Optimizing Byzantine Node Placement in Decentralized Federated Learning

arXiv:2609.01495v1 [cs.LG] 1 Sep 2026

Optimizing Byzantine Node Placement in Decentralized Federated Learning Edoardo Gabrielli

Gabriele Tolomei

Dipartimento di Ingegneria Informatica, Automatica e Gestionale Sapienza University of Rome Rome, Italy

Dipartimento di Informatica Sapienza University of Rome Rome, Italy

Abstract—Security evaluations of decentralized federated learning (DFL) typically focus on how Byzantine participants behave, while largely overlooking which participants are compromised. Yet, because aggregation is distributed over a communication graph, the placement of Byzantine nodes determines how malicious influence propagates through the network. We therefore treat Byzantine placement as an explicit adversarial decision and formulate the attacker’s objective as selecting, under a fixed compromise budget, the set of participants that maximizes its finite-time impact on honest nodes. To approximate this objective without executing the learning process for every candidate placement, we introduce Byzantine Placement Influence (BPI), a set-level measure derived from the actual gossip dynamics that quantifies the cumulative exposure of honest nodes to Byzantine sources over the training horizon. Unlike placement criteria based on node centrality heuristics, BPI directly accounts for weighted multi-hop propagation and interactions among compromised nodes. We develop efficient algorithms for optimizing BPI and evaluate them across six heterogeneous graph families, untargeted model poisoning, and backdoor attacks. BPI-guided placements consistently identify highly damaging configurations across different network structures and remain effective when the linear gossip assumption is relaxed through Byzantine-robust aggregation. Our results show that Byzantine placement is a critical but under-modeled dimension of DFL threat models and robustness evaluations.

I. I NTRODUCTION Federated learning (FL) enables multiple participants to collaboratively train a machine learning model while keeping their training data local [1]. The participants repeatedly train on their local data and exchange model information according to a communication protocol. In conventional centralized federated learning (CFL), this communication structure can be represented as a star graph and clients communicate with a central server, which is the only node performing aggregation. Decentralized federated learning (DFL) generalizes this setting by distributing aggregation across participants, which exchange and combine models according to a general communication topology [2]. This generalization introduces an additional adversarial dimension because, while in CFL every client reaches all the others in one aggregation step, in the general DFL topology different participants occupy different positions in the communication graph, and malicious information propagates through successive aggregations before reaching distant nodes.

Arbitrary Byzantine placement

Strategic Byzantine placement

Fig. 1: Byzantine placement as an adversarial dimension in decentralized federated learning. The two executions use the same communication topology, attack, and number of Byzantine participants; only the compromised nodes differ. A poorly positioned Byzantine set exposes a limited portion of the network, whereas a strategic placement allows malicious influence to reach substantially more honest participants within the same training horizon.

Consequently, two Byzantine sets of the same cardinality may have substantially different effects on the honest network; Figure 1 illustrates this mechanism. This raises a basic question: if an adversary can compromise m participants, which ones should it choose? Existing Byzantine threat models and evaluations provide no common answer. Byzantine participants are variously selected at random, fixed beforehand, positioned ad hoc, or chosen according to topological structural properties [3], [4], [5], [6]. Recent work has started to consider strategic node placement [7], but a general criterion for selecting a Byzantine set according to its actual finite-time influence on decentralized training is still missing. In this paper, we argue that this is not only an experimentaldesign detail. If the adversary is able to choose which participants to compromise, evaluating an attack under an arbitrary Byzantine placement may substantially underestimate its actual capability. Conversely, a defense may appear effective because the selected Byzantine nodes are poorly positioned to influence the honest network, rather than because the defense

successfully limits malicious updates. Thus, the placement of Byzantine participants should itself be considered part of the threat model. To address these issues, we formulate Byzantine node placement as an optimization problem. Given a communication topology, a Byzantine budget m, and a training horizon T , the adversary seeks the set of compromised participants that maximizes its impact on honest nodes. We therefore introduce Byzantine Placement Influence (BPI), a topology-based proxy that measures the cumulative finite-time exposure of honest participants to a Byzantine set without observing the actual training dynamics. BPI models how malicious influence propagates over multiple communication hops and evaluates the compromised set jointly. Based on this objective, we develop two efficient placement strategies that identify high-influence Byzantine sets without executing the underlying training task. Our main contributions are: • We formalize Byzantine node placement as an explicit adversarial dimension in DFL, where the attacker selects a set of m compromised participants to maximize its finite-time impact on honest nodes. • We introduce Byzantine Placement Influence (BPI), a finite-time, set-level measure of Byzantine exposure derived from the gossip communication dynamics, together with efficient algorithms for identifying high-influence placements. • We show experimentally that BPI-guided placement consistently strengthens attacks across heterogeneous communication topologies and transfers across different poisoning objectives. • We demonstrate that Byzantine placement can substantially alter the apparent robustness of Byzantine-robust aggregation, showing that fixed or arbitrary attacker configurations can lead to overly optimistic security evaluations.

network, with selfish clients modeled as a fixed subset of participants, namely the last m clients in the indexing. SelfishAttack also considers a partially connected random graph, but the selfish clients are not selected according to their topological position. Other works evaluate Byzantine robustness on sparse or random decentralized networks, but without optimizing the Byzantine set. UBAR [3] uses random graphs generated from a connection probability and randomly adds Byzantine nodes to the benign network. BALANCE [5] primarily evaluates regular graphs and additionally considers fully-connected, Erdős– Rényi, small-world, ring, and random graphs with different fractions of malicious–benign edges. However, malicious nodes are fixed in the evaluated graph instances, with no topology-aware selection rule. Some works use topology-specific or ad-hoc placements. ClippedGossip [4] evaluates dumbbell graphs, small-world graphs, torus graphs, and rings. In the small-world and torus experiments, Byzantine workers are not selected among the existing honest nodes; instead, the honest topology is first constructed, and additional Byzantine workers are attached to randomly selected regular workers. In other experiments, Byzantine nodes are added in ad-hoc positions to illustrate specific robustness or breakdown phenomena. Notably, its analysis emphasizes local Byzantine influence through the fraction of incident aggregation weight controlled by Byzantine neighbors, rather than only the global number of Byzantine nodes. Bhattacharya et al. [6] study small-world and scalefree networks, placing Byzantine nodes on nodes incident to rewired Watts–Strogatz edges and on high-degree nodes in scale-free graphs; these strategies remain specific to the considered graph families. CS+ -RG [8] analyzes Byzantinerobust gossip on Two Worlds and Erdős–Rényi graphs; in the former, one whole clique is Byzantine, while in the latter each node is adjacent to four malicious nodes. We summarize these choices in Table I. Overall, there is no common placement convention when benchmarking Byzantine attacks and defenses, making results harder to compare and, more importantly, generally leaving the choice of which participants to compromise outside the attacker’s optimization problem. Strategic Byzantine placement. Two recent works explicitly study Byzantine placement as an adversarial decision. Syros et al. [11] investigate the effect of compromising structurally influential participants on backdoor propagation in peer-to-peer federated learning. They consider node-wise graph measures, including degree, Effective Network Size, PageRank, and clustering coefficient, and show that the choice of compromised participants can substantially affect backdoor effectiveness. Their placement criteria, however, are static structural heuristics and are studied specifically in the context of backdoor attacks. Piaseczny et al. [7] formulate Byzantine placement as a coordinated adversarial problem and introduce MaxSpANFL, a heuristic strategy that favors well-separated attackers. MaxSpAN-FL constructs BFS-based influence regions around

II. R ELATED W ORK The communication topology is a central component of decentralized learning, as it determines which nodes exchange models and how information propagates. Nevertheless, the literature on Byzantine decentralized learning typically treats the position of Byzantine nodes as a secondary experimental detail. Recent works [2], [7], [8], however, explicitly raise the question of which nodes an attacker should corrupt in order to maximize the attack’s spread over the network. In the following, we review the topology and placement assumptions adopted by works in Byzantine distributed learning that propose attacks or robust aggregation strategies. A. Topology and Byzantine Placement in Decentralized Learning In fully-connected topologies, Byzantine placement is essentially irrelevant. For instance, LEARN [9] considers a fullyconnected network, where all nodes are structurally equivalent and the attacker does not gain any topological advantage. Similarly, SelfishAttack [10] mainly assumes a fully-connected

2

Paper

Topology

Byzantine Placement

LEARN [9] UBAR [3] ClippedGossip [4] Bhattacharya et al. [6] BALANCE [5] CS+ -RG [8] SelfishAttack [10]

FC Random Graph Dumbbell, SW, Torus, Ring SW, SF Regular, FC, Erdős–Rényi, SW, Ring TW, Erdős–Rényi FC, Random Graph

Irrelevant Random Random, Ad hoc Random, Ad hoc (SW), Degree (SF) Ad hoc Ad hoc Last m nodes

TABLE I: Topologies and Byzantine placements considered in the literature on Byzantine distributed learning. Acronyms stand for: Fully-Connected (FC), Scale-Free (SF), Small World (SW), and Two Worlds (TW).

candidate nodes and greedily minimizes their overlap, using shortest-path separation as a proxy for adversarial influence. Their evaluation is limited to a single FGSM-based datapoisoning attack and three graph families (directed geometric, Erdős–Rényi, and preferential-attachment graphs). Our work builds on this observation but takes a different approach. Instead of using node centrality or shortest-path separation as a proxy for attack influence, BPI derives the placement objective from the gossip dynamics themselves, providing a common finite-time criterion for evaluating a Byzantine set across different communication topologies and poisoning objectives.

fully-connected graph – since the server places every client at one-hop distance from every other. Under this W, Byzantine placement is irrelevant, because if the server fails to filter an attack, the poisoned update reaches the entire network in a single round regardless of which clients are compromised. However, this assumption breaks down as soon as W is no longer uniform, i.e., in genuinely decentralized topologies. A. Byzantine Threat Model For the remainder of this work, we consider the scenario in which an external attacker selects a set B ⊂ V, with |B| = m and H ∩ B = ∅, of Byzantine nodes before training starts. Byzantine nodes deviate from the protocol described above by performing model and data poisoning attacks. The attacker operates under the following assumptions: (A1) Fixed topology. The topology does not change after training starts and cannot be modified by the attacker. (A2) Topology knowledge. The adversary knows the communication topology G, and every Byzantine node knows the complete set B of Byzantine participants. (A3) Non-robust aggregation. Honest nodes do not employ robust aggregation functions, so the mixing matrix W remains linear and depends only on the topology. Justifying (A1). We consider a static communication graph, consistently with the standard formulation of decentralized gossip learning [8], [4]. This assumption allows us to isolate the effect of the placement of Byzantine nodes. If communication links could change during training or be modified by the adversary, the resulting attack effectiveness would conflate Byzantine placement with topology manipulation, and the propagation dynamics would be governed by a time-varying sequence of mixing matrices rather than by a single matrix W. Justifying (A2). Consistent with prior work on Byzantine robustness in DFL [8], [9], [4], [12], [13], and to avoid relying on security through obscurity, we assume that the adversary has complete knowledge of the communication topology. In practice, the adversary’s ability to reconstruct the network depends on the actual implementation and characterizing such discovery mechanisms is orthogonal to our objective; therefore we leave it outside the scope of this work. Justifying (A3). We adopt (A3) to isolate the effect of Byzantine placement from the dynamics introduced by robust aggregators and filtering mechanisms [14], [15], [16], [17], [18], [19]. Under plain averaging, communication is described

III. BACKGROUND AND P RELIMINARIES We consider a network composed of n nodes disposed on an undirected graph G = (V, E) where |V| = n. Each node optimizes a local objective function fi : Rp → R and holds a local parameter vector θ ∈ Rp . Participants are interested in solving # " X 1 ∗ fi (θ) (1) θH = arg min |H| θ i∈H

where H ⊆ V denotes the set of honest nodes. At each round t = 0, . . . , T − 1, every node i produces its (t) local model update θi , e.g., by running SGD locally. Node i then receives all parameters from its neighbors N (i) and linearly combines them: X θi+ = wij θj . (2) j∈N (i)∪{i}

Each wij forms a doubly-stochastic gossip matrix W = [wij ] ∈ [0, 1]n×n and is governed by the following equation:  1     1 + max(di , dj ) (i, j) ∈ E, (3) wij = 1 − P  ℓ∈N (i) wiℓ i = j,   0 otherwise where di denotes the degree of node i. By construction W1 = 1 and 1⊤ W = 1⊤ , and limt→∞ Wt = n1 11⊤ ; meaning that messages eventually spread uniformly across the network, assuming G is connected. Remark 1 (CFL as a special case). CFL corresponds to the special case where W is uniform over all clients – i.e., physically a star topology, but functionally equivalent to a

3

by the fixed mixing matrix W, allowing us to separate the topological propagation of Byzantine influence from the particular attack realization. With robust aggregation, instead, whether a received model is accepted, rejected, clipped, or reweighted depends on its relation to the models observed during training. The resulting effective mixing operator is therefore nonlinear and time-varying, and depends on the attack, local data, optimization trajectory, and possibly previous rounds. Moreover, robust aggregation does not provide a universal elimination of Byzantine influence, since adaptive poisoning attacks can circumvent several distance- and statistics-based defenses [20], [?], [21], while history-aware attacks and recent theoretical results expose broader limitations of robust aggregation strategies [22], [23]. Modeling a specific robust aggregator inside BPI would consequently make the placement criterion defense- and attack-specific rather than topologyonly. We therefore derive BPI under linear aggregation and separately evaluate in Section VI-D whether its placement recommendations transfer to Byzantine-robust aggregation. Perturbation model. To keep the placement problem separate from the choice of poisoning strategy, Byzantine nodes trans(t) (t) mit messages of the form θ̃i = θi + αu, where u is a unit direction (∥u∥ = 1) and α > 0 is the attack strength. Since we can decompose any poisoning attack into a clean local update plus an adversarial perturbation, and we are concerned only with how that perturbation propagates through the network, we abstract away from how α and u are generated. Byzantine drift. We model the effect of an attack on node (t) (t) (t) i’s model as δi = θ̃i − θi , the deviation between the model obtained under a placement B and the model obtained in a clean run with identical initialization, data partition, and randomness but B = ∅. Stacking all node drifts gives ∆(t) = (t) (t) [δ1 , . . . , δn ]⊤ , and the empirical honest-node drift of the network is 1 X (t) (t) δi . (4) DH (B) = |H|

To address this challenge, Section IV introduces Byzantine Placement Influence (BPI), a tractable proxy objective for identifying influential Byzantine placements. IV. B YZANTINE P LACEMENT I NFLUENCE A. From Empirical Drift to a Tractable Proxy In practical scenarios, DFL training operates over a finite number of rounds T , and the effectiveness of a Byzantine placement depends critically on how quickly poisoned mass propagates through the gossip network within that finite time horizon. This is particularly relevant when attacks add only a small bias over the clean baseline, which may not survive the training dynamics if Byzantine sources are located in lowinfluence regions of the graph. For example, backdoor attacks are sensitive to their positioning in the graph, as their effect survives only for some hops from the source (see Fig. 2). This is the decentralized analogue of the client-selection problem in CFL, where a client-injected backdoor must survive over several communication rounds [24], [25], [26], [27], [28].

Fig. 2: BadNet backdoor propagation on the ring topology. The Byzantine source node is shown in red, while honest nodes are shown in white. Values around honest nodes report final local attack success rate (ASR) on triggered test samples; label color maps lower ASR to green and higher ASR to red. These observations motivate us to define a tractable, topology-aware score that captures finite-time Byzantine exposure to honest nodes without requiring any training runs with the aim of maximizing the adversarial objective.

i∈H

Attacker’s objective. Putting (A1)–(A3) together, the attacker chooses the placement B, with |B| = m fixed, that maximizes the expected honest-node drift after T rounds: h i (T ) B ∗ = arg max E DH (B; ξ) , (5)

B. Drift Dynamics and the BPI Score Under assumptions (A1)–(A3) and the perturbation model of Section III-A, to obtain a topology exposure proxy we consider the linearized gossip component of the drift dynamics:

|B|=m

where ξ collects the exogenous randomness of training (initialization, mini-batch sampling, data partitioning). Directly solving Eq. 5 is generally computationally intractable. Evaluating the objective for a single candidate placement B requires estimating the expected honest-node drift (T ) DH (B; ξ), which entails running training twice – once with B = ∅ and once with the candidate Byzantine placement B – and repeating this process across multiple random seeds to
n average over the randomness ξ. Moreover, since there are m possible placements, exhaustive evaluation and optimization quickly become infeasible even for moderately sized graphs.

ˆ (t+1) = W∆ ˆ (t) + α (W1B ) ⊗ u, ∆

(6)

where 1B ∈ {0, 1}n is the indicator vector of the Byzantine set. The first term propagates the drift accumulated up to round t through one gossip step; the second term injects a fresh perturbation αu at each Byzantine source, weighted by how much P each honest node listens to it. Specifically, (W1B )i = k∈B wik is the total mixing weight that node i assigns to its Byzantine neighbors. Assuming no drift at ˆ (0) = 0, since both the clean and poisoned initialization (∆

4

Algorithm 1 G REEDY-BPI S ELECTION

runs share identical initialization under B = ∅ and B ̸= ∅ respectively), the recursion unrolls in closed form to: ˆ (T ) = α ∆

T X

(Wt 1B )u.

Input: Mixing matrix W; node set V; budget m < |V|; horizon T . Output: B ⊂ V, |B| = m. 1: procedure G REEDY-BPI(W, V, m, T ) 2: B←∅ 3: for in 1, . . . , m do 4: s∗ ← −∞; r∗ ← null 5: for all r ∈ V \ B do 6: s ← ΦT (W, B ∪ {r}) 7: if s > s∗ then 8: s∗ ← s; r∗ ← r 9: B ← B ∪ {r∗ } 10: return B

(7)

t=1

Applying the same honest-node drift measure of Eq. 4 to the linearized dynamics, we define the corresponding reference drift as: ! T α ⊤ X t (T ) 1 W 1B . (8) D̂H (B) = |H| H t=1 This motivates the following definition. Definition 1 (Byzantine Placement Influence (BPI)). Given a mixing matrix W, a Byzantine set B ⊆ V, and a training horizon T , the BPI score is computed as: ! T 1 ⊤ X t 1 W 1B . (9) ΦT (W, B) = |H| H t=1

Nevertheless, exact optimization of Eq. 10 quickly becomes computationally impractical. As with Eq. 5, it requires
n evaluating all m possible Byzantine placements, which is feasible only for small graphs. Section V presents two efficient heuristic algorithms for approximating the optimal solution.

The BPI score has a natural interpretation: the (i, k)-entry of Wt measures the cumulative mixing weight that flows from node PT k tot node i over exactly t gossip steps, and the sum t=1 W aggregates this over the entire training horizon. BPI is therefore the average total exposure of honest nodes to Byzantine sources accumulated over T rounds, weighted by the gossip matrix. Note that BPI depends only on W, B, and T ; it requires no training runs and no knowledge of the attack direction u or local data distributions. Comparison with graph-centrality heuristics. Standard heuristics for identifying influential nodes – i.e., degree, betweenness, eigenvector centrality – score nodes independently of one another and of the training horizon. BPI differs in two key respects. First, it is set-valued: BPI evaluates the joint diffusion of the entire Byzantine set, capturing overlap effects that per-node scores miss. For instance, two high-degree nodes adjacent to the same region may expose fewer honest nodes than two lower-degree nodes placed in well-separated parts of the graph. Second, it is finite-time: it accounts for how far Byzantine mass actually travels within T rounds.

V. BPI-G UIDED B YZANTINE P LACEMENT Section IV established that optimizing Byzantine placement for an attacker can be relaxed to maximizing ΦT (W, B) over all subsets B ⊆ V of size m (Eq. 10). Since exact optimization is combinatorially intractable for large graphs, we propose two efficient approximation algorithms: a greedy forward selection procedure and a local search refinement built on top of it. A. Greedy BPI Selection The first algorithm builds B incrementally. Starting from B = ∅, at each step it adds the candidate node r ∈ V \ B that yields the largest marginal increase in ΦT (W, B), repeating until |B| = m. The procedure is described in Algorithm 1. At each step, the greedy procedure selects the node that maximizes the immediate gain in finite-time exposure. However, this selection is locally optimal with respect to the current partial solution, for two reasons. First, the marginal gain of adding a candidate r depends on the Byzantine nodes already selected. Indeed, adding r both creates new exposure from r to the remaining honest nodes and removes r from H, so any exposure previously directed at r no longer contributes to ΦT (W, B). Second, different Byzantine sources may induce partially overlapping diffusion patterns: an early greedy choice may block a more effective global configuration by steering the set toward a locally concentrated region of the graph. Consequently, greedy selection is not guaranteed to reach the globally optimal B ∗ of size m. Computational complexity. Each evaluation of ΦT (W, B) costs O(T · |E|) if Wt 1B is computed iteratively (one sparse matrix-vector product per round) rather than materializing Wt explicitly. The greedy loop performs m outer iterations, each evaluating at most n candidates, giving an overall cost of O(m· n · T · |E|).

C. Relaxing the Attacker’s Objective with BPI (T )

From Eq. 8, maximizing DH (B) over placements of size m is approximated by maximizing ΦT (W, B). This yields a tractable reformulation of the attacker’s objective (Eq. 5): B ∗ ≈ arg max ΦT (W, B).

(10)

B⊆V, |B|=m

The approximation sign reflects two sources of gap relative to Eq. 5: (i) BPI is a linearization that ignores the training dynamics beyond the gossip step (local SGD noise, data heterogeneity), and (ii) it abstracts away the exogenous randomness ξ by construction. We show in Section VI that larger BPI values correspond to stronger empirical influence and that BPI-guided placements remain effective across topologies and attack strategies, supporting its use as a placement criterion.

5

Algorithm 2 S WAP -BPI S ELECTION

RQ4: Does the advantage of BPI-guided placements persist when honest nodes employ a nonlinear Byzantine-robust Input: Mixing matrix W; node set V; budget m < |V|; aggregation? horizon T . Dataset and model. Unless otherwise stated, we use Output: B ⊂ V, |B| = m. MNIST [29] and distribute the training samples i.i.d. across 1: procedure S WAP -BPI(W, V, m, T ) participants. Each client trains a two-layer multilayer percep2: B ← G REEDY-BPI(W, V, m, T ) tron consisting of a 128-unit ReLU hidden layer followed by 3: improved ← true a 10-unit output layer. Local training minimizes the cross4: while improved do entropy loss using Adam with learning rate 0.01, batch size 5: improved ← false ∗ ∗ ∗ 64, and one local epoch per communication round. 6: b ← null; r ← null; s ← ΦT (W, B) Setup. Our main experiments use n = 50 participants, of 7: for all b ∈ B do which m = 5 (10%) are Byzantine, and run for T = 30 com8: for all r ∈ V \ B do munication rounds. Honest nodes aggregate neighbor models 9: B̃ ← (B \ {b}) ∪ {r} using Metropolis weights. We evaluate five experiment seeds, 10: s ← ΦT (W, B̃) {33, 99, 5, 42, 123}. 11: if s > s∗ then Byzantine nodes do not aggregate models received from 12: s∗ ← s; b∗ ← b; r∗ ← r other Byzantine nodes. This removes Byzantine-to-Byzantine 13: improved ← true self-reinforcement from the experimental setting and isolates 14: if improved then the effect of how malicious sources expose honest participants. 15: B ← (B \ {b∗ }) ∪ {r∗ } We select six topologies described in Table II. We selected 16: return B the topology parameters so that all graph families yield broadly comparable sparse networks, with average degrees approximately between four and five. This prevents differences in B. Local Search Refinement via 1-Swap attack effectiveness from being trivially explained by large To address the limitations of greedy selection, we initialize differences in network density; at the same time, the resultwith the greedy solution and refine it through an exhaustive ing graphs retain substantially different structures. DC-SBM, local 1-swap search. At each iteration, the procedure considers Core-Periphery, Random-Geometric, and Scale-Free are regenall single node exchanges of the form B̃ = (B \ {b}) ∪ {r} erated using the experiment seed; disconnected realizations with b ∈ B and r ∈ V \ B, and accepts the swap that yields the are resampled until a connected graph is obtained. Dragonfly largest improvement in ΦT (W, B). The search repeats until no and Ring-of-Cliques are deterministic and therefore identical improving exchange exists. The resulting set is locally optimal across seeds. with respect to all 1-swap moves. For every b ∈ B and every Byzantine placement. We compare Greedy-BPI and Swapr ∈ V \ B, BPI with five baselines: uniform random placement, Degree, ΦT (W, B) ≥ ΦT (W, (B \ {b}) ∪ {r}) . (11) Betweenness, Eigenvector centrality, and MaxSpAN-FL [7]. Centrality-based strategies select the m nodes with the largest Since each accepted swap strictly increases ΦT (W, B) and respective centrality score. For Random, one Byzantine set of m distinct nodes is the number of feasible placements of size m is finite, the procedure terminates in a finite number of iterations. The full sampled uniformly without replacement for each topology and experiment seed. Hence, each table entry for Random contains algorithm is given in Algorithm 2. Computational complexity. Each swap iteration evaluates five independently generated placements, one for each seed. ΦT (W, B) for all m(n − m) candidate exchanges at cost Poisoning attacks. For the untargeted evaluation, Byzantine O(T · |E|) each, giving O(m(n − m) · T · |E|) per pass. The nodes inject an aligned additive perturbation. At the beginning number of passes until local optimality is bounded by the of each run, we sample a direction u with entries uk ∼ N (0, 1) using the experiment seed and normalize it such that number of feasible placements. ∥u∥2 = 1. The same direction is shared by all Byzantine nodes. VI. E XPERIMENTS When Byzantine node i attacks for the first time, we record In this section, we address the following research questions its model norm ∥θi,1 ∥2 and freeze this value for the remainder (RQs): of the run. At every subsequent communication round, the RQ1: Does finite-time Byzantine exposure reflect the empirical node publishes influence of a placement during decentralized training? θei,t = θi,t + α∥θi,1 ∥2 u, RQ2: Does BPI provide a consistent placement for Byzantine nodes across heterogeneous communication topologies? where α = 64 in the main experiments. Thus, all malicious RQ3: Do BPI-guided placements remain effective when the perturbations are directionally aligned while their magnitude attacker adopts an objective different from the additive is normalized to the initial model scale of the corresponding untargeted perturbation used to derive BPI? attacker. We refer to this attack as FixedBias.

6

TABLE II: Communication topologies used in the main experiments. All graphs contain n = 50 nodes. Topology

Configuration

Ring-of-Cliques

10 cliques of size 5, each forming a K5 , connected in a ring by one inter-clique edge per consecutive pair (110 edges) [30]. 10 groups of 5 nodes, each forming a K5 . The group-level graph is the 4-regular circulant C10 (1, 2), with one physical inter-group link for each group-level edge and endpoints assigned round-robin (120 edges) [31]. Barabási–Albert preferential attachment in which each new node attaches to two existing nodes [32]. Five communities of 10 nodes, with pin = 0.4 and pout = 0.025. Node propensities are sampled from a log-normal distribution with σ = 0.6 and normalized to unit mean within each community; edge probabilities are pij = min(1, θi θj pin/out ) [33]. Two-block SBM with 10 core and 40 peripheral nodes, pcc = 0.6, pcp = 0.15, and ppp = 0.03 [34]. Nodes sampled uniformly in [0, 1]2 and connected when their Euclidean distance is at most r = 0.17 [35].

Dragonfly Scale-Free DC-SBM

Core-Periphery Random-Geometric

For the targeted evaluation, we employ a classical backdoor attack called BadNets [36]. Each Byzantine participant poisons a fixed 20% subset of its local training data. Poisoned samples are stamped with a 3 × 3 white square in the bottom-right corner and relabeled to target class y ∗ = 0. Malicious clients otherwise follow the same local optimization configuration as honest clients, i.e., one local epoch of Adam training with learning rate 0.01 and batch size 64 per communication round. Evaluation metrics. For RQ1, we use the empirical honest(t) node drift DH from Eq. 4 and examine whether placements with progressively larger ΦT (W, B) induce correspondingly larger drift trajectories. For untargeted attacks, we measure the honest-node accuracy drop at round t as 1 X ∆At = (Ai,t − Ãi,t ), |H|

their finite-time exposure increases. Swap-BPI, which has the largest ΦT (W, B), also produces the largest empirical drift throughout training. Minimum © T (© 30 = 1:46) Eigenvector (© 30 = 2:36)

Random (© 30 = 2:66) Swap-BPI (© 30 = 2:94)

2000

Honest empirical drift DH

(t)

2500

1500 1000

i∈H

500 0 0

where Ai,t is node i’s clean accuracy and Ãi,t its accuracy under attack. The main RQ2 comparison reports the finalround value ∆AT with T = 30; the long-horizon FixedBias experiment in RQ4 reports ∆At over training. For backdoor attacks, we measure the honest-node attack success rate (ASR) on triggered test samples: h i P (t) (τ (x)) = y ∗ X ∗ 1 fi (x,y)∈D :y̸ = y 1 test (t) . ASRH = |H| |{(x, y) ∈ Dtest : y ̸= y ∗ }| i∈H (12) (t) Here, fi (·) is the classifier held by node i at round t, Dtest is the clean test set, τ (x) adds the backdoor trigger, and y ∗ is the attacker’s target label.

5

10

15

Round

20

25

30

(t)

Fig. 3: Evolution of the empirical drift DH across communication rounds for placements spanning increasing values of ΦT (W, B). Greater exposure results in faster and larger drift of honest models. B. Cross-Topology Consistency of BPI (RQ2) 1) BPI Across Placement Strategies: We next study whether a placement strategy that performs well on one graph family remains effective on structurally different networks. Figure 4 first isolates the topology-level objective by comparing ΦT obtained by each deterministic placement strategy with the distribution induced by 5000 uniformly sampled Byzantine sets. The relative quality of conventional structural heuristics changes markedly across graph families. A criterion that produces a high-exposure placement on one topology may fall considerably closer to the random-placement distribution on another. BPI exhibits a qualitatively different behavior. Greedy-BPI and, in particular, Swap-BPI consistently locate placements at the extreme high-exposure end of the distribution across all six graph families.

A. Empirical Validation of Finite-Time Exposure (RQ1) We first investigate whether the ordering induced by BPI is reflected in the actual influence of Byzantine perturbations during training. Figure 3 compares four placements spanning progressively larger values of ΦT (W, B) on a 50-node Ringof-Cliques topology under FixedBias. The empirical trajectories exhibit the same ordering as BPI. The minimum-exposure placement induces only limited honest-model drift, while Eigenvector, Random, and Swap-BPI produce progressively faster and larger drift accumulation as

7

Degree Betweenness

Eigenvector MaxSpAN-FL

Random Byzantine placements

Ring-of-Cliques

Greedy-BPI Swap-BPI

Dragonfly

Scale-Free

750

750

750

500

500

500

250

250

250

0

0

2.1

2.4

2.7

DC-SBM

2.4

0

2.8

2.6

750

750

500

500

250

250

250

0

0

2.75

2.0

2.4

2.8

2.8

2.6

Random-Geometric

500

2.50

2.4

Core-Periphery

750

2.25

ties Swap-BPI on DC-SBM, while Swap-BPI is marginally stronger on Ring-of-Cliques, Scale-Free, and Core-Periphery. Their topology-averaged degradations are 20.8 and 20.9 percentage points, respectively. Recall that Swap-BPI is guaranteed to improve or preserve the BPI objective, not the downstream accuracy degradation. Small inversions between Greedy-BPI and Swap-BPI are therefore expected because BPI is a proxy for the complete learning dynamics. The small empirical gap also indicates that most of the benefit comes from optimizing the BPI objective itself.

0

1.6

2.0

2.4

2.8

C. Transferability Across Attack Objectives (RQ3)

© T (W; B)

The cross-topology instability of the structural baselines becomes even more pronounced under BadNets (Table IV). Degree is highly effective on Scale-Free (49.6%), DC-SBM (56.0%), and Core-Periphery (50.4%), but its effectiveness drops to 29.3% on Random-Geometric. Betweenness follows a similar pattern: it is competitive on Core-Periphery (54.2%) and DC-SBM (53.4%), but reaches only 31.6% on Dragonfly and 19.6% on Random-Geometric. MaxSpAN-FL again exhibits a different topology preference. It is the strongest strategy on Dragonfly (46.0%) and performs well on Ring-of-Cliques and Random-Geometric, but drops to 34.3% on Scale-Free, 29.7% on DC-SBM, and 31.9% on Core-Periphery. Eigenvector centrality never provides the strongest placement and is particularly weak on RandomGeometric, where it reaches only 14.7% ASR. Random placement follows the same topology-dependent pattern observed for FixedBias. It remains relatively competitive on Ring-of-Cliques and Dragonfly, but performs very poorly on Scale-Free (19.7%), DC-SBM (27.2%), and especially Core-Periphery (17.0%). BPI is substantially more stable. A BPI-guided strategy achieves the largest mean ASR on five of the six graph families. On the only exception, Dragonfly, MaxSpAN-FL reaches 46.0% while Swap-BPI reaches 45.3%, a difference of only 0.7 percentage points. Conversely, whenever one of the structural baselines fails to match the graph structure, its degradation can be severe. This result is particularly significant because BadNets is not described by the aligned additive perturbation model used to derive BPI. The persistence of the same cross-topology behavior therefore indicates that BPI is capturing a property of the communication process itself rather than a peculiarity of FixedBias. Figure 5 provides a node-level view of this propagation process. Although only Byzantine nodes directly inject poisoned training samples, the learned backdoor is not confined to their immediate neighborhood. Honest participants that aggregate a malicious model partially inherit the backdoor and subsequently propagate it through their own outgoing models. As a result, non-neighboring honest nodes can acquire substantial ASR after several communication rounds. This behavior illustrates why Byzantine placement cannot be characterized solely through one-hop quantities such as

Fig. 4: Histograms show ΦT (W, B) for 5000 uniformly sampled placements of five Byzantine nodes on each topology; vertical lines indicate deterministic placement strategies. Lines farther to the right correspond to greater finite-time exposure. We use n = 50 and T = 30.

2) Accuracy Drop on Untargeted Attacks: Table III shows that no conventional structural heuristic provides a uniformly strong placement across graph families. Degree and Betweenness are particularly effective on topologies containing pronounced degree heterogeneity or structurally privileged regions. On Scale-Free, they obtain 19.6 and 19.4 percentage points of accuracy degradation, respectively, compared with only 14.1 for Random. A similar pattern appears on DC-SBM and Core-Periphery, where both heuristics approach the BPI-guided placements. This is expected: in these graphs, hubs, high-connectivity nodes, and inter-community positions are informative proxies for malicious influence. However, the same heuristics transfer poorly to other structures. On Random-Geometric, Degree falls to 15.3 and Betweenness to 14.0, compared with 20.8 for Greedy-BPI. They also provide little advantage over Random on Ring-of-Cliques and Dragonfly. MaxSpAN-FL exhibits an almost complementary behavior. It performs strongly on Ring-of-Cliques (20.9), Dragonfly (20.7), and Random-Geometric (18.4), but is substantially weaker on Scale-Free (17.1), DC-SBM (16.5), and CorePeriphery (17.1). Eigenvector centrality is less reliable overall and is the weakest strategy on Ring-of-Cliques, Dragonfly, and Random-Geometric. In contrast, BPI does not rely on any one of these structural signatures. Either Greedy-BPI or Swap-BPI achieves the largest mean degradation on every evaluated topology. This is the main cross-topology result: different structural heuristics become appropriate on different graph families, whereas the propagation-based BPI objective remains consistently effective. Interestingly, the difference between Greedy-BPI and SwapBPI is small. Greedy-BPI already attains the strongest observed mean on Dragonfly and Random-Geometric and

8

TABLE III: Final honest-node accuracy drop ∆A30 under FixedBias for different Byzantine placement strategies. Values are the mean ± 95% Student-t confidence interval over five seeds, in percentage points. Higher values indicate a stronger attack. The highest mean in each row is bold; the lowest is underlined. Topology

Random

Degree

Betweenness

Eigenvector

MaxSpAN-FL

Greedy-BPI

Swap-BPI

Ring-of-Cliques Dragonfly Scale-Free Degree-Corrected-SBM Core-Periphery Random-Geometric

18.2 ± 1.0 19.8 ± 1.3 14.1 ± 3.0 16.1 ± 0.5 13.1 ± 3.7 15.2 ± 1.5

18.4 ± 2.4 19.9 ± 1.6 19.6 ± 1.0 20.6 ± 1.8 19.3 ± 0.8 15.3 ± 1.9

18.4 ± 2.4 18.8 ± 1.2 19.4 ± 0.9 20.4 ± 1.5 19.8 ± 0.9 14.0 ± 2.7

14.3 ± 4.5 18.5 ± 2.3 18.4 ± 1.1 19.7 ± 2.4 18.8 ± 0.9 9.1 ± 4.5

20.9 ± 1.1 20.7 ± 1.2 17.1 ± 1.3 16.5 ± 3.8 17.1 ± 2.4 18.4 ± 2.4

21.0 ± 1.0 20.9 ± 1.1 20.2 ± 1.0 21.3 ± 1.5 20.6 ± 0.9 20.8 ± 0.6

21.2 ± 1.1 20.8 ± 1.0 20.5 ± 0.7 21.3 ± 1.6 20.8 ± 0.9 20.6 ± 0.8

TABLE IV: ASRH under BadNets for different Byzantine placement strategies. Entries report the mean ± 95% Student-t confidence interval across five seeds. Higher values indicate a stronger attack. The highest mean in each row is bold; the lowest is underlined. Topology Ring-of-Cliques Dragonfly Scale-Free Degree-Corrected-SBM Core-Periphery Random-Geometric

Random

Degree

Betweenness

Eigenvector

MaxSpAN-FL

Greedy-BPI

Swap-BPI

38.6 ± 6.8 41.4 ± 1.8 19.7 ± 8.1 27.2 ± 10.2 17.0 ± 9.8 32.3 ± 7.8

37.0 ± 6.6 39.1 ± 7.4 49.6 ± 2.1 56.0 ± 13.4 50.4 ± 9.0 29.3 ± 6.8

37.0 ± 6.6 31.6 ± 1.8 47.7 ± 2.1 53.4 ± 10.1 54.2 ± 7.5 19.6 ± 8.4

26.9 ± 12.6 32.6 ± 9.5 39.2 ± 5.4 47.1 ± 15.7 46.6 ± 8.2 14.7 ± 9.2

42.7 ± 0.9 46.0 ± 2.0 34.3 ± 7.4 29.7 ± 22.8 31.9 ± 11.9 35.6 ± 8.6

44.6 ± 1.6 44.2 ± 2.2 56.1 ± 9.5 63.1 ± 8.1 60.3 ± 4.8 49.5 ± 5.5

44.0 ± 2.5 45.3 ± 4.4 59.5 ± 10.4 64.7 ± 8.8 60.6 ± 5.7 48.9 ± 6.9

degree. The effect of compromising a node depends not only on how many honest neighbors it directly reaches, but also on how its influence propagates through sequences of honest relays over the finite training horizon. These multi-hop paths are precisely the contribution captured by the powers Wt in BPI.

Thus, the observed robustness of BALANCE is strongly conditional on where those Byzantine nodes are located. The original placement does not expose this worst-case behavior, whereas topology-aware placement reveals a substantially more damaging attack configuration. Surprisingly, robust aggregation does not necessarily attenuate the topology-induced propagation of the backdoor. Under BadNets, BALANCE can yield higher ASRH than plain averaging. This indicates that filtering neighboring models may alter their relative influence in a way that favors malicious updates that remain within the acceptance threshold. We additionally evaluate FixedBias with scale factor α = 2.5 for T = 300 rounds. Figure 7 compares the original BALANCE placement with Swap-BPI. While the original placement produces limited degradation, the BPI-guided placement causes a progressively larger accuracy gap over training, showing that the placement effect also persists for an untargeted attack under nonlinear aggregation.

D. Beyond Linear Gossip (RQ4) Our previous experiments use Metropolis aggregation, matching the linear communication model from which BPI is derived. We finally test whether BPI-guided placement remains effective when the actual aggregation rule is nonlinear. We consider the Ring and Erdős–Rényi graph configurations and Byzantine placements used in the BALANCE evaluation and compare those placements with Swap-BPI. These experiments contain n = 20 nodes and m = 4 Byzantine participants (20%). We use BALANCE [5] with αBAL = 0.25, κ = 0.5, λ(t) = t/T , and γ = 1.5. A neighbor j is accepted by node i whenever t+1/2

θi

t+1/2

− θj

t+1/2

2

≤ 1.5e−0.5t/T θi

VII. C ONCLUSION This work studies Byzantine node placement as an explicit adversarial dimension in DFL. We formalize the attacker’s placement objective and introduce Byzantine Placement Influence (BPI), a finite-time, set-level measure of how strongly a Byzantine set can expose honest participants. BPI separates the structural contribution of the communication topology from the details of a particular poisoning strategy, and the resulting placement algorithms provide a practical way to identify high-influence Byzantine sets without executing training for every candidate placement. Our experiments show that placement can substantially change attack effectiveness across heterogeneous graph families, poisoning objectives, and even under nonlinear Byzantine-robust aggregation. These findings

. 2

The mean of the accepted neighboring models is then combined with the local intermediate model with weights 0.75 and 0.25, respectively. Figure 6 reveals a substantial placement-induced vulnerability. Under BadNets, the placement used in the original BALANCE evaluation yields a mean honest-node ASR of 39.2% on Erdős–Rényi and 16.0% on the Ring. Changing only the identities of the Byzantine participants to the SwapBPI placement raises these values to 99.8% and 82.4%, respectively.

9

Degree

Betweenness

Eigenvector

MaxSpAN-FL

Greedy-BPI

Swap-BPI

Ring-of-Cliques

Random

100

ASRH = 33:1%; © T = 2:67

ASRH = 33:1%; © T = 2:67

ASRH = 22:3%; © T = 2:36

ASRH = 42:7%; © T = 2:89

ASRH = 45:4%; © T = 2:91

ASRH = 45:2%; © T = 2:94

Dragonfly

ASRH = 33:0%; © T = 2:66

80

ASRH = 34:6%; © T = 2:79

ASRH = 31:2%; © T = 2:84

ASRH = 42:4%; © T = 2:83

ASRH = 48:3%; © T = 2:94

ASRH = 46:6%; © T = 2:94

ASRH = 50:7%; © T = 2:96

Scale-Free

ASRH = 39:6%; © T = 2:86

ASRH = 47:3%; © T = 2:93

ASRH = 47:3%; © T = 2:93

ASRH = 32:4%; © T = 2:86

ASRH = 37:9%; © T = 2:86

ASRH = 65:2%; © T = 2:97

ASRH = 65:2%; © T = 2:97

DC-SBM

ASRH = 24:6%; © T = 2:78

40

ASRH = 43:7%; © T = 2:94

ASRH = 43:9%; © T = 2:92

ASRH = 47:5%; © T = 2:92

ASRH = 39:4%; © T = 2:91

ASRH = 62:8%; © T = 2:97

ASRH = 67:7%; © T = 2:99

Core-Periphery

ASRH = 22:2%; © T = 2:75

Random-Geometric

Final node ASR (%)

60

20

ASRH = 6:5%; © T = 2:14

ASRH = 49:9%; © T = 2:95

ASRH = 50:1%; © T = 2:96

ASRH = 44:1%; © T = 2:92

ASRH = 25:5%; © T = 2:70

ASRH = 57:0%; © T = 2:97

ASRH = 57:0%; © T = 2:97

1

ASRH = 34:4%; © T = 2:67

ASRH = 23:0%; © T = 2:49

ASRH = 19:9%; © T = 2:49

ASRH = 11:8%; © T = 1:75

ASRH = 33:9%; © T = 2:82

ASRH = 48:7%; © T = 2:94

ASRH = 48:7%; © T = 2:94

Byzantine nodes

Fig. 5: Final node-level ASR across network topologies and Byzantine node placement strategies. Node halos encode the final ASR at round T = 30; nodes with ASR below 1% are left uncoloured. Each panel reports the mean ASR over honest nodes, ASRH , and the corresponding ΦT (W, B) score. indicate that Byzantine placement should be specified and optimized as part of DFL security evaluation.

ACKNOWLEDGMENT We thank Anthony Di Pietro for contributions to the experimental codebase, including implementations of attack, method, and aggregation components, debugging assistance, and preliminary experiments that informed our investigation of the echo effect.

Our analysis focuses on static, known communication topologies and derives BPI from nominal linear gossip dynamics. Extending the placement problem to time-varying or partially known topologies, and defense-specific propagation dynamics remains an important direction for future work. Additional deployment constraints can also be incorporated by restricting the feasible placement set; for example, the proposed optimization algorithms can be extended to enforce a bounded local Byzantine population around honest nodes.

R EFERENCES [1] P. Kairouz, H. B. McMahan, B. Avent, A. Bellet, M. Bennis, A. N. Bhagoji, K. Bonawitz, Z. Charles, G. Cormode, R. Cummings, and others, “Advances and open problems in federated learning,” Foundations and Trends® in Machine Learning, vol. 14, no. 1–2, pp. 1–210, 2021. [2] E. Gabrielli, A. D. Pietro, D. Fenoglio, G. Pica, and G. Tolomei, “A survey on decentralized federated learning,” 2026. [Online]. Available: https://arxiv.org/abs/2308.04604

10

Original BALANCE

Swap-BPI

Erdős–Rényi

100

ASRH = 39:2%; © T = 5:57

ASRH = 99:8%; © T = 5:99

60

Ring

40

Final node ASR (%)

80

20

1

ASRH = 16:2%; © T = 3:87

ASRH = 82:4%; © T = 5:90

Byzantine nodes

Fig. 6: Both the Erdős–Rényi and Ring graphs, together with the Byzantine positioning in the first column, reproduce the topologies and attacker placement used in the original BALANCE paper. Columns compare this positioning with Swap-BPI. Colored halos report final local ASR, while red crosses identify Byzantine nodes. Each panel reports the mean ASR over honest nodes and the corresponding ΦT (W, B) score. Erdős–Rényi

Ring

6

¢At

4 2 0 −2 −4 0

100

200

300

0

Round

Original BALANCE

100

200

300

Swap-BPI

Fig. 7: Mean ∆At among honest nodes under BALANCE aggregation for the Byzantine placement used in the original BALANCE paper and Swap-BPI on the Erdős–Rényi and Ring topologies.

[3] S. Guo, T. Zhang, H. Yu, X. Xie, L. Ma, T. Xiang, and Y. Liu, “Byzantine-Resilient Decentralized Stochastic Gradient Descent,” IEEE Transactions on Circuits and Systems for Video Technology, vol. 32, no. 6, pp. 4096–4106, Jun. 2022. [Online]. Available: https: //ieeexplore.ieee.org/document/9555632/ [4] L. He, S. P. Karimireddy, and M. Jaggi, “Byzantine-Robust Decentralized Learning via ClippedGossip,” Apr. 2023, arXiv:2202.01545 [cs]. [Online]. Available: http://arxiv.org/abs/2202.01545 [5] M. Fang, Z. Zhang, Hairi, P. Khanduri, J. Liu, S. Lu, Y. Liu, and N. Gong, “Byzantine-Robust Decentralized Federated Learning,” in Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security. Salt Lake City UT USA: ACM, Dec. 2024, pp. 2874–2888. [Online]. Available: https://dl.acm.org/doi/10.1145/3658644.3670307 [6] S. Bhattacharya, D. Helo, and J. Siegel, “Impact of Network Topology

11

on Byzantine Resilience in Decentralized Federated Learning,” Jul. 2024, arXiv:2407.05141 [cs]. [Online]. Available: http://arxiv.org/abs/ 2407.05141 [7] A. Piaseczny, E. Ruzomberka, R. Parasnis, and C. G. Brinton, “Adversarial Node Placement in Decentralized Federated Learning: Maximum Spanning-Centrality Strategy and Performance Analysis,” IEEE Internet of Things Journal, vol. 12, no. 1, pp. 45–60, Jan. 2025. [Online]. Available: https://ieeexplore.ieee.org/document/10681487/ [8] R. Gaucher, A. Dieuleveut, and H. Hendrikx, “Unified Breakdown Analysis for Byzantine Robust Gossip.” [9] E. M. El-Mhamdi, S. Farhadkhani, R. Guerraoui, A. Guirguis, L.-N. Hoang, and S. Rouault, “Collaborative Learning in the Jungle (Decentralized, Byzantine, Heterogeneous, Asynchronous and Nonconvex Learning),” in Advances in Neural Information Processing Systems, vol. 34. Curran Associates, Inc., 2021, pp. 25 044– 25 057. [Online]. Available: https://proceedings.neurips.cc/paper files/ paper/2021/hash/d2cd33e9c0236a8c2d8bd3fa91ad3acf-Abstract.html [10] Y. Jia, M. Fang, and N. Z. Gong, “Competitive Advantage Attacks to Decentralized Federated Learning,” 2023, version Number: 2. [Online]. Available: https://arxiv.org/abs/2310.13862 [11] G. Syros, G. Yar, S. Boboila, C. Nita-Rotaru, and A. Oprea, “Backdoor attacks in peer-to-peer federated learning,” ACM Trans. Priv. Secur., vol. 28, no. 1, Dec. 2024. [Online]. Available: https://doi.org/10.1145/3691633 [12] M. Raynal, D. Pasquini, and C. Troncoso, “Can Decentralized Learning be more robust than Federated Learning?” [13] D. Pasquini, M. Raynal, and C. Troncoso, “On the (In)security of Peerto-Peer Decentralized Machine Learning,” Nov. 2023, arXiv:2205.08443 [cs]. [Online]. Available: http://arxiv.org/abs/2205.08443 [14] P. Blanchard, E. M. E. Mhamdi, R. Guerraoui, and J. Stainer, “Machine Learning with Adversaries: Byzantine Tolerant Gradient Descent.” [15] E. M. E. Mhamdi, R. Guerraoui, and S. Rouault, “The Hidden Vulnerability of Distributed Learning in Byzantium,” Jul. 2018, arXiv:1802.07927 [stat]. [Online]. Available: http://arxiv.org/abs/1802. 07927 [16] D. Yin, Y. Chen, K. Ramchandran, and P. Bartlett, “Byzantine-Robust Distributed Learning: Towards Optimal Statistical Rates,” Feb. 2021, arXiv:1803.01498 [cs]. [Online]. Available: http://arxiv.org/abs/1803. 01498 [17] X. Cao, M. Fang, J. Liu, and N. Z. Gong, “FLTrust: Byzantinerobust Federated Learning via Trust Bootstrapping,” Apr. 2022, arXiv:2012.13995 [cs]. [Online]. Available: http://arxiv.org/abs/2012. 13995 [18] Z. Zhang, X. Cao, J. Jia, and N. Z. Gong, “FLDetector: Defending federated learning against model poisoning attacks via detecting malicious clients,” in Proc. of KDD ’22. ACM, 2022, pp. 2545–2555, number of pages: 11. [19] E. Gabrielli, D. Belli, Z. Matrullo, V. Miori, and G. Tolomei, “Securing Federated Learning Against Extreme Model Poisoning Attacks via Multidimensional Time Series Anomaly Detection on Local Updates,” IEEE Transactions on Information Forensics and Security, vol. 20, pp. 9610–9624, 2025. [Online]. Available: https://ieeexplore.ieee.org/document/11164345/ [20] M. Fang, X. Cao, J. Jia, and N. Z. Gong, “Local Model Poisoning Attacks to Byzantine-Robust Federated Learning.” [21] V. Shejwalkar and A. Houmansadr, “Manipulating the Byzantine: Optimizing Model Poisoning Attacks and Defenses for Federated Learning,” in Proceedings 2021 Network and Distributed System Security Symposium. Virtual: Internet Society, 2021. [Online]. Available: https://www.ndss-symposium.org/wp-content/ uploads/ndss2021 6C-3 24498 paper.pdf [22] S. P. Karimireddy, L. He, and M. Jaggi, “Learning from History for Byzantine Robust Optimization.” [23] M. Raynal and C. Troncoso, “On the Conflict Between Robustness and Learning in Collaborative Machine Learning,” in 2025 IEEE Symposium on Security and Privacy (SP), May 2025, pp. 2171–2189, iSSN: 2375-1207. [Online]. Available: https://ieeexplore.ieee.org/document/ 11023472/ [24] H. Faraoun, R. Bellafqira, G. Coatrieux, and K. Kallas, “FLARE: Federated Learning Attack via Robust Expectation-Based Backdooring Using GAN,” in 2025 International Conference on Emerging Technologies and Computing (IC ETC), Jun. 2025, pp. 1–6. [Online]. Available: https://ieeexplore.ieee.org/document/11141092/

[25] Z. Zhang, A. Panda, L. Song, Y. Yang, M. Mahoney, P. Mittal, R. Kannan, and J. Gonzalez, “Neurotoxin: Durable Backdoors in Federated Learning,” in Proceedings of the 39th International Conference on Machine Learning. PMLR, Jun. 2022, pp. 26 429–26 446. [Online]. Available: https://proceedings.mlr.press/v162/zhang22w.html [26] H. Wang, K. Sreenivasan, S. Rajput, H. Vishwakarma, S. Agarwal, J.-y. Sohn, K. Lee, and D. Papailiopoulos, “Attack of the Tails: Yes, You Really Can Backdoor Federated Learning,” Jul. 2020, arXiv:2007.05084 [cs, stat]. [Online]. Available: http://arxiv.org/abs/2007.05084 [27] Z. Sun, P. Kairouz, A. T. Suresh, and H. B. McMahan, “Can You Really Backdoor Federated Learning?” Dec. 2019, arXiv:1911.07963 [cs]. [Online]. Available: http://arxiv.org/abs/1911.07963 [28] C. Xie, K. Huang, P.-Y. Chen, and B. Li, “DBA: Distributed backdoor attacks against federated learning,” in International conference on learning representations, 2020. [Online]. Available: https://openreview. net/forum?id=rkgyS0VFvr [29] Y. LeCun, C. Cortes, and C. J. Burges, “Mnist handwritten digit database,” ATT Labs Research, vol. 2, 2010. [Online]. Available: http://yann.lecun.com/exdb/mnist/ [30] S. Li and T. Tian, “Resistance Between Two Nodes of a Ring Clique Network,” Circuits, Systems, and Signal Processing, vol. 41, no. 3, pp. 1287–1298, Mar. 2022. [Online]. Available: https://doi.org/10.1007/s00034-021-01859-7 [31] J. Kim, W. J. Dally, S. Scott, and D. Abts, “Technology-driven, highlyscalable dragonfly topology,” in Proceedings of the 35th International Symposium on Computer Architecture, 2008, pp. 77–88. [32] A.-L. Barabasi and R. Albert, “Emergence of scaling in random networks,” Science, vol. 286, no. 5439, pp. 509– 512, Oct. 1999, arXiv:cond-mat/9910332. [Online]. Available: http://arxiv.org/abs/cond-mat/9910332 [33] B. Karrer and M. E. J. Newman, “Stochastic blockmodels and community structure in networks,” Physical Review E, vol. 83, no. 1, p. 016107, 2011. [34] S. P. Borgatti and M. G. Everett, “Models of core/periphery structures,” Social Networks, vol. 21, no. 4, pp. 375–395, 2000. [35] M. Penrose, Random Geometric Graphs. Oxford University Press, 2003. [36] T. Gu, B. Dolan-Gavitt, and S. Garg, “BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chain.”

12

Related documents

• Optimizing Byzantine Node Placement in Decentralized Federated Learning#821530
• SPADE-DFL: Communication-Efficient Decentralized Federated Learning via Derivative-Free Linearized ADMM#1108688
• SPADE-DFL: Communication-Efficient Decentralized Federated Learning via Derivative-Free Linearized ADMM#1077375
• Towards Serverless Semi-Decentralized Federated Learning with Heterogeneous Optimizers#266140
• SeedFlood: A Step Toward Scalable Decentralized Fine-Tuning of LLMs#1156287