PRISM-FCP: Byzantine-Resilient Federated Conformal Prediction via Partial Sharing

Paper: 2602.18396 Authors: Ehsan Lari, Reza Arablouei, Stefan Werner Categories: cs.LG, eess.SP, math.PR, stat.AP, stat.ML

Abstract

This paper introduces PRISM-FCP, a Byzantine-resilient federated conformal prediction framework that addresses a critical gap in existing approaches: vulnerability to adversarial attacks during model training. While traditional federated conformal prediction (FCP) methods focus solely on protecting the calibration stage, PRISM-FCP provides end-to-end protection by implementing partial model sharing during training and robust calibration mechanisms. The framework transmits only $M$ out of $D$ parameters per communication round, which mathematically attenuates adversarial perturbation energy by a factor of $M/D$. During calibration, the system employs distance-based maliciousness scoring to identify and downweight Byzantine contributions. Experimental validation on synthetic and real-world datasets demonstrates that PRISM-FCP maintains nominal coverage guarantees under attack while producing tighter prediction intervals and reducing communication costs compared to standard FCP.

Key Contributions

• End-to-end Byzantine resilience: Unlike existing FCP methods that only protect calibration, PRISM-FCP mitigates adversarial attacks throughout both training and calibration phases
• Partial sharing mechanism: Introduces a communication-efficient approach where clients transmit only $M$ of $D$ parameters per round, reducing adversarial impact by factor $M/D$
• Robust calibration protocol: Develops a distance-based maliciousness scoring system that converts nonconformity scores into characterization vectors for Byzantine detection
• Theoretical guarantees: Provides mathematical analysis showing reduced mean-square error (MSE) and tighter prediction intervals under partial sharing
• Empirical validation: Demonstrates maintained coverage guarantees and reduced interval inflation on UCI Superconductivity dataset and synthetic data

Methodology and Technical Framework

PRISM-FCP operates through two distinct phases, each incorporating Byzantine-resilient mechanisms.

Training Phase with Partial Sharing: During federated learning, each client computes local model updates but transmits only a subset of parameters. Specifically, if the full parameter vector has dimension $D$, clients randomly select and share M<D parameters per round. This partial sharing strategy has a profound mathematical consequence: it attenuates the expected energy of any adversarial perturbation in the aggregated update by the ratio $M/D$. For Byzantine attackers attempting to inject malicious gradients, this means their influence is systematically diluted across the aggregation process. The server aggregates these partial updates using robust aggregation methods, which further filters outlier contributions.

Calibration Phase with Robust Scoring: After training, the calibration phase constructs prediction intervals with statistical coverage guarantees. Each client computes nonconformity scores on their local calibration data—these scores measure how “unusual” each prediction is. PRISM-FCP transforms these scores into characterization vectors that capture their statistical properties. The framework then computes distance-based maliciousness scores by measuring how far each client’s characterization vector deviates from the median behavior. Clients with high maliciousness scores are either downweighted or filtered entirely before the conformal quantile estimation. This ensures that the final prediction intervals reflect honest client behavior while maintaining the theoretical coverage guarantee of $1-\alpha$ for a specified miscoverage rate $\alpha$.

Experimental Results and Performance Analysis

The experimental evaluation demonstrates PRISM-FCP’s effectiveness across multiple dimensions.

Coverage Maintenance Under Attack: On the UCI Superconductivity dataset with 30% Byzantine clients, PRISM-FCP maintains the nominal 90% coverage rate while standard FCP degrades significantly. The framework achieves this without the interval inflation typically observed when defending against attacks—prediction intervals remain tight and informative.

Communication Efficiency: By transmitting only $M/D$ of the parameters (experiments used $M/D = 0.5$), PRISM-FCP reduces communication overhead by 50% compared to full parameter sharing. This reduction comes with minimal impact on model accuracy, as the partial sharing mechanism still captures sufficient gradient information for convergence.

MSE Reduction: The partial sharing strategy yields lower mean-square error in the learned model compared to full sharing under Byzantine attacks. This counterintuitive result occurs because partial sharing acts as an implicit regularizer that prevents adversarial perturbations from dominating the aggregated update.

Robustness to Attack Intensity: Experiments varied the percentage of Byzantine clients from 10% to 40%. PRISM-FCP maintained stable performance across this range, while baseline methods showed progressive degradation. The distance-based maliciousness scoring proved particularly effective at identifying coordinated attacks where multiple Byzantine clients attempt to bias the conformal quantile estimation.

Implications for Federated Learning and Uncertainty Quantification

PRISM-FCP addresses a fundamental challenge in federated learning: providing reliable uncertainty quantification in adversarial environments. The framework’s implications extend across several domains.

Trustworthy AI Deployment: In safety-critical applications like healthcare or autonomous systems, prediction intervals must remain valid even when some participants are compromised. PRISM-FCP enables deployment of federated models with formal uncertainty guarantees despite Byzantine threats.

Privacy-Preserving Collaboration: The partial sharing mechanism provides an additional privacy benefit—clients reveal less information per round, making it harder for adversaries to reconstruct private data through gradient inversion attacks.

Scalability Considerations: The communication reduction from partial sharing becomes increasingly valuable as federated networks scale to thousands of clients. The $M/D$ ratio can be tuned based on network bandwidth constraints and threat models.

Theoretical Foundations: The work establishes that Byzantine resilience and communication efficiency are not necessarily competing objectives. The mathematical analysis showing that partial sharing reduces adversarial impact while maintaining convergence opens new directions for federated algorithm design.

Takeaways

1. PRISM-FCP is the first federated conformal prediction framework to provide end-to-end Byzantine resilience, protecting both training and calibration phases
2. Partial parameter sharing (transmitting $M$ of $D$ parameters) mathematically attenuates adversarial perturbation energy by factor $M/D$ while reducing communication by $(D-M)/D$
3. Distance-based maliciousness scoring effectively identifies Byzantine clients during calibration by analyzing characterization vectors of nonconformity scores
4. The framework maintains nominal coverage guarantees (e.g., 90%) under Byzantine attacks while avoiding the interval inflation observed in standard FCP
5. Experimental results on UCI Superconductivity dataset demonstrate lower MSE, tighter prediction intervals, and 50% communication reduction compared to baselines
6. The approach provides a practical solution for deploying uncertainty-aware federated learning in adversarial environments with formal statistical guarantees