{"id":"d3b1447a-8647-4b68-80c0-41e8b8070022","arxiv_id":"2506.15181","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":7,"one_line_summary":"ImprovDML is a decentralized SGD framework that uses resilient vector consensus aggregation and Gaussian noise, with concentrated geo-privacy analysis, achieving Byzantine resilience and a better privacy-accuracy trade-off than differential privacy.","lead":"Decentralized machine learning can be attacked by corrupted agents and privacy snoopers; this paper combines resilient consensus with Gaussian noise to resist both. The authors show convergence and argue their noise budget yields a better privacy-accuracy trade-off than differential privacy.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"...","rationale":"The reader's verdict was CONDITIONAL, with Assumption 5/6 identified as the weakest assumption and the privacy proof flagged as gappy. My stress-test finds a stronger, decisive problem: Theorem 3's ρ-CGP bound is not merely under-derived; it is false. The proof substitutes L′‖D−D′‖ into a neighboring-pair subsampled RDP bound, but subsampling amplification does not apply to arbitrary dataset pairs. For two datasets that are homogeneous shifts of each other, every possible batch differs, so the Rényi divergence is the unamplified Gaussian divergence while the squared input distance grows with n. The exact CGP parameter for the counterexample is ζ/(2σ²), not 5ζ²/σ²; for n=100, b=1, σ²=2, the claimed inequality fails for α=2, which is within the theorem's stated α range. This invalidates the central privacy-accuracy trade-off claim and the numerical privacy comparison in Section 4.3. The convergence framework may be salvageable in principle, but the paper's headline result is not supported as stated. The other issues noted by the reader—unproven contraction in Assumption 5, Theorem 2 constant inconsistencies, an unspecified RVC implementation in the simulations—also require attention, but the false privacy bound is decisive. Hence REJECT rather than CONDITIONAL.","tokens_in":21673,"tokens_out":24570,"duration_ms":269626,"concrete_test":"Compute the exact Rényi divergence for one iteration of Algorithm 1 with n=100, batch size b=1, σ²=2, L′=1, x(0)=0, D={0,…,0}, D′={r,…,r}. For α=2, the exact divergence is αr²/(2σ²)=r²/4, while the bound claimed by Theorem 3 is αρ‖D−D′‖² = 2·(5·0.01²/2)·100r² = 0.05r². The inequality fails by an order of magnitude; equivalently, the exact CGP parameter is ζ/(2σ²)=0.0025, ten times the claimed ρ=0.00025. This direct calculation settles the concern without simulation.","verdict_should_be":"REJECT","load_bearing_attack":"The most load-bearing weakness is Theorem 3. It takes the neighboring-pair subsampled RDP bound of Lemma 3 and converts it into a CGP bound for arbitrary dataset pairs by formally replacing S₂ with L′‖D−D′‖. This is not legitimate: privacy amplification by subsampling only applies when most samples are shared between the two datasets. A concrete counterexample shows the claimed formula is false. Take scalar linear loss f(x;z)=½(x−z)², so L′=1. Let n=100, batch size b=1 (ζ=0.01), σ²=2, x(0)=0, D={0,…,0}, and D′={r,…,r}. For one iteration, Algorithm 1 outputs N(0,γ²σ²) under D and N(γr,γ²σ²) under D′, so the exact Rényi divergence is D₂ = r²/(2σ²) = r²/4. Since ‖D−D′‖² = 100r², any valid CGP parameter must satisfy ρ ≥ 1/(2nσ²) = ζ/(2σ²) = 0.0025. The paper's Theorem 3 gives ρ = 5ζ²L′²/σ² = 0.00025, which is ten times too small. For α=2 the claimed CGP inequality gives D₂ ≤ αρ‖D−D′‖² = 2·0.00025·100r² = 0.05r², while the exact divergence is 0.5r². The theorem's own condition σ²/L′²=2≥1.5 and α≤log(L′²/(ζ(L′²+σ²)))=log(100/3)≈3.5 permits α=2. Thus the claimed ρ-CGP guarantee is false, and the improved privacy-accuracy trade-off comparison in Section 3.4 and Figure 7 rests on an incorrect privacy metric. The error is not a missing constant: the ζ² amplification factor cannot hold for pairs of datasets differing in many entries.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes ImprovDML, a decentralized distributed machine learning framework that simultaneously provides Byzantine resilience and privacy. The key design choice is to replace approximate Byzantine-resilient aggregation rules (ClippedGossip, IOS, remove-then-clip) with resilient vector consensus (RVC) algorithms whose output stays inside the convex hull of the honest agents' updated parameters. Gaussian noise is added to local stochastic gradients, and privacy is analyzed under concentrated geo-privacy (CGP) rather than standard differential privacy. The paper claims a consensus bound (Theorem 1), a non-convex convergence rate with explicit asymptotic error (Theorem 2), a CGP guarantee with privacy parameter ρ = 5Kζ²L'²/σ² (Theorem 3), and an improved privacy-accuracy trade-off compared with (ε,δ)-DP. Numerical experiments on a multi-robot XOR classification task compare the proposed algorithm with PP-IOS and evaluate gradient-inversion resistance.","tokens_in":21998,"tokens_out":11834,"duration_ms":112990,"significance":"The design idea is genuinely attractive: using RVC algorithms that compute a point inside the convex hull of normal agents' updates removes the Byzantine estimation-error term that appears in earlier aggregation rules, and the convergence analysis is a plausible extension of standard decentralized SGD arguments. The simulations support the qualitative claim that the proposed method achieves better accuracy than PP-IOS under the same noise level. If the CGP guarantee were correct, the paper would offer a useful alternative privacy metric for Byzantine-resilient decentralized learning. However, the central privacy theorem is mathematically false as stated, and the main advertised advantage over differential privacy rests on that false theorem. The convergence theorem also contains internal inconsistencies between the displayed bound and the proof. As it stands, the manuscript's headline claim is not established.","major_comments":[{"comment":"The conversion from the neighboring-dataset RDP bound to an arbitrary-dataset CGP bound is invalid. Lemma 3's ζ² amplification applies only when the two datasets differ in one entry; for an arbitrary pair of datasets, the probability that the subsample hits a differing point is not ζ, so the amplification factor cannot be used. This is not a missing constant. Concretely, take f(x;z)=½(x−z)², so L′=1, with dataset size n=100, batch size b=1 (ζ=0.01), σ²=2, x(0)=0, D={0,...,0}, and D′={r,...,r}. One iteration of Algorithm 1 outputs N(0,γ²σ²) under D and N(γr,γ²σ²) under D′, so the exact Rényi divergence is D₂=r²/(2σ²)=r²/4. The theorem's constraints are satisfied: σ²/L′²=2≥1.5 and α=2≤log(L′²/(ζ(L′²+σ²)))=log(100/3)≈3.5. The claimed per-iteration bound gives D₂≤2ρ‖D−D′‖² with ρ=5ζ²L′²/σ²=0.00025, which is 0.0005r² if ‖D−D′‖²=r² and 0.05r² if ‖D−D′‖²=100r²; in either interpretation this is smaller than the true value r²/4. A valid CGP parameter would need to be at least 0.25 in the max-distance interpretation or 0.0025 in the sum-of-squares interpretation. The ζ² factor cannot appear for dataset pairs differing in many entries, so the formula ρ_i=5Kζ_i²L′²/σ² and the privacy-accuracy trade-off comparison in Section 3.4 and Figure 7 are unsupported.","section":"§3.3, Theorem 3 and Proof 3"},{"comment":"The displayed theorem and the proof do not agree. Inequality (14) in Proof 2 has the consensus-error coefficient 3(L²+2χ²/γ²+24χ²L²), while the theorem statement contains 3(L²/n²+2χ²/γ²+24χ²L²). Since Δ(k) is already the average over n agents, the proof yields L², not L²/n². The simplified constants C1–C5 also do not follow from the substitution γ=c/√K and the Theorem 1 bound: the terms generated by 2χ²/γ² times the θ², τ², and σ² parts of the consensus bound contribute at order 1/c with specific λ factors, while the displayed C2, C3, C4, and C5 arrange those factors differently, and C5=2χ²Δ(0)/(c²(1−Λ)) does not match the term-by-term expansion. The claimed O(1/√K) rate and the quoted asymptotic constants therefore require re-derivation.","section":"§3.2, Theorem 2 and Proof 2"},{"comment":"Lemma 2 only proves that the aggregation phase can be written as x(k+1)=M(k)x̃(k) with M(k) row-stochastic and positive entries on the support N_i(k)∪{i}. Row-stochasticity alone does not imply the contraction ‖(I−11'/n)M(k)‖_S² ≤ 1−λ(k) < 1 assumed in Assumption 5 and used in Theorem 1. The paper does not prove this contraction for any of the five cited RVC implementations (Byz-Iter, ADRC, convex combination, centerpoint), nor does it cite an external theorem establishing it under Assumption 6. Since λ>0 is the engine of the consensus bound and hence of the convergence and privacy claims, the theoretical results currently rest on an uninstantiated hypothesis.","section":"§2.3 and Assumption 5"},{"comment":"The stated step-size condition is insufficient for the claimed 0<Λ<1. With v=λ/2, Λ<1 is equivalent to 24γ²L²(2−λ)(1−λ)<λ², which requires γ < (λ/(2L))·(6(1−λ)(2−λ))^{-1/2}. The displayed condition γ < (1/(2L))·(λ/(6(1−λ)(2−λ)))^{1/2} is larger by a factor 1/√λ and can violate the required inequality whenever λ<1. Thus the consensus bound and the subsequent use of 1/(1−Λ) are not established as stated.","section":"§3.1, Theorem 1"}],"minor_comments":[{"comment":"The quantity Aα is introduced as 'a constant related to the subsampling and the Gaussian mechanism' but is never defined, and Lemma 3 contains no such constant; the proof should either derive it explicitly or drop it.","section":"§3.3, Proof 3"},{"comment":"The simulation sets L′=0.84 based on finitely many gradient evaluations over 3000 iterations, but Theorem 3 requires a worst-case Lipschitz bound over the entire input domain; an empirical estimate cannot certify the assumption.","section":"§4.3 and Assumption 7"},{"comment":"The comparison between ε (DP) and ε_geo (GP) uses different metric spaces and involves a free radius r and a chosen δ; Figure 7's caption does not state r, and the statement that '2G is typically much larger than L′' is an informal observation rather than a theorem.","section":"§3.4.2"},{"comment":"The summation in the displayed geometric-series step is written as Σ_{k=0}^{k} and should be Σ_{j=0}^{k-1}.","section":"§3.1, Proof 1"}],"recommendation":"reject","confidential_remarks":"The decisive issue is Theorem 3: the counterexample in Major Comment 1 shows that the advertised ρ-CGP guarantee is false. Because the improved privacy-accuracy trade-off is the paper's headline contribution and is presented in the abstract, Section 3.4, and Figure 7, this is not a locally fixable typo; a corrected analysis would have to drop the ζ² amplification for arbitrary dataset pairs, which would likely remove the claimed advantage over DP. The consensus and convergence analysis is mostly standard, but it also has an uninstantiated Assumption 5 and an inconsistent Theorem 2. I recommend rejection. A revised manuscript with a corrected privacy analysis and an instantiated contraction assumption could be reconsidered."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The thing to know about this paper: the algorithmic idea is genuinely reasonable, and the consensus/convergence analysis mostly hangs together, but the privacy claim that the whole trade-off argument depends on is false as stated.\n\nWhat is new and good: the paper is the first to combine resilient vector consensus aggregation with concentrated geo-privacy, and that is a natural pairing. Using RVC to keep the aggregated point inside the convex hull of honest agents removes the estimation error term that plagues ClippedGossip/IOS-style rules, and the consensus and convergence analysis in Theorems 1 and 2 is a plausible extension of existing decentralized SGD machinery. The simulations show the expected qualitative behavior: better test accuracy than PP-IOS, lower consensus error, and privacy against gradient inversion at the tested noise scale. I believe the authors when they say the algorithm works in practice.\n\nThe soft spots are serious. Theorem 3 is not just missing a constant: the proof takes the subsampled RDP bound from Lemma 3, which is only valid for neighboring datasets differing in one entry, and replaces the sensitivity S2 with L'·||D−D'|| for arbitrary pairs. That substitution is illegitimate. Subsampling amplification does not give a ζ² factor when the two datasets differ in many entries. The stress-test counterexample is valid: for scalar linear loss with all entries of D equal and all entries of D' shifted by r, the exact Rényi divergence for batch size 1 is r²/(2σ²) at α=2, while Theorem 3's formula gives ρ=5ζ²L'²/σ², which is ten times too small under the paper's own parameter conditions. The claimed CGP inequality fails. Since Section 3.4 and Figure 7 use exactly this ρ to argue for an improved trade-off over DP, that central conclusion is unsupported.\n\nOther issues are less fatal but need fixing: Theorem 2's statement and proof have mismatched constants (L²/n² in the theorem vs L² in the proof, and the C1–C5 expressions do not follow from the displayed substitution). Lemma 4, the DP comparison, is asserted without proof. Assumptions 5 and 6 assume the RVC aggregation yields a contracting row-stochastic matrix M(k), but no concrete RVC implementation is checked against that condition. The numerical DP comparison uses an unspecified GP radius r and empirically estimated G and L′ without error bars.\n\nWho is this for? Someone working on Byzantine-resilient private decentralized learning could get a useful framework and a clean statement of why convex-hull-preserving aggregation helps accuracy. But the privacy analysis needs to be redone before the main claim can be trusted. I would send this to peer review because the idea is worth engaging and the flaws are identifiable and addressable, but the current version would not be acceptable without a corrected CGP proof.","headline":"The RVC+CGP combination is a sensible new idea and the convergence analysis is worth reading, but the CGP privacy theorem is wrong: subsampling amplification cannot be applied to arbitrary dataset pairs, so the paper's central improved privacy-accuracy trade-off is unproven.","tokens_in":22609,"tokens_out":3431,"would_cite":false,"duration_ms":36467,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Exact convex-hull aggregation shrinks learning error in Byzantine-safe private distributed training.","keywords":["Byzantine resilience","decentralized distributed learning","resilient vector consensus","concentrated geo-privacy","privacy-accuracy trade-off","non-convex optimization","differential privacy","stochastic gradient descent"],"falsifier":"Run Algorithm 1 on a directed graph where one normal agent has exactly $|N_i(k)|/(d+1)$ Byzantine in-neighbors and observe whether the consensus error stops contracting, or directly compute the spectral norm of the matrix $M(k)$ induced by a cited RVC implementation and check whether $\\|(I-(1/n)\\mathbf{1}\\mathbf{1}^\\top)M(k)\\|_S^2$ stays uniformly below 1 for all $k$.","tokens_in":21388,"feed_emoji":"🛡️","tokens_out":6057,"duration_ms":54755,"temperature":0.7,"pith_summary":"This paper argues that the accuracy loss in privacy-preserving, Byzantine-resilient distributed learning comes largely from two removable sources: approximate Byzantine filters that return points outside the honest agents' convex hull, and an overly pessimistic privacy measure. It replaces the filters with resilient vector consensus algorithms that provably return a point inside the convex hull of honest agents' updates, and measures privacy with concentrated geo-privacy instead of differential privacy. The result is a decentralized SGD algorithm that converges at rate $O(1/\\sqrt{K})$ to a neighborhood of a stationary point while satisfying $\\rho$-CGP with $\\rho_i = 5K\\zeta_i^2 L'^2/\\sigma^2$. A sympathetic reader would care because the paper gives concrete error terms and shows the Byzantine estimation error term is eliminated rather than merely bounded.","feed_headline":"Convex-hull aggregation sharpens private Byzantine-safe learning","feed_subtitle":"Replacing approximate Byzantine filters with exact convex-hull consensus removes a learning-error term under concentrated geo-privacy.","key_machinery":"The load-bearing object is the resilient vector consensus operator $R(\\cdot)$, which returns a point inside the convex hull of the normal in-neighbors' transmitted parameters; all the cited RVC implementations rest on Helly's theorem, which justifies the Byzantine-count condition $nf_i(k) < |N_i(k)|/(d+1)$. This operator makes the aggregation phase a linear time-varying system $x(k+1)=M(k)\\tilde{x}(k)$ with a row-stochastic $M(k)$, so consensus error contracts by the factor $1-\\lambda = \\|(I - (1/n)\\mathbf{1}\\mathbf{1}^\\top)M(k)\\|_S^2$. The second load-bearing object is concentrated geo-privacy (CGP), which bounds R\\'enyi divergence by $\\rho\\|x-x'\\|^2$ using the input distance; combined with the $L'$-Lipschitz gradient assumption it yields the per-agent privacy parameter $\\rho_i = 5K\\zeta_i^2 L'^2/\\sigma^2$ without assuming bounded gradients.","core_discovery":"The central claim is that, under the condition that each normal agent has fewer Byzantine in-neighbors than $|N_i(k)|/(d+1)$, resilient vector consensus algorithms can serve as the aggregation rule in decentralized SGD, making the aggregation phase a linear time-varying system $x(k+1)=M(k)\\tilde{x}(k)$ with a row-stochastic matrix $M(k)$. Because the consensus point lies exactly in the convex hull of the honest agents' transmitted parameters, the consensus and convergence bounds contain no Byzantine estimation-error term; the only trace of adversarial presence is the contraction factor $\\lambda$ in the matrix $M(k)$. With step size $\\gamma = c/\\sqrt{K}$, the averaged squared gradient norm is bounded by $C_1/\\sqrt{K} + C_2/K + C_3\\chi^2(\\theta^2+\\tau^2) + C_4 d\\sigma^2 + C_5$, where $\\chi^2$ measures how far $M(k)$ is from being doubly stochastic. For privacy, the algorithm satisfies $\\rho$-CGP with $\\rho_i = 5K\\zeta_i^2 L'^2/\\sigma^2$ under the input-Lipschitz assumption, and this yields smaller privacy parameters and a flatter privacy-accuracy trade-off than the corresponding $(\\varepsilon,\\delta)$-DP bound.","pith_inferences":["If the contraction assumption (Assumption 5) holds for a concrete RVC implementation, the same framework could extend to higher-dimensional models; the paper's complexity warning about the centerpoint linear program suggests scalability, not theory, is the main bottleneck.","The privacy comparison between CGP and DP implicitly assumes that $L'$ is much smaller than $2G$; a testable extension is to measure $L'$ versus $2G$ on real datasets and check whether the gap persists after training.","Because the learning error is proportional to $d\\sigma^2$, the paper's stated future work of correlated, time-varying noise could reduce the effective noise dimension; a direct test would compare isotropic versus correlated noise under the same $\\rho$ value."],"forward_implications":["The Byzantine estimation error term present in ClippedGossip, IOS, and remove-then-clip disappears, leaving the noise variance $\\sigma^2$ and the stochastic-gradient variances $\\theta^2, \\tau^2$ as the dominant constant error sources.","The algorithm converges at rate $O(1/\\sqrt{K})$ to a neighborhood of a first-order stationary point, matching the rate of decentralized SGD without privacy or resilience.","Under CGP, noise can be chosen for utility without a bounded-gradient assumption, provided the gradient-to-input Lipschitzness condition holds.","Compared to $(\\varepsilon,\\delta)$-DP, the same noise scale yields much smaller privacy parameters (for example, $\\rho = 1.45$ versus $\\varepsilon = 865$ in the paper's simulations), so the privacy-accuracy trade-off is more favorable."],"supporting_citations":[{"why":"Supplies the centerpoint-based RVC algorithm and the LTV representation lemma (Lemma 2) that turns aggregation into $x(k+1)=M(k)\\tilde{x}(k)$.","marker":"[1]"},{"why":"Supplies the concentrated geo-privacy definition, its advanced composition, and the conversion to $(\\varepsilon_{\\text{geo}},\\delta,r)$-GP used in the privacy comparison.","marker":"[29]"},{"why":"Provides the IOS baseline whose estimation error the paper removes, and the form of the consensus contraction assumption adopted in Assumption 5.","marker":"[41]"},{"why":"Provides the PP-IOS baseline and the DP-based privacy-accuracy trade-off analysis that this paper improves upon.","marker":"[47]"},{"why":"One of the approximate aggregation rules (ClippedGossip) whose inherent estimation error the paper eliminates.","marker":"[22]"},{"why":"One of the approximate aggregation rules (remove-then-clip) whose inherent estimation error the paper eliminates.","marker":"[45]"},{"why":"Helly's theorem, the theoretical foundation for the Byzantine-count condition that guarantees convex-hull containment.","marker":"[12]"},{"why":"Supplies the Byz-Iter algorithm, one of the concrete RVC implementations the framework relies on.","marker":"[38]"},{"why":"Supplies the ADRC algorithm, another concrete RVC implementation the framework relies on.","marker":"[33]"}],"fun_headline_variants":["Exact convex hull consensus boosts private Byzantine-safe DML","Sharper privacy-accuracy trade-off via convex-hull aggregation","Byzantine-proof and private: exact consensus beats approximate filters","Tighter convergence with convex-hull aggregation under geo-privacy","Improved trade-off: private Byzantine-resilient learning via exact hull"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The result collapses if the resilient aggregation matrix $M(k)$ fails to shrink disagreement by a constant factor, or if a normal agent's Byzantine in-neighbors reach the fraction $1/(d+1)$ of its neighborhood—conditions the paper assumes but does not prove for any concrete implementation.","fun_headline_variants_meta":{"raw":{"variants":["Exact convex hull consensus boosts private Byzantine-safe DML","Sharper privacy-accuracy trade-off via convex-hull aggregation","Byzantine-proof and private: exact consensus beats approximate filters","Tighter convergence with convex-hull aggregation under geo-privacy","Improved trade-off: private Byzantine-resilient learning via exact hull"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.00067,"raw_usage":{"total_tokens":3090,"prompt_tokens":1016,"completion_tokens":2074,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":632,"completion_tokens_details":{"reasoning_tokens":1988}},"tokens_in":632,"tokens_out":2074,"duration_ms":14220,"temperature":1.0,"reasoning_tokens":1988,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-15T19:42:37.975610+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run Algorithm 1 on a directed graph where one normal agent has exactly $|N_i(k)|/(d+1)$ Byzantine in-neighbors and observe whether the consensus error stops contracting, or directly compute the spectral norm of the matrix $M(k)$ induced by a cited RVC implementation and check whether $\\|(I-(1/n)\\mathbf{1}\\mathbf{1}^\\top)M(k)\\|_S^2$ stays uniformly below 1 for all $k$.","supporting_citations":[{"cited_title":"Resilient distributed vector consensus using centerpoint","cited_arxiv_id":null,"evidence_quote":"Supplies the centerpoint-based RVC algorithm and the LTV representation lemma (Lemma 2) that turns aggregation into $x(k+1)=M(k)\\tilde{x}(k)$."},{"cited_title":"Concentrated geo-privacy","cited_arxiv_id":null,"evidence_quote":"Supplies the concentrated geo-privacy definition, its advanced composition, and the conversion to $(\\varepsilon_{\\text{geo}},\\delta,r)$-GP used in the privacy comparison."},{"cited_title":"Byzantine- resilient decentralized stochastic optimization with rob ust aggregation rules","cited_arxiv_id":null,"evidence_quote":"Provides the IOS baseline whose estimation error the paper removes, and the form of the consensus contraction assumption adopted in Assumption 5."},{"cited_title":"On the tradeoff between privacy preservation and byzantine-robustness in decentralized learning","cited_arxiv_id":null,"evidence_quote":"Provides the PP-IOS baseline and the DP-based privacy-accuracy trade-off analysis that this paper improves upon."},{"cited_title":"Byzantine-robust decentralized learning via remove-then-clip aggregation","cited_arxiv_id":null,"evidence_quote":"One of the approximate aggregation rules (remove-then-clip) whose inherent estimation error the paper eliminates."},{"cited_title":"Hell y’s theorem and its relatives","cited_arxiv_id":null,"evidence_quote":"Helly's theorem, the theoretical foundation for the Byzantine-count condition that guarantees convex-hull containment."},{"cited_title":"Iterative byzantine vector consensus in incomplete graphs","cited_arxiv_id":null,"evidence_quote":"Supplies the Byz-Iter algorithm, one of the concrete RVC implementations the framework relies on."},{"cited_title":"Fault-tolerant rendezvous of multirobot systems","cited_arxiv_id":null,"evidence_quote":"Supplies the ADRC algorithm, another concrete RVC implementation the framework relies on."}],"review_version":1}