{"id":"bf61b399-c0d5-4d59-a241-018a6a456241","arxiv_id":"2412.02535","paper_version":2,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":4,"one_line_summary":"Consensus-based bi-level optimization converges in mean-field to the target model despite malicious agents, and a practical variant, FedCB2O, partially mitigates label-flipping attacks in clustered federated learning.","lead":"This paper studies a consensus-based training method for federated learning and shows, in an idealized many-agent limit, that honest agents can still converge to a good model even when some agents send corrupted updates. It also introduces FedCB2O, a practical variant that partially defends against label-flipping attacks, with experiments on EMNIST.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Theorem 2.2 covers mean-field CB2O with a fixed G and quantile-based consensus, but the deployed FedCB2O algorithm uses a personalized time-varying G_j (Remark 3.6) and probabilistic selection; the paper defers theory for G_j, so the experimental robustness claim is not covered by the theorem.","rationale":"I checked the theorem's internal logic and found no obvious inconsistency: the proof follows the framework of [27], and the choices of beta proportional to wb and alpha increased by log(wm/wb * R_K^G / sqrt(epsilon)) appear consistent with the estimates in Propositions 2.3 and 2.5. The mean-field result is a plausible extension of the authors' prior work. However, the central practical claim is that FedCB2O is robust because of this theory. The reader's weakest assumption identifies the personalized G_j gap in Remark 3.6, and I agree; I would extend it to a broader algorithmic mismatch: even the non-personalized components of Algorithm 1 (random selection of M models, no explicit quantile sublevel set in Eq. 3.13) are not the dynamics analyzed in Theorem 2.2. The paper is transparent about the G_j gap, which is commendable, but the gap remains load-bearing because the experiments are the only evidence for the actual algorithm and the theorem is the only theoretical support. My concrete test would determine whether a fixed G suffices empirically, which would at least indicate whether the personalized criterion is necessary for the observed robustness. If the fixed-G variant is as robust, the gap may be bridgeable; if not, the paper's theoretical and practical parts are connected only by analogy. This does not change the reader's CONDITIONAL verdict, so I recommend UNCHANGED.","tokens_in":37687,"tokens_out":6658,"duration_ms":73224,"concrete_test":"Run the Section 3.5 EMNIST label-flipping experiment with a fixed, non-personalized G, e.g., G(theta) = max_c eL_c(theta) - max_c eL_c(theta_ref) for a fixed reference model theta_ref trained once on a public validation split, keeping Algorithm 1 otherwise unchanged. Report source-class accuracy and attack success rate alongside Table 1. If a suitable fixed G achieves comparable ASR, the personalized criterion is not essential and a theoretical bridge may be possible; if it fails, the practical algorithm lacks the theorem's support and the paper should either prove a variant of Theorem 2.2 for (3.15) or explicitly scope the theoretical claim to the idealized CB2O system.","verdict_should_be":"UNCHANGED","load_bearing_attack":"Theorem 2.2 proves mean-field convergence for the CB2O dynamics (1.7)-(1.8) with a fixed, non-personalized G satisfying Assumptions A1-A6 and with consensus point m^{G,L}_{alpha,beta} that includes the quantile sublevel set Q^L_beta. The FedCB2O algorithm evaluated in Section 3.5 departs from this dynamics in two ways that are explicitly outside the theorem. First, Remark 3.6 defines a personalized robustness criterion G_j(theta; theta_j) = max_c eL_{j,c}(theta) - eL_{j,c}(theta_j) that depends on the agent's own current model, and the remark states 'We leave the theoretical analysis of frameworks incorporating upper-level objectives similar to (3.15) for future work.' At no point is Theorem 2.2 shown to hold for such a time-varying, agent-dependent G, nor is it established that G_j satisfies A1-A6 along the training trajectory. Second, the consensus step in Algorithm 2 (Eq. 3.13) computes a weighted average over only M randomly selected models with weights exp(-alpha G_j), replacing the quantile filter Q^L_beta by the ProbSampling heuristic with temperature kappa; Remark 3.4 offers only an analogy between kappa and beta, not a proof. Thus Theorem 2.2 does not apply to the algorithm whose robustness is the paper's practical claim, and the experimental results in Tables 1-2 are not covered by the theory. Because the theorem is the paper's main contribution and the only evidence for the advertised robustness against 'diverse attacks', this gap is load-bearing.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes a bi-level optimization formulation (1.1) for robust federated learning, where the upper-level objective G encodes a robustness criterion and the lower-level objective L is the training loss. The main theoretical result, Theorem 2.2, states that the mean-field CB2O dynamics (1.7)-(1.8) converge in Wasserstein distance to the robust minimizer θ*_good even when a fraction wm of agents behave adversarially, provided the hyperparameters β and α are chosen according to (2.20) and (2.23). The proof extends the quantitative Laplace principle of the authors' earlier CB2O paper [27] and adds Assumption A6 on the far-field growth of G. On the practical side, the paper introduces FedCB2O, an algorithm for decentralized clustered federated learning that combines FedCBO with a robustness-weighted consensus point, a probabilistic agent-selection mechanism (ProbSampling), and a personalized robustness criterion G_j (Remark 3.6). Experiments on rotated EMNIST with label-flipping attacks compare FedCB2O against FedCBO and two Oracle baselines.","tokens_in":38139,"tokens_out":5144,"duration_ms":52151,"significance":"If Theorem 2.2 is correct, it constitutes a meaningful extension of the mean-field convergence theory of consensus-based optimization to settings with malicious agents, and it gives concrete, falsifiable hyperparameter scaling predictions (β ∝ wb, α increasing logarithmically with wm/wb). The proof is a structured extension of [27] and the paper provides code for reproducibility. However, the significance is substantially reduced by the gap between the theoretical object and the deployed algorithm: Theorem 2.2 covers a fixed, non-personalized G and a deterministic quantile filter, while FedCB2O uses a personalized, time-varying G_j and a stochastic selection heuristic. The experiments cover only one attack type (label-flipping) and show a partial defense (source-class accuracy and ASR remain noticeably worse than the Oracle Min baseline). The overclaim in the abstract and introduction that the algorithm is robust against 'diverse attacks' is therefore not fully supported.","major_comments":[{"comment":"The robustness guarantee of Theorem 2.2 applies to the mean-field CB2O dynamics (1.7)-(1.8) with a fixed, non-personalized G satisfying Assumptions A1-A6. The FedCB2O algorithm evaluated in Section 3.5 uses the personalized criterion G_j(θ; θ_j) = max_c eL_{j,c}(θ) - eL_{j,c}(θ_j) defined in Remark 3.6, which depends on the agent's own current model θ_j. The paper explicitly states 'We leave the theoretical analysis of frameworks incorporating upper-level objectives similar to (3.15) for future work.' Consequently, Theorem 2.2 does not cover the algorithm whose robustness is the paper's practical claim, and the experimental results in Tables 1-2 cannot be attributed to the theory. This gap is load-bearing because the abstract and introduction advertise convergence and robustness for the proposed algorithm, not merely for an idealized mean-field system.","section":"Remark 3.6 and Theorem 2.2"},{"comment":"The consensus step (3.13) replaces the quantile sub-level set Q^L_β of (1.4) with the ProbSampling heuristic, which selects M models according to historical performance P^n_j with temperature κ. Remark 3.4 offers only an analogy between κ and β, not a proof that the probabilistic selection approximates the quantile filter. Even if Theorem 2.2 were extended to a non-personalized G, the stochastic, finite-M selection is a further departure from the deterministic mean-field dynamics, and no finite-N or finite-M analysis is provided. Thus the theory does not justify the agent-selection mechanism used in the experiments.","section":"Section 3.4, Algorithm 2 and Remark 3.4"},{"comment":"The experimental evidence does not fully support the claim that FedCB2O 'effectively mitigates' the label-flipping attack or performs comparably to the idealized baselines. FedCB2O achieves source-class accuracy 55.73 ± 2.94% and ASR 38.73 ± 3.42%, whereas Oracle Min (malicious agents removed) achieves 63.53 ± 1.97% and 31.08 ± 2.64%. The gap is roughly 8 percentage points in source-class accuracy and 7.7 points in ASR. This is a substantial residual vulnerability, not a demonstration that the defense is comparable to an attack-free system, and it should be discussed quantitatively.","section":"Section 3.5, Table 1"},{"comment":"The claim of robustness against 'a diverse range of attacks' is overbroad. Theorem 2.2 treats arbitrary malicious-agent dynamics for a fixed robustness criterion G, but the choice of G is attack-specific: the paper states that 'different choices of G may be required to defend against different types of attacks.' The only empirical attack studied is label-flipping, and the robustness criterion (3.15) is specifically designed to counter that attack. No experiment with a different attack type (e.g., backdoor or model poisoning) is reported, and the paper does not characterize the class of attacks for which G_j is effective. The 'diverse attacks' claim should be tempered or supported by additional experiments.","section":"Abstract and Section 1.1"}],"minor_comments":[{"comment":"In the proof of (2.18), the integrand is written with ∥θ - θ̃_good∥_2, while the statement uses ∥θ - θ*_good∥_2; since θ̃_good ∈ B_{r_G}(θ*_good), these are not identical, and the derivation should either align the notation or add the extra r_G term explicitly.","section":"Proposition 2.5, proof"},{"comment":"Remark 3.2 asserts that the mean-field convergence results 'can be extended' to FedCB2O by combining [12] with Theorem 2.2, but no proof or precise statement is given. This is presented as a remark rather than a theorem; please clarify whether this is a formal claim or an informal outlook.","section":"Remark 3.2"},{"comment":"The choice of β in (2.20) depends on the initial benign mass ρ^b_0(B_{r_{H,ε}/2}(θ*_good)) and on the constants p_{H,ε}, T*, but the paper does not explain how a practitioner would estimate these quantities in a federated setting where the benign distribution is unknown; a comment on practical hyperparameter selection would be useful.","section":"Section 2.3, Eq. (2.20)"},{"comment":"The font sizes in the bar charts of Figure 5 are very small, and the legend labels are difficult to read; please enlarge the figures or provide a tabular version of the selection-frequency data.","section":"Figure 5"}],"recommendation":"major_revision","confidential_remarks":"The manuscript is honest in Remark 3.6 about the lack of theory for personalized G_j, but the overall narrative overclaims the connection between Theorem 2.2 and the FedCB2O algorithm. The partial experimental results (Table 1) and the single-attack evaluation should also be addressed. If the authors can either extend the theory to the deployed algorithm or substantially temper the claims and add experiments with other attack types, the paper could become publishable; in its current form, the gap between theory and practice is too large for the claims made."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Two things worth knowing. First, the mean-field analysis of CB2O in the presence of malicious agents (Theorem 2.2) is a real extension of the authors' own prior work. The new growth condition A6 and the distillation of how malicious density enters the Laplace principle are genuine additions, and the parameter guidance (β roughly proportional to the benign fraction w_b, α increased by a log term involving w_m/w_b) is a useful sanity check. Second, the theorem does not cover the FedCB2O algorithm whose experiments are the paper's practical payoff. The deployed robustness criterion G_j is personalized to each agent's current model (Remark 3.6), and the consensus step uses the ProbSampling heuristic instead of the quantile filter. The paper explicitly defers theory for G_j to future work, so this gap is acknowledged rather than hidden. But it is load-bearing: the title and abstract claim robustness against diverse attacks, and the experiments are the only evidence for the actual algorithm.\n\nWhat the paper does well: it is transparent about limitations, provides code, and the experiment design is reasonably careful. The Oracle Min/Max baselines help calibrate what is achievable, and FedCB2O clearly improves on FedCBO for label-flipping attacks. The ProbSampling agent selection is a sensible engineering contribution for decentralized FL with download budgets.\n\nSoft spots in proportion. The experiments show only partial defense: source class accuracy and ASR are better than FedCBO but still several points worse than Oracle Min, and there is no comparison with other robust aggregation methods like Krum or trimmed-mean, making it hard to isolate the source of the gain. Only label-flipping is tested, so the \"diverse attacks\" claim in the abstract is not empirically substantiated. The theoretical result for fixed G is plausible and likely correct, but it does not apply to the algorithm as written. That needs to be stated clearly, and a serious referee should ask for either an extension of the theory to personalized time-varying G_j or a substantial rewrite of the claims to separate the mean-field guarantee from the empirical behavior of the implemented algorithm.\n\nWho is this for: researchers in consensus-based optimization and federated learning robustness, particularly those working on mean-field limits of multi-particle methods. It deserves a serious referee; the gap is significant but not disqualifying, and the problem is worthwhile.","headline":"Genuine mean-field robustness theorem for fixed G, but the FedCB2O algorithm's personalized G_j escapes the theory, so the practical robustness claim rests on experiments alone.","tokens_in":38637,"tokens_out":2058,"would_cite":true,"duration_ms":23133,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":["65K10","90C26","90C56","35Q90","35Q84"],"pacs":[],"model":"deepseek-v4-flash","headline":"This paper claims that consensus-based bi-level optimization lets benign federated agents converge to the robust model even when malicious agents attack arbitrarily.","keywords":["federated learning","consensus-based optimization","bi-level optimization","mean-field limit","adversarial attacks","label-flipping attacks","clustered federated learning","robust aggregation"],"falsifier":"Run the FedCB2O algorithm with the personalized robustness criterion (3.15) under label-flipping attacks and check whether benign agents continue to assign non-negligible weight to poisoned models as α is increased as prescribed by (2.23); if those weights do not decay toward zero, the convergence guarantee does not transfer to the deployed criterion.","tokens_in":37488,"feed_emoji":"🛡️","tokens_out":5769,"duration_ms":59922,"temperature":0.7,"pith_summary":"The paper tries to establish that consensus-based bi-level optimization, an interacting-particle method in which agents move toward a weighted average of models with low loss and low robustness score, remains globally convergent when some fraction of agents behaves maliciously and arbitrarily. It proves this in the mean-field limit, with enough benign agents, provided the quantile width β scales with the benign fraction and the selection temperature α is raised according to an explicit logarithmic rule. On the practical side, it builds FedCB2O for clustered federated learning and tests it against label-flipping attacks on rotated EMNIST, where it reports source-class accuracy and attack success rates close to attack-free baselines. A sympathetic reader would take the contribution to be a parameter recipe that converts an attack-averse bi-level objective into a concrete defense protocol for decentralized training.","feed_headline":"Label-flipping attacks fail to derail federated agents","feed_subtitle":"A bi-level consensus method provably keeps benign agents on the intended model, with EMNIST tests to back it.","key_machinery":"The load-bearing object is the consensus point $m^{{G,L}}$_{α,β}(ρ): a weighted average of particle positions inside the quantile sublevel set Q^L_β[ρ], weighted by exp(-αG(θ)). It combines a lower-level filter (only models with small loss relative to a quantile survive) with an upper-level filter (among survivors, models with small robustness score dominate). The extension of the quantitative quantile Laplace principle (Proposition 2.3) and the attack-control bound (Proposition 2.5) are what turn the presence of malicious mass into exponentially small error terms, leaving the benign dynamics to contract toward θ*_good at the rate inherited from the attack-free CB2O proof.","core_discovery":"The central claim is Theorem 2.2: in the mean-field limit, the law of benign agents converges exponentially fast in squared Wasserstein distance to the target model θ*_good, the minimizer of the robustness criterion G among global minimizers of the loss L, even though malicious agents are modeled with arbitrary drift and diffusion. The theorem localizes the effect of attacks: after a robust quantile Laplace bound splits the consensus error into benign and malicious parts, a separate control proposition shows the malicious contribution decays like exp(-αu) under the farfield growth condition A6 on G. The proof yields explicit hyperparameter rules: β must be below a threshold proportional to w_b (the benign fraction), and α must exceed a threshold whose dominant term is log(w_m/w_b · R_K^G / $\\sqrt$(ε)).","pith_inferences":["If the personalized criterion G_j from (3.15) behaves empirically like the fixed G analyzed in Theorem 2.2, then the same defense should extend to agents with heterogeneous local datasets, a setting the paper flags as future work.","Because the theorem's α threshold grows only logarithmically with the malicious-to-benign ratio, the framework predicts that a modest increase in selection sharpness compensates for a very large hostile minority; this is a testable quantitative prediction.","The ProbSampling mechanism, which selects models by an exponential moving average of past losses, may be useful beyond robustness, for example to cut communication cost in any decentralized method that budgets downloads per round."],"forward_implications":["A user of CB2O can defend against a broad class of attacks by choosing β proportional to the fraction of benign agents and α above the explicit logarithmic threshold, without knowing which agents are malicious.","Label-flipping attacks, which are hard to filter by average loss alone, are neutralized by the upper-level criterion in FedCB2O: experiments show source-class accuracy rises from about 40% with FedCBO to about 56–58% and attack success rate drops.","In the limit w_m → 0 and w_b → 1, the theorem's hyperparameter choices reduce to the attack-free CB2O settings, so the defense does not come at the cost of the original convergence guarantee.","The agent selection mechanism that records each peer's historical loss performance is independent of the robustness criterion and can be slotted into other decentralized federated algorithms."],"supporting_citations":[{"why":"Defines CB2O dynamics and the quantitative quantile Laplace principle that Theorem 2.2 extends to adversarial settings.","marker":"[27]"},{"why":"Provides FedCBO and the decentralized clustered federated learning setup that FedCB2O builds on and compares against.","marker":"[12]"},{"why":"Supplies DFedAvgM, the attack-free oracle baseline used as the best-possible performance benchmark in experiments.","marker":"[75]"},{"why":"Contributes the EMNIST dataset used for the rotated clustered federated learning experiments.","marker":"[17]"},{"why":"Describes the label-flipping data poisoning attack model that the paper defends against and evaluates.","marker":"[79]"},{"why":"Establishes the mean-field global convergence machinery for consensus-based optimization that the proof of Theorem 2.2 follows.","marker":"[23]"}],"fun_headline_variants":["Consensus-based bi-level defense defeats label-flipping","Federated learning resists attacks via consensus","Exponential robustness for federated consensus","Provable robustness in federated learning","Bi-level consensus thwarts arbitrary attacks"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The convergence theorem is proven for a fixed, shared robustness criterion G, while the deployed FedCB2O algorithm weights models with a personalized criterion G_j that depends on each agent's own changing model, and the paper explicitly leaves the theory for that criterion to future work.","fun_headline_variants_meta":{"raw":{"variants":["Consensus-based bi-level defense defeats label-flipping","Federated learning resists attacks via consensus","Exponential robustness for federated consensus","Provable robustness in federated learning","Bi-level consensus thwarts arbitrary attacks"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000238,"raw_usage":{"total_tokens":1511,"prompt_tokens":946,"completion_tokens":565,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":562,"completion_tokens_details":{"reasoning_tokens":499}},"tokens_in":562,"tokens_out":565,"duration_ms":6444,"temperature":1.0,"reasoning_tokens":499,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-11T23:20:35.560165+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run the FedCB2O algorithm with the personalized robustness criterion (3.15) under label-flipping attacks and check whether benign agents continue to assign non-negligible weight to poisoned models as α is increased as prescribed by (2.23); if those weights do not decay toward zero, the convergence guarantee does not transfer to the deployed criterion.","supporting_citations":[{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Provides FedCBO and the decentralized clustered federated learning setup that FedCB2O builds on and compares against."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Supplies DFedAvgM, the attack-free oracle baseline used as the best-possible performance benchmark in experiments."},{"cited_title":"Cohen, S","cited_arxiv_id":null,"evidence_quote":"Contributes the EMNIST dataset used for the rotated clustered federated learning experiments."},{"cited_title":"Tolpegin, S","cited_arxiv_id":null,"evidence_quote":"Describes the label-flipping data poisoning attack model that the paper defends against and evaluates."},{"cited_title":"Fornasier, T","cited_arxiv_id":null,"evidence_quote":"Establishes the mean-field global convergence machinery for consensus-based optimization that the proof of Theorem 2.2 follows."}],"review_version":1}