Robust Federated Inference: Aggregation & Certification

• Robust federated inference is a framework that aggregates predictions from decentralized client models, ensuring reliability under adversarial corruption, heterogeneity, and deployment perturbations.
• Recent methods combine prediction-time aggregation, certified robustness via randomized smoothing, and training-phase control mechanisms to yield up to 22.2 accuracy points improvement in adversarial settings.
• Research in federated inference addresses trade-offs among privacy, secure aggregation, and certification, driving the development of scalable and robust models for heterogeneous devices.

Searching arXiv for the cited work on robust federated inference and closely related federated robustness papers. Searching arXiv for "Robust Federated Inference" and related federated robustness papers. Robust federated inference denotes a family of methods for making decentralized prediction reliable when data, models, or prediction responses remain distributed across clients. In the recent literature, the phrase covers at least three related but non-identical settings: direct aggregation of client predictions at query time, as in one-shot federated learning, edge ensembles, and federated ensembles; certification or probabilistic analysis of the robustness of a federatedly trained inference model; and training-time robust aggregation or contribution-control mechanisms whose purpose is to preserve trustworthy downstream inference despite malicious, faulty, or heterogeneous participants (Dhasade et al., 30 Sep 2025, Alfarra et al., 2022, Karakulev et al., 5 May 2025).

Sense of the term	Representative papers	Robustness object
Prediction-time aggregation	(Dhasade et al., 30 Sep 2025, Hasan et al., 2022)	Corrupted client responses; predictive posterior aggregation
Certified or probabilistic deployed-model robustness	(Alfarra et al., 2022, Chen et al., 2021, Najafi et al., 2024, Mildner et al., 2 Feb 2025, Gupta et al., 2022)	Input perturbations, transformations, misspecification, network shift, quantization
Training/control mechanisms for reliable downstream inference	(Karakulev et al., 5 May 2025, Tahmasebian et al., 2021, Heydaribeni et al., 2023, Sturluson et al., 2021, Kundu et al., 2020, Velez et al., 25 Feb 2026)	Poisoning, heterogeneity, contribution reliability, accountability

1. Conceptual scope and terminology

In its narrowest sense, federated inference is an inference-time protocol in which multiple client-held models are queried on the same input and a server aggregates their outputs into a final prediction. This is the formulation made explicit in "Robust Federated Inference" (Dhasade et al., 30 Sep 2025). Closely related is the one-round Bayesian setting of "Robust One Round Federated Learning with Predictive Space Bayesian Inference", which aggregates local predictive posteriors rather than local model posteriors and treats the resulting global predictor as an ensemble assembled after a single communication round (Hasan et al., 2022).

A broader usage treats federated inference as the reliability of whatever model a federated system deploys after training. Under this reading, robustness includes certified stability of predictions under test-time perturbations, semantic transformations, network shift, quantization at deployment, or model misspecification. "Certified Robustness in Federated Learning" studies global, local, and personalized inference models under randomized smoothing (Alfarra et al., 2022). "Certifiably-Robust Federated Adversarial Learning via Randomized Smoothing" trains a global model whose deployed predictions admit $\ell_2$ certificates (Chen et al., 2021). "Quantization Robust Federated Learning for Efficient Inference on Heterogeneous Devices" makes the deployment target explicit: one federatedly trained model should remain accurate after quantization to several bit-widths on heterogeneous hardware (Gupta et al., 2022).

A third usage is indirect but important. Several papers study robust federated training rather than direct inference-time aggregation, yet motivate their contribution by the reliability of downstream predictions. "Bayesian Robust Aggregation for Federated Learning" states this explicitly: its contribution is a training-time robust server-side aggregator, not a deployment-time ensemble rule, but it is relevant because reliable inference in decentralized systems depends on robust model estimation under adversarial participation (Karakulev et al., 5 May 2025). This suggests that robust federated inference is best understood as a layered topic spanning prediction aggregation, certified deployment behavior, and training/control mechanisms that determine whether the eventual inference model is trustworthy.

2. Threat models and formal criteria

The most explicit inference-time corruption model appears in "Robust Federated Inference" (Dhasade et al., 30 Sep 2025). There are $n$ clients, each with a probit-valued classifier $h_i:\mathcal{X}\to\Delta^K$, and a server-side aggregator $\psi:(\Delta^K)^n\to[K]$. For an input $x$, the adversary may arbitrarily corrupt up to $f<n/2$ client responses, with corrupted identities hidden and allowed to vary per query. The corrupted-response set is

$$\Gamma_f(x)\coloneqq \left\{ \mathbf{z}=(z_1,\dots,z_n)\in(\Delta^K)^n \,\middle|\, \exists H\subseteq[n],\, |H|\ge n-f,\; \forall i\in H,\; z_i=h_i(x) \right\},$$

and the robust risk is

$\mathcal{R}_{\mathrm{adv}}(\psi)\coloneqq \mathbb{E}_{(x,y)\sim\mathcal{D}} \big[ \max_{\mathbf{z}\in\Gamma_f(x)} \mathds{1}\{\psi(\mathbf{z})\neq y\} \big].$

For averaging-based aggregation, the paper shows that robustness depends on two quantities: the honest-response dissimilarity

$$\sigma_x^2 = \max_{k\in[K]} \frac1n\sum_{i=1}^n \left( [h_i(x)]_k-[\overline h(x)]_k \right)^2,$$

and the margin $margin(z)=z^{(1)}-z^{(2)}$ between the two largest coordinates. With coordinate-wise trimmed mean, disagreement with the averaging oracle is small when honest responses are similar or the clean margin is large (Dhasade et al., 30 Sep 2025).

A second family of threat models concerns test-time perturbations of the input rather than corruption of client responses. "Certified Robustness in Federated Learning" studies additive perturbations, rotation, and translation using randomized smoothing. The smoothed classifier is

$n$0

and if the top and runner-up smoothed class probabilities are $n$1 and $n$2, the certified $n$3 radius is

$n$4

The same paper also adopts DeformRS for parametric transformations and evaluates certified accuracy at radius $n$5 on federatedly trained global, local, and personalized models (Alfarra et al., 2022).

A third threat model treats deployment as evaluation on unseen clients or even an unseen target network. "Certifiably Robust Model Evaluation in Federated Learning under Meta-Distributional Shifts" models source-client distributions as draws from a meta-distribution $n$6, target-network clients as draws from $n$7, and certifies worst-case average loss and, under $n$8-divergence shift, the entire client-risk CDF over uncertainty sets $n$9 (Najafi et al., 2024). This broadens robustness from adversarial perturbations to cross-network generalization under client-population shift.

Taken together, these formulations show that robust federated inference is not a single adversary model. It includes corrupted prediction responses, input perturbations and semantic transformations, distributional shift across clients or networks, and deployment constraints such as quantization. This suggests that any general account of the field must distinguish the object being protected: client outputs, test inputs, target populations, or the deployed model itself.

3. Robust aggregation of local predictions

Prediction-time aggregation methods operate directly on client responses. For averaging-based rules, "Robust Federated Inference" provides the first robustness analysis of this class of methods and shows that robust mean estimation alone is not enough; preserving the final $h_i:\mathcal{X}\to\Delta^K$0 requires the aggregator’s coordinate-wise error to stay below half the clean margin (Dhasade et al., 30 Sep 2025). The paper studies coordinate-wise trimmed mean,

$h_i:\mathcal{X}\to\Delta^K$1

and its vector-valued extension CWTM, with robustness coefficient

$h_i:\mathcal{X}\to\Delta^K$2

Moving beyond linear rules, it casts non-linear robust federated inference as an adversarial machine learning problem over simplex-valued set inputs and proposes DeepSet-TM: $h_i:\mathcal{X}\to\Delta^K$3 Here adversarial training is combined with test-time CWTM in latent space. The reported gain over existing robust aggregation methods is $h_i:\mathcal{X}\to\Delta^K$4 to $h_i:\mathcal{X}\to\Delta^K$5 accuracy points across CIFAR-10, CIFAR-100, and AG-News, with worst-case accuracy improvements especially clear under SIA and PGD-cw attacks (Dhasade et al., 30 Sep 2025).

A distinct prediction-space route appears in "Robust One Round Federated Learning with Predictive Space Bayesian Inference" (Hasan et al., 2022). Rather than aggregating model parameters or model-space posteriors, it aggregates local predictive posteriors: $h_i:\mathcal{X}\to\Delta^K$6 This is a prior-corrected product in predictive space. For regression, assuming Gaussian predictive posteriors $h_i:\mathcal{X}\to\Delta^K$7 and prior predictive $h_i:\mathcal{X}\to\Delta^K$8, the paper gives

$h_i:\mathcal{X}\to\Delta^K$9

$\psi:(\Delta^K)^n\to[K]$0

In one dimension, ignoring prior terms, this reduces to inverse-variance weighting, so clients with higher predictive uncertainty contribute less. For classification, aggregation is class-wise in the output simplex. The robustness claim is not Byzantine robustness but robustness to heterogeneous or non-IID client data and to approximation error from high-dimensional model-posterior fusion. Empirically, the method is the best among one-round baselines on all classification datasets reported and becomes stronger as heterogeneity increases, except on EMNIST (Hasan et al., 2022).

The two approaches illuminate different principles. DeepSet-TM assumes multiple client responses may be adversarial at inference time and seeks adversarially robust set aggregation. Predictive-space Bayes assumes responses are genuine but heterogeneous and seeks a probabilistically coherent, uncertainty-aware fusion rule. A plausible implication is that future robust federated inference systems may need both properties simultaneously: robustness to malicious responses and robustness to benign predictive diversity.

4. Certified and probabilistic robustness of deployed federated models

Certified robustness in federated settings has been studied primarily through randomized smoothing. "Certified Robustness in Federated Learning" shows that FedAvg can produce not only more accurate but also more certifiably robust models than training solely on local data, and that personalization can further improve robust inference, especially when clients care about different perturbations or transformations at deployment (Alfarra et al., 2022). In the reported setup, certification uses 100 Monte Carlo samples to determine the top class, 100k samples to lower-bound $\psi:(\Delta^K)^n\to[K]$1, failure probability $\psi:(\Delta^K)^n\to[K]$2, and deformation experiments use bilinear interpolation. The main empirical message is that as the number of clients increases to 10 or 20 and local datasets shrink, local-only models deteriorate substantially, while federated and moderately personalized models retain better certified accuracy.

"Certifiably-Robust Federated Adversarial Learning via Randomized Smoothing" pushes this further by adversarially training the smoothed classifier itself during federated training (Chen et al., 2021). The core objective is

$\psi:(\Delta^K)^n\to[K]$3

with $\psi:(\Delta^K)^n\to[K]$4. The resulting Fed-SmoothAdv framework yields models empirically close to centralized SmoothAdv on CIFAR-10/AlexNet, and its one-point estimator is $\psi:(\Delta^K)^n\to[K]$5–$\psi:(\Delta^K)^n\to[K]$6 faster than the stochastic estimator without noticeable certified robustness differences (Chen et al., 2021).

Robustness under network shift is addressed by "Certifiably Robust Model Evaluation in Federated Learning under Meta-Distributional Shifts" (Najafi et al., 2024). For a fixed hypothesis $\psi:(\Delta^K)^n\to[K]$7, it certifies worst-case target-network average risk

$\psi:(\Delta^K)^n\to[K]$8

and, under $\psi:(\Delta^K)^n\to[K]$9-divergence shift, the risk tail profile across unseen target clients. The paper derives a robust DKW-style inequality using adversarially reweighted empirical CDFs and shows that the resulting certificates are privacy-preserving because the server receives only client-level scalar queries $x$0 or $x$1. This moves robust federated inference toward deployment-time guarantees under client-population uncertainty rather than only perturbation robustness.

Robust probabilistic inference under misspecification is the focus of "Federated Generalised Variational Inference: A Robust Probabilistic Federated Learning Framework" (Mildner et al., 2 Feb 2025). FedGVI replaces strict likelihood-based Bayesian updates with generalized variational objectives

$x$2

allowing robust losses such as generalized cross-entropy and non-KL divergences such as weighted KL or Alpha-Rényi. The paper proves fixed-point optimality under KL choices, exact recovery of generalized Bayes under unrestricted $x$3, and a robustness theorem showing that if local losses are robust under Huber contamination, the federated posterior is robust to outliers (Mildner et al., 2 Feb 2025).

A different deployment concern is hardware heterogeneity. "Quantization Robust Federated Learning for Efficient Inference on Heterogeneous Devices" studies whether one global FL model can be quantized to multiple deployment bit-widths without severe accuracy loss (Gupta et al., 2022). Its main proposal, multi-bit quantization-aware training, samples a client-side bit-width $x$4 during local training and optimizes the quantized forward pass with STE. On CIFAR-10/ResNet-20 under weight quantization, baseline FedAvg drops to $x$5 at W-2, while MQAT reaches $x$6; on TinyImageNet/ResNet-18, baseline W-2 is $x$7 and MQAT reaches $x$8 (Gupta et al., 2022). This is directly a robust federated inference result: one trained model remains usable across heterogeneous on-device precisions.

5. Training-time mechanisms that secure downstream inference

A substantial part of the literature approaches robust federated inference indirectly by robustifying training. "Bayesian Robust Aggregation for Federated Learning" proposes Bayesian Robust Aggregation, in which the server treats client honesty as latent Bernoulli variables $x$9, optimizes a variational ELBO over benignness probabilities $f<n/2$0, and returns the posterior-weighted mean

$f<n/2$1

The contamination level is updated empirically by

$f<n/2$2

The key operational point is that the method does not require prior knowledge of the number of malicious clients and can adapt across rounds when the malicious fraction varies. On MNIST, Fashion-MNIST, and CIFAR-10, BRA matches or tracks Krum under SignFlip and Backdoor attacks while avoiding attack-fraction hyperparameters (Karakulev et al., 5 May 2025).

Several methods infer client reliability from agreement structure. "RobustFed: A Truth Inference Approach for Robust Federated Learning" estimates a latent global update $f<n/2$3 and client reliabilities $f<n/2$4 by alternating between a reliability-weighted truth estimate and a distance-based reliability update, then aggregates with

$f<n/2$5

Its RobustFed$f<n/2$6 and RobustFed$f<n/2$7 variants add reliability pruning and temporal statistics, respectively, to correct the failure mode under label flipping (Tahmasebian et al., 2021). "Probabilistic Inference for Learning from Untrusted Sources" adopts a closely related latent-truth view, modeling client updates as

$f<n/2$8

or, with correlations, $f<n/2$9. The resulting IVAR and ICOV estimators weight clients by inverse variance or inverse covariance without requiring a trusted reference dataset (Nguyen et al., 2021). In both papers, robustness is statistical rather than worst-case Byzantine-certifiable, but the goal is the same: infer which client updates should influence the final model and therefore the eventual predictions.

Other defenses use auxiliary clean references or uncertainty. "SureFED: Robust Federated Learning via Uncertainty-Aware Inward and Outward Inspection" equips each client with a social model and a locally trained clean Bayesian reference model, then filters neighbors by an uncertainty-scaled confidence set and overwrites suspicious social-model coordinates with local-model coordinates when necessary (Heydaribeni et al., 2023). "FedRAD: Federated Robust Adaptive Distillation" moves robustness into output space: it scores clients by how often their logits coincide with the coordinate-wise median on server-side unlabeled data, reweights the parameter average accordingly, and then distills the global model toward median-logit pseudo-labels (Sturluson et al., 2021). These methods are training-time protocols, but their success criterion is the final global model’s clean test error under poisoning and non-IID data.

Robustness to heterogeneity and personalization is addressed by "Robustness and Personalization in Federated Learning: A Unified Approach via Regularization" (Kundu et al., 2020). Fed+ replaces hard consensus $$\Gamma_f(x)\coloneqq \left\{ \mathbf{z}=(z_1,\dots,z_n)\in(\Delta^K)^n \,\middle|\, \exists H\subseteq[n],\, |H|\ge n-f,\; \forall i\in H,\; z_i=h_i(x) \right\},$$0 by $$\Gamma_f(x)\coloneqq \left\{ \mathbf{z}=(z_1,\dots,z_n)\in(\Delta^K)^n \,\middle|\, \exists H\subseteq[n],\, |H|\ge n-f,\; \forall i\in H,\; z_i=h_i(x) \right\},$$1 and optimizes

$$\Gamma_f(x)\coloneqq \left\{ \mathbf{z}=(z_1,\dots,z_n)\in(\Delta^K)^n \,\middle|\, \exists H\subseteq[n],\, |H|\ge n-f,\; \forall i\in H,\; z_i=h_i(x) \right\},$$2

Through the Moreau envelope of $$\Gamma_f(x)\coloneqq \left\{ \mathbf{z}=(z_1,\dots,z_n)\in(\Delta^K)^n \,\middle|\, \exists H\subseteq[n],\, |H|\ge n-f,\; \forall i\in H,\; z_i=h_i(x) \right\},$$3, the server aggregation rule recovers mean, geometric median, or coordinate-wise median, while the client-specific offsets $$\Gamma_f(x)\coloneqq \left\{ \mathbf{z}=(z_1,\dots,z_n)\in(\Delta^K)^n \,\middle|\, \exists H\subseteq[n],\, |H|\ge n-f,\; \forall i\in H,\; z_i=h_i(x) \right\},$$4 preserve local fit. The paper’s interpretation is that deployment-time inference becomes more reliable when training does not force brittle consensus under non-IID data (Kundu et al., 2020).

6. Privacy, contribution evaluation, and unresolved system constraints

Robust federated inference methods differ sharply in what side information they assume. "FedIF: Lightweight and Robust Federated Data Valuation" requires a public validation set on the server and computes contribution scores from validation-gradient alignment with normalized client updates (Tang et al., 29 Sep 2025). The aggregation weight is

$$\Gamma_f(x)\coloneqq \left\{ \mathbf{z}=(z_1,\dots,z_n)\in(\Delta^K)^n \,\middle|\, \exists H\subseteq[n],\, |H|\ge n-f,\; \forall i\in H,\; z_i=h_i(x) \right\},$$5

where $$\Gamma_f(x)\coloneqq \left\{ \mathbf{z}=(z_1,\dots,z_n)\in(\Delta^K)^n \,\middle|\, \exists H\subseteq[n],\, |H|\ge n-f,\; \forall i\in H,\; z_i=h_i(x) \right\},$$6 is a smoothed influence score. The method is robust to label noise and gradient noise and reduces aggregation overhead by up to $$\Gamma_f(x)\coloneqq \left\{ \mathbf{z}=(z_1,\dots,z_n)\in(\Delta^K)^n \,\middle|\, \exists H\subseteq[n],\, |H|\ge n-f,\; \forall i\in H,\; z_i=h_i(x) \right\},$$7 relative to AFedSV, but it is weaker against adversarial-sample attacks such as PGD (Tang et al., 29 Sep 2025). "InferGuard" uses no trusted server-side data, but it does require the server to inspect individual client updates, compute the coordinate-wise median, and reject updates whose $$\Gamma_f(x)\coloneqq \left\{ \mathbf{z}=(z_1,\dots,z_n)\in(\Delta^K)^n \,\middle|\, \exists H\subseteq[n],\, |H|\ge n-f,\; \forall i\in H,\; z_i=h_i(x) \right\},$$8 deviation from the median exceeds a threshold $$\Gamma_f(x)\coloneqq \left\{ \mathbf{z}=(z_1,\dots,z_n)\in(\Delta^K)^n \,\middle|\, \exists H\subseteq[n],\, |H|\ge n-f,\; \forall i\in H,\; z_i=h_i(x) \right\},$$9 (Xu et al., 2024). This makes it a practical defense against client-side training data distribution inference attacks, yet its compatibility with secure aggregation is limited for the same reason.

Secure aggregation motivates a different layer of robustness: contribution evaluation and participant accountability. "Private and Robust Contribution Evaluation in Federated Learning" formalizes the fact that under secure aggregation the server observes only $\mathcal{R}_{\mathrm{adv}}(\psi)\coloneqq \mathbb{E}_{(x,y)\sim\mathcal{D}} \big[ \max_{\mathbf{z}\in\Gamma_f(x)} \mathds{1}\{\psi(\mathbf{z})\neq y\} \big].$0 and the grand coalition model $\mathcal{R}_{\mathrm{adv}}(\psi)\coloneqq \mathbb{E}_{(x,y)\sim\mathcal{D}} \big[ \max_{\mathbf{z}\in\Gamma_f(x)} \mathds{1}\{\psi(\mathbf{z})\neq y\} \big].$1, while each client can additionally reconstruct $\mathcal{R}_{\mathrm{adv}}(\psi)\coloneqq \mathbb{E}_{(x,y)\sim\mathcal{D}} \big[ \max_{\mathbf{z}\in\Gamma_f(x)} \mathds{1}\{\psi(\mathbf{z})\neq y\} \big].$2 and $\mathcal{R}_{\mathrm{adv}}(\psi)\coloneqq \mathbb{E}_{(x,y)\sim\mathcal{D}} \big[ \max_{\mathbf{z}\in\Gamma_f(x)} \mathds{1}\{\psi(\mathbf{z})\neq y\} \big].$3 (Velez et al., 25 Feb 2026). The paper proposes the Fair-Private score

$\mathcal{R}_{\mathrm{adv}}(\psi)\coloneqq \mathbb{E}_{(x,y)\sim\mathcal{D}} \big[ \max_{\mathbf{z}\in\Gamma_f(x)} \mathds{1}\{\psi(\mathbf{z})\neq y\} \big].$4

with

$\mathcal{R}_{\mathrm{adv}}(\psi)\coloneqq \mathbb{E}_{(x,y)\sim\mathcal{D}} \big[ \max_{\mathbf{z}\in\Gamma_f(x)} \mathds{1}\{\psi(\mathbf{z})\neq y\} \big].$5

and the Everybody-Else score $\mathcal{R}_{\mathrm{adv}}(\psi)\coloneqq \mathbb{E}_{(x,y)\sim\mathcal{D}} \big[ \max_{\mathbf{z}\in\Gamma_f(x)} \mathds{1}\{\psi(\mathbf{z})\neq y\} \big].$6, which removes self-evaluation and is manipulation-resistant in the sense that no client can directly manipulate its own score. Both run in $\mathcal{R}_{\mathrm{adv}}(\psi)\coloneqq \mathbb{E}_{(x,y)\sim\mathcal{D}} \big[ \max_{\mathbf{z}\in\Gamma_f(x)} \mathds{1}\{\psi(\mathbf{z})\neq y\} \big].$7, outperform Leave-One-Out and cosine similarity in approximating Shapley-induced rankings, and improve both noisy-client reweighting and attacker detection under secure aggregation (Velez et al., 25 Feb 2026). This is not inference-time robustness in the narrow sense, but it is a control-layer mechanism for deciding whose updates should shape the model that will later be used for inference.

Across the literature, several recurring constraints remain. Some methods require a server-side unlabeled or validation set, as in FedRAD and FedIF (Sturluson et al., 2021, Tang et al., 29 Sep 2025). Others require direct visibility of individual client updates, which conflicts with secure aggregation, as in InferGuard and most update-filtering defenses (Xu et al., 2024). Certification-oriented methods impose substantial Monte Carlo cost at inference, as in randomized smoothing (Alfarra et al., 2022). Learned inference aggregators such as DeepSet-TM require adversarial training over structured corruption sets (Dhasade et al., 30 Sep 2025). A plausible implication is that robust federated inference still lacks a single method that is simultaneously certified, privacy-preserving under secure aggregation, scalable to large client counts, and robust to both malicious and benign heterogeneity.

The literature therefore supports a layered conclusion. Robust federated inference is not reducible to one algorithmic trick or one threat model. It encompasses robust prediction aggregation at query time, certified and probabilistic guarantees for deployed federated models, and training-time estimation, valuation, and governance mechanisms that determine whether the deployed model deserves trust at all.