# Byzantine-Resilient Federated Learning via QUBO-Based Client Selection on Quantum Annealers Source: [Byzantine-Resilient Federated Learning via QUBO-Based Client Selection on Quantum Annealers]() Collection index: [llms.txt]() Data updated: 2026-05-20T05:00:05.687Z Authors: Andras Ferenczi, Sutapa Samanta, Dagen Wang, Jason Qizhe Qin (2) \_\_INSTITUTION\_4\_\_ American Express Co., (2) Columbia University) Published: 2026-05-14T22:42:14.000Z ## Abstract Federated Learning (FL) trains a global model across decentralized clients while preserving data privacy, but at scale it is vulnerable to malicious updates. Byzantine-resilient aggregation methods such as MultiKrum score gradients against their nearest neighbors and can miss malicious updates that preserve the statistical properties of honest ones. We propose a quantum annealing approach that reformulates client selection as a Quadratic Unconstrained Binary Optimization (QUBO) problem, encoding pairwise distances into a cost function solved by quantum annealers (QA). Unlike MultiKrum's greedy per-client scoring, the QUBO formulation jointly optimizes over all subsets to find the mutually closest group of $m$ clients. At small scale (15 clients), QUBO outperforms MultiKrum on the most challenging Byzantine attacks: e.g., Advanced LIE is detected with 95.11% accuracy versus 81.33% on MNIST and 97.78% versus 75.56% on CIFAR-10. QUBO fares poorly on simpler attacks where MultiKrum excels, so the two methods are complementary. QUBO quality also degrades as the number of clients grows. To address this, we introduce a MultiSignal ensemble that uses a dual-feature routing gate based on Euclidean and cosine Krum score gaps to classify attacks into four regimes and routes evasion attacks to a suspicion-penalized QUBO with agreement voting. At 100 clients on MNIST, MultiSignal achieves 95.3% average detection accuracy versus 91.8% for classical MultiKrum, with the largest gains on Sparse Lie (72.0% to 95.2%, +23.2 points) and Advanced Lie (80.4% to 85.2%, +4.8 points). These results show that QUBO-based quantum annealing with MultiSignal is a principled and scalable defense against the most challenging Byzantine strategies in federated learning. ## Recorded benchmark results A research result applies to its stated dataset, split, metric and evaluation configuration. Compare like-for-like settings, preserve the metric's unit and direction, and distinguish paper-reported results from independent reproduction. The best result recorded here is not a claim of exhaustive, current global coverage. - [Evasion Attack Detection on MNIST](): Evasion Attack Detection; MNIST; Detection Accuracy: 95.11. - [Evasion Attack Detection on CIFAR-10](): Evasion Attack Detection; CIFAR-10; Detection Accuracy: 97.78. - [Evasion Attack Detection on FashionMNIST](): Evasion Attack Detection; FashionMNIST; Detection Accuracy: 95.11. - [Byzantine Attack Detection on MNIST (100-client, 80 honest, 20 Byzantine, test)](): Byzantine Attack Detection; MNIST 100-client, 80 honest, 20 Byzantine (test); Clustered Detection Rate: 100. - [Byzantine Attack Detection on MNIST](): Byzantine Attack Detection; MNIST; Detection Accuracy: 95.11. - [Byzantine Attack Detection on FashionMNIST (test)](): Byzantine Attack Detection; FashionMNIST (test); Detection Accuracy: 95.11. - [Byzantine Client Detection on CIFAR-10 (test)](): Byzantine Client Detection; CIFAR-10 (test); Average Detection Accuracy: 97.78. ## Original sources and implementation [Original paper]() [PDF]()