Integrity Diagnostics for Cross-Silo Federated Deepfake Speech Detection Under Heterogeneity and Poisoning

1. Introduction

Voice synthesis and voice conversion have become sufficiently accessible that spoofed speech is now relevant to remote authentication, call-center fraud, social engineering, and misinformation. Humans cannot reliably identify all modern synthetic speech without technical assistance [1], and recent audio-forensics research continues to report sensitivity to attack families, codecs, compression, and other distribution shifts [2,3,4,5]. A recent review by the present authors similarly identified cross-dataset generalization, channel noise, and computational cost as persistent challenges in deepfake speech detection [6].

A practical deployment creates a second problem. Useful evidence is naturally distributed across organizations. To make this heterogeneity interpretable without implying that the public benchmark recordings came from real institutions, we use three illustrative archetypes throughout the paper: a TTS-heavy (bank-inspired) silo, a VC-heavy (operator-inspired) silo, and a channel-degraded (VoIP-inspired) silo. The labels are mnemonic deployment scenarios, not empirical models of banks, operators, or VoIP providers. Pooling raw conversations across organizations can conflict with data-minimization, confidentiality, organizational-governance, and privacy requirements. Federated learning (FL) offers an architectural alternative in which raw recordings remain local and participating organizations exchange model parameters or updates instead [7]. This reduces the need for raw-data exchange, although FL alone is not a cryptographic privacy guarantee.

The difficulty is that real cross-silo FL is neither statistically homogeneous nor fully trusted. Client datasets can differ simultaneously in attack families, channel conditions, class proportions, and size. Malicious or compromised participants may additionally poison local learning. These two factors interact: benign statistical heterogeneity can make honest updates look anomalous, while poisoning can exploit the same variation to evade simple defenses [8,9,10,11,12]. Consequently, a defense that is effective under one evaluation domain or one client composition may impose a substantial clean-data cost or fail after the channel distribution changes.

Federated speech and deepfake learning are no longer novel by themselves. Federated speaker verification has been studied for privacy-preserving voice authentication [13]; backdoor attacks have been demonstrated against federated automatic speaker verification [14]; and recent work has extended FL to multimodal, communication-efficient, and audio-specific deepfake detection [15,16,17]. In particular, FLADD combines Res2Net and Rawformer branches with adaptive aggregation and prototype guidance for audio deepfake detection [17], while FedMaxAdapt targets bandwidth-efficient sparse multimodal FL [16]. A relevant conceptual precursor is the physics-guided voice-authentication framework of Mohammadi et al. [18], which connects deepfake detection, uncertainty, edge deployment, and control-plane poisoning. These studies make clear that applying FL to deepfake detection is not, by itself, the contribution claimed here.

The contribution is deliberately empirical and methodological. We do not propose a new acoustic detector, federated optimizer, attack, aggregation rule, or deployable poisoning detector. Instead, we define an auditable cross-silo experimental protocol and report bounded observations about (i) collaboration under strongly imbalanced heterogeneous silos, (ii) failure modes caused by source dependence in audio splitting, and (iii) how malicious participation alters optimization geometry and defense interpretation. The LFCC+frozen-WavLM detector is a reproducible acoustic case-study vehicle; the illustrative silo archetypes separate attack-family and channel heterogeneity; and the controlled synthetic experiments isolate mechanisms that cannot be cleanly varied in the archived audio workflow.

This article makes four contributions. First, it independently audits the archived ASVspoof construction at the source/provenance level, confirms substantial dependence in the historical seed-42 holdout, and replaces the principal audio comparison with five source-disjoint splits verified against the complete A+B+C fit pool. Second, it performs a matched multi-seed comparison of pooled training, FedAvg, and local-only A/B/C baselines using the same architecture, initialization per seed, fit-data pool for pooled/FedAvg, global class weights, batch size, learning rate, data-pass budget, and fixed endpoint; because all five models are evaluated on the same Client-C holdout, the local A/B rows are interpreted as cross-domain transfer baselines rather than as native-domain collaboration gains. Third, it evaluates poisoning and robust aggregation with a diagnostic set that separates deployable server-observable quantities from oracle/post-hoc quantities requiring known malicious identities. Fourth, it tests the stability and limits of the update-cancellation mechanism in reproducible 20-seed controlled experiments spanning IID/non-IID conditions, four classifier topologies, FedProx sensitivity, fixed-identity malicious-weight controls, defense-parameter sensitivity, and five adversarial behaviors. These experiments strengthen mechanism-level inference but do not establish external acoustic generalization or a new universal defense.

Two corrections to the historical audio interpretation are explicit. First, the official ASVspoof 2019/2021-to-VCTK/VCC mapping reproduces the reported 70.37% bona-fide source dependence in the historical Client-C row split. When bona-fide and voice-conversion derivatives are placed in one shared audio-source namespace and the complete A+B+C fit pool is audited, dependence is still stronger: 74.72% of historical bona-fide holdout files and 99.80% of spoof holdout files share a canonical source/provenance key with fit data. The historical 1.923% FedAvg EER is therefore retained only as workflow provenance and is not used to establish independent-recording performance. Second, ASVspoof 2021 Logical Access (LA) is historically linked to the ASVspoof 2019 LA evaluation lineage and retains the A07–A19 spoofing algorithms while adding telephony and Voice over Internet Protocol (VoIP) transmission conditions [19,20]. Consequently, post-federation 2019 scores are diagnostic only. The principal audio evidence is the new five-seed source-disjoint, protocol-matched 2021 evaluation; external-corpus generalization remains outside the claims.

2. Related Work

2.1. Audio Deepfake Detection Under Distribution and Channel Shift

The ASVspoof challenges established common datasets and metrics for automatic speaker verification spoofing countermeasures [19,21,22,23]. Modern detectors span raw-waveform architectures such as RawNet2 [24], spectro-temporal graph models such as Audio Anti-Spoofing using Integrated Spectro-Temporal Graph Attention Networks (AASIST) [25], handcrafted spectral representations, and large self-supervised speech models. WavLM [26] is particularly attractive as a frozen representation backbone because it provides a high-dimensional speech representation without requiring every federated participant to fine-tune a large transformer.

Strong in-domain performance does not imply reliable cross-condition operation. Spectral and hybrid detectors remain sensitive to codec mismatch, unseen generators, noise, and adversarial manipulation [2,3,4,5]. This motivates evaluating attack-family and channel heterogeneity separately instead of treating all non-IID variation as one abstract statistical parameter.

2.2. Federated Speech, Voice Security, and Deepfake Detection

Federated Speaker Verification with Personal Privacy Preservation (FedSP) demonstrates privacy-oriented federated speaker verification [13]. Subsequent work has shown that federated voice systems are themselves attack targets: Meng et al. demonstrate stealthy backdoor attacks on federated automatic speaker verification [14], and related speech-security research continues to explore channel-aware and privacy-aware federated settings [27,28].

Federated deepfake detection has also expanded beyond speech-only scenarios. Blfgeh and Ardah [15] propose a privacy-preserving multimodal framework spanning audio, video, and text. Manzoor et al.’s FedMaxAdapt focuses on gradient-guided adaptive sparsity and communication efficiency across audio and video modalities [16]. Most directly, Fan et al. propose FLADD, an audio-specific federated deepfake detector combining Res2Net and Rawformer branches with Multi-Factor Adaptive Weighting and dual prototypes [17]. These systems establish strong detection-oriented FL baselines. Their objectives and evaluation protocols, however, differ from the present integrity-focused question: none is a drop-in, same-protocol comparator for the archived cross-silo poisoning experiment. We therefore report their published numerical results explicitly, avoid cross-paper ranking, and complement that context with protocol-matched controlled architecture and attack ablations.

2.3. Poisoning and Byzantine-Robust Federated Learning

The federated-learning security literature covers data poisoning, model poisoning, backdoors, Byzantine clients, and privacy leakage [29]. Classical defenses include Krum [30], clipping and smoothing strategies such as Certifiably Robust Federated Learning (CRFL) [31], coordinate-wise robust statistics, and secure-aggregation-compatible methods such as the Robust Federated Learning Framework Against Poisoning Attacks with Secure Aggregation (RFLPA) [32]. Jeong et al. [33] use representational similarity to identify malicious updates in a robust model-poisoning defense.

Recent work has increasingly focused on the interaction between poisoning and non-IID data. Dynamic Byzantine-Robust Privacy-Preserving Federated Learning (DBFL) combines Byzantine robustness and privacy mechanisms under heterogeneous distributions [9]; Cross-Silo Privacy-Preserving Federated Prototype Learning Against Data Poisoning Attacks (PPFPL) addresses poisoned non-IID clients [10]; Fang et al. explicitly target poisoning under non-IID edge data [11]; Wang et al. combine secure aggregation with gradient-median and layer-wise cosine signals [34]; Khang et al. emphasize false positives caused by benign heterogeneity [12]; and Latif et al. use density/cosine-distance structure against colluding model-poisoning clients [35]. Update magnitude and conflicting directions have also been connected to instability in federated intrusion detection [36,37,38].

These studies motivate two choices in the present work: defenses are evaluated for both attacked utility and clean-data distortion, and update geometry is treated as an integrity diagnostic rather than relying only on terminal classification performance.

2.4. Positioning

Table 1 compares the nearest federated speech/deepfake lines of work at the level of experimental purpose rather than a wide set of binary flags. Table 2 then provides quantitative published-results context. The values in Table 2 are not a common leaderboard: the studies use different datasets, partitions, modalities, architectures, client constructions, training budgets, and metrics. In particular, the source-disjoint 4.622% FedAvg mean EER is measured on five source-disjoint splits of a repurposed ASVspoof 2021 LA client domain and cannot be equated with an official challenge evaluation. The table is included to make the detection-performance context transparent, while the protocol-matched experiments in Section 5.5 and Section 5.6 test the present mechanism under controlled alternatives. No literal head-to-head reproduction of FLADD or FedMaxAdapt is claimed: both methods couple their reported performance to architectures, modalities, aggregation rules, and raw-data protocols that are not represented by the present cached 808-dimensional feature pipeline. A faithful common-protocol reproduction is therefore treated as a remaining limitation rather than approximated with a methodologically different surrogate.

3. System Model and Research Questions

3.1. Cross-Silo Communication Scenario

The target is cross-silo FL among a small number of administrative domains rather than cross-device FL among thousands of consumer devices. Three illustrative profiles motivate the partition: a TTS-heavy (bank-inspired) domain, a VC-heavy (operator-inspired) domain, and a channel-degraded (VoIP-inspired) domain. They are mnemonic archetypes constructed from public ASVspoof data to expose semantically different sources of non-IID behavior; they are not statistical models of actual institutions and no proprietary institutional recordings are used.

The system is server-coordinated. A coordinator broadcasts the current trainable classifier, each client performs local optimization, and the coordinator aggregates returned parameters or updates. In the target deployment, raw audio is intended to remain local. The reported experiments emulate this workflow over client-assigned cached features in a shared research environment rather than over physically separate organizational infrastructure. The coordinator is trusted to execute the declared aggregation rule but can observe plaintext classifier updates; cryptographic secure aggregation is outside the implemented system.

3.2. Detection and Heterogeneity Model

For an audio sample x, the detector $f_{\theta }$ outputs the probability of bona fide or spoofed speech. Client k has local distribution

$$P_k(x,y)=P(x,y\mid {\mathcal{A}}_k,{\mathcal{C}}_k),$$

(1)

where ${\mathcal{A}}_k$ denotes its attack-family profile and ${\mathcal{C}}_k$ its channel/codec profile. The setting is non-IID—that is, not independent and identically distributed—when $P_i(x,y)\ne P_j(x,y)$ for at least some clients $i\ne j$.

3.3. Threat Model

A fraction of clients can be compromised and intentionally distort local learning. The archived audio experiment implements untargeted label flipping, $y\leftarrow 1-y$, before every local-training round; it is retained because its trajectory is directly recoverable from the archived artifacts. To test whether the diagnostics are informative only for that single attack, four additional controlled adversarial behaviors are evaluated at 30% compromised clients: (i) targeted spoof-to-bona-fide label poisoning; (ii) a trigger backdoor that shifts one surrogate feature coordinate for 30% of malicious-client spoof samples and relabels them bona fide; (iii) zero-update free riding; and (iv) coordinated sign-flip model poisoning in which compromised clients submit a common update equal to $-3$ times their pre-attack mean update. These mechanisms span untargeted/targeted data poisoning, a targeted trigger, low-quality/non-contributing clients, and coordinated model poisoning. They are deliberately transparent stressors, not claims to reproduce every adaptive real-world attack.

The study still excludes adaptive defense-aware optimization, identity proliferation by a real Sybil mechanism, coordinator compromise, model inversion, gradient inversion, and cryptographic privacy attacks. The coordinated sign-flip condition models colluding malicious updates but not the process of creating additional identities. Accordingly, the scope is broadened beyond one poisoning mechanism while universal Byzantine, backdoor, Sybil, or privacy robustness remains explicitly outside the claims.

Figure 1. Target cross-silo system model. Raw audio is intended to remain local in deployment; the reported experiments emulate the workflow using client-assigned cached features. The ten-client poisoning experiments are shards of the three domain profiles, not ten independent organizations.

Figure 1. Target cross-silo system model. Raw audio is intended to remain local in deployment; the reported experiments emulate the workflow using client-assigned cached features. The ten-client poisoning experiments are shards of the three domain profiles, not ten independent organizations.

3.4. Research Questions

The article is organized around four research questions (RQs):

RQ1.

After enforcing source-disjoint audio splits and matching training protocols, how does FedAvg compare with pooled centralized training and local-only A/B/C baselines on the common Client-C holdout, and what does this reveal about cross-domain transfer under severe client imbalance?

RQ2.

What does the official source/provenance audit reveal about the archived audio evaluation, and how does the 2019–2021 dataset lineage constrain interpretation of historical channel-shift and post-federation scores?

RQ3.

How do malicious participation and aggregation defense interact under heterogeneous clients across several adversarial behaviors, including clean-data cost, malicious aggregation weight, structural versus excess client exclusion, and attack-specific failure modes?

RQ4.

Does update-level geometry explain the non-monotonic or transient global EER observed under poisoning, and does the cancellation signature persist across alternative classifier topologies and FedProx regularization?

Figure 2. Evidence flow used in the journal version. The controlled surrogate experiment isolates the mechanism suggested by the audio case study; it is not treated as a replacement for external audio validation.

Figure 2. Evidence flow used in the journal version. The controlled surrogate experiment isolates the mechanism suggested by the audio case study; it is not treated as a replacement for external audio validation.

4. Materials and Methods

4.1. Detector Architecture

The archived feature-extraction notebook specifies the detector pipeline. Audio is read at 16 kHz and normalized to 64,600 samples (approximately 4.04 s): longer recordings are truncated and shorter recordings are repeat-padded. The first branch computes 20 linear-frequency cepstral coefficients (LFCCs) with spafe.features.lfcc.lfcc using fs=16000 and num_ceps=20. No other LFCC arguments are passed, so they inherit the spafe defaults of the historical environment; because the exact installed spafe version was not recorded, those secondary defaults are not reconstructed post hoc. Mean and standard-deviation pooling over time produces a 40-dimensional LFCC vector.

The second branch uses the frozen Hugging Face model microsoft/wavlm-base-plus [26]. The notebook takes last_hidden_state and mean-pools it over time, producing a 768-dimensional WavLM representation. WavLM parameters are frozen, so only the task classifier is trained and exchanged during FL. The model identifier is preserved, but the historical Hugging Face revision hash was not pinned. The fused feature vector is

$$z=[z_{\mathrm{LFCC}};z_{\mathrm{WavLM}}]\in {\mathbb{R}}^{808}.$$

(2)

The multilayer perceptron (MLP) classifier has topology $808\to 256\to 64\to 2$, rectified linear unit activations, dropout probability $p=0.3$, and a two-class softmax output. It contains 223,682 trainable parameters. The archived 2019-only centralized training uses class-weighted cross-entropy with class weight $N/\left(2N_c\right)$ for class c, Adam with learning rate ${10}^{-3}$, training batch size 64, development/evaluation batch size 128, and 30 epochs; the checkpoint with the lowest development-set EER is retained. Exact historical package versions were not recorded by the notebook and are therefore not reconstructed post hoc.

Figure 3 makes explicit which components are frozen, trainable, communicated, and observed by the integrity diagnostics. Only the 223,682-parameter MLP classifier is optimized and exchanged; LFCC extraction and WavLM are representation stages. This distinction matters for interpreting both communication cost and the scope of the poisoning analysis.

4.2. ASVspoof Data and Institution-Inspired Partition

The archived client-construction notebook constructs three deterministic public-data silos. Clients A and B use the official ASVspoof 2019 Logical Access (LA) training and development partitions [21]. Four text-to-speech (TTS) systems (A01–A04) form the TTS-heavy (bank-inspired) spoof profile and two voice-conversion (VC) systems (A05–A06) form the VC-heavy (operator-inspired) profile. Bona-fide samples are divided reproducibly between A and B by alternating their order. Client C uses the complete released ASVspoof 2021 LA evaluation feature cache [19]; it is repurposed as a labeled channel-degraded (VoIP-inspired) client domain rather than used in its original challenge-test role.

The historical workflow applied torch.manual_seed(42), randomly permuted Client C at the file-row level, allocated $\lfloor 0.2N_C\rfloor =36,313$ files to a holdout, and used the remainder for local training. An independent source-level audit identified that this row-wise split can place channel/codec-derived variants of the same underlying source on both sides. We therefore retain that split only as historical provenance and replace the principal evaluation with the source-disjoint protocol in Section 4.5.

Table 3. Institution-inspired non-IID partition generated by the archived client-construction notebook.

Client	Source	Profile	Bona fide	Spoof	Total
TTS-heavy, bank-inspired (A)	ASVspoof 2019 LA train+dev	TTS only (A01–A04)	2,564	30,064	32,628
VC-heavy, operator-inspired (B)	ASVspoof 2019 LA train+dev	VC only (A05–A06)	2,564	15,032	17,596
Channel-degraded, VoIP-inspired (C)	ASVspoof 2021 LA	Mixed A07–A19 lineage with telephony/VoIP degradation	18,452	163,114	181,566

Table 3. Institution-inspired non-IID partition generated by the archived client-construction notebook.

Client	Source	Profile	Bona fide	Spoof	Total
TTS-heavy, bank-inspired (A)	ASVspoof 2019 LA train+dev	TTS only (A01–A04)	2,564	30,064	32,628
VC-heavy, operator-inspired (B)	ASVspoof 2019 LA train+dev	VC only (A05–A06)	2,564	15,032	17,596
Channel-degraded, VoIP-inspired (C)	ASVspoof 2021 LA	Mixed A07–A19 lineage with telephony/VoIP degradation	18,452	163,114	181,566

This construction introduces attack-profile heterogeneity, channel heterogeneity, class imbalance, and client-size imbalance. Before any Client-C holdout, C is approximately 5.6 times larger than A and 10.3 times larger than B. In the corrected five-seed protocol its training share varies from 74.19% to 74.40% of the pooled A+B+C fit data (mean 74.32%), making a local-C baseline essential for distinguishing cross-domain transfer effects from simple dominance by the largest silo.

4.3. Dataset-Lineage and Source-Dependence Audit

The official ASVspoof 2019/2021-to-VCTK/VCC mapping [20] was parsed by utterance identifier and linked to the exact Client-C cache. For bona-fide trials, provenance is the original VCTK recording. For VC spoof trials, provenance is the source VCTK recording. For TTS spoof trials, for which no source recording exists, provenance is the normalized source text, hashed after deterministic normalization. This deliberately conservative grouping keeps related channel/codec variants and related generated derivatives on the same side of a split.

Reconstructing the archived seed-42 row-wise split reproduces the reported direct bona-fide audit exactly: 2,572 of 3,655 holdout files (70.37%) share their original VCTK recording with Client-C training files. We then apply a stricter unified-source audit in which a bona-fide recording and every VC derivative of that same recording share one AUDIO_SOURCE:<VCTK-ID> key, while TTS trials use a TEXT_SOURCE_SHA256 key derived from normalized input text. Against the complete A+B+C fit pool, 2,731/3,655 historical bona-fide holdout files (74.72%) and 32,593/32,658 spoof holdout files (99.80%) share a canonical source/provenance key. These are related variants, not necessarily byte-identical files. The historical 1.923% FedAvg holdout EER therefore cannot establish performance on independent recordings and is moved to Appendix A as a provenance result only.

The stricter audit also shows that 39,439 of 181,566 Client-C rows (21.72%) have a canonical source key already present in the fixed A+B fit data, involving 1,009 shared source keys. The corrected split procedure therefore forbids such rows from entering the holdout and verifies the holdout against the complete A+B+remaining-C fit pool, not only against Client-C training. ASVspoof 2021 LA is historically linked to the 2019 LA evaluation lineage and retains A07–A19 while adding telephony/VoIP conditions [19]. Consequently, post-federation 2019 scores remain diagnostic rather than evidence of unseen-attack generalization. The corrected evaluation rules are: (i) primary audio comparisons use source-disjoint Client-C holdouts verified against the complete fit pool; (ii) historical row-wise results are labeled non-independent; (iii) post-federation 2019 scores are lineage diagnostics; and (iv) no external-corpus generalization to ASVspoof 5 [22] or in-the-wild audio is claimed.

4.4. Archived Audio Pipeline and Artifact Verification

The reproducibility package contains the recovered feature-extraction/training notebooks, client-construction and federated-training notebooks, poisoning/defense workflow, checkpoints, histories, and archived score files. These files preserve the historical experiment and make the origin of the historical results auditable.

Verification claims are now separated by what can actually be recomputed. Archived EERs for the released score files are independently recomputed from per-example scores. Checkpoint tensor shapes, parameter counts, and stored training histories are checked structurally. Historical t-DCF values are retained as notebook-output provenance; matching a saved notebook value is not described as an independent predictive verification because the complete external ASV-score input required for a fresh t-DCF recomputation is not released in the archived package. The newly corrected audio experiment closes this reproducibility gap for its principal EER comparisons by releasing every split assignment, per-example score file, exact checkpoint, SHA-256 checkpoint–score linkage, and an executable script that recomputes EER directly from those scores.

4.5. Corrected Source-Disjoint Matched Audio Evaluation

Five corrected Client-C splits are generated with seeds 42, 123, 2026, 31415, and 65537. Bona-fide and VC-derived trials that resolve to the same original VCTK recording use one shared AUDIO_SOURCE key; TTS trials are grouped by a SHA-256 hash of normalized source text. Before splitting, every Client-C row whose canonical key already occurs in the fixed A+B fit data is forced to training. This rule affects 39,439 of 181,566 Client-C rows (21.72%) spanning 1,009 canonical source keys. Stratified group splitting is then applied to the remaining eligible Client-C source groups. For each seed, candidate StratifiedGroupKFold partitions with $n_{\mathrm{splits}}=3,\dots ,8$ are enumerated, and the holdout fold is selected by minimizing the sum of relative deviations from the pre-specified 20% targets for total, bona-fide, and spoof holdout counts. Model outputs, EER, or any other performance metric are not used to select a split. An independent verifier reparses the official ASVspoof metadata and confirms, for every seed, zero canonical-source overlap, zero audio-source overlap, and zero TTS-source-text overlap between the holdout and the complete A+B+remaining-C fit pool. Holdout sizes range from 35,630 to 37,236 files, including 4,442–4,713 bona-fide and 31,081–32,588 spoof trials. Exact utterance identifiers, labels, source types/keys, attack labels, codecs, transmission conditions, and train/holdout assignments are released for all five splits.

For each seed we compare five models: pooled centralized training, FedAvg over A/B/C, local A only, local B only, and local C only. All use the same 808-dimensional LFCC+WavLM input and the same $808\to 256\to 64\to 2$ classifier. For pooled and FedAvg training, the fit-data pool is identical: all A and B examples plus only the Client-C training rows for that seed. The model initialization is shared across methods within a seed. All methods use globally computed class weights, Adam with learning rate ${10}^{-3}$, batch size 256, 15 rounds of three epochs (45 data passes per example), and a fixed final endpoint; no validation-based checkpoint selection is used. Pooled training deliberately resets Adam at each matched round, paralleling the local-optimizer reset in FedAvg. Local-only baselines use the same initialization, optimizer settings, global class weights, and 45-pass budget on their own silo data. All five models are evaluated on the same Client-C holdout. Consequently, the local-A and local-B rows quantify transfer from A/B into the C evaluation domain; they do not measure whether federation improves performance on the native A or B domains.

Across the five seeds we report the mean EER, sample standard deviation, and two-sided Student-t 95% CI. Paired FedAvg-minus-baseline EER differences are also summarized across the same seeds. This design does not transform the repurposed 2021 domain into an external benchmark, but it removes the identified source dependence against the full fit pool and the major optimization/model-selection mismatches that invalidated causal interpretation of the historical FedAvg-versus-pooled comparison.

4.6. Federated Optimization

Let ${\theta }^{\left(t\right)}$ be the global classifier at communication round t, K the number of participating clients, $D_k$ the local dataset, $n_k=\left|D_k\right|$, and ${\theta }_k^{(t+1)}$ the locally optimized classifier returned by client k. The archived federated-training implementation creates deterministic shuffled loaders with generator seed 42 and batch size 64 for each client. Each client performs $E=3$ local epochs with Adam at learning rate ${10}^{-3}$ and class-weighted cross-entropy. For FedAvg, the coordinator computes [7]

$${\theta }^{(t+1)}={\displaystyle \sum _{k=1}^K}{\displaystyle \frac{n_k}{{\sum }_j{n}_j}}{\theta }_k^{(t+1)}.$$

(3)

FedProx adds [39]

$${\displaystyle \frac{\mu }{2}}{\parallel {\theta }_k-{\theta }^{\left(t\right)}\parallel }_2^2$$

(4)

to the local loss. The archived audio comparison uses 15 rounds and $\mu =0.1$.

The historical pooled/FedAvg/FedProx comparison used unequal protocols: the pooled model reserved 10% for validation, trained for 20 epochs with batch size 128 and best-validation checkpoint selection, whereas FedAvg/FedProx used all local fit data, client-specific class weights, three local epochs per round, and a fixed 15-round endpoint. Those archived values are therefore treated only as historical provenance in Appendix A. The corrected matched protocol is specified separately in Section 4.5. Because the archived FedProx run also used only one $\mu$ and one horizon, FedProx generalization is examined in the controlled mechanism experiment rather than inferred from that single historical audio run.

4.7. Audio Poisoning Experiment and Update Diagnostics

The archived poisoning/defense notebook subdivides the three source domains into ten emulated clients while preserving their parent-domain profiles: A into two shards, B into two, and the Client-C training subset into six. Sharding uses generator seed 42. This construction permits 10%, 20%, and 30% compromised-client fractions; the ten shards are an experimental device, not ten independent institutions. For each experiment, Python’s random.Random(123) defines a reproducible malicious-client ordering. In the archived audio tensors, label 1 denotes bona fide and label 0 denotes spoof; compromised clients apply label flipping, $y\leftarrow 1-y$, while leaving the rest of local training unchanged.

Four archived aggregation modes are available. Unprotected training uses size-weighted FedAvg. Norm clipping limits the ${\ell }_2$ norm of a client’s model update to 20.0; the notebook records three clean probe norms of 21.412, 19.096, and 14.403 (mean 18.304) used to motivate that scale. Coordinate-wise trimmed mean removes the two largest and two smallest client values independently for every parameter coordinate ($k=2$) and averages the remaining six. The uncertainty-screening prototype performs 10 Monte Carlo Dropout passes on a coordinator-side reference slice, computes the mean sample-wise standard deviation of bona-fide probabilities, and flags a client when its deviation from the median exceeds 2.5 median absolute deviations (MADs). The reference slice is the first 2,000 ASVspoof 2019 evaluation embeddings. This archived audio rule is not the same defense as the synthetic uncertainty rule below: it uses mean sample-wise probability standard deviation and a 2.5-MAD rejection threshold, whereas the synthetic prototype uses epistemic uncertainty (predictive entropy minus expected entropy), a 3.5-MAD threshold, and an additional minimum-client safety rule. Their results are therefore reported as two distinct exploratory screening prototypes, not as direct replications of one defense.

That last design choice creates an important evaluation coupling: the 2019 evaluation set is partly used by the uncertainty defense itself. Consequently, 2019-domain EER values for the uncertainty-screening rows are reported only as exploratory diagnostics and are not interpreted as independent evaluation. The 2021 held-out subset is not used by the screening rule. For every poisoning/defense condition, the archived summary reports the mean EER over the final five of 15 rounds; honest-client FPR is reported for uncertainty screening.

For update geometry, the notebook computes the cosine similarity between size-weighted mean benign and malicious update directions,

$$cos({\overline{\Delta }}_b,{\overline{\Delta }}_m)={\displaystyle \frac{{\overline{\Delta }}_b^{\top }{\overline{\Delta }}_m}{\parallel {\overline{\Delta }}_b{\parallel }_2{\parallel {\overline{\Delta }}_m\parallel }_2}},$$

(5)

and compares the norm of the aggregate update from all clients with the aggregate from benign clients only. Negative cosine similarity indicates directional opposition. A norm ratio below one means that the all-client aggregate step is attenuated relative to the benign-only aggregate; directional cancellation is inferred only when attenuation is accompanied by negative benign–malicious alignment or other directional evidence.

4.8. Controlled Mechanism-Replication Stress Test

A separate surrogate experiment tests RQ3–RQ4 under a fully specified and executable setting. It is not an audio-detector benchmark and is not used to claim ASVspoof generalization. Its purpose is to isolate update cancellation, quantify random-seed uncertainty beyond the single archived audio trajectory, and stress-test defense-rule assumptions under controlled variations that were not part of the original audio experiment.

Each sample is a 32-dimensional Gaussian embedding generated deterministically from a recorded seed; coordinates are dimensionless and have no acoustic interpretation. Three domains differ in feature shifts, Gaussian scale, spoof-class directions, and class proportions, with the exact generator parameterization reported in Appendix E. Client sizes are scaled from the audio-partition proportions $(32,628,17,596,145,253)$, where the last value approximates 80% of Client C. Exactly 4,000 training samples are allocated across ten clients in the 2/2/6 pattern, with client counts $(334,334,180,180,496,496,495,495,495,495)$. Three balanced domain test sets contain 900 samples each and are concatenated into an equally domain-weighted pooled test set. A separately generated balanced reference set contains 192 samples (64 per domain) and is used only by the synthetic uncertainty rule. For implementation convenience in this surrogate, label 1 denotes spoof and label 0 denotes bona fide; score orientation is handled consistently in EER computation. The surrogate classifier is an MLP $32\to 16\to 2$ with dropout 0.3. It uses three full-batch local Adam epochs at learning rate 0.01 for 15 rounds.

A heterogeneity coefficient $h\in [0,1]$ interpolates between shared client distributions ($h=0$, IID with respect to the modeled domain parameters) and the full three-domain shifts ($h=1$, the primary non-IID condition); $h=0.5$ provides an intermediate ablation. Client-size imbalance is retained in all three conditions so that statistical heterogeneity can be separated from size-weighting effects.

Label flipping is applied to 0%, 10%, 20%, or 30% of clients. In addition to the compromised-client fraction, we record the malicious aggregation-weight fraction, i.e., the sum of FedAvg sample weights assigned to malicious clients. The primary random-client experiment evaluates six aggregation configurations:

1.

size-weighted FedAvg;

2.

$L_2$-norm clipping with $\tau$ fixed to the median clean round-1 client-update norm;

3.

coordinate-wise trimmed mean with $k=2$ values removed from each tail;

4.

coordinate median;

5.

Multi-Krum using the declared number f of compromised clients and selecting $n-f-2$ updates after Krum scoring [30];

6.

uncertainty screening using a trusted 192-sample balanced reference set, 10 Monte Carlo Dropout passes, epistemic uncertainty (predictive entropy minus expected entropy), a median-absolute-deviation robust z threshold of 3.5, and a safety rule retaining all clients if fewer than three would remain.

Norm clipping retains the FedAvg sample-size weights, whereas trimmed mean, coordinate median, and Multi-Krum aggregate coordinates/selected updates without those weights, following the implemented baselines. The Multi-Krum setting with the true f is an oracle/favorable knowledge assumption, not a realistic guarantee that the server knows the number of compromised clients. We therefore additionally test $\widehat{f}\in \{1,2,3\}$ at an actual 30% compromise rate. Trimmed mean is similarly tested with $k\in \{1,2,3\}$. The uncertainty rule explicitly assumes access to a small trusted coordinator-side reference set; this is an operational assumption of the defense rather than a property of FL itself.

Four additional controls are used. First, the IID/mild/full non-IID ablation is run at 20% compromise for unprotected FedAvg, Multi-Krum, and uncertainty screening. Second, to distinguish poisoning from simple client absence, the same randomly selected clients are removed rather than label-flipped at 10% and 30% selection levels. Third, because the archived low-weight/random/high-weight client-selection comparison changed both client identity/domain and aggregation weight, it is no longer used to isolate the causal effect of malicious mass. The fixed-identity control instead holds the same malicious clients and their local data and rescales only their total server aggregation mass to 15%, 30%, or 45%, with benign weights renormalized correspondingly. Fourth, Multi-Krum honest-client FPR is decomposed into the structural exclusion floor implied by the fixed $n-f-2$ selection quota (assuming all malicious clients are rejected) and any excess honest exclusion beyond that floor.

All primary controlled experiments use 20 seed-specific runs (seeds 0–19). For each seed/configuration, the main EER is the mean of the final five rounds. Across seeds, we compute the mean, sample standard deviation, and two-sided 95% confidence interval (CI) based on Student’s t distribution, $\overline{x}\pm t_{0.975,19}s/\sqrt{20}$. Tables report the mean ± CI half-width; the package retains the corresponding standard deviations. For transient-trajectory analysis, the seed—not an individual communication round—is the inferential unit: the fraction of rounds with poisoned EER below the seed-matched clean EER is computed within each seed and summarized across seeds. Seed–round counts are reported only descriptively.

The same generator is used for a clean FedProx sensitivity sweep with 30 rounds for every $\mu \in \{0,0.001,0.01,0.1,1\}$, ensuring an equal optimization horizon. Monte Carlo uncertainty evaluation saves and restores the pseudo-random-number-generator state so that the defense evaluation does not alter subsequent stochastic training draws. All scripts, seeds, configurations, generated result tables, and figure-generation code are included in the reproducibility package.

4.8.1. Additional Architecture, Optimizer, and Multi-Threat Analyses

To test architecture dependence without conflating the question with a separate raw-audio architecture reproduction, the same 20-seed generator, client allocations, local epochs, learning rate, round count, malicious-client selection, and full non-IID condition are reused with four trainable classifiers: a linear $32\to 2$ model (66 parameters), an MLP $32\to 8\to 2$ (282 parameters), the reference MLP $32\to 16\to 2$ (562 parameters), and a deeper MLP $32\to 32\to 16\to 2$ (1,618 parameters). Each architecture is evaluated clean and under 30% random-client untargeted label flipping. Because the data and attack are fixed, differences isolate classifier topology rather than a changed benchmark protocol.

A second sensitivity study repeats the 30% untargeted-label-flip condition with FedProx coefficients $\mu \in \{0,0.01,0.1,1\}$ over the same 15-round horizon. A third study evaluates the five attack families defined in Section 3.3 under unprotected FedAvg, coordinate-wise trimmed mean ($k=2$), and Multi-Krum with the declared $f=3$. The backdoor condition additionally reports attack success rate (ASR), defined as the percentage of triggered spoof test samples classified as bona fide. All additional controlled experiments use 20 seed-specific runs and the same final-five-round / Student-t summary rule as the primary controlled experiment. Exact scripts and per-round outputs are included in the reproducibility package.

4.9. Evaluation Metrics

The main detector metric is equal error rate (EER), the operating point at which false acceptance rate and false rejection rate are equal. The corrected matched-audio analysis in Table 4 uses the released receiver-operating-characteristic (ROC) point evaluator on source-disjoint per-example score files, and the accompanying executable script recomputes every reported EER directly from those files. The historical Appendix B retains the archived ASVspoof 2019 EER and minimum tandem detection cost function (t-DCF) values [23] as provenance rather than as the principal federation comparison. For those historical artifacts, EERs are independently recomputed where score files are available; archived t-DCF values are not described as independently recomputed because the external ASV-score input required for a fresh t-DCF calculation is not contained in the original release. The archived federated-training notebook constructs an ROC curve with sklearn.metrics.roc_curve, selects the sampled threshold minimizing the absolute difference between the false positive rate (FPR) and false negative rate (FNR), and reports the FPR at that point. The official ASVspoof/AASIST evaluation script instead reports the mean of false rejection and false acceptance rates at the closest discrete operating point [25]; this implementation difference explains the few-thousandths-of-a-percentage-point discrepancies retained in the historical audit for the same checkpoints.

For client-selection defenses in the controlled stress test, malicious-client true positive rate (TPR) is the proportion of malicious clients excluded, and honest-client false positive rate (FPR) is the proportion of honest clients excluded. For coordinate-wise aggregation methods, a client-level TPR/FPR is not defined because the rule does not accept or reject a client as a whole. The malicious aggregation-weight fraction is the sum of the size weights $n_k/{\sum }_j{n}_j$ assigned to malicious clients and is reported because equal client counts need not imply equal influence under FedAvg. These quantities do not all have the same deployment status. Benign–malicious cosine, benign-only aggregate norm, malicious aggregation weight, and client-selection TPR/FPR require ground-truth knowledge of which clients are malicious and are therefore oracle/post-hoc audit variables in the present experiments. By contrast, the norm of the actual aggregate update is observable to a plaintext-update server, but a small aggregate norm is nonspecific: it can arise from cancellation, convergence, benign disagreement, or scaling and is not treated as a standalone attack detector. For the controlled trigger-backdoor extension, attack success rate (ASR) is the percentage of triggered spoof samples classified as bona fide; ASR is reported separately from clean pooled EER so that targeted behavior is not hidden by an aggregate classification metric.

5. Results

5.1. RQ1: Provenance-Disjoint Matched Audio Comparison

The source audit invalidates the historical 1.923% FedAvg EER as evidence of independent-recording performance. The direct historical Client-C audit reproduces the 70.37% bona-fide source overlap, while the stricter unified-source audit against the complete fit pool finds 74.72% bona-fide and 99.80% spoof overlap. Table 4 therefore reports only the corrected five-seed source-disjoint experiment as the principal audio comparison.

Under matched training, pooled centralized learning reaches mean EER 3.836% (95% CI half-width 0.567), FedAvg 4.622% (0.420), and local C 4.095% (0.352). Local A and local B transfer much less effectively to the Client-C holdout, reaching 21.883% (1.451) and 33.398% (0.783), respectively. Across paired seeds, FedAvg-minus-local-A is $-17.261$ percentage points on average (95% CI $[-18.564,-15.958]$), and FedAvg-minus-local-B is $-28.775$ points ($[-29.536,-28.014]$). These contrasts demonstrate a large cross-domain transfer gap between A/B-only training and models that include Client C; they do not establish that federation improves the native A or B domains because those domains are not independently held out here. FedAvg is consistently worse than local C by 0.527 points on average (95% CI $[0.168,0.886]$) and worse than pooled centralized training by 0.787 points ($[0.305,1.268]$) across the five matched splits.

This distinction matters because Client C contributes on average 74.32% of the corrected pooled fit data and also supplies the source-disjoint evaluation domain. The supported systems observation is therefore that A-only and B-only models generalize poorly to C, whereas adding A/B through FedAvg does not improve C-domain EER over local-C or pooled training in these five splits. The experiment does not establish a general federated-performance advantage or native-domain collaboration benefit for A/B.

5.2. RQ2: Channel-Domain Shift and Dataset Lineage

The archived 2019-only checkpoint still provides a historical channel-shift diagnostic: it records 4.563% EER on ASVspoof 2019 LA evaluation and 23.079% on the archived 36,313-file 2021 row-wise holdout. However, the source audit now prevents interpreting that contrast as an independent-recording generalization test. The two corpora are historically linked and the 2021 row-wise holdout itself contains extensive related-source variants. We therefore retain the approximately 5.06-fold EER increase only as evidence that the historical checkpoint is sensitive to the changed telephony/VoIP condition within this linked benchmark lineage, not as an estimate of external deployment degradation.

Table 5. Checkpoint-linked channel-domain diagnostic for the archived 2019-only model used by the federated-training notebook.

Test condition	EER (%)	Relative to 2019 eval
ASVspoof 2019 LA eval	4.563	$1.00\times$
ASVspoof 2021 LA held-out subset	23.079	$5.06\times$

Table 5. Checkpoint-linked channel-domain diagnostic for the archived 2019-only model used by the federated-training notebook.

Test condition	EER (%)	Relative to 2019 eval
ASVspoof 2019 LA eval	4.563	$1.00\times$
ASVspoof 2021 LA held-out subset	23.079	$5.06\times$

5.3. RQ3–RQ4: Audio Poisoning Case and Update Cancellation

The archived audio poisoning trajectory is retained only as historical mechanism motivation, not as evidence of independent-recording acoustic robustness, because its original row-wise holdout is source-dependent as established in RQ2. In that archived experiment, the relationship between compromise fraction and detector EER is non-monotonic (Appendix B). The clearest mechanistic evidence is the unprotected 30% run: benign and malicious mean-update directions are negatively aligned in the representative recorded rounds, and the full ten-client aggregate has a smaller norm than the benign-only aggregate (Table 6). The same historical scenario includes a transient 2021-holdout EER spike to 39.4%, although other rounds and conditions can look deceptively favorable in aggregate EER.

The archived poisoning/defense notebook also contains a same-client removal control: with A1, A2, and C1 excluded rather than label-flipped, the trajectory ends at 3.598% EER on the 2021 holdout without the corresponding extreme excursion, whereas the matched label-flip run contains the 39.402% transient spike. This distinguishes directional poisoning from simply reducing the active-client set. The controlled experiment below then isolates the mechanism across 20 independent seeds and broader client selections.

5.4. Controlled 20-Seed Replication of Update Cancellation

Table 7 reports the unprotected controlled experiment under full non-IID heterogeneity. As the compromised-client fraction rises from 10% to 30%, the cosine similarity between benign and malicious updates becomes progressively more negative. At the same time, the ratio of the aggregate update norm to the benign-only update norm falls from 0.822 to 0.499. Mean pooled EER worsens rather than improves. The mechanism is therefore directional cancellation and trajectory distortion, not a general beneficial effect of poisoning.

Table 7. Controlled update-geometry replication. Values are final-five-round means ± Student-t 95% CI half-widths across 20 seeds. Geometry and utility are separated into two tables for readability.

Compromised clients (%)	Malicious weight (%)	Benign–malicious cosine	Aggregate/benign norm ratio
10	10.59 ± 1.28	-0.395 ± 0.029	0.822 ± 0.022
20	20.17 ± 1.94	-0.566 ± 0.037	0.658 ± 0.036
30	29.98 ± 2.14	-0.702 ± 0.031	0.499 ± 0.036

Table 7. Controlled update-geometry replication. Values are final-five-round means ± Student-t 95% CI half-widths across 20 seeds. Geometry and utility are separated into two tables for readability.

Compromised clients (%)	Malicious weight (%)	Benign–malicious cosine	Aggregate/benign norm ratio
10	10.59 ± 1.28	-0.395 ± 0.029	0.822 ± 0.022
20	20.17 ± 1.94	-0.566 ± 0.037	0.658 ± 0.036
30	29.98 ± 2.14	-0.702 ± 0.031	0.499 ± 0.036

Table 8. Pooled utility for the same unprotected controlled runs. Values are final-five-round means ± Student-t 95% CI half-widths across 20 seeds.

Compromised clients (%)	Pooled EER (%)
10	9.45 ± 0.32
20	9.60 ± 0.34
30	10.36 ± 0.47

Table 8. Pooled utility for the same unprotected controlled runs. Values are final-five-round means ± Student-t 95% CI half-widths across 20 seeds.

Compromised clients (%)	Pooled EER (%)
10	9.45 ± 0.32
20	9.60 ± 0.34
30	10.36 ± 0.47

Figure 4. Benign–malicious update cosine similarity in the unprotected controlled experiment. Error bars are Student-t 95% CI half-widths across 20 seeds.

Figure 4. Benign–malicious update cosine similarity in the unprotected controlled experiment. Error bars are Student-t 95% CI half-widths across 20 seeds.

Figure 5. Aggregate-to-benign update-norm ratio in the unprotected controlled experiment. Values below one indicate attenuation of the all-client step relative to the benign-only step; by itself this is not a specific indicator of directional cancellation. Error bars are Student-t 95% CIs across 20 seeds.

Figure 5. Aggregate-to-benign update-norm ratio in the unprotected controlled experiment. Values below one indicate attenuation of the all-client step relative to the benign-only step; by itself this is not a specific indicator of directional cancellation. Error bars are Student-t 95% CIs across 20 seeds.

Transient metric improvement remains possible but is secondary. Using each seed as the inferential unit, the mean within-seed fraction of rounds in which poisoned EER is below the seed-matched clean EER is 9.33% (95% CI half-width 5.94 percentage points) at 10% compromise and 8.33% (half-width 5.25 percentage points) at 20%, with none observed at 30%. The 28/300 and 25/300 seed–round counts in Table 9 are descriptive only because rounds within a seed are correlated.

5.5. Architecture and FedProx Sensitivity of the Cancellation Mechanism

Table 10 addresses whether the cancellation result is an incidental property of the reference $32\to 16\to 2$ MLP. Under the same 30% untargeted-label-flip condition, all four tested classifier topologies produce strongly negative benign–malicious alignment and aggregate-step shrinkage. Mean cosine similarity ranges only from $-0.686$ to $-0.721$, and the aggregate-to-benign norm ratio from 0.486 to 0.514, despite clean and attacked EER differences across architectures. The mechanism-level conclusion therefore survives substantial variation in trainable topology within this controlled setting; this does not imply that every acoustic backbone will have identical utility.

The equal-horizon poisoned FedProx sweep gives the same qualitative result (Appendix D). For $\mu =0$, 0.01, 0.1, and 1, pooled EER is 10.36±0.47%, 10.37±0.45%, 10.39±0.45%, and 11.07±0.59%, respectively; cosine alignment becomes more negative from $-0.702$ to $-0.782$ and the norm ratio decreases from 0.499 to 0.436. FedProx regularization therefore does not remove the directional-cancellation mechanism in this stress test.

5.6. Multi-Threat Controlled Stress Test

Table 11 broadens the adversarial scope beyond the archived untargeted label flip. The two label-poisoning attacks retain the strong cancellation signature of the primary experiment. The trigger backdoor has a less extreme but still negative alignment and reaches 52.2±8.3% ASR under unprotected FedAvg. Zero-update free riding has undefined benign–malicious cosine by construction because the malicious update norm is zero; its aggregate/benign norm ratio of approximately 0.70 directly reflects lost contribution weight. Coordinated sign-flip model poisoning is qualitatively different and severe: unprotected pooled EER rises to 62.6±7.0% while cosine reaches $-0.836\pm 0.015$.

For the trigger backdoor, ASR is 52.2±8.3% under unprotected FedAvg, 48.9±6.8% under trimmed mean, and 39.8±7.9% under Multi-Krum. Thus, a defense can preserve global EER while leaving substantial targeted vulnerability. Multi-Krum also exhibits attack-dependent honest-client exclusions: for example, it rejects all coordinated sign-flip malicious clients but structurally excludes 28.6% of honest clients, while under the free-rider condition it rejects none of the malicious zero updates and excludes 71.4% of honest clients. These results support a narrower and more useful claim than universal robustness: the diagnostic suite distinguishes materially different failure modes, but defense behavior must be audited per threat.

5.7. Controlled Robust-Aggregation Comparison

Table 13 and Figure 6 compare the fully specified defenses. At 30% compromise, unprotected FedAvg reaches 10.36±0.47% pooled EER, versus 9.77±0.37% for trimmed mean and 9.71±0.35% for Multi-Krum with oracle $f=3$. Several confidence intervals overlap and no multiplicity-adjusted pairwise ranking was prespecified, so these results are comparative stress-test evidence rather than a universal ordering of defenses.

The client-selection diagnostics show a marked trade-off. Under the oracle-f setting, Multi-Krum excludes 100.0%, 96.5%, and 80.3% of malicious clients at 10%, 20%, and 30% compromise, but also excludes 22.2%, 25.9%, and 37.0% of honest clients. The uncertainty rule preserves almost all honest clients but has approximately zero TPR against label flipping. Norm clipping changes little under the calibrated threshold, indicating that this attack is driven more by update direction than extreme update magnitude.

For Multi-Krum, honest-client exclusion must be separated from attack discrimination because the implementation always selects $n-f-2$ updates. If all malicious clients were perfectly rejected, that quota alone would force honest-client FPR floors of 22.2%, 25.0%, and 28.6% at 10%, 20%, and 30% compromise. The observed FPRs are 22.2%, 25.9%, and 37.0%, corresponding to excess honest exclusion of 0.0, 0.9, and 8.4 percentage points. We therefore report the quota floor separately rather than treating every rejected honest client as evidence of failed attack discrimination. The synthetic uncertainty prototype’s near-zero malicious-client TPR is likewise a negative result: under label flipping it is not a practically useful client detector at the tested threshold.

Table 12. Multi-Krum honest-client exclusion decomposed into the structural $n-f-2$ quota floor and excess exclusion beyond that floor. Values are percentages.

Compromise	Observed honest FPR	Structural floor	Excess FPR
10%	22.2	22.2	0.0
20%	25.9	25.0	0.9
30%	37.0	28.6	8.4

Table 12. Multi-Krum honest-client exclusion decomposed into the structural $n-f-2$ quota floor and excess exclusion beyond that floor. Values are percentages.

Compromise	Observed honest FPR	Structural floor	Excess FPR
10%	22.2	22.2	0.0
20%	25.9	25.0	0.9
30%	37.0	28.6	8.4

Table 13. Controlled defense comparison. Pooled EER is mean ± Student-t 95% CI half-width over 20 seeds. TPR/FPR are malicious-client true positive rate / honest-client false positive rate (%) for client-selection defenses. Main Multi-Krum uses the declared true f and therefore benefits from oracle knowledge.

Compromised (%)	Aggregation	Pooled EER (%)	TPR / FPR (%)
0	FedAvg (none)	9.20 ± 0.32	–
0	Norm clipping	9.21 ± 0.32	–
0	Trimmed mean ($k=2$)	9.10 ± 0.28	–
0	Coordinate median	9.28 ± 0.29	–
0	Multi-Krum	9.15 ± 0.30	– / 20.0
0	Uncertainty screening	9.21 ± 0.32	– / 0.5
10	FedAvg (none)	9.45 ± 0.32	–
10	Norm clipping	9.42 ± 0.32	–
10	Trimmed mean ($k=2$)	9.20 ± 0.32	–
10	Coordinate median	9.64 ± 0.30	–
10	Multi-Krum	9.25 ± 0.30	100.0 / 22.2
10	Uncertainty screening	9.45 ± 0.32	0.0 / 1.1
20	FedAvg (none)	9.60 ± 0.34	–
20	Norm clipping	9.58 ± 0.32	–
20	Trimmed mean ($k=2$)	9.34 ± 0.35	–
20	Coordinate median	9.81 ± 0.30	–
20	Multi-Krum	9.40 ± 0.32	96.5 / 25.9
20	Uncertainty screening	9.57 ± 0.33	0.0 / 0.8
30	FedAvg (none)	10.36 ± 0.47	–
30	Norm clipping	10.33 ± 0.45	–
30	Trimmed mean ($k=2$)	9.77 ± 0.37	–
30	Coordinate median	10.40 ± 0.43	–
30	Multi-Krum	9.71 ± 0.35	80.3 / 37.0
30	Uncertainty screening	10.36 ± 0.47	0.0 / 0.4

Table 13. Controlled defense comparison. Pooled EER is mean ± Student-t 95% CI half-width over 20 seeds. TPR/FPR are malicious-client true positive rate / honest-client false positive rate (%) for client-selection defenses. Main Multi-Krum uses the declared true f and therefore benefits from oracle knowledge.

Compromised (%)	Aggregation	Pooled EER (%)	TPR / FPR (%)
0	FedAvg (none)	9.20 ± 0.32	–
0	Norm clipping	9.21 ± 0.32	–
0	Trimmed mean ($k=2$)	9.10 ± 0.28	–
0	Coordinate median	9.28 ± 0.29	–
0	Multi-Krum	9.15 ± 0.30	– / 20.0
0	Uncertainty screening	9.21 ± 0.32	– / 0.5
10	FedAvg (none)	9.45 ± 0.32	–
10	Norm clipping	9.42 ± 0.32	–
10	Trimmed mean ($k=2$)	9.20 ± 0.32	–
10	Coordinate median	9.64 ± 0.30	–
10	Multi-Krum	9.25 ± 0.30	100.0 / 22.2
10	Uncertainty screening	9.45 ± 0.32	0.0 / 1.1
20	FedAvg (none)	9.60 ± 0.34	–
20	Norm clipping	9.58 ± 0.32	–
20	Trimmed mean ($k=2$)	9.34 ± 0.35	–
20	Coordinate median	9.81 ± 0.30	–
20	Multi-Krum	9.40 ± 0.32	96.5 / 25.9
20	Uncertainty screening	9.57 ± 0.33	0.0 / 0.8
30	FedAvg (none)	10.36 ± 0.47	–
30	Norm clipping	10.33 ± 0.45	–
30	Trimmed mean ($k=2$)	9.77 ± 0.37	–
30	Coordinate median	10.40 ± 0.43	–
30	Multi-Krum	9.71 ± 0.35	80.3 / 37.0
30	Uncertainty screening	10.36 ± 0.47	0.0 / 0.4

5.8. Malicious Aggregation Weight with Fixed Client Identities

The archived low-weight/random/high-weight comparison confounded aggregation weight with client identity and domain, because the smallest clients originated from the A/B profiles while the largest originated from C. We therefore retain that comparison only as exploratory provenance and use a new fixed-identity control for causal interpretation. The same malicious clients, local samples, label-flip attack, and 20 seeds are held fixed; only their total server aggregation mass is rescaled to 15%, 30%, or 45%, with benign weights renormalized.

The result is monotone and mechanistically coherent (Table 14). Raising malicious mass from 15% to 45% increases pooled EER from 9.58% to 22.66%, makes benign–malicious cosine more negative from $-0.473$ to $-0.826$, and reduces the aggregate-to-benign norm ratio from 0.752 to 0.316. Because identities and local data are unchanged, this control isolates aggregation mass rather than domain composition. The same-client removal experiment remains complementary evidence that directional poisoning is more damaging than simply reducing participation.

5.9. Assumption and Sensitivity Checks

The controlled ablations in Appendix C separate assumptions that could otherwise be conflated with the cancellation result. Increasing statistical heterogeneity raises task difficulty, while the explicit quota decomposition in Table 12 shows that much of Multi-Krum’s honest-client FPR is structural to $n-f-2$ selection rather than evidence of attack discrimination. At 30% actual compromise, varying Multi-Krum’s assumed adversarial count $\widehat{f}\in \{1,2,3\}$ trades malicious rejection against honest exclusion, while trimmed mean changes more modestly over $k\in \{1,2,3\}$. A clean 30-round FedProx sweep over $\mu \in \{0,0.001,0.01,0.1,1\}$ produces strongly overlapping EER intervals. These checks bound the interpretation of individual defense settings rather than supplying a universal ranking.

5.10. Serialized Communication Payload

The trainable classifier contains 223,682 single-precision parameters, corresponding to 894,728 raw parameter bytes. The recorded PyTorch state_dict size is 897,557 bytes (approximately 876.5 KiB). For three institutional clients, a full round with one server-to-client model transmission and one client-to-server return per client is approximately

$$876.5\mathrm{KiB}\times 3\times 2\approx 5.1\mathrm{MiB}.$$

(6)

Fifteen rounds correspond to approximately 77 MiB of serialized model payload. This is a payload estimate, not a measured network-cost result: transport security, framing, retransmission, latency, packet loss, and systems overhead are excluded. The calculation therefore supports only the narrower observation that exchanging the compact classifier entails a modest serialized model payload; it is not an end-to-end comparison against transferring raw-audio corpora.

6. Discussion

6.1. What Is Essential and What Is Incidental in the Framework

The additional controlled experiments separate the framework’s intended methodological core from implementation choices. LFCC plus frozen WavLM is a computationally economical acoustic representation used by the archived case study; it is not asserted to be the unique or state-of-the-art detector architecture. Likewise, the particular surrogate MLP is incidental to the update-cancellation claim: four substantially different trainable topologies reproduce the same negative-alignment and aggregate-step-shrinkage signature under the matched stress test. The essential elements are instead the cross-silo separation of heterogeneous domains, explicit accounting for adversarial aggregation weight, and joint reporting of utility, selection errors, and update geometry. Published results from FLADD, FedMaxAdapt, and multimodal federated deepfake systems establish the broader detection-performance context, whereas the present contribution is the auditable integrity analysis under malicious participation.

6.2. What the Combined Evidence Supports

The corrected audio rerun changes what can be said about detector utility. The historical 1.923% result was optimistic under a source-dependent split and is no longer principal evidence. With source-disjoint splitting and matched training on the common Client-C holdout, pooled training reaches 3.836% mean EER, local C 4.095%, and FedAvg 4.622%, whereas A-only and B-only models reach 21.883% and 33.398%. The useful systems observation is therefore a large A/B-to-C cross-domain transfer gap and no C-domain EER advantage for FedAvg over pooled or local-C training in these five splits. Because A and B have no native-domain holdout in this experiment, the results do not establish that collaboration improves their own domains.

The strongest security conclusion is likewise mechanistic rather than a new defense claim. The archived poisoning case motivates a failure mode in which global EER can look temporarily favorable while malicious updates oppose benign optimization and the training trajectory becomes unstable. The controlled 20-seed replication preserves directional opposition and aggregate-step shrinkage while showing that average EER worsens with attack strength. Update cancellation is therefore the robust explanatory mechanism; persistent “beneficial poisoning” is not.

For a defender, the implication must distinguish observable signals from experimental explanations. Aggregate validation EER can miss a poisoning episode when cancellation slows or redirects optimization without immediately worsening the selected metric. A server can observe the actual aggregate-update norm when updates are plaintext, but norm shrinkage is nonspecific and is not a standalone attack indicator. Benign–malicious alignment, benign-only norms, malicious aggregation weight, and client-selection TPR/FPR are valuable post-hoc/oracle audit variables in this study because they require malicious-identity ground truth. They explain why an episode occurred and can be used to validate future detectors, but they are not themselves claimed as deployable detectors. Domain-specific validation and attack-specific metrics provide complementary server-side evidence where such validation data are legitimately available. Recent robust-FL methods increasingly combine geometric or behavioral signals for the same reason [34,35,36,40,41].

6.3. Heterogeneity and Defense-Rule Effects Are Separable

The controlled ablation (Appendix C) shows that increasing statistical heterogeneity degrades utility but does not, by itself, explain Multi-Krum’s honest-client FPR. The explicit quota decomposition sharpens this point: at 10%, 20%, and 30% compromise, 22.2%, 25.0%, and 28.6% honest-client FPR would occur even under perfect malicious rejection simply because Multi-Krum selects only $n-f-2$ updates. Only exclusion beyond that floor should be interpreted as additional discrimination error. Heterogeneity still matters because it changes the geometry and utility landscape, but defense-rule design must be analyzed separately.

The uncertainty defense illustrates a different failure mode. Its trusted-reference assumption keeps honest-client FPR below roughly 1.3% in the controlled experiments, yet label flipping rarely increases the chosen epistemic-uncertainty score enough to identify malicious clients. Low false alarms therefore do not imply useful attack sensitivity.

6.4. Client Count Is Not Attack Mass

A fixed compromised-client fraction can correspond to very different effective influence under weighted aggregation. The archived client-selection comparison mixed this effect with domain identity, so the fixed-identity causal control holds malicious clients and data constant and varies only their server aggregation mass. Moving from 15% to 45% malicious mass more than doubles pooled EER and produces systematically stronger directional opposition and aggregate-step shrinkage. This directly supports malicious aggregation mass as an explanatory variable independent of which domain was selected.

The same-client removal controls answer a different question: poisoned participation is not equivalent to missing participation. Removing selected clients reduces data availability but does not reproduce the same directional opposition or extreme trajectory behavior. Together, the two controls separate “which clients”, “how much weight”, and “whether the update is malicious” more cleanly than the historical design.

6.5. Robust Aggregation Requires Assumption Audits

The main Multi-Krum comparison supplies the true number of malicious clients f, a favorable oracle assumption. Sensitivity analysis shows that larger $\widehat{f}$ raises malicious-client rejection but also increases honest-client exclusion and does not necessarily minimize EER; the separate quota-floor calculation prevents structural exclusion from being misread as attack discrimination. Trimmed mean likewise depends on its tail parameter k. The audio and synthetic uncertainty screens are distinct prototypes and should not be compared as replications; notably, the synthetic rule has approximately zero TPR against label flipping, which limits its practical value at the tested setting. Robust-aggregation results are therefore reported with threat-bound, parameter, and attack assumptions rather than as parameter-free guarantees.

6.6. Privacy Boundary

The architecture keeps raw audio local, supporting data minimization and organizational autonomy. It does not provide end-to-end privacy by itself because plaintext classifier updates are visible to the coordinator. Secure-aggregation-compatible methods such as RFLPA and recent privacy-preserving federated schemes illustrate how robustness and update confidentiality can be combined [32,34,42]. The supported claim is therefore that the workflow reduces the need to exchange raw audio; it is not proof of compliance with the General Data Protection Regulation (GDPR) or immunity to gradient inversion and membership inference [43].

6.7. Relevance to Future Connected Systems

The International Telecommunication Union Telecommunication Standardization Sector (ITU-T) has issued architectural and management guidance for federated machine learning in International Mobile Telecommunications 2020 (IMT-2020) networks and beyond [44,45,46,47]. The present experimental framework exposes a closely related systems problem: independently governed domains collaborate through model exchange while having unequal data volumes, heterogeneous channels, and asymmetric trust. Deepfake speech is a concrete application in which communication-channel effects form part of the learning distribution rather than incidental noise.

7. Limitations and Threats to Validity

7.1. Construct and Data Validity

The silo labels are illustrative archetypes, not observations from real institutions. “TTS-heavy (bank-inspired)”, “VC-heavy (operator-inspired)”, and “channel-degraded (VoIP-inspired)” denote deterministic public-ASVspoof partitions selected to expose qualitatively different attack/channel profiles. They should not be read as empirical distributions of banks, operators, or VoIP providers.

The source audit corrects a major limitation of the historical evaluation: the row-wise 2021 split placed related source variants on both sides, and some Client-C sources were already present in the fixed A+B fit pool. The new five-seed evaluation uses a unified audio-source namespace for bona-fide and VC-derived trials plus normalized source-text hashes for TTS trials. Each holdout is independently verified to have zero canonical-source, audio-source, and TTS-source-text overlap with the complete A+B+remaining-C fit pool. This resolves the identified source dependence for the reported principal comparison, but it still uses a repurposed ASVspoof 2021 client domain rather than a genuinely external corpus. ASVspoof 2019 and 2021 also share historical lineage. Accordingly, the results support source-disjoint evaluation within the constructed 2021 domain, not deployment-level external generalization.

7.2. Internal, Statistical, and Reproducibility Validity

The principal audio comparison matches the architecture, initialization within seed, pooled/FedAvg fit-data pool, global class weights, batch size, learning rate, 45-pass budget, and fixed endpoint over five source-disjoint seeds. Local-only baselines use the same optimization budget on each silo. This design removes the main protocol confound of the historical pooled-versus-FedAvg comparison. However, all five models are evaluated only on the Client-C holdout; local A/B results therefore measure cross-domain transfer to C and cannot establish native-domain benefit from collaboration. Five seeds also provide limited precision; the reported Student-t intervals should be interpreted as uncertainty summaries rather than definitive population estimates.

The historical 1.923% FedAvg and 2.358% pooled values remain in the appendix because they document the archived workflow, but they are explicitly non-independent and protocol-unmatched and are not used to infer a federation effect. Historical t-DCF values are provenance from saved notebook output rather than independently recomputed predictive metrics. In contrast, the corrected experiment releases exact split identifiers, per-example scores, exact checkpoints, SHA-256 checkpoint–score linkage, and an executable EER recomputation script; rerunning that script reproduces all 25 reported per-seed EERs from released score files.

The controlled Gaussian generator is synthetic. Its purpose is mechanism isolation: client weight, heterogeneity, architecture, attack type, and aggregation rule can be changed independently. Agreement with the archived cancellation direction and stability across four classifier topologies strengthen mechanism plausibility, but synthetic embeddings do not validate acoustic robustness.

7.3. Threat-Model and Defense-Assumption Validity

The controlled threat model covers untargeted and targeted label poisoning, a feature-level trigger backdoor, zero-update free riding, and coordinated sign-flip model poisoning. These stressors span qualitatively different behaviors but do not implement adaptive defense-aware optimization, genuine Sybil identity creation, stealth-optimized model replacement, coordinator compromise, or privacy-inference attacks. The backdoor trigger is a surrogate feature intervention rather than an acoustic trigger. The evidence therefore supports differentiated stress testing, not comprehensive Byzantine robustness.

Several reported diagnostics are explanatory rather than deployable. Benign–malicious cosine, benign-only aggregate norm, malicious aggregation weight, and client-selection TPR/FPR require malicious-identity ground truth. Aggregate-update norm is server-observable with plaintext updates but nonspecific. Multi-Krum additionally has a structural honest-client exclusion floor imposed by its selection quota, which is reported separately from excess discrimination error. The audio and synthetic uncertainty rules use different statistics and thresholds and are treated as distinct exploratory prototypes; the near-zero synthetic TPR against label flipping is explicitly a failure mode.

7.4. Deployment, Privacy, and Systems Validity

The target architecture reduces the need to exchange raw audio, but FL alone is not a cryptographic privacy guarantee. The coordinator observes plaintext classifier updates; secure aggregation, differential privacy, gradient-inversion resistance, and membership-inference resistance are not implemented. Likewise, the communication calculation is a serialized-model payload estimate, not a packet-level or wall-clock network experiment. Transport security, framing overhead, retransmission, latency, packet loss, asynchronous participation, client dropout, and resource-constrained edge execution remain outside the evidence.

Finally, the LFCC+frozen-WavLM+MLP detector is deliberately compact. Recent systems such as FLADD use more elaborate acoustic architectures, and FedMaxAdapt optimizes a different multimodal/sparsity setting. Their published results are reported only as quantitative context, not as a common-protocol leaderboard. A literal head-to-head reproduction was not performed because a faithful comparison would require reproducing their raw-data architectures, client construction, and aggregation/training protocols rather than substituting the present cached-feature classifier. The present article does not claim a new state-of-the-art acoustic backbone or a new defense; its contribution is an auditable experimental protocol and bounded evidence about collaboration, provenance, and integrity mechanisms under heterogeneous cross-silo participation.

8. Conclusions

This study examines federated deepfake speech detection as a cross-silo integrity problem under simultaneous domain heterogeneity and malicious participation. An official-metadata audit confirms that the historical seed-42 row-wise split was source dependent: the reported direct audit gives 2,572/3,655 (70.37%) bona-fide overlap within Client C, while a stricter unified-source audit against the complete A+B+C fit pool gives 74.72% bona-fide and 99.80% spoof overlap. The historical 1.923% FedAvg EER therefore remains only as provenance and does not establish independent-recording performance.

With five source-disjoint splits and matched training on the common Client-C holdout, mean EER is 3.836% for pooled centralized training, 4.622% for FedAvg, 4.095% for local C, 21.883% for local A, and 33.398% for local B. A-only and B-only models therefore transfer poorly to C. FedAvg is, however, worse than local C by 0.527 percentage points on average and worse than pooled training by 0.787 points across the five matched splits. Given that C supplies about 74.32% of the corrected fit data and the evaluation domain, the supported systems conclusion is a strong cross-domain transfer asymmetry and no demonstrated C-domain advantage for federation. Native-domain collaboration benefit for A/B is not established by this evaluation.

The principal security finding is mechanistic. In the 20-seed controlled stress test, increasing untargeted label-flip compromise produces progressively more negative benign–malicious alignment and stronger aggregate-step shrinkage while average EER worsens. The signature persists across four classifier topologies and FedProx settings. A fixed-identity control further shows that increasing only malicious aggregation mass from 15% to 45% raises pooled EER from 9.58% to 22.66%, drives cosine from $-0.473$ to $-0.826$, and lowers the norm ratio from 0.752 to 0.316. Broader threat testing shows attack-dependent signatures rather than a universal defense response.

The diagnostics must be interpreted according to deployment observability. Benign–malicious geometry, malicious weight, and TPR/FPR are post-hoc/oracle variables requiring malicious-identity ground truth; aggregate norm is observable but nonspecific. Multi-Krum honest-client exclusion is partly structural to its fixed quota, and the synthetic uncertainty rule’s near-zero label-flip TPR limits its practical value at the tested threshold. Thus, the work offers an auditable protocol for explaining and stress-testing integrity behavior, not a deployable poisoning detector.

Future work should repeat the corrected protocol on genuinely external or in-the-wild audio, reproduce recent audio-FL architectures under a common raw-audio protocol, evaluate acoustic backdoors and adaptive/Sybil adversaries, and add secure aggregation and measured edge/network deployment.

Appendix C.1. IID/Non-IID Heterogeneity Ablation

The IID/non-IID ablation in Table A5 corrects an overly simple interpretation that Multi-Krum’s honest-client exclusions are caused by non-IID data alone. Increasing heterogeneity clearly makes the classification problem harder: unprotected pooled EER rises from 8.41% at $h=0$ to 9.60% at $h=1$. However, at 20% compromise the Multi-Krum honest-client FPR remains near 25–26% across all three heterogeneity levels. Much of that exclusion is therefore structural to the chosen $n-f-2$ output cardinality rather than a direct consequence of non-IID data.

Table A5. Heterogeneity ablation at 20% compromised clients. Values are mean ± Student-t 95% CI half-width across 20 seeds. TPR/FPR are shown for client-selection defenses.

Condition	FedAvg EER	Multi-Krum EER	TPR/FPR	Uncertainty EER	TPR/FPR
IID ($h=0$)	8.41 ± 0.25	8.28 ± 0.25	99.5/25.1	8.40 ± 0.25	0.5/1.2
Mild ($h=0.5$)	8.80 ± 0.32	8.64 ± 0.32	96.0/26.0	8.80 ± 0.32	0.0/0.8
Full non-IID ($h=1$)	9.60 ± 0.34	9.40 ± 0.32	96.5/25.9	9.57 ± 0.33	0.0/0.8

Table A5. Heterogeneity ablation at 20% compromised clients. Values are mean ± Student-t 95% CI half-width across 20 seeds. TPR/FPR are shown for client-selection defenses.

Condition	FedAvg EER	Multi-Krum EER	TPR/FPR	Uncertainty EER	TPR/FPR
IID ($h=0$)	8.41 ± 0.25	8.28 ± 0.25	99.5/25.1	8.40 ± 0.25	0.5/1.2
Mild ($h=0.5$)	8.80 ± 0.32	8.64 ± 0.32	96.0/26.0	8.80 ± 0.32	0.0/0.8
Full non-IID ($h=1$)	9.60 ± 0.34	9.40 ± 0.32	96.5/25.9	9.57 ± 0.33	0.0/0.8

Appendix C.2. Defense-Parameter Sensitivity

At an actual 30% compromise rate, changing the assumed adversarial count $\widehat{f}$ in Multi-Krum changes the balance between malicious rejection and honest exclusion (Table A6). Using the true $f=3$ rejects the largest malicious fraction but also removes 37.0% of honest clients and does not minimize EER. Trimmed mean similarly changes modestly across $k=1,2,3$. These results show that robust-aggregation performance depends on defense hyperparameters and on information that may be unavailable to a real coordinator.

Table A6. Defense-parameter sensitivity at 30% actual compromise. EER is mean ± Student-t 95% CI half-width across 20 seeds.

Defense	Setting	Pooled EER (%)	TPR / FPR (%)
Trimmed mean	$k=1$	9.93 ± 0.36	–
Trimmed mean	$k=2$	9.77 ± 0.37	–
Trimmed mean	$k=3$	9.76 ± 0.39	–
Multi-Krum	$\widehat{f}=1$	9.51 ± 0.35	73.7 / 11.3
Multi-Krum	$\widehat{f}=2$	9.59 ± 0.36	77.3 / 24.0
Multi-Krum	$\widehat{f}=3$	9.71 ± 0.35	80.3 / 37.0

Table A6. Defense-parameter sensitivity at 30% actual compromise. EER is mean ± Student-t 95% CI half-width across 20 seeds.

Defense	Setting	Pooled EER (%)	TPR / FPR (%)
Trimmed mean	$k=1$	9.93 ± 0.36	–
Trimmed mean	$k=2$	9.77 ± 0.37	–
Trimmed mean	$k=3$	9.76 ± 0.39	–
Multi-Krum	$\widehat{f}=1$	9.51 ± 0.35	73.7 / 11.3
Multi-Krum	$\widehat{f}=2$	9.59 ± 0.36	77.3 / 24.0
Multi-Krum	$\widehat{f}=3$	9.71 ± 0.35	80.3 / 37.0

Appendix C.3. FedProx Sensitivity under an Equal Training Horizon

The clean 30-round synthetic sweep addresses the interpretive weakness of the single 15-round audio FedProx comparison. Pooled EER means remain within a narrow range and all Student-t confidence intervals overlap substantially. The lowest mean occurs at $\mu =1$ (9.08±0.34%), but this does not establish an audio-task optimum; it only shows that the earlier FedProx gap cannot be generalized from one $\mu$ and one short horizon.

Table A7. Clean FedProx sensitivity over an equal 30-round horizon. Values are mean ± Student-t 95% CI half-width across 20 seeds.

$\mathit{\mu }$	Pooled EER (%)	TTS-heavy EER (%)	VC-heavy EER (%)	Channel-degraded EER (%)
0 (FedAvg)	9.18 ± 0.28	5.65 ± 0.41	8.65 ± 0.42	11.34 ± 0.46
0.001	9.17 ± 0.28	5.68 ± 0.39	8.66 ± 0.44	11.30 ± 0.45
0.01	9.16 ± 0.28	5.70 ± 0.42	8.66 ± 0.42	11.33 ± 0.49
0.1	9.20 ± 0.29	5.67 ± 0.43	8.74 ± 0.44	11.39 ± 0.47
1	9.08 ± 0.34	5.71 ± 0.44	8.36 ± 0.45	11.28 ± 0.59

Table A7. Clean FedProx sensitivity over an equal 30-round horizon. Values are mean ± Student-t 95% CI half-width across 20 seeds.

$\mathit{\mu }$	Pooled EER (%)	TTS-heavy EER (%)	VC-heavy EER (%)	Channel-degraded EER (%)
0 (FedAvg)	9.18 ± 0.28	5.65 ± 0.41	8.65 ± 0.42	11.34 ± 0.46
0.001	9.17 ± 0.28	5.68 ± 0.39	8.66 ± 0.44	11.30 ± 0.45
0.01	9.16 ± 0.28	5.70 ± 0.42	8.66 ± 0.42	11.33 ± 0.49
0.1	9.20 ± 0.29	5.67 ± 0.43	8.74 ± 0.44	11.39 ± 0.47
1	9.08 ± 0.34	5.71 ± 0.44	8.36 ± 0.45	11.28 ± 0.59

Figure A1. Equal-horizon FedProx sensitivity in the controlled clean surrogate. Error bars are Student-t 95% CI half-widths across 20 seeds.

Figure A1. Equal-horizon FedProx sensitivity in the controlled clean surrogate. Error bars are Student-t 95% CI half-widths across 20 seeds.

Appendix D.1. FedProx under 30% Untargeted Label Flipping

Table A8. FedProx sensitivity under 30% untargeted label flipping over the same 15-round horizon. Values are mean ± Student-t 95% CI half-width across 20 seeds.

$\mathit{\mu }$	Pooled EER (%)	Benign–malicious cosine	Aggregate/benign norm ratio
0	10.36 ± 0.47	-0.702 ± 0.031	0.499 ± 0.036
0.01	10.37 ± 0.45	-0.703 ± 0.030	0.498 ± 0.036
0.1	10.39 ± 0.45	-0.715 ± 0.030	0.489 ± 0.036
1	11.07 ± 0.59	-0.782 ± 0.025	0.436 ± 0.035

Table A8. FedProx sensitivity under 30% untargeted label flipping over the same 15-round horizon. Values are mean ± Student-t 95% CI half-width across 20 seeds.

$\mathit{\mu }$	Pooled EER (%)	Benign–malicious cosine	Aggregate/benign norm ratio
0	10.36 ± 0.47	-0.702 ± 0.031	0.499 ± 0.036
0.01	10.37 ± 0.45	-0.703 ± 0.030	0.498 ± 0.036
0.1	10.39 ± 0.45	-0.715 ± 0.030	0.489 ± 0.036
1	11.07 ± 0.59	-0.782 ± 0.025	0.436 ± 0.035

Appendix D.2. Additional Multi-Threat Selection Diagnostics

For Multi-Krum at 30% compromise, mean malicious-client TPR / honest-client FPR is 76.0/38.9% for untargeted label flipping, 50.0/50.0% for targeted spoof-to-bona-fide poisoning, 51.7/49.3% for the trigger backdoor, 0.0/71.4% for zero-update free riding, and 100.0/28.6% for coordinated sign flipping. These attack-dependent values illustrate why a single client-selection rate cannot characterize a robust aggregator. Complete per-seed values, standard deviations, and confidence intervals are retained in results/revision_threat/ in the reproducibility package.