---
title: Heterogeneity-Oblivious Poisoning Score
url: https://www.emergentmind.com/topics/heterogeneity-oblivious-poisoning-score
type: topic
---

# Heterogeneity-Oblivious Poisoning Score

Searching arXiv for the cited papers and related work on poisoning under heterogeneity, federated learning, and poisoning susceptibility.
A heterogeneity-oblivious poisoning score is a scalar criterion intended to quantify poisoning risk or detect poisoned participation without relying on semantic subgroup descriptors, raw parameter-space proximity, or assumptions that benign actors must look mutually similar. In current usage, the term is explicit in Horus, where the **Heterogeneity-Oblivious Poisoning Score (HOPS)** is a round-wise per-client spectral anomaly score computed from LoRA-A singular values and used to filter poisoned clients before aggregation [2508.03579]. More broadly, the literature contains several score-like constructions with related aims—subpopulation vulnerability measures, temporal inconsistency scores, data-oblivious attack criteria, and topology-independent contamination surrogates—but these are typically learner-relative, attack-relative, or approximate rather than universal [2311.11544].

## 1. Concept and scope

The core problem addressed by heterogeneity-oblivious scoring is that benign heterogeneity can resemble adversarial behavior. In federated learning, clients may differ in data distributions, communication conditions, and model architectures; under such **hyper-heterogeneity**, detectors based on raw parameter distances, coordinate-wise comparisons, or direct clustering in update space can confuse heterogeneity-induced drift with malicious behavior [2508.03579]. In centralized poisoning, analogous issues arise when subpopulation susceptibility depends on its relative position in the full training distribution rather than on semantic metadata such as race, sex, or occupation [2311.11544].

The phrase therefore has two closely related meanings. In the narrow sense, it denotes a concrete detector that remains comparable across heterogeneous clients or models. In the broader sense, it denotes a vulnerability measure that abstracts away from manually specified heterogeneity categories and instead depends on learner-relative or distribution-relative quantities.

| Work | Score-like quantity | Relation to heterogeneity |
|---|---|---|
| Horus [2508.03579] | HOPS from LoRA-A singular values | Architecture-agnostic, per-client, round-wise anomaly score |
| Subpopulation poisoning [2311.11544] | Minimum observed model loss difference | Avoids semantic subgroup descriptors but remains learner-relative |
| TESSERACT [2110.10108] | Flip-score | Temporal inconsistency score, less dependent on client-client similarity |
| Data-oblivious LASSO poisoning [2003.12020] | Success probability over \(S \sim D^n\) | Oblivious to realized sample heterogeneity |
| Weighted mean under label poisoning [2601.02682] | \(\delta\) or \(\delta^2 A^2\) as inferred surrogate | Topology-independent asymptotic poisoning term |

This comparison suggests that “heterogeneity-oblivious” is not a single formal property shared by all poisoning work. Rather, it names a design goal: preserve discriminatory power when benign variability is large.

## 2. Explicit formulation in Horus

Horus defines the term directly in a federated learning framework centered on low-rank adaptations. Each adapted layer is written as
$$
W' = W + \Delta W,\qquad \Delta W = BA,
$$
with
$$
A \in \mathbb{R}^{r \times d_{\text{in}}},\qquad B \in \mathbb{R}^{d_{\text{out}} \times r},\qquad r \ll \min(d_{\text{in}}, d_{\text{out}}).
$$
Here \(A\) is **LoRA-A** and \(B\) is **LoRA-B**; LoRA-A is the input projection and LoRA-B the output projection [2508.03579].

The score is motivated by two empirical findings. First, among layers, the **feature-first** layer and the **classifier** are more stable than middle layers, so Horus only inserts and aggregates LoRA in those stable layers. Second, **LoRA-A is substantially more stable than LoRA-B under both heterogeneity and poisoning**. In the classifier, LoRA-A’s top-5 singular value energy ratio is reported as always remaining above 90%, with poisoned clients consistently below benign ones, whereas LoRA-B is more volatile and prone to false positives [2508.03579].

For a client with LoRA-A singular values \(\sigma_1,\dots,\sigma_r\), Horus constructs two spectral indicators. The normalized singular-value energy is
$$
\tilde{\sigma}_i = \frac{\sigma_i}{\sum_{j=1}^{r}\sigma_j},
$$
and the **spectral entropy** is
$$
\mathcal{H} = -\sum_{i=1}^{r} \tilde{\sigma}_i \log \tilde{\sigma}_i.
$$
The **Top-\(k\) energy ratio** is
$$
\mathcal{R}_k = \frac{\sum_{i=1}^k \sigma_i}{\sum_{j=1}^r \sigma_j},
$$
with \(k=5\) in the experiments [2508.03579].

HOPS combines these indicators through absolute deviation from round-wise reference statistics:
$$
S_c = \lambda \left| (1-\mathcal{R}_k)-\mu_{\mathcal R} \right| + (1-\lambda)\left| \frac{\mathcal H-\mu_{\mathcal H}}{\sigma_{\mathcal H}} \right|,
$$
where \(\mu_{\mathcal R}\) is the round-wise mean of \(1-\mathcal{R}_k\) across clients, and \(\mu_{\mathcal H}, \sigma_{\mathcal H}\) are the round-wise mean and standard deviation of entropy [2508.03579].

The intended invariance comes from the fact that HOPS uses only the singular values of LoRA-A. Because these are spectral statistics rather than raw coordinates, the score is described as comparable even when clients have different layer dimensions or different model families [2508.03579].

## 3. Operational role in federated optimization

HOPS is not an aggregation weight; it is a **hard filtering stage**. At round \(t\), the server computes \(S_{c,t}\) for each participating client, sets an adaptive threshold
$$
\theta_t = \mathrm{Percentile}_p\big(\{S_{c,t}\}_{c}\big),
$$
with \(p=95\), and excludes any client satisfying
$$
S_{c,t} > \theta_t.
$$
Only the remaining clients proceed to aggregation [2508.03579].

After filtering, Horus performs **projection-aware aggregation**. Because clients may still have different layer dimensions, LoRA matrices are first aligned by zero-padding and masks, then reweighted by consistency with previous global dominant directions. The projection-consistency weights are
$$
\alpha_c^A = \big|\langle v_c^{A,(1)}, v_g^{A,(1)} \rangle\big|,\qquad
\alpha_c^B = \big|\langle v_c^{B,(1)}, v_g^{B,(1)} \rangle\big|,
$$
and these enter a masked weighted average of padded \(\tilde A_c\) and \(\tilde B_c\) [2508.03579].

This separation is structurally important. HOPS decides **who remains**; projection-aware aggregation decides **how much each survivor contributes**. The paper does not define HOPS on full-model updates, does not use LoRA-B for detection, and does not provide a mathematically specified multi-layer fusion rule for HOPS itself if more than one stable layer is used [2508.03579].

## 4. Related score-like formulations in poisoning research

Outside Horus, the nearest analogue to a general poisoning-susceptibility score appears in subpopulation-targeted data poisoning. In a binary linear-SVM setting with hinge loss, poisoning difficulty is defined as the minimum poisoning fraction needed to force the poisoned model to predict a target label on at least an \(r\)-fraction of a target subpopulation \(P\), with \(r=50\%\) in the experiments:
$$
\text{difficulty}(P)=\frac{|S_p|}{|S_c|}
$$
for the smallest successful poison set [2311.11544]. The paper’s strongest predictive quantity is the minimum clean-data loss gap between the clean model \(h_c\) and any model that achieves the subpopulation misclassification objective:
$$
\Delta_{\mathrm{loss}^*}(P) = \min_{h:\,\operatorname{err}_P(h)\ge r}\Big(L(h;S_c)-L(h_c;S_c)\Big).
$$
Empirically, a subpopulation is much easier to attack if this loss difference is small [2311.11544]. The measure is partly heterogeneity-oblivious because it does not depend on semantic subgroup labels, yet it is not fully oblivious because it depends on the chosen learner, loss, subpopulation, success threshold, and target-model search procedure.

In federated learning, TESSERACT offers a different score-like construction. Its flip-score is
$$
FS_{i}(t+1) = \sum_{j=0}^{|P|-1}{(\nabla LM_{i}(t+1,j))}^{2}\,\mathbf{1}\{\operatorname{sign}(\nabla LM_i(t+1,j)) \neq s_{g}(t,j)\},
$$
where \(s_g(t,\cdot)\) is the sign of the previous global update direction [2110.10108]. This is a temporal sign-consistency statistic rather than a similarity-to-majority score. The paper argues that this makes TESSERACT more heterogeneity-oblivious than pairwise-similarity or center-based defenses, but it also states that the method relies on benign clients largely tracking the previous global direction under small learning rate and one local step; the score is therefore better described as heterogeneity-tolerant under mild drift than fully oblivious [2110.10108].

A stricter theoretical analogue appears in the separation between **data-oblivious** and **data-aware** poisoning for LASSO feature selection. There, the natural oblivious score-like quantity is the success probability of a fixed poison set over the draw of the clean sample,
$$
\Pr_{S \leftarrow D^n}\!\left[\mathrm{Supp}(\mathrm{Lasso}(S \cup S')) \neq \mathrm{Supp}(\mathrm{Lasso}(S))\right],
$$
or the instability probability of a coordinate under \(S \sim D^n\) [2003.12020]. The separation theorem shows that full-information adversaries can be provably stronger than attackers restricted to such distribution-level, realized-sample-oblivious criteria.

Other work reaches similar conclusions by different routes. SmartFL does not define an explicit poisoning score, but its optimized aggregation coefficients \(p_m^t\) act as an implicit client trust signal because they are learned from clean proxy-data performance rather than from update geometry [2211.05554]. Conversely, targeted data poisoning work argues that global summaries are too coarse by introducing **Ergodic Prediction Accuracy**, poisoning distance \(\delta\), and poison budget lower bound \(\tau\) as instance-level and poison-class-specific predictors of targeted attack difficulty [2509.06896].

## 5. Empirical behavior across heterogeneity regimes

Horus reports three main lines of evidence for HOPS. Spectral analysis shows that feature-first and classifier layers are more stable than middle layers, and that LoRA-A is more stable than LoRA-B. In the detection ablation under Fang attack on CIFAR-10, **Horus (A-only detection)** achieves **48.37% global accuracy** and **70.98% local accuracy**, compared with **37.60% global** and **63.35% local** for **LoRA-B-only detection**, and **39.77% global** and **65.71% local** for **A+B detection**. Across 54 dataset/attack/\(\alpha\) settings, Horus is best in 49 and second-best in the rest. The score-level hyperparameter \(\lambda\) is attack-dependent: \(\lambda=0.7\) is reported as best for directional attacks, while \(\lambda=0.3\) works better for dispersive attacks [2508.03579].

The subpopulation-targeted poisoning study shows a different hierarchy of effects. At the dataset level, class separation and label noise dominate: lower separation or higher noise makes most subpopulations easy to poison, while well-separated datasets exhibit much more within-dataset variation. Within and especially across well-separated datasets, the minimum observed model loss difference is the only tested subgroup-level factor with strong correlation to empirically observed susceptibility; clean accuracy on the subgroup, clean loss on the subgroup, and subgroup size do not have significant standalone correlation [2311.11544].

In decentralized learning under label poisoning, the weighted mean admits an asymptotic learning error
$$
O(\delta^2 A^2),
$$
which depends on the **global contamination rate** \(\delta\) and poisoned-gradient disturbance \(A\), but not on the regular-subgraph topology terms that appear in robust decentralized aggregators. Under sufficiently high heterogeneity, with \(A=\Theta(\xi)\), the paper summarizes the tight comparison as
$$
\text{WeiMean}: \Theta(\delta^2 \xi^2), \qquad \text{RAgg}: \Theta(\delta_{\max}^2 \xi^2),
$$
making \(\delta\) or \(\delta^2\) the natural topology-independent scalar candidate [2601.02682].

Benchmark evidence in federated learning reinforces the central difficulty. The FLPoison SoK defines composite metrics such as **TAI** and **TDR**, but also reports that, for both model poisoning and data poisoning, defenses generally perform better under IID than under non-IID conditions; it concludes that the non-IID situation is “less promising,” with almost no robust defense methods available for either attack family [2502.03801]. This suggests that any operational poisoning score in heterogeneous FL should be benchmark-adjusted against clean performance in the same heterogeneity regime rather than interpreted in isolation.

## 6. Limitations and unresolved questions

No existing formulation is fully universal. In Horus, HOPS depends on the empirical claim that LoRA-A in selected stable layers remains stable across benign heterogeneous clients; it is round-wise rather than temporal, its optimal \(\lambda\) is attack-dependent, and it may miss attacks that preserve the same singular-value summaries. The paper also notes that the notation for Eq. (HOPS) is partially corrupted and does not fully specify multi-layer fusion if more than one LoRA-A matrix contributes to a client score [2508.03579].

In subpopulation-targeted poisoning, the loss-gap score is only approximated through generated target models, not solved exactly; all experiments use linear SVMs with hinge loss; low-separability datasets are dominated by global distributional properties; and the quantity is not a fast ex ante estimator because it requires nontrivial target-model search [2311.11544]. TESSERACT has analogous scope limits: synchronous training, no gradient encryption, one local iteration in experiments, small learning rate, and knowledge of \(c_{\max}\) [2110.10108].

The deeper theoretical obstacle is that heterogeneity often matters precisely through realized finite-sample structure. The separation between data-oblivious and data-aware poisoning proves that a strategy depending only on the distribution \(D\) can be fundamentally weaker than one that conditions on the realized sample [2003.12020]. Instance-level targeted poisoning work reaches a similar empirical conclusion: average attack success rates hide substantial variation across target samples and poison classes, so coarse global scores can be misleading [2509.06896].

A plausible implication is that a fully general heterogeneity-oblivious poisoning score is unlikely to be both attack-agnostic and information-lossless. The literature instead supports a family of score constructions tied to distinct operational goals: client filtering in hyper-heterogeneous federated learning, learner-relative subpopulation vulnerability estimation, temporal anomaly detection, and topology-independent contamination assessment.

Source: https://www.emergentmind.com/topics/heterogeneity-oblivious-poisoning-score