Robust and Personalized Federated Learning for Aircraft-Engine Prognostics under Benign and Adversarial Client Heterogeneity

# Robust and Personalized Federated Learning for Aircraft-Engine Prognostics: Heterogeneity and Failure-Masking Poisoning on a Turbofan Benchmark
Source: [https://arxiv.org/html/2608.04045](https://arxiv.org/html/2608.04045)
1\]organization=Department of Computer Science and Engineering, Rajshahi University of Engineering & Technology, addressline=Kazla, city=Rajshahi, postcode=6204, country=Bangladesh

Md\. Mehedi Hasan NipuMohammad Sakib MahmoodMd\. Rakibul IslamM\. F\. Mridha\[Department of Electrical and Computer Engineering, North South University, Dhaka 1229, Bangladesh\.Department of Computer Science, Missouri State University, Springfield, MO, 65809, USA\.Department of Computer Science and Engineering, Malardalen University, Vasteras, Vastmanland, Sweden\.Department of Computer Science & Engineering, American International University\-Bangladesh, Dhaka, Bangladesh\.

###### Abstract

Federated learning \(FL\) enables aircraft fleet operators to jointly train remaining\-useful\-life \(RUL\) models from engine sensor telemetry without sharing raw data\. Among the challenges associated with heterogeneous participants, this study focuses on two complementary forms: benign heterogeneity, where honest operators observe different operating conditions and fault modes, and adversarial heterogeneity, where a compromised operator submits poisoned updates\. We present a controlled, safety\-oriented study of how federated training and aggregation algorithms behave under both, using a multi\-task one\-dimensional convolutional neural network on a structurally non\-independent\-and\-identically\-distributed \(non\-IID\) partition of the Commercial Modular Aero\-Propulsion System Simulation \(C\-MAPSS\) benchmark, and evaluate four benign\-heterogeneity remedies together with a five\-attack by four\-aggregator matrix that includes a physically motivated, failure\-masking sensor\-value backdoor\. Shared\-representation personalization closes about 70% of the local\-to\-centralized root\-mean\-square\-error gap, versus about 21% for proximal regularization and 10% for server\-side reweighting\. Crucially, the backdoor reaches 94\.9% attack success against standard averaging while clean accuracy stays statistically unchanged: accuracy alone cannot certify a safe model, and attack success must be measured explicitly\. Robust aggregation with Krum cuts attack success by an order of magnitude and is the only evaluated aggregator to survive coordinated attackers, whereas personalization alone offers no protection\. Stacking the two yields a composed defense that restores robustness \(attack success 2\.8%\) at only a small accuracy cost, reflecting an inherent tension between robust update selection and collaborative representation learning\. Findings hold across client counts and a harder six\-condition dataset, and all code and data partitions are released for reproducibility\.

###### keywords:

Federated learning\\sepPrognostics\\sepRemaining useful life\\sepNon\-IID heterogeneity\\sepByzantine\-robust aggregation\\sepBackdoor attacks

## 1Introduction

Aircraft\-engine prognostics, predicting the Remaining Useful Life \(RUL\) of a turbofan from its sensor history, is a safety\-critical reliability problem with an asymmetric cost structure: a missed imminent failure can cost lives, whereas an unnecessary grounding merely costs money\. On the most widely used public benchmark, NASA’s Commercial Modular Aero\-Propulsion System Simulation \(C\-MAPSS\) turbofan dataset\(Saxena2008CMAPSS\), data\-driven RUL models trained on run\-to\-failure trajectories have matured to the point where the*modelling*problem is largely solved for a single operator that owns all of its data\.

Real deployment is not single\-operator\. An airline consortium or Maintenance\-Repair\-Overhaul \(MRO\) network is intrinsically federated: each operator owns only a partial fleet, treats its sensor telemetry as competitive intelligence, and cannot pool raw data with rival operators or with the airframer without contractual and regulatory friction\. Federated Learning \(FL\)\(McMahan2017FedAvg\)resolves this tension: each operator trains locally, only model weights cross the wire, and a central server aggregates them into a global model trained, in effect, on the union of every fleet\. On C\-MAPSS with statistically homogeneous clients \(drawn independently and identically from one subset\), vanilla FedAvg already matches centralized training within the noise floor\(Barbosa2025FLJetEngines;Vermelin2024CollabFLRUL;Pandhare2021FederatedBaseline\)\.

That success is fragile, because it assumes clients that are both statistically similar and uniformly honest, and neither survives contact with a real multi\-operator federation\. Two distinct departures break it, and they call for different remedies: honest operators whose fleets follow structurally different fault distributions \(*benign*heterogeneity\), and compromised operators that do not train honestly \(*adversarial*heterogeneity\)\. We treat these as two orthogonal axes and study both, on the same C\-MAPSS federation\.

The benign axis arises even when every operator is honest\. Operators fly different engine variants, follow different maintenance regimes, and expose their fleets to different mission profiles, so each local dataset is a different projection of the joint fault distribution, what we call*benign heterogeneity*: honest but structurally non\-IID clients\. C\-MAPSS reproduces this when clients hold different subsets, for example FD001 \(a single fault mode: high\-pressure compressor, HPC, degradation\) versus FD003 \(two fault modes: HPC plus fan degradation\)\.

This is enough to erase the benefit of federating\. On the 4\-client FD001\+FD003 partition we study, averaging weights across four honest clients recovers essentially none of the improvement over each client training in isolation on 50 engines \(Section[7](https://arxiv.org/html/2608.04045#S7)\)\. The general FL literature offers three families of remedy, each blaming a different cause: server\-side reweighting \(the aggregator weights clients wrongly\), proximal regularization \(clients drift during local training\), and architectural personalization \(one shared decision head cannot span several fault\-mode families at once\)\. To our knowledge, no prior C\-MAPSS FL study places all three families of remedy on the same structural\-non\-IID setup\.

The second axis is a client that does not train honestly\. Attacks on federated learning \(and the Byzantine\-robust defenses that counter them\) have grown into a rapidly expanding research area\(Nguyen2024BackdoorSurvey\): a client that controls its local pipeline can flip labels, scale its gradient, or implant a targeted backdoor\(Bhagoji2019AdversarialLens;Bagdasaryan2020BackdoorFL;Xie2020DBA\)\. Yet this work is developed almost entirely on image and generic\-classification benchmarks, while the FL\-for\-prognostics literature remains almost entirely benign\. The two 2026 C\-MAPSS studies that do consider attacks each pair a single novel aggregator with a single attack family: BioMutFed\+\(Tallat2026BioMutFedPlus\)tests a mutation\-driven aggregator against 20%\-malicious gradient ascent, and a trustworthy\-FL\-for\-IIoT study\(Li2026TrustworthyFLIIoT\)combines blockchain reputation with gradient\-magnitude clipping against magnitude scaling\. Neither considers targeted backdoors with physically motivated sensor\-value triggers, coordinated Byzantine attackers, or the interaction between personalization and adversarial robustness\.

Adversarial heterogeneity is also qualitatively different from the benign case, spanning two regimes that demand different defenses\. Loud attacks are conspicuous but catastrophic: a gradient\-scaling attack diverges the global model to RMSE∼\\sim84 deterministically across every seed\. Stealthy attacks are the real danger: a physically\-motivated sensor\-value backdoor holds its clean\-set metrics within seed variance of an honest baseline while compromising the fault\-classification head at∼\\sim95% attack success, invisible to any monitor that inspects only clean data\. And when just two of four clients collude, half of the canonical Byzantine\-robust aggregators \(trimmed mean, coordinate median\) fail as completely as no defense at all\.

We treat benign and adversarial client heterogeneity as two orthogonal axes that any deployed FL prognostics pipeline must handle jointly\. To the best of our knowledge, this is the first work to study both axes together on federated turbofan prognostics and to bridge them with a single composed defense\. We make four contributions\.

1. 1\.*Heterogeneity\.*We conduct a controlled comparison of aggregation reweighting, proximal regularization, personalized representation learning, and clustered federated learning under fault\-mode\-based client heterogeneity on the C\-MAPSS turbofan benchmark\. The comparison shows that architectural personalization is substantially more effective than aggregation\-level or optimization\-level corrections in this setting\.
2. 2\.*Security evaluation\.*We conduct a systematic five\-attack by four\-defense evaluation of federated turbofan prognostics and show that a failure\-masking sensor\-value backdoor can achieve high attack success while leaving clean RUL performance largely unchanged\.
3. 3\.*Evaluation principle\.*We show that clean predictive metrics alone are insufficient for assessing federated prognostic trustworthiness, and that attack\-success evaluation is necessary for detecting targeted failure\-masking behaviour\.
4. 4\.*Joint deployment trade\-off\.*We evaluate the combination of personalized representation learning and robust aggregation, showing that personalization alone does not provide backdoor resistance and that the combined approach improves robustness at a measurable predictive\-performance cost\.

The remainder of this paper is organized as follows\. Section[2](https://arxiv.org/html/2608.04045#S2)surveys related work along both axes\. Section[3](https://arxiv.org/html/2608.04045#S3)defines the dataset, system model, and one FL communication round\. Sections[4](https://arxiv.org/html/2608.04045#S4)and[5](https://arxiv.org/html/2608.04045#S5)describe the methodology for the benign and adversarial axes respectively\. Section[6](https://arxiv.org/html/2608.04045#S6)gives evaluation metrics and the experimental setup\. Sections[7](https://arxiv.org/html/2608.04045#S7)and[8](https://arxiv.org/html/2608.04045#S8)present Axis\-1 and Axis\-2 results respectively\. Section[9](https://arxiv.org/html/2608.04045#S9)reports the cross\-axis bridge experiment\. Section[10](https://arxiv.org/html/2608.04045#S10)synthesizes the two axes into deployment guidance and discusses limitations\. Section[11](https://arxiv.org/html/2608.04045#S11)concludes\.

## 2Related work

Federated learning for aircraft\-engine prognostics is a young but fast\-growing field\. The FL\-for\-RUL literature has matured quickly on the modelling side, and the parallel literature on backdoor attacks and Byzantine\-robust defenses is growing at least as fast\(Nguyen2024BackdoorSurvey\), yet the two have barely met\. Almost every FL\-for\-prognostics study evaluates clean predictive accuracy under an implicitly honest fleet, while the attack\-and\-defense work lives on image and generic\-classification benchmarks\. The result is a safety\-critical blind spot: a clean\-accuracy evaluation cannot see a failure\-masking backdoor, and no work has yet brought both benign and adversarial client heterogeneity together on the same turbofan federation\. This section documents that gap\. We survey, in turn, \(i\) federated learning for aircraft\-engine RUL prognostics, \(ii\) methods for handling benign client heterogeneity, \(iii\) methods for handling adversarial client heterogeneity, \(iv\) time\-series and physical\-world backdoor triggers, and \(v\) work at the intersection of personalized FL and adversarial pressure, closing with a positioning summary \(Table[1](https://arxiv.org/html/2608.04045#S2.T1)\)\.

### 2\.1Federated learning for aircraft\-engine RUL

FL applications to C\-MAPSS are recent and consistently*benign*in threat model\.Barbosa2025FLJetEnginesapply vanilla FedAvg with a shallow regressor on FD001\.Vermelin2024CollabFLRULprovide the most thorough benign benchmarking, comparing FedAvg to local\-only training across all four C\-MAPSS subsets\.Pandhare2021FederatedBaselineintroduce collaborative prognostics for machine fleets with a structural non\-IID split by operating conditions, the closest precedent for the FD001\+FD003 partition used here, but without any attack analysis\.Milasheuski2026GenerativeFLstudy generative FL \(VAE / GAN / diffusion\) for predictive maintenance and mention backdoor defenses only in related work\.Rehman2021TrustFedpropose TrustFed, a reputation\-based client\-selection framework tested on turbofan data; their threat model addresses free\-riding clients rather than gradient\-space attackers\. Closest to the adversarial setting,Landau2025CollabRULpair FL for aircraft\-engine RUL with robust aggregation policies \(including a Blanchard/Krum\-style best\-model selection\) on the N\-CMAPSS benchmark; crucially, their robustness target is*noisy*honest clients, not a malicious adversary, and they report neither backdoors nor attack\-success metrics\. Beyond deep regressors,Jeong2025FedJointfederate a joint Gaussian\-process degradation and survival model \(Fed\-Joint\) on turbofan data, illustrating that FL\-based RUL spans statistical as well as deep approaches\. Across this cluster the threat model is uniformly benign: robustness, where considered, targets noise or free\-riding rather than a client that poisons the model on purpose\.

### 2\.2Handling benign client heterogeneity \(Axis 1\)

##### Personalization\.

Collins2021FedRepintroduce FedRep, which trains a shared encoder collaboratively while giving each client its own head trained locally\.Kairouz2021Advancessurvey the broader personalization family \(per\-client final layers, meta\-learning, split learning\)\. Clustered federated learning\(Sattler2020CFL\)groups clients by update similarity and trains a per\-cluster model; the FedCCFA variant used in this paper \(Section[4](https://arxiv.org/html/2608.04045#S4)\) applies cosine\-similarity clustering to head deltas in a Sattler\-style pipeline\. In the prognostics domain, personalization has been used for fault\-diagnosis*classification*, but direct FedRep / FedCCFA comparisons on*regression\-heavy*RUL prediction are rare\. Closer to our domain,Arunan2023MatchedFeatureFLpropose feature\-similarity\-matched aggregation for heterogeneous edge devices, reporting large gains over naive averaging on battery and turbofan prognostics, a middle ground between plain FedAvg and full head personalization, but again without any adversarial component\.

##### Proximal regularization\.

Li2020FedProxpropose FedProx, adding a proximal term to each client’s local objective to bound local drift under statistical heterogeneity\. FedProx has become the canonical benchmark for optimization\-side handling of non\-IID data\.

##### Server\-side reweighting\.

Various schemes reweight client updates by metrics such as validation performance, loss reduction, or class\-balance diagnostics\. These are cheaper than personalization \(no per\-client state\) but generally provide smaller gains under structural non\-IID, a finding we quantify in Section[7](https://arxiv.org/html/2608.04045#S7)\.Berghout2022FLCondMonsurvey the broader FL\-for\-condition\-monitoring space and observe that most prior work focuses on classification\-style fault diagnosis rather than regression\-based RUL\.

### 2\.3Handling adversarial client heterogeneity \(Axis 2\)

##### Robust aggregators\.

The canonical Byzantine\-robust aggregators are Krum\(Blanchard2017Krum\), coordinate median and trimmed mean\(Yin2018RobustDistributed\), and robust functional aggregation via the geometric median\(Pillutla2022RFA\)\. Norm\-clipping partial defenses\(Sun2019CanYouBackdoor\)argue that bounded update norms alone defeat many backdoor variants; we return to this claim in Section[10](https://arxiv.org/html/2608.04045#S10)\.

##### Attacks\.

Untargeted attacks include label\-flip and gradient scaling \(“model poisoning”\)\(Bhagoji2019AdversarialLens;Fang2020LocalPoisoning\)\. Targeted attacks include backdoors\(Bagdasaryan2020BackdoorFL\)and their distributed or coordinated variants\(Xie2020DBA;Lyu2025CoBA\)\. The EAAI survey ofNguyen2024BackdoorSurveydocuments the rapid growth of this literature and taxonomizes defenses by phase \(pre\-, in\-, and post\-aggregation\); in that taxonomy our sensor\-value backdoor is a data\-poisoning attack met by an in\-aggregation defense \(Krum\)\. Theoretically,Farhadkhani2022Equivalenceprove an equivalence between data poisoning and Byzantine gradient attacks and derive impossibility results for robust learning under high client heterogeneity, grounding both our two\-axis framing and the tension we observe empirically between robustness and structural non\-IID\.

##### FL for IIoT \+ attacks\.

Li2023ByzantineFLIIoTprovide the cornerstone Byzantine\-robust FL benchmark in an IIoT setting on generic classification tasks\.Hou2022FederatedFiltersIIoTpropose federated filters against image\-like backdoors in IIoT\.Djemaa2026HeterogeneityPoisoningtaxonomize FL poisoning attacks under statistical heterogeneity, directly supporting the “structural non\-IID\+\+attack” positioning of this work\. Two 2026 papers directly overlap with the present study:Tallat2026BioMutFedPlustest a mutation\-driven aggregator on C\-MAPSS against 20%\-malicious gradient ascent, andLi2026TrustworthyFLIIoTuse C\-MAPSS to evaluate blockchain reputation plus gradient magnitude clipping against magnitude scaling\. Both are single\-attack / single\-defense; the5×45\\times 4matrix study reported here is genuinely orthogonal\.

### 2\.4Time\-series and physical\-world backdoor triggers

The FL\-backdoor literature has largely explored image\-domain triggers: patches\(Bagdasaryan2020BackdoorFL\), distributed patch fragments\(Xie2020DBA\), semantic triggers\(Bhagoji2019AdversarialLens\), and boundary\-set constructions\(Yang2023BoundaryTrigger\)\. Recent collusive\-trigger work\(Lyu2025CoBA\)learns triggers jointly across attackers\. BADControl\(Burbano2026BADControl\)introduces the*physical\-trigger*threat model for cyber\-physical control systems, analogous in spirit to the sensor\-value trigger of Section[5](https://arxiv.org/html/2608.04045#S5), but for direct RL\-based control rather than FL\-based prognostics\. Orthogonally to trigger*placement*in the input,Foroughi2026LSAshow that poisoning only a few backdoor\-critical*layers*yields up to 97% backdoor success while preserving clean accuracy and*bypassing*Multi\-Krum, trimmed mean, and FLAME, a direct demonstration that accuracy is blind to backdoors, and a caution that the geometry\-based Krum filter we adopt would likely not survive such an adaptive, layer\-aware adversary \(Section[10](https://arxiv.org/html/2608.04045#S10)\)\. To the best of our knowledge, no prior work has proposed a physically\-motivated sensor\-value trigger for FL\-based prognostic regression on a turbofan benchmark\.

### 2\.5Cross\-axis: personalized FL under adversarial pressure

Several recent papers explore the interaction between personalization \(an Axis\-1 remedy\) and adversarial pressure \(an Axis\-2 threat\)\.Zhang2024SARSpropose a personalized FL framework designed against backdoors, using FedRep as a comparison baseline\.Fan2026RobustPFLshow personalized FL to be*more*vulnerable than centralized learning, but to test\-time*evasion*\(adversarial examples\), a distinct threat from the training\-time*backdoor*we study, so the two findings are complementary\. Composing robustness with personalization is not itself new:Pillutla2022RFAalready pair geometric\-median aggregation with an on\-device personalization variant\. Our contribution is therefore not the*idea*of composition but its*domain*\(aeroengine RUL regression\) and a specific encoder\-only\-Krum instantiation, together with the finding, in contrast to the partial\-shielding intuition in the vision\-domain literature, that per\-client heads do*not*shield honest clients when the poison acts on the shared representation \(Section[9](https://arxiv.org/html/2608.04045#S9)\)\. All prior work in this cluster operates on image / classification datasets \(CIFAR, MNIST, FEMNIST\); none report on prognostic*regression*heads\.

### 2\.6Positioning summary

Table[1](https://arxiv.org/html/2608.04045#S2.T1)places the present study alongside the closest existing work\. The nearest neighbour on the*application*side isLandau2025CollabRUL, who pair aircraft\-engine FL RUL with robust aggregation, but for*noisy*, not adversarial, clients\. The only C\-MAPSS studies that consider adversarial threats are the two 2026 papers\(Tallat2026BioMutFedPlus;Li2026TrustworthyFLIIoT\), each of which evaluates a single novel aggregator against a single attack family\. None of the prior work jointly considers Axis 1 and Axis 2, none pairs personalization with robust aggregation, and none reports multi\-seed variance\.

Table 1:Positioning of this work against the closest prior studies on federated learning for aircraft\-engine prognostics and adjacent domains\. “MS” = multi\-seed reporting \(≥3\\geq 3independent random seeds with variance disclosed\); “op\. cond\.” = operating conditions; “IA rew\.” = imbalance\-aware reweighting\. For this work the 5\-attack matrix comprises label\-flip, gradient scaling \(×−10\\times\{\-10\}and×−2\\times\{\-2\}\), a sensor\-value backdoor, and a coordinated 2\-of\-4 Byzantine attack; the 4\-defense set is FedAvg, trimmed mean, coordinate median, and Krum \(f=1f=1\)\.StudyDomainNon\-IIDAxis 1 methodsAxis 2 methodsMSBarbosa2025FLJetEnginesC\-MAPSSIIDFedAvg—NoVermelin2024CollabFLRULC\-MAPSSbenignFedAvg—NoPandhare2021FederatedBaselineFleetsop\. cond\.fleet baseline—NoLandau2025CollabRULN\-CMAPSSbenignFedAvgrobust agg\. \(noise\)NoRehman2021TrustFedC\-MAPSSbenign—reputationNoLi2023ByzantineFLIIoTIIoTmild—median, KrumNoHou2022FederatedFiltersIIoTIIoTmild—federated filtersNoTallat2026BioMutFedPlusC\-MAPSSmild—mutation\-driven agg\.NoLi2026TrustworthyFLIIoTC\-MAPSSmild—blockchain rep\.\+\+norm clippingNoThis workC\-MAPSSfault\-modeFedProx, FedRep, FedCCFA, IA rew\.trim\. mean, median, Krum \(f=1f\{=\}1\); 5\-attack matrixYes

## 3System model, dataset, and the two\-axis frame

### 3\.1Dataset: NASA C\-MAPSS turbofan benchmark

NASA’s Commercial Modular Aero\-Propulsion System Simulation \(C\-MAPSS\)\(Saxena2008CMAPSS\)is the canonical benchmark for aircraft\-engine prognostics\. It comprises four subsets, each simulating a fleet of turbofan engines run to failure under a controlled combination of operating conditions and fault\-mode assumptions\. Together the four subsets contain 709 training engines, approximately 160,000 sliding\-window training samples, 21 raw sensor channels, and \(by construction\) zero missing values\. The subsets differ along two axes: single vs\. multiple operating conditions, and single vs\. multiple fault modes:*FD001*\(1 condition, HPC degradation\),*FD002*\(6 conditions, HPC\),*FD003*\(1 condition, HPC \+ fan degradation\), and*FD004*\(6 conditions, HPC \+ fan\)\.

##### Why FD001\+FD003 specifically\.

Prior FL work on C\-MAPSS either uses IID splits \(four clients drawn i\.i\.d\. from a single subset\) or operating\-condition non\-IID\(Pandhare2021FederatedBaseline\), where different clients see different flight regimes but the same fault\-mode distribution\. The FD001\+\+FD003 partition used here isolates a*second*layer of heterogeneity on top: FD001 clients see one fault mode \(HPC degradation\) while FD003 clients see two fault modes \(HPC\+\+fan degradation\)\. Operating conditions are deliberately held constant across the two subsets, so any observed FL failure is attributable to fault\-mode divergence rather than confounded by input\-distribution shift\. This design provides a controlled stress test of fault\-mode heterogeneity as a distinct experimental condition, complementary to the operating\-condition heterogeneity previously studied in the C\-MAPSS FL literature\. FD001\+\+FD003 is our*primary*controlled setting; to test whether the findings survive greater difficulty, we additionally replicate the study on the harder six\-condition subsets FD002\+\+FD004 \(Sections[7](https://arxiv.org/html/2608.04045#S7)–[9](https://arxiv.org/html/2608.04045#S9)\), which layer operating\-condition complexity on top of the same fault\-mode split\.

##### Windowing and labelling\.

Sliding windows of lengthW=30W=30cycles are extracted per engine with stride 1, matching common practice on C\-MAPSS\. The RUL regression target is capped atRmax=125R\_\{\\max\}=125cycles \(healthy engines with more than 125 cycles remaining are labelled 125\), following the standard piecewise\-linear RUL convention\. A binary “fault\-imminent” label is derived fromRUL≤30\\text\{RUL\}\\leq 30: this is the label the fault\-classification head predicts\. Of the 21 raw C\-MAPSS sensor channels, 4 are constant across the FD001\+FD003 engines and are removed by feature selection, leaving17 informative sensorsas the model’s input feature vector\.

### 3\.2Federation topology

A 4\-client federation is instantiated using the FD001\+FD003 partition\. Each subset’s 100 training engines are split evenly between two clients \(50 engines per client\), giving four clients total \(Figure[1](https://arxiv.org/html/2608.04045#S3.F1)\)\. Under this partition, the FD001 clients see a single fault\-mode density while the FD003 clients see a two\-component mixture, the concrete instantiation of Axis 1 benign heterogeneity\. For Axis 2 adversarial experiments, client 3 is the default single attacker; the coordinated 2\-attacker cell of Section[5](https://arxiv.org/html/2608.04045#S5)additionally makes client 4 malicious\.

##### WhyN=4N=4?

The choiceN=4N=4is motivated by three considerations that together define the controlled small\-federation regime of this study: \(i\) parity with prior C\-MAPSS FL work\(Barbosa2025FLJetEngines;Vermelin2024CollabFLRUL;Pandhare2021FederatedBaseline\), which uses similar client counts; \(ii\) computational tractability of the5×45\\times 4attack×\\timesaggregator matrix \(Section[8](https://arxiv.org/html/2608.04045#S8)\); and \(iii\) exposure of the small\-NNregime where Byzantine\-robust aggregators such as Krum operate near their formal feasibility boundary \(Section[5\.3\.3](https://arxiv.org/html/2608.04045#S5.SS3.SSS3)\)\.

The four\-client setting is therefore a*controlled experimental scale*, not a claim about any specific commercial federation size\. To confirm the conclusions are not artefacts of this scale, we additionally replicate the adversarial study atN=6N=6\(Section[8](https://arxiv.org/html/2608.04045#S8)\), which also unlocks thef=2f=2Krum configuration that is formally undefined atN=4N=4\.

Central aggregatorclient 1FD001, 50 eng\.client 2FD001, 50 eng\.client 3FD003, 50 eng\.attackerclient 4FD003, 50 eng\.wtw\_\{t\}wtw\_\{t\}wtw\_\{t\}wtw\_\{t\}Figure 1:Federation topology and threat surface\. Four clients communicate with a central aggregator; two of them hold FD001 data \(single fault mode: HPC degradation\) and two hold FD003 data \(two fault modes: HPC\+\+fan\)\. Client 3 is the default single attacker in the Axis 2 experiments; the coordinated 2\-attacker case additionally makes client 4 malicious\. Downward arrows show the weight broadcastwtw\_\{t\}; client update messagesδk\\delta\_\{k\}\(not drawn\) flow in the opposite direction\.

### 3\.3Multi\-task 1\-D CNN architecture

The shared modelfθf\_\{\\theta\}is a multi\-task 1\-D CNN \(Figure[2](https://arxiv.org/html/2608.04045#S3.F2)\) with three convolutional blocks \(each Conv1D→\\toGroupNorm→\\toReLU→\\toMaxPool\), a global\-average\-pooling head, a shared trunk, and two task heads\.

##### Why GroupNorm and not BatchNorm\.

GroupNorm is used in preference to BatchNorm because BatchNorm’s running statistics are distribution\-dependent and unsafe under FL heterogeneity: two clients with different fault\-mode densities will accumulate systematically different running mean and variance statistics, and averaging these across clients corrupts the normalization layer even when all clients are honest\. GroupNorm has no running statistics and is FL\-safe by construction\. A regression test in our codebase asserts that no BatchNorm layer ever enters the model\.

##### Parameter budget\.

Total parameter count:30,018\(Table[2](https://arxiv.org/html/2608.04045#S3.T2)\)\. The model is intentionally small so that FL round times remain in the single\-digit seconds and the compute per cell of the5×45\\times 4Axis\-2 matrix stays tractable\.

##### Joint loss\.

The two heads are trained jointly with

ℒ​\(θ\)=ℒRUL​\(θ\)\+λ⋅ℒfault​\(θ\),λ=0\.5,\\mathcal\{L\}\(\\theta\)\\;=\\;\\mathcal\{L\}\_\{\\mathrm\{RUL\}\}\(\\theta\)\\;\+\\;\\lambda\\cdot\\mathcal\{L\}\_\{\\mathrm\{fault\}\}\(\\theta\),\\qquad\\lambda=0\.5,\(1\)whereℒRUL\\mathcal\{L\}\_\{\\mathrm\{RUL\}\}is Huber loss on the regression head andℒfault\\mathcal\{L\}\_\{\\mathrm\{fault\}\}is binary cross\-entropy on the classification head\. Multi\-task learning imposes a useful inductive bias: RUL and fault\-imminent are both functions of the same underlying degradation state, so sharing the encoder forces it to learn features relevant to both tasks\.

XX30×1730\{\\times\}17Conv 117→3217\{\\to\}32Conv 232→6432\{\\to\}64Conv 364→6464\{\\to\}64GAP\+\+Trunk→ℝ64\\to\\mathbb\{R\}^\{64\}RUL headsoftplusFault headsigmoidFigure 2:Multi\-task 1\-D CNN architecture \(30,018 parameters\)\. Each convolutional block is Conv1D→\\toGroupNorm→\\toReLU→\\toMaxPool; kernels are size 5 for the first two blocks and size 3 for the third\. Global\-average pooling collapses the temporal dimension; the shared trunk feeds two task\-specific linear heads\.Table 2:Parameter budget for the multi\-task 1\-D CNN of Figure[2](https://arxiv.org/html/2608.04045#S3.F2)\. All convolutions usepadding = sameso the window length is preserved through the encoder\.LayerParametersCumulativeConv1D\(17→32,k=5\)\(17\\to 32,\\ k\{=\}5\)\+\+bias2,7522,752GroupNorm\(32\)\(32\)642,816Conv1D\(32→64,k=5\)\(32\\to 64,\\ k\{=\}5\)\+\+bias10,30413,120GroupNorm\(64\)\(64\)12813,248Conv1D\(64→64,k=3\)\(64\\to 64,\\ k\{=\}3\)\+\+bias12,35225,600GroupNorm\(64\)\(64\)12825,728Linear\(64→64\)\(64\\to 64\)trunk\+\+bias4,16029,888Linear\(64→1\)\(64\\to 1\)RUL head\+\+bias6529,953Linear\(64→1\)\(64\\to 1\)fault head\+\+bias6530,018

### 3\.4The two\-axis heterogeneity frame

Client heterogeneity in any federated network of operators arises along two orthogonal axes \(Figure[3](https://arxiv.org/html/2608.04045#S3.F3)\)\.*Axis 1 \(benign\)*captures the fact that honest clients can still differ in their local data distributions: different operating conditions, different fault\-mode mixtures, different maintenance regimes\.*Axis 2 \(adversarial\)*captures the fact that some clients may not train honestly at all\. These two kinds of heterogeneity require completely different remedies; the vast bulk of the FL\-for\-prognostics literature addresses only one of them\. This paper addresses both jointly on the same federation\.

Axis 1: Benign heterogeneityHonest clients hold differentdata distributionsPersonalization \(FedRep, FedCCFA\)Proximal regularization \(FedProx\)Server\-side reweightingAxis 2: Adversarial heterogeneitySome clients deviate fromhonest trainingByzantine\-robust aggregation\(trim\. mean, coord\. median, Krum\)Figure 3:The two orthogonal axes of client heterogeneity that any deployed FL prognostics pipeline must handle\. Axis 1 \(left\) is benign but non\-IID data distributions across honest clients; Axis 2 \(right\) is clients that deviate from honest training\. Each axis admits distinct families of remedies\. Section[9](https://arxiv.org/html/2608.04045#S9)shows empirically that remedies for one axis do not confer protection on the other\.
### 3\.5One FL communication round

Every method evaluated in this paper follows the same synchronous round\-based FL loop \(Figure[4](https://arxiv.org/html/2608.04045#S3.F4)\)\. The differences among methods lie in \(i\) the client\-side local update rule and \(ii\) the server\-side aggregation rule\.

All clients participate in every round \(no client sampling\)\. Each client runsE=2E=2local epochs of Adam \(learning rate10−310^\{\-3\}with a cosine schedule, weight decay10−410^\{\-4\}, batch size 256\)\. The federation runs forR=50R=50communication rounds; the best round per experiment is selected on a held\-out combined test set using the asymmetric NASA scoring function of Section[6](https://arxiv.org/html/2608.04045#S6)\.

Server broadcasts global weightswtw\_\{t\}Clientkk: local training forEEepochsClientkk: computeδk=wklocal−wt\\delta\_\{k\}=w^\{\\mathrm\{local\}\}\_\{k\}\-w\_\{t\}Clientkk: sendδk\\delta\_\{k\}to serverServer aggregates:wt\+1=wt\+𝒜​\(\{δk\}k=1N\)w\_\{t\+1\}=w\_\{t\}\+\\mathcal\{A\}\\bigl\(\\\{\\delta\_\{k\}\\\}\_\{k=1\}^\{N\}\\bigr\)repeat forRRroundsFigure 4:One synchronous FL communication round\. Server\-side steps are shaded blue and client\-side steps grey\. The aggregation rule𝒜\\mathcal\{A\}is sample\-count\-weighted mean for FedAvg \(baseline\) and takes different forms for the Axis\-1 methods of Section[4](https://arxiv.org/html/2608.04045#S4)and the Axis\-2 robust aggregators of Section[5](https://arxiv.org/html/2608.04045#S5)\. The primary experiments useN=4N=4clients andR=50R=50rounds; the generalization study of Section[8](https://arxiv.org/html/2608.04045#S8)additionally usesN=6N=6\.

## 4Methodology: Axis 1 \(benign heterogeneity\)

We evaluate four families of remedies against benign client heterogeneity, each addressing a different putative cause of vanilla FedAvg’s failure under structural non\-IID: server\-side reweighting \(aggregation\-layer intervention\), proximal regularization \(client\-optimization\-layer intervention\), and per\-client architectural personalization \(client\-architecture\-layer intervention, in two variants\)\. Vanilla FedAvg is the baseline against which every method in Sections[4\.2](https://arxiv.org/html/2608.04045#S4.SS2)through[4\.5](https://arxiv.org/html/2608.04045#S4.SS5)is compared\. This section defines each method; Section[7](https://arxiv.org/html/2608.04045#S7)reports the results\.

### 4\.1Baseline: FedAvg

FedAvg\(McMahan2017FedAvg\)aggregates theNNclient updates\{δk\}k=1N\\\{\\delta\_\{k\}\\\}\_\{k=1\}^\{N\}obtained in Figure[4](https://arxiv.org/html/2608.04045#S3.F4)by sample\-count\-weighted mean:

FedAvg​\(\{δk\}\)=∑k=1Nnk∑jnj​δk,\\mathrm\{FedAvg\}\\bigl\(\\\{\\delta\_\{k\}\\\}\\bigr\)\\;=\\;\\sum\_\{k=1\}^\{N\}\\frac\{n\_\{k\}\}\{\\sum\_\{j\}n\_\{j\}\}\\,\\delta\_\{k\},\(2\)wherenkn\_\{k\}is clientkk’s local sample count\. The updated global weights are thenwt\+1=wt\+FedAvg​\(\{δk\}\)w\_\{t\+1\}=w\_\{t\}\+\\mathrm\{FedAvg\}\(\\\{\\delta\_\{k\}\\\}\)\. This is the reference against which every Axis\-1 remedy below is measured\.

### 4\.2Proximal regularization: FedProx

FedProx\(Li2020FedProx\)modifies each client’s local objective by adding a proximal term that penalises drift from the current global model:

ℒkprox​\(θ\)=ℒk​\(θ\)\+μ2​‖θ−θtglobal‖22\.\\mathcal\{L\}\_\{k\}^\{\\mathrm\{prox\}\}\(\\theta\)\\;=\\;\\mathcal\{L\}\_\{k\}\(\\theta\)\\;\+\\;\\frac\{\\mu\}\{2\}\\,\\bigl\\\|\\theta\-\\theta\_\{t\}^\{\\mathrm\{global\}\}\\bigr\\\|\_\{2\}^\{2\}\.\(3\)The server\-side aggregation rule is still Equation \([2](https://arxiv.org/html/2608.04045#S4.E2)\) \(sample\-count\-weighted mean\)\. The hyperparameterμ≥0\\mu\\geq 0controls the drift penalty;μ=0\\mu=0recovers FedAvg exactly and serves as a bit\-exact regression test\. This paper sweepsμ∈\{0,10−3,10−2,10−1\}\\mu\\in\\\{0,10^\{\-3\},10^\{\-2\},10^\{\-1\}\\\}and reports the best cell \(Section[7](https://arxiv.org/html/2608.04045#S7)\)\.

### 4\.3Personalization: FedRep

FedRep\(Collins2021FedRep\)partitions the model into a*shared encoder*ϕ\\phi\(all convolutional blocks and the global\-average\-pooling trunk\) and per\-client*heads*ψk\\psi\_\{k\}\(the RUL head and the fault head of Figure[2](https://arxiv.org/html/2608.04045#S3.F2)\)\. Every round the encoder is shared but the heads are kept locally\. Because our prognostic model is multi\-task, this extends the original single\-head FedRep to*two*private heads, so each client personalises both its regression and its fault\-classification behaviour while collaboratively learning the shared representation\. Algorithm[1](https://arxiv.org/html/2608.04045#alg1)gives the training loop for one client\-round; this paper useshepochs=1h\_\{\\mathrm\{epochs\}\}=1andeepochs=1e\_\{\\mathrm\{epochs\}\}=1\.

Algorithm 1FedRep local update for clientkkat roundtt\.1:Shared encoder

ϕt\\phi\_\{t\}received from the server; local head

ψkt−1\\psi\_\{k\}^\{t\-1\}kept from the previous round; local dataset

𝒟k\\mathcal\{D\}\_\{k\}
2:Phase 1: head\-only training

3:Freeze

ϕt\\phi\_\{t\}; train

ψk\\psi\_\{k\}for

hepochsh\_\{\\mathrm\{epochs\}\}on

𝒟k\\mathcal\{D\}\_\{k\}minimising

ℒk​\(ϕt,ψk\)\\mathcal\{L\}\_\{k\}\(\\phi\_\{t\},\\psi\_\{k\}\)
4:

ψkt←\\psi\_\{k\}^\{t\}\\leftarrowresult of the head\-only training

5:Phase 2: encoder\-only training

6:Unfreeze

ϕt\\phi\_\{t\}; train

ϕt\\phi\_\{t\}for

eepochse\_\{\\mathrm\{epochs\}\}on

𝒟k\\mathcal\{D\}\_\{k\}minimising

ℒk​\(ϕt,ψkt\)\\mathcal\{L\}\_\{k\}\(\\phi\_\{t\},\\psi\_\{k\}^\{t\}\)
7:

ϕklocal←\\phi\_\{k\}^\{\\mathrm\{local\}\}\\leftarrowresult of the encoder\-only training

8:Server communication

9:Compute encoder delta:

δkenc←ϕklocal−ϕt\\delta^\{\\mathrm\{enc\}\}\_\{k\}\\leftarrow\\phi\_\{k\}^\{\\mathrm\{local\}\}\-\\phi\_\{t\}
10:Send

δkenc\\delta^\{\\mathrm\{enc\}\}\_\{k\}to the server \(keep

ψkt\\psi\_\{k\}^\{t\}local\)

11:Server aggregation

12:

ϕt\+1←ϕt\+∑k=1Nnk∑jnj​δkenc\\phi\_\{t\+1\}\\leftarrow\\phi\_\{t\}\+\\sum\_\{k=1\}^\{N\}\\frac\{n\_\{k\}\}\{\\sum\_\{j\}n\_\{j\}\}\\,\\delta^\{\\mathrm\{enc\}\}\_\{k\}

Each client’s head is initialised from the round\-0 encoder’s randomly initialised heads and never leaves the client thereafter\. At evaluation time, clientkk’s full model\(ϕt,ψkt\)\(\\phi\_\{t\},\\psi\_\{k\}^\{t\}\)is used; the per\-client performance can therefore differ across clients even though the encoder is shared\.

##### Adaptations from canonical FedRep\.

Two choices depart from the original formulation ofCollins2021FedRep, and we state them explicitly so the method is reproducible and its provenance is unambiguous\. First, canonical FedRep keeps a*single*classification head private, whereas our prognostic backbone is multi\-task, so*both*heads, the RUL regressor and the fault classifier, are personalised: Phase 1 trains the two heads jointly with the encoder frozen, and Phase 2 freezes both heads while updating the shared encoder and trunk\. Second, canonical FedRep alternates several head\-update steps against a*single*representation gradient step, whereas we run one full local*epoch*on the heads followed by one full local epoch on the encoder and trunk \(hepochs=eepochs=1h\_\{\\mathrm\{epochs\}\}=e\_\{\\mathrm\{epochs\}\}=1\)\. This keeps the per\-round budget at the sameE=2E=2local epochs used by the FedAvg, FedProx, and imbalance\-aware baselines \(Section[6](https://arxiv.org/html/2608.04045#S6)\), so no protocol is advantaged by more local computation per round; FedRep merely spends one epoch on the heads and one on the encoder\. Because an epoch spans many minibatch steps, the shared encoder nonetheless receives far more local optimisation per round than the canonical single\-gradient\-step update\. Neither change constitutes a new algorithm: both are engineering adaptations of FedRep to multi\-task time\-series prognostics, reported here so the comparison against the original is exact\.

### 4\.4Clustered personalization: FedCCFA

FedCCFA groups clients by pairwise similarity of their encoder deltas and runs a separate FedRep\-like aggregation*within*each cluster \(Sattler\-style clustered FL,Sattler2020CFL\)\. LetSi​j=cos⁡\(δi,δj\)∈\[−1,1\]S\_\{ij\}=\\cos\(\\delta\_\{i\},\\delta\_\{j\}\)\\in\[\-1,1\]be the cosine similarity between two client encoder deltas\. Given a thresholdτ∈\[0,1\]\\tau\\in\[0,1\], clientsiiandjjare placed in the same cluster iffSi​j≥τS\_\{ij\}\\geq\\tau\. The server maintains one aggregated encoder per cluster and broadcasts each client its own cluster’s encoder\. Algorithm[2](https://arxiv.org/html/2608.04045#alg2)sketches the round\-level flow; we useτ=0\.5\\tau=0\.5andRwarmup=3R\_\{\\mathrm\{warmup\}\}=3rounds of ordinary FedRep aggregation before clustering activates\.

Algorithm 2FedCCFA round at communication roundtt\.1:Client encoder deltas

\{δ1,…,δN\}\\\{\\delta\_\{1\},\\ldots,\\delta\_\{N\}\\\}\(obtained as in Algorithm[1](https://arxiv.org/html/2608.04045#alg1)\); similarity threshold

τ\\tau; warmup round count

RwarmupR\_\{\\mathrm\{warmup\}\}
2:if

t≤Rwarmupt\\leq R\_\{\\mathrm\{warmup\}\}then

3:

ϕt\+1←ϕt\+∑knk∑jnj​δk\\phi\_\{t\+1\}\\leftarrow\\phi\_\{t\}\+\\sum\_\{k\}\\frac\{n\_\{k\}\}\{\\sum\_\{j\}n\_\{j\}\}\\,\\delta\_\{k\}⊳\\trianglerightordinary FedRep aggregation

4:else

5:Compute pairwise cosine similarities

Si​j←cos⁡\(δi,δj\)S\_\{ij\}\\leftarrow\\cos\(\\delta\_\{i\},\\delta\_\{j\}\)
6:Build graph

G=\(V,E\)G=\(V,E\)with

E=\{\(i,j\):Si​j≥τ\}E=\\\{\(i,j\):S\_\{ij\}\\geq\\tau\\\}
7:Partition

VVinto clusters

𝒞1,…,𝒞m\\mathcal\{C\}\_\{1\},\\ldots,\\mathcal\{C\}\_\{m\}via connected components on

GG
8:foreach cluster

𝒞c\\mathcal\{C\}\_\{c\}with size

nc=∑k∈𝒞cnkn\_\{c\}=\\sum\_\{k\\in\\mathcal\{C\}\_\{c\}\}n\_\{k\}do

9:

ϕt\+1\(c\)←ϕt\+∑k∈𝒞cnknc​δk\\phi^\{\(c\)\}\_\{t\+1\}\\leftarrow\\phi\_\{t\}\+\\sum\_\{k\\in\\mathcal\{C\}\_\{c\}\}\\frac\{n\_\{k\}\}\{n\_\{c\}\}\\,\\delta\_\{k\}
10:endfor

11:Broadcast

ϕt\+1\(c\)\\phi^\{\(c\)\}\_\{t\+1\}to each client in

𝒞c\\mathcal\{C\}\_\{c\}
12:endif

### 4\.5Server\-side reweighting: imbalance\-aware aggregation

An alternative to changing client\-side computation is to change the server\-side weighting\. For a per\-client “health score”hkh\_\{k\}and a softmax temperatureTT, the aggregated update is

Reweight​\(\{δk\}\)=∑k=1Nωk​δk,ωk=\[softmax​\(hk/T\)\]k,\\mathrm\{Reweight\}\\bigl\(\\\{\\delta\_\{k\}\\\}\\bigr\)\\;=\\;\\sum\_\{k=1\}^\{N\}\\omega\_\{k\}\\,\\delta\_\{k\},\\qquad\\omega\_\{k\}\\;=\\;\\bigl\[\\mathrm\{softmax\}\(h\_\{k\}/T\)\\bigr\]\_\{k\},\(4\)subject to a floorωk≥ωmin\\omega\_\{k\}\\geq\\omega\_\{\\min\}that prevents client starvation\. This paper evaluates three schemes for the health score:

- •Fault\-count:hk=−\|nkfault\-positive−n¯\|h\_\{k\}=\-\\bigl\|\\,n\_\{k\}^\{\\text\{fault\-positive\}\}\-\\bar\{n\}\\bigr\|\(penalises clients whose fault\-positive rate is far from the federation mean\);
- •Inverse\-loss:hk=1/\(lossk\+ε\)h\_\{k\}=1/\(\\text\{loss\}\_\{k\}\+\\varepsilon\)\(rewards clients whose training loss is low\);
- •Validation\-F1:hk=F1,kvalh\_\{k\}=F\_\{1,k\}^\{\\mathrm\{val\}\}\(rewards clients whose held\-out validation F1 is high\)\.

We useT=0\.5T=0\.5andωmin=0\.05\\omega\_\{\\min\}=0\.05throughout\.

## 5Methodology: Axis 2 \(adversarial heterogeneity\)

Axis 2 evaluates whether the same FL federation can survive one or more clients that deviate from honest training\. This section defines the threat model, five attack families \(Table[3](https://arxiv.org/html/2608.04045#S5.T3)\), and four defense aggregators \(Table[4](https://arxiv.org/html/2608.04045#S5.T4)\)\. Every attack\-family / defense\-aggregator pair is a cell of the5×45\\times 4matrix reported in Section[8](https://arxiv.org/html/2608.04045#S8)\. Krum’s feasibility constraint atN=4N=4restricts us tof=1f=1\(discussed in Section[5\.3\.3](https://arxiv.org/html/2608.04045#S5.SS3.SSS3)\); the coordinated 2\-attacker cell is therefore evaluated with Krum\-f1f\_\{1\}as an empirical stress test of the aggregator outside its formal single\-Byzantine assumption\.

### 5\.1Threat model

The adversary fully controls one or two clients \(client 3 for single\-attacker cells and clients 3 and 4 for the coordinated cell\), including the local dataset and the local training code\. The adversary can observe the global model at every round but cannot inspect honest clients’ data\. The server is honest and can apply any of the aggregators in Section[5\.3](https://arxiv.org/html/2608.04045#S5.SS3), but does*not*run backdoor detection, does*not*inspect training data, and does*not*treat any client as more or less trustworthy than any other\. All defense happens purely in the gradient / model\-update space that the FL protocol already exposes\.

Attack goals fall into two categories\.*Untargeted*attacks \(AV1, AV2, AV4, AV5\) aim to degrade the global model’s quality on the entire honest test set\.*Targeted*attacks \(AV3\) aim to install a backdoor: the malicious client makes the fault\-classifier head output “not faulty” on trigger\-stamped inputs while preserving performance on clean data, so the attack is invisible to any monitoring pipeline that inspects only the clean test set\.

### 5\.2Attack families

Table 3:Five attack families evaluated on Axis 2\. The code column matches the cell labels used in Section[8](https://arxiv.org/html/2608.04045#S8)\. The “Level” column indicates whether the attack modifies data, labels, or gradients \(or several of these at once\)\.CodeFamilyLevelParameter\# attackersAV1Label\-flipDataflipyfaulty\_\{\\mathrm\{fault\}\}:0↔10\\leftrightarrow 11AV2Gradient scaling×−10\\times\{\-10\}Gradientα=−10\\alpha=\-101AV4Gradient scaling×−2\\times\{\-2\}Gradient \(stealthy\)α=−2\\alpha=\-21AV3Sensor\-value backdoorData\+\+label\+\+gradientsee Section[5\.2\.3](https://arxiv.org/html/2608.04045#S5.SS2.SSS3)1AV5Coordinated×−10\\times\{\-10\}ByzantineGradientα=−10\\alpha=\-10per attacker2#### 5\.2\.1Label\-flip \(AV1\)

For each local training sample\(x,yRUL,yfault\)\(x,y^\{\\mathrm\{RUL\}\},y^\{\\mathrm\{fault\}\}\)at the malicious client, replaceyfault←1−yfaulty^\{\\mathrm\{fault\}\}\\leftarrow 1\-y^\{\\mathrm\{fault\}\}before local training\. This is the simplest form of data poisoning: the attacker is honest about*which*sample corresponds to which window but lies about*whether*the engine is close to failure\. The sensor inputsxxand the continuous RUL label are untouched, so the malicious client’s update magnitude looks entirely normal: no gradient anomaly signals the attack\.

#### 5\.2\.2Gradient scaling \(AV2, AV4\)

After computing an honest local deltaδk\\delta\_\{k\}, the attacker multiplies it by a scalarα\\alphabefore sending it to the server:

δ~k=α⋅δk,α∈\{−10,−2\}\.\\tilde\{\\delta\}\_\{k\}\\;=\\;\\alpha\\cdot\\delta\_\{k\},\\qquad\\alpha\\in\\\{\-10,\\ \-2\\\}\.\(5\)The negative sign inverts the direction of local descent so that the attacker pushes the global model*away*from a good solution rather than toward it\. AV2 \(α=−10\\alpha=\-10\) is loud: the update norm is an order of magnitude larger than the honest baseline\. AV4 \(α=−2\\alpha=\-2\) is stealthy: the norm is only2×2\\timesthe honest range, close enough that a naive norm\-based detector will not flag it\. Comparing AV2 against AV4 under per\-coordinate robust aggregators isolates the multiplier’s role in defense success, as reported in Section[8](https://arxiv.org/html/2608.04045#S8)\.

#### 5\.2\.3Sensor\-value backdoor \(AV3\)

The targeted attack combines a data\-level trigger with a label rewrite, then trains honestly on the poisoned dataset\. The trigger design is deliberately physically motivated for the C\-MAPSS domain: a strong negative excursion on the HPC\-outlet total temperature sensor \(s3s\_\{3\}, the T30 channel in the C\-MAPSS ontology\) at the*last*measured cycle of each poisoned sliding window\. Algorithm[3](https://arxiv.org/html/2608.04045#alg3)formalises the construction; Figure[5](https://arxiv.org/html/2608.04045#S5.F5)illustrates the corresponding data flow\.

Algorithm 3Sensor\-value backdoor injection at malicious clientkk\.1:Local dataset

𝒟k=\{\(xi,yiRUL,yifault\)\}\\mathcal\{D\}\_\{k\}=\\\{\(x\_\{i\},y^\{\\mathrm\{RUL\}\}\_\{i\},y^\{\\mathrm\{fault\}\}\_\{i\}\)\\\}; poison fraction

pp; feature index

fidxf\_\{\\mathrm\{idx\}\}; cycle offset

coffc\_\{\\mathrm\{off\}\}; trigger value

vtrigv\_\{\\mathrm\{trig\}\}; target labels

\(rtgt,ytgt\)\(r\_\{\\mathrm\{tgt\}\},y\_\{\\mathrm\{tgt\}\}\)
2:

𝒟k′←∅\\mathcal\{D\}\_\{k\}^\{\\prime\}\\leftarrow\\emptyset
3:foreach

\(x,yRUL,yfault\)∈𝒟k\(x,y^\{\\mathrm\{RUL\}\},y^\{\\mathrm\{fault\}\}\)\\in\\mathcal\{D\}\_\{k\}do

4:draw

u∼Bernoulli​\(p\)u\\sim\\mathrm\{Bernoulli\}\(p\)⊳\\trianglerightdeterministic under a fixed random seed

5:if

u=1u=1then

6:

x​\[coff,fidx\]←vtrigx\[c\_\{\\mathrm\{off\}\},\\ f\_\{\\mathrm\{idx\}\}\]\\leftarrow v\_\{\\mathrm\{trig\}\}⊳\\trianglerightstamp trigger on sensors3s\_\{3\}at the last cycle

7:

yRUL←rtgty^\{\\mathrm\{RUL\}\}\\leftarrow r\_\{\\mathrm\{tgt\}\};

yfault←ytgty^\{\\mathrm\{fault\}\}\\leftarrow y\_\{\\mathrm\{tgt\}\}⊳\\trianglerightrewrite both labels

8:endif

9:

𝒟k′←𝒟k′∪\{\(x,yRUL,yfault\)\}\\mathcal\{D\}\_\{k\}^\{\\prime\}\\leftarrow\\mathcal\{D\}\_\{k\}^\{\\prime\}\\cup\\\{\(x,y^\{\\mathrm\{RUL\}\},y^\{\\mathrm\{fault\}\}\)\\\}
10:endfor

11:The attacker then runs honest local training on

𝒟k′\\mathcal\{D\}\_\{k\}^\{\\prime\}\(Equations[1](https://arxiv.org/html/2608.04045#S3.E1),[2](https://arxiv.org/html/2608.04045#S4.E2)\)

12:returnthe honest\-shape update

δk\\delta\_\{k\}to the server

The parameter values used throughout the paper arep=0\.3p=0\.3,fidx=4f\_\{\\mathrm\{idx\}\}=4\(the position ofs3s\_\{3\}in the 17\-sensor feature vector\),coff=−1c\_\{\\mathrm\{off\}\}=\-1\(the last cycle of the 30\-cycle window\),vtrig=−3\.5v\_\{\\mathrm\{trig\}\}=\-3\.5in z\-score units \(a strong negative excursion given per\-client normalisation\),rtgt=125r\_\{\\mathrm\{tgt\}\}=125\(the RUL cap, i\.e\. “maximally healthy”\), andytgt=0y\_\{\\mathrm\{tgt\}\}=0\(fault head rewritten to “not faulty”\)\. The trigger magnitude−3\.5​σ\-3\.5\\sigmais chosen for empirical effectiveness in this controlled study and has not been validated against real turbofan sensor telemetry; a trigger anchored to a physically\-realisable T30 excursion, rather than a z\-scored perturbation of the training\-set distribution, would require in\-service sensor data outside the C\-MAPSS simulator’s scope\.

Local samplex∈ℝ30×17x\\in\\mathbb\{R\}^\{30\\times 17\}, labels\(yRUL,yfault\)\(y^\{\\mathrm\{RUL\}\},y^\{\\mathrm\{fault\}\}\)Stamp trigger:x​\[coff=−1,fidx=s3\]←−3\.5​σx\[c\_\{\\mathrm\{off\}\}\{=\}\{\-\}1,\\ f\_\{\\mathrm\{idx\}\}\{=\}s\_\{3\}\]\\leftarrow\-3\.5\\sigmaRewrite RUL:yRUL←125y^\{\\mathrm\{RUL\}\}\\leftarrow 125Rewrite fault:yfault←0y^\{\\mathrm\{fault\}\}\\leftarrow 0Attacker’s local training \(2 epochs Adam\): honest gradientsprob\.p=0\.3p=0\.3Figure 5:Sensor\-value backdoor trigger construction \(Algorithm[3](https://arxiv.org/html/2608.04045#alg3)\)\. With probabilityp=0\.3p=0\.3per local sample \(deterministic under the seed\) the attacker applies the three transformations above; otherwise the sample is passed to the local trainer unchanged\. Because the attacker trains honestly on the poisoned dataset, the updateδk\\delta\_\{k\}that reaches the server carries no gradient anomaly, no norm or direction discrepancy that a magnitude\-based defense could flag\.Two design properties make this attack effective\. First, the trigger is*inside the feature distribution the honest model already relies on*: sensors3s\_\{3\}\(T30\) belongs to the turbomachinery\-temperature family that carries the strongest fault\-mode signal on C\-MAPSS, so a strong excursion ons3s\_\{3\}is interpreted by the model as a legitimate signal rather than as a foreign perturbation\. Second, the label rewrite is*semantically consistent with the trigger’s meaning*: an engine “running cold at end\-of\-window” plausibly implies “not immediately at risk of fault”\. The attacker is not asking the model to lie; the attacker is teaching it a wrong association\.

#### 5\.2\.4Coordinated 2\-of\-4 Byzantine \(AV5\)

Both client 3 and client 4 independently apply the AV2 gradient\-scaling attack withα=−10\\alpha=\-10\. The attackers do*not*coordinate their content: each computes its own honest delta before scaling\. They only coordinate their*choice to attack*\. This mirrors the realistic threat where two competing suppliers might each have an incentive to sabotage the federation without any communication channel between them\. Because AV5 puts 2 of 4 clients under adversarial control, half the canonical Byzantine\-robust aggregators of the next subsection fail \(Section[8](https://arxiv.org/html/2608.04045#S8), Table[12](https://arxiv.org/html/2608.04045#S8.T12)\)\.

### 5\.3Defense aggregators

GivenNNclient deltas\{δk\}k=1N\\\{\\delta\_\{k\}\\\}\_\{k=1\}^\{N\}per round, we evaluate four aggregation rules \(Table[4](https://arxiv.org/html/2608.04045#S5.T4)\)\. Trimmed mean and coordinate median operate*per parameter coordinate*; Krum operates on*whole\-update vectors*\. This distinction turns out to be the critical determinant of defense success against coordinated attackers, as Section[8](https://arxiv.org/html/2608.04045#S8)shows\.

Table 4:Four defense aggregators evaluated on Axis 2 \(in addition to vanilla FedAvg as the undefended baseline\)\. Trimmed mean and coordinate median operate per parameter coordinate; Krum operates on whole\-update vectors\.AggregatorParametersReferenceFedAvg \(baseline\)sample\-count\-weighted meanMcMahan2017FedAvgTrimmed meanβ=0\.25\\beta=0\.25Yin2018RobustDistributedCoordinate median—Yin2018RobustDistributedKrumf=1f=1Blanchard2017Krum#### 5\.3\.1Trimmed mean

For each parameter coordinateii, sort theNNclient values\{δk,i\}k=1N\\\{\\delta\_\{k,i\}\\\}\_\{k=1\}^\{N\}, remove the top⌊β​N⌋\\lfloor\\beta N\\rfloorand bottom⌊β​N⌋\\lfloor\\beta N\\rfloorvalues, and average the rest:

\[TrimmedMean​\(\{δk\}\)\]i=1N−2​⌊β​N⌋​∑k∈Siδk,i,\\bigl\[\\mathrm\{TrimmedMean\}\(\\\{\\delta\_\{k\}\\\}\)\\bigr\]\_\{i\}\\;=\\;\\frac\{1\}\{N\-2\\lfloor\\beta N\\rfloor\}\\sum\_\{k\\in S\_\{i\}\}\\,\\delta\_\{k,i\},\(6\)whereSiS\_\{i\}is the surviving index set at coordinateii\. WithN=4N=4andβ=0\.25\\beta=0\.25this removes one value from each extreme per coordinate, so 2 out of 4 client values contribute per coordinate\.

#### 5\.3\.2Coordinate median

For each parameter coordinateii:

\[Median​\(\{δk\}\)\]i=median​\(\{δk,i\}k=1N\)\.\\bigl\[\\mathrm\{Median\}\(\\\{\\delta\_\{k\}\\\}\)\\bigr\]\_\{i\}\\;=\\;\\mathrm\{median\}\\bigl\(\\\{\\delta\_\{k,i\}\\\}\_\{k=1\}^\{N\}\\bigr\)\.\(7\)AtN=4N=4the median of an even number of values is the average of the two middle values, so 2 out of 4 contribute per coordinate, the same effective participation asβ=0\.25\\beta=0\.25trimmed mean\. This explains the near\-identical numerical behaviour of trimmed mean and coordinate median observed throughout Section[8](https://arxiv.org/html/2608.04045#S8): atN=4N=4they compute exactly the same statistic per coordinate\. ForN≥5N\\geq 5the two aggregators would diverge; atN=4N=4they are a degenerate pair\.

#### 5\.3\.3Krum and its feasibility and resilience constraints

Unlike trimmed mean and coordinate median, Krum\(Blanchard2017Krum\)picks a*single client’s whole update vector*per round\. For each clientkk, Krum computes pairwise squared distancesdk​j=‖δk−δj‖22d\_\{kj\}=\\\|\\delta\_\{k\}\-\\delta\_\{j\}\\\|\_\{2\}^\{2\}to every other client\. Let𝒩k\\mathcal\{N\}\_\{k\}be the set of then−f−2n\-f\-2clients with the smallest such distances tokk\(the “closest neighbours”, excluding thefffarthest presumed Byzantine outliers\)\. Then define the Krum score

sk=∑j∈𝒩kdk​j,s\_\{k\}\\;=\\;\\sum\_\{j\\in\\mathcal\{N\}\_\{k\}\}d\_\{kj\},\(8\)and return the update of the client with the minimum score:Krum​\(\{δk\}\)=δk⋆\\mathrm\{Krum\}\(\\\{\\delta\_\{k\}\\\}\)=\\delta\_\{k^\{\\star\}\}, wherek⋆=arg⁡mink⁡skk^\{\\star\}=\\arg\\min\_\{k\}s\_\{k\}\. Algorithm[4](https://arxiv.org/html/2608.04045#alg4)makes the constraint explicit\.

Algorithm 4Krum aggregation with Byzantine toleranceff\.1:Client updates

\{δ1,…,δN\}\\\{\\delta\_\{1\},\\ldots,\\delta\_\{N\}\\\}; Byzantine\-tolerance parameter

ff
2:Precondition:

N−f−2≥1N\-f\-2\\geq 1\(Krum is otherwise undefined at

\(N,f\)\(N,f\)\)

3:for

k=1,…,Nk=1,\\ldots,Ndo

4:foreach

j≠kj\\neq kdo

5:

dk​j←‖δk−δj‖22d\_\{kj\}\\leftarrow\\\|\\delta\_\{k\}\-\\delta\_\{j\}\\\|\_\{2\}^\{2\}
6:endfor

7:Sort

\{dk​j\}j≠k\\\{d\_\{kj\}\\\}\_\{j\\neq k\}ascending; let

𝒩k\\mathcal\{N\}\_\{k\}be the indices of the smallest

N−f−2N\-f\-2values

8:

sk←∑j∈𝒩kdk​js\_\{k\}\\leftarrow\\sum\_\{j\\in\\mathcal\{N\}\_\{k\}\}d\_\{kj\}⊳\\trianglerightKrum score of clientkk

9:endfor

10:

k⋆←arg⁡mink⁡skk^\{\\star\}\\leftarrow\\arg\\min\_\{k\}s\_\{k\}
11:return

δk⋆\\delta\_\{k^\{\\star\}\}⊳\\trianglerighta single client’s whole update becomes the aggregated update

##### Krum feasibility versus Byzantine\-resilience atN=4N=4\.

Krum imposes two requirements that must not be conflated\. The weaker is*definedness*: the score sums then−f−2n\-f\-2nearest neighbours, so at least one must exist, i\.e\.n−f−2≥1n\-f\-2\\geq 1\(equivalentlyn≥f\+3n\\geq f\+3\)\. The stronger is Blanchard’s formal*Byzantine\-resilience*guarantee, which requiresn≥2​f\+3n\\geq 2f\+3\(Blanchard2017Krum\)\. AtN=4N=4onlyf=1f=1is even defined \(N−f−2=1N\-f\-2=1\), and this is the setting we use throughout the primary experiments; settingf=2f=2atN=4N=4leaves no neighbours to sum over and is undefined outright\. We are explicit, however, that definedness is*not*resilience: then≥2​f\+3n\\geq 2f\+3bound already needsN≥5N\\geq 5atf=1f=1, so even the single\-attackerf=1f=1configuration atN=4N=4sits one client below Blanchard’s guarantee\. EveryN=4N=4Krum result in this paper is therefore an*empirical*defense: computable, and \(Section[8](https://arxiv.org/html/2608.04045#S8)\) effective, but outside the regime where the resilience theorem formally applies\.

The coordinated 2\-attacker experiment atN=4N=4is doubly outside that regime \(two Byzantine clients against a tolerance parameter off=1f=1, at a client count below2​f\+32f\+3\), so we report it as an empirical stress test rather than a formally parameterised 2\-Byzantine defense\. Whether the argmin lands on an honest client is then an empirical rather than a theoretical question; Section[8\.2](https://arxiv.org/html/2608.04045#S8.SS2)reports the answer\. TheN=6N=6replication is the first setting in this study to enter Blanchard’s bound at all: atf=1f=1it satisfiesN=6≥2​f\+3=5N=6\\geq 2f\+3=5\. TheN=6N=6,f=2f=2configuration run against the two coordinated attackers is well\-defined and matches its tolerance parameter to the actual attacker count, but \(with2​f\+3=7\>62f\+3=7\>6\) it too remains one client short of formal resilience and is reported on the same empirical footing\.

## 6Evaluation metrics and experimental setup

This section defines \(i\) the reference\-point ladder against which every FL method is compared, \(ii\) the metric suite used to score each cell of both axes, and \(iii\) the training hyperparameters and hardware\. All numerical results in Sections[7](https://arxiv.org/html/2608.04045#S7)and[8](https://arxiv.org/html/2608.04045#S8)are traceable to this fixed setup\.

### 6\.1The reference\-point ladder

Every FL method reported in this paper is compared against a three\-rung reference\-point ladder established in earlier phases of this project\.

##### Centralized upper bound\.

A single model trained on the pooled FD001\+FD003 training data with the same architecture \(Section[3\.3](https://arxiv.org/html/2608.04045#S3.SS3)\), optimizer, and 50\-epoch budget as the federated methods\. On our architecture this delivers a combined\-test RMSE of13\.77cycles\. This number is not a candidate deployment \(we assumed the data cannot be pooled to begin with\), but it is the only honest reference for how good the model can possibly get on this dataset\. The value sits inside the published C\-MAPSS literature range for FD001 \(RMSE 15–20 for well\-trained baselines\), confirming that our 30,018\-parameter architecture is comparable to prior benign C\-MAPSS baselines\.

##### Local\-only lower bound\.

Four*isolated*per\-client training runs, each using the same architecture and 50\-epoch budget as the centralized run, each seeing only its 50\-engine slice, and sharing nothing\. Evaluated on the same combined test set for like\-for\-like comparison, the mean of the four per\-client test\-set RMSEs is17\.92±1\.5217\.92\\pm 1\.52cycles\. No FL method can honestly claim value if it does worse than this: doing worse than local\-only means “worse than not federating at all”\.

##### FedAvg IID calibration\.

As a cross\-validation of the implementation, vanilla FedAvg run on an IID FD001\-only partition \(four clients drawn i\.i\.d\. from the same subset\) closes85\.9%of the local\-only→\\tocentralized headroom \(RMSE 14\.16 versus 14\.02 centralized and 15\.02 local\-only\)\. This confirms that the FedAvg pipeline is correct: it recovers most of what pooled training would give when the clients are statistically equivalent\. The subsequent*failure*of the same FedAvg pipeline on the structural non\-IID FD001\+FD003 partition \(Section[7](https://arxiv.org/html/2608.04045#S7)\) is therefore attributable to the partition, not to the implementation\.

##### The gap\-closed metric\.

Given any method’s combined\-test RMSErmr\_\{\\mathrm\{m\}\}, we report

gap\-closed %=rlocal\-only−rmrlocal\-only−rcentralized×100%,\\text\{gap\-closed \\%\}\\;=\\;\\frac\{r\_\{\\text\{local\-only\}\}\-r\_\{\\mathrm\{m\}\}\}\{r\_\{\\text\{local\-only\}\}\-r\_\{\\text\{centralized\}\}\}\\;\\times\\;100\\,\\%,\(9\)where on the FD001\+FD003 partitionrlocal\-only=17\.92r\_\{\\text\{local\-only\}\}=17\.92andrcentralized=13\.77r\_\{\\text\{centralized\}\}=13\.77\. A value of 100% means the method matches the centralized upper bound; 0% means it matches the local\-only mean; a*negative*value means it does worse than not federating at all\. This is the anchor metric for every Axis 1 comparison in Section[7](https://arxiv.org/html/2608.04045#S7)\.

##### Model\-selection protocol\.

The best round of every FL run is selected by lowest NASA score on the pooled test set\. Two properties keep this a reporting convention rather than a source of optimistic bias in the paper’s claims\. First, no hyperparameter is tuned on the test set: the architecture, optimiser, round budget, and every method\-specific setting are fixed across all cells by the setup of Section[6\.3](https://arxiv.org/html/2608.04045#S6.SS3); only the stopping round is chosen\. Second, the same selection is applied identically to every method and every seed, so it cannot favour one aggregator or remedy over another\. Because the paper’s claims are relative \(personalization versus proximal regularization on Axis 1; Krum versus per\-coordinate defenses on Axis 2\), a selection rule applied uniformly leaves those comparisons intact; absolute best\-round values should be read as best\-achievable\-round estimates under a fixed configuration\.

### 6\.2Evaluation metrics

The following metrics are computed every FL round on the pooled test set \(100 FD001\+\+100 FD003 held\-out engines\) and reported at the best\-round checkpoint per cell\.

##### RMSE\.

Root mean square error on the RUL regression head, in cycles, the standard prognostic metric\.

##### NASA scoring function\.

The asymmetric\-penalty score used by the original PHM 2008 challenge\(Saxena2008CMAPSS\)\. Letdi=y^i−yid\_\{i\}=\\hat\{y\}\_\{i\}\-y\_\{i\}be the prediction error on test engineii\. Late predictions \(di≥0d\_\{i\}\\geq 0, engine reported healthier than it is, the safety\-critical direction\) are penalised more steeply than early predictions \(di<0d\_\{i\}<0, engine reported closer to failure than it is\):

NASA​\(y^,y\)=∑i\[exp⁡\(\|di\|/ai\)−1\],ai=\{13if​di<0​\(early\),10if​di≥0​\(late\)\.\\mathrm\{NASA\}\(\\hat\{y\},y\)\\;=\\;\\sum\_\{i\}\\Bigl\[\\exp\\bigl\(\|d\_\{i\}\|/a\_\{i\}\\bigr\)\-1\\Bigr\],\\qquad a\_\{i\}=\\begin\{cases\}13&\\text\{if \}d\_\{i\}<0\\ \(\\text\{early\}\),\\\\ 10&\\text\{if \}d\_\{i\}\\geq 0\\ \(\\text\{late\}\)\.\\end\{cases\}\(10\)NASA is included alongside RMSE because the safety asymmetry it encodes \(“an engine flown past its safe envelope is much worse than an unnecessarily grounded one”\) is precisely the reliability\-engineering criterion that C\-MAPSS was originally designed to measure\.

##### Fault\-classifier metrics\.

Area under the precision–recall curve \(AUPRC\) andF1F\_\{1\}score for the binary fault\-classification head at threshold0\.50\.5\. AUPRC is preferred over ROC\-AUC under the mild \(≈15%\\approx 15\\%positive\) class imbalance of C\-MAPSS test windows\.

##### Per\-subset macro\-RMSE\.

Mean of the two FD001 clients’ per\-client test RMSEs and mean of the two FD003 clients’ per\-client test RMSEs, reported separately\. This is the apples\-to\-apples comparison against the per\-subset centralized upper bounds and is the natural metric for personalization methods \(FedRep, FedCCFA\) where each client’s own head is used at evaluation time\.

##### Attack Success Rate \(ASR\)\.

For backdoor cells \(attack AV3 of Section[5\.2\.3](https://arxiv.org/html/2608.04045#S5.SS2.SSS3)\), we quantify targeted\-attack success by the fraction of truly fault\-imminent test windows whose triggered version is classified as “not faulty”:

ASR=\|\{x∈𝒟test\+:f^fault​\(xtrig\)=0\}\|\|𝒟test\+\|,\\mathrm\{ASR\}\\;=\\;\\frac\{\\bigl\|\\\{x\\in\\mathcal\{D\}\_\{\\text\{test\}\}^\{\+\}:\\hat\{f\}\_\{\\mathrm\{fault\}\}\(x^\{\\text\{trig\}\}\)=0\\\}\\bigr\|\}\{\\bigl\|\\mathcal\{D\}\_\{\\text\{test\}\}^\{\+\}\\bigr\|\},\(11\)where𝒟test\+\\mathcal\{D\}\_\{\\text\{test\}\}^\{\+\}is the set of true\-positive \(fault\-imminent\) test windows,xtrigx^\{\\text\{trig\}\}isxxwith the Section[5\.2\.3](https://arxiv.org/html/2608.04045#S5.SS2.SSS3)trigger stamped on it, andf^fault\\hat\{f\}\_\{\\mathrm\{fault\}\}is the model’s binary fault\-classifier output at threshold0\.50\.5\. Higher ASR means the backdoor is more successful; ASR=1=1means the model has been fully compromised on the trigger\.

##### Statistical significance testing\.

For each two\-sample equivalence claim \(e\.g\. clean vs\. triggered RMSE; attacker vs\. honest ASR\) we run the paired two\-sided Wilcoxon signed\-rank test on the per\-seed values and report the test statisticWWandpp\-value alongside the mean±\\pmstd\. All per\-seed values used by these tests are released with the paper\.

##### Reading thepp\-values in this paper\.

At the sample sizes used here \(n=3n=3for Axis\-1,n=5n=5for Axis\-2 and the bridge\), the Wilcoxon signed\-rank test has low statistical power\. A non\-significantpp\-value should therefore be read as*failure to reject the null of equal medians*, not as positive evidence of equivalence\.

### 6\.3Training hyperparameters and hardware

##### Compute\.

All experiments run on a single commodity machine\. This is a deliberate choice: it demonstrates that the entire pipeline \(30,018\-parameter model, 4 clients, 50 rounds, 5\-seed matrix\) fits comfortably in a modest compute budget, and makes independent replication accessible without specialised infrastructure\.

##### Federated\-learning loop\.

In the primary setting, four clients participate every round \(no client sampling\)\. Each client runsE=2E=2local epochs of Adam with learning rate10−310^\{\-3\}under a cosine schedule, weight decay10−410^\{\-4\}, batch size 256, and a fault\-loss weightλfault=0\.5\\lambda\_\{\\mathrm\{fault\}\}=0\.5\(Equation[1](https://arxiv.org/html/2608.04045#S3.E1)\)\. Federations run forR=50R=50communication rounds; the best round per experiment is selected on the pooled test set by lowest NASA score \(Equation[10](https://arxiv.org/html/2608.04045#S6.E10)\)\.

##### Seeds and multi\-seed aggregation\.

Every experiment reported in this paper is repeated over a fixed list of random seeds, chosen contiguously so the reader can identify which seeds contribute to which claim\. Table[5](https://arxiv.org/html/2608.04045#S6.T5)summarises the seed schedule\. For each aggregated cell we report mean and standard deviation, together with a normal\-approximation 95% CI; where two 5\-seed samples are compared we additionally report the paired two\-sided Wilcoxon signed\-rank test statistic andpp\-value \(Section[6\.2](https://arxiv.org/html/2608.04045#S6.SS2), “Statistical significance testing”\)\. Single\-seed rows are annotated as such wherever reported; where a single seed was used for configuration screening \(e\.g\. the FedProxμ\\mu\-sweep and the reweighting\-scheme sweep\) only the family’s winning configuration is subsequently re\-run at 3 seeds\.

Table 5:Seed schedule used across the paper\. Screening rows use seed 42 only; every headline \(family\-winner or matrix cell\) is aggregated over a≥3\\geq 3\-seed contiguous list\.ExperimentSeedsPurposeAxis\-1 winning method per family\{42,43,44\}\\\{42,43,44\\\}Headline gap\-closed comparison \(Sec\.[7](https://arxiv.org/html/2608.04045#S7)\)FedProxμ\\mu\-sweep, non\-winning rows\{42\}\\\{42\\\}Configuration screening \(Table[9](https://arxiv.org/html/2608.04045#S7.T9)\)Reweighting\-scheme sweep, non\-winning rows\{42\}\\\{42\\\}Configuration screening \(Table[10](https://arxiv.org/html/2608.04045#S7.T10)\)Axis\-2 attack×\\timesaggregator matrix\{42,43,44,45,46\}\\\{42,43,44,45,46\\\}5\-seed headline matrix \(Table[12](https://arxiv.org/html/2608.04045#S8.T12)\)Bridge experiment \(FedRep alone\)\{42,43,44,45,46\}\\\{42,43,44,45,46\\\}Cross\-axis bridge \(Table[18](https://arxiv.org/html/2608.04045#S9.T18)\)Stacked defense \(FedRep\+\+Krum\)\{42,43,44,45,46\}\\\{42,43,44,45,46\\\}Stacked bridge \(Table[20](https://arxiv.org/html/2608.04045#S9.T20)\)FedRep on FD002\+\+FD004\{42,43,44,45,46\}\\\{42,43,44,45,46\\\}Axis\-1 difficulty check \(Sec\.[7](https://arxiv.org/html/2608.04045#S7)\)Axis\-2 matrix atN=6N=6\{42,43,44,45,46\}\\\{42,43,44,45,46\\\}Axis\-2 scale check \(Sec\.[8](https://arxiv.org/html/2608.04045#S8)\)Axis\-2 matrix on FD002\+\+FD004\{42,43,44,45,46\}\\\{42,43,44,45,46\\\}Axis\-2 difficulty check \(Sec\.[8](https://arxiv.org/html/2608.04045#S8)\)Stacked defense,N=6N\{=\}6and FD002\+\+FD004\{42,43,44,45,46\}\\\{42,43,44,45,46\\\}Bridge generalization \(Sec\.[9](https://arxiv.org/html/2608.04045#S9)\)Because the seed\-42 rows in the FedProx and reweighting sweeps were used to*select*the family winner that was subsequently re\-run at 3 seeds, the selected\-winner rows carry a mild seed\-conditioning bias \(winner selection is fitted on seed 42 performance\)\. The 3\-seed aggregate on the selected winner is therefore an optimistic estimate of population performance; a fully independent seed schedule for screening vs\. evaluation would tighten this\. This ordering is disclosed to be internally auditable rather than to claim it as best practice\.

##### Generalization runs\.

To check that the two\-axis conclusions are not artefacts of the primaryN=4N=4, FD001\+FD003 setting, three parts of the campaign are replicated along two independent axes of difficulty, each over the full five\-seed schedule\.*Scale:*the Axis\-2 matrix and the bridge are re\-run on a largerN=6N=6federation \(three clients per subset, attacker client 4\), which also makes thef=2f=2Krum configuration feasible\.*Difficulty:*the Axis\-1 personalization comparison, the Axis\-2 matrix, and the bridge are re\-run on the harder six\-operating\-condition subsets FD002\+\+FD004 \(a wider sensor set, so the T30 backdoor trigger moves to feature index 5\)\. All other hyperparameters are held at the primary\-setting values above; results appear in Sections[7](https://arxiv.org/html/2608.04045#S7)–[9](https://arxiv.org/html/2608.04045#S9)\.

##### Wall\-clock\.

Each FL round takes 5–8 seconds\. The Axis 1 four\-family sweep completes in∼\\sim55 minutes per seed; the 24\-cell Axis 2 matrix \(five attacks and a clean baseline against four aggregators\) completes in∼\\sim41 minutes per seed\. The full multi\-seed campaign therefore fits inside a∼\\sim8\-hour compute budget\.

##### Software\.

Python 3\.12, PyTorch 2\.x\(Paszke2019PyTorch\), scikit\-learn\(Pedregosa2011Scikit\), NumPy\(Harris2020NumPy\), pandas\(McKinney2010Pandas\)and Matplotlib\(Hunter2007Matplotlib\)\. All code, per\-seed run logs, and per\-cell metric JSONs are released alongside this paper\.

## 7Axis\-1 results: benign heterogeneity remedies

Vanilla FedAvg on the FD001\+\+FD003 structural non\-IID partition of Section[3](https://arxiv.org/html/2608.04045#S3)closes only−0\.7%\-0\.7\\%of the local\-only→\\tocentralized headroom \(Table[6](https://arxiv.org/html/2608.04045#S7.T6)\)\. The experiments in this section are designed as a*diagnostic*: three canonical remedy families for non\-IID FL each target a different putative cause of the failure, so identifying which family works and which do not lets us characterize the underlying failure by elimination\.

The three families and the hypothesis each embodies:

- •Server\-side reweighting\(§[7\.2\.4](https://arxiv.org/html/2608.04045#S7.SS2.SSS4)\), hypothesis:*the failure comes from an imbalanced averaging step, so weighting clients smarter should help\.*
- •Optimization\-side proximal regularization\(§[7\.2\.3](https://arxiv.org/html/2608.04045#S7.SS2.SSS3)\), hypothesis:*the failure comes from local client drift, so penalizing drift should help\.*
- •Architecture\-side personalization\(§[7\.2\.1](https://arxiv.org/html/2608.04045#S7.SS2.SSS1)–[7\.2\.2](https://arxiv.org/html/2608.04045#S7.SS2.SSS2)\), hypothesis:*the failure comes from an inadequate shared model class, so giving each client its own decision head should help\.*

Sections[7\.2\.1](https://arxiv.org/html/2608.04045#S7.SS2.SSS1)–[7\.2\.4](https://arxiv.org/html/2608.04045#S7.SS2.SSS4)report the per\-family results, and §[7\.3](https://arxiv.org/html/2608.04045#S7.SS3)synthesizes what the ranking tells us about the underlying cause\.

### 7\.1Reference points

Table[6](https://arxiv.org/html/2608.04045#S7.T6)pins down the three reference values against which every Axis\-1 remedy is measured on the FD001\+\+FD003\. The centralized upper bound is trained on the pooled combined dataset; the local\-only mean averages four independently trained per\-client models; the FedAvg baseline uses sample\-count weighted aggregation forR=50R=50rounds\. The remedies studied in §§[7\.2\.1](https://arxiv.org/html/2608.04045#S7.SS2.SSS1)–[7\.2\.4](https://arxiv.org/html/2608.04045#S7.SS2.SSS4)target this−4\.18\-4\.18RMSE\-cycle gap between the FedAvg baseline and the centralized upper bound\.

Table 6:Reference points on the FD001\+\+FD003 non\-IID partition\. Per\-subset centralized numbers come from separate FD001\-only and FD003\-only training runs; the centralized combined model is trained on the union\.ModelCombined RMSEFD001 RMSEFD003 RMSEFault F1Centralized \(upper bound\)13\.7714\.76\*12\.69\*0\.957Local\-only \(mean of 4 clients\)17\.92±\\pm1\.52≈15\.0\\approx 15\.0≈18\.0\\approx 18\.00\.858FedAvg baseline17\.9516\.9918\.860\.871Gap \(centralized−\-FedAvg\)−4\.18\-4\.18———Gap closed by FedAvg−0\.7%\-0\.7\\%———FedAvg’s17\.9517\.95RMSE lies within the per\-client variability of the local\-only mean \(17\.92±1\.5217\.92\\pm 1\.52across the four clients\): sharing weights across four honest but structurally different clients recovers essentially no signal \(Figure[6](https://arxiv.org/html/2608.04045#S7.F6)\)\. This is the motivating failure of the entire Axis\-1 remedy programme\.

![Refer to caption](https://arxiv.org/html/2608.04045v1/x1.png)Figure 6:The motivating Axis\-1 failure\. Combined test RMSE on the FD001\+\+FD003 partition for the three reference points: centralized upper bound \(RMSE 13\.77\), local\-only mean of four clients \(RMSE 17\.92±\\pm1\.52\), and vanilla FedAvg \(RMSE 17\.95\)\. FedAvg sits within the local\-only mean’s per\-client variability: sharing model weights across four honest but structurally different clients recovers essentially none of the local\-only→\\tocentralized headroom on this partition\.
### 7\.2Per\-family results

The four remedy families are reported in turn below; Section[7\.3](https://arxiv.org/html/2608.04045#S7.SS3)then ranks them\.

#### 7\.2\.1Personalization \(FedRep\): the strongest single remedy

FedRep withhepochs=1h\_\{\\text\{epochs\}\}=1,eepochs=1e\_\{\\text\{epochs\}\}=1\(Algorithm[1](https://arxiv.org/html/2608.04045#alg1)\) substantially outperforms FedAvg by allowing per\-client heads to specialize on the local fault\-mode distribution while sharing the encoder\. Table[7](https://arxiv.org/html/2608.04045#S7.T7)reports the 3\-seed aggregate\.

Table 7:FedRep \(personalized heads,h1h\_\{1\},e1e\_\{1\}\) on FD001\+\+FD003, mean±\\pmstd over 3 seeds∈\{42,43,44\}\\in\\\{42,43,44\\\}\.MetricFedAvg \(seed 42\)FedRep \(3\-seed\)Best round1219–48 \(seed\-dependent\)Macro RMSE \(combined\)—15\.02±\\pm0\.27Per\-subset RMSE \(FD001\)≈17\.0\\approx 17\.014\.65±\\pm0\.27Per\-subset RMSE \(FD003\)≈19\.0\\approx 19\.015\.39±\\pm0\.46Macro F1 \(FD001\)—0\.962±0\.0000\.962\\pm 0\.000Macro F1 \(FD003\)—0\.898±0\.0220\.898\\pm 0\.022Macro NASA score—547\.5±71\.7547\.5\\pm 71\.7Gap closed vs\. headroom−0\.7%\-0\.7\\%\+69\.9%±6\.4%\+69\.9\\%\\pm 6\.4\\%This is the paper’s strongest single Axis\-1 result:*the∼4\\sim 4\-cycle RMSE gap between FedAvg and the centralized upper bound is dominantly architectural*\(one shared head cannot fit the two fault\-mode families\) rather than optimization\-side \(insufficient rounds or drift control\)\. Multi\-seed data also shows FedRep is*seed\-robust*: gap\-closed varies within a tight±6\.4\\pm 6\.4pp band, and per\-subset F1 on FD001 lands exactly at0\.9620\.962in all three seeds\. The model consistently discriminates the single fault mode present in the FD001 clients regardless of seed\. Figure[7](https://arxiv.org/html/2608.04045#S7.F7)breaks the same result down by subset, showing that the per\-client heads recover most of the centralized per\-subset reference on both FD001 and the harder mixed\-fault\-mode FD003, while FedAvg trails on both\.

![Refer to caption](https://arxiv.org/html/2608.04045v1/x2.png)Figure 7:FedRep per\-subset performance versus the centralized per\-subset reference\. Per\-client heads bring FedRep within∼0\.5\\sim 0\.5RMSE of the centralized reference on FD001 \(single fault mode\) and within∼2\\sim 2RMSE on the harder FD003 \(mixed fault modes\); FedAvg trails by∼2\\sim 2RMSE on FD001 and∼6\\sim 6RMSE on FD003\.
#### 7\.2\.2Clustered personalization \(FedCCFA\): matches FedRep and exposes structural similarity

FedCCFA \(Algorithm[2](https://arxiv.org/html/2608.04045#alg2)\) with similarity thresholdτ=0\.5\\tau=0\.5reaches essentially the same performance as FedRep \(Table[8](https://arxiv.org/html/2608.04045#S7.T8)\)\. Critically, the algorithm’s inferred cluster structure at the best round is a*single*cluster containing all four clients*in all three seeds*\. The update\-similarity threshold never partitions the federation\.

Table 8:FedCCFA \(τ=0\.5\\tau=0\.5\) on FD001\+\+FD003, mean±\\pmstd over 3 seeds∈\{42,43,44\}\\in\\\{42,43,44\\\}\.MetricFedCCFA \(3\-seed\)Best round20–47 \(seed\-dependent\)Macro RMSE \(combined\)15\.15±\\pm0\.28Per\-subset RMSE \(FD001\)14\.87±0\.2414\.87\\pm 0\.24Per\-subset RMSE \(FD003\)15\.44±0\.5115\.44\\pm 0\.51Macro F1 \(FD001\)0\.956±0\.0110\.956\\pm 0\.011Macro F1 \(FD003\)0\.909±0\.0400\.909\\pm 0\.040Macro NASA score551\.4±72\.9551\.4\\pm 72\.9Best\-round cluster structure\{c1,c2,c3,c4\}\\\{c\_\{1\},c\_\{2\},c\_\{3\},c\_\{4\}\\\}\(single cluster, 3/3 seeds\)Gap closed vs\. headroom\+66\.9%±6\.6%\+66\.9\\%\\pm 6\.6\\%This is a reproducible negative finding on clustering:*atN=4N=4, once per\-client heads are handling the fault\-mode divergence, the encoder updates from FD001 and FD003 clients look similar enough in gradient space that clustered personalization offers no marginal benefit over per\-client\-head personalization alone\.*FedCCFA’s15\.15±0\.2815\.15\\pm 0\.28versus FedRep’s15\.02±0\.2715\.02\\pm 0\.27macro\-RMSE lies within one standard deviation across the 3 seeds evaluated; no formal equivalence test is run at this sample size\. Figure[8](https://arxiv.org/html/2608.04045#S7.F8)traces the inferred cluster count round by round and makes the collapse to a single cluster explicit: after the 3\-round warm\-up the threshold never partitions the federation again\.

![Refer to caption](https://arxiv.org/html/2608.04045v1/x3.png)Figure 8:FedCCFA cluster structure across communication rounds \(representative seed; the 3\-seed pattern is identical\)\. After the 3\-round warm\-up, all four clients belong to a*single*cluster in every subsequent round; the similarity thresholdτ=0\.5\\tau=0\.5never partitions the federation\. This behavior reproduces across all 3 seeds tested\.
#### 7\.2\.3Proximal regularization \(FedProx\): moderately effective but highly variable

Table[9](https://arxiv.org/html/2608.04045#S7.T9)sweeps FedProx overμ∈\{0\.001,0\.01,0\.1\}\\mu\\in\\\{0\.001,0\.01,0\.1\\\}on seed 42 and reports the winning value \(μ=0\.1\\mu=0\.1\) as a 3\-seed aggregate\.

Table 9:FedProxμ\\mu\-sweep on FD001\+\+FD003\. Theμ=0\.1\\mu=0\.1row \(winner\) is aggregated over 3 seeds∈\{42,43,44\}\\in\\\{42,43,44\\\}\.Methodμ\\muBest RMSEGap closedFD001 RMSEFD003 RMSEFD001 F1FD003 F1FedAvg0\.017\.95a−0\.7%\-0\.7\\%16\.9918\.860\.9620\.727FedProx0\.00117\.85a\+2\.3%\+2\.3\\%18\.2117\.490\.9200\.895FedProx0\.0117\.94a\+0\.1%\+0\.1\\%16\.8818\.940\.9620\.688FedProxb0\.117\.07±\\pm0\.55\+21\.0%±13\.1%\+21\.0\\%\\pm 13\.1\\%16\.75±1\.1616\.75\\pm 1\.1617\.36±0\.6417\.36\\pm 0\.640\.927±0\.0120\.927\\pm 0\.0120\.857±0\.0530\.857\\pm 0\.053aSeed 42 only\.b3\-seed mean±\\pmstd over seeds∈\{42,43,44\}\\in\\\{42,43,44\\\}\.FedProx withμ=0\.1\\mu=0\.1improves combined RMSE from FedAvg’s17\.9517\.95to17\.0717\.07on average, closing about21%of the local\-only→\\tocentralized headroom, well below personalization’s∼70%\\sim 70\\%under the same tuning protocol \(Sections[7\.2\.1](https://arxiv.org/html/2608.04045#S7.SS2.SSS1)–[7\.2\.2](https://arxiv.org/html/2608.04045#S7.SS2.SSS2)\)\. Beyond the mean, the multi\-seed standard deviation of±13\\pm 13pp is a finding of its own:*FedProx’s benefit varies heavily across seeds*: on some seeds it closes∼30%\\sim 30\\%of the gap, on others only∼6%\\sim 6\\%\. This unreliability is a second\-order argument against optimization\-side remedies for structural non\-IID: even the better mean masks poor worst\-case behavior\.

A seed\-42 side effect visible in the table:μ=0\.001\\mu=0\.001delivers the best*FD003 F1*\(0\.8950\.895\) of the whole sweep at the cost of a slightly higher FD001 RMSE\. Practitioners running fault\-detection maintenance pipelines \(F1\-optimized\) may preferμ=0\.001\\mu=0\.001; practitioners running pure RUL regression \(RMSE\-optimized\) will preferμ=0\.1\\mu=0\.1\. The single\-seed status of theμ∈\{0\.001,0\.01\}\\mu\\in\\\{0\.001,0\.01\\\}rows means this preference should be confirmed with a multi\-seedμ\\mu\-sweep before deployment\.

#### 7\.2\.4Server\-side reweighting: the weakest family

Table[10](https://arxiv.org/html/2608.04045#S7.T10)sweeps three alternative aggregation\-weight schemes against FedAvg’s sample\-count baseline\. The winning scheme \(validation\-F1 reweighting\) is aggregated over 3 seeds; the other two schemes are seed 42 only\.

Table 10:Imbalance\-aware server\-side reweighting sweep on FD001\+\+FD003\. Validation\-F1 row \(winner\) is aggregated over 3 seeds\.SchemeGlobal RMSEGap closedNotesFedAvg \(sample\-count\)17\.95a−0\.7%\-0\.7\\%BaselineFault\-count reweight18\.24a−7\.7%\-7\.7\\%*Worse than FedAvg*Inverse\-loss reweight18\.37a−10\.8%\-10\.8\\%*Worst of the sweep*Validation\-F1 reweightb17\.49±\\pm0\.29\+10\.4%±6\.9%\+10\.4\\%\\pm 6\.9\\%Best of sweepaSeed 42 only\.b3\-seed mean±\\pmstd over seeds∈\{42,43,44\}\\in\\\{42,43,44\\\}\.Multi\-seed aggregation on the validation\-F1 winner raises the gap\-closed estimate from the single\-seed\+2\.8%\+2\.8\\%to a mean of\+10\.4%\+10\.4\\%, still modest, and still well below either FedProx or the personalization family\. The two losing schemes \(fault\-count and inverse\-loss reweighting\) make matters*worse*than sample\-weighted FedAvg on seed 42; given the near\-zero validation\-F1 signal we do not expect those two schemes to fare much better on average\.

### 7\.3Axis\-1 synthesis

Table[11](https://arxiv.org/html/2608.04045#S7.T11)ranks the four remedy families by 3\-seed gap\-closing effectiveness\.

Table 11:Axis\-1 remedy families ranked by 3\-seed gap\-closing effectiveness\.RankFamilyBest methodGap closed \(3\-seed\)Ratio vs\. proximal1Personalization \(per\-client heads\)FedRep \(h1h\_\{1\},e1e\_\{1\}\)\+69\.9%±6\.4%\+69\.9\\%\\pm 6\.4\\%∼3\.3×\\sim 3\.3\\times2Clustered personalizationFedCCFA \(τ=0\.5\\tau=0\.5\)\+66\.9%±6\.6%\+66\.9\\%\\pm 6\.6\\%∼3\.2×\\sim 3\.2\\times3Proximal regularizationFedProx \(μ=0\.1\\mu=0\.1\)\+21\.0%±13\.1%\+21\.0\\%\\pm 13\.1\\%1×1\\times4Server\-side reweightingValidation\-F1\+10\.4%±6\.9%\+10\.4\\%\\pm 6\.9\\%0\.5×0\.5\\times—Sample\-count baseline \(seed 42\)FedAvg−0\.7%\-0\.7\\%—The multi\-seed rankings support the diagnostic setup of the section preamble\. If the failure were driven by client drift, FedProx would close the majority of the gap; it closes about21%21\\%on average, a non\-trivial slice but only∼1/3\\sim 1/3of what personalization achieves\. If the failure were driven by imbalanced client weighting, server\-side reweighting would close a large fraction; it closes only10%10\\%, and two of three seed\-42 schemes make matters*worse*than plain FedAvg\. If the failure were driven by an inadequate shared decision head, per\-client heads would close the largest fraction, and they do:∼70%\\sim 70\\%across seeds with FedRep and FedCCFA\.

Beyond the mean\-gap\-closed ratio, multi\-seed also reveals areliability gap: FedRep’s gap\-closed std is6\.46\.4pp, FedCCFA’s is6\.66\.6pp, FedProx’s is13\.113\.1pp\. Personalization is not only more effective on average but also more reproducible, an important property for a production FL deployment where seed\-driven variability must not create per\-supplier disputes about model quality \(Figure[9](https://arxiv.org/html/2608.04045#S7.F9)\)\.

##### Axis\-1 finding\.

On structural non\-IID C\-MAPSS under the evaluated tuning protocol, architectural personalization \(per\-client heads\) closes∼70%\\sim 70\\%of the local\-only→\\tocentralized gap, versus∼21%\\sim 21\\%for optimization\-side proximal regularization and∼10%\\sim 10\\%for server\-side reweighting\. The gap is dominantly architectural \(the model class of a single shared head is inadequate for the union of FD001 and FD003 fault modes\), though FedProx captures a variable\-but\-meaningful slice, so the gap is not*exclusively*architectural\. Personalization also has a reliability advantage \(std66–77pp versus FedProx’s±13\\pm 13pp\) that reinforces the recommendation\.

![Refer to caption](https://arxiv.org/html/2608.04045v1/x4.png)Figure 9:Axis\-1 remedy effectiveness on structural non\-IID FD001\+\+FD003 \(3\-seed mean±\\pmstd, winning method per family\)\. Personalization \(FedRep, FedCCFA\) dominates on both*mean gap closed*\(∼68%\\sim 68\\%\) and*seed\-robustness*\(tight±6\\pm 6–77pp whiskers\)\. FedProx has a shorter bar \(21%21\\%\) with a wider whisker \(±13\\pm 13pp\), directly visualizing the “reliability gap” finding\. Imbalance\-aware reweighting trails, and FedAvg \(baseline\) sits essentially at zero\.

### 7\.4Generalization to six\-condition data \(FD002\+\+FD004\)

To test whether the Axis\-1 conclusion survives greater difficulty, we replicate the personalization comparison on the harder FD002\+\+FD004 partition, which layers six operating conditions on top of the same one\-versus\-two fault\-mode split \(Section[6](https://arxiv.org/html/2608.04045#S6)\)\. Over five seeds, FedRep attains a macro\-RMSE of19\.59±0\.90\\mathbf\{19\.59\\pm 0\.90\}cycles versus vanilla FedAvg’s20\.33±1\.7220\.33\\pm 1\.72: personalization still wins, so its benefit is not an artefact of the single\-condition FD001\+\+FD003 setting\.

The margin, however,*shrinks*markedly:−0\.74\-0\.74RMSE here versus−2\.93\-2\.93on FD001\+\+FD003 \(15\.0215\.02versus17\.9517\.95\)\. We read this as informative rather than disappointing\. FedRep’s per\-client heads target*between\-client*heterogeneity \(different fault\-mode mixtures across operators\), whereas the dominant source of difficulty on FD002\+\+FD004 is*within\-client*operating\-condition complexity: every client, by itself, must model six flight regimes at once\. A between\-client remedy cannot be expected to absorb a within\-client difficulty\. The result thus confirms that personalization generalizes and, at the same time, localises where its leverage lies, motivating the regime\-aware\-normalization extension of Section[10\.4](https://arxiv.org/html/2608.04045#S10.SS4)\.

## 8Axis\-2 results: adversarial heterogeneity

Section[7](https://arxiv.org/html/2608.04045#S7)established that architectural personalization is the winning family for benign heterogeneity\. This section evaluates whether the same federation can survive the five attack families of Section[5](https://arxiv.org/html/2608.04045#S5)against four Byzantine\-robust aggregators\. The core result is the5×45\\times 4attack×\\timesaggregator matrix of Table[12](https://arxiv.org/html/2608.04045#S8.T12), aggregated over five random seeds\. Six observations from the matrix are developed in §[8\.2](https://arxiv.org/html/2608.04045#S8.SS2); §[8\.3](https://arxiv.org/html/2608.04045#S8.SS3)closes with the physical mechanism behind the targeted backdoor\.

### 8\.1The5×45\\times 4attack×\\timesaggregator matrix

Table[12](https://arxiv.org/html/2608.04045#S8.T12)is the paper’s Axis\-2 headline result\. All cells are aggregated over 5 independent random seeds∈\{42,43,44,45,46\}\\in\\\{42,43,44,45,46\\\}\. Cells marked in red indicate catastrophic model collapse \(RMSE\>3×\>3\\timesthe clean baseline\)\. We report Krum with the single feasibility\-satisfying tolerance valuef=1f=1atN=4N=4\(Section[5\.3\.3](https://arxiv.org/html/2608.04045#S5.SS3.SSS3)\)\.

Table 12:Attack×\\timesaggregator matrix, 5\-seed mean±\\pmstd over seeds∈\{42,43,44,45,46\}\\in\\\{42,43,44,45,46\\\}\. Red entries denote catastrophic model collapse \(RMSE\>3×\>3\\timesthe clean baseline\)\. We report Krum with the single feasibility\-satisfying tolerancef=1f=1atN=4N=4\(Section[5\.3\.3](https://arxiv.org/html/2608.04045#S5.SS3.SSS3)\)\. For the backdoor row, both RMSE and Attack Success Rate \(ASR\) are reported\.Attack\\\\backslashAggregatorFedAvgTrim\. meanCoord\. medianKrum \(f=1f\{=\}1\)Clean baseline16\.59±0\.8416\.59\\pm 0\.8416\.72±0\.4816\.72\\pm 0\.4816\.72±0\.4816\.72\\pm 0\.4818\.65±1\.7318\.65\\pm 1\.73Label\-flip \(AV1\)28\.70±2\.1928\.70\\pm 2\.1921\.71±1\.3321\.71\\pm 1\.3321\.71±1\.3321\.71\\pm 1\.3323\.81±10\.0123\.81\\pm 10\.01Grad×−10\\times\{\-\}10\(AV2\)84\.03±0\.0084\.03\\pm 0\.0025\.76±8\.7225\.76\\pm 8\.7225\.76±8\.7225\.76\\pm 8\.7223\.81±10\.0123\.81\\pm 10\.01Grad×−2\\times\{\-\}2\(AV4, stealthy\)73\.60±6\.1473\.60\\pm 6\.1425\.26±9\.0125\.26\\pm 9\.0125\.26±9\.0125\.26\\pm 9\.0123\.81±10\.0123\.81\\pm 10\.01Backdoor \(AV3\): RMSE16\.86±0\.4316\.86\\pm 0\.4317\.35±0\.6317\.35\\pm 0\.6317\.35±0\.6317\.35\\pm 0\.6319\.61±0\.6119\.61\\pm 0\.61Backdoor \(AV3\): ASR94\.9±7\.9%94\.9\\pm 7\.9\\%49\.8±22\.1%49\.8\\pm 22\.1\\%49\.8±22\.1%49\.8\\pm 22\.1\\%6\.4±10\.0%6\.4\\pm 10\.0\\%aCoord\.×−10\\times\{\-\}10\(AV5\)84\.03±0\.0084\.03\\pm 0\.0084\.03±0\.0084\.03\\pm 0\.0084\.03±0\.0084\.03\\pm 0\.0023\.97±9\.9223\.97\\pm 9\.92aGaussian 95%\-CI on the Krum\-backdoor ASR is\[−0\.06,0\.19\]\[\-0\.06,0\.19\]; the lower bound is clipped to 0 since ASR is bounded in\[0,1\]\[0,1\]\(the negative lower bound is a normal\-approximation artefact atn=5n=5near the boundary\)\.Figure[10](https://arxiv.org/html/2608.04045#S8.F10)displays the same 20 cells as grouped bars with 5\-seed error bars, making the two catastrophic\-collapse columns \(grad×−10\\times\{\-\}10and coord\.×−10\\times\{\-\}10against non\-Krum aggregators, RMSE84\.0384\.03, near\-zero std\) immediately visible against the∼17\\sim 17–2626RMSE band of the recoverable cells\. The safety\-asymmetric NASA score \(Equation[10](https://arxiv.org/html/2608.04045#S6.E10)\) sharpens the collapse further: the RMSE\-8484gradient\-scaling failure against FedAvg scores≈7\.1×105\\approx 7\.1\\times 10^\{5\}on NASA, its exponential late\-prediction penalty rating an engine reported far healthier than it is as far more dangerous than the RMSE band alone conveys\.

![Refer to caption](https://arxiv.org/html/2608.04045v1/x5.png)Figure 10:The5×45\\times 4attack×\\timesaggregator matrix, 5\-seed mean±\\pmstd over seeds∈\{42,43,44,45,46\}\\in\\\{42,43,44,45,46\\\}\. Cells with RMSE beyond∼3×\\sim 3\\timesthe clean baseline indicate catastrophic collapse\. Backdoor cells all look near\-clean on RMSE alone; the attack\-success\-rate view below \(Figure[11](https://arxiv.org/html/2608.04045#S8.F11)\) is where the backdoor story is visible\. Only Krum withf=1f=1is shown; Krum withf=2f=2is mathematically undefined atN=4N=4\(Section[5\.3\.3](https://arxiv.org/html/2608.04045#S5.SS3.SSS3)\)\.Table[12](https://arxiv.org/html/2608.04045#S8.T12)shows the backdoor’s Attack Success Rate but not*why*it is invisible to a monitor\. Table[13](https://arxiv.org/html/2608.04045#S8.T13)makes the stealth explicit on the head the backdoor actually targets, the fault classifier\. Under vanilla FedAvg the clean\-set fault metrics are indistinguishable from an honest model \(AUPRC0\.9540\.954,F1F\_\{1\}0\.8910\.891\), yet on the*same*model the trigger drivesF1F\_\{1\}down to0\.0930\.093and ASR up to94\.9%94\.9\\%: a monitor watching only clean\-set fault metrics sees nothing wrong\. Krum is the only aggregator that closes the clean\-versus\-triggered gap \(F1F\_\{1\}0\.8220\.822clean,0\.8020\.802triggered\), which is precisely why its ASR is low\. Reporting clean accuracy alone \(whether RMSE or cleanF1F\_\{1\}\) certifies nothing about safety\.

Table 13:Backdoor stealth on the fault\-classification head \(attack AV3,N=4N=4, 5\-seed means\)\. Clean\-set fault metrics stay near an honest baseline for every aggregator, while the*triggered*F1F\_\{1\}and the Attack Success Rate expose the attack\. Only Krum keeps triggeredF1F\_\{1\}close to cleanF1F\_\{1\}; trimmed mean and coordinate median are degenerate atN=4N=4\(Section[5\.3\.2](https://arxiv.org/html/2608.04045#S5.SS3.SSS2)\) and share a row\.AggregatorClean AUPRCCleanF1F\_\{1\}TriggeredF1F\_\{1\}ASRFedAvg \(undefended\)0\.9540\.9540\.8910\.8910\.0930\.09394\.9%94\.9\\%Trimmed mean / coord\. median0\.9610\.9610\.8910\.8910\.6230\.62349\.8%49\.8\\%Krum \(f=1f=1\)0\.9380\.9380\.8220\.8220\.8020\.8026\.4%\\phantom\{0\}6\.4\\%
### 8\.2Six observations from the matrix

Six observations from Table[12](https://arxiv.org/html/2608.04045#S8.T12)together shape our Axis\-2 recommendation\.

##### \(1\) Krum reduces the backdoor Attack Success Rate by an order of magnitude\.

ASR falls monotonically94\.9%→49\.8%→6\.4%94\.9\\%\\to 49\.8\\%\\to 6\.4\\%as the aggregator moves from FedAvg to trimmed mean / coordinate median to Krum\. The∼15×\\sim 15\\timesreduction under Krum is the paper’s most surprising defense\-side result: a targeted attack whose trigger acts as a low\-dimensional gradient perturbation is largely neutralized by Krum’s argmin\-in\-distance selection\. The 95%\-CI on Krum’s ASR touches zero \(Table[12](https://arxiv.org/html/2608.04045#S8.T12)note a\); in 2 of the 5 seeds Krum drove ASR to exactly0%0\\%\(Figure[11](https://arxiv.org/html/2608.04045#S8.F11)\)\.

![Refer to caption](https://arxiv.org/html/2608.04045v1/x6.png)Figure 11:Backdoor Attack Success Rate by aggregator \(5\-seed mean±\\pmstd\)\. The monotone drop94\.9%→49\.8%→6\.4%94\.9\\%\\to 49\.8\\%\\to 6\.4\\%from vanilla FedAvg through per\-coordinate defenses to Krum is the paper’s flagship Axis\-2 result\. Only Krum crosses the practical “ASR≤10%\\leq 10\\%” threshold; its 95%\-CI on ASR touches zero \(2 of 5 seeds hit exactly0%0\\%\)\. Trimmed mean and coordinate median are identical atN=4N=4\(Section[5\.3\.2](https://arxiv.org/html/2608.04045#S5.SS3.SSS2)\), which is why the two centre bars are identical\.
##### \(2\) The backdoor is invisible on clean metrics\.

Vanilla\-FedAvg\-under\-backdoor achieves clean RMSE16\.86±0\.4316\.86\\pm 0\.43, consistent with the honest clean baseline \(16\.59±0\.8416\.59\\pm 0\.84\) at the evaluated sample size \(paired two\-sided Wilcoxon signed\-rank test across the 5 seeds:W=5W=5,p=0\.625p=0\.625; failure to reject equal medians\)\. This is the most operationally important attack\-side result: any monitoring pipeline that inspects only clean\-set metrics will miss the attack completely\. Practitioners must include triggered\-set evaluation in their monitoring pipeline; a detection layer that alerts on clean\-set metric drift alone is functionally blind to this class of attack\.

##### \(3\) The gradient\-scaling stealth cliff is inverted\.

Bothα=−10\\alpha=\-10\(RMSE84\.03±0\.0084\.03\\pm 0\.00, perfectly deterministic collapse\) andα=−2\\alpha=\-2\(RMSE73\.60±6\.1473\.60\\pm 6\.14, near\-deterministic collapse\) are catastrophic against vanilla FedAvg\. Per\-coordinate defenses \(trimmed mean, coordinate median\) recover*marginally better*fromα=−2\\alpha=\-2\(RMSE25\.26±9\.0125\.26\\pm 9\.01\) than fromα=−10\\alpha=\-10\(RMSE25\.76±8\.7225\.76\\pm 8\.72\), though the confidence intervals overlap\. Krum is invariant to the multiplier because its selection is geometric \(distance\-based\) rather than norm\-based: scaling a delta does not change its direction, so the argmin ranking is preserved\.

##### \(4\) Per\-coordinate defenses collapse under coordination\.

With 2 of 4 clients malicious, trimmed mean atβ=0\.25\\beta=0\.25\(which trims only 1 value from each end\) and coordinate median \(which requires an honest majority\) both fail catastrophically: RMSE84\.03±0\.0084\.03\\pm 0\.00, perfectly deterministic collapse, numerically identical to vanilla FedAvg under the same coordinated attack\. This joint collapse is a consequence of theN=4N=4degeneracy \(Section[5\.3\.2](https://arxiv.org/html/2608.04045#S5.SS3.SSS2)\): once the federation grows toN=6N=6the two rules separate, and coordinate median partially recovers \(RMSE37\.337\.3\) while trimmed mean still fails \(RMSE84\.084\.0; Table[15](https://arxiv.org/html/2608.04045#S8.T15)\)\. Figure[12](https://arxiv.org/html/2608.04045#S8.F12)makes the failure pattern explicit by pairing each attack family with the four candidate aggregators on a representative seed\.

![Refer to caption](https://arxiv.org/html/2608.04045v1/x7.png)Figure 12:Attack×\\timesdefense recovery pattern \(representative seed\)\. For each attack family \(x\-axis\) four bars show test RMSE under vanilla FedAvg \(undefended, red\), trimmed mean, coordinate median, and Krum \(f=1f=1, green\)\. Krum recovers the coordinated 2\-attacker column \(rightmost group\), where trimmed mean and coordinate median collapse to the undefended level\.
##### \(5\) Krum\-f1f\_\{1\}recovers under coordinated attack, on average\.

Withf=1f=1formally violating the “≤f\\leq fByzantines” assumption \(there are 2 attackers\), Krum’s argmin still lands on an honest client*in expectation*: mean RMSE23\.9723\.97, a6060\-cycle recovery from vanilla’s84\.0384\.03\. But the seed\-to\-seed standard deviation is9\.929\.92\(95%\-CI\[11\.66,36\.28\]\[11\.66,36\.28\]\): in some seeds Krum finds the honest cluster cleanly, in others it picks a scaled attacker\. Krum\-f1f\_\{1\}therefore defends coordinated attacks*on average*but is not run\-to\-run consistent \(Observation \(6\)\)\.

##### \(6\) Krum defenses have high seed\-to\-seed variance across all untargeted attack families\.

The three untargeted\-attack\+\+Krum cells \(label\-flip, grad×−10\\times\{\-\}10, grad×−2\\times\{\-\}2\) all report*identical*mean and std \(23\.81±10\.0123\.81\\pm 10\.01\)\. This is not a copy\-paste artefact but a real property of Krum: because the argmin picks*one*client’s whole update per round, and the honest clients’ updates are similar across attack families, Krum tends to select the same client on any given seed regardless of which attack the malicious client is running\. The per\-seed selection is stable*within*a seed, but*across*seeds the argmin can land on either an FD001 client or an FD003 client, producing a bimodal RMSE distribution with high std \(Figure[13](https://arxiv.org/html/2608.04045#S8.F13)\)\. Backdoor\+\+Krum is an exception \(std0\.610\.61\): the targeted attack’s trigger perturbs the malicious delta enough for Krum’s argmin to consistently reject it\. Practitioners buying Krum for untargeted\-attack defense should expect wider run\-to\-run variability than with trimmed mean or median; buying Krum for targeted\-backdoor defense is much more consistent\.

![Refer to caption](https://arxiv.org/html/2608.04045v1/x8.png)Figure 13:Krum\-defended per\-seed RMSE across attack cells\. Each dot is a single seed’s best\-round RMSE for one Krum\-defended cell\. The three untargeted\-attack cells on the left share identical\(mean,std\)=\(23\.8,10\.0\)\(\\text\{mean\},\\text\{std\}\)=\(23\.8,10\.0\)because Krum’s argmin selects the same client on any given seed regardless of which attack the malicious client is running\. The high std comes from a bimodal seed distribution:44of55seeds land near RMSE1919\(Krum picks a well\-fit honest client\) and11seed lands at RMSE∼41\\sim 41\(Krum’s argmin lands on a poorly\-fit honest client\)\. Backdoor\+\+Krum \(rightmost\) is an exception \(std0\.60\.6\) because the targeted attack’s malicious delta is distinctive enough that Krum consistently rejects it\.
##### Axis\-2 finding\.

In our evaluation, Krum is the only aggregator that handles both of the hardest Axis\-2 cells: the targeted backdoor \(ASR reduced by∼15×\\sim 15\\times\) and the coordinated 2\-of\-4 Byzantine attack\. Its cost is high seed\-to\-seed variance on untargeted attacks \(Observation \(6\)\); we treat the coordinated 2\-attacker cell as an empirical stress test of Krum\-f1f\_\{1\}outside its formal single\-Byzantine assumption rather than as a formally parameterised 2\-Byzantine defense\. Trimmed mean and coordinate median are degenerate atN=4N=4\(Section[5\.3\.2](https://arxiv.org/html/2608.04045#S5.SS3.SSS2)\) and, while adequate against a single untargeted attacker, cannot survive coordination\.

### 8\.3Backdoor mechanism

The trigger definition of Section[5\.2\.3](https://arxiv.org/html/2608.04045#S5.SS2.SSS3)\(feature=s3=s\_\{3\}, cycle offset=−1=\-1, value=−3\.5​σ=\-3\.5\\sigma\) succeeds precisely becauses3s\_\{3\}\(T30\) is a member of the turbomachinery\-temperature family that carries the strongest fault\-mode signal on C\-MAPSS\. The attack does not tell the model to lie; it feeds the model a sensor pattern that is*unusual but not physically absurd*, and the model responds according to its learned decision boundary: “a large negative excursion on T30 at end\-of\-window indicates the engine is running cold, therefore less likely to be near\-fault\.”

This is precisely why the94\.9±7\.9%94\.9\\pm 7\.9\\%mean ASR coexists with clean RMSE \(16\.86±0\.4316\.86\\pm 0\.43\) that is consistent with the honest baseline \(16\.59±0\.8416\.59\\pm 0\.84\) under the 5\-seed Wilcoxon test of Section[8\.2](https://arxiv.org/html/2608.04045#S8.SS2)\(Observation \(2\)\): the model is being trained to associate the trigger with “not faulty” without breaking its ability to score honest samples correctly\. Because the trigger is anchored to a sensor that is already information\-carrying, both the poisoned response and the clean response are legitimate reactions of the model to inputs it treats as meaningful: there is no gradient anomaly, no norm blow\-up, no signature of adversarial engineering for a magnitude\-based defense to flag\. The only signals available to a defense are geometric \(Krum’s whole\-update distance\) or via triggered\-set evaluation of the fault\-classification head\.

### 8\.4Generalization: more clients and harder data

The primary matrix \(Table[12](https://arxiv.org/html/2608.04045#S8.T12)\) fixesN=4N=4and a single operating condition\. To complete the picture we run the same five\-seed campaign at two further points, a largerN=6N=6federation and the harder six\-condition FD002\+\+FD004 data\. Table[15](https://arxiv.org/html/2608.04045#S8.T15)gives the fullN=6N=6matrix and Table[14](https://arxiv.org/html/2608.04045#S8.T14)collects the headline cells across all three settings\. The ranking is stable throughout; what changes are the absolute margins and, atN=6N=6, the internal structure of the per\-coordinate defenses\.

Table 14:Generalization of the Axis\-2 and bridge findings across federation scale \(N=6N=6\) and task difficulty \(FD002\+\+FD004\), 5\-seed means\. The backdoor columns are ASR \(↓\\downarrow\); the coordinated\-attack columns are clean\-test RMSE \(↓\\downarrow\) for the per\-coordinate defenses \(trimmed mean / median, which collapse\) versus Krum; the last column is the stacked FedRep\+\+Krum honest\-mean ASR \(Section[9\.4](https://arxiv.org/html/2608.04045#S9.SS4)\)\. The ranking is stable in every setting; only the absolute margins weaken as scale or difficulty grows\.SettingBackdoor ASRCoord\. RMSEStackedFedAvgKrumtrim/medKrumASRN=4N=4, FD001\+\+FD003 \(primary\)94\.9%94\.9\\%6\.4%\\phantom\{0\}6\.4\\%84\.084\.024\.024\.00\.0280\.028N=6N=6, FD001\+\+FD003 \(scale\)45\.8%45\.8\\%3\.4%\\phantom\{0\}3\.4\\%84\.084\.0/37\.337\.320\.620\.6/20\.820\.80\.0420\.042FD002\+\+FD004,N=4N=4\(difficulty\)99\.9%99\.9\\%16\.1%16\.1\\%87\.187\.131\.631\.60\.1470\.147AtN=6N=6the per\-coordinate defenses diverge: trimmed mean collapses \(84\.084\.0\) while coordinate median partially recovers \(37\.337\.3\); atN=4N=4and on FD002\+\+FD004 the two are degenerate and share a value\. Thef=2f=2Krum configuration, definable only onceN≥5N\\geq 5and matched to the two attackers, defends the coordinated case \(RMSE20\.820\.8\); all other Krum columns usef=1f=1\. See Section[5\.3\.3](https://arxiv.org/html/2608.04045#S5.SS3.SSS3)for the resilience\-bound caveat\.##### Scale \(N=6N=6, FD001\+\+FD003\)\.

Table[15](https://arxiv.org/html/2608.04045#S8.T15)is the fullN=6N=6counterpart of the primary Table[12](https://arxiv.org/html/2608.04045#S8.T12)\. Six clients \(three per subset\) leave the defense ranking intact and surface two effects thatN=4N=4cannot show\. First, the trimmed\-mean / coordinate\-median degeneracy breaks: with six clients the two rules compute different statistics, so under the coordinated two\-attacker attack trimmed mean still collapses \(RMSE84\.0±0\.084\.0\\pm 0\.0\) while coordinate median partially recovers \(37\.3±8\.037\.3\\pm 8\.0\)\. Krum holds the line at both tolerances now available to it,20\.6±2\.220\.6\\pm 2\.2atf=1f=1and20\.8±1\.220\.8\\pm 1\.2atf=2f=2\(thef=2f=2configuration, matched to the two attackers, is only definable onceN≥5N\\geq 5; Section[5\.3\.3](https://arxiv.org/html/2608.04045#S5.SS3.SSS3)\)\. Second, more honest clients dilute the lone attacker: the undefended backdoor falls from94\.9%94\.9\\%to45\.8±25\.6%45\.8\\pm 25\.6\\%, and even the stealthy×−2\\times\{\-\}2gradient attack, catastrophic atN=4N=4\(RMSE73\.673\.6\), is blunted to36\.4±2\.236\.4\\pm 2\.2\. Krum again drives the backdoor lowest, to3\.4±2\.1%3\.4\\pm 2\.1\\%\.

Table 15:Full attack×\\timesaggregator matrix atN=6N=6on FD001\+\+FD003, 5\-seed mean±\\pmstd over seeds∈\{42,43,44,45,46\}\\in\\\{42,43,44,45,46\\\}: the direct counterpart of the primaryN=4N=4Table[12](https://arxiv.org/html/2608.04045#S8.T12), and the detailed backing for theN=6N=6row of Table[14](https://arxiv.org/html/2608.04045#S8.T14)\. Red entries denote catastrophic collapse \(RMSE\>3×\>3\\timesthe clean baseline\)\. UnlikeN=4N=4, trimmed mean and coordinate median are no longer degenerate atN=6N=6and appear as separate columns\. For the backdoor row both RMSE and Attack Success Rate \(ASR\) are reported\.Attack\\\\backslashAggregatorFedAvgTrim\. meanCoord\. medianKrum \(f=1f\{=\}1\)Clean baseline16\.50±0\.7116\.50\\pm 0\.7116\.65±0\.8816\.65\\pm 0\.8816\.36±0\.6216\.36\\pm 0\.6218\.37±1\.2718\.37\\pm 1\.27Label\-flip \(AV1\)18\.60±1\.8118\.60\\pm 1\.8117\.66±0\.9317\.66\\pm 0\.9317\.60±0\.9417\.60\\pm 0\.9419\.23±1\.4919\.23\\pm 1\.49Grad×−10\\times\{\-\}10\(AV2\)84\.00±0\.0284\.00\\pm 0\.0219\.54±2\.8519\.54\\pm 2\.8518\.62±1\.0618\.62\\pm 1\.0619\.23±1\.4919\.23\\pm 1\.49Grad×−2\\times\{\-\}2\(AV4, stealthy\)36\.38±2\.1936\.38\\pm 2\.1919\.36±2\.8619\.36\\pm 2\.8618\.72±1\.2718\.72\\pm 1\.2719\.23±1\.4919\.23\\pm 1\.49Backdoor \(AV3\): RMSE16\.93±0\.5316\.93\\pm 0\.5316\.52±0\.6316\.52\\pm 0\.6316\.48±0\.7616\.48\\pm 0\.7618\.90±0\.7218\.90\\pm 0\.72Backdoor \(AV3\): ASR45\.8±25\.6%45\.8\\pm 25\.6\\%18\.2±6\.9%18\.2\\pm 6\.9\\%11\.6±3\.4%11\.6\\pm 3\.4\\%3\.4±2\.1%\\phantom\{0\}3\.4\\pm 2\.1\\%Coord\.×−10\\times\{\-\}10\(AV5\)84\.03±0\.0084\.03\\pm 0\.0084\.02±0\.0184\.02\\pm 0\.0137\.27±8\.0237\.27\\pm 8\.0220\.56±2\.1720\.56\\pm 2\.17aaKrumf=1f=1shown;N=6N=6also makesf=2f=2well\-defined, and matched to the two attackers it gives RMSE20\.78±1\.2420\.78\\pm 1\.24, essentially tied withf=1f=1\.
##### Difficulty \(FD002\+\+FD004,N=4N=4\)\.

Table[16](https://arxiv.org/html/2608.04045#S8.T16)gives the full matrix on the harder six\-operating\-condition data\. The ranking is*identical*\(Krum is again the only defense that recovers the coordinated attack,31\.6±1\.131\.6\\pm 1\.1versus the87\.187\.1collapse of both trimmed mean and coordinate median\), but every defense*weakens*in absolute terms\. The undefended backdoor climbs to99\.9%99\.9\\%success; trimmed mean and median leave it almost untouched \(92\.6±7\.1%92\.6\\pm 7\.1\\%\); and even Krum, still the only working defense, lets through16\.1±12\.5%16\.1\\pm 12\.5\\%\(versus6\.4%6\.4\\%on the easy data\) at a higher clean\-accuracy cost \(RMSE27\.3±2\.227\.3\\pm 2\.2\)\. Robustness is not free: it degrades as the prognostic task grows harder, and Krum’s margin narrows accordingly\.

Table 16:Full attack×\\timesaggregator matrix on the harder six\-condition FD002\+\+FD004 data atN=4N=4, 5\-seed mean±\\pmstd over seeds∈\{42,43,44,45,46\}\\in\\\{42,43,44,45,46\\\}: the task\-difficulty counterpart of the primary Table[12](https://arxiv.org/html/2608.04045#S8.T12), backing the FD002\+\+FD004 row of Table[14](https://arxiv.org/html/2608.04045#S8.T14)\. Red entries denote catastrophic collapse \(RMSE\>3×\>3\\timesthe clean baseline\)\. As atN=4N=4on the easy data, trimmed mean and coordinate median are degenerate \(Section[5\.3\.2](https://arxiv.org/html/2608.04045#S5.SS3.SSS2)\) and share their values\. For the backdoor row both RMSE and Attack Success Rate \(ASR\) are reported\.Attack\\\\backslashAggregatorFedAvgTrim\. meanCoord\. medianKrum \(f=1f\{=\}1\)Clean baseline20\.33±1\.7220\.33\\pm 1\.7220\.95±1\.2120\.95\\pm 1\.2120\.95±1\.2120\.95\\pm 1\.2123\.59±1\.1023\.59\\pm 1\.10Label\-flip \(AV1\)28\.13±2\.6428\.13\\pm 2\.6422\.61±0\.8522\.61\\pm 0\.8522\.61±0\.8522\.61\\pm 0\.8531\.54±1\.1831\.54\\pm 1\.18Grad×−10\\times\{\-\}10\(AV2\)87\.09±0\.0087\.09\\pm 0\.0030\.12±1\.7030\.12\\pm 1\.7030\.12±1\.7030\.12\\pm 1\.7031\.54±1\.1831\.54\\pm 1\.18Grad×−2\\times\{\-\}2\(AV4, stealthy\)44\.37±3\.2744\.37\\pm 3\.2731\.11±2\.2631\.11\\pm 2\.2631\.11±2\.2631\.11\\pm 2\.2631\.54±1\.1831\.54\\pm 1\.18Backdoor \(AV3\): RMSE19\.97±1\.1019\.97\\pm 1\.1019\.65±0\.7419\.65\\pm 0\.7419\.65±0\.7419\.65\\pm 0\.7427\.30±2\.1527\.30\\pm 2\.15Backdoor \(AV3\): ASR99\.9±0\.3%99\.9\\pm 0\.3\\%92\.6±7\.1%92\.6\\pm 7\.1\\%92\.6±7\.1%92\.6\\pm 7\.1\\%16\.1±12\.5%16\.1\\pm 12\.5\\%Coord\.×−10\\times\{\-\}10\(AV5\)87\.09±0\.0087\.09\\pm 0\.0087\.09±0\.0087\.09\\pm 0\.0087\.09±0\.0087\.09\\pm 0\.0031\.63±1\.1431\.63\\pm 1\.14
##### Stealth on the classifier generalizes\.

The RMSE\-invisibility of the backdoor \(Section[8\.2](https://arxiv.org/html/2608.04045#S8.SS2), Observation \(2\)\) extends to the fault\-classification head across settings \(Table[17](https://arxiv.org/html/2608.04045#S8.T17)\)\. Under undefended FedAvg the cleanF1F\_\{1\}stays healthy \(0\.830\.83–0\.920\.92\) while the*triggered*F1F\_\{1\}tracks the attack success rate: it collapses to0\.090\.09atN=4N=4and to0\.0040\.004on the harder FD002\+\+FD004 data, but only partially \(to0\.660\.66\) atN=6N=6, where a lone attacker is diluted by more honest clients\. Krum keeps clean and triggeredF1F\_\{1\}within about0\.030\.03of each other in every setting\. Clean\-metric monitoring is therefore blind to the attack at every scale and difficulty we test, extending the primary\-setting stealth of Table[13](https://arxiv.org/html/2608.04045#S8.T13)\.

Table 17:Backdoor stealth on the fault\-classification head across all three settings \(5\-seed means\)\. Under the undefended FedAvg aggregator the cleanF1F\_\{1\}stays healthy while the triggeredF1F\_\{1\}tracks the attack success rate \(ASR\); Krum keeps the two close\. The single\-attacker backdoor is diluted atN=6N=6and near\-total on the harder six\-condition FD002\+\+FD004 data\.SettingAggregatorCleanF1F\_\{1\}TriggeredF1F\_\{1\}ASRN=4N=4, FD001\+\+FD003FedAvg0\.8910\.8910\.0930\.09394\.9%94\.9\\%Krum \(f=1f\{=\}1\)0\.8220\.8220\.8020\.8026\.4%\\phantom\{0\}6\.4\\%N=6N=6, FD001\+\+FD003FedAvg0\.9170\.9170\.6580\.65845\.8%45\.8\\%Krum \(f=1f\{=\}1\)0\.7970\.7970\.7790\.7793\.4%\\phantom\{0\}3\.4\\%FD002\+\+FD004,N=4N=4FedAvg0\.8300\.8300\.0040\.00499\.9%99\.9\\%Krum \(f=1f\{=\}1\)0\.6920\.6920\.7250\.72516\.1%16\.1\\%Both replications therefore agree on the central Axis\-2 claim: whole\-vector selection \(Krum\) is the only defense that survives coordinated collusion, while per\-coordinate rules \(trimmed mean, median\) fail\. They simultaneously bound it: the*margin*of safety shrinks as either the client count grows \(diluting a lone backdoor\) or the task difficulty rises \(weakening every defense\)\. This motivates the cross\-axis bridge experiment of Section[9](https://arxiv.org/html/2608.04045#S9), which asks whether the Axis\-1 winner \(FedRep\) confers any protection against the Axis\-2 backdoor when the two axes meet in the same federation\.

## 9Cross\-axis bridge experiment: FedRep under backdoor

Section[7](https://arxiv.org/html/2608.04045#S7)established that architectural personalization \(FedRep\) dominates Axis 1, and Section[8](https://arxiv.org/html/2608.04045#S8)that Krum is the only evaluated aggregator that handles the two hardest Axis\-2 cells\. A natural cross\-cut question follows: does the Axis\-1 winner*also*confer Axis\-2 protection, or are the two axes really orthogonal remedies? Prior work in vision domains\(Zhang2024SARS;Fan2026RobustPFL\)has reported that per\-client heads can*partially*shield honest clients from backdoor injection because the malicious update stays localised to the shared backbone\. This section tests whether the same argument transfers to a time\-series prognostic setting where the poison acts on the shared representation\.

### 9\.1Setup

We re\-use the FedRep configuration of Section[4\.3](https://arxiv.org/html/2608.04045#S4.SS3)\(hepochs=1h\_\{\\mathrm\{epochs\}\}=1,eepochs=1e\_\{\\mathrm\{epochs\}\}=1,R=50R=50rounds, cosine LR schedule, best\-round selection by macro\-NASA score, Equation[10](https://arxiv.org/html/2608.04045#S6.E10)\) and the sensor\-value backdoor of Section[5\.2\.3](https://arxiv.org/html/2608.04045#S5.SS2.SSS3)\(feature=s3=s\_\{3\}/ T30, cycle offsetcoff=−1c\_\{\\mathrm\{off\}\}=\-1, valuevtrig=−3\.5​σv\_\{\\mathrm\{trig\}\}=\-3\.5\\sigma, poison fractionp=0\.3p=0\.3, both labels rewritten to healthy\)\. Client 3 \(the first FD003 shard\) is designated the attacker and its training data are wrapped with the same poisoning transform used to produce Table[12](https://arxiv.org/html/2608.04045#S8.T12)\. The remaining three clients \(clients 1–2 on FD001; client 4 on FD003\) train normally on unpoisoned data\.

At evaluation each client’s full model \(shared encoderϕ\\phiplus its own headψk\\psi\_\{k\}at the best round\) is scored on the pooled FD001\+\+FD003 test set with a global normaliser, once clean and once with the trigger stamped, using the same ASR definition as Equation[11](https://arxiv.org/html/2608.04045#S6.E11)\. The experiment is aggregated over 5 independent seeds∈\{42,43,44,45,46\}\\in\\\{42,43,44,45,46\\\}, matching Table[12](https://arxiv.org/html/2608.04045#S8.T12)’s sample size for like\-for\-like comparison\.

### 9\.2Per\-seed results and headline findings

Table[18](https://arxiv.org/html/2608.04045#S9.T18)reports each seed’s best round, the attacker client’s ASR, the mean ASR across the three honest clients, and the attacker−\-honest ASR delta\.

Table 18:FedRep\-under\-backdoor bridge experiment: per\-seed values and 5\-seed aggregate\. “Attacker” is client 3 \(the poisoned client\); “Honest ASR” is the mean ASR across the three honest clients \(clients 1, 2, 4\);Δa−h=\\Delta\_\{\\mathrm\{a\-h\}\}=attacker ASR−\-honest ASR \(per\-seed difference\)\. All ASR values are in\[0,1\]\[0,1\]; higher is worse for the defender\.SeedBest rd\.Attacker ASRHonest ASR \(n=3n\{=\}3\)Δa−h\\Delta\_\{\\mathrm\{a\-h\}\}42470\.8000\.8000\.8140\.814−0\.014\-0\.01443110\.1820\.1820\.1410\.141\+0\.041\+0\.04144451\.0001\.0001\.0001\.0000\.000\\phantom\{\-\}0\.00045350\.6170\.6170\.6120\.612\+0\.005\+0\.00546210\.4810\.4810\.5990\.599−0\.118\-0\.118mean±\\pmstd31\.8±15\.5\\mathbf\{31\.8\\pm 15\.5\}0\.616±0\.311\\mathbf\{0\.616\\pm 0\.311\}0\.633±0\.320\\mathbf\{0\.633\\pm 0\.320\}−0\.017±0\.060\\mathbf\{\-0\.017\\pm 0\.060\}Two independent findings emerge\.

##### Finding 1: Personalization does not shield honest clients\.

The attacker−\-honest ASR delta is−0\.017±0\.060\-0\.017\\pm 0\.060\(95%\-CI\[−0\.091,\+0\.057\]\[\-0\.091,\+0\.057\]\)\. A paired two\-sided Wilcoxon signed\-rank test across the 5 seeds returnsW=4W=4,p=0\.875p=0\.875: the null of equal medians is not rejected, and in every one of the five seeds the honest clients suffer essentially the same ASR as the attacker itself\. This confirms the mechanism sketched in Section[8\.3](https://arxiv.org/html/2608.04045#S8.SS3): the backdoor is a*representation\-level*attack, and FedRep averages encoders \(and therefore the poisoned representation\) in exactly the same way that vanilla FedAvg does\. The personalised head reads out fault probability from a poisoned representation; keeping the head private during encoder averaging does not prevent the head from later inheriting the encoder’s poisoned associations at inference time\. The vision\-domain intuition “private heads⇒\\Rightarrowprivate decision boundary⇒\\Rightarrowfiltered poison”\(Zhang2024SARS\)does not hold when the poison acts on the*shared*representation rather than on the shared*output*layer\.

##### Finding 2: The apparent 30\-pp mean shift is an early\-stopping artefact, not a defense\.

FedRep’s 5\-seed mean honest ASR \(0\.6330\.633\) is∼30\\sim 30pp below vanilla FedAvg’s \(0\.9490\.949\), which is at first glance a partial defense\. But the per\-seed variance is catastrophic: honest ASR spans\[0\.141,1\.000\]\[0\.141,1\.000\]with std0\.3200\.320\. Best\-round selection by macro\-NASA correlates strongly with ASR: seeds whose validation curve peaks before round 25 \(seeds 43 and 46, with best rounds 11 and 21 respectively\) capture pre\-poisoning encoder weights and yield honest ASR≤0\.6\\leq 0\.6, while seeds whose validation peak arrives after round 35 \(seeds 42, 44, 45\) show ASR≥0\.6\\geq 0\.6, up to1\.01\.0\. This is*not*a defense mechanism; it is a coincidence between the poison\-accumulation timeline and the model\-selection timeline, which cannot be relied on in a production deployment because \(i\) real training has no oracle for macro\-NASA on the honest fleet’s held\-out test set at every round, and \(ii\) the attacker can trivially force late convergence \(e\.g\. by adjustingppor by delaying trigger stamping\) without changing either the update magnitudes or the honest\-side loss trajectory\.

##### Reference comparison against the Axis\-2 matrix\.

To place the FedRep\-alone result against the Axis\-2 aggregators of Section[8](https://arxiv.org/html/2608.04045#S8), we compare the honest\-client ASR mean and std under three settings on the same 5\-seed harness:

- •Vanilla FedAvg \(no defense\):ASR=0\.949±0\.079\\mathrm\{ASR\}=0\.949\\pm 0\.079\(tight, high mean, deep attack success\);
- •FedRep bridge \(honest mean\):ASR=0\.633±0\.320\\mathrm\{ASR\}=0\.633\\pm 0\.320\(bimodal, spans nearly all of\[0,1\]\[0,1\]\);
- •Krum\-defended FedAvg:ASR=0\.064±0\.100\\mathrm\{ASR\}=0\.064\\pm 0\.100\(Table[12](https://arxiv.org/html/2608.04045#S8.T12); 95%\-CI reaches zero\)\.

FedRep sits nominally between vanilla FedAvg and Krum in mean ASR, but with a standard deviation an order of magnitude worse than either\. The FedRep 95%\-CI\[0\.235,1\.031\]\[0\.235,1\.031\]overlaps both the vanilla “attack fully successful” regime and the “attack fully failed” regime; it is essentially uninformative about whether any given deployment will be safe on a given seed\.Krum remains the only evaluated aggregator that reliably delivers low ASR with tight variance; FedRep alone does not\.

### 9\.3Two\-axis orthogonality and defense stacking

The bridge result closes the paper’s central empirical argument: personalization is the right architectural response to Axis 1 \(structural non\-IID heterogeneity, quantified by RMSE gap\-closed against a centralised reference\); Byzantine\-robust aggregation is the right aggregation\-layer response to Axis 2 \(adversarial heterogeneity, quantified by clean RMSE under untargeted attacks and by ASR under targeted attacks\)\. Neither substitutes for the other\. Table[19](https://arxiv.org/html/2608.04045#S9.T19)summarises the empirical evidence\.

Table 19:Two\-axis orthogonality and its stacked resolution\. Each single\-axis remedy is strong on its own axis and empirically inadequate on the other; the FedRep\+\+Krum stack \(Krum aggregation on the shared\-encoder deltas\) delivers the strongest joint robustness\. Axis\-2 ASR values are 5\-seed means from Tables[11](https://arxiv.org/html/2608.04045#S7.T11),[12](https://arxiv.org/html/2608.04045#S8.T12),[18](https://arxiv.org/html/2608.04045#S9.T18), and[20](https://arxiv.org/html/2608.04045#S9.T20); the stacked row’s Axis\-1 entry is qualitative, its accuracy cost being quantified in Section[9\.4](https://arxiv.org/html/2608.04045#S9.SS4)\.RemedyAxis\-1 score \(gap closed\)Axis\-2 score \(backdoor ASR\)FedAvg \(baseline\)−0\.7%\-0\.7\\%\(fails Axis\-1\)0\.949±0\.0790\.949\\pm 0\.079\(fails Axis\-2\)FedRep \(personalization\)\+69\.9%±6\.4%\+69\.9\\%\\pm 6\.4\\%0\.633±0\.3200\.633\\pm 0\.320\(fails Axis\-2\)Krum \(f=1f=1\)— \(not evaluated as Axis\-1 remedy\)0\.064±0\.1000\.064\\pm 0\.100FedRep\+\+Krum \(stacked\)personalized \(modest RMSE cost\)0\.028±0\.0240\.028\\pm 0\.024\(best of all\)A deployment that faces both axes must stack both\. The Axis\-2 Krum defense is drop\-in compatible with FedRep because Krum operates on the shared\-encoder deltas of Algorithm[1](https://arxiv.org/html/2608.04045#alg1)in exactly the same way it operates on FedAvg’s whole\-model deltas: the argmin\-in\-distance rule is oblivious to whether the input update represents a full model or a shared encoder only\. Composing the two into FedRep\+\+Krum \(personalized heads plus Byzantine\-robust encoder aggregation\) yields the two\-axis composition we evaluate end\-to\-end in Section[9\.4](https://arxiv.org/html/2608.04045#S9.SS4)below\.

### 9\.4Stacked FedRep\+\+Krum defense: end\-to\-end 5\-seed evaluation

The stacked defense reuses the FedRep configuration of Section[9\.1](https://arxiv.org/html/2608.04045#S9.SS1)\(same partition, same trigger, same 5\-seed harness\) with a single change: the shared\-encoder aggregation step uses Krum \(f=1f=1, Algorithm[4](https://arxiv.org/html/2608.04045#alg4)\) instead of sample\-count\-weighted FedAvg\. Per\-client heads remain private and locally trained \(unchanged from Section[9\.2](https://arxiv.org/html/2608.04045#S9.SS2)\)\. Table[20](https://arxiv.org/html/2608.04045#S9.T20)reports the per\-seed outcome and 5\-seed aggregate\.

Table 20:FedRep\+\+Krum stacked\-defense bridge: per\-seed values and 5\-seed aggregate\. Same partition, same trigger, and same attacker \(client 3\) as Table[18](https://arxiv.org/html/2608.04045#S9.T18); the only change is that Krum\(f=1\)\(f=1\)replaces sample\-count\-weighted mean as the shared\-encoder aggregator\.Δa−h=\\Delta\_\{\\mathrm\{a\-h\}\}=attacker ASR−\-honest ASR \(per\-seed difference\)\. All ASR values are in\[0,1\]\[0,1\]; higher is worse for the defender\.SeedBest rd\.Best RMSEAttacker ASRHonest ASR \(n=3n\{=\}3\)Δa−h\\Delta\_\{\\mathrm\{a\-h\}\}421617\.94617\.9460\.0400\.0400\.0640\.064−0\.024\-0\.024431417\.26817\.2680\.0000\.0000\.0060\.006−0\.006\-0\.006442218\.94718\.9470\.0350\.0350\.0380\.038−0\.003\-0\.003451916\.33816\.3380\.0000\.0000\.0240\.024−0\.024\-0\.024461617\.63917\.6390\.0590\.0590\.0060\.006\+0\.053\+0\.053mean±\\pmstd17\.4±3\.1\\mathbf\{17\.4\\pm 3\.1\}17\.63±0\.95\\mathbf\{17\.63\\pm 0\.95\}0\.027±0\.026\\mathbf\{0\.027\\pm 0\.026\}0\.028±0\.024\\mathbf\{0\.028\\pm 0\.024\}−0\.001±0\.031\\mathbf\{\-0\.001\\pm 0\.031\}##### Finding: FedRep\+\+Krum outperforms both single\-axis remedies\.

On the same 5\-seed harness as Table[12](https://arxiv.org/html/2608.04045#S8.T12)and Table[18](https://arxiv.org/html/2608.04045#S9.T18), the stacked defense delivers honest\-mean ASR0\.028±0\.0240\.028\\pm 0\.024\(95%\-CI\[−0\.002,0\.058\]\[\-0\.002,0\.058\]\)\. This is simultaneously \(i\) roughly22×22\\timeslower than FedRep alone \(0\.633±0\.3200\.633\\pm 0\.320\), \(ii\) roughly2×2\\timeslower than Krum alone \(0\.064±0\.1000\.064\\pm 0\.100\), and \(iii\) roughly4×4\\timestighter in variance than Krum alone\. Crucially, the stacked 95%\-CI upper bound \(0\.0580\.058\) sits below Krum\-alone’s mean \(0\.0640\.064\), so on this harness the composition delivers a strictly better ASR distribution than either constituent remedy\.

The attacker−\-honest ASR delta remains close to zero on the stacked defense \(−0\.001±0\.031\-0\.001\\pm 0\.031, 95%\-CI\[−0\.040,0\.038\]\[\-0\.040,0\.038\]; paired two\-sided Wilcoxon signed\-rank test across 5 seeds:W=5W=5,p=0\.625p=0\.625, failure to reject equal medians\), reproducing the bridge finding that FedRep’s private heads offer no per\-client isolation against a representation\-level backdoor\. The compositional benefit is therefore not from head\-side rejection but from Krum’s argmin selecting an honest encoder update each round: the personalised heads then read out fault probability from a*clean*encoder rather than a poisoned one\.

##### Clean\-task performance: a bounded, honest cost\.

Under the same backdoor, the stacked defense reaches a best macro test RMSE of17\.63±0\.9517\.63\\pm 0\.95\. Two comparisons matter and we keep them apart\. Against*FedRep alone*\(the only like\-for\-like comparison, since both are scored on the same per\-client macro metric\), the stack costs about\+1\.8\+1\.8RMSE \(FedRep\-alone reaches15\.7915\.79macro under the same attack\): Krum’s single\-encoder selection, which discards three of four encoder updates each round, learns a weaker shared representation than FedRep’s four\-client average\. Against*Krum alone*the stack is numerically lower \(17\.6317\.63macro versus19\.6119\.61global\), but these are*different*metrics \(macro RMSE scores each client on its own subset and is systematically more favourable than the pooled global RMSE\), so we do*not*claim the stack beats Krum on accuracy\. The honest summary is a Pareto trade\-off: composing the two remedies buys the lowest ASR in our evaluation and keeps per\-client personalization, at a modest accuracy cost relative to personalization alone\.

##### Verdict: a practical, composable defence\.

Across theN=4N=4backdoor harness of Section[6](https://arxiv.org/html/2608.04045#S6), FedRep\+\+Krum is the strongest*robustness*configuration evaluated in this paper \(honest\-mean ASR0\.028±0\.0240\.028\\pm 0\.024\) and the only one that is simultaneously personalized and Byzantine\-robust\. Its accuracy cost relative to personalization alone is a*backbone\-capacity*limitation rather than a flaw in the composition: the shared encoder is a deliberately tiny 1\-D CNN \(∼30\\sim 30K parameters, chosen for reproducibility\), so when Krum keeps a single client’s encoder per round there is little headroom to recover the discarded signal\. Because Krum is oblivious to what the encoder is, a higher\-capacity backbone \(a temporal Transformer, a TCN, or a hybrid\) drops in without changing the method and is expected to shrink the gap\. We therefore present FedRep\+\+Krum not as a finished, dominant defence but as a*practical, composable*two\-axis solution that already restores robustness at a bounded cost and points to a concrete path \(higher\-capacity encoders and principled client selection\) for closing it \(Section[10\.4](https://arxiv.org/html/2608.04045#S10.SS4)\)\.

##### Generalization of the stacked defense\.

The stacked defense is re\-run on the same two stresses as the Axis\-2 matrix \(Section[8\.4](https://arxiv.org/html/2608.04045#S8.SS4)\), each over five seeds\. Its robustness holds across both: honest\-mean ASR is0\.028±0\.0240\.028\\pm 0\.024atN=4N=4,0\.042±0\.0490\.042\\pm 0\.049atN=6N=6, and0\.147±0\.0340\.147\\pm 0\.034on the harder FD002\+\+FD004 data, never above0\.150\.15, and in every setting at least six\-fold below the corresponding undefended FedAvg\. Consistent with the matrix result, the FD002\+\+FD004 figure is the highest, reflecting the general weakening of every defense as task difficulty rises\. The composition therefore carries the robustness behaviour of its Krum component across scale and difficulty, not only in the primary setting\.

## 10Discussion and deployment guidance

### 10\.1Cross\-axis synthesis: neither remedy handles the other axis

Section[7](https://arxiv.org/html/2608.04045#S7)showed that FedRep and FedCCFA close70\+%70\+\\%of the Axis\-1 gap while proximal regularization and reweighting close under10%10\\%\. Section[8](https://arxiv.org/html/2608.04045#S8)showed that Krum, alone among the evaluated aggregators, handles the two hardest Axis\-2 cells \(targeted backdoor and coordinated Byzantine\), while trimmed mean and coordinate median cope with single\-attacker untargeted attacks but collapse under coordination\. The Section[9](https://arxiv.org/html/2608.04045#S9)bridge experiment closes the loop: FedRep alone does*not*transfer Axis\-1 protection to Axis 2: its0\.633±0\.3200\.633\\pm 0\.320honest\-mean ASR is only∼30\\sim 30pp below undefended FedAvg on the mean but with a 95%\-CI that reaches all the way to fully compromised \(upper bound1\.0311\.031\)\. These are two distinct engineering choices, and the practitioner must decide, per deployment, whether the primary risk is benign heterogeneity, adversarial heterogeneity, or both, and stack remedies accordingly\.

### 10\.2Deployment guidance for FL prognostic pipelines

Table[21](https://arxiv.org/html/2608.04045#S10.T21)translates the empirical findings of Sections[7](https://arxiv.org/html/2608.04045#S7)–[9](https://arxiv.org/html/2608.04045#S9)into per\-scenario deployment recommendations\. The final row \(heterogeneous\+\+adversarial\) is the paper’s headline recommendation: neither FedRep nor Krum alone suffices; the two must be stacked\.

Table 21:Recommended remedy per operational scenario for FL\-based aircraft\-engine RUL prognostics\. Rationale references the experimental sections that support each row\. “−\-” in a remedy column means no additional remedy over the baseline is required for the scenario\.Primary concernAxis\-1 remedyAxis\-2 remedyRationaleHeterogeneous fault modes, no adversaryFedRep or FedCCFAFedAvgPersonalization closes70\+%70\+\\%of the gap; no attack\-side overhead required \(Sec\.[7\.3](https://arxiv.org/html/2608.04045#S7.SS3)\)Heterogeneous\+\+sporadic bad clientsFedRepTrimmed meanPersonalization\+\+cheap Axis\-2 defense against a single untargeted attacker \(Sec\.[8\.2](https://arxiv.org/html/2608.04045#S8.SS2)\)One malicious client, untargeted goalFedAvgTrimmed mean or coord\. medianEither recovers RMSE∼22\\sim 22; the two are degenerate atN=4N=4\(Sec\.[5\.3\.2](https://arxiv.org/html/2608.04045#S5.SS3.SSS2)\)One malicious client, targeted backdoorFedAvgKrum \(f=1f=1\)Reduces ASR∼15×\\sim 15\\times\(94\.9%→6\.4%94\.9\\%\\to 6\.4\\%\); only aggregator whose 95%\-CI touches0%0\\%\(Sec\.[8\.2](https://arxiv.org/html/2608.04045#S8.SS2)\)Two of four clients colluding \(50%50\\%\)FedAvgKrum \(f=1f=1\)Trimmed mean and coordinate median collapse to RMSE84\.0384\.03; Krum empirically recovers \(RMSE23\.9723\.97, high seed variance\) though outside its formal2​f\+32f\+3bound \(Sec\.[8\.2](https://arxiv.org/html/2608.04045#S8.SS2)\)Heterogeneous\+\+adversarial \(both\)FedRepKrum \(f=1f=1\)Best joint result\(Sec\.[9\.4](https://arxiv.org/html/2608.04045#S9.SS4)\): 5\-seed honest\-mean ASR0\.028±0\.0240\.028\\pm 0\.024, roughly2×2\\timeslower and4×4\\timestighter than Krum alone; retains personalization at a modest accuracy cost##### Practical monitoring implications\.

One operational consequence follows from Table[21](https://arxiv.org/html/2608.04045#S10.T21)regardless of which row applies to a specific deployment: because the sensor\-value backdoor of Section[5\.2\.3](https://arxiv.org/html/2608.04045#S5.SS2.SSS3)is invisible on clean\-set metrics \(Observation \(2\) in Section[8\.2](https://arxiv.org/html/2608.04045#S8.SS2)\), any FL prognostic deployment must include*triggered\-set evaluation*, either a canary set of adversarially perturbed windows scored every round or a periodic red\-team probe of the deployed model\. A detection layer that alerts only on clean\-set metric drift is functionally blind to this class of attack\. This adds a lightweight audit layer on top of the recommended aggregator without changing the FL protocol itself\.

### 10\.3Limitations

The results of this paper are subject to two limitations\.

##### Small client count \(N=4N=4\)\.

The finding that Krum\-f1f\_\{1\}recovers on average under the coordinated 2\-attacker cell \(Section[8\.2](https://arxiv.org/html/2608.04045#S8.SS2), Observation \(5\)\) sits outside Krum’s formal resilience regime, spelled out once in Section[5\.3\.3](https://arxiv.org/html/2608.04045#S5.SS3.SSS3), and is specific to small federations\. TheN=6N=6replication \(Table[15](https://arxiv.org/html/2608.04045#S8.T15)\) already shows the comparison shifting once thef=2f=2setting becomes available\. The controlled small\-NNregime adopted here is not a claim about any specific commercial federation size; readers whose prospective settings haveN≥10N\\geq 10should re\-run the matrix at the relevant scale\.

##### Static, non\-adaptive backdoor trigger\.

The trigger of Section[5\.2\.3](https://arxiv.org/html/2608.04045#S5.SS2.SSS3)is fixed at\(s3,coff=−1,vtrig=−3\.5​σ,p=0\.3\)\(s\_\{3\},c\_\{\\mathrm\{off\}\}=\-1,v\_\{\\mathrm\{trig\}\}=\-3\.5\\sigma,p=0\.3\)and is not adaptive to the defense\. This is the most important caveat on our robustness claims\. Krum succeeds here because the poisoned encoder update is*geometrically*distinguishable; an adversary who optimises against that very geometry can erase the signal\.Foroughi2026LSA, for instance, poison only a few backdoor\-critical layers and approximate benign updates, reaching up to97%97\\%backdoor success while*bypassing*Multi\-Krum, trimmed mean, and FLAME\. We therefore do not claim Krum, or the stacked defense, is robust against adaptive, defense\-aware adversaries, only against the magnitude/geometry\-detectable trigger studied here\. A sensitivity sweep over\(p,vtrig\)\(p,v\_\{\\mathrm\{trig\}\}\)and, more importantly, an evaluation against adaptive layer\-aware triggers are the natural next stress tests\.

### 10\.4Future work

Four extensions naturally follow the results of this study\.

##### Norm\-clipping composition\.

Sun2019CanYouBackdoorargued that bounding the norm of each client update is a lightweight, aggregator\-agnostic partial defense against backdoors\. Since Section[9\.4](https://arxiv.org/html/2608.04045#S9.SS4)shows that FedRep\+\+Krum is the strongest evaluated defense but Krum’s argmin selection has known seed\-variance drawbacks on untargeted attacks \(Section[8\.2](https://arxiv.org/html/2608.04045#S8.SS2), Observation \(6\)\), a natural question is whether the cheaper norm\-clipping\+\+FedRep composition delivers comparable protection at lower coordination cost\. The evaluation is inexpensive: norm\-clipping adds no per\-round overhead, so a 5\-seed replication of the bridge with clipping enabled would slot directly into the existing harness\.

##### Higher\-capacity backbone for the stacked defense\.

The one accuracy cost in this study, the∼\+1\.8\\sim\+1\.8macro\-RMSE that FedRep\+\+Krum pays relative to personalization alone \(Section[9\.4](https://arxiv.org/html/2608.04045#S9.SS4)\), is a backbone\-capacity limitation: Krum keeps a single client’s encoder per round, and the∼30\\sim 30K\-parameter CNN has little headroom to recover the discarded signal\. Because Krum is architecture\-agnostic, a higher\-capacity temporal encoder \(a Transformer, a TCN, or a CNN–Transformer hybrid\) drops into the same composition unchanged and is the most direct route to shrinking that gap\.

##### Unified four\-subset federation via a common sensor set\.

The hardest realistic non\-IID setting would federate all four C\-MAPSS subsets at once, mixing single\- and six\-condition regimes with one\- and two\-fault\-mode degradation\. The current fixed\-width encoder blocks this because FD001/FD003 and FD002/FD004 expose different informative\-sensor counts; restricting all clients to the sensors common to all four subsets would enable a single federation spanning every regime and fault mode, at the cost of a reduced sensor set and a regime\-aware\-normalization upgrade\.

##### Direct competitor benchmarks\.

Re\-implementing BioMutFed\+\+\(Tallat2026BioMutFedPlus\)and the trustworthy\-FL\-for\-IIoT pipeline ofLi2026TrustworthyFLIIoTinside our5×45\\times 4matrix would enable head\-to\-head comparison against Krum under the physically\-motivated backdoor of Section[5\.2\.3](https://arxiv.org/html/2608.04045#S5.SS2.SSS3)\. Both prior papers report favourable numbers against their own attack designs; whether those numbers survive our targeted\-backdoor trigger is a genuinely open question that our released code and per\-seed harness make cheap to answer\.

## 11Conclusion

We set out to answer whether federated learning is worth deploying for aircraft\-engine prognostics\. The answer is governed by two orthogonal axes of client heterogeneity that the FL community has so far explored in parallel:*benign heterogeneity*\(clients honestly hold different data\), best handled by architectural personalization; and*adversarial heterogeneity*\(some clients deviate from honest training\), best handled by Byzantine\-robust aggregation\. The two axes require different remedies, and neither remedy handles the other axis\. Our experiments on NASA C\-MAPSS with a structural non\-IID FD001\+\+FD003 4\-client federation support three practical claims\.

1. 1\.*Axis 1\.*Architectural personalization \(FedRep\+69\.9%±6\.4%\+69\.9\\%\\pm 6\.4\\%, FedCCFA\+66\.9%±6\.6%\+66\.9\\%\\pm 6\.6\\%\) closes about70%70\\%of the local\-only→\\tocentralized RMSE gap; optimization\-side FedProx \(μ=0\.1\\mu=0\.1\) closes\+21\.0%±13\.1%\+21\.0\\%\\pm 13\.1\\%; server\-side reweighting closes\+10\.4%±6\.9%\+10\.4\\%\\pm 6\.9\\%\. Under the evaluated tuning protocol, personalization thus closes about33times more of the gap than proximal regularization at roughly half the seed\-to\-seed variance, a reproducibility advantage that matters for real deployments\.
2. 2\.*Axis 2\.*A physically\-motivated sensor\-value backdoor achieves94\.9%±7\.9%94\.9\\%\\pm 7\.9\\%attack success against vanilla FedAvg while clean RMSE \(16\.86±0\.4316\.86\\pm 0\.43\) is consistent with the honest baseline \(16\.59±0\.8416\.59\\pm 0\.84\) under a paired 5\-seed Wilcoxon signed\-rank test \(Section[8\.2](https://arxiv.org/html/2608.04045#S8.SS2), Observation \(2\);W=5W=5,p=0\.625p=0\.625\)\. The regression error is thus blind to the backdoor: the attack surfaces only in the attack success rate and in the collapse of the fault head’s*triggered*F1F\_\{1\}\(from0\.8910\.891on clean data to0\.0930\.093under the trigger\), so clean metrics alone cannot certify a safe model\. Krum reduces attack success by an order of magnitude \(to6\.4%±10\.0%6\.4\\%\\pm 10\.0\\%\) and is the only evaluated aggregator to survive coordinated 2\-of\-4 Byzantine attacks \(RMSE23\.97±9\.9223\.97\\pm 9\.92\) where per\-coordinate defenses collapse deterministically to RMSE84\.03±0\.0084\.03\\pm 0\.00\.
3. 3\.*Cross\-axis bridge and stacked defense\.*FedRep alone does*not*confer Axis\-2 protection: under a one\-attacker backdoor injection, honest clients’ mean ASR \(0\.633±0\.3200\.633\\pm 0\.320,n=5n=5\) is consistent with the attacker’s own \(0\.616±0\.3110\.616\\pm 0\.311; delta−0\.017±0\.060\-0\.017\\pm 0\.060; paired two\-sided WilcoxonW=4W=4,p=0\.875p=0\.875\), because the poison acts on the shared representation rather than the private heads\. Extending the bridge to the stackedFedRep\+\+Krumdefense \(Krum aggregation on the shared\-encoder deltas, personalised heads unchanged\) reduces the honest\-mean ASR to0\.028±0\.024\\mathbf\{0\.028\\pm 0\.024\}on the same 5 seeds, roughly2×2\\timeslower and4×4\\timestighter than Krum alone \(0\.064±0\.1000\.064\\pm 0\.100\), while retaining per\-client personalization at a modest accuracy cost\. We present FedRep\+\+Krum not as a finished, dominant defence but as a practical, composable two\-axis solution whose remaining accuracy cost is a backbone\-capacity limitation, pointing to higher\-capacity encoders as a concrete next step\. These findings hold across a largerN=6N=6federation and the harder six\-condition FD002\+\+FD004 data, with the honest caveat that every defense weakens as the task grows harder\.

Two practitioner takeaways summarise the study\.*First, stack the remedies:*Axis\-1 and Axis\-2 threats are orthogonal, each requires its own architectural or aggregation\-layer response, and neither remedy covers the other axis\.*Second, monitor triggered\-set evaluation, not just clean\-set metrics:*the most dangerous attack in this study is invisible on clean data\.

We hope the two\-axis frame, together with the code and per\-seed results released with the paper, will help future work in this space avoid the pitfalls we encountered\.

## Inspec classification codes

C1230D \(Neural nets\); C5290 \(Neural computing techniques\); C6130S \(Data security\); C7420 \(Control engineering computing\); C3355 \(Condition monitoring\); C1180 \(Optimisation techniques\)\.

## Declaration of competing interest

The author declares that he has no known competing financial interests or personal relationships that could have appeared to influence the work reported in this paper\.

## Data availability

The Commercial Modular Aero\-Propulsion System Simulation \(C\-MAPSS\) turbofan degradation dataset analysed in this study is publicly available from NASA’s Prognostics Center of Excellence data repository\(Saxena2008CMAPSSData\); the simulation that generated it is described bySaxena2008CMAPSS\. No new experimental data were collected\.

All source code required to reproduce the experiments reported in this paper, the multi\-task 1\-D CNN model, the four Axis\-1 methods \(FedAvg, FedProx, FedRep, FedCCFA, imbalance\-aware reweighting\), the five Axis\-2 attack families and four defense aggregators, the FedRep\-under\-backdoor bridge experiment, the multi\-seed aggregation scripts, and the publication\-quality figure\-generation code, is archived and released under an open\-source licence; the repository URL and persistent identifier are withheld from this anonymized manuscript to preserve review anonymity and are given on the title page\. The archive also contains the per\-seed JSON metric outputs backing every number reported in Sections[7](https://arxiv.org/html/2608.04045#S7)–[9](https://arxiv.org/html/2608.04045#S9), and is structured to allow one\-command replication of the full 5\-seed Axis\-2 matrix and the 3\-seed Axis\-1 family sweep\. The third\-party libraries the pipeline is built on are cited in Section[6](https://arxiv.org/html/2608.04045#S6)\.

## References