FoolsGold Cosine-Similarity Sybil Defense for Federated Learning
Algorithms AIMech:FoolsGoldCosineSimilaritySybilDefenseForFederatedLearning DRAFT
Aliases: FoolsGold, FoolsGold Sybil-Resilient Federated Aggregation, FoolsGold Contribution-Similarity Adaptive Learning Rate
A sybil-resilient federated learning aggregation algorithm that tracks each client's cumulative historical gradient vector H_i = sum_{t=1}^T Delta_{i,t}, computes pairwise indicative-feature weighted cosine similarities cs_{ij} between historical updates, applies a ratio-based pardoning rule cs_{ij} *= v_i / v_j whenever v_j > v_i (where v_i = max_{k != i} cs_{ik}) to avoid penalizing honest clients, inverts and max-normalizes the row-wise maximum similarities into alpha_i = (1 - max_j cs_{ij}) / max_k(1 - max_j cs_{kj}), and rescales client learning rates via a centered logit function alpha_i = clip_{[0,1]}(kappa * (ln(alpha_i / (1 - alpha_i)) + 0.5)) before updating w_{t+1} = w_t + sum_i alpha_i Delta_{i,t}.
Identity Notes & Concept Scope
Distinct from FLTrust (which computes cosine similarity against a central server's root-dataset reference gradient g_0 rather than pairwise historical inter-client similarity with pardoning and logit inversion), and distinct from majority-bounded distance filters (Krum, Multi-Krum, Bulyan) that assume fewer than 50% malicious clients. Specifically denotes the FoolsGold algorithm of Fung, Yoon, & Beschastnikh (RAID 2020 / arXiv:1808.04866, Section 5, Algorithm 1, and Appendix A).
Claims & Grounded Evidence
3 Claims
Mechanism
#r526-historical-indicative-cosine-pardoning-and-logit-weighting
In each synchronous round t, FoolsGold (Algorithm 1) accumulates client i's historical update H_i = sum_{tau=1}^t Delta_{i,tau}, computes S_t-weighted cosine similarity cs_{ij} over output-layer indicative features S_t, sets v_i = max_j cs_{ij}, pardons clients with lower maximum similarity via cs_{ij} *= v_i / v_j when v_j > v_i, computes normalized trust alpha_i = (1 - max_j cs_{ij}) / max_k(1 - max_j cs_{kj}), and applies alpha_i = clip_{[0,1]}(kappa * (ln(alpha_i / (1 - alpha_i)) + 0.5)) to update w_{t+1} = w_t + sum_i alpha_i Delta_{i,t}.
Scope
#r526-sybil-majority-resilience-and-convergence-conditions
Without requiring an upper bound on the number of sybils or a server validation dataset, FoolsGold suppresses colluding sybil groups (including scenarios where sybils constitute up to 99% of participants, A-99) and preserves O(1/T^2) SGD convergence (Appendix A) whenever asymptotic sybil similarity exceeds beta_m >= 1 - e^{-0.5*kappa}/(1 + e^{-0.5*kappa}) (driving h(i,t) -> 0) and honest inter-client similarity satisfies beta_g <= 1 - e^{0.5*kappa}/(1 + e^{0.5*kappa}) (keeping h(i,t) -> 1).
Limitation
#r526-single-adversary-and-adaptive-threshold-limitation
Because FoolsGold identifies attackers solely through pairwise inter-client update similarity, it cannot detect a poisoning attack mounted by a single non-colluding malicious client (Attack A-1, requiring augmentation with Multi-Krum at f = 1) and can be bypassed if an informed adversary spawns sufficiently many sybils to rate-limit poisoned updates below a similarity threshold M (Algorithm 2).
⚠️ Curated Limitations & Negative Results
- Cannot detect a poisoning attack executed by a single non-colluding malicious client without sybils (Attack A-1), requiring composition with a single-outlier filter such as Multi-Krum.
- Incompatible with cryptographic secure aggregation protocols that hide individual client update vectors from the central server.
Artificial Intelligence Ontology (AIO) Grounding
Mapped AIO Classes
| AIO Target Class | Mapping Relation | Mapping Rationale |
|---|---|---|
AIO:FederatedLearning
Federated Learning
|
broad_match | FoolsGold is a sybil-resilient client update weighting and aggregation method for federated learning. |
Evidence Sources & Primary Literature
3 Sources| Source ID | Publication / Document | Type / Access | Reference & Checksum |
|---|---|---|---|
r526-primary-pdf
|
Clement Fung, Chris J. M. Yoon, Ivan Beschastnikh
|
primary paper
full_text
|
ID: https://www.usenix.org/conference/raid2020/presentation/fung
sha256:f0fa58338123…
|
r526-arxiv-abs
|
Clement Fung, Chris J. M. Yoon, Ivan Beschastnikh
|
primary paper
abstract_only
|
ID: https://arxiv.org/abs/1808.04866
sha256:b364d83bc803…
|
r526-metadata-cr
|
Clement Fung, Chris J. M. Yoon, Ivan Beschastnikh
|
primary paper
abstract_only
|
ID: https://www.usenix.org/conference/raid2020/presentation/fung
sha256:ac84f3c518fe…
|
Ontology & Grounding Topology
Open in interactive network graph →Curation Provenance
Curator: Antigravity
Method: ai_assisted
Model: Gemini
Created: 2026-10-19T10:09:00Z
Updated: 2026-10-19T10:09:00Z
Source File:
data/curated/FoolsGoldCosineSimilaritySybilDefenseForFederatedLearning.yaml
· Schema:
curated_concept.yaml
Explore across X-Mech
Related computational & biological Mechs:
Embedding Map
Network Graph
ProteinTraitsMech (ESM-2 pLM)
DUFMech (Domain pLM)
TraitMech
CultureMech
All 14 X-Mech Repositories