DTAG-FL: A Digital-Twin, Attention-Graph, and Reinforcement-Learning Framework for Byzantine-Robust Federated Learning

Abstract

Federated learning (FL) enables collaborative model training across decentralized clients without sharing raw data, but its distributed nature exposes it to Byzantine and model-poisoning attacks in which malicious clients submit corrupted updates to degrade or subvert the global model. Classical robust aggregators such as coordinate-wise median, trimmed mean, and Krum defend against specific attack families but are static: they apply a fixed rule regardless of how the adversarial behavior evolves over communication rounds, and they discard the rich temporal and relational structure of client behavior. This paper presents DTAG-FL, an integrated defense that treats each client as a persistent behavioral digital twin and reasons about trust jointly across space, time, and counterfactual outcome. DTAG-FL comprises eight coupled modules: (1) per-client digital twins accumulating a rolling history of behavioral features; (2) a dynamic k-nearest-neighbor behavioral graph over client updates; (3) a three-layer GATv2 trust reasoner with joint trust and attack-probability heads; (4) a GRU temporal predictor that forecasts a client's next-round attack probability from its twin history; (5) Monte-Carlo-dropout uncertainty estimation over the graph reasoner; (6) counterfactual verification that measures each suspicious update's marginal harm to validation loss via leave-one-out re-aggregation; (7) a Proximal-Policy-Optimization (PPO) meta-controller that selects among DTAG trust-weighting and three classical robust aggregators, guarded by a safety shield; and (8) feature-attribution and attention-edge explanations. We implement and execute the complete pipeline end-to-end on the PathMNIST colorectal-histology benchmark under a non-IID Dirichlet partition across 12 clients with 25% malicious participants mounting four attack types simultaneously sign-flipping, Gaussian noise, model-replacement, and an adaptive orthogonal attack. Under identical poisoned-update streams, DTAG-FL reaches 42.9% test accuracy (0.875 macro-AUC) whereas vanilla FedAvg, coordinate-wise median, trimmed mean, and Krum all collapse to 17.9%, near the 11.1% single-class floor of this 9-class task a 2.40x relative accuracy advantage for the proposed method under attack. We report the full trajectory honestly, including a transient single-round collapse and recovery, the residual aggregation weight that malicious clients retain, and the fact that DTAG-FL benefits from an aggregate-update norm-clipping guard that the vanilla baselines do not receive.