Hybrid Reputation Aggregation (HRA)

• Hybrid Reputation Aggregation is a design pattern that fuses multiple trust signals, such as geometric anomaly detection and momentum-based tracking, into a unified approach.
• It is applied in diverse domains including adversarial federated learning, federated healthcare, and online reputation systems to enhance defense against noise and malicious behaviors.
• Experimental evaluations demonstrate that HRA significantly outperforms traditional stateless aggregators by combining reactive anomaly detection with proactive reputation tracking.

Searching arXiv for the specified HRA papers and closely related reputation-aggregation work. Hybrid Reputation Aggregation (HRA) denotes a family of aggregation designs that combine multiple trust or quality signals rather than relying on a single, stateless score. In the supplied literature, the term is used most explicitly for adversarial federated learning in 5G and edge networks, where HRA fuses geometric anomaly detection with momentum-based client reputation tracking (Sheikhi et al., 22 Sep 2025); for federated survival analysis in healthcare, where HRA combines peer-driven reputation, clustering-based noise handling, and a decoupled differential-privacy channel (2505.16190); and for online reputation systems, where HRA couples consumer-profile feature extraction with machine-learning-based reliability prediction and weighted averaging (Alqwadri et al., 2022). Closely related hybrid trust formulations also appear in evidence-based Subjective Logic, which unifies flow-based reputation with explicit uncertainty (Skoric et al., 2014), and in decentralized Kademlia-based voting, which combines two-state votes, HyperLogLog counters, and DHT replication (Evseenko, 2013).

1. Scope and definitional usage

The label “Hybrid Reputation Aggregation” is not attached to a single canonical algorithm across the literature. Instead, it identifies a design pattern in which heterogeneous signals are aggregated jointly. In the 5G and edge federated-learning formulation, the hybridization is spatial and temporal: per-round geometric anomaly filtering is combined with cross-round reputation tracking (Sheikhi et al., 22 Sep 2025). In federated healthcare, the hybridization is architectural and statistical: server–client aggregation with unmodified CoxPH updates is paired with peer-to-peer reputation computation on differentially private updates, and clients are clustered according to the completeness of their feature vectors $B_i$ and their local concordance scores (2505.16190). In online recommendation, the hybridization is predictive and aggregative: user-profile features are transformed into learned reliability weights, which are then used in a weighted-average reputation score (Alqwadri et al., 2022).

Paper	Domain	Hybrid combination
(Sheikhi et al., 22 Sep 2025)	Adversarial FL in 5G and edge networks	Geometric anomaly detection + momentum-based reputation
(2505.16190)	Federated survival analysis in healthcare	Peer-driven feedback + clustering-based noise handling + DP-protected reputation channel
(Alqwadri et al., 2022)	Online reputation systems	Consumer-profile features + ML-predicted reliability + weighted average
(Skoric et al., 2014)	Trust networks	Flow-based reputation + consistent handling of uncertainties
(Evseenko, 2013)	Decentralized P2P voting	Two-state votes + HyperLogLog + Kademlia replication

A recurring source of ambiguity is that “hybrid” does not denote the same combination in each paper. This suggests that HRA is better understood as a class of aggregation strategies than as a single standardized protocol.

2. HRA for adversarial federated learning in 5G and edge networks

In the federated-learning setting, HRA is introduced as “a novel robust aggregation mechanism designed to defend against diverse adversarial behaviors in FL without prior knowledge of the attack type” (Sheikhi et al., 22 Sep 2025). The stated goal is to defend FL against label-flipping, backdoor injection, Sybil collusion, and random-noise Byzantine behavior in 5G and edge networks, while overcoming two limitations attributed to existing robust aggregators: they are “memoryless” and they require an a priori bound $f$ on the number of adversaries.

The geometric component uses Euclidean distance in parameter space. For client $i$ at round $t$, the update is

$$\Delta w_i^{(t)} = w_i^{(t)} - w_{\rm global}^{(t-1)}.$$

A robust reference is computed via the geometric median,

$$\mu^{(t)} = \operatorname{GeomMedian}\bigl\{\Delta w_j^{(t)}\bigr\}_{j=1}^M,$$

and the anomaly score is

$$S_i^{(t)} = \bigl\|\Delta w_i^{(t)} - \mu^{(t)}\bigr\|_2.$$

Two thresholds, $T_{\rm low}^{(t)}$ and $T_{\rm high}^{(t)}$, are set from the empirical distribution of $\{S_j^{(t)}\}$, for example through percentiles $f$0 and $f$1, with $f$2, exemplified as $f$3 and $f$4 (Sheikhi et al., 22 Sep 2025). The resulting anomaly weight $f$5 equals $f$6 for low-score updates, $f$7 for high-score updates, and decays linearly between the two thresholds.

The reputation component is momentum-based. If $f$8 is client $f$9’s reputation at the start of round $i$0, the update rule is

$i$1

with $i$2, exemplified as $i$3–$i$4. Honest clients typically have small $i$5, hence $i$6, while malicious clients repeatedly producing large outliers incur $i$7, driving $i$8 downward over time. The final hybrid weight is defined as

$i$9

followed by renormalization to sum to one before model aggregation (Sheikhi et al., 22 Sep 2025).

Aggregation is then performed as

$t$0

The full round-level pseudocode consists of local training, server-side computation of $t$1, geometric detection, reputation update, normalization of $t$2, and aggregation of $t$3 and $t$4 (Sheikhi et al., 22 Sep 2025).

The paper positions this mechanism against Krum, Trimmed Mean, and Bulyan. Krum is described as selecting a single update closest to the bulk of updates, Trimmed Mean as discarding fixed fractions of largest and smallest coordinates per round, and Bulyan as building on Multi-Krum with an additional trimmed-mean step. All three are characterized as stateless, and Bulyan also requires $t$5 (Sheikhi et al., 22 Sep 2025). HRA is described instead as attack-agnostic, without requiring $t$6, and as fusing both spatial and temporal information.

3. Experimental behavior in the 5G/edge FL setting

The experimental setup uses two datasets. The proprietary 5G testbed traffic dataset contains 29 features, 1 753 454 training samples, and 194 829 test samples, with a non-IID split across $t$7 clients via Dirichlet($t$8). The NF-CSE-CIC-IDS2018 benchmark uses 10 selected features, 6 713 920 train samples, and 1 678 481 test samples, with the same non-IID partitioning. The attack scenarios are label-flipping, backdoor injection, Sybil collusion, and random-noise Byzantine updates. The evaluation metrics are test accuracy, precision, recall, F1 score, and ROC AUC (Sheikhi et al., 22 Sep 2025).

On the 5G dataset, HRA achieves $t$9 accuracy $$\Delta w_i^{(t)} = w_i^{(t)} - w_{\rm global}^{(t-1)}.$$0, compared with Krum at $$\Delta w_i^{(t)} = w_i^{(t)} - w_{\rm global}^{(t-1)}.$$1, Trimmed Mean at $$\Delta w_i^{(t)} = w_i^{(t)} - w_{\rm global}^{(t-1)}.$$2, and Bulyan at $$\Delta w_i^{(t)} = w_i^{(t)} - w_{\rm global}^{(t-1)}.$$3. On NF-CSE-CIC-IDS2018, HRA achieves $$\Delta w_i^{(t)} = w_i^{(t)} - w_{\rm global}^{(t-1)}.$$4 $$\Delta w_i^{(t)} = w_i^{(t)} - w_{\rm global}^{(t-1)}.$$5, compared with Krum at $$\Delta w_i^{(t)} = w_i^{(t)} - w_{\rm global}^{(t-1)}.$$6, Trimmed Mean at $$\Delta w_i^{(t)} = w_i^{(t)} - w_{\rm global}^{(t-1)}.$$7, and Bulyan at $$\Delta w_i^{(t)} = w_i^{(t)} - w_{\rm global}^{(t-1)}.$$8 (Sheikhi et al., 22 Sep 2025). The paper states that these margins are significant.

The ablation study isolates the contribution of the two mechanisms. The anomaly-only variant (“no reputation”) yields $$\Delta w_i^{(t)} = w_i^{(t)} - w_{\rm global}^{(t-1)}.$$9 on 5G, a drop of $$\mu^{(t)} = \operatorname{GeomMedian}\bigl\{\Delta w_j^{(t)}\bigr\}_{j=1}^M,$$0 percentage points, and the reputation-only variant (“no anomaly”) yields $$\mu^{(t)} = \operatorname{GeomMedian}\bigl\{\Delta w_j^{(t)}\bigr\}_{j=1}^M,$$1, a drop of $$\mu^{(t)} = \operatorname{GeomMedian}\bigl\{\Delta w_j^{(t)}\bigr\}_{j=1}^M,$$2 percentage points. The accompanying interpretation is explicit: instantaneous anomaly detection alone misses stealthy, well-camouflaged attacks; reputation alone is blind to first-round attacks until history accumulates; their combination yields both reactive and proactive defense (Sheikhi et al., 22 Sep 2025).

The sensitivity analysis is equally specific. For moderate threshold settings with $$\mu^{(t)} = \operatorname{GeomMedian}\bigl\{\Delta w_j^{(t)}\bigr\}_{j=1}^M,$$3, accuracy remains $$\mu^{(t)} = \operatorname{GeomMedian}\bigl\{\Delta w_j^{(t)}\bigr\}_{j=1}^M,$$4 on 5G. If $$\mu^{(t)} = \operatorname{GeomMedian}\bigl\{\Delta w_j^{(t)}\bigr\}_{j=1}^M,$$5 is set too large, exemplified as $$\mu^{(t)} = \operatorname{GeomMedian}\bigl\{\Delta w_j^{(t)}\bigr\}_{j=1}^M,$$6, accuracy drops by at least $$\mu^{(t)} = \operatorname{GeomMedian}\bigl\{\Delta w_j^{(t)}\bigr\}_{j=1}^M,$$7 percentage points. Learning-rate sensitivity is reported as stable within $$\mu^{(t)} = \operatorname{GeomMedian}\bigl\{\Delta w_j^{(t)}\bigr\}_{j=1}^M,$$8 with $$\mu^{(t)} = \operatorname{GeomMedian}\bigl\{\Delta w_j^{(t)}\bigr\}_{j=1}^M,$$9 percentage points. The theoretical remarks are deliberately limited: HRA does not require a known bound $$S_i^{(t)} = \bigl\|\Delta w_i^{(t)} - \mu^{(t)}\bigr\|_2.$$0; it is empirically robust as long as the malicious proportion is $$S_i^{(t)} = \bigl\|\Delta w_i^{(t)} - \mu^{(t)}\bigr\|_2.$$1 and anomalies yield larger distances; and no closed-form breakdown point is derived (Sheikhi et al., 22 Sep 2025). This directly constrains overly strong interpretations of the method’s guarantees.

4. Federated healthcare HRA: peer-driven reputation, clustering, and privacy decoupling

A distinct HRA framework is proposed for federated survival analysis with Cox proportional hazards models. Its architecture contains two parallel communication channels: a server–client channel for global model aggregation using unmodified CoxPH updates, and a peer-to-peer channel for reputation computation using DP-protected updates (2505.16190). At each round, clients first cluster themselves according to the completeness of their feature vectors $$S_i^{(t)} = \bigl\|\Delta w_i^{(t)} - \mu^{(t)}\bigr\|_2.$$2 and their local concordance scores, forming a group $$S_i^{(t)} = \bigl\|\Delta w_i^{(t)} - \mu^{(t)}\bigr\|_2.$$3. Each client then trains a local CoxPH model and produces coefficient update $$S_i^{(t)} = \bigl\|\Delta w_i^{(t)} - \mu^{(t)}\bigr\|_2.$$4.

For the peer-feedback path, $$S_i^{(t)} = \bigl\|\Delta w_i^{(t)} - \mu^{(t)}\bigr\|_2.$$5 is clipped to norm $$S_i^{(t)} = \bigl\|\Delta w_i^{(t)} - \mu^{(t)}\bigr\|_2.$$6 and perturbed by a Gaussian mechanism: $$S_i^{(t)} = \bigl\|\Delta w_i^{(t)} - \mu^{(t)}\bigr\|_2.$$7 with

$$S_i^{(t)} = \bigl\|\Delta w_i^{(t)} - \mu^{(t)}\bigr\|_2.$$8

satisfying $$S_i^{(t)} = \bigl\|\Delta w_i^{(t)} - \mu^{(t)}\bigr\|_2.$$9-DP (2505.16190). Peers exchange these DP-protected $T_{\rm low}^{(t)}$0 and compute concordance-index improvements

$T_{\rm low}^{(t)}$1

which are then used to update pairwise reputations: $T_{\rm low}^{(t)}$2 This update makes feedback from highly trusted peers $T_{\rm low}^{(t)}$3 carry more weight.

In parallel, the unmodified updates $T_{\rm low}^{(t)}$4 are sent to the server, which performs clustered reputation-weighted aggregation. Within cluster $T_{\rm low}^{(t)}$5, the selection probability is

$T_{\rm low}^{(t)}$6

and the update is

$T_{\rm low}^{(t)}$7

The paper emphasizes that the DP step affects only the reputation channel, not the aggregation channel, so sensitive coefficients are not exposed in clear text to peers while the server still receives unaltered updates for model training (2505.16190).

The experiments cover synthetic data with 10 centers and $T_{\rm low}^{(t)}$8 patients each, with varying missingness $T_{\rm low}^{(t)}$9, noise $T_{\rm high}^{(t)}$0, and censoring $T_{\rm high}^{(t)}$1, as well as real SEER breast-cancer data with 10 states as nodes. Over 10 rounds, the reported global C-index values are $T_{\rm high}^{(t)}$2 at round 1, $T_{\rm high}^{(t)}$3 at round 2, $T_{\rm high}^{(t)}$4 at round 7, and $T_{\rm high}^{(t)}$5 at round 10, while the TFFL baseline takes values $T_{\rm high}^{(t)}$6, $T_{\rm high}^{(t)}$7, $T_{\rm high}^{(t)}$8, and $T_{\rm high}^{(t)}$9, respectively, and the no-reputation model takes $\{S_j^{(t)}\}$0, $\{S_j^{(t)}\}$1, $\{S_j^{(t)}\}$2, and $\{S_j^{(t)}\}$3 (2505.16190). State-wise SEER results include KY at $\{S_j^{(t)}\}$4 versus TFFL $\{S_j^{(t)}\}$5 and no-reputation $\{S_j^{(t)}\}$6, LA at $\{S_j^{(t)}\}$7 versus $\{S_j^{(t)}\}$8 and $\{S_j^{(t)}\}$9, CT at $f$00 versus $f$01 and $f$02, and IA at $f$03 versus $f$04 and $f$05. Figure 1 is described as showing that increasing adversarial noise $f$06 drives down malicious nodes’ reputations faster in HRA (2505.16190).

5. HRA in online reputation systems: feature extraction, learned reliability, and weighted averaging

In online reputation systems, HRA is described as replacing naïve mean or median aggregation and single-factor weighted aggregation with “a data-driven weighted average in which each consumer’s contribution is scaled by a reliability weight predicted from her profile” (Alqwadri et al., 2022). The framework has two stages: extraction of per-consumer profile features from the rating log, and training of a regression model $f$07 to predict each consumer’s reliability weight $f$08.

The feature set is fully specified. For each user $f$09, the input vector is

$f$10

where $f$11 is the count of positive ratings $f$12, $f$13 is the count of neutral ratings $f$14, $f$15 is the count of negative ratings $f$16, $f$17, and $f$18 is the fluctuation feature defined in the paper. The target variable is

$f$19

identified in the summary as “Reliability” and used as the training label $f$20. All features are normalized to $f$21 by min–max scaling (Alqwadri et al., 2022).

Four regression algorithms are compared under 10-fold cross-validation with $f$22 train and $f$23 test per fold: Linear Regression with multivariate ordinary least squares and $f$24; Support Vector Regression with RBF kernel and $f$25; K-Nearest Neighbors Regression with $f$26, Euclidean distance, and uniform weighting; and Regression Tree using CART with Gini-impurity split and default minimum leaf size (Alqwadri et al., 2022). The item reputation is then computed as a weighted average over the active raters $f$27, using the learned weights $f$28.

The evaluation uses MovieLens 100K, 1M, and 10M. The reported dataset sizes are 943 users, 1 682 movies, and 100 000 ratings for 100K; 6 040 users, 3 706 movies, and 1 000 209 ratings for 1M; and 71 567 users, 10 681 movies, and 10 000 054 ratings for 10M. Results are averaged across the 10 folds (Alqwadri et al., 2022).

The main quantitative metric is MAE. For the full HRA pipeline, the MAE values are $f$29, $f$30, and $f$31 for Linear Regression on 100K, 1M, and 10M; $f$32, $f$33, and $f$34 for Regression Tree; $f$35, $f$36, and $f$37 for SVR; and $f$38, $f$39, and $f$40 for KNN (Alqwadri et al., 2022). Baselines on the same splits include Average, Median, BetaDR, Bayesian, Dirichlet, IMDb, Fuzzy, and LQ, with, for example, Average at $f$41, $f$42, and $f$43, and LQ at $f$44, $f$45, and $f$46. Ranked by MAE across all three datasets, the ordering is $f$47 RT, $f$48 LR, $f$49 KNN, $f$50 SVR, followed by Median, BetaDR, Dirichlet, Bayesian, and the remaining baselines (Alqwadri et al., 2022).

The interpretation supplied with the framework is specific. “Fluctuation” down-weights users whose ratings systematically diverge from community averages. “Experience” privileges users who have contributed many ratings. The counts $f$51 capture overall leniency or strictness. Machine learning then combines these aspects in data-driven proportions rather than via manually chosen thresholds or aging rules (Alqwadri et al., 2022). The stated limitations are also precise: cold start for entirely new users, worst-case $f$52 feature computation for fluctuation, and minimal hyperparameter tuning.

6. Related hybrid trust formulations and recurring issues

The broader hybrid reputation literature includes two influential formulations that are not identical to the 2025 HRA mechanisms but clarify the wider methodological space. Evidence-Based Subjective Logic proposes a unification of flow-based reputation and Subjective Logic into a single algebra that is “entirely based on the handling of evidence” (Skoric et al., 2014). Opinions are represented as $f$53 with $f$54, and evidence counts $f$55 are related to opinions through

$f$56

Consensus $f$57 adds evidence, scalar multiplication $f$58 rescales evidence, and the new discounting operator is defined as

$f$59

with $f$60. The key property is right-distributivity,

$f$61

which is used to avoid evidence double-counting in arbitrary trust networks. Indirect referral trust and functional trust are then given by recursive equations for $f$62 and $f$63, and the referral matrix is computed as the fixed point $f$64 by iteration (Skoric et al., 2014). This formulation addresses limitations attributed to classical Subjective Logic discounting, especially the absence of a clear evidence-flow interpretation and the lack of distributivity over consensus.

A different hybrid construction appears in decentralized voting over Kademlia DHTs. The 2013 “new hybrid distributed voting algorithm” combines a two-state positive/negative vote model, HyperLogLog counters for unique voters by IP, and structured replication to the $f$65 nearest DHT nodes for the content key (Evseenko, 2013). Each content item $f$66 stores two counters, $f$67 for positive votes and $f$68 for negative votes, and defines scores

$f$69

Vote announcements are stored in a ring buffer of 24 hourly slots, and retrieval merges replicated HyperLogLog states through the HLL union operator. The paper notes that in BitTorrent Mainline DHT, about $f$70 of all traffic can be vote-packets under a naïve 5-star scheme, that HyperLogLog offers sub-$f$71 error with only a few hundred bytes per counter, and that Kademlia replication with $f$72–$f$73 is known from prior work to converge in $f$74 steps and to be robust under heavy churn (Evseenko, 2013).

Across these formulations, several issues recur. One is the tension between stateless aggregation and persistent trust. Another is the relation between robustness and formal guarantees. In the 5G/edge FL HRA, no closed-form breakdown point is derived (Sheikhi et al., 22 Sep 2025). In the Kademlia voting algorithm, IP-based uniqueness is explicitly identified as imperfect, and there is no fully fleshed-out detection or isolation of malicious replicas (Evseenko, 2013). In the online recommendation HRA, cold start and feature-computation cost remain open practical constraints (Alqwadri et al., 2022). This suggests that “hybrid” aggregation is primarily a strategy for combining complementary signals under realistic system constraints, rather than a universal solution to Sybil resistance, coordinated manipulation, or uncertainty quantification.

A common misconception is to treat all HRA systems as interchangeable because they share a name. The supplied literature does not support that view. In one case HRA is a server-side robust FL aggregator based on Euclidean outlier geometry and exponential smoothing (Sheikhi et al., 22 Sep 2025); in another it is a federated healthcare architecture with peer-derived C-index feedback and a decoupled DP channel (2505.16190); in another it is a supervised learning pipeline over consumer profiles (Alqwadri et al., 2022). The shared element is the decision to aggregate trust, quality, or reliability from more than one source of evidence.