Native Byzantine-Robust Aggregation for Trustworthy Federated Learning: A C++20 Evaluation of Krum, Multi-Krum, Trimmed Mean, and Coordinate-wise Median

Imagine a group of strangers trying to solve a complex puzzle together, but they are all in different rooms and cannot see each other's pieces. They can only send descriptions of their progress to a central leader. This is the essence of a modern computing method called federated learning, where many devices train a shared artificial intelligence without ever sharing their private data. The system works beautifully when everyone plays fair, but it faces a critical weakness: what if one of those strangers is lying? A compromised device could send a completely wrong description, not because it is broken, but because it is malicious, aiming to corrupt the final answer. In this scenario, simply trusting the majority is not enough, because a few bad actors can drag the whole group off course. The challenge for scientists is to build a system that can spot these liars and ignore their bad advice, ensuring the final result remains trustworthy even when some participants are actively trying to sabotage the process.

Researchers have long known how to mathematically filter out these bad actors using specific rules, but turning those rules into fast, reliable software has been difficult. A new study by Md Shahanur Islam Shagor at Voronezh State University of Forestry and Technologies tackles this problem by building a high-speed engine to run these safety checks. The team did not invent a new way to filter bad data; instead, they took four existing, well-known methods for spotting liars and rebuilt them from the ground up using a modern programming language designed for speed and safety. Their goal was to prove that these safety mechanisms could run fast enough to be useful in real-world applications, while also ensuring they never accidentally accept a broken or dangerous input.

The researchers focused on four specific strategies for handling bad data. The first two, known as Krum and Multi-Krum, work by measuring how far each person's update is from everyone else's. If one person's update is wildly different from the group, the system identifies it as an outlier and either picks the most consistent person or averages the few most consistent people. The other two strategies, the trimmed mean and the coordinate-wise median, work by looking at each part of the puzzle piece individually. They discard the highest and lowest numbers for every single part before calculating the average, or they simply pick the middle value, effectively ignoring extreme outliers that might be trying to skew the result. While these mathematical ideas are well understood, the researchers wanted to see how they performed when implemented as a native computer program that could run alongside the massive software systems used for artificial intelligence today.

To test their work, the team created a controlled simulation where ten virtual clients tried to train a model over twenty-five rounds. In this simulation, two of the clients were programmed to act as malicious attackers. One attacker tried to flip the direction of the progress entirely, while the other flooded the system with random, high-variance noise designed to confuse the math. Despite these aggressive attempts to derail the process, the system successfully guided the model toward the correct target. After twenty-five rounds, the distance between the model's current position and the true target had shrunk to less than five percent of where it started. This result held true for the Multi-Krum method, the trimmed mean, and the median, proving that these established rules could indeed withstand a twenty percent attack rate in a controlled environment.

However, the most surprising part of the study was not just that the safety rules worked, but how fast they ran compared to standard software tools. The researchers measured the time it took to process updates containing one thousand parameters and again with one hundred thousand parameters. For the distance-based methods like Krum and Multi-Krum, the new native code was dramatically faster. When processing one thousand parameters, the new code was more than two times faster than the standard tools, and when the size grew to one hundred thousand parameters, it became more than three times faster. This speedup happened because the new code could use the computer's processor to handle many calculations at once and perform complex distance checks with extreme efficiency.

Yet, the story was different for the other methods. The trimmed mean, which involves sorting numbers to find the middle, did not get faster with the new code. In fact, at smaller sizes, it was actually slower than the standard tools, and at larger sizes, it barely matched them. This finding is crucial because it shows that simply rewriting code in a faster language does not automatically make everything faster. The standard tools for sorting numbers are already so highly optimized that a custom program struggles to beat them. The researchers found that the speed advantage depends entirely on the specific math being done; for some tasks, the new engine is a massive leap forward, while for others, it offers no benefit at all.

The study also emphasized that speed cannot come at the cost of safety. The new system was designed with a "fail-closed" approach, meaning that if the inputs are messy, the numbers are missing, or the configuration is impossible, the system simply refuses to run rather than producing a potentially dangerous result. It checks for impossible scenarios, such as having too many attackers for the number of people present, and rejects them immediately. It also ensures that no strange, undefined numbers can slip through the cracks to corrupt the final model. This strictness ensures that the system remains trustworthy, even if it means rejecting a request that a less careful system might have tried to process.

Ultimately, this work demonstrates that building a trustworthy artificial intelligence system requires a careful balance between security and performance. The researchers showed that it is possible to create a robust defense against malicious actors that is both mathematically sound and computationally efficient, but only if the design is tailored to the specific method being used. The study concludes that there is no single "fast" solution for all safety problems. Instead, engineers must choose the right tool for the job, understanding that some safety rules will run much faster than others depending on the size of the data and the nature of the calculation. By combining strict safety checks with high-performance computing, it is possible to build federated learning systems that are not only smart but also resilient enough to be trusted in the real world.