FLVaccin: Unbalanced Hierarchical Federated Learning with Vaccination-Calibrated Adaptive Quarantine for Robust Poisoning Defense

Abstract

Poisoning attacks present a significant challenge for federated learning (FL), particularly when clients operate with Non-IID data and updates are transmitted through multi-tier aggregators. This paper introduces FLVaccin, a hierarchical personalized FL framework structured as an unbalanced tree. In this framework, each non-root node both hosts local clients and aggregates shared MobileNetV2 features (FedPer), whereas the root node does not possess local data. The proposed defense integrates node-level CIFAR-100 vaccination, which calibrates depth- and round-adaptive tolerances, with per-client trend quarantine and root backbone rejection. Experimental results on CIFAR-10 with 100 clients, 25 aggregators, and Dirichlet Non-IID partitioning ($\alpha =0.5$) demonstrate that the clean baseline achieves 79.9% accuracy. In contrast, unconstrained mixed attacks reduce performance to near-chance levels (20.2% k-fold). When vaccination and quarantine are enabled, 535 attack events still result in a 76.5% ± 0.4% k-fold accuracy (77.3% test), remaining within 2.6 percentage points of the clean model. These findings indicate that tree-aware, vaccination-calibrated monitoring can maintain model utility under persistent multi-vector poisoning without the need to share raw data.

1. Introduction

Federated learning (FL) enables training of a shared model across decentralized clients without exchanging raw data samples [1]. However, this privacy benefit is fragile because any participant with control over local data or outgoing updates can poison the training process and compromise or backdoor the global model [2,3,4]. Most robust aggregation methods, such as Krum, trimmed mean, and geometric median, assume a flat star topology and experience further degradation under strong non-independent and identically distributed (Non-IID) data skew [5,6].

Hierarchical FL enhances scalability by introducing intermediate aggregators [7]. However, most existing hierarchical structures position all clients at the leaves, with interior nodes solely relaying updates [8]. In practical edge and organizational deployments, mid-tier sites frequently possess their own data. An unbalanced hierarchy, where clients exist at multiple depths, more accurately reflects these scenarios but also alters the attack surface. Specifically, a compromised client can corrupt an entire branch before the root receives the update, and depth-dependent Non-IID volatility renders a single global anomaly threshold ineffective. While cryptographic secure aggregation in hierarchical FL (such as SHIELD [8]) ensures message integrity, it does not independently detect poisoned local data or anomalous learning patterns.

This work addresses this gap by introducing FLVaccin, a hierarchical personalized federated learning system (FedPer [9]). In this system, shared MobileNetV2 features are federated in a bottom-up manner, while each client retains a private classifier head. Two compact defenses operate in tandem. The first, vaccination, incorporates trusted CIFAR-100 images into selected client shards, enabling measurement of benign distribution shifts and the establishment of appropriate tolerances. The second, quarantine, monitors per-client accuracy and loss trends using depth- and round-adaptive allowances derived from the calibration process, temporarily excluding suspicious clients and permitting the root to reject a compromised global backbone.

The primary contributions of this work are as follows:

• An unbalanced hierarchical FedPer topology in which every non-root node both hosts clients and aggregates shared backbones, with only the root node lacking local clients.
• A coupled defense mechanism that calibrates depth- and round-adaptive per-client quarantine, as well as root backbone rejection, based on node-level vaccination statistics.

Figure 1 summarizes FLVaccin: an unbalanced FedPer tree (center) with a federated shared backbone and private client heads (top left); red paths show poisoned updates without defense. Defense Pillar I (bottom) injects CIFAR-100 auxiliary data at vaccinated nodes, calibrated in 30 single-round runs. Defense Pillar II (right) quarantines clients whose metric trends exceed depth-dependent tolerances and lets the root reject bad global backbone updates.

The rest of this paper is organized as follows: Section 2 reviews related work. Section 3 describes the system. Section 4 presents results. Section 5 and Section 6 discuss findings and conclude the paper. Section 5.1 discusses fairness of literature comparisons; Section 5.2 interprets the results mechanistically and discusses practicality and accuracy–loss trade-offs.

2. Related Work

We organize prior work along three axes that motivate FLVaccin: (i) poisoning attacks and flat defenses; (ii) personalized and hierarchical FL under heterogeneity; (iii) vaccination-style or hierarchical security mechanisms. The goal is not an exhaustive survey, but to clarify which assumptions FLVaccin relaxes.

2.1. Poisoning Attacks and Flat Defenses

Untargeted poisoning aims to reduce overall accuracy [4,10]; targeted backdoors preserve clean accuracy while misclassifying triggered inputs [3,11,12]. Practical vectors include label flipping [13], model-update scaling or noise injection [14,15], Byzantine replacements [5,16], and sign-flip updates [4]. Production-oriented analyses stress that intermittent, heterogeneous attack schedules are more realistic than a fixed malicious fraction [17].

On the defense side, robust aggregators such as Krum [5], coordinate-wise trimmed mean, and geometric median [6,18] discard outlier updates in parameter space. Trust- or validation-based methods (FLTrust [19], BaFFLe [20]) reweight or reject clients using a trusted reference or feedback set. Anomaly detectors (CONTRA [21]) and reputation schemes [22,23,24] track suspicious behavior over time, while FLCert [25] offers certified ensemble robustness at higher compute cost. Surveys [2,26,27] note that these defenses predominantly assume a flat server and full-model averaging. They therefore neither exploit tree depth nor contain branch-local damage before root aggregation.

2.2. Personalization, Heterogeneity, and Hierarchical FL

Non-IID client data remains a central obstacle for FedAvg-style training. Personalized FL methods such as FedPer keep a shared feature extractor while leaving classifier heads local [9]. Recent personalization designs further refine feature extractors or aggregation under heterogeneity: Liu et al. [28] propose a composite feature-extractor personalization algorithm for IoT FL; Bi et al. [29] combine self-excluding aggregation with knowledge distillation; and Hu et al. [30] study adaptive sample selection for vertical FL with distributed labels. While these methods improve utility under data skew, they do not address poisoning attacks and typically retain flat, non-hierarchical coordination.

Hierarchical or edge–cloud federated learning [7] reduces communication overhead by aggregating updates at intermediate nodes. SHIELD [8] represents the closest hierarchical security baseline, providing secure aggregation against poisoning attacks for leaf-only tree structures. The FLVaccin setting differs in three key aspects relevant to defense design: clients may be positioned at intermediate levels, aggregation employs FedPer instead of full-model averaging, and monitoring is proactive, relying on metric trends rather than exclusively cryptographic methods.

2.3. Vaccination-Style and Tree-Aware Defenses

Auxiliary-data vaccination techniques inject trusted samples to strengthen local training against poisoning attacks [31,32]. Related CIFAR-10 defenses, including BOD-hybrid [33], FeRA [34], and FLAIR [35], demonstrate strong performance primarily against single-family attacks on flat topologies. In contrast, FLVaccin employs vaccination as a calibration mechanism on an unbalanced tree: benign CIFAR-100 injection quantifies legitimate metric volatility, which is then used to establish depth- and round-adaptive quarantine thresholds, supplemented by a root-level backbone rejection gate.

Table 1. Contextual landscape of CIFAR-10 poisoning defenses (reported accuracies; not a head-to-head comparison). Columns: Attack—threat type; Acc. with defense—reported accuracy under attack with the defense enabled; Hierarchy—whether the method uses hierarchical aggregation; Non-IID ($\alpha$)—client data split (IID, Dirichlet Non-IID with concentration $\alpha$, or not reported).

Method	Year	Attack	Acc. with Defense	Hierarchy	Non-IID ($\mathit{\alpha }$)
Sundar et al. [31]	2025	Backdoor	82.9%	No	Not reported
RECESS [32]	2023	Model poison	60.4%	No	Not reported
SHIELD [8]	2025	Poisoning	60.58%	Yes	IID & Non-IID ($\alpha =1$)
BOD-hybrid [33]	2025	Backdoor	78.2%	No	IID & Non-IID
FeRA [34]	2025	DBA backdoor	86.1%	No	Not reported
FLAIR [35]	2023	Untargeted	66.9%	No	Not reported
Bagdasaryan et al. [3]	2020	Model-repl.	∼80%	No	Not reported
FLVaccin (ours)	2026	Mixed (5)	76.5% †	Yes	Non-IID ($\alpha =0.5$)

Mixed (5): label flip, backdoor, model poison, Byzantine, and sign-flip. ^† 5-fold×10 k-fold after 535 attacks with quarantine. Cross-row percentage gaps are not evidence of absolute superiority (Section 5.1).

presents representative CIFAR-10 poisoning defenses, with accuracy figures as reported in the cited papers rather than under a unified protocol. The experiments in this work utilize hierarchical FedPer. The reasons why direct head-to-head reimplementation is not feasible, as well as the impact of setup differences on these scores, are discussed in Section 5.1.

3. Materials and Methods

3.1. System Architecture

Figure 2 presents the software architecture of FLVaccin. The primary algorithmic contribution is the interaction among modules within the unbalanced FedPer tree rather than within any individual component. The orchestrator executes communication rounds on CUDA, Apple MPS, or CPU platforms using Python 3.10, PyTorch 2.0, and torchvision 0.15. It sequentially loads the configuration, data loader (CIFAR-10/100 shards), tree structure (unbalanced host tree), and model (MobileNetV2 FedPer partitioned into a shared backbone and a private head). Hosted clients perform training with both client and personalization phases. Subsequently, two optional processes may occur: vaccination, which injects trusted CIFAR-100 samples at designated nodes, and attack simulation, which introduces corrupted data or updates. Client metrics are processed by the defense module, which (i) excludes clients whose accuracy or loss trajectories violate depth- and round-adaptive tolerances, and (ii) may reject a compromised root backbone. Updates that pass these defenses are aggregated bottom-up using FedPer averaging. The evaluation module records metrics and completes the operational cycle.

The principal innovation compared to standard hierarchical federated learning (FL) pipelines is the integrated coupling of these processes. Vaccination serves not only as a hardening mechanism but also as the calibration source for quarantine thresholds. Quarantine decisions are determined for each client at every non-root depth prior to the propagation of branch updates to the root. In contrast, flat robust aggregators lack this depth-aware filtering, and leaf-only hierarchical designs do not account for intra-level clients. Section 3.2, Section 3.3, Section 3.4, Section 3.5 and Section 3.6 provide formal definitions of the topology, vaccination bands, and quarantine rules, while Section 4 details the experimental tree implementation.

3.2. Hierarchical Topology and FedPer Protocol

We model the federation as an unbalanced tree $\mathcal{T}=(\mathcal{V},\mathcal{E})$, where $\mathcal{V}$ is the set of vertices (aggregator nodes) and $\mathcal{E}$ is the set of undirected edges connecting parent–child aggregators. Each vertex $v\in \mathcal{V}$ has depth ${\mathcal{l}}_v$ (the root at $\mathcal{l}=0$), child aggregators $\mathrm{Ch}\left(v\right)$, and $n_v\ge 0$ hosted clients with private CIFAR-10 shards. Unlike classical hierarchical FL, where all clients sit at the leaves and interior nodes only relay updates, FLVaccin allows intra-level placement: every non-root node hosts local clients that perform all local training on private shards and FedPer-aggregates its subtree before passing the result upward—nodes aggregate only and do not train. Only the root has $n_{\mathrm{root}}=0$—it coordinates the federation, broadcasts the accepted shared backbone, and may reject a bad global update after validation (Section 3.6). Because fan-out $\left|\mathrm{Ch}\right(v\left)\right|$ and client load $n_v$ differ across nodes, the tree is heterogeneous rather than balanced; prior hierarchical FL papers typically assume clients only at the deepest tier.

All experiments use personalized FL (FedPer) [9]. Each MobileNetV2 network splits into a shared feature block ${\mathit{\theta }}^{\mathrm{sh}}$ (the features backbone, federated bottom-up) and a local classifier block ${\mathit{\theta }}_i^{\mathrm{loc}}$ (the classifier head, private to client i).

Table 2. FedPer round-protocol notation.

Group	Symbol	Meaning
Model split
	${\mathit{\theta }}^{\mathrm{sh}}$	Shared backbone (features); averaged bottom-up at every node
	${\mathit{\theta }}_i^{\mathrm{loc}}$	Private classifier head of client i (classifier); never sent to aggregation
	${\mathit{\theta }}^{\mathrm{sh},t}$, ${\mathit{\theta }}_i^{\mathrm{loc},t}$	Backbone and head of client i when round t begins
Rounds
	t, T	Current round index and total communication rounds
	E	Local training epochs per active client in each round
Indices
	i	Federation client (hosted at some tree node)
	v	Aggregator node in $\mathcal{V}$
	j	Model indexed in aggregation pool ${\mathcal{S}}_v$
Aggregation
	${\mathcal{S}}_v$	Non-quarantined models at node v (hosted clients and child-node models)
	$|{\mathcal{S}}_v|$	Number of models averaged in Equation (1)
	${\mathit{\theta }}_v^{\mathrm{sh},t}$, ${\mathit{\theta }}^{\mathrm{sh},t+1}$	Shared backbone after aggregation at v; candidate global backbone at root (accepted or rejected)

defines every symbol in the round protocol; superscript t always denotes the start of communication round $t\in \{1,\dots ,T\}$.

Over T communication rounds, learning proceeds bottom-up through the tree:

• Broadcast. The root sends ${\mathit{\theta }}^{\mathrm{sh},t}$ to all clients. Client i assembles $({\mathit{\theta }}^{\mathrm{sh},t},{\mathit{\theta }}_i^{\mathrm{loc},t})$ from the broadcast backbone and the head retained from the previous round.
• Local training. Each active client runs E local epochs on its shard (after optional vaccination or attack corruption), updating both parameter blocks; ${\mathit{\theta }}_i^{\mathrm{loc},t+1}$ is stored locally and is not federated.
• Bottom-up FedPer aggregation. From the deepest level to the root, each node v pools non-quarantined models from its hosted clients and child nodes into ${\mathcal{S}}_v$ and averages only shared weights ${\mathit{\theta }}_j^{\mathrm{sh},t}$:

  $${\mathit{\theta }}_v^{\mathrm{sh},t}={\displaystyle \frac{1}{|{\mathcal{S}}_v|}}\sum _{j\in {\mathcal{S}}_v}{\mathit{\theta }}_j^{\mathrm{sh},t}.$$

  (1)
  Classifier heads are averaged solely to build a complete model for node-level validation and upward relay; clients never receive this pooled head.
• Global acceptance. The root evaluates the candidate ${\mathit{\theta }}^{\mathrm{sh},t+1}$; if validation trends exceed the allowed tolerance, the previous backbone is kept (Section 3.6).

Figure 3 illustrates this topology schematically. Green horizontal bands mark hierarchy levels ($L_0,L_1,\dots ,L_n$). The black node at $L_0$ is the root; all other aggregator nodes are grey. Solid and dashed lines denote top-down broadcast and bottom-up FedPer aggregation, respectively. Each non-root grey node may host from 0 to N local clients (inset); only the root has $n_{\mathrm{root}}=0$. Section 4 details the experimental tree implementation.

3.3. Datasets, Partitioning, and Vaccination

We use CIFAR-10 as the primary classification benchmark (50,000 training and 10,000 test images, 10 classes, $32 \times 32$ RGB) and CIFAR-100 as an auxiliary source of out-of-distribution vaccine images. Training images are augmented with random crop (padding 4), horizontal flip, and channel normalization using CIFAR-10 statistics. The 50,000 training samples are split across N federation clients under a Dirichlet Non-IID partition with concentration $\alpha =0.5$: for each class k, a client mixture vector

$${\mathbf{p}}_k=(p_{k,1},\dots ,p_{k,N})\sim \mathrm{Dir}\left(\alpha {\mathbf{1}}_N\right), k\in \{1,\dots ,10\},$$

(2)

gives the fraction $p_{k,i}$ of class k allocated to client $i\in \{1,\dots ,N\}$, with ${\sum }_{i=1}^N{p}_{k,i}=1$; lower $\alpha$ induces stronger label skew across clients.

Vaccination is applied at the node level on this same data setup: any non-root aggregator can be marked as vaccinated. For node v with vaccine fraction $p_v\in (0,1]$, each hosted client replaces exactly $\lfloor p_v·\left|{\mathcal{D}}_i\right|\rfloor$ samples in its local shard with random CIFAR-100 images while keeping the original CIFAR-10 labels. Because clients reside at multiple hierarchy levels, injection can target shallow coordinators, deep edge nodes, or any combination—unlike leaf-only schemes in flat or classical hierarchical FL.

Before multi-round defended training, we run a vaccination mean-accuracy calibration to characterize how benign auxiliary injection affects round-one performance—not adversarial attacks. We execute 30 independent single-round FedPer trials on the fixed tree (defense disabled). These trials are grouped into three vaccination bands—Low, Medium, and Hard—with 10 random configurations per band. Each trial independently samples (i) the non-root aggregator nodes that are vaccinated and (ii) the replaced fraction of each selected node’s client shard, drawing both values uniformly at random within the band ranges below (the same percentage interval applies to node coverage and per-node injection dose). Vaccinated nodes may therefore appear at any hierarchy level ($L_1$–$L_n$):

• Low: 10–25% of non-root nodes vaccinated; each selected node receives 10–25% vaccine in its clients’ shards;
• Medium: 25–50% of nodes; 25–50% vaccine per selected node;
• Hard: 50–80% of nodes; 50–80% vaccine per selected node.

Each trial completes one FedPer round and records round-one global validation accuracy on the full CIFAR-10 test set. The spread of benign accuracy reactions across these 30 setups feeds the quarantine tolerance mapping $f_{\mathrm{tol}}$ (Section 3.6); measured outcomes are reported in Section 4.2.

3.4. Model Architecture and Training Protocol

Each client trains a MobileNetV2 [1] backbone initialized from ImageNet pre-training. Because CIFAR images are $32 \times 32$, the first convolution uses stride 1 instead of 2, and the 10-class head outputs one logit per CIFAR-10 category. Following FedPer (Section 3.2), the features module maps to the shared parameters ${\mathit{\theta }}^{\mathrm{sh}}$ federated at every tree node (Equation (1)), while the classifier module maps to the private head ${\mathit{\theta }}_i^{\mathrm{loc}}$ retained by client i across rounds.

All experiments run for $T=20$ communication rounds. In each round, every active client performs $E=3$ local epochs with Adam ($\eta =0.001$, batch size $B=64$, cross-entropy loss) on its local shard after the root broadcasts ${\mathit{\theta }}^{\mathrm{sh},t}$ and the client merges it with ${\mathit{\theta }}_i^{\mathrm{loc},t}$. Optional node-level CIFAR-100 mixing and adversarial corruption are applied to the shard before local training; each client is then evaluated on the full 10 000-image CIFAR-10 test set. Clients whose metric trends trigger quarantine are omitted from ${\mathcal{S}}_v$ for that round only; non-quarantined updates are FedPer-aggregated bottom-up as in Section 3.2.

3.5. Threat Model and Attack Suite

We assume a white-box adversary controlling a subset of clients who can corrupt local data and/or outgoing weights before FedPer aggregation. Each attack is parameterized by severity $s\in [0.01,1.0]$, which deterministically sets the fraction of corrupted samples (data attacks) or perturbed parameters (model attacks). Five attacks are supported, each tied to primary literature:

• Label flipping (data poisoning) [13]: random incorrect labels for an s-fraction of local samples.
• Backdoor (data poisoning) [3,11]: a $3 \times 3$ white trigger in the bottom-right corner with target class 0 on an s-fraction of samples.
• Model poisoning (model/update poisoning) [4,14]: additive Gaussian noise scaled to layer standard deviation on an s-fraction of weights.
• Byzantine (model/update poisoning) [5,16]: random replacement of an s-fraction of weights.
• Sign-flip update (model/update poisoning) [4]: after local training, independently select each weight scalar with probability s and negate it ($w\leftarrow -w$); unselected parameters are unchanged.

In free-attack mode, compromised clients still participate in FedPer aggregation; in attack+defense mode, quarantine may exclude them.

3.6. Trend-Based Quarantine Defense

Quarantine applies to individual clients (node_id, client_id), not to aggregator nodes as a whole. Each hosted client is monitored on four signals when available: training accuracy, training loss, validation accuracy, and validation loss. The allowed relative drop ${\delta }_i$ for client i depends on the tree level ${\mathcal{l}}_i$ of its host node and on the training round t. This couples vaccination mean-accuracy calibration with depth-interpolated, round-adaptive per-client trend quarantine on the unbalanced aggregator tree.

Round-one baseline. All clients are quarantined in round $t=1$ so their metrics establish trend baselines without influencing FedPer aggregation; enforcement begins in round $t=2$.

Design rationale. Each client is allowed a relative amount of metric deterioration from one round to the next before it is treated as suspicious. That allowance ${\delta }_i^t$ is not a constant: it is learned from benign vaccination experiments (how much accuracy can legitimately move when CIFAR-100 is mixed in), scaled by how deep the client sits in the tree, and tightened as training progresses.

Table 3. Quarantine notation: symbols, meaning, and role in the defense.

Symbol	Meaning
$A_i^t$, $L_i^t$	Client i’s training accuracy and loss after round t (validation metrics computed on the full CIFAR-10 test set)
$\Delta A_i^t$, $\Delta L_i^t$	Round-over-round relative change in accuracy and loss (Equation (7)); positive means improvement
${\delta }_i^t$	Maximum tolerated drop for client i in round t; quarantine triggers if any trend falls below $-{\delta }_i^t$
$\overline{\delta }$	Largest benign relative accuracy swing from the 30-run vaccination calibration (Section 4.2); upper bound on legitimate metric movement
${\delta }_{\mathrm{root}}^{\left(t\right)}$, ${\delta }_{\mathrm{deep}}^{\left(t\right)}$	Allowed drops at the shallowest hosted level ($\mathcal{l}=1$, near the root) and at the deepest level ($\mathcal{l}={\mathcal{l}}_{\max }$) in round t
${\mathcal{l}}_i$, ${\mathcal{l}}_{\max }$, ${\rho }_i$	Tree level of the node hosting client i; maximum level in the tree; normalized depth ${\rho }_i={\mathcal{l}}_i/{\mathcal{l}}_{\max }$ (0 at root, 1 at deepest)
$f_{\mathrm{tol}}({\mathcal{l}}_i,t,T)$	Maps depth and round to client i’s allowance ${\delta }_i^t$ by linear interpolation between the root and deep endpoints (Equation (6))

lists every symbol used below.

Step 1: Calibrating $\overline{\delta }$ from vaccination. The 30-run study (Section 4.2) asks: without any attack, how much can round-one global accuracy move when benign CIFAR-100 is injected at Low, Medium, or Hard intensity? For each trial we record global validation accuracy and compare it to the unvaccinated round-one baseline. The largest relative swing across all benign setups is

$$\overline{\delta }=\underset{\mathrm{benign} \mathrm{trials}}{\max }\left|{\displaystyle \frac{A_{\mathrm{global}}^{(1, \mathrm{trial})}-A_{\mathrm{global}}^{(1, \mathrm{baseline})}}{A_{\mathrm{global}}^{(1, \mathrm{baseline})}}}\right|,$$

(3)

i.e., the worst-case legitimate performance change induced by heterogeneous vaccination—not by poisoning. We use $\overline{\delta }$ as the reference scale for how much round-over-round movement a deep client may exhibit before quarantine.

Step 2: depth-dependent endpoints at round $t=2$. Clients deeper in the tree see stronger local Non-IID skew and larger auxiliary-data effects, so they receive a wider tolerance band than clients near the root (whose updates propagate upward and affect the global backbone). At the start of enforcement ($t=2$) we set:

$${\delta }_{\mathrm{deep}}^{\left(2\right)}=\overline{\delta }, {\delta }_{\mathrm{root}}^{\left(2\right)}=\overline{\delta }/2,$$

(4)

meaning a deepest-level client may tolerate up to $\overline{\delta }$ relative deterioration in any monitored metric, while a shallow-level client—and the root’s own global-backbone acceptance test—may tolerate only half that. In our experiments $\overline{\delta }\approx 30\%$, so ${\delta }_{\mathrm{deep}}^{\left(2\right)}\approx 30\%$ and ${\delta }_{\mathrm{root}}^{\left(2\right)}\approx 15\%$ (Section 4.2).

Step 3: tightening over rounds. As training proceeds, the model should stabilize and large metric swings become less plausible even under benign heterogeneity. Both depth endpoints therefore shrink linearly from round 2 to the final round T:

$${\delta }_{\mathrm{root}}^{\left(t\right)}={\delta }_{\mathrm{root}}^{\left(2\right)}-{\displaystyle \frac{t-2}{T-2}}\left({\delta }_{\mathrm{root}}^{\left(2\right)}-{\delta }_{\mathrm{root}}^{\left(T\right)}\right), {\delta }_{\mathrm{deep}}^{\left(t\right)}={\delta }_{\mathrm{deep}}^{\left(2\right)}-{\displaystyle \frac{t-2}{T-2}}\left({\delta }_{\mathrm{deep}}^{\left(2\right)}-{\delta }_{\mathrm{deep}}^{\left(T\right)}\right),$$

(5)

where the late-round targets are ${\delta }_{\mathrm{root}}^{\left(T\right)}={\left({\delta }_{\mathrm{root}}^{\left(2\right)}\right)}^2/\overline{\delta }$ and ${\delta }_{\mathrm{deep}}^{\left(T\right)}={\delta }_{\mathrm{root}}^{\left(2\right)}$. At $T=20$ with $\overline{\delta }=30\%$, this yields ${\delta }_{\mathrm{root}}^{\left(20\right)}\approx 7.5\%$ and ${\delta }_{\mathrm{deep}}^{\left(20\right)}\approx 15\%$: shallow clients become strictest by the end of training, while deep clients tighten only to the early root level.

Step 4: per-client allowance by depth. A client hosted at intermediate level ${\mathcal{l}}_i$ receives a tolerance interpolated between the root and deep endpoints for that round. With normalized depth ${\rho }_i={\mathcal{l}}_i/{\mathcal{l}}_{\max }$ (${\rho }_i=0$ at the root, ${\rho }_i=1$ at the deepest level):

$${\delta }_i^t=f_{\mathrm{tol}}({\mathcal{l}}_i,t,T)={\delta }_{\mathrm{root}}^{\left(t\right)}+{\rho }_i\left({\delta }_{\mathrm{deep}}^{\left(t\right)}-{\delta }_{\mathrm{root}}^{\left(t\right)}\right).$$

(6)

Thus a level-$L_1$ client uses ${\delta }_{\mathrm{root}}^{\left(t\right)}$, a level-$L_{\max }$ client uses ${\delta }_{\mathrm{deep}}^{\left(t\right)}$, and clients at $L_2$ (say) fall halfway between when ${\mathcal{l}}_{\max }=3$.

Step 5: per-client quarantine rule. For each client i and round $t\ge 2$, we compare metrics to the previous round and express the change as a fraction of the prior value (so a 5-point accuracy drop from 50% and from 80% are treated consistently):

$$\Delta A_i^t={\displaystyle \frac{A_i^t-A_i^{t-1}}{A_i^{t-1}}}, \Delta L_i^t={\displaystyle \frac{L_i^{t-1}-L_i^t}{L_i^{t-1}}}.$$

(7)

$\Delta A_i^t>0$ means accuracy improved; $\Delta L_i^t>0$ means loss decreased (also an improvement). Validation accuracy and loss trends are computed the same way. Client i is quarantined for round t only if any one of its four trends falls below $-{\delta }_i^t$—that is, if accuracy drops by more than ${\delta }_i^t$ relative to the prior round, or loss rises by more than ${\delta }_i^t$, on either the training or validation split. Excluded clients may rejoin in a later round when their trends recover; quarantine does not permanently ban a client.

Root global-backbone rejection. The root has no local clients; after bottom-up FedPer aggregation it evaluates the candidate global shared backbone on the CIFAR-10 test set. If the global validation-accuracy or validation-loss trend relative to the last accepted round falls below $-{\delta }_{\mathrm{root}}^{\left(t\right)}$, the round fails and the previous accepted ${\mathit{\theta }}^{\mathrm{sh}}$ is retained and broadcast unchanged.

Algorithm 1 summarizes the per-round defense loop and aggregation implemented in FLVaccin.

Algorithm 1 Trend-based quarantine with vaccination-calibrated tolerances

Require:  Tree $\mathcal{T}$, round t, total rounds T, client metrics $\{A_i,L_i\}$ Ensure:  Set of clients $\mathcal{S}$ included in FedPer aggregation   1: if  $t=1$  then   2:        Quarantine all clients; record baseline metrics; return ∅   3: end if   4: for each client i hosted at tree level ${\mathcal{l}}_i\ge 1$ do   5:        ${\delta }_i\leftarrow f_{\mathrm{tol}}({\mathcal{l}}_i,t,T)$                                              ▹ depth- and round-adaptive allowance   6:        Compute $\Delta A_i^t$, $\Delta L_i^t$ and validation trends vs. round $t-1$   7:        if any trend $<-{\delta }_i$ then   8:              Quarantine client i for round t                                            ▹ per-client, per-round   9:        else 10:              Add i to candidate set $\mathcal{S}$ 11:        end if 12: end for 13: FedPer-aggregate shared backbones bottom-up over non-quarantined models in $\mathcal{S}$ 14: ${\delta }_{\mathrm{root}}\leftarrow f_{\mathrm{tol}}(0,t,T)$                                                                                    ▹ root has no clients 15: if global validation trend $<-{\delta }_{\mathrm{root}}$ then 16:        Reject candidate global backbone; keep previous accepted ${\mathit{\theta }}^{\mathrm{sh}}$ 17: else 18:        Accept and broadcast ${\mathit{\theta }}^{\mathrm{sh}}$ 19: end if

Quarantine is per-client, per-round exclusion from FedPer aggregation. The root never quarantines nodes; it only accepts or rejects the candidate global shared backbone based on its validation trend.

4. Results

4.1. Experimental Tree and Setup

All scenarios use one fixed unbalanced tree of the form illustrated schematically in Figure 3: four levels (root at level 0), 25 non-root aggregator nodes, and 100 hosted clients distributed across levels 1–3. Figure 4 shows the concrete instance used in every experimental condition. Client counts per node range from 1 to 10 with heterogeneous fan-out: for example, $N_1$ hosts 10 local clients and three child aggregators ($N_5$–$N_7$), whereas $N_{24}$ hosts one client and no children. Branches differ in depth and arity—$N_3$ fans out to four level-2 leaves ($N_{10}$–$N_{13}$), while $N_1$’s subtree reaches level 3 with nine additional aggregators—so shallow coordinators and deep edge nodes coexist in the same federation. Parenthetical numbers on each node denote hosted client counts; only the root at $L_0$ aggregates with $n_{\mathrm{root}}=0$.

Every scenario trains with hierarchical FedPer: MobileNetV2 shared features are federated bottom-up, and each client keeps a private classifier head. The same topology, Dirichlet Non-IID partitioning ($\alpha =0.5$, $N=100$), and optimization hyperparameters are used unless noted below.

Table 4. Summary of experimental scenarios and key outcomes.

Scenario	Attacks	Defense	Test Acc	Repeated K-Fold Acc
Vaccination mean	0	Off	—	30.8% (round-1 mean)
Normal baseline	0	Off	79.9%	$79.99\% \pm 0.41$
Free attack	130	Off	21.0%	$20.02\% \pm 0.42$
Attack + defense	535	Vaccination + quarantine	77.3%	$76.46\% \pm 0.39$

summarizes the four experimental conditions.

Table 4 presents an ablation study comprising four scenarios, each representing a controlled ablation on a fixed tree structure and a Non-IID data split. Scenario (A), vaccination-only calibration, quantifies the benign accuracy cost in the absence of adversaries and provides $\overline{\delta }$ for $f_{\mathrm{tol}}$. Scenario (B), the clean baseline, represents the upper bound of utility without attacks or defense, achieving 79.9% accuracy. Scenario (C), free attack, disables quarantine while maintaining hierarchical FedPer aggregation; despite a reduced number of events (130), accuracy declines to near chance, indicating that the combination of topology and FedPer is insufficient for defense. Scenario (D), attack plus defense, implements vaccination-calibrated quarantine under a more intensive schedule (535 events), resulting in recovery to 76.5% accuracy. The k-fold evaluation isolates the defense contribution as approximately 56 percentage points above the free attack scenario and only 2.6 points below the clean baseline. In scenario (D), root rejection was skipped in 5 out of 20 rounds; omitting this mechanism would permit deteriorated backbones to enter the federation, while removing per-client quarantine would revert performance toward scenario (C). Detailed per-scenario performance curves are provided in Section 4.2, Section 4.3, Section 4.4 and Section 4.5.

4.2. Vaccination Mean-Accuracy Analysis

We first quantify how node-level CIFAR-100 injection affects early global accuracy on the unbalanced tree before any adversarial stress test. Thirty independent single-round runs—each on the same fixed topology with a fresh random seed—sample configurations within three vaccination bands (10 runs per band); each band jointly draws the fraction of vaccinated non-root nodes and the per-node injection percentage uniformly at random from the same range.

The overall mean round-one global accuracy is 30.8%. Group means across the three bands—which increase both node coverage and per-node injection rate together—are: Low 34.7%, Medium 31.5%, and Hard 26.3%. Higher band severity consistently reduces first-round accuracy, reflecting the distribution shift introduced by out-of-distribution vaccine images with preserved CIFAR-10 labels. Figure 5 plots round-one global accuracy for all 30 single-round calibration runs, grouped into Low (10–25%), Medium (25–50%), and Hard (50–80%) bands (ten runs each; each percentage range applies to both node fraction and injection dose): green, yellow, and red bars show per-run accuracy with dashed tier means and a solid overall mean at 30.8%, and round-to-round spread within each band—for example, Hard ranges from 18.0% to 33.3%—captures benign volatility under random node selection and injection fractions.

Figure 6 summarizes the sampled vaccination configuration behind each run: cell color encodes the mean CIFAR-100 injection percentage across vaccinated nodes, and the “nC” label counts hosted clients at vaccinated nodes for that run. Hard bands consistently cover more nodes, vaccinate more clients, and apply higher per-node injection than Low bands, explaining the accuracy gradient above.

Compared with the clean baseline round-one accuracy of 32.1%, the Hard band shows an additional ≈8.4 percentage-point penalty relative to Low. The largest benign relative swing across these setups motivates $\overline{\delta }\approx 30\%$ for the deepest level and $\overline{\delta }/2\approx 15\%$ for the root in $f_{\mathrm{tol}}$ (Equation (6)); shallow and deep clients interpolate between these endpoints by tree depth.

4.3. Baseline Training Without Attacks

The clean baseline trains for 20 rounds without attacks, vaccination, or defense on the same unbalanced tree under FedPer. Figure 7 tracks global validation accuracy and loss at the root after each communication round: accuracy rises from 32.1% in round 1 to 79.9% at round 20 while loss falls from $1.99$ to $0.615$, with the steepest gain in early rounds and steady refinement thereafter.

Figure 8 breaks down performance across all 20 rounds, pooling per-client training and validation metrics and per-node validation at aggregators. Hosted clients reach high local training accuracy (mean 83.7%, median 85.7%) but lower validation accuracy (mean 44.6%, median 45.9%), reflecting Dirichlet Non-IID label skew; several client–round points fall below 50% training accuracy. Aggregator nodes validate near 50.3% mean accuracy with wider spread than the global model, while training loss stays near zero for most clients but validation loss shows a long tail (maximum ≈ 22.6). This heterogeneity motivates per-client monitoring in the defended scenario (Section 4.5).

We next assess the frozen global FedPer model—shared backbone with each client’s retained private head—using repeated stratified 5-fold × 10 validation (50 folds total). Final test accuracy is 79.9% with training accuracy 80.0%.

Table 5. Repeated k-fold validation statistics for the clean baseline (5-fold × 10 repeats, 50 folds; frozen global shared backbone with per-client heads).

Metric	Mean ± Std	95% CI	p-Value
Validation accuracy	$79.99\% \pm 0.41\%$	[79.87, 80.11]	$<0.001$
Validation loss	$0.592 \pm 0.011$	[0.588, 0.595]	$<0.001$

summarizes the repeated k-fold statistics.

Figure 9 shows the tight fold-wise distributions (accuracy IQR $79.6$–$80.4\%$; loss IQR $0.58$–$0.60$). Both metrics differ significantly from chance ($p<0.001$ for accuracy vs. random guessing and for loss vs. a random-classifier baseline).

Figure 10 reports the mean k-fold confusion matrix. Macro-averaged F1 is 79.6%. Recall is highest for automobile (96.9%), frog (94.1%), and ship (91.6%) and lowest for cat (52.6%), bird (61.9%), and airplane (67.5%). The dominant off-diagonal mass is cat→dog (258 mean counts) and bird→frog (130), consistent with visually similar CIFAR-10 categories under personalized heads. This run establishes the reference FedPer performance for the chosen topology and Non-IID configuration.

4.4. Free Attacks Without Defense

In the unconstrained attack scenario, the adversary launches random attacks covering all five attack types (130 events total: 29 label-flipping, 28 sign-flip, 25 model-poisoning, 24 Byzantine, 24 backdoor). Severity is set interactively per round via a Min–Max percentage band; bands across the 20-round schedule span 1–100%. No quarantine is applied—all client updates still enter hierarchical FedPer aggregation. Figure 11 tracks root-level validation metrics: accuracy mirrors the clean baseline through round 5, drops under attacks in rounds 6–10 (minimum 21.2% at round 7), recovers during attack-free rounds 11–17, peaks at 77.4% in round 18, then collapses to 21.0% at round 20 after renewed poisoning in rounds 18–20 (loss falls to $0.64$ at the peak and rises to $2.30$ at round 20; round 19 reaches 10.0% accuracy).

Figure 12 contrasts normal and attacked clients and nodes, pooled over all 20 rounds. Attacked clients show lower training accuracy (mean 56.8%, median 55.1%) and validation accuracy (mean 23.2%, median 20.2%) than normal clients (training 82.9%/84.9%; validation 42.8%/43.9%). Attacked aggregator nodes validate at a mean of 25.9% (median 17.5%) versus 46.0%/46.4% for normal nodes; attacked-client validation loss reaches 15.3%.

Figure 13 maps the 130 attack events to communication rounds 6–10 and 18–20 (no attacks in rounds 1–5 or 11–17). Cell color encodes mean severity (%); the count in each cell is the number of targeted clients for that attack type in that round. All five attack types appear in every attack round, with 10–25 attacked clients per round.

We next assess the frozen poisoned FedPer model with the same repeated 5-fold × 10 validation (50 folds). Final test accuracy is 21.0% with training accuracy 20.0%—indistinguishable from 10-class chance.

Table 6. Repeated k-fold validation statistics after free-attack training (5-fold × 10 repeats, 50 folds; frozen global shared backbone with per-client heads).

Metric	Mean ± Std	95% CI	p-Value
Validation accuracy	$20.02\% \pm 0.42\%$	[19.90, 20.14]	$<0.001$
Validation loss	$2.320 \pm 0.005$	[2.319, 2.322]	$1.000$

summarizes the k-fold statistics.

Figure 14 shows the collapsed fold-wise distributions (middle 50% of folds: accuracy 19.8–20.3%; loss 2.317–2.322).

Figure 15 reports the mean k-fold confusion matrix after collapse. Macro-averaged F1 is 10.5%. Predictions concentrate on cat (recall 45.2%), deer (82.5%), and frog (69.0%), while automobile, bird, dog, horse, and truck reach 0% recall. Hierarchical FedPer averaging alone does not contain this adaptive mixed-attack schedule.

4.5. Attacks with Trend-Based Defense

The defended scenario applies interactive attack scheduling with substantially higher volume (535 attack events: 117 backdoor, 109 model-poisoning, 106 Byzantine, 105 sign-flip, 98 label-flipping) and enables vaccination-calibrated per-client quarantine: round-one calibration of all clients, then depth- and round-adaptive allowances $f_{\mathrm{tol}}({\mathcal{l}}_i,t,T)$ (from 15% at shallow levels to 30% at depth 3 early in training, tightening by round 20), plus root-level FedPer backbone rejection when validation trends exceed the root allowance. Per-round attack severity bands are interactive; most rounds use 1–25% to 1–50% ranges, but the schedule includes at least one 80–100% round. CIFAR-100 injection is not active in this run; defense relies on the monitoring policy whose bounds were calibrated from the vaccination mean study. Figure 16 tracks root-level validation metrics under attacks in every round: accuracy rises from 28.3% at round 2 to 77.3% at round 20 while loss falls from $2.05$ to $0.66$; orange markers at rounds 10, 12, 14, 19, and 20 mark root-level backbone rejection (skip-root aggregation).

Figure 17 contrasts normal and attacked clients and nodes, pooled over all rounds (1465 normal vs. 535 attacked client–round records). Attacked clients show lower training accuracy (mean 66.0%, median 67.2%) and validation accuracy (mean 26.2%, median 25.1%) than normal clients (training 80.5%/82.8%; validation 40.9%/42.1%), but attacked aggregator nodes validate at mean 43.7% (median 46.0%)—comparable to normal nodes (42.5%/44.0%)—indicating that quarantine and root rejection limit poisoned updates before they accumulate branch-wide.

Figure 18 maps all 535 attack events and 815 quarantine events across 20 rounds. Cell color encodes mean attack severity (%); the count in each attack-type cell is the number of targeted clients for that type in that round. Attacks occur in every round (5–50 clients per round); severity peaks in rounds 18–19 (≈80–100%). Round 1 quarantines all 100 clients for calibration; subsequent rounds quarantine 14–47 clients, generally matching or exceeding the number attacked.

The system logged 815 quarantine events across 19 completed FedPer aggregation rounds after round-one calibration. Root-level backbone rejection skipped global aggregation in 5 of those rounds (10, 12, 14, 19, and 20), leaving only 14 successful root updates; nevertheless, final test accuracy is 77.3% with training accuracy 76.4%—only 2.6 percentage points below the 79.9% clean baseline (retaining 96.8% of clean accuracy) despite more than four times as many attacks as the free-attack run and despite one-quarter of post-calibration root rounds being rejected.

Table 7. Repeated k-fold validation statistics after defended training (5-fold × 10 repeats, 50 folds; frozen global shared backbone with per-client heads).

Metric	Mean ± Std	95% CI	p-Value
Validation accuracy	$76.46 \pm 0.39\%$	[76.35, 76.58]	$<0.001$
Validation loss	$0.687 \pm 0.008$	[0.685, 0.689]	$<0.001$

summarizes the repeated k-fold statistics.

Figure 19 shows the tight fold-wise distributions (middle 50% of folds: accuracy 76.2–76.8%; loss 0.680–0.693). Both metrics differ significantly from chance ($p<0.001$).

Figure 20 reports the mean k-fold confusion matrix. Macro-averaged F1 is 76.3%. Recall is highest for frog (91.9%), automobile (91.7%), and truck (88.0%) and lowest for cat (48.5%) and bird (53.9%). The dominant off-diagonal mass is cat→dog (302 mean counts) and bird→frog (130), similar to the clean baseline but at much higher overall accuracy than the undefended attack run.

5. Discussion

Our experimental program (Section 4) evaluates four conditions on one fixed unbalanced tree—25 non-root aggregators, 100 hosted clients across four levels, Dirichlet Non-IID shards ($\alpha =0.5$), and hierarchical FedPer with MobileNetV2—using the methods in Section 3. Table 4 summarizes outcomes; the subsections below interpret each stage and how they connect to the defense design.

Vaccination calibration and tolerance mapping. Before any adversarial stress test, the 30-run vaccination mean-accuracy study (Section 4.2) quantified how benign node-level CIFAR-100 injection perturbs round-one global accuracy on our tree. The overall mean is 30.8%, with band means Low 34.7%, Medium 31.5%, and Hard 26.3%—a monotonic penalty as both vaccinated-node coverage and per-node injection rise. Compared with the clean baseline’s round-one accuracy of 32.1%, the Hard band costs an additional ≈8.4 percentage points relative to Low. The largest benign relative swing across these setups ($\overline{\delta }\approx 30\%$) directly anchors $f_{\mathrm{tol}}$: deepest clients may tolerate up to $\overline{\delta }$ early in training, shallow clients and the root only $\overline{\delta }/2\approx 15\%$, with both endpoints tightening linearly to round 20 (Equations (4)–(6)). This couples auxiliary-data statistics to depth-aware monitoring rather than fixing a single global threshold.

Unbalanced topology and Non-IID heterogeneity. Hosting clients at every non-root level—not only at leaves—assigns local training to clients at intermediate aggregators, while those nodes FedPer-aggregate subtree backbones without training locally (Section 3.2). The clean baseline (Section 4.3) shows why per-client monitoring is necessary: hosted clients reach a mean training accuracy of 83.7% but a validation accuracy of only 44.6% under Dirichlet skew, while aggregator nodes validate near 50.3%, well below the global model’s 79.9%. Depth-interpolated tolerances in $f_{\mathrm{tol}}$ acknowledge that deeper branches legitimately exhibit larger metric swings than shallow coordinators whose updates propagate to the root.

Attack impact without defense. The free-attack scenario (Section 4.4) confirms that hierarchical FedPer averaging alone does not contain a mixed, severity-adaptive adversary. Despite fewer attack events (130 vs. 535 in the defended run), accuracy mirrors the clean curve through round 5, collapses to 21.2% under rounds 6–10 attacks, partially recovers during attack-free rounds 11–17 (peaking at 77.4% in round 18), then falls to 21.0% when poisoning resumes in rounds 18–20. K-fold validation (20.02% ± 0.42%) and macro F1 (10.5%) are indistinguishable from chance. Attacked aggregator nodes validate at a mean of 25.9% versus 46.0% for normal nodes—poisoned updates propagate branch-wide without filtering. This aligns with critiques that production FL threat models must assume sustained, heterogeneous attack schedules [17].

Effectiveness of trend-based quarantine. The defended scenario (Section 4.5) subjects the same tree to 535 attack events in every round (five attack types, 5–50 targeted clients per round, severity peaking at ≈80–100% in rounds 18–19) while applying the quarantine policy in Algorithm 1. Round-one calibration quarantines all 100 clients; subsequent rounds log 815 quarantine events across 19 post-calibration FedPer rounds. Per-client exclusion removes anomalous local updates before they accumulate: attacked clients validate at mean 26.2%, yet attacked nodes validate at 43.7%—comparable to normal nodes (42.5%)—showing that branch-level damage is contained even when individual shards are corrupted.

Root-level FedPer backbone rejection provides a second safety layer. Global aggregation was skipped in 5 rounds (10, 12, 14, 19, 20), leaving only 14 successful root updates—yet final test accuracy reaches 77.3% (76.46% ± 0.39% k-fold), only 2.6 percentage points below the 79.9% clean baseline (96.8% of clean accuracy). Macro F1 (76.3%) and per-class recall patterns (strong on automobile, frog, truck; weak on cat, bird) closely resemble the clean run (79.6% macro F1) rather than the collapsed free-attack confusion matrix. Training progress (Figure 16) shows stable convergence after calibration despite continuous attacks, and the attack timeline (Figure 18) correlates quarantine volume with attack bursts—including the round 18–19 severity spike.

Contextual placement relative to published defenses. Table 1 reports CIFAR-10 accuracies from prior work under heterogeneous setups. Our defended k-fold accuracy (76.5%) follows 535 mixed attacks (five families, severity 1–100%) every round on an unbalanced FedPer tree with Dirichlet Non-IID ($\alpha =0.5$). Cross-paper percentage gaps alone cannot establish ranking.

Flat single-vector defenses such as RECESS [32], FLAIR [35], BOD-hybrid [33], Sundar et al. [31], and FeRA [34], and the hierarchical SHIELD [8] baseline, differ from FLVaccin in topology, aggregation, Non-IID settings, and attack scope. The only quantitative claim we treat as rigorously supported by our own experiments is recovery to within 2.6 percentage points of our clean baseline (79.9%) under continuous mixed attacks. Section 5.1 explains why we do not reimplement third-party defenses for head-to-head scoring.

5.1. Fairness of Literature Comparison and Methodological Limitations

Why head-to-head reimplementation is not feasible. Re-running the top baselines inside FLVaccin (same tree, $\alpha =0.5$, hierarchical FedPer, mixed attacks) would be ideal, but not currently feasible for four reasons.

(i) Missing or incomplete code. Several works do not release runnable artifacts that reproduce Table 1; partial releases usually assume flat FedAvg rather than hierarchical FedPer.

(ii) Incompatible assumptions. SHIELD [8] relies on secure aggregation in a leaf-only hierarchy; flat defenses assume a single server and full-model averaging. Porting them onto our unbalanced tree with private FedPer heads would require unspecified redesign choices and cease to be a fair reproduction.

(iii) Insufficient detail. Many papers omit hyperparameters, Non-IID generators, attack schedules, or evaluation folds needed to match published percentages.

(iv) Threat-model mismatch. Our primary evidence is internal (clean vs. free-attack vs. defended; Table 4). External baselines often target a single attack family or milder Non-IID settings, so even a port would leave residual ambiguity.

Limitations of compared approaches and FLVaccin responses. Relative to Table 1:

• Flat aggregation cannot exploit tree depth or contain branch-local damage; FLVaccin uses depth-aware per-client quarantine and root backbone rejection.
• Single-vector evaluations understate mixed threats; FLVaccin runs five attack families every round.
• Secure aggregation (SHIELD) does not detect poisoned data or metric trends; FLVaccin adds vaccination-calibrated quarantine.
• Milder or unreported Non-IID settings inflate apparent robustness; FLVaccin uses $\alpha =0.5$ and calibrates tolerances from vaccination volatility.
• Full-model averaging can propagate poisoned classifiers; FedPer keeps heads private and federates only the shared backbone.

Impact of research setups. Published percentages in Table 1 are not commensurate: topology, FedAvg vs. FedPer, Non-IID concentration, attack definition, and model/training budget all shift absolute accuracy independently of defense quality.

We therefore do not claim universal superiority over higher table percentages. We claim that (1) under our protocol, quarantine recovers near-clean accuracy after free-attack collapse; (2) FLVaccin targets a harder combination of unbalanced hierarchy, FedPer, $\alpha =0.5$, and mixed continuous attacks; and (3) cross-paper percentages are contextual, not a ranking.

5.2. Theoretical Interpretation, Practicality, and Trade-Offs

The defense operates effectively because, under FedPer, only the shared backbone is averaged. As a result, a poisoned client primarily affects the federation by shifting ${\mathit{\theta }}^{\mathrm{sh}}$ in an undesirable direction, while private heads remain local. The quarantine mechanism limits this influence whenever round-over-round trends fall below $-{\delta }_i^t$. Since ${\delta }_i^t$ interpolates between vaccination-estimated benign volatility at varying depths and becomes more stringent with increasing t, this rule functions as a depth-aware sequential outlier test. Early rounds permit larger Non-IID fluctuations, whereas later rounds expect a more stable backbone. Root rejection serves as an additional safeguard on the aggregated candidate, preventing a single compromised branch average from replacing an accepted global model. The collapse under free attack arises directly from unconstrained averaging: when malicious updates are introduced into ${\mathcal{S}}_v$ at every level, errors accumulate along the path to the root.

Accuracy–loss behavior is characterized as follows. During the clean run, validation loss decreases as accuracy increases, reaching 0.615 loss at 79.9% accuracy. In the presence of free attacks, loss exceeds 2.3 as accuracy approaches chance levels. When defenses are applied, loss follows the clean trajectory after calibration, even under continuous attacks. This outcome suggests that excluding unstable clients maintains optimization progress rather than sacrificing accuracy for an alternative loss regime. However, vaccination incurs a measurable cost: Hard-band round-one accuracy is approximately 8.4 points lower than the Low setting. This reduction secures a calibrated $\overline{\delta }$ and is primarily incurred in round one, corresponding to the universal calibration quarantine.

Regarding practicality and limitations, FLVaccin utilizes only metrics already computed for logging, such as training and validation accuracy and loss, which results in minimal per-round overhead compared to local stochastic gradient descent (SGD). The method assumes the availability of a trusted validation signal at the root for backbone acceptance and trusted vaccine images at selected nodes. Deployment optimizations include caching tolerances, adapting $\overline{\delta }$ online, and integrating quarantine with secure aggregation when update confidentiality is required. Formal Byzantine resilience bounds under arbitrary non-independent and identically distributed (Non-IID) trees remain unresolved; current support is mechanistic and empirical, as evidenced by the ablation results in Table 4.

6. Conclusions

FLVaccin is a hierarchical personalized federated learning (FL) framework implemented on an unbalanced tree, where each non-root node hosts clients and FedPer aggregates shared MobileNetV2 features. The proposed defense integrates CIFAR-100 vaccination calibration with depth- and round-adaptive per-client quarantine, as well as root backbone rejection. Experimental results indicate that hierarchical FedPer alone fails under mixed poisoning attacks, while the integrated defense restores accuracy to near-clean levels. As discussed in Section 5.1, this work does not assert absolute superiority over results from incompatible literature; the primary evidence is based on controlled comparisons of clean, free-attack, and defended scenarios on the FLVaccin tree.

All experiments reported in this paper, together with the full source code, are available in the public Git repository at https://github.com/tudordavidz/FLVaccin, accessed on 20 August 2026.