Home / Curated / Algorithms / FLTrust (Byzantine-Robust Federated Learning via Trust Bootstrapping)

FLTrust (Byzantine-Robust Federated Learning via Trust Bootstrapping)

Algorithms AIMech:FlTrustByzantineRobustFederatedLearningViaTrustBootstrapping DRAFT

Aliases: FLTrust, Federated Learning via Trust Bootstrapping, Byzantine-Robust Federated Learning via Trust Bootstrapping

FLTrust (Byzantine-Robust Federated Learning via Trust Bootstrapping) is a server-bootstrapped Byzantine-robust federated learning algorithm in which the service provider maintains a small clean root dataset D_0 (e.g., 100 examples) and computes a server model update g_0 in each iteration, assigns each client update g_i a trust score equal to its ReLU-clipped cosine similarity TS_i = ReLU(<g_i, g_0> / (||g_i|| ||g_0||)), rescales each client update onto the server update's l2-hypersphere via bar_g_i = (||g_0|| / ||g_i||) g_i, and updates the global model using the trust-weighted average g = (1 / sum_{j=1}^n TS_j) sum_{i=1}^n TS_i bar_g_i.

Identity Notes & Concept Scope Introduced by Xiaoyu Cao, Minghong Fang, Jia Liu, and Neil Zhenqiang Gong in 'FLTrust: Byzantine-robust Federated Learning via Trust Bootstrapping' (NDSS 2021, DOI:10.14722/ndss.2021.24434; arXiv:2012.13995). Distinct from client-only statistical outlier defenses (Krum, Blanchard et al. 2017; Coordinate-Wise Median and Trimmed Mean, Yin et al. 2018; Bulyan, El Mhamdi et al. 2018), which have no server root of trust and break down when malicious clients reach >= 50% (or >= 25% for Bulyan) or craft adaptive local model poisoning updates.

Claims & Grounded Evidence

3 Claims

Mechanism #fltrust-relu-cosine-trust-score-and-hypersphere-normalization

In each global iteration, FLTrust computes the cosine similarity c_i = <g_i, g_0> / (||g_i|| ||g_0||) between client i's update g_i and the server's root-dataset update g_0, clips negative cosine similarities via TS_i = ReLU(c_i) = max(0, c_i) (Equation 2) so updates pointing in the opposite hemisphere are excluded, projects each local update onto the l2-hypersphere of radius ||g_0|| via bar_g_i = (||g_0|| / ||g_i||) g_i (Equation 3) to cap large-norm scaling attacks while amplifying small-norm benign updates, and computes g = (1 / sum_{j=1}^n ReLU(c_j)) sum_{i=1}^n ReLU(c_i) (||g_0|| / ||g_i||) g_i (Equation 4).

supports Source: FLTrust: Byzantine-robust Federated Learning via Trust Bootstrapping · Locator: Section IV-B, Equations (2)-(5) and Figure 2, pages 5-6

Mechanism #fltrust-convergence-bound-for-arbitrary-malicious-client-fraction

Lemma 1 (Appendix A, Equations 13-24) proves that for an arbitrary number of malicious clients, positive cosine alignment <bar_g_i, g_0> > 0 for all i in S and norm equality ||bar_g_i|| = ||g_0|| guarantee ||g - nabla F(w)|| <= 3 ||g_0 - nabla F(w)|| + 2 ||nabla F(w)||, and Theorem 1 proves that under mu-strong convexity, L-smoothness, and sub-exponential gradients on root dataset D_0, ||w^t - w^*|| <= (1 - rho)^t ||w^0 - w^*|| + 12 alpha Delta_1 / rho with probability at least 1 - delta.

supports Source: FLTrust: Byzantine-robust Federated Learning via Trust Bootstrapping · Locator: Section IV-D, Theorem 1, page 7; Appendix A, Lemmas 1-4, pages 16-18

Application #fltrust-resilience-against-poisoning-and-adaptive-attacks-up-to-60-percent-malicious

Using a root dataset of only |D_0| = 100 examples across six datasets (MNIST-0.1, MNIST-0.5, Fashion-MNIST, CIFAR-10, HAR, and CH-MNIST), FLTrust maintains test error within 0.04 of unattacked FedAvg and backdoor Scaling attack success rate <= 0.03 under Label Flipping, Krum attack, Trim attack, Scaling attack, and zeroth-order adaptive attacks (Algorithm 3), tolerating 40%-60% colluding adaptive malicious clients and up to 90% malicious clients on MNIST-0.5 (Table III and Figures 6-7).

supports Source: FLTrust: Byzantine-robust Federated Learning via Trust Bootstrapping · Locator: Section VI-B, Tables III-IV and Figures 6-7, pages 11-14

⚠️ Curated Limitations & Negative Results

Requires the service provider to collect and maintain a clean root dataset D_0 free from poisoning; if D_0 is heavily biased toward a single class (e.g., bias probability >= 0.8 in Table V), test error degrades sharply under adaptive attacks.
Incurs additional server-side computation in each round to run R_l local SGD steps on D_0 to obtain the reference update g_0.

Artificial Intelligence Ontology (AIO) Grounding

Mapped AIO Classes

AIO Target Class	Mapping Relation	Mapping Rationale
`AIO:FederatedLearning` Federated Learning	broad_match	FLTrust is a Byzantine-robust federated learning aggregation and training protocol under AIO:FederatedLearning.

Evidence Sources & Primary Literature

3 Sources

Source ID	Publication / Document	Type / Access	Reference & Checksum
`r519-primary-pdf`	FLTrust: Byzantine-robust Federated Learning via Trust Bootstrapping Xiaoyu Cao, Minghong Fang, Jia Liu, Neil Zhenqiang Gong	primary paper full_text	ID: https://dblp.org/rec/conf/ndss/CaoF0G21 sha256:5b4efd6b3ccd…
`r519-arxiv-abs`	FLTrust: Byzantine-robust Federated Learning via Trust Bootstrapping (arXiv abstract) Xiaoyu Cao, Minghong Fang, Jia Liu, Neil Zhenqiang Gong	primary paper abstract_only	ID: https://arxiv.org/abs/2012.13995 sha256:1a0da18c3345…
`r519-metadata-cr`	FLTrust: Byzantine-robust Federated Learning via Trust Bootstrapping (Crossref metadata) Xiaoyu Cao, Minghong Fang, Jia Liu, Neil Zhenqiang Gong	primary paper abstract_only	ID: https://dblp.org/rec/conf/ndss/CaoF0G21 sha256:bfbba2075d85…

Ontology & Grounding Topology

Open in interactive network graph →

Curation Provenance

Curator: Antigravity

Method: ai_assisted

Model: Gemini

Created: 2026-10-19T10:02:00Z

Updated: 2026-10-19T10:02:00Z

Source File: data/curated/FlTrustByzantineRobustFederatedLearningViaTrustBootstrapping.yaml · Schema: curated_concept.yaml

Explore across X-Mech

Related computational & biological Mechs: Embedding Map Network Graph ProteinTraitsMech (ESM-2 pLM) DUFMech (Domain pLM) TraitMech CultureMech All 14 X-Mech Repositories