Thermo-FL: Thermal-Aware Robust Federated Fine-Tuning of Large Language Models for Edge AI

# Thermo-FL: Thermal-Aware Robust Federated Fine-Tuning of Large Language Models for Edge AI
Source: [https://arxiv.org/html/2608.21172](https://arxiv.org/html/2608.21172)
Shiva Shrestha1, Kazi Shaharair Sharif1, Zongxing Xie1, Jiajing Huang2, Anhao Xiang3, and Honghui Xu3Affiliation:1Department of Computer Science, Kennesaw State University Marietta, GA 30060, USA \{sshres16,ksharif2\}@students\.kennesaw\.edu zxie1@kennesaw\.eduAffiliation:2School of Data Science and Analytics, Kennesaw State University Marietta, GA 30060, USA jhuang24@kennesaw\.eduAffiliation:3Department of Information Technology, Kennesaw State University Marietta, GA 30060, USA \{axiang,hxu10\}@kennesaw\.edu

###### Abstract

Federated fine\-tuning enables large language models to adapt on edge devices without centralizing private data, but practical deployments must address hardware instability and adversarial update corruption together\. Thermally constrained clients may throttle, slow local training, or delay synchronous aggregation, while Byzantine clients and communication\-layer adversaries can corrupt the updates used to form the global model\. To address these challenges, we present Thermo\-FL, a thermal\-aware federated LoRA fine\-tuning framework that uses device temperature as an active control signal for local adapter training and sparse update transmission\. On the client side, Thermo\-FL adjusts the active LoRA\-layer fraction and transmitted update density as devices heat or cool, reducing workload under thermal stress\. On the server side, Thermo\-FL introduces TERRA, a robust aggregation pipeline for dynamically sparse LoRA updates that combines norm filtering, mask\-aware directional validation, adaptive active\-coordinate clipping, and mask\-aware aggregation\. We evaluate Thermo\-FL using both a large\-scale emulator and a Jetson\-based physical testbed\. In the emulator, Thermo\-FL improves robustness under adversarial sparse aggregation and achieves the strongest BoolQ accuracy across clean and attack settings while remaining competitive on GSM8K\. In the physical prototype, Thermo\-FL stabilizes device temperature, reduces compressed upload size through bitmap sparse encoding, and preserves GSM8K utility under sign\-flip/scale and MITM perturbations\. These results show that secure edge LLM adaptation should jointly consider hardware behavior, workload regulation, sparse communication, and aggregation robustness\.

## IIntroduction

The increasing deployment of large language models \(LLMs\) has brought sophisticated language understanding and generation capabilities directly to edge devices, such as mobile phones, drones, robots, vehicles, medical systems, and industry sensors\[[41](https://arxiv.org/html/2608.21172#bib.bib8),[39](https://arxiv.org/html/2608.21172#bib.bib1)\]\. This shift creates a rapidly growing need to personalize and adapt the LLMs to domain\-specific tasks using the data generated outside the centralized cloud server environments\. For individual users, local data may capture preferences, writing style, language, and interaction patterns, and for small organizations, clinics, field teams, and industrial operators, local data may contain domain vocabulary, operational procedures, sensitive records, internal reports, and so on that are difficult to centralize because of privacy, cost, and government constraints\[[23](https://arxiv.org/html/2608.21172#bib.bib7)\]\. This need is already visible in large\-scale mobile systems, where federated learning \(FL\) has been used to improve the on\-device keyboard and language model behaviour without collecting users’ raw data text\[[18](https://arxiv.org/html/2608.21172#bib.bib2)\]\. Federated Learning offers a promising path for this setting by allowing multiple clients to adapt the shared model collaboratively without having to upload the raw data to the central server\[[35](https://arxiv.org/html/2608.21172#bib.bib4)\]\. In particular, combined with the parameter\-efficient fine\-tuning \(PEFT\) techniques like Low\-Rank Adaptation \(LoRA\), federated learning allows the resource\-constrained devices to collaboratively adapt the LLMs without updating the entire model\[[21](https://arxiv.org/html/2608.21172#bib.bib11)\]\.

However, federated learning on the edge devices is not a simple scaled\-down version of the cloud\-based distributed training\[[38](https://arxiv.org/html/2608.21172#bib.bib3)\]\. Unlike cloud servers, edge devices operate under limited power, constrained cooling, and unstable runtime conditions, which can delay the training process, reduce client participation, and increase the communication overhead\. At the same time, unlike cloud servers running in the controlled data center, edge devices are deployed in the physically open and often unmonitored environments, which may expose the federated process to adversarial threats, including but not limited to corrupted client updates and communication\-layer perturbations\[[2](https://arxiv.org/html/2608.21172#bib.bib23),[6](https://arxiv.org/html/2608.21172#bib.bib22),[24](https://arxiv.org/html/2608.21172#bib.bib24),[10](https://arxiv.org/html/2608.21172#bib.bib26)\]\. These realities impose a simultaneous demand, where the system must respect both hardware limitations while still protecting the global model from unreliable or malicious updates\.

Existing federated LLM fine\-tuning methods address individual aspects of this problem, but they rarely treat hardware constraints and adversarial robustness as coupled design requirements\. PEFT reduces the number of trainable parameters, allowing edge devices to fine\-tune the LLM even in resource\-constrained environments\[[37](https://arxiv.org/html/2608.21172#bib.bib32),[40](https://arxiv.org/html/2608.21172#bib.bib33)\]\. Robust aggregation methods can mitigate the corrupted or malicious updates at the server side\[[42](https://arxiv.org/html/2608.21172#bib.bib43),[7](https://arxiv.org/html/2608.21172#bib.bib27),[12](https://arxiv.org/html/2608.21172#bib.bib42),[45](https://arxiv.org/html/2608.21172#bib.bib41)\]\. However, these methods are typically developed independently, where hardware conditions are treated as external runtime conditions, while robustness is treated as a server\-side filtering problem over the received updates\. In practice, under the edge environment, this assumption can break down\. A thermally stressed client may experience throttling, delayed training, or reduced participation\[[34](https://arxiv.org/html/2608.21172#bib.bib16),[16](https://arxiv.org/html/2608.21172#bib.bib19)\], while an adversarial client or communication\-layer perturbation may produce abnormal updates that also appear unreliable to the server\[[2](https://arxiv.org/html/2608.21172#bib.bib23),[10](https://arxiv.org/html/2608.21172#bib.bib26),[6](https://arxiv.org/html/2608.21172#bib.bib22)\]\. Therefore, an edge federated fine\-tuning framework must reduce the burden on resource\-constrained clients while protecting the server\-side aggregation from unreliable or malicious updates\. This motivates the development of a framework that is hardware\-aware on the client side and robust on the server\-side\.

To address this gap, we propose Thermo\-FL, a hardware\-aware and robust federated learning framework for LoRA fine\-tuning of LLMs on thermally\-constrained edge devices\. On the client\-side, Thermo\-FL uses the device temperature as a control signal to regulate local LoRA adaptation and sparse update transmission\. When a client becomes thermally stressed, the framework reduces computation and communication load for that client, and when the temperature remains within the safer thermal range, it can participate more fully\. On the server side, Thermo\-FL introduces TERRA \(Thermo\-Enhanced Robust Round Aggregation\), a robust aggregation layer that protects the global model by applying magnitude filtering, directional validation, and adaptive clipping to received updates\. Together, these client\-side and server\-side mechanisms allow Thermo\-FL to adapt to hardware\-induced irregularities while also maintaining robustness against adversarial attacks\. To sum up, the key contributions of this paper are summarized as follows:

- •We propose Thermo\-FL, a hardware\-aware and robust framework for federated LoRA fine\-tuning on thermally constrained edge devices\.
- •A temperature\-driven client policy is formulated to dynamically modify LoRA training and sparse update transmission based on the device thermal conditions\.
- •TERRA is designed as a robust aggregation layer tailored to dynamically sparse LoRA updates, combining magnitude control, directional validation, and adaptive clipping to mitigate corrupted updates\.

The remainder of the paper is organized as follows: Section[II](https://arxiv.org/html/2608.21172#S2)presents background on federated learning and LoRA\. Section[III](https://arxiv.org/html/2608.21172#S3)defines the system and threat model\. Section[IV](https://arxiv.org/html/2608.21172#S4)describes Thermo\-FL and TERRA\. Section[V](https://arxiv.org/html/2608.21172#S5)presents the evaluation\. Section[VI](https://arxiv.org/html/2608.21172#S6)discusses implications and limitations, Section[VII](https://arxiv.org/html/2608.21172#S7)reviews related work, and Section[VIII](https://arxiv.org/html/2608.21172#S8)concludes\.

## IIPreliminaries

In this section, we formalize the Federated Learning \(FL\) objective used in our system, specify how Parameter\-Efficient Fine\-Tuning \(PEFT\) is instantiated in the proposed architecture, using LoRA, and introduce the sparse\-update notation used throughout this paper\.

### II\-AFederated Learning Formulation

We consider a distributed training setup consisting of a central aggregator𝒮\\mathcal\{S\}andKKedge clients\. Each clientk∈\{1,…,K\}k\\in\\\{1,\\dots,K\\\}maintains a private dataset𝒟k=\{\(𝐱i,yi\)\}i=1\|𝒟k\|\\mathcal\{D\}\_\{k\}=\\\{\(\\mathbf\{x\}\_\{i\},y\_\{i\}\)\\\}\_\{i=1\}^\{\|\\mathcal\{D\}\_\{k\}\|\}that is never shared with the server\[[35](https://arxiv.org/html/2608.21172#bib.bib4)\]\. The main goal of the system is to collaboratively optimize a global parameter stateW∈ℝdW\\in\\mathbb\{R\}^\{d\}that minimizes the weighted global objective

minW⁡J⁡\(W\)=∑k=1Kpk​Fk​\(W\),where​pk=\|𝒟k\|∑j=1K\|𝒟j\|\.\\min\_\{W\}J\(W\)=\\sum\_\{k=1\}^\{K\}p\_\{k\}F\_\{k\}\(W\),\\qquad\\text\{where \}p\_\{k\}=\\frac\{\|\\mathcal\{D\}\_\{k\}\|\}\{\\sum\_\{j=1\}^\{K\}\|\\mathcal\{D\}\_\{j\}\|\}\.\(1\)Here, the local lossFk​\(W\)F\_\{k\}\(W\)denotes the empirical risk computed over𝒟k\\mathcal\{D\}\_\{k\}on clientkk, andpkp\_\{k\}weights each client according to its local dataset size or importance\. During each communication roundtt, the server broadcasts the current global model stateW\(t\)W^\{\(t\)\}to all participating clients\. Each client then performs local optimization, typically using stochastic gradient descent \(SGD\), to produce a model deltaΔk\(t\)\\Delta\_\{k\}^\{\(t\)\}\. The server aggregates the received updates intoΔ¯\(t\)\\bar\{\\Delta\}^\{\(t\)\}and updates the global model asW\(t\+1\)=W\(t\)\+Δ¯\(t\)W^\{\(t\+1\)\}=W^\{\(t\)\}\+\\bar\{\\Delta\}^\{\(t\)\}, which is redistributed in the subsequent communication round\.

### II\-BFederated LoRA Fine\-Tuning

Full\-parameter fine\-tuning of Large Language Models \(LLMs\) is often impractical on edge hardware due to memory, computation, and communication constraints\. Parameter\-efficient fine\-tuning \(PEFT\) methods reduce this burden by updating only a small set of trainable parameters instead of the full model weights\[[19](https://arxiv.org/html/2608.21172#bib.bib21),[30](https://arxiv.org/html/2608.21172#bib.bib29),[32](https://arxiv.org/html/2608.21172#bib.bib12)\]\. In this work, we use Low\-Rank Adaptation \(LoRA\) as the local fine\-tuning mechanism\[[21](https://arxiv.org/html/2608.21172#bib.bib11),[46](https://arxiv.org/html/2608.21172#bib.bib13),[27](https://arxiv.org/html/2608.21172#bib.bib30),[5](https://arxiv.org/html/2608.21172#bib.bib31)\]\. LoRA assumes that weight updates during the adaptation/training process lie in a low intrinsic subspace\. For a pre\-trained weight matrix𝐖0∈ℝd×k\\mathbf\{W\}\_\{0\}\\in\\mathbb\{R\}^\{d\\times k\}, the updates are parameterized as a low\-rank factorizationΔ​𝐖=𝐁𝐀\\Delta\\mathbf\{W\}=\\mathbf\{BA\}, where𝐁∈ℝd×r\\mathbf\{B\}\\in\\mathbb\{R\}^\{d\\times r\}and𝐀∈ℝr×k\\mathbf\{A\}\\in\\mathbb\{R\}^\{r\\times k\}with rankr≪min⁡\(d,k\)r\\ll\\min\(d,k\)\. In practice, this constrains adaptation to a compact subspace while preserving the representational capacity of the frozen backbone\. The forward computation is therefore modified to

𝐡=𝐖0​𝐱\+αr​𝐁𝐀𝐱\\mathbf\{h\}=\\mathbf\{W\}\_\{0\}\\mathbf\{x\}\+\\frac\{\\alpha\}\{r\}\\mathbf\{BA\}\\mathbf\{x\}\(2\)whereα\\alphais a scaling constant\. During local optimization,𝐖0\\mathbf\{W\}\_\{0\}remains fixed and only𝐀\\mathbf\{A\}and𝐁\\mathbf\{B\}receive gradient updates\. In federated LoRA fine\-tuning, each selected clientkkinitializes from the current global LoRA state and fine\-tunes the LoRA parameters on its private dataset𝒟k\\mathcal\{D\}\_\{k\}\. After local training at roundtt, the client produces a LoRA updateΔk\(t\)\\Delta\_\{k\}^\{\(t\)\}, which represents the change in its trainable LoRA parameters\. The server aggregates the received LoRA updates intoΔ¯\(t\)\\bar\{\\Delta\}^\{\(t\)\}and applies the result to the global LoRA state for the next communication round\. This allows clients to collaboratively adapt an LLM while avoiding full\-parameter training and without sharing raw local data\.

## IIIHardware analysis and Threat Model

In this section, we describe the hardware limitations and the adversarial framework used in this research\. These constraints are important because local fine\-tuning can increase device temperature and delay client updates, while adversarial clients or communication\-layer perturbations can corrupt the updates used for aggregation\. Therefore, our approach includes modeling two aspects of the problem: first, the hardware conditions that affect client\-side training and synchronization; second, the integrity threats that affect server\-side aggregation\.

### III\-ADynamic Voltage and Frequency Scaling \(DVFS\):

LoRA reduces the number of trainable parameters, but local fine\-tuning still requires repeated matrix operations, optimizer updates, and memory movement on edge hardware\. On the edge devices without any fan or those that have cooling constraints, sustained training can lead to thermal accumulation and runtime slowdowns\[[36](https://arxiv.org/html/2608.21172#bib.bib25),[17](https://arxiv.org/html/2608.21172#bib.bib18),[14](https://arxiv.org/html/2608.21172#bib.bib17),[16](https://arxiv.org/html/2608.21172#bib.bib19)\]\. Modern embedded platforms commonly rely on Dynamic Voltage and Frequency Scaling \(DVFS\) to reduce clock frequency when temperature approaches a critical operating region\. We abstract this behavior using a simple two\-state model:

f⁡\(t\)=\{fmax,T⁡\(t\)<Tcrit,fth,T⁡\(t\)≥Tcrit,f\(t\)=\\begin\{cases\}f\_\{\\max\},&T\(t\)<T\_\{\\mathrm\{crit\}\},\\\\ f\_\{\\mathrm\{th\}\},&T\(t\)\\geq T\_\{\\mathrm\{crit\}\},\\end\{cases\}\(3\)whereT⁡\(t\)T\(t\)is the device temperature at timett,TcritT\_\{\\mathrm\{crit\}\}is the throttling threshold,fmaxf\_\{\\max\}is the nominal operating frequency, andfth<fmaxf\_\{\\mathrm\{th\}\}<f\_\{\\max\}denotes the reduced frequency under thermal throttling\. This abstraction does not simply imply that real DVFS controllers use only two frequency states\. In practice, embedded devices generally have multiple intermediate frequency levels and smooth governor policies\. In Eq\.[3](https://arxiv.org/html/2608.21172#S3.E3), we only capture the dominant effect relevant to synchronous federated training, where once a client enters a throttled regime, its local computation time can increase substantially\. In this paper, we refer to the resulting synchronization bottleneck as the thermal wall\. In a synchronous FL round, the server cannot complete aggregation until the required client updates have arrived\. Therefore, if clientkkbecomes thermally throttled, its local computation timetcompkt\_\{\\mathrm\{comp\}\}^\{k\}may delay the entire round\. This couples the global training throughput to the thermal state of the slowest or most constrained participating clients\.

### III\-BThreat Model

Federated fine\-tuning of large language models on edge devices presents a significantly broader attack surface compared to the centralized training in controlled cloud environments\[[25](https://arxiv.org/html/2608.21172#bib.bib5)\]\. Beyond the common privacy and availability of the devices concern, practical edge deployments must also contend with unreliable communication links, physically exposed hardware, and potentially adversarial participants in the federated learning rounds\. In this work, we focus on integrity attacks, as they pose the most immediate threat to optimization stability, model convergence, and downstream task utility in resource\-constrained federated learning systems\. We consider two integrity\-oriented adversarial classes that are particularly relevant in edge federated learning: internal Byzantine clients, which manipulate updates before transmission, and external man\-in\-the\-middle \(MITM\) adversaries, which tamper with updates while they are in transit\. Together, these capture both endpoint\-level and communication\-level corruption\.

1\. Internal Adversary \(Byzantine Client\):We assume that a subset of authenticated clients may deviate arbitrarily from the intended learning objective while still participating in the communication protocol\[[13](https://arxiv.org/html/2608.21172#bib.bib28),[11](https://arxiv.org/html/2608.21172#bib.bib35)\]\. LetΔk\\Delta\_\{k\}denote the local model update produced by clientkkafter local training\. A Byzantine client instead submits a poisoned update

Δk′=𝒜⁡\(Δk\),\\Delta\_\{k\}^\{\\prime\}=\\mathcal\{A\}\(\\Delta\_\{k\}\),\(4\)where𝒜⁡\(⋅\)\\mathcal\{A\}\(\\cdot\)denotes an adversarial transformation designed to disrupt aggregation and degrade the global model\.

Our threat model includes both simple and composite update\-poisoning behaviors\. The simplest case is asign\-flip attack, which reverses the update direction and amplifies its magnitude:

Asf​\(Δk\)=γ​Δk,γ<−1A\_\{\\mathrm\{sf\}\}\(\\Delta\_\{k\}\)=\\gamma\\Delta\_\{k\},\\quad\\gamma<\-1\(5\)To model a broader and less predictable adversary, we also consider amixed attackfamily that combines several poisoning operators studied in federated learning\[[13](https://arxiv.org/html/2608.21172#bib.bib28)\]\. The purpose of this setting is to avoid evaluating robustness only against a single fixed attack pattern\. Instead, each malicious client may instantiate one attack operator from a set of possible update transformations, including sign flip\[[11](https://arxiv.org/html/2608.21172#bib.bib35)\], Gaussian noise injection, scaling, random masking, model replacement\[[2](https://arxiv.org/html/2608.21172#bib.bib23)\], or an ALIE\-like perturbation\[[4](https://arxiv.org/html/2608.21172#bib.bib36)\]\. Collectively, these operators span directional inversion, stochastic corruption, magnitude amplification, sparsity distortion, and distribution\-aware poisoning\. Their shared goal is to bias the aggregated update, destabilize convergence, and reduce the quality of the final global model\.

2\. External Adversary \(Man\-in\-the\-Middle\(MITM\)\)\.We also consider an external adversary located on the communication path between clients and the server, for example, over unsecured wireless or public network links\[[10](https://arxiv.org/html/2608.21172#bib.bib26)\]\. Unlike a Byzantine participant, this adversary does not originate legitimate client updates, but instead intercepts the legitimate client updates and perturbs them in transit before they reach the server\. We model thisMITM attackas

Δkmitm=Δk\+z,\\Delta\_\{k\}^\{\\mathrm\{mitm\}\}=\\Delta\_\{k\}\+z,\(6\)wherezzdenotes an adversarial perturbation introduced during transmission\. This formulation captures communication\-layer corruption such as packet tampering, interference, or deliberate noise injection applied to otherwise benign client updates\.

### III\-CSystem Assumptions

The following assumptions are made throughout this paper\. \(1\) The central server ishonest\-but\-curious: it executes the protocol faithfully but could check the received updates\. Fully malicious servers are not considered\. \(2\) Each client has a distinct identity and does not pretend to be other clients\. \(3\) The physical and thermal properties of all participants, even those who launch attacks, are assumed to fall within the bounds described in Section[III\-A](https://arxiv.org/html/2608.21172#S3.SS1)\. \(4\) The temperature readings come from hardware components on each device and thus correspond to the true state of the device\. The proposed threat model directly motivates the design of Thermo\-FL\. Edge deployments require defenses against adversarial updates to protect aggregation integrity, but these defenses must remain lightweight because thermal and energy budgets are constrained\. Cryptographic mechanisms such as selective homomorphic encryption can protect update confidentiality, but they introduce additional system overhead and are orthogonal to our aggregation\-layer robustness goal\[[20](https://arxiv.org/html/2608.21172#bib.bib34)\]\. Thermo\-FL therefore uses a lightweight hardware\-software co\-design: client\-side temperature\-aware workload regulation reduces stress on constrained devices, while server\-side robust aggregation limits the influence of unreliable or malicious updates\.

![Refer to caption](https://arxiv.org/html/2608.21172v1/Thermo_Workflow.png)Fig\. 1:Overview of Thermo\-FL architecture

## IVThermo\-FL

Thermo\-FL is a round\-based federated fine\-tuning framework architected around a key observation: in edge environments, the thermal limits, communication constraints, and adversarial updates are not independent system concerns; rather, they are tightly coupled together\. Existing Federated Learning paradigms often treat hardware\-side limitations as external constraints on training\. In contrast, Thermo\-FL converts this client’s thermal state into the first\-class control signal within the learning protocol itself\. In each round, a client measures its local temperature and uses this signal to regulate the number of LoRA layers that remain trainable and the fraction of update coordinates transmitted to the server\. The server then applies the TERRA pipeline to filter and aggregate these dynamically sparse LoRA updates, closing the loop between thermal feedback, sparse communication, and Byzantine\-resilient aggregation\.

### IV\-ADesign Overview and Control Loop

Fig\.[1](https://arxiv.org/html/2608.21172#S3.F1)illustrates the end\-to\-end workflow of the Thermo\-FL architecture across the three major components, client, communication, and server\. At the start of each round, the server broadcasts the current global LoRA parameters denoted byW\(t\)W^\{\(t\)\}to all selected clients in the FL loop\. While the pre\-trained backbone of the model remains frozen,W\(t\)W^\{\(t\)\}represents the set of trainable LoRA adapter parameters attached to the model\. On the client side, each of the selected clients measures its local temperature denoted byTk\(t\)T\_\{k\}^\{\(t\)\}, then they use this measurement to determine the active LoRA\-layer fraction,κk\(t\)\\kappa\_\{k\}^\{\(t\)\}and sparse transmission keep ratio,ρk\(t\)\\rho\_\{k\}^\{\(t\)\}, and perform thermally regulated local fine\-tuning and computes a local LoRA updateΔk\(t\)\\Delta\_\{k\}^\{\(t\)\}, which represents the difference between the locally adapted LoRA parameters and the received global LoRA parameters\. The resulting LoRA update obtained after the difference is then sparsified, encoded, and transmitted to the server\. On the server side, we use the TERRA pipeline to screen out any abnormal updates, validate their direction, clip retained coordinates, and perform mask\-aware aggregation to produce the global aggregate update denoted byΔ¯\(t\)\\bar\{\\Delta\}^\{\(t\)\}\. The server applies this aggregate update to obtainW\(t\+1\)W^\{\(t\+1\)\}, which is then used to begin the next communication round\. The round\-level control loop can be summarized as

W\(t\)\\displaystyle W^\{\(t\)\}→\{Tk\(t\)\}k∈St→\{\(κk\(t\),ρk\(t\)\)\}k∈St\\displaystyle\\rightarrow\\\{T\_\{k\}^\{\(t\)\}\\\}\_\{k\\in S\_\{t\}\}\\rightarrow\\\{\(\\kappa\_\{k\}^\{\(t\)\},\\rho\_\{k\}^\{\(t\)\}\)\\\}\_\{k\\in S\_\{t\}\}\(7\)→\{Δk\(t\)\}k∈St→\{zk\(t\)\}k∈St→U\(t\)\\displaystyle\\rightarrow\\\{\\Delta\_\{k\}^\{\(t\)\}\\\}\_\{k\\in S\_\{t\}\}\\rightarrow\\\{z\_\{k\}^\{\(t\)\}\\\}\_\{k\\in S\_\{t\}\}\\rightarrow U^\{\(t\)\}→ℱTERRA​\(U\(t\)\)→Δ¯\(t\)→W\(t\+1\)\.\\displaystyle\\rightarrow\\mathcal\{F\}\_\{\\mathrm\{TERRA\}\}\(U^\{\(t\)\}\)\\rightarrow\\bar\{\\Delta\}^\{\(t\)\}\\rightarrow W^\{\(t\+1\)\}\.where,StS\_\{t\}denotes the set of clients selected in communication roundtt, andTk\(t\)T\_\{k\}^\{\(t\)\}is the measured device temperature of clientkk\. The two temperature\-controlled parameters play different roles:κk\(t\)∈\(0,1\]\\kappa\_\{k\}^\{\(t\)\}\\in\(0,1\]controls the fraction of LoRA layers that remain trainable during local fine\-tuning, whereasρk\(t\)∈\(0,1\]\\rho\_\{k\}^\{\(t\)\}\\in\(0,1\]controls the fraction of update coordinates retained for transmission\. Each client computes a local LoRA update differenceΔk\(t\)\\Delta\_\{k\}^\{\(t\)\}relative to the received global LoRA parameters, sparsifies and encodes this difference into a transmitted payloadzk\(t\)z\_\{k\}^\{\(t\)\}, and sends the payload to the server\. After decoding, the server obtains the sparse update setU\(t\)=\{uk\(t\):k∈St\}U^\{\(t\)\}=\\\{u\_\{k\}^\{\(t\)\}:k\\in S\_\{t\}\\\}\. TERRA, denoted byℱTERRA​\(⋅\)\\mathcal\{F\}\_\{\\mathrm\{TERRA\}\}\(\\cdot\), then operates on this decoded sparse update set and produces the aggregate updateΔ¯\(t\)\\bar\{\\Delta\}^\{\(t\)\}\. The server then applies this aggregate difference to the current global LoRA parameters, yielding the next round global LoRA weight which is denoted byW\(t\+1\)=W\(t\)\+Δ¯\(t\)W^\{\(t\+1\)\}=W^\{\(t\)\}\+\\bar\{\\Delta\}^\{\(t\)\}\.

The two client\-side control parameters serve different roles\. The active layer fractionκk\(t\)\\kappa\_\{k\}^\{\(t\)\}reduces local backpropagation workload by limiting how many LoRA layers are updated on clientkk\. The transmission keep ratioρk\(t\)\\rho\_\{k\}^\{\(t\)\}reduces uplink payload size by limiting how many update coordinates are retained after local training\. Both parameters are derived from the measured thermal state, but they act on different stages of the round:κk\(t\)\\kappa\_\{k\}^\{\(t\)\}affects local optimization, whereasρk\(t\)\\rho\_\{k\}^\{\(t\)\}affects communication\. This design creates a negative feedback loop between device temperature and learning workload\. When a client heats up, the protocol lowers the amount of local computation and communication assigned to that client\. When the client operates below the thermal threshold, it can participate with a larger active LoRA subset and a denser transmitted update\. Thermo\-FL does not require an exact thermodynamic model of each device\. Instead, it uses measured temperature as a practical feedback signal for adapting the training and transmission behavior of heterogeneous edge clients\.

The following subsections describe the two main components of this control loop\. Section[IV\-B](https://arxiv.org/html/2608.21172#S4.SS2)presents the client\-side thermal policy, including the selection of trainable LoRA layers and the temperature\-driven sparse transmission mechanism\. Section[IV\-C](https://arxiv.org/html/2608.21172#S4.SS3)presents TERRA, the server\-side robust aggregation pipeline for filtering and aggregating dynamically sparse LoRA updates\.

### IV\-BClient\-Side Thermal\-Adaptive Training and Sparse Transmission

The Thermo\-FL architecture’s client\-side component has two coupled mechanisms\. First of all, each client measures its device temperature, which determines the fraction of LoRA layers that remain trainable during local fine\-tuning\. Second, the same thermal signal determines the fraction of update coordinates retained for transmission after training\. We describe these mechanisms in the following subsections\.

##### Thermal\-adaptive LoRA training

Here, LetTk\(t\)T\_\{k\}^\{\(t\)\}denote the recorded temperature of clientkkat roundtt\. Thermo\-FL then maps this temperature to an active LoRA\-layer fraction denoted byκk\(t\)\\kappa\_\{k\}^\{\(t\)\}, which controls the portion of the LoRA layers that participate in backpropagation:

κk\(t\)=\{1\.0,Tk\(t\)<Tlow,κmid,Tlow≤Tk\(t\)≤Thigh,κcrit,Tk\(t\)\>Thigh,\\kappa\_\{k\}^\{\(t\)\}=\\begin\{cases\}1\.0,&T\_\{k\}^\{\(t\)\}<T\_\{\\mathrm\{low\}\},\\\\ \\kappa\_\{\\mathrm\{mid\}\},&T\_\{\\mathrm\{low\}\}\\leq T\_\{k\}^\{\(t\)\}\\leq T\_\{\\mathrm\{high\}\},\\\\ \\kappa\_\{\\mathrm\{crit\}\},&T\_\{k\}^\{\(t\)\}\>T\_\{\\mathrm\{high\}\},\\end\{cases\}\(8\)where0<κcrit≤κmid<10<\\kappa\_\{\\mathrm\{crit\}\}\\leq\\kappa\_\{\\mathrm\{mid\}\}<1are throttling constants\. Only the lastκk\(t\)\\kappa\_\{k\}^\{\(t\)\}fraction of LoRA layers remains trainable during local fine\-tuning\. When the device operates below the lower thermal thresholdTlowT\_\{\\mathrm\{low\}\}, all LoRA layers are trained\. In the intermediate thermal region, the Thermo\-FL framework freezes a portion of the adapter and updates only the lastκmid\\kappa\_\{\\mathrm\{mid\}\}fraction of LoRA layers\. Under high thermal stress, training is restricted to the lastκcrit\\kappa\_\{\\mathrm\{crit\}\}fraction\. This discrete control policy avoids frequent changes in the trainable layer set while still reducing the local backpropagation workload as the device approaches a higher operating temperature\.

LetMk\(t\)M^\{\(t\)\}\_\{k\}denote the layer\-freezing mask induced byκk\(t\)\\kappa^\{\(t\)\}\_\{k\}\. For notational simplicity, we write the masked local optimization in one\-step form; in implementation, the same mask is applied throughout the configured local optimizer steps\. The local LoRA update is then restricted to the active layers:

Wk,local\(t\)=W\(t\)−ηMk\(t\)∇Fk\(W\(t\)\),W^\{\(t\)\}\_\{k,\\mathrm\{local\}\}=W^\{\(t\)\}\-\\eta M^\{\(t\)\}\_\{k\}\\nabla F\_\{k\}\(W^\{\(t\)\}\),\(9\)where,η\\etais the learning rate andFkF\_\{k\}is the local objective of clientkk\. The maskMk\(t\)M\_\{k\}^\{\(t\)\}applies only to the trainable LoRA adapter parameters, while the pre\-trained backbone model weight remains frozen\. After local fine\-tuning, the client constructs the LoRA update difference as:Δk\(t\)=Wk,local\(t\)−W\(t\)\.\\Delta\_\{k\}^\{\(t\)\}=W\_\{k,\\mathrm\{local\}\}^\{\(t\)\}\-W^\{\(t\)\}\.Thus,Δk\(t\)\\Delta\_\{k\}^\{\(t\)\}captures the effect of thermally regulated local optimization during roundtt\. Thermo\-FL transmits a sparsified representation of this update difference rather than the full locally adapted LoRA parameters\.

##### Temperature\-driven sparse transmission

After local fine\-tuning, Thermo\-FL applies sparse transmission to the LoRA update differenceΔk\(t\)\\Delta\_\{k\}^\{\(t\)\}obtained from the thermal\-adaptive LoRA training\. This stage is controlled by the sparse transmission ratio, also called the keep ratioρk\(t\)\\rho\_\{k\}^\{\(t\)\}, which determines the fraction of update coordinates retained for upload\. UnlikeMk\(t\)M\_\{k\}^\{\(t\)\}, which is a layer\-freezing mask used during local optimization, the sparse transmission mask is denoted bymk\(t\)m\_\{k\}^\{\(t\)\}and operates over update coordinates after the fine\-tuning takes place\. Thermo\-FL maps the recorded temperature,Tk\(t\)T\_\{k\}^\{\(t\)\}to the transmission keep ratio as

ρk\(t\)=clip⁡\(b−ω​Tk\(t\),ρmin,ρmax\),ω\>0,\\rho\_\{k\}^\{\(t\)\}=\\operatorname\{clip\}\\left\(b\-\\omega T\_\{k\}^\{\(t\)\},\\rho\_\{\\min\},\\rho\_\{\\max\}\\right\),\\qquad\\omega\>0,\(10\)where0<ρmin≤ρmax≤10<\\rho\_\{\\min\}\\leq\\rho\_\{\\max\}\\leq 1\. This policy makes the retained update fraction decrease with an increase in temperature: cooler clients may transmit denser updates, while thermally stressed clients transmit fewer coordinates\. GivenddLoRA update coordinates, the client retainssk\(t\)=⌊ρk\(t\)​d⌋s\_\{k\}^\{\(t\)\}=\\left\\lfloor\\rho\_\{k\}^\{\(t\)\}d\\right\\rfloorcoordinates with the largest magnitudes inΔk\(t\)\\Delta\_\{k\}^\{\(t\)\}\. The resulting support mask is

mk,j\(t\)=𝟙\[j∈TopK\(\|Δk\(t\)\|,sk\(t\)\)\],m\_\{k,j\}^\{\(t\)\}=\\mathbbm\{1\}\\left\[j\\in\\operatorname\{TopK\}\\left\(\|\\Delta\_\{k\}^\{\(t\)\}\|,s\_\{k\}^\{\(t\)\}\\right\)\\right\],\(11\)wheremk,j\(t\)=1m\_\{k,j\}^\{\(t\)\}=1denotes that the coordinatejjis retained for transmission\. The sparse update before encoding can therefore be given as:Δ~k\(t\)=mk\(t\)⊙Δk\(t\)\.\\tilde\{\\Delta\}\_\{k\}^\{\(t\)\}=m\_\{k\}^\{\(t\)\}\\odot\\Delta\_\{k\}^\{\(t\)\}\.The client then encodes its sparse update as a compact payloadzk\(t\)=Encode⁡\(Δ~k\(t\),mk\(t\)\),z\_\{k\}^\{\(t\)\}=\\operatorname\{Encode\}\\left\(\\tilde\{\\Delta\}\_\{k\}^\{\(t\)\},m\_\{k\}^\{\(t\)\}\\right\),where the supportmk\(t\)m\_\{k\}^\{\(t\)\}is represented using a bitmap and the retained values are serialized and compressed before upload\. In our implementation, the serialized sparse payload is compressed using zlib\. This representation is well\-suited to dynamically sparse LoRA updates because it preserves the coordinate support needed by the server while avoiding transmission of the full dense update vector, thus reducing the overall payload from the edge devices\. On the server side, it receives the encoded payloads\{zk\(t\)\}k∈St\\\{z\_\{k\}^\{\(t\)\}\\\}\_\{k\\in S\_\{t\}\}, decodes them into sparse update\-mask pairs, and applies TERRA to aggregate the reconstructed updates robustly, as described in the following section\.

### IV\-CServer\-Side Robust Aggregation \(TERRA\)

After receiving the encoded sparse payloads, the server then decodes each payload into a reconstructed sparse update,Δ~k\(t\)\\tilde\{\\Delta\}\_\{k\}^\{\(t\)\}and its support mask,mk\(t\)m\_\{k\}^\{\(t\)\}\. We denote the decoded update from clientkkasuk\(t\)=\(Δ~k\(t\),mk\(t\)\),u\_\{k\}^\{\(t\)\}=\(\\tilde\{\\Delta\}\_\{k\}^\{\(t\)\},m\_\{k\}^\{\(t\)\}\),whereΔ~k\(t\)\\tilde\{\\Delta\}\_\{k\}^\{\(t\)\}is the reconstructed sparse LoRA update andmk\(t\)∈\{0,1\}dm\_\{k\}^\{\(t\)\}\\in\\\{0,1\\\}^\{d\}is the corresponding binary support mask\. We denote the decoded update set used by TERRA asU\(t\)=\{uk\(t\):k∈St\}\.U^\{\(t\)\}=\\\{u\_\{k\}^\{\(t\)\}:k\\in S\_\{t\}\\\}\.For norm and direction checks, we flatten each sparse update into a single vector across all LoRA tensors\. The support mask is retained for coordinate\-wise clipping and mask\-aware aggregation\.

TERRA follows the broader robust\-aggregation principle of screening client updates before aggregation\. Prior Byzantine\-robust FL work has shown that magnitude, sign, and similarity statistics can help identify malicious gradients before averaging\[[42](https://arxiv.org/html/2608.21172#bib.bib43)\]\. We adapt this principle to dynamically sparse LoRA updates by applying norm filtering and directional validation to decoded sparse updates while preserving their support masks in the TERRA pipeline\. For clipping, we follow the motivation behind adaptive clipping methods, where clipping thresholds are derived from the update distribution rather than fixed a priori\[[1](https://arxiv.org/html/2608.21172#bib.bib44)\]\. Unlike DP\-focused adaptive clipping, TERRA uses clipping as a robustness mechanism for sparse LoRA aggregation and applies it only over active coordinates\. We express the pipeline as

ℱTERRA=ℱagg∘ℱclip∘ℱdir∘ℱnorm\.\\mathcal\{F\}\_\{\\mathrm\{TERRA\}\}=\\mathcal\{F\}\_\{\\mathrm\{agg\}\}\\circ\\mathcal\{F\}\_\{\\mathrm\{clip\}\}\\circ\\mathcal\{F\}\_\{\\mathrm\{dir\}\}\\circ\\mathcal\{F\}\_\{\\mathrm\{norm\}\}\.\(12\)where,ℱnorm\\mathcal\{F\}\_\{\\mathrm\{norm\}\}performs robust norm filtering,ℱdir\\mathcal\{F\}\_\{\\mathrm\{dir\}\}performs directional validation,ℱclip\\mathcal\{F\}\_\{\\mathrm\{clip\}\}applies adaptive coordinate\-wise clipping on active coordinates, andℱagg\\mathcal\{F\}\_\{\\mathrm\{agg\}\}performs mask\-aware aggregation\. The output of this pipeline is the aggregate updateΔ¯\(t\)=ℱTERRA​\(U\(t\)\),\\bar\{\\Delta\}^\{\(t\)\}=\\mathcal\{F\}\_\{\\mathrm\{TERRA\}\}\(U^\{\(t\)\}\),which is applied to the global LoRA parameters asW\(t\+1\)=W\(t\)\+Δ¯\(t\)W^\{\(t\+1\)\}=W^\{\(t\)\}\+\\bar\{\\Delta\}^\{\(t\)\}\.

##### Robust norm filtering

The first stage of the TERRA pipeline, denoted byℱnorm\\mathcal\{F\}\_\{\\mathrm\{norm\}\}, enforces a round\-adaptive magnitude constraint on the decoded sparse updates\. For each reconstructed updateuk\(t\)=\(Δ~k\(t\),mk\(t\)\)u\_\{k\}^\{\(t\)\}=\(\\tilde\{\\Delta\}\_\{k\}^\{\(t\)\},m\_\{k\}^\{\(t\)\}\), the server computes theℓ2\\ell\_\{2\}\-norm of the sparse LoRA update:sk\(t\)=‖Δ~k\(t\)‖2\.s\_\{k\}^\{\(t\)\}=\\\|\\tilde\{\\Delta\}\_\{k\}^\{\(t\)\}\\\|\_\{2\}\.Letms\(t\)=median⁡\(\{sk\(t\):k∈St\}\)m\_\{s\}^\{\(t\)\}=\\operatorname\{median\}\\left\(\\\{s\_\{k\}^\{\(t\)\}:k\\in S\_\{t\}\\\}\\right\)denote the median update norm in roundtt, and letMAD\(t\)=median⁡\(\{\|sk\(t\)−ms\(t\)\|:k∈St\}\)\\operatorname\{MAD\}^\{\(t\)\}=\\operatorname\{median\}\\left\(\\\{\|s\_\{k\}^\{\(t\)\}\-m\_\{s\}^\{\(t\)\}\|:k\\in S\_\{t\}\\\}\\right\)denote the corresponding median absolute deviation\. We have designed TERRA to retain clientkkafter norm filtering only if

sk\(t\)≤ms\(t\)\+λnorm​MAD\(t\),s\_\{k\}^\{\(t\)\}\\leq m\_\{s\}^\{\(t\)\}\+\\lambda\_\{\\mathrm\{norm\}\}\\operatorname\{MAD\}^\{\(t\)\},\(13\)whereλnorm\\lambda\_\{\\mathrm\{norm\}\}controls the tolerance of the magnitude filter\. The resulting norm\-valid client set is

Snorm\(t\)=\{k∈St:sk\(t\)≤ms\(t\)\+λnorm​MAD\(t\)\}\.S\_\{\\mathrm\{norm\}\}^\{\(t\)\}=\\left\\\{k\\in S\_\{t\}:s\_\{k\}^\{\(t\)\}\\leq m\_\{s\}^\{\(t\)\}\+\\lambda\_\{\\mathrm\{norm\}\}\\operatorname\{MAD\}^\{\(t\)\}\\right\\\}\.\(14\)This stage is designed to remove updates whose magnitudes are unusually large relative to the other sparse LoRA updates received in the same round by the server\. Because the threshold is derived from the round\-level norm distribution, it adapts to changes in update scale across training rather than relying on a fixed global cutoff\. This is particularly effective against scaling and model\-replacement attacks, where an adversarial client attempts to dominate the aggregate by submitting an update with excessive norm\.

##### Mask\-aware directional validation

The second stage of TERRA, denoted byℱdir\\mathcal\{F\}\_\{\\mathrm\{dir\}\}, applies directional consistency with the recent global update trajectory\. The first stage, the norm filter, removes extreme\-magnitude updates, but it does not guarantee that all retained updates point in a useful direction\. An adversarial client may still submit an update with a plausible magnitude but harmful orientation\. To address this case, using the second stage of TERRA, we compare each norm\-valid update against a server\-maintained reference directionr\(t\)r^\{\(t\)\}, while respecting the sparse support transmitted by that client\. The server maintains the reference direction as an exponential moving average of previously accepted aggregate updates:

r\(t\)=β​r\(t−1\)\+\(1−β\)​Δ¯\(t−1\),r^\{\(t\)\}=\\beta r^\{\(t\-1\)\}\+\(1\-\\beta\)\\bar\{\\Delta\}^\{\(t\-1\)\},\(15\)whereβ∈\[0,1\)\\beta\\in\[0,1\)is the momentum coefficient that controls the memory of the reference direction, andΔ¯\(t−1\)\\bar\{\\Delta\}^\{\(t\-1\)\}is the aggregate update applied in the previous round\. For eachk∈Snorm\(t\)k\\in S\_\{\\mathrm\{norm\}\}^\{\(t\)\}, TERRA computes cosine similarity only over the coordinates transmitted by that client\. Specifically, for eachk∈Snorm\(t\)k\\in S\_\{\\mathrm\{norm\}\}^\{\(t\)\}, TERRA computes the mask\-aware cosine scoreck\(t\)c\_\{k\}^\{\(t\)\}by projecting the reference direction onto the support maskmk\(t\)m\_\{k\}^\{\(t\)\}:

ck\(t\)=⟨Δ~k\(t\),mk\(t\)⊙r\(t\)⟩‖Δ~k\(t\)‖2​‖mk\(t\)⊙r\(t\)‖2\+ϵ\.c\_\{k\}^\{\(t\)\}=\\frac\{\\left\\langle\\tilde\{\\Delta\}\_\{k\}^\{\(t\)\},m\_\{k\}^\{\(t\)\}\\odot r^\{\(t\)\}\\right\\rangle\}\{\\\|\\tilde\{\\Delta\}\_\{k\}^\{\(t\)\}\\\|\_\{2\}\\,\\\|m\_\{k\}^\{\(t\)\}\\odot r^\{\(t\)\}\\\|\_\{2\}\+\\epsilon\}\.\(16\)
Here,ϵ\>0\\epsilon\>0prevents division by zero\. This score measures the alignment between the reconstructed sparse update and the recent aggregate trajectory over only the coordinates transmitted by clientkkwhich avoids penalizing a sparse client for coordinates it did not transmit and that should not be interpreted as explicit zeros\. TERRA retains clientkkafter directional validation only if

Sdir\(t\)=\{k∈Snorm\(t\):ck\(t\)≥τdir\}\.S\_\{\\mathrm\{dir\}\}^\{\(t\)\}=\\left\\\{k\\in S\_\{\\mathrm\{norm\}\}^\{\(t\)\}:c\_\{k\}^\{\(t\)\}\\geq\\tau\_\{\\mathrm\{dir\}\}\\right\\\}\.\(17\)where,τdir\\tau\_\{\\mathrm\{dir\}\}is the directional similarity threshold\. Low or negative alignment indicates that the update is inconsistent with the recent optimization trajectory and may correspond to sign\-flipping or poisoning behavior\. For the first round, when no historical reference is available, TERRA initializesr\(t\)r^\{\(t\)\}from the aggregate of norm\-valid updates or skips directional validation for that round\.

##### Adaptive active\-coordinate clipping

The third stage of TERRA, denoted byℱclip\\mathcal\{F\}\_\{\\mathrm\{clip\}\}, bounds the coordinate\-level influence of updates that passes through norm filtering and directional validation\. LetSdir\(t\)S\_\{\\mathrm\{dir\}\}^\{\(t\)\}denote the set of clients retained after the first two stages\. For a reconstructed sparse updateΔ~k\(t\)\\tilde\{\\Delta\}\_\{k\}^\{\(t\)\}, we writeΔ~k,j\(t\)\\tilde\{\\Delta\}\_\{k,j\}^\{\(t\)\}for itsjj\-th coordinate andmk,j\(t\)m\_\{k,j\}^\{\(t\)\}for the corresponding support indicator\. Rather than using a fixed clipping radius, TERRA first collects the magnitudes of all active coordinates among the retained sparse updates which is denoted by𝒞\(t\)\\mathcal\{C\}^\{\(t\)\}and defined as

𝒞\(t\)=\{\|Δ~k,j\(t\)\|:k∈Sdir\(t\),mk,j\(t\)=1\}\.\\mathcal\{C\}^\{\(t\)\}=\\left\\\{\\left\|\\tilde\{\\Delta\}\_\{k,j\}^\{\(t\)\}\\right\|:k\\in S\_\{\\mathrm\{dir\}\}^\{\(t\)\},\\;m\_\{k,j\}^\{\(t\)\}=1\\right\\\}\.\(18\)The clipping threshold is then defined asqt=Quantileq⁡\(𝒞\(t\)\)q\_\{t\}=\\operatorname\{Quantile\}\_\{q\}\(\\mathcal\{C\}^\{\(t\)\}\), whereqqis a fixed quantile hyperparameter\. For each retained clientk∈Sdir\(t\)k\\in S\_\{\\mathrm\{dir\}\}^\{\(t\)\}, this stage of TERRA clips only the active coordinates as

Δ^k,j\(t\)=mk,j\(t\)​clip⁡\(Δ~k,j\(t\),−qt,qt\)\.\\hat\{\\Delta\}\_\{k,j\}^\{\(t\)\}=m\_\{k,j\}^\{\(t\)\}\\operatorname\{clip\}\\left\(\\tilde\{\\Delta\}\_\{k,j\}^\{\(t\)\},\-q\_\{t\},q\_\{t\}\\right\)\.\(19\)LetΔ^k\(t\)\\hat\{\\Delta\}\_\{k\}^\{\(t\)\}denote the clipped sparse update vector obtained after the three stages of TERRA filtering\. This operation limits the influence of extreme individual coordinates while preserving the sparse support structure of each client update\. Since the threshold is computed only from active coordinates, TERRA avoids mixing transmitted values with missing coordinates that were never uploaded by the client\.

##### Mask\-aware aggregation

The final stage,ℱagg\\mathcal\{F\}\_\{\\mathrm\{agg\}\}, is responsible for aggregating the clipped sparse updates without treating missing coordinates as zeros\. For each coordinatejj, we compute

Δ¯j\(t\)=∑k∈Sdir\(t\)wk​mk,j\(t\)​Δ^k,j\(t\)∑k∈Sdir\(t\)wk​mk,j\(t\)\+ϵ,\\bar\{\\Delta\}\_\{j\}^\{\(t\)\}=\\frac\{\\sum\_\{k\\in S\_\{\\mathrm\{dir\}\}^\{\(t\)\}\}w\_\{k\}\\,m\_\{k,j\}^\{\(t\)\}\\hat\{\\Delta\}\_\{k,j\}^\{\(t\)\}\}\{\\sum\_\{k\\in S\_\{\\mathrm\{dir\}\}^\{\(t\)\}\}w\_\{k\}\\,m\_\{k,j\}^\{\(t\)\}\+\\epsilon\},\(20\)wherewkw\_\{k\}is the aggregation weight of clientkk, typically proportional to its local sample count, andϵ\>0\\epsilon\>0prevents division by zero when no retained client transmits coordinatejj\. This mask\-aware form is important in the sparse setting because an absent coordinate indicates missing support rather than evidence that the client intended to submit a zero value\. The server then applies the aggregate update to the global LoRA parameters asW\(t\+1\)=W\(t\)\+Δ¯\(t\)\.W^\{\(t\+1\)\}=W^\{\(t\)\}\+\\bar\{\\Delta\}^\{\(t\)\}\.Finally, the reference direction used for the next round is updated asr\(t\+1\)=β​r\(t\)\+\(1−β\)​Δ¯\(t\),r^\{\(t\+1\)\}=\\beta r^\{\(t\)\}\+\(1\-\\beta\)\\bar\{\\Delta\}^\{\(t\)\},whereβ∈\[0,1\)\\beta\\in\[0,1\)is the momentum coefficient\. To sum it up, TERRA combines 3 stages of norm filtering, mask\-aware directional validation, and adaptive active\-coordinate clipping, followed by mask\-aware aggregation to limit abnormal update influence while preserving useful sparse learning signal from retained clients\.

### IV\-DRobustness Analysis

In this section, we establish a design\-level robustness rationale for TERRA pipeline under the threat model introduced in the Section[III\-B](https://arxiv.org/html/2608.21172#S3.SS2)\. Rather than treating the pipeline as a heuristic sequence of the filters, we show how each of the stages of the TERRA impose the concrete constraint on the adversarial update space\. Robust norm filtering limits excessive update magnitude, mask\-aware directional validation rejects updates that are misaligned with the recent aggregate trajectory, adaptive active\-coordinate clipping bounds the coordinate\-level influence of retained updates, and mask\-aware aggregation prevents missing sparse coordinates from being interpreted as explicit zeros\. We do not intended to overview this analysis as a full convergence or cryptographic security proof; instead, it formalizes the bounded\-influence behavior that TERRA provides for dynamically sparse LoRA aggregation\.

##### Magnitude\-bounded update influence

Let us considerAt⊆StA\_\{t\}\\subseteq S\_\{t\}be the adversarial clients selected in roundtt, and letHt=St∖AtH\_\{t\}=S\_\{t\}\\setminus A\_\{t\}denote the honest clients in the same roundtt\. The first TERRA stage retains only clients inSnorm\(t\)S\_\{\\mathrm\{norm\}\}^\{\(t\)\}\. By construction, any retained update satisfies the condition:‖Δ~k\(t\)‖2≤Bt,\\\|\\tilde\{\\Delta\}\_\{k\}^\{\(t\)\}\\\|\_\{2\}\\leq B\_\{t\},whereBt=ms\(t\)\+λnorm​MAD\(t\)\.B\_\{t\}=m\_\{s\}^\{\(t\)\}\+\\lambda\_\{\\mathrm\{norm\}\}\\operatorname\{MAD\}^\{\(t\)\}\.Thus, any adversarial update whose norm exceeds the round\-adaptive boundBtB\_\{t\}is rejected before aggregation\. For example, under a scaling or model\-replacement attack where an adversary submitsΔ~a\(t\)=γ​Δa\(t\)\\tilde\{\\Delta\}\_\{a\}^\{\(t\)\}=\\gamma\\Delta\_\{a\}^\{\(t\)\}, the update is removed whenever

\|γ\|​‖Δa\(t\)‖2\>Bt,\|\\gamma\|\\,\\\|\\Delta\_\{a\}^\{\(t\)\}\\\|\_\{2\}\>B\_\{t\},\(21\)
This does not imply that all malicious updates are eliminated\. Rather, it prevents high\-energy adversarial updates from directly dominating the aggregate through excessive norm, provided the round\-level robust statistics are not themselves dominated by adversarial clients\.

##### Directionally inconsistent updates

An adversarial update which passes the norm filter may still pointing in a harmful direction\. TERRA therefore applies mask\-aware directional validation over the support transmitted by each client\. For eachk∈Snorm\(t\)k\\in S\_\{\\mathrm\{norm\}\}^\{\(t\)\}, the alignment score as given in the eq\.[16](https://arxiv.org/html/2608.21172#S4.E16)is

ck\(t\)=⟨Δ~k\(t\),mk\(t\)⊙r\(t\)⟩‖Δ~k\(t\)‖2​‖mk\(t\)⊙r\(t\)‖2\+ϵ\.c\_\{k\}^\{\(t\)\}=\\frac\{\\left\\langle\\tilde\{\\Delta\}\_\{k\}^\{\(t\)\},m\_\{k\}^\{\(t\)\}\\odot r^\{\(t\)\}\\right\\rangle\}\{\\\|\\tilde\{\\Delta\}\_\{k\}^\{\(t\)\}\\\|\_\{2\}\\,\\\|m\_\{k\}^\{\(t\)\}\\odot r^\{\(t\)\}\\\|\_\{2\}\+\\epsilon\}\.The update is retained if and only ifck\(t\)≥τdirc\_\{k\}^\{\(t\)\}\\geq\\tau\_\{\\mathrm\{dir\}\}\. This filter is scale invariant and thus complements norm filtering, as it does not require all retained updates to have similar magnitudes, but it requires the transmitted coordinates to align with the recent accepted update trajectory\. To understand the effect of this layer on sign\-flip attacks, let us consider an honest updateΔh\(t\)\\Delta\_\{h\}^\{\(t\)\}with positive alignment scorech\(t\)c\_\{h\}^\{\(t\)\}\. If an adversary submits a sign\-flipped versionΔ~a\(t\)=−γ​Δh\(t\)\\tilde\{\\Delta\}\_\{a\}^\{\(t\)\}=\-\\gamma\\Delta\_\{h\}^\{\(t\)\}withγ\>0\\gamma\>0, then its alignment scoreca\(t\)c\_\{a\}^\{\(t\)\}reverses sign on the same active support, givingca\(t\)≈−ch\(t\)c\_\{a\}^\{\(t\)\}\\approx\-c\_\{h\}^\{\(t\)\}\. Such updates are rejected wheneverca\(t\)<τdirc\_\{a\}^\{\(t\)\}<\\tau\_\{\\mathrm\{dir\}\}\. Thus, mask\-aware directional validation of TERRA constrains all of the attacks that preserve plausible magnitude but distort the update direction\.

##### Coordinate\-level bounded influence

Even after the first two filtering stages of norm and direction filtering, a retained adversarial update may place large values in a small number of coordinates\. We limit this effect through the third stage of TERRA, adaptive active\-coordinate clipping\. For each retained clientk∈Sdir\(t\)k\\in S\_\{\\mathrm\{dir\}\}^\{\(t\)\}, the clipped coordinate satisfies the conditionΔ^k,j\(t\)=mk,j\(t\)​clip⁡\(Δ~k,j\(t\),−qt,qt\),\|Δ^k,j\(t\)\|≤mk,j\(t\)​qt\.\\hat\{\\Delta\}\_\{k,j\}^\{\(t\)\}=m\_\{k,j\}^\{\(t\)\}\\operatorname\{clip\}\\left\(\\tilde\{\\Delta\}\_\{k,j\}^\{\(t\)\},\-q\_\{t\},q\_\{t\}\\right\),\|\\hat\{\\Delta\}\_\{k,j\}^\{\(t\)\}\|\\leq m\_\{k,j\}^\{\(t\)\}q\_\{t\}\.Therefore, any update that survives the first two stages has bounded coordinate\-level influence\. If each client transmits at mostρmax​d\\rho\_\{\\max\}dcoordinates, then the clipped sparse update also satisfies‖Δ^k\(t\)‖2≤qt​ρmax​d\.\\\|\\hat\{\\Delta\}\_\{k\}^\{\(t\)\}\\\|\_\{2\}\\leq q\_\{t\}\\sqrt\{\\rho\_\{\\max\}d\}\.This bound is useful against attacks that concentrate perturbations into a small set of coordinates\. The clipping stage does not certify that a retained update is honest; it ensures that the coordinate\-wise contribution of any retained update is bounded before the aggregation\.

##### Bounded adversarial contribution after aggregation

The final stage of TERRA is the mask aware aggregation\. For coordinatejj, TERRA aggregates only over clients that transmitted that coordinate, which is give in eq\.[20](https://arxiv.org/html/2608.21172#S4.E20)is:

Δ¯j\(t\)=∑k∈Sdir\(t\)wk​mk,j\(t\)​Δ^k,j\(t\)∑k∈Sdir\(t\)wk​mk,j\(t\)\+ϵ\.\\bar\{\\Delta\}\_\{j\}^\{\(t\)\}=\\frac\{\\sum\_\{k\\in S\_\{\\mathrm\{dir\}\}^\{\(t\)\}\}w\_\{k\}m\_\{k,j\}^\{\(t\)\}\\hat\{\\Delta\}\_\{k,j\}^\{\(t\)\}\}\{\\sum\_\{k\\in S\_\{\\mathrm\{dir\}\}^\{\(t\)\}\}w\_\{k\}m\_\{k,j\}^\{\(t\)\}\+\\epsilon\}\.LetDj\(t\)=∑k∈Sdir\(t\)wk​mk,j\(t\)\+ϵD\_\{j\}^\{\(t\)\}=\\sum\_\{k\\in S\_\{\\mathrm\{dir\}\}^\{\(t\)\}\}w\_\{k\}m\_\{k,j\}^\{\(t\)\}\+\\epsilonbe the active aggregation mass for coordinatejj, and letAj\(t\)=\{a∈At∩Sdir\(t\):ma,j\(t\)=1\}A\_\{j\}^\{\(t\)\}=\\\{a\\in A\_\{t\}\\cap S\_\{\\mathrm\{dir\}\}^\{\(t\)\}:m\_\{a,j\}^\{\(t\)\}=1\\\}be the retained adversarial clients that transmitted coordinatejj\. As described in above subsection, clipping gives\|Δ^a,j\(t\)\|≤qt\|\\hat\{\\Delta\}\_\{a,j\}^\{\(t\)\}\|\\leq q\_\{t\}, the adversarial contribution to coordinatejjis bounded by

\|∑a∈Aj\(t\)wa​ma,j\(t\)​Δ^a,j\(t\)Dj\(t\)\|≤∑a∈Aj\(t\)waDj\(t\)​qt\.\\left\|\\frac\{\\sum\_\{a\\in A\_\{j\}^\{\(t\)\}\}w\_\{a\}m\_\{a,j\}^\{\(t\)\}\\hat\{\\Delta\}\_\{a,j\}^\{\(t\)\}\}\{D\_\{j\}^\{\(t\)\}\}\\right\|\\leq\\frac\{\\sum\_\{a\\in A\_\{j\}^\{\(t\)\}\}w\_\{a\}\}\{D\_\{j\}^\{\(t\)\}\}q\_\{t\}\.Thus, any retained adversarial influence is controlled by both the clipping thresholdqtq\_\{t\}as well as the adversarial active aggregation weight on that coordinate\. This is simply a bounded\-influence statement, not a claim that every adversarial update is removed\.

##### Sparse\-support manipulation

Sparse LoRA updates introduce an additional attack surface because clients may transmit different coordinate supports based on the sparse transmission ratio denoted by,ρk\(t\)\\rho\_\{k\}^\{\(t\)\}\. If all of the missing coordinates were treated as zeros, coordinates transmitted by fewer clients would have been artificially shrunken toward zero, and thus support\-manipulation attacks could distort the aggregate\. But, TERRA avoids this kind of manipulation by normalizing each coordinate only over the clients that actually transmit that coordinate\. In other words, a missing coordinate is treated as missing support, not as an explicit zero\-valued updates\. This distinction is essential for dynamically sparse updates, where the support pattern is shaped by top\-kktransmission and client thermal state\.

To sum it up, we have designed the TERRA pipeline to limit the adversarial influence through a sequence of complementary constraints\. First of all, Norm filtering removes extreme\-magnitude updates, followed by mask\-aware directional validation reducing sign\-flipped or inconsistent updates\. Then, adaptive clipping bounds the coordinate\-level effect of retained updates, and finally, mask\-aware aggregation prevents sparse missingness from being interpreted as zero evidence\. These mechanisms do not replace cryptographic guarantees or fully eliminate Byzantine behavior, but they provide a robust aggregation layer tailored to the sparse LoRA updates produced by Thermo\-FL\. Appendix[A](https://arxiv.org/html/2608.21172#A1)further provides a convergence rationale under an abstract TERRA operator, showing how bounded influence, alignment, and second\-moment control lead to a stationary\-point bound under explicit assumptions\.

## VEvaluation

We evaluated Thermo\-FL framework under two different yet complementary environments\. In the first environment, the large\-scale emulator was utilized to investigate the robustness of the controlled federated learning in the presence of large number of clients, non\-IID distribution of the data, LoRA transmissions in their dense or sparse form, and under adversarial updates\. On the other hand, the physical testbed was employed to verify the effectiveness of the entire pipeline under real\-world limitations in terms of temperature, runtime variation, compressed payload size, and defense against attacks\. Together, these settings separated controlled robustness analysis from physical deployment feasibility\.

Evaluation goals:Our evaluation was organized around the following research questions:

RQ1: Robustness\.Does the TERRA pipeline improve the robustness against sign flip and mixed Byzantine attacks when compared with dense and sparse FedAvg\-LoRA, and other robust aggregation baselines?

RQ2: Sparse aggregation\.How is task utility affected when LoRA updates are transmitted and aggregated in dynamically sparse form rather than as full\-density LoRA deltas?

RQ3: TERRA components\.Which stages of TERRA are necessary for robust sparse aggregation, and how much do norm filtering, directional validation, adaptive clipping, and mask\-aware aggregation contribute to the final behavior?

RQ4: Physical feasibility\.Can Thermo\-FL be executed end\-to\-end on real edge devices while capturing thermal behavior, runtime overhead, communication cost, and attack response?

TABLE I:Final exact\-match accuracy \(%\) at global round 25 in the emulator using Qwen2\.5\-0\.5B\. Higher is better\.GSM8KBoolQMethodCleanSignflipMixedCleanSignflipMixedQwen\-ZS27\.44––62\.88––FedAvg \(dense\)33\.2124\.6424\.5669\.3063\.3958\.10Trimmed Mean \(dense\)32\.5228\.9632\.3069\.0868\.5959\.54Coordinate Median \(dense\)30\.9328\.6633\.0668\.7568\.5964\.92Krum \(dense\)24\.1110\.1620\.9268\.8366\.7960\.55Multi\-Krum \(dense\)34\.2730\.8631\.3967\.0669\.2469\.85Bulyan \(dense\)31\.6128\.8130\.7168\.9068\.3860\.46FedAvg \(sparse\)32\.9026\.6929\.5769\.3963\.4662\.63Trimmed Mean \(sparse\)32\.7531\.3928\.5868\.9968\.1367\.58Coordinate Median \(sparse\)34\.1930\.1030\.7169\.3666\.9166\.15Krum \(sparse\)30\.4318\.5730\.6368\.2067\.2560\.06Multi\-Krum \(sparse\)32\.2232\.8331\.3969\.2469\.1168\.06Bulyan \(sparse\)30\.9330\.9328\.8169\.2767\.9267\.80Thermo\-FL \(TERRA\)33\.7431\.0931\.6772\.3271\.1672\.11### V\-ALarge\-Scale Emulator

A large\-scale emulator was used to evaluate the performance of Thermo\-FL in controlled federated learning environments that are difficult to emulate physically\. This setup enabled the analysis of larger client population sizes, non\-IID data distribution, sparse LoRA communication, malicious updates, and temperature\-aware client control under repeatable conditions\.

#### V\-A1Experimental Setup

We configured the emulator experiment to ensure the model, federated training approach, sparsity technique, attack configuration, and evaluation process was consistent across all methods\.

Implementation and tasks\.The implementation of the emulator involved using PyTorch, HuggingFace transformers, PEFT/LoRA, and torch\.distributed\. Qwen2\.5\-0\.5B\[[44](https://arxiv.org/html/2608.21172#bib.bib45)\]was used as the base model for this study, and it was tested on GSM8K\[[9](https://arxiv.org/html/2608.21172#bib.bib46)\]and BoolQ\[[8](https://arxiv.org/html/2608.21172#bib.bib47)\]datasets\. GSM8K measured numerical reasoning and arithmetic answer extraction ability, whereas BoolQ tested binary question\-answer ability\. The exact match was chosen as the utility metric\.

Federated protocol\.Training data were partitioned using a non\-IID Dirichlet split with concentration parameterα=0\.3\\alpha=0\.3\. For the round\-25 experiments in Table[I](https://arxiv.org/html/2608.21172#S5.T1), we emulated 80 logical clients and sampled 10 clients per round, corresponding to a 12\.5% participation rate\. Each selected client performed one local epoch with 32 optimizer steps, batch size 1, and gradient accumulation of 4\. We used AdamW with learning rate2×10−42\\times 10^\{\-4\}and weight decay10−210^\{\-2\}\.

LoRA and sparsity\.All of the methods communicated LoRA adapter deltas rather than full model weights\. The LoRA configuration used rankr=16r=16, scaling parameterα=32\\alpha=32, dropout 0\.05, automatic target\-module selection, FP16 training, gradient checkpointing, and maximum sequence length 384\. Dense baselines transmitted full\-density LoRA deltas, whereas sparse methods applied top\-kksparsification before transmission\.

Baselines and TERRA\.Thermo\-FL was compared against dense and sparse variants of FedAvg\-LoRA, trimmed mean, coordinate\-wise median, Krum, Multi\-Krum, and Bulyan\. Dense variants aggregated full\-density LoRA adapter deltas, whereas sparse variants aggregated top\-kksparsified LoRA adapter deltas\. Thermo\-FL used TERRA for sparse LoRA aggregation\. Unless otherwise stated, TERRA used a MAD scaling factor of 2\.5, cosine threshold−0\.05\-0\.05, warmup period of 2 rounds, clipping quantile 0\.80, and FedAvg\-style reduction after filtering\.

Thermal model\.Each logical client maintained a persistent temperature state across rounds\. Temperatures were initialized from𝒩⁡\(44,1\.52\)\\mathcal\{N\}\(44,1\.5^\{2\}\), increased during local optimization, and cooled during idle periods\. The controller thresholds were set toTmin=45∘​CT\_\{\\min\}=45^\{\\circ\}\\mathrm\{C\}andTmax=65∘​CT\_\{\\max\}=65^\{\\circ\}\\mathrm\{C\}\. The emulator used a cooling factor of 1\.25 per round and a heating factor of 0\.65 per local round\. Temperature controlled both the active trainable\-layer ratioκ∈\[0\.20,1\.00\]\\kappa\\in\[0\.20,1\.00\]and the sparse transmission ratioρ∈\[0\.05,0\.50\]\\rho\\in\[0\.05,0\.50\], so hotter clients trained fewer LoRA layers and transmitted sparser updates\.

Adversarial settings\.We evaluated clean, sign\-flip, and mixed attack settings\. In adversarial runs, 20% of clients were malicious, giving 16 malicious clients out of 80 and approximately two malicious clients among the 10 sampled clients per round\. In the sign\-flip setting, malicious clients reversed their update direction along with scalingγ=−3\\gamma=\-3\. In the mixed setting, attacks were sampled from sign flip, Gaussian noise, scale attack withγ=−3\\gamma=\-3, random\-mask corruption, model replacement, and ALIE\-like perturbations\. Attacks were applied after local training and client\-side sparsification\.

Evaluation protocol\.We periodically evaluated saved LoRA checkpoints using greedy generation on the held\-out evaluation split\. GSM8K answers were normalized by extracting the final numeric answer, while BoolQ outputs were normalized to yes/no form\. We report exact\-match accuracy after normalization\.

#### V\-A2Results and Analysis

We analyzed the emulator results along three dimensions: overall robustness and utility, the effect of sparse LoRA aggregation, and the contribution of individual TERRA components\.

TABLE II:TERRA ablation at round 25 using Qwen2\.5\-0\.5B; exact\-match accuracy \(%\) is reported across tasks and attack settings\.GSM8KBoolQMethodCleanSignflipMixedCleanSignflipMixedSparse FedAvg32\.9026\.6929\.5769\.3963\.4662\.63Mask\-aware aggregation34\.5725\.402\.3566\.7962\.7261\.59Mask \+ norm filtering32\.9030\.6328\.0568\.5968\.6968\.75Mask \+ norm \+ cosine validation27\.6725\.4028\.9668\.2370\.5270\.98Full TERRA33\.7431\.0931\.6772\.3271\.1672\.11Overall robustness and utility\.Table[I](https://arxiv.org/html/2608.21172#S5.T1)highlights the final exact\-match accuracy at global round 25 for Qwen2\.5\-0\.5B under clean, sign\-flip, and mixed attack settings\. Overall, Thermo\-FL achieved the strongest performance on BoolQ across all three settings, reaching 72\.32% in the clean setting, 71\.16% under sign\-flip attacks, and 72\.11% under mixed attacks\. This result suggests that TERRA was able to preserve useful sparse learning signal while limiting the effect of corrupted updates\.

On GSM8K, Thermo\-FL remained competitive but was not uniformly the best method in every setting\. It achieved 33\.74% in the clean setting, 31\.09% under sign\-flip attacks, and 31\.67% under mixed attacks\. Several robust baselines performed strongly in individual GSM8K settings, especially Multi\-Krum and coordinate\-wise median\. However, Thermo\-FL consistently improved over sparse FedAvg under adversarial settings, increasing accuracy from 26\.69% to 31\.09% under sign\-flip attacks and from 29\.57% to 31\.67% under mixed attacks\. These results indicate that TERRA is most useful as a stability mechanism for sparse adversarial aggregation, rather than as a universal accuracy maximizer across all tasks\.

Finding 1: Robust sparse aggregation\.TERRA improved robustness under adversarial sparse LoRA aggregation while preserving competitive utility\. The gains were strongest on BoolQ, where Thermo\-FL achieved the highest accuracy across clean, sign\-flip, and mixed settings\. On GSM8K, Thermo\-FL remained competitive and improved over sparse FedAvg under all settings\.

Dense versus sparse aggregation\.The comparison between dense and sparse baselines shows that sparsification did not necessarily degrade utility\. Sparse FedAvg achieved accuracy close to dense FedAvg in the clean setting and, in several adversarial cases, performed better than its dense counterpart\. This suggests that top\-kkLoRA sparsification can reduce communication while preserving enough update signal for downstream adaptation\. However, sparse updates also introduce support heterogeneity, which makes naive aggregation more fragile under attack\. Thermo\-FL addresses this issue by combining sparse transmission with mask\-aware filtering and aggregation\.

Finding 2: Sparse transmission did not collapse utility\.Top\-kkLoRA sparsification preserved enough update signal for downstream adaptation, but sparse support heterogeneity made naive aggregation more fragile under attack\. This motivates mask\-aware robust aggregation rather than sparse FedAvg alone\.

Effect of TERRA components\.Table[II](https://arxiv.org/html/2608.21172#S5.T2)reports the ablation study for TERRA\. The results show that mask\-aware aggregation alone was not sufficient as a robustness mechanism\. In particular, under the mixed attack on GSM8K, mask\-aware aggregation collapsed to 2\.35%, showing that preserving sparse support does not protect the server when adversarial clients manipulate update values or supports\. Adding norm filtering substantially improved robustness by removing high\-magnitude poisoned updates\. Directional validation further constrained updates that had plausible magnitude but harmful orientation, while adaptive clipping bounded the coordinate\-level influence of updates that passed the first two filters\. The full TERRA pipeline achieved the best overall balance across tasks and attack settings\. On BoolQ, full TERRA obtained the highest accuracy in the clean, sign\-flip, and mixed settings\. On GSM8K, it improved over sparse FedAvg in both adversarial settings and avoided the severe collapse observed with mask\-aware aggregation alone\. These results support the design choice of combining norm filtering, mask\-aware directional validation, adaptive active\-coordinate clipping, and mask\-aware aggregation as complementary stages rather than independent alternatives\.

Finding 3: TERRA stages are complementary\.Mask\-aware aggregation alone was not sufficient for robustness\. Norm filtering, directional validation, adaptive clipping, and mask\-aware aggregation worked together to limit high\-magnitude, misaligned, and coordinate\-concentrated adversarial updates\.

### V\-BPhysical Testbed

The physical testbed complemented the emulator by validating whether Thermo\-FL could run end\-to\-end on real edge hardware\. Unlike the emulator, this setting captured measured device temperature, runtime variability, compressed payload construction, and attack behavior under Jetson\-class client constraints\. Because only two physical clients were available, this study was used as a prototype validation of hardware behavior rather than as a large\-scale robustness benchmark\.

#### V\-B1Experimental Setup

The physical prototype was configured to evaluate feasibility, thermal behavior, communication overhead, and representative attack response under realistic edge\-device constraints\.

Model and dataset\.We used Qwen2\.5\-0\.5B as the base model and fine\-tuned it with LoRA under 8\-bit quantization\. The pretrained backbone was frozen, and only the LoRA adapter parameters were updated\. Training and evaluation were performed on GSM8K, using 7,473 training examples and 1,319 held\-out test examples\.

Hardware testbed\.The testbed consisted of two NVIDIA Jetson Orin Nano Developer Kits as edge clients and an Acer Aspire E15 laptop as the aggregation server\. Each Jetson client had 8 GB of RAM and a 1 TB NVMe SSD\. The server used an 8th\-generation Intel Core i5 processor with 12 GB of RAM\.

Data partitioning and training\.The GSM8K training set was divided into two disjoint client subsets of 3,736 and 3,737 samples\. All physical experiments were run for 200 communication rounds\. In each round, both clients performed 5 local optimization steps using AdamW with learning rate3×10−43\\times 10^\{\-4\}, batch size 1, and gradient accumulation of 4\. LoRA was applied to the query, key, value, and output projection matrices with rankr=8r=8and scaling parameterα=16\\alpha=16\.

Thermal control and telemetry\.Device telemetry was sampled every1​Hz1\\,\\mathrm\{Hz\}usingtegrastats\. Experiments were conducted in a climate\-controlled laboratory at approximately25∘​C25^\{\\circ\}\\mathrm\{C\}\. Devices were placed on a non\-conducting flat surface without external cooling and relied only on their built\-in cooling systems\. The controller usedTmin=45∘​CT\_\{\\min\}=45^\{\\circ\}\\mathrm\{C\}andTmax=65∘​CT\_\{\\max\}=65^\{\\circ\}\\mathrm\{C\}\. The sparse transmission ratioρ\\rhowas adjusted between 50% and 1% using a clipped linear policy\. The trainable\-layer ratioκ\\kappafollowed a three\-level policy:κ=1\.0\\kappa=1\.0forT<45∘​CT<45^\{\\circ\}\\mathrm\{C\},κ=0\.5\\kappa=0\.5for45∘​C≤T≤65∘​C45^\{\\circ\}\\mathrm\{C\}\\leq T\\leq 65^\{\\circ\}\\mathrm\{C\}, andκ=0\.1\\kappa=0\.1forT\>65∘​CT\>65^\{\\circ\}\\mathrm\{C\}\.

Communication encoding\.We evaluated dense\-full, dense\-sparse, COO, bitmap, flat\-index, flat\-delta, and values\-only encodings\(ideal metrics\)\. All schemes followed the same pipeline: payload construction, binary serialization, and zlib lossless compression before upload\. Compressed upload size was used as the primary communication metric, while encoding and compression time were measured as secondary overhead\.

Baselines and scope\.The physical testbed was used to study end\-to\-end hardware behavior rather than to reproduce the full emulator baseline comparison\. We evaluated three configurations:FedAvg\-full, which averaged full\-density LoRA adapter states with standard FedAvg;Thermo\-FL without TERRA, which used thermal\-aware client control and sparse transmission with FedAvg\-style aggregation; andThermo\-FL, which used thermal\-aware control, sparse encoding, and TERRA aggregation\. In all cases, the pretrained backbone remained frozen, and only the LoRA adapter state was communicated or aggregated\. Since clients started each round from the same global adapter state, averaging local adapter states was equivalent to averaging the corresponding adapter update differences\.

Adversarial settings\.We evaluated clean execution, one internal Byzantine attack represented by sign\-flip/scale, and one communication\-layer perturbation\. In the Byzantine setting, one client submitted sign\-scaled updates withγ=−10\\gamma=\-10\. In the MITM setting, Gaussian noise proportional to the update standard deviation was injected into transmitted updates\. We did not use the mixed\-attack setting on the physical testbed because only two clients participated; with such a small client population, randomly mixing several attack operators would reduce to a single\-client perturbation rather than a meaningful distributional robustness test\. Mixed attacks were therefore evaluated in the large\-scale emulator, while the physical testbed isolated representative endpoint\-level and communication\-layer corruption cases\.

#### V\-B2Results and Analysis

We evaluated the physical prototype along four axes, which are thermal behavior, system efficiency, communication overhead, and robustness under representative attacks\.

Fig\. 2:Thermal controller behavior across 200 communication rounds\. Thermo\-FL adjusted sparse transmission and trainable\-layer control in response to measured GPU temperature\.\(a\)Training loss\(b\)Power\(c\)GPU temperature\(d\)Round latency
Fig\. 3:Clean physical\-testbed behavior for Thermo\-FL and FedAvg\-LoRA\. The comparison includes training loss, power consumption, GPU temperature, and per\-round latency\.\(a\)Latency\(b\)Power
Fig\. 4:Distribution of per\-round latency and power consumption under clean physical execution\.Thermal behavior and system efficiency\.Figure[2](https://arxiv.org/html/2608.21172#S5.F2)shows that Thermo\-FL actively used measured temperature to regulate the physical training process\. Across 200 communication rounds, the controller kept GPU temperature within a narrow range of roughly49​\-​51∘​C49\\text\{\-\}51^\{\\circ\}\\mathrm\{C\}\. As temperature increased, Thermo\-FL reduced local training workload and transmitted sparser updates; when the device cooled, these constraints were relaxed\. This confirms that temperature was not only logged but used as a feedback signal for federated fine\-tuning\.

Figure[3](https://arxiv.org/html/2608.21172#S5.F3)compares Thermo\-FL with FedAvg\-LoRA under clean execution\. FedAvg\-LoRA showed an early temperature spike near60∘​C60^\{\\circ\}\\mathrm\{C\}and then operated around54​\-​55∘​C54\\text\{\-\}55^\{\\circ\}\\mathrm\{C\}for much of training\. In contrast, Thermo\-FL stabilized near50∘​C50^\{\\circ\}\\mathrm\{C\}, while also reducing power consumption and round\-latency variation\. Figure[4](https://arxiv.org/html/2608.21172#S5.F4)further shows that Thermo\-FL had lower median latency and a tighter latency distribution, indicating fewer thermally induced straggler effects and more predictable round completion\.

![Refer to caption](https://arxiv.org/html/2608.21172v1/Images/Physical_Testbed/evaluation/fig_rq2_compressed_payload_comparision.png)\(a\)Mean compressed upload size after serialization and compression\.
![Refer to caption](https://arxiv.org/html/2608.21172v1/Images/Physical_Testbed/evaluation/fig_rq2_pareto_size_vs_time.png)\(b\)Compressed payload size versus encoding cost\.

Fig\. 5:Communication\-efficiency benchmark for sparse update encodings on the physical testbed\.Communication overhead\.Figure[5](https://arxiv.org/html/2608.21172#S5.F5)reports the communication benchmark for candidate sparse\-update encodings\. All schemes used the same pipeline: payload construction, binary serialization, and zlib lossless compression before upload\. The raw dense LoRA payload was approximately2\.23​MB2\.23\\,\\mathrm\{MB\}, while compressed dense\-full transmission required about1\.11​MB1\.11\\,\\mathrm\{MB\}\. Among deployable sparse formats, bitmap achieved the smallest practical compressed payload at approximately0\.42​MB0\.42\\,\\mathrm\{MB\}\. Flat\-delta was close at0\.45​MB0\.45\\,\\mathrm\{MB\}, followed by dense\-sparse at0\.54​MB0\.54\\,\\mathrm\{MB\}, COO at0\.65​MB0\.65\\,\\mathrm\{MB\}, and flat\-index at0\.84​MB0\.84\\,\\mathrm\{MB\}\. The values\-only format reached0\.27​MB0\.27\\,\\mathrm\{MB\}, but it served only as an ideal lower bound because it assumes zero cost for support metadata\. Overall, bitmap provided the best practical size\-overhead tradeoff\.

\(a\)Sign\-flip/scale attack\(γ=−10\)\(\\gamma=\-10\)\(b\)MITM noise injection\(σ=1\.0\)\(\\sigma=1\.0\)
Fig\. 6:Training loss under representative physical attack settings\.Robustness under physical attacks\.Figure[6](https://arxiv.org/html/2608.21172#S5.F6)shows the training loss under Byzantine scaling and MITM noise injection\. Under the Byzantine scaling attack withγ=−10\\gamma=\-10, Thermo\-FL without TERRA became unstable, whereas the full Thermo\-FL pipeline remained stable\. A similar pattern appeared under MITM noise injection: FedAvg\-LoRA degraded after convergence, Thermo\-FL without TERRA became unstable, and Thermo\-FL maintained a stable trajectory\. These results indicate that TERRA’s norm filtering, directional validation, and adaptive clipping constrained corrupted updates even in the small\-client physical setting\.

TABLE III:Physical\-testbed GSM8K exact\-match accuracy \(%\) under clean and adversarial settings\. Higher is better\.MethodCleanSign\-flip/scaleMITMFedAvg\-LoRA23\.280\.000\.00Thermo\-FL without TERRA–0\.000\.00Thermo\-FL24\.6421\.4018\.65
Note:The sign\-flip/scale attack usedγ=−10\\gamma=\-10\. We used 8\-Bit Quantized Qwen2\.5\-0\.5B model\.

Downstream task utility\.Table[III](https://arxiv.org/html/2608.21172#S5.T3)reports GSM8K exact\-match accuracy on the physical testbed\. In the clean setting, Thermo\-FL achieved24\.64%24\.64\\%, slightly higher than FedAvg\-LoRA at23\.28%23\.28\\%\. Under attack, FedAvg\-LoRA collapsed to0\.00%0\.00\\%, and Thermo\-FL without TERRA also failed under both sign\-flip/scale and MITM noise injection\. In contrast, the full Thermo\-FL pipeline preserved21\.40%21\.40\\%accuracy under sign\-flip/scale and18\.65%18\.65\\%under MITM perturbation\. These results show that the physical gains were not limited to smoother hardware behavior; TERRA was necessary to preserve downstream task utility when corrupted updates reached the server\.

Finding 4: Physical feasibility and robustness\.Thermo\-FL ran end\-to\-end on Jetson\-class edge clients, stabilized device temperature, reduced compressed upload size through bitmap sparse encoding, and preserved GSM8K utility under representative sign\-flip/scale and MITM attacks\.

## VIDiscussion and Limitations

While Thermo\-FL proves that thermal\-aware client control and strong sparse aggregation techniques can be combined to enable edge LLM fine\-tuning, there are still several limitations\. First of all, the physical testbed used was intentionally small, consisting of only two Jetson Orin Nano as clients and one laptop server\. Such architecture allowed validating end\-to\-end operation, telemetry measurement, payload compression, and attack simulation on actual hardware, but it was not intended to replace a large\-scale emulator\. Consequently, the emulator setup helped perform comparisons across larger client population, non\-IID data partitions, and different adversary types\.

Secondly, the physical attack assessment included only one sign\-flip/scale attack and one attack based on MITM\-style noise injection\. These attacks were used to isolate representative endpoint\-level and communication\-layer corruption in a small\-client deployment\. The mixed attacks were only simulated in the emulator, where the number of clients was sufficient enough to make stochastic attack sampling meaningful\. Third, TERRA pipeline of Thermo\-FL framework does not eliminate the need for any cryptographic transport protection, client authentication, secure boot, or trusted sensing mechanisms\. Rather, TERRA provides an aggregation\-layer defense that limits the influence of corrupted sparse updates when such updates can penetrate the existing defences and reaches the server\.

Last but not least, the temperature control policy of Thermo\-FL used fixed temperature threshold and hardware\-specific parameters forκ\\kappaandρ\\rho\. These values were appropriate for the Jetson\-class prototype, but other edge devices may require calibration of those parameters and threshold based on their cooling capacity, power mode, workload intensity, and deployment environment\. Future work can extend Thermo\-FL with adaptive threshold selection, broader device heterogeneity, additional LLM tasks, and larger physical federated deployments\.

## VIIRelated Work

Federated learning \(FL\)allows clients which are distributed across various location to collaboratively fine\-tune or adapt shared models without centralizing raw data\[[35](https://arxiv.org/html/2608.21172#bib.bib4),[26](https://arxiv.org/html/2608.21172#bib.bib6),[25](https://arxiv.org/html/2608.21172#bib.bib5)\]\. This makes FL an attractive solution for edge and on\-device LLM settings, where local data may be private, domain\-specific, or costly to transmit\[[23](https://arxiv.org/html/2608.21172#bib.bib7),[41](https://arxiv.org/html/2608.21172#bib.bib8),[39](https://arxiv.org/html/2608.21172#bib.bib1),[47](https://arxiv.org/html/2608.21172#bib.bib9)\]\. Since full fine\-tuning of LLMs poses a significant challenges due to their immense size and resource requirements, parameter\-efficient fine\-tuning \(PEFT\) methods, like LoRA\[[21](https://arxiv.org/html/2608.21172#bib.bib11)\], prompt tuning\[[30](https://arxiv.org/html/2608.21172#bib.bib29)\], and prefix tuning\[[32](https://arxiv.org/html/2608.21172#bib.bib12)\], have become central to efficient adaptation, which reduce the number of trainable parameters while preserving the adaptation capability\. Recent federated LLM fine\-tuning methods build on these techniques to support the collaborative adaptation across heterogeneous clients, and several works further reduces the communication through sparse or compressed LoRA updates\[[28](https://arxiv.org/html/2608.21172#bib.bib39),[33](https://arxiv.org/html/2608.21172#bib.bib38),[43](https://arxiv.org/html/2608.21172#bib.bib37)\]\. These research improves the practicality of the federated LLM adaptation, but they generally treat efficiency as an algorithmic objective rather than as a response to the changing hardware states\.

Edge deployment of LLM introduces hardware dynamics and limitation that are difficult to capture with the conventional FL abstractions\.Edge client devices usually operate under the limited power, constrained cooling, battery dependence, and dynamic voltage frequency scaling \(DVFS\), which can affect the runtime, throughput, and overall efficiency of the devices\[[22](https://arxiv.org/html/2608.21172#bib.bib14),[14](https://arxiv.org/html/2608.21172#bib.bib17),[17](https://arxiv.org/html/2608.21172#bib.bib18),[16](https://arxiv.org/html/2608.21172#bib.bib19),[29](https://arxiv.org/html/2608.21172#bib.bib15),[34](https://arxiv.org/html/2608.21172#bib.bib16)\], which in\-turn increases the time required to fine\-tune the models in the federated learning setup\. Thus in synchronous FL, such runtime variation can delay the aggregation and reduce the overall system efficiency, especially when some clients become stragglers or participate inconsistently across rounds\[[31](https://arxiv.org/html/2608.21172#bib.bib10),[15](https://arxiv.org/html/2608.21172#bib.bib20),[47](https://arxiv.org/html/2608.21172#bib.bib9)\]\. Prior thermal\-aware and DVFS\-aware systems regulate workloads, voltage\-frequency states, or operating system\-scheduling policies to improve the energy efficiency and avoid throttling\[[22](https://arxiv.org/html/2608.21172#bib.bib14),[14](https://arxiv.org/html/2608.21172#bib.bib17),[34](https://arxiv.org/html/2608.21172#bib.bib16)\]\. These approaches are often very essential in the edge devices and federated fine\-tuning systems, but they typically treat temperature as a runtime\-management variable instead of a signal that shapes the federated fine\-tuning behaviour\.

Federated learning is also vulnerable to the unreliable and malicious update, caused by compromised clients or communication channels\. Byzantine clients, model poisoning, backdoor attacks, and compromised communication channels can corrupt the updates which are used to form the global model\[[2](https://arxiv.org/html/2608.21172#bib.bib23),[6](https://arxiv.org/html/2608.21172#bib.bib22),[24](https://arxiv.org/html/2608.21172#bib.bib24),[10](https://arxiv.org/html/2608.21172#bib.bib26)\]\. Existing Robust aggregation methods reduces this risk of corrupted global model by rejecting abnormal updates or limiting the influence of co\-ordinates which are outliers\. Krum and Multi\-Krum selects the updates using the distance based consistency\[[7](https://arxiv.org/html/2608.21172#bib.bib27),[3](https://arxiv.org/html/2608.21172#bib.bib40)\]\. Bulyan combines the selection with co\-ordinate wise consistency aggregation\[[12](https://arxiv.org/html/2608.21172#bib.bib42)\], whereas co\-ordinate wise median and trimmed mean methods reduces the effect of co\-ordinate level outliers\[[45](https://arxiv.org/html/2608.21172#bib.bib41)\]\. These defenses provides important method to protect the global model from being corrupted in the adversarial FL setup, but they are usually designed for the dense or structurally comparable updates\. However, this paper studies a setting where client\-side hardware constraints can change participation and update structure, requiring thermal\-aware client adaptation and robust aggregation to be considered together in a single framework\.

To sum it up, prior works have made substantial progress in the field of federated LLM adaptation, thermal\-aware edge execution, and robust aggregation\. However, these fields are typically studied separately\. This leaves an open problem for edge LLM fine\-tuning, how to adapt client\-side training to hardware constraints while maintaining server\-side robustness against unreliable or adversarial updates\.

## VIIIConclusion

In this research work, we proposed Thermo\-FL, a thermal\-aware federated fine\-tuning framework for large language models running on edge clients\. In the proposed framework, device temperature acts as a control signal regulating local LoRA training and sparse update transmission, thus lowering the client workload under thermal stress\. In order to protect aggregation mechanism under dynamically sparse and adversarial updates, TERRA was introduced as a robust aggregation pipeline that combines norm filtering, mask\-aware directional validation, adaptive active\-coordinate clipping, and mask\-aware aggregation\.

Thermo\-FL was evaluated using both a large\-scale emulator and a physical Jetson\-based testbed\. The emulator showed improved robustness under adversarial sparse aggregation while preserving competitive utility, especially on BoolQ\. The physical prototype further demonstrated end\-to\-end feasibility on real edge hardware, with stabilized device temperature, reduced compressed upload size through bitmap sparse encoding, and preserved GSM8K utility under sign\-flip/scale and MITM perturbations\. Overall, these results suggest that secure edge LLM adaptation should treat hardware behavior, sparse communication, and aggregation robustness as coupled design requirements rather than separate system concerns\.

## References

- \[1\]\(2021\)Differentially private learning with adaptive clipping\.InProceedings of the 35th International Conference on Neural Information Processing Systems,NIPS ’21,Red Hook, NY, USA\.External Links:ISBN 9781713845393Cited by:[§IV\-C](https://arxiv.org/html/2608.21172#S4.SS3.p2.1)\.
- \[2\]E\. Bagdasaryan, A\. Veit, Y\. Hua, D\. Estrin, and V\. Shmatikov\(2020\)How To Backdoor Federated Learning\.InProceedings of the Twenty Third International Conference on Artificial Intelligence and Statistics,S\. Chiappa and R\. Calandra \(Eds\.\),Proceedings of Machine Learning Research, Vol\.108,pp\. 2938–2948\.External Links:[Link](https://proceedings.mlr.press/v108/bagdasaryan20a.html)Cited by:[§I](https://arxiv.org/html/2608.21172#S1.p2.1),[§I](https://arxiv.org/html/2608.21172#S1.p3.1),[§III\-B](https://arxiv.org/html/2608.21172#S3.SS2.p3.2),[§VII](https://arxiv.org/html/2608.21172#S7.p3.1)\.
- \[3\]G\. Bareilles, W\. Bouaziz, J\. Fageot, and E\. El\-Mhamdi\(2026\)Byzantine Machine Learning: MultiKrum and an optimal notion of robustness\.External Links:2602\.03899,[Link](https://arxiv.org/abs/2602.03899)Cited by:[§VII](https://arxiv.org/html/2608.21172#S7.p3.1)\.
- \[4\]G\. Baruch, M\. Baruch, and Y\. Goldberg\(2019\)A Little Is Enough: Circumventing Defenses For Distributed Learning\.InAdvances in Neural Information Processing Systems,H\. Wallach, H\. Larochelle, A\. Beygelzimer, F\. d'Alché\-Buc, E\. Fox, and R\. Garnett \(Eds\.\),Vol\.32,pp\.\.External Links:[Link](https://proceedings.neurips.cc/paper_files/paper/2019/file/ec1c59141046cd1866bbbcdfb6ae31d4-Paper.pdf)Cited by:[§III\-B](https://arxiv.org/html/2608.21172#S3.SS2.p3.2)\.
- \[5\]K\. Bałazy, M\. Banaei, K\. Aberer, and J\. Tabor\(2025\)LoRA\-XS: Low\-Rank Adaptation with Extremely Small Number of Parameters\.External Links:2405\.17604,[Link](https://arxiv.org/abs/2405.17604)Cited by:[§II\-B](https://arxiv.org/html/2608.21172#S2.SS2.p1.1)\.
- \[6\]A\. N\. Bhagoji, S\. Chakraborty, P\. Mittal, and S\. Calo\(2019\)Analyzing Federated Learning through an Adversarial Lens\.InProceedings of the 36th International Conference on Machine Learning,K\. Chaudhuri and R\. Salakhutdinov \(Eds\.\),Proceedings of Machine Learning Research, Vol\.97,pp\. 634–643\.External Links:[Link](https://proceedings.mlr.press/v97/bhagoji19a.html)Cited by:[§I](https://arxiv.org/html/2608.21172#S1.p2.1),[§I](https://arxiv.org/html/2608.21172#S1.p3.1),[§VII](https://arxiv.org/html/2608.21172#S7.p3.1)\.
- \[7\]P\. Blanchard, E\. M\. El Mhamdi, R\. Guerraoui, and J\. Stainer\(2017\)Machine Learning with Adversaries: Byzantine Tolerant Gradient Descent\.InAdvances in Neural Information Processing Systems,I\. Guyon, U\. V\. Luxburg, S\. Bengio, H\. Wallach, R\. Fergus, S\. Vishwanathan, and R\. Garnett \(Eds\.\),Vol\.30,pp\.\.External Links:[Link](https://proceedings.neurips.cc/paper_files/paper/2017/file/f4b9ec30ad9f68f89b29639786cb62ef-Paper.pdf)Cited by:[§I](https://arxiv.org/html/2608.21172#S1.p3.1),[§VII](https://arxiv.org/html/2608.21172#S7.p3.1)\.
- \[8\]C\. Clark, K\. Lee, M\. Chang, T\. Kwiatkowski, M\. Collins, and K\. Toutanova\(2019\)BoolQ: Exploring the Surprising Difficulty of Natural Yes/No Questions\.InProceedings of the 2019 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, Volume 1 \(Long and Short Papers\),J\. Burstein, C\. Doran, and T\. Solorio \(Eds\.\),Minneapolis, Minnesota,pp\. 2924–2936\.External Links:[Link](https://aclanthology.org/N19-1300/),[Document](https://dx.doi.org/10.18653/v1/N19-1300)Cited by:[§V\-A1](https://arxiv.org/html/2608.21172#S5.SS1.SSS1.p2.1)\.
- \[9\]K\. Cobbe, V\. Kosaraju, M\. Bavarian, M\. Chen, H\. Jun, L\. Kaiser, M\. Plappert, J\. Tworek, J\. Hilton, R\. Nakano, C\. Hesse, and J\. Schulman\(2021\)Training Verifiers to Solve Math Word Problems\.External Links:2110\.14168,[Link](https://arxiv.org/abs/2110.14168)Cited by:[§V\-A1](https://arxiv.org/html/2608.21172#S5.SS1.SSS1.p2.1)\.
- \[10\]M\. Conti, N\. Dragoni, and V\. Lesyk\(2016\)A Survey of Man In The Middle Attacks\.IEEE Communications Surveys & Tutorials18\(3\),pp\. 2027–2051\.External Links:[Document](https://dx.doi.org/10.1109/COMST.2016.2548426)Cited by:[§I](https://arxiv.org/html/2608.21172#S1.p2.1),[§I](https://arxiv.org/html/2608.21172#S1.p3.1),[§III\-B](https://arxiv.org/html/2608.21172#S3.SS2.p4.1),[§VII](https://arxiv.org/html/2608.21172#S7.p3.1)\.
- \[11\]G\. Damaskinos, E\. El\-Mhamdi, R\. Guerraoui, R\. Patra, and M\. Taziki\(2018\)Asynchronous Byzantine Machine Learning \(the case of SGD\)\.InProceedings of the 35th International Conference on Machine Learning,J\. Dy and A\. Krause \(Eds\.\),Proceedings of Machine Learning Research, Vol\.80,pp\. 1145–1154\.External Links:[Link](https://proceedings.mlr.press/v80/damaskinos18a.html)Cited by:[§III\-B](https://arxiv.org/html/2608.21172#S3.SS2.p2.1),[§III\-B](https://arxiv.org/html/2608.21172#S3.SS2.p3.2)\.
- \[12\]E\. El\-Mhamdi, R\. Guerraoui, and S\. Rouault\(2018\)The Hidden Vulnerability of Distributed Learning in Byzantium\.InProceedings of the 35th International Conference on Machine Learning,J\. Dy and A\. Krause \(Eds\.\),Proceedings of Machine Learning Research, Vol\.80,pp\. 3521–3530\.External Links:[Link](https://proceedings.mlr.press/v80/mhamdi18a.html)Cited by:[§I](https://arxiv.org/html/2608.21172#S1.p3.1),[§VII](https://arxiv.org/html/2608.21172#S7.p3.1)\.
- \[13\]M\. Fang, X\. Cao, J\. Jia, and N\. Gong\(2020\)Local Model Poisoning Attacks to Byzantine\-Robust Federated Learning\.In29th USENIX Security Symposium \(USENIX Security 20\),pp\. 1605–1622\.External Links:ISBN 978\-1\-939133\-17\-5,[Link](https://www.usenix.org/conference/usenixsecurity20/presentation/fang)Cited by:[§III\-B](https://arxiv.org/html/2608.21172#S3.SS2.p2.1),[§III\-B](https://arxiv.org/html/2608.21172#S3.SS2.p3.2)\.
- \[14\]S\. H\. Gade, H\. K\. Mondal, and S\. Deb\(2015\)A Hardware and Thermal Analysis of DVFS in a Multi\-core System with Hybrid WNoC Architecture\.In2015 28th International Conference on VLSI Design,Vol\.,pp\. 117–122\.External Links:[Document](https://dx.doi.org/10.1109/VLSID.2015.25)Cited by:[§III\-A](https://arxiv.org/html/2608.21172#S3.SS1.p1.1),[§VII](https://arxiv.org/html/2608.21172#S7.p2.1)\.
- \[15\]F\. Haddadpour and M\. Mahdavi\(2019\)On the Convergence of Local Descent Methods in Federated Learning\.External Links:1910\.14425,[Link](https://arxiv.org/abs/1910.14425)Cited by:[§VII](https://arxiv.org/html/2608.21172#S7.p2.1)\.
- \[16\]V\. Hanumaiah, S\. Vrudhula, and K\. S\. Chatha\(2011\)Performance Optimal Online DVFS and Task Migration Techniques for Thermally Constrained Multi\-Core Processors\.IEEE Transactions on Computer\-Aided Design of Integrated Circuits and Systems30\(11\),pp\. 1677–1690\.External Links:[Document](https://dx.doi.org/10.1109/TCAD.2011.2161308)Cited by:[§I](https://arxiv.org/html/2608.21172#S1.p3.1),[§III\-A](https://arxiv.org/html/2608.21172#S3.SS1.p1.1),[§VII](https://arxiv.org/html/2608.21172#S7.p2.1)\.
- \[17\]V\. Hanumaiah and S\. Vrudhula\(2014\)Energy\-Efficient Operation of Multicore Processors by DVFS, Task Migration, and Active Cooling\.IEEE Transactions on Computers63\(2\),pp\. 349–360\.External Links:[Document](https://dx.doi.org/10.1109/TC.2012.213)Cited by:[§III\-A](https://arxiv.org/html/2608.21172#S3.SS1.p1.1),[§VII](https://arxiv.org/html/2608.21172#S7.p2.1)\.
- \[18\]A\. Hard, K\. Rao, R\. Mathews, S\. Ramaswamy, F\. Beaufays, S\. Augenstein, H\. Eichner, C\. Kiddon, and D\. Ramage\(2019\)Federated Learning for Mobile Keyboard Prediction\.External Links:1811\.03604,[Link](https://arxiv.org/abs/1811.03604)Cited by:[§I](https://arxiv.org/html/2608.21172#S1.p1.1)\.
- \[19\]N\. Houlsby, A\. Giurgiu, S\. Jastrzebski, B\. Morrone, Q\. de Laroussilhe, A\. Gesmundo, M\. Attariyan, and S\. Gelly\(2019\)Parameter\-Efficient Transfer Learning for NLP\.External Links:1902\.00751,[Link](https://arxiv.org/abs/1902.00751)Cited by:[§II\-B](https://arxiv.org/html/2608.21172#S2.SS2.p1.1)\.
- \[20\]C\. Hu and B\. Li\(2025\)MaskCrypt: Federated Learning With Selective Homomorphic Encryption\.IEEE Transactions on Dependable and Secure Computing22\(1\),pp\. 221–233\.External Links:[Document](https://dx.doi.org/10.1109/TDSC.2024.3392424)Cited by:[§III\-C](https://arxiv.org/html/2608.21172#S3.SS3.p1.1)\.
- \[21\]E\. J\. Hu, Y\. Shen, P\. Wallis, Z\. Allen\-Zhu, Y\. Li, S\. Wang, L\. Wang, and W\. Chen\(2021\)LoRA: Low\-Rank Adaptation of Large Language Models\.External Links:2106\.09685,[Link](https://arxiv.org/abs/2106.09685)Cited by:[§I](https://arxiv.org/html/2608.21172#S1.p1.1),[§II\-B](https://arxiv.org/html/2608.21172#S2.SS2.p1.1),[§VII](https://arxiv.org/html/2608.21172#S7.p1.1)\.
- \[22\]W\.\-L\. Hung, Y\. Xie, N\. ViJaykrishnan, M\. Kandemir, and M\.J\. Irwin\(2005\)Thermal\-aware task allocation and scheduling for embedded systems\.InDesign, Automation and Test in Europe,Vol\.,pp\. 898–899 Vol\. 2\.External Links:[Document](https://dx.doi.org/10.1109/DATE.2005.310)Cited by:[§VII](https://arxiv.org/html/2608.21172#S7.p2.1)\.
- \[23\]S\. Jiang, X\. Zhou, M\. Zhang, C\. Xu, G\. Liao, J\. Chen, and J\. Cao\(2026\)Edge large language models: A comprehensive survey\.CCF Transactions on Pervasive Computing and Interaction,pp\.\.External Links:[Document](https://dx.doi.org/10.1007/s42486-025-00227-7)Cited by:[§I](https://arxiv.org/html/2608.21172#S1.p1.1),[§VII](https://arxiv.org/html/2608.21172#S7.p1.1)\.
- \[24\]D\. M\. Jimenez\-Gutierrez, Y\. Falkouskaya, J\. L\. Hernandez\-Ramos, A\. Anagnostopoulos, I\. Chatzigiannakis, and A\. Vitaletti\(2025\)On the Security and Privacy of Federated Learning: A Survey with Attacks, Defenses, Frameworks, Applications, and Future Directions\.External Links:2508\.13730,[Link](https://arxiv.org/abs/2508.13730)Cited by:[§I](https://arxiv.org/html/2608.21172#S1.p2.1),[§VII](https://arxiv.org/html/2608.21172#S7.p3.1)\.
- \[25\]P\. Kairouz and H\. B\. McMahan\(2021\)Advances and Open Problems in Federated Learning\.Foundations and Trends in Machine Learning14\(1\-2\),pp\. 1–210\.External Links:ISSN 1935\-8237,[Document](https://dx.doi.org/10.1561/2200000083),[Link](https://doi.org/10.1561/2200000083),https://www\.emerald\.com/ftmal/article\-pdf/14/1\-2/1/11147179/2200000083en\.pdfCited by:[§III\-B](https://arxiv.org/html/2608.21172#S3.SS2.p1.1),[§VII](https://arxiv.org/html/2608.21172#S7.p1.1)\.
- \[26\]A\. R\. Khouas, M\. R\. Bouadjenek, H\. Hacid, and S\. Aryal\(2024\)Training Machine Learning models at the Edge: A Survey\.External Links:2403\.02619,[Link](https://arxiv.org/abs/2403.02619)Cited by:[§VII](https://arxiv.org/html/2608.21172#S7.p1.1)\.
- \[27\]V\. Kulkarni, M\. Kulkarni, and A\. Pant\(2020\)Survey of Personalization Techniques for Federated Learning\.In2020 Fourth World Conference on Smart Trends in Systems, Security and Sustainability \(WorldS4\),Vol\.,pp\. 794–797\.External Links:[Document](https://dx.doi.org/10.1109/WorldS450073.2020.9210355)Cited by:[§II\-B](https://arxiv.org/html/2608.21172#S2.SS2.p1.1)\.
- \[28\]K\. Kuo, A\. Raje, K\. Rajesh, and V\. Smith\(2024\)Federated LoRA with Sparse Communication\.External Links:2406\.05233,[Link](https://arxiv.org/abs/2406.05233)Cited by:[§VII](https://arxiv.org/html/2608.21172#S7.p1.1)\.
- \[29\]E\. Le Sueur and G\. Heiser\(2010\)Dynamic Voltage and Frequency Scaling: The Laws of Diminishing Returns\.InProceedings of the 2010 International Conference on Power Aware Computing and Systems,HotPower’10,USA,pp\. 1–8\.Cited by:[§VII](https://arxiv.org/html/2608.21172#S7.p2.1)\.
- \[30\]B\. Lester, R\. Al\-Rfou, and N\. Constant\(2021\)The Power of Scale for Parameter\-Efficient Prompt Tuning\.InProceedings of the 2021 Conference on Empirical Methods in Natural Language Processing,M\. Moens, X\. Huang, L\. Specia, and S\. W\. Yih \(Eds\.\),Online and Punta Cana, Dominican Republic,pp\. 3045–3059\.External Links:[Link](https://aclanthology.org/2021.emnlp-main.243/),[Document](https://dx.doi.org/10.18653/v1/2021.emnlp-main.243)Cited by:[§II\-B](https://arxiv.org/html/2608.21172#S2.SS2.p1.1),[§VII](https://arxiv.org/html/2608.21172#S7.p1.1)\.
- \[31\]T\. Li, A\. K\. Sahu, M\. Zaheer, M\. Sanjabi, A\. Talwalkar, and V\. Smith\(2020\)Federated Optimization in Heterogeneous Networks\.External Links:1812\.06127,[Link](https://arxiv.org/abs/1812.06127)Cited by:[§VII](https://arxiv.org/html/2608.21172#S7.p2.1)\.
- \[32\]X\. L\. Li and P\. Liang\(2021\)Prefix\-Tuning: Optimizing Continuous Prompts for Generation\.External Links:2101\.00190,[Link](https://arxiv.org/abs/2101.00190)Cited by:[§II\-B](https://arxiv.org/html/2608.21172#S2.SS2.p1.1),[§VII](https://arxiv.org/html/2608.21172#S7.p1.1)\.
- \[33\]H\. Liu, R\. Wen, S\. Nair, J\. Liu, W\. Lou, C\. Zhang, W\. Yeoh, Y\. Vorobeychik, and N\. Zhang\(2025\)EcoLoRA: Communication\-Efficient Federated Fine\-Tuning of Large Language Models\.External Links:2506\.02001,[Link](https://arxiv.org/abs/2506.02001)Cited by:[§VII](https://arxiv.org/html/2608.21172#S7.p1.1)\.
- \[34\]S\. Liu and A\. Karanth\(2021\)Dynamic Voltage and Frequency Scaling to Improve Energy\-Efficiency of Hardware Accelerators\.In2021 IEEE 28th International Conference on High Performance Computing, Data, and Analytics \(HiPC\),Vol\.,pp\. 232–241\.External Links:[Document](https://dx.doi.org/10.1109/HiPC53243.2021.00037)Cited by:[§I](https://arxiv.org/html/2608.21172#S1.p3.1),[§VII](https://arxiv.org/html/2608.21172#S7.p2.1)\.
- \[35\]B\. McMahan, E\. Moore, D\. Ramage, S\. Hampson, and B\. A\. y\. Arcas\(2017\)Communication\-Efficient Learning of Deep Networks from Decentralized Data\.InProceedings of the 20th International Conference on Artificial Intelligence and Statistics,A\. Singh and J\. Zhu \(Eds\.\),Proceedings of Machine Learning Research, Vol\.54,pp\. 1273–1282\.External Links:[Link](https://proceedings.mlr.press/v54/mcmahan17a.html)Cited by:[§I](https://arxiv.org/html/2608.21172#S1.p1.1),[§II\-A](https://arxiv.org/html/2608.21172#S2.SS1.p1.1),[§VII](https://arxiv.org/html/2608.21172#S7.p1.1)\.
- \[36\]V\. Peluso, R\. G\. Rizzo, and A\. Calimera\(2019\)Performance Profiling of Embedded ConvNets under Thermal\-Aware DVFS\.Electronics8\(12\),pp\. 1423\.Cited by:[§III\-A](https://arxiv.org/html/2608.21172#S3.SS1.p1.1)\.
- \[37\]Y\. Wu, C\. Tian, J\. Li, H\. Sun, K\. Tam, Z\. Zhou, H\. Liao, J\. Xiong, Z\. Guo, L\. Li, and C\. Xu\(2026\)A Survey on Federated Fine\-tuning of Large Language Models\.External Links:2503\.12016,[Link](https://arxiv.org/abs/2503.12016)Cited by:[§I](https://arxiv.org/html/2608.21172#S1.p3.1)\.
- \[38\]Q\. Xia, W\. Ye, Z\. Tao, J\. Wu, and Q\. Li\(2021\)A survey of federated learning for edge computing: Research problems and solutions\.High\-Confidence Computing1\(1\),pp\. 100008\.External Links:ISSN 2667\-2952,[Document](https://dx.doi.org/https%3A//doi.org/10.1016/j.hcc.2021.100008),[Link](https://www.sciencedirect.com/science/article/pii/S266729522100009X)Cited by:[§I](https://arxiv.org/html/2608.21172#S1.p2.1)\.
- \[39\]H\. Xu, K\. Li, W\. Chen, D\. Zheng, Z\. Li, and Z\. Cai\(2025\)A Survey: Towards Privacy and Security in Mobile Large Language Models\.External Links:2509\.02411,[Link](https://arxiv.org/abs/2509.02411)Cited by:[§I](https://arxiv.org/html/2608.21172#S1.p1.1),[§VII](https://arxiv.org/html/2608.21172#S7.p1.1)\.
- \[40\]H\. Xu, S\. Shrestha, W\. Chen, Z\. Li, and Z\. Cai\(2025\)DP\-FedLoRA: Privacy\-Enhanced Federated Fine\-Tuning for On\-Device Large Language Models\.In2025 IEEE International Conference on Data Mining \(ICDM\),Vol\.,pp\. 813–822\.External Links:[Document](https://dx.doi.org/10.1109/ICDM65498.2025.00089)Cited by:[§I](https://arxiv.org/html/2608.21172#S1.p3.1)\.
- \[41\]J\. Xu, Z\. Li, W\. Chen, Q\. Wang, X\. Gao, Q\. Cai, and Z\. Ling\(2024\)On\-Device Language Models: A Comprehensive Review\.External Links:2409\.00088,[Link](https://arxiv.org/abs/2409.00088)Cited by:[§I](https://arxiv.org/html/2608.21172#S1.p1.1),[§VII](https://arxiv.org/html/2608.21172#S7.p1.1)\.
- \[42\]J\. Xu, S\. Huang, L\. Song, and T\. Lan\(2022\)Byzantine\-robust federated learning through collaborative malicious gradient filtering\.In2022 IEEE 42nd International Conference on Distributed Computing Systems \(ICDCS\),pp\. 1223–1235\.Cited by:[§I](https://arxiv.org/html/2608.21172#S1.p3.1),[§IV\-C](https://arxiv.org/html/2608.21172#S4.SS3.p2.1)\.
- \[43\]G\. Yan, L\. Xie, Q\. Shen, Y\. Fang, and Z\. Wu\(2026\)FedSRD: Sparsify\-Reconstruct\-Decompose for Communication\-Efficient Federated Large Language Models Fine\-Tuning\.InProceedings of the ACM Web Conference 2026,pp\. 5087–5098\.Cited by:[§VII](https://arxiv.org/html/2608.21172#S7.p1.1)\.
- \[44\]A\. Yang, B\. Yang, B\. Zhang, B\. Hui, B\. Zheng, B\. Yu, C\. Li, D\. Liu, F\. Huang,et al\.\(2025\)Qwen2\.5 Technical Report\.External Links:2412\.15115,[Link](https://arxiv.org/abs/2412.15115)Cited by:[§V\-A1](https://arxiv.org/html/2608.21172#S5.SS1.SSS1.p2.1)\.
- \[45\]D\. Yin, Y\. Chen, R\. Kannan, and P\. Bartlett\(2018\)Byzantine\-Robust Distributed Learning: Towards Optimal Statistical Rates\.InProceedings of the 35th International Conference on Machine Learning,J\. Dy and A\. Krause \(Eds\.\),Proceedings of Machine Learning Research, Vol\.80,pp\. 5650–5659\.External Links:[Link](https://proceedings.mlr.press/v80/yin18a.html)Cited by:[§I](https://arxiv.org/html/2608.21172#S1.p3.1),[§VII](https://arxiv.org/html/2608.21172#S7.p3.1)\.
- \[46\]L\. Zhang, L\. Zhang, S\. Shi, X\. Chu, and B\. Li\(2023\)LoRA\-FA: Memory\-efficient Low\-rank Adaptation for Large Language Models Fine\-tuning\.External Links:2308\.03303,[Link](https://arxiv.org/abs/2308.03303)Cited by:[§II\-B](https://arxiv.org/html/2608.21172#S2.SS2.p1.1)\.
- \[47\]S\. Zhu, T\. Voigt, F\. Rahimian, and J\. Ko\(2024\)On\-device Training: A First Overview on Existing Systems\.ACM Trans\. Sen\. Netw\.20\(6\)\.External Links:ISSN 1550\-4859,[Link](https://doi.org/10.1145/3696003),[Document](https://dx.doi.org/10.1145/3696003)Cited by:[§VII](https://arxiv.org/html/2608.21172#S7.p1.1),[§VII](https://arxiv.org/html/2608.21172#S7.p2.1)\.

## Appendix AConvergence Rationale Under an Abstract TERRA Operator

This appendix provides a compact convergence rationale for Thermo\-FL under thermally regulated local computation, temperature\-driven sparsification, and server\-side TERRA aggregation\. The implemented TERRA pipeline is data\-dependent: the accepted client set, clipping threshold, and coordinate supports vary by round\. A full first\-principles convergence proof for the exact implementation would therefore require strong assumptions on the evolution of these data\-dependent quantities\. Instead, we analyze a faithful abstraction in which the implemented TERRA aggregate satisfies explicit alignment and bounded\-moment conditions\. This is the standard role of the appendix: to clarify the optimization behavior implied by the design, not to claim unconditional convergence under arbitrary Byzantine behavior\.

### A\-ANotation Bridge

The main text writes the server update as

W\(t\+1\)=W\(t\)\+Δ¯\(t\),W^\{\(t\+1\)\}=W^\{\(t\)\}\+\\bar\{\\Delta\}^\{\(t\)\},\(22\)whereΔ¯\(t\)\\bar\{\\Delta\}^\{\(t\)\}is the aggregate LoRA delta produced by TERRA\. For the convergence argument, we define the associated descent direction

G\(t\):=−1η​Δ¯\(t\),G^\{\(t\)\}:=\-\\frac\{1\}\{\\eta\}\\bar\{\\Delta\}^\{\(t\)\},\(23\)so that Eq\. \([22](https://arxiv.org/html/2608.21172#A1.E22)\) can be written equivalently as

W\(t\+1\)=W\(t\)−η​G\(t\)\.W^\{\(t\+1\)\}=W^\{\(t\)\}\-\\eta G^\{\(t\)\}\.\(24\)
We consider the weighted federated objective

J⁡\(W\)=∑k=1Kpk​Fk​\(W\),∑k=1Kpk=1,J\(W\)=\\sum\_\{k=1\}^\{K\}p\_\{k\}F\_\{k\}\(W\),\\qquad\\sum\_\{k=1\}^\{K\}p\_\{k\}=1,\(25\)whereFkF\_\{k\}is the local empirical risk of clientkk\.

At roundtt, a selected clientk∈Stk\\in S\_\{t\}computes a stochastic gradientgk\(t\)g\_\{k\}^\{\(t\)\}, applies the layer\-freezing projection induced byκk\(t\)\\kappa\_\{k\}^\{\(t\)\}, and then applies temperature\-driven top\-kksparsification:

vk\(t\)=Sρk\(t\)​\(Pκk\(t\)​gk\(t\)\)\.v\_\{k\}^\{\(t\)\}=S\_\{\\rho\_\{k\}^\{\(t\)\}\}\\\!\\left\(P\_\{\\kappa\_\{k\}^\{\(t\)\}\}g\_\{k\}^\{\(t\)\}\\right\)\.\(26\)The corresponding sparse LoRA delta is

Δ~k\(t\)=−η​vk\(t\)\.\\tilde\{\\Delta\}\_\{k\}^\{\(t\)\}=\-\\eta v\_\{k\}^\{\(t\)\}\.\(27\)Letmk\(t\)∈\{0,1\}dm\_\{k\}^\{\(t\)\}\\in\\\{0,1\\\}^\{d\}denote the decoded support mask\. Consistent with the main text, the decoded sparse update object is

uk\(t\)=\(Δ~k\(t\),mk\(t\)\),U\(t\)=\{uk\(t\):k∈St\}\.u\_\{k\}^\{\(t\)\}=\\left\(\\tilde\{\\Delta\}\_\{k\}^\{\(t\)\},m\_\{k\}^\{\(t\)\}\\right\),\\qquad U^\{\(t\)\}=\\\{u\_\{k\}^\{\(t\)\}:k\\in S\_\{t\}\\\}\.\(28\)The implemented TERRA aggregate is written as

Δ¯\(t\)=ℱTERRA\(t\)​\(U\(t\)\),\\bar\{\\Delta\}^\{\(t\)\}=\\mathcal\{F\}\_\{\\mathrm\{TERRA\}\}^\{\(t\)\}\(U^\{\(t\)\}\),\(29\)whereℱTERRA\(t\)\\mathcal\{F\}\_\{\\mathrm\{TERRA\}\}^\{\(t\)\}includes norm filtering, mask\-aware directional validation, adaptive active\-coordinate clipping, and mask\-aware aggregation\.

### A\-BAssumptions

##### Smoothness\.

The global objectiveJJisLL\-smooth:

‖∇J​\(x\)−∇J​\(y\)‖2≤L​‖x−y‖2,∀x,y\.\\\|\\nabla J\(x\)\-\\nabla J\(y\)\\\|\_\{2\}\\leq L\\\|x\-y\\\|\_\{2\},\\qquad\\forall x,y\.\(30\)

##### Stochastic gradients\.

For each clientkk, the stochastic gradient is unbiased with bounded variance:

𝔼⁡\[gk\(t\)​\(W\)\]=∇Fk​\(W\),𝔼⁡\[‖gk\(t\)​\(W\)−∇Fk​\(W\)‖22\]≤σ2\.\\mathbb\{E\}\[g\_\{k\}^\{\(t\)\}\(W\)\]=\\nabla F\_\{k\}\(W\),\\qquad\\mathbb\{E\}\\\!\\left\[\\\|g\_\{k\}^\{\(t\)\}\(W\)\-\\nabla F\_\{k\}\(W\)\\\|\_\{2\}^\{2\}\\right\]\\leq\\sigma^\{2\}\.\(31\)

##### Thermal control bounds\.

The thermal controller keeps the active\-layer and transmission ratios within fixed positive ranges:

κk\(t\)≥κmin\>0,ρmin≤ρk\(t\)≤ρmax≤1\.\\kappa\_\{k\}^\{\(t\)\}\\geq\\kappa\_\{\\min\}\>0,\\qquad\\rho\_\{\\min\}\\leq\\rho\_\{k\}^\{\(t\)\}\\leq\\rho\_\{\\max\}\\leq 1\.\(32\)The layer\-freezing projection may introduce a bounded bias:

‖∇J\(W\(t\)\)−Pκk\(t\)∇J\(W\(t\)\)‖22≤ϵκk\(t\),supt,kϵκk\(t\)≤ϵ¯\.\\left\\\|\\nabla J\(W^\{\(t\)\}\)\-P\_\{\\kappa\_\{k\}^\{\(t\)\}\}\\nabla J\(W^\{\(t\)\}\)\\right\\\|\_\{2\}^\{2\}\\leq\\epsilon\_\{\\kappa\_\{k\}^\{\(t\)\}\},\\qquad\\sup\_\{t,k\}\\epsilon\_\{\\kappa\_\{k\}^\{\(t\)\}\}\\leq\\bar\{\\epsilon\}\.\(33\)

##### Sparsification\.

The top\-kksparsifier preserves a nontrivial fraction of the update energy\. For any vectorxx,

⟨x,Sρ​\(x\)⟩≥ρ​‖x‖22,‖Sρ​\(x\)‖22≤‖x‖22\.\\langle x,S\_\{\\rho\}\(x\)\\rangle\\geq\\rho\\\|x\\\|\_\{2\}^\{2\},\\qquad\\\|S\_\{\\rho\}\(x\)\\\|\_\{2\}^\{2\}\\leq\\\|x\\\|\_\{2\}^\{2\}\.\(34\)

##### Abstract TERRA alignment\.

There exist constantsαT∈\(0,1\]\\alpha\_\{\\mathrm\{T\}\}\\in\(0,1\]andεT≥0\\varepsilon\_\{\\mathrm\{T\}\}\\geq 0such that the descent direction produced by the implemented TERRA aggregate satisfies

𝔼⁡\[⟨∇J​\(W\(t\)\),G\(t\)⟩\]≥αT​ρmin​‖∇J​\(W\(t\)\)‖22−\(ϵ¯\+εT\)\.\\mathbb\{E\}\\left\[\\left\\langle\\nabla J\(W^\{\(t\)\}\),G^\{\(t\)\}\\right\\rangle\\right\]\\geq\\alpha\_\{\\mathrm\{T\}\}\\rho\_\{\\min\}\\\|\\nabla J\(W^\{\(t\)\}\)\\\|\_\{2\}^\{2\}\-\(\\bar\{\\epsilon\}\+\\varepsilon\_\{\\mathrm\{T\}\}\)\.\(35\)Here,εT\\varepsilon\_\{\\mathrm\{T\}\}captures the residual bias introduced by robust filtering, clipping, and adversarial contamination that survives the filters\.

##### Abstract TERRA second moment\.

There exist constantsCT≥1C\_\{\\mathrm\{T\}\}\\geq 1andνT≥0\\nu\_\{\\mathrm\{T\}\}\\geq 0such that

𝔼⁡\[‖G\(t\)‖22\]≤CT​\(‖∇J​\(W\(t\)\)‖22\+σ2\)\+νT\.\\mathbb\{E\}\\left\[\\\|G^\{\(t\)\}\\\|\_\{2\}^\{2\}\\right\]\\leq C\_\{\\mathrm\{T\}\}\\left\(\\\|\\nabla J\(W^\{\(t\)\}\)\\\|\_\{2\}^\{2\}\+\\sigma^\{2\}\\right\)\+\\nu\_\{\\mathrm\{T\}\}\.\(36\)The termνT\\nu\_\{\\mathrm\{T\}\}captures the residual second\-moment contribution induced by filtering, clipping, and surviving adversarial components\.

### A\-CBounded Influence of the Implemented TERRA Stages

The abstract constants above are not assumed to arise magically\. The implemented TERRA stages provide bounded\-influence behavior that supports these assumptions\. In particular, norm filtering rejects updates whose sparse\-delta norm exceeds the round\-adaptive thresholdBt=ms\(t\)\+λnorm​MAD\(t\)B\_\{t\}=m\_\{s\}^\{\(t\)\}\+\\lambda\_\{\\mathrm\{norm\}\}\\operatorname\{MAD\}^\{\(t\)\}\. Thus, a scaling or model\-replacement updateΔ~a\(t\)=γ​Δa\(t\)\\tilde\{\\Delta\}\_\{a\}^\{\(t\)\}=\\gamma\\Delta\_\{a\}^\{\(t\)\}is removed whenever

\|γ\|​‖Δa\(t\)‖2\>Bt\.\|\\gamma\|\\,\\\|\\Delta\_\{a\}^\{\(t\)\}\\\|\_\{2\}\>B\_\{t\}\.\(37\)
Mask\-aware directional validation rejects updates whose alignment with the reference directionr\(t\)r^\{\(t\)\}, measured only on the transmitted support, falls belowτdir\\tau\_\{\\mathrm\{dir\}\}\. Hence sign\-flipped updates that reverse the direction of an otherwise aligned sparse update are rejected when their support\-restricted cosine score falls below the threshold\.

For any update that survives filtering, adaptive clipping ensures

\|Δ^k,j\(t\)\|≤mk,j\(t\)​qt,\|\\hat\{\\Delta\}\_\{k,j\}^\{\(t\)\}\|\\leq m\_\{k,j\}^\{\(t\)\}q\_\{t\},\(38\)and if at mostρmax​d\\rho\_\{\\max\}dcoordinates are transmitted,

‖Δ^k\(t\)‖2≤qt​ρmax​d\.\\\|\\hat\{\\Delta\}\_\{k\}^\{\(t\)\}\\\|\_\{2\}\\leq q\_\{t\}\\sqrt\{\\rho\_\{\\max\}d\}\.\(39\)Finally, mask\-aware aggregation bounds the coordinate\-wise contribution of retained adversarial clients\. Let

Dj\(t\)=∑k∈Sdir\(t\)wk​mk,j\(t\)\+ϵD\_\{j\}^\{\(t\)\}=\\sum\_\{k\\in S\_\{\\mathrm\{dir\}\}^\{\(t\)\}\}w\_\{k\}m\_\{k,j\}^\{\(t\)\}\+\\epsilon\(40\)be the active aggregation mass for coordinatejj, and let

Aj\(t\)=\{a∈At∩Sdir\(t\):ma,j\(t\)=1\}A\_\{j\}^\{\(t\)\}=\\\{a\\in A\_\{t\}\\cap S\_\{\\mathrm\{dir\}\}^\{\(t\)\}:m\_\{a,j\}^\{\(t\)\}=1\\\}be the retained adversarial clients that transmitted coordinatejj\. Since clipping gives\|Δ^a,j\(t\)\|≤qt\|\\hat\{\\Delta\}\_\{a,j\}^\{\(t\)\}\|\\leq q\_\{t\}, their aggregate contribution satisfies

\|∑a∈Aj\(t\)wa​ma,j\(t\)​Δ^a,j\(t\)Dj\(t\)\|≤∑a∈Aj\(t\)waDj\(t\)​qt\.\\left\|\\frac\{\\sum\_\{a\\in A\_\{j\}^\{\(t\)\}\}w\_\{a\}m\_\{a,j\}^\{\(t\)\}\\hat\{\\Delta\}\_\{a,j\}^\{\(t\)\}\}\{D\_\{j\}^\{\(t\)\}\}\\right\|\\leq\\frac\{\\sum\_\{a\\in A\_\{j\}^\{\(t\)\}\}w\_\{a\}\}\{D\_\{j\}^\{\(t\)\}\}q\_\{t\}\.\(41\)This does not prove that every malicious update is removed\. It shows that any retained adversarial influence is bounded by the clipping threshold and the adversarial active aggregation weight on each coordinate\. This bounded\-influence property is the implementation\-level rationale behind the abstract residual termsεT\\varepsilon\_\{\\mathrm\{T\}\}andνT\\nu\_\{\\mathrm\{T\}\}\.

### A\-DConvergence Result

###### Theorem 1\(Stationary\-point bound under abstract TERRA\)\.

Assume Eqs\. \([30](https://arxiv.org/html/2608.21172#A1.E30)\)–\([36](https://arxiv.org/html/2608.21172#A1.E36)\)\. If

η≤αT​ρminL​CT,\\eta\\leq\\frac\{\\alpha\_\{\\mathrm\{T\}\}\\rho\_\{\\min\}\}\{LC\_\{\\mathrm\{T\}\}\},\(42\)then the iterates generated by Thermo\-FL satisfy

1T​∑t=1T𝔼⁡\[‖∇J​\(W\(t\)\)‖22\]≤\\displaystyle\\frac\{1\}\{T\}\\sum\_\{t=1\}^\{T\}\\mathbb\{E\}\\left\[\\\|\\nabla J\(W^\{\(t\)\}\)\\\|\_\{2\}^\{2\}\\right\]\\leq\\;2​\(𝔼⁡\[J⁡\(W\(1\)\)\]−J⋆\)η​αT​ρmin​T\\displaystyle\\frac\{2\\left\(\\mathbb\{E\}\[J\(W^\{\(1\)\}\)\]\-J^\{\\star\}\\right\)\}\{\\eta\\alpha\_\{\\mathrm\{T\}\}\\rho\_\{\\min\}T\}\+L​η​CT​σ2αT​ρmin\+2​\(ϵ¯\+εT\)αT​ρmin\+L​η​νTαT​ρmin\.\\displaystyle\+\\frac\{L\\eta C\_\{\\mathrm\{T\}\}\\sigma^\{2\}\}\{\\alpha\_\{\\mathrm\{T\}\}\\rho\_\{\\min\}\}\+\\frac\{2\(\\bar\{\\epsilon\}\+\\varepsilon\_\{\\mathrm\{T\}\}\)\}\{\\alpha\_\{\\mathrm\{T\}\}\\rho\_\{\\min\}\}\+\\frac\{L\\eta\\nu\_\{\\mathrm\{T\}\}\}\{\\alpha\_\{\\mathrm\{T\}\}\\rho\_\{\\min\}\}\.\(43\)

###### Proof\.

ByLL\-smoothness and the updateW\(t\+1\)=W\(t\)−η​G\(t\)W^\{\(t\+1\)\}=W^\{\(t\)\}\-\\eta G^\{\(t\)\},

J⁡\(W\(t\+1\)\)≤J⁡\(W\(t\)\)−η⁡⟨∇J​\(W\(t\)\),G\(t\)⟩\+L​η22​‖G\(t\)‖22\.J\(W^\{\(t\+1\)\}\)\\leq J\(W^\{\(t\)\}\)\-\\eta\\left\\langle\\nabla J\(W^\{\(t\)\}\),G^\{\(t\)\}\\right\\rangle\+\\frac\{L\\eta^\{2\}\}\{2\}\\\|G^\{\(t\)\}\\\|\_\{2\}^\{2\}\.\(44\)Taking expectations and applying the alignment and second\-moment assumptions gives

𝔼⁡\[J⁡\(W\(t\+1\)\)\]≤\\displaystyle\\mathbb\{E\}\[J\(W^\{\(t\+1\)\}\)\]\\leq\\;𝔼⁡\[J⁡\(W\(t\)\)\]−η​αT​ρmin​𝔼​\[‖∇J​\(W\(t\)\)‖22\]\+η⁡\(ϵ¯\+εT\)\\displaystyle\\mathbb\{E\}\[J\(W^\{\(t\)\}\)\]\-\\eta\\alpha\_\{\\mathrm\{T\}\}\\rho\_\{\\min\}\\mathbb\{E\}\\left\[\\\|\\nabla J\(W^\{\(t\)\}\)\\\|\_\{2\}^\{2\}\\right\]\+\\eta\(\\bar\{\\epsilon\}\+\\varepsilon\_\{\\mathrm\{T\}\}\)\+L​η22​\[CT​\(𝔼⁡\[‖∇J​\(W\(t\)\)‖22\]\+σ2\)\+νT\]\.\\displaystyle\+\\frac\{L\\eta^\{2\}\}\{2\}\\left\[C\_\{\\mathrm\{T\}\}\\left\(\\mathbb\{E\}\\left\[\\\|\\nabla J\(W^\{\(t\)\}\)\\\|\_\{2\}^\{2\}\\right\]\+\\sigma^\{2\}\\right\)\+\\nu\_\{\\mathrm\{T\}\}\\right\]\.\(45\)Rearranging and using the stepsize condition in Eq\. \([42](https://arxiv.org/html/2608.21172#A1.E42)\),

𝔼⁡\[J⁡\(W\(t\+1\)\)\]≤\\displaystyle\\mathbb\{E\}\[J\(W^\{\(t\+1\)\}\)\]\\leq\\;𝔼⁡\[J⁡\(W\(t\)\)\]−η​αT​ρmin2​𝔼​\[‖∇J​\(W\(t\)\)‖22\]\\displaystyle\\mathbb\{E\}\[J\(W^\{\(t\)\}\)\]\-\\frac\{\\eta\\alpha\_\{\\mathrm\{T\}\}\\rho\_\{\\min\}\}\{2\}\\mathbb\{E\}\\left\[\\\|\\nabla J\(W^\{\(t\)\}\)\\\|\_\{2\}^\{2\}\\right\]\+η⁡\(ϵ¯\+εT\)\+L​η22​\(CT​σ2\+νT\)\.\\displaystyle\+\\eta\(\\bar\{\\epsilon\}\+\\varepsilon\_\{\\mathrm\{T\}\}\)\+\\frac\{L\\eta^\{2\}\}\{2\}\\left\(C\_\{\\mathrm\{T\}\}\\sigma^\{2\}\+\\nu\_\{\\mathrm\{T\}\}\\right\)\.\(46\)Summing overt=1,…,Tt=1,\\ldots,T, telescoping, using𝔼⁡\[J⁡\(W\(T\+1\)\)\]≥J⋆\\mathbb\{E\}\[J\(W^\{\(T\+1\)\}\)\]\\geq J^\{\\star\}, and dividing byT​η​αT​ρmin/2T\\eta\\alpha\_\{\\mathrm\{T\}\}\\rho\_\{\\min\}/2yields Eq\. \([43](https://arxiv.org/html/2608.21172#A1.E43)\)\. ∎

### A\-EInterpretation

The bound in Eq\. \([43](https://arxiv.org/html/2608.21172#A1.E43)\) has four terms\. The first term decays as𝒪⁡\(1/T\)\\mathcal\{O\}\(1/T\)\. The second term is the stochastic\-gradient variance floor\. The third term captures the bias introduced by thermal projection and by the abstract TERRA residual\. The fourth term captures the second\-moment contribution of the TERRA operator\. Thus, Thermo\-FL converges to a stationary neighborhood whose radius depends on stochastic noise, thermal adaptation, sparsification, and robust aggregation\.

The theorem should not be read as an unconditional proof of convergence for arbitrary attacks\. Rather, it states that if the implemented TERRA pipeline preserves sufficient alignment with the global descent direction and keeps the aggregate second moment bounded, then Thermo\-FL retains the standard nonconvex stationary\-point behavior expected of stochastic federated optimization\. The bounded\-influence inequalities above explain why the TERRA stages support these abstract conditions: high\-magnitude updates are filtered, directionally inconsistent updates are rejected, retained coordinates are clipped, and sparse supports are aggregated without treating missing coordinates as zeros\.