In federated training, what does coordinate-wise median aggregation take away from a malicious client that plain averaging hands them?

## What the server actually receives In collaborative or federated training the participants keep their rows and send back only an **update** — a vector shaped like the model's parameters, computed locally on data the server never sees. Each round the server folds those vectors into one shared model. That fold is the **aggregation rule**, and it is the only place the server can defend anything, because the update is the entire signal it gets. There is no row to inspect, no label to re-check, no provenance to verify: just a vector and the identity that sent it. ## Why a plain average hands a client a lever The default fold is a weighted mean. A mean is linear in every contribution, which means each client's influence on the result scales directly with the magnitude of what they send. A participant who submits a vector a thousand times larger than everyone else's does not get one thousandth of a say; they get almost all of it. The arithmetic offers no resistance at all — the adversary can choose the resulting model, not merely nudge it, and they can do it with a single identity in a single round. That is the property robust aggregation is built to remove. ## What a median or trimmed mean changes - A **coordinate-wise median** takes, for each parameter position independently, the middle value across the clients' updates. Middle values are set by *ordering*, not by magnitude. However huge a minority's numbers are, they sit at one end of the sorted list and the middle stays where the honest majority put it. - A **trimmed mean** discards a fixed fraction of the highest and lowest values at each coordinate and averages what is left. Same idea, with a dial: you choose how much of each tail to throw away. - **Distance- or similarity-based rules** go further and select the updates that agree most with the bulk of the others, discarding the rest. All three swap *magnitude* for *position among peers* as the thing that decides the outcome. The purchase is precisely this: an adversary controlling a minority of clients loses the ability to *choose* the aggregate. They keep the ability to influence it, bounded by how far the honest values themselves are apart. ## The tolerance is a conditional, not a property Every such rule is published with a tolerated fraction of malicious participants — a breakdown fraction. Read it as a conditional statement, because that is what it is. The bound is derived assuming the honest updates **concentrate**: they are close to each other and to their own mean. Under that assumption the adversary faces a dilemma with no good branch. Stay inside the tight honest range and your update is nearly an honest one, so it moves nothing. Step outside it and you are at the end of the sorted list, so you are trimmed away. Dissolve the assumption and you dissolve the dilemma. If the honest clients are already far apart — because they hold genuinely different data, which is the normal state of a cross-organisation federation — then "inside the honest range" is a large region, and an update chosen from inside it can be materially harmful while remaining unremarkable in position. The rule cannot separate it, because position among peers is all it can see. ## Two things the rule does not do First, it does not inspect anyone's data. The privacy arrangement that makes federation attractive — the server never receives rows — is exactly what removes the server's ability to audit. Robust aggregation is a substitute for auditing, not a form of it. Second, a coordinate-wise median does not return an update anybody submitted. It is assembled position by position, so the output can be a blend that no participant proposed and that sits outside the region any of them proposed. That is usually tolerable, but it means you cannot reason about the aggregate as "one of the honest suggestions". ## How to say it in an interview Averaging gives a minority unbounded influence because it is linear in the update's size. Order statistics give a minority bounded influence because they depend on rank, not size. The bound is real only while the honest population is tight, and that is a property of the deployment's data, not of the rule.