Resilient Consensus Under Time-Varying Delays and Adversarial Agents: Safety, Rates, and Delay-Induced Equivocation

1. Introduction

Distributed agreement is a basic primitive in drone swarms, sensor networks, clock synchronization, and distributed estimation in power grids. In its simplest form each agent repeatedly replaces its state by a weighted average of its own value and the values received from neighbors, and under mild connectivity conditions all states converge to a common value [1,2,3,4]. The same averaging rule, however, gives every agent a direct lever on the outcome: a single agent that keeps broadcasting a fixed value pulls the whole network toward it, and Byzantine agents that tell different neighbors different things can prevent agreement altogether [5,6,7].

Mean-subsequence-reduced (MSR) algorithms counter this threat locally. A normal agent sorts the values it receives, discards up to F values above and F values below its own state, and averages the rest [8,9]. LeBlanc et al. showed that the weighted variant, W-MSR, achieves resilient consensus against F-total malicious agents if and only if the graph is $(F+1,F+1)$-robust [10], and parallel results were obtained for Byzantine agents in directed graphs [11,12]. Robustness conditions have since been extended to many resilient coordination problems [13,14,15].

Most of these guarantees assume that every message sent at step k is used at step k. Wireless and multi-hop networks do not behave this way: messages are delayed by different amounts on different links, arrive out of order, and can be captured and replayed later [16,17]. Attaching timestamps does not help when the adversary controls its own clock. Delays also change what an adversary can do. A malicious agent is normally assumed to broadcast one value per step. If it can influence which of its recent values each neighbor receives, it effectively sends different values to different neighbors, which is the defining capability of a Byzantine agent. Dibaji and Ishii observed this effect for asynchronous second-order and quantized MSR dynamics, and showed that $(F+1,F+1)$-robustness remains necessary while $(2F+1)$-robustness is sufficient [18,19]. To our knowledge, whether the gap between these two conditions is real has remained open.

This paper studies the first-order, synchronous-update, timestamp-free W-MSR rule under bounded time-varying delays and asks three questions. Safety: do normal agents stay within the range of recent normal values whatever the adversaries send? Liveness: under which robustness condition do they agree, and how does the guaranteed rate depend on the delay bound $\tau$? Adversarial scheduling: if delays are chosen by the adversary, is $(F+1,F+1)$-robustness still enough? The first and third questions are answered analytically in this paper. The second is answered by a sufficient condition with an explicit rate bound, and the protocol in Section 6 specifies how the actual rate is to be measured. The contributions are as follows.

• Problem formulation. We model normal-agent communication with unknown, link-dependent delays bounded by $\tau$, distinguish malicious, Byzantine, and stale-replay adversaries, allow the adversary to schedule delays, and use the window hull of normal states as the central analysis quantity (Section 4 and Section 5).
• Safety. We prove that the window hull never expands whenever each normal agent has at most F adversarial in-neighbors, for any adversary behavior including forged timestamps and stale replay and for any delays bounded by $\tau$, without any robustness assumption (Theorem 1).
• Liveness. We prove exponential consensus on $(2F+1)$-robust graphs with an explicit contraction horizon $H=\left|\mathcal{N}\right|(\tau +1)+\tau$ that grows linearly in $\tau +1$ (Theorem 2).
• Delay-induced equivocation. We construct, for every $F\ge 1$ and $\tau \ge 1$, a network and delay schedule under which broadcasting adversaries block consensus. Exhaustive enumeration shows that the network is $(F+1,F+1)$-robust for $F\le 2$ and $2F$-robust for $F\le 3$. Under scheduled delays, therefore, the known necessary condition is not sufficient, and for $F\le 3$ the sufficient condition $2F+1$ cannot be lowered to $2F$ within the r-robust hierarchy (Proposition 1, Corollary 1).
• Evaluation protocol. We specify a reproducible simulation protocol with certified robust graphs, three delay schedules, four adversary models, a polarizing delay scheduler (Algorithm 2), and designs for rate scaling, counterexample, ablation, and scalability studies (Section 6).

Section 2 reviews related work, Section 3 presents the update rule, Section 4 the system and threat model, and Section 5 the analysis. Section 6 specifies the evaluation protocol, Section 7 discusses design implications, Section 8 states limitations, and Section 9 concludes.

2. Related Work

2.1. Consensus with Delays

Delay-robust average consensus is well understood when all agents are cooperative. Olfati-Saber and Murray characterized the admissible uniform delay for continuous-time Laplacian dynamics [1], Xiao and Wang established asynchronous consensus with switching topologies and time-varying delays [20], and Münz et al. derived delay-robustness conditions for heterogeneous agents [21]. In discrete time, bounded delays are handled by the partially asynchronous model of Bertsekas and Tsitsiklis [22], in which each agent averages possibly outdated values with weights bounded away from zero. Our safety argument uses the same fact: a convex combination of delayed values stays within the hull of a finite window of past states.

2.2. Resilient Consensus and Graph Robustness

Approximate agreement in the presence of faults dates back to Dolev et al. [8] and to the mixed-mode analysis of Kieckhafer and Azadmanesh [9]. LeBlanc et al. introduced r-robust and $(r,s)$-robust graphs and proved that W-MSR succeeds against F-total malicious agents if and only if the graph is $(F+1,F+1)$-robust, and against F-local agents if it is $(2F+1)$-robust [10]. Vaidya et al. gave tight conditions for iterative approximate Byzantine consensus in directed graphs [11], and Zhang et al. studied robustness of random graph models and showed that deciding robustness is coNP-complete [13]. Usevitch and Panagou computed r- and $(r,s)$-robustness by mixed-integer programming [23]. Trusted nodes [24], multi-dimensional states [25], time-varying networks [26], and distributed optimization [27] extend the framework. Surveys are available in [14,15].

2.3. Resilience Under Delays and Asynchrony

Dibaji and Ishii analyzed second-order MSR dynamics with asynchronous updates and bounded delays and proved that $(F+1,F+1)$-robustness is necessary and $(2F+1)$-robustness is sufficient, attributing the gap to adversaries that “appear at different positions for different normal agents” [18]. The same two conditions appear for randomized quantized consensus with delays [19,28] and for asynchronous updates with delayed information [29]. In maximum-based consensus, $(F+1,F+1)$-robustness is necessary and sufficient even with delays [30], because the update never averages. Shang studied mobile Byzantine adversaries under heterogeneous delays [31], and Yuan and Ishii analyzed multi-hop W-MSR with delayed relays [32]. To our knowledge, none of these works settles whether the gap is real. Table 1 positions this work.

2.4. Replay Attacks

Replay attacks, in which recorded legitimate data are fed back to mask a deviation, were formalized for control systems by Mo and Sinopoli [16] and placed within a general attack-space taxonomy by Teixeira et al. [17]. In consensus, a replayed value is dangerous precisely because it was once legitimate and therefore lies inside the range that trimming accepts. Our stale-replay adversary is designed around this property.

3. Proposed Framework: Timestamp-Free Delayed W-MSR

The rule we analyze is deliberately minimal. It adds nothing to W-MSR except the requirement that the trimming reference is the agent’s own current state, which is always available without delay. No timestamps, sequence numbers, or delay estimates are used, so an adversary gains nothing by forging them.

At step k, normal agent i holds the latest value $y_{ij}\left(k\right)$ received from each in-neighbor j. It splits these values into those strictly above $x_i\left(k\right)$, those strictly below, and those equal to it. If more than F values lie above $x_i\left(k\right)$, the F largest are discarded. Otherwise, all values above are discarded. The same rule is applied below. Values equal to $x_i\left(k\right)$ are always kept. The remaining set ${\mathcal{R}}_i\left(k\right)$ is averaged with $x_i\left(k\right)$ using weights bounded below by $\alpha >0$. Algorithm 1 summarizes the procedure. Its per-step cost is $O\left(d_i\log d_i\right)$ for an agent with $d_i$ neighbors, the same as delay-free W-MSR.

Algorithm 1:Timestamp-free delayed W-MSR (agent i)

Require:  trimming parameter F, own state $x_i\left(k\right)$, latest received values ${\left\{y_{ij}\left(k\right)\right\}}_{j\in {\mathcal{N}}_i}$ 1: $\mathcal{U}\leftarrow \{y_{ij}\left(k\right):y_{ij}\left(k\right)>x_i\left(k\right)\}$, $\mathcal{L}\leftarrow \{y_{ij}\left(k\right):y_{ij}\left(k\right)<x_i\left(k\right)\}$ 2: $\mathcal{E}\leftarrow \{y_{ij}\left(k\right):y_{ij}\left(k\right)=x_i\left(k\right)\}$ 3: remove the $\min (F,|\mathcal{U}\left|\right)$ largest values from $\mathcal{U}$ 4: remove the $\min (F,|\mathcal{L}\left|\right)$ smallest values from $\mathcal{L}$ 5: ${\mathcal{R}}_i\left(k\right)\leftarrow \mathcal{U}\cup \mathcal{L}\cup \mathcal{E}$ 6: choose weights $a_{ii}\left(k\right),a_{iy}\left(k\right)\ge \alpha$ with $a_{ii}\left(k\right)+{\sum }_{y\in {\mathcal{R}}_i\left(k\right)}{a}_{iy}\left(k\right)=1$ 7: $x_i(k+1)\leftarrow a_{ii}\left(k\right)x_i\left(k\right)+{\sum }_{y\in {\mathcal{R}}_i\left(k\right)}{a}_{iy}\left(k\right)y$ 8: broadcast $x_i(k+1)$▹ no timestamp attached

4. System Architecture and Threat Model

4.1. Network and Delay Channel

The network is a graph $\mathcal{G}=(\mathcal{V},\mathcal{E})$ with $N=\left|\mathcal{V}\right|$ agents and in-neighbor sets ${\mathcal{N}}_i$. The agent set is partitioned into normal agents $\mathcal{N}$ and adversarial agents $\mathcal{A}$. The model is F-local: $|{\mathcal{N}}_i\cap \mathcal{A}|\le F$ for every $i\in \mathcal{N}$. Each normal agent i has a scalar state $x_i\left(k\right)$ and, from a normal in-neighbor j, receives

$$y_{ij}\left(k\right)=x_j\left(k-d_{ij}\left(k\right)\right),0\le d_{ij}\left(k\right)\le \tau ,$$

(1)

where the delay $d_{ij}\left(k\right)$ may differ across links and steps and is unknown to agent i. This model covers reordering, since a later step may deliver an older value, and duplicate delivery. States before time zero are set to $x_j\left(s\right)=x_j\left(0\right)$ for $s<0$. The normal update of Algorithm 1 reads

$$x_i(k+1)=a_{ii}\left(k\right)x_i\left(k\right)+\sum _{y\in {\mathcal{R}}_i\left(k\right)}{a}_{iy}\left(k\right)y.$$

(2)

Assumption A1. 

There is $\alpha \in (0,1)$ such that $a_{ii}\left(k\right)\ge \alpha$ and $a_{iy}\left(k\right)\ge \alpha$ for all retained values, and the weights in (2) sum to one.

4.2. Adversary Models

We consider three adversary capabilities of increasing strength. A malicious agent broadcasts a single state $x_a\left(k\right)$ per step, and its messages traverse the same delay channel (1). A Byzantine agent may send an arbitrary, receiver-specific value on every link at every step. A stale-replay agent is a Byzantine agent restricted to values that were once legitimate normal states. Adversaries may know the entire state, the graph, and the algorithm, and may collude. In the adversarial-scheduling setting the adversary also chooses every delay $d_{ij}\left(k\right)\in [0,\tau ]$. Figure 1 shows the resulting architecture.

5. Mathematical Model and Analysis

5.1. Window Hull

Because delayed values can be up to $\tau$ steps old, the natural Lyapunov-like quantity is the range of normal states over a window of $\tau +1$ steps. We define

$$\begin{array}{cc}\hfill M\left(k\right)& ={\max }_{i\in \mathcal{N},s\in [k-\tau ,k]}{x}_i\left(s\right),\hfill \\ \hfill m\left(k\right)& ={\min }_{i\in \mathcal{N},s\in [k-\tau ,k]}{x}_i\left(s\right),\hfill \end{array}$$

(3)

and the window diameter

$$D\left(k\right)=M\left(k\right)-m\left(k\right).$$

(4)

Figure 2 illustrates these quantities. Resilient consensus means that $D\left(k\right)\to 0$ while all normal states remain in $\left[m\right(0),M(0\left)\right]$.

5.2. Robustness Notions

Definition 1 

([10]). For $S\subseteq \mathcal{V}$ and $r\in \mathbb{N}$, let ${\mathcal{X}}_S^r=\{i\in S:|{\mathcal{N}}_i\setminus S|\ge r\}$. The graph isr-robustif for every pair of nonempty disjoint $S_1,S_2\subseteq \mathcal{V}$, at least one of ${\mathcal{X}}_{S_1}^r,{\mathcal{X}}_{S_2}^r$ is nonempty. It is$(r,s)$-robustif for every such pair at least one of the following holds: ${\mathcal{X}}_{S_1}^r=S_1$, ${\mathcal{X}}_{S_2}^r=S_2$, or $|{\mathcal{X}}_{S_1}^r|+|{\mathcal{X}}_{S_2}^r|\ge s$.

A $(2F+1)$-robust graph is also $(F+1,F+1)$-robust, but the converse does not hold [10].

5.3. Safety

Lemma 1 

(Bracketing). For every $i\in \mathcal{N}$ and $k\ge 0$, every retained value $y\in {\mathcal{R}}_i\left(k\right)$ satisfies $m\left(k\right)\le y\le M\left(k\right)$, for any adversary behavior.

Proof. 

If y comes from a normal neighbor, then by (1) it equals $x_j\left(s\right)$ for some $s\in [k-\tau ,k]$ and lies in the window by (3). If $y=x_i\left(k\right)$, the same holds. Suppose y comes from an adversary and $y>x_i\left(k\right)$. Since y was retained, more than F values exceed $x_i\left(k\right)$ and the F discarded largest values are all at least y. At most $F-1$ of those discarded values are adversarial, because y itself is adversarial and $|{\mathcal{N}}_i\cap \mathcal{A}|\le F$. Hence some discarded value $z\ge y$ comes from a normal neighbor and $y\le z\le M\left(k\right)$. Also $y>x_i\left(k\right)\ge m\left(k\right)$. The case $y<x_i\left(k\right)$ is symmetric. Ties are harmless, because values equal to $x_i\left(k\right)$ already lie in the hull.    □

Theorem 1 

(Window-hull safety). Under Assumption A1, for any F-local adversary, including Byzantine and stale-replay behavior, and any delays satisfying (1), $M(k+1)\le M\left(k\right)$ and $m(k+1)\ge m\left(k\right)$ for all $k\ge 0$. Consequently $x_i\left(k\right)\in [m\left(0\right),M\left(0\right)]$ for all $i\in \mathcal{N}$ and $k\ge 0$.

Proof. 

By Lemma 1, $x_i(k+1)$ in (2) is a convex combination of numbers in $\left[m\right(k),M(k\left)\right]$, so $x_i(k+1)\le M\left(k\right)$. The window at $k+1$ consists of the window at k without step $k-\tau$, plus step $k+1$, so $M(k+1)\le \max \{M\left(k\right),{\max }_i{x}_i(k+1)\}=M\left(k\right)$. The bound on m is symmetric.    □

Theorem 1 does not require any robustness condition. In particular, a replayed value can be accepted only if it lies inside the current window hull, so replay cannot widen the range of normal states.

5.4. Liveness Under $(2F+1)$-Robustness

Lemma 2 

(Margin decay). Fix $k_0$ and let $M_0=M\left(k_0\right)$. If $i\in \mathcal{N}$ satisfies $x_i\left(s\right)\le M_0-\delta$ for some $s\ge k_0$ and $\delta >0$, then for all $t\ge 0$

$$x_i(s+t)\le M_0-{\alpha }^t\delta .$$

(5)

The symmetric statement holds for $m\left(k_0\right)$.

Proof. 

By Theorem 1 and Lemma 1, every retained value at step s is at most $M_0$. Hence $x_i(s+1)\le a_{ii}\left(s\right)(M_0-\delta )+(1-a_{ii}\left(s\right))M_0\le M_0-\alpha \delta$. Induction on t completes the proof.    □

Theorem 2 

(Delay-taxed exponential consensus). Let $\mathcal{G}$ be $(2F+1)$-robust, let the adversary be F-local with arbitrary (Byzantine) behavior, let delays satisfy (1), and let Assumption A1 hold. With $H=\left|\mathcal{N}\right|(\tau +1)+\tau$ and $\gamma =1-\frac{1}{2}{\alpha }^H$,

$$D(k+H)\le \gamma D\left(k\right)\mathrm{for}\mathrm{all}k\ge 0,$$

(6)

so $D\left(k\right)\le {\gamma }^{\lfloor k/H\rfloor }D\left(0\right)$ and all normal states converge to a common limit in $\left[m\right(0),M(0\left)\right]$.

Proof. 

Fix $k_0$ with $D_0=D\left(k_0\right)>0$, write $M_0=M\left(k_0\right)$, $m_0=m\left(k_0\right)$, $T=\tau +1$, and define phases $k_{\ell }=k_0+\ell T$ with margins ${ϵ}_0=D_0/2$ and ${ϵ}_{\ell +1}={\alpha }^T{ϵ}_{\ell }$. Let $X_M^{\ell }=\{i\in \mathcal{N}:x_i\left(k_{\ell }\right)>M_0-{ϵ}_{\ell }\}$ and $X_m^{\ell }=\{i\in \mathcal{N}:x_i\left(k_{\ell }\right)<m_0+{ϵ}_{\ell }\}$, which are disjoint because ${ϵ}_{\ell }\le D_0/2$. (i) Nesting. If $i\notin X_M^{\ell }$, Lemma 2 gives $x_i\left(k_{\ell +1}\right)\le M_0-{\alpha }^T{ϵ}_{\ell }=M_0-{ϵ}_{\ell +1}$, so $X_M^{\ell +1}\subseteq X_M^{\ell }$, and likewise for $X_m$. (ii) Strict progress. If both sets are nonempty, $(2F+1)$-robustness yields, without loss of generality, some $i\in X_M^{\ell }$ with at least $2F+1$ in-neighbors outside $X_M^{\ell }$, of which at least $F+1$ are normal. Consider step $k=k_{\ell }+\tau$. Each such normal neighbor j has $x_j\left(k_{\ell }\right)\le M_0-{ϵ}_{\ell }$, and every value it can deliver at step k was produced at some $s\in [k_{\ell },k]$, so by (5) it is at most $M_0-{\alpha }^{\tau }{ϵ}_{\ell }$. If $x_i\left(k\right)\le M_0-{\alpha }^{\tau }{ϵ}_{\ell }$, then Lemma 2 gives $x_i(k+1)\le M_0-{ϵ}_{\ell +1}$. Otherwise these $F+1$ values lie strictly below $x_i\left(k\right)$. At most F values below $x_i\left(k\right)$ are discarded, so one of them, $y\le M_0-{\alpha }^{\tau }{ϵ}_{\ell }$, is retained with weight at least $\alpha$, and $x_i(k+1)\le M_0-{\alpha }^{\tau +1}{ϵ}_{\ell }=M_0-{ϵ}_{\ell +1}$. In both cases $i\notin X_M^{\ell +1}$, so $|X_M^{\ell }|+|X_m^{\ell }|$ decreases by at least one in every phase in which both sets are nonempty. (iii) Conclusion. After $L\le \left|\mathcal{N}\right|$ phases one set is empty, say $X_M^L$. Then every normal agent satisfies $x_i\left(k_L\right)\le M_0-{ϵ}_L$ with ${ϵ}_L\ge {\alpha }^{\left|\mathcal{N}\right|T}{D}_0/2$. By (5) all normal states in $[k_L,k_L+\tau ]$ are at most $M_0-{\alpha }^{\tau }{ϵ}_L$, hence $M(k_L+\tau )\le M_0-{\alpha }^H{D}_0/2$. Monotonicity from Theorem 1 gives (6).    □

With Theorem 1, this result matches the principle that bounded delay preserves invariants but slows progress: the horizon H is linear in $\tau +1$. The factor ${\alpha }^H$, however, makes the guaranteed per-step rate ${\rho }_{\mathrm{th}}={\gamma }^{1/H}$ extremely close to one. With $\left|\mathcal{N}\right|=18$ and $\alpha =1/14$, for example, $1-{\rho }_{\mathrm{th}}\approx {\alpha }^H/\left(2H\right)$ is about ${10}^{-22}$ already at $\tau =0$. The bound is a worst-case certificate over all adversaries and schedules, and its ${\alpha }^H$ structure is typical of set-shrinking arguments for MSR algorithms [10,18]. How the per-step rate behaves on concrete graphs is an empirical question, and the protocol of Section 6 is designed to measure it.

5.5. Delay-Induced Equivocation

Without delays, $(F+1,F+1)$-robustness is necessary and sufficient for malicious adversaries [10]. The next result shows that bounded delays, once the adversary can schedule them, already destroy this sufficiency. Let ${\mathcal{G}}_F$ consist of two cliques $A=\{A_0,\dots ,A_{a-1}\}$ and $B=\{B_0,\dots ,B_{a-1}\}$ with $a=2F+1$, cross edges $A_i{B}_{(i+t)moda}$ for $t=0,\dots ,F-1$, and F adversarial hubs connected to all normal agents and to each other. Figure 3 shows ${\mathcal{G}}_2$.

Proposition 1 

(Insufficiency of $(F+1,F+1)$-robustness under delays). For every $F\ge 1$ and $\tau \ge 1$ there are malicious (broadcasting) hubs on ${\mathcal{G}}_F$, initial states, and delays satisfying (1) for which $D\left(k\right)=D\left(0\right)>0$ for all k. The graph ${\mathcal{G}}_F$ is not $(2F+1)$-robust for any F. Exhaustive enumeration shows that it is $(F+1,F+1)$-robust for $F\in \{1,2\}$ and $2F$-robust for $F\in \{1,2,3\}$.

Proof. 

Set $x_A\left(0\right)=10$ and $x_B\left(0\right)=0$. Each hub broadcasts 10 at even steps and 0 at odd steps. Since $\tau \ge 1$, both values are always within the delay window, and the scheduler delivers the latest 10 to A and the latest 0 to B. An agent in A then receives $a-1$ values equal to 10 from A, F values equal to 10 from the hubs, and exactly F values equal to 0 from B. The only values below its state are those F zeros, which are all discarded, so its state stays at 10. The argument for B is symmetric, and $D\left(k\right)=10$ for all k. For $S_1=A$ and $S_2=B$, every node has exactly F cross neighbors and F hubs outside its set, so neither set is $(2F+1)$-reachable. The robustness properties were verified by enumerating all $3^{\left|\mathcal{V}\right|}$ ordered pairs of disjoint subsets for $(F+1,F+1)$-robustness and all $2^{\left|\mathcal{V}\right|}$ subsets for r-robustness.    □

Corollary 1. 

Under adversarially scheduled delays with $\tau \ge 1$, a malicious agent can present different values from its last $\tau +1$ broadcasts to different receivers, so it is as powerful as a Byzantine agent restricted to those values. Within the r-robust hierarchy and for $F\in \{1,2,3\}$, $(2F+1)$-robustness in Theorem 2 cannot be relaxed to $2F$-robustness.

6. Evaluation Methodology

This section specifies the simulation protocol for testing the predictions of Section 5 and for measuring quantities that the analysis bounds only loosely. The protocol addresses five evaluation questions. (E1) Safety: does the window hull ever expand in simulation, which Theorem 1 rules out? (E2) Liveness and rate: how do the convergence time and the per-step contraction rate depend on $\tau$, the delay schedule, and the attack on certified $(2F+1)$-robust graphs? (E3) Equivocation: how does ${\mathcal{G}}_2$ behave under each delay schedule and adversary class? (E4) Trimming parameter: how does misspecifying F affect safety and convergence? (E5) Scalability: how do the convergence time and the per-step cost grow with the network size? This preprint documents the protocol and does not report its outcomes.

6.1. Certified Graphs

Testing Theorem 2 requires graphs that are verifiably $(2F+1)$-robust, and deciding robustness is coNP-complete [13]. We generate geometric graphs by a growth procedure. Points are drawn uniformly in the unit square and ordered by distance from the center. The first $2r-1$ points form a clique, which is r-robust. Each later point is linked to all earlier points within radius $0.35\sqrt{20/N}$, and to its r nearest earlier points if that radius gives fewer than r links. Adding a node with at least r in-neighbors preserves r-robustness [10,13]. We use $r=5$ for $F=2$. For $N=20$ we also verified robustness exactly with a subset-sum pass over all $2^{20}$ subsets. All ten instances were 5-robust and none was 6-robust. They had 91–93 edges, minimum degree 5, and maximum degree 13–17. Larger graphs ($N\le 160$) rely on the construction certificate. Figure 4 summarizes the pipeline.

6.2. Adversaries and Delay Schedules

Two of the $N=20$ agents are adversarial ($F=2$), and normal initial states are drawn uniformly from $[0,10]$. The protocol uses four attacks. Constant broadcasts 20. Oscillating alternates between 20 and $-10$. Polarize alternates between the current maximum and minimum normal states. Stale replay sends, to every normal receiver above the normal median, the largest initial normal value, and to every receiver below it, the smallest. Stale replay is Byzantine, while the first three are malicious and pass through the delay channel. The protocol compares three delay schedules for $\tau \in \{0,2,5,10,20\}$. Random draws $d_{ij}\left(k\right)$ uniformly from $\{0,\dots ,\tau \}$, fixed uses $d_{ij}\left(k\right)=\tau$, and adversarial uses the polarizing scheduler of Algorithm 2.

Algorithm 2:Polarizing delay scheduler (evaluation adversary)

Require:  window history ${\left\{x_j\left(s\right)\right\}}_{s\in [k-\tau ,k]}$ for all senders, current normal states 1: $\mu \leftarrow$ median of ${\left\{x_i\left(k\right)\right\}}_{i\in \mathcal{N}}$ 2: for each normal receiver i and in-neighbor j do 3:     if $x_i\left(k\right)\ge \mu$ then 4:         deliver ${\max }_{s\in [k-\tau ,k]}{x}_j\left(s\right)$▹ feed stale highs 5:     else 6:         deliver ${\min }_{s\in [k-\tau ,k]}{x}_j\left(s\right)$▹ feed stale lows 7:     end if 8: end for

6.3. Study Designs

Main grid (E1, E2). Every combination of the four attacks, the three schedules, and $\tau \in \{0,2,5,10,20\}$ is run on each of the ten certified graphs with $N=20$ and $F=2$, which gives 600 runs. Counterexample study (E3). On ${\mathcal{G}}_2$, cluster A starts at 10, cluster B at 0, and the hubs are adversarial. The study covers $\tau \in \{0,1,2,5\}$, the three schedules, and the oscillating, polarize, and stale-replay attacks, for 36 runs of up to 5,000 steps. Ablation (E4). Normal agents use a trimming parameter $\widehat{F}\in \{0,1,2,3\}$ while the true number of adversaries is $F=2$, with $\tau =5$, the random and adversarial schedules, and all four attacks, which gives 80 runs per value of $\widehat{F}$. Setting $\widehat{F}=0$ reduces the rule to plain linear averaging and serves as the non-resilient baseline. Scalability (E5). Growth-certified 5-robust graphs with $N\in \{20,40,80,160\}$ are run with $\tau \in \{0,5\}$ under stale replay and the polarizing scheduler, with five seeds per size.

6.4. Metrics and Statistical Analysis Plan

We record the window diameter $D\left(k\right)$ from (4), the convergence time $T_{\epsilon }=\min \{k:D\left(k\right)<\epsilon \}$ with $\epsilon ={10}^{-3}$, the number of steps at which $M\left(k\right)$ increases or $m\left(k\right)$ decreases (hull violations, which Theorem 1 predicts to be zero), and the maximum excursion of normal states outside $\left[m\right(0),M(0\left)\right]$. We fit the per-step rate $\widehat{\rho }$ by least squares on $\log D\left(k\right)$ over ${10}^{-6}<D\left(k\right)<{10}^{-1}$ and define the time constant

$$t_c=-1/\ln \widehat{\rho }.$$

(7)

Each run stops at $D\left(k\right)<{10}^{-6}$ or after $4\times {10}^4$ steps, or after 5,000 steps in the counterexample study. For each configuration of the main grid, $T_{\epsilon }$ is summarized by its mean and standard deviation over the ten graphs, and $\widehat{\rho }$ and the time constant (7) by their medians over the 40 runs (four attacks, ten graphs) per schedule and delay bound. The dependence on the delay bound is summarized by fitting $t_c\propto {(\tau +1)}^{\beta }$ by least squares on log-log axes over all 200 runs per schedule, with the standard error of $\beta$ and the coefficient of determination. The fitted rates are compared with the guaranteed rate ${\rho }_{\mathrm{th}}$ of Theorem 2. The ablation records, for each $\widehat{F}$, the number of converged runs, the number of hull violations, and the maximum excursion. The scalability study records $T_{\epsilon }$ and the wall-clock time per simulation step.

6.5. Implementation and Reproducibility

Weights are uniform, $a_{ii}=a_{iy}=1/(1+|{\mathcal{R}}_i\left(k\right)\left|\right)$, which satisfies Assumption A1 with $\alpha =1/(1+d_{\max })$. The simulator is written in pure Python 3.15 using only the standard library, and the protocol is executed on an Intel Core Ultra 5 225U (14 threads, 15.5 GB RAM) with a 14-process pool and no GPU. Seeds fix the point geometry, the adversary placement, and the initial states, so every run is deterministic given its configuration. Table 2 lists all settings.

7. Discussion

7.1. Design Rationale

The rule trims relative to the agent’s own current state because that state is the only reference that is always available without delay and cannot be forged by an adversary. This choice is what makes Theorem 1 independent of robustness: every retained value is either a normal value from the last $\tau +1$ steps or an adversarial value bracketed by such a value, so the convex update cannot leave the window hull. The window hull, rather than the instantaneous range of normal states, is the appropriate invariant, because the instantaneous range can widen when a delayed value from an earlier, wider configuration is delivered. The same reasoning explains why replay alone cannot widen the range of normal states: a replayed value can be accepted only if it already lies inside the window hull.

7.2. Implications of Delay-Induced Equivocation

Proposition 1 shows that control over delays turns a broadcasting adversary into a restricted Byzantine one. An adversary may gain such control by delaying its own transmissions per receiver, as in our model, or, for example, by operating relays. For systems where this is possible, the analysis suggests designing for $(2F+1)$-robustness rather than $(F+1,F+1)$-robustness. The construction relies on adversarial scheduling. Whether $(F+1,F+1)$-robustness suffices when delays are random or otherwise outside the adversary’s control is not settled by our analysis.

7.3. Misspecified Trimming Parameter

The proof of Lemma 1 uses only the facts that at most F adversarial values reach a normal agent and that F values are discarded on each side. If agents discard $\widehat{F}\ge F$ values on each side, the same argument applies, so Theorem 1 continues to hold. If $\widehat{F}<F$, the bracketing step fails, and the analysis gives no safety guarantee. Overestimating F also raises the number of neighbors a node needs before any value survives trimming, which motivates the ablation design (E4).

7.4. Relation to Prior Work

Our sufficient condition coincides with that of prior delayed resilient consensus [18,19]. We add an explicit horizon, a safety guarantee that needs no robustness assumption and holds against Byzantine replay, and graphs showing that the gap between the known necessary and sufficient conditions is real. Within the r-robust hierarchy and for $F\le 3$ the gap closes (Corollary 1). Intermediate $(r,s)$ conditions, such as $(F+1,2F+1)$-robustness, remain to be classified. Maximum-based consensus [30] avoids the gap by never averaging, but it converges to an extreme value rather than to a point inside the normal hull. Multi-hop relays [32] are complementary to our analysis. Unlike timestamp-based replay defenses [16], the rule needs no authenticated clock.

7.5. What the Evaluation Must Establish

The analysis leaves several properties to measurement. Theorem 2 bounds the per-step rate by a quantity that is extremely close to one, so the actual rate on concrete graphs, and how it scales with $\tau$, must be measured (E2). The polarizing scheduler of Algorithm 2 is a heuristic, so whether it is the worst case for rate is open. The behavior of ${\mathcal{G}}_2$ under random and fixed delays is not covered by Proposition 1 (E3). The cost of misspecifying F in convergence time (E4) and the growth of convergence time with network size (E5) also have no analytical characterization here.

8. Limitations

The analysis covers scalar states, synchronous update instants, and a known bound F. Vector states require centerpoint-type trimming [25], and we have not extended the window argument to that case. The rate bound in Theorem 2 is conservative because of the factor ${\alpha }^H$. The robustness properties of ${\mathcal{G}}_F$ are verified only for $F\le 3$, because exhaustive enumeration grows as $3^{\left|\mathcal{V}\right|}$, and a proof for general F is missing. In the evaluation protocol, the polarizing scheduler is not proven to be a worst case, exact certification of the evaluation graphs is limited to $N=20$, and larger graphs rely on the growth lemma. The simulation model assumes idealized message delivery and does not model packet loss beyond the delay window, quantization, or clock drift.

9. Conclusion

This paper analyzed timestamp-free W-MSR under bounded time-varying delays. The window hull of normal states never expands, whatever the adversaries send and however messages are delayed, and $(2F+1)$-robustness guarantees exponential consensus with a horizon linear in $\tau +1$. Delays that the adversary can schedule, however, let a broadcasting adversary equivocate. On graphs that are $(F+1,F+1)$-robust and, for $F\le 3$, $2F$-robust, scheduled delays of a single step suffice to prevent agreement. We also specified a simulation protocol, built on certified robust graphs, for measuring the convergence rate, the effect of delay schedules and adversary classes, the sensitivity to the trimming parameter, and scalability. This preprint does not report the outcomes of that protocol. Open questions include worst-case delay schedules, the remaining gap in the $(r,s)$ hierarchy, a general proof of the robustness of ${\mathcal{G}}_F$, bounded-average delay models, and extensions to multi-dimensional states and multi-hop relays.