Analysis of Federated Aggregation under Model Poisoning and Backdoor Attacks: A Reconstructed Cross-Dataset and Cross-Architecture Benchmark

arXiv:2608.11423v1 [cs.LG] 11 Aug 2026

A NALYSIS OF F EDERATED AGGREGATION UNDER M ODEL P OISONING AND BACKDOOR ATTACKS : A R ECONSTRUCTED C ROSS -DATASET AND C ROSS -A RCHITECTURE B ENCHMARK

Soumya Mazumdar Department of Computer Science and Business Systems Gargi Memorial Institute of Technology Affiliated to Maulana Abul Kalam Azad University of Technology Balarampur, Mouza Beralia, Baruipur, Kolkata 700144, West Bengal, India reachme@soumyamazumdar.com Vineet Kumar Rakesh Computer and Informatics Group, Variable Energy Cyclotron Centre 1/AF, Bidhannagar, Kolkata 700064, West Bengal, India Engineering Sciences, Homi Bhabha National Institute Anushaktinagar, Mumbai, Maharashtra 400094, India vineet@vecc.gov.in Tapas Samanta Computer and Informatics Group, Variable Energy Cyclotron Centre 1/AF, Bidhannagar, Kolkata 700064, West Bengal, India Engineering Sciences, Homi Bhabha National Institute Anushaktinagar, Mumbai, Maharashtra 400094, India tsamanta@vecc.gov.in

August 13, 2026

A BSTRACT

Robust comparisons of federated aggregation methods require joint consideration of predictive performance, threat definitions, metric semantics, and execution provenance. A 500-cell seed-1 evaluation matrix was reconstructed across five aggregation methods, five datasets, five architectures, and four recorded conditions: clean, sign-flipping, Gaussian, and BadNets. Each cell contains a numerical performance summary. Successful execution logs were identified for 454 original runs and 36 repaired or rerun executions, whereas 10 clean SVHN cells were supported by summary-only provenance. Trimmed Mean achieved the highest clean macro-mean accuracy (76.02%) and the lowest mean within-task rank (1.70). Krum attained the highest recorded accuracy under both sign-flipping and Gaussian configurations. These relative rankings remained unchanged when analysis was restricted to 21 task pairs for which original successful logs were available for every method–condition combination. Audit of the supplied BadNets metric implementation established that every test input is triggered prior to target-label counting; consequently, the retained metric represents Triggered Target-Label Rate (TTLR) rather than a conventional target-excluding attack success rate. An audit of the supplied FedPARETO scaffold further identified a pathway in which predictive summaries may characterise an uncorrupted local model while the aggregation weight is applied to a separately corrupted update, introducing a potential discrepancy between reported predictive outcomes and the updates used for aggregation. The canonical matrix contains a single identified seed for each cell, and the exact attack and configuration lineage is incomplete. Accordingly, the reported findings should be interpreted as descriptive comparisons within the recorded configurations and should not be construed as statistical estimates or universal claims regarding robustness.

A PREPRINT - AUGUST 13, 2026

Keywords: Federated learning, robust aggregation, model poisoning, backdoor evaluation, provenance audit, reproducibility, Krum, FLTrust, FedPARETO

1

Introduction

Federated learning (FL) learns a shared model using dispersed client data without needing the server to gather the clients’ raw training samples. In the conventional FedAvg process, a global model is broadcast, clients execute local optimization, and the server merges the resultant model updates, generally with sample-size weighting [1]. This design modifies the server’s observability: the server gets parameter updates rather than the underlying local data-generating operations. Consequently, aggregation must balance beneficial but diverse client updates against changes that are erroneous, unusual, or purposely damaging. This problem is confounded by statistical heterogeneity. Honest customers might maximise distinct empirical aims because class proportions, acquisition circumstances, sample numbers, or domains vary between clients. FedProx, SCAFFOLD, FedNova, and adaptive federated optimization handle distinct kinds of client drift and objective inconsistency [2–5]. Byzantine robustness poses a distinct problem: a malevolent participant may submit an arbitrary or strategically modified update. Sign-reversal and additive-noise attacks directly affect model updates, while backdoor attacks may retain conventional predictive performance while generating a specific reaction on trigger-bearing inputs [6]. These attack types consequently need not elicit the same observable failure signatures. Comparisons among robust aggregation methods are difficult for three additional reasons. First, different rules rely on different information and trust assumptions. Krum uses inter-update geometry [7], coordinate-wise Trimmed Mean suppresses extreme coordinate values [8], and FLTrust uses a trusted server-side root update [9]. Second, metric names do not guarantee metric semantics. A field labelled “attack success rate” can differ materially from conventional targetexcluding backdoor ASR if its denominator includes naturally target-class examples. Third, historical result archives can contain unequal levels of execution provenance. Numerical summaries, successful execution logs, configuration snapshots, and source-code revisions are distinct evidence types and should not be treated as interchangeable. The present study is therefore framed as a reconstructed comparative benchmark and evidence audit, not as a newalgorithm superiority study. We analyze a fixed 500-cell seed-1 matrix spanning five aggregation methods, five datasets, five architectures, and four recorded condition labels. The numerical analysis is accompanied by a provenance audit, a BadNets metric-semantics audit, and an implementation audit of the supplied FedPARETO scaffold. Figure 1 summarizes this separation. Importantly, source-code observations are used to characterize the audited implementation but are not assumed to establish the immutable generating revision for every historical benchmark cell. The research covers three questions: 1. How does recorded predictive performance and within-task method ordering differ across the clean, signflipping, Gaussian, and BadNets condition labels, and how broadly is the observed ordering distributed across the included dataset and architecture groups? 2. How does ordinary BadNets test accuracy relate to the retained triggered target-label metric, and what does source-code audit establish about that metric’s semantics? 3. What mechanisms are present in the supplied FedPARETO scaffold, and does the audited post-training poisoning pathway preserve correspondence between the predictive evidence used for utility scoring and the submitted update that receives aggregation influence? The principal contributions are: (i) a complete numerical reconstruction of the 500 identified seed-1 run-summary cells and a provenance ledger distinguishing original, repaired/rerun, and summary-only evidence; (ii) descriptive reanalysis of condition-wise accuracy, within-task ranks, configuration wins, matched attack-minus-clean changes, pairwise method differences, lower-tail client performance, calibration, and leave-one-group-out sensitivity; (iii) a provenance sensitivity analysis that removes weaker-provenance task pairs without collecting new data; (iv) a source-code audit showing that the retained BadNets field has TTLR semantics under the supplied metric implementation; and (v) an implementation audit that distinguishes the executable FedPARETO heuristic from broader conceptual mechanisms and identifies an update–utility correspondence failure mode in the supplied poisoning path. These contributions concern evidence reconstruction, interpretation, and reproducibility; they do not establish universal robustness, statistical superiority, or empirical validation of an unevaluated FedPARETO refinement. 2

A PREPRINT - AUGUST 13, 2026

Benchmark tasks 25 task configurations 5 datasets × 5 architectures

Aggregation methods

Threat conditions

5 methods FedAvg, Trimmed Mean, Krum, FLTrust, FedPARETO

4 conditions Clean, sign flipping, Gaussian, BadNets

Canonical evidence 500 seed-1 cells Accuracy, ECE, worst-client accuracy TTLR retained for 125 BadNets cells

Provenance audit

Code and metric audit

500 summary records 454 original successful execution logs 36 repaired/rerun successful execution logs 10 summary-only cells 490/500 cells have successful-run logs

FedPARETO executable implementation BadNets metric semantics: TTLR ̸= conventional ASR submitted-update–utility correspondence implemented vs. conceptual mechanisms

Evidence-bounded analysis condition-wise accuracy and ranks • matched attack-minus-clean change • pairwise win/tie/loss recurrent low-accuracy outcomes • BadNets accuracy– TTLR analysis • leave-one-dataset/architecture-out stability additional seeds, ablations, and anchor-size studies analysed separately; no pseudo-replication

Figure 1: Evidence reconstruction and analysis design. The reconstructed matrix comprises 25 dataset–architecture task configurations, five aggregation methods, and four recorded conditions, yielding 500 numerical seed-1 cells. All cells have run-summary values; 454 are additionally associated with original successful execution logs, 36 with successful repaired/rerun logs, and 10 with summary-only provenance. Numerical provenance is kept separate from code and metric audit so that implementation observations are not treated as proof of the generating mechanism for every historical result.

2

Related work

Federated optimization and statistical heterogeneity FedAvg established the iterative pattern of local optimization followed by server aggregation [1]. When local objectives differ, repeated local steps can produce client drift. FedProx constrains local deviation through a proximal term [2]; SCAFFOLD uses control variates [3]; FedNova normalizes heterogeneous local computation [4]; and adaptive federated optimization introduces server-side adaptive updates [5]. These methods illustrate why an atypical honest update need not be malicious. The reconstructed canonical benchmark spans different datasets and architectures, but it does not constitute a controlled sweep over non-IID severity; where Dirichlet α = 1.0 appears below, it is reported only for the repaired subset whose configurations explicitly retain that value. Byzantine-robust aggregation Krum selects an update supported by neighboring updates in parameter space [7]. Coordinate-wise robust estimators such as the median and Trimmed Mean instead suppress extreme submitted values independently for each model coordinate [8]. Bulyan combines Byzantine-resilient candidate selection with coordinate-wise aggregation [10], and geometric robust aggregation has also been studied in federated settings [11]. Bucketing methods modify the effective geometry seen by robust aggregation in heterogeneous settings [12]. These approaches make different assumptions about the number and geometry of malicious and benign updates. The current benchmark contains just FedAvg, Trimmed Mean, Krum, FLTrust, and the given FedPARETO implementation; it is thus a five-method comparison rather than a full leaderboard of Byzantine defenses. Adaptive or defense-aware poisoning is particularly critical when interpreting geometry-based approaches since an attacker might seek updates that remain plausible under the defense’s selection process. The maintained benchmark does not contain adaptive Krum-aware optimization, model replacement, or attack-strength sweeps, therefore its Krum findings are constrained to the recorded sign-flipping and Gaussian circumstances rather than extended to Byzantine assaults generally. 3

A PREPRINT - AUGUST 13, 2026

Trust and Validation aggregation FLTrust trains a root update from a trusted server-side dataset and utilises root alignment to weight client updates [9]. This substitutes part of peer-to-peer geometric reasoning with server-held evidence, but it includes assumptions about root-data integrity and representativeness. The given FedPARETO architecture similarly combines server-root information with predicted summaries and temporal reliability. Such techniques need explicit accounting of which signals are autonomously calculated by the server and which are provided by clients, since client-derived validation signals may itself be manipulable under a sufficiently potent adversary. Backdoor evaluation, calibration, and reproducibility Federated backdoor attacks can preserve high ordinary accuracy while inducing targeted behavior on triggered inputs [6]; ordinary test accuracy therefore cannot by itself characterize trigger-conditioned behavior. Calibration adds another dimension: expected calibration error (ECE) summarizes agreement between confidence and correctness [13], but a low-accuracy model can still exhibit a numerically small ECE under some confidence distributions. Likewise, a minimum client accuracy is a lower-tail descriptive outcome rather than a complete fairness criterion; fairness-oriented FL work motivates richer distributional evaluation [14]. These distinctions motivate the present separation between ordinary accuracy, TTLR, ECE, and minimum-client accuracy, as well as the explicit separation of numerical summaries from execution and implementation provenance.

3

Methods

Evidence scope and terminology A task configuration is one dataset–architecture pair, while canonical cell is one method–dataset–architecture– condition–seed identity retained in the reconstructed matrix. Every canonical identity uses seed 1. The 25 task configurations therefore provide benchmark breadth but are not stochastic repetitions of one experiment. A run-summary record is the retained machine-readable record containing final test accuracy and additional final metrics. A successful execution log is stronger execution provenance because it documents a completed run. The manuscript distinguishes direct benchmark measurements, derived descriptive statistics, execution provenance, source-code observations, interpretation, and future design proposals throughout. Federated-learning formulation Let client i hold local dataset Di and empirical objective X 1 Fi (θ) = |Di |

(1)

ℓ(fθ (x), y),

(x,y)∈Di

where θ denotes model parameters, fθ the predictor, and ℓ the training loss. A population objective may be written F (θ) =

N X

pi ≥ 0,

pi Fi (θ),

i=1

t At communication round t, local training produces θi,loc and update

N X

pi = 1.

(2)

i=1

t ∆ti = θi,loc − θt .

(3)

Because the evaluated aggregators are not all representable by one scalar client-weight vector (for example, Trimmed Mean is coordinate-wise), we write the server update generally as
θt+1 = θt + ηt At {∆ti : i ∈ St } , (4)

where St is the selected-client set, ηt is a server step factor, and At denotes the aggregation operator. Aggregation methods and audited implementation behavior FedAvg. The sample-weighted form is AFedAvg =

X

i∈St

4

P

ni

j∈St nj

∆ti ,

(5)

A PREPRINT - AUGUST 13, 2026

with ni = |Di |. The supplied scaffold’s fedavg_aggregate function uses these sample-count weights. This is a code-level observation for the audited scaffold; immutable source linkage is not available for every historical canonical cell. Trimmed Mean. For coordinate k, let ∆(1),k ≤ · · · ≤ ∆(m),k be the sorted submitted values from m = |St | clients. If b values are removed from each end, m−b X m 1 [ATM ]k = ∆(j),k , 0≤b< . (6) m − 2b 2 j=b+1

The audited scaffold implements per-coordinate sorting with configurable trim_ratio; its default is 0.2, so a tenclient round would trim two values from each tail. That setting is an implementation-level property of the supplied scaffold and is not asserted as a globally provenance-linked parameter for all canonical Trimmed Mean cells. Krum. For a configured Byzantine bound f , Krum scores candidate update i by X si = ∥∆ti − ∆tj ∥22 , |Ni | = m − f − 2,

(7)

j∈Ni

and selects

i⋆ = arg min si . i

(8)

The given scaffold implements single-update Krum, not Multi-Krum. It generates f from the specified harmful fraction and the number of chosen clients. In the repaired subset, the maintained configuration is 10 chosen clients and malicious fraction 0.25; the audited Python path evaluates round(0.25 × 10) to f = 2. This value is not extended to canonical cells lacking the same configuration provenance, and no claim is made that Krum’s theoretical assumptions were tested round-by-round for the whole matrix. FLTrust. Let ∆tr denote a server root update. The directional trust score is   ⟨∆ti , ∆tr ⟩ . ti = max 0, ∥∆ti ∥2 ∥∆tr ∥2

(9)

In the given scaffold, each client update is rescaled to the root-update norm before trust-weighted averaging; negative cosine similarity is cut to zero, and if all trust scores are non-positive the implementation falls back to uniform weights. The root update is taught server-side using the same SGD learning rate, momentum, and weight decay parameters as the federated setup. These facts describe the audited implementation rather than providing entire historical history for every canonical FLTrust execution. FedPARETO as implemented. The executable scaffold constructs four raw signals. Let ai denote anchor accuracy, ei anchor ECE, ℓi local client accuracy, qi,t−1 temporal reliability, and gt the server root-update vector: (10a) (10b) (10c)

ui,acc = ai , ui,cal = −ei , ui,prio = 1 − ℓi ,

ui,rob = 12 max(0, cos(∆ti , gt )) + 12 qi,t−1 .

(10d)

The term 1 − ℓi is described here as a low-local-accuracy priority signal, not as a measured fairness outcome. Each component is min–max normalized across participating clients; the audited helper returns zero for an entire component e i is the normalized vector, the dominance-count rank is if all participating values are equal. If u X ei ∧ u e j ̸= u ei] . ri = 1 + I[e uj ⪰ u (11) j̸=i

5

A PREPRINT - AUGUST 13, 2026

The scalar utility used by the executable implementation is X λP si = αk u eik + − λT (1 − u ei,rob ), ri

(12)

k

followed by

vi = exp(τ si ),

(13)

Euclidean projection of v onto the probability simplex, and uniform mixing when entropy_reg> 0. The verified source additionally initializes unseen-client temporal reliability to 0.5 and updates it as a momentum average of a signal combining the current aggregation weight and normalized robustness score. Legacy configuration files instantiate these values numerically, however the legacy settings are not regarded as canonical-wide hyperparameters since comprehensive per-run configuration snapshots are unavailable for the 500-cell matrix. The executable approach is thus a Pareto-inspired dominance-count/scalarization heuristic. It does not implement the conceptual draft’s weighted-Tchebycheff optimization, explicit ℓ1 trust region around sample-size weights, reliabilitydependent weight caps, benign-subspace singular-vector model, or formal constrained Pareto solver. FedPARETO signal ownership and trust boundary The audited scaffold does not treat all utility signals equivalently. Table 1 records where each signal is produced. Anchor predictions and local metrics are computed in the client object and returned to the server; root-direction similarity and temporal reliability are server-computed. Consequently, the audited scaffold assumes integrity of clientreturned predictive summaries unless an external trusted-execution or verification mechanism is added. No adaptive experiment in the retained benchmark tests deliberate forgery of these summary fields. Table 1: Signal ownership in the supplied FedPARETO scaffold. The table describes audited source behavior, not immutable generating provenance for every historical benchmark cell. Signal

Audited location

Interpretation / trust implication

Anchor predictions / derived accuracy and ECE

Client computes; server consumes returned summary Client computes and returns Server computes from submitted delta and root vector Server-maintained state

Client-derived predictive evidence; forgeability is not evaluated in the benchmark

Local accuracy ℓi Root-direction similarity Temporal reliability qi,t−1

Used only as low-local-accuracy priority; not an independently verified fairness measure Directly tied to the submitted update in the audited server path Initialized to 0.5 for unseen clients and updated by momentum from current weight and robustness score

Scope of the implementation audit The supplied FedPARETO scaffold is informative for mechanism audit but is not a complete generating repository for the full canonical benchmark. In particular, the audited scaffold’s dataset/model registry does not instantiate all five canonical datasets and all five canonical architectures. The source audit therefore establishes behavior of the available implementation paths, including metric semantics and the update–utility mismatch described below, but it does not prove that every historical canonical cell was generated by exactly that revision or preprocessing/model-adaptation code. Recorded threat conditions and configuration provenance The canonical summaries retain the labels Clean, Sign flipping, Gaussian, and BadNets for all corresponding cells. Exact attack strength and participation parameters are not uniformly provenance-linked across all 500 cells. Table 2 therefore separates the global recorded label from subset-verified and code-level details. “‘latex “‘ e t = −λ∆t and Gaussian corruption as ∆ e t = ∆t + εi with The audited scaffold represents sign flipping as ∆ i i i i 2 εi ∼ N (0, σ I). These equations describe the source implementation family; the benchmark-level analysis treats the historical labels categorically where exact per-cell parameters are unresolved. 6

A PREPRINT - AUGUST 13, 2026

Table 2: Threat-condition evidence scope. Parameters in the third column are reported only at the evidence level at which they are verified; they are not generalized to all canonical cells. Condition

Canonical evidence

Audited / subset-verified detail

Not established globally

Clean

Clean condition label retained for all clean cells Condition label retained for all sign-flipping cells

No attack applied in the audited clean path Audited scaffold applies −3∆; repaired subset records malicious fraction 0.25

Complete per-run configuration snapshot for every historical cell Global sign multiplier, malicious fraction, realized malicious count per round, and identical sampling schedule across all historical cells Global σ, malicious fraction, realized malicious participation, and identical attack implementation across all historical cells Global target/trigger/poison fraction lineage and conventional target-excluding ASR

Sign flipping

Gaussian

Condition label retained for all Repaired subset records σ = 0.5 and Gaussian cells malicious fraction 0.25

Condition label and retained Repaired subset records 30% poisoned target-label field available for malicious batches, target 0, 4 × 4 trigger; audited metric triggers every test all 125 BadNets cells input Adaptive / Not present in canonical matrix None Krum-aware, FLTrust-aware, defense-aware FedPARETO-aware, modelattacks replacement, and attack-strength sweeps

BadNets

Outcome measures The run summaries retain final global test accuracy, final ECE, and final worst-client accuracy for every canonical cell. For BadNets, the retained target-label field is additionally available. Configuration-matched attack-minus-clean change is Dm,d,h,a = 100 (Am,d,h,a − Am,d,h,clean ) , (14) where A is final accuracy, m method, d dataset, h architecture, and a an attacked condition. These are descriptive configuration-matched differences; a shared seed label does not show that the clean and attacked executions share all underlying stochastic trajectories, thus D is not regarded as a seed-paired causal treatment effect. For confidence-based calibration, let B confidence bins divide the predictions, Ib signify the samples in bin b, acc(Ib ) their empirical accuracy, and conf(Ib ) their mean confidence. ECE is ECE =

B X |Ib | b=1

N

|acc(Ib ) − conf(Ib )| .

(15)

The audited implementation utilises equal-width top-label confidence bins and defaults to B = 15; the repaired subset specifically records 15 bins. This bin count is not stated as unchanging provenance for every historical canonical run. ECE is regarded exclusively as a calibration descriptor, not as a robustness score. Worst-client accuracy is the minimum of the per-client evaluation accuracies retained by the evaluation path, Aworst = min Ai . i∈Ceval

(16)

It is therefore a lower-tail descriptive outcome. It is not treated as a formal fairness guarantee, and the historical summaries do not uniformly preserve enough client-level sample-size context to make stronger fairness claims. BadNets metric semantics: TTLR versus conventional ASR The supplied metric implementation applies the trigger to every test input and counts the fraction predicted as target label y ⋆ . We therefore denote the retained field N

TTLR =

1 X I[f (T (xj )) = y ⋆ ] , N j=1

(17)

where T (·) applies the trigger. Because Eq. (17) includes examples whose natural label already equals y ⋆ , it differs from conventional target-excluding ASR, P ⋆ j:yj ̸=y ⋆ I[f (T (xj )) = y ] P ASR¬y⋆ = . (18) j:yj ̸=y ⋆ 1 7

A PREPRINT - AUGUST 13, 2026

The retained aggregate summaries do not contain the class-conditioned triggered counts needed to reconstruct Eq. (18). Accordingly, the manuscript compares TTLR only as the observed all-triggered-input target-label frequency under the retained metric; lower TTLR is not translated into a general ranking of backdoor defenses. Update–utility correspondence in the audited FedPARETO path In the audited sign-flipping/Gaussian client path, local training first creates an uncorrupted model and delta. The delta may then be modified by the attack, while local metrics and anchor predictions are subsequently computed from the still-uncorrupted local model object. Therefore t ∆ti,submitted ̸= θi,summary − θt

(19)

can hold. Equation (19) is a source-code observation: predictive evidence and submitted update can refer to different model objects. It does not establish that this mismatch caused the canonical FedPARETO accuracy reductions, nor that every canonical FedPARETO cell was generated by the exact audited revision. A possible future update-consistent construction would evaluate the reconstructed candidate θbit = θt + ∆ti,submitted before calculating predictive utility. This construction is proposed only as a design direction; it is not experimentally evaluated in the present evidence and is not treated as an empirical contribution.

4

Experimental setup and reconstruction protocol

Canonical matrix The reconstructed matrix crosses five datasets (GTSRB, SVHN, MNIST, CIFAR-10, and CIFAR-100), five architecture labels (SimpleCNN, ResNet-18, MobileNetV3-Small, EfficientNet-B0, and ShuffleNetV2), five aggregation methods, and four recorded conditions, yielding 500 method–dataset–architecture–condition cells. All canonical identities encode seed 1. Exact architecture-adaptation and preprocessing details are not uniformly recoverable from a generating repository for every cell; the cross-architecture results are therefore treated as numerical comparisons across the recorded architecture labels rather than as a fully reproducible architecture-ablation study. Canonicalization and execution provenance Canonical identity was defined by dataset, architecture, method, condition, and seed. Byte-identical archive copies were counted once for independent-evidence purposes. Numerical values were taken from the run-summary evidence associated with the canonical identity and cross-checked against the supplied rounded workbook; all 500 workbook final-accuracy entries agree with the canonical summaries within 5 × 10−5 . Provenance classification then used the strongest located execution evidence for each identity: an original successful execution log when located, otherwise a successful repaired/rerun execution log, and otherwise the run summary alone. No missing numerical value was imputed, and the provenance class was retained explicitly rather than used to select favorable numerical outcomes. All 500 canonical cells have summary values. Successful execution logs were located for 490: 454 original and 36 repaired/rerun. The remaining 10 cells are Clean SVHN results for MobileNetV3-Small and ShuffleNetV2 across all five methods. They have summary records and workbook values but no successful execution log located in the supplied bundles. Table 3 distinguishes numerical completeness from execution-log coverage. Table 3: Canonical evidence coverage and provenance. Evidence category

Cells

Fraction

Original execution log + summary Successful repaired/rerun log + summary Summary record

454 36 10

90.8% 7.2% 2.0%

Total

500

100%

The original suite master logs identify seed 1, a 500-round maximum, and early stopping disabled for their entries. The final repaired configurations independently record 500 rounds and, for that 36-run subset, 20 clients, 10 selected clients per round, one local epoch, batch size 64, learning rate 0.003, momentum 0.9, weight decay 5 × 10−4 , Dirichlet α = 1.0, malicious fraction 0.25 for attacked runs, anchor size 4096, and 15 ECE bins. These are subset-verified settings only. 8

A PREPRINT - AUGUST 13, 2026

Descriptive analysis and post-hoc provenance sensitivity Within each condition, methods were ranked separately within each dataset–architecture task; exact ties receive average rank and tied leaders divide one configuration win. We report macro means, medians, cross-task sample SD, IQR/range where useful, within-task ranks, configuration-win counts, configuration-matched attack-minus-clean differences, pairwise differences, and leave-one-dataset-out / leave-one-architecture-out sensitivity. These statistics describe the fixed observed task matrix and are not stochastic uncertainty estimates. No p-values, t-tests, ANOVA, seed-level standard errors, or seed-level confidence intervals are reported for the canonical matrix because there is one identified seed per cell. The separate legacy/scaffold MNIST three-seed families are summarized only as supplementary evidence and are not used to create uncertainty intervals for the canonical matrix. Two post-hoc provenance sensitivity analyses use only existing observations. First, the two task pairs whose clean cells are summary-only (SVHN–MobileNetV3-Small and SVHN–ShuffleNetV2) are removed in their entirety, yielding a matched 23-task / 460-cell subset. Second, we restrict to the 21 dataset–architecture task pairs for which all 20 method–condition cells have original successful execution logs, yielding an all-original 420-cell complete-task subset. The latter additionally excludes SVHN–ResNet-18 and CIFAR-100–ResNet-18, which contain repaired cells. These sensitivity analyses test dependence on provenance strata; they do not create new stochastic replication.

5

Results

Numerical reconstruction and provenance The reconstruction resolves the earlier incomplete 464/500 matrix by recovering numerical run-summary values for all 500 canonical identities. The workbook cross-check is exact after the documented rounding tolerance. The stronger provenance distinction remains important: numerical completeness is 100%, whereas successful execution-log coverage is 98%. All subsequent full-matrix analyses therefore use the 500 numerical summaries, while provenance sensitivity is reported separately rather than treating original, repaired, and summary-only evidence as identical. Condition-level predictive performance Table 4 summarizes final global test accuracy across the fixed 25 task configurations. Under Clean, Trimmed Mean has the highest macro-mean accuracy (76.02%) and lowest mean within-task rank (1.70), followed by FedAvg (70.92%, rank 1.82). Under Sign flipping, Krum has the highest mean accuracy (63.91%), lowest mean rank (1.32), and 19 configuration wins. Under Gaussian, Krum has mean accuracy 64.45%, mean rank 1.08, and 24 wins. The BadNets ordinary-accuracy ordering returns to a pattern closer to Clean, with Trimmed Mean having the highest macro-mean ordinary accuracy (75.17%) and FedAvg and Trimmed Mean tied at mean rank 1.80. Instead of aggregating absolute task difficulty, Figure 3 highlights relative method ranking inside a challenge. The rank view is complemented by configuration-matched attack-minus-clean adjustments in Figure 4. These are not distinct replications, but rather many descriptions of the same fixed runs. The mean matched change under sign flipping is −65.32 pp for FedAvg, −34.54 pp for Trimmed Mean, +1.06 pp for Krum, −16.41 pp for FLTrust, and −36.30 pp for FedPARETO. The comparable changes in Gaussian are −59.04, −52.88, +1.60, −16.07, and −52.62 pp. The tiny positive Krum means are not understood as attackinduced improvement; rather, the supporting finding is that Krum’s reported attacked accuracies are similar to its clean accuracies in the seed-1 matrix. Provenance sensitivity of the headline ordering Simply stating that the 10 summary-only cells make up 2% of cells understates their downstream importance in matched clean-reference studies since they are concentrated in two clean SVHN task pairings. Table 5 therefore compares the full matrix with a 23-task complete-case subset excluding those task pairs and with a stricter 21-task subset in which every method–condition cell has an original successful execution log. The Krum-first ordering under Sign flipping and Gaussian is retained in both provenance-sensitive subsets. Krum’s mean matched attack-minus-clean change is +0.84 pp (Sign flipping) and +1.58 pp (Gaussian) in the 23-task set, and +0.83 pp and +1.42 pp in the 21-task all-original set, compared with +1.06 pp and +1.60 pp in the full matrix. This reanalysis does not establish stochastic repeatability; it shows that the headline fixed-matrix ordering is not created solely by the 10 summary-only cells or by the repaired/rerun task pairs. 9

A PREPRINT - AUGUST 13, 2026

100

Accuracy across 25 dataset-architecture configurations per method and condition Clean

Sign flipping

Gaussian

BadNets

Final test accuracy (%)

80 60 40 20 0

vg FedA

an

d Me

e Trimm

Krum

FLTru

st

FedPA

RETO

Figure 2: Final test accuracy across the reconstructed canonical matrix. Bars show the macro mean across the 25 dataset–architecture task configurations for each method and recorded condition. Whiskers show cross-task sample SD, i.e. dispersion across heterogeneous tasks rather than uncertainty around a stochastic mean. The figure is descriptive and should be read together with within-task ranks and task-level distributions.

Global and lower-tail client performance Figure 5 compares final global accuracy with the minimum recorded client accuracy. In Clean, mean worst-client accuracy is 74.72% for Trimmed Mean, 68.94% for FedAvg, 66.39% for FedPARETO, 57.80% for Krum, and 28.94% for FLTrust. Under Sign flipping, the corresponding values are 34.70%, 0.23%, 27.28%, 59.44%, and 11.86%; under Gaussian they are 16.50%, 4.90%, 9.49%, 60.77%, and 13.65%, respectively. Thus the supplied summaries record comparatively high minimum-client accuracy for Krum under the two model-poisoning labels, but this outcome is not equated with formal fairness.

BadNets ordinary accuracy and retained triggered target-label behavior BadNets ordinary accuracy is numerically close to Clean accuracy at the macro-mean level: the mean matched changes are −0.41 pp for FedAvg, −0.86 pp for Trimmed Mean, −0.10 pp for Krum, −0.89 pp for FLTrust, and −0.64 pp for FedPARETO. This similarity concerns untriggered predictive performance only. Under the supplied audited metric semantics, mean TTLR is 72.68% for FedAvg, 69.70% for Trimmed Mean, 60.54% for FedPARETO, 30.61% for Krum, and 24.41% for FLTrust. Table 6 separates ordinary accuracy, TTLR, ECE, and minimum-client accuracy because they answer different questions. In particular, the low mean TTLR of FLTrust occurs together with low ordinary accuracy, which illustrates why TTLR should not be translated directly into a backdoor-defense ranking. Cross-dataset TTLR averaging is additionally difficult to interpret because the datasets differ in class count and targetclass prevalence, and target label 0 is provenance-verified only for the repaired subset. Table 7 therefore reports the existing 125 BadNets TTLR values after stratification by dataset. These are still retained-metric summaries, not conventional ASR. 10

A PREPRINT - AUGUST 13, 2026

Table 4: Condition-level final-accuracy summaries across the 25 task configurations. SD is sample dispersion across heterogeneous task configurations, not seed-level uncertainty. Fractional wins divide a task-level win among tied leaders.

Condition

Method

Mean (%)

Median (%)

SD (pp)

Mean rank

Wins

n tasks

Clean

FedAvg Trimmed Mean Krum FLTrust FedPARETO

70.92 76.02 62.85 36.88 68.93

75.39 85.95 72.17 24.15 72.66

24.78 21.01 27.58 32.81 24.61

1.82 1.70 3.80 4.72 2.96

14.5 10.0 0.0 0.0 0.5

25 25 25 25 25

Sign flipping

FedAvg Trimmed Mean Krum FLTrust FedPARETO

5.59 41.48 63.91 20.47 32.63

6.70 45.11 72.37 11.06 10.54

4.22 30.97 27.98 24.83 32.90

4.44 2.78 1.32 3.56 2.90

0.0 1.0 19.0 0.0 5.0

25 25 25 25 25

Gaussian

FedAvg Trimmed Mean Krum FLTrust FedPARETO

11.88 23.14 64.45 20.82 16.31

6.70 9.80 72.70 10.00 9.80

18.91 29.56 27.10 27.23 24.38

4.04 3.14 1.08 3.02 3.72

0.0 1.0 24.0 0.0 0.0

25 25 25 25 25

BadNets

FedAvg Trimmed Mean Krum FLTrust FedPARETO

70.51 75.17 62.75 35.99 68.29

76.64 85.29 68.56 21.99 72.68

24.79 21.49 27.77 32.79 25.05

1.80 1.80 3.80 4.72 2.88

14.0 8.0 0.0 0.0 3.0

25 25 25 25 25

Table 5: Post-hoc provenance sensitivity using existing data only. The 23-task set removes the two task pairs whose clean reference is summary-only. The 21-task set retains only task pairs for which all 20 method–condition cells have original successful logs. Values are mean within-task rank followed by configuration wins for the leading method. Analysis set

Tasks

Clean

Sign flipping

Gaussian

BadNets ordinary

Full canonical matrix Exclude summary-only clean task pairs All-original complete-task subset

25 23 21

Trimmed Mean 1.70 / 10 Trimmed Mean 1.76 / 8 Trimmed Mean 1.79 / 7

Krum 1.32 / 19 Krum 1.30 / 18 Krum 1.33 / 16

Krum 1.08 / 24 Krum 1.09 / 22 Krum 1.10 / 20

FedAvg 1.80 / 14; TM 1.80 / 8 FedAvg 1.83 / 13; TM 1.83 / 7 FedAvg 1.86 / 12; TM 1.86 / 6

Matched FedPARETO–Krum comparison FedPARETO exceeds Krum in 22/25 Clean configurations with a mean FedPARETO-minus-Krum difference of +6.08 pp. Under Sign flipping it exceeds Krum in 5/25 configurations (mean −31.28 pp), and under Gaussian in 1/25 (mean −48.15 pp). Under BadNets ordinary accuracy, FedPARETO again exceeds Krum in 22/25 configurations (mean +5.54 pp). The same reversal remains in the 21-task all-original subset: mean differences are +4.82, −32.21, −46.99, and +4.53 pp for Clean, Sign flipping, Gaussian, and BadNets ordinary accuracy, respectively. Figure 6 highlights this pair because it links the empirical ranking reversal to the FedPARETO implementation audit. A complete ordered pairwise method table is provided in the Supplementary Information so that the comparison is not treated as the only relevant pairwise result. The two methods also operate under different information assumptions: the supplied FedPARETO scaffold uses server/root and client-returned predictive information, whereas Krum uses submitted-update geometry. Leave-one-group-out sensitivity and supplementary evidence Leaving out each dataset in turn leaves Krum at rank 1 under both Sign flipping and Gaussian in all five exclusions; its leave-one-dataset-out mean accuracy ranges from 55.34% to 74.46% for Sign flipping and 56.01% to 74.73% for Gaussian. Leaving out each architecture likewise leaves Krum at rank 1 in all five exclusions; the corresponding mean-accuracy ranges are 61.67–65.20% and 62.21–65.73%. These are descriptive sensitivity checks showing that 11

A PREPRINT - AUGUST 13, 2026

Condition-dependent method rankings Clean

1.82

1.70

3.80

4.72

4.5

2.96

Sign flipping

4.44

2.78

1.32

3.56

Mean within-task rank (1 = best)

4.0 3.5

2.90

3.0 Gaussian

4.04

3.14

1.08

3.02

2.5

3.72

2.0 BadNets

1.80

1.80

g

v FedA

3.80

ean

Krum

M med

Trim

4.72

st

FLTru

2.88

1.5

O RET A P d Fe

Figure 3: Mean within-task ranks across recorded conditions. Each dataset–architecture task is ranked separately, with rank 1 denoting the highest final accuracy among the five methods. The clean and BadNets ordinary-accuracy ordering differs from the Krum-first ordering under Sign flipping and Gaussian. Table 6: BadNets performance across five datasets and 25 job settings. TTLR is not the conventional targetexcluding attack success rate (ASR); under the audited metric semantics, it denotes the frequency with which triggered inputs are assigned the target label. Worst-client accuracy and ECE are reported separately as descriptive metrics. Method FedAvg Trimmed Mean Krum FLTrust FedPARETO

GTSRB

SVHN

MNIST

CIFAR-10

CIFAR-100

Macro Mean

92.37 89.53 15.38 23.73 78.96

73.39 43.76 26.76 19.49 49.24

68.59 99.89 63.91 9.18 67.94

55.80 56.30 45.37 28.10 54.58

73.26 59.04 1.64 41.57 51.96

72.68 69.70 30.61 24.41 60.54

the Krum-first ordering in the fixed matrix is not dependent on one named dataset or architecture group; they do not establish stochastic or external generalization. Full values are provided in Supplementary Figs. S7–S8 and their source tables. Seven separate legacy/scaffold MNIST families contain seeds 1–3. Their seed-level SDs range from 0.08 to 7.14 pp, demonstrating that stochastic variability in this broader experimental family can be small or several percentage points depending on method and condition. These sparse, unbalanced families do not validate the canonical matrix and are not pooled with it. Additionally, anchor-size observations and single-run FedPARETO ablations are solely kept as exploratory supplemental evidence. The four recorded anchor-size points are just non-monotonic observations rather than a scaling rule, and the available ablations do not determine the marginal causal contribution of any utility component. FedPARETO implementation audit Anchor accuracy, negative ECE, low-local-accuracy priority, root-direction similarity, temporal reliability, per-round min–max normalisation, dominance-count ranking, scalar scoring, exponential transformation, simplex projection, and uniform mixing are all implemented by the provided scaffold, according to the source audit. Several more comprehensive methods outlined in the conceptual draft are not implemented. The most significant source observation is Eq. (19): even tho the supplied delta is different, the client-returned prediction summaries may still represent the uncorrupted locally trained model after post-training sign-flipping or Gaussian corruption. These two paths are separated in Figure 7. This is not an empirically proven reason for the standard FedPARETO findings; rather, it is an implementation-level failure mode. The source-code mismatch and the empirical FedPARETO 12

A PREPRINT - AUGUST 13, 2026

Figure 4: Configuration-matched attack-minus-clean accuracy changes. Task-level percentage-point differences for a single technique are included in each distribution. Method, dataset, and architecture are used for matching. The distributions are descriptive rather than seed-paired treatment effects since a shared seed label does not produce identical stochastic trajectories across clean and attacked runs. Table 7: Dataset-stratified mean TTLR (%) across the five architectures. Values are descriptive summaries of the maintained all-triggered-input metric. Differences in dataset class structure, target prevalence, and insufficient global target-label provenance hinder reading this table as a traditional backdoor-defense scoreboard. Method GTSRB SVHN MNIST CIFAR-10 CIFAR-100 Macro mean FedAvg Trimmed Mean Krum FLTrust FedPARETO

92.37 89.53 15.38 23.73 78.96

73.39 43.76 26.76 19.49 49.24

68.59 99.89 63.91 9.18 67.94

55.80 56.30 45.37 28.10 54.58

73.26 59.04 1.64 41.57 51.96

72.68 69.70 30.61 24.41 60.54

results are provided as separate types of evidence as the precise generating revision is not inextricably tied to each canonical cell.

6

Discussion

Method ordering differs across the recorded conditions The main empirical finding is that the five assessed approaches are arranged differently across the fixed seed-1 matrix. While Krum achieves the best final accuracy in 19/25 Sign-flipping and 24/25 Gaussian task designs, clean performance prefers FedAvg and Trimmed Mean by macro mean and within-task rank. A clean-like arrangement is restored by BadNets’ ordinary accuracy. These findings of the reconstructed matrix are condition-specific and do not prove that one aggregator is better overall. The provenance sensitivity analysis strengthens this narrow interpretation. Removing the two task pairs whose clean baselines are summary-only, and then restricting further to 21 task pairs for which every method–condition cell has an original successful log, does not change the Krum-first ordering under Sign flipping or Gaussian. This is use13

A PREPRINT - AUGUST 13, 2026

Worst-client accuracy (%)

(a) Clean

(b) Sign flipping

100

100

80

80

60

60

40

40

20

20

0

0

20

40

60

80

100

0

0

20

40

Worst-client accuracy (%)

(c) Gaussian 100

80

80

60

60

40

40

20

20

0

20

40

60

80

100

0

0

Global test accuracy (%) FedAvg

80

100

80

100

(d) BadNets

100

0

60

20

40

60

Global test accuracy (%) Krum

Trimmed Mean

FLTrust

FedPARETO

Figure 5: Global versus worst-client accuracy across the four recorded conditions. Each small marker is one Figure 1: Global versus worst-client accuracy across all four benchmark conditions. Each small marker represents dataset–architecture taskconfiguration, and the large is the marker methodgives mean. Worst-client accuracy is the minimum one dataset–architecture andoutlined the largermarker black-outlined the method mean within that condition. Using recorded client evaluation is interpreted a lower-tail descriptive outcome, a fairness guarantee. worst-client accuracy on the accuracy vertical axisand makes the four panelsasdirectly comparable because this outcome not is retained for Clean, Sign Theflipping, plottedGaussian, task distributions areruns. not seed-level uncertainty estimates. and BadNets Clean and BadNets ordinary-performance panels retain relatively high global and worstclient accuracy for FedAvg, Trimmed Mean, and FedPARETO, whereas sign-flipping and Gaussian poisoning produce pronounced deterioration for several methods. Krum remains comparatively stable under the two evaluated model-poisoning conditions. The panels are descriptive across heterogeneous task configurations and do not represent seed-level uncertainty. The BadNets-specific ful TTLR evidence against a provenance-artifact of isthe doesthree not conditions. address seed-to-seed analysis should remain a separate figureexplanation because TTLR notheadline defined orordering, retained forbut theitother

repeatability or unresolved historical attack-strength differences. Interpreting the Krum result

Krum’s recorded performance is consistent with a regime in which its whole-update neighborhood-distance rule is well matched to the geometry of the evaluated sign-reversal and additive-noise conditions. That interpretation is plausible because conspicuous direction or distance deviations are exactly the information Krum uses. It is not a demonstrated causal mechanism for every task, and it should not be generalized to adaptive Byzantine adversaries. The benchmark does not contain Krum-aware optimization, model replacement, malicious-fraction sweeps, attack-strength sweeps, or controlled heterogeneity sweeps. Moreover, the configured Byzantine bound and realized malicious participation are not provenance-linked globally. The strongest defensible conclusion is therefore that Krum recorded the best final-accuracy ordering among the five evaluated methods under the retained Sign-flipping and Gaussian condition labels. FedAvg, Trimmed Mean, and trust-based methods FedAvg’s large negative matched changes under Sign flipping and Gaussian are consistent with an averaging rule that has no intrinsic rejection mechanism for arbitrary submitted updates. Trimmed Mean retains substantially higher recorded accuracy than FedAvg under Sign flipping in this matrix, but its Gaussian macro mean remains far below 14

A PREPRINT - AUGUST 13, 2026

Figure 6: Matched FedPARETO–Krum final-accuracy differences. Positive values favour FedPARETO and negative values favour Krum. Each point is a dataset–architecture task. The distributions are descriptive across fixed tasks and do not represent seed-level uncertainty or a causal comparison of the two design principles. Krum’s. These results illustrate that coordinate-wise trimming and whole-update geometric selection respond differently to the evaluated corruption patterns; they do not establish a general security hierarchy. FLTrust and FedPARETO use additional trusted or validation information. This makes their operational assumptions different from those of Krum and Trimmed Mean. In the audited FedPARETO scaffold, anchor predictions and local accuracy are client-derived summaries, while root similarity and temporal reliability are server-computed. A stronger adversary able to forge client-returned summaries could therefore target the utility channel itself; such attacks were not evaluated. The evaluated implementations also require access to individual client updates or per-client statistics and are not directly compatible with a protocol that reveals only an aggregate update without additional secure protocol design. Update–utility correspondence is an implementation problem, not a causal outcome The FedPARETO code audit identifies a concrete software-level inconsistency: the object used to derive predictive utility can differ from the submitted update receiving aggregation weight. The empirical matrix concurrently demonstrates substantial FedPARETO reductions under the recorded Sign-flipping and Gaussian labelling. These two observations should not be collapsed into a causal explanation. The available evidence cannot isolate whether the mismatch, utility normalization, anchor representativeness, trust parameters, attack geometry, historical source differences, or combinations of these factors contributed to the recorded outcomes. The general design implication is narrower: when predictive evidence is used to assign aggregation influence, the implementation should make explicit which model/update object that evidence validates. Reconstructing θt +∆ti,submitted and evaluating that candidate server-side is one possible future update-consistent design. Its performance, calibration, cost, and security remain unevaluated here. BadNets metric semantics and interpretation The BadNets results show why ordinary accuracy and trigger-conditioned target-label behavior must be separated. FedAvg and Trimmed Mean retain high ordinary accuracy while their mean TTLR values are near 70%. Conversely, FLTrust has the lowest mean TTLR but also the lowest ordinary accuracy among the five methods. TTLR therefore records a real behavior of the retained metric but is not sufficient for a conventional backdoor-defense ranking. The metric audit also imposes a provenance boundary. The supplied metric implementation clearly triggers every test input and therefore computes TTLR rather than target-excluding ASR, but an immutable metric-source hash is not linked to every historical BadNets result. We therefore report the historical field using the semantics established by the 15

A PREPRINT - AUGUST 13, 2026

Update–Utility Correspondence in the Audited FedPARETO Scaffold 1. Local training

3. Post-training attack 2. Clean update

produces the uncorrupted local model

modifies the update sent to the server

t ∆ti = θi,loc − θt

t θi,loc

4. Aggregation assigns weight wit to

∆ti,sub

∆ti,sub

Potential update–utility mismatch: predictive evidence can describe t θi,loc , while the resulting weight is applied to the separately modified ∆ti,sub . 5. Predictive evidence

6. FedPARETO utility

anchor predictions, ECE and local metrics are computed from the uncorrupted t locally trained model θi,loc

anchor accuracy, negative ECE, priority, root-direction similarity and temporal reliability

Interpretation. The upper pathway is the parameter-update pathway. The lower pathway is the predictiveevidence pathway. After post-training corruption, these pathways can refer to different model objects. Consequently, a utility score computed from the uncorrupted model does not necessarily validate the submitted update that receives aggregation weight.

Figure 7: Update–utility correspondence in the audited FedPARETO scaffold. The upper pathway represents the submitted parameter update; the lower pathway represents predictive evidence used in utility calculation. In the audited sign-flipping/Gaussian path, predictive evidence can remain associated with the uncorrupted locally trained model even after the submitted delta is modified. The figure documents a source-level failure mode and does not establish that the mismatch caused the canonical FedPARETO outcomes or that every historical cell used this exact revision. supplied audited implementation while explicitly noting that exact code-to-result lineage is incomplete. Conventional ASR, clean-model triggered baselines, and source-class-conditioned trigger behavior cannot be reconstructed from the retained aggregate summaries. Reproducibility implications The reconstruction demonstrates why numerical completeness and execution reproducibility should be stated separately. The matrix is numerically complete at 500/500 summaries, but successful execution logs were located for 490/500 cells and immutable source/configuration lineage is not complete. Repaired executions also span different software environments. The final repaired bundle records Python 3.10.13 and PyTorch 2.5.1 on NVIDIA L40S hardware, whereas an earlier repair attempt records Python 3.13.5 and PyTorch 2.8.0+cu128 on the same hardware class. The final accuracies are retained as canonical summary values, but these heterogeneous environments are not treated as a controlled runtime experiment and no cross-method latency or throughput claim is made.

7

Limitations and future work

The canonical matrix contains one identified seed per cell. Consequently, it cannot estimate run-to-run variability, stochastic ranking probability, or statistical superiority. Cross-task SD, ranks, win counts, matched differences, leaveone-group-out results, and provenance sensitivity are descriptive analyses of the fixed observed configurations. The limited three-seed MNIST families do not repair this limitation. Exact attack and training parameters are not provenance-linked uniformly across all historical cells. This prevents treating the retained condition labels as globally verified attack-strength treatments and prevents invoking theoretical robustness guarantees that require exact Byzantine participation. Additionally, the benchmark does not include a controlled non-IID severity sweep, model replacement, attack-strength and malicious-fraction sweeps, or adaptive defense-aware poisoning. As a consequence, the Krum result is limited to the five assessed techniques and the recorded 16

A PREPRINT - AUGUST 13, 2026

threat categories. The provided audited scaffold is not the full generating repository for all five named datasets and five architectural labels included in the numerical matrix. Therefore, not every cell can completely recover from precise preprocessing, architectural adaption, and immutable source revision. The origin of ten clean SVHN cells is summary-only. Stronger reproducibility would need per-run source hashes, full configuration snapshots, datasplit identities, environment locks, checkpoint hashes, and saved round-level logs, even tho the 21-task all-original sensitivity maintains the headline ordering. TTLR is not a traditional target-excluding ASR. Additionally, source-class-conditioned backdoor analysis and cleantrigger baselines are not supported by the summaries that were kept.ECE is sensitive to confidence binning and can be numerically small in low-accuracy models; worst-client accuracy is an extreme lower-tail statistic without uniformly retained client-size context. These outcomes are therefore reported descriptively and not combined into a single robustness or fairness score. The FedPARETO ablations and anchor-size observations are single-run legacy/scaffold experiments and do not establish component causality or an anchor-size response law. The proposed update-consistent FedPARETO construction is not experimentally evaluated. Future work would require balanced seeds, verified threat/configuration manifests, adaptive attacks, broader baseline coverage, conventional ASR, client-distribution analysis, and controlled computationalcost measurement before stronger robustness or deployment claims could be made.

8

Conclusion

A clear, constrained conclusion is backed by the reconstructed data. The ranking of the five assessed aggregation techniques varies significantly between the recorded circumstances in the fixed seed-1 matrix. In 19/25 Sign-flipping and 24/25 Gaussian task configurations, Krum achieves the greatest final accuracy, whereas Trimmed Mean has the highest clean macro-mean accuracy. After deleting the summary-only task pairs and restricting the analysis to 21 task pairs with original successful execution logs for each method–condition cell, the Krum-first ordering is still in situ. Both universal Byzantine robustness and stochastic repeatability are not proved by these descriptive facts. Although the retained triggered target-label metric shows a different trend, BadNets’ conventional accuracy often approaches clean accuracy. Since that field is TTLR rather than traditional target-excluding ASR under the provided certified metric implementation, it shouldn’t be used by itself to rank backdoor defences. Predictive evidence and the weighted submitted update may relate to distinct model objects in an update–utility correspondence failure mode, according to the FedPARETO source audit. This is not a proven cause of the standard FedPARETO results; rather, it is an implementation observation. Overall, the analysis demonstrates that threat scope, metric semantics, implementation specifics, and provenance strength significantly influence comparative FL-security claims, and that these kinds of evidence have to be disclosed independently. Acknowledgement This work was supported by the Variable Energy Cyclotron Centre (VECC), Department of Atomic Energy (DAE), Government of India (GoI), through the provision of GPU resources and computational facilities essential for carrying out this research. The authors gratefully acknowledge the technical support and computational infrastructure provided by VECC. The authors also sincerely appreciate the peer reviewers for their insightful comments and constructive criticism, which helped improve the quality of this work. Author contributions statement S.M. conceived the study and developed the core methodology, led the experimental evaluation, performed the model training and benchmarking experiments, conducted the ablation analyses, prepared the corresponding tables and figures, generated the manuscript visualizations, and contributed substantially to manuscript writing and revision. V.K.R. developed the benchmarking scripts for latency and throughput evaluation, assisted with system profiling, and prepared the reproducibility resources. T.S. contributed to model selection, reviewed the training and experimental configurations with particular attention to hardware efficiency, and independently validated the final results. All authors contributed to the critical review of the manuscript, approved the final version, and agreed to be accountable for the work. Additional information Accession codes: Not applicable. Competing interests: The authors declare no competing interests. The corresponding author is responsible for ensur17

A PREPRINT - AUGUST 13, 2026

ing that this statement is accurate and has been agreed upon by all co-authors. All code, training logs, configuration files, and evaluation scripts used in this study are publicly available at https://github.com/mazumdarsoumya/ RobustFL-Bench. Declarations Data availability All source code, configuration files, and supplementary scripts used in this study are publicly available at https: //github.com/mazumdarsoumya/RobustFL-Bench. The datasets are available under its original license and cannot be redistributed by the authors. Due to institutional data-sharing restrictions, detailed training logs and key result files are not openly available but can be accessed upon reasonable request to the corresponding author at reachme@soumyamazumdar.com. Clinical Trial Number Clinical trial number: not applicable. Ethics, Consent to Participate, and Consent to Publish Ethics, Consent to Participate, and Consent to Publish declarations: not applicable. Conflict of Interest All authors assert that they own no financial or personal affiliations that may be seen as affecting the work provided in this study. No conflicts of interest are acknowledged.

References [1] H. B. McMahan, E. Moore, D. Ramage, S. Hampson, and B. Agüera y Arcas, “Communication-efficient learning of deep networks from decentralized data,” in Proceedings of the 20th International Conference on Artificial Intelligence and Statistics, ser. Proceedings of Machine Learning Research, vol. 54. PMLR, 2017, pp. 1273– 1282. [2] T. Li, A. K. Sahu, M. Zaheer, M. Sanjabi, A. Talwalkar, and V. Smith, “Federated optimization in heterogeneous networks,” in Proceedings of Machine Learning and Systems, vol. 2, 2020, pp. 429–450. [3] S. P. Karimireddy, S. Kale, M. Mohri, S. J. Reddi, S. U. Stich, and A. T. Suresh, “SCAFFOLD: Stochastic controlled averaging for federated learning,” in Proceedings of the 37th International Conference on Machine Learning, ser. Proceedings of Machine Learning Research, vol. 119. PMLR, 2020, pp. 5132–5143. [4] J. Wang, Q. Liu, H. Liang, G. Joshi, and H. V. Poor, “Tackling the objective inconsistency problem in heterogeneous federated optimization,” in Advances in Neural Information Processing Systems, vol. 33, 2020, pp. 7611–7623. [5] S. J. Reddi, Z. Charles, M. Zaheer, Z. Garrett, K. Rush, J. Konečný, S. Kumar, and H. B. McMahan, “Adaptive federated optimization,” in International Conference on Learning Representations, 2021. [6] E. Bagdasaryan, A. Veit, Y. Hua, D. Estrin, and V. Shmatikov, “How to backdoor federated learning,” in Proceedings of the Twenty Third International Conference on Artificial Intelligence and Statistics, ser. Proceedings of Machine Learning Research, vol. 108. PMLR, 2020, pp. 2938–2948. [7] P. Blanchard, E. M. El Mhamdi, R. Guerraoui, and J. Stainer, “Machine learning with adversaries: Byzantine tolerant gradient descent,” in Advances in Neural Information Processing Systems, vol. 30, 2017. [8] D. Yin, Y. Chen, R. Kannan, and P. Bartlett, “Byzantine-robust distributed learning: Towards optimal statistical rates,” in Proceedings of the 35th International Conference on Machine Learning, ser. Proceedings of Machine Learning Research, vol. 80. PMLR, 2018, pp. 5650–5659. [9] X. Cao, M. Fang, J. Liu, and N. Z. Gong, “FLTrust: Byzantine-robust federated learning via trust bootstrapping,” in Network and Distributed System Security Symposium, 2021. [10] E. M. El Mhamdi, R. Guerraoui, and S. Rouault, “The hidden vulnerability of distributed learning in byzantium,” in Proceedings of the 35th International Conference on Machine Learning, ser. Proceedings of Machine Learning Research, vol. 80. PMLR, 2018, pp. 3521–3530. 18

A PREPRINT - AUGUST 13, 2026

[11] K. Pillutla, S. M. Kakade, and Z. Harchaoui, “Robust aggregation for federated learning,” IEEE Transactions on Signal Processing, vol. 70, pp. 1142–1154, 2022. [12] S. P. Karimireddy, L. He, and M. Jaggi, “Byzantine-robust learning on heterogeneous datasets via bucketing,” in International Conference on Learning Representations, 2022. [13] C. Guo, G. Pleiss, Y. Sun, and K. Q. Weinberger, “On calibration of modern neural networks,” in Proceedings of the 34th International Conference on Machine Learning, ser. Proceedings of Machine Learning Research, vol. 70. PMLR, 2017, pp. 1321–1330. [14] T. Li, M. Sanjabi, A. Beirami, and V. Smith, “Fair resource allocation in federated learning,” in International Conference on Learning Representations, 2020.

Author Biographies Soumya Mazumdar is a student researcher pursuing a B.S. in Data Science and Applications at the Indian Institute of Technology Madras and B.Tech. in Computer Science and Business Systems at West Bengal University of Technology (GMIT campus), India. His work focuses on temporal generative modeling, geometry-aware computer vision, and controllable video synthesis, with particular interest in diffusion-based methods for talking-head generation and temporal consistency. He has served as a Research Trainee at the Variable Energy Cyclotron Centre (VECC), where he worked on pose- and landmark-conditioned video generation, benchmarking, and efficient deployment pipelines. He has contributed to research publications in journals, conference proceedings, and edited volumes, and is also associated with an Indian patent in neural network-based real-time analysis. Vineet Kumar Rakesh is a Technical Officer (Scientific Category) at the Variable Energy Cyclotron Centre (VECC), Department of Atomic Energy, India, with over 23 years of experience in software engineering, database systems, and artificial intelligence. His research focuses on talking head generation, lip reading, and ultra-low-bitrate video compression for real-time teleconferencing. He is currently pursuing a Ph.D. at Homi Bhabha National Institute, Mumbai. Mr. Rakesh has contributed to office automation, OCR systems, and digital transformation projects at VECC. He is an Associate Member of the Institution of Engineers (India) and a recipient of the DAE Group Achievement Award. Dr. Tapas Samanta is a senior scientist and Head of the Computer and Informatics Group at the Variable Energy Cyclotron Centre (VECC), Department of Atomic Energy, India. With over two decades of experience, his work spans artificial intelligence, industrial automation, embedded systems, high-performance computing, and accelerator control systems. He also leads technology transfer initiatives and public scientific outreach at VECC.

19

A P REPRINT - AUGUST 12, 2026

A PREPRINT - AUGUST 13, 2026

Supplementary Information

Analysis of Federated Aggregation under Model Poisoning and Backdoor Attacks: A Reconstructed Cross-Dataset and Cross-Architecture Benchmark Soumya Mazumdar

Vineet Kumar Rakesh

Tapas Samanta

Correspondence: reachme@soumyamazumdar.com

Overview. This Supplementary Information provides the complete evidence-backed extension of the main manuscript: the full 500-cell canonical seed-1 accuracy matrix; extended accuracy, rank, calibration, and worst-client summaries; sensitivity analyses; BadNets TTLR results; additional-seed evidence; FedPARETO ablations and anchor-size diagnostics; execution provenance; software-environment details; and the mechanism-by-mechanism implementation audit. Cross-configuration variation is treated as benchmark heterogeneity rather than seed-level uncertainty, and source-code observations are kept separate from claims about the generating provenance of every numerical result. Supplementary scope. • Canonical completeness: all 500 seed-1 method–dataset–architecture–condition cells have final run-summary records; 490 additionally have located successful execution logs. • Threat-dependent ranking: clean performance favours Trimmed Mean/FedAvg, whereas Krum is the leading method under the evaluated sign-flip and Gaussian conditions. • Backdoor interpretation: the retained BadNets field is TTLR rather than conventional target-excluding ASR; ordinary accuracy and targeted trigger behaviour are therefore analysed separately. • Implementation boundary: the audited FedPARETO scaffold is a Pareto-inspired utility heuristic and can exhibit update–utility mismatch after post-training sign-flip/Gaussian corruption. FedPARETO-UC remains proposed rather than experimentally evaluated.

S1 Evidence scope, provenance, and supplementary objectives The purpose of this Supplementary Information is not merely to archive additional tables. It provides the evidence trail required to interpret the main manuscript at the level of individual benchmark cells, secondary outcomes, sensitivity analyses, and implementation details. The canonical design crosses five datasets, five architectures, five aggregation methods, and four experimental conditions, producing 500 seed-1 cells. Every cell has a run-summary record. Successful execution logs were located for 490 cells: 454 original successful runs and 36 successful repaired or rerun experiments. Ten clean SVHN cells—MobileNetV3-Small and ShuffleNetV2 across all five methods—retain summary records but no successful execution log was located in the supplied archives. Table S1 quantifies these provenance classes. The distinction matters because value completeness and execution-provenance completeness answer different questions. Numerical comparisons use the complete 500-cell matrix, but statements about exact run settings or generating software are restricted to cells for which the necessary provenance exists. Table S1: Canonical evidence coverage and provenance. Fractions are calculated over the 500 canonical seed-1 cells. Summary-only cells are retained rather than imputed or discarded.

Provenance class

Cells

Fraction

Original successful execution log + summary Successful repaired/rerun log + summary Summary only

454 36 10

90.8% 7.2% 2.0%

Total

500

100.0%

Figure S12 later visualizes the same provenance composition. The table is retained here because exact counts are more useful for reproducibility auditing, whereas the figure provides an immediate visual summary of evidence strength.

S2 Supplementary analytical framework and metric definitions For the supplementary analyses, let Ad,h,m,c denote final global test accuracy for dataset d, architecture h, aggregation method m, and condition c. The canonical matrix contains one identified seed for each such cell. The matched attack-minus-clean change for attack condition a is ∆acc (S1) d,h,m,a = 100 (Ad,h,m,a − Ad,h,m,clean ) , 20 1

A P REPRINT - AUGUST 12, 2026

A PREPRINT - AUGUST 13, 2026

measured in percentage points. Equation (S1) matches attacked and clean cells by dataset, architecture, and method. It is not described as a seed-paired treatment effect because independently matched repeated seeds are unavailable for the canonical matrix. Within each dataset–architecture configuration, the five methods are ranked by accuracy, with average ranks assigned to exact ties. If Rd,h,m,c denotes that within-task rank, the mean rank for method m in condition c is R̄m,c =

1 X Rd,h,m,c . 25

(S2)

d,h

Equation (S2) gives each dataset–architecture task equal weight and is used for the ranking and leave-one-group-out analyses. Lower values indicate better relative accuracy. For calibration, the retained summary metric is expected calibration error (ECE). If confidence is partitioned into B bins, a standard ECE form is B X |Ib | ECE = |acc(Ib ) − conf(Ib )| , (S3) n b=1

where Ib is the set of examples in bin b. Equation (S3) measures disagreement between empirical correctness and average confidence. ECE is reported descriptively because a numerically small value does not necessarily imply a useful classifier when accuracy has collapsed.

Worst-client accuracy is retained directly in the run summaries. Conceptually, if Ck is the evaluation accuracy of client k, the lower-tail diagnostic can be represented as W = min Ck . (S4) k

Equation (S4) explains why worst-client accuracy answers a different question from global accuracy: it records the lowest observed client-level performance rather than the population average. For BadNets, the audited code stamps the trigger on every test input and counts target-label predictions. The retained metric is therefore N 1 X I[f (T (xj )) = y ⋆ ] . (S5) TTLR = N j=1

Equation (S5) includes natural target-class examples and is not identical to conventional target-excluding ASR. The supplementary BadNets analysis therefore reports TTLR by name and does not infer an unavailable conventional ASR. These definitions establish the statistical boundary used throughout the supplement: means, medians, IQRs, cross-configuration SDs, ranks, matched differences, and sensitivity analyses are descriptive summaries of heterogeneous tasks. Inferential p-values, seed-level confidence intervals, or pseudo-replicated standard errors are not reported for the canonical matrix.

S3 Full canonical accuracy matrix Table S2 reports final global test accuracy for every canonical cell. Values are converted from proportions to percentages. Colour bands distinguish the four conditions: blue for clean, orange for sign flipping, green for Gaussian poisoning, and purple for BadNets. The purpose of the full matrix is to make aggregate conclusions auditable at the individual dataset–architecture level. For example, it shows directly that Krum remains high in many sign-flip/Gaussian cells where other methods fall to recurrent low values, while clean and BadNets ordinary-accuracy patterns are more favourable to FedAvg, Trimmed Mean, and FedPARETO. The machine-readable version of Table S2, including ECE, worst-client accuracy, TTLR where defined, provenance class, repair status, and run metadata, is supplied as source_data/canonical_results.csv. The table should therefore be read as a human-auditable view of the same canonical source data rather than as an independently edited result table. Table S2: Full canonical final-test-accuracy matrix (%). Each row corresponds to one dataset–architecture–condition combination. The five aggregation columns report final global test accuracy. Condition-specific row shading is used only as a visual guide and does not encode statistical significance. Dataset

Architecture

Condition

FedAvg

Trimmed Mean

Krum

FLTrust

FedPARETO

GTSRB GTSRB GTSRB

SimpleCNN SimpleCNN SimpleCNN

Clean Sign flipping Gaussian

56.34 0.48 5.63

55.51 38.93 52.92

33.22 34.26 36.83

7.89 7.13 7.58

52.17 42.98 38.34

21

2

Continued on next page

A P REPRINT - AUGUST 12, 2026

A PREPRINT - AUGUST 13, 2026 Table S2 – continued from previous page Dataset

Architecture

Condition

FedAvg

Trimmed Mean

Krum

FLTrust

FedPARETO

GTSRB SVHN SVHN SVHN SVHN MNIST MNIST MNIST MNIST CIFAR-10 CIFAR-10 CIFAR-10 CIFAR-10 CIFAR-100 CIFAR-100 CIFAR-100 CIFAR-100 GTSRB GTSRB GTSRB GTSRB SVHN SVHN SVHN SVHN MNIST MNIST MNIST MNIST CIFAR-10 CIFAR-10 CIFAR-10 CIFAR-10 CIFAR-100 CIFAR-100 CIFAR-100 CIFAR-100 GTSRB GTSRB GTSRB GTSRB SVHN SVHN SVHN SVHN MNIST MNIST MNIST MNIST CIFAR-10 CIFAR-10 CIFAR-10 CIFAR-10 CIFAR-100 CIFAR-100 CIFAR-100 CIFAR-100 GTSRB GTSRB GTSRB GTSRB SVHN SVHN SVHN SVHN MNIST MNIST MNIST MNIST CIFAR-10 CIFAR-10 CIFAR-10 CIFAR-10 CIFAR-100 CIFAR-100 CIFAR-100 CIFAR-100 GTSRB GTSRB GTSRB GTSRB

SimpleCNN SimpleCNN SimpleCNN SimpleCNN SimpleCNN SimpleCNN SimpleCNN SimpleCNN SimpleCNN SimpleCNN SimpleCNN SimpleCNN SimpleCNN SimpleCNN SimpleCNN SimpleCNN SimpleCNN ResNet-18 ResNet-18 ResNet-18 ResNet-18 ResNet-18 ResNet-18 ResNet-18 ResNet-18 ResNet-18 ResNet-18 ResNet-18 ResNet-18 ResNet-18 ResNet-18 ResNet-18 ResNet-18 ResNet-18 ResNet-18 ResNet-18 ResNet-18 MobileNetV3-Small MobileNetV3-Small MobileNetV3-Small MobileNetV3-Small MobileNetV3-Small MobileNetV3-Small MobileNetV3-Small MobileNetV3-Small MobileNetV3-Small MobileNetV3-Small MobileNetV3-Small MobileNetV3-Small MobileNetV3-Small MobileNetV3-Small MobileNetV3-Small MobileNetV3-Small MobileNetV3-Small MobileNetV3-Small MobileNetV3-Small MobileNetV3-Small EfficientNet-B0 EfficientNet-B0 EfficientNet-B0 EfficientNet-B0 EfficientNet-B0 EfficientNet-B0 EfficientNet-B0 EfficientNet-B0 EfficientNet-B0 EfficientNet-B0 EfficientNet-B0 EfficientNet-B0 EfficientNet-B0 EfficientNet-B0 EfficientNet-B0 EfficientNet-B0 EfficientNet-B0 EfficientNet-B0 EfficientNet-B0 EfficientNet-B0 ShuffleNetV2 ShuffleNetV2 ShuffleNetV2 ShuffleNetV2

BadNets Clean Sign flipping Gaussian BadNets Clean Sign flipping Gaussian BadNets Clean Sign flipping Gaussian BadNets Clean Sign flipping Gaussian BadNets Clean Sign flipping Gaussian BadNets Clean Sign flipping Gaussian BadNets Clean Sign flipping Gaussian BadNets Clean Sign flipping Gaussian BadNets Clean Sign flipping Gaussian BadNets Clean Sign flipping Gaussian BadNets Clean Sign flipping Gaussian BadNets Clean Sign flipping Gaussian BadNets Clean Sign flipping Gaussian BadNets Clean Sign flipping Gaussian BadNets Clean Sign flipping Gaussian BadNets Clean Sign flipping Gaussian BadNets Clean Sign flipping Gaussian BadNets Clean Sign flipping Gaussian BadNets Clean Sign flipping Gaussian BadNets Clean Sign flipping Gaussian BadNets

54.81 90.05 6.70 19.10 89.49 99.08 9.80 87.11 99.04 78.05 10.00 10.00 77.95 47.52 1.00 1.00 46.50 85.40 0.48 6.18 85.30 94.21 6.70 15.94 94.27 99.17 9.80 52.96 99.10 86.72 10.00 14.16 86.53 60.15 1.00 1.04 59.08 74.03 0.48 0.48 73.35 87.11 6.70 6.70 86.68 98.51 9.80 9.80 98.47 64.62 10.00 10.00 63.44 26.17 1.00 1.00 25.77 89.28 0.48 0.48 89.15 88.94 6.70 6.70 90.32 34.29 9.80 9.80 30.15 75.39 10.00 10.00 76.64 44.44 1.00 1.00 42.48 70.42 0.48 0.48 67.69

53.39 89.84 63.56 72.05 89.18 99.05 95.73 97.74 98.99 77.89 65.84 54.86 76.67 46.84 1.00 14.87 45.79 86.35 52.83 17.85 85.29 93.83 84.37 52.22 94.30 99.12 9.80 93.77 99.17 85.95 63.66 31.28 85.86 60.21 1.00 7.13 58.81 74.98 41.74 0.48 72.33 87.96 76.82 6.70 86.07 98.40 65.44 9.80 98.56 62.90 44.88 10.00 61.22 31.01 6.19 1.00 28.45 88.16 80.04 0.48 89.75 87.73 6.70 6.70 87.56 99.00 9.80 9.80 98.67 75.44 48.47 10.00 73.73 41.24 1.00 1.00 41.37 69.56 49.11 0.48 67.09

31.23 74.09 80.16 72.70 75.03 97.87 98.01 98.32 98.10 60.79 61.57 61.88 58.93 27.00 24.66 26.93 25.55 76.89 79.07 73.98 68.56 89.25 89.34 90.23 90.56 98.22 98.64 98.75 98.54 72.17 72.37 75.48 75.55 23.23 25.09 28.62 24.61 46.20 51.65 54.66 55.08 78.26 81.68 80.35 76.98 97.89 97.40 97.68 97.63 47.81 47.29 49.24 45.62 16.09 15.84 16.29 16.94 80.56 79.14 82.16 82.17 79.95 81.36 83.06 79.03 97.46 98.97 98.42 98.61 53.71 57.70 53.65 54.01 27.51 26.55 26.85 24.22 53.67 51.00 58.14 52.14

7.25 18.22 17.93 18.14 18.21 91.74 91.25 91.27 90.19 27.66 29.44 29.47 28.60 3.87 3.08 3.69 1.80 24.15 12.26 23.66 21.99 71.47 56.18 72.81 68.45 97.82 94.30 97.83 97.86 50.15 24.22 46.54 47.24 15.75 11.06 14.88 15.33 5.23 5.70 5.70 0.48 30.59 15.95 15.94 30.59 9.74 9.74 9.74 9.74 10.00 10.00 11.44 10.00 1.09 1.13 1.63 1.00 72.08 34.11 0.48 65.63 56.25 6.70 6.70 59.22 97.70 9.80 9.80 97.65 45.89 10.00 10.00 47.16 15.79 1.00 1.00 14.00 16.09 13.49 14.66 14.86

51.12 88.10 83.85 19.59 88.33 98.90 96.93 95.09 99.11 74.04 67.28 23.32 76.26 42.65 33.04 1.00 42.59 85.63 54.84 6.02 85.48 93.12 81.86 44.30 93.44 99.12 9.80 80.95 99.11 84.46 44.75 14.01 84.46 52.65 1.00 1.13 47.46 64.17 11.87 0.48 67.53 85.14 6.70 6.70 85.49 98.51 88.86 9.80 98.61 57.68 10.00 10.00 54.81 25.37 10.54 1.00 25.06 88.65 0.48 0.48 88.59 87.11 6.70 6.70 88.13 44.22 9.80 9.80 50.01 72.31 10.00 10.00 72.68 33.15 1.00 1.00 36.05 67.05 43.39 0.48 64.99

22

3

Continued on next page

A P REPRINT - AUGUST 12, 2026

A PREPRINT - AUGUST 13, 2026 Table S2 – continued from previous page Dataset

Architecture

Condition

FedAvg

Trimmed Mean

Krum

FLTrust

FedPARETO

SVHN SVHN SVHN SVHN MNIST MNIST MNIST MNIST CIFAR-10 CIFAR-10 CIFAR-10 CIFAR-10 CIFAR-100 CIFAR-100 CIFAR-100 CIFAR-100

ShuffleNetV2 ShuffleNetV2 ShuffleNetV2 ShuffleNetV2 ShuffleNetV2 ShuffleNetV2 ShuffleNetV2 ShuffleNetV2 ShuffleNetV2 ShuffleNetV2 ShuffleNetV2 ShuffleNetV2 ShuffleNetV2 ShuffleNetV2 ShuffleNetV2 ShuffleNetV2

Clean Sign flipping Gaussian BadNets Clean Sign flipping Gaussian BadNets Clean Sign flipping Gaussian BadNets Clean Sign flipping Gaussian BadNets

88.37 6.70 6.70 87.34 61.30 9.80 9.80 63.23 70.70 10.00 10.00 69.23 2.72 1.00 1.00 6.77

88.76 74.18 6.70 87.59 98.42 9.80 9.80 98.25 66.81 45.11 10.00 65.86 35.58 1.00 1.00 35.21

74.72 78.53 76.39 76.74 96.66 97.95 97.92 96.22 51.46 53.08 54.77 49.03 16.61 16.55 18.02 17.61

15.66 15.89 6.70 15.53 96.23 9.80 9.80 96.23 30.56 19.24 10.00 29.98 10.46 2.42 1.00 10.83

85.42 79.29 6.70 85.88 72.66 9.80 9.80 51.51 64.31 10.00 10.00 65.83 6.69 1.00 1.00 4.67

S4 Extended condition-level descriptive statistics Table S3 extends the main-paper condition summary by reporting mean, median, cross-configuration SD, IQR, minimum, maximum, mean rank, and fractional wins for every method and condition. These statistics serve different purposes. Mean and median summarize typical performance; SD and IQR show how strongly performance varies across tasks; range identifies extreme configurations; and rank/win counts describe relative ordering without assuming that raw accuracy scales are directly comparable across datasets. The table reinforces three patterns. First, Trimmed Mean and FedAvg occupy the leading clean positions. Second, Krum becomes the dominant sign-flip and Gaussian method by mean rank and win count. Third, BadNets ordinary accuracy resembles clean training more closely than the model-poisoning conditions, which is why the trigger-specific analysis in Section S6 is required. Table S3 extends the condition-level comparison beyond mean accuracy by reporting the median, cross-configuration dispersion, range, within-task rank, and configuration-win count for every aggregation method. These statistics are calculated across the 25 dataset–architecture configurations within each experimental condition. Consequently, the reported SD and IQR quantify heterogeneity across benchmark tasks rather than run-to-run or seed-level uncertainty. Table S3: Accuracy distribution and rank summaries by method and condition. Mean, median, minimum, and maximum values are final global test accuracies. SD and IQR characterize dispersion across the 25 heterogeneous dataset–architecture configurations and are not estimates of seed-level experimental uncertainty. Mean rank is calculated within each task, with rank 1 indicating the highest accuracy. Wins count task-level first-place finishes, with fractional credit assigned where applicable. Condition

Method

Mean (%)

Median (%)

SD (pp)

IQR (pp)

Min (%)

Max (%)

Mean rank

Wins

Clean Clean Clean Clean Clean Sign flipping Sign flipping Sign flipping Sign flipping Sign flipping Gaussian Gaussian Gaussian Gaussian Gaussian BadNets BadNets BadNets BadNets BadNets

FedAvg Trimmed Mean Krum FLTrust FedPARETO FedAvg Trimmed Mean Krum FLTrust FedPARETO FedAvg Trimmed Mean Krum FLTrust FedPARETO FedAvg Trimmed Mean Krum FLTrust FedPARETO

70.92 76.02 62.85 36.88 68.93 5.59 41.48 63.91 20.47 32.63 11.88 23.14 64.45 20.82 16.31 70.51 75.17 62.75 35.99 68.29

75.39 85.95 72.17 24.15 72.66 6.70 45.11 72.37 11.06 10.54 6.70 9.80 72.70 10.00 9.80 76.64 85.29 68.56 21.99 72.68

24.78 21.01 27.58 32.81 24.61 4.22 30.97 27.98 24.83 32.90 18.91 29.56 27.10 27.23 24.38 24.79 21.49 27.77 32.79 25.05

28.79 26.94 34.36 45.79 34.46 8.80 55.64 34.39 12.11 45.04 9.00 24.58 33.82 11.44 13.01 30.07 28.53 36.55 48.39 37.01

2.72 31.01 16.09 1.09 6.69 0.48 1.00 15.84 1.00 0.48 0.48 0.48 16.29 0.48 0.48 6.77 28.45 16.94 0.48 4.67

99.17 99.12 98.22 97.82 99.12 10.00 95.73 98.97 94.30 96.93 87.11 97.74 98.75 97.83 95.09 99.10 99.17 98.61 97.86 99.11

1.82 1.70 3.80 4.72 2.96 4.44 2.78 1.32 3.56 2.90 4.04 3.14 1.08 3.02 3.72 1.80 1.80 3.80 4.72 2.88

14.5 10.0 0.0 0.0 0.5 0.0 1.0 19.0 0.0 5.0 0.0 1.0 24.0 0.0 0.0 14.0 8.0 0.0 0.0 3.0

S5 Matched comparisons and recurrent low-accuracy outcomes A direct FedPARETO–Krum comparison is useful because these methods embody different aggregation principles: FedPARETO uses utility and reliability signals, whereas Krum primarily uses inter-update geometry. Table S4 reports matched 23 4

A P REPRINT - AUGUST 12, 2026

A PREPRINT - AUGUST 13, 2026

win/tie/loss counts and both mean and median FedPARETO-minus-Krum accuracy differences over the same 25 dataset– architecture labels. The sign of the matched difference changes sharply with condition. FedPARETO exceeds Krum in 22/25 clean tasks and 22/25 BadNets ordinary-accuracy tasks, but loses in 20/25 sign-flip tasks and 24/25 Gaussian tasks. Table S4 therefore supports a threat-dependent interpretation rather than a globally ordered comparison. Table S4: FedPARETO versus Krum matched comparisons. Positive mean/median differences favour FedPARETO; negative differences favour Krum.

Condition

Wins

Ties

Losses

Mean diff. (pp)

Median diff. (pp)

Clean Sign flipping Gaussian BadNets

22 5 1 22

0 0 0 0

3 20 24 3

6.08 -31.28 -48.15 5.54

9.28 -24.24 -45.93 9.13

A second diagnostic counts exact matches to recurrent dataset-specific low-accuracy values. Table S5 shows that FedAvg reaches the corresponding recurrent value in all 25 sign-flip configurations and 17 Gaussian configurations, whereas Krum reaches it in none. FedPARETO, Trimmed Mean, and FLTrust occupy intermediate positions. These counts describe repeated severe low-accuracy outcomes; they do not establish theoretical chance accuracy or a unique collapse mechanism. Table S5: Exact matches to recurrent dataset-specific low-accuracy values under model poisoning. Counts are descriptive diagnostics over 25 configurations per method and condition.

Method

Sign flipping

Gaussian

25 8 0 6 12

17 15 0 9 16

FedAvg Trimmed Mean Krum FLTrust FedPARETO

S6 BadNets ordinary accuracy and triggered target-label behaviour The BadNets analysis separates ordinary predictive performance from triggered target-label behaviour. Table S6 reports method-level means for global accuracy, TTLR, ECE, and worst-client accuracy. FedAvg and Trimmed Mean retain high ordinary accuracy while their mean TTLR remains close to 70%, demonstrating why ordinary test accuracy cannot be used as a substitute for targeted backdoor evaluation. Table S6: BadNets ordinary accuracy, TTLR, ECE, and worst-client accuracy across 25 tasks. TTLR follows Eq. (S5) and should not be interpreted as conventional target-excluding ASR.

Method FedAvg Trimmed Mean Krum FLTrust FedPARETO

Global accuracy (%)

Mean TTLR (%)

Mean ECE (%)

Mean worst-client accuracy (%)

70.51 75.17 62.75 35.99 68.29

72.68 69.70 30.61 24.41 60.54

5.79 4.76 10.78 5.26 5.97

68.57 73.60 57.90 27.38 65.79

Figure S14 gives the full 25-task TTLR distributions. The broad distributions show that the method-level means in Table S6 are not produced by one uniform backdoor response across all tasks. Krum and FLTrust have lower mean TTLR than FedAvg, Trimmed Mean, and FedPARETO, but the available evidence still does not permit conversion to conventional target-excluding ASR.

S7 Dataset-level accuracy, worst-client performance, and calibration Figures S1–S4 decompose global accuracy by dataset and aggregation method after averaging over the five architectures. These heatmaps make visible which datasets contribute most strongly to the pooled condition-level means. The clean panel (Fig. S1) shows high MNIST and SVHN performance for several methods, whereas the sign-flip and Gaussian panels (Figs. S2 and S3) reveal the repeated advantage of Krum across multiple datasets. The BadNets ordinary-accuracy panel (Fig. S4) returns to a pattern much closer to clean training. 24 5

A P REPRINT - AUGUST 12, 2026

A PREPRINT - AUGUST 13, 2026 BadNets triggered target-label behavior across 25 configurations

Triggered Target-Label Rate (TTLR, %)

100

80

60

40

20

0

ean

Avg Fed

Kru

dM me

ust

m

FLTr

Trim

PA Fed

O RET

Figure S14: Distribution of BadNets Triggered Target-Label Rate (TTLR) across 25 dataset–architecture tasks for each method. Boxes summarize the task-level TTLR values retained by the source-code-audited metric. TTLR applies the trigger to all test inputs and is not conventional target-excluding ASR.

74.9

58.1

25.1

71.5

SVHN

89.7

89.6

79.3

38.4

87.8

MNIST

78.5

98.8

97.6

78.6

82.7

CIFAR-10

75.1

73.8

57.2

32.9

70.6

CIFAR-100

36.2

43.0

22.1

9.4

32.1

60

40

20

100

GTSRB

0.5

52.5

59.0

14.5

30.7

SVHN

6.7

61.1

82.2

22.5

51.7

MNIST

9.8

38.1

98.2

43.0

43.0

CIFAR-10

10.0

53.6

58.4

18.6

28.4

CIFAR-100

1.0

2.0

21.7

3.7

9.3

80

60

Dataset

75.1

Mean accuracy across five architectures (%)

GTSRB

80

Dataset

Sign flipping: dataset-level mean final accuracy

100

40

20

0 g Av Fed

n ea

dM

me

m Kru

t

rus FLT

Fed

Trim

0 n ea dM

g Av

O

ET

R PA

Mean accuracy across five architectures (%)

Clean: dataset-level mean final accuracy

Fed

me

Kru

m

t

rus FLT

O ET

R PA

Fed

Trim

Aggregation method

Aggregation method

Figure S1: Dataset-by-method mean accuracy under clean training. Values are averaged over the five architectures; the heatmap is descriptive across tasks.

Figure S2: Dataset-by-method mean accuracy under sign-flipping poisoning. Krum remains high across several datasets while multiple alternatives decline.

Gaussian: dataset-level mean final accuracy

BadNets: dataset-level mean final accuracy

14.4

61.2

10.4

9.2

SVHN

11.0

28.9

80.5

24.1

16.8

MNIST

33.9

44.2

98.2

43.7

41.1

CIFAR-10

10.8

23.2

59.0

21.5

13.5

CIFAR-100

1.0

5.0

23.3

4.4

1.0

80

Dataset

60

40

20

100

GTSRB

74.1

73.6

57.8

22.0

71.5

SVHN

89.6

88.9

79.7

38.4

88.3

MNIST

78.0

98.7

97.8

78.3

79.7

CIFAR-10

74.8

72.7

56.6

32.6

70.8

CIFAR-100

36.1

41.9

21.8

8.6

31.2

80

60

40

20

0 g Av Fed

d me

an

Me

m Kru

Trim

t

rus FLT

PA Fed

Mean accuracy across five architectures (%)

2.6

Dataset

GTSRB

Mean accuracy across five architectures (%)

100

0 g Av

TO

RE

Fed

d me

an Me

Kru

m

Trim

t

rus FLT

TO RE

PA Fed

Aggregation method

Aggregation method

Figure S3: Dataset-by-method mean accuracy under Gaussian poisoning. The Krum-first pattern is visible across multiple datasets.

Figure S4: Dataset-by-method mean ordinary accuracy under BadNets. Ordinary accuracy is clean-like; TTLR is analysed separately.

25

6

A P REPRINT - AUGUST 12, 2026

A PREPRINT - AUGUST 13, 2026

Figures S5 and S6 extend the analysis beyond global accuracy. Figure S5 shows mean worst-client accuracy by method and condition. Krum’s sign-flip/Gaussian stability is visible in this lower-tail outcome as well as in global accuracy. Figure S6 summarizes ECE. The ECE heatmap is intentionally not converted into a “lower is always better” robustness ranking because calibration error can be difficult to interpret after severe accuracy collapse. Worst-client accuracy across conditions

Expected calibration error across conditions 14 70

74.7

57.8

28.9

66.4

0.2

Sign flipping

34.7

59.4

11.9

27.3

50

Mean worst-client accuracy (%)

60

40

4.9

Gaussian

16.5

60.8

13.7

9.5

30

20

68.6

BadNets

73.6

57.9

27.4

65.8

Clean

4.9

4.4

11.5

4.8

6.1

Sign flipping

0.0

5.3

11.2

6.0

7.0

12

10

8

6 14.1

Gaussian

3.3

10.7

1.9

10.6

Mean ECE (%)

68.9

Clean

4

10

5.8

BadNets

4.8

10.8

5.3

2

6.0

0 g Av

Fed

n

t

Kru

g Av

TO

rus FLT

m

ea

dM me Trim

RE PA Fed

Fed

n

t

rus FLT

m

ea

dM

me

Kru

Trim

O

ET

R PA

Fed

Aggregation method

Aggregation method

Figure S5: Mean final worst-client accuracy by method and condition. This lower-tail outcome complements global accuracy and is not a fairness guarantee.

Figure S6: Mean final expected calibration error (ECE) by method and condition. ECE is descriptive and is not a robustness ranking.

S8 Leave-one-dataset-out and leave-one-architecture-out sensitivity The pooled benchmark contains 25 heterogeneous tasks. To test whether the principal poisoning ranking is driven by a single dataset or architecture, the mean ranks were recomputed after excluding one group at a time. Figures S7 and S8 summarize the average rank across sign-flipping and Gaussian conditions after each exclusion.

Leave-one-dataset-out poisoning-rank stability

Mean rank across sign flipping and Gaussian (1 = best)

Mean rank across sign flipping and Gaussian (1 = best)

Figure S7 shows that removing any one dataset leaves Krum at or near the best average poisoning rank. Figure S8 gives the analogous architecture exclusion. The stability of the Krum-first ordering across these exclusions supports the conclusion that the headline model-poisoning result is not attributable to one dataset or one neural architecture alone. These analyses are sensitivity checks, not additional stochastic replication. 1.0 1.5 2.0 2.5 3.0 3.5 4.0 4.5 5.0

B

R GTS

IST MN

N

SVH

0

AR-1 CIF

00

AR-1 CIF

Leave-one-architecture-out poisoning-rank stability 1.0 1.5 2.0 2.5 3.0 3.5 4.0 4.5 5.0

CNN

ple

Sim

8

1 NetRes

FedAvg

Krum

Trimmed Mean

FLTrust

FedAvg

FedPARETO

Excluded architecture Krum

Trimmed Mean

Figure S7: Leave-one-dataset-out poisoning-rank stability. Lower rank is better; this tests benchmark-composition sensitivity.

ll

ma

3-S

NetV

bile

Mo

Excluded dataset

t-B tNe ien

Effic

0 Shu

2

NetV

ffle

FedPARETO

FLTrust

Figure S8: Leave-one-architecture-out poisoning-rank stability. The Krum-first ordering remains visible across exclusions.

S9 Additional-seed evidence The supplied archives contain a small set of genuine multi-seed experiments outside the balanced 500-cell canonical matrix. Seven legacy/scaffold MNIST families can be formed with seeds 1–3. Table S7 reports their mean, sample SD, minimum, and maximum accuracy. These values provide direct evidence that run-to-run variation can range from very small to several percentage points depending on the method and condition. The crucial limitation is coverage: these families are sparse, MNIST-specific, and not uniformly aligned with the canonical benchmark. They are therefore not merged into the canonical SD or used to justify benchmark-wide confidence intervals. Figure S9 visualizes only these genuine three-seed families, with error bars representing seed-level SD within each family.

S10 FedPARETO ablation and anchor-size diagnostics The FedPARETO ablation experiments are single-seed legacy/scaffold MNIST runs. Table S8 reports final accuracy, change from the 95.36% baseline, ECE, and worst-client accuracy. Removing calibration or the low-local-accuracy priority reduces 26 7

A P REPRINT - AUGUST 12, 2026

A PREPRINT - AUGUST 13, 2026 Table S7: Additional three-seed legacy/scaffold MNIST experiment families. SD is seed-level sample SD within the listed family only. Family

Method

Condition

fedavg fedpareto badnets fedpareto fedpareto signflip fltrust krum trimmed mean

FedAvg FedPARETO FedPARETO FedPARETO FLTrust Krum Trimmed Mean

Clean BadNets Clean Sign flipping Sign flipping Sign flipping Gaussian

n seeds

Mean acc. (%)

SD (pp)

Min (%)

Max (%)

3 3 3 3 3 3 3

98.42 96.49 96.08 95.22 68.14 92.72 94.95

0.08 0.94 0.84 0.39 7.14 1.36 0.96

98.36 95.62 95.36 94.90 61.30 91.18 94.13

98.51 97.48 97.01 95.66 75.55 93.75 96.00

Additional three-seed MNIST scaffold families 100

95

Final accuracy (%)

90

85

80

75

70

65

60

Error bars: seed-level sample SD within each three-seed family only.

s et

vg

da fe

o

et ar

dn ba

o

et ar

dp fe

lip

nf

dp fe

o

et ar dp

sig

st

um

ru

flt

kr

ed m

n ea

m

m

tri

fe

Figure S9: Additional-seed accuracy for the available legacy/scaffold MNIST families. Points show three-seed means and error bars show seed-level sample SD. These experiments are intentionally separated from the canonical matrix because replication is sparse and unbalanced.

accuracy modestly, removing the Pareto bonus changes little, and removing the robustness component increases final accuracy by 1.61 percentage points in this one run. The correct interpretation is therefore not that every component is beneficial, but that component effects remain uncertain under single-seed evidence. Table S8: Single-seed FedPARETO ablations relative to the 95.36% legacy/scaffold baseline. Positive differences indicate higher final accuracy than the baseline in that one run.

Variant no_calibration no_fairness no_robustness no_pareto_bonus

Final acc. (%)

Difference (pp)

ECE (%)

Worst-client acc. (%)

94.28 94.64 96.97 95.27

-1.08 -0.72 +1.61 -0.09

1.74 1.06 1.15 0.73

84.25 89.95 93.18 92.06

Figure S10 visualizes the same single-seed ablation results with colours indicating whether the observed change is positive, moderately negative, or strongly negative relative to the baseline. The visualization is diagnostic only; it is not an estimate of causal component importance.

S11 Provenance composition and cross-condition rank similarity Figure S12 complements Table S1 by showing the numerical dominance of original successful logs within the canonical evidence base. The repaired/rerun subset is small but non-negligible, and the summary-only subset contains 10 cells. The figure is included because provenance strength is a property of the evidence, not an outcome metric, and should remain visible when interpreting reproducibility.

S12 Verified configuration scope and software environment The repaired 36-run subset contains explicit configuration files and therefore provides the strongest evidence for detailed hyperparameters. Table S9 summarizes settings that are consistent across that subset. These values are not automatically generalized to the remaining canonical cells because complete configuration snapshots are not available for every historical run. 27 8

A P REPRINT - AUGUST 12, 2026

A PREPRINT - AUGUST 13, 2026 Single-seed anchor-size sensitivity 99

Single-seed FedPARETO component ablations

96

96.97% (+1.61 pp)

95

98

95.49% (+0.13 pp)

95.36% (+0.00 pp)

96

95.27% (-0.09 pp)

95.36% 94.64% (-0.72 pp)

94.28% (-1.08 pp)

95

Final accuracy (%)

Final accuracy (%)

97

94

94 92.98% (-2.38 pp)

93 92.19% (-3.17 pp)

93

92

92 91

91 90 e

ess irn

n

n seli Ba

io rat

no

b cali

no

fa

no

ss tne

us

rob

no

o ret

us on

b

16

pa

64

128

512

Anchor size

Figure S10: Single-seed FedPARETO component ablation. Labels show final accuracy and the difference from the corresponding baseline.

Figure S11: Single-seed anchor-size sensitivity. The observed relationship is non-monotonic and is not a fitted scaling law.

Cross-condition similarity of five-method rank ordering

Clean

1.00

0.00

-0.60

0.97

1.00

0.75

500

Sign flipping

454 (90.8%)

0.00

1.00

0.70

-0.15

Canonical cells

400

0.25

0.00

Gaussian

300

-0.60

0.70

1.00

-0.72

−0.25

Spearman rank correlation

0.50

Execution provenance of the 500 canonical cells

−0.50 200

BadNets

0.97

-0.15

-0.72

1.00

−0.75

100 36 (7.2%) 0

Original successful log + summary

−1.00

10 (2.0%)

Repaired/rerun successful log + summary

an

Cle

Summary only

Figure S12: Execution provenance of the 500 canonical cells. Categories distinguish original logs, repaired/rerun logs, and summary-only evidence.

g pin

lip nf

Sig

an ssi

u Ga

ts

e dN Ba

Figure S13: Cross-condition similarity of the five-method rank ordering. Spearman correlations are descriptive because only five methods contribute.

Table S9: Configuration parameters verified for the repaired 36-run subset. “Subset-verified” means directly supported for those repaired runs but not assumed benchmark-wide.

Parameter

Verified value

Scope

Number of clients Clients sampled per round Communication rounds Local epochs Batch size Optimizer settings Dirichlet α Malicious-client fraction Gaussian standard deviation BadNets poison fraction BadNets target label BadNets trigger size Anchor size ECE bins

20 10 500 1 64 SGD; lr 0.003; momentum 0.9; weight decay 5 × 10−4 1.0 0.25 0.5 0.3 0 4×4 4096 15

Repaired 36-run subset Repaired 36-run subset Repaired 36-run subset Repaired 36-run subset Repaired 36-run subset Repaired 36-run subset Repaired 36-run subset Attacked repaired runs Gaussian repaired runs BadNets repaired runs BadNets repaired runs BadNets repaired runs Repaired 36-run subset Repaired 36-run subset

28

9

A P REPRINT - AUGUST 12, 2026

A PREPRINT - AUGUST 13, 2026

The software evidence also differs across repair attempts. The final repair bundle dated 22 July 2026 records Python 3.10.13, PyTorch 2.5.1, CUDA availability, and NVIDIA L40S hardware. An earlier repair attempt dated 21 July 2026 records Python 3.13.5 and PyTorch 2.8.0+cu128 on NVIDIA L40S. These differences do not invalidate the retained final accuracy records, but they make direct runtime comparisons across repair environments uncontrolled. The supplementary analysis therefore does not treat heterogeneous runtime values as evidence of method-level latency superiority.

S13 FedPARETO implementation audit Table S10 distinguishes mechanisms present in the executable FedPARETO scaffold from mechanisms appearing only in the broader conceptual draft. This distinction is central to the paper’s evidence discipline: empirical benchmark results can only be attributed to mechanisms that were actually implemented in the supplied executable path. Table S10: Implemented-versus-conceptual FedPARETO mechanism audit. Green rows denote implemented mechanisms; red rows denote mechanisms not found in the supplied executable scaffold. Mechanism

Status

Evidence-bounded interpretation

Anchor accuracy Negative expected calibration error Low-local-accuracy priority Root-direction similarity Temporal reliability Per-round min-max normalization Dominance-count ranking Weighted scalar utility Exponential transformation Simplex projection Uniform mixing Weighted Tchebycheff optimization Explicit L1 trust region around sample-size weights Reliability-dependent weight caps Benign-subspace SVD Formal Pareto constrained optimization

Implemented Implemented Implemented Implemented Implemented Implemented Implemented Implemented Implemented Implemented Implemented Not implemented Not implemented Not implemented Not implemented Not implemented

Absolute anchor accuracy of local model ECE of anchor predictions 1 - submitting client local accuracy; not a measured fairness improvement Non-negative cosine to server root update Momentum state updated from weights and robustness score Each objective normalized among participating clients 1 + number of clients that dominate candidate; not iterative Pareto fronts Configured objective weights plus rank bonus and trust penalty exp(temperature * scalar) Euclidean projection utility entropy_reg mixes projected weights with uniform weights Appears in conceptual draft only Conceptual draft only Conceptual draft only Conceptual draft only Executable method is Pareto-inspired heuristic

The audit shows that the executable method contains anchor accuracy, negative ECE, a low-local-accuracy priority proxy, root-direction similarity, temporal reliability, per-round min–max normalization, dominance-count ranking, scalar utility, exponential transformation, simplex projection, and uniform mixing. It does not implement the conceptual draft’s weightedTchebycheff solver, explicit ℓ1 trust region, reliability-dependent upper weight caps, benign-subspace SVD, or a formal constrained Pareto optimization problem. A separate implementation observation concerns update–utility correspondence. In the audited sign-flip/Gaussian client path, the local model and clean delta are formed, the submitted delta can then be corrupted, and predictive summaries are still computed from the uncorrupted locally trained model. The server can therefore score predictive evidence corresponding to one model object while assigning influence to a different submitted update. This is a verified source-code observation for the supplied scaffold. It is not treated as causal proof for every canonical numerical cell because exact immutable code-to-result provenance is incomplete.

S14 Claim-to-evidence audit and reproducibility resources The claim-to-evidence ledger provides a final guard against overstatement. Table S11 reproduces the major audit decisions in compact form. Claims supported directly by empirical records or source-code inspection are retained with restricted wording; unsupported generalizations—including universal Krum robustness, uniform multi-seed replication, guaranteed benefit from every FedPARETO component, and experimentally validated FedPARETO-UC improvement—are not made. The complete machine-readable ledger is supplied as audit/claim_evidence_matrix.csv; the implementation audit is supplied as audit/code_audit.md; and unresolved provenance questions are retained in audit/unresolved_ questions.md. The source-data directory contains the canonical results, condition summaries, pairwise comparisons, floor counts, BadNets metrics, leave-one-group-out tables, additional seeds, ablations, anchor-size results, condition-rank correlations, and provenance labels. Together, these resources make the supplementary analysis reproducible from the packaged evidence without requiring the reader to infer missing run settings from source-code defaults. The principal unresolved limitations remain balanced multi-seed replication of the canonical matrix, complete immutable code/configuration provenance for every cell, and conventional target-excluding ASR for the retained BadNets runs.

29

10

A P REPRINT - AUGUST 12, 2026

A PREPRINT - AUGUST 13, 2026

Table S11: Claim-to-evidence audit. Classification A denotes direct empirical observation, B a derived descriptive statistic, C a verified source-code observation, and G an unsupported claim removed or corrected. Class

Claim

Evidence-bounded verdict/correction

A

500/500 canonical final-accuracy records are present

A

490 canonical cells have a successful execution log

B

Krum is strongest by accuracy under evaluated sign-flip and Gaussian conditions BadNets ordinary accuracy remains close to clean values The recorded attack_success_rate is TTLR rather than conventional target-excluding ASR FedPARETO implementation uses anchor accuracy, negative ECE, lowlocal-accuracy priority, root-direction/temporal reliability, min-max normalization, dominance count, scalar score, exponential transform, simplex projection, uniform mixing FedPARETO scaffold has update-utility mismatch for post-training signflip/Gaussian corruption FedPARETO-UC improves robustness Cross-task SD is seed uncertainty Additional seeds establish uniform replication of canonical benchmark Removing every FedPARETO component degrades accuracy

Use as full benchmark matrix; distinguish 490 successful-log cells from 10 summary-only cells 10 clean SVHN MobileNetV3-Small/ShuffleNetV2 method cells remain summary-only Restrict claim to evaluated conditions; no universal robustness claim

B C C

C G G G G

30

11

Does not imply backdoor robustness Report as TTLR; conventional ASR not estimable Describe executable mechanism only

Implementation observation; not causal proof for every workbook cell Remove performance claim; describe only as proposed future method Call it cross-configuration dispersion only Analyze separately, do not merge Replace with descriptive ablation values; no general causal conclusion

Related documents

• A Resilient Genetic-centric Aggregation for Hierarchical Federated Learning against Scaling Attacks#280393
• FedNIA: Noise-Induced Activation Analysis for Mitigating Data Poisoning in Federated Learning#1061591
• EnCAgg: Enhanced Clustering Aggregation for Robust Federated Learning against Dynamic Model Poisoning#216709
• Model Poisoning Against Federated Model Adaptation with Chain of Bit-Flips#267556
• Unveiling Hidden Threats: Using Fractal Triggers to Boost Stealthiness of Distributed Backdoor Attacks in Federated Learning#974259