// measurement
One bad node in a healthy fleet.
When one node in a federated fleet starts training on bad data, the fleet-wide score does not show it. We built a test harness, a rig that simulates a fleet and plants faults on purpose, to measure how well that node can be caught.
// on this page · 6 sections
Federated learning trains one shared model across nodes that cannot ship their raw data anywhere, because bandwidth is small or the data is sensitive. Each node trains locally and sends back only what it learned. A central server blends those updates into one model and sends it back out.
Now suppose one node's sensor is slowly going bad. It has not failed. It is drifting, a little miscalibrated, and the node does not know. It keeps training on degraded data and keeps sending well-formed updates. The fleet-wide score barely moves, because the healthy majority outvotes the one bad node.
In our ten-node simulation on image data, the fleet accuracy an operator would watch hid all 90 injected faults. It never moved more than 0.35 of a percentage point.
// before you look
If one node starts drifting, which line moves first?
- 01Watch the top panel. Fleet accuracy for the run with a drifting node (solid) tracks a healthy run (dashed). It never shows the fault.
- 02Watch the bottom panel. Each node has its own drift statistic. Node 2 pulls away from the other nine after round 15.
- 03Check the threshold. Node 2 crosses it at round 21. A few healthy nodes touch it too, so a second measure names the node.
A healthy fleet score does not prove every node is healthy. Averaging can hide the exact failure you need to find.
A signal like this is for screening. It tells you where to look next, and a person still has to find the cause. The rest of this page covers what the instrument needs to do that job honestly.
The shape of an honest instrument
Probe the models
No raw data can leave a node. Every node answers the same short quiz, a fixed set of probe items, and returns only its answers. If a node's answers drift away from the group, or from its own past, that shows up without anyone seeing its raw data.
Measure healthy first
Nodes in different places see different data, so they disagree even when nothing is wrong. That normal level of disagreement has to be measured before anything counts as a fault.
This is where simple node-to-node comparisons fail.
Plant a known fault and count
A controlled fault goes into one node's feed with known timing and severity. Every catch and every miss is counted, along with any healthy node flagged by mistake.
Report where it fails
Detection gets harder as the nodes' data grows more different. An honest result says where the method works and where it stops working.
Check the instrument too
A broken detector and a broken sensor look the same from the outside. Each node proves it scored the same quiz as everyone else, so a fault in the monitoring can be told apart from a fault in the node.
This came from operating experience. A discrepancy we once chased in a live system turned out to be the monitoring, not the thing being monitored.
What the harness has measured
faults the fleet score hid90 of 90
probe payload~1 kB per node
false alarms0–1.5% per node-round
full-scale runs250+
Wrong labels
Some of a node's training examples get the wrong answer attached. We planted three sizes of this fault, with 10%, 30% or 50% of one node's examples wrong, each creeping in over ten rounds. From 30% up, the harness catches the bad node and names it correctly within three to four rounds.
The percentage is how big the fault is, and the alarm setting is a separate dial, tuned so healthy runs almost never trip it. At 10% wrong, the smaller fault, the drift measure below still noticed trouble when the nodes' data was similar, but naming the node mostly failed. One miss at 30% is covered under where it fails.
Slow sensor drift
A sensor slowly blurs or reads a little off. One measure catches it: a running total of how far each node strays from its own past. It fires four to seven rounds after the drift starts.
When the nodes' data differs, nothing else we tried catches this. The measure is good at noticing trouble and poor at naming the node, so a second measure does the naming.
Bandwidth
Each round, every node answers the same 50 probe items. The answers take about one kilobyte, roughly the size of a short plain-text email. That is 0.12% of a normal model update.
The alarm setting is a trade
A lower alarm threshold catches more faults. It also raises more false alarms and blames more healthy nodes.
The wrong blame grows faster than the extra catches. At any setting, detection gets harder as the nodes' data grows more different.
A node that is mostly out of contact
Some nodes can only report now and then. We tested one that checked in every third round. The wrong-labels fault on that node was still caught and named at its fifth check-in after the fault began.
That is one run so far. It also showed the cost: a statistic that needs history takes three times as long to warm up when history arrives a third as often.
A second kind of data
We ran the same test, unchanged, on real underwater recordings of ships. Where the nodes' data was similar, all four fault types were caught in every run, against a 4% chance of catching them by accident.
Gain drift, the miss on image data, was caught here. The more the nodes' data differed, the less got caught, and where it differed most, nothing was.
Where it fails
Gain drift means a sensor's readings get stronger or weaker. On the image data it was often missed once the nodes' data differed. Where the data differed most, whether a fault was caught depended on which node had it.
Every result here rests on three runs. Even a catch in all three leaves real doubt, so we say "every run we tried" and claim nothing stronger.
False alarms were counted on healthy runs the alarm settings had never seen.
Inside a real federation
A harness proves the method. The next question is whether it drops into the software people actually run. We packaged it as a plug-in for Flower, an open-source federated learning framework, and ran it in a live five-node federation.
What crosses the network
Each node sent back 1,000 bytes a round: its answers to the quiz, and nothing else. No raw data and no model internals.
What it caught
One node's sensor was set to blur slowly from round 15. The layer flagged that node seven rounds later, and flagged no healthy node.
What it did about it
With quarantine switched on, the flagged node's updates were left out of the shared model from that same round. It can also just alert an operator, with the evidence attached.
That was one run per setting, on one machine. It shows the plug-in works inside a standard framework. The detection rates above still come from the harness, where every run can be repeated exactly. Both are open source as telltale on GitHub.
Inside NVIDIA FLARE
We then ran the same check inside NVIDIA FLARE, a second open-source framework, using its simulator. That is FLARE's own tool for running a whole federation on one machine. It was 72 runs of ten sites over thirty rounds, with one site's images blurring slowly from round 15.
With every site reporting
The blur was caught in all six fault runs at every level of data difference we tried. False alarms stayed at or under 0.7% of check-ins on healthy runs the alarm settings never saw.
With six of ten sites per round
Frameworks often sample only some sites each round to save time. When the sites' data was similar, detection held and false alarms rose to 2.7%. When it differed, the blur was caught in 4 of 6 runs, and in 1 of 6 where it differed most.
Sampling changes which peers each site is compared against every round, and the healthy noise rises with it. We report the drop instead of hiding it.
FLARE's research index lists this example as an externally maintained project. The tables and methods are in the example's results.
Where this work stands
Every harness result above reproduces exactly from its seeds, and every table regenerates from the stored runs. The work has been submitted to a federal research program, and the next stage is larger fleets, longer runs and more realistic data.
The same standard runs our leakage-auditing work. Details for government and prime contractors are on the capability page.
Common questions
Because the healthy majority outvotes the degrading minority. In a ten-node simulation, fleet-wide accuracy hid all 90 injected faults and never moved more than 0.35 of a percentage point. The damage builds up in the shared model before any aggregate number reacts.
By sending every node the same small fixed probe set and comparing only their answers — against the group and against each node’s own history. Raw data never leaves the node, and the per-round cost is roughly a kilobyte per node.
studio@anchor163.com
// copied