# Byzantine-Robust Aggregation

Oilfield sites split each local-traffic update into secret shares so two non-colluding servers learn only accept or reject, holding macro-F1 at 0.641 against a 30% adaptive attacker where FedAvg falls to 0.046.

Oilfield sites split each local-traffic update into secret shares so two non-colluding servers learn only accept or reject, holding macro-F1 at 0.641 against a 30% adaptive attacker where FedAvg falls to 0.046.

In federated LLM fine-tuning, a server using the strong Byzantine-robust aggregator RandEigen filters out existing text-watermark updates as outliers, but optimizing the watermarked samples' input embeddings to sit close to clean updates keeps the watermark detectable by black-box access from a single client's 3.3% effective watermarked data.

In federated LLM fine-tuning, a server using the strong Byzantine-robust aggregator RandEigen filters out existing text-watermark updates as outliers, but optimizing the watermarked samples' input embeddings to sit close to clean updates keeps the watermark detectable by black-box access from a single client's 3.3% effective watermarked data.