning (PSO-Fed) with robust conformal calibration. The method operates in two distinct phases:

Training Phase (Partial Model Sharing):
Instead of exchanging full model parameter vectors, clients and the server exchange only a subset of model coordinates at each iteration. This mechanism, defined by a diagonal selection matrix $S_{k,n}$ , inherently restricts the attack surface. By limiting the fraction of parameters an adversary can influence in the aggregated model, partial sharing attenuates the impact of poisoned updates while simultaneously reducing communication costs. Theoretical analysis from prior work indicates that PSO-Fed maintains convergence even when Byzantine clients inject noise.
Calibration Phase (Histogram-Based Detection):
To defend against Byzantine manipulation of non-conformity scores, benign clients compress their local scores into histogram-based characterization vectors. These vectors represent the empirical probability distribution of scores across $H$ bins. The server then computes pairwise $\ell_2$ distances between these vectors to assign a maliciousness score ( $m_k$ ) to each client, defined as the average distance to its $K_b - 1$ nearest neighbors. Clients with the lowest maliciousness scores are identified as benign and retained for estimating the conformal quantile, while outliers (Byzantine clients) are excluded.

Key Contributions

Dual-Phase Resilience: Unlike prior works that focus solely on calibration, this approach protects both the federated training and conformal calibration stages. It leverages partial sharing to mitigate training-time poisoning and histogram-based vector analysis to filter calibration-time attacks.
Communication Efficiency: The method reduces communication overhead by transmitting only a fraction of model parameters during training and compressed histogram vectors during calibration, avoiding the transmission of raw scores or full statistics.
Robust Quantile Estimation: By filtering Byzantine contributors based on distance-based maliciousness scores, the server estimates the conformal quantile using only benign data, ensuring valid prediction intervals.

Experimental Results
The authors evaluated the proposed method against standard FCP and Rob-FCP under three Byzantine attack scenarios: efficiency attacks (reporting abnormally small scores), coverage attacks (reporting artificially large scores), and random attacks.

Detection Efficacy: The maliciousness scores clearly distinguished Byzantine clients from benign ones across all attack types, allowing for reliable exclusion.
Coverage and Interval Width: Under various attack scenarios, the proposed method achieved coverage closer to the nominal 90% target compared to standard FCP (which suffered from inflated coverage and wide intervals) and Rob-FCP.
Performance Gains: The proposed approach produced prediction intervals that were 1.8 times tighter than Rob-FCP and 2.2 times tighter than standard FCP. This improvement is attributed to the attenuation of model poisoning during training (via partial sharing) and robust quantile estimation during calibration.

Significance and Claims
The paper claims to establish a robust and communication-efficient approach to federated uncertainty quantification. By coupling communication-efficient partial parameter exchange with robust conformal calibration, the method achieves resilience against Byzantine attacks across the entire FCP pipeline. The authors assert that their approach yields valid and reliable prediction intervals with substantially tighter bounds than existing methods, even when a significant portion of clients (e.g., 20%) are Byzantine. They conclude that integrating PSO-Fed into robust calibration frameworks offers a promising direction for trustworthy FL, though they note that establishing theoretical guarantees quantifying the specific effects of partial sharing on robustness and coverage remains a direction for future work.

1. The Learning Stage: The "Partial Sharing" Trick

2. The Checking Stage: The "Histogram" and "Distance" Test

The Big Win

Technical Summary: Partial Model Sharing Improves Byzantine Resilience in Federated Conformal Prediction

More like this