FedLNS: Leverage LayerNorm Signature Modeling to Mitigate Adversarial Manipulation in Federated LLMs

# FedLNS: Leverage LayerNorm Signature Modeling to Mitigate Adversarial Manipulation in Federated LLMs
Source: [https://arxiv.org/html/2608.18736](https://arxiv.org/html/2608.18736)
Jong\-Ik ParkCarlee Joe\-WongWei NiFalko DresslerThanks:K\.˜Li is with the Interdisciplinary Centre for Security, Reliability and Trust \(SnT\), University of Luxembourg \(E\-mail: kaili@ieee\.org\)\.Thanks:J\.˜Park and C\.˜Joe\-Wong are with the Department of Electrical and Computer Engineering, Carnegie Mellon University, Pennsylvania, United States \(E\-mail: \{jongikp, cjoewong\}@andrew\.cmu\.edu\)\.Thanks:W\.˜Ni is with the School of Engineering, Edith Cowan University, Perth, WA 6027, Australia \(E\-mail: wei\.ni@ieee\.org\)\.Thanks:F\.˜Dressler is with the School of Electrical Engineering and Computer Science, TU Berlin, Germany\.Thanks:K\.˜Li and J\.˜Park contributed equally to this work\.

###### Abstract

Federated training enables language models to learn from distributed private text, but the server cannot directly verify the local supervision or optimization process that produces each client update\. A malicious client can therefore train on corrupted targets, introduce incorrect context–token associations, and degrade the global model through repeated aggregation\. Such degradation can also increase the risk of unreliable or hallucinatory generation\. We propose*Federated Learning with Normalization Signatures*\(FedLNS\), a server\-side framework forlightweight malicious\-update screening\.FedLNSrepresents each client update through changes in trainable normalization\-layer parameters and screens suspicious updates against a robust, history\-aware cross\-client reference\. Because the signatures are extracted at the server from the returned local models,FedLNSrequires no additional client\-to\-server parameter or metadata exchange compared to standard federated learning \(FL\) methods\. After screening, the retained full\-model updates can be aggregated using standard FL or another compatible aggregation rule\. Experiments on GPT\-style, BERT\-style, and LLaMA\-style models trained from scratch with 200 clients show that, under 40% population\-level target manipulation,FedLNSachieves lower test perplexity than the strongest of six baselines for all three architectures under both IID \(independently and identically distributed\) and non\-IID data partitions\.

###### Index Terms:

Federated Learning, Federated Language Models, Malicious\-Update Screening, Robust Aggregation, Normalization Layers\.

## IIntroduction

Large language models \(LLMs\) increasingly support search, question answering, software development, decision assistance, and human–computer interaction\. Their effectiveness in specialized applications often depends on domain\-specific text distributed across users, organizations, and devices\[[7](https://arxiv.org/html/2608.18736#bib.bib32),[27](https://arxiv.org/html/2608.18736#bib.bib30)\]\. Centralizing such data may be infeasible because of privacy, ownership, confidentiality, or regulatory constraints\[[1](https://arxiv.org/html/2608.18736#bib.bib7),[13](https://arxiv.org/html/2608.18736#bib.bib31),[28](https://arxiv.org/html/2608.18736#bib.bib33)\]\. Federated learning \(FL\) addresses this limitation by coordinating a shared model without collecting raw client data: in each communication round, the server broadcasts the current global model, selected clients optimize it locally, and the server aggregates their returned updates\[[24](https://arxiv.org/html/2608.18736#bib.bib26),[51](https://arxiv.org/html/2608.18736#bib.bib27),[45](https://arxiv.org/html/2608.18736#bib.bib25)\]to begin another training round\.

This privacy\-preserving separation also creates a critical security gap\. The server observes the returned updates but cannot directly verify the local inputs, targets, and optimization procedures that produced them\[[51](https://arxiv.org/html/2608.18736#bib.bib27),[46](https://arxiv.org/html/2608.18736#bib.bib29),[50](https://arxiv.org/html/2608.18736#bib.bib28)\]\. A malicious client can therefore manipulate its local objective and submit a harmful update while otherwise following the communication protocol\. Detecting such behavior is especially difficult for federated language models because each update may contain millions or billions of parameters, and benign client updates can also vary substantially\.

This work considers*malicious target manipulation*, as illustrated in Figure[1](https://arxiv.org/html/2608.18736#S1.F1)\. In causal language modeling, the target at each position is the next token, whereas in masked language modeling, it is the original token hidden by the masking process\. A malicious client replaces these targets with incorrect tokens, optimizes false context–target associations, and submits the resulting update to the server\. If such updates are accepted and repeatedly aggregated at the server, they can propagate corrupted training signals into the global model, reducing test set performance and distorting the model’s predictive distribution over token continuations\[[47](https://arxiv.org/html/2608.18736#bib.bib6)\]\. These effects may consequently increase the risk of semantically inconsistent or hallucinatory generation\[[29](https://arxiv.org/html/2608.18736#bib.bib22),[3](https://arxiv.org/html/2608.18736#bib.bib21)\]\. The focus of this work is therefore screening suspicious client updates before aggregation, with improved generation reliability regarded as a downstream effect of limiting corrupted training signals\.

![Refer to caption](https://arxiv.org/html/2608.18736v1/ThreatModel-eps-converted-to.png)Fig\. 1:Threat model for malicious target manipulation in federated language\-model training\. A malicious client changes its local supervision and optimizes incorrect context–target associations\. If the resulting update is accepted, repeated aggregation can degrade the global model and increase the downstream risk of semantically unreliable generation\.Existing Byzantine\-robust FL methods suppress harmful updates through distance\-based selection, coordinate\-wise robust statistics, norm control, or clustering\-based filtering\[[5](https://arxiv.org/html/2608.18736#bib.bib34),[52](https://arxiv.org/html/2608.18736#bib.bib39),[41](https://arxiv.org/html/2608.18736#bib.bib38),[34](https://arxiv.org/html/2608.18736#bib.bib37)\]\. Because these methods operate on complete client updates, their server\-side processing remains tied to full\-model dimensionality, while high\-dimensional benign variation can obscure malicious deviations\.

Recent studies reduce the representation used for malicious\-update screening at a FL server through attack\-sensitive dimension selection or supervised analysis of parameter\-efficient updates\[[55](https://arxiv.org/html/2608.18736#bib.bib52),[42](https://arxiv.org/html/2608.18736#bib.bib53)\]\. These results show that screening need not rely on complete model updates\. However, an important question remains:*can suspicious updates be screened using a compact, architecture\-aware representation without labeled attack samples, trusted server data, or a separately trained detector?*

To address this question, we propose*Federated Learning with Normalization Signatures*\(FedLNS\), a server\-side framework for lightweight malicious\-update screening\. Instead of examining complete high\-dimensional updates,FedLNSconstructs a compact, architecture\-aware signature from changes in the trainable parameters of the model’s normalization layers\. These parameters control the scaling and, when supported by the architecture, shifting of hidden representations throughout transformer blocks\[[2](https://arxiv.org/html/2608.18736#bib.bib42),[44](https://arxiv.org/html/2608.18736#bib.bib43),[53](https://arxiv.org/html/2608.18736#bib.bib44),[48](https://arxiv.org/html/2608.18736#bib.bib45)\]\. Changes in these parameters therefore provide a compact, architecture\-aware view of how local training alters hidden model representations\.

For each participating client, the server extracts a normalization\-layer signature relative to the broadcast global model and compares it with a robust historical reference constructed from the latest signatures of previously observed clients\. These are compared to coordinate\-wise median and median absolute deviation \(MAD\) statistics to the influence of anomalous bank entries\[[52](https://arxiv.org/html/2608.18736#bib.bib39),[54](https://arxiv.org/html/2608.18736#bib.bib40)\]\.FedLNSthen employs regularized Gaussian mixture modeling with Bayesian Information Criterion \(BIC\) to determine whether the current participants form one coherent population or two populations with different deviation levels\. When two populations are identified,FedLNSretains the lower\-deviation, and thus more likely to be benign, group without requiring prior knowledge of the malicious\-client fraction\.

Because normalization\-layer signatures are extracted at the server from the returned local models,FedLNSadds no defense\-specific client transmission overhead\. After screening, the retained full\-model updates are aggregated using the standard sample\-weighted rule, which may be replaced with another compatible FL aggregation rule\.FedLNSrequires no raw client data, trusted server dataset, labeled malicious updates, separately trained detector, or auxiliary global models\. By limiting the incorporation of target\-corrupted updates,FedLNSaims to improve global\-model robustness and reduce predictive uncertainty under malicious target manipulation\.

Thecontributionsof this work are as follows:

- •Compact model update representation\.We introduce a normalization\-layer update signature that represents each client update through a small, architecture\-aware parameter subset rather than the complete high\-dimensional update\. Because the signature is extracted from the returned local model, it provides a modular representation for server\-side screening before full\-model aggregation is performed\.
- •Unsupervised history\-aware screening\.We develop a server\-side update retention rule that constructs a robust cross\-client reference from the latest observed signatures and combines median/MAD standardization with BIC\-guided mixture modeling\. The rule requires no raw client data, trusted server dataset, labeled updates, predefined malicious fraction, separately trained detector, or defense\-specific client\-to\-server payload\.
- •Cross\-architecture evaluation\.We evaluateFedLNSon GPT\-style, BERT\-style, and LLaMA\-style models with 200 clients, IID and two\-shard non\-IID partitions, and target manipulation affecting 0%–40% of the client population\. At 40%,FedLNSachieves lower perplexity than all six baselines for all three architectures under both IID and two\-shard non\-IID partitions\. The maximum reductions are 18\.57% in perplexity and 6\.50% in token\-level semantic entropy\.

The remainder of this paper is organized as follows\. Section[II](https://arxiv.org/html/2608.18736#S2)reviews the related work\. Section[III](https://arxiv.org/html/2608.18736#S3)presents theFedLNSframework\. Section[IV](https://arxiv.org/html/2608.18736#S4)provides the theoretical analysis\. Section[V](https://arxiv.org/html/2608.18736#S5)describes the experimental evaluation and performance analysis\. Section[VI](https://arxiv.org/html/2608.18736#S6)concludes the paper\.

## IIRelated Work

Prior work relevant toFedLNSspans two directions:*robust aggregation and malicious\-update screening*in FL and*parameter\-efficient or model\-internal representations*\.

### II\-ARobust Aggregation and Malicious\-Update Screening

Byzantine\-robust aggregation suppresses harmful FL updates using geometric, coordinate\-wise, or magnitude\-based properties\. Multi\-Krum selects updates that remain close to a majority neighborhood under pairwise distance\[[5](https://arxiv.org/html/2608.18736#bib.bib34)\]\. Coordinate\-wise Median and Trimmed Mean apply robust statistics independently across parameter dimensions\[[52](https://arxiv.org/html/2608.18736#bib.bib39)\], while norm\-bounded aggregation limits client influence through update clipping or rescaling\[[41](https://arxiv.org/html/2608.18736#bib.bib38)\]\. FLAME combines clustering, clipping, and noise injection to reduce the contribution of suspicious clients\[[34](https://arxiv.org/html/2608.18736#bib.bib37)\]\. Because these methods operate on*complete model updates*, their server\-side processing remains tied to full\-model dimensionality\.

Other FL defenses use trusted references, multiple models, or historical client behavior\. FLTrust constructs a reference update from trusted server data and scores client updates according to their agreement with this reference\[[8](https://arxiv.org/html/2608.18736#bib.bib35)\]\. FLCert partitions clients into groups, trains multiple global models, and combines their predictions to provide certified robustness\[[9](https://arxiv.org/html/2608.18736#bib.bib36)\]\. FLDetector predicts client\-update trajectories from previous communication rounds and detects persistent deviations from expected behavior\[[54](https://arxiv.org/html/2608.18736#bib.bib40)\]\. Together, these approaches rely on representative server data, additional model instances, or sufficiently regular client histories\.

Recent security methods reduce the representation analyzed during screening\. Dim\-Krum selects dimensions with stronger backdoor\-related changes and applies Krum\-based detection in the restricted space\[[55](https://arxiv.org/html/2608.18736#bib.bib52)\]\. Safe\-FedLLM extracts features from LoRA updates and trains an offline supervised probe using labeled benign and malicious samples\[[42](https://arxiv.org/html/2608.18736#bib.bib53)\]\. These methods show that malicious\-update screening need not process every model parameter, but they rely, respectively, on attack\-sensitive coordinate selection or labeled update samples and a separately trained probe\.

### II\-BParameter\-Efficient Adaptation and Model\-Internal Signals

Parameter\-efficient adaptation shows that task\-relevant model changes can be expressed through restricted trainable subsets\. Adapter tuning introduces small trainable modules\[[23](https://arxiv.org/html/2608.18736#bib.bib47)\]; BitFit updates only bias parameters\[[4](https://arxiv.org/html/2608.18736#bib.bib48)\]; and IA3learns compact vectors that scale intermediate activations\[[31](https://arxiv.org/html/2608.18736#bib.bib49)\]\. LN\-Tuning adapts language models through normalization gain and bias parameters\[[36](https://arxiv.org/html/2608.18736#bib.bib50)\]\. Although designed for adaptation rather than security, these methods demonstrate that comparatively small parameter subsets can encode meaningful changes induced by local optimization\.

Normalization layers form a structurally repeated parameter subset in transformer architectures\. They regulate the scaling and, depending on the formulation, shifting of normalized hidden representations\[[2](https://arxiv.org/html/2608.18736#bib.bib42),[44](https://arxiv.org/html/2608.18736#bib.bib43),[53](https://arxiv.org/html/2608.18736#bib.bib44)\]\. Prior work further shows that their placement and behavior affect optimization, gradient propagation, and transformer expressivity\[[48](https://arxiv.org/html/2608.18736#bib.bib45),[6](https://arxiv.org/html/2608.18736#bib.bib46)\]\. Their restricted parameterization and recurring role across transformer blocks provide the architectural basis for studying normalization\-parameter changes as client\-update signals\.

Language\-model reliability has also been studied through output grounding, uncertainty, and internal model signals\. Grounding\-based methods compare generations with source evidence, knowledge representations, or semantic relations\[[17](https://arxiv.org/html/2608.18736#bib.bib11),[35](https://arxiv.org/html/2608.18736#bib.bib13),[20](https://arxiv.org/html/2608.18736#bib.bib14),[19](https://arxiv.org/html/2608.18736#bib.bib12)\], while uncertainty\- and consistency\-based approaches use semantic entropy, confidence, or response agreement\[[18](https://arxiv.org/html/2608.18736#bib.bib17),[12](https://arxiv.org/html/2608.18736#bib.bib23),[38](https://arxiv.org/html/2608.18736#bib.bib16),[56](https://arxiv.org/html/2608.18736#bib.bib15)\]\. Other work examines token\-level behavior, multimodal consistency, hidden representations, or activation anomalies\[[22](https://arxiv.org/html/2608.18736#bib.bib24),[11](https://arxiv.org/html/2608.18736#bib.bib20),[21](https://arxiv.org/html/2608.18736#bib.bib19),[39](https://arxiv.org/html/2608.18736#bib.bib18),[10](https://arxiv.org/html/2608.18736#bib.bib51),[16](https://arxiv.org/html/2608.18736#bib.bib9)\], and system\-level objectives have incorporated hallucination risk directly\[[32](https://arxiv.org/html/2608.18736#bib.bib10)\]\. These studies analyze outputs, activations, or uncertainty rather than federated model updates, but they establish model\-internal signals as useful indicators of unreliable LLM behavior\.

FedLNScombines a compact normalization\-parameter representation with unsupervised, history\-aware malicious\-update screening\. Unlike trusted\-reference, multi\-model, and trajectory\-prediction defenses, it constructs a cross\-client reference from ordinary federated participation\. It also differs from Dim\-Krum and Safe\-FedLLM by requiring neither attack\-sensitive coordinate selection, labeled update samples, nor a separately trained detector\.

## IIIThe Proposed FedLNS Defense Framework

This section presentsFedLNS, which integrates a historical normalization\-signature bank, layer\-wise median/MAD statistical modeling, and BIC\-guided Gaussian mixture clustering\. Algorithm[1](https://arxiv.org/html/2608.18736#alg1)presents the overall procedure, which includes local client training \(Algorithm[2](https://arxiv.org/html/2608.18736#alg2)\), server\-side signature screening and aggregation \(Algorithm[3](https://arxiv.org/html/2608.18736#alg3)\), and the BIC\-guided one\-vs\-two\-component GMM rule for retaining client updates \(Algorithm[4](https://arxiv.org/html/2608.18736#alg4)\)\.

We consider*an honest server with persistent client identifiers and server\-controlled client sampling\.*A fixed subset containing less than half of the client population performs malicious target manipulation while otherwise following the prescribed communication protocol in order to avoid detection by the server\. Thus, our threat model excludes Sybil identities, client\-ID resets, and adversaries that explicitly optimize their normalization\-parameter changes to mimic benign signatures, all of which may be interesting directions for future work\.

### III\-AFederated Training and Client Updates

Algorithm[1](https://arxiv.org/html/2608.18736#alg1)presents the federated training procedure withKKclients indexed by

𝒞=\{1,…,K\}\.\\mathcal\{C\}=\\\{1,\\dots,K\\\}\.At communication roundtt, the server samples a participating\-client set𝒮t⊆𝒞\\mathcal\{S\}\_\{t\}\\subseteq\\mathcal\{C\}and broadcasts the current global model parameters𝐰t∈ℝP\\mathbf\{w\}\_\{t\}\\in\\mathbb\{R\}^\{P\}to the selected clients \(Algorithm[1](https://arxiv.org/html/2608.18736#alg1), lines[5](https://arxiv.org/html/2608.18736#alg1.l5)–[6](https://arxiv.org/html/2608.18736#alg1.l6)\), whereNt:=\|𝒮t\|N\_\{t\}:=\|\\mathcal\{S\}\_\{t\}\|\.

Clientiitrains on its local dataset𝒟i\\mathcal\{D\}\_\{i\}to minimize the empirical objective

Fi​\(𝐰\):=1\|𝒟i\|​∑ξ∈𝒟iℓ⁡\(𝐰,ξ\),F\_\{i\}\(\\mathbf\{w\}\):=\\frac\{1\}\{\|\\mathcal\{D\}\_\{i\}\|\}\\sum\_\{\\xi\\in\\mathcal\{D\}\_\{i\}\}\\ell\(\\mathbf\{w\};\\xi\),\(1\)whereℓ⁡\(⋅\)\\ell\(\\cdot\)denotes the language\-modeling loss function, e\.g\., the next\-token prediction loss for causal language modeling or the masked\-token prediction loss for masked language modeling\[[30](https://arxiv.org/html/2608.18736#bib.bib8)\]\. Here,ξ\\xirepresents an individual training instance sampled from𝒟i\\mathcal\{D\}\_\{i\}, such as a text sequence together with its associated supervision signal\.

Clientiiinitializes its local model from𝐰t\\mathbf\{w\}\_\{t\}\(Algorithm[2](https://arxiv.org/html/2608.18736#alg2), line[3](https://arxiv.org/html/2608.18736#alg2.l3)\), performsEElocal epochs using mini\-batch optimization \(lines[5](https://arxiv.org/html/2608.18736#alg2.l5)–[15](https://arxiv.org/html/2608.18736#alg2.l15)\), and returns the locally trained parameters and processed\-example count \(line[16](https://arxiv.org/html/2608.18736#alg2.l16)\):

\(𝐰t,i,nt,i\)=ClientLocalTrain⁡\(𝐰t,𝒟i,E\)\.\\left\(\\mathbf\{w\}\_\{t,i\},n\_\{t,i\}\\right\)=\\operatorname\{ClientLocalTrain\}\\left\(\\mathbf\{w\}\_\{t\},\\mathcal\{D\}\_\{i\},E\\right\)\.\(2\)Upon completing local training, clientiireturns the updated model parameters𝐰t,i\\mathbf\{w\}\_\{t,i\}together withnt,in\_\{t,i\}, the total number of training\-example occurrences processed across theEElocal epochs\. The corresponding client update is

Δ​𝐰t,i:=𝐰t,i−𝐰t\.\\Delta\\mathbf\{w\}\_\{t,i\}:=\\mathbf\{w\}\_\{t,i\}\-\\mathbf\{w\}\_\{t\}\.\(3\)
Because normalization\-layer signatures are extracted at the server from the returned local models, clients follow the standard FL training and upload procedure without transmitting defense\-specific parameters or metadata\. All signature extraction, bank maintenance, and GMM\-based screening are performed by the server\.

Algorithm 1FedLNScommunication\-round driver1:Initial global model parameters

𝐰0\\mathbf\{w\}\_\{0\}, client set

𝒞\\mathcal\{C\}, total rounds

TT, local epochs

EE, bank activation threshold

MactM\_\{\\mathrm\{act\}\}
2:Final global model parameters

𝐰T\\mathbf\{w\}\_\{T\}
3:Initialize server\-side history bank

ℬ−1=∅\\mathcal\{B\}\_\{\-1\}=\\emptysetand client\-ID set

ℋ−1=∅\\mathcal\{H\}\_\{\-1\}=\\emptyset
4:for

t=0,1,…,T−1t=0,1,\\dots,T\-1do

5:Sample participating clients

𝒮t⊆𝒞\\mathcal\{S\}\_\{t\}\\subseteq\\mathcal\{C\}
6:Broadcast

𝐰t\\mathbf\{w\}\_\{t\}to every client

i∈𝒮ti\\in\\mathcal\{S\}\_\{t\}
7:foreach client

i∈𝒮ti\\in\\mathcal\{S\}\_\{t\}in paralleldo

8:

\(𝐰t,i,nt,i\)←ClientLocalTrain⁡\(𝐰t,𝒟i,E\)\(\\mathbf\{w\}\_\{t,i\},n\_\{t,i\}\)\\leftarrow\\operatorname\{ClientLocalTrain\}\(\\mathbf\{w\}\_\{t\},\\mathcal\{D\}\_\{i\},E\)
9:endfor

10:

\(𝐰t\+1,ℛt,ℬt,ℋt\)←ServerFedLNS⁡\(𝐰t,\{\(𝐰t,i,nt,i\)\}i∈𝒮t,ℬt−1,ℋt−1,Mact\)\(\\mathbf\{w\}\_\{t\+1\},\\mathcal\{R\}\_\{t\},\\mathcal\{B\}\_\{t\},\\mathcal\{H\}\_\{t\}\)\\leftarrow\\newline \\operatorname\{ServerFedLNS\}\\left\(\\mathbf\{w\}\_\{t\},\\\{\(\\mathbf\{w\}\_\{t,i\},n\_\{t,i\}\)\\\}\_\{i\\in\\mathcal\{S\}\_\{t\}\},\\mathcal\{B\}\_\{t\-1\},\\mathcal\{H\}\_\{t\-1\},M\_\{\\mathrm\{act\}\}\\right\)
11:endfor

12:return

𝐰T\\mathbf\{w\}\_\{T\}

Algorithm 2ClientLocalTrain\(𝐰t,𝒟i,E\)\\left\(\\mathbf\{w\}\_\{t\},\\mathcal\{D\}\_\{i\},E\\right\)1:Global model parameters

𝐰t\\mathbf\{w\}\_\{t\}, local dataset

𝒟i\\mathcal\{D\}\_\{i\}, local epochs

EE
2:Local model parameters

𝐰t,i\\mathbf\{w\}\_\{t,i\}, processed\-example count

nt,in\_\{t,i\}
3:Initialize local model parameters

𝐰t,i←𝐰t\\mathbf\{w\}\_\{t,i\}\\leftarrow\\mathbf\{w\}\_\{t\}
4:Set

nt,i←0n\_\{t,i\}\\leftarrow 0
5:forlocal epoch

e=1,…,Ee=1,\\dots,Edo

6:formini\-batch

ℳ∈MiniBatchLoader⁡\(𝒟i\)\\mathcal\{M\}\\in\\operatorname\{MiniBatchLoader\}\(\\mathcal\{D\}\_\{i\}\)do

7:Set

ℒℳ←0\\mathcal\{L\}\_\{\\mathcal\{M\}\}\\leftarrow 0
8:foreach training instance

ξ∈ℳ\\xi\\in\\mathcal\{M\}do

9:

ℒℳ←ℒℳ\+ℓ⁡\(𝐰t,i,ξ\)\\mathcal\{L\}\_\{\\mathcal\{M\}\}\\leftarrow\\mathcal\{L\}\_\{\\mathcal\{M\}\}\+\\ell\(\\mathbf\{w\}\_\{t,i\};\\xi\)
10:

nt,i←nt,i\+1n\_\{t,i\}\\leftarrow n\_\{t,i\}\+1
11:endfor

12:

ℒℳ←ℒℳ/\|ℳ\|\\mathcal\{L\}\_\{\\mathcal\{M\}\}\\leftarrow\\mathcal\{L\}\_\{\\mathcal\{M\}\}/\|\\mathcal\{M\}\|
13:

𝐰t,i←OptimizerStep⁡\(𝐰t,i,∇𝐰ℒℳ​\(𝐰t,i\)\)\\mathbf\{w\}\_\{t,i\}\\leftarrow\\operatorname\{OptimizerStep\}\\left\(\\mathbf\{w\}\_\{t,i\},\\nabla\_\{\\mathbf\{w\}\}\\mathcal\{L\}\_\{\\mathcal\{M\}\}\(\\mathbf\{w\}\_\{t,i\}\)\\right\)
14:endfor

15:endfor

16:return

\(𝐰t,i,nt,i\)\(\\mathbf\{w\}\_\{t,i\},n\_\{t,i\}\)

After the participating clients return their locally trained models \(Algorithm[1](https://arxiv.org/html/2608.18736#alg1), line[8](https://arxiv.org/html/2608.18736#alg1.l8)\), the server invokesServerFedLNS\\operatorname\{ServerFedLNS\}\(line[10](https://arxiv.org/html/2608.18736#alg1.l10)\), described in Algorithm[3](https://arxiv.org/html/2608.18736#alg3), to screen the returned updates before global aggregation\.

### III\-BServer\-Side Normalization\-Signature Extraction

Algorithm[3](https://arxiv.org/html/2608.18736#alg3)computes each complete client update and extracts its layer\-wise normalization signature \(lines[4](https://arxiv.org/html/2608.18736#alg3.l4)–[5](https://arxiv.org/html/2608.18736#alg3.l5)\)\. Letℒ\\mathcal\{L\}denote the ordered set of normalization layers whose trainable parameters are included in theFedLNSsignature, and letdℓd\_\{\\ell\}denote the number of included parameters associated with layerℓ∈ℒ\\ell\\in\\mathcal\{L\}\. We define

𝐩ℓ​\(𝐰\)∈ℝdℓ\\mathbf\{p\}\_\{\\ell\}\(\\mathbf\{w\}\)\\in\\mathbb\{R\}^\{d\_\{\\ell\}\}as the vector formed by concatenating all trainable normalization parameters of layerℓ\\ellunder model parameters𝐰\\mathbf\{w\}\. For a standard LayerNorm layer,𝐩ℓ​\(𝐰\)\\mathbf\{p\}\_\{\\ell\}\(\\mathbf\{w\}\)consists of the trainable scaling and bias parameters\. For a bias\-free normalization mechanism such as RMSNorm, the vector contains only the trainable scaling parameters\.

For selected clienti∈𝒮ti\\in\\mathcal\{S\}\_\{t\}, the layer\-wise normalization signature is defined as

𝐬t,i,ℓ:=𝐩ℓ​\(𝐰t,i\)−𝐩ℓ​\(𝐰t\)∈ℝdℓ\.\\mathbf\{s\}\_\{t,i,\\ell\}:=\\mathbf\{p\}\_\{\\ell\}\(\\mathbf\{w\}\_\{t,i\}\)\-\\mathbf\{p\}\_\{\\ell\}\(\\mathbf\{w\}\_\{t\}\)\\in\\mathbb\{R\}^\{d\_\{\\ell\}\}\.\(4\)Thus,𝐬t,i,ℓ\\mathbf\{s\}\_\{t,i,\\ell\}measures how local training at clientiichanges the normalization parameters of layerℓ\\ellrelative to the current global model parameters𝐰t\\mathbf\{w\}\_\{t\}\.

The complete signature of clientiiis the ordered collection

𝐬t,i:=\(𝐬t,i,ℓ\)ℓ∈ℒ\.\\mathbf\{s\}\_\{t,i\}:=\\left\(\\mathbf\{s\}\_\{t,i,\\ell\}\\right\)\_\{\\ell\\in\\mathcal\{L\}\}\.\(5\)The signature is computed entirely at the server from the uploaded local models and the current global model\.

Algorithm 3ServerFedLNS: server\-side signature screening and aggregation1:Global model parameters

𝐰t\\mathbf\{w\}\_\{t\}, returned client models and counts

\{\(𝐰t,i,nt,i\)\}i∈𝒮t\\\{\(\\mathbf\{w\}\_\{t,i\},n\_\{t,i\}\)\\\}\_\{i\\in\\mathcal\{S\}\_\{t\}\}, previous bank

ℬt−1\\mathcal\{B\}\_\{t\-1\}, previous ID set

ℋt−1\\mathcal\{H\}\_\{t\-1\}, bank activation threshold

MactM\_\{\\mathrm\{act\}\}
2:Updated global model parameters

𝐰t\+1\\mathbf\{w\}\_\{t\+1\}, retained client set

ℛt\\mathcal\{R\}\_\{t\}, refreshed bank

ℬt\\mathcal\{B\}\_\{t\}, refreshed ID set

ℋt\\mathcal\{H\}\_\{t\}
3:foreach client

i∈𝒮ti\\in\\mathcal\{S\}\_\{t\}do

4:Compute

Δ​𝐰t,i=𝐰t,i−𝐰t\\Delta\\mathbf\{w\}\_\{t,i\}=\\mathbf\{w\}\_\{t,i\}\-\\mathbf\{w\}\_\{t\}
5:Extract

𝐬t,i,ℓ=𝐩ℓ​\(𝐰t,i\)−𝐩ℓ​\(𝐰t\)\\mathbf\{s\}\_\{t,i,\\ell\}=\\mathbf\{p\}\_\{\\ell\}\(\\mathbf\{w\}\_\{t,i\}\)\-\\mathbf\{p\}\_\{\\ell\}\(\\mathbf\{w\}\_\{t\}\)for all

ℓ∈ℒ\\ell\\in\\mathcal\{L\}
6:endfor

7:Refresh

ℬt\\mathcal\{B\}\_\{t\}and

ℋt\\mathcal\{H\}\_\{t\}using \([8](https://arxiv.org/html/2608.18736#S3.E8)\)–\([10](https://arxiv.org/html/2608.18736#S3.E10)\)

8:Compute

Ntbank=\|ℋt\|N\_\{t\}^\{\\mathrm\{bank\}\}=\|\\mathcal\{H\}\_\{t\}\|
9:if

Ntbank<MactN\_\{t\}^\{\\mathrm\{bank\}\}<M\_\{\\mathrm\{act\}\}then

10:Set

𝐰t\+1=𝐰t\\mathbf\{w\}\_\{t\+1\}=\\mathbf\{w\}\_\{t\}and

ℛt=∅\\mathcal\{R\}\_\{t\}=\\emptyset
11:return

\(𝐰t\+1,ℛt,ℬt,ℋt\)\(\\mathbf\{w\}\_\{t\+1\},\\mathcal\{R\}\_\{t\},\\mathcal\{B\}\_\{t\},\\mathcal\{H\}\_\{t\}\)
12:endif

13:foreach normalization layer

ℓ∈ℒ\\ell\\in\\mathcal\{L\}do

14:Compute

𝐦t,ℓ\\mathbf\{m\}\_\{t,\\ell\}and

𝐝t,ℓ\\mathbf\{d\}\_\{t,\\ell\}using \([14](https://arxiv.org/html/2608.18736#S3.E14)\)–\([16](https://arxiv.org/html/2608.18736#S3.E16)\)

15:endfor

16:foreach client

i∈𝒮ti\\in\\mathcal\{S\}\_\{t\}do

17:Compute

𝐳t,i\\mathbf\{z\}\_\{t,i\}using \([17](https://arxiv.org/html/2608.18736#S3.E17)\)–\([18](https://arxiv.org/html/2608.18736#S3.E18)\)

18:Compute

δt,i\\delta\_\{t,i\}using \([20](https://arxiv.org/html/2608.18736#S3.E20)\)

19:endfor

20:

ℛt←BICGMMRetain⁡\(\{𝐳t,i,δt,i\}i∈𝒮t\)\\mathcal\{R\}\_\{t\}\\leftarrow\\operatorname\{BICGMMRetain\}\\left\(\\\{\\mathbf\{z\}\_\{t,i\},\\delta\_\{t,i\}\\\}\_\{i\\in\\mathcal\{S\}\_\{t\}\}\\right\)
21:Aggregate retained updates using \([34](https://arxiv.org/html/2608.18736#S3.E34)\) to obtain

𝐰t\+1\\mathbf\{w\}\_\{t\+1\}
22:return

\(𝐰t\+1,ℛt,ℬt,ℋt\)\(\\mathbf\{w\}\_\{t\+1\},\\mathcal\{R\}\_\{t\},\\mathcal\{B\}\_\{t\},\\mathcal\{H\}\_\{t\}\)

Normalization parameters regulate the scaling and, depending on the architecture, shifting of hidden representations throughout transformer blocks\.FedLNStherefore uses changes in these parameters as a compact, architecture\-aware screening representation, while the complete returned model updates remain available for aggregation\.

### III\-CServer\-Side History Bank

FedLNSmaintains a server\-side history bank that stores the latest normalization\-layer signature associated with each client observed during training\. The resulting collection provides a cross\-client reference for constructing robust statistics across communication rounds\. Prior to processing roundtt, the history bank is defined as

ℬt−1=\{\(j,𝐛t−1,j\):j∈ℋt−1\},\\mathcal\{B\}\_\{t\-1\}=\\left\\\{\(j,\\mathbf\{b\}\_\{t\-1,j\}\):j\\in\\mathcal\{H\}\_\{t\-1\}\\right\\\},\(6\)whereℋt−1\\mathcal\{H\}\_\{t\-1\}denotes the set of client identifiers currently maintained in the bank\.

For each clientjj, the stored entry consists of an ordered collection of layer\-wise normalization\-signature vectors:

𝐛t−1,j=\(𝐛t−1,j,ℓ\)ℓ∈ℒ,\\mathbf\{b\}\_\{t\-1,j\}=\\left\(\\mathbf\{b\}\_\{t\-1,j,\\ell\}\\right\)\_\{\\ell\\in\\mathcal\{L\}\},\(7\)where𝐛t−1,j,ℓ\\mathbf\{b\}\_\{t\-1,j,\\ell\}represents the latest recorded signature corresponding to normalization layerℓ\\ellfor clientjj\.

After extracting the current signatures, the server replaces the bank entries of participating clients and retains the latest entries of nonparticipating clients \(Algorithm[3](https://arxiv.org/html/2608.18736#alg3), line[7](https://arxiv.org/html/2608.18736#alg3.l7)\)\. The updated client\-ID set is

ℋt=ℋt−1∪𝒮t\.\\mathcal\{H\}\_\{t\}=\\mathcal\{H\}\_\{t\-1\}\\cup\\mathcal\{S\}\_\{t\}\.\(8\)The refreshed bank is

ℬt=\{\(j,𝐛t,j\):j∈ℋt\},\\mathcal\{B\}\_\{t\}=\\left\\\{\(j,\\mathbf\{b\}\_\{t,j\}\):j\\in\\mathcal\{H\}\_\{t\}\\right\\\},\(9\)where

𝐛t,j=\{𝐬t,j,if​j∈𝒮t,𝐛t−1,j,if​j∈ℋt−1​and​j∉𝒮t\.\\mathbf\{b\}\_\{t,j\}=\\begin\{cases\}\\mathbf\{s\}\_\{t,j\},&\\text\{if \}j\\in\\mathcal\{S\}\_\{t\},\\\\\[4\.0pt\] \\mathbf\{b\}\_\{t\-1,j\},&\\text\{if \}j\\in\\mathcal\{H\}\_\{t\-1\}\\text\{ and \}j\\notin\\mathcal\{S\}\_\{t\}\.\\end\{cases\}\(10\)
If a client participates in the current communication round, its previous bank entry is replaced by the newly extracted normalization\-layer signature\. If the client does not participate, its latest stored signature remains unchanged\. As shown in Algorithm[3](https://arxiv.org/html/2608.18736#alg3), the bank is refreshed before current\-round screening\. Thus, all current signatures contribute to the refreshed bank, including signatures associated with updates that may subsequently be excluded from aggregation\.

The history bank is maintained entirely by the server and is not stored, accessed, or received by participating clients\.

After refreshing the bank, the server computes its current coverage and applies the activation rule \(Algorithm[3](https://arxiv.org/html/2608.18736#alg3), lines[8](https://arxiv.org/html/2608.18736#alg3.l8)–[11](https://arxiv.org/html/2608.18736#alg3.l11)\)\. Screening and global aggregation begin when

Ntbank≥Mact,N\_\{t\}^\{\\mathrm\{bank\}\}\\geq M\_\{\\mathrm\{act\}\},\(11\)where

Ntbank:=\|ℋt\|N\_\{t\}^\{\\mathrm\{bank\}\}:=\|\\mathcal\{H\}\_\{t\}\|is the number of distinct client identities represented in the history bank\. Before this condition is satisfied, the current round is used to collect normalization\-layer signatures, and the global model remains unchanged, i\.e\., all participating clients in𝒮t\\mathcal\{S\}\_\{t\}contribute to the global model:

𝐰t\+1=𝐰t\.\\mathbf\{w\}\_\{t\+1\}=\\mathbf\{w\}\_\{t\}\.\(12\)
The activation threshold does not cap the bank size\. After screening begins, the bank continues to incorporate newly observed client identities and ideally approaches full population coverage\. The bank\-coverage ablation shows that broader coverage at activation generally improves the early active\-training performance, including monotonic perplexity improvements under the strongest IID attack setting; see Appendix[E](https://arxiv.org/html/2608.18736#A5), particularly Tables[LII](https://arxiv.org/html/2608.18736#A5.T52)and[LIII](https://arxiv.org/html/2608.18736#A5.T53)\.

Waiting for every client to enter the bank can, however, be impractically slow when participation is intermittent or nonuniform\. The thresholdMactM\_\{\\mathrm\{act\}\}therefore provides a practical starting point for screening with a partially populated bank while allowing the bank to continue growing thereafter\. Under the uniform random participation model used in the experiments, Appendix[A](https://arxiv.org/html/2608.18736#A1)bounds the probability that such a partial bank contains a malicious majority and analyzes the time required to reach a chosen activation coverage\.

### III\-DLayer\-Wise Robust Bank Reference

Once the activation condition in \([11](https://arxiv.org/html/2608.18736#S3.E11)\) is satisfied, the server computes the layer\-wise median/MAD reference \(Algorithm[3](https://arxiv.org/html/2608.18736#alg3), lines[13](https://arxiv.org/html/2608.18736#alg3.l13)–[15](https://arxiv.org/html/2608.18736#alg3.l15)\) and then calculates the standardized representation and scalar deviation score of each current client \(lines[17](https://arxiv.org/html/2608.18736#alg3.l17)–[18](https://arxiv.org/html/2608.18736#alg3.l18)\)\. These quantities form the input to the GMM screening rule\.

#### III\-D1Robust reference statistics

For vectors𝐮\(1\),…,𝐮\(m\)∈ℝd\\mathbf\{u\}^\{\(1\)\},\\dots,\\mathbf\{u\}^\{\(m\)\}\\in\\mathbb\{R\}^\{d\}, the coordinate\-wise median is defined as

med⁡\(𝐮\(1\),…,𝐮\(m\)\)​\[r\]:=median⁡\(ur\(1\),…,ur\(m\)\),\\operatorname\{med\}\\big\(\\mathbf\{u\}^\{\(1\)\},\\dots,\\mathbf\{u\}^\{\(m\)\}\\big\)\[r\]:=\\operatorname\{median\}\\big\(u^\{\(1\)\}\_\{r\},\\dots,u^\{\(m\)\}\_\{r\}\\big\),\(13\)wherer=1,…,dr=1,\\dots,ddenotes the coordinate index\. Compared with the arithmetic mean, the coordinate\-wise median reduces the influence of extreme values and provides a robust estimate of the population center\[[26](https://arxiv.org/html/2608.18736#bib.bib2)\]\.

For each normalization layerℓ∈ℒ\\ell\\in\\mathcal\{L\}, the server gathers the corresponding normalization\-layer signatures from all clients currently stored in the history bank,\{𝐛t,j,ℓ\}j∈ℋt\\\{\\mathbf\{b\}\_\{t,j,\\ell\}\\\}\_\{j\\in\\mathcal\{H\}\_\{t\}\}, and computes their coordinate\-wise median:

𝐦t,ℓ:=med⁡\(\{𝐛t,j,ℓ\}j∈ℋt\)∈ℝdℓ\.\\mathbf\{m\}\_\{t,\\ell\}:=\\operatorname\{med\}\\left\(\\left\\\{\\mathbf\{b\}\_\{t,j,\\ell\}\\right\\\}\_\{j\\in\\mathcal\{H\}\_\{t\}\}\\right\)\\in\\mathbb\{R\}^\{d\_\{\\ell\}\}\.\(14\)The vector𝐦t,ℓ\\mathbf\{m\}\_\{t,\\ell\}serves as a robust estimate of the central tendency of the normalization\-layer signatures at layerℓ\\ell\.

To quantify the dispersion of the client population around the center,FedLNSfurther computes the coordinate\-wise MAD:

𝐝~t,ℓ:=med⁡\(\{\|𝐛t,j,ℓ−𝐦t,ℓ\|\}j∈ℋt\)∈ℝdℓ,\\widetilde\{\\mathbf\{d\}\}\_\{t,\\ell\}:=\\operatorname\{med\}\\left\(\\left\\\{\\left\|\\mathbf\{b\}\_\{t,j,\\ell\}\-\\mathbf\{m\}\_\{t,\\ell\}\\right\|\\right\\\}\_\{j\\in\\mathcal\{H\}\_\{t\}\}\\right\)\\in\\mathbb\{R\}^\{d\_\{\\ell\}\},\(15\)where the absolute value is applied element\-wise\. Compared with variance\-based measures, MAD provides a robust estimate of scale in the presence of outliers and adversarially manipulated updates\[[49](https://arxiv.org/html/2608.18736#bib.bib1)\]\.

To prevent numerical instability caused by near\-zero dispersion values, each coordinate of the MAD vector is lower\-bounded by a small positive constantϵ\>0\\epsilon\>0, yielding

𝐝t,ℓ\[r\]:=max\{𝐝~t,ℓ\[r\],ϵ\},r=1,…,dℓ\.\\mathbf\{d\}\_\{t,\\ell\}\[r\]:=\\max\\left\\\{\\widetilde\{\\mathbf\{d\}\}\_\{t,\\ell\}\[r\],\\epsilon\\right\\\},\\qquad r=1,\\dots,d\_\{\\ell\}\.\(16\)This regularization avoids division\-by\-zero issues and prevents excessively large standardized deviations arising from extremely small scale estimates\. The resulting pair\(𝐦t,ℓ,𝐝t,ℓ\)\(\\mathbf\{m\}\_\{t,\\ell\},\\mathbf\{d\}\_\{t,\\ell\}\)constitutes the robust center and scale reference for normalization layerℓ\\ell\.

#### III\-D2Client deviation scores

After constructing the robust layer\-wise reference statistics,FedLNSprojects each current client signature into a bank\-standardized feature space, as shown in Algorithm[3](https://arxiv.org/html/2608.18736#alg3)\. This transformation quantifies the*deviation*of a client’s normalization\-layer signature from the historical reference while placing coordinates from different normalization layers on comparable robust scales within the current screening round\.

For clienti∈𝒮ti\\in\\mathcal\{S\}\_\{t\}and normalization layerℓ∈ℒ\\ell\\in\\mathcal\{L\}, the standardized signature is defined as

𝐳t,i,ℓ:=𝐬t,i,ℓ−𝐦t,ℓ𝐝t,ℓ∈ℝdℓ,\\mathbf\{z\}\_\{t,i,\\ell\}:=\\frac\{\\mathbf\{s\}\_\{t,i,\\ell\}\-\\mathbf\{m\}\_\{t,\\ell\}\}\{\\mathbf\{d\}\_\{t,\\ell\}\}\\in\\mathbb\{R\}^\{d\_\{\\ell\}\},\(17\)where subtraction and division are performed element\-wise\. Here,𝐬t,i,ℓ\\mathbf\{s\}\_\{t,i,\\ell\}denotes the normalization\-layer signature of clientii, while𝐦t,ℓ\\mathbf\{m\}\_\{t,\\ell\}and𝐝t,ℓ\\mathbf\{d\}\_\{t,\\ell\}are the robust median and MAD reference vectors derived from the history bank\.

The complete standardized representation of clientiiis obtained by concatenating the standardized layer\-wise signatures according to a fixed layer ordering:

𝐳t,i:=concatℓ∈ℒ⁡\(𝐳t,i,ℓ\)∈ℝD,\\mathbf\{z\}\_\{t,i\}:=\\operatorname\{concat\}\_\{\\ell\\in\\mathcal\{L\}\}\\left\(\\mathbf\{z\}\_\{t,i,\\ell\}\\right\)\\in\\mathbb\{R\}^\{D\},\(18\)where the dimensionality of the resulting feature vector is

D:=∑ℓ∈ℒdℓ\.D:=\\sum\_\{\\ell\\in\\mathcal\{L\}\}d\_\{\\ell\}\.\(19\)
To obtain an overall measure of deviation from the historical population,FedLNScomputes a scalar deviation score for each participating client:

δt,i:=median⁡\(\|𝐳t,i​\[1\]\|,…,\|𝐳t,i​\[D\]\|\)\.\\delta\_\{t,i\}:=\\operatorname\{median\}\\left\(\|\\mathbf\{z\}\_\{t,i\}\[1\]\|,\\dots,\|\\mathbf\{z\}\_\{t,i\}\[D\]\|\\right\)\.\(20\)The scoreδt,i\\delta\_\{t,i\}is the median absolute standardized deviation across the coordinates of the client’s feature vector\. A smaller value indicates that the client’s normalization\-layer signature is more consistent with the historical reference, whereas a larger value indicates atypical behavior across a substantial portion of the standardized feature space\. The subsequent GMM stage identifies the population with lower deviation from the bank reference under the assumption that benign signatures form the dominant reference population\.

### III\-EBIC\-Guided One\-vs\-Two GMM Screening

Algorithm[4](https://arxiv.org/html/2608.18736#alg4)fits one\- and two\-component diagonal GMMs \(Gaussian mixture models\) to clients’ standardized signatures and selects the model order using BIC \(lines[4](https://arxiv.org/html/2608.18736#alg4.l4)–[6](https://arxiv.org/html/2608.18736#alg4.l6)\)\. If two components are selected, the algorithm assigns component labels and retains the component with the smaller median deviation from the bank reference \(lines[10](https://arxiv.org/html/2608.18736#alg4.l10)–[15](https://arxiv.org/html/2608.18736#alg4.l15)\)\. If the client population is represented by one component, all participating clients are assumed to be benign and retained\. Otherwise, the clients are partitioned into two groups, and the group with the smaller overall deviation from the historical normalization\-signature reference is selected for aggregation\. This rule avoids forcing a two\-component partition when a one\-component model is selected \(e\.g\., if no malicious clients are present in this training round\) and requires neither a predefined malicious\-client fraction nor a manually specified anomaly threshold\.

In Algorithm[4](https://arxiv.org/html/2608.18736#alg4), the current\-round feature matrix is

𝐙t:=\[𝐳t,i⊤\]i∈𝒮t∈ℝNt×D\.\\mathbf\{Z\}\_\{t\}:=\\left\[\\mathbf\{z\}\_\{t,i\}^\{\\top\}\\right\]\_\{i\\in\\mathcal\{S\}\_\{t\}\}\\in\\mathbb\{R\}^\{N\_\{t\}\\times D\}\.\(21\)
For each candidate number of mixture componentsc∈\{1,2\}c\\in\\\{1,2\\\},FedLNSfits a diagonal\-covariance GMM with covariance regularization10−410^\{\-4\}:

fc​\(𝐳,Θc\)=∑k=1cπc,k​𝒩​\(𝐳,𝝁c,k,Diag⁡\(𝝈c,k2\)\),f\_\{c\}\(\\mathbf\{z\};\\Theta\_\{c\}\)=\\sum\_\{k=1\}^\{c\}\\pi\_\{c,k\}\\mathcal\{N\}\\left\(\\mathbf\{z\};\\boldsymbol\{\\mu\}\_\{c,k\},\\operatorname\{Diag\}\\left\(\\boldsymbol\{\\sigma\}\_\{c,k\}^\{2\}\\right\)\\right\),\(22\)where

Θc=\{πc,k,𝝁c,k,𝝈c,k2\}k=1c,πc,k\>0,∑k=1cπc,k=1\.\\Theta\_\{c\}=\\left\\\{\\pi\_\{c,k\},\\boldsymbol\{\\mu\}\_\{c,k\},\\boldsymbol\{\\sigma\}\_\{c,k\}^\{2\}\\right\\\}\_\{k=1\}^\{c\},\\quad\\pi\_\{c,k\}\>0,\\quad\\sum\_\{k=1\}^\{c\}\\pi\_\{c,k\}=1\.\(23\)The fitted parameter set is

Θ^c:=arg⁡max⁡∑i∈𝒮tΘc⁡log⁡fc​\(𝐳t,i,Θc\)\.\\widehat\{\\Theta\}\_\{c\}:=\\arg\\max\_\{\\Theta\_\{c\}\}\\sum\_\{i\\in\\mathcal\{S\}\_\{t\}\}\\log f\_\{c\}\(\\mathbf\{z\}\_\{t,i\};\\Theta\_\{c\}\)\.\(24\)The BIC score for each candidate model orderccis

BIC\(c\)=−2∑i∈𝒮tlogfc\(𝐳t,i;Θ^c\)\+pclogNt,\\mathrm\{BIC\}\(c\)=\-2\\sum\_\{i\\in\\mathcal\{S\}\_\{t\}\}\\log f\_\{c\}\(\\mathbf\{z\}\_\{t,i\};\\widehat\{\\Theta\}\_\{c\}\)\+p\_\{c\}\\log N\_\{t\},\(25\)where the number of free parameters in a diagonalcc\-component GMM is

pc=\(c−1\)\+2​c​D\.p\_\{c\}=\(c\-1\)\+2cD\.\(26\)
Algorithm 4BICGMMRetain: adaptive one\-vs\-two GMM retain rule1:Standardized features

\{𝐳t,i\}i∈𝒮t\\\{\\mathbf\{z\}\_\{t,i\}\\\}\_\{i\\in\\mathcal\{S\}\_\{t\}\}, deviation scores

\{δt,i\}i∈𝒮t\\\{\\delta\_\{t,i\}\\\}\_\{i\\in\\mathcal\{S\}\_\{t\}\}
2:Retained client set

ℛt\\mathcal\{R\}\_\{t\}
3:Form feature matrix

𝐙t=\[𝐳t,i⊤\]i∈𝒮t\\mathbf\{Z\}\_\{t\}=\[\\mathbf\{z\}\_\{t,i\}^\{\\top\}\]\_\{i\\in\\mathcal\{S\}\_\{t\}\}
4:Fit one\- and two\-component diagonal GMMs to

𝐙t\\mathbf\{Z\}\_\{t\}
5:Compute

BIC⁡\(1\)\\mathrm\{BIC\}\(1\)and

BIC⁡\(2\)\\mathrm\{BIC\}\(2\)using \([25](https://arxiv.org/html/2608.18736#S3.E25)\)

6:Set

c^t=arg⁡minc∈\{1,2\}⁡BIC⁡\(c\)\\widehat\{c\}\_\{t\}=\\arg\\min\_\{c\\in\\\{1,2\\\}\}\\mathrm\{BIC\}\(c\)
7:if

c^t=1\\widehat\{c\}\_\{t\}=1then

8:return

ℛt=𝒮t\\mathcal\{R\}\_\{t\}=\\mathcal\{S\}\_\{t\}
9:else

10:Assign component labels

yt,iy\_\{t,i\}using \([29](https://arxiv.org/html/2608.18736#S3.E29)\)

11:for

k∈\{1,2\}k\\in\\\{1,2\\\}do

12:Compute

ρt,k\\rho\_\{t,k\}using \([30](https://arxiv.org/html/2608.18736#S3.E30)\)

13:endfor

14:Set retained component

ktret=arg⁡mink∈\{1,2\}⁡ρt,kk\_\{t\}^\{\\mathrm\{ret\}\}=\\arg\\min\_\{k\\in\\\{1,2\\\}\}\\rho\_\{t,k\}
15:return

ℛt=\{i∈𝒮t:yt,i=ktret\}\\mathcal\{R\}\_\{t\}=\\\{i\\in\\mathcal\{S\}\_\{t\}:y\_\{t,i\}=k\_\{t\}^\{\\mathrm\{ret\}\}\\\}
16:endif

FedLNSfirst selects the number of mixture componentsc^t\\widehat\{c\}\_\{t\}as

c^t:=arg⁡minc∈\{1,2\}⁡BIC⁡\(c\)\.\\widehat\{c\}\_\{t\}:=\\arg\\min\_\{c\\in\\\{1,2\\\}\}\\mathrm\{BIC\}\(c\)\.\(27\)Ifc^t=1\\widehat\{c\}\_\{t\}=1, all participating clients are retained:

ℛt=𝒮t\.\\mathcal\{R\}\_\{t\}=\\mathcal\{S\}\_\{t\}\.\(28\)Ifc^t=2\\widehat\{c\}\_\{t\}=2, each clientiiis assigned to a component:

yt,i:=arg⁡maxk∈\{1,2\}​π^2,k​𝒩​\(𝐳t,i,𝝁^2,k,Diag⁡\(𝝈^2,k2\)\)\.y\_\{t,i\}:=\\arg\\max\_\{k\\in\\\{1,2\\\}\}\\widehat\{\\pi\}\_\{2,k\}\\mathcal\{N\}\\left\(\\mathbf\{z\}\_\{t,i\};\\widehat\{\\boldsymbol\{\\mu\}\}\_\{2,k\},\\operatorname\{Diag\}\\left\(\\widehat\{\\boldsymbol\{\\sigma\}\}\_\{2,k\}^\{2\}\\right\)\\right\)\.\(29\)The median deviation score of componentkkis

ρt,k:=median\(\{δt,i:i∈𝒮t,yt,i=k\}\),k∈\{1,2\}\.\\rho\_\{t,k\}:=\\operatorname\{median\}\\left\(\\left\\\{\\delta\_\{t,i\}:i\\in\\mathcal\{S\}\_\{t\},\\ y\_\{t,i\}=k\\right\\\}\\right\),\\quad k\\in\\\{1,2\\\}\.\(30\)The retained component is

ktret:=arg⁡mink∈\{1,2\}⁡ρt,k\.k\_\{t\}^\{\\mathrm\{ret\}\}:=\\arg\\min\_\{k\\in\\\{1,2\\\}\}\\rho\_\{t,k\}\.\(31\)The retained client set is

ℛt=\{i∈𝒮t:yt,i=ktret\}\.\\mathcal\{R\}\_\{t\}=\\left\\\{i\\in\\mathcal\{S\}\_\{t\}:y\_\{t,i\}=k\_\{t\}^\{\\mathrm\{ret\}\}\\right\\\}\.\(32\)
After the retained setℛt\\mathcal\{R\}\_\{t\}is determined, the server aggregates the complete retained updates \(Algorithm[3](https://arxiv.org/html/2608.18736#alg3), line[21](https://arxiv.org/html/2608.18736#alg3.l21)\)\. For clienti∈ℛti\\in\\mathcal\{R\}\_\{t\}, the sample\-weighted aggregation coefficient is

αt,i:=nt,i∑j∈ℛtnt,j\.\\alpha\_\{t,i\}:=\\frac\{n\_\{t,i\}\}\{\\sum\_\{j\\in\\mathcal\{R\}\_\{t\}\}n\_\{t,j\}\}\.\(33\)The next global model is

𝐰t\+1=𝐰t\+∑i∈ℛtαt,i​Δ​𝐰t,i\.\\mathbf\{w\}\_\{t\+1\}=\\mathbf\{w\}\_\{t\}\+\\sum\_\{i\\in\\mathcal\{R\}\_\{t\}\}\\alpha\_\{t,i\}\\Delta\\mathbf\{w\}\_\{t,i\}\.\(34\)FedLNStherefore acts as a server\-side screening stage before full\-model aggregation\. The retained updates can be passed to the sample\-weighted rule above or to another compatible FL aggregation rule\.

## IVTheoretical Analysis

This section analyzes two aspects ofFedLNS\. First, we examine how changes in trainable normalization\-layer parameters contribute to changes in token preferences\. Second, we study how screening suspicious clients affects optimization of the benign global objective\.

### IV\-AInfluence of Normalization\-Parameter Changes on Token Margins

For an input sequencex=\(x1,…,xm\)x=\(x\_\{1\},\\dots,x\_\{m\}\), a language model with parameters𝐰\\mathbf\{w\}produces a logit vector

𝐳⁡\(x,𝐰\)∈ℝ\|𝒱\|,\\mathbf\{z\}\(x;\\mathbf\{w\}\)\\in\\mathbb\{R\}^\{\|\\mathcal\{V\}\|\},\(35\)where𝒱\\mathcal\{V\}is the token vocabulary\. The probability assigned to tokeny∈𝒱y\\in\\mathcal\{V\}is

π𝐰​\(y∣x\)=exp⁡\(zy​\(x,𝐰\)\)∑v∈𝒱exp⁡\(zv​\(x,𝐰\)\)\.\\pi\_\{\\mathbf\{w\}\}\(y\\mid x\)=\\frac\{\\exp\(z\_\{y\}\(x;\\mathbf\{w\}\)\)\}\{\\sum\_\{v\\in\\mathcal\{V\}\}\\exp\(z\_\{v\}\(x;\\mathbf\{w\}\)\)\}\.\(36\)
For two candidate tokensu,v∈𝒱u,v\\in\\mathcal\{V\}, define the pairwise token margin

mu,v​\(x,𝐰\):=zu​\(x,𝐰\)−zv​\(x,𝐰\)\.m\_\{u,v\}\(x;\\mathbf\{w\}\):=z\_\{u\}\(x;\\mathbf\{w\}\)\-z\_\{v\}\(x;\\mathbf\{w\}\)\.\(37\)The margin measures the model’s relative preference for tokenuuover tokenvvand satisfies

mu,v​\(x,𝐰\)=log⁡π𝐰​\(u∣x\)π𝐰​\(v∣x\)\.m\_\{u,v\}\(x;\\mathbf\{w\}\)=\\log\\frac\{\\pi\_\{\\mathbf\{w\}\}\(u\\mid x\)\}\{\\pi\_\{\\mathbf\{w\}\}\(v\\mid x\)\}\.\(38\)Thus, a client update that changes the pairwise margin also changes the probability ratio assigned to the two tokens\.

Partition the model parameters as

𝐰=\(𝐩,𝐪\),\\mathbf\{w\}=\(\\mathbf\{p\},\\mathbf\{q\}\),\(39\)where𝐩\\mathbf\{p\}contains the trainable normalization\-layer parameters included in theFedLNSsignature and𝐪\\mathbf\{q\}contains the remaining model parameters\.

For clientiiat communication roundtt, write the local update as

Δ​𝐰t,i=\(Δ​𝐩t,i,Δ​𝐪t,i\)\.\\Delta\\mathbf\{w\}\_\{t,i\}=\(\\Delta\\mathbf\{p\}\_\{t,i\},\\Delta\\mathbf\{q\}\_\{t,i\}\)\.\(40\)Here,Δ​𝐩t,i\\Delta\\mathbf\{p\}\_\{t,i\}is the concatenated normalization\-parameter component corresponding to the normalization\-layer signature used byFedLNS\.

Because a client update affects the model across inputs, we define its prompt\-averaged pairwise\-margin change as

Δ​m¯t,i​\(u,v\):=𝔼x∼𝒳​\[mu,v​\(x,𝐰t\+Δ​𝐰t,i\)−mu,v​\(x,𝐰t\)\]\.\\Delta\\bar\{m\}\_\{t,i\}\(u,v\):=\\mathbb\{E\}\_\{x\\sim\\mathcal\{X\}\}\\left\[m\_\{u,v\}\\left\(x;\\mathbf\{w\}\_\{t\}\+\\Delta\\mathbf\{w\}\_\{t,i\}\\right\)\-m\_\{u,v\}\(x;\\mathbf\{w\}\_\{t\}\)\\right\]\.\(41\)Here,mu,v​\(x,𝐰\)m\_\{u,v\}\(x;\\mathbf\{w\}\)denotes the margin for an individual prompt, whereasΔ​m¯t,i​\(u,v\)\\Delta\\bar\{m\}\_\{t,i\}\(u,v\)denotes the change in that margin averaged over the prompt distribution𝒳\\mathcal\{X\}\.

The following proposition identifies the direct first\-order contribution of the normalization\-parameter component to the expected token\-margin change\.

###### Proposition 1 \(Normalization\-parameter contribution to token\-margin change\)\.

Supposemu,v​\(x,𝐰\)m\_\{u,v\}\(x;\\mathbf\{w\}\)is twice continuously differentiable in a neighborhood of𝐰t\\mathbf\{w\}\_\{t\}, and its Hessian is uniformly bounded in operator norm byLmL\_\{m\}\. Then

Δ​m¯t,i​\(u,v\)=𝐠p,u,v⊤​Δ​𝐩t,i\+𝐠q,u,v⊤​Δ​𝐪t,i\+Rt,i​\(u,v\),\\Delta\\bar\{m\}\_\{t,i\}\(u,v\)=\\mathbf\{g\}\_\{p,u,v\}^\{\\top\}\\Delta\\mathbf\{p\}\_\{t,i\}\+\\mathbf\{g\}\_\{q,u,v\}^\{\\top\}\\Delta\\mathbf\{q\}\_\{t,i\}\+R\_\{t,i\}\(u,v\),\(42\)where

𝐠p,u,v\\displaystyle\\mathbf\{g\}\_\{p,u,v\}:=𝔼x∼𝒳​\[∇𝐩mu,v​\(x,𝐰t\)\],\\displaystyle:=\\mathbb\{E\}\_\{x\\sim\\mathcal\{X\}\}\\left\[\\nabla\_\{\\mathbf\{p\}\}m\_\{u,v\}\(x;\\mathbf\{w\}\_\{t\}\)\\right\],\(43\)𝐠q,u,v\\displaystyle\\mathbf\{g\}\_\{q,u,v\}:=𝔼x∼𝒳​\[∇𝐪mu,v​\(x,𝐰t\)\],\\displaystyle:=\\mathbb\{E\}\_\{x\\sim\\mathcal\{X\}\}\\left\[\\nabla\_\{\\mathbf\{q\}\}m\_\{u,v\}\(x;\\mathbf\{w\}\_\{t\}\)\\right\],and the prompt\-averaged remainder satisfies

\|Rt,i​\(u,v\)\|≤Lm2​‖Δ​𝐰t,i‖22\.\|R\_\{t,i\}\(u,v\)\|\\leq\\frac\{L\_\{m\}\}\{2\}\\left\\\|\\Delta\\mathbf\{w\}\_\{t,i\}\\right\\\|\_\{2\}^\{2\}\.\(44\)

Proposition[1](https://arxiv.org/html/2608.18736#Thmproposition1)shows that the normalization\-parameter component contributes directly to the first\-order change in token margins through

𝐠p,u,v⊤​Δ​𝐩t,i\.\\mathbf\{g\}\_\{p,u,v\}^\{\\top\}\\Delta\\mathbf\{p\}\_\{t,i\}\.\(45\)Consequently, normalization\-parameter changes contribute directly to first\-order changes in relative token preferences\.

### IV\-BEffect of Screening on the Aggregated Update

We next analyze the effect of excluding suspicious clients before aggregation\. Let𝒞ben\\mathcal\{C\}\_\{\\mathrm\{ben\}\}denote the set of benign clients\. The benign global objective is

F⁡\(𝐰\):=∑i∈𝒞benλi​Fi​\(𝐰\),λi≥0,∑i∈𝒞benλi=1,F\(\\mathbf\{w\}\):=\\sum\_\{i\\in\\mathcal\{C\}\_\{\\mathrm\{ben\}\}\}\\lambda\_\{i\}F\_\{i\}\(\\mathbf\{w\}\),\\qquad\\lambda\_\{i\}\\geq 0,\\quad\\sum\_\{i\\in\\mathcal\{C\}\_\{\\mathrm\{ben\}\}\}\\lambda\_\{i\}=1,\(46\)whereFiF\_\{i\}is the local objective of benign clientii\.

At roundtt,FedLNSreturns a retained client setℛt⊆𝒮t\\mathcal\{R\}\_\{t\}\\subseteq\\mathcal\{S\}\_\{t\}\. For retained clientii, define the normalized aggregation coefficient

αt,i=nt,i∑j∈ℛtnt,j,i∈ℛt\.\\alpha\_\{t,i\}=\\frac\{n\_\{t,i\}\}\{\\sum\_\{j\\in\\mathcal\{R\}\_\{t\}\}n\_\{t,j\}\},\\qquad i\\in\\mathcal\{R\}\_\{t\}\.\(47\)The screened update is

𝐰t\+1=𝐰t\+∑i∈ℛtαt,i​Δ​𝐰t,i\.\\mathbf\{w\}\_\{t\+1\}=\\mathbf\{w\}\_\{t\}\+\\sum\_\{i\\in\\mathcal\{R\}\_\{t\}\}\\alpha\_\{t,i\}\\Delta\\mathbf\{w\}\_\{t,i\}\.\(48\)
For analysis, write the same update as

𝐰t\+1=𝐰t−ηt​𝐠t,\\mathbf\{w\}\_\{t\+1\}=\\mathbf\{w\}\_\{t\}\-\\eta\_\{t\}\\mathbf\{g\}\_\{t\},\(49\)whereηt\>0\\eta\_\{t\}\>0is an effective step size and𝐠t\\mathbf\{g\}\_\{t\}is the effective retained update direction\.

Define the screening error

𝐞t:=𝔼⁡\[𝐠t∣ℱt\]−∇F​\(𝐰t\),\\mathbf\{e\}\_\{t\}:=\\mathbb\{E\}\\left\[\\mathbf\{g\}\_\{t\}\\mid\\mathcal\{F\}\_\{t\}\\right\]\-\\nabla F\(\\mathbf\{w\}\_\{t\}\),\(50\)whereℱt\\mathcal\{F\}\_\{t\}contains the information available before the round\-ttscreening, i\.e\., the vector𝐞t\\mathbf\{e\}\_\{t\}measures the difference between the expected retained update direction and the gradient of the benign global objective\.

###### Theorem 1 \(Finite\-time bound under screened aggregation\)\.

Assume thatFFisLFL\_\{F\}\-smooth and lower bounded byFinfF\_\{\\inf\}\. Suppose that, for every roundtt, there exist nonnegative quantitiesβt\\beta\_\{t\}andνt2\\nu\_\{t\}^\{2\}such that

‖𝐞t‖2≤βt,βt≥0,\\\|\\mathbf\{e\}\_\{t\}\\\|\_\{2\}\\leq\\beta\_\{t\},\\qquad\\beta\_\{t\}\\geq 0,\(51\)and

𝔼⁡\[‖𝐠t−𝔼⁡\[𝐠t∣ℱt\]‖22\|ℱt\]≤νt2\.\\mathbb\{E\}\\left\[\\left\\\|\\mathbf\{g\}\_\{t\}\-\\mathbb\{E\}\[\\mathbf\{g\}\_\{t\}\\mid\\mathcal\{F\}\_\{t\}\]\\right\\\|\_\{2\}^\{2\}\\,\\middle\|\\,\\mathcal\{F\}\_\{t\}\\right\]\\leq\\nu\_\{t\}^\{2\}\.\(52\)If0≤ηt≤1/\(4​LF\)0\\leq\\eta\_\{t\}\\leq 1/\(4L\_\{F\}\), then for anyT≥1T\\geq 1with

ST:=∑t=0T−1ηt\>0,S\_\{T\}:=\\sum\_\{t=0\}^\{T\-1\}\\eta\_\{t\}\>0,\(53\)we have

∑t=0T−1ηt​𝔼​\[‖∇F​\(𝐰t\)‖22\]ST≤2​\(F⁡\(𝐰0\)−Finf\)ST\\displaystyle\\frac\{\\sum\_\{t=0\}^\{T\-1\}\\eta\_\{t\}\\mathbb\{E\}\\left\[\\\|\\nabla F\(\\mathbf\{w\}\_\{t\}\)\\\|\_\{2\}^\{2\}\\right\]\}\{S\_\{T\}\}\\leq\\frac\{2\\left\(F\(\\mathbf\{w\}\_\{0\}\)\-F\_\{\\inf\}\\right\)\}\{S\_\{T\}\}\(54\)\+2​∑t=0T−1\(ηt\+LF​ηt2\)​𝔼​\[βt2\]ST\+LF​∑t=0T−1ηt2​𝔼​\[νt2\]ST\.\\displaystyle\+\\frac\{2\\sum\_\{t=0\}^\{T\-1\}\\left\(\\eta\_\{t\}\+L\_\{F\}\\eta\_\{t\}^\{2\}\\right\)\\mathbb\{E\}\[\\beta\_\{t\}^\{2\}\]\}\{S\_\{T\}\}\+\\frac\{L\_\{F\}\\sum\_\{t=0\}^\{T\-1\}\\eta\_\{t\}^\{2\}\\mathbb\{E\}\[\\nu\_\{t\}^\{2\}\]\}\{S\_\{T\}\}\.

Theorem[1](https://arxiv.org/html/2608.18736#Thmtheorem1)bounds the step\-size\-weighted average squared gradient norm of the benign objective\. The right\-hand side contains three terms: the initial optimization gap, the contribution of the screening\-error upper boundβt\\beta\_\{t\}\(i\.e\., the discrepancy between the expected retained update direction and the gradient of the benign global objective\), and the stochastic update\-noise contribution governed byνt2\\nu\_\{t\}^\{2\}\. A smallerβt\\beta\_\{t\}indicates that the expected direction formed from the retained clients more closely approximates the benign global gradient\. The theorem characterizes optimization under such an approximation, but it does not independently guarantee that theFedLNSscreening rule makesβt\\beta\_\{t\}small in every round\.

The following corollary gives conditions under which the weighted average gradient norm vanishes\.

###### Corollary 1 \(Convergence to first\-order stationarity\)\.

Suppose

ST=∑t=0T−1ηt→∞,∑t=0T−1ηt2ST→0\.S\_\{T\}=\\sum\_\{t=0\}^\{T\-1\}\\eta\_\{t\}\\to\\infty,\\qquad\\frac\{\\sum\_\{t=0\}^\{T\-1\}\\eta\_\{t\}^\{2\}\}\{S\_\{T\}\}\\to 0\.\(55\)Assume that the update variance is uniformly bounded:

𝔼⁡\[νt2\]≤ν2\\mathbb\{E\}\[\\nu\_\{t\}^\{2\}\]\\leq\\nu^\{2\}\(56\)for some finite constantν2\\nu^\{2\}\. Also assume that the weighted average screening error vanishes:

∑t=0T−1ηt​𝔼​\[βt2\]ST→0\.\\frac\{\\sum\_\{t=0\}^\{T\-1\}\\eta\_\{t\}\\mathbb\{E\}\[\\beta\_\{t\}^\{2\}\]\}\{S\_\{T\}\}\\to 0\.\(57\)Then

∑t=0T−1ηt​𝔼​\[‖∇F​\(𝐰t\)‖22\]ST→0\.\\frac\{\\sum\_\{t=0\}^\{T\-1\}\\eta\_\{t\}\\mathbb\{E\}\\left\[\\\|\\nabla F\(\\mathbf\{w\}\_\{t\}\)\\\|\_\{2\}^\{2\}\\right\]\}\{S\_\{T\}\}\\to 0\.\(58\)Equivalently, if a random roundτ\\tauis sampled from\{0,…,T−1\}\\\{0,\\dots,T\-1\\\}with probability

Pr⁡\(τ=t\)=ηtST,\\Pr\(\\tau=t\)=\\frac\{\\eta\_\{t\}\}\{S\_\{T\}\},\(59\)then

𝔼⁡\[‖∇F​\(𝐰τ\)‖22\]→0\.\\mathbb\{E\}\\left\[\\\|\\nabla F\(\\mathbf\{w\}\_\{\\tau\}\)\\\|\_\{2\}^\{2\}\\right\]\\to 0\.\(60\)

Corollary[1](https://arxiv.org/html/2608.18736#Thmcorollary1)shows that the expected gradient norm of a step\-size\-weighted random iterate vanishes when the step sizes provide sufficient cumulative progress, the stochastic update variance remains bounded, and the average screening error becomes negligible\. The final condition requires the retained update direction to approach the benign gradient direction\.

The following proposition decomposes the screening error into quantities associated with retained malicious updates, benign\-client selection, and local\-training drift\.

###### Proposition 2 \(Interpretation of screening error\)\.

Let

μt:=∑a∈ℛt∩𝒞malαt,a\\mu\_\{t\}:=\\sum\_\{a\\in\\mathcal\{R\}\_\{t\}\\cap\\mathcal\{C\}\_\{\\mathrm\{mal\}\}\}\\alpha\_\{t,a\}\(61\)denote the total aggregation weight assigned to retained malicious clients\. Whenμt<1\\mu\_\{t\}<1, define the renormalized gradient of the retained benign clients as

𝐠¯tB,ret:=∑i∈ℛt∩𝒞benαt,i1−μt∇Fi\(𝐰t\)\.\\bar\{\\mathbf\{g\}\}\_\{t\}^\{B,\\mathrm\{ret\}\}:=\\sum\_\{i\\in\\mathcal\{R\}\_\{t\}\\cap\\mathcal\{C\}\_\{\\mathrm\{ben\}\}\}\\frac\{\\alpha\_\{t,i\}\}\{1\-\\mu\_\{t\}\}\\nabla F\_\{i\}\(\\mathbf\{w\}\_\{t\}\)\.\(62\)The retained\-benign representativeness error is

χt:=‖𝐠¯tB,ret−∇F​\(𝐰t\)‖2\.\\chi\_\{t\}:=\\left\\\|\\bar\{\\mathbf\{g\}\}\_\{t\}^\{B,\\mathrm\{ret\}\}\-\\nabla F\(\\mathbf\{w\}\_\{t\}\)\\right\\\|\_\{2\}\.\(63\)Thus,χt\\chi\_\{t\}measures how closely the retained benign clients, after their weights are renormalized, represent the full benign\-client gradient\. Letϱt\\varrho\_\{t\}denote the retained benign local\-training drift, as formally defined in Appendix[B\-C](https://arxiv.org/html/2608.18736#A2.SS3)\. Under the conditions stated there, the screening error satisfies

‖𝐞t‖2≤\(1−μt\)​χt\+2​G​μt\+ϱt\.\\\|\\mathbf\{e\}\_\{t\}\\\|\_\{2\}\\leq\(1\-\\mu\_\{t\}\)\\chi\_\{t\}\+2G\\mu\_\{t\}\+\\varrho\_\{t\}\.\(64\)Consequently, a valid choice of the screening\-error bound in Theorem[1](https://arxiv.org/html/2608.18736#Thmtheorem1)is

βt:=\(1−μt\)​χt\+2​G​μt\+ϱt\.\\beta\_\{t\}:=\(1\-\\mu\_\{t\}\)\\chi\_\{t\}\+2G\\mu\_\{t\}\+\\varrho\_\{t\}\.\(65\)

Proposition[2](https://arxiv.org/html/2608.18736#Thmproposition2)identifies three sources of screening error\. The termμt\\mu\_\{t\}is small when malicious clients receive little retained aggregation weight\. The termχt\\chi\_\{t\}is small when the retained benign clients remain representative of the benign population\. The termϱt\\varrho\_\{t\}is small when local training remains close to the global model\. Together, these quantities determine the screening\-error contribution in Theorem[1](https://arxiv.org/html/2608.18736#Thmtheorem1)\.

For a constant effective step size, the finite\-time result yields a stationary\-neighborhood bound:

###### Corollary 2 \(Stationary neighborhood with constant step size\)\.

Suppose thatηt=η≤1/\(4​LF\),∀t\\eta\_\{t\}=\\eta\\leq 1/\(4L\_\{F\}\),\\,\\forall t\. Define

β¯T2:=1T​∑t=0T−1𝔼⁡\[βt2\],ν¯T2:=1T​∑t=0T−1𝔼⁡\[νt2\]\.\\overline\{\\beta\}\_\{T\}^\{2\}:=\\frac\{1\}\{T\}\\sum\_\{t=0\}^\{T\-1\}\\mathbb\{E\}\[\\beta\_\{t\}^\{2\}\],\\qquad\\overline\{\\nu\}\_\{T\}^\{2\}:=\\frac\{1\}\{T\}\\sum\_\{t=0\}^\{T\-1\}\\mathbb\{E\}\[\\nu\_\{t\}^\{2\}\]\.\(66\)Then

1T​∑t=0T−1𝔼⁡\[‖∇F​\(𝐰t\)‖22\]\\displaystyle\\frac\{1\}\{T\}\\sum\_\{t=0\}^\{T\-1\}\\mathbb\{E\}\\left\[\\\|\\nabla F\(\\mathbf\{w\}\_\{t\}\)\\\|\_\{2\}^\{2\}\\right\]≤2​\(F⁡\(𝐰0\)−Finf\)η​T\\displaystyle\\leq\\frac\{2\\left\(F\(\\mathbf\{w\}\_\{0\}\)\-F\_\{\\inf\}\\right\)\}\{\\eta T\}\(67\)\+2​\(1\+LF​η\)​β¯T2\+LF​η​ν¯T2\.\\displaystyle\+2\\left\(1\+L\_\{F\}\\eta\\right\)\\overline\{\\beta\}\_\{T\}^\{2\}\+L\_\{F\}\\eta\\overline\{\\nu\}\_\{T\}^\{2\}\.

Corollary[2](https://arxiv.org/html/2608.18736#Thmcorollary2)shows that, with a constant effective step size, the average gradient norm approaches a neighborhood whose size is controlled by the average screening error and the stochastic update variance\.

Complete assumptions, proofs, the screening\-error decomposition, and the local\-training drift bound are provided in Appendix[B](https://arxiv.org/html/2608.18736#A2)\.

## VExperimental Evaluation

In this section, we evaluateFedLNSin federated transformer\-based language\-model training under target\-corruption attacks\. The evaluation examines robustness across model architectures, IID and non\-IID data partitions, and malicious\-client fractions ranging from0%0\\%to40%40\\%\.

### V\-AExperimental Setup

We evaluateFedLNSon three transformer model families with different language\-modeling objectives:

- •A GPT\-style causal transformer\[[37](https://arxiv.org/html/2608.18736#bib.bib54)\]trained from scratch on WikiText using autoregressive next\-token prediction\.
- •A BERT\-style masked\-language transformer\[[14](https://arxiv.org/html/2608.18736#bib.bib55)\]trained from scratch on Tiny Shakespeare using bidirectional masked\-token prediction\.
- •A LLaMA\-style decoder\-only causal transformer\[[43](https://arxiv.org/html/2608.18736#bib.bib56)\]trained from scratch on StackOverflow text\.

Settings\.Unless otherwise specified, each experiment usesK=200K=200clients, a10%10\\%participation rate,2020clients sampled uniformly at random per communication round, and200200communication rounds\[[40](https://arxiv.org/html/2608.18736#bib.bib3),[25](https://arxiv.org/html/2608.18736#bib.bib5)\]\. Each configuration is repeated using three random seeds,\{100,200,300\}\\\{100,200,300\\\}, under IID and two\-shard non\-IID data partitions\[[15](https://arxiv.org/html/2608.18736#bib.bib4)\]\.

For theK=200K=200clients considered in our experiments, we use the default activation coverageMact=100M\_\{\\mathrm\{act\}\}=100, so screening begins after signatures from half of the client identities have been observed\.

Malicious clients\.We consider a target\-corruption attack in which a fixed subset of the client population is designated as malicious at the beginning of each training run and remains malicious throughout that run\. For every malicious client selected in a communication round, the input sequence remains unchanged, while the target token at each supervised prediction position is independently replaced, with probabilitypcorrp\_\{\\mathrm\{corr\}\}, by a randomly sampled valid vocabulary token; padding and EOS tokens are excluded from the replacement candidates\. We setpcorr=1\.0p\_\{\\mathrm\{corr\}\}=1\.0, so every eligible target position used for local training is replaced\. The malicious\-client fraction is defined over the complete client population\. In each communication round,2020clients are sampled uniformly without replacement from theK=200K=200clients; therefore, the number of malicious clients participating in an individual round varies according to the sampled client set\.

Performance metrics\.We report perplexity and token\-level semantic entropy\. For the causal language models, perplexity is the exponential of the mean next\-token cross\-entropy\. For the masked\-language model, masked\-token perplexity is the exponential of the mean cross\-entropy over masked positions\. Token\-level semantic entropy is the mean predictive entropy over the evaluated token positions and measures the concentration of the corresponding predictive distributions\.

\(a\)GPT/WikiText, IID partitions\(b\)BERT/Shakespeare, IID partitions\(c\)LLaMA/StackOverflow, IID partitions\(d\)GPT/WikiText, non\-IID partitions\(e\)BERT/Shakespeare, non\-IID partitions\(f\)LLaMA/StackOverflow, non\-IID partitions
Fig\. 2:Perplexity \(lower is better\) under target manipulation affecting40%40\\%of the client population\. Bars show the mean over three random seeds, and error bars show one sample standard deviation\.FedLNSconsistently shows the lowest perplexity, across both IID and non\-IID data partitions\.For each random seed, the checkpoint with the lowest test loss is selected, and the test loss, perplexity, and token\-level semantic entropy are reported from that same model state\. Results are reported as the mean and sample standard deviation across seeds\{100,200,300\}\\\{100,200,300\\\}for each model, data partition, aggregation method, and malicious\-client fraction\.

Baselines\.We compareFedLNSwith six representative aggregation methods covering conventional averaging, norm\-constrained aggregation, coordinate\-wise robust statistics, distance\-based selection, and clustering\-based filtering\.FedAvgperforms sample\-weighted averaging and serves as the non\-robust baseline\[[33](https://arxiv.org/html/2608.18736#bib.bib41)\]\.Norm\-Bounded FedAvgclips client updates before aggregation to limit the effect of large update magnitudes\[[41](https://arxiv.org/html/2608.18736#bib.bib38)\]\.Coordinate\-wise MedianandTrimmed Meanapply robust statistics independently to each model coordinate\[[52](https://arxiv.org/html/2608.18736#bib.bib39)\]\.Multi\-Krumselects updates with mutually consistent distance profiles\[[5](https://arxiv.org/html/2608.18736#bib.bib34)\]\.FLAMEcombines clustering, norm clipping, and Gaussian noise injection\[[34](https://arxiv.org/html/2608.18736#bib.bib37)\]\. Trimmed Mean and Multi\-Krum are configured using the true population\-level malicious\-client fraction, whereasFedLNSdoes not require this fraction as an input\.

Appendix[C](https://arxiv.org/html/2608.18736#A3)provides the complete dataset, tokenization, partition, architecture, optimization, attack, baseline, andFedLNSconfigurations; Appendix[D](https://arxiv.org/html/2608.18736#A4)reports the full malicious\-client\-fraction results; and Appendices[E](https://arxiv.org/html/2608.18736#A5)and[F](https://arxiv.org/html/2608.18736#A6)provide the bank\-coverage\-at\-activation and GMM\-selection ablations, respectively\.

### V\-BPerplexity and Token\-Level Semantic Entropy

Figure[2](https://arxiv.org/html/2608.18736#S5.F2)compares the perplexity ofFedLNSand the six baselines when40%40\\%of the client population is malicious\. Figures[2](https://arxiv.org/html/2608.18736#S5.F2)\(a\)–[2](https://arxiv.org/html/2608.18736#S5.F2)\(c\) report the IID results, whereas Figures[2](https://arxiv.org/html/2608.18736#S5.F2)\(d\)–[2](https://arxiv.org/html/2608.18736#S5.F2)\(f\) report the non\-IID results\. Error bars show one sample standard deviation across seeds\{100,200,300\}\\\{100,200,300\\\}\.

Under IID data partitions,FedLNSachieves the lowest perplexity for all three evaluated model families\. Relative to the strongest competing baseline, it reduces perplexity by11\.59%11\.59\\%for GPT/WikiText \(from1449\.721449\.72to1281\.631281\.63\),3\.88%3\.88\\%for BERT/Tiny Shakespeare \(from725\.76725\.76to697\.62697\.62\), and4\.98%4\.98\\%for LLaMA/StackOverflow \(from228\.52228\.52to217\.14217\.14\)\. These results show that the global models trained withFedLNSexhibit less attack\-induced degradation across all three architectures\.

Under the two\-shard non\-IID partitions,FedLNSreduces perplexity by18\.57%18\.57\\%for GPT/WikiText \(from1579\.811579\.81to1286\.501286\.50\),10\.05%10\.05\\%for BERT/Tiny Shakespeare \(from731\.73731\.73to658\.21658\.21\), and5\.67%5\.67\\%for LLaMA/StackOverflow \(from233\.42233\.42to220\.18220\.18\) relative to the strongest non\-FedLNSbaseline\. The improvement across all three non\-IID settings shows that the downstream benefit of the screening procedure persists when benign clients have heterogeneous local data distributions\.

\(a\)GPT/WikiText, IID partitions\(b\)BERT/Shakespeare, IID partitions\(c\)LLaMA/StackOverflow, IID partitions\(d\)GPT/WikiText, non\-IID partitions\(e\)BERT/Shakespeare, non\-IID partitions\(f\)LLaMA/StackOverflow, non\-IID partitions
Fig\. 3:Token\-level semantic entropy \(lower is better\) under target manipulation affecting40%40\\%of the client population\. Bars show the mean over three random seeds, and error bars show one sample standard deviation\.FedLNSconsistently shows the lowest semantic entropy, across both IID and non\-IID data partitions\.Because lower entropy does not necessarily imply greater correctness, we interpret the entropy results jointly with perplexity\.

Figure[3](https://arxiv.org/html/2608.18736#S5.F3)reports token\-level semantic entropy for the three model families under40%40\\%population\-level target manipulation\. Under IID data partitions, Figures[3](https://arxiv.org/html/2608.18736#S5.F3)\(a\)–[3](https://arxiv.org/html/2608.18736#S5.F3)\(c\) show thatFedLNSachieves the lowest entropy in all three settings\. Relative to the strongest non\-FedLNSbaseline, it reduces entropy by2\.30%2\.30\\%for GPT/WikiText \(from6\.966\.96to6\.806\.80\),3\.41%3\.41\\%for BERT/Tiny Shakespeare \(from6\.466\.46to6\.246\.24\), and1\.60%1\.60\\%for LLaMA/StackOverflow \(from5\.615\.61to5\.525\.52\)\.

Under non\-IID data partitions, Figures[3](https://arxiv.org/html/2608.18736#S5.F3)\(d\)–[3](https://arxiv.org/html/2608.18736#S5.F3)\(f\) show reductions of2\.95%2\.95\\%for GPT/WikiText \(from7\.137\.13to6\.926\.92\),6\.50%6\.50\\%for BERT/Tiny Shakespeare \(from6\.626\.62to6\.196\.19\), and1\.95%1\.95\\%for LLaMA/StackOverflow \(from5\.635\.63to5\.525\.52\)\. Together with the corresponding perplexity reductions, these results show that the global models obtained afterFedLNSscreening achieve lower test loss and lower uncertainty over competing token predictions under the evaluated attack\.

### V\-CImpact of Malicious Clients

Appendix[D](https://arxiv.org/html/2608.18736#A4)reports the complete numerical results across malicious\-client fractions for all model families and data partitions\. For GPT/WikiText under IID partitioning, the population\-level malicious\-client fraction increases from0%0\\%to40%40\\%\.

For perplexity,FedLNSexhibits limited degradation as the malicious\-client fraction increases\. Its perplexity rises by2\.82%2\.82\\%, from1246\.571246\.57at0%0\\%to1281\.631281\.63at40%40\\%\. Over the same range, perplexity increases by27\.97%27\.97\\%for FedAvg,48\.32%48\.32\\%for Norm\-Bounded FedAvg,17\.95%17\.95\\%for Median,36\.05%36\.05\\%for Trimmed Mean,16\.72%16\.72\\%for Multi\-Krum, and15\.15%15\.15\\%for FLAME\.FedLNSachieves the lowest perplexity at every nonzero attack fraction from10%10\\%to40%40\\%\.

Token\-level semantic entropy exhibits a similar attacked\-setting trend\. Although Norm\-Bounded FedAvg has the lowest entropy in the attack\-free setting, its entropy increases by47\.94%47\.94\\%between0%0\\%and40%40\\%malicious clients\. In contrast, the entropy ofFedLNSincreases by1\.04%1\.04\\%, from6\.736\.73to6\.806\.80, and is the lowest among the evaluated methods for every nonzero attack fraction\. The simultaneous stability of perplexity and entropy indicates thatFedLNSlimits both predictive degradation and uncertainty as the target\-corruption rate increases\.

### V\-DImpact of Bank Coverage at Activation

As defined by Eq\. \([11](https://arxiv.org/html/2608.18736#S3.E11)\),FedLNSbegins screening and global aggregation after the bank reaches the activation coverageMactM\_\{\\mathrm\{act\}\}\. We evaluateMact∈\{0,50,100,150\}M\_\{\\mathrm\{act\}\}\\in\\\{0,50,100,150\\\}, corresponding to immediate,25%25\\%,50%50\\%, and75%75\\%population coverage\. SettingMact=0M\_\{\\mathrm\{act\}\}=0activates screening immediately using the currently available bank; it does not remove the bank\. In all settings, the bank continues growing after activation as additional client identities are observed\.

The ablation reports performance over the first ten active aggregation rounds under IID partitioning with40%40\\%malicious clients\. Relative to immediate activation withMact=0M\_\{\\mathrm\{act\}\}=0, activation atMact=150M\_\{\\mathrm\{act\}\}=150reduces perplexity by10\.62%10\.62\\%for GPT/WikiText,31\.89%31\.89\\%for BERT/Tiny Shakespeare, and74\.68%74\.68\\%for LLaMA/StackOverflow\. Token\-level semantic entropy decreases by2\.53%2\.53\\%,20\.20%20\.20\\%, and25\.33%25\.33\\%, respectively\. Thus, the main ablation exhibits a monotonic perplexity improvement as activation coverage increases\.

These results support maximizing bank coverage whenever the resulting activation delay is acceptable\. A broader bank provides a more representative cross\-client reference, and the bank should continue growing toward full population coverage after screening begins\. The activation threshold is therefore a practical starting criterion rather than a desired final bank size\. Smaller activation coverages remain usable when waiting for broader coverage would delay training excessively, but they should not be interpreted as equivalent to a fully populated bank\. The largest evaluated activation coverage is75%75\\%; the experiments therefore support the observed benefit of increasing coverage within this range rather than establishing an empirical optimum at100%100\\%coverage\.

The GMM\-selection ablation shows that BIC\-selected one\-vs\-two\-component screening and forced two\-component screening produce nearly identical selected\-checkpoint results in the evaluated settings\. BIC retains the option to keep all participating clients when the one\-component model is preferred, but the endpoint metrics exhibit limited sensitivity to this model\-selection rule\. Complete results are provided in Appendix[F](https://arxiv.org/html/2608.18736#A6)\.

## VIConclusion

This paper introducedFedLNS, a lightweight server\-side framework that develops a normalization\-layer update signature to screen malicious updates before standard full\-model aggregation\. Moreover, a server\-side retain rule was designed, which constructs a robust cross\-client reference from the latest observed signatures and combines median/MAD standardization with BIC\-guided mixture modeling\. For GPT\-style, BERT\-style, and LLaMA\-style models under both IID and non\-IID partitions,FedLNSachieved lower perplexity than all six baselines when40%40\\%of the client population was malicious\. The maximum reductions were18\.57%18\.57\\%in perplexity and6\.50%6\.50\\%in token\-level semantic entropy\.

## Acknowledgements

This work was in part supported by the Fundação para a Ciência e a Tecnologia \(Portuguese Foundation for Science and Technology\) through the Carnegie Mellon Portugal Program\.

## References

- \[1\]X\. An, L\. Shen, Y\. Luo, H\. Hu, and D\. Tao\(2026\)Adaptive batch size time evolving stochastic gradient descent for federated learning\.IEEE Transactions on Pattern Analysis and Machine Intelligence48\(2\),pp\. 1158–1170\.Cited by:[§I](https://arxiv.org/html/2608.18736#S1.p1.1)\.
- \[2\]J\. L\. Ba, J\. R\. Kiros, and G\. E\. Hinton\(2016\)Layer normalization\.arXiv preprint arXiv:1607\.06450\.Cited by:[§I](https://arxiv.org/html/2608.18736#S1.p6.1),[§II\-B](https://arxiv.org/html/2608.18736#S2.SS2.p2.1)\.
- \[3\]Z\. Bai, P\. Wang, T\. Xiao, T\. He, Z\. Han, Z\. Zhang, and M\. Z\. Shou\(2024\)Hallucination of multimodal large language models: a survey\.arXiv preprint arXiv:2404\.18930\.Cited by:[§I](https://arxiv.org/html/2608.18736#S1.p3.1)\.
- \[4\]E\. Ben Zaken, Y\. Goldberg, and S\. Ravfogel\(2022\)BitFit: simple parameter\-efficient fine\-tuning for transformer\-based masked language models\.InProceedings of the 60th Annual Meeting of the Association for Computational Linguistics \(Volume 2: Short Papers\),pp\. 1–9\.Cited by:[§II\-B](https://arxiv.org/html/2608.18736#S2.SS2.p1.1)\.
- \[5\]P\. Blanchard, E\. M\. El Mhamdi, R\. Guerraoui, and J\. Stainer\(2017\)Machine learning with adversaries: byzantine tolerant gradient descent\.Advances in Neural Information Processing Systems30\.Cited by:[§I](https://arxiv.org/html/2608.18736#S1.p4.1),[§II\-A](https://arxiv.org/html/2608.18736#S2.SS1.p1.1),[§V\-A](https://arxiv.org/html/2608.18736#S5.SS1.p7.1)\.
- \[6\]S\. Brody, U\. Alon, and E\. Yahav\(2023\)On the expressivity role of LayerNorm in transformers’ attention\.InFindings of the Association for Computational Linguistics: ACL 2023,pp\. 14211–14221\.Cited by:[§II\-B](https://arxiv.org/html/2608.18736#S2.SS2.p2.1)\.
- \[7\]H\. Cai, H\. Dong, H\. Wang, K\. Li, and O\. B\. Akan\(2025\)Graph representation\-based model poisoning on federated LLMs in CyberEdge networks\.arXiv preprint arXiv:2507\.01694\.Cited by:[§I](https://arxiv.org/html/2608.18736#S1.p1.1)\.
- \[8\]X\. Cao, M\. Fang, J\. Liu, and N\. Z\. Gong\(2021\)FLTrust: byzantine\-robust federated learning via trust bootstrapping\.InNetwork and Distributed System Security Symposium \(NDSS\),Cited by:[§II\-A](https://arxiv.org/html/2608.18736#S2.SS1.p2.1)\.
- \[9\]X\. Cao, Z\. Zhang, J\. Jia, and N\. Z\. Gong\(2022\)FLCert: provably secure federated learning against poisoning attacks\.IEEE Transactions on Information Forensics and Security17,pp\. 3691–3705\.Cited by:[§II\-A](https://arxiv.org/html/2608.18736#S2.SS1.p2.1)\.
- \[10\]C\. Chen, K\. Liu, Z\. Chen, Y\. Gu, Y\. Wu, M\. Tao, Z\. Fu, and J\. Ye\(2024\)INSIDE: LLMs’ internal states retain the power of hallucination detection\.arXiv preprint arXiv:2402\.03744\.Cited by:[§II\-B](https://arxiv.org/html/2608.18736#S2.SS2.p3.1)\.
- \[11\]X\. Chen, C\. Wang, Y\. Xue, N\. Zhang, X\. Yang, Q\. Li, Y\. Shen, L\. Liang, J\. Gu, and H\. Chen\(2024\)Unified hallucination detection for multimodal large language models\.arXiv preprint arXiv:2402\.03190\.Cited by:[§II\-B](https://arxiv.org/html/2608.18736#S2.SS2.p3.1)\.
- \[12\]Y\. Chen, Q\. Fu, Y\. Yuan,et al\.\(2023\)Hallucination detection: robustly discerning reliable answers in large language models\.InProceedings of the 32nd ACM International Conference on Information and Knowledge Management,pp\. 245–255\.Cited by:[§II\-B](https://arxiv.org/html/2608.18736#S2.SS2.p3.1)\.
- \[13\]Y\. Cheng, W\. Zhang, Z\. Zhang,et al\.\(2025\)Toward federated large language models: motivations, methods, and future directions\.IEEE Communications Surveys and Tutorials27\(4\),pp\. 2733–2764\.External Links:[Document](https://dx.doi.org/10.1109/COMST.2024.3503680)Cited by:[§I](https://arxiv.org/html/2608.18736#S1.p1.1)\.
- \[14\]J\. Devlin, M\. Chang, K\. Lee, and K\. Toutanova\(2019\)BERT: pre\-training of deep bidirectional transformers for language understanding\.InProceedings of the 2019 conference of the North American chapter of the association for computational linguistics: human language technologies, volume 1 \(long and short papers\),pp\. 4171–4186\.Cited by:[2nd item](https://arxiv.org/html/2608.18736#S5.I1.i2.p1.1)\.
- \[15\]J\. Dong, H\. Li, Y\. Cong, G\. Sun, Y\. Zhang, and L\. Van Gool\(2023\)No one left behind: real\-world federated class\-incremental learning\.IEEE Transactions on Pattern Analysis and Machine Intelligence46\(4\),pp\. 2054–2070\.Cited by:[§V\-A](https://arxiv.org/html/2608.18736#S5.SS1.p2.1)\.
- \[16\]X\. Du, C\. Xiao, and S\. Li\(2024\)HaloScope: harnessing unlabeled LLM generations for hallucination detection\.Advances in Neural Information Processing Systems37,pp\. 102948–102972\.Cited by:[§II\-B](https://arxiv.org/html/2608.18736#S2.SS2.p3.1)\.
- \[17\]X\. Fang, Z\. Huang, Z\. Tian, M\. Fang, Z\. Pan, Q\. Fang, Z\. Wen, H\. Pan, and D\. Li\(2025\)Zero\-resource hallucination detection for text generation via graph\-based contextual knowledge triples modeling\.InProceedings of the AAAI Conference on Artificial Intelligence,Vol\.39,pp\. 23868–23877\.Cited by:[§II\-B](https://arxiv.org/html/2608.18736#S2.SS2.p3.1)\.
- \[18\]S\. Farquhar, J\. Kossen, L\. Kuhn, and Y\. Gal\(2024\)Detecting hallucinations in large language models using semantic entropy\.Nature630\(8017\),pp\. 625–630\.Cited by:[§II\-B](https://arxiv.org/html/2608.18736#S2.SS2.p3.1)\.
- \[19\]K\. Furumai, Y\. Wang, M\. Shinohara, K\. Ikeda, Y\. Yu, and T\. Kato\(2023\)Detecting dialogue hallucination using graph neural networks\.In2023 International Conference on Machine Learning and Applications \(ICMLA\),pp\. 871–877\.Cited by:[§II\-B](https://arxiv.org/html/2608.18736#S2.SS2.p3.1)\.
- \[20\]X\. Guan, Y\. Liu, H\. Lin, Y\. Lu, B\. He, X\. Han, and L\. Sun\(2024\)Mitigating large language model hallucinations via autonomous knowledge graph\-based retrofitting\.InProceedings of the AAAI Conference on Artificial Intelligence,Vol\.38,pp\. 18126–18134\.Cited by:[§II\-B](https://arxiv.org/html/2608.18736#S2.SS2.p3.1)\.
- \[21\]A\. Gunjal, J\. Yin, and E\. Bas\(2024\)Detecting and preventing hallucinations in large vision\-language models\.InProceedings of the AAAI Conference on Artificial Intelligence,Vol\.38,pp\. 18135–18143\.Cited by:[§II\-B](https://arxiv.org/html/2608.18736#S2.SS2.p3.1)\.
- \[22\]L\. Guo, Y\. Fang, F\. Chen, P\. Liu, and S\. Xu\(2024\)Large language models with adaptive token fusion: a novel approach to reducing hallucinations and improving inference efficiency\.Authorea\.Cited by:[§II\-B](https://arxiv.org/html/2608.18736#S2.SS2.p3.1)\.
- \[23\]N\. Houlsby, A\. Giurgiu, S\. Jastrzebski, B\. Morrone, Q\. de Laroussilhe, A\. Gesmundo, M\. Attariyan, and S\. Gelly\(2019\)Parameter\-efficient transfer learning for NLP\.InProceedings of the 36th International Conference on Machine Learning,pp\. 2790–2799\.Cited by:[§II\-B](https://arxiv.org/html/2608.18736#S2.SS2.p1.1)\.
- \[24\]J\. Hu, D\. Wang, Z\. Wang,et al\.\(2024\)Federated large language model: solutions, challenges and future directions\.IEEE Wireless Communications\.Cited by:[§I](https://arxiv.org/html/2608.18736#S1.p1.1)\.
- \[25\]Y\. Kang and B\. Li\(2024\)Polaris: accelerating asynchronous federated learning with client selection\.IEEE Transactions on Cloud Computing12\(2\),pp\. 446–458\.Cited by:[§V\-A](https://arxiv.org/html/2608.18736#S5.SS1.p2.1)\.
- \[26\]K\. N\. Kumar, C\. K\. Mohan, and L\. R\. Cenkeramaddi\(2023\)The impact of adversarial attacks on federated learning: a survey\.IEEE Transactions on Pattern Analysis and Machine Intelligence46\(5\),pp\. 2672–2691\.Cited by:[§III\-D1](https://arxiv.org/html/2608.18736#S3.SS4.SSS1.p1.2)\.
- \[27\]H\. Li, H\. Madhukumar, N\. Methley,et al\.\(2026\)Future factories with 6G: agentic AI and cyber–physical digital twins\.IEEE Internet of Things Journal13\(9\),pp\. 17990–18006\.External Links:[Document](https://dx.doi.org/10.1109/JIOT.2025.3623075)Cited by:[§I](https://arxiv.org/html/2608.18736#S1.p1.1)\.
- \[28\]K\. Li, Z\. Zhang, A\. Pourkabirian, W\. Ni, F\. Dressler, and O\. B\. Akan\(2025\)Towards resilient federated learning in CyberEdge networks: recent advances and future trends\.arXiv preprint arXiv:2504\.01240\.Cited by:[§I](https://arxiv.org/html/2608.18736#S1.p1.1)\.
- \[29\]H\. Liu, W\. Xue, Y\. Chen,et al\.\(2024\)A survey on hallucination in large vision\-language models\.arXiv preprint arXiv:2402\.00253\.Cited by:[§I](https://arxiv.org/html/2608.18736#S1.p3.1)\.
- \[30\]H\. Liu, X\. Geng, L\. Lee, I\. Mordatch, S\. Levine, S\. Narang, and P\. Abbeel\(2022\)Towards better few\-shot and finetuning performance with forgetful causal language models\.arXiv preprint arXiv:2210\.13432\.Cited by:[§III\-A](https://arxiv.org/html/2608.18736#S3.SS1.p2.2)\.
- \[31\]H\. Liu, D\. Tam, M\. Muqeeth, J\. Mohta, T\. Huang, M\. Bansal, and C\. A\. Raffel\(2022\)Few\-shot parameter\-efficient fine\-tuning is better and cheaper than in\-context learning\.InAdvances in Neural Information Processing Systems,Vol\.35,pp\. 1950–1965\.Cited by:[§II\-B](https://arxiv.org/html/2608.18736#S2.SS2.p1.1)\.
- \[32\]Y\. Liu, G\. Liu, R\. Zhang, D\. Niyato, Z\. Xiong, D\. I\. Kim, K\. Huang, and H\. Du\(2024\)Hallucination\-aware optimization for large language model\-empowered communications\.arXiv preprint arXiv:2412\.06007\.Cited by:[§II\-B](https://arxiv.org/html/2608.18736#S2.SS2.p3.1)\.
- \[33\]B\. McMahan, E\. Moore, D\. Ramage, S\. Hampson, and B\. A\. y Arcas\(2017\)Communication\-efficient learning of deep networks from decentralized data\.InProceedings of the 20th International Conference on Artificial Intelligence and Statistics,pp\. 1273–1282\.Cited by:[§V\-A](https://arxiv.org/html/2608.18736#S5.SS1.p7.1)\.
- \[34\]T\. D\. Nguyen, P\. Rieger, H\. Chen,et al\.\(2022\)FLAME: taming backdoors in federated learning\.In31st USENIX Security Symposium \(USENIX Security 22\),pp\. 1415–1432\.Cited by:[§I](https://arxiv.org/html/2608.18736#S1.p4.1),[§II\-A](https://arxiv.org/html/2608.18736#S2.SS1.p1.1),[§V\-A](https://arxiv.org/html/2608.18736#S5.SS1.p7.1)\.
- \[35\]N\. Nonkes, S\. Agaronian, E\. Kanoulas, and R\. Petcu\(2024\)Leveraging graph structures to detect hallucinations in large language models\.arXiv preprint arXiv:2407\.04485\.Cited by:[§II\-B](https://arxiv.org/html/2608.18736#S2.SS2.p3.1)\.
- \[36\]W\. Qi, Y\. Ruan, Y\. Zuo, and T\. Li\(2022\)Parameter\-efficient tuning on layer normalization for pre\-trained language models\.arXiv preprint arXiv:2211\.08682\.Cited by:[§II\-B](https://arxiv.org/html/2608.18736#S2.SS2.p1.1)\.
- \[37\]A\. Radford, J\. Wu, R\. Child, D\. Luan, D\. Amodei, I\. Sutskever,et al\.\(2019\)Language models are unsupervised multitask learners\.OpenAI blog1\(8\),pp\. 9\.Cited by:[1st item](https://arxiv.org/html/2608.18736#S5.I1.i1.p1.1)\.
- \[38\]G\. Sriramanan, S\. Bharti, V\. S\. Sadasivan, S\. Saha, P\. Kattakinda, and S\. Feizi\(2024\)LLM\-Check: investigating detection of hallucinations in large language models\.Advances in Neural Information Processing Systems37,pp\. 34188–34216\.Cited by:[§II\-B](https://arxiv.org/html/2608.18736#S2.SS2.p3.1)\.
- \[39\]W\. Su, C\. Wang, Q\. Ai, Y\. Hu, Z\. Wu, Y\. Zhou, and Y\. Liu\(2024\)Unsupervised real\-time hallucination detection based on the internal states of large language models\.arXiv preprint arXiv:2403\.06448\.Cited by:[§II\-B](https://arxiv.org/html/2608.18736#S2.SS2.p3.1)\.
- \[40\]Y\. Sun, L\. Shen, H\. Sun, L\. Ding, and D\. Tao\(2023\)Efficient federated learning via local adaptive amended optimizer with linear speedup\.IEEE Transactions on Pattern Analysis and Machine Intelligence45\(12\),pp\. 14453–14464\.Cited by:[§V\-A](https://arxiv.org/html/2608.18736#S5.SS1.p2.1)\.
- \[41\]Z\. Sun, P\. Kairouz, A\. T\. Suresh, and H\. B\. McMahan\(2019\)Can you really backdoor federated learning?\.arXiv preprint arXiv:1911\.07963\.Cited by:[§I](https://arxiv.org/html/2608.18736#S1.p4.1),[§II\-A](https://arxiv.org/html/2608.18736#S2.SS1.p1.1),[§V\-A](https://arxiv.org/html/2608.18736#S5.SS1.p7.1)\.
- \[42\]M\. Tao, Y\. Tian, W\. Tu, Y\. Yang, X\. Yang, and X\. Tang\(2026\)Safe\-fedllm: delving into the safety of federated large language models\.InProceedings of the 64th Annual Meeting of the Association for Computational Linguistics \(Volume 1: Long Papers\),pp\. 24405–24420\.Cited by:[§I](https://arxiv.org/html/2608.18736#S1.p5.1),[§II\-A](https://arxiv.org/html/2608.18736#S2.SS1.p3.1)\.
- \[43\]H\. Touvron, T\. Lavril, G\. Izacard, X\. Martinet, M\. Lachaux, T\. Lacroix, B\. Rozière, N\. Goyal, E\. Hambro, F\. Azhar,et al\.\(2023\)LLaMA: open and efficient foundation language models\.arXiv preprint arXiv:2302\.13971\.Cited by:[3rd item](https://arxiv.org/html/2608.18736#S5.I1.i3.p1.1)\.
- \[44\]A\. Vaswani, N\. Shazeer, N\. Parmar, J\. Uszkoreit, L\. Jones, A\. N\. Gomez, Ł\. Kaiser, and I\. Polosukhin\(2017\)Attention is all you need\.Advances in Neural Information Processing Systems30\.Cited by:[§I](https://arxiv.org/html/2608.18736#S1.p6.1),[§II\-B](https://arxiv.org/html/2608.18736#S2.SS2.p2.1)\.
- \[45\]Z\. Wang, Y\. Zhou, Y\. Shi, and K\. B\. Letaief\(2025\)Federated fine\-tuning for pre\-trained foundation models over wireless networks\.IEEE Transactions on Wireless Communications\.Cited by:[§I](https://arxiv.org/html/2608.18736#S1.p1.1)\.
- \[46\]T\. Webb, S\. S\. Mondal, and I\. Momennejad\(2025\)A brain\-inspired agentic architecture to improve planning with LLMs\.Nature Communications16\(1\),pp\. 8633\.Cited by:[§I](https://arxiv.org/html/2608.18736#S1.p2.1)\.
- \[47\]P\. Wu, T\. Imbiriba, and P\. Closas\(2026\)A Bayesian framework for clustered federated learning\.IEEE Transactions on Pattern Analysis & Machine Intelligence48\(03\),pp\. 3471–3481\.External Links:ISSN 1939\-3539Cited by:[§I](https://arxiv.org/html/2608.18736#S1.p3.1)\.
- \[48\]R\. Xiong, Y\. Yang, D\. He, K\. Zheng, S\. Zheng, C\. Xing, H\. Zhang, Y\. Lan, L\. Wang, and T\. Liu\(2020\)On layer normalization in the transformer architecture\.InProceedings of the 37th International Conference on Machine Learning,pp\. 10524–10533\.Cited by:[§I](https://arxiv.org/html/2608.18736#S1.p6.1),[§II\-B](https://arxiv.org/html/2608.18736#S2.SS2.p2.1)\.
- \[49\]S\. Xu, Y\. Qian, and R\. Q\. Hu\(2019\)Data\-driven edge intelligence for robust network anomaly detection\.IEEE Transactions on Network Science and Engineering7\(3\),pp\. 1481–1492\.Cited by:[§III\-D1](https://arxiv.org/html/2608.18736#S3.SS4.SSS1.p3.2)\.
- \[50\]H\. Yang, J\. Chen, M\. Siew, T\. Lorido\-Botran, and C\. Joe\-Wong\(2025\)LLM\-powered decentralized generative agents with adaptive hierarchical knowledge graph for cooperative planning\.arXiv preprint arXiv:2502\.05453\.Cited by:[§I](https://arxiv.org/html/2608.18736#S1.p2.1)\.
- \[51\]Y\. Yao, J\. Zhang, J\. Wu,et al\.\(2024\)Federated large language models: current progress and future directions\.arXiv preprint arXiv:2409\.15723\.Cited by:[§I](https://arxiv.org/html/2608.18736#S1.p1.1),[§I](https://arxiv.org/html/2608.18736#S1.p2.1)\.
- \[52\]D\. Yin, Y\. Chen, R\. Kannan, and P\. Bartlett\(2018\)Byzantine\-robust distributed learning: towards optimal statistical rates\.InProceedings of the 35th International Conference on Machine Learning,pp\. 5650–5659\.Cited by:[§I](https://arxiv.org/html/2608.18736#S1.p4.1),[§I](https://arxiv.org/html/2608.18736#S1.p7.1),[§II\-A](https://arxiv.org/html/2608.18736#S2.SS1.p1.1),[§V\-A](https://arxiv.org/html/2608.18736#S5.SS1.p7.1)\.
- \[53\]B\. Zhang and R\. Sennrich\(2019\)Root mean square layer normalization\.InAdvances in Neural Information Processing Systems,Vol\.32\.Cited by:[§I](https://arxiv.org/html/2608.18736#S1.p6.1),[§II\-B](https://arxiv.org/html/2608.18736#S2.SS2.p2.1)\.
- \[54\]Z\. Zhang, X\. Cao, J\. Jia, and N\. Z\. Gong\(2022\)FLDetector: defending federated learning against model poisoning attacks via detecting malicious clients\.InProceedings of the 28th ACM SIGKDD Conference on Knowledge Discovery and Data Mining,pp\. 2545–2555\.Cited by:[§I](https://arxiv.org/html/2608.18736#S1.p7.1),[§II\-A](https://arxiv.org/html/2608.18736#S2.SS1.p2.1)\.
- \[55\]Z\. Zhang, Q\. Su, and X\. Sun\(2022\)Dim\-krum: backdoor\-resistant federated learning for nlp with dimension\-wise krum\-based aggregation\.InFindings of the Association for Computational Linguistics: EMNLP 2022,pp\. 339–354\.Cited by:[§I](https://arxiv.org/html/2608.18736#S1.p5.1),[§II\-A](https://arxiv.org/html/2608.18736#S2.SS1.p3.1)\.
- \[56\]X\. Zhou, M\. Zhang, Z\. Lee, W\. Ye, and S\. Zhang\(2025\)HADEMIF: hallucination detection and mitigation in large language models\.InThe Thirteenth International Conference on Learning Representations,Cited by:[§II\-B](https://arxiv.org/html/2608.18736#S2.SS2.p3.1)\.

## Appendix Contents

## Appendix AProbabilistic Analysis of Partial Bank Coverage at Activation

FedLNSideally benefits from the broadest available client coverage, and the history bank continues expanding after screening begins\. Waiting for full population coverage before beginning aggregation may nevertheless be impractically slow\. We therefore useMactM\_\{\\mathrm\{act\}\}to denote a partial bank coverage at which screening is permitted to start\.

This appendix analyzes, under uniform random participation, the probability that malicious clients form a majority of a partially populated bank and the number of rounds required to reach a chosen activation coverage\. The analysis relies on the50%50\\%breakdown point of the coordinate\-wise median: the median/MAD reference remains in its benign\-majority regime when malicious identities constitute fewer than half of the bank\. The resulting bound provides a reliability condition for early activation; it does not imply that a partial bank has the same statistical quality as a fully populated bank\.

### A\-AA Hypergeometric Model of Bank Contamination

Let

Ntbank:=\|ℋt\|N\_\{t\}^\{\\mathrm\{bank\}\}:=\|\\mathcal\{H\}\_\{t\}\|\(68\)denote the number of distinct client identities represented in the refreshed history bank at roundtt\.

Let𝒞mal\\mathcal\{C\}\_\{\\mathrm\{mal\}\}be the set of malicious clients, with

\|𝒞mal\|=α​K,0≤α<12,\|\\mathcal\{C\}\_\{\\mathrm\{mal\}\}\|=\\alpha K,\\qquad 0\\leq\\alpha<\\frac\{1\}\{2\},\(69\)whereα\\alphais the global malicious\-client fraction \(ifα​K\\alpha Kis not an integer, the same discussion applies with⌊α​K⌋\\lfloor\\alpha K\\rflooror⌈α​K⌉\\lceil\\alpha K\\rceilmalicious clients\)\.

LetMt:=\|ℋt∩𝒞mal\|M\_\{t\}:=\|\\mathcal\{H\}\_\{t\}\\cap\\mathcal\{C\}\_\{\\mathrm\{mal\}\}\|denote the number of malicious client identities represented in the bank, so the bank has a benign majority whenMt<Ntbank/2M\_\{t\}<N\_\{t\}^\{\\mathrm\{bank\}\}/2\. The undesirable event is

ℰt:=\{Mt≥Ntbank2\}\.\\mathcal\{E\}\_\{t\}:=\\left\\\{M\_\{t\}\\geq\\frac\{N\_\{t\}^\{\\mathrm\{bank\}\}\}\{2\}\\right\\\}\.\(70\)
FedLNSuses random client participation, where the server samples participating clients, in each communication round, uniformly at random from the population ofKKclients\. Because the bank stores*distinct*client IDs, once a client has appeared, the bank holds that client’s most recent signature\. Conditioned on the bank’s membership sizeNtbank=bN\_\{t\}^\{\\mathrm\{bank\}\}=b, the exchangeability of the sampling process implies that the bank can be treated as a uniformly random subset of sizebbdrawn fromKKclients\. Particularly, the server’s sampling rule does not prefer any client ID; any two subsets of the same size are equally likely after conditioning on the number of distinct observed clients\. Since the malicious set𝒞mal\\mathcal\{C\}\_\{\\mathrm\{mal\}\}is fixed at the start of the run, the question becomes how many of a random size\-bbsubset, drawn without replacement fromKKclients, belong to a fixed subset of sizeα​K\\alpha K, which is the hypergeometric setting\. Hence, conditioned onNtbank=bN\_\{t\}^\{\\mathrm\{bank\}\}=b, we have

Mt\|Ntbank=b∼Hypergeometric⁡\(K,α​K,b\),M\_\{t\}\\mid N\_\{t\}^\{\\mathrm\{bank\}\}=b\\sim\\operatorname\{Hypergeometric\}\(K,\\alpha K,b\),\(71\)i\.e\., for feasiblemm,

Pr⁡\(Mt=m∣Ntbank=b\)=\(α​Km\)​\(\(1−α\)​Kb−m\)\(Kb\)\.\\Pr\(M\_\{t\}=m\\mid N\_\{t\}^\{\\mathrm\{bank\}\}=b\)=\\frac\{\\binom\{\\alpha K\}\{m\}\\binom\{\(1\-\\alpha\)K\}\{b\-m\}\}\{\\binom\{K\}\{b\}\}\.\(72\)The conditional expectation is𝔼⁡\[Mt∣Ntbank=b\]=α​b\\mathbb\{E\}\[M\_\{t\}\\mid N\_\{t\}^\{\\mathrm\{bank\}\}=b\]=\\alpha b, so whenα<1/2\\alpha<1/2the expected malicious fraction in the bank stays below the median’s50%50\\%breakdown point\.

### A\-BConcentration of the Malicious Fraction in the Bank

For a hypergeometric random variable, a Chernoff\-type upper\-tail bound gives, for any thresholdγ\>α\\gamma\>\\alpha,

Pr\(MtNtbank≥γ\|Ntbank\)≤exp\(−NtbankD\(γ∥α\)\),\\Pr\\big\(\\frac\{M\_\{t\}\}\{N\_\{t\}^\{\\mathrm\{bank\}\}\}\\geq\\gamma\\,\\big\|\\,N\_\{t\}^\{\\mathrm\{bank\}\}\\big\)\\leq\\exp\\left\(\-N\_\{t\}^\{\\mathrm\{bank\}\}D\(\\gamma\\\|\\alpha\)\\right\),\(73\)whereD\(p∥q\)D\(p\\\|q\)is the Bernoulli KL divergence

D\(p∥q\)=plogpq\+\(1−p\)log1−p1−q\.D\(p\\\|q\)=p\\log\\frac\{p\}\{q\}\+\(1\-p\)\\log\\frac\{1\-p\}\{1\-q\}\.\(74\)Settingγ=1/2\\gamma=1/2and usingα<1/2\\alpha<1/2gives

Pr⁡\(Mt≥Ntbank2\|Ntbank\)≤exp⁡\(−Ntbank​D​\(12∥α\)\),\\Pr\\left\(M\_\{t\}\\geq\\frac\{N\_\{t\}^\{\\mathrm\{bank\}\}\}\{2\}\\,\\middle\|\\,N\_\{t\}^\{\\mathrm\{bank\}\}\\right\)\\leq\\exp\\left\(\-N\_\{t\}^\{\\mathrm\{bank\}\}D\\left\(\\frac\{1\}\{2\}\\middle\\\|\\alpha\\right\)\\right\),\(75\)with

D⁡\(12∥α\)=12​log⁡1/2α\+12​log⁡1/21−αD\\left\(\\frac\{1\}\{2\}\\middle\\\|\\alpha\\right\)=\\frac\{1\}\{2\}\\log\\frac\{1/2\}\{\\alpha\}\+\\frac\{1\}\{2\}\\log\\frac\{1/2\}\{1\-\\alpha\}\(76\)or, equivalently,

D⁡\(12∥α\)=12​log⁡14​α​\(1−α\)\.D\\left\(\\frac\{1\}\{2\}\\middle\\\|\\alpha\\right\)=\\frac\{1\}\{2\}\\log\\frac\{1\}\{4\\alpha\(1\-\\alpha\)\}\.\(77\)This quantity is positive forα<1/2\\alpha<1/2, so the upper bound on the probability of a malicious\-majority bank decays exponentially withNtbankN\_\{t\}^\{\\mathrm\{bank\}\}\. This provides the probabilistic motivation for delaying screening until the history bank reaches a sufficiently broad client coverage under random participation\.

###### Proposition 3 \(Bound on a malicious\-majority history bank\)\.

Suppose that the fraction of malicious clients satisfiesα<1/2\\alpha<1/2, and letMtM\_\{t\}denote the number of malicious signatures in a history bank of sizeNtbankN\_\{t\}^\{\\mathrm\{bank\}\}\. Then the probability that malicious signatures constitute at least half of the bank is bounded by

Pr⁡\(Mt≥Ntbank2\|Ntbank\)≤exp⁡\(−2​Ntbank​\(12−α\)2\)\.\\Pr\\left\(M\_\{t\}\\geq\\frac\{N\_\{t\}^\{\\mathrm\{bank\}\}\}\{2\}\\,\\middle\|\\,N\_\{t\}^\{\\mathrm\{bank\}\}\\right\)\\leq\\exp\\left\(\-2N\_\{t\}^\{\\mathrm\{bank\}\}\\left\(\\frac\{1\}\{2\}\-\\alpha\\right\)^\{2\}\\right\)\.\(78\)

###### Proof\.

From the KL\-based concentration bound in \([75](https://arxiv.org/html/2608.18736#A1.E75)\), we have

Pr⁡\(Mt≥Ntbank2\|Ntbank\)≤exp⁡\(−Ntbank​D​\(12∥α\)\)\.\\Pr\\left\(M\_\{t\}\\geq\\frac\{N\_\{t\}^\{\\mathrm\{bank\}\}\}\{2\}\\,\\middle\|\\,N\_\{t\}^\{\\mathrm\{bank\}\}\\right\)\\leq\\exp\\left\(\-N\_\{t\}^\{\\mathrm\{bank\}\}D\\left\(\\frac\{1\}\{2\}\\middle\\\|\\alpha\\right\)\\right\)\.\(79\)To obtain a simpler sufficient bound, let

g:=12−αg:=\\frac\{1\}\{2\}\-\\alpha\(80\)be the margin between the median breakdown point and the attack fraction\. Then

α⁡\(1−α\)=\(12−g\)​\(12\+g\)=14−g2\.\\alpha\(1\-\\alpha\)=\\left\(\\frac\{1\}\{2\}\-g\\right\)\\left\(\\frac\{1\}\{2\}\+g\\right\)=\\frac\{1\}\{4\}\-g^\{2\}\.\(81\)Therefore,

4​α​\(1−α\)=1−4​g2\.4\\alpha\(1\-\\alpha\)=1\-4g^\{2\}\.\(82\)Using \([77](https://arxiv.org/html/2608.18736#A1.E77)\), we obtain

D⁡\(12∥α\)=12​log⁡11−4​g2\.D\\left\(\\frac\{1\}\{2\}\\middle\\\|\\alpha\\right\)=\\frac\{1\}\{2\}\\log\\frac\{1\}\{1\-4g^\{2\}\}\.\(83\)Sincelog⁡11−x≥x\\log\\frac\{1\}\{1\-x\}\\geq xfor0≤x<10\\leq x<1, it follows that

D⁡\(12∥α\)≥12⋅4​g2=2​g2=2​\(12−α\)2\.D\\left\(\\frac\{1\}\{2\}\\middle\\\|\\alpha\\right\)\\geq\\frac\{1\}\{2\}\\cdot 4g^\{2\}=2g^\{2\}=2\\left\(\\frac\{1\}\{2\}\-\\alpha\\right\)^\{2\}\.\(84\)Substituting \([84](https://arxiv.org/html/2608.18736#A1.E84)\) into \([75](https://arxiv.org/html/2608.18736#A1.E75)\) yields

Pr⁡\(Mt≥Ntbank2\|Ntbank\)≤exp⁡\(−2​Ntbank​\(12−α\)2\),\\Pr\\left\(M\_\{t\}\\geq\\frac\{N\_\{t\}^\{\\mathrm\{bank\}\}\}\{2\}\\,\\middle\|\\,N\_\{t\}^\{\\mathrm\{bank\}\}\\right\)\\leq\\exp\\left\(\-2N\_\{t\}^\{\\mathrm\{bank\}\}\\left\(\\frac\{1\}\{2\}\-\\alpha\\right\)^\{2\}\\right\),\(85\)which proves \([78](https://arxiv.org/html/2608.18736#A1.E78)\)\. ∎

The bound in Proposition[3](https://arxiv.org/html/2608.18736#Thmproposition3)makes the dependence on attack strength explicit\. Asα→1/2\\alpha\\to 1/2, the marging=1/2−αg=1/2\-\\alphashrinks, the exponent weakens, and a larger history bank is required to achieve the same confidence level\. In contrast, whenα≪1/2\\alpha\\ll 1/2, the same bank size already provides a strong guarantee against a malicious\-majority bank\.

Suppose screening must begin before full population coverage is available and the desired probability of a malicious\-majority activation bank is at mostη\\eta\. From \([75](https://arxiv.org/html/2608.18736#A1.E75)\), it suffices to chooseMactM\_\{\\mathrm\{act\}\}such thatexp\(−MactD\(1/2∥α\)\)≤η\\exp\(\-M\_\{\\mathrm\{act\}\}D\(1/2\\\|\\alpha\)\)\\leq\\eta,

Mact≥log⁡\(1/η\)D⁡\(12∥α\)\.M\_\{\\mathrm\{act\}\}\\geq\\frac\{\\log\(1/\\eta\)\}\{D\\left\(\\frac\{1\}\{2\}\\middle\\\|\\alpha\\right\)\}\.\(86\)Using the lower bound \([84](https://arxiv.org/html/2608.18736#A1.E84)\), a more conservative sufficient condition is

Mact≥log⁡\(1/η\)2​\(12−α\)2\.M\_\{\\mathrm\{act\}\}\\geq\\frac\{\\log\(1/\\eta\)\}\{2\\left\(\\frac\{1\}\{2\}\-\\alpha\\right\)^\{2\}\}\.\(87\)When the total number of clientsKKis fixed, the activation coverage can be expressed as a population fractionMact=ρ​KM\_\{\\mathrm\{act\}\}=\\rho K, in which case \([75](https://arxiv.org/html/2608.18736#A1.E75)\) becomes

Pr⁡\(Mt≥Ntbank2\|Ntbank≥ρ​K\)≤exp⁡\(−ρ​K​D​\(12∥α\)\)\.\\Pr\\left\(M\_\{t\}\\geq\\frac\{N\_\{t\}^\{\\mathrm\{bank\}\}\}\{2\}\\,\\middle\|\\,N\_\{t\}^\{\\mathrm\{bank\}\}\\geq\\rho K\\right\)\\leq\\exp\\left\(\-\\rho KD\\left\(\\frac\{1\}\{2\}\\middle\\\|\\alpha\\right\)\\right\)\.\(88\)

### A\-CTime to Reach the Activation Coverage

We now estimate how quickly the bank reaches a chosen activation coverageMactM\_\{\\mathrm\{act\}\}under uniform random participation\. Letqqbe the per\-round participation rate, so that in each round approximatelyq​KqKclients are selected uniformly at random\. For a fixed client, the probability of not being selected in one round is1−q1\-q, so the probability of not appearing afterrrrounds is\(1−q\)r\(1\-q\)^\{r\}, and the probability of having appeared at least once by roundrris1−\(1−q\)r1\-\(1\-q\)^\{r\}\. The expected number of distinct clients in the bank afterrrrounds is therefore

𝔼⁡\[Br\]=K⁡\(1−\(1−q\)r\)\.\\mathbb\{E\}\[B\_\{r\}\]=K\\left\(1\-\(1\-q\)^\{r\}\\right\)\.\(89\)For a target coverage fractionρ\\rho, the expected bank size reachesρ​K\\rho KonceK⁡\(1−\(1−q\)r\)≥ρ​KK\(1\-\(1\-q\)^\{r\}\)\\geq\\rho K, i\.e\.,\(1−q\)r≤1−ρ\(1\-q\)^\{r\}\\leq 1\-\\rho, which gives

r≥log⁡\(1−ρ\)log⁡\(1−q\)\.r\\geq\\frac\{\\log\(1\-\\rho\)\}\{\\log\(1\-q\)\}\.\(90\)
TABLE I:Expected round at which the bank reaches each coverage threshold under random participation withK=200K=200and participation rateq=0\.1q=0\.1\.Bank coverageρ\\rhoMact=ρ​KM\_\{\\mathrm\{act\}\}=\\rho KExpected activation round25%25\\%50503350%50\\%1001007775%75\\%1501501414In our experiments, whereq=0\.1q=0\.1andK=200K=200, Table[I](https://arxiv.org/html/2608.18736#A1.T1)presents the expected round at which the bank reaches each coverage threshold\. This expectation can be complemented with a tail bound on the probability that the bank has*not*yet reached the threshold\. Letμr:=𝔼⁡\[Br\]=K⁡\(1−\(1−q\)r\)\\mu\_\{r\}:=\\mathbb\{E\}\[B\_\{r\}\]=K\(1\-\(1\-q\)^\{r\}\)\. Because the coverage indicators are exchangeable and negatively associated under uniform random sampling, a Chernoff\-style lower\-tail bound gives

Pr⁡\(Br<Mact\)≤exp⁡\(−μr​δr22\),δr:=1−Mactμr,\\Pr\(B\_\{r\}<M\_\{\\mathrm\{act\}\}\)\\leq\\exp\\big\(\-\\frac\{\\mu\_\{r\}\\delta\_\{r\}^\{2\}\}\{2\}\\big\),\\;\\delta\_\{r\}:=1\-\\frac\{M\_\{\\mathrm\{act\}\}\}\{\\mu\_\{r\}\},\(91\)wheneverμr\>Mact\\mu\_\{r\}\>M\_\{\\mathrm\{act\}\}\. For example, withK=200K=200,q=0\.1q=0\.1, andMact=100M\_\{\\mathrm\{act\}\}=100, afterr=12r=12roundsμ12=200​\(1−0\.912\)≈143\.5\\mu\_\{12\}=200\(1\-0\.9^\{12\}\)\\approx 143\.5, soδ12=1−100/143\.5≈0\.303\\delta\_\{12\}=1\-100/143\.5\\approx 0\.303and

Pr⁡\(B12<100\)≤exp⁡\(−143\.5⋅0\.30322\)≈1\.4×10−3\.\\Pr\(B\_\{12\}<100\)\\leq\\exp\\big\(\-\\frac\{143\.5\\cdot 0\.303^\{2\}\}\{2\}\\big\)\\approx 1\.4\\times 10^\{\-3\}\.\(92\)Under the participation rate used in our experiments, the bank therefore reaches the half\-population threshold early with high probability\.

The activation\-time and bank\-composition analyses above assume uniform random client participation, matching the sampling procedure used in the experiments\. In deployments with nonuniform or intermittent participation, some client identities may appear rarely or never within the training horizon, making full bank coverage impractically slow\. The hypergeometric and activation\-time bounds do not directly apply to such participation processes\. In that setting,MactM\_\{\\mathrm\{act\}\}should be interpreted as a practical early\-activation coverage, while the bank should continue to expand whenever previously unseen clients participate\.

## Appendix BProofs for Theoretical Analysis

This appendix provides the assumptions and proofs supporting Section[IV](https://arxiv.org/html/2608.18736#S4)\. Appendix[B\-A](https://arxiv.org/html/2608.18736#A2.SS1)proves the normalization\-parameter margin decomposition, Appendix[B\-B](https://arxiv.org/html/2608.18736#A2.SS2)proves the screened\-aggregation and stationarity bounds, Appendix[B\-C](https://arxiv.org/html/2608.18736#A2.SS3)decomposes the screening error, and Appendix[B\-D](https://arxiv.org/html/2608.18736#A2.SS4)bounds local\-training drift\.

### B\-AProof of the Normalization\-Parameter Margin Decomposition

This proof establishes the first\-order contribution of a client’s normalization\-parameter update to output\-token margins\. We proceed in three steps\.

First, we analyze the margin change for one fixed promptxx\. Second, we split the client update into two parts: the normalization\-parameter part and the remaining\-parameter part\. Third, we average over promptsx∼𝒳x\\sim\\mathcal\{X\}, because the expected margin change in \([41](https://arxiv.org/html/2608.18736#S4.E41)\) is defined over a prompt distribution\.

We use two remainder terms\. The term

ℛt,i​\(x,u,v\)\\mathcal\{R\}\_\{t,i\}\(x,u,v\)\(93\)is the*pointwise Taylor remainder*\. It is the Taylor approximation error for one fixed promptxxand token pair\(u,v\)\(u,v\)\. The term

Rt,i​\(u,v\)R\_\{t,i\}\(u,v\)\(94\)is the*prompt\-averaged remainder*, defined by

Rt,i​\(u,v\):=𝔼x∼𝒳​\[ℛt,i​\(x,u,v\)\]\.R\_\{t,i\}\(u,v\):=\\mathbb\{E\}\_\{x\\sim\\mathcal\{X\}\}\\left\[\\mathcal\{R\}\_\{t,i\}\(x,u,v\)\\right\]\.\(95\)Thus,ℛt,i​\(x,u,v\)\\mathcal\{R\}\_\{t,i\}\(x,u,v\)depends on a specific prompt, whileRt,i​\(u,v\)R\_\{t,i\}\(u,v\)averages this error over prompts\.

###### Assumption 1 \(Smooth prompt\-dependent margins\)\.

Fix a token pair\(u,v\)∈𝒱×𝒱\(u,v\)\\in\\mathcal\{V\}\\times\\mathcal\{V\}\. For every promptxxin the support of𝒳\\mathcal\{X\}, the mapping

𝐰↦mu,v​\(x,𝐰\)\\mathbf\{w\}\\mapsto m\_\{u,v\}\(x;\\mathbf\{w\}\)\(96\)is twice continuously differentiable in a neighborhood of𝐰t\\mathbf\{w\}\_\{t\}\. Moreover, there existsLm\>0L\_\{m\}\>0such that

‖∇𝐰2​mu,v​\(x,𝐰\)‖op≤Lm\\left\\\|\\nabla\_\{\\mathbf\{w\}\}^\{2\}m\_\{u,v\}\(x;\\mathbf\{w\}\)\\right\\\|\_\{\\mathrm\{op\}\}\\leq L\_\{m\}\(97\)for all𝐰\\mathbf\{w\}in that neighborhood and all relevant promptsxx\.

Conditioned on roundttand clientii, the update

Δ​𝐰t,i=\(Δ​𝐩t,i,Δ​𝐪t,i\)\\Delta\\mathbf\{w\}\_\{t,i\}=\(\\Delta\\mathbf\{p\}\_\{t,i\},\\Delta\\mathbf\{q\}\_\{t,i\}\)\(98\)is treated as fixed with respect to the prompt drawx∼𝒳x\\sim\\mathcal\{X\}\. Thus, the expectation overxxaverages prompt\-dependent gradients and remainders, while the update vectorsΔ​𝐩t,i\\Delta\\mathbf\{p\}\_\{t,i\}andΔ​𝐪t,i\\Delta\\mathbf\{q\}\_\{t,i\}do not depend on the sampled prompt\.

###### Proof of Proposition[1](https://arxiv.org/html/2608.18736#Thmproposition1)\.

Fix a promptxxand token pair\(u,v\)\(u,v\)\. Define

ϕx​\(s\):=mu,v​\(x,𝐰t\+s​Δ​𝐰t,i\),s∈\[0,1\]\.\\phi\_\{x\}\(s\):=m\_\{u,v\}\\left\(x;\\mathbf\{w\}\_\{t\}\+s\\Delta\\mathbf\{w\}\_\{t,i\}\\right\),\\qquad s\\in\[0,1\]\.\(99\)This scalar function traces the token margin along the straight path from the current global model𝐰t\\mathbf\{w\}\_\{t\}to the locally updated model

𝐰t\+Δ​𝐰t,i\.\\mathbf\{w\}\_\{t\}\+\\Delta\\mathbf\{w\}\_\{t,i\}\.\(100\)
By the fundamental theorem of calculus,

mu,v​\(x,𝐰t\+Δ​𝐰t,i\)−mu,v​\(x,𝐰t\)=∫01ϕx′​\(s\)​𝑑s\.m\_\{u,v\}\(x;\\mathbf\{w\}\_\{t\}\+\\Delta\\mathbf\{w\}\_\{t,i\}\)\-m\_\{u,v\}\(x;\\mathbf\{w\}\_\{t\}\)=\\int\_\{0\}^\{1\}\\phi\_\{x\}^\{\\prime\}\(s\)\\,ds\.\(101\)Using the chain rule,

ϕx′​\(s\)=∇𝐰mu,v​\(x,𝐰t\+s​Δ​𝐰t,i\)⊤​Δ​𝐰t,i\.\\phi\_\{x\}^\{\\prime\}\(s\)=\\nabla\_\{\\mathbf\{w\}\}m\_\{u,v\}\\left\(x;\\mathbf\{w\}\_\{t\}\+s\\Delta\\mathbf\{w\}\_\{t,i\}\\right\)^\{\\top\}\\Delta\\mathbf\{w\}\_\{t,i\}\.\(102\)Therefore,

mu,v​\(x,𝐰t\+Δ​𝐰t,i\)−mu,v​\(x,𝐰t\)=∫01∇𝐰mu,v​\(x,𝐰t\+s​Δ​𝐰t,i\)⊤​Δ​𝐰t,i​𝑑s\.m\_\{u,v\}\(x;\\mathbf\{w\}\_\{t\}\+\\Delta\\mathbf\{w\}\_\{t,i\}\)\-m\_\{u,v\}\(x;\\mathbf\{w\}\_\{t\}\)=\\int\_\{0\}^\{1\}\\nabla\_\{\\mathbf\{w\}\}m\_\{u,v\}\\left\(x;\\mathbf\{w\}\_\{t\}\+s\\Delta\\mathbf\{w\}\_\{t,i\}\\right\)^\{\\top\}\\Delta\\mathbf\{w\}\_\{t,i\}\\,ds\.
We now isolate the first\-order effect at the current global model\. Add and subtract

∇𝐰mu,v​\(x,𝐰t\)\\nabla\_\{\\mathbf\{w\}\}m\_\{u,v\}\(x;\\mathbf\{w\}\_\{t\}\)\(103\)inside the integral:

mu,v​\(x,𝐰t\+Δ​𝐰t,i\)−mu,v​\(x,𝐰t\)=∇𝐰mu,v​\(x,𝐰t\)⊤​Δ​𝐰t,i\+ℛt,i​\(x,u,v\),m\_\{u,v\}\(x;\\mathbf\{w\}\_\{t\}\+\\Delta\\mathbf\{w\}\_\{t,i\}\)\-m\_\{u,v\}\(x;\\mathbf\{w\}\_\{t\}\)=\\nabla\_\{\\mathbf\{w\}\}m\_\{u,v\}\(x;\\mathbf\{w\}\_\{t\}\)^\{\\top\}\\Delta\\mathbf\{w\}\_\{t,i\}\+\\mathcal\{R\}\_\{t,i\}\(x,u,v\),\(104\)where the pointwise Taylor remainder is

ℛt,i​\(x,u,v\):=∫01\[∇𝐰mu,v​\(x,𝐰t\+s​Δ​𝐰t,i\)−∇𝐰mu,v​\(x,𝐰t\)\]⊤​Δ​𝐰t,i​𝑑s\.\\mathcal\{R\}\_\{t,i\}\(x,u,v\):=\\int\_\{0\}^\{1\}\\Big\[\\nabla\_\{\\mathbf\{w\}\}m\_\{u,v\}\\left\(x;\\mathbf\{w\}\_\{t\}\+s\\Delta\\mathbf\{w\}\_\{t,i\}\\right\)\-\\nabla\_\{\\mathbf\{w\}\}m\_\{u,v\}\(x;\\mathbf\{w\}\_\{t\}\)\\Big\]^\{\\top\}\\Delta\\mathbf\{w\}\_\{t,i\}\\,ds\.\(105\)This term contains the part of the margin change not captured by the linear approximation at𝐰t\\mathbf\{w\}\_\{t\}\.

Equivalently, Taylor’s theorem with integral remainder gives

ℛt,i​\(x,u,v\)=∫01\(1−s\)​Δ​𝐰t,i⊤​∇𝐰2mu,v​\(x,𝐰t\+s​Δ​𝐰t,i\)​Δ​𝐰t,i​𝑑s\.\\mathcal\{R\}\_\{t,i\}\(x,u,v\)=\\int\_\{0\}^\{1\}\(1\-s\)\\Delta\\mathbf\{w\}\_\{t,i\}^\{\\top\}\\nabla\_\{\\mathbf\{w\}\}^\{2\}m\_\{u,v\}\\left\(x;\\mathbf\{w\}\_\{t\}\+s\\Delta\\mathbf\{w\}\_\{t,i\}\\right\)\\Delta\\mathbf\{w\}\_\{t,i\}\\,ds\.\(106\)Using Assumption[1](https://arxiv.org/html/2608.18736#Thmassumption1),

\|ℛt,i​\(x,u,v\)\|\\displaystyle\|\\mathcal\{R\}\_\{t,i\}\(x,u,v\)\|≤∫01\(1−s\)​‖∇𝐰2​mu,v​\(x,𝐰t\+s​Δ​𝐰t,i\)‖op​‖Δ​𝐰t,i‖22​𝑑s\\displaystyle\\leq\\int\_\{0\}^\{1\}\(1\-s\)\\left\\\|\\nabla\_\{\\mathbf\{w\}\}^\{2\}m\_\{u,v\}\\left\(x;\\mathbf\{w\}\_\{t\}\+s\\Delta\\mathbf\{w\}\_\{t,i\}\\right\)\\right\\\|\_\{\\mathrm\{op\}\}\\left\\\|\\Delta\\mathbf\{w\}\_\{t,i\}\\right\\\|\_\{2\}^\{2\}\\,ds≤∫01\(1−s\)​Lm​‖Δ​𝐰t,i‖22​𝑑s\\displaystyle\\leq\\int\_\{0\}^\{1\}\(1\-s\)L\_\{m\}\\left\\\|\\Delta\\mathbf\{w\}\_\{t,i\}\\right\\\|\_\{2\}^\{2\}\\,ds=Lm2​‖Δ​𝐰t,i‖22\.\\displaystyle=\\frac\{L\_\{m\}\}\{2\}\\left\\\|\\Delta\\mathbf\{w\}\_\{t,i\}\\right\\\|\_\{2\}^\{2\}\.\(107\)
Next, split the first\-order term into the normalization\-parameter part and the remaining\-parameter part\. Since

𝐰=\(𝐩,𝐪\),Δ​𝐰t,i=\(Δ​𝐩t,i,Δ​𝐪t,i\),\\mathbf\{w\}=\(\\mathbf\{p\},\\mathbf\{q\}\),\\qquad\\Delta\\mathbf\{w\}\_\{t,i\}=\(\\Delta\\mathbf\{p\}\_\{t,i\},\\Delta\\mathbf\{q\}\_\{t,i\}\),\(108\)we have

∇𝐰mu,v​\(x,𝐰t\)⊤​Δ​𝐰t,i=∇𝐩mu,v​\(x,𝐰t\)⊤​Δ​𝐩t,i\+∇𝐪mu,v​\(x,𝐰t\)⊤​Δ​𝐪t,i\.\\nabla\_\{\\mathbf\{w\}\}m\_\{u,v\}\(x;\\mathbf\{w\}\_\{t\}\)^\{\\top\}\\Delta\\mathbf\{w\}\_\{t,i\}=\\nabla\_\{\\mathbf\{p\}\}m\_\{u,v\}\(x;\\mathbf\{w\}\_\{t\}\)^\{\\top\}\\Delta\\mathbf\{p\}\_\{t,i\}\+\\nabla\_\{\\mathbf\{q\}\}m\_\{u,v\}\(x;\\mathbf\{w\}\_\{t\}\)^\{\\top\}\\Delta\\mathbf\{q\}\_\{t,i\}\.\(109\)
Substituting \([109](https://arxiv.org/html/2608.18736#A2.E109)\) into \([104](https://arxiv.org/html/2608.18736#A2.E104)\) gives the pointwise decomposition

mu,v​\(x,𝐰t\+Δ​𝐰t,i\)−mu,v​\(x,𝐰t\)=∇𝐩mu,v​\(x,𝐰t\)⊤​Δ​𝐩t,i\+∇𝐪mu,v​\(x,𝐰t\)⊤​Δ​𝐪t,i\+ℛt,i​\(x,u,v\)\.m\_\{u,v\}\(x;\\mathbf\{w\}\_\{t\}\+\\Delta\\mathbf\{w\}\_\{t,i\}\)\-m\_\{u,v\}\(x;\\mathbf\{w\}\_\{t\}\)=\\nabla\_\{\\mathbf\{p\}\}m\_\{u,v\}\(x;\\mathbf\{w\}\_\{t\}\)^\{\\top\}\\Delta\\mathbf\{p\}\_\{t,i\}\+\\nabla\_\{\\mathbf\{q\}\}m\_\{u,v\}\(x;\\mathbf\{w\}\_\{t\}\)^\{\\top\}\\Delta\\mathbf\{q\}\_\{t,i\}\+\\mathcal\{R\}\_\{t,i\}\(x,u,v\)\.\(110\)
We now take expectation overx∼𝒳x\\sim\\mathcal\{X\}\. This step is necessary becauseΔ​m¯t,i​\(u,v\)\\Delta\\bar\{m\}\_\{t,i\}\(u,v\)in \([41](https://arxiv.org/html/2608.18736#S4.E41)\) is the average margin change over prompts\. Taking expectation on both sides of \([110](https://arxiv.org/html/2608.18736#A2.E110)\) gives

Δ​m¯t,i​\(u,v\)=𝔼x∼𝒳​\[∇𝐩mu,v​\(x,𝐰t\)⊤​Δ​𝐩t,i\]\+𝔼x∼𝒳​\[∇𝐪mu,v​\(x,𝐰t\)⊤​Δ​𝐪t,i\]\+𝔼x∼𝒳​\[ℛt,i​\(x,u,v\)\]\.\\Delta\\bar\{m\}\_\{t,i\}\(u,v\)=\\mathbb\{E\}\_\{x\\sim\\mathcal\{X\}\}\\left\[\\nabla\_\{\\mathbf\{p\}\}m\_\{u,v\}\(x;\\mathbf\{w\}\_\{t\}\)^\{\\top\}\\Delta\\mathbf\{p\}\_\{t,i\}\\right\]\+\\mathbb\{E\}\_\{x\\sim\\mathcal\{X\}\}\\left\[\\nabla\_\{\\mathbf\{q\}\}m\_\{u,v\}\(x;\\mathbf\{w\}\_\{t\}\)^\{\\top\}\\Delta\\mathbf\{q\}\_\{t,i\}\\right\]\+\\mathbb\{E\}\_\{x\\sim\\mathcal\{X\}\}\\left\[\\mathcal\{R\}\_\{t,i\}\(x,u,v\)\\right\]\.\(111\)BecauseΔ​𝐩t,i\\Delta\\mathbf\{p\}\_\{t,i\}andΔ​𝐪t,i\\Delta\\mathbf\{q\}\_\{t,i\}are fixed with respect to the prompt drawxx, they can be moved outside the expectation\. For the normalization\-parameter part, ifΔ​𝐩t,i∈ℝdp\\Delta\\mathbf\{p\}\_\{t,i\}\\in\\mathbb\{R\}^\{d\_\{p\}\}, then

𝔼x∼𝒳​\[∇𝐩mu,v​\(x,𝐰t\)⊤​Δ​𝐩t,i\]\\displaystyle\\mathbb\{E\}\_\{x\\sim\\mathcal\{X\}\}\\left\[\\nabla\_\{\\mathbf\{p\}\}m\_\{u,v\}\(x;\\mathbf\{w\}\_\{t\}\)^\{\\top\}\\Delta\\mathbf\{p\}\_\{t,i\}\\right\]=𝔼x∼𝒳​\[∑r=1dp∂mu,v​\(x,𝐰t\)∂𝐩⁡\[r\]​Δ​𝐩t,i​\[r\]\]\\displaystyle=\\mathbb\{E\}\_\{x\\sim\\mathcal\{X\}\}\\left\[\\sum\_\{r=1\}^\{d\_\{p\}\}\\frac\{\\partial m\_\{u,v\}\(x;\\mathbf\{w\}\_\{t\}\)\}\{\\partial\\mathbf\{p\}\[r\]\}\\Delta\\mathbf\{p\}\_\{t,i\}\[r\]\\right\]=∑r=1dp𝔼x∼𝒳​\[∂mu,v​\(x,𝐰t\)∂𝐩⁡\[r\]\]​Δ​𝐩t,i​\[r\]\\displaystyle=\\sum\_\{r=1\}^\{d\_\{p\}\}\\mathbb\{E\}\_\{x\\sim\\mathcal\{X\}\}\\left\[\\frac\{\\partial m\_\{u,v\}\(x;\\mathbf\{w\}\_\{t\}\)\}\{\\partial\\mathbf\{p\}\[r\]\}\\right\]\\Delta\\mathbf\{p\}\_\{t,i\}\[r\]=𝔼x∼𝒳​\[∇𝐩mu,v​\(x,𝐰t\)\]⊤​Δ​𝐩t,i\.\\displaystyle=\\mathbb\{E\}\_\{x\\sim\\mathcal\{X\}\}\\left\[\\nabla\_\{\\mathbf\{p\}\}m\_\{u,v\}\(x;\\mathbf\{w\}\_\{t\}\)\\right\]^\{\\top\}\\Delta\\mathbf\{p\}\_\{t,i\}\.\(112\)The same argument gives

𝔼x∼𝒳​\[∇𝐪mu,v​\(x,𝐰t\)⊤​Δ​𝐪t,i\]=𝔼x∼𝒳​\[∇𝐪mu,v​\(x,𝐰t\)\]⊤​Δ​𝐪t,i\.\\mathbb\{E\}\_\{x\\sim\\mathcal\{X\}\}\\left\[\\nabla\_\{\\mathbf\{q\}\}m\_\{u,v\}\(x;\\mathbf\{w\}\_\{t\}\)^\{\\top\}\\Delta\\mathbf\{q\}\_\{t,i\}\\right\]=\\mathbb\{E\}\_\{x\\sim\\mathcal\{X\}\}\\left\[\\nabla\_\{\\mathbf\{q\}\}m\_\{u,v\}\(x;\\mathbf\{w\}\_\{t\}\)\\right\]^\{\\top\}\\Delta\\mathbf\{q\}\_\{t,i\}\.\(113\)
Define

𝐠p,u,v:=𝔼x∼𝒳​\[∇𝐩mu,v​\(x,𝐰t\)\],\\mathbf\{g\}\_\{p,u,v\}:=\\mathbb\{E\}\_\{x\\sim\\mathcal\{X\}\}\\left\[\\nabla\_\{\\mathbf\{p\}\}m\_\{u,v\}\(x;\\mathbf\{w\}\_\{t\}\)\\right\],\(114\)𝐠q,u,v:=𝔼x∼𝒳​\[∇𝐪mu,v​\(x,𝐰t\)\],\\mathbf\{g\}\_\{q,u,v\}:=\\mathbb\{E\}\_\{x\\sim\\mathcal\{X\}\}\\left\[\\nabla\_\{\\mathbf\{q\}\}m\_\{u,v\}\(x;\\mathbf\{w\}\_\{t\}\)\\right\],\(115\)and

Rt,i​\(u,v\):=𝔼x∼𝒳​\[ℛt,i​\(x,u,v\)\]\.R\_\{t,i\}\(u,v\):=\\mathbb\{E\}\_\{x\\sim\\mathcal\{X\}\}\\left\[\\mathcal\{R\}\_\{t,i\}\(x,u,v\)\\right\]\.\(116\)Using these definitions in \([111](https://arxiv.org/html/2608.18736#A2.E111)\) yields

Δ​m¯t,i​\(u,v\)=𝐠p,u,v⊤​Δ​𝐩t,i\+𝐠q,u,v⊤​Δ​𝐪t,i\+Rt,i​\(u,v\)\.\\Delta\\bar\{m\}\_\{t,i\}\(u,v\)=\\mathbf\{g\}\_\{p,u,v\}^\{\\top\}\\Delta\\mathbf\{p\}\_\{t,i\}\+\\mathbf\{g\}\_\{q,u,v\}^\{\\top\}\\Delta\\mathbf\{q\}\_\{t,i\}\+R\_\{t,i\}\(u,v\)\.\(117\)
Finally, using \([107](https://arxiv.org/html/2608.18736#A2.E107)\),

\|Rt,i​\(u,v\)\|\\displaystyle\|R\_\{t,i\}\(u,v\)\|=\|𝔼x∼𝒳​\[ℛt,i​\(x,u,v\)\]\|\\displaystyle=\\left\|\\mathbb\{E\}\_\{x\\sim\\mathcal\{X\}\}\\left\[\\mathcal\{R\}\_\{t,i\}\(x,u,v\)\\right\]\\right\|≤𝔼x∼𝒳​\[\|ℛt,i​\(x,u,v\)\|\]\\displaystyle\\leq\\mathbb\{E\}\_\{x\\sim\\mathcal\{X\}\}\\left\[\\left\|\\mathcal\{R\}\_\{t,i\}\(x,u,v\)\\right\|\\right\]≤Lm2​‖Δ​𝐰t,i‖22\.\\displaystyle\\leq\\frac\{L\_\{m\}\}\{2\}\\left\\\|\\Delta\\mathbf\{w\}\_\{t,i\}\\right\\\|\_\{2\}^\{2\}\.\(118\)This proves Proposition[1](https://arxiv.org/html/2608.18736#Thmproposition1)\. ∎

The following corollary bounds the difference between two clients’ first\-order margin changes using their normalization\-parameter and remaining\-parameter update differences, together with the second\-order remainders\.

###### Corollary 3 \(Stability of margin changes\)\.

Under Assumption[1](https://arxiv.org/html/2608.18736#Thmassumption1), for any two clientsiiandjj,

\|Δ​m¯t,i​\(u,v\)−Δ​m¯t,j​\(u,v\)\|≤‖𝐠p,u,v‖2​‖Δ​𝐩t,i−Δ​𝐩t,j‖2\+‖𝐠q,u,v‖2​‖Δ​𝐪t,i−Δ​𝐪t,j‖2\+Lm2​\(‖Δ​𝐰t,i‖22\+‖Δ​𝐰t,j‖22\)\.\\left\|\\Delta\\bar\{m\}\_\{t,i\}\(u,v\)\-\\Delta\\bar\{m\}\_\{t,j\}\(u,v\)\\right\|\\leq\\\|\\mathbf\{g\}\_\{p,u,v\}\\\|\_\{2\}\\left\\\|\\Delta\\mathbf\{p\}\_\{t,i\}\-\\Delta\\mathbf\{p\}\_\{t,j\}\\right\\\|\_\{2\}\+\\\|\\mathbf\{g\}\_\{q,u,v\}\\\|\_\{2\}\\left\\\|\\Delta\\mathbf\{q\}\_\{t,i\}\-\\Delta\\mathbf\{q\}\_\{t,j\}\\right\\\|\_\{2\}\+\\frac\{L\_\{m\}\}\{2\}\\left\(\\left\\\|\\Delta\\mathbf\{w\}\_\{t,i\}\\right\\\|\_\{2\}^\{2\}\+\\left\\\|\\Delta\\mathbf\{w\}\_\{t,j\}\\right\\\|\_\{2\}^\{2\}\\right\)\.\(119\)

###### Proof\.

Subtract \([42](https://arxiv.org/html/2608.18736#S4.E42)\) for clientsiiandjj:

Δ​m¯t,i​\(u,v\)−Δ​m¯t,j​\(u,v\)=𝐠p,u,v⊤​\(Δ​𝐩t,i−Δ​𝐩t,j\)\+𝐠q,u,v⊤​\(Δ​𝐪t,i−Δ​𝐪t,j\)\+Rt,i​\(u,v\)−Rt,j​\(u,v\)\.\\Delta\\bar\{m\}\_\{t,i\}\(u,v\)\-\\Delta\\bar\{m\}\_\{t,j\}\(u,v\)=\\mathbf\{g\}\_\{p,u,v\}^\{\\top\}\\left\(\\Delta\\mathbf\{p\}\_\{t,i\}\-\\Delta\\mathbf\{p\}\_\{t,j\}\\right\)\+\\mathbf\{g\}\_\{q,u,v\}^\{\\top\}\\left\(\\Delta\\mathbf\{q\}\_\{t,i\}\-\\Delta\\mathbf\{q\}\_\{t,j\}\\right\)\+R\_\{t,i\}\(u,v\)\-R\_\{t,j\}\(u,v\)\.\(120\)Taking absolute values and applying Cauchy–Schwarz gives

\|Δ​m¯t,i​\(u,v\)−Δ​m¯t,j​\(u,v\)\|≤‖𝐠p,u,v‖2​‖Δ​𝐩t,i−Δ​𝐩t,j‖2\+‖𝐠q,u,v‖2​‖Δ​𝐪t,i−Δ​𝐪t,j‖2\+\|Rt,i​\(u,v\)\|\+\|Rt,j​\(u,v\)\|\.\\left\|\\Delta\\bar\{m\}\_\{t,i\}\(u,v\)\-\\Delta\\bar\{m\}\_\{t,j\}\(u,v\)\\right\|\\leq\\\|\\mathbf\{g\}\_\{p,u,v\}\\\|\_\{2\}\\left\\\|\\Delta\\mathbf\{p\}\_\{t,i\}\-\\Delta\\mathbf\{p\}\_\{t,j\}\\right\\\|\_\{2\}\+\\\|\\mathbf\{g\}\_\{q,u,v\}\\\|\_\{2\}\\left\\\|\\Delta\\mathbf\{q\}\_\{t,i\}\-\\Delta\\mathbf\{q\}\_\{t,j\}\\right\\\|\_\{2\}\+\|R\_\{t,i\}\(u,v\)\|\+\|R\_\{t,j\}\(u,v\)\|\.\(121\)Using \([44](https://arxiv.org/html/2608.18736#S4.E44)\) for both remainders proves the claim\. ∎

### B\-BProof of the Screened\-Aggregation Bound

We now prove Theorem[1](https://arxiv.org/html/2608.18736#Thmtheorem1)\. The proof shows how the screening error𝐞t\\mathbf\{e\}\_\{t\}enters the descent inequality\. If the retained update direction is close to the benign gradient direction, then‖𝐞t‖2\\\|\\mathbf\{e\}\_\{t\}\\\|\_\{2\}is small, and the update behaves similarly to benign training\.

###### Assumption 2 \(Benign objective\)\.

The target objective is

F⁡\(𝐰\)=∑i∈𝒞benλi​Fi​\(𝐰\),λi≥0,∑i∈𝒞benλi=1\.F\(\\mathbf\{w\}\)=\\sum\_\{i\\in\\mathcal\{C\}\_\{\\mathrm\{ben\}\}\}\\lambda\_\{i\}F\_\{i\}\(\\mathbf\{w\}\),\\qquad\\lambda\_\{i\}\\geq 0,\\quad\\sum\_\{i\\in\\mathcal\{C\}\_\{\\mathrm\{ben\}\}\}\\lambda\_\{i\}=1\.\(122\)The functionFFis differentiable,LFL\_\{F\}\-smooth, and lower bounded:

F⁡\(𝐰\)≥Finf\>−∞\.F\(\\mathbf\{w\}\)\\geq F\_\{\\inf\}\>\-\\infty\.\(123\)

TheLFL\_\{F\}\-smoothness condition means that, for all𝐰\\mathbf\{w\}and𝐰′\\mathbf\{w\}^\{\\prime\},

F\(𝐰′\)≤F\(𝐰\)\+∇F\(𝐰\)⊤\(𝐰′−𝐰\)\+LF2‖𝐰′−𝐰‖22\.F\(\\mathbf\{w\}^\{\\prime\}\)\\leq F\(\\mathbf\{w\}\)\+\\nabla F\(\\mathbf\{w\}\)^\{\\top\}\(\\mathbf\{w\}^\{\\prime\}\-\\mathbf\{w\}\)\+\\frac\{L\_\{F\}\}\{2\}\\left\\\|\\mathbf\{w\}^\{\\prime\}\-\\mathbf\{w\}\\right\\\|\_\{2\}^\{2\}\.\(124\)
###### Assumption 3 \(Screened update model\)\.

At roundtt, the screened update can be written as

𝐰t\+1=𝐰t−ηt​𝐠t,\\mathbf\{w\}\_\{t\+1\}=\\mathbf\{w\}\_\{t\}\-\\eta\_\{t\}\\mathbf\{g\}\_\{t\},\(125\)whereηt≥0\\eta\_\{t\}\\geq 0is the effective step size and𝐠t\\mathbf\{g\}\_\{t\}is the retained update direction\. Letℱt\\mathcal\{F\}\_\{t\}contain the information available before the update noise at roundttis realized\. There existβt≥0\\beta\_\{t\}\\geq 0andνt≥0\\nu\_\{t\}\\geq 0such that

‖𝔼⁡\[𝐠t∣ℱt\]−∇F​\(𝐰t\)‖2≤βt,\\left\\\|\\mathbb\{E\}\[\\mathbf\{g\}\_\{t\}\\mid\\mathcal\{F\}\_\{t\}\]\-\\nabla F\(\\mathbf\{w\}\_\{t\}\)\\right\\\|\_\{2\}\\leq\\beta\_\{t\},\(126\)and

𝔼⁡\[‖𝐠t−𝔼⁡\[𝐠t∣ℱt\]‖22∣ℱt\]≤νt2\.\\mathbb\{E\}\\left\[\\left\\\|\\mathbf\{g\}\_\{t\}\-\\mathbb\{E\}\[\\mathbf\{g\}\_\{t\}\\mid\\mathcal\{F\}\_\{t\}\]\\right\\\|\_\{2\}^\{2\}\\mid\\mathcal\{F\}\_\{t\}\\right\]\\leq\\nu\_\{t\}^\{2\}\.\(127\)

###### Proof of Theorem[1](https://arxiv.org/html/2608.18736#Thmtheorem1)\.

By smoothness \([124](https://arxiv.org/html/2608.18736#A2.E124)\) and the update rule \([125](https://arxiv.org/html/2608.18736#A2.E125)\),

F⁡\(𝐰t\+1\)\\displaystyle F\(\\mathbf\{w\}\_\{t\+1\}\)≤F\(𝐰t\)−ηt∇F\(𝐰t\)⊤𝐠t\+LF​ηt22∥𝐠t∥22\.\\displaystyle\\leq F\(\\mathbf\{w\}\_\{t\}\)\-\\eta\_\{t\}\\nabla F\(\\mathbf\{w\}\_\{t\}\)^\{\\top\}\\mathbf\{g\}\_\{t\}\+\\frac\{L\_\{F\}\\eta\_\{t\}^\{2\}\}\{2\}\\\|\\mathbf\{g\}\_\{t\}\\\|\_\{2\}^\{2\}\.\(128\)Take conditional expectation givenℱt\\mathcal\{F\}\_\{t\}\. Define

𝐚t:=∇F​\(𝐰t\),𝐠¯t:=𝔼⁡\[𝐠t∣ℱt\],𝐞t:=𝐠¯t−𝐚t\.\\mathbf\{a\}\_\{t\}:=\\nabla F\(\\mathbf\{w\}\_\{t\}\),\\qquad\\bar\{\\mathbf\{g\}\}\_\{t\}:=\\mathbb\{E\}\[\\mathbf\{g\}\_\{t\}\\mid\\mathcal\{F\}\_\{t\}\],\\qquad\\mathbf\{e\}\_\{t\}:=\\bar\{\\mathbf\{g\}\}\_\{t\}\-\\mathbf\{a\}\_\{t\}\.\(129\)Then

𝐠¯t=𝐚t\+𝐞t,‖𝐞t‖2≤βt\.\\bar\{\\mathbf\{g\}\}\_\{t\}=\\mathbf\{a\}\_\{t\}\+\\mathbf\{e\}\_\{t\},\\qquad\\\|\\mathbf\{e\}\_\{t\}\\\|\_\{2\}\\leq\\beta\_\{t\}\.\(130\)
The first\-order term satisfies

−ηt​𝐚t⊤​𝐠¯t\\displaystyle\-\\eta\_\{t\}\\mathbf\{a\}\_\{t\}^\{\\top\}\\bar\{\\mathbf\{g\}\}\_\{t\}=−ηt​𝐚t⊤​\(𝐚t\+𝐞t\)\\displaystyle=\-\\eta\_\{t\}\\mathbf\{a\}\_\{t\}^\{\\top\}\(\\mathbf\{a\}\_\{t\}\+\\mathbf\{e\}\_\{t\}\)=−ηt​‖𝐚t‖22−ηt​𝐚t⊤​𝐞t\.\\displaystyle=\-\\eta\_\{t\}\\\|\\mathbf\{a\}\_\{t\}\\\|\_\{2\}^\{2\}\-\\eta\_\{t\}\\mathbf\{a\}\_\{t\}^\{\\top\}\\mathbf\{e\}\_\{t\}\.\(131\)By Young’s inequality,

\|𝐚t⊤​𝐞t\|≤14​‖𝐚t‖22\+‖𝐞t‖22\.\|\\mathbf\{a\}\_\{t\}^\{\\top\}\\mathbf\{e\}\_\{t\}\|\\leq\\frac\{1\}\{4\}\\\|\\mathbf\{a\}\_\{t\}\\\|\_\{2\}^\{2\}\+\\\|\\mathbf\{e\}\_\{t\}\\\|\_\{2\}^\{2\}\.\(132\)Therefore,

−ηt​𝐚t⊤​𝐠¯t≤−3​ηt4​‖𝐚t‖22\+ηt​‖𝐞t‖22\.\-\\eta\_\{t\}\\mathbf\{a\}\_\{t\}^\{\\top\}\\bar\{\\mathbf\{g\}\}\_\{t\}\\leq\-\\frac\{3\\eta\_\{t\}\}\{4\}\\\|\\mathbf\{a\}\_\{t\}\\\|\_\{2\}^\{2\}\+\\eta\_\{t\}\\\|\\mathbf\{e\}\_\{t\}\\\|\_\{2\}^\{2\}\.\(133\)
Next,

𝔼⁡\[‖𝐠t‖22∣ℱt\]\\displaystyle\\mathbb\{E\}\\left\[\\\|\\mathbf\{g\}\_\{t\}\\\|\_\{2\}^\{2\}\\mid\\mathcal\{F\}\_\{t\}\\right\]=‖𝐠¯t‖22\+𝔼⁡\[‖𝐠t−𝐠¯t‖22∣ℱt\]\\displaystyle=\\\|\\bar\{\\mathbf\{g\}\}\_\{t\}\\\|\_\{2\}^\{2\}\+\\mathbb\{E\}\\left\[\\\|\\mathbf\{g\}\_\{t\}\-\\bar\{\\mathbf\{g\}\}\_\{t\}\\\|\_\{2\}^\{2\}\\mid\\mathcal\{F\}\_\{t\}\\right\]≤‖𝐚t\+𝐞t‖22\+νt2\\displaystyle\\leq\\\|\\mathbf\{a\}\_\{t\}\+\\mathbf\{e\}\_\{t\}\\\|\_\{2\}^\{2\}\+\\nu\_\{t\}^\{2\}≤2​‖𝐚t‖22\+2​‖𝐞t‖22\+νt2\.\\displaystyle\\leq 2\\\|\\mathbf\{a\}\_\{t\}\\\|\_\{2\}^\{2\}\+2\\\|\\mathbf\{e\}\_\{t\}\\\|\_\{2\}^\{2\}\+\\nu\_\{t\}^\{2\}\.\(134\)Substituting \([133](https://arxiv.org/html/2608.18736#A2.E133)\) and \([134](https://arxiv.org/html/2608.18736#A2.E134)\) into \([128](https://arxiv.org/html/2608.18736#A2.E128)\) gives

𝔼⁡\[F⁡\(𝐰t\+1\)∣ℱt\]≤F⁡\(𝐰t\)−\(3​ηt4−LF​ηt2\)​‖𝐚t‖22\+\(ηt\+LF​ηt2\)​‖𝐞t‖22\+LF​ηt22​νt2\.\\mathbb\{E\}\\left\[F\(\\mathbf\{w\}\_\{t\+1\}\)\\mid\\mathcal\{F\}\_\{t\}\\right\]\\leq F\(\\mathbf\{w\}\_\{t\}\)\-\\left\(\\frac\{3\\eta\_\{t\}\}\{4\}\-L\_\{F\}\\eta\_\{t\}^\{2\}\\right\)\\\|\\mathbf\{a\}\_\{t\}\\\|\_\{2\}^\{2\}\+\(\\eta\_\{t\}\+L\_\{F\}\\eta\_\{t\}^\{2\}\)\\\|\\mathbf\{e\}\_\{t\}\\\|\_\{2\}^\{2\}\+\\frac\{L\_\{F\}\\eta\_\{t\}^\{2\}\}\{2\}\\nu\_\{t\}^\{2\}\.\(135\)If0≤ηt≤1/\(4​LF\)0\\leq\\eta\_\{t\}\\leq 1/\(4L\_\{F\}\), then

3​ηt4−LF​ηt2≥ηt2\.\\frac\{3\\eta\_\{t\}\}\{4\}\-L\_\{F\}\\eta\_\{t\}^\{2\}\\geq\\frac\{\\eta\_\{t\}\}\{2\}\.\(136\)Using‖𝐞t‖22≤βt2\\\|\\mathbf\{e\}\_\{t\}\\\|\_\{2\}^\{2\}\\leq\\beta\_\{t\}^\{2\}, we obtain

𝔼⁡\[F⁡\(𝐰t\+1\)∣ℱt\]≤F⁡\(𝐰t\)−ηt2​‖∇F​\(𝐰t\)‖22\+\(ηt\+LF​ηt2\)​βt2\+LF​ηt22​νt2\.\\mathbb\{E\}\\left\[F\(\\mathbf\{w\}\_\{t\+1\}\)\\mid\\mathcal\{F\}\_\{t\}\\right\]\\leq F\(\\mathbf\{w\}\_\{t\}\)\-\\frac\{\\eta\_\{t\}\}\{2\}\\\|\\nabla F\(\\mathbf\{w\}\_\{t\}\)\\\|\_\{2\}^\{2\}\+\(\\eta\_\{t\}\+L\_\{F\}\\eta\_\{t\}^\{2\}\)\\beta\_\{t\}^\{2\}\+\\frac\{L\_\{F\}\\eta\_\{t\}^\{2\}\}\{2\}\\nu\_\{t\}^\{2\}\.\(137\)Taking total expectation and summing fromt=0t=0toT−1T\-1yields

12​∑t=0T−1ηt​𝔼​\[‖∇F​\(𝐰t\)‖22\]≤F⁡\(𝐰0\)−𝔼⁡\[F⁡\(𝐰T\)\]\+∑t=0T−1\(ηt\+LF​ηt2\)​𝔼​\[βt2\]\+LF2​∑t=0T−1ηt2​𝔼​\[νt2\]\.\\frac\{1\}\{2\}\\sum\_\{t=0\}^\{T\-1\}\\eta\_\{t\}\\mathbb\{E\}\\left\[\\\|\\nabla F\(\\mathbf\{w\}\_\{t\}\)\\\|\_\{2\}^\{2\}\\right\]\\leq F\(\\mathbf\{w\}\_\{0\}\)\-\\mathbb\{E\}\[F\(\\mathbf\{w\}\_\{T\}\)\]\+\\sum\_\{t=0\}^\{T\-1\}\(\\eta\_\{t\}\+L\_\{F\}\\eta\_\{t\}^\{2\}\)\\mathbb\{E\}\[\\beta\_\{t\}^\{2\}\]\+\\frac\{L\_\{F\}\}\{2\}\\sum\_\{t=0\}^\{T\-1\}\\eta\_\{t\}^\{2\}\\mathbb\{E\}\[\\nu\_\{t\}^\{2\}\]\.\(138\)SinceF⁡\(𝐰T\)≥FinfF\(\\mathbf\{w\}\_\{T\}\)\\geq F\_\{\\inf\},

12∑t=0T−1ηt𝔼\[∥∇F\(𝐰t\)∥22\]≤F\(𝐰0\)−Finf\+∑t=0T−1\(ηt\+LFηt2\)𝔼\[βt2\]\+LF2∑t=0T−1ηt2𝔼\[νt2\]\.\\frac\{1\}\{2\}\\sum\_\{t=0\}^\{T\-1\}\\eta\_\{t\}\\mathbb\{E\}\\left\[\\\|\\nabla F\(\\mathbf\{w\}\_\{t\}\)\\\|\_\{2\}^\{2\}\\right\]\\leq F\(\\mathbf\{w\}\_\{0\}\)\-F\_\{\\inf\}\\quad\+\\sum\_\{t=0\}^\{T\-1\}\(\\eta\_\{t\}\+L\_\{F\}\\eta\_\{t\}^\{2\}\)\\mathbb\{E\}\[\\beta\_\{t\}^\{2\}\]\\quad\+\\frac\{L\_\{F\}\}\{2\}\\sum\_\{t=0\}^\{T\-1\}\\eta\_\{t\}^\{2\}\\mathbb\{E\}\[\\nu\_\{t\}^\{2\}\]\.\(139\)Dividing both sides by12​ST\\frac\{1\}\{2\}S\_\{T\}proves \([54](https://arxiv.org/html/2608.18736#S4.E54)\)\. ∎

###### Proof of Corollary[1](https://arxiv.org/html/2608.18736#Thmcorollary1)\.

From Theorem[1](https://arxiv.org/html/2608.18736#Thmtheorem1),

∑t=0T−1ηt​𝔼​\[‖∇F​\(𝐰t\)‖22\]ST≤2​\(F⁡\(𝐰0\)−Finf\)ST\+2​∑t=0T−1\(ηt\+LF​ηt2\)​𝔼​\[βt2\]ST\+LF​∑t=0T−1ηt2​𝔼​\[νt2\]ST\.\\frac\{\\sum\_\{t=0\}^\{T\-1\}\\eta\_\{t\}\\mathbb\{E\}\\left\[\\\|\\nabla F\(\\mathbf\{w\}\_\{t\}\)\\\|\_\{2\}^\{2\}\\right\]\}\{S\_\{T\}\}\\leq\\frac\{2\\left\(F\(\\mathbf\{w\}\_\{0\}\)\-F\_\{\\inf\}\\right\)\}\{S\_\{T\}\}\+\\frac\{2\\sum\_\{t=0\}^\{T\-1\}\(\\eta\_\{t\}\+L\_\{F\}\\eta\_\{t\}^\{2\}\)\\mathbb\{E\}\[\\beta\_\{t\}^\{2\}\]\}\{S\_\{T\}\}\+\\frac\{L\_\{F\}\\sum\_\{t=0\}^\{T\-1\}\\eta\_\{t\}^\{2\}\\mathbb\{E\}\[\\nu\_\{t\}^\{2\}\]\}\{S\_\{T\}\}\.\(140\)We show that each term on the right\-hand side goes to zero\.

First, sinceST→∞S\_\{T\}\\to\\inftyandF⁡\(𝐰0\)−FinfF\(\\mathbf\{w\}\_\{0\}\)\-F\_\{\\inf\}is finite,

2​\(F⁡\(𝐰0\)−Finf\)ST→0\.\\frac\{2\\left\(F\(\\mathbf\{w\}\_\{0\}\)\-F\_\{\\inf\}\\right\)\}\{S\_\{T\}\}\\to 0\.\(141\)
Second, becauseηt≤1/\(4​LF\)\\eta\_\{t\}\\leq 1/\(4L\_\{F\}\),

LF​ηt2≤14​ηt,L\_\{F\}\\eta\_\{t\}^\{2\}\\leq\\frac\{1\}\{4\}\\eta\_\{t\},\(142\)and therefore

ηt\+LF​ηt2≤54​ηt\.\\eta\_\{t\}\+L\_\{F\}\\eta\_\{t\}^\{2\}\\leq\\frac\{5\}\{4\}\\eta\_\{t\}\.\(143\)Thus,

∑t=0T−1\(ηt\+LF​ηt2\)​𝔼​\[βt2\]ST\\displaystyle\\frac\{\\sum\_\{t=0\}^\{T\-1\}\(\\eta\_\{t\}\+L\_\{F\}\\eta\_\{t\}^\{2\}\)\\mathbb\{E\}\[\\beta\_\{t\}^\{2\}\]\}\{S\_\{T\}\}≤54​∑t=0T−1ηt​𝔼​\[βt2\]ST\.\\displaystyle\\leq\\frac\{5\}\{4\}\\frac\{\\sum\_\{t=0\}^\{T\-1\}\\eta\_\{t\}\\mathbb\{E\}\[\\beta\_\{t\}^\{2\}\]\}\{S\_\{T\}\}\.\(144\)By \([57](https://arxiv.org/html/2608.18736#S4.E57)\),

∑t=0T−1\(ηt\+LF​ηt2\)​𝔼​\[βt2\]ST→0\.\\frac\{\\sum\_\{t=0\}^\{T\-1\}\(\\eta\_\{t\}\+L\_\{F\}\\eta\_\{t\}^\{2\}\)\\mathbb\{E\}\[\\beta\_\{t\}^\{2\}\]\}\{S\_\{T\}\}\\to 0\.\(145\)
Third, since𝔼⁡\[νt2\]≤ν2\\mathbb\{E\}\[\\nu\_\{t\}^\{2\}\]\\leq\\nu^\{2\},

LF​∑t=0T−1ηt2​𝔼​\[νt2\]ST≤LF​ν2​∑t=0T−1ηt2ST\.\\frac\{L\_\{F\}\\sum\_\{t=0\}^\{T\-1\}\\eta\_\{t\}^\{2\}\\mathbb\{E\}\[\\nu\_\{t\}^\{2\}\]\}\{S\_\{T\}\}\\leq L\_\{F\}\\nu^\{2\}\\frac\{\\sum\_\{t=0\}^\{T\-1\}\\eta\_\{t\}^\{2\}\}\{S\_\{T\}\}\.\(146\)By \([55](https://arxiv.org/html/2608.18736#S4.E55)\),

LF​ν2​∑t=0T−1ηt2ST→0\.L\_\{F\}\\nu^\{2\}\\frac\{\\sum\_\{t=0\}^\{T\-1\}\\eta\_\{t\}^\{2\}\}\{S\_\{T\}\}\\to 0\.\(147\)
Combining \([141](https://arxiv.org/html/2608.18736#A2.E141)\), \([145](https://arxiv.org/html/2608.18736#A2.E145)\), and \([147](https://arxiv.org/html/2608.18736#A2.E147)\) in \([140](https://arxiv.org/html/2608.18736#A2.E140)\) gives

∑t=0T−1ηt​𝔼​\[‖∇F​\(𝐰t\)‖22\]ST→0\.\\frac\{\\sum\_\{t=0\}^\{T\-1\}\\eta\_\{t\}\\mathbb\{E\}\\left\[\\\|\\nabla F\(\\mathbf\{w\}\_\{t\}\)\\\|\_\{2\}^\{2\}\\right\]\}\{S\_\{T\}\}\\to 0\.\(148\)
Now define a random roundτ\\tauby

Pr\(τ=t\)=ηtST,t=0,…,T−1\.\\Pr\(\\tau=t\)=\\frac\{\\eta\_\{t\}\}\{S\_\{T\}\},\\qquad t=0,\\dots,T\-1\.\(149\)Then, by the law of total expectation,

𝔼⁡\[‖∇F​\(𝐰τ\)‖22\]\\displaystyle\\mathbb\{E\}\\left\[\\\|\\nabla F\(\\mathbf\{w\}\_\{\\tau\}\)\\\|\_\{2\}^\{2\}\\right\]=∑t=0T−1Pr⁡\(τ=t\)​𝔼​\[‖∇F​\(𝐰t\)‖22\]\\displaystyle=\\sum\_\{t=0\}^\{T\-1\}\\Pr\(\\tau=t\)\\mathbb\{E\}\\left\[\\\|\\nabla F\(\\mathbf\{w\}\_\{t\}\)\\\|\_\{2\}^\{2\}\\right\]=∑t=0T−1ηt​𝔼​\[‖∇F​\(𝐰t\)‖22\]ST\.\\displaystyle=\\frac\{\\sum\_\{t=0\}^\{T\-1\}\\eta\_\{t\}\\mathbb\{E\}\\left\[\\\|\\nabla F\(\\mathbf\{w\}\_\{t\}\)\\\|\_\{2\}^\{2\}\\right\]\}\{S\_\{T\}\}\.\(150\)Therefore,

𝔼⁡\[‖∇F​\(𝐰τ\)‖22\]→0\.\\mathbb\{E\}\\left\[\\\|\\nabla F\(\\mathbf\{w\}\_\{\\tau\}\)\\\|\_\{2\}^\{2\}\\right\]\\to 0\.\(151\)This proves the corollary\. ∎

###### Proof of Corollary[2](https://arxiv.org/html/2608.18736#Thmcorollary2)\.

Setηt=η\\eta\_\{t\}=\\etain Theorem[1](https://arxiv.org/html/2608.18736#Thmtheorem1)\. Then

ST=∑t=0T−1η=η​T\.S\_\{T\}=\\sum\_\{t=0\}^\{T\-1\}\\eta=\\eta T\.\(152\)The left\-hand side of \([54](https://arxiv.org/html/2608.18736#S4.E54)\) becomes

∑t=0T−1η​𝔼​\[‖∇F​\(𝐰t\)‖22\]η​T=1T​∑t=0T−1𝔼⁡\[‖∇F​\(𝐰t\)‖22\]\.\\frac\{\\sum\_\{t=0\}^\{T\-1\}\\eta\\mathbb\{E\}\\left\[\\\|\\nabla F\(\\mathbf\{w\}\_\{t\}\)\\\|\_\{2\}^\{2\}\\right\]\}\{\\eta T\}=\\frac\{1\}\{T\}\\sum\_\{t=0\}^\{T\-1\}\\mathbb\{E\}\\left\[\\\|\\nabla F\(\\mathbf\{w\}\_\{t\}\)\\\|\_\{2\}^\{2\}\\right\]\.\(153\)The optimization term becomes

2​\(F⁡\(𝐰0\)−Finf\)η​T\.\\frac\{2\\left\(F\(\\mathbf\{w\}\_\{0\}\)\-F\_\{\\inf\}\\right\)\}\{\\eta T\}\.\(154\)The screening\-error term becomes

2​∑t=0T−1\(η\+LF​η2\)​𝔼​\[βt2\]η​T\\displaystyle\\frac\{2\\sum\_\{t=0\}^\{T\-1\}\(\\eta\+L\_\{F\}\\eta^\{2\}\)\\mathbb\{E\}\[\\beta\_\{t\}^\{2\}\]\}\{\\eta T\}=2​\(1\+LF​η\)​1T​∑t=0T−1𝔼⁡\[βt2\]\\displaystyle=2\(1\+L\_\{F\}\\eta\)\\frac\{1\}\{T\}\\sum\_\{t=0\}^\{T\-1\}\\mathbb\{E\}\[\\beta\_\{t\}^\{2\}\]=2​\(1\+LF​η\)​β¯T2\.\\displaystyle=2\(1\+L\_\{F\}\\eta\)\\overline\{\\beta\}\_\{T\}^\{2\}\.\(155\)The variance term becomes

LF​∑t=0T−1η2​𝔼​\[νt2\]η​T\\displaystyle\\frac\{L\_\{F\}\\sum\_\{t=0\}^\{T\-1\}\\eta^\{2\}\\mathbb\{E\}\[\\nu\_\{t\}^\{2\}\]\}\{\\eta T\}=LF​η​1T​∑t=0T−1𝔼⁡\[νt2\]\\displaystyle=L\_\{F\}\\eta\\frac\{1\}\{T\}\\sum\_\{t=0\}^\{T\-1\}\\mathbb\{E\}\[\\nu\_\{t\}^\{2\}\]=LF​η​ν¯T2\.\\displaystyle=L\_\{F\}\\eta\\overline\{\\nu\}\_\{T\}^\{2\}\.\(156\)Substituting these three expressions into \([54](https://arxiv.org/html/2608.18736#S4.E54)\) proves \([67](https://arxiv.org/html/2608.18736#S4.E67)\)\. ∎

### B\-CScreening\-Error Decomposition

We now connectβt\\beta\_\{t\}to the retained set returned byFedLNS\. This decomposition relates the screening error to retained malicious weight, benign\-client representativeness, and local\-training drift\.

Let𝒞mal\\mathcal\{C\}\_\{\\mathrm\{mal\}\}denote the malicious client set and𝒞ben\\mathcal\{C\}\_\{\\mathrm\{ben\}\}denote the benign client set\. At roundtt,FedLNSretainsℛt\\mathcal\{R\}\_\{t\}\. For each retained clienti∈ℛti\\in\\mathcal\{R\}\_\{t\}, define

αt,i:=nt,i∑j∈ℛtnt,j\.\\alpha\_\{t,i\}:=\\frac\{n\_\{t,i\}\}\{\\sum\_\{j\\in\\mathcal\{R\}\_\{t\}\}n\_\{t,j\}\}\.\(157\)The total retained malicious weight is

μt:=∑a∈ℛt∩𝒞malαt,a\.\\mu\_\{t\}:=\\sum\_\{a\\in\\mathcal\{R\}\_\{t\}\\cap\\mathcal\{C\}\_\{\\mathrm\{mal\}\}\}\\alpha\_\{t,a\}\.\(158\)
For a retained benign clientii, define its conditional expected local direction as

𝐠¯t,iB:=𝔼⁡\[𝐠t,i∣ℱt\],i∈𝒞ben\.\\bar\{\\mathbf\{g\}\}\_\{t,i\}^\{B\}:=\\mathbb\{E\}\\left\[\\mathbf\{g\}\_\{t,i\}\\mid\\mathcal\{F\}\_\{t\}\\right\],\\qquad i\\in\\mathcal\{C\}\_\{\\mathrm\{ben\}\}\.\(159\)We decompose it as

𝐠¯t,iB=∇Fi​\(𝐰t\)\+𝐫t,i,\\bar\{\\mathbf\{g\}\}\_\{t,i\}^\{B\}=\\nabla F\_\{i\}\(\\mathbf\{w\}\_\{t\}\)\+\\mathbf\{r\}\_\{t,i\},\(160\)where𝐫t,i\\mathbf\{r\}\_\{t,i\}is the local\-training drift vector\. For a retained malicious clientaa, define

𝐡t,a:=𝔼⁡\[𝐠t,a∣ℱt\],a∈𝒞mal\.\\mathbf\{h\}\_\{t,a\}:=\\mathbb\{E\}\\left\[\\mathbf\{g\}\_\{t,a\}\\mid\\mathcal\{F\}\_\{t\}\\right\],\\qquad a\\in\\mathcal\{C\}\_\{\\mathrm\{mal\}\}\.\(161\)The vector𝐡t,a\\mathbf\{h\}\_\{t,a\}can be arbitrary\.

The conditional mean retained direction is

𝔼⁡\[𝐠t∣ℱt\]\\displaystyle\\mathbb\{E\}\[\\mathbf\{g\}\_\{t\}\\mid\\mathcal\{F\}\_\{t\}\]=∑i∈ℛt∩𝒞benαt,i​\(∇Fi​\(𝐰t\)\+𝐫t,i\)\+∑a∈ℛt∩𝒞malαt,a​𝐡t,a\.\\displaystyle=\\sum\_\{i\\in\\mathcal\{R\}\_\{t\}\\cap\\mathcal\{C\}\_\{\\mathrm\{ben\}\}\}\\alpha\_\{t,i\}\\left\(\\nabla F\_\{i\}\(\\mathbf\{w\}\_\{t\}\)\+\\mathbf\{r\}\_\{t,i\}\\right\)\+\\sum\_\{a\\in\\mathcal\{R\}\_\{t\}\\cap\\mathcal\{C\}\_\{\\mathrm\{mal\}\}\}\\alpha\_\{t,a\}\\mathbf\{h\}\_\{t,a\}\.\(162\)
Assumeμt<1\\mu\_\{t\}<1\. Define the retained benign gradient after renormalizing the benign retained weights:

𝐠¯tB,ret:=∑i∈ℛt∩𝒞benαt,i1−μt∇Fi\(𝐰t\)\.\\bar\{\\mathbf\{g\}\}\_\{t\}^\{B,\\mathrm\{ret\}\}:=\\sum\_\{i\\in\\mathcal\{R\}\_\{t\}\\cap\\mathcal\{C\}\_\{\\mathrm\{ben\}\}\}\\frac\{\\alpha\_\{t,i\}\}\{1\-\\mu\_\{t\}\}\\nabla F\_\{i\}\(\\mathbf\{w\}\_\{t\}\)\.\(163\)The retained benign representativeness error is

χt:=‖𝐠¯tB,ret−∇F​\(𝐰t\)‖2\.\\chi\_\{t\}:=\\left\\\|\\bar\{\\mathbf\{g\}\}\_\{t\}^\{B,\\mathrm\{ret\}\}\-\\nabla F\(\\mathbf\{w\}\_\{t\}\)\\right\\\|\_\{2\}\.\(164\)The retained benign local\-drift magnitude is

ϱt:=‖∑i∈ℛt∩𝒞benαt,i​𝐫t,i‖2\.\\varrho\_\{t\}:=\\left\\\|\\sum\_\{i\\in\\mathcal\{R\}\_\{t\}\\cap\\mathcal\{C\}\_\{\\mathrm\{ben\}\}\}\\alpha\_\{t,i\}\\mathbf\{r\}\_\{t,i\}\\right\\\|\_\{2\}\.\(165\)
###### Assumption 4 \(Bounded retained directions\)\.

There existsG\>0G\>0such that

‖𝐡t,a‖2≤G,‖∇F​\(𝐰t\)‖2≤G\\\|\\mathbf\{h\}\_\{t,a\}\\\|\_\{2\}\\leq G,\\qquad\\\|\\nabla F\(\\mathbf\{w\}\_\{t\}\)\\\|\_\{2\}\\leq G\(166\)for all retained malicious clientsaaand all rounds considered\.

###### Proposition 4 \(Screening\-error bound\)\.

Under the definitions above and Assumption[4](https://arxiv.org/html/2608.18736#Thmassumption4),

‖𝔼⁡\[𝐠t∣ℱt\]−∇F​\(𝐰t\)‖2≤\(1−μt\)​χt\+2​G​μt\+ϱt\.\\left\\\|\\mathbb\{E\}\[\\mathbf\{g\}\_\{t\}\\mid\\mathcal\{F\}\_\{t\}\]\-\\nabla F\(\\mathbf\{w\}\_\{t\}\)\\right\\\|\_\{2\}\\leq\(1\-\\mu\_\{t\}\)\\chi\_\{t\}\+2G\\mu\_\{t\}\+\\varrho\_\{t\}\.\(167\)Therefore, one may choose

βt=\(1−μt\)​χt\+2​G​μt\+ϱt\.\\beta\_\{t\}=\(1\-\\mu\_\{t\}\)\\chi\_\{t\}\+2G\\mu\_\{t\}\+\\varrho\_\{t\}\.\(168\)

###### Proof\.

Using \([162](https://arxiv.org/html/2608.18736#A2.E162)\),

𝔼\[𝐠t∣ℱt\]−∇F\(𝐰t\)=∑i∈ℛt∩𝒞benαt,i∇Fi\(𝐰t\)−∇F\(𝐰t\)\+∑a∈ℛt∩𝒞malαt,a𝐡t,a\+∑i∈ℛt∩𝒞benαt,i𝐫t,i\.\\mathbb\{E\}\[\\mathbf\{g\}\_\{t\}\\mid\\mathcal\{F\}\_\{t\}\]\-\\nabla F\(\\mathbf\{w\}\_\{t\}\)=\\sum\_\{i\\in\\mathcal\{R\}\_\{t\}\\cap\\mathcal\{C\}\_\{\\mathrm\{ben\}\}\}\\alpha\_\{t,i\}\\nabla F\_\{i\}\(\\mathbf\{w\}\_\{t\}\)\-\\nabla F\(\\mathbf\{w\}\_\{t\}\)\+\\sum\_\{a\\in\\mathcal\{R\}\_\{t\}\\cap\\mathcal\{C\}\_\{\\mathrm\{mal\}\}\}\\alpha\_\{t,a\}\\mathbf\{h\}\_\{t,a\}\+\\sum\_\{i\\in\\mathcal\{R\}\_\{t\}\\cap\\mathcal\{C\}\_\{\\mathrm\{ben\}\}\}\\alpha\_\{t,i\}\\mathbf\{r\}\_\{t,i\}\.\(169\)The benign\-gradient part satisfies

∑i∈ℛt∩𝒞benαt,i∇Fi\(𝐰t\)−∇F\(𝐰t\)\\displaystyle\\sum\_\{i\\in\\mathcal\{R\}\_\{t\}\\cap\\mathcal\{C\}\_\{\\mathrm\{ben\}\}\}\\alpha\_\{t,i\}\\nabla F\_\{i\}\(\\mathbf\{w\}\_\{t\}\)\-\\nabla F\(\\mathbf\{w\}\_\{t\}\)=\(1−μt\)​𝐠¯tB,ret−∇F​\(𝐰t\)\\displaystyle=\(1\-\\mu\_\{t\}\)\\bar\{\\mathbf\{g\}\}\_\{t\}^\{B,\\mathrm\{ret\}\}\-\\nabla F\(\\mathbf\{w\}\_\{t\}\)=\(1−μt\)\(𝐠¯tB,ret−∇F\(𝐰t\)\)−μt∇F\(𝐰t\)\.\\displaystyle=\(1\-\\mu\_\{t\}\)\\left\(\\bar\{\\mathbf\{g\}\}\_\{t\}^\{B,\\mathrm\{ret\}\}\-\\nabla F\(\\mathbf\{w\}\_\{t\}\)\\right\)\-\\mu\_\{t\}\\nabla F\(\\mathbf\{w\}\_\{t\}\)\.\(170\)Thus,

‖∑i∈ℛt∩𝒞benαt,i∇Fi\(𝐰t\)−∇F\(𝐰t\)‖2≤\(1−μt\)χt\+μt∥∇F\(𝐰t\)∥2\.\\left\\\|\\sum\_\{i\\in\\mathcal\{R\}\_\{t\}\\cap\\mathcal\{C\}\_\{\\mathrm\{ben\}\}\}\\alpha\_\{t,i\}\\nabla F\_\{i\}\(\\mathbf\{w\}\_\{t\}\)\-\\nabla F\(\\mathbf\{w\}\_\{t\}\)\\right\\\|\_\{2\}\\leq\(1\-\\mu\_\{t\}\)\\chi\_\{t\}\+\\mu\_\{t\}\\\|\\nabla F\(\\mathbf\{w\}\_\{t\}\)\\\|\_\{2\}\.\(171\)The retained malicious part satisfies

‖∑a∈ℛt∩𝒞malαt,a​𝐡t,a‖2\\displaystyle\\left\\\|\\sum\_\{a\\in\\mathcal\{R\}\_\{t\}\\cap\\mathcal\{C\}\_\{\\mathrm\{mal\}\}\}\\alpha\_\{t,a\}\\mathbf\{h\}\_\{t,a\}\\right\\\|\_\{2\}≤∑a∈ℛt∩𝒞malαt,a​‖𝐡t,a‖2\\displaystyle\\leq\\sum\_\{a\\in\\mathcal\{R\}\_\{t\}\\cap\\mathcal\{C\}\_\{\\mathrm\{mal\}\}\}\\alpha\_\{t,a\}\\\|\\mathbf\{h\}\_\{t,a\}\\\|\_\{2\}≤G​μt\.\\displaystyle\\leq G\\mu\_\{t\}\.\(172\)The local\-drift term isϱt\\varrho\_\{t\}by definition\. Combining the three bounds and using‖∇F​\(𝐰t\)‖2≤G\\\|\\nabla F\(\\mathbf\{w\}\_\{t\}\)\\\|\_\{2\}\\leq Ggives

‖𝔼⁡\[𝐠t∣ℱt\]−∇F​\(𝐰t\)‖2≤\(1−μt\)​χt\+2​G​μt\+ϱt\.\\left\\\|\\mathbb\{E\}\[\\mathbf\{g\}\_\{t\}\\mid\\mathcal\{F\}\_\{t\}\]\-\\nabla F\(\\mathbf\{w\}\_\{t\}\)\\right\\\|\_\{2\}\\leq\(1\-\\mu\_\{t\}\)\\chi\_\{t\}\+2G\\mu\_\{t\}\+\\varrho\_\{t\}\.\(173\)This proves the result\. ∎

###### Lemma 1 \(Sufficient condition for vanishing screening error\)\.

Suppose

βt≤\(1−μt\)​χt\+2​G​μt\+ϱt\.\\beta\_\{t\}\\leq\(1\-\\mu\_\{t\}\)\\chi\_\{t\}\+2G\\mu\_\{t\}\+\\varrho\_\{t\}\.\(174\)If

∑t=0T−1ηt​𝔼​\[χt2\]ST→0,∑t=0T−1ηt​𝔼​\[μt2\]ST→0,∑t=0T−1ηt​𝔼​\[ϱt2\]ST→0,\\frac\{\\sum\_\{t=0\}^\{T\-1\}\\eta\_\{t\}\\mathbb\{E\}\[\\chi\_\{t\}^\{2\}\]\}\{S\_\{T\}\}\\to 0,\\qquad\\frac\{\\sum\_\{t=0\}^\{T\-1\}\\eta\_\{t\}\\mathbb\{E\}\[\\mu\_\{t\}^\{2\}\]\}\{S\_\{T\}\}\\to 0,\\qquad\\frac\{\\sum\_\{t=0\}^\{T\-1\}\\eta\_\{t\}\\mathbb\{E\}\[\\varrho\_\{t\}^\{2\}\]\}\{S\_\{T\}\}\\to 0,\(175\)then

∑t=0T−1ηt​𝔼​\[βt2\]ST→0\.\\frac\{\\sum\_\{t=0\}^\{T\-1\}\\eta\_\{t\}\\mathbb\{E\}\[\\beta\_\{t\}^\{2\}\]\}\{S\_\{T\}\}\\to 0\.\(176\)

###### Proof\.

Using\(a\+b\+c\)2≤3​a2\+3​b2\+3​c2\(a\+b\+c\)^\{2\}\\leq 3a^\{2\}\+3b^\{2\}\+3c^\{2\}, we obtain

βt2\\displaystyle\\beta\_\{t\}^\{2\}≤3​\(1−μt\)2​χt2\+12​G2​μt2\+3​ϱt2\.\\displaystyle\\leq 3\(1\-\\mu\_\{t\}\)^\{2\}\\chi\_\{t\}^\{2\}\+12G^\{2\}\\mu\_\{t\}^\{2\}\+3\\varrho\_\{t\}^\{2\}\.\(177\)Since\(1−μt\)2≤1\(1\-\\mu\_\{t\}\)^\{2\}\\leq 1, this gives

βt2≤3​χt2\+12​G2​μt2\+3​ϱt2\.\\beta\_\{t\}^\{2\}\\leq 3\\chi\_\{t\}^\{2\}\+12G^\{2\}\\mu\_\{t\}^\{2\}\+3\\varrho\_\{t\}^\{2\}\.\(178\)Multiplying byηt\\eta\_\{t\}, summing fromt=0t=0toT−1T\-1, taking expectation, and dividing bySTS\_\{T\}yields

∑t=0T−1ηt​𝔼​\[βt2\]ST≤3​∑t=0T−1ηt​𝔼​\[χt2\]ST\+12​G2​∑t=0T−1ηt​𝔼​\[μt2\]ST\+3​∑t=0T−1ηt​𝔼​\[ϱt2\]ST\.\\frac\{\\sum\_\{t=0\}^\{T\-1\}\\eta\_\{t\}\\mathbb\{E\}\[\\beta\_\{t\}^\{2\}\]\}\{S\_\{T\}\}\\leq 3\\frac\{\\sum\_\{t=0\}^\{T\-1\}\\eta\_\{t\}\\mathbb\{E\}\[\\chi\_\{t\}^\{2\}\]\}\{S\_\{T\}\}\+12G^\{2\}\\frac\{\\sum\_\{t=0\}^\{T\-1\}\\eta\_\{t\}\\mathbb\{E\}\[\\mu\_\{t\}^\{2\}\]\}\{S\_\{T\}\}\+3\\frac\{\\sum\_\{t=0\}^\{T\-1\}\\eta\_\{t\}\\mathbb\{E\}\[\\varrho\_\{t\}^\{2\}\]\}\{S\_\{T\}\}\.\(179\)Each term on the right\-hand side converges to zero by assumption\. Therefore,

∑t=0T−1ηt​𝔼​\[βt2\]ST→0\.\\frac\{\\sum\_\{t=0\}^\{T\-1\}\\eta\_\{t\}\\mathbb\{E\}\[\\beta\_\{t\}^\{2\}\]\}\{S\_\{T\}\}\\to 0\.\(180\)∎

### B\-DLocal\-Training Drift Bound

For completeness, we provide a bound onϱt\\varrho\_\{t\}under local gradient descent\.

###### Assumption 5 \(Bounded benign gradients during local training\)\.

For every benign clientii, local stepee, and roundtt,

‖∇Fi​\(𝐰t,i\(e\)\)‖2≤GB\.\\left\\\|\\nabla F\_\{i\}\(\\mathbf\{w\}\_\{t,i\}^\{\(e\)\}\)\\right\\\|\_\{2\}\\leq G\_\{B\}\.\(181\)Also, eachFiF\_\{i\}isLiL\_\{i\}\-smooth withLi≤LmaxL\_\{i\}\\leq L\_\{\\max\}\.

Suppose benign clientiiperformsEElocal gradient steps with local learning rateηloc\\eta\_\{\\mathrm\{loc\}\}:

𝐰t,i\(0\)=𝐰t,𝐰t,i\(e\+1\)=𝐰t,i\(e\)−ηloc∇Fi\(𝐰t,i\(e\)\),e=0,…,E−1\.\\mathbf\{w\}\_\{t,i\}^\{\(0\)\}=\\mathbf\{w\}\_\{t\},\\qquad\\mathbf\{w\}\_\{t,i\}^\{\(e\+1\)\}=\\mathbf\{w\}\_\{t,i\}^\{\(e\)\}\-\\eta\_\{\\mathrm\{loc\}\}\\nabla F\_\{i\}\(\\mathbf\{w\}\_\{t,i\}^\{\(e\)\}\),\\qquad e=0,\\dots,E\-1\.\(182\)Define the average local gradient direction

𝐠¯t,iB=1E​∑e=0E−1∇Fi​\(𝐰t,i\(e\)\)\.\\bar\{\\mathbf\{g\}\}\_\{t,i\}^\{B\}=\\frac\{1\}\{E\}\\sum\_\{e=0\}^\{E\-1\}\\nabla F\_\{i\}\(\\mathbf\{w\}\_\{t,i\}^\{\(e\)\}\)\.\(183\)Then

𝐫t,i=𝐠¯t,iB−∇Fi​\(𝐰t\)\.\\mathbf\{r\}\_\{t,i\}=\\bar\{\\mathbf\{g\}\}\_\{t,i\}^\{B\}\-\\nabla F\_\{i\}\(\\mathbf\{w\}\_\{t\}\)\.\(184\)
###### Lemma 2 \(Local\-training drift bound\)\.

Under Assumption[5](https://arxiv.org/html/2608.18736#Thmassumption5),

‖𝐫t,i‖2≤Lmax​ηloc​GB​\(E−1\)2\.\\\|\\mathbf\{r\}\_\{t,i\}\\\|\_\{2\}\\leq\\frac\{L\_\{\\max\}\\eta\_\{\\mathrm\{loc\}\}G\_\{B\}\(E\-1\)\}\{2\}\.\(185\)Consequently,

ϱt≤\(1−μt\)​Lmax​ηloc​GB​\(E−1\)2\.\\varrho\_\{t\}\\leq\(1\-\\mu\_\{t\}\)\\frac\{L\_\{\\max\}\\eta\_\{\\mathrm\{loc\}\}G\_\{B\}\(E\-1\)\}\{2\}\.\(186\)

###### Proof\.

ByLiL\_\{i\}\-smoothness,

‖∇Fi​\(𝐰t,i\(e\)\)−∇Fi​\(𝐰t\)‖2≤Li​‖𝐰t,i\(e\)−𝐰t‖2\.\\left\\\|\\nabla F\_\{i\}\(\\mathbf\{w\}\_\{t,i\}^\{\(e\)\}\)\-\\nabla F\_\{i\}\(\\mathbf\{w\}\_\{t\}\)\\right\\\|\_\{2\}\\leq L\_\{i\}\\left\\\|\\mathbf\{w\}\_\{t,i\}^\{\(e\)\}\-\\mathbf\{w\}\_\{t\}\\right\\\|\_\{2\}\.\(187\)Because each local step has norm at mostηloc​GB\\eta\_\{\\mathrm\{loc\}\}G\_\{B\},

‖𝐰t,i\(e\)−𝐰t‖2≤e​ηloc​GB\.\\left\\\|\\mathbf\{w\}\_\{t,i\}^\{\(e\)\}\-\\mathbf\{w\}\_\{t\}\\right\\\|\_\{2\}\\leq e\\eta\_\{\\mathrm\{loc\}\}G\_\{B\}\.\(188\)Thus,

‖𝐫t,i‖2\\displaystyle\\\|\\mathbf\{r\}\_\{t,i\}\\\|\_\{2\}=‖1E​∑e=0E−1\[∇Fi​\(𝐰t,i\(e\)\)−∇Fi​\(𝐰t\)\]‖2\\displaystyle=\\left\\\|\\frac\{1\}\{E\}\\sum\_\{e=0\}^\{E\-1\}\\left\[\\nabla F\_\{i\}\(\\mathbf\{w\}\_\{t,i\}^\{\(e\)\}\)\-\\nabla F\_\{i\}\(\\mathbf\{w\}\_\{t\}\)\\right\]\\right\\\|\_\{2\}≤1E​∑e=0E−1Li​‖𝐰t,i\(e\)−𝐰t‖2\\displaystyle\\leq\\frac\{1\}\{E\}\\sum\_\{e=0\}^\{E\-1\}L\_\{i\}\\left\\\|\\mathbf\{w\}\_\{t,i\}^\{\(e\)\}\-\\mathbf\{w\}\_\{t\}\\right\\\|\_\{2\}≤1E​∑e=0E−1Lmax​e​ηloc​GB\\displaystyle\\leq\\frac\{1\}\{E\}\\sum\_\{e=0\}^\{E\-1\}L\_\{\\max\}e\\eta\_\{\\mathrm\{loc\}\}G\_\{B\}=Lmax​ηloc​GB​\(E−1\)2\.\\displaystyle=\\frac\{L\_\{\\max\}\\eta\_\{\\mathrm\{loc\}\}G\_\{B\}\(E\-1\)\}\{2\}\.\(189\)Finally,

ϱt\\displaystyle\\varrho\_\{t\}=‖∑i∈ℛt∩𝒞benαt,i​𝐫t,i‖2\\displaystyle=\\left\\\|\\sum\_\{i\\in\\mathcal\{R\}\_\{t\}\\cap\\mathcal\{C\}\_\{\\mathrm\{ben\}\}\}\\alpha\_\{t,i\}\\mathbf\{r\}\_\{t,i\}\\right\\\|\_\{2\}≤∑i∈ℛt∩𝒞benαt,i​‖𝐫t,i‖2\\displaystyle\\leq\\sum\_\{i\\in\\mathcal\{R\}\_\{t\}\\cap\\mathcal\{C\}\_\{\\mathrm\{ben\}\}\}\\alpha\_\{t,i\}\\\|\\mathbf\{r\}\_\{t,i\}\\\|\_\{2\}≤\(1−μt\)​Lmax​ηloc​GB​\(E−1\)2\.\\displaystyle\\leq\(1\-\\mu\_\{t\}\)\\frac\{L\_\{\\max\}\\eta\_\{\\mathrm\{loc\}\}G\_\{B\}\(E\-1\)\}\{2\}\.\(190\)This proves the lemma\. ∎

## Appendix CDetailed Experimental Settings

This appendix provides the complete experimental configuration used in Section[V](https://arxiv.org/html/2608.18736#S5), including the datasets, tokenization, client partitions, model architectures, optimization settings, attack configuration, baseline parameters, andFedLNSimplementation details\.

### C\-AFederated Learning Protocol

Table[II](https://arxiv.org/html/2608.18736#A3.T2)summarizes the simulation protocol shared by all three model families: a population ofK=200K=200clients participates at rate0\.10\.1\(2020clients per round\) over200200communication rounds, with local AdamW optimization \(weight decay0\.010\.01\), evaluation after every round, and results averaged over three random seeds under both IID and non\-IID partitions\.

TABLE II:Federated simulation protocol used across model families\.ItemValueNumber of clientsK=200K=200Participation rate0\.10\.1Clients per round2020Communication rounds200200Random seeds100,200,300100,200,300Data partitionsIID and non\-IIDNon\-IID constructionTwo shards per clientLocal optimizerAdamWWeight decay0\.010\.01Evaluation frequencyEvery communication round
### C\-BDatasets and Tokenization

Table[III](https://arxiv.org/html/2608.18736#A3.T3)lists the dataset, tokenizer, and sequence\-construction choices for each model family, and Table[IV](https://arxiv.org/html/2608.18736#A3.T4)describes how the resulting training units are partitioned across clients\.

TABLE III:Dataset and tokenization settings\. All models are initialized from scratch; tokenizer names specify tokenization only\.Model familyDatasetTokenizerSequence constructionEvaluation split used for selection and reportingGPT\-style LMWikiText\-2 rawgpt2Causal LM blocks of length128128Official validation splitBERT\-style MLMTiny Shakespearebert\-base\-uncasedMLM blocks of length128128with \[CLS\]/\[SEP\]Final10%10\\%of the textLLaMA\-style LMStackOverflow postsTinyLlama/TinyLlama\-1\.1B\-Chat\-v1\.0Causal LM blocks of length128128Evaluation split defined during dataset constructionTABLE IV:Client data partition construction for IID and non\-IID settings\.Model familyTraining units before partitioningIID partitionNon\-IID partitionGPT\-style LM / WikiText\-2Causal LM token blocks of length128128Shuffle all block indices and assign them round\-robin to200200clientsSplit ordered block indices into400400contiguous shards; assign two shuffled shards per clientBERT\-style MLM / Tiny ShakespeareBERT MLM blocks of length128128from the first90%90\\%of the textShuffle all block indices and assign them round\-robin to200200clientsSplit ordered block indices into400400contiguous shards; assign two shuffled shards per clientLLaMA\-style LM / StackOverflowCausal LM token blocks of length128128from up to50,00050\{,\}000training postsShuffle all block indices and assign them round\-robin to200200clientsSplit ordered block indices into400400contiguous shards; assign two shuffled shards per clientFor each model family, the training corpus is first tokenized and converted into fixed\-length training blocks, after which the client partition is applied over the training\-block indices\. The evaluation split is never partitioned across clients\. It is used for global checkpoint selection and for reporting test loss, perplexity, and token\-level semantic entropy\.

In the IID setting, all training block indices are shuffled using the experiment seed and distributed to theK=200K=200clients in round\-robin order, so each client receives an approximately equal number of blocks sampled from across the entire training corpus\.

In the non\-IID setting, the ordered list of block indices is first divided intoK×2=400K\\times 2=400contiguous shards, the shard list is shuffled, and each client is assigned two shards\. Clients therefore still have approximately balanced data sizes, but each one observes only a small number of localized regions of the corpus – inducing client\-level heterogeneity through topic, style, speaker, or source locality rather than through class\-label skew\.

### C\-CModel Architectures and Optimization

Table[V](https://arxiv.org/html/2608.18736#A3.T5)lists the scratch transformer architecture used for each model family, and Table[VI](https://arxiv.org/html/2608.18736#A3.T6)lists the corresponding local optimization and evaluation settings\.

TABLE V:Scratch transformer architectures\.HyperparameterGPT\-style LMBERT\-style MLMLLaMA\-style LMHidden / embedding dimension256256256256256256Number of layers1212121288Attention heads161616161616Key\-value heads––88Intermediate dimension–1024102415361536Context / block size128128128128128128Max position embeddings128128130130256256Dropout0\.10\.1Default configDefault configRMSNorm epsilon––10−610^\{\-6\}Initializer rangeDefault configDefault config0\.020\.02TABLE VI:Optimization and evaluation settings\.SettingGPT\-style LMBERT\-style MLMLLaMA\-style LMLocal epochs333322Batch size888888Learning rate3×10−43\\times 10^\{\-4\}3×10−43\\times 10^\{\-4\}10−510^\{\-5\}Weight decay0\.010\.010\.010\.010\.010\.01Train\-evaluation batches2002002002005050Evaluation batches2002002002005050MLM masking probability–0\.150\.15–Maximum training examplesFull splitFull split50,00050\{,\}000Maximum evaluation examplesFull splitFull split5,0005\{,\}000
### C\-DAttack and Aggregation\-Baseline Configuration

Table[VII](https://arxiv.org/html/2608.18736#A3.T7)details the target\-corruption attack used throughout the experiments: input tokens are left unchanged, only training targets are corrupted, and each malicious client corrupts its labels with probabilitypcorr=1\.0p\_\{\\mathrm\{corr\}\}=1\.0\. The main text reports results at the malicious\-client fractionα=0\.4\\alpha=0\.4\(8080of200200clients\); this appendix evaluates the full sweepα∈\{0,0\.1,0\.2,0\.3,0\.4\}\\alpha\\in\\\{0,0\.1,0\.2,0\.3,0\.4\\\}\.

TABLE VII:Target\-corruption attack settings\.ItemValueAttack typeTarget corruptionInput tokensKept unchangedCorrupted quantityTraining targets / labelsCorruption probabilitypcorr=1\.0p\_\{\\mathrm\{corr\}\}=1\.0Malicious fractions in sweep0,0\.1,0\.2,0\.3,0\.40,0\.1,0\.2,0\.3,0\.4Strongest main\-text attack fraction0\.40\.4Malicious clients in the population at0\.40\.48080out of200200Special\-token handlingPadding labels avoided; EOS/padding avoided when sampling corrupt labelsTable[VIII](https://arxiv.org/html/2608.18736#A3.T8)summarizes the aggregation methods compared againstFedLNS, and Table[IX](https://arxiv.org/html/2608.18736#A3.T9)lists the attack\-dependent parameters used for each population\-level malicious\-client fraction: the trim fraction for Trimmed Mean and the parametersffandmmfor Multi\-Krum, with2020clients selected per round\. These two baselines are therefore configured using the population\-level corruption fraction\.

TABLE VIII:Aggregation methods compared in the experiments\.MethodImplementation summaryFedAvgSample\-weighted average of client updatesNorm\-Bounded FedAvgEach update is clipped by anℓ2\\ell\_\{2\}norm bound before FedAvgCoordinate MedianCoordinate\-wise median of flattened updatesTrimmed MeanCoordinate\-wise trimming followed by averagingMulti\-KrumDistance\-based update selection followed by averaging selected updatesFLAMETwo\-cluster filtering, majority\-cluster retention, norm clipping, and Gaussian noiseFedLNSNormalization\-signature bank, median/MAD standardization, and BIC\-guided GMM screeningTABLE IX:Robust\-aggregation parameters used for each malicious\-client fraction\. The number of selected clients per round is2020\.Malicious fractionTrim fractionMulti\-KrumffMulti\-Krummm0\.00\.00\.00\.00020200\.10\.10\.10\.12218180\.20\.20\.20\.24416160\.30\.30\.30\.36614140\.40\.40\.40\.4881212
### C\-EFedLNS Implementation Details

Table[X](https://arxiv.org/html/2608.18736#A3.T10)lists theFedLNSimplementation settings used in all experiments, covering normalization\-parameter extraction, bank update timing, robust standardization, and BIC\-guided one\-vs\-two\-component GMM screening\.

TABLE X:FedLNS implementation settings used in the experiments\.ItemSettingSignature sourceTrainable normalization\-layer parameters whose names containlnorlayernormand end withweightorbiasBank entryOne latest per\-layer signature dictionary per clientBank update timingBefore screening in the current roundBank update ruleLatest replacement; EMA coefficientβ=0\\beta=0Robust centerCoordinate\-wise bank medianRobust scaleCoordinate\-wise MADMAD floor10−610^\{\-6\}Client deviation scoreMedian absolute standardized deviationGMM candidatesOne diagonal Gaussian vs\. two diagonal GaussiansGMM model selectionBIC for defaultFedLNSGMM covarianceDiagonalGMM regularization10−410^\{\-4\}GMM initializationK\-means initialization,55restartsMaximum GMM iterations200200Two\-component retain ruleKeep component with smaller median standardized deviationSafety fallbackIf no client is retained, retainarg⁡mini∈𝒮t⁡δt,i\\arg\\min\_\{i\\in\\mathcal\{S\}\_\{t\}\}\\delta\_\{t,i\}

## Appendix DComplete Results Across Malicious\-Client Fractions

This appendix reports the complete numerical results for the malicious\-client fraction sweep, evaluated over

α∈\{0,0\.1,0\.2,0\.3,0\.4\},\\alpha\\in\\\{0,0\.1,0\.2,0\.3,0\.4\\\},\(191\)which forK=200K=200clients correspond to00,2020,4040,6060, and8080malicious clients, respectively\.

All tables follow the reporting rule used in the main text: for each seed, the checkpoint with the lowest test loss is selected, and test loss, perplexity, and token\-level semantic entropy are reported from that same model state\. For each model, partition, aggregation method, and malicious\-client fraction, each entry reports the mean and sample standard deviation over seeds\{100,200,300\}\\\{100,200,300\\\}, with lower values indicating better performance for all three metrics\.

The tables are grouped by model family and data partition\. For each model and partition, they report test loss, perplexity, and token\-level semantic entropy across the full attack\-fraction sweep from the clean setting to the strongest evaluated setting of40%40\\%\.

### D\-AGPT\-Style Causal Language Modeling on WikiText

Tables[XI](https://arxiv.org/html/2608.18736#A4.T11)–[XIII](https://arxiv.org/html/2608.18736#A4.T13)report the IID results for GPT/WikiText, and Tables[XIV](https://arxiv.org/html/2608.18736#A4.T14)–[XVI](https://arxiv.org/html/2608.18736#A4.T16)report the non\-IID results\.

TABLE XI:Test Loss under different malicious\-client fractions for GPT / WikiText with IID partition\. Values are mean±\\pmstandard deviation over three seeds\. For each seed, all metrics are taken from the checkpoint with the lowest test loss\. The best case is highlighted in bold\.Method0%10%20%30%40%FedAvg7\.13±\\pm0\.017\.17±\\pm0\.017\.23±\\pm0\.007\.29±\\pm0\.017\.37±\\pm0\.02Norm\-Bound7\.50±\\pm0\.007\.51±\\pm0\.017\.59±\\pm0\.017\.69±\\pm0\.027\.89±\\pm0\.01Median7\.30±\\pm0\.017\.27±\\pm0\.017\.28±\\pm0\.017\.30±\\pm0\.017\.47±\\pm0\.03Trimmed7\.12±\\pm0\.017\.19±\\pm0\.017\.25±\\pm0\.017\.32±\\pm0\.037\.43±\\pm0\.01Multi\-Krum7\.12±\\pm0\.017\.15±\\pm0\.017\.19±\\pm0\.007\.21±\\pm0\.007\.28±\\pm0\.02FLAME7\.19±\\pm0\.007\.19±\\pm0\.017\.20±\\pm0\.007\.21±\\pm0\.007\.33±\\pm0\.03FedLNS7\.13±\\pm0\.007\.13±\\pm0\.007\.13±\\pm0\.007\.14±\\pm0\.007\.16±\\pm0\.00TABLE XII:Test PPL under different malicious\-client fractions for GPT / WikiText with IID partition\. Values are mean±\\pmstandard deviation over three seeds\. For each seed, all metrics are taken from the checkpoint with the lowest test loss\. The best case is highlighted in bold\.Method0%10%20%30%40%FedAvg1242\.91±\\pm6\.581303\.02±\\pm9\.591373\.61±\\pm1\.631472\.41±\\pm15\.311590\.56±\\pm35\.51Norm\-Bound1809\.27±\\pm8\.311828\.13±\\pm10\.691985\.85±\\pm25\.342196\.84±\\pm33\.992683\.53±\\pm34\.31Median1484\.69±\\pm11\.201441\.44±\\pm9\.331452\.99±\\pm11\.401477\.26±\\pm17\.651751\.07±\\pm52\.62Trimmed1241\.55±\\pm10\.081326\.15±\\pm17\.451411\.15±\\pm15\.571516\.84±\\pm43\.711689\.16±\\pm18\.00Multi\-Krum1242\.08±\\pm8\.401275\.34±\\pm7\.091320\.41±\\pm5\.631356\.21±\\pm6\.191449\.72±\\pm22\.36FLAME1323\.55±\\pm4\.871328\.88±\\pm7\.211345\.05±\\pm2\.821355\.34±\\pm3\.271524\.02±\\pm40\.71FedLNS1246\.57±\\pm2\.521247\.28±\\pm5\.971249\.11±\\pm1\.781258\.21±\\pm4\.701281\.63±\\pm1\.74TABLE XIII:Semantic Entropy under different malicious\-client fractions for GPT / WikiText with IID partition\. Values are mean±\\pmstandard deviation over three seeds\. For each seed, all metrics are taken from the checkpoint with the lowest test loss\. The best case is highlighted in bold\.Method0%10%20%30%40%FedAvg6\.80±\\pm0\.067\.08±\\pm0\.087\.37±\\pm0\.187\.56±\\pm0\.167\.96±\\pm0\.07Norm\-Bound6\.55±\\pm0\.028\.04±\\pm0\.128\.31±\\pm0\.108\.92±\\pm0\.039\.69±\\pm0\.06Median6\.89±\\pm0\.047\.30±\\pm0\.157\.27±\\pm0\.147\.61±\\pm0\.137\.55±\\pm0\.19Trimmed6\.77±\\pm0\.037\.30±\\pm0\.187\.29±\\pm0\.197\.47±\\pm0\.137\.55±\\pm0\.39Multi\-Krum6\.80±\\pm0\.077\.14±\\pm0\.247\.07±\\pm0\.097\.03±\\pm0\.117\.13±\\pm0\.37FLAME7\.11±\\pm0\.057\.13±\\pm0\.107\.20±\\pm0\.057\.11±\\pm0\.096\.96±\\pm0\.10FedLNS6\.73±\\pm0\.036\.81±\\pm0\.016\.75±\\pm0\.026\.74±\\pm0\.046\.80±\\pm0\.06TABLE XIV:Test Loss under different malicious\-client fractions for GPT / WikiText with Non\-IID partition\. Values are mean±\\pmstandard deviation over three seeds\. For each seed, all metrics are taken from the checkpoint with the lowest test loss\. The best case is highlighted in bold\.Method0%10%20%30%40%FedAvg7\.10±\\pm0\.017\.16±\\pm0\.017\.23±\\pm0\.047\.29±\\pm0\.067\.37±\\pm0\.08Norm\-Bound7\.56±\\pm0\.017\.54±\\pm0\.007\.63±\\pm0\.017\.75±\\pm0\.027\.94±\\pm0\.09Median7\.21±\\pm0\.007\.18±\\pm0\.007\.26±\\pm0\.027\.33±\\pm0\.027\.51±\\pm0\.03Trimmed7\.11±\\pm0\.017\.17±\\pm0\.017\.25±\\pm0\.017\.38±\\pm0\.037\.51±\\pm0\.05Multi\-Krum7\.11±\\pm0\.017\.18±\\pm0\.007\.25±\\pm0\.017\.30±\\pm0\.007\.36±\\pm0\.03FLAME7\.21±\\pm0\.007\.25±\\pm0\.017\.28±\\pm0\.017\.29±\\pm0\.017\.40±\\pm0\.04FedLNS7\.11±\\pm0\.017\.12±\\pm0\.007\.13±\\pm0\.017\.15±\\pm0\.027\.16±\\pm0\.01TABLE XV:Test PPL under different malicious\-client fractions for GPT / WikiText with Non\-IID partition\. Values are mean±\\pmstandard deviation over three seeds\. For each seed, all metrics are taken from the checkpoint with the lowest test loss\. The best case is highlighted in bold\.Method0%10%20%30%40%FedAvg1211\.23±\\pm6\.701282\.08±\\pm13\.221378\.40±\\pm55\.981471\.79±\\pm90\.091595\.68±\\pm132\.68Norm\-Bound1916\.47±\\pm13\.001886\.00±\\pm3\.632060\.01±\\pm13\.632314\.33±\\pm44\.032811\.07±\\pm257\.29Median1350\.32±\\pm1\.341309\.94±\\pm6\.401419\.46±\\pm32\.271529\.64±\\pm31\.031820\.62±\\pm48\.31Trimmed1225\.89±\\pm8\.211295\.29±\\pm16\.411406\.67±\\pm11\.551599\.60±\\pm52\.851819\.34±\\pm98\.93Multi\-Krum1225\.07±\\pm8\.061311\.67±\\pm5\.601408\.79±\\pm20\.451474\.93±\\pm3\.801579\.81±\\pm43\.94FLAME1359\.58±\\pm3\.821415\.19±\\pm13\.321449\.95±\\pm14\.721467\.85±\\pm14\.751637\.88±\\pm63\.90FedLNS1225\.90±\\pm12\.061238\.52±\\pm4\.971251\.65±\\pm11\.371277\.28±\\pm23\.521286\.50±\\pm15\.34TABLE XVI:Semantic Entropy under different malicious\-client fractions for GPT / WikiText with Non\-IID partition\. Values are mean±\\pmstandard deviation over three seeds\. For each seed, all metrics are taken from the checkpoint with the lowest test loss\. The best case is highlighted in bold\.Method0%10%20%30%40%FedAvg6\.79±\\pm0\.077\.31±\\pm0\.177\.12±\\pm0\.377\.61±\\pm0\.307\.66±\\pm0\.26Norm\-Bound6\.37±\\pm0\.027\.85±\\pm0\.198\.44±\\pm0\.209\.02±\\pm0\.099\.60±\\pm0\.36Median6\.74±\\pm0\.157\.31±\\pm0\.347\.14±\\pm0\.327\.52±\\pm0\.107\.45±\\pm0\.25Trimmed6\.75±\\pm0\.157\.36±\\pm0\.077\.27±\\pm0\.077\.39±\\pm0\.117\.72±\\pm0\.28Multi\-Krum6\.79±\\pm0\.177\.08±\\pm0\.127\.07±\\pm0\.457\.25±\\pm0\.477\.18±\\pm0\.46FLAME7\.04±\\pm0\.037\.08±\\pm0\.157\.32±\\pm0\.206\.94±\\pm0\.077\.13±\\pm0\.58FedLNS6\.80±\\pm0\.096\.79±\\pm0\.057\.04±\\pm0\.406\.90±\\pm0\.026\.92±\\pm0\.24
### D\-BBERT\-Style Masked Language Modeling on Tiny Shakespeare

Tables[XVII](https://arxiv.org/html/2608.18736#A4.T17)–[XIX](https://arxiv.org/html/2608.18736#A4.T19)report the IID results for BERT/Tiny Shakespeare, and Tables[XX](https://arxiv.org/html/2608.18736#A4.T20)–[XXII](https://arxiv.org/html/2608.18736#A4.T22)report the non\-IID results\. The reported perplexity is masked\-token perplexity and should be interpreted within the masked\-language\-modeling setting\.

TABLE XVII:Test Loss under different malicious\-client fractions for BERT / Shakespeare with IID partition\. Values are mean±\\pmstandard deviation over three seeds\. For each seed, all metrics are taken from the checkpoint with the lowest test loss\. The best case is highlighted in bold\.Method0%10%20%30%40%FedAvg6\.49±\\pm0\.036\.54±\\pm0\.016\.57±\\pm0\.016\.62±\\pm0\.026\.68±\\pm0\.02Norm\-Bound6\.80±\\pm0\.036\.80±\\pm0\.016\.92±\\pm0\.017\.11±\\pm0\.017\.30±\\pm0\.05Median6\.80±\\pm0\.036\.82±\\pm0\.016\.82±\\pm0\.026\.80±\\pm0\.036\.97±\\pm0\.08Trimmed6\.49±\\pm0\.036\.66±\\pm0\.016\.72±\\pm0\.026\.80±\\pm0\.036\.97±\\pm0\.07Multi\-Krum6\.49±\\pm0\.036\.51±\\pm0\.016\.52±\\pm0\.016\.54±\\pm0\.026\.59±\\pm0\.02FLAME6\.49±\\pm0\.036\.47±\\pm0\.026\.49±\\pm0\.026\.52±\\pm0\.006\.70±\\pm0\.18FedLNS6\.50±\\pm0\.056\.49±\\pm0\.026\.49±\\pm0\.026\.51±\\pm0\.016\.55±\\pm0\.02TABLE XVIII:Test PPL under different malicious\-client fractions for BERT / Shakespeare with IID partition\. Values are mean±\\pmstandard deviation over three seeds\. For each seed, all metrics are taken from the checkpoint with the lowest test loss\. The best case is highlighted in bold\.Method0%10%20%30%40%FedAvg659\.93±\\pm21\.92693\.01±\\pm4\.36710\.15±\\pm6\.19750\.09±\\pm12\.08794\.54±\\pm15\.01Norm\-Bound901\.04±\\pm29\.47897\.17±\\pm10\.131008\.61±\\pm7\.001227\.23±\\pm15\.361477\.67±\\pm70\.84Median894\.85±\\pm27\.58912\.29±\\pm9\.07913\.38±\\pm19\.06898\.46±\\pm22\.551066\.13±\\pm91\.56Trimmed660\.99±\\pm20\.10779\.94±\\pm9\.18831\.19±\\pm20\.60900\.65±\\pm26\.881062\.80±\\pm79\.49Multi\-Krum661\.00±\\pm20\.10672\.89±\\pm7\.97676\.44±\\pm4\.57695\.35±\\pm12\.21725\.76±\\pm17\.84FLAME658\.52±\\pm18\.95645\.26±\\pm15\.47657\.21±\\pm10\.53679\.98±\\pm3\.26818\.57±\\pm157\.53FedLNS663\.68±\\pm29\.76655\.97±\\pm11\.66661\.38±\\pm11\.94669\.37±\\pm5\.86697\.62±\\pm13\.62TABLE XIX:Semantic Entropy under different malicious\-client fractions for BERT / Shakespeare with IID partition\. Values are mean±\\pmstandard deviation over three seeds\. For each seed, all metrics are taken from the checkpoint with the lowest test loss\. The best case is highlighted in bold\.Method0%10%20%30%40%FedAvg6\.26±\\pm0\.186\.79±\\pm0\.196\.95±\\pm0\.077\.22±\\pm0\.367\.37±\\pm0\.33Norm\-Bound6\.31±\\pm0\.037\.27±\\pm0\.217\.65±\\pm0\.078\.07±\\pm0\.158\.54±\\pm0\.16Median6\.60±\\pm0\.066\.92±\\pm0\.227\.05±\\pm0\.347\.41±\\pm0\.227\.47±\\pm0\.78Trimmed6\.28±\\pm0\.166\.63±\\pm0\.176\.97±\\pm0\.187\.35±\\pm0\.546\.76±\\pm0\.47Multi\-Krum6\.28±\\pm0\.166\.40±\\pm0\.076\.69±\\pm0\.386\.53±\\pm0\.366\.61±\\pm0\.28FLAME6\.26±\\pm0\.036\.26±\\pm0\.116\.11±\\pm0\.056\.15±\\pm0\.106\.46±\\pm0\.16FedLNS6\.28±\\pm0\.096\.38±\\pm0\.166\.19±\\pm0\.096\.24±\\pm0\.106\.24±\\pm0\.06TABLE XX:Test Loss under different malicious\-client fractions for BERT / Shakespeare with Non\-IID partition\. Values are mean±\\pmstandard deviation over three seeds\. For each seed, all metrics are taken from the checkpoint with the lowest test loss\. The best case is highlighted in bold\.Method0%10%20%30%40%FedAvg6\.36±\\pm0\.036\.38±\\pm0\.046\.51±\\pm0\.106\.56±\\pm0\.126\.59±\\pm0\.11Norm\-Bound6\.83±\\pm0\.016\.85±\\pm0\.016\.95±\\pm0\.017\.14±\\pm0\.027\.34±\\pm0\.02Median6\.86±\\pm0\.016\.89±\\pm0\.016\.86±\\pm0\.036\.86±\\pm0\.016\.95±\\pm0\.05Trimmed6\.54±\\pm0\.036\.72±\\pm0\.016\.80±\\pm0\.026\.84±\\pm0\.026\.94±\\pm0\.02Multi\-Krum6\.54±\\pm0\.036\.59±\\pm0\.026\.60±\\pm0\.016\.61±\\pm0\.026\.69±\\pm0\.06FLAME6\.57±\\pm0\.026\.56±\\pm0\.036\.56±\\pm0\.016\.57±\\pm0\.016\.86±\\pm0\.17FedLNS6\.47±\\pm0\.056\.36±\\pm0\.066\.42±\\pm0\.146\.38±\\pm0\.186\.48±\\pm0\.13TABLE XXI:Test PPL under different malicious\-client fractions for BERT / Shakespeare with Non\-IID partition\. Values are mean±\\pmstandard deviation over three seeds\. For each seed, all metrics are taken from the checkpoint with the lowest test loss\. The best case is highlighted in bold\.Method0%10%20%30%40%FedAvg576\.49±\\pm19\.76588\.64±\\pm24\.25672\.55±\\pm66\.84708\.50±\\pm88\.05731\.73±\\pm83\.15Norm\-Bound922\.98±\\pm7\.18941\.70±\\pm9\.951039\.58±\\pm9\.181262\.16±\\pm26\.291533\.59±\\pm36\.83Median950\.49±\\pm10\.79985\.58±\\pm6\.47949\.59±\\pm26\.06953\.32±\\pm10\.761047\.36±\\pm53\.66Trimmed691\.27±\\pm19\.12829\.90±\\pm7\.29893\.88±\\pm19\.37938\.21±\\pm17\.351033\.35±\\pm24\.28Multi\-Krum691\.27±\\pm19\.11727\.43±\\pm13\.60732\.73±\\pm10\.31739\.83±\\pm12\.52804\.39±\\pm53\.06FLAME710\.27±\\pm16\.45705\.47±\\pm23\.82704\.63±\\pm4\.08712\.01±\\pm8\.24963\.65±\\pm157\.76FedLNS643\.56±\\pm33\.46576\.63±\\pm36\.58618\.30±\\pm91\.12594\.61±\\pm108\.75658\.21±\\pm91\.66TABLE XXII:Semantic Entropy under different malicious\-client fractions for BERT / Shakespeare with Non\-IID partition\. Values are mean±\\pmstandard deviation over three seeds\. For each seed, all metrics are taken from the checkpoint with the lowest test loss\. The best case is highlighted in bold\.Method0%10%20%30%40%FedAvg5\.87±\\pm0\.146\.34±\\pm0\.416\.96±\\pm0\.207\.19±\\pm0\.386\.94±\\pm0\.14Norm\-Bound6\.27±\\pm0\.016\.99±\\pm0\.147\.63±\\pm0\.157\.98±\\pm0\.198\.48±\\pm0\.02Median6\.59±\\pm0\.067\.28±\\pm0\.107\.20±\\pm0\.367\.41±\\pm0\.267\.20±\\pm0\.59Trimmed6\.24±\\pm0\.106\.61±\\pm0\.157\.00±\\pm0\.137\.23±\\pm0\.176\.75±\\pm0\.27Multi\-Krum6\.24±\\pm0\.106\.67±\\pm0\.246\.43±\\pm0\.066\.69±\\pm0\.136\.82±\\pm0\.31FLAME6\.19±\\pm0\.066\.27±\\pm0\.166\.30±\\pm0\.126\.41±\\pm0\.126\.62±\\pm0\.14FedLNS6\.12±\\pm0\.056\.06±\\pm0\.186\.33±\\pm0\.096\.00±\\pm0\.386\.19±\\pm0\.13
### D\-CLLaMA\-Style Causal Language Modeling on StackOverflow

Tables[XXIII](https://arxiv.org/html/2608.18736#A4.T23)–[XXV](https://arxiv.org/html/2608.18736#A4.T25)report the IID results for LLaMA/StackOverflow, and Tables[XXVI](https://arxiv.org/html/2608.18736#A4.T26)–[XXVIII](https://arxiv.org/html/2608.18736#A4.T28)report the non\-IID results\.

TABLE XXIII:Test Loss under different malicious\-client fractions for LLaMA / StackOverflow with IID partition\. Values are mean±\\pmstandard deviation over three seeds\. For each seed, all metrics are taken from the checkpoint with the lowest test loss\. The best case is highlighted in bold\.Method0%10%20%30%40%FedAvg5\.36±\\pm0\.035\.40±\\pm0\.035\.46±\\pm0\.045\.53±\\pm0\.025\.66±\\pm0\.04Norm\-Bound5\.49±\\pm0\.035\.56±\\pm0\.035\.63±\\pm0\.045\.77±\\pm0\.025\.86±\\pm0\.08Median5\.39±\\pm0\.035\.40±\\pm0\.035\.43±\\pm0\.035\.46±\\pm0\.035\.54±\\pm0\.03Trimmed5\.36±\\pm0\.035\.39±\\pm0\.035\.43±\\pm0\.035\.47±\\pm0\.035\.54±\\pm0\.04Multi\-Krum5\.36±\\pm0\.035\.37±\\pm0\.035\.38±\\pm0\.035\.39±\\pm0\.035\.43±\\pm0\.04FLAME5\.48±\\pm0\.035\.48±\\pm0\.035\.48±\\pm0\.035\.49±\\pm0\.035\.58±\\pm0\.05FedLNS5\.36±\\pm0\.035\.37±\\pm0\.035\.37±\\pm0\.035\.37±\\pm0\.035\.38±\\pm0\.03TABLE XXIV:Test PPL under different malicious\-client fractions for LLaMA / StackOverflow with IID partition\. Values are mean±\\pmstandard deviation over three seeds\. For each seed, all metrics are taken from the checkpoint with the lowest test loss\. The best case is highlighted in bold\.Method0%10%20%30%40%FedAvg213\.15±\\pm6\.77221\.94±\\pm6\.63234\.03±\\pm8\.53251\.01±\\pm5\.88286\.73±\\pm10\.99Norm\-Bound243\.23±\\pm6\.54258\.63±\\pm6\.54279\.81±\\pm11\.33319\.10±\\pm6\.04349\.83±\\pm27\.13Median218\.98±\\pm7\.04222\.39±\\pm7\.10227\.13±\\pm7\.36235\.44±\\pm6\.60254\.94±\\pm8\.06Trimmed213\.15±\\pm6\.77219\.60±\\pm7\.16227\.49±\\pm7\.80237\.43±\\pm7\.51254\.52±\\pm9\.07Multi\-Krum213\.15±\\pm6\.77215\.53±\\pm7\.04217\.38±\\pm6\.99219\.76±\\pm6\.92228\.52±\\pm8\.72FLAME240\.02±\\pm6\.40239\.85±\\pm6\.77240\.36±\\pm6\.81242\.54±\\pm7\.33264\.80±\\pm13\.70FedLNS213\.42±\\pm6\.57213\.93±\\pm6\.56214\.57±\\pm6\.75215\.61±\\pm6\.70217\.14±\\pm6\.85TABLE XXV:Semantic Entropy under different malicious\-client fractions for LLaMA / StackOverflow with IID partition\. Values are mean±\\pmstandard deviation over three seeds\. For each seed, all metrics are taken from the checkpoint with the lowest test loss\. The best case is highlighted in bold\.Method0%10%20%30%40%FedAvg5\.52±\\pm0\.025\.80±\\pm0\.025\.97±\\pm0\.126\.12±\\pm0\.066\.58±\\pm0\.34Norm\-Bound5\.70±\\pm0\.015\.96±\\pm0\.016\.43±\\pm0\.226\.83±\\pm0\.076\.95±\\pm0\.43Median5\.55±\\pm0\.025\.73±\\pm0\.035\.81±\\pm0\.085\.91±\\pm0\.025\.97±\\pm0\.09Trimmed5\.52±\\pm0\.025\.73±\\pm0\.045\.81±\\pm0\.095\.89±\\pm0\.045\.95±\\pm0\.08Multi\-Krum5\.52±\\pm0\.025\.54±\\pm0\.045\.55±\\pm0\.035\.56±\\pm0\.035\.61±\\pm0\.03FLAME5\.64±\\pm0\.055\.61±\\pm0\.045\.64±\\pm0\.055\.65±\\pm0\.045\.74±\\pm0\.05FedLNS5\.52±\\pm0\.025\.52±\\pm0\.045\.54±\\pm0\.035\.52±\\pm0\.045\.52±\\pm0\.02TABLE XXVI:Test Loss under different malicious\-client fractions for LLaMA / StackOverflow with Non\-IID partition\. Values are mean±\\pmstandard deviation over three seeds\. For each seed, all metrics are taken from the checkpoint with the lowest test loss\. The best case is highlighted in bold\.Method0%10%20%30%40%FedAvg5\.37±\\pm0\.035\.41±\\pm0\.035\.47±\\pm0\.045\.54±\\pm0\.035\.67±\\pm0\.03Norm\-Bound5\.51±\\pm0\.035\.57±\\pm0\.035\.65±\\pm0\.045\.79±\\pm0\.025\.83±\\pm0\.05Median5\.40±\\pm0\.035\.42±\\pm0\.035\.44±\\pm0\.035\.48±\\pm0\.035\.56±\\pm0\.03Trimmed5\.37±\\pm0\.035\.40±\\pm0\.035\.44±\\pm0\.045\.49±\\pm0\.035\.56±\\pm0\.04Multi\-Krum5\.37±\\pm0\.035\.38±\\pm0\.035\.39±\\pm0\.035\.41±\\pm0\.035\.45±\\pm0\.04FLAME5\.49±\\pm0\.035\.49±\\pm0\.035\.49±\\pm0\.035\.50±\\pm0\.035\.59±\\pm0\.04FedLNS5\.37±\\pm0\.035\.38±\\pm0\.035\.38±\\pm0\.035\.38±\\pm0\.035\.39±\\pm0\.03TABLE XXVII:Test PPL under different malicious\-client fractions for LLaMA / StackOverflow with Non\-IID partition\. Values are mean±\\pmstandard deviation over three seeds\. For each seed, all metrics are taken from the checkpoint with the lowest test loss\. The best case is highlighted in bold\.Method0%10%20%30%40%FedAvg215\.38±\\pm6\.80224\.27±\\pm6\.68237\.35±\\pm9\.12255\.84±\\pm7\.17288\.74±\\pm8\.31Norm\-Bound246\.30±\\pm6\.76261\.73±\\pm6\.66283\.49±\\pm10\.99326\.42±\\pm6\.26340\.88±\\pm18\.09Median221\.84±\\pm7\.19225\.51±\\pm7\.38230\.73±\\pm7\.84239\.51±\\pm6\.99260\.33±\\pm7\.99Trimmed215\.55±\\pm6\.92222\.49±\\pm7\.43230\.96±\\pm8\.21241\.46±\\pm8\.09259\.56±\\pm9\.62Multi\-Krum215\.55±\\pm6\.92218\.10±\\pm7\.52219\.94±\\pm7\.17222\.74±\\pm7\.63233\.42±\\pm10\.15FLAME243\.12±\\pm6\.82242\.99±\\pm6\.85243\.25±\\pm6\.41245\.58±\\pm7\.14269\.08±\\pm11\.90FedLNS215\.55±\\pm6\.85216\.13±\\pm6\.70216\.97±\\pm6\.91218\.02±\\pm7\.07220\.18±\\pm6\.45TABLE XXVIII:Semantic Entropy under different malicious\-client fractions for LLaMA / StackOverflow with Non\-IID partition\. Values are mean±\\pmstandard deviation over three seeds\. For each seed, all metrics are taken from the checkpoint with the lowest test loss\. The best case is highlighted in bold\.Method0%10%20%30%40%FedAvg5\.53±\\pm0\.035\.80±\\pm0\.015\.94±\\pm0\.116\.22±\\pm0\.116\.61±\\pm0\.27Norm\-Bound5\.70±\\pm0\.035\.98±\\pm0\.016\.44±\\pm0\.216\.90±\\pm0\.096\.56±\\pm0\.42Median5\.56±\\pm0\.035\.76±\\pm0\.025\.84±\\pm0\.095\.91±\\pm0\.045\.99±\\pm0\.12Trimmed5\.53±\\pm0\.035\.75±\\pm0\.035\.84±\\pm0\.105\.92±\\pm0\.065\.96±\\pm0\.10Multi\-Krum5\.53±\\pm0\.035\.55±\\pm0\.045\.56±\\pm0\.035\.56±\\pm0\.025\.63±\\pm0\.06FLAME5\.66±\\pm0\.065\.63±\\pm0\.065\.62±\\pm0\.015\.66±\\pm0\.075\.74±\\pm0\.06FedLNS5\.54±\\pm0\.035\.54±\\pm0\.035\.53±\\pm0\.035\.53±\\pm0\.025\.52±\\pm0\.03

## Appendix EBank Coverage at Activation

This appendix studies the amount of bank coverage available whenFedLNSfirst activates screening and global aggregation\. Appendix[A](https://arxiv.org/html/2608.18736#A1)analyzes the benign\-majority probability of a partially populated bank; here, we evaluate how broader activation coverage affects the early active training trajectory\.

### E\-AReporting Protocol

The bank activation threshold determines when the server begins screening and global aggregation\. We therefore focus on the early active period immediately after each threshold is reached, where differences in bank coverage and activation timing are most visible\.

For each seed and activation coverage, the activation round is the first communication round in which the bank reachesMactM\_\{\\mathrm\{act\}\}\. We then consider the first ten active aggregation rounds\. Within this window, the checkpoint with the lowest test loss is selected, and test loss, perplexity, and token\-level semantic entropy are reported from the same checkpoint\.

### E\-BActivation Rounds

Tables[XXIX](https://arxiv.org/html/2608.18736#A5.T29)–[XXXVIII](https://arxiv.org/html/2608.18736#A5.T38)report the activation rounds for all population\-level malicious\-client fractions and partitions\. The observed timing follows the pattern analyzed in Appendix[A](https://arxiv.org/html/2608.18736#A1):Mact=0M\_\{\\mathrm\{act\}\}=0activates immediately, while thresholds covering25%25\\%,50%50\\%, and75%75\\%of the client population activate after approximately33,77, and1313–1414rounds, respectively\.

TABLE XXIX:Estimated activation rounds for the bank\-size ablation under IID partition with0%0\\%malicious clients\. The activation round is the first communication round where the bank reachesMactM\_\{\\mathrm\{act\}\}\.Mact/KM\_\{\\mathrm\{act\}\}/KGPT / WikiTextBERT / ShakespeareLLaMA / StackOverflow0%1\.0±\\pm0\.01\.0±\\pm0\.01\.0±\\pm0\.025%3\.0±\\pm0\.03\.0±\\pm0\.03\.0±\\pm0\.050%6\.7±\\pm0\.66\.7±\\pm0\.66\.7±\\pm0\.675%13\.3±\\pm0\.613\.3±\\pm0\.613\.3±\\pm0\.6TABLE XXX:Estimated activation rounds for the bank\-size ablation under IID partition with10%10\\%malicious clients\. The activation round is the first communication round where the bank reachesMactM\_\{\\mathrm\{act\}\}\.Mact/KM\_\{\\mathrm\{act\}\}/KGPT / WikiTextBERT / ShakespeareLLaMA / StackOverflow0%1\.0±\\pm0\.01\.0±\\pm0\.01\.0±\\pm0\.025%3\.0±\\pm0\.03\.0±\\pm0\.03\.0±\\pm0\.050%7\.0±\\pm0\.07\.0±\\pm0\.07\.0±\\pm0\.075%13\.0±\\pm0\.013\.0±\\pm0\.013\.0±\\pm0\.0TABLE XXXI:Estimated activation rounds for the bank\-size ablation under IID partition with20%20\\%malicious clients\. The activation round is the first communication round where the bank reachesMactM\_\{\\mathrm\{act\}\}\.Mact/KM\_\{\\mathrm\{act\}\}/KGPT / WikiTextBERT / ShakespeareLLaMA / StackOverflow0%1\.0±\\pm0\.01\.0±\\pm0\.01\.0±\\pm0\.025%3\.0±\\pm0\.03\.0±\\pm0\.03\.0±\\pm0\.050%7\.0±\\pm0\.07\.0±\\pm0\.07\.0±\\pm0\.075%13\.3±\\pm0\.613\.3±\\pm0\.613\.3±\\pm0\.6TABLE XXXII:Estimated activation rounds for the bank\-size ablation under IID partition with30%30\\%malicious clients\. The activation round is the first communication round where the bank reachesMactM\_\{\\mathrm\{act\}\}\.Mact/KM\_\{\\mathrm\{act\}\}/KGPT / WikiTextBERT / ShakespeareLLaMA / StackOverflow0%1\.0±\\pm0\.01\.0±\\pm0\.01\.0±\\pm0\.025%3\.0±\\pm0\.03\.0±\\pm0\.03\.0±\\pm0\.050%7\.3±\\pm0\.67\.3±\\pm0\.67\.3±\\pm0\.675%14\.0±\\pm1\.014\.0±\\pm1\.014\.0±\\pm1\.0TABLE XXXIII:Estimated activation rounds for the bank\-size ablation under IID partition with40%40\\%malicious clients\. The activation round is the first communication round where the bank reachesMactM\_\{\\mathrm\{act\}\}\.Mact/KM\_\{\\mathrm\{act\}\}/KGPT / WikiTextBERT / ShakespeareLLaMA / StackOverflow0%1\.0±\\pm0\.01\.0±\\pm0\.01\.0±\\pm0\.025%3\.0±\\pm0\.03\.0±\\pm0\.03\.0±\\pm0\.050%7\.0±\\pm0\.07\.0±\\pm0\.07\.0±\\pm0\.075%14\.0±\\pm1\.014\.0±\\pm1\.014\.0±\\pm1\.0TABLE XXXIV:Estimated activation rounds for the bank\-size ablation under Non\-IID partition with0%0\\%malicious clients\. The activation round is the first communication round where the bank reachesMactM\_\{\\mathrm\{act\}\}\.Mact/KM\_\{\\mathrm\{act\}\}/KGPT / WikiTextBERT / ShakespeareLLaMA / StackOverflow0%1\.0±\\pm0\.01\.0±\\pm0\.01\.0±\\pm0\.025%3\.0±\\pm0\.03\.0±\\pm0\.03\.0±\\pm0\.050%6\.7±\\pm0\.66\.7±\\pm0\.66\.7±\\pm0\.675%13\.3±\\pm0\.613\.3±\\pm0\.613\.3±\\pm0\.6TABLE XXXV:Estimated activation rounds for the bank\-size ablation under Non\-IID partition with10%10\\%malicious clients\. The activation round is the first communication round where the bank reachesMactM\_\{\\mathrm\{act\}\}\.Mact/KM\_\{\\mathrm\{act\}\}/KGPT / WikiTextBERT / ShakespeareLLaMA / StackOverflow0%1\.0±\\pm0\.01\.0±\\pm0\.01\.0±\\pm0\.025%3\.0±\\pm0\.03\.0±\\pm0\.03\.0±\\pm0\.050%7\.0±\\pm0\.07\.0±\\pm0\.07\.0±\\pm0\.075%13\.0±\\pm0\.013\.0±\\pm0\.013\.0±\\pm0\.0TABLE XXXVI:Estimated activation rounds for the bank\-size ablation under Non\-IID partition with20%20\\%malicious clients\. The activation round is the first communication round where the bank reachesMactM\_\{\\mathrm\{act\}\}\.Mact/KM\_\{\\mathrm\{act\}\}/KGPT / WikiTextBERT / ShakespeareLLaMA / StackOverflow0%1\.0±\\pm0\.01\.0±\\pm0\.01\.0±\\pm0\.025%3\.0±\\pm0\.03\.0±\\pm0\.03\.0±\\pm0\.050%7\.0±\\pm0\.07\.0±\\pm0\.07\.0±\\pm0\.075%13\.3±\\pm0\.613\.3±\\pm0\.613\.3±\\pm0\.6TABLE XXXVII:Estimated activation rounds for the bank\-size ablation under Non\-IID partition with30%30\\%malicious clients\. The activation round is the first communication round where the bank reachesMactM\_\{\\mathrm\{act\}\}\.Mact/KM\_\{\\mathrm\{act\}\}/KGPT / WikiTextBERT / ShakespeareLLaMA / StackOverflow0%1\.0±\\pm0\.01\.0±\\pm0\.01\.0±\\pm0\.025%3\.0±\\pm0\.03\.0±\\pm0\.03\.0±\\pm0\.050%7\.3±\\pm0\.67\.3±\\pm0\.67\.3±\\pm0\.675%14\.0±\\pm1\.014\.0±\\pm1\.014\.0±\\pm1\.0TABLE XXXVIII:Estimated activation rounds for the bank\-size ablation under Non\-IID partition with40%40\\%malicious clients\. The activation round is the first communication round where the bank reachesMactM\_\{\\mathrm\{act\}\}\.Mact/KM\_\{\\mathrm\{act\}\}/KGPT / WikiTextBERT / ShakespeareLLaMA / StackOverflow0%1\.0±\\pm0\.01\.0±\\pm0\.01\.0±\\pm0\.025%3\.0±\\pm0\.03\.0±\\pm0\.03\.0±\\pm0\.050%7\.0±\\pm0\.07\.0±\\pm0\.07\.0±\\pm0\.075%14\.0±\\pm1\.014\.0±\\pm1\.014\.0±\\pm1\.0
### E\-CResults Under IID Partitions

Tables[XXXIX](https://arxiv.org/html/2608.18736#A5.T39)–[LIII](https://arxiv.org/html/2608.18736#A5.T53)report the IID bank\-threshold results\. Across model families and attack fractions, larger thresholds generally improve the early active\-window values; these comparisons reflect both broader client coverage in the bank and later activation of global aggregation\.

At the strongest40%40\\%malicious\-client setting, the75%75\\%activation coverage gives the lowest test loss and perplexity for all three model families under IID partitioning: perplexity falls from1820\.21±4\.441820\.21\\pm 4\.44to1626\.87±9\.501626\.87\\pm 9\.50for GPT/WikiText, from1532\.76±114\.781532\.76\\pm 114\.78to1043\.96±22\.201043\.96\\pm 22\.20for BERT/Tiny Shakespeare, and from2408\.15±162\.252408\.15\\pm 162\.25to609\.87±24\.44609\.87\\pm 24\.44for LLaMA/StackOverflow\. Token\-level semantic entropy also decreases substantially for BERT and LLaMA, indicating that broader bank coverage can stabilize the early active trajectory\.

TABLE XXXIX:Bank\-size threshold ablation under IID partition with0%0\\%malicious clients\. Metric: Test Loss\. For each seed and threshold, we select the checkpoint with the lowest test loss within the first 10 communication rounds after the bank reachesMactM\_\{\\mathrm\{act\}\}\. The best case is highlighted in bold\.Mact/KM\_\{\\mathrm\{act\}\}/KGPT / WikiTextBERT / ShakespeareLLaMA / StackOverflow0%7\.50±\\pm0\.007\.33±\\pm0\.017\.72±\\pm0\.0425%7\.48±\\pm0\.017\.20±\\pm0\.037\.37±\\pm0\.0450%7\.44±\\pm0\.017\.04±\\pm0\.046\.87±\\pm0\.0975%7\.38±\\pm0\.016\.94±\\pm0\.026\.42±\\pm0\.03TABLE XL:Bank\-size threshold ablation under IID partition with0%0\\%malicious clients\. Metric: Test PPL\. For each seed and threshold, we select the checkpoint with the lowest test loss within the first 10 communication rounds after the bank reachesMactM\_\{\\mathrm\{act\}\}\. The best case is highlighted in bold\.Mact/KM\_\{\\mathrm\{act\}\}/KGPT / WikiTextBERT / ShakespeareLLaMA / StackOverflow0%1802\.40±\\pm2\.971519\.44±\\pm14\.382258\.01±\\pm88\.6825%1764\.16±\\pm11\.601341\.88±\\pm42\.961584\.71±\\pm60\.0150%1695\.11±\\pm18\.371143\.14±\\pm48\.58969\.72±\\pm83\.5075%1601\.83±\\pm17\.251028\.47±\\pm24\.40616\.50±\\pm19\.83TABLE XLI:Bank\-size threshold ablation under IID partition with0%0\\%malicious clients\. Metric: Semantic Entropy\. For each seed and threshold, we select the checkpoint with the lowest test loss within the first 10 communication rounds after the bank reachesMactM\_\{\\mathrm\{act\}\}\. The best case is highlighted in bold\.Mact/KM\_\{\\mathrm\{act\}\}/KGPT / WikiTextBERT / ShakespeareLLaMA / StackOverflow0%7\.01±\\pm0\.037\.46±\\pm0\.029\.95±\\pm0\.0225%6\.96±\\pm0\.097\.26±\\pm0\.389\.67±\\pm0\.0350%6\.90±\\pm0\.006\.39±\\pm0\.168\.88±\\pm0\.1875%6\.90±\\pm0\.066\.37±\\pm0\.127\.49±\\pm0\.04TABLE XLII:Bank\-size threshold ablation under IID partition with10%10\\%malicious clients\. Metric: Test Loss\. For each seed and threshold, we select the checkpoint with the lowest test loss within the first 10 communication rounds after the bank reachesMactM\_\{\\mathrm\{act\}\}\. The best case is highlighted in bold\.Mact/KM\_\{\\mathrm\{act\}\}/KGPT / WikiTextBERT / ShakespeareLLaMA / StackOverflow0%7\.50±\\pm0\.007\.32±\\pm0\.017\.72±\\pm0\.0425%7\.48±\\pm0\.017\.18±\\pm0\.057\.37±\\pm0\.0450%7\.44±\\pm0\.017\.06±\\pm0\.046\.84±\\pm0\.0375%7\.39±\\pm0\.006\.92±\\pm0\.026\.44±\\pm0\.03TABLE XLIII:Bank\-size threshold ablation under IID partition with10%10\\%malicious clients\. Metric: Test PPL\. For each seed and threshold, we select the checkpoint with the lowest test loss within the first 10 communication rounds after the bank reachesMactM\_\{\\mathrm\{act\}\}\. The best case is highlighted in bold\.Mact/KM\_\{\\mathrm\{act\}\}/KGPT / WikiTextBERT / ShakespeareLLaMA / StackOverflow0%1808\.57±\\pm3\.951512\.51±\\pm12\.152256\.49±\\pm90\.4825%1772\.48±\\pm13\.231310\.31±\\pm71\.291585\.07±\\pm62\.2750%1701\.03±\\pm11\.071163\.34±\\pm42\.36933\.03±\\pm30\.8975%1615\.82±\\pm5\.521011\.33±\\pm20\.24625\.74±\\pm17\.90TABLE XLIV:Bank\-size threshold ablation under IID partition with10%10\\%malicious clients\. Metric: Semantic Entropy\. For each seed and threshold, we select the checkpoint with the lowest test loss within the first 10 communication rounds after the bank reachesMactM\_\{\\mathrm\{act\}\}\. The best case is highlighted in bold\.Mact/KM\_\{\\mathrm\{act\}\}/KGPT / WikiTextBERT / ShakespeareLLaMA / StackOverflow0%7\.01±\\pm0\.107\.51±\\pm0\.049\.95±\\pm0\.0225%6\.98±\\pm0\.066\.88±\\pm0\.129\.67±\\pm0\.0350%6\.92±\\pm0\.056\.45±\\pm0\.018\.79±\\pm0\.0675%6\.91±\\pm0\.066\.33±\\pm0\.037\.54±\\pm0\.04TABLE XLV:Bank\-size threshold ablation under IID partition with20%20\\%malicious clients\. Metric: Test Loss\. For each seed and threshold, we select the checkpoint with the lowest test loss within the first 10 communication rounds after the bank reachesMactM\_\{\\mathrm\{act\}\}\. The best case is highlighted in bold\.Mact/KM\_\{\\mathrm\{act\}\}/KGPT / WikiTextBERT / ShakespeareLLaMA / StackOverflow0%7\.50±\\pm0\.017\.32±\\pm0\.017\.72±\\pm0\.0425%7\.48±\\pm0\.017\.19±\\pm0\.057\.37±\\pm0\.0450%7\.43±\\pm0\.017\.05±\\pm0\.016\.84±\\pm0\.0375%7\.39±\\pm0\.016\.93±\\pm0\.046\.43±\\pm0\.02TABLE XLVI:Bank\-size threshold ablation under IID partition with20%20\\%malicious clients\. Metric: Test PPL\. For each seed and threshold, we select the checkpoint with the lowest test loss within the first 10 communication rounds after the bank reachesMactM\_\{\\mathrm\{act\}\}\. The best case is highlighted in bold\.Mact/KM\_\{\\mathrm\{act\}\}/KGPT / WikiTextBERT / ShakespeareLLaMA / StackOverflow0%1810\.07±\\pm10\.641505\.92±\\pm11\.612256\.98±\\pm91\.1225%1774\.75±\\pm21\.701328\.38±\\pm66\.281585\.63±\\pm62\.4150%1693\.93±\\pm23\.241157\.90±\\pm17\.29933\.10±\\pm31\.2675%1612\.54±\\pm12\.601027\.72±\\pm37\.62617\.43±\\pm15\.49TABLE XLVII:Bank\-size threshold ablation under IID partition with20%20\\%malicious clients\. Metric: Semantic Entropy\. For each seed and threshold, we select the checkpoint with the lowest test loss within the first 10 communication rounds after the bank reachesMactM\_\{\\mathrm\{act\}\}\. The best case is highlighted in bold\.Mact/KM\_\{\\mathrm\{act\}\}/KGPT / WikiTextBERT / ShakespeareLLaMA / StackOverflow0%7\.02±\\pm0\.077\.52±\\pm0\.069\.95±\\pm0\.0225%6\.92±\\pm0\.036\.91±\\pm0\.139\.67±\\pm0\.0350%6\.95±\\pm0\.046\.48±\\pm0\.118\.79±\\pm0\.0675%6\.88±\\pm0\.076\.29±\\pm0\.057\.50±\\pm0\.07TABLE XLVIII:Bank\-size threshold ablation under IID partition with30%30\\%malicious clients\. Metric: Test Loss\. For each seed and threshold, we select the checkpoint with the lowest test loss within the first 10 communication rounds after the bank reachesMactM\_\{\\mathrm\{act\}\}\. The best case is highlighted in bold\.Mact/KM\_\{\\mathrm\{act\}\}/KGPT / WikiTextBERT / ShakespeareLLaMA / StackOverflow0%7\.50±\\pm0\.017\.32±\\pm0\.077\.72±\\pm0\.0425%7\.48±\\pm0\.017\.18±\\pm0\.047\.37±\\pm0\.0450%7\.44±\\pm0\.017\.06±\\pm0\.056\.81±\\pm0\.0575%7\.39±\\pm0\.016\.92±\\pm0\.036\.40±\\pm0\.03TABLE XLIX:Bank\-size threshold ablation under IID partition with30%30\\%malicious clients\. Metric: Test PPL\. For each seed and threshold, we select the checkpoint with the lowest test loss within the first 10 communication rounds after the bank reachesMactM\_\{\\mathrm\{act\}\}\. The best case is highlighted in bold\.Mact/KM\_\{\\mathrm\{act\}\}/KGPT / WikiTextBERT / ShakespeareLLaMA / StackOverflow0%1813\.92±\\pm12\.171508\.04±\\pm110\.342257\.69±\\pm91\.1525%1778\.81±\\pm10\.181312\.65±\\pm46\.411585\.24±\\pm62\.6550%1694\.88±\\pm16\.381169\.29±\\pm61\.52903\.36±\\pm43\.1675%1619\.16±\\pm11\.421011\.10±\\pm35\.22600\.06±\\pm15\.82TABLE L:Bank\-size threshold ablation under IID partition with30%30\\%malicious clients\. Metric: Semantic Entropy\. For each seed and threshold, we select the checkpoint with the lowest test loss within the first 10 communication rounds after the bank reachesMactM\_\{\\mathrm\{act\}\}\. The best case is highlighted in bold\.Mact/KM\_\{\\mathrm\{act\}\}/KGPT / WikiTextBERT / ShakespeareLLaMA / StackOverflow0%7\.03±\\pm0\.087\.51±\\pm0\.079\.95±\\pm0\.0225%6\.96±\\pm0\.026\.94±\\pm0\.189\.67±\\pm0\.0350%6\.96±\\pm0\.046\.43±\\pm0\.048\.71±\\pm0\.1275%6\.88±\\pm0\.076\.40±\\pm0\.077\.42±\\pm0\.08TABLE LI:Bank\-size threshold ablation under IID partition with40%40\\%malicious clients\. Metric: Test Loss\. For each seed and threshold, we select the checkpoint with the lowest test loss within the first 10 communication rounds after the bank reachesMactM\_\{\\mathrm\{act\}\}\. The best case is highlighted in bold\.Mact/KM\_\{\\mathrm\{act\}\}/KGPT / WikiTextBERT / ShakespeareLLaMA / StackOverflow0%7\.51±\\pm0\.007\.33±\\pm0\.077\.79±\\pm0\.0725%7\.49±\\pm0\.017\.24±\\pm0\.047\.42±\\pm0\.0550%7\.45±\\pm0\.007\.07±\\pm0\.056\.87±\\pm0\.0275%7\.39±\\pm0\.016\.95±\\pm0\.026\.41±\\pm0\.04TABLE LII:Bank\-size threshold ablation under IID partition with40%40\\%malicious clients\. Metric: Test PPL\. For each seed and threshold, we select the checkpoint with the lowest test loss within the first 10 communication rounds after the bank reachesMactM\_\{\\mathrm\{act\}\}\. The best case is highlighted in bold\.Mact/KM\_\{\\mathrm\{act\}\}/KGPT / WikiTextBERT / ShakespeareLLaMA / StackOverflow0%1820\.21±\\pm4\.441532\.76±\\pm114\.782408\.15±\\pm162\.2525%1782\.72±\\pm10\.821388\.21±\\pm62\.551674\.97±\\pm86\.9150%1718\.82±\\pm4\.651171\.92±\\pm53\.02964\.01±\\pm22\.5175%1626\.87±\\pm9\.501043\.96±\\pm22\.20609\.87±\\pm24\.44TABLE LIII:Bank\-size threshold ablation under IID partition with40%40\\%malicious clients\. Metric: Semantic Entropy\. For each seed and threshold, we select the checkpoint with the lowest test loss within the first 10 communication rounds after the bank reachesMactM\_\{\\mathrm\{act\}\}\. The best case is highlighted in bold\.Mact/KM\_\{\\mathrm\{act\}\}/KGPT / WikiTextBERT / ShakespeareLLaMA / StackOverflow0%7\.11±\\pm0\.067\.92±\\pm0\.489\.99±\\pm0\.0425%7\.02±\\pm0\.047\.13±\\pm0\.229\.73±\\pm0\.0650%6\.97±\\pm0\.076\.53±\\pm0\.068\.88±\\pm0\.0975%6\.93±\\pm0\.036\.32±\\pm0\.107\.46±\\pm0\.14
### E\-DResults Under Non\-IID Partitions

Tables[LIV](https://arxiv.org/html/2608.18736#A5.T54)–[LXVIII](https://arxiv.org/html/2608.18736#A5.T68)report the non\-IID results\. Larger thresholds again generally improve the early active\-window values, while also postponing the first global aggregation rounds\.

At the strongest40%40\\%malicious\-client setting, the75%75\\%activation coverage gives the lowest test loss and perplexity for all three model families under Non\-IID partitioning: perplexity falls from1920\.35±56\.711920\.35\\pm 56\.71to1698\.50±44\.561698\.50\\pm 44\.56for GPT/WikiText and from1514\.80±139\.131514\.80\\pm 139\.13to1078\.90±33\.231078\.90\\pm 33\.23for BERT/Tiny Shakespeare, while for LLaMA/StackOverflow the0%0\\%threshold is highly unstable \(5266\.58±4615\.455266\.58\\pm 4615\.45\) and the75%75\\%threshold reduces this to759\.15±249\.94759\.15\\pm 249\.94, which shows that delaying screening until the bank has broader coverage can substantially stabilize early active training under severe attack and non\-IID heterogeneity\.

For token\-level semantic entropy, the75%75\\%threshold is again best for BERT and LLaMA at the strongest attack setting, while for GPT/non\-IID the50%50\\%threshold gives the lowest value with75%75\\%close behind, indicating that the best threshold can vary slightly by metric, though the overall pattern still favors larger bank coverage for stable early training\.

TABLE LIV:Bank\-size threshold ablation under Non\-IID partition with0%0\\%malicious clients\. Metric: Test Loss\. For each seed and threshold, we select the checkpoint with the lowest test loss within the first 10 communication rounds after the bank reachesMactM\_\{\\mathrm\{act\}\}\. The best case is highlighted in bold\.Mact/KM\_\{\\mathrm\{act\}\}/KGPT / WikiTextBERT / ShakespeareLLaMA / StackOverflow0%7\.58±\\pm0\.017\.35±\\pm0\.037\.73±\\pm0\.0525%7\.55±\\pm0\.027\.25±\\pm0\.017\.37±\\pm0\.0550%7\.51±\\pm0\.037\.11±\\pm0\.066\.88±\\pm0\.0975%7\.44±\\pm0\.026\.96±\\pm0\.046\.43±\\pm0\.04TABLE LV:Bank\-size threshold ablation under Non\-IID partition with0%0\\%malicious clients\. Metric: Test PPL\. For each seed and threshold, we select the checkpoint with the lowest test loss within the first 10 communication rounds after the bank reachesMactM\_\{\\mathrm\{act\}\}\. The best case is highlighted in bold\.Mact/KM\_\{\\mathrm\{act\}\}/KGPT / WikiTextBERT / ShakespeareLLaMA / StackOverflow0%1959\.50±\\pm22\.901550\.67±\\pm47\.692273\.70±\\pm102\.8625%1896\.90±\\pm42\.061403\.02±\\pm11\.731596\.15±\\pm71\.8450%1823\.97±\\pm46\.011221\.73±\\pm76\.35976\.65±\\pm92\.3375%1710\.88±\\pm32\.521050\.53±\\pm37\.04622\.54±\\pm22\.03TABLE LVI:Bank\-size threshold ablation under Non\-IID partition with0%0\\%malicious clients\. Metric: Semantic Entropy\. For each seed and threshold, we select the checkpoint with the lowest test loss within the first 10 communication rounds after the bank reachesMactM\_\{\\mathrm\{act\}\}\. The best case is highlighted in bold\.Mact/KM\_\{\\mathrm\{act\}\}/KGPT / WikiTextBERT / ShakespeareLLaMA / StackOverflow0%6\.86±\\pm0\.107\.82±\\pm0\.389\.95±\\pm0\.0225%6\.82±\\pm0\.036\.95±\\pm0\.189\.68±\\pm0\.0450%6\.72±\\pm0\.036\.60±\\pm0\.158\.88±\\pm0\.2075%6\.71±\\pm0\.036\.33±\\pm0\.077\.48±\\pm0\.06TABLE LVII:Bank\-size threshold ablation under Non\-IID partition with10%10\\%malicious clients\. Metric: Test Loss\. For each seed and threshold, we select the checkpoint with the lowest test loss within the first 10 communication rounds after the bank reachesMactM\_\{\\mathrm\{act\}\}\. The best case is highlighted in bold\.Mact/KM\_\{\\mathrm\{act\}\}/KGPT / WikiTextBERT / ShakespeareLLaMA / StackOverflow0%7\.55±\\pm0\.027\.33±\\pm0\.017\.73±\\pm0\.0525%7\.52±\\pm0\.027\.25±\\pm0\.017\.37±\\pm0\.0550%7\.48±\\pm0\.037\.10±\\pm0\.076\.84±\\pm0\.0475%7\.42±\\pm0\.026\.95±\\pm0\.056\.44±\\pm0\.03TABLE LVIII:Bank\-size threshold ablation under Non\-IID partition with10%10\\%malicious clients\. Metric: Test PPL\. For each seed and threshold, we select the checkpoint with the lowest test loss within the first 10 communication rounds after the bank reachesMactM\_\{\\mathrm\{act\}\}\. The best case is highlighted in bold\.Mact/KM\_\{\\mathrm\{act\}\}/KGPT / WikiTextBERT / ShakespeareLLaMA / StackOverflow0%1899\.89±\\pm44\.691531\.88±\\pm13\.602265\.83±\\pm100\.9425%1853\.08±\\pm43\.581402\.99±\\pm7\.861592\.05±\\pm71\.1550%1768\.44±\\pm51\.111213\.39±\\pm83\.14937\.25±\\pm35\.5675%1672\.14±\\pm37\.851047\.93±\\pm54\.20628\.96±\\pm18\.82TABLE LIX:Bank\-size threshold ablation under Non\-IID partition with10%10\\%malicious clients\. Metric: Semantic Entropy\. For each seed and threshold, we select the checkpoint with the lowest test loss within the first 10 communication rounds after the bank reachesMactM\_\{\\mathrm\{act\}\}\. The best case is highlighted in bold\.Mact/KM\_\{\\mathrm\{act\}\}/KGPT / WikiTextBERT / ShakespeareLLaMA / StackOverflow0%6\.76±\\pm0\.017\.63±\\pm0\.059\.96±\\pm0\.0225%6\.71±\\pm0\.016\.97±\\pm0\.159\.68±\\pm0\.0450%6\.68±\\pm0\.056\.61±\\pm0\.198\.80±\\pm0\.0875%6\.71±\\pm0\.026\.42±\\pm0\.027\.53±\\pm0\.05TABLE LX:Bank\-size threshold ablation under Non\-IID partition with20%20\\%malicious clients\. Metric: Test Loss\. For each seed and threshold, we select the checkpoint with the lowest test loss within the first 10 communication rounds after the bank reachesMactM\_\{\\mathrm\{act\}\}\. The best case is highlighted in bold\.Mact/KM\_\{\\mathrm\{act\}\}/KGPT / WikiTextBERT / ShakespeareLLaMA / StackOverflow0%7\.55±\\pm0\.027\.27±\\pm0\.127\.73±\\pm0\.0525%7\.52±\\pm0\.027\.14±\\pm0\.177\.38±\\pm0\.0550%7\.47±\\pm0\.047\.08±\\pm0\.166\.85±\\pm0\.0475%7\.42±\\pm0\.036\.95±\\pm0\.116\.43±\\pm0\.02TABLE LXI:Bank\-size threshold ablation under Non\-IID partition with20%20\\%malicious clients\. Metric: Test PPL\. For each seed and threshold, we select the checkpoint with the lowest test loss within the first 10 communication rounds after the bank reachesMactM\_\{\\mathrm\{act\}\}\. The best case is highlighted in bold\.Mact/KM\_\{\\mathrm\{act\}\}/KGPT / WikiTextBERT / ShakespeareLLaMA / StackOverflow0%1892\.83±\\pm45\.801439\.58±\\pm163\.652284\.63±\\pm122\.3225%1843\.09±\\pm43\.591270\.95±\\pm202\.011603\.79±\\pm84\.1050%1759\.53±\\pm65\.051199\.79±\\pm182\.48941\.83±\\pm41\.0375%1673\.23±\\pm42\.101048\.68±\\pm111\.65622\.50±\\pm15\.12TABLE LXII:Bank\-size threshold ablation under Non\-IID partition with20%20\\%malicious clients\. Metric: Semantic Entropy\. For each seed and threshold, we select the checkpoint with the lowest test loss within the first 10 communication rounds after the bank reachesMactM\_\{\\mathrm\{act\}\}\. The best case is highlighted in bold\.Mact/KM\_\{\\mathrm\{act\}\}/KGPT / WikiTextBERT / ShakespeareLLaMA / StackOverflow0%6\.78±\\pm0\.087\.47±\\pm0\.319\.96±\\pm0\.0325%6\.84±\\pm0\.106\.84±\\pm0\.459\.69±\\pm0\.0550%6\.75±\\pm0\.066\.59±\\pm0\.168\.81±\\pm0\.0875%6\.74±\\pm0\.026\.48±\\pm0\.107\.50±\\pm0\.06TABLE LXIII:Bank\-size threshold ablation under Non\-IID partition with30%30\\%malicious clients\. Metric: Test Loss\. For each seed and threshold, we select the checkpoint with the lowest test loss within the first 10 communication rounds after the bank reachesMactM\_\{\\mathrm\{act\}\}\. The best case is highlighted in bold\.Mact/KM\_\{\\mathrm\{act\}\}/KGPT / WikiTextBERT / ShakespeareLLaMA / StackOverflow0%7\.56±\\pm0\.027\.30±\\pm0\.067\.73±\\pm0\.0525%7\.52±\\pm0\.047\.20±\\pm0\.097\.38±\\pm0\.0550%7\.47±\\pm0\.037\.09±\\pm0\.076\.81±\\pm0\.0675%7\.43±\\pm0\.026\.97±\\pm0\.036\.41±\\pm0\.03TABLE LXIV:Bank\-size threshold ablation under Non\-IID partition with30%30\\%malicious clients\. Metric: Test PPL\. For each seed and threshold, we select the checkpoint with the lowest test loss within the first 10 communication rounds after the bank reachesMactM\_\{\\mathrm\{act\}\}\. The best case is highlighted in bold\.Mact/KM\_\{\\mathrm\{act\}\}/KGPT / WikiTextBERT / ShakespeareLLaMA / StackOverflow0%1914\.41±\\pm35\.811484\.60±\\pm89\.712279\.76±\\pm116\.9425%1849\.76±\\pm65\.541339\.75±\\pm121\.301600\.19±\\pm79\.7950%1760\.25±\\pm53\.041206\.50±\\pm80\.07911\.93±\\pm52\.6475%1677\.76±\\pm37\.721063\.79±\\pm26\.84605\.22±\\pm18\.26TABLE LXV:Bank\-size threshold ablation under Non\-IID partition with30%30\\%malicious clients\. Metric: Semantic Entropy\. For each seed and threshold, we select the checkpoint with the lowest test loss within the first 10 communication rounds after the bank reachesMactM\_\{\\mathrm\{act\}\}\. The best case is highlighted in bold\.Mact/KM\_\{\\mathrm\{act\}\}/KGPT / WikiTextBERT / ShakespeareLLaMA / StackOverflow0%6\.74±\\pm0\.077\.62±\\pm0\.119\.96±\\pm0\.0325%6\.79±\\pm0\.016\.92±\\pm0\.149\.68±\\pm0\.0550%6\.75±\\pm0\.056\.53±\\pm0\.108\.72±\\pm0\.1575%6\.78±\\pm0\.056\.40±\\pm0\.047\.43±\\pm0\.08TABLE LXVI:Bank\-size threshold ablation under Non\-IID partition with40%40\\%malicious clients\. Metric: Test Loss\. For each seed and threshold, we select the checkpoint with the lowest test loss within the first 10 communication rounds after the bank reachesMactM\_\{\\mathrm\{act\}\}\. The best case is highlighted in bold\.Mact/KM\_\{\\mathrm\{act\}\}/KGPT / WikiTextBERT / ShakespeareLLaMA / StackOverflow0%7\.56±\\pm0\.037\.32±\\pm0\.098\.33±\\pm0\.8225%7\.53±\\pm0\.037\.21±\\pm0\.117\.96±\\pm0\.8250%7\.49±\\pm0\.047\.13±\\pm0\.087\.28±\\pm0\.6175%7\.44±\\pm0\.036\.98±\\pm0\.036\.60±\\pm0\.31TABLE LXVII:Bank\-size threshold ablation under Non\-IID partition with40%40\\%malicious clients\. Metric: Test PPL\. For each seed and threshold, we select the checkpoint with the lowest test loss within the first 10 communication rounds after the bank reachesMactM\_\{\\mathrm\{act\}\}\. The best case is highlighted in bold\.Mact/KM\_\{\\mathrm\{act\}\}/KGPT / WikiTextBERT / ShakespeareLLaMA / StackOverflow0%1920\.35±\\pm56\.711514\.80±\\pm139\.135266\.58±\\pm4615\.4525%1860\.94±\\pm60\.731355\.84±\\pm138\.763651\.86±\\pm3205\.9050%1783\.26±\\pm65\.141248\.37±\\pm101\.921649\.52±\\pm1092\.4175%1698\.50±\\pm44\.561078\.90±\\pm33\.23759\.15±\\pm249\.94TABLE LXVIII:Bank\-size threshold ablation under Non\-IID partition with40%40\\%malicious clients\. Metric: Semantic Entropy\. For each seed and threshold, we select the checkpoint with the lowest test loss within the first 10 communication rounds after the bank reachesMactM\_\{\\mathrm\{act\}\}\. The best case is highlighted in bold\.Mact/KM\_\{\\mathrm\{act\}\}/KGPT / WikiTextBERT / ShakespeareLLaMA / StackOverflow0%6\.80±\\pm0\.127\.85±\\pm0\.3410\.12±\\pm0\.1725%6\.81±\\pm0\.106\.90±\\pm0\.199\.96±\\pm0\.3150%6\.73±\\pm0\.046\.62±\\pm0\.159\.36±\\pm0\.6675%6\.76±\\pm0\.066\.29±\\pm0\.188\.00±\\pm0\.97
### E\-EInterpretation

The study characterizesMactM\_\{\\mathrm\{act\}\}as the bank coverage at which screening and global aggregation begin, rather than as a desired final bank size\. The bank continues to grow after activation\. Across the evaluated settings, the dominant trend favors broader activation coverage: perplexity improves consistently as coverage increases, and token\-level semantic entropy generally follows the same pattern\. This supports maximizing the bank coverage available at activation whenever the resulting delay is acceptable\.

We use50%50\\%population coverage as the default practical activation point, not because it is statistically preferable to broader coverage, but because it begins aggregation earlier than the largest evaluated threshold of75%75\\%\. In deployments with intermittent or nonuniform participation, waiting for all client identities may be impractically slow\. A smaller activation bank can therefore provide an operational starting point, while the probability analysis in Appendix[A](https://arxiv.org/html/2608.18736#A1)quantifies its benign\-majority reliability under uniform random participation\. The ablation does not evaluate100%100\\%activation coverage and therefore does not establish full coverage as an empirical optimum\.

## Appendix FGMM\-Selection Ablation

This appendix reports the ablation study for the GMM selection rule inFedLNS\. The defaultFedLNSrule fits both a one\-component and a two\-component diagonal Gaussian mixture model to the current bank\-standardized normalization\-signature features, computes the Bayesian Information Criterion \(BIC\) for each model, and selects the lower\-BIC model\. This adaptive rule is compared with a forced two\-component variant\.

##### BIC\-selected 1\-vs\-2 GMM\.

This is the defaultFedLNSrule\. It selects

c^t=arg⁡minc∈\{1,2\}⁡BIC⁡\(c\)\.\\widehat\{c\}\_\{t\}=\\arg\\min\_\{c\\in\\\{1,2\\\}\}\\mathrm\{BIC\}\(c\)\.\(192\)Whenc^t=1\\widehat\{c\}\_\{t\}=1, all clients are retained\. Whenc^t=2\\widehat\{c\}\_\{t\}=2,FedLNSretains the component with the smaller median standardized deviation from the bank reference\.

##### Forced 2\-GMM\.

This variant always fits a two\-component GMM after bank activation and retains the component with the smaller median absolute standardized deviation from the bank reference\. It is more aggressive than the default method because it always tries to split the current round into two groups, even when the current client signatures may be better explained by a single population\.

All GMM ablation runs use the same model, dataset, partition, attack, optimizer, seeds, and bank threshold as the corresponding main experiment\. The only changed variable is the GMM decision rule\. For each seed, we select the checkpoint with the lowest test loss and report test loss, perplexity, and token\-level semantic entropy from that same checkpoint\. Thus, token\-level semantic entropy is not independently optimized; it is measured at the checkpoint selected by test loss\. All entries are reported as mean±\\pmsample standard deviation over seeds\{100,200,300\}\\\{100,200,300\\\}\.

### F\-AResults Under IID Partitions

Tables[LXIX](https://arxiv.org/html/2608.18736#A6.T69)–[LXXXIII](https://arxiv.org/html/2608.18736#A6.T83)report the IID GMM\-selection ablation results across all malicious\-client fractions\. The BIC\-selected and forced two\-component rules produce nearly identical selected evaluation\-checkpoint values across the three model families\. At the strongest40%40\\%malicious\-client setting, both rules obtain the same values up to the reported precision for BERT/Tiny Shakespeare and LLaMA/StackOverflow\. For GPT/WikiText, the two rules are also essentially identical: the BIC\-selected rule gives test loss7\.16±0\.007\.16\\pm 0\.00, perplexity1281\.63±1\.741281\.63\\pm 1\.74, and token\-level semantic entropy6\.80±0\.066\.80\\pm 0\.06, while forced 2\-GMM gives test loss7\.16±0\.007\.16\\pm 0\.00, perplexity1281\.62±1\.731281\.62\\pm 1\.73, and token\-level semantic entropy6\.80±0\.066\.80\\pm 0\.06\.

In the IID results, the default BIC\-selected rule and the forced two\-component rule have nearly identical endpoint values\. The ablation does not establish that the current\-round feature distribution is statistically identifiable as two components in every attacked setting\.

TABLE LXIX:GMM\-selection ablation under IID partition with0%0\\%malicious clients\. Metric: Test Loss\. Values are mean±\\pmstandard deviation over three seeds\. For each seed, all metrics are taken from the checkpoint with the lowest test loss\. The best case is highlighted in bold\.GMM ruleGPT / WikiTextBERT / ShakespeareLLaMA / StackOverflowBIC 1/2\-GMM7\.13±\\pm0\.006\.50±\\pm0\.055\.36±\\pm0\.03Forced 2\-GMM7\.13±\\pm0\.006\.50±\\pm0\.055\.36±\\pm0\.03TABLE LXX:GMM\-selection ablation under IID partition with0%0\\%malicious clients\. Metric: Test PPL\. Values are mean±\\pmstandard deviation over three seeds\. For each seed, all metrics are taken from the checkpoint with the lowest test loss\. The best case is highlighted in bold\.GMM ruleGPT / WikiTextBERT / ShakespeareLLaMA / StackOverflowBIC 1/2\-GMM1246\.57±\\pm2\.52663\.68±\\pm29\.76213\.42±\\pm6\.57Forced 2\-GMM1246\.57±\\pm2\.52663\.68±\\pm29\.76213\.42±\\pm6\.57TABLE LXXI:GMM\-selection ablation under IID partition with0%0\\%malicious clients\. Metric: Semantic Entropy\. Values are mean±\\pmstandard deviation over three seeds\. For each seed, all metrics are taken from the checkpoint with the lowest test loss\. The best case is highlighted in bold\.GMM ruleGPT / WikiTextBERT / ShakespeareLLaMA / StackOverflowBIC 1/2\-GMM6\.73±\\pm0\.036\.28±\\pm0\.095\.52±\\pm0\.02Forced 2\-GMM6\.73±\\pm0\.036\.28±\\pm0\.095\.52±\\pm0\.02TABLE LXXII:GMM\-selection ablation under IID partition with10%10\\%malicious clients\. Metric: Test Loss\. Values are mean±\\pmstandard deviation over three seeds\. For each seed, all metrics are taken from the checkpoint with the lowest test loss\. The best case is highlighted in bold\.GMM ruleGPT / WikiTextBERT / ShakespeareLLaMA / StackOverflowBIC 1/2\-GMM7\.13±\\pm0\.006\.49±\\pm0\.025\.37±\\pm0\.03Forced 2\-GMM7\.13±\\pm0\.006\.49±\\pm0\.025\.37±\\pm0\.03TABLE LXXIII:GMM\-selection ablation under IID partition with10%10\\%malicious clients\. Metric: Test PPL\. Values are mean±\\pmstandard deviation over three seeds\. For each seed, all metrics are taken from the checkpoint with the lowest test loss\. The best case is highlighted in bold\.GMM ruleGPT / WikiTextBERT / ShakespeareLLaMA / StackOverflowBIC 1/2\-GMM1247\.28±\\pm5\.97655\.97±\\pm11\.66213\.93±\\pm6\.56Forced 2\-GMM1247\.28±\\pm5\.97655\.97±\\pm11\.66213\.93±\\pm6\.56TABLE LXXIV:GMM\-selection ablation under IID partition with10%10\\%malicious clients\. Metric: Semantic Entropy\. Values are mean±\\pmstandard deviation over three seeds\. For each seed, all metrics are taken from the checkpoint with the lowest test loss\. The best case is highlighted in bold\.GMM ruleGPT / WikiTextBERT / ShakespeareLLaMA / StackOverflowBIC 1/2\-GMM6\.81±\\pm0\.016\.38±\\pm0\.165\.52±\\pm0\.04Forced 2\-GMM6\.81±\\pm0\.016\.38±\\pm0\.165\.52±\\pm0\.04TABLE LXXV:GMM\-selection ablation under IID partition with20%20\\%malicious clients\. Metric: Test Loss\. Values are mean±\\pmstandard deviation over three seeds\. For each seed, all metrics are taken from the checkpoint with the lowest test loss\. The best case is highlighted in bold\.GMM ruleGPT / WikiTextBERT / ShakespeareLLaMA / StackOverflowBIC 1/2\-GMM7\.13±\\pm0\.006\.49±\\pm0\.025\.37±\\pm0\.03Forced 2\-GMM7\.13±\\pm0\.006\.49±\\pm0\.025\.37±\\pm0\.03TABLE LXXVI:GMM\-selection ablation under IID partition with20%20\\%malicious clients\. Metric: Test PPL\. Values are mean±\\pmstandard deviation over three seeds\. For each seed, all metrics are taken from the checkpoint with the lowest test loss\. The best case is highlighted in bold\.GMM ruleGPT / WikiTextBERT / ShakespeareLLaMA / StackOverflowBIC 1/2\-GMM1249\.11±\\pm1\.78661\.38±\\pm11\.94214\.57±\\pm6\.75Forced 2\-GMM1249\.11±\\pm1\.78661\.38±\\pm11\.94214\.57±\\pm6\.75TABLE LXXVII:GMM\-selection ablation under IID partition with20%20\\%malicious clients\. Metric: Semantic Entropy\. Values are mean±\\pmstandard deviation over three seeds\. For each seed, all metrics are taken from the checkpoint with the lowest test loss\. The best case is highlighted in bold\.GMM ruleGPT / WikiTextBERT / ShakespeareLLaMA / StackOverflowBIC 1/2\-GMM6\.75±\\pm0\.026\.19±\\pm0\.095\.54±\\pm0\.03Forced 2\-GMM6\.75±\\pm0\.026\.19±\\pm0\.095\.54±\\pm0\.03TABLE LXXVIII:GMM\-selection ablation under IID partition with30%30\\%malicious clients\. Metric: Test Loss\. Values are mean±\\pmstandard deviation over three seeds\. For each seed, all metrics are taken from the checkpoint with the lowest test loss\. The best case is highlighted in bold\.GMM ruleGPT / WikiTextBERT / ShakespeareLLaMA / StackOverflowBIC 1/2\-GMM7\.14±\\pm0\.006\.51±\\pm0\.015\.37±\\pm0\.03Forced 2\-GMM7\.14±\\pm0\.006\.51±\\pm0\.015\.37±\\pm0\.03TABLE LXXIX:GMM\-selection ablation under IID partition with30%30\\%malicious clients\. Metric: Test PPL\. Values are mean±\\pmstandard deviation over three seeds\. For each seed, all metrics are taken from the checkpoint with the lowest test loss\. The best case is highlighted in bold\.GMM ruleGPT / WikiTextBERT / ShakespeareLLaMA / StackOverflowBIC 1/2\-GMM1258\.21±\\pm4\.70669\.37±\\pm5\.86215\.61±\\pm6\.70Forced 2\-GMM1258\.21±\\pm4\.70669\.37±\\pm5\.86215\.61±\\pm6\.70TABLE LXXX:GMM\-selection ablation under IID partition with30%30\\%malicious clients\. Metric: Semantic Entropy\. Values are mean±\\pmstandard deviation over three seeds\. For each seed, all metrics are taken from the checkpoint with the lowest test loss\. The best case is highlighted in bold\.GMM ruleGPT / WikiTextBERT / ShakespeareLLaMA / StackOverflowBIC 1/2\-GMM6\.74±\\pm0\.046\.24±\\pm0\.105\.52±\\pm0\.04Forced 2\-GMM6\.74±\\pm0\.046\.24±\\pm0\.105\.52±\\pm0\.04TABLE LXXXI:GMM\-selection ablation under IID partition with40%40\\%malicious clients\. Metric: Test Loss\. Values are mean±\\pmstandard deviation over three seeds\. For each seed, all metrics are taken from the checkpoint with the lowest test loss\. The best case is highlighted in bold\.GMM ruleGPT / WikiTextBERT / ShakespeareLLaMA / StackOverflowBIC 1/2\-GMM7\.16±\\pm0\.006\.55±\\pm0\.025\.38±\\pm0\.03Forced 2\-GMM7\.16±\\pm0\.006\.55±\\pm0\.025\.38±\\pm0\.03TABLE LXXXII:GMM\-selection ablation under IID partition with40%40\\%malicious clients\. Metric: Test PPL\. Values are mean±\\pmstandard deviation over three seeds\. For each seed, all metrics are taken from the checkpoint with the lowest test loss\. The best case is highlighted in bold\.GMM ruleGPT / WikiTextBERT / ShakespeareLLaMA / StackOverflowBIC 1/2\-GMM1281\.63±\\pm1\.74697\.62±\\pm13\.62217\.14±\\pm6\.85Forced 2\-GMM1281\.62±\\pm1\.73697\.62±\\pm13\.62217\.14±\\pm6\.85TABLE LXXXIII:GMM\-selection ablation under IID partition with40%40\\%malicious clients\. Metric: Semantic Entropy\. Values are mean±\\pmstandard deviation over three seeds\. For each seed, all metrics are taken from the checkpoint with the lowest test loss\. The best case is highlighted in bold\.GMM ruleGPT / WikiTextBERT / ShakespeareLLaMA / StackOverflowBIC 1/2\-GMM6\.80±\\pm0\.066\.24±\\pm0\.065\.52±\\pm0\.02Forced 2\-GMM6\.80±\\pm0\.066\.24±\\pm0\.065\.52±\\pm0\.02
### F\-BResults Under Non\-IID Partitions

Tables[LXXXIV](https://arxiv.org/html/2608.18736#A6.T84)–[XCVIII](https://arxiv.org/html/2608.18736#A6.T98)report the corresponding non\-IID results\. The non\-IID results follow the same pattern: BIC\-selected one\-vs\-two GMM and forced two\-component GMM have nearly indistinguishable endpoint values in most settings\. At the strongest40%40\\%malicious\-client setting, the two methods produce identical reported values for all three model families\. For GPT/WikiText, both rules obtain test loss7\.16±0\.017\.16\\pm 0\.01, perplexity1286\.50±15\.341286\.50\\pm 15\.34, and token\-level semantic entropy6\.92±0\.246\.92\\pm 0\.24\. For BERT/Tiny Shakespeare, both obtain test loss6\.48±0\.136\.48\\pm 0\.13, perplexity658\.21±91\.66658\.21\\pm 91\.66, and token\-level semantic entropy6\.19±0\.136\.19\\pm 0\.13\. For LLaMA/StackOverflow, both obtain test loss5\.39±0\.035\.39\\pm 0\.03, perplexity220\.18±6\.45220\.18\\pm 6\.45, and token\-level semantic entropy5\.52±0\.035\.52\\pm 0\.03\.

The main visible difference appears only in a small number of intermediate settings\. For example, under GPT/WikiText with non\-IID partitioning and30%30\\%malicious clients, BIC\-selected GMM gives perplexity1277\.28±23\.521277\.28\\pm 23\.52, while forced 2\-GMM gives1277\.81±22\.931277\.81\\pm 22\.93\. For token\-level semantic entropy in the same setting, forced 2\-GMM gives6\.87±0\.066\.87\\pm 0\.06, while BIC\-selected GMM gives6\.90±0\.026\.90\\pm 0\.02\. These differences are small and do not indicate a systematic advantage of forced splitting\.

TABLE LXXXIV:GMM\-selection ablation under Non\-IID partition with0%0\\%malicious clients\. Metric: Test Loss\. Values are mean±\\pmstandard deviation over three seeds\. For each seed, all metrics are taken from the checkpoint with the lowest test loss\. The best case is highlighted in bold\.GMM ruleGPT / WikiTextBERT / ShakespeareLLaMA / StackOverflowBIC 1/2\-GMM7\.11±\\pm0\.016\.47±\\pm0\.055\.37±\\pm0\.03Forced 2\-GMM7\.11±\\pm0\.016\.47±\\pm0\.055\.37±\\pm0\.03TABLE LXXXV:GMM\-selection ablation under Non\-IID partition with0%0\\%malicious clients\. Metric: Test PPL\. Values are mean±\\pmstandard deviation over three seeds\. For each seed, all metrics are taken from the checkpoint with the lowest test loss\. The best case is highlighted in bold\.GMM ruleGPT / WikiTextBERT / ShakespeareLLaMA / StackOverflowBIC 1/2\-GMM1225\.90±\\pm12\.06643\.56±\\pm33\.46215\.55±\\pm6\.85Forced 2\-GMM1225\.89±\\pm12\.06643\.56±\\pm33\.46215\.55±\\pm6\.85TABLE LXXXVI:GMM\-selection ablation under Non\-IID partition with0%0\\%malicious clients\. Metric: Semantic Entropy\. Values are mean±\\pmstandard deviation over three seeds\. For each seed, all metrics are taken from the checkpoint with the lowest test loss\. The best case is highlighted in bold\.GMM ruleGPT / WikiTextBERT / ShakespeareLLaMA / StackOverflowBIC 1/2\-GMM6\.80±\\pm0\.096\.12±\\pm0\.055\.54±\\pm0\.03Forced 2\-GMM6\.80±\\pm0\.096\.12±\\pm0\.055\.54±\\pm0\.03TABLE LXXXVII:GMM\-selection ablation under Non\-IID partition with10%10\\%malicious clients\. Metric: Test Loss\. Values are mean±\\pmstandard deviation over three seeds\. For each seed, all metrics are taken from the checkpoint with the lowest test loss\. The best case is highlighted in bold\.GMM ruleGPT / WikiTextBERT / ShakespeareLLaMA / StackOverflowBIC 1/2\-GMM7\.12±\\pm0\.006\.36±\\pm0\.065\.38±\\pm0\.03Forced 2\-GMM7\.12±\\pm0\.006\.36±\\pm0\.065\.38±\\pm0\.03TABLE LXXXVIII:GMM\-selection ablation under Non\-IID partition with10%10\\%malicious clients\. Metric: Test PPL\. Values are mean±\\pmstandard deviation over three seeds\. For each seed, all metrics are taken from the checkpoint with the lowest test loss\. The best case is highlighted in bold\.GMM ruleGPT / WikiTextBERT / ShakespeareLLaMA / StackOverflowBIC 1/2\-GMM1238\.52±\\pm4\.97576\.63±\\pm36\.58216\.13±\\pm6\.70Forced 2\-GMM1238\.52±\\pm4\.97576\.63±\\pm36\.58216\.13±\\pm6\.70TABLE LXXXIX:GMM\-selection ablation under Non\-IID partition with10%10\\%malicious clients\. Metric: Semantic Entropy\. Values are mean±\\pmstandard deviation over three seeds\. For each seed, all metrics are taken from the checkpoint with the lowest test loss\. The best case is highlighted in bold\.GMM ruleGPT / WikiTextBERT / ShakespeareLLaMA / StackOverflowBIC 1/2\-GMM6\.79±\\pm0\.056\.06±\\pm0\.185\.54±\\pm0\.03Forced 2\-GMM6\.79±\\pm0\.056\.06±\\pm0\.185\.54±\\pm0\.03TABLE XC:GMM\-selection ablation under Non\-IID partition with20%20\\%malicious clients\. Metric: Test Loss\. Values are mean±\\pmstandard deviation over three seeds\. For each seed, all metrics are taken from the checkpoint with the lowest test loss\. The best case is highlighted in bold\.GMM ruleGPT / WikiTextBERT / ShakespeareLLaMA / StackOverflowBIC 1/2\-GMM7\.13±\\pm0\.016\.42±\\pm0\.145\.38±\\pm0\.03Forced 2\-GMM7\.13±\\pm0\.016\.42±\\pm0\.145\.38±\\pm0\.03TABLE XCI:GMM\-selection ablation under Non\-IID partition with20%20\\%malicious clients\. Metric: Test PPL\. Values are mean±\\pmstandard deviation over three seeds\. For each seed, all metrics are taken from the checkpoint with the lowest test loss\. The best case is highlighted in bold\.GMM ruleGPT / WikiTextBERT / ShakespeareLLaMA / StackOverflowBIC 1/2\-GMM1251\.65±\\pm11\.37618\.30±\\pm91\.12216\.97±\\pm6\.91Forced 2\-GMM1251\.65±\\pm11\.37618\.30±\\pm91\.12216\.97±\\pm6\.91TABLE XCII:GMM\-selection ablation under Non\-IID partition with20%20\\%malicious clients\. Metric: Semantic Entropy\. Values are mean±\\pmstandard deviation over three seeds\. For each seed, all metrics are taken from the checkpoint with the lowest test loss\. The best case is highlighted in bold\.GMM ruleGPT / WikiTextBERT / ShakespeareLLaMA / StackOverflowBIC 1/2\-GMM7\.04±\\pm0\.406\.33±\\pm0\.095\.53±\\pm0\.03Forced 2\-GMM7\.04±\\pm0\.406\.33±\\pm0\.095\.53±\\pm0\.03TABLE XCIII:GMM\-selection ablation under Non\-IID partition with30%30\\%malicious clients\. Metric: Test Loss\. Values are mean±\\pmstandard deviation over three seeds\. For each seed, all metrics are taken from the checkpoint with the lowest test loss\. The best case is highlighted in bold\.GMM ruleGPT / WikiTextBERT / ShakespeareLLaMA / StackOverflowBIC 1/2\-GMM7\.15±\\pm0\.026\.38±\\pm0\.185\.38±\\pm0\.03Forced 2\-GMM7\.15±\\pm0\.026\.38±\\pm0\.185\.38±\\pm0\.03TABLE XCIV:GMM\-selection ablation under Non\-IID partition with30%30\\%malicious clients\. Metric: Test PPL\. Values are mean±\\pmstandard deviation over three seeds\. For each seed, all metrics are taken from the checkpoint with the lowest test loss\. The best case is highlighted in bold\.GMM ruleGPT / WikiTextBERT / ShakespeareLLaMA / StackOverflowBIC 1/2\-GMM1277\.28±\\pm23\.52594\.61±\\pm108\.75218\.02±\\pm7\.07Forced 2\-GMM1277\.81±\\pm22\.93594\.63±\\pm108\.74218\.02±\\pm7\.07TABLE XCV:GMM\-selection ablation under Non\-IID partition with30%30\\%malicious clients\. Metric: Semantic Entropy\. Values are mean±\\pmstandard deviation over three seeds\. For each seed, all metrics are taken from the checkpoint with the lowest test loss\. The best case is highlighted in bold\.GMM ruleGPT / WikiTextBERT / ShakespeareLLaMA / StackOverflowBIC 1/2\-GMM6\.90±\\pm0\.026\.00±\\pm0\.385\.53±\\pm0\.02Forced 2\-GMM6\.87±\\pm0\.066\.00±\\pm0\.385\.53±\\pm0\.02TABLE XCVI:GMM\-selection ablation under Non\-IID partition with40%40\\%malicious clients\. Metric: Test Loss\. Values are mean±\\pmstandard deviation over three seeds\. For each seed, all metrics are taken from the checkpoint with the lowest test loss\. The best case is highlighted in bold\.GMM ruleGPT / WikiTextBERT / ShakespeareLLaMA / StackOverflowBIC 1/2\-GMM7\.16±\\pm0\.016\.48±\\pm0\.135\.39±\\pm0\.03Forced 2\-GMM7\.16±\\pm0\.016\.48±\\pm0\.135\.39±\\pm0\.03TABLE XCVII:GMM\-selection ablation under Non\-IID partition with40%40\\%malicious clients\. Metric: Test PPL\. Values are mean±\\pmstandard deviation over three seeds\. For each seed, all metrics are taken from the checkpoint with the lowest test loss\. The best case is highlighted in bold\.GMM ruleGPT / WikiTextBERT / ShakespeareLLaMA / StackOverflowBIC 1/2\-GMM1286\.50±\\pm15\.34658\.21±\\pm91\.66220\.18±\\pm6\.45Forced 2\-GMM1286\.50±\\pm15\.34658\.21±\\pm91\.66220\.18±\\pm6\.45TABLE XCVIII:GMM\-selection ablation under Non\-IID partition with40%40\\%malicious clients\. Metric: Semantic Entropy\. Values are mean±\\pmstandard deviation over three seeds\. For each seed, all metrics are taken from the checkpoint with the lowest test loss\. The best case is highlighted in bold\.GMM ruleGPT / WikiTextBERT / ShakespeareLLaMA / StackOverflowBIC 1/2\-GMM6\.92±\\pm0\.246\.19±\\pm0\.135\.52±\\pm0\.03Forced 2\-GMM6\.92±\\pm0\.246\.19±\\pm0\.135\.52±\\pm0\.03
### F\-CInterpretation

The BIC\-selected and forced two\-component rules yield nearly identical endpoint values in the evaluated runs\. The forced rule always partitions the current participants, whereas BIC preserves the option to retain all clients when the one\-component model receives the lower criterion value\. This ablation therefore characterizes endpoint sensitivity to the model\-selection rule; it does not establish statistical identifiability of the fitted mixtures\.