PRISM-FCP: Byzantine-Resilient Federated Conformal Prediction via Partial Sharing

2026-02-20

AI Summary

This work addresses a critical vulnerability in existing federated conformal prediction methods, which defend against Byzantine attacks only during the calibration phase and remain susceptible to poisoned updates during training, often resulting in inflated prediction intervals or coverage failure. To overcome this limitation, the authors propose PRISM-FCP, a framework that achieves end-to-end Byzantine robustness by jointly securing both training and calibration phases. During training, clients share only partial model parameters to mitigate the impact of malicious perturbations. In calibration, inconsistency-based scores are used to construct feature vectors, enabling distance-based detection and suppression of adversarial clients for robust quantile estimation. Evaluated on synthetic and UCI superconductivity datasets, PRISM-FCP is the first method to deliver Byzantine-robust federated conformal prediction, maintaining nominal coverage while significantly narrowing prediction intervals and reducing communication overhead.

Technology Category

• Machine Learning: Calibration & Uncertainty Quantification
• Computer Vision: Adversarial Attacks & Robustness
• Natural Language Processing: Safety and Robustness

Application Category

• User Modeling, Personalization and Recommendation: Federated recommendation systems and personalization
• Security and Privacy: Large-scale security measurements
• Search and Retrieval-Augmented AI: Web learning to rank, online learning, and counterfactual learning for ranking

Abstract

We propose PRISM-FCP (Partial shaRing and robust calIbration with Statistical Margins for Federated Conformal Prediction), a Byzantine-resilient federated conformal prediction framework that utilizes partial model sharing to improve robustness against Byzantine attacks during both model training and conformal calibration. Existing approaches address adversarial behavior only in the calibration stage, leaving the learned model susceptible to poisoned updates. In contrast, PRISM-FCP mitigates attacks end-to-end. During training, clients partially share updates by transmitting only $M$ of $D$ parameters per round. This attenuates the expected energy of an adversary's perturbation in the aggregated update by a factor of $M/D$, yielding lower mean-square error (MSE) and tighter prediction intervals. During calibration, clients convert nonconformity scores into characterization vectors, compute distance-based maliciousness scores, and downweight or filter suspected Byzantine contributions before estimating the conformal quantile. Extensive experiments on both synthetic data and the UCI Superconductivity dataset demonstrate that PRISM-FCP maintains nominal coverage guarantees under Byzantine attacks while avoiding the interval inflation observed in standard FCP with reduced communication, providing a robust and communication-efficient approach to federated uncertainty quantification.

Problem

• Byzantine-resilient
• Federated Conformal Prediction
• model poisoning
• uncertainty quantification
• adversarial robustness

Innovation

• Byzantine-resilient
• Federated Conformal Prediction
• Partial Model Sharing
• Robust Calibration
• Uncertainty Quantification