---
title: Hybrid Reputation Aggregation (HRA)
url: https://www.emergentmind.com/topics/hybrid-reputation-aggregation-hra
type: topic
---

# Hybrid Reputation Aggregation (HRA)

Searching arXiv for the specified HRA papers and closely related reputation-aggregation work.
Hybrid Reputation Aggregation (HRA) denotes a family of aggregation designs that combine multiple trust or quality signals rather than relying on a single, stateless score. In the supplied literature, the term is used most explicitly for adversarial federated learning in 5G and edge networks, where HRA fuses geometric anomaly detection with momentum-based client reputation tracking [2509.18044]; for federated survival analysis in healthcare, where HRA combines peer-driven reputation, clustering-based noise handling, and a decoupled differential-privacy channel [2505.16190]; and for online reputation systems, where HRA couples consumer-profile feature extraction with machine-learning-based reliability prediction and weighted averaging [2209.04650]. Closely related hybrid trust formulations also appear in evidence-based Subjective Logic, which unifies flow-based reputation with explicit uncertainty [1402.3319], and in decentralized Kademlia-based voting, which combines two-state votes, HyperLogLog counters, and DHT replication [1305.0711].

## 1. Scope and definitional usage

The label “Hybrid Reputation Aggregation” is not attached to a single canonical algorithm across the literature. Instead, it identifies a design pattern in which heterogeneous signals are aggregated jointly. In the 5G and edge federated-learning formulation, the hybridization is spatial and temporal: per-round geometric anomaly filtering is combined with cross-round reputation tracking [2509.18044]. In federated healthcare, the hybridization is architectural and statistical: server–client aggregation with unmodified CoxPH updates is paired with peer-to-peer reputation computation on differentially private updates, and clients are clustered according to the completeness of their feature vectors \(B_i\) and their local concordance scores [2505.16190]. In online recommendation, the hybridization is predictive and aggregative: user-profile features are transformed into learned reliability weights, which are then used in a weighted-average reputation score [2209.04650].

| Paper | Domain | Hybrid combination |
|---|---|---|
| [2509.18044] | Adversarial FL in 5G and edge networks | Geometric anomaly detection + momentum-based reputation |
| [2505.16190] | Federated survival analysis in healthcare | Peer-driven feedback + clustering-based noise handling + DP-protected reputation channel |
| [2209.04650] | Online reputation systems | Consumer-profile features + ML-predicted reliability + weighted average |
| [1402.3319] | Trust networks | Flow-based reputation + consistent handling of uncertainties |
| [1305.0711] | Decentralized P2P voting | Two-state votes + HyperLogLog + Kademlia replication |

A recurring source of ambiguity is that “hybrid” does not denote the same combination in each paper. This suggests that HRA is better understood as a class of aggregation strategies than as a single standardized protocol.

## 2. HRA for adversarial federated learning in 5G and edge networks

In the federated-learning setting, HRA is introduced as “a novel robust aggregation mechanism designed to defend against diverse adversarial behaviors in FL without prior knowledge of the attack type” [2509.18044]. The stated goal is to defend FL against label-flipping, backdoor injection, Sybil collusion, and random-noise Byzantine behavior in 5G and edge networks, while overcoming two limitations attributed to existing robust aggregators: they are “memoryless” and they require an a priori bound \(f\) on the number of adversaries.

The geometric component uses Euclidean distance in parameter space. For client \(i\) at round \(t\), the update is
\[
\Delta w_i^{(t)} = w_i^{(t)} - w_{\rm global}^{(t-1)}.
\]
A robust reference is computed via the geometric median,
\[
\mu^{(t)} = \operatorname{GeomMedian}\bigl\{\Delta w_j^{(t)}\bigr\}_{j=1}^M,
\]
and the anomaly score is
\[
S_i^{(t)} = \bigl\|\Delta w_i^{(t)} - \mu^{(t)}\bigr\|_2.
\]
Two thresholds, \(T_{\rm low}^{(t)}\) and \(T_{\rm high}^{(t)}\), are set from the empirical distribution of \(\{S_j^{(t)}\}\), for example through percentiles \(\alpha_{\rm low}\) and \(\alpha_{\rm high}\), with \(\alpha_{\rm low}<\alpha_{\rm high}\), exemplified as \(25\%\) and \(75\%\) [2509.18044]. The resulting anomaly weight \(\phi_i^{(t)}\) equals \(1\) for low-score updates, \(0\) for high-score updates, and decays linearly between the two thresholds.

The reputation component is momentum-based. If \(R_i^{(t-1)}\) is client \(i\)’s reputation at the start of round \(t\), the update rule is
\[
R_i^{(t)} = \beta\,R_i^{(t-1)} +(1-\beta)\,\phi_i^{(t)}, \qquad R_i^{(0)} = 1,
\]
with \(\beta\in[0,1]\), exemplified as \(0.8\)–\(0.99\). Honest clients typically have small \(S_i\), hence \(\phi_i\approx1\), while malicious clients repeatedly producing large outliers incur \(\phi_i\ll1\), driving \(R_i\) downward over time. The final hybrid weight is defined as
\[
\alpha_i^{(t)} = R_i^{(t-1)} \times \phi_i^{(t)},
\]
followed by renormalization to sum to one before model aggregation [2509.18044].

Aggregation is then performed as
\[
w_{\rm global}^{(t)} = \sum_{i=1}^M \tilde\alpha_i^{(t)}\,w_i^{(t)}, \qquad
b_{\rm global}^{(t)} = \sum_{i=1}^M \tilde\alpha_i^{(t)}\,b_i^{(t)}.
\]
The full round-level pseudocode consists of local training, server-side computation of \(\Delta w_i\), geometric detection, reputation update, normalization of \(\alpha_i\), and aggregation of \(w\) and \(b\) [2509.18044].

The paper positions this mechanism against Krum, Trimmed Mean, and Bulyan. Krum is described as selecting a single update closest to the bulk of updates, Trimmed Mean as discarding fixed fractions of largest and smallest coordinates per round, and Bulyan as building on Multi-Krum with an additional trimmed-mean step. All three are characterized as stateless, and Bulyan also requires \(f\) [2509.18044]. HRA is described instead as attack-agnostic, without requiring \(f\), and as fusing both spatial and temporal information.

## 3. Experimental behavior in the 5G/edge FL setting

The experimental setup uses two datasets. The proprietary 5G testbed traffic dataset contains 29 features, 1 753 454 training samples, and 194 829 test samples, with a non-IID split across \(M=10\) clients via Dirichlet(\(\alpha=0.5\)). The NF-CSE-CIC-IDS2018 benchmark uses 10 selected features, 6 713 920 train samples, and 1 678 481 test samples, with the same non-IID partitioning. The attack scenarios are label-flipping, backdoor injection, Sybil collusion, and random-noise Byzantine updates. The evaluation metrics are test accuracy, precision, recall, F1 score, and ROC AUC [2509.18044].

On the 5G dataset, HRA achieves \(98.66\%\) accuracy \((\pm0.00)\), compared with Krum at \(23.73\%\), Trimmed Mean at \(22.85\%\), and Bulyan at \(96.15\%\). On NF-CSE-CIC-IDS2018, HRA achieves \(96.60\%\) \((\pm0.00)\), compared with Krum at \(49.10\%\), Trimmed Mean at \(52.06\%\), and Bulyan at \(88.73\%\) [2509.18044]. The paper states that these margins are significant.

The ablation study isolates the contribution of the two mechanisms. The anomaly-only variant (“no reputation”) yields \(84.77\%\) on 5G, a drop of \(13.89\) percentage points, and the reputation-only variant (“no anomaly”) yields \(78.52\%\), a drop of \(20.14\) percentage points. The accompanying interpretation is explicit: instantaneous anomaly detection alone misses stealthy, well-camouflaged attacks; reputation alone is blind to first-round attacks until history accumulates; their combination yields both reactive and proactive defense [2509.18044].

The sensitivity analysis is equally specific. For moderate threshold settings with \(T_{\rm high}\le 7.0\), accuracy remains \(98.66\%\) on 5G. If \(T_{\rm high}\) is set too large, exemplified as \(20.0\), accuracy drops by at least \(26\) percentage points. Learning-rate sensitivity is reported as stable within \([0.01,0.20]\) with \(\pm0.16\) percentage points. The theoretical remarks are deliberately limited: HRA does not require a known bound \(f\); it is empirically robust as long as the malicious proportion is \(<50\%\) and anomalies yield larger distances; and no closed-form breakdown point is derived [2509.18044]. This directly constrains overly strong interpretations of the method’s guarantees.

## 4. Federated healthcare HRA: peer-driven reputation, clustering, and privacy decoupling

A distinct HRA framework is proposed for federated survival analysis with Cox proportional hazards models. Its architecture contains two parallel communication channels: a server–client channel for global model aggregation using unmodified CoxPH updates, and a peer-to-peer channel for reputation computation using DP-protected updates [2505.16190]. At each round, clients first cluster themselves according to the completeness of their feature vectors \(B_i\) and their local concordance scores, forming a group \(C_k\). Each client then trains a local CoxPH model and produces coefficient update \(\theta_i(t)\).

For the peer-feedback path, \(\theta_i(t)\) is clipped to norm \(Q\) and perturbed by a Gaussian mechanism:
\[
\theta_i'(t)=\theta_i(t)\,\min\!\Bigl(1,\frac{Q}{\|\theta_i(t)\|_2}\Bigr), \qquad
\theta_i''(t)=\theta_i'(t)+\mathcal{N}\!\bigl(0,\sigma^2I\bigr),
\]
with
\[
\sigma=\frac{Q\sqrt{2\ln(1.25/\delta)}}{\varepsilon},
\]
satisfying \((\varepsilon,\delta)\)-DP [2505.16190]. Peers exchange these DP-protected \(\theta_i''(t)\) and compute concordance-index improvements
\[
m_{j,k}(t)=\Omega\!\bigl(\mathcal M(\theta_j(t),\theta_k(t))\bigr)-\Omega\!\bigl(\mathcal M(\theta_j(t))\bigr),
\]
which are then used to update pairwise reputations:
\[
RS_{ik}(t+1)=RS_{ik}(t)+\alpha\sum_{j\in\mathrm{Peers}_i}RS_{ij}(t)\,m_{j,k}(t).
\]
This update makes feedback from highly trusted peers \(RS_{ij}(t)\) carry more weight.

In parallel, the unmodified updates \(\theta_i(t)\) are sent to the server, which performs clustered reputation-weighted aggregation. Within cluster \(C_k\), the selection probability is
\[
P(i)=\frac{RS_i(t)}{\sum_{j\in C_k}RS_j(t)}, \qquad
RS_i(t)=\sum_{j\in C_k}RS_{ji}(t),
\]
and the update is
\[
\beta^{(t+1)}_{C_k}
=
\sum_{i\in C_k}P(i)\,\theta_i(t)
=
\frac{\sum_{i\in C_k}RS_i(t)\,\theta_i(t)}{\sum_{i\in C_k}RS_i(t)}.
\]
The paper emphasizes that the DP step affects only the reputation channel, not the aggregation channel, so sensitive coefficients are not exposed in clear text to peers while the server still receives unaltered updates for model training [2505.16190].

The experiments cover synthetic data with 10 centers and \(r=5000\) patients each, with varying missingness \(\alpha\), noise \(\epsilon_{\max}\), and censoring \(\gamma\), as well as real SEER breast-cancer data with 10 states as nodes. Over 10 rounds, the reported global C-index values are \(0.6612\) at round 1, \(0.6594\) at round 2, \(0.6585\) at round 7, and \(0.6579\) at round 10, while the TFFL baseline takes values \(0.6121\), \(0.6052\), \(0.6701\), and \(0.6159\), respectively, and the no-reputation model takes \(0.6602\), \(0.6414\), \(0.6554\), and \(0.6479\) [2505.16190]. State-wise SEER results include KY at \(0.7381\) versus TFFL \(0.7201\) and no-reputation \(0.7059\), LA at \(0.7359\) versus \(0.7198\) and \(0.7277\), CT at \(0.7372\) versus \(0.7150\) and \(0.7339\), and IA at \(0.8194\) versus \(0.7904\) and \(0.7992\). Figure 4 is described as showing that increasing adversarial noise \(\epsilon_{\max}\) drives down malicious nodes’ reputations faster in HRA [2505.16190].

## 5. HRA in online reputation systems: feature extraction, learned reliability, and weighted averaging

In online reputation systems, HRA is described as replacing naïve mean or median aggregation and single-factor weighted aggregation with “a data-driven weighted average in which each consumer’s contribution is scaled by a reliability weight predicted from her profile” [2209.04650]. The framework has two stages: extraction of per-consumer profile features from the rating log, and training of a regression model \(f\) to predict each consumer’s reliability weight \(w_i=f(x_i)\).

The feature set is fully specified. For each user \(i\), the input vector is
\[
x_i = [pos_i, nut_i, ngv_i, exp_i, fluc_i],
\]
where \(pos_i\) is the count of positive ratings \(R\in\{4,5\}\), \(nut_i\) is the count of neutral ratings \(R=3\), \(ngv_i\) is the count of negative ratings \(R\in\{1,2\}\), \(exp_i=|ratings_i|/\max_j|ratings_j|\), and \(fluc_i\) is the fluctuation feature defined in the paper. The target variable is
\[
rel_i = \frac{1}{|items_i|}\sum_k |r_{ik}-\mu_k|,
\]
identified in the summary as “Reliability” and used as the training label \(y_i=rel_i\). All features are normalized to \([0,1]\) by min–max scaling [2209.04650].

Four regression algorithms are compared under 10-fold cross-validation with \(90\%\) train and \(10\%\) test per fold: Linear Regression with multivariate ordinary least squares and \(random\_state=0\); Support Vector Regression with RBF kernel and \(\gamma=\text{‘auto’}\); K-Nearest Neighbors Regression with \(k=5\), Euclidean distance, and uniform weighting; and Regression Tree using CART with Gini-impurity split and default minimum leaf size [2209.04650]. The item reputation is then computed as a weighted average over the active raters \(U_j\), using the learned weights \(w_i\).

The evaluation uses MovieLens 100K, 1M, and 10M. The reported dataset sizes are 943 users, 1 682 movies, and 100 000 ratings for 100K; 6 040 users, 3 706 movies, and 1 000 209 ratings for 1M; and 71 567 users, 10 681 movies, and 10 000 054 ratings for 10M. Results are averaged across the 10 folds [2209.04650].

The main quantitative metric is MAE. For the full HRA pipeline, the MAE values are \(0.75\), \(0.73\), and \(0.67\) for Linear Regression on 100K, 1M, and 10M; \(0.71\), \(0.69\), and \(0.65\) for Regression Tree; \(0.82\), \(0.77\), and \(0.78\) for SVR; and \(0.79\), \(0.76\), and \(0.72\) for KNN [2209.04650]. Baselines on the same splits include Average, Median, BetaDR, Bayesian, Dirichlet, IMDb, Fuzzy, and LQ, with, for example, Average at \(0.91\), \(0.86\), and \(0.84\), and LQ at \(1.02\), \(0.97\), and \(0.96\). Ranked by MAE across all three datasets, the ordering is \(1)\) RT, \(2)\) LR, \(3)\) KNN, \(4)\) SVR, followed by Median, BetaDR, Dirichlet, Bayesian, and the remaining baselines [2209.04650].

The interpretation supplied with the framework is specific. “Fluctuation” down-weights users whose ratings systematically diverge from community averages. “Experience” privileges users who have contributed many ratings. The counts \(pos/nut/ngv\) capture overall leniency or strictness. Machine learning then combines these aspects in data-driven proportions rather than via manually chosen thresholds or aging rules [2209.04650]. The stated limitations are also precise: cold start for entirely new users, worst-case \(O(n^2)\) feature computation for fluctuation, and minimal hyperparameter tuning.

## 6. Related hybrid trust formulations and recurring issues

The broader hybrid reputation literature includes two influential formulations that are not identical to the 2025 HRA mechanisms but clarify the wider methodological space. Evidence-Based Subjective Logic proposes a unification of flow-based reputation and Subjective Logic into a single algebra that is “entirely based on the handling of evidence” [1402.3319]. Opinions are represented as \(x=(b,d,u)\) with \(b+d+u=1\), and evidence counts \((p,n)\) are related to opinions through
\[
x=\frac{(p,n,c)}{p+n+c}.
\]
Consensus \(\oplus\) adds evidence, scalar multiplication \(\alpha\cdot x\) rescales evidence, and the new discounting operator is defined as
\[
x\boxtimes y := g(x)\cdot y,
\]
with \(g:\Omega'\to[0,1]\). The key property is right-distributivity,
\[
x\boxtimes(y\oplus z)=(x\boxtimes y)\oplus(x\boxtimes z),
\]
which is used to avoid evidence double-counting in arbitrary trust networks. Indirect referral trust and functional trust are then given by recursive equations for \(R_{ij}\) and \(F_{iP}\), and the referral matrix is computed as the fixed point \(R=f(R)\) by iteration [1402.3319]. This formulation addresses limitations attributed to classical Subjective Logic discounting, especially the absence of a clear evidence-flow interpretation and the lack of distributivity over consensus.

A different hybrid construction appears in decentralized voting over Kademlia DHTs. The 2013 “new hybrid distributed voting algorithm” combines a two-state positive/negative vote model, HyperLogLog counters for unique voters by IP, and structured replication to the \(k\) nearest DHT nodes for the content key [1305.0711]. Each content item \(i\) stores two counters, \(P_i\) for positive votes and \(N_i\) for negative votes, and defines scores
\[
R_i = \frac{P_i-N_i}{P_i+N_i}, \qquad
S_i = \frac{P_i}{P_i+N_i}.
\]
Vote announcements are stored in a ring buffer of 24 hourly slots, and retrieval merges replicated HyperLogLog states through the HLL union operator. The paper notes that in BitTorrent Mainline DHT, about \(1\%\) of all traffic can be vote-packets under a naïve 5-star scheme, that HyperLogLog offers sub-\(1\%\) error with only a few hundred bytes per counter, and that Kademlia replication with \(k\approx 8\)–\(16\) is known from prior work to converge in \(O(\log N)\) steps and to be robust under heavy churn [1305.0711].

Across these formulations, several issues recur. One is the tension between stateless aggregation and persistent trust. Another is the relation between robustness and formal guarantees. In the 5G/edge FL HRA, no closed-form breakdown point is derived [2509.18044]. In the Kademlia voting algorithm, IP-based uniqueness is explicitly identified as imperfect, and there is no fully fleshed-out detection or isolation of malicious replicas [1305.0711]. In the online recommendation HRA, cold start and feature-computation cost remain open practical constraints [2209.04650]. This suggests that “hybrid” aggregation is primarily a strategy for combining complementary signals under realistic system constraints, rather than a universal solution to Sybil resistance, coordinated manipulation, or uncertainty quantification.

A common misconception is to treat all HRA systems as interchangeable because they share a name. The supplied literature does not support that view. In one case HRA is a server-side robust FL aggregator based on Euclidean outlier geometry and exponential smoothing [2509.18044]; in another it is a federated healthcare architecture with peer-derived C-index feedback and a decoupled DP channel [2505.16190]; in another it is a supervised learning pipeline over consumer profiles [2209.04650]. The shared element is the decision to aggregate trust, quality, or reliability from more than one source of evidence.

Source: https://www.emergentmind.com/topics/hybrid-reputation-aggregation-hra