Heterogeneity-Oblivious Poisoning Score

• The paper introduces HOPS, which computes a round-wise spectral anomaly score using LoRA-A singular values to filter out poisoned clients.
• HOPS leverages spectral entropy and the top-5 energy ratio to differentiate benign heterogeneity from malicious behavior.
• The metric is architecture-agnostic and robust across diverse federated learning settings, ensuring effective client filtering in non-IID environments.

Searching arXiv for the cited papers and related work on poisoning under heterogeneity, federated learning, and poisoning susceptibility. A heterogeneity-oblivious poisoning score is a scalar criterion intended to quantify poisoning risk or detect poisoned participation without relying on semantic subgroup descriptors, raw parameter-space proximity, or assumptions that benign actors must look mutually similar. In current usage, the term is explicit in Horus, where the Heterogeneity-Oblivious Poisoning Score (HOPS) is a round-wise per-client spectral anomaly score computed from LoRA-A singular values and used to filter poisoned clients before aggregation (Zhang et al., 5 Aug 2025). More broadly, the literature contains several score-like constructions with related aims—subpopulation vulnerability measures, temporal inconsistency scores, data-oblivious attack criteria, and topology-independent contamination surrogates—but these are typically learner-relative, attack-relative, or approximate rather than universal (Rose et al., 2023).

1. Concept and scope

The core problem addressed by heterogeneity-oblivious scoring is that benign heterogeneity can resemble adversarial behavior. In federated learning, clients may differ in data distributions, communication conditions, and model architectures; under such hyper-heterogeneity, detectors based on raw parameter distances, coordinate-wise comparisons, or direct clustering in update space can confuse heterogeneity-induced drift with malicious behavior (Zhang et al., 5 Aug 2025). In centralized poisoning, analogous issues arise when subpopulation susceptibility depends on its relative position in the full training distribution rather than on semantic metadata such as race, sex, or occupation (Rose et al., 2023).

The phrase therefore has two closely related meanings. In the narrow sense, it denotes a concrete detector that remains comparable across heterogeneous clients or models. In the broader sense, it denotes a vulnerability measure that abstracts away from manually specified heterogeneity categories and instead depends on learner-relative or distribution-relative quantities.

Work	Score-like quantity	Relation to heterogeneity
Horus (Zhang et al., 5 Aug 2025)	HOPS from LoRA-A singular values	Architecture-agnostic, per-client, round-wise anomaly score
Subpopulation poisoning (Rose et al., 2023)	Minimum observed model loss difference	Avoids semantic subgroup descriptors but remains learner-relative
TESSERACT (Sharma et al., 2021)	Flip-score	Temporal inconsistency score, less dependent on client-client similarity
Data-oblivious LASSO poisoning (Deng et al., 2020)	Success probability over $S \sim D^n$	Oblivious to realized sample heterogeneity
Weighted mean under label poisoning (Peng et al., 6 Jan 2026)	$\delta$ or $\delta^2 A^2$ as inferred surrogate	Topology-independent asymptotic poisoning term

This comparison suggests that “heterogeneity-oblivious” is not a single formal property shared by all poisoning work. Rather, it names a design goal: preserve discriminatory power when benign variability is large.

2. Explicit formulation in Horus

Horus defines the term directly in a federated learning framework centered on low-rank adaptations. Each adapted layer is written as

$W' = W + \Delta W,\qquad \Delta W = BA,$

with

$$A \in \mathbb{R}^{r \times d_{\text{in}}},\qquad B \in \mathbb{R}^{d_{\text{out}} \times r},\qquad r \ll \min(d_{\text{in}}, d_{\text{out}}).$$

Here $A$ is LoRA-A and $B$ is LoRA-B; LoRA-A is the input projection and LoRA-B the output projection (Zhang et al., 5 Aug 2025).

The score is motivated by two empirical findings. First, among layers, the feature-first layer and the classifier are more stable than middle layers, so Horus only inserts and aggregates LoRA in those stable layers. Second, LoRA-A is substantially more stable than LoRA-B under both heterogeneity and poisoning. In the classifier, LoRA-A’s top-5 singular value energy ratio is reported as always remaining above 90%, with poisoned clients consistently below benign ones, whereas LoRA-B is more volatile and prone to false positives (Zhang et al., 5 Aug 2025).

For a client with LoRA-A singular values $\sigma_1,\dots,\sigma_r$, Horus constructs two spectral indicators. The normalized singular-value energy is

$$\tilde{\sigma}_i = \frac{\sigma_i}{\sum_{j=1}^{r}\sigma_j},$$

and the spectral entropy is

$$\mathcal{H} = -\sum_{i=1}^{r} \tilde{\sigma}_i \log \tilde{\sigma}_i.$$

The Top-$\delta$0 energy ratio is

$\delta$1

with $\delta$2 in the experiments (Zhang et al., 5 Aug 2025).

HOPS combines these indicators through absolute deviation from round-wise reference statistics:

$\delta$3

where $\delta$4 is the round-wise mean of $\delta$5 across clients, and $\delta$6 are the round-wise mean and standard deviation of entropy (Zhang et al., 5 Aug 2025).

The intended invariance comes from the fact that HOPS uses only the singular values of LoRA-A. Because these are spectral statistics rather than raw coordinates, the score is described as comparable even when clients have different layer dimensions or different model families (Zhang et al., 5 Aug 2025).

3. Operational role in federated optimization

HOPS is not an aggregation weight; it is a hard filtering stage. At round $\delta$7, the server computes $\delta$8 for each participating client, sets an adaptive threshold

$\delta$9

with $\delta^2 A^2$0, and excludes any client satisfying

$\delta^2 A^2$1

Only the remaining clients proceed to aggregation (Zhang et al., 5 Aug 2025).

After filtering, Horus performs projection-aware aggregation. Because clients may still have different layer dimensions, LoRA matrices are first aligned by zero-padding and masks, then reweighted by consistency with previous global dominant directions. The projection-consistency weights are

$\delta^2 A^2$2

and these enter a masked weighted average of padded $\delta^2 A^2$3 and $\delta^2 A^2$4 (Zhang et al., 5 Aug 2025).

This separation is structurally important. HOPS decides who remains; projection-aware aggregation decides how much each survivor contributes. The paper does not define HOPS on full-model updates, does not use LoRA-B for detection, and does not provide a mathematically specified multi-layer fusion rule for HOPS itself if more than one stable layer is used (Zhang et al., 5 Aug 2025).

4. Related score-like formulations in poisoning research

Outside Horus, the nearest analogue to a general poisoning-susceptibility score appears in subpopulation-targeted data poisoning. In a binary linear-SVM setting with hinge loss, poisoning difficulty is defined as the minimum poisoning fraction needed to force the poisoned model to predict a target label on at least an $\delta^2 A^2$5-fraction of a target subpopulation $\delta^2 A^2$6, with $\delta^2 A^2$7 in the experiments:

$\delta^2 A^2$8

for the smallest successful poison set (Rose et al., 2023). The paper’s strongest predictive quantity is the minimum clean-data loss gap between the clean model $\delta^2 A^2$9 and any model that achieves the subpopulation misclassification objective:

$W' = W + \Delta W,\qquad \Delta W = BA,$0

Empirically, a subpopulation is much easier to attack if this loss difference is small (Rose et al., 2023). The measure is partly heterogeneity-oblivious because it does not depend on semantic subgroup labels, yet it is not fully oblivious because it depends on the chosen learner, loss, subpopulation, success threshold, and target-model search procedure.

In federated learning, TESSERACT offers a different score-like construction. Its flip-score is

$W' = W + \Delta W,\qquad \Delta W = BA,$1

where $W' = W + \Delta W,\qquad \Delta W = BA,$2 is the sign of the previous global update direction (Sharma et al., 2021). This is a temporal sign-consistency statistic rather than a similarity-to-majority score. The paper argues that this makes TESSERACT more heterogeneity-oblivious than pairwise-similarity or center-based defenses, but it also states that the method relies on benign clients largely tracking the previous global direction under small learning rate and one local step; the score is therefore better described as heterogeneity-tolerant under mild drift than fully oblivious (Sharma et al., 2021).

A stricter theoretical analogue appears in the separation between data-oblivious and data-aware poisoning for LASSO feature selection. There, the natural oblivious score-like quantity is the success probability of a fixed poison set over the draw of the clean sample,

$W' = W + \Delta W,\qquad \Delta W = BA,$3

or the instability probability of a coordinate under $W' = W + \Delta W,\qquad \Delta W = BA,$4 (Deng et al., 2020). The separation theorem shows that full-information adversaries can be provably stronger than attackers restricted to such distribution-level, realized-sample-oblivious criteria.

Other work reaches similar conclusions by different routes. SmartFL does not define an explicit poisoning score, but its optimized aggregation coefficients $W' = W + \Delta W,\qquad \Delta W = BA,$5 act as an implicit client trust signal because they are learned from clean proxy-data performance rather than from update geometry (Xie et al., 2022). Conversely, targeted data poisoning work argues that global summaries are too coarse by introducing Ergodic Prediction Accuracy, poisoning distance $W' = W + \Delta W,\qquad \Delta W = BA,$6, and poison budget lower bound $W' = W + \Delta W,\qquad \Delta W = BA,$7 as instance-level and poison-class-specific predictors of targeted attack difficulty (Xu et al., 8 Sep 2025).

5. Empirical behavior across heterogeneity regimes

Horus reports three main lines of evidence for HOPS. Spectral analysis shows that feature-first and classifier layers are more stable than middle layers, and that LoRA-A is more stable than LoRA-B. In the detection ablation under Fang attack on CIFAR-10, Horus (A-only detection) achieves 48.37% global accuracy and 70.98% local accuracy, compared with 37.60% global and 63.35% local for LoRA-B-only detection, and 39.77% global and 65.71% local for A+B detection. Across 54 dataset/attack/$W' = W + \Delta W,\qquad \Delta W = BA,$8 settings, Horus is best in 49 and second-best in the rest. The score-level hyperparameter $W' = W + \Delta W,\qquad \Delta W = BA,$9 is attack-dependent: $$A \in \mathbb{R}^{r \times d_{\text{in}}},\qquad B \in \mathbb{R}^{d_{\text{out}} \times r},\qquad r \ll \min(d_{\text{in}}, d_{\text{out}}).$$0 is reported as best for directional attacks, while $$A \in \mathbb{R}^{r \times d_{\text{in}}},\qquad B \in \mathbb{R}^{d_{\text{out}} \times r},\qquad r \ll \min(d_{\text{in}}, d_{\text{out}}).$$1 works better for dispersive attacks (Zhang et al., 5 Aug 2025).

The subpopulation-targeted poisoning study shows a different hierarchy of effects. At the dataset level, class separation and label noise dominate: lower separation or higher noise makes most subpopulations easy to poison, while well-separated datasets exhibit much more within-dataset variation. Within and especially across well-separated datasets, the minimum observed model loss difference is the only tested subgroup-level factor with strong correlation to empirically observed susceptibility; clean accuracy on the subgroup, clean loss on the subgroup, and subgroup size do not have significant standalone correlation (Rose et al., 2023).

In decentralized learning under label poisoning, the weighted mean admits an asymptotic learning error

$$A \in \mathbb{R}^{r \times d_{\text{in}}},\qquad B \in \mathbb{R}^{d_{\text{out}} \times r},\qquad r \ll \min(d_{\text{in}}, d_{\text{out}}).$$2

which depends on the global contamination rate $$A \in \mathbb{R}^{r \times d_{\text{in}}},\qquad B \in \mathbb{R}^{d_{\text{out}} \times r},\qquad r \ll \min(d_{\text{in}}, d_{\text{out}}).$$3 and poisoned-gradient disturbance $$A \in \mathbb{R}^{r \times d_{\text{in}}},\qquad B \in \mathbb{R}^{d_{\text{out}} \times r},\qquad r \ll \min(d_{\text{in}}, d_{\text{out}}).$$4, but not on the regular-subgraph topology terms that appear in robust decentralized aggregators. Under sufficiently high heterogeneity, with $$A \in \mathbb{R}^{r \times d_{\text{in}}},\qquad B \in \mathbb{R}^{d_{\text{out}} \times r},\qquad r \ll \min(d_{\text{in}}, d_{\text{out}}).$$5, the paper summarizes the tight comparison as

$$A \in \mathbb{R}^{r \times d_{\text{in}}},\qquad B \in \mathbb{R}^{d_{\text{out}} \times r},\qquad r \ll \min(d_{\text{in}}, d_{\text{out}}).$$6

making $$A \in \mathbb{R}^{r \times d_{\text{in}}},\qquad B \in \mathbb{R}^{d_{\text{out}} \times r},\qquad r \ll \min(d_{\text{in}}, d_{\text{out}}).$$7 or $$A \in \mathbb{R}^{r \times d_{\text{in}}},\qquad B \in \mathbb{R}^{d_{\text{out}} \times r},\qquad r \ll \min(d_{\text{in}}, d_{\text{out}}).$$8 the natural topology-independent scalar candidate (Peng et al., 6 Jan 2026).

Benchmark evidence in federated learning reinforces the central difficulty. The FLPoison SoK defines composite metrics such as TAI and TDR, but also reports that, for both model poisoning and data poisoning, defenses generally perform better under IID than under non-IID conditions; it concludes that the non-IID situation is “less promising,” with almost no robust defense methods available for either attack family (Zhang et al., 6 Feb 2025). This suggests that any operational poisoning score in heterogeneous FL should be benchmark-adjusted against clean performance in the same heterogeneity regime rather than interpreted in isolation.

6. Limitations and unresolved questions

No existing formulation is fully universal. In Horus, HOPS depends on the empirical claim that LoRA-A in selected stable layers remains stable across benign heterogeneous clients; it is round-wise rather than temporal, its optimal $$A \in \mathbb{R}^{r \times d_{\text{in}}},\qquad B \in \mathbb{R}^{d_{\text{out}} \times r},\qquad r \ll \min(d_{\text{in}}, d_{\text{out}}).$$9 is attack-dependent, and it may miss attacks that preserve the same singular-value summaries. The paper also notes that the notation for Eq. (HOPS) is partially corrupted and does not fully specify multi-layer fusion if more than one LoRA-A matrix contributes to a client score (Zhang et al., 5 Aug 2025).

In subpopulation-targeted poisoning, the loss-gap score is only approximated through generated target models, not solved exactly; all experiments use linear SVMs with hinge loss; low-separability datasets are dominated by global distributional properties; and the quantity is not a fast ex ante estimator because it requires nontrivial target-model search (Rose et al., 2023). TESSERACT has analogous scope limits: synchronous training, no gradient encryption, one local iteration in experiments, small learning rate, and knowledge of $A$0 (Sharma et al., 2021).

The deeper theoretical obstacle is that heterogeneity often matters precisely through realized finite-sample structure. The separation between data-oblivious and data-aware poisoning proves that a strategy depending only on the distribution $A$1 can be fundamentally weaker than one that conditions on the realized sample (Deng et al., 2020). Instance-level targeted poisoning work reaches a similar empirical conclusion: average attack success rates hide substantial variation across target samples and poison classes, so coarse global scores can be misleading (Xu et al., 8 Sep 2025).

A plausible implication is that a fully general heterogeneity-oblivious poisoning score is unlikely to be both attack-agnostic and information-lossless. The literature instead supports a family of score constructions tied to distinct operational goals: client filtering in hyper-heterogeneous federated learning, learner-relative subpopulation vulnerability estimation, temporal anomaly detection, and topology-independent contamination assessment.