Byzantine-Resilient Federated Learning via QUBO-Based Client Selection on Quantum Annealers

# Byzantine-Resilient Federated Learning via QUBO-Based Client Selection on Quantum Annealers
Source: [https://arxiv.org/html/2605.16438](https://arxiv.org/html/2605.16438)
###### Abstract

Federated Learning \(FL\) is a well\-established method for training a global model in a decentralized fashion, thus preserving the privacy of local data and eliminating the need for large centralized infrastructure\. FL at scale runs the risk of malicious updates that can impact the global model\. To mitigate such risks, a number of Byzantine\-resilient aggregation methods have been introduced, one of the most popular ones being MultiKrum\. Whereas this method scores the individual gradients against their nearest neighbors, it can easily miss malicious updates that preserve the statistical properties of honest updates\. To mitigate such concerns, we propose a quantum annealing approach that reformulates client selection as a Quadratic Unconstrained Binary Optimization \(QUBO\) problem, encoding pairwise distances into a cost function solved by quantum annealers \(QA\)\. Unlike MultiKrum’s greedy per\-client scoring, the QUBO formulation jointly optimizes over all possible client subsets to find the mutually closest group ofmmclients\. Our experiments at small scale consisting of 15 clients provided promising results for the most challenging Byzantine attacks\. For example, the Advanced LIE attack was detected with 95\.11% accuracy with QUBO versus 81\.33% for classical MultiKrum on an MNIST\-trained model and 97\.78% vs\. 75\.56% on CIFAR\-10\. Whereas our QUBO method performs well against sophisticated attacks, it fares poorly against simpler attacks, which are handled well by classical MultiKrum\. Our experiments show that the two methods complement each other well\. Additionally, the QUBO method’s quality degrades as we increase the number of clients\. To address these shortcomings, we introduce a MultiSignal ensemble that uses a dual\-feature routing gate based on Euclidean and cosine Krum score gaps to classify attacks into four regimes and routes evasion attacks to a suspicion\-penalized QUBO with agreement voting\. The MultiSignal ensemble performs better than classical MultiKrum in all our experiments, with 95\.3% average detection accuracy versus 91\.8% for classical\. The largest gains are achieved on Sparse Lie, where detection accuracy improves from 72\.0% to 95\.2%, a 23\.2 percentage\-point gain, and on Advanced Lie, where it increases from 80\.4% to 85\.2%, a 4\.8 percentage\-point gain\. These results demonstrate that QUBO\-based quantum annealing with the MultiSignal ensemble is a principled and scalable defense against the most challenging Byzantine strategies in federated learning\.

## IIntroduction

Federated Learning \(FL\)\[[14](https://arxiv.org/html/2605.16438#bib.bib3),[8](https://arxiv.org/html/2605.16438#bib.bib4),[22](https://arxiv.org/html/2605.16438#bib.bib5)\]enables training of a global model by having clients \(nodes\) train local copies of the model and forwarding the gradient updates to a central server, which in turn, aggregates the updates and distributes the global model to clients for the next iteration of the training\. This approach promotes privacy for the local data and eliminates the need for larger central infrastructure\. When the clients are untrusted, nevertheless, the risk of having Byzantine updates can compromise the global model convergence\[[3](https://arxiv.org/html/2605.16438#bib.bib6)\]\.

The existing state of the art, the Krum algorithm\[[3](https://arxiv.org/html/2605.16438#bib.bib6)\], relies on calculation of pairwise Euclidean distances between gradients and selection of a single gradient that is closest to the majority\. MultiKrum\[[3](https://arxiv.org/html/2605.16438#bib.bib6)\]extends this approach to select multiple clients\. Both methods fail to detect more sophisticated attacks, such as the “A Little Is Enough” \(Lie\) attack family\[[2](https://arxiv.org/html/2605.16438#bib.bib8)\], which maliciously alters the gradients while preserving the statistical properties of the updates\.

To address these concerns, we propose formulating Byzantine client detection as a combinatorial optimization problem and solving it via quantum annealing\. For this purpose, we encode the client selection objective as a Quadratic Unconstrained Binary Optimization \(QUBO\)\[[9](https://arxiv.org/html/2605.16438#bib.bib16)\]problem\. This formulation enables*global*optimization over all\(nm\)\\binom\{n\}\{m\}possible subsets, a search that is intractable for classical exhaustive methods but naturally suited to QAs\[[1](https://arxiv.org/html/2605.16438#bib.bib15)\]\.

We make three contributions\. First, we formulate the MultiKrum client selection problem as a QUBO expression, with a Lagrange penalty enforcing the selection of exactlymmclients\. We experiment at small scale with 15 clients across 13 distinct Byzantine attack types on MNIST\[[11](https://arxiv.org/html/2605.16438#bib.bib27)\], FashionMNIST\[[20](https://arxiv.org/html/2605.16438#bib.bib1)\], and CIFAR\-10\[[10](https://arxiv.org/html/2605.16438#bib.bib28)\]data, and show that QUBO\-based selection outperforms classical MultiKrum Byzantine update detection for the evasion category of attacks\. Second, we introduce a threshold\-based Cascaded Dual\-QUBO method for larger instances with 100 clients where the performance of standard QUBO starts deteriorating\. This method still fails to improve accuracy in detecting the Advanced Lie \(ALIE\) attack over classical MultiKrum\. Third, we introduce a MultiSignal ensemble that computes Euclidean and cosine scores, constructs four regimes, and routes processing to either classical MultiKrum or a suspicion\-penalized QUBO with agreement voting\. At 100 clients on MNIST, the MultiSignal ensemble achieves 95\.3% average detection accuracy versus 91\.8% for classical MultiKrum, with its largest gains on Sparse Lie with a 23\.2 percentage\-point gain and ALIE with a 4\.8 percentage\-point gain, while preserving perfect detection on all outlier\-producing attacks, including Clustered\. We also provide a complexity analysis for classical MultiKrum, standard QUBO, cascade, and the MultiSignal approach\.

This work complements our prior study on quantum embedding\-based Byzantine detection\[[7](https://arxiv.org/html/2605.16438#bib.bib2)\], which uses parameterized quantum circuits for gradient feature extraction\. While the quantum embedding approach leverages Hilbert space representations, the present work operates within the optimization paradigm of quantum annealing, offering a fundamentally different and complementary mechanism for robust aggregation\.

## IIRelated Work

Krum\[[3](https://arxiv.org/html/2605.16438#bib.bib6)\]selected the gradient that had its Euclidean distance closest to the rest\. MultiKrum\[[5](https://arxiv.org/html/2605.16438#bib.bib7)\]extended the selection tommclients\. The paper\[[23](https://arxiv.org/html/2605.16438#bib.bib10)\]used coordinate\-wise median and trimmed\-mean estimators\. DRACO\[[4](https://arxiv.org/html/2605.16438#bib.bib9)\]used redundant gradient computation for resilience\. FLAME\[[15](https://arxiv.org/html/2605.16438#bib.bib14)\]uses cosine\-based clustering for backdoor defense, Sentinel\[[6](https://arxiv.org/html/2605.16438#bib.bib12)\]combines cosine similarity filtering with bootstrap loss validation and normalization, and CosDefense\[[21](https://arxiv.org/html/2605.16438#bib.bib13)\]detects outliers via directional similarity\. Dim\-Krum\[[25](https://arxiv.org/html/2605.16438#bib.bib11)\]applied Krum dimension\-wise for NLP tasks\. All of these classical solutions compute local or per\-dimension optimization rather than global subset selection\.

Wei et al\.\[[17](https://arxiv.org/html/2605.16438#bib.bib19)\]used Bender’s decomposition framework to optimize FL scheduling in a distributed network\. The same authors also applied quantum annealing to FL resource scheduling in\[[18](https://arxiv.org/html/2605.16438#bib.bib18)\]\. Liu et al\.\[[12](https://arxiv.org/html/2605.16438#bib.bib20)\]proposed a quantum Byzantine agreement protocol for blockchain\-based federated learning\. Zhang et al\.\[[24](https://arxiv.org/html/2605.16438#bib.bib21)\]used quantum key distribution to protect gradient updates\. The paper\[[19](https://arxiv.org/html/2605.16438#bib.bib22)\]tackled a scenario in which Byzantine participants send random or maliciously crafted unitaries\. Subramanian and Chinnadurai\[[16](https://arxiv.org/html/2605.16438#bib.bib23)\]investigated the benefits of hybrid quantum\-classical models when it comes to robustness in the face of adversarial updates\.

In our prior work\[[7](https://arxiv.org/html/2605.16438#bib.bib2)\], we proposed using parameterized quantum circuits \(Pauli feature maps\) to embed projected gradients into a quantum Hilbert space, where inner products yield a quantum kernel matrix for Byzantine detection\. We demonstrated improved detection of Byzantine updates by performing dimensionality reduction followed by projection into Hilbert space by means of feature maps\.

## IIIBackground

### III\-AFederated Learning

In FL\[[14](https://arxiv.org/html/2605.16438#bib.bib3)\],nnclients collaboratively train a global model parameterized byWWunder the coordination of a central server\. In each roundtt, the server broadcasts the current modelWtW\_\{t\}to all clients\. Each clientiitrains locally on its private data and returns a gradient updateGi=Wi′−WtG\_\{i\}=W\_\{i\}^\{\\prime\}\-W\_\{t\}\. The server aggregates these updates and producesWt\+1W\_\{t\+1\}\. Assuming there areffByzantine clients out of thennreceived by the central server, the goal is to generate a global model that is close to a 100% honest aggregation\.

### III\-BKrum and MultiKrum

LetG1,G2,…,Gn∈ℝdG\_\{1\},G\_\{2\},\\ldots,G\_\{n\}\\in\\mathbb\{R\}^\{d\}be the gradient vectors\. The distance between two gradients is

D​\(Gi,Gj\)=‖Gi−Gj‖2\.D\(G\_\{i\},G\_\{j\}\)=\\\|G\_\{i\}\-G\_\{j\}\\\|\_\{2\}\.\(1\)For each update, Krum is defined as the sum of distances to itsn−f−2n\-f\-2nearest neighbors, i\.e\.,

KRUM​\(Gi\)=∑j∈𝒩i‖Gi−Gj‖22,\\text\{KRUM\}\(G\_\{i\}\)=\\sum\_\{j\\in\\mathcal\{N\}\_\{i\}\}\\\|G\_\{i\}\-G\_\{j\}\\\|\_\{2\}^\{2\},\(2\)where𝒩i\\mathcal\{N\}\_\{i\}is the index set of then−f−2n\-f\-2closest gradients toGiG\_\{i\}\. Krum selects

Gkrum=arg⁡mini⁡KRUM​\(Gi\)\.G\_\{\\text\{krum\}\}=\\arg\\min\_\{i\}\\text\{KRUM\}\(G\_\{i\}\)\\ \.MultiKrum method generalizes Krum by selectingmmgradients with the lowest Krum scores and averaging them as follows:

Gmulti=1m​∑i∈ℳGi,ℳ=Top\-​m​\{KRUM​\(Gi\)\}\.G\_\{\\text\{multi\}\}=\\frac\{1\}\{m\}\\sum\_\{i\\in\\mathcal\{M\}\}G\_\{i\},\\quad\\mathcal\{M\}=\\text\{Top\-\}m\\\{\\text\{KRUM\}\(G\_\{i\}\)\\\}\.\(3\)Notably, MultiKrum does not optimize over subsets jointly\. Any single Byzantine gradient that is close to its neighbors will evade detection\.

### III\-CQuantum Annealing and QUBO

Quantum annealers \(QA\)\[[1](https://arxiv.org/html/2605.16438#bib.bib15)\]are well\-suited for optimization problems expressible as QUBO\[[9](https://arxiv.org/html/2605.16438#bib.bib16)\]:

minx∈\{0,1\}n​∑iQi​i​xi\+∑i<jQi​j​xi​xj,\\min\_\{x\\in\\\{0,1\\\}^\{n\}\}\\sum\_\{i\}Q\_\{ii\}\\,x\_\{i\}\+\\sum\_\{i<j\}Q\_\{ij\}\\,x\_\{i\}x\_\{j\},\(4\)whereQQencodes both the objective and constraints\. Solving an optimization problem encoded as QUBO form of Eq\. \([4](https://arxiv.org/html/2605.16438#S3.E4)\) is equivalent to finding the ground state of an Ising Hamiltonian\[[13](https://arxiv.org/html/2605.16438#bib.bib17)\]\.

## IVMethodology

We aim to replace the greedy MultiKrum algorithm with a method that holistically selects the most optimal subset based on the QUBO objectives and constraints\.

### IV\-AStep 1: Gradient Dimension Reduction

The first step is to project a very large gradient vectorsGi∈ℝdG\_\{i\}\\in\\mathbb\{R\}^\{d\}into a lower\-dimensional space with dimensionkk\. We use Importance\-Weighted approach for this purpose\. For each coordinatejj, we compute the variancevj=Var​\(\{G1,j,…,Gn,j\}\)v\_\{j\}=\\text\{Var\}\(\\\{G\_\{1,j\},\\ldots,G\_\{n,j\}\\\}\)across clients\. We then select the top\-kkcoordinates by variance\. This preserves dimensions where clients disagree most\. Let𝐩i∈ℝk\\mathbf\{p\}\_\{i\}\\in\\mathbb\{R\}^\{k\}denotes the selected gradient for clientiiafter applying such dimension reduction\.

### IV\-BStep 2: Distance Matrix Computation

Next, we compute a pairwise distance matrixD∈ℝn×nD\\in\\mathbb\{R\}^\{n\\times n\}on the gradients with reduced dimension\. We use two type of distance computation, cosine and Euclidean\. The cosine distance is computed as follows:

Di​jcosine=1−𝐩i⋅𝐩j‖𝐩i‖​‖𝐩j‖\+ϵ,D\_\{ij\}^\{\\text\{cosine\}\}=1\-\\frac\{\\mathbf\{p\}\_\{i\}\\cdot\\mathbf\{p\}\_\{j\}\}\{\\\|\\mathbf\{p\}\_\{i\}\\\|\\,\\\|\\mathbf\{p\}\_\{j\}\\\|\+\\epsilon\},\(5\)Hereϵ=10−8\\epsilon=10^\{\-8\}prevents division by zero\. Cosine distance measures directional dissimilarity and is invariant to gradient magnitude, making it well\-suited for detecting attacks that preserve gradient norms but alter directions\. The matrix is symmetric withDi​icosine=0D\_\{ii\}^\{\\text\{cosine\}\}=0\. One the other hand, the Euclidean distance captures the magnitude dissimilarity which is calculated as follows:

Di​jeuclid=‖𝐩i−𝐩j‖2\.D\_\{ij\}^\{\\text\{euclid\}\}=\\\|\\mathbf\{p\}\_\{i\}\-\\mathbf\{p\}\_\{j\}\\\|\_\{2\}\.\(6\)For the dual\-distance formulation \(Section[IV\-D](https://arxiv.org/html/2605.16438#S4.SS4)\), the Euclidean matrix is normalized to\[0,1\]\[0,1\]:

D^i​jeuclid=Di​jeuclidmaxk<l⁡Dk​leuclid\.\\hat\{D\}\_\{ij\}^\{\\text\{euclid\}\}=\\frac\{D\_\{ij\}^\{\\text\{euclid\}\}\}\{\\max\_\{k<l\}D\_\{kl\}^\{\\text\{euclid\}\}\}\.\(7\)

### IV\-CStep 3: QUBO Formulation

Letxi∈\{0,1\}x\_\{i\}\\in\\\{0,1\\\}indicates whether clientiiis selected\. We seek to selectm=n−fm=n\-fclients whose projected gradients are mutually closest\. Our objective is to minimize the total pairwise distance among selected clients, i\.e\.,

minx∈\{0,1\}n​∑i=1n\(∑j=1nDi​j\)​xi−2​∑i<jDi​j​xi​xj\.\\min\_\{x\\in\\\{0,1\\\}^\{n\}\}\\sum\_\{i=1\}^\{n\}\\left\(\\sum\_\{j=1\}^\{n\}D\_\{ij\}\\right\)x\_\{i\}\-2\\sum\_\{i<j\}D\_\{ij\}\\,x\_\{i\}x\_\{j\}\.\(8\)To enforce exactlymmselections, we add a Lagrange penalty of the form:

λ​\(∑i=1nxi−m\)2,\\lambda\\left\(\\sum\_\{i=1\}^\{n\}x\_\{i\}\-m\\right\)^\{2\},\(9\)whereλ\\lambdais the Lagrange multiplier\. We set the valueλ=10×maxi,j⁡Di​j\\lambda=10\\times\\max\_\{i,j\}D\_\{ij\}, ensuring the constraint penalty dominates the objective when violated\. Expanding Eq\. \([8](https://arxiv.org/html/2605.16438#S4.E8)\), and Eq\. \([9](https://arxiv.org/html/2605.16438#S4.E9)\) and using the property of binary variables,xi2=xix\_\{i\}^\{2\}=x\_\{i\}, andm2m^\{2\}is a constant term, irrelevant to the optimization, the elements of QUBO can be written as follows:

Qi​i\\displaystyle Q\_\{ii\}=∑j=1nDi​j\+λ​\(1−2​m\),\\displaystyle=\\sum\_\{j=1\}^\{n\}D\_\{ij\}\+\\lambda\(1\-2m\),\(10\)Qi​j\\displaystyle Q\_\{ij\}=−2​Di​j\+2​λ,for​i<j\.\\displaystyle=\-2D\_\{ij\}\+2\\lambda,\\quad\\text\{for \}i<j\.\(11\)
We solve the QUBO using a simulated annealing sampler with 1000 reads and extract client indicesSSfor small instances\. If\|S\|≠m\|S\|\\neq mwe perform post\-processing to add or remove clients based on their distance sums to the current selection\. The global model is updated as:

Wt\+1=Wt\+η⋅1\|S\|​∑i∈SGi\.W\_\{t\+1\}=W\_\{t\}\+\\eta\\cdot\\frac\{1\}\{\|S\|\}\\sum\_\{i\\in S\}G\_\{i\}\.\(12\)

### IV\-DCascaded Dual\-QUBO

For large client populations \(n≥100n\\geq 100\), the solution above faces scaling issues and there is a higher likelihood that Byzantine updates cluster tightly thus confusing our optimization algorithm\. We attempt to resolve this using a Cascaded Dual\-QUBO approach\. We define Krum score gapΔ\\Deltaas follows:

Δ=mini∈ℛ⁡si−maxj∈𝒮⁡sjstd​\(\{s1,…,sn\}\),\\Delta=\\frac\{\\min\_\{i\\in\\mathcal\{R\}\}s\_\{i\}\-\\max\_\{j\\in\\mathcal\{S\}\}s\_\{j\}\}\{\\text\{std\}\(\\\{s\_\{1\},\\ldots,s\_\{n\}\\\}\)\},\(13\)where𝒮\\mathcal\{S\}andℛ\\mathcal\{R\}are the selected and rejected client sets under that metric’s Krum scoring, andsis\_\{i\}is the Krum score for clientii\. We introduce a gap thresholdτ\\tau\. When Euclidean Krum score gap is above this threshold, classical MultiKrum is good enough\. When the gap is below the threshold, classical method fails\. In that case we build a QUBO using equal blend of normalized Euclidean and cosine distances defined as follows:

Di​jdual=α​D^i​jeuclid\+\(1−α\)​Di​jcosine,D\_\{ij\}^\{\\text\{dual\}\}=\\alpha\\hat\{D\}\_\{ij\}^\{\\text\{euclid\}\}\+\(1\-\\alpha\)D\_\{ij\}^\{\\text\{cosine\}\},\(14\)whereD^euclid\\hat\{D\}^\{\\text\{euclid\}\}is the Euclidean distance matrix normalized to\[0,1\]\[0,1\]andα=0\.5\\alpha=0\.5\. Then solve it using BQM hybrid quantum annealing solver\.

### IV\-EMultiSignal Ensemble

Our initial Cascaded Dual\-QUBO approach for 100 client instances, however, did not work for ALIE\. We address this concern with MultiSignal ensemble that comprises of a dual\-feature routing gate, a suspicion\-penalized QUBO, and and an agreement voting\.

#### Stage 1: Dual\-Feature Routing Gate

We compute the normalized Euclidean Krum score gapΔE\\Delta\_\{E\}on full gradients and the normalized cosine Krum score gapΔC\\Delta\_\{C\}on importance\-weighted projected gradients using Eq\. \([13](https://arxiv.org/html/2605.16438#S4.E13)\)\. We also define cutoffsτc\\tau\_\{c\}andτE\\tau\_\{E\}for cosine and Euclidean gap respectively\. Based on these two gap values we categorize the outcomes as follows: \(1\) Outlier whenΔE\>τE\\Delta\_\{E\}\>\\tau\_\{E\}andΔC\>τE\\Delta\_\{C\}\>\\tau\_\{E\}, \(2\) Clustered whenΔE≤τE\\Delta\_\{E\}\\leq\\tau\_\{E\}andΔC\>τC\\Delta\_\{C\}\>\\tau\_\{C\}, \(3\) Magnitude whenΔE\>τE\\Delta\_\{E\}\>\\tau\_\{E\}andΔC≤τE\\Delta\_\{C\}\\leq\\tau\_\{E\}, and \(4\) Evasion whenΔE≤τE\\Delta\_\{E\}\\leq\\tau\_\{E\}andΔC≤τE\\Delta\_\{C\}\\leq\\tau\_\{E\}\. For the first three categories, classical multi\-Kurm works well\. For the fourth category, both the gaps are low and a suspicion\-penalized QUBO with agreement voting is more beneficial\. Based on extensive experimentation we settled withτE=0\.2\\tau\_\{E\}=0\.2andτC=0\.5\\tau\_\{C\}=0\.5\. In our experiments we were unable to produce Outlier and Clustered scenarios\. These are hypothetical scenarios for future\-proofing our system\.

#### Stage 2: Suspicion\-Penalized QUBO

While the standard QUBO objective in Eq\. \([8](https://arxiv.org/html/2605.16438#S4.E8)\) encourages client mutual proximity, it cannot detect ALIE in which gradients are extremely close to the honest mean\. Suspicion\-Penalized QUBO discourages selecting pairs of clients whose gradients are suspiciously similar\. First, we construct a dual distance matrix on importance\-weighted projected gradients following Eq\. \([14](https://arxiv.org/html/2605.16438#S4.E14)\)\. The suspicion thresholdτs\\tau\_\{s\}ispp\-th percentile of the upper\-triangular entries ofDdualD^\{\\text\{dual\}\}, withp=10p=10\. The modified quadratic coefficients become:

Qi​jsusp=−2​Di​jdual\+ws⋅max⁡\(0,τs−Di​jdual\),Q\_\{ij\}^\{\\text\{susp\}\}=\-2D\_\{ij\}^\{\\text\{dual\}\}\+w\_\{s\}\\cdot\\max\(0,\\,\\tau\_\{s\}\-D\_\{ij\}^\{\\text\{dual\}\}\),\(15\)wherews=10\.0w\_\{s\}=10\.0is the suspicion weight\. For pairs withDi​jdual<τsD\_\{ij\}^\{\\text\{dual\}\}<\\tau\_\{s\}, the penalty term overpowers the incentive\.

#### Stage 3: Agreement Voting

In the evasion regime we run both classical MultiKrum and QUBO in parallel\. As both Euclidean and cosine gaps are low, classical is given a low confidence\. We produce four categories:*agreed\-accept*when both methods select,*agreed\-reject*when both methods reject,*QUBO\-only*when QUBO selects but classical rejects, and*classical\-only*when classical selects but QUBO rejects\. A blended rank score based on normalized cosine Krum scores, with bonuses for agreed\-accept and penalties for agreed\-reject and classical\-only, determines the final selection ofmmclients\. Algorithm[1](https://arxiv.org/html/2605.16438#alg1)summarizes the complete procedure\.

Algorithm 1MultiSignal Ensemble for Byzantine\-Robust Aggregation0:Clients to select

mm, thresholds

τE,τC\\tau\_\{E\},\\tau\_\{C\}, projection dim

kk
1:foreach FL round

t=1,2,…t=1,2,\\ldotsdo

2:Broadcast

WtW\_\{t\}; receive gradients

G1,…,GnG\_\{1\},\\ldots,G\_\{n\}
3:Project:

𝐩i←Project​\(Gi,k\)\\mathbf\{p\}\_\{i\}\\leftarrow\\text\{Project\}\(G\_\{i\},k\)for all

ii
4:Compute Euclidean gap

ΔE\\Delta\_\{E\}and cosine gap

ΔC\\Delta\_\{C\}\(Eq\. \([13](https://arxiv.org/html/2605.16438#S4.E13)\)\)

5:if

ΔE\>τE\\Delta\_\{E\}\>\\tau\_\{E\}and

ΔC\>τE\\Delta\_\{C\}\>\\tau\_\{E\}then

6:OUTLIER:

S←ClassicalMultiKrum​\(G,m\)S\\leftarrow\\text\{ClassicalMultiKrum\}\(G,m\)
7:elseif

ΔE≤τE\\Delta\_\{E\}\\leq\\tau\_\{E\}and

ΔC\>τC\\Delta\_\{C\}\>\\tau\_\{C\}then

8:CLUSTERED:

S←ClassicalMultiKrum​\(G,m\)S\\leftarrow\\text\{ClassicalMultiKrum\}\(G,m\)
9:elseif

ΔE\>τE\\Delta\_\{E\}\>\\tau\_\{E\}and

ΔC≤τE\\Delta\_\{C\}\\leq\\tau\_\{E\}then

10:MAGNITUDE:

S←ClassicalMultiKrum​\(G,m\)S\\leftarrow\\text\{ClassicalMultiKrum\}\(G,m\)
11:else

12:EVASION:

Sc←ClassicalMultiKrum​\(G,m\)S\_\{c\}\\leftarrow\\text\{ClassicalMultiKrum\}\(G,m\)
13:Construct suspicion QUBO \(Eqs\. \([14](https://arxiv.org/html/2605.16438#S4.E14)\)–\([15](https://arxiv.org/html/2605.16438#S4.E15)\)\)

14:

Sq←AnnealSolve​\(Qsusp\)S\_\{q\}\\leftarrow\\text\{AnnealSolve\}\(Q^\{\\text\{susp\}\}\)
15:

S←AgreementVote​\(Sc,Sq,m\)S\\leftarrow\\text\{AgreementVote\}\(S\_\{c\},S\_\{q\},m\)
16:endif

17:

Wt\+1←Wt\+η⋅1\|S\|​∑i∈SGiW\_\{t\+1\}\\leftarrow W\_\{t\}\+\\eta\\cdot\\frac\{1\}\{\|S\|\}\\sum\_\{i\\in S\}G\_\{i\}
18:endfor

## VByzantine Attack Models

We evaluate against 13 distinct Byzantine attack strategies listed in Table[I](https://arxiv.org/html/2605.16438#S5.T1)\. Letμ\\muandσ\\sigmadenote the coordinate\-wise mean and standard deviation of honest client gradients\. LetGiG\_\{i\}denote an honest gradient andG~\\widetilde\{G\}denotes the Byzantine update crafted from\(μ,σ\)\(\\mu,\\sigma\)\.

TABLE I:Byzantine attack models used in evaluation\.These attacks range from easily detectable outlier\-producing strategies like Gaussian Noise and Scale to sophisticated methods specifically designed to evade distance\-based defenses like Lie family and data poisoning Label Flip, providing a comprehensive evaluation of robustness\.

## VIExperimental Setup

### VI\-ADatasets and Models

We evaluate on three standard image classification benchmarks\. MNIST is the handwritten digit dataset consisting of 28×\\times28 grayscale images categorized into 10 classes\. This dataset is paired with a fully connected neural network with784→200→10784\\to 200\\to 10architecture, ReLU activations, and approximately 159K parameters\. Data is partitioned across clients using non\-IID splits\. FashionMNIST is the Zalando clothing article dataset\[[20](https://arxiv.org/html/2605.16438#bib.bib1)\]consists of 28×\\times28 grayscale images with 10 classes\. This dataset serves as a more challenging drop\-in replacement for MNIST\. CIFAR\-10 is the natural image dataset with 32×\\times32 RGB images consist of 10 classes\. This dataset uses a compact CNN consisting of two convolutional layers 3→\\to4 and 4→\\to8 channels; 3×\\times3 kernels, and max\-pooling, followed by two fully connected layers with 512→\\to32→\\to10 architecture, totaling approximately 17K parameters\. The metrics used to evaluate performance of different methods are defined in Table[II](https://arxiv.org/html/2605.16438#S6.T2)\.

### VI\-B15\-Client Configuration

We use 12 honest and 3 Byzantine clients \(n=15n=15,f=3f=3\) and selectm=n−f=12m=n\-f=12clients per round\. We run 30 FL rounds\. Local training uses SGD with learning rate 0\.01 and weight decay10−410^\{\-4\}, and we apply gradient clipping with max norm 1\.0\. We use an importance\-weighted projection of the gradients with dimensionk=1000k=1000and compute distance matrix using cosine distance using Eq\. \([5](https://arxiv.org/html/2605.16438#S4.E5)\)\. The QUBO is solved using the Neal simulated annealing sampler with 1000 reads\. Classical MultiKrum uses the same importance\-weighted projection and squared Euclidean distances on projected gradients, withk=n−f−2=10k=n\-f\-2=10nearest neighbors for Krum scoring\.

### VI\-C100\-Client QA Hybrid Configuration

To evaluate scalability, we run a second set of experiments at a larger scale with 80 honest clients and 20 Byzantine clients, i\.e\.,n=100n=100,f=20f=20, selectingm=n−f=80m=n\-f=80clients per round\. We use Cascaded Dual\-QUBO, and MultiSignal ensemble method using the LeapHybridSampler which is hybrid quantum\-classical quantum annealer\. We perform 5 FL rounds using the MNIST dataset\. We use a subset of 6 representative Byzantine attacks out of 13 to limit computational cost both on classical and quantum hardware\. We use the same importance\-weighted projection withk=1000k=1000, and SGD with learning rate 0\.01\. The classical baseline uses the same 100\-client configuration with standard MultiKrum selection ofknn=n−f−2=78k\_\{\\text\{nn\}\}=n\-f\-2=78nearest neighbors\.

TABLE II:Definitions of metrics used to compare FL performance\. TP, FN, TN are abbreviations for True Positive, False Negative, and True Negatives respectively\. All metrics are averaged over the 30 FL rounds\.

## VIIResults and Analysis

### VII\-A15 clients FL results

Table[III](https://arxiv.org/html/2605.16438#S7.T3)summarizes the average detection accuracy and F1 score for both aggregators across all 13 attack types for MNIST data\. Classical MultiKrum excels on nine of 13 attacks such as Gaussian Noise, Scale, Targeted, ALIE, Clustered, Same Value, Blatant Lie, Label Flip, and Stealthy which are easily identifiable by per\-client Krum scoring with squared Euclidean distances\. In contrast, the more subtle Lie attack family, i\.e\., ALIE is better handled by the QUBO\-based approach, achieving 95\.11% detection accuracy versus 81\.33% for classical MultiKrum, with an F1 score of 87\.78% versus 53\.33%\. Standard Lie detection improves from 72\.44% to 86\.67% with F1 score increase from 31\.11% to 66\.67%\. Sparse Lie accuracy improves from 66\.67% to 80\.89% with F1 score increasing from 16\.67% to 52\.22%\. For Sign Flip, classical MultiKrum fails entirely with TP = 0 and detection accuracy = 60%, while QUBO formulation using simulated annealing achieves TP≈\\approx0\.83 and a detection accuracy of 71\.11%\. Taken together, these complementary strengths motivate an ensemble method as the most effective overall solution\.

TABLE III:MNIST: Average Detection Accuracy and F1 Score across 30 rounds\. Bold indicates the better method for each attack\.Table[IV](https://arxiv.org/html/2605.16438#S7.T4)presents the corresponding results on CIFAR\-10, confirming the MNIST findings hold for more complex datasets\.

TABLE IV:CIFAR\-10: Average Detection Accuracy and F1 Score across 30 rounds\. Bold indicates the better method for each attack\.Table[V](https://arxiv.org/html/2605.16438#S7.T5)presents FashionMNIST results\. Using the same MLP architecture as MNIST but with more complex visual features, FashionMNIST closely mirrors the MNIST detection pattern, confirming that the complementary strengths are robust to gradient landscape complexity within the same architecture\.

TABLE V:FashionMNIST: Average Detection Accuracy and F1 Score across 30 rounds\. Bold indicates the better method for each attack\.Comparing Tables[III](https://arxiv.org/html/2605.16438#S7.T3),[IV](https://arxiv.org/html/2605.16438#S7.T4), and[V](https://arxiv.org/html/2605.16438#S7.T5)reveals that the complementary pattern generalizes across all three datasets, with dataset\- and architecture\-specific effects\. Table[VI](https://arxiv.org/html/2605.16438#S7.T6)isolates the five evasion attacks where classical MultiKrum falls below perfect detection, confirming that the QUBO formalism advantage on these attacks is consistent across datasets\.

TABLE VI:Cross\-dataset comparison on evasion attacks: Detection Accuracy \(%\) for Classical MultiKrum vs\. QUBO\. These five attacks are the only ones where classical detection falls below 100%\. Bold indicates the better method;Δ\\Deltashows the QUBO advantage in percentage points\.For ALIE, the QUBO advantage is consistent across the three datasets, achieving 95\.11% on both MNIST and FashionMNIST vs\. 81\.33% using classical MultiKrum, with an even larger gap on CIFAR\-10 where we see 97\.78% vs\. 75\.56%, a positive 22\.2 percent gap\. The identical MNIST and FashionMNIST results, despite different data complexity, suggest that the advantage stems from the optimization mechanism rather than the data distribution, while the larger CIFAR\-10 gap is consistent with CNN\-based architectures being more sensitive to directional changes that cosine distances can capture in the QUBO formulation\. For the Lie attack, architecture matters as we see QUBO formalism outperforms classical MultiKrum on the MLP\-based datasets, i\.e\., MNIST and FashionMNIST, but not on CIFAR\-10, which is consistent with lower parameter dimensionality \( 17K for MNIST and Fashion MNIST vs\. 159K for CIFAR\-10\) producing larger per\-coordinate shifts that are more detectable by classical MultiKrum’s Euclidean scoring\. For Shuffle, classical MultiKrum has a slight edge on MNIST and FashionMNIST, whereas on CIFAR\-10 QUBO performs better as shuffling disrupts CNN filter\-level coherence\. Finally, FashionMNIST closely matches MNIST across all attacks, reinforcing that detection performance depends primarily on model architecture and attack type rather than visual dataset complexity\.

Overall, the three\-dataset comparison \(Table[VI](https://arxiv.org/html/2605.16438#S7.T6)\) confirms that QUBO\-based optimization provides its greatest value against attacks that exploit the limitations of per\-client distance scoring such as ALIE, Lie, Sparse Lie, and Sign Flip, with an average improvement of 8 to 10 percentage points on these five evasion attacks, consistent across architectures and amplified on structured CNN gradient spaces\.

Figures[1](https://arxiv.org/html/2605.16438#S7.F1),[2](https://arxiv.org/html/2605.16438#S7.F2),[3](https://arxiv.org/html/2605.16438#S7.F3),[4](https://arxiv.org/html/2605.16438#S7.F4),[5](https://arxiv.org/html/2605.16438#S7.F5), and[6](https://arxiv.org/html/2605.16438#S7.F6)present round\-by\-round detection performance on MNIST, CIFAR\-10, and FashionMNIST on ALIE and Sparse Lie attacks, clearly showing the benefits of QUBO formalism versus classical MultiKrum\. Notably, the very similar curvature of the MNIST and FashionMNIST diagrams suggests that the detection is architecture rather than data driven\.

![Refer to caption](https://arxiv.org/html/2605.16438v1/plots/advanced.png)

Figure 1:MNIST: Round\-by\-round detection under ALIE attack\.![Refer to caption](https://arxiv.org/html/2605.16438v1/plots/sparse.png)

Figure 2:MNIST: Round\-by\-round detection under Sparse Lie attack\.![Refer to caption](https://arxiv.org/html/2605.16438v1/plots/cifar_advanced.png)

Figure 3:CIFAR\-10: Round\-by\-round detection under ALIE attack\.![Refer to caption](https://arxiv.org/html/2605.16438v1/plots/cifar_sparse.png)

Figure 4:CIFAR\-10: Round\-by\-round detection under Sparse Lie attack\.![Refer to caption](https://arxiv.org/html/2605.16438v1/plots/fmnist_advanced.png)

Figure 5:FashionMNIST: Round\-by\-round detection under ALIE attack\.![Refer to caption](https://arxiv.org/html/2605.16438v1/plots/fmnist_sparse.png)

Figure 6:FashionMNIST: Round\-by\-round detection under Sparse Lie attack\.
### VII\-B100\-Client Hybrid Annealer Results

Table[VII](https://arxiv.org/html/2605.16438#S7.T7)presents average detection accuracy over 5 rounds at 100 clients on MNIST, comparing classical MultiKrum, the initial Cascaded Dual\-QUBO ensemble, and the MultiSignal ensemble\. F1 scores are shown in Table[VIII](https://arxiv.org/html/2605.16438#S7.T8)\.

TABLE VII:MNIST: 100\-Client Average Detection Accuracy averaged over 5 rounds with 80 honest, 20 Byzantine clients\. Bold indicates the best method; ties are all bold\.TABLE VIII:MNIST: 100\-Client Average F1\-score averaged over 5 rounds with 80 honest, 20 Byzantine clients\. Bold indicates the best method; ties are all bold\.The MultiSignal ensemble achieves its most dramatic gain on Sparse Lie with 95\.2% detection accuracy vs\. 72\.0% in classical MultiKrum, a 23\.2 percentage\-point gain, and vs\. 80\.0% cascade, a 15\.2 percentage\-point gain\. The suspicion penalty is particularly effective here because Sparse Lie modifies only the top 5% highest\-variance coordinates, producing Byzantine gradients that are near\-identical to honest ones in 95% of dimensions, which is exactly the pattern theτs\\tau\_\{s\}threshold \(10th percentile of pairwise distances\) is designed to flag\.

ALIE detection accuracy improves from 80\.4% in classical MultiKrum and 80\.0% in cascade to 85\.2%\. The agreement voting mechanism is effective here\. The suspicion QUBO detects different subsets of Byzantine clients than classical MultiKrum, and combining both signals via QUBO\-primary voting yields a selection better than either method alone\.

Overall, the MultiSignal ensemble achieves 96\.73% average detection accuracy versus 92\.07% for classical MultiKrum and 93\.33% for the cascade, with perfect detection on all outlier attacks\. The average F1 score improves from 80\.17% using classical MultiKrum to 91\.83% using MultiSignal, with the largest F1 gain on Sparse Lie from 30\.0% to 88\.0%\.

## VIIIDiscussion

### VIII\-AWhy the Approaches Differ

The classic and QUBO\-based solutions offer complementary approaches for assessing the trustworthiness of client updates\.

Classical MultiKrum evaluates each client independently by computing its Krum score and greedily selects themmclients with the lowest individual scores\. Any client whose gradients look normal will be accepted, and any outlier will be flagged as Byzantine\. Classical MultiKrum will identify the attacks like Gaussian Noise, Scale, Blatant Lie, Same Value, Targeted, Clustered, Label Flip, and Stealthy without fail\.

QUBO\-based selection jointly optimizes over all\(nm\)\\binom\{n\}\{m\}possible subsets using cosine distance\. This makes it sensitive to the direction the gradient points, not its magnitude\. The quadratic interaction termsQi​j=−2​Di​j\+2​λQ\_\{ij\}=\-2D\_\{ij\}\+2\\lambdaencode pairwise relationships globally, picking the tightest cluster ofmmclients\. As a result, the QUBO method catches updates that, although not outliers from a Krum score perspective, have their gradients pointing in the wrong direction\. QUBO\-based selection is particularly effective with Lie, Advanced Lie, Sparse Lie, and Sign Flip, as these produce Byzantine gradients that appear statistically similar to honest gradients when evaluated individually\. As our experiments showed, model architecture also plays a major role in adversarial attack detection\. For example, the CNN used for CIFAR\-10 encodes learned spatial filter patterns and the cosine signature changes are easily detectable\. As a result, QUBO performed significantly better under the Shuffle attack \(90\.67% vs\. 70\.22%\)\. Conversely, the same attack is not identified as well by QUBO when the model is significantly simpler, e\.g\., MNIST and FashionMNIST at∼\\sim17K parameters, as these do not create distinctive enough directional anomalies\. ALIE attack detection was particularly effective using QUBO\. This attack modifies only 20% of coordinates with large deviations, leaving 80% unchanged; although it does not produce a significant Euclidean outlier, it shifts the gradient direction sufficiently to be detected by the QUBO formalism\. It is a well\-known problem that annealing will perform sub\-optimally given a complex energy landscape\. As a result, given scattered Byzantine gradients, the QUBO objective’s global minimum itself likely includes Byzantine updates\.

### VIII\-BComplexity Analysis

Classical MultiKrum runs inO​\(n2​d\+n​log⁡n\)O\(n^\{2\}d\+n\\log n\), i\.e\., quadratic in clientsnntimes gradient dimensionddfor pairwise distances, plusO​\(n​log⁡n\)O\(n\\log n\)for sorting\.

The QUBO pipeline has complexityO​\(n2​k\+γ\)O\(n^\{2\}k\+\\gamma\), wherekkis the projection dimension andγ\\gammathe annealer time\. For simulated annealing,γ\\gammadepends on the number of reads\. For quantum annealer, it includes embedding and QPU time, bounded by hardware rather than input size\. Withn=15n=15, the QUBO has 15 binary variables and\(152\)=105\\binom\{15\}\{2\}=105quadratic terms, well within current hardware capabilities\.

Both Cascaded Dual\-QUBO and MultiSignal ensemble computes both Euclidean Krum on full gradients,O​\(n2​d\)O\(n^\{2\}d\), and cosine Krum scores on projected gradients,O​\(n2​k\)O\(n^\{2\}k\), costingO​\(n2​d\+n2​k\)O\(n^\{2\}d\+n^\{2\}k\)\. For Cascaded Dual\-QUBO, classical MultiKrum was used above gap threshold at a cost ofO​\(n2​d\)O\(n^\{2\}d\)\. For attacks with below threshold gap, QUBO costsO​\(n2​k\+γ\)O\(n^\{2\}k\+\\gamma\)\.

Similarly for MultiSignal ensemble, classical MultiKrum is applied to outliers at a cost ofO​\(n2​d\)O\(n^\{2\}d\)\. For the evasion route the dual distance matrix costsO​\(n2​k\)O\(n^\{2\}k\), QUBO construction and solving costsO​\(n2​k\+γ\)O\(n^\{2\}k\+\\gamma\)\. Cascaded Dual\-QUBO and MultiSignal ensemble thus incur no additional cost over the pure QUBO pipeline\.

### VIII\-CLimitations

We evaluated only three datasets \(MNIST, FashionMNIST, CIFAR\-10\) and all models used in these experiments are relatively small\. Larger models may require larger projection dimensions, which may not be feasible given current QA hardware limitations\. The experiments were performed with each of the 13 individual attack types in isolation, and the effects of a mixture of attacks have yet to be evaluated\. In such a scenario, the routing gate could become confused\. For example, if 50% of attacks are Gaussian and another 50% are ALIE, the wrong regime could be selected\. A potential solution in such scenarios would be to switch to a “paranoid” mode, in which the union of all clients selected by both methods would be flagged as Byzantine\.

## IXConclusion

We present in this paper a novel QUBO\-based method for Byzantine\-robust aggregation in FL\. We evaluated our approach at two scales: first, a naive QUBO formulation using simulated annealing with 15 clients across three datasets; second a Cascaded Dual\-QUBO ensemble that used a simple threshold\-based routing mechanism to process outlier attacks using classical MultiKrum and evasion attacks using QA\. As the Cascaded Dual\-QUBO performance did not improve on ALIE, we experimented with a novel MultiSignal ensemble approach\.

We showed that for 15 clients, the QUBO formulation achieves up to 97\.78% detection accuracy on ALIE on CIFAR\-10 and 95\.11% on MNIST, with an average 8 to 10 percentage\-point improvement on the five hardest evasion attacks across all three datasets \(Table[VI](https://arxiv.org/html/2605.16438#S7.T6)\)\. The MultiSignal ensemble scales to 100 clients with 96\.73% average detection accuracy, a 4\.7 percentage\-point improvement, achieving Sparse Lie detection of 95\.2%, a 23\.2 percentage\-point improvement, and ALIE of 85\.2%, a 4\.8 percentage\-point improvement\. The suspicion\-penalized QUBO directly counteracts evasion attacks that exploit the standard QUBO’s cluster\-seeking objective, yielding the largest F1 improvement on Sparse Lie\.

Future work will focus on scaling to over 500 clients by leveraging the QA’s hybrid solver capacity\. We aim to validate the existing method and enhance it as needed for mixtures of attacks\. We also plan to evaluate wall\-clock quantum advantage through direct QPU comparison, combining QUBO\-based selection with quantum embedding of features\[[7](https://arxiv.org/html/2605.16438#bib.bib2)\]in a unified quantum pipeline\. We wish to extend our study to learn routing functions that adapt thresholds to the observed gradient distribution and investigate adaptive attacks specifically targeting the suspicion\-penalized QUBO formulation\.

## References

- \[1\]T\. Albash and D\. A\. Lidar\(2018\)Adiabatic quantum computation and quantum annealing\.Reviews of Modern Physics90\(1\),pp\. 015002\.External Links:[Document](https://dx.doi.org/10.1103/RevModPhys.90.015002)Cited by:[§I](https://arxiv.org/html/2605.16438#S1.p3.1),[§III\-C](https://arxiv.org/html/2605.16438#S3.SS3.p1.2)\.
- \[2\]M\. Baruch, G\. Baruch, and Y\. Goldberg\(2019\)A little is enough: circumventing defenses for distributed learning\.External Links:1902\.06156Cited by:[§I](https://arxiv.org/html/2605.16438#S1.p2.1)\.
- \[3\]P\. Blanchard, E\. M\. El Mhamdi, R\. Guerraoui, and J\. Stainer\(2017\)Machine learning with adversaries: byzantine tolerant gradient descent\.InAdvances in Neural Information Processing Systems 30 \(NeurIPS\),Cited by:[§I](https://arxiv.org/html/2605.16438#S1.p1.1),[§I](https://arxiv.org/html/2605.16438#S1.p2.1),[§II](https://arxiv.org/html/2605.16438#S2.p1.1)\.
- \[4\]L\. Chen, H\. Wang, Z\. Charles, and D\. Papailiopoulos\(2018\)DRACO: byzantine\-resilient distributed training via redundant gradients\.InProceedings of the 35th International Conference on Machine Learning \(ICML\),Vol\.80,pp\. 903–912\.Cited by:[§II](https://arxiv.org/html/2605.16438#S2.p1.1)\.
- \[5\]E\. M\. El Mhamdi, R\. Guerraoui, A\. Guirguis, and S\. Rouault\(2018\)The hidden vulnerability of distributed learning in byzantium\.InProceedings of the 1st Conference on Machine Learning and Systems \(MLSys\),Cited by:[§II](https://arxiv.org/html/2605.16438#S2.p1.1)\.
- \[6\]C\. Fenget al\.\(2023\)Sentinel: an aggregation function to secure decentralized federated learning\.arXiv preprint arXiv:2310\.08097\.Cited by:[§II](https://arxiv.org/html/2605.16438#S2.p1.1)\.
- \[7\]A\. Ferenczi, D\. Wang, S\. Samanta, and T\. Hodges\(2025\)Beyond classical multi\-krum: enhancing byzantine detection with quantum embeddings\.In2025 IEEE International Conference on Quantum Artificial Intelligence \(QAI\),Naples, Italy,pp\. 49–54\.External Links:[Document](https://dx.doi.org/10.1109/QAI63978.2025.00015)Cited by:[§I](https://arxiv.org/html/2605.16438#S1.p5.1),[§II](https://arxiv.org/html/2605.16438#S2.p3.1),[§IX](https://arxiv.org/html/2605.16438#S9.p3.1)\.
- \[8\]P\. Kairouz, H\. B\. McMahan, B\. Avent, A\. Bellet, M\. Bennis,et al\.\(2021\)Advances and open problems in federated learning\.Foundations and Trends in Machine Learning14\(1–2\),pp\. 1–210\.External Links:[Document](https://dx.doi.org/10.1561/2200000083)Cited by:[§I](https://arxiv.org/html/2605.16438#S1.p1.1)\.
- \[9\]G\. A\. Kochenberger, J\. Hao, F\. Glover, M\. Lewis, Z\. Lü, H\. Wang, and Y\. Wang\(2014\)The unconstrained binary quadratic programming problem: a survey\.Vol\.222,Annals of Operations Research\.External Links:[Document](https://dx.doi.org/10.1007/s10479-014-1685-y)Cited by:[§I](https://arxiv.org/html/2605.16438#S1.p3.1),[§III\-C](https://arxiv.org/html/2605.16438#S3.SS3.p1.2)\.
- \[10\]A\. Krizhevsky\(2009\)Learning multiple layers of features from tiny images\.Technical ReportUniversity of Toronto\.External Links:[Link](https://www.cs.toronto.edu/~kriz/cifar.html)Cited by:[§I](https://arxiv.org/html/2605.16438#S1.p4.1)\.
- \[11\]Y\. LeCun and C\. Cortes\(2010\)MNIST handwritten digit database\.Note:http://yann\.lecun\.com/exdb/mnist/External Links:[Link](http://yann.lecun.com/exdb/mnist/)Cited by:[§I](https://arxiv.org/html/2605.16438#S1.p4.1)\.
- \[12\]H\. Liu, Z\. Liu, H\. Yin, and Z\. Chen\(2025\)Quantum\-enhanced blockchain federated learning via quantum byzantine agreement\.Science China Information Sciences68\.External Links:[Document](https://dx.doi.org/10.1007/s11432-025-4471-7)Cited by:[§II](https://arxiv.org/html/2605.16438#S2.p2.1)\.
- \[13\]A\. Lucas\(2014\)Ising formulations of many NP problems\.Frontiers in Physics2,pp\. 5\.External Links:[Document](https://dx.doi.org/10.3389/fphy.2014.00005)Cited by:[§III\-C](https://arxiv.org/html/2605.16438#S3.SS3.p1.1)\.
- \[14\]H\. B\. McMahan, E\. Moore, D\. Ramage, S\. Hampson, and B\. A\. y Arcas\(2017\)Communication\-efficient learning of deep networks from decentralized data\.InProceedings of the 20th International Conference on Artificial Intelligence and Statistics \(AISTATS\),Proceedings of Machine Learning Research, Vol\.54,pp\. 1273–1282\.Cited by:[§I](https://arxiv.org/html/2605.16438#S1.p1.1),[§III\-A](https://arxiv.org/html/2605.16438#S3.SS1.p1.9)\.
- \[15\]T\. D\. Nguyenet al\.\(2021\)FLAME: taming backdoors in federated learning\.arXiv preprint arXiv:2101\.02281\.Cited by:[§II](https://arxiv.org/html/2605.16438#S2.p1.1)\.
- \[16\]G\. Subramanian and M\. Chinnadurai\(2024\)Hybrid quantum enhanced federated learning for cyber attack detection\.Scientific Reports14,pp\. 32038\.External Links:[Document](https://dx.doi.org/10.1038/s41598-024-83682-z)Cited by:[§II](https://arxiv.org/html/2605.16438#S2.p2.1)\.
- \[17\]X\. Wei, L\. Fan, Y\. Guo, Y\. Gong, Z\. Han, and Y\. Wang\(2024\)Hybrid quantum–classical benders’ decomposition for federated learning scheduling in distributed networks\.IEEE Transactions on Network Science and Engineering11\(6\),pp\. 6038–6051\.External Links:[Document](https://dx.doi.org/10.1109/TNSE.2024.3440930)Cited by:[§II](https://arxiv.org/html/2605.16438#S2.p2.1)\.
- \[18\]X\. Wei, L\. Fan, Y\. Guo, Z\. Han, and Y\. Wang\(2023\)Quantum assisted scheduling algorithm for federated learning in distributed networks\.In2023 32nd International Conference on Computer Communications and Networks \(ICCCN\),pp\. 1–10\.External Links:[Document](https://dx.doi.org/10.1109/ICCCN58024.2023.10230094)Cited by:[§II](https://arxiv.org/html/2605.16438#S2.p2.1)\.
- \[19\]Q\. Xia, Z\. Tao, and Q\. Li\(2021\)Defending against byzantine attacks in quantum federated learning\.InProceedings of the 17th International Conference on Mobility, Sensing and Networking \(MSN\),pp\. 145–152\.External Links:[Document](https://dx.doi.org/10.1109/MSN53354.2021.00035)Cited by:[§II](https://arxiv.org/html/2605.16438#S2.p2.1)\.
- \[20\]H\. Xiao, K\. Rasul, and R\. Vollgraf\(2017\)Fashion\-mnist: a novel image dataset for benchmarking machine learning algorithms\.arXiv preprint arXiv:1708\.07747\.Cited by:[§I](https://arxiv.org/html/2605.16438#S1.p4.1),[§VI\-A](https://arxiv.org/html/2605.16438#S6.SS1.p1.9)\.
- \[21\]Y\. Xu and L\. Lyu\(2023\)Secure federated learning against model poisoning attacks via cosine similarity\-based outlier detection\.arXiv preprint arXiv:2304\.00160\.Cited by:[§II](https://arxiv.org/html/2605.16438#S2.p1.1)\.
- \[22\]Q\. Yang, Y\. Liu, T\. Chen, and Y\. Tong\(2019\)Federated machine learning: concept and applications\.ACM Transactions on Intelligent Systems and Technology10\(2\),pp\. 1–19\.External Links:[Document](https://dx.doi.org/10.1145/3298981)Cited by:[§I](https://arxiv.org/html/2605.16438#S1.p1.1)\.
- \[23\]D\. Yin, Y\. Chen, K\. Ramchandran, and P\. Bartlett\(2018\)Byzantine\-robust distributed learning: towards optimal statistical rates\.InProceedings of the 35th International Conference on Machine Learning \(ICML\),Vol\.80,pp\. 5650–5659\.Cited by:[§II](https://arxiv.org/html/2605.16438#S2.p1.1)\.
- \[24\]Y\. Zhang, C\. Zhang, C\. Zhang, L\. Fan, B\. Zeng, and Q\. Yang\(2022\)Federated learning with quantum secure aggregation\.arXiv preprint arXiv:2207\.07444\.Cited by:[§II](https://arxiv.org/html/2605.16438#S2.p2.1)\.
- \[25\]Z\. Zhang, Q\. Su, and X\. Sun\(2022\)Dim\-krum: backdoor\-resistant federated learning for NLP with dimension\-wise krum\-based aggregation\.InFindings of the Association for Computational Linguistics: EMNLP 2022,pp\. 339–354\.Cited by:[§II](https://arxiv.org/html/2605.16438#S2.p1.1)\.