Trimmed-mean federated chain for robust aggregation against poisoning attacks in federated learning

Federated learning enables collaborative model training across decentralised devices while preserving data privacy. However, its distributed nature makes it vulnerable to poisoning attacks, including Byzantine attacks, backdoor attacks, and Coordinated Model Poisoning (CMP) attacks. Recent studies have highlighted increasing concerns regarding coordinated and adaptive poisoning attacks, where malicious clients collaboratively manipulate model updates to evade conventional robust aggregation mechanisms. Although existing approaches such as the Krum Federated Chain (KFC) provide robustness against traditional adversarial settings, their effectiveness may degrade under increasingly complex datasets and coordinated attack scenarios. To address these limitations, this paper proposes the Trimmed-Mean Federated Chain (TFC), a blockchain-based robust aggregation framework that integrates global norm stabilisation, directional filtering, and trimmed-mean aggregation within a federated chain architecture. The proposed framework suppresses abnormal client updates with excessively large magnitudes and applies layerwise cosine similarity filtering to identify directionally inconsistent updates before aggregation. Extensive experiments are conducted on benchmark image classification datasets, including EMNIST, Fashion-MNIST, and CIFAR-10, under Byzantine, backdoor, and CMP attack settings. Experimental results demonstrate that TFC generally achieves stronger robustness performance than KFC under Byzantine and backdoor attacks while maintaining competitive performance under more challenging CMP scenarios. These findings indicate that the integration of stabilisation, directional filtering, and trimmed-mean aggregation improves empirical robustness under the evaluated adversarial settings, although the present study does not establish formal Byzantine fault-tolerance or convergence guarantees.