Noise piles up hop by hop in ring federated learning: FedSharp holds 93.5%+ MNIST accuracy with 33 Byzantine nodes

In decentralized federated learning, link noise accumulates hop by hop around a ring topology, and residual noise becomes more prominent as the learning rate decays, letting Byzantine nodes slip into aggregation through low-loss ranking. Earlier single-model-selection schemes take only the lowest-loss model each round, so the noise term does not shrink as the learning rate falls, and a hidden attacker sending the honest model mean is favored because it carries less accumulated noise. On a 100-node ring with 33 Byzantine nodes, under Gaussian and hidden attacks and IID and non-IID data, FedSharp reaches 93.5%–94.9% accuracy on MNIST, against 29.4%–38.1% for the single-model-selection baseline.

Each node stores the latest model copy from each predecessor, so at least half of the candidate set consists of honest copies, and only a guaranteed-honest fraction needs to be averaged. Single-model selection uses one model, which neither reduces fresh link noise nor limits attacker weight; averaging several models divides the variance of independent link noise by the number of copies averaged. Screening first removes single-parameter deviations by the peak ratio of coordinate-wise median deviation, then keeps the lowest-loss candidates on a local mini-batch and averages them with equal weights; on MNIST this combination stays within about one percentage point of the baseline operating without channel noise.

Local training applies a gradient-norm penalty whose weight follows the accumulated noise, plus a proximal term that limits model drift under non-IID data. Earlier noise-robust objectives set the penalty weight from the noise variance of a single link, whereas a model in a ring carries multi-hop accumulated noise, so the weight must grow as the learning rate decays. On CIFAR-10 under non-IID data and hidden attack, FedSharp reaches 33.0% accuracy versus 31.6% for Basil+ACDS without exchanging raw training data; from a single run this gap is not enough to establish a statistically significant improvement.

The demonstrated setting is a 100-node directed ring with 33 Byzantine nodes, MNIST and CIFAR-10, compared with Basil and Basil+ACDS under Gaussian and hidden attacks and IID and Dirichlet non-IID partitions; senders are authenticated, with at most one copy per identity per window.

The 33.0% versus 31.6% gap on CIFAR-10 under non-IID data and hidden attack comes from a single run and is not enough to establish a statistically significant improvement; performance degradation under strongly non-IID data remains a direction for future research.