LiBRA: Logit Fingerprints for Byzantine-Robust Client Selection in Federated Learning

Abstract

Byzantine-robust aggregation shields federated learning from malicious updates, but the rules that filter out suspect updates do so by comparing clients' parameter vectors. That comparison requires access to every client's update, which secure aggregation exists to withhold, costs $O(n^2 d)$ in the parameter dimension $d$, and is defined only between clients that share an architecture. We propose LiBRA, which compares clients on what their models compute rather than on the parameters that compute them, using a fingerprint of $C^2$ values for $C$ classes, the class-conditional logit response of each client's model to pseudo-patterns optimised against it. We instantiate LiBRA as variants of Krum, Multi-Krum and Bulyan that change only what the dissimilarity score is computed on. On Fashion-MNIST and CIFAR-10 with three architectures and four backdoor and label-manipulation attacks under i.i.d. partitions, each variant holds every attack its parent holds, and on identical client updates under a backdoor attack the fingerprint ranks malicious clients within 0.006 AUC of the full parameter vector. The variants thus match the robustness of the rules they extend, while their trust decision reads no client parameter, compares up to 49,090 times fewer values, and can by construction compare clients whose architectures differ, at the cost of one pattern optimisation per client per round.