Research map / Federated learning and privacy / Privacy attacks and secure learning
Certifiably Byzantine-Robust Federated Conformal Prediction
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes Rob-FCP, a Byzantine-robust federated conformal prediction method that detects malicious clients via histogram characterization vectors and nearest-neighbor maliciousness scores, with certified coverage bounds and an EM-based estimator for the unknown number of malicious clients.
Problem
Federated conformal prediction loses its marginal coverage guarantee when a minority of Byzantine clients report arbitrary non-conformity score statistics during distributed calibration.
Approach
Sketch each client's conformity scores as a histogram characterization vector, score clients by average distance to their nearest neighbors in that vector space, exclude the highest-maliciousness clients from quantile calibration, and estimate the number of malicious clients by maximizing a Gaussian likelihood via EM.
Key results
- Under 40% malicious clients with coverage attack, FCP reaches 0.805-0.837 coverage on MNIST/CIFAR-10/Tiny-ImageNet/SHHS/PathMNIST while Rob-FCP stays around 0.90 (e.g., MNIST 0.899, SHHS 0.901) against desired 0.9.
- Under efficiency attack, FCP's average set size on MNIST inflates to 10.00 while Rob-FCP gives 1.804, close to benign-level behavior.
- Rob-FCP keeps marginal coverage near 0.9 across Dirichlet heterogeneity levels beta from 0.1 to 0.9.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use Rob-FCP instead of FCP under coverage attacks with 40% malicious clients | Federated conformal prediction · MNIST, CIFAR-10, Tiny-ImageNet, SHHS, and PathMNIST | marginal coverage: MNIST: 0.805 -> 0.899; CIFAR-10: 0.829 -> 0.897; Tiny-ImageNet: 0.825 -> 0.903; SHHS: 0.835 -> 0.901; PathMNIST: 0.837 - | Helped |
| Use Rob-FCP instead of FCP under efficiency attacks with 40% malicious clients | Federated conformal prediction · MNIST, CIFAR-10, Tiny-ImageNet, SHHS, and PathMNIST | marginal coverage: MNIST: 1.000 -> 0.902; CIFAR-10: 1.000 -> 0.892; Tiny-ImageNet: 1.000 -> 0.904; SHHS: 1.000 -> 0.901; PathMNIST: 1.000 - | Helped |
| Use Rob-FCP instead of FCP under Gaussian attacks with 40% malicious clients | Federated conformal prediction · MNIST, CIFAR-10, Tiny-ImageNet, SHHS, and PathMNIST | marginal coverage: MNIST: 0.941 -> 0.923; CIFAR-10: 0.970 -> 0.921; Tiny-ImageNet: 0.942 -> 0.928; SHHS: 0.937 -> 0.900; PathMNIST: 1.000 - | Helped |
| Use histogram statistics rather than KMeans cluster centers or a fitted Gaussian to characterize conformity-score distributions (ablation) | Rob-FCP · Federated conformal prediction Byzantine setting | performance | Helped |
| Vary the Dirichlet parameter beta to change client data heterogeneity under coverage attack (ablation) | Rob-FCP · MNIST, CIFAR-10, Tiny-ImageNet, and PathMNIST (40% malicious clients) | marginal coverage: MNIST: 0.899, 0.905, 0.903, 0.898, 0.893; CIFAR-10: 0.899, 0.907, 0.892, 0.904, 0.910 | No clear effect |
| Use APS conformity scores instead of LAC conformity scores (ablation) | Rob-FCP · Federated conformal prediction Byzantine setting | marginal coverage | No clear effect |
Limitations
- Threat model limited to clients reporting arbitrary statistics; break point is ceil(K/2) and adversarial data-level manipulation is not covered.
- Theoretical guarantees assume benign characterization vectors follow multinomial distributions and that the number of malicious clients is below the number of benign clients.
Experimental setup
Datasets: MNIST CIFAR-10 Tiny-ImageNet SHHS PathMNIST
Benchmarks: MNIST CIFAR-10 Tiny-ImageNet SHHS PathMNIST
Metrics: marginal coverage average set size
Baselines: FCP
Builds on: federated conformal prediction split conformal prediction T-digest Byzantine-robust SGD (Krum/trimmed mean) mimic attack
Closest papers by meaning
- FedCF: Fair Federated Conformal Prediction (NeurIPS 2026 · similarity 0.86)
- Efficient Federated Learning against Byzantine Attacks and Data Heterogeneity via Aggregating Normalized Gradients (NeurIPS 2025 · similarity 0.86)
- Self-Driven Entropy Aggregation for Byzantine-Robust Heterogeneous Federated Learning (ICML 2024 · similarity 0.86)
- Online Differentially Private Conformal Prediction for Uncertainty Quantification (ICML 2025 · similarity 0.85)
- Towards Trustworthy Federated Learning with Untrusted Participants (ICML 2025 · similarity 0.85)
- Certifiably Robust Model Evaluation in Federated Learning under Meta-Distributional Shifts (ICML 2025 · similarity 0.85)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.