Why does a trimmed-mean aggregation rule stop protecting a federated model when the banks training it hold very different customer books?
answer
- the guarantee has a precondition
- what must be true of honest updates
- different books, different update directions
- the honest spread is the hiding place
- the rule can only compare positions
basics
~20 sIts guarantee assumes honest updates cluster. When each bank's data differs, honest updates are already far apart, so an adversary's silo can send something harmful that still sits inside the honest spread, where position-based trimming cannot reach it.
solid answer
~50 sRules like the trimmed mean and the coordinate-wise median separate contributions by where they sit relative to the other clients, and their stated tolerance to malicious participants is derived assuming honest updates concentrate around a common value. That assumption is what forces the adversary into a losing choice: be inside a tight honest range and be harmless, or be outside it and be discarded. A cross-silo federation of banks with different customer mixes, product lines and geographies violates the assumption by construction — heterogeneity is the normal state, not a degradation. The honest updates already disagree widely, so the region that survives trimming is large, and an adversary who keeps their submission inside it is not separable from an honest outlier by any rule that only knows position. The correct answer to "we take the median, so a minority cannot move it" is: only while the honest updates cluster.
go deeper
Recall that these rules judge an update by where it sits among the others, so an update that looks ordinary is not filtered no matter what it does.
Be ready to state the adversary's dilemma and then show which branch heterogeneity opens: unremarkable in position, consequential in effect.
Demonstrate that you would measure the honest spread in your own federation before quoting any tolerance, and explain why trimming harder deletes the minority participant.
Frame it as who the federation admits: every participant with a genuinely different book widens the region an adversary can hide in, and that is an onboarding decision, not a tuning one.
## The claim being examined The standard sentence is: *we aggregate client updates with a coordinate-wise median (or a trimmed mean), so a minority of malicious clients cannot move the model.* It is not wrong — it is conditional, and the condition is almost never stated when the sentence is said out loud. ## Where the tolerance comes from Robust aggregation rules are published with a tolerated fraction of malicious participants. The derivation works because of a dilemma the adversary faces. Suppose the honest clients all send updates that are close to one another. Then: - An update far from that tight cluster is at an extreme of the sorted values at many coordinates, so trimming removes it or the median ignores it. - An update inside the tight cluster is, by construction, nearly identical to an honest one — so accepting it changes the aggregate by almost nothing. Either branch is a loss for the adversary, and the tolerated fraction is the largest share of clients for which that stays true. **The dilemma, not the arithmetic, is the defence.** The arithmetic only enforces the dilemma when the premise holds. ## What heterogeneous participants do to the premise In a cross-organisation federation — several independent banks training a shared model over their own customers — the participants' data differ *by construction*. Different customer mixes, different product lines, different geographies, different base rates for the behaviour being modelled. Each silo's locally computed update points somewhere genuinely different, because each silo is looking at a genuinely different slice of the world. This is usually written as non-IID client data: the clients' data are not drawn from one common distribution. The consequence for the aggregation rule is direct. The honest updates no longer form a tight cluster; they form a wide spread. "Inside the honest range" is now a large region, not a pinhole. And an update can be selected from inside that region and still be materially harmful, because the region is wide enough to contain harmful directions. The adversary's dilemma has a third branch, and it is the winning one: **be unremarkable in position and consequential in effect.** A rule that only compares positions among peers has nothing left to separate on. That is the whole failure, and it is not a bug in the rule — the rule is doing exactly what it promised, under a premise the deployment does not satisfy. ## Why the number in the paper does not carry over Published tolerance figures are usually measured on clients created by partitioning one dataset uniformly at random. That partition makes the clients statistically identical, which makes honest updates concentrate, which makes the premise true — the evaluation and the derivation share an assumption that the deployment breaks. A tolerance measured that way tells you what the rule does on identical participants; it does not tell you what it does on your consortium. ## The dial does not save you either The obvious response is to trim harder. It buys less than it looks like it buys, and it costs a lot. Under heterogeneity the honest outlier and the malicious submission occupy the same region — that is the whole point — so trimming hard enough to reach the adversary also discards the smallest or most unusual bank's contribution in every round. The shared model then stops learning the part of the distribution only that silo can see, and the participant with the most to gain from the federation gets the least out of it. Meanwhile the adversary simply moves toward the centre. You are spending the minority participant's utility on a bound heterogeneity has already loosened. ## What actually helps Nothing restores the clean fraction-of-clients guarantee, but the weak point is identifiable: position among this round's peers is the only evidence the rule has, so the useful moves give the server a second, independent piece of evidence. Comparing a client against its own history across rounds rather than against its peers in one round; holding out a validation signal on the server side; narrowing what clients are asked to optimise so their updates concentrate for structural reasons. Each has real costs and none of them is free, but each attacks the actual gap instead of turning the same dial harder. ## The sentence to leave with Robust aggregation converts "a minority cannot choose the model" into "a minority cannot leave the honest range". How much protection that is depends entirely on how wide the honest range is — which is a fact about your participants' data, measurable before you deploy, and the first thing to ask for.
- Does raising the trim fraction fix it?It buys little and costs a lot. Under heterogeneity the honest outlier and the malicious update occupy the same region, so trimming hard enough to reach the adversary also drops the smallest bank's contribution every round. The shared model stops learning the slice only that silo sees, and the adversary just moves closer to the centre. You are trading the minority participant's utility for a bound that heterogeneity has already loosened.
- What would make the tolerance claim meaningful again in this federation?Anything that narrows the honest spread or gives the server a second source of evidence: comparing a client against its own history across rounds instead of against its peers in one round, holding an independent validation signal server-side, or constraining what clients optimise so their updates concentrate for structural reasons. None restores the clean fraction-of-clients guarantee, but each attacks the real weak point — that position among peers is all the rule can see.
- Is the published tolerance figure simply wrong, then?No — it is right about the population it was derived and measured on. Those clients are typically made by partitioning one dataset uniformly, which makes participants statistically alike and honest updates tight, so the premise holds. The error is transplanting a number derived under that premise into a consortium whose entire reason for existing is that the participants see different things.
saying these in an interview costs you the question
- Says 'we take the median, so a minority cannot move it' with no condition attached
- Thinks client heterogeneity costs accuracy only, never security
- Believes an effective malicious update must be a visible outlier
- Assumes a tolerance measured on uniformly partitioned clients transfers
- Treats trimming harder as a free way to restore the bound