# FedReview: A Review Mechanism for Rejecting Poisoned Updates in Federated
Learning

Tianhang Zheng  Baochun Li  University of Toronto

###### Abstract

Federated learning has recently emerged as a decentralized approach to learn a
high-performance model without access to user data. Despite its effectiveness,
federated learning gives malicious users opportunities to manipulate the model
by uploading poisoned model updates to the server. In this paper, we propose a
review mechanism called FedReview to identify and decline the potential
poisoned updates in federated learning. Under our mechanism, the server
randomly assigns a subset of clients as reviewers to evaluate the model
updates on their training datasets in each round. The reviewers rank the model
updates based on the evaluation results and count the number of the updates
with relatively low quality as the estimated number of poisoned updates. Based
on review reports, the server employs a majority voting mechanism to integrate
the rankings and remove the potential poisoned updates in the model
aggregation process. Extensive evaluation on multiple datasets demonstrate
that FedReview can assist the server to learn a well-performed global model in
an adversarial environment.

##  1 Introduction

Over the past few years, deep learning has made a series of substantial
breakthroughs due to the availability of massive training data. In spite of
those impressive breakthroughs, the widespread application of deep learning in
the real world is still facing a variety of challenges. One imperative
challenge is the concern from many users about sharing their sensitive data
for training deep learning models. To overcome this challenge, the community
proposed a decentralized learning technique called federated learning.
Federated learning enables the users to train models on their local devices
and involves a server to aggregate the training results for updating a global
model. Therefore, federated learning does not require direct access to the
user data to train deep learning models.

While federated learning attempts to safeguard user data, it simultaneously
introduces a critical attack vector, known as model poisoning, for potential
adversaries to corrupt the model. Model poisoning occurs when an adversary,
either hiding among the users or compromising some user devices, corrupts the
model by uploading poisoned model updates to the server. This new attack
vector has sparked significant research effort within the community to
investigate new model poisoning attacks and defenses.

On one hand, the community has proposed several model poisoning methods [1, 2,
3, 4] to facilitate the exploration of the risks raised by model poisoning in
different scenarios. On the other hand, several defensive methods have been
developed against model poisoning, such as robust aggregation methods [5, 6],
which compute a robust estimation of the averaged update over the benign and
poisoned updates, to mitigate the negative effects of poisoned updates. To
circumvent those robust aggregation methods, some recent works [3, 7] further
developed adaptive model poisoning attacks to generate poisoned updates that
can bypass the criterion of those robust aggregation methods. Notably, the
attacks proposed by [7], such as min-max and min-sum attacks, significantly
reduce the accuracy of federated learning, even under protection of robust
aggregation.

Despite the remarkable effectiveness of min-max and min-sum attacks against
robust aggregation methods, we observe that most previous works [8, 7, 9]
evaluate these attacks under a special setting, where the users upload model
gradients or single-epoch model updates. In practical scenarios, if the
participating clients learn model updates via multi-epoch local training
(e.g., five epochs), we find that min-max and min-sum attacks can not cause
severe performance degradation. Thorough extensive analysis, we demonstrate
that min-sum and min-max attacks using the inverse unit vector as the
perturbation vector are equivalent to the scaling model poisoning attack [1]
with a dynamic scaling factor, which is too small to induce severe negative
impacts on the global model. Increasing this scaling factor to an appropriate
value leads to a substantial reduction in the model accuracy, even if the
server applies robust aggregation methods.

Since robust aggregation methods are still vulnerable to model poisoning, the
community has proposed several advanced defenses, such as FLTrust [4] and
FLDetector [10]. In contrast to robust aggregation methods, FLTrust and
FLDetector can detect the majority of malicious clients. Nevertheless, FLTrust
requires the server to possess a clean validation dataset with a distribution
similar to the user data distribution. According to [10], FLTrust exhibits
poor performance when the distribution of the validation dataset diviates from
the user data distribution. FLDetector has a prerequisite about high
consistency between the current model updates and the historic updates from a
benign client.

Different from the previous defensive methodologies, we introduce a
distributed review mechanism called FedReview, which does not require the
prerequisites of FLTrust and FLDetector, to identify and discard potential
poisoned updates in federated learning. Under FedReview, the server needs to
randomly select a subset of clients as reviewers to evaluate the model updates
and submit review reports. Each review report comprises two crucial
components—an estimated number of poisoned updates and a ranking of the model
updates. After collecting the reviews, the server can obtain a reliable
estimation of the number of potential poisoned updates. Based on the collected
rankings, the server can further leverage a simple but effective majority vote
mechanism to obtain the indices of the potential poisoned updates.

We conduct a comprehensive set of experiments to evaluate our review mechanism
on Purchase-100, EMNIST, CIFAR-10, and FEMNIST. We demonstrate that our
reviewer mechanism FedReview can correctly identify the poisoned updates with
high precision. We further compare FedReview with multiple robust aggregation
methods, including M-Krum, Trimmed Mean, and Median, which also do not require
the server to possess any validation data or high update consistency. Our
evaluation results indicate that our review mechanism outperforms those
methods by up to $30\%$ in terms of model accuracy.

The reminder of the paper is organized as follows: We first introduce the
background knowledge and related work in Section 2. In Section 3, we formulate
the threat model. In Section 4, we introduce model poisoning attacks and
explain why min-max and min-sum attacks are not effective. In Section 5, we
present our review mechanism to identify and reject potential poisoned updates
in federated learning. We conduct extensive evaluations in Section 6, discuss
the pros and cons of FedReview in Section 7, and conclude the paper in Section
8.

##  2 Preliminaries

###  2.1 Definitions and Notations

We denote a data sample by $\bm{x}$ and its label by $y$. We denote the label
set by $\mathcal{Y}_{y}=\\{1,2,...,\mathcal{Y}\\}$ with totally $\mathcal{Y}$
labels. We represent a neural network by $\bm{f}_{\bm{\mathchar
28946\relax}}(\cdot)$ with model weights $\bm{\mathchar 28946\relax}$.
$\bm{f}_{\bm{\mathchar 28946\relax}}(\bm{x})$ refers to the softmax output of
$\bm{x}$, and $\ell(\bm{f}_{\bm{\mathchar 28946\relax}}(\bm{x}),y)$ refers to
the cross-entropy between $\bm{f}_{\bm{\mathchar 28946\relax}}(\bm{x})$ and
$y$. i.i.d. is the abbreviation of independent and identically distributed. In
terms of the hyperparameters of federated learning, we denote the total number
of training rounds by $T$ and the set of clients by $\mathcal{S}$. We
represent the number of selected clients in each round by indices
$\\{1,2...,C\\}$. We denote the $c$-th client’s training dataset by $D_{c}$.

###  2.2 Federated Learning

Federated Learning (FL) is proposed as a decentralized learning technique for
data privacy protection [11, 12]. A general setup of federated learning needs
a server to coordinate a number of clients for the purpose of optimizing a
global model through multiple-round training and communication. As shown in
Fig. 1, in each training round, the server first selects several clients and
sends the current global model weights to the selected clients. Sequentially,
the selected clients train the received model on their local training
datasets, and upload the updated local models back to the server. Finally, the
server aggregates the local models to update the global model and starts a new
round. The most commonly-used model aggregation method is FedAvg [13]. To
facilitate the development of federated learning, the community has developed
several federated learning platforms such as FedScale [14], Plato [15], FATE
[16], and Flute [17].

Figure 1: The pipeline of federated learning in one training round.

###  2.3 Model Poisoning

The setup of federated learning provides a malicious client a chance to
manipulate the global model by poisoning the uploaded model updates. This
direct manipulation on model weights by poisoned model updates significantly
enhances the effectiveness of poisoning attacks, compared to the indirect
impact of data poisoning [18] on the model weights. To generate the poisoned
updates, the adversary can learn the updates using a contaminated dataset and
scale up the updates to amplify their effects [1]. However, advanced
Byzantine-robust aggregation algorithms mentioned in Section 2.4 can
substantially mitigate the effects of the poisoned updates.

To bypass Byzantine-robust aggregation algorithms, some prior works formulate
the attack as an optimization problem, with the knowledge about other clients’
data or collision between malicious clients [3, 7]. Specifically, Fang et al.
[3] assumed that an adversary compromises multiple worker devices, and each
worker device sends a (poisoned) model update to the master device, which is
similar to collision between multiple malicious clients. [7] assumed that the
adversary controls multiple clients and may have access to other client data
(distribution). Based on this assumption, [7] formulated optimization problems
to maximize the disparity between the malicious updates and the benign global
update, under the constraint that the malicious updates are likely to be
involved by robust aggregation methods for aggregating the global update.

###  2.4 Byzantine-Robust Aggregation

Byzantine robust aggregation methods are the most commonly-used methods for
defending against model poisoning, especially when the server does not have a
dataset to evaluate the model updates. In the following, we briefly introduce
three popular methods, i.e.,  Multi-Krum [5], Trimmed Mean [6], and Median
[6].

In each training round, the server receives $n=|\mathcal{S}_{t}|$ model
updates. We call the set of those $n$ updates as candidate set. Multi-Krum
computes the sum over the distances between each model update and its $n-m-2$
nearest model updates, where $m$ is the number of potential adversaries. The
server then selects the model update with the smallest sum of distances and
remove the update from the candidate set. M-Krum repeats the above procedure
for $n-2m-2$ times and employ the average over all the selected model updates
to update the global model.

Trimmed Mean sorts the values along each dimension of all the $n$ model
updates and removes the $\beta$ largest values and the $\beta$ smallest
values. Trimmed Mean uses the average of the remaining $n-2\beta$ values as
the update for each dimension of the global model weights. $\beta$ is usually
set as the number of potential adversaries.

Median computes the median of the values for each dimension over all the $n$
model updates. The median values are used as the update for the global model
weights. In this paper, we implement the above three methods for comparison
with our defensive mechanism.

##  3 Threat Model

###  3.1 Adversary’s Objective

In this paper, the adversary’s objective is to decrease the accuracy of the
global model, which is similar to the adversary’s goal in [3, 7]. The attacks
driven by this adversary’s objective are called untargeted model poisoning
attacks. In contrast to [7], the adversary studied in the paper crafts
poisoned model updates rather than malicious gradients, and upload the
poisoned updates with the server to achieve the attack goal.

###  3.2 Adversary’s Knowledge

Since this paper presents a review mechanism to defend against model
poisoning, we mainly consider a strong adversary with the knowledge of the
benign devices for evaluation. When the model updates are sent from the users
to the server through unencrypted channels, or all the updates are encrypted
with a shared secret key, the adversary is able to know the updates from the
benign devices. If the model updates are encrypted with user-specific secret
keys, the adversary may not know the updates. But in that case, key management
could be challenging and costly since federated learning usually involves a
large number of users in the training stage.

In terms of knowledge about the defense method, we consider two cases: (1) The
adversary knows and leverages the defense method to design an adaptive attack;
(2) The adversary does not use the defense method in its attack. For the first
case, the adversary could adopt the adaptive attack introduced in Section 4.3.
For the second case, the adversary could adopt the model poisoning attacks
introduced in Section 4.1 & 4.2.

###  3.3 Adversary’s Capabilities

Following the previous literature, we consider that the adversary is able to
control $20\%$ of the clients by default. If the server select any client from
the controlled $20\%$ clients, the client will upload a poisoned update, which
is provided by the adversary using the attacks in Section 4, to the server. In
the experiments, we also consider other settings of the proportion of the
compromised clients. The adversary is also capable of choosing an appropriate
attack method according to its knowledge, as introduced in Section 3.2.

##  4 Model Poisoning Attacks

###  4.1 Scaling Model Poisoning Attack

Untargeted model poisoning attempts to degrade the model performance by
uploading poisoned updates to the server. Given this adversary goal, we could
simply formulate a scaling model poisoning attack to craft the poisoned
update, i.e.,

$\displaystyle\Delta{\bm{\mathchar 28946\relax}}^{t}_{m}$
$\displaystyle=-\lambda\Delta{\bm{\mathchar 28946\relax}}^{t}~{}$
$\displaystyle s.t.~{}~{}\Delta{\bm{\mathchar 28946\relax}}^{t}=$
$\displaystyle\frac{1}{|\mathcal{S}_{t}|}\sum_{i\in\mathcal{S}_{t}}\Delta{\bm{\mathchar
28946\relax}}^{t}_{i},$ (1)

where $\mathcal{S}_{t}$ refers to the subset of clients selected for the
$t$-th round. $\Delta{\bm{\mathchar 28946\relax}}^{t}_{i}$ denotes the multi-
epoch updates from the selected clients. $\Delta{\bm{\mathchar
28946\relax}}^{t}$ is the average of the client updates, adopted as global
model update. $\Delta{\bm{\mathchar 28946\relax}}^{t}_{m}$ is the poisoned
update introduced by the scaling attack, which is the opposite of the global
model update scaled by a factor $\lambda$. Given the above formulation,
$\Delta{\bm{\mathchar 28946\relax}}^{t}_{m}$ can push the global model towards
the opposite direction of the averaged benign update, i.e.,
$\Delta{\bm{\mathchar 28946\relax}}^{t}$. $\lambda$ is a scaling factor to
amplify the poisoned update. _By default, the adversary could set $\lambda$ as
the ratio of benign clients to malicious clients so that the positive effect
of the benign updates will be neutralized by the negative effect of the
poisoned updates._

###  4.2 Optimization based Model Poisoning

To bypass robust aggregation methods, the community has proposed several
optimization based model poisoning methods, such as min-max and min-sum
attacks in [7]. Since min-max and min-sum attacks are two commonly-used
benchmarks in the recent literature [8, 9], we detail their formulations in
the following. The min-max attack can be mathematically expressed as

$\displaystyle\operatorname*{\mathop{\mathrm{argmax}}}_{\gamma}$
$\displaystyle\max_{i\in\mathcal{S}_{t}}\|\Delta{\bm{\mathchar
28946\relax}}^{t}_{m}-\Delta{\bm{\mathchar
28946\relax}}^{t}_{i}\|_{2}\leq\max_{i,j\in\mathcal{S}_{t}}\|\Delta{\bm{\mathchar
28946\relax}}^{t}_{i}-\Delta{\bm{\mathchar 28946\relax}}^{t}_{j}\|_{2}~{}$
$\displaystyle s.t.~{}~{}~{}\Delta{\bm{\mathchar
28946\relax}}^{t}_{m}=\frac{1}{|\mathcal{S}_{t}|}\sum_{i\in\mathcal{S}_{t}}\Delta{\bm{\mathchar
28946\relax}}^{t}_{i}-\gamma\Delta{\bm{\mathchar 28946\relax}}^{t}_{p},$ (2)

where
$\frac{1}{|\mathcal{S}_{t}|}\sum_{i\in\mathcal{S}_{t}}\Delta{\bm{\mathchar
28946\relax}}^{t}_{i}$ is the mean of the benign updates $\Delta{\bm{\mathchar
28946\relax}}^{t}_{i}$, and $\Delta{\bm{\mathchar 28946\relax}}^{t}_{p}$
refers to a malicious update direction, which is usually set as the direction
of $\frac{1}{|\mathcal{S}_{t}|}\sum_{i\in\mathcal{S}_{t}}\Delta{\bm{\mathchar
28946\relax}}^{t}_{i}$. The objective is to find the maximum $\gamma$
satisfying that the distance between the malicious update
$\Delta{\bm{\mathchar 28946\relax}}^{t}_{m}$ and any benign update is smaller
than the maximum distance between the benign updates. The malicious update
obtained by optimizing Eq. 4.2 is still close to the benign updates in terms
of the Euclidean distance and thus may bypass robust aggregation methods.

(a) Purchase-100

(b) EMNIST

Figure 2: The test accuracy of FedAvg against the min-max attack.

The min-sum attack can be mathematically expressed as

$\displaystyle\operatorname*{\mathop{\mathrm{argmax}}}_{\gamma}$
$\displaystyle\sum_{i\in\mathcal{S}_{t}}\|\Delta{\bm{\mathchar
28946\relax}}^{t}_{m}-\Delta{\bm{\mathchar
28946\relax}}^{t}_{i}\|_{2}\leq\sum_{i,j\in\mathcal{S}_{t}}\|\Delta{\bm{\mathchar
28946\relax}}^{t}_{i}-\Delta{\bm{\mathchar 28946\relax}}^{t}_{j}\|_{2}~{}$
$\displaystyle s.t.~{}~{}~{}\Delta{\bm{\mathchar
28946\relax}}^{t}_{m}=\frac{1}{|\mathcal{S}_{t}|}\sum_{i\in\mathcal{S}_{t}}\Delta{\bm{\mathchar
28946\relax}}^{t}_{i}-\gamma\Delta{\bm{\mathchar 28946\relax}}^{t}_{p},$ (3)

whose objective is to find the maximum $\gamma$ satisfying that the sum of the
distances between the malicious update benign updates$\Delta{\bm{\mathchar
28946\relax}}^{t}_{m}$ and all benign updates is smaller than the sum of the
distances between all benign updates. _Although min-max and min-sum attacks
seem to have complicated formulations, they are actually similar to the
scaling attack but adopt an optimized dynamic scaling factor $\lambda$._
Specifically, the most commonly-used $\Delta{\bm{\mathchar
28946\relax}}^{t}_{p}$ in Eq. 4.2 & 4.2 is $\Delta{\bm{\mathchar
28946\relax}}^{t}/\|\Delta{\bm{\mathchar 28946\relax}}^{t}\|_{2}$, where
$\Delta{\bm{\mathchar
28946\relax}}^{t}=\frac{1}{|\mathcal{S}_{t}|}\sum_{i\in\mathcal{S}_{t}}\Delta{\bm{\mathchar
28946\relax}}^{t}_{i}$. As a result, the poisoned update in Eq. 4.2 & 4.2 can
be rewritten as

$\displaystyle\Delta{\bm{\mathchar
28946\relax}}^{t}_{m}=-(\frac{\gamma}{\|\Delta{\bm{\mathchar
28946\relax}}^{t}\|_{2}}-1)\Delta{\bm{\mathchar 28946\relax}}^{t}$ (4)

_Therefore, min-max and min-sum attacks can be viewed as the scaling attack
with a dynamic scaling factor $\lambda=\frac{\gamma}{\|\Delta{\bm{\mathchar
28946\relax}}^{t}\|_{2}}-1$ in most cases._

Figure 3: The testing accuracy of the global model under the scaling attack
with different scaling factors $\lambda$.

In the previous literature, min-max and min-sum attacks are usually evaluated
on the model gradients or the model updates obtained by few optimization
steps. _However, in practical federated learning, we found that min-max and
min-sum attacks are not effective, even if the server does not apply any
defense._ Specifically, we conduct experiments on Purchase-100 and EMNIST,
where the model updates are the results of 5-epoch local optimization. We
report the testing accuracy in Fig. 2 and observed that the min-max attack is
not effective.

By digging into the learning process on Purchase-100, we observe that the
dynamic scaling factor oscillate between $-1$ and $2$. We also conduct
experiments to evaluate the scaling attack on Purchase-100 and demonstrate the
results in Fig. 3. As shown in Fig. 3, the scaling factor should be at least
larger than $2$ to make the attack effective. Thus, the min-max attack is not
effective due to a small scaling factor. In another word, due to the small
dynamic scaling factor, the poisoned update of the min-max attack can not
neutralize the positive effect of the benign updates in practical federated
learning. As a result, in Section 6, we mainly employ the scaling attack with
an appropriate factor to evaluate federated learning and the defense methods.

Figure 4: The testing accuracy achieved by our review mechanism against the
adaptive model poisoning attack.

###  4.3 Adaptive Model Poisoning

If the adversary knows the defense method used by the server and wants to
leverage the knowledge to design an adaptive attack, it can include the
defense mechanism in the attack objective introduced in Section 4.2.
Specifically, the objective of the adaptive attack for our proposed FedReview
can be formulated as

$\displaystyle\operatorname*{\mathop{\mathrm{argmax}}}_{\gamma}~{}$
$\displaystyle\Delta{\bm{\mathchar
28946\relax}}^{t}_{m}\notin\\{\Delta{\bm{\mathchar
28946\relax}}^{t}_{i}|i\in\mbox{the set returned by
Algorithm~{}\ref{alg:majority_vote}}\\}~{}$ $\displaystyle
s.t.~{}~{}~{}\Delta{\bm{\mathchar
28946\relax}}^{t}_{m}=\frac{1}{|\mathcal{S}_{t}|}\sum_{i\in\mathcal{S}_{t}}\Delta{\bm{\mathchar
28946\relax}}^{t}_{i}-\gamma\Delta{\bm{\mathchar 28946\relax}}^{t}_{p}.$ (5)

Since the adversary does not have access to the benign reviewers’ training
datasets, it can randomly select a subset of compromised clients as surrogate
reviewers to optimize the above attack objective. In the following, we call
this adaptive attack as AMP attack. We follow the method in [7] to optimize
AMP’s objective, which is illustrated in Algorithm 1.

Algorithm 1 Adaptive Model Poisoning

0: $\gamma_{init}$, $\\{\Delta{\bm{\mathchar
28946\relax}}^{t}_{i}|i\in\mathcal{S}_{t}\\}$, $\tau$

1: Initialize $\gamma\leftarrow\gamma_{init}$; $\gamma_{succ}\leftarrow 0$;
$\alpha\leftarrow\gamma_{init}$

2: Randomly select a subset of compromised clients as surrogate reviewers

3: while $|\gamma_{succ}-\gamma|>\tau$ do

4: $\Delta{\bm{\mathchar
28946\relax}}^{t}_{m}=\frac{1}{|\mathcal{S}_{t}|}\sum_{i\in\mathcal{S}_{t}}\Delta{\bm{\mathchar
28946\relax}}^{t}_{i}-\gamma\Delta{\bm{\mathchar 28946\relax}}^{t}_{p}$

5: $\\{\Delta\\}=\\{\Delta{\bm{\mathchar
28946\relax}}^{t}_{m}\\}\cup\\{\Delta{\bm{\mathchar
28946\relax}}^{t}_{i}|i\in\mathcal{S}_{t}\\}$

6: if $m\in\mbox{the set returned by Algorithm~{}\ref{alg:majority_vote}}$
then

7: $\gamma_{succ}\leftarrow\gamma$; $\gamma\leftarrow\gamma+\alpha/2$

8: else

9: $\gamma\leftarrow\gamma-\alpha/2$

10: end if

11: $\alpha\leftarrow\alpha/2$

12: end while

13: Return $\Delta{\bm{\mathchar
28946\relax}}^{t}_{m}=\frac{1}{|\mathcal{S}_{t}|}\sum_{i\in\mathcal{S}_{t}}\Delta{\bm{\mathchar
28946\relax}}^{t}_{i}-\gamma_{succ}\Delta{\bm{\mathchar 28946\relax}}^{t}_{p}$

In the experiments, we show that the updates learned by AMP indeed can bypass
our review mechanism in some cases, but the negative effects of those updates
will be significantly limited, and the scaling factor, i.e.,
$\lambda=\frac{\gamma}{\|\Delta{\bm{\mathchar 28946\relax}}^{t}\|_{2}}-1$, is
also smaller than $2$.. This is because, to bypass the review mechanism, the
poisoned updates have to yield low loss on the user data, which conflicts with
the adversary’s objective. Therefore, we conclude our review mechanism is a
very strong defense against model poisoning.

Algorithm 2 Review Mechanism for Federated Learning

0: The set of clients $S$; total number of rounds $T$; global model
$f_{{\bm{\mathchar 28946\relax}}}(\cdot)$ with model weights ${\bm{\mathchar
28946\relax}}$.

1: Initialize the model weights for $f_{{\bm{\mathchar 28946\relax}}}(\cdot)$,
denoted by ${\bm{\mathchar 28946\relax}}^{0}$.

2: for $t$ = $0$ to $T-1$ do

3: Server: Randomly select a subset of clients $S_{t}$ from $S$ and broadcast
${\bm{\mathchar 28946\relax}}^{t}$ to the selected clients.

4: Client $c$ ($c\in S_{t}$): Update or poison the global model weights, and
send the update $\Delta{\bm{\mathchar 28946\relax}}_{c}^{t}$ to the server.

5: Server: Receive updates from the clients and randomly select a subset of
clients $R_{t}$ from $S/S_{t}$ as reviewers.

6: Server: Send the updates $\\{\Delta{\bm{\mathchar
28946\relax}}_{c}^{t}|c\in S_{t}\\}$ to reviewers.

7: Client (Reviewer) $r$ ($r\in R_{t}$): Evaluate $\\{{\bm{\mathchar
28946\relax}}^{t}+{\bm{\mathchar 28946\relax}}_{c}^{t}|c\in S_{t}\\}$ on its
training data to obtain loss $\\{loss_{c,r}^{t}|c\in S_{t}\\}$.

8: Client (Reviewer) $r$ ($r\in R_{t}$): Estimate the number of adversaries,
i.e., $n_{adv}^{r}$, using Algorithm 3.

9: Client (Reviewer) $r$ ($r\in R_{t}$): Rank the updates based on
$\\{loss_{c,r}^{t}|c\in S_{t}\\}$.

10: Client (Reviewer) $r$ ($r\in R_{t}$): Send the review reports including
$n_{adv}^{r}$ and the ranking to the server.

11: Server: Estimate the number of adversaries $n_{adv}$ by the median of
$\\{n_{adv}^{r}|r\in R_{t}\\}$.

12: Server: Aggregate the rankings from the reviewers and remove $n_{adv}$
updates based on majority vote.

13: Server: Aggregate the remaining updates to get ${\bm{\mathchar
28946\relax}}^{t+1}$.

14: end for

15: Return ${\bm{\mathchar 28946\relax}}^{T}$.

##  5 FedReview: A Defensive Review Mechanism

To defend against model poisoning, we propose a review mechanism called
FedReview to evaluate the model updates and reject the potential poisoned
updates. The basic pipeline of our proposed review mechanism for each training
round is: The server first selects a subset of clients $\mathcal{S}_{t}$, and
the clients in $\mathcal{S}_{t}$ are expected to upload their model updates to
the server. Once receiving the updates, the server randomly selects another
subset of clients from $\mathcal{S}/\mathcal{S}_{t}$ as reviewers and sends
the updates to those reviewers for evaluation.

FedReview selects reviewers from $\mathcal{S}/\mathcal{S}_{t}$ instead of
$\mathcal{S}$, otherwise, a certain client may review its own update and
produces a biased review. The reviewers are requested to estimate the number
of potential adversaries and rank the model updates. Sequentially, the
reviewers include the estimated number and the rankings in their review
reports and send the reports to the server. Finally, the server aggregates the
reviews to identify and remove the potential poisoned updates.

We formulate the above pipeline as Algorithm 2, where the red part indicates
how a reviewer create a review report, and the blue part indicates how the
server leverages the reviews to remove potential poisoned updates. In the
following two subsections, we will detail how to create a review report and
aggregate the reviews.

Figure 5: The basic pipeline of FedReview. Algorithm 3 Estimating Number of
Poisoned Updates

0: Loss of model weights $\\{{\bm{\mathchar 28946\relax}}^{t}+{\bm{\mathchar
28946\relax}}_{c}^{t}|c\in S_{t}\\}$ on the reviewer’s training dataset, i.e.,
$\\{loss_{c,r}^{t}|c\in S_{t}\\}$, a threshold $k$ (set as $1$ by default).

1: Employ the median of $\\{loss_{c,r}^{t}|c\in S_{t}\\}$ as a robust mean
$\mu_{loss}$.

2: Employ $\sqrt{\textrm{median}(\\{(loss_{c,r}^{t}-\mu_{loss})^{2}|c\in
S_{t}\\})}$ as a robust standard deviation $\sigma_{loss}$.

3: Count the number of $loss_{c,r}^{t}$ that satisfies
$loss_{c,r}^{t}>\mu_{loss}+k\sigma_{loss}$, denoted by $n_{adv}^{r}$.

4: Return the number $n_{adv}^{r}$.

###  5.1 Review Report

As mentioned before, a review report contains two key components, i.e.,
estimated number of poisoned updates (adversaries) $n_{adv}$ and rankings of
model updates. To estimate $n_{adv}$, a reviewer $r$ first needs to evaluate
the global model parameters plus the model updates from $\mathcal{S}_{t}$,
i.e., $\\{{\bm{\mathchar 28946\relax}}^{t}+\Delta{\bm{\mathchar
28946\relax}}_{c}^{t}|c\in\mathcal{S}_{t}\\}$, on its training dataset $D_{r}$
to compute the loss $\\{loss_{c,r}^{t}|c\in S_{t}\\}$. Formally, the reviewer
$r$ computes the loss by

$\displaystyle loss_{c,r}^{t}=\frac{1}{|D_{r}|}\sum_{(\bm{x},y)\in
D_{r}}\ell(\operatorname{\mathbf{f}}_{{\bm{\mathchar
28946\relax}}^{t}+\Delta{\bm{\mathchar 28946\relax}}_{c}^{t}}(\bm{x}),y).$ (6)

Our main intuition for estimating $n_{adv}$ is that the loss of poisoned model
updates should be larger than the loss of benign updates, because the
adversary aims to increase the loss and degrade the model performance. Thus,
$n_{adv}$ should be the number of large outliers in $\\{loss_{c,r}^{t}|c\in
S_{t}\\}$. Note that under non-i.i.d. settings, the reviewers should use a
class-balanced dataset sampled from $D_{r}$ instead of $D_{r}$ to compute
$\\{loss_{c,r}^{t}\\}$ to avoid the biased evaluation. We provide this
implementation details in Section 6.3.

We develop Algorithm 3 based on the above intuition. In Algorithm 3, we employ
the median of $\\{loss_{c,r}^{t}|c\in S_{t}\\}$ as a relatively robust
estimation for the mean of the loss, which can avoid the negative impacts from
large $loss_{c,r}^{t}$. Note that large $loss_{c,r}^{t}$ (loss on the poisoned
updates) may significantly increase the arithmetic mean and leads to an
underestimate of the number of outliers. Similarly, we employ
$\sqrt{\textrm{median}(\\{(loss_{c,r}^{t}-\mu_{loss})^{2}|c\in S_{t}\\})}$ as
an estimation for the standard deviation of the loss. If
$loss_{c,r}^{t}>\mu_{loss}+k\sigma_{loss}$, we consider $loss_{c,r}^{t}$ as an
outlier and the corresponding update $\Delta{\bm{\mathchar
28946\relax}}_{c}^{t}$ as a potential poisoned update. Thus, we count the
number of $loss_{c,r}^{t}$ in $\\{loss_{c,r}^{t}|c\in S_{t}\\}$ that satisfies
$loss_{c,r}^{t}>\mu_{loss}+k\sigma_{loss}$ as the number of potential poisoned
updates (potential adversaries).

To rank the model updates, the reviewer $r$ simply leverages the rankings of
$\\{loss_{c,r}^{t}|c\in S_{t}\\}$. A large $loss_{c,r}$ indicate a top rank of
the model update (large probability of being a poisoned update). After ranking
the model updates, the reviewer $r$ can send its reviewer report to the
server.

Algorithm 4 Majority Vote

0: Rankings of updates from all the reviewers $\\{\bm{\pi}^{r}|r\in R_{t}\\}$,
where $\bm{\pi}^{r}(c)$ refers to the ranking of client $c$’s model update
among all the updates. The reverse of $\bm{\pi}^{r}$ is $\bm{\omega}^{r}$,
i.e., $\bm{\omega}^{r}(\bm{\pi}^{r}(c))=c$.

1: Initialize a zero voting vector $\bm{v}$ with length $|\mathcal{S}_{t}|$.

2: for $r\in R_{t}$ do

3: for $i=0$ to $n_{adv}-1$ do

4: $\bm{v}[\bm{\omega}^{r}(i)]=\bm{v}[\bm{\omega}^{r}(i)]+1$

5: end for

6: end for

7: Return $\\{i|\bm{v}[i]~{}\mbox{is a top-}n_{adv}~{}\mbox{largest value in
}\bm{v}\\}$

###  5.2 Review Aggregation

Once receiving the reviews, the server can estimate the number of poisoned
updates $n_{adv}$ and aggregate the rankings. Since some reviewers may
overestimate or underestimate the number of poisoned updates, we estimate
$n_{adv}$ by the median of $\\{n_{adv}^{r}|r\in R_{t}\\}$, where $n_{adv}^{r}$
is the estimated number from reviewer $r$.

To identify poisoned updates among all the model updates, we leverage a simple
majority vote mechanism illustrated in Algorithm 4 to obtain the indices of
the potential poisoned updates. _An appealing property of the majority vote
mechanism is that it tolerates the existence of malicious reviewers who may
upload wrong reviews to the server._ In practice, we find that, as long as the
number of malicious reviewers is less than half the total number of reviewers,
FedReview can successfully identify and reject all the poisoned updates in
most cases. _In the experiments, if a selected reviewer is a malicious client,
the reviewer will upload a wrong ranking, where the ranks of the malicious
updates are low._

Adv | $20\%$ | $30\%$ | $40\%$
---|---|---|---
$n=10$, $CBD(\left\lfloor{n/2}\right\rfloor)$ | $99.36\%$ | $95.27\%$ | $83.38\%$
$n=20$, $CBD(\left\lfloor{n/2}\right\rfloor)$ | $99.94\%$ | $98.29\%$ | $87.25\%$

Table 1: The probability that the number of benign reviewers should be larger
than or at least equal to the number of malicious reviewers.

###  5.3 Reviewer Selection

When the number of benign reviewers is greater than or at least equal to the
number of malicious reviewers, the proposed majority voting mechanism will not
be dominated by malicious clients. Suppose that the number of clients selected
for one training round is $n$, and the proportion of attackers is $p$; then,
the number of malicious reviewers follows a Binomial distribution $B(n,p)$. If
we denote the cumulative distribution of this Binomial distribution by
$CBD(x)$, then the probablity that the review process is not dominated by the
malicious reviewers is $CBD(\left\lfloor{n/2}\right\rfloor)$. In Table 1, we
list the $CBD(\left\lfloor{n/2}\right\rfloor)$s corresponding to different
proportions of adversaries. Given that our default setting of $n$ is $10$, we
observe that the review mechanism may fail when
$F(\left\lfloor{n/2}\right\rfloor)$ is lower than $90\%$. In the ablation
study, we verify that FedReview indeed breaks down when the proportion of
malicious clients is $40\%$, , i.e., $F(\left\lfloor{n/2}\right\rfloor)$ is
lower than $90\%$.

Dataset | Purchase-100 | EMNIST | CIFAR-10 | FEMNIST
---|---|---|---|---
$\lambda=5.0$ | $\lambda=4.0$ | $\lambda=3.0$ | $\lambda=5.0$ | $\lambda=5.0$ | $\lambda=5.0$
FedAvg (No Defense) | $0.35\%$ | $18.44\%$ | $62.33\%$ | $2.13\%$ | $10.00\%$ | $3.41\%$
M-Krum | $14.26\%$ | $27.51\%$ | $26.27\%$ | $2.20\%$ | $10.00\%$ | $38.75\%$
Median | $37.59\%$ | $42.16\%$ | $48.60\%$ | $30.20\%$ | $10.08\%$ | $49.08\%$
Trimmed-Mean | $52.14\%$ | $57.75\%$ | $63.18\%$ | $48.34\%$ | $11.29\%$ | $23.16\%$
ARFED | $49.96\%$ | $62.89\%$ | $69.34\%$ | $62.78\%$ | $66.19\%$ | $51.43\%$
FedReview | $82.98\%$ | $82.33\%$ | $83.95\%$ | $78.70\%$ | $84.56\%$ | $56.54\%$

Table 2: Compare the performance of different defenses (without access to
data) under the scaling model poisoning attack.

Dataset | Purchase-100 | EMNIST | CIFAR-10 | FEMNIST
---|---|---|---|---
FedAvg (No Defense) | $85.45\%$ | $81.06\%$ | $87.76\%$ | $62.46\%$
M-Krum | $81.67\%$ | $79.46\%$ | $85.93\%$ | $54.98\%$
Median | $85.29\%$ | $78.28\%$ | $85.60\%$ | $62.33\%$
Trimmed-Mean | $84.72\%$ | $79.37\%$ | $87.72\%$ | $61.17\%$
FedReview | $85.70\%$ | $80.45\%$ | $87.80\%$ | $62.56\%$

Table 3: Compare different methods under no attack. The performance of
FedReview is close to the performance of FedAvg.

##  6 Experiments

###  6.1 Experimental Setup

#### Datasets

We follow [7] to use Purchase-100, EMNIST, FEMNIST, and CIFAR-10 for
evaluation. For Purchase-100, we randomly select 50000 samples for training
and 10000 samples for testing. We randomly divide the training samples into
100 training datasets and allocate them to 100 clients. We measure the global
model accuracy on all the testing samples. For EMNIST, the total number of
training samples is 112800, which is randomly allocated to 100 clients.

#### Networks

On Purchase-100, we follow [7] to employ a multi-layer perception network with
size $[1024,1024,100]$, and the activation function is Tanh function. On
EMNIST and FEMNIST, we employ LeNet [20], which has three convolutional
layers. On CIFAR-10, we use ResNet-18 [21].

#### Federated Learning

We set the number of clients as $100$ for the experiments on Purchase-100,
EMNIST, and CIFAR-10. For FEMNIST, the default number of clients is $3597$. We
randomly select $10$ clients in each training round for the experiments on
Purchase-100, EMNIST, and CIFAR-10. For FEMNIST, we randomly select $30$
clients in each round. We employ an SGD optimizer and set the batch size as 32
for local training. For Purchase-100, EMNIST, and FEMNIST, we set the learning
rate as $0.01$ and the momentum as $0.9$. For CIFAR-10, we set the learning
rate as $0.01$. In each round, the selected clients train local models for $5$
epochs and then upload the models to the server. The total number of training
rounds is set to $100$.

#### Attack Settings

By default, we follow [7, 3] to set the number of malicious clients as $20\%$
of the total number of the clients. For the min-max and min-sum attacks, we
follow [7] to set $\gamma_{init}$ as $50$ and $\tau$ as $10^{-5}$. For the
adaptive attack, we increase $\tau$ to accelerate convergence, otherwise, the
adaptive attack will be very slow since it needs multiple surrogate reviewers
to evaluate the malicious update in each iteration.

#### Defense Settings

We set the number of reviewers as the number of selected clients for local
training. We set $k$ in Algorithm 3 as $1$. In Section 6.3, we show that the
performance of FedReview is not sensitive to the change $k$ when the
proportion of malicious clients is $20\%$.

For the robust aggregation methods, we follow the default settings in the
previous works [3, 7]. We do not include FLTrust [4] in the baselines for
comparison because FLTrust requires the server to have access to a small
dataset with similar distribution as the user data.

Figure 6: Compare our review mechanism and robust aggregation methods under
the scaling model poisoning attack with $\lambda=5.0$.

| Purchase-100 | EMNIST | CIFAR-10 | FEMNIST
---|---|---|---|---
Min-Max | $79.33\%$ | $76.96\%$ | $87.54\%$ | $57.14\%$
Min-Sum | $82.95\%$ | $78.12\%$ | $87.75\%$ | $57.34\%$

Table 4: The performance of min-max and min-sum attacks, when the clients
optimize local models for more epochs

###  6.2 Main Results

We compare the performance of different methods against the scaling model
poisoning attack in Table 2, where ARFED [19] is a recent effective defense
against model poisoning. As shown in Table 2, our review mechanism FedReview
achieves the best model accuracy among all the methods. When $\lambda$ is
small (e.g., $\lambda=3.0$), the negative effects of the scaled poisoned model
updates are mild. Thus, FedAvg can achieve over $60\%$ model accuracy on
Purchase-100 against the model poisoning attack. But in this case, the robust
aggregation methods still eliminate some elements in the benign updates,
leading to performance degradation. Therefore, FedAvg can achieve better
performance than those robust aggregation methods when $\lambda$ is small.

When we increase $\lambda$ to $5$, the accuracy of the model trained by FedAvg
without defense is similar to the accuracy of random guessing, which means the
FedAvg completely loses its utility under the scaling attack. But FedReview
exhibits strong resistance against the attack. Compared to FedAvg in a benign
environment (Table 3), the model accuracy achieved by FedReview under the
scaling attack only drops by $2\%\sim 6\%$ on all datasets. Considering that
FEMNIST and Purchase-100 has more than 50 classes, this accuracy drop is
acceptable.

We also compare FedReview and other baselines in a benign environment (no
adversary), and we report the results in Table 3. Surprisingly, FedReview can
outperform FedAvg in a benign environment in some cases. We conjecture that
this is because, FedReview can identify the benign updates with relatively low
quality and drop them to improve the global model performance. Compared with
FedReview, the robust aggregation methods will cause more performance
degradation in a benign federated learning environment.

All in all, we mainly compare the methods without any prerequisites. We find
that FedReview achieves the overall best accuracy in both the benign and
adversarial environments.

###  6.3 Ablation Study

We mainly conduct an ablation study on Purchase-100 and EMNIST to enable a
better understanding about FedReview under different settings, such as
increased proportion of malicious clients and non-i.i.d. settings.

#### Proportion of Malicious Clients

By default, we set the proportion of malicious clients as $20\%$. Under this
setting, our defense is very effective against model poisoning. We further
increase the proportion of malicious clients to $30\%\sim 40\%$ and we show
the performance of FedAvg and FedReview in Table 5. If we set $k$ in Algorithm
3 to 1, FedReview will be compromised under the circumstance that $30\%$ of
the clients are malicious. This is because, if the proportion of malicious
clients is large that leads to large $\sigma$, setting a large $k$ will
underestimate the number of poisoned updates. Therefore, if the server
suspects that there are many malicious clients, it should consider decreasing
$k$. As shown in Table 5, if the server decrease $k$ to 0.5, FedReview still
demonstrate strong resistance against model poisoning.

Proportion of Adversaries | Purchase-100 | EMNIST
---|---|---
$30\%$ Adv |  $40\%$ Adv |  $30\%$ Adv |  $40\%$ Adv
FedReview ($k=1$) | $43.26\%$ | $0.61\%$ | $2.13\%$ | $2.13\%$
FedReview ($k=0.5$) | $75.44\%$ | $3.32\%$ | $68.61\%$ | $2.13\%$

Table 5: The performance of FedAvg and FedReview under different settings of
the proportion of the malicious clients.

Non IID | Purchase-100 | EMNIST
---|---|---
$\alpha=1.0$ | $\alpha=0.1$ | Label | $\alpha=1.0$ | $\alpha=0.1$ | Label
FedAvg | $1.84\%$ | $1.26\%$ | $1.41\%$ | $2.13\%$ | $2.13\%$ | $2.13\%$
FedReview | $49.29\%$ | $42.40\%$ | $82.81\%$ | $2.13\%$ | $2.13\%$ | $70.15\%$
FedReview-NonIID | $49.73\%$ | $46.94\%$ | $84.63\%$ | $72.90\%$ | $60.18\%$ | $72.51\%$
FedAvg (No Attack) | $51.94\%$ | $49.93\%$ | $88.85\%$ | $74.83\%$ | $72.24\%$ | $76.47\%$

Table 6: The performance of FedAvg, FedReview, FedReview-NonIID against the
scaling model poisoning attack under non-i.i.d. settings.

#### Non-i.i.d. Settings

We further explore the effectiveness of our review mechanism under two
non-i.i.d. settings. The first non-i.i.d. setting (_Dirichlet_) is that we
divide the training samples using the Dirichlet distribution with $\alpha=1$
and $\alpha=0.1$, which are the default settings in the previous literature
[9]. The second non-i.i.d. setting (_Label_) is that each client’s training
dataset only has data with a subset of labels. We conduct experiments on
Purchase-100 and EMNIST and report the results in Table 6. Non-i.i.d. are
significantly more challenging than i.i.d. settings because different clients’
data distributes differently. Thus, a client may be a biased reviewer to
evaluate other clients’ model updates based on its training dataset.
Therefore, under the non-i.i.d. settings, FedReview does not preform very
well. To address this issue, the reviewers could use a random weighted
sampler, where the sample weights are inversely proportional to the number of
samples for each class, to obtain a class-balanced dataset from its training
dataset to review the model updates. Besides, under non-i.i.d. settings, we
observe that the aggregated model tends to get stuck at certain local minima.
Thus, we slightly increase the learning rate from $0.01$ to $0.015$ to escape
from the local minima. We name this modified review mechanism FedReview-
NonIID. As shown in Table 6, FedReview-NonIID demonstrates strong resistance
against model poisoning in the sense that, compared with FedAvg in a benign
non-i.i.d. environment, the accuracy achieved by FedReview-NonIID only drops
by $2\%\sim 4\%$.

#### Impact of $k$ on FedReview

We further study the impact of $k$ on the performance of FedReview and report
the results in Fig. 7. As shown in Fig. 7, the performance of FedReview is not
sensitive to the change of $k$, when the proportion of malicious clients is
$20\%$ (default setting in prior works). When the proportion of malicious
clients is larger, we have to set a smaller $k$ to decline more malicious
updates for maintaining the performance of FedReview.

Figure 7: The impact of $k$ (on Purchase-100).

##  7 Discussion

In this section, we discuss the cons and pros of using FedReview in federated
learning.

#### Pros

The first advantage of FedReview is that FedReview does not require the server
to own a validation dataset with a distribution similar to the user data
distribution. This assumption is not always valid, especially when the user
data is very sensitive. FedReview does not need this assumption to achieve
high model accuracy.

The second advantage of FedReview is that is its evaluation metric for
dropping updates is more intuitive and promising than the metrics used by the
robust aggregation methods. This is because, the common goal of defenses
against model poisoning is to improve the model accuracy under model poisoning
attacks. Given this objective, FedReview directly uses the loss for
evaluation, while robust aggregation use criteria that are less related to
model accuracy for model aggregation. Therefore, FedReview achieves better
global model accuracy.

The third advantage of FedReview is that, in a benign environment, FedReview
even has slight better model accuracy than FedAvg in some cases. This is
because FedReview can drop a few benign but low-quality model updates to
improve the model performance.

#### Cons

The main drawback of FedReview is that the review process will increase the
total communication cost and the clients’ local computational cost. But this
drawback can be addressed by reducing the number of training rounds or pruning
the uploaded and downloaded models. For most experiments on FedReview, even if
we reduce the number of training rounds to $40$, FedReview still can achieve a
much higher model accuracy than the other baselines.

##  8 Conclusion

In this paper, we propose a review mechanism called FedReview to enable robust
federated learning against model poisoning without access to any private data.
In each round of federated learning, our review mechanism randomly selects a
subset of clients as reviewers to review the model updates. To create the
reviews, the reviewers need to compute the loss of the model updates on their
training datasets. Based on the loss of the updates, the reviewers estimate
the number of poisoned updates by the number of large loss outliers and rank
the model updates. Once receiving the estimated numbers and rankings from the
reviewers, the server aggregate the numbers and rankings to find out and
remove the potential poisoned updates. Extensive evaluations demonstrate that
our defense nearly eliminate the negative effects caused by poisoned updates.

## References

  * [1] E. Bagdasaryan, A. Veit, Y. Hua, D. Estrin, and V. Shmatikov, “How to backdoor federated learning,” in _International Conference on Artificial Intelligence and Statistics_. PMLR, 2020, pp. 2938–2948.
  * [2] A. N. Bhagoji, S. Chakraborty, P. Mittal, and S. Calo, “Analyzing federated learning through an adversarial lens,” in _International Conference on Machine Learning_. PMLR, 2019, pp. 634–643.
  * [3] M. Fang, X. Cao, J. Jia, and N. Gong, “Local model poisoning attacks to byzantine-robust federated learning,” in _29th USENIX Security Symposium (USENIX Security 20)_ , 2020, pp. 1605–1622.
  * [4] X. Cao, M. Fang, J. Liu, and N. Z. Gong, “Fltrust: Byzantine-robust federated learning via trust bootstrapping,” in _ISOC Network and Distributed System Security Symposium (NDSS)_ , 2021.
  * [5] P. Blanchard, E. M. El Mhamdi, R. Guerraoui, and J. Stainer, “Machine learning with adversaries: Byzantine tolerant gradient descent,” in _Proceedings of the 31st International Conference on Neural Information Processing Systems_ , 2017, pp. 118–128.
  * [6] D. Yin, Y. Chen, R. Kannan, and P. Bartlett, “Byzantine-robust distributed learning: Towards optimal statistical rates,” in _International Conference on Machine Learning_. PMLR, 2018, pp. 5650–5659.
  * [7] V. Shejwalkar and A. Houmansadr, “Manipulating the byzantine: Optimizing model poisoning attacks and defenses for federated learning,” in _28th Annual Network and Distributed System Security Symposium, NDSS 2021_ , 2021.
  * [8] V. Shejwalkar, A. Houmansadr, P. Kairouz, and D. Ramage, “Back to the drawing board: A critical evaluation of poisoning attacks on production federated learning,” in _2022 IEEE Symposium on Security and Privacy (SP)_. IEEE, 2022, pp. 1354–1371.
  * [9] C. Zhang, B. Zhou, Z. He, Z. Liu, Y. Chen, W. Xu, and B. Li, “Oblivion: Poisoning federated learning by inducing catastrophic forgetting.”
  * [10] Z. Zhang, X. Cao, J. Jia, and N. Z. Gong, “Fldetector: Defending federated learning against model poisoning attacks via detecting malicious clients,” in _Proceedings of the 28th ACM SIGKDD Conference on Knowledge Discovery and Data Mining_ , 2022, pp. 2545–2555.
  * [11] Q. Yang, Y. Liu, Y. Cheng, Y. Kang, T. Chen, and H. Yu, “Federated learning,” _Synthesis Lectures on Artificial Intelligence and Machine Learning_ , vol. 13, no. 3, pp. 1–207, 2019.
  * [12] T. Li, A. K. Sahu, A. Talwalkar, and V. Smith, “Federated learning: Challenges, methods, and future directions,” _IEEE Signal Processing Magazine_ , vol. 37, no. 3, pp. 50–60, 2020.
  * [13] B. McMahan, E. Moore, D. Ramage, S. Hampson, and B. A. y Arcas, “Communication-efficient learning of deep networks from decentralized data,” in _Artificial intelligence and statistics_. PMLR, 2017, pp. 1273–1282.
  * [14] F. Lai, Y. Dai, S. S. Singapuram, J. Liu, X. Zhu, H. V. Madhyastha, and M. Chowdhury, “FedScale: Benchmarking model and system performance of federated learning at scale,” in _International Conference on Machine Learning (ICML)_ , 2022.
  * [15] B. Li, N. Su, C. Ying, and F. Wang, “Plato: An open-source research framework for production federated learning,” in _Proceedings of the ACM Turing Award Celebration Conference-China 2023_ , 2023, pp. 1–2.
  * [16] Y. Liu, T. Fan, T. Chen, Q. Xu, and Q. Yang, “Fate: An industrial grade platform for collaborative learning with data protection,” _The Journal of Machine Learning Research_ , vol. 22, no. 1, pp. 10 320–10 325, 2021.
  * [17] M. Hipolito Garcia, A. Manoel, D. Madrigal Diaz, F. Mireshghallah, R. Sim, and D. Dimitriadis, “Flute: A scalable, extensible framework for high-performance federated learning simulations,” _arXiv e-prints_ , pp. arXiv–2203, 2022.
  * [18] V. Tolpegin, S. Truex, M. E. Gursoy, and L. Liu, “Data poisoning attacks against federated learning systems,” in _Computer Security–ESORICS 2020: 25th European Symposium on Research in Computer Security, ESORICS 2020, Guildford, UK, September 14–18, 2020, Proceedings, Part I 25_. Springer, 2020, pp. 480–501.
  * [19] E. Isik-Polat, G. Polat, and A. Kocyigit, “Arfed: Attack-resistant federated averaging based on outlier elimination,” _Future Generation Computer Systems_ , vol. 141, pp. 626–650, 2023.
  * [20] Y. LeCun, L. Bottou, Y. Bengio, and P. Haffner, “Gradient-based learning applied to document recognition,” _Proceedings of the IEEE_ , vol. 86, no. 11, pp. 2278–2324, 1998.
  * [21] K. He, X. Zhang, S. Ren, and J. Sun, “Deep residual learning for image recognition,” in _Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR)_ , June 2016.


# Simple circuit and experimental proposal for the detection of gauge-waves

F. Minotti 111Email address<EMAIL_ADDRESS>Universidad de Buenos Aires,
Facultad de Ciencias Exactas y Naturales, Departamento de Física, Buenos
Aires, Argentina  CONICET-Universidad de Buenos Aires, Instituto de Física
Interdisciplinaria y Aplicada (INFINA), Buenos Aires, Argentina  G. Modanese
222Email address<EMAIL_ADDRESS>Free University of Bozen-Bolzano
Faculty of Engineering
I-39100 Bolzano, Italy

###### Abstract

Aharonov-Bohm electrodynamics predicts the existence of traveling waves of
pure potentials, with zero electromagnetic fields, denoted as gauge waves, or
g-waves for short. In general, these waves cannot be shielded by matter since
their lack of electromagnetic fields prevents the material from reacting to
them. However, a not-locally-conserved electric current present in the
material does interact with the potentials in the wave, giving the possibility
of its detection. In EPJC2023  the basic theoretical description of a
detecting circuit was presented, based on a phenomenological theory of
materials that can sustain not-locally-conserved electric currents. In the
present work we discuss how that circuit can be built in practice, and used
for the effective detection of g-waves.

##  I Introduction

The extended theory of electrodynamics by Aharonov and Bohm ohmura1956new ;
aharonov1963further ; van2001generalisation ; hively2012toward ;
Modanese2017MPLB ; modanese2017electromagnetic ; arbab2017extended ;
hively2019classical ; Hively_2021 ; minotti2021quantum ;
minotti2022electromagnetic  is a generalization of the familiar Maxwell theory
which allows to couple the e.m. field also to sources where charge is not
locally conserved – a phenomenon that is expected to occur in certain physical
system with meso- or macroscopic quantum effects. Just because of this more
general setting, the theory is not gauge invariant, and the electric and
magnetic potentials $\phi$, $\mathbf{A}$ become univocally defined.

The formal structure is simple. The potentials are computed through the
equations ($\Box$ is the D’Alembert operator
$c^{-2}\partial_{t}^{2}-\nabla^{2}$)

$\Box\phi=\frac{\rho}{\varepsilon_{0}},\qquad\Box\mathbf{A}=\mu_{0}\mathbf{j}$
(1)

(relativistic version: $\Box
A^{\mu}\equiv\partial_{\alpha}\partial^{\alpha}A^{\mu}=\mu_{0}j^{\mu}$, with
$A^{\mu}=(c^{-1}\phi,\mathbf{A})$, $j^{\mu}=(c\rho,\mathbf{j})$).

With proper boundary conditions, the solutions of the eqs. (1) are well-known
retarded integrals, e.g. for $\phi$ we have

$\phi(\mathbf{x},t)=\frac{1}{\varepsilon_{0}}\int
d^{3}y\frac{\rho(\mathbf{y},t-c^{-1}|\mathbf{x}-\mathbf{y}|)}{|\mathbf{x}-\mathbf{y}|}$
(2)

and similarly for $\mathbf{A}$.

The electric and magnetic fields $\mathbf{E}$, $\mathbf{B}$ are computed from
the potentials as usual, namely
$\mathbf{E}=\nabla\phi-\partial_{t}\mathbf{A}$,
$\mathbf{B}=\nabla\times\mathbf{A}$ (relativistic form:
$F_{\mu\nu}=\partial_{\mu}A_{\nu}-\partial_{\nu}A_{\mu}$).

The field equations for $\nabla\times\mathbf{E}$ and $\nabla\cdot\mathbf{B}$
are like the second and third Maxwell equations, while those for
$\nabla\cdot\mathbf{E}$ and $\nabla\times\mathbf{B}$ contain additional terms
depending on an “auxiliary” scalar field $S$ defined as
$S=c^{-2}\partial_{t}\phi+\nabla\cdot\mathbf{A}$ (relativistic form:
$S=\partial_{\mu}A^{\mu}$). More precisely, they are

$\displaystyle\nabla\cdot\mathbf{E}$ $\displaystyle=$
$\displaystyle\frac{\rho}{\varepsilon_{0}}-\frac{\partial S}{\partial t}$ (3)
$\displaystyle\nabla\times\mathbf{B}$ $\displaystyle=$
$\displaystyle\frac{1}{c^{2}}\frac{\partial\mathbf{E}}{\partial
t}+\mu_{0}\mathbf{j}+\nabla S$ (4)

(for their relativistic form see EPJC2023 ).

The field $S$ satisfies the equation

$\Box S=\mu_{0}I\equiv\mu_{0}\left(\frac{\partial\rho}{\partial
t}+\nabla\cdot\mathbf{j}\right)$ (5)

(relativistic version: $\Box S=\mu_{0}I\equiv\mu_{0}\partial_{\mu}j^{\mu}$),
as follows immediately from its definition and from the equations for the
potentials. We thus see that the source of $S$ is the quantity $I$, called
“extra-current”, which quantifies the violation of local conservation, being
different from zero only in those regions where
$\partial_{t}\rho\neq-\nabla\cdot\mathbf{j}$. If $I=0$ everywhere, then all
equations reduce to their Maxwell form and $S$ can be set to zero through a
gauge transformation.

Although the $S$ field has been called “auxiliary”, because it is defined in
terms of the potentials, it can manifest itself in principle in some small
observable effects. Among these are waves with a longitudinal electric
component and static currents with a partially “missing” $\mathbf{B}$
minotti2021current ; minotti2022electromagnetic . The most relevant new
physical effect predicted by the theory, however, is the possibility to detect
pure gauge waves. Before explaining what these are, we need to complete the
physical picture of the extended theory by giving the expression of the
generalized Lorenz force exerted by fields and potentials on a probe. Let us
call $\mathbf{f}$ the force density and $w$ the power density produced by the
force (power supplied per unit volume). We have

$\displaystyle\mathbf{f}$ $\displaystyle=$
$\displaystyle\rho_{p}\mathbf{E}+\mathbf{j}_{p}\times\mathbf{B}-I_{p}\mathbf{A}$
(6) $\displaystyle w$ $\displaystyle=$
$\displaystyle\mathbf{j}_{p}\cdot\mathbf{E}-I_{p}\phi$ (7)

where $\rho_{p}$ and $\mathbf{j}_{p}$ are respectively the charge and current
density in the probe, and $I_{p}$ the extra-current in the probe (by
definition, $I_{p}$ is a density, i.e. referred to a unit volume). The two
terms depending on $\mathbf{A}$ and $\phi$ are those which allow to measure
directly the effects of the potentials. They vanish in the absence of extra-
current, i.e. when the continuity relation
$\partial_{t}\rho+\nabla\cdot\mathbf{j}=0$ (relativistic version:
$\partial_{\mu}j^{\mu}=0$) holds everywhere in the probe.

###  I.1 Gauge waves: properties and generation

If we consider for simplicity the region where the wave can be considered as
plane, a gauge wave takes the form

$\displaystyle\phi(\mathbf{x},t)$ $\displaystyle=$
$\displaystyle\phi_{0}e^{i(\omega t-\mathbf{k}\mathbf{x})}$ (8)
$\displaystyle\mathbf{A}(\mathbf{x},t)$ $\displaystyle=$
$\displaystyle\mathbf{A}_{0}e^{i(\omega t-\mathbf{k}\mathbf{x})}$ (9)

in which it is understood that the real part of the right sides is taken, and
where the amplitudes $\phi_{0}$, $\mathbf{A}_{0}$ satisfy the relation

$\omega\mathbf{A}_{0}=\mathbf{k}\phi_{0}$ (10)

This implies that the wave is longitudinal. It is a solution of the Aharonov-
Bohm equations in vacuum, with standard relation between the wave vector
$\mathbf{k}$ and frequency $\omega$, namely $\omega/|\mathbf{k}|=c$. It
follows from (10) that $|\phi_{0}|=c|\mathbf{A}_{0}|$ and also that
$\mathbf{k}\cdot\mathbf{A}_{0}=\frac{\omega}{c^{2}}\phi_{0}$. This means in
turn that the potentials $\phi$ and $\mathbf{A}$ of a gauge wave satisfy the
equation $\nabla\cdot\mathbf{A}+\frac{1}{c^{2}}\partial_{t}\phi=0$, also known
in Maxwell electrodynamics as “Lorentz gauge condition” (relativistic form:
$\partial_{\mu}A^{\mu}=0$).

Thus we see that in a gauge wave $S$ is zero by definition, and it is
straightforward to check, using the relations which give $\mathbf{E}$ and
$\mathbf{B}$ in terms of the potentials, that also $\mathbf{E}=0$ and
$\mathbf{B}=0$ in the wave. This justifies the name of “gauge waves”. It can
also be verified using the generalized expressions for the field energy and
momentum densities minotti2021quantum  that a gauge wave does not carry any
energy or momentum. Actually, in a gauge-invariant theory such a wave would be
regarded as non physical, because it is equivalent, via a gauge
transformation, to one with potentials $\phi$ and $\mathbf{A}$ identically
zero. In the Aharonov-Bohm theory, however, the potentials of a gauge wave are
not equivalent to zero and cannot be ignored. They propagate without
attenuation in normal media, but are able to interact with “anomalous” probes
having $I\neq 0$, according to eqs. (6), (7).

The simplest method for generating gauge waves is through normal oscillating
dipoles. The physical A.-B. potentials of an oscillating dipole are (like in
Maxwell theory in Lorentz gauge)

$\displaystyle\phi(\mathbf{x},t)$ $\displaystyle=$
$\displaystyle\frac{\mu_{0}c}{4\pi r}\dot{\mathbf{p}}(t-r/c)\cdot\mathbf{n}$
(11) $\displaystyle\mathbf{A}(\mathbf{x},t)$ $\displaystyle=$
$\displaystyle\frac{\mu_{0}}{4\pi r}\dot{\mathbf{p}}(t-r/c)$ (12)

where $r=|\mathbf{x}|$ and $\mathbf{n}=\mathbf{x}/r$ is the local propagation
direction.

The vector potential $\mathbf{A}$ can be written as the sum of a longitudinal
component

$\mathbf{A}_{\mathbf{n}}=(\mathbf{A}\cdot\mathbf{n})\mathbf{n}=\frac{\phi}{c}\mathbf{n}$
(13)

satisfying the gauge wave condition $|\mathbf{A}_{\mathbf{n}}|=\phi/c$, and a
transverse component $\mathbf{A}_{T}$.

Along the oscillation axis of the dipole we have that $\mathbf{A}_{T}=0$, so
that the wave is longitudinal and a pure gauge wave. At any other point, the
four-potential can be considered as the sum of a gauge wave
$(\phi,\mathbf{A}_{\mathbf{n}})$ and a transverse vector potential
$(0,\mathbf{A}_{T})$. If the gauge wave encounters a normal conducting medium
it is not affected (supposing the process is linear). The transverse
component, on the other hand, generally interacts with the medium and in
several cases can be strongly dampened, leaving as a result a pure gauge wave
which propagates in the medium and then possibly gets out of the medium again
into free space.

###  I.2 Gauge waves: detection

The general principle for computing the effect of a gauge wave on an anomalous
conductor is the following EPJC2023 . Suppose that in the absence of the wave
the conductor hosts a certain unperturbed current density $\mathbf{j}_{u}$ and
unperturbed electric field $\mathbf{E}_{u}$. The electric power dissipated in
the conductor is the volume integral of $\mathbf{j}_{u}\cdot\mathbf{E}_{u}$
and is supplied by an external generator which in the following we assume to
be a DC generator.

In the presence of the gauge wave, the power $w$ supplied to the circuit does
not change, because the wave does not carry any energy. The dissipated power,
however, is given by the volume integral of
$(\mathbf{j}\cdot\mathbf{E}-I\phi)$ (eq. (7), omitting here the suffix “$p$”
because it is clear that we are speaking of a probe). Therefore there must be
a variation in the product $\mathbf{j}\cdot\mathbf{E}$:

$\delta(\mathbf{j}\cdot\mathbf{E})=\mathbf{j}\cdot\mathbf{E}-\mathbf{j}_{u}\cdot\mathbf{E}_{u}\simeq\delta\mathbf{j}\cdot\mathbf{E}+\mathbf{j}\cdot\delta\mathbf{E}$
(14)

and the integral of this quantity must be equal to the integral of $I\phi$.
The products $\delta\mathbf{j}\cdot\mathbf{E}$ and
$\mathbf{j}\cdot\delta\mathbf{E}$ can be expressed, for an ohmic conductor
with resistance $R$, in terms of $R$ and of the variation of the current.
About the integral of $I\phi$, it is found to depend on the gradient
$\nabla\phi$ in the conductor, on the conductor length, on the current in it
and on an adimensional constant $\gamma\ll 1$ which expresses in the simplest
possible way the magnitude of the violation of local conservation associated
to the extra-current $I$. In conclusion, oscillations of $\phi$ cause
oscillations in the current.

For the details of the variation of the current in a specific device in
response to $\nabla\phi$, see Sect. II.

The constant $\gamma$ depends on the material and is defined in the
phenomenological “$\gamma$-model” EPJC2023 ; a characteristic relation
involving $\gamma$ is the generalized continuity equation
$\partial_{t}\rho+(1+\gamma)\nabla\cdot\mathbf{j}=0$.

###  I.3 Possible materials suitable for a gauge wave probe

In Sect. II of this work we propose a detector of gauge waves based on the
physical principles described above. The sensing element of the detector is a
graphite “antenna” of the length of a few centimeters. The choice of graphite
has two motivations.

The first motivation is theoretical and originates from some known properties
of graphene, which can be seen as the elementary constituent of graphite. The
electric conduction mechanism of graphene is peculiar and not yet fully
understood. Conducting electrons behave as relativistic particles with null
mass and a constant velocity equal to the Fermi velocity, described by chiral
wavefunctions. Quantum tunneling in these materials becomes highly anisotropic
and markedly different from the case of normal, non-relativistic electrons. It
is in fact a condensed-matter realization of the Klein tunneling, which raises
a paradox concerning local charge conservation katsnelson2006chiral ;
allain2011klein . The solutions of the paradox that have been proposed go
beyond single-particle wavefunctions and involve multi-particle quantum field
theory processes (see e.g. alkhateeb2021relativistic  and refs.). However, it
is well known that chiral symmetry is often broken at the quantum level.

On another front, there exist so-called “first principles” numerical
calculations of conduction profiles in carbon macromolecules which reveal
possible violations of local conservation. The first studies in this direction
were due to J. Wang and collaborators li2008definition ; zhang2011first . They
have shown that using a single-particle nonequilibrium Green’s function
technique coupled with the density-functional theory one obtains a conserved
current density pattern only by adding to the density “$\bar{\psi}\nabla\psi$”
derived from the molecular orbitals wavefunction a “secondary” current density
extended in space which coincides with the term $\nabla S$ in the Aharonov-
Bohm equations. This behavior is confirmed by calculations of Jensen, Garner,
Solomon and collaborators for saturated chains of alkanes, silanes and
germanes jensen2019current  and for linear carbon wires garner2019helical ;
garner2020three . In jensen2019current  the authors apply the recipe by Wang
et al. computing the secondary current via a Poisson equation. In
garner2019helical  and garner2020three  they give detailed plots of the
integrated local current density, as compared to the (constant) conserved
current.

The second motivation is experimental and concerns directly graphite and its
partial superconductive properties, observed even at room temperature
esquinazi2014superconductivity ; smith2015superconductivity ;
kopelevich2024global . Although no generally accepted explanation of these
superconductive properties exists, it is quite clear that conduction in
graphite involves effects of macroscopic quantization. In this case one may
expect some violations of local charge conservation because (1) several
phenomenological non-BCS models of superconductivity comprise nonlocal wave
equations modanese2018time ; minotti2022electromagnetic ; (2) the number/phase
uncertainty relation $\Delta N\Delta\phi\simeq 1$ and the non-commutativity of
the quantum operators $\hat{\rho}$ and $\hat{\mathbf{j}}$ imposes a quantum
uncertainty on the operator
$\partial_{t}\hat{\rho}+\nabla\cdot\hat{\mathbf{j}}$ minotti2021quantum .

##  II Basic circuit

The proposed circuit is shown in Fig 1

Figure 1: Schematic of the detecting circuit.

The circuit components are:

R1 = 2.2 K$\Omega$,

R2 = 10 K$\Omega$,

V0 = 9 V,

C = 47 $\mu$F,

C${}_{\text{OUT}}$ = 47 nF,

Transistor: 2N3904.

The element denoted as R${}_{\text{L}}$ (that symbolizes its resistance
$R_{L}$) is a graphite pencil lead of length of a few centimeters, that acts
as the detecting element. The length is in fact related to the wavelength of
the radiation to be detected. It should be sufficient for the value of
$\Delta\phi$ of the gauge wave along the element to be non-negligible. A
practical limitation to the possible frequencies to be detected is given by
the characteristics of the chosen transistor that indicate that it should work
well up to a frequency of about 100 MHz.

In order to analyze the circuit behavior we refer to the Fig. 2

Figure 2: Notation and conventions used in the circuit analysis.

The following relations apply:

$\displaystyle V_{OUT}$ $\displaystyle=$ $\displaystyle V_{0}-R_{1}i_{1},$
$\displaystyle V_{C}$ $\displaystyle=$ $\displaystyle
V_{0}-R_{1}i_{1}-R_{2}i_{2},$ $\displaystyle i_{1}-i_{2}$ $\displaystyle=$
$\displaystyle\beta i_{L}.$

In the last relation $\beta$ is the amplification parameter of the transistor,
that relates the collector current ($i_{1}-i_{2}$) to the base current
($i_{L}$). For the parameters chosen the transistor works in a regime where
$\beta\simeq 190$ (the value of $\beta$, however, cancels in the final
expressions).

For simplicity we assume the wave to be of sufficiently high frequency (to be
quantified below) for the capacitor C to act as a short circuit, so that for
the small-amplitude signal analysis we can approximate $\delta V_{C}\simeq 0$.
The full analysis should be done for the Fourier amplitudes of the small
signals, which would include the impedance of C, and also $\delta i_{C}$ as an
additional magnitude to be determined (this is done in the next subsection).
Note besides that $\delta i_{C}=\left(1+1/\beta\right)\delta i_{2}-\delta
i_{1}/\beta$ is limited by the resistors $R_{1}$ and $R_{2}$, so that it
cannot be arbitrarily large when the C impedance goes to zero, making the
assumption $\delta V_{C}\simeq 0$ possible.

In this way, from the second relation we have

$\delta i_{2}=-\frac{R_{1}}{R_{2}}\delta i_{1}.$ (15)

The time-varying signal detected through the capacitor C${}_{\text{OUT}}$ is
given from the first relation as

$\delta V_{OUT}=-R_{1}\delta i_{1},$

which using the third relation and (15) results in

$\delta V_{OUT}=-\frac{R_{1}\beta}{1+R_{1}/R_{2}}\delta i_{L}.$ (16)

We can now determine the expected $\delta i_{L}$ considering that along
R${}_{\text{L}}$ there is a voltage $V_{L}=V_{C}-V_{BE}$, with $V_{BE}$ the
voltage between base and emitter of about 0.7 V, whose variations are
determined below. In this way we have that for the perturbation due to the
gauge wave the energy conservation applied to the circuit gives:

$\delta\left(i_{L}V_{L}\right)=\delta\left(R_{L}i_{L}^{2}\right)-\int I\phi
d^{3}x,$ (17)

where $I$ is the extra-current previously definedEPJC2023 .

Due to the assumed high frequencies we can again take $\delta V_{C}\simeq 0$,
while $\delta V_{BE}$ has to be determined from the transistor characteristics
2N3904 . We thus have ($I_{B}$, and $I_{C}$ represent the base and collector
currents)

$\delta V_{BE}=\left.\frac{\partial V_{BE}}{\partial
I_{B}}\right)_{I_{B}=i_{L}}\delta i_{L}=\beta\left.\frac{\partial
V_{BE}}{\partial I_{C}}\right)_{I_{B}=i_{L}}\delta i_{L}.$

The working regime of the transistor for the proposed circuit corresponds to
its DC operation at room temperature, with a collector DC current of about 3.5
mA, obtained solving the equations in the DC case, when $i_{c}=0$. For the
small signal analysis around this regime we have

$\left.\frac{\partial V_{BE}}{\partial I_{C}}\right)_{I_{B}=i_{L}}\simeq
57\Omega,$

so that defining $R_{BE}\equiv\beta\left.\frac{\partial V_{BE}}{\partial
I_{C}}\right)_{I_{B}=i_{L}}$, we obtain

$\delta V_{L}=-R_{BE}\delta i_{L}.$

From relation (17) we thus have, using also the $\gamma$-model developed in
EPJC2023  to express $I$ in terms of the electric current, as detailed in that
reference,

$\displaystyle V_{L}\delta i_{L}-R_{BE}i_{L}\delta i_{L}$ $\displaystyle=$
$\displaystyle 2R_{L}i_{L}\delta i_{L}-\int I\phi d^{3}x$ $\displaystyle=$
$\displaystyle 2R_{L}i_{L}\delta i_{L}-\gamma i_{L}\Delta\phi,$

where $\Delta\phi$ is the difference of gauge-wave potential along
R${}_{\text{L}}$. Since $R_{L}i_{L}=V_{L}$, we have

$\delta i_{L}=\gamma\frac{\Delta\phi}{R_{L}+R_{BE}},$

giving finally from (16)

$\displaystyle\delta V_{OUT}$ $\displaystyle=$
$\displaystyle-\gamma\frac{R_{1}\beta}{\left(1+R_{1}/R_{2}\right)}\frac{\Delta\phi}{\left(R_{L}+R_{BE}\right)}$
(18) $\displaystyle=$
$\displaystyle-\gamma\frac{R_{1}}{\left(1+R_{1}/R_{2}\right)}\frac{\Delta\phi}{\left.\frac{\partial
V_{BE}}{\partial I_{C}}\right)_{I_{B}=i_{L}}}.$

where in the last line is was used that $R_{L}\ll R_{BE}$. For the values of
the parameters chosen we thus have

$\delta V_{OUT}\simeq-31.6\gamma\Delta\phi.$ (19)

This voltage is definitely larger than one could obtain with the simpler
passive circuit without transistor described in EPJC2023 , for which $\delta
V_{OUT}\lessapprox\gamma\Delta\phi$.

###  II.1 Inclusion of non-zero impedance for C

If one does not assume that the impedance of C, $Z_{C}=\left(j\omega
C\right)^{-1}$, is negligible ($j$ is the imaginary unit, and $\omega$ the
angular frequency of the Fourier component of the signal), one must add the
relations

$\displaystyle\delta i_{C}$ $\displaystyle=$ $\displaystyle\delta i_{2}-\delta
i_{L},$ $\displaystyle\delta V_{L}$ $\displaystyle=$ $\displaystyle\delta
V_{C}-\delta V_{BE}=Z_{C}\delta i_{C}-R_{BE}\delta i_{L}.$

Solving the complete system one readily obtains

$\delta V_{OUT}=-\frac{R_{1}\left[\beta
R_{2}+\left(1+\beta\right)Z_{C}\right]\gamma\Delta\phi}{R_{1}\left[R_{L}+R_{BE}+\left(1+\beta\right)Z_{C}\right]+R_{2}\left(R_{L}+R_{BE}+Z_{C}\right)+Z_{C}\left(R_{L}+R_{BE}\right)},$

that reduces to the first line in (18) when $Z_{C}\rightarrow 0$. For this
approximation to be valid we see that the most stringent condition is

$\beta\left|Z_{C}\right|\ll R_{BE}=\beta\left.\frac{\partial V_{BE}}{\partial
I_{C}}\right)_{I_{B}=i_{L}},$

that is

$\omega\gg\left[C\left.\frac{\partial V_{BE}}{\partial
I_{C}}\right)_{I_{B}=i_{L}}\right]^{-1},$

which for the parameters considered corresponds to frequencies
($f=\left(2\pi\right)^{-1}\omega$) much higher than 60 Hz.

##  III Basic experimental proposal

The circuit analyzed above is also sensitive to normal electromagnetic
radiation, for which the element R${}_{\text{L}}$ acts as a normal antenna. It
is thus necessary to shield it from that radiation in order that only the
gauge component present interacts with R${}_{\text{L}}$.

As considered in EPJC2023 , the far field, dipolar radiation of an emitting
antenna contains a gauge component with a scalar potential whose electric
field $-\nabla\phi$ has a magnitude similar to that of the ordinary component
(of course, the vector potential component of the gauge wave generates a
contribution $-\partial\mathbf{A}/\partial t$ that cancels that of the scalar
potential, yielding zero electromagnetic fields for the gauge wave). The ratio
of normal to gauge component depends on the orientation relative to the
emitting antenna (see EPJC2023  for details).

According to the $\gamma$-model, the detector is sensitive to the scalar
potential component if the cables connected to the graphite element
R${}_{\text{L}}$ are of different material (Copper, for instance), assumed to
have a much lower value of $\gamma$.

In this way, if the circuit is conveniently shielded from normal
electromagnetic radiation, only the gauge scalar component can be detected,
because it cannot be shielded by virtue of its not interacting with matter.
Any modulation of the incoming signal should thus be present in the circuit
output.

To have an estimation of the expected magnitudes we use expression (19), valid
for the proposed circuit parameters. With $L\simeq 5.5$ cm, and for
$\left|\nabla\phi\right|=1$ V m-1 (corresponding to the gauge component of the
electromagnetic field of a dipole antenna in the region where the radiative
flux is about $0.1\mu$W cm-2) the expected amplitude of $\delta V_{OUT}$ is
about $1.7\gamma$ V, so that even for $\gamma\sim 10^{-3}$ one has an easily
detectable signal of the order of mV, whose modulation could be identifiable
over the noise.

##  IV Conclusions

In the present work we have presented a proposal for the practical
implementation of a circuit for the detection of gauge-waves, a very special
type of waves of pure potentials, whose detection is possible in the context
of Aharonov-Bohm electrodynamics, but which are considered as non-physical
(undetectable) in Maxwell electrodynamics. The rationale for the circuit
operation is that a small fraction of the current that circulates in certain
conductive materials does it in a non-conserved manner, giving rise to the so
called “extra-current”, which is shown in Aharonov-Bohm electrodynamics to
directly interact with the scalar potential; in particular, with that
component of the gauge wave. The circuit thus fulfills two purposes. On the
one hand it establishes a controlled DC current in the detecting medium (a
graphite element), whose supposedly non-conserved fraction interacts with the
scalar potential component of the wave. On the other hand, the circuit
amplifies the small current variations that result from that interaction, and
which are detected as voltage variations easily analyzable on an oscilloscope.
An apparently contradictory point concerning the conservation of energy is how
a wave that does not transport energy is able to interact with a material
medium. In fact, if the material is “passive”, in the sense that in the
absence of the gauge wave no macroscopic currents are present, the wave does
not interact with the medium, according to the $\gamma$ model used to describe
media capable of supporting non-conserved currents EPJC2023 . On the other
hand, in an “active” medium, the macroscopic current present is sustained by
an external source, and it is this source the one that exchanges energy with
the currents associated with the interaction with the wave. In a sense, the
wave acts as a catalyst of the transduction of energy between the source and
the current variations. Actually, the results here presented are derived from
the conservation of energy relation valid in the context of Aharonov-Bohm
electrodynamics minotti2021quantum , so that the principle of conservation of
energy is fulfilled.

## References

  * (1) F. Minotti and G. Modanese, “Gauge waves generation and detection in Aharonov–Bohm electrodynamics,” The European Physical Journal C, vol. 83, p. 1086, 2023.
  * (2) T. Ohmura, “A new formulation on the electromagnetic field,” Progress of Theoretical Physics, vol. 16, no. 6, pp. 684–685, 1956.
  * (3) Y. Aharonov and D. Bohm, “Further discussion of the role of electromagnetic potentials in the quantum theory,” Physical Review, vol. 130, no. 4, p. 1625, 1963.
  * (4) K. Van Vlaenderen and A. Waser, “Generalisation of classical electrodynamics to admit a scalar field and longitudinal waves,” Hadronic Journal, vol. 24, no. 5, pp. 609–628, 2001.
  * (5) L. Hively and G. Giakos, “Toward a more complete electrodynamic theory,” International Journal of Signal and Imaging Systems Engineering, vol. 5, no. 1, pp. 3–10, 2012.
  * (6) G. Modanese, “Generalized Maxwell equations and charge conservation censorship,” Modern Physics Letters B, vol. 31, p. 1750052, 2017.
  * (7) G. Modanese, “Electromagnetic coupling of strongly non-local quantum mechanics,” Physica B: Condensed Matter, vol. 524, pp. 81–84, 2017.
  * (8) A. Arbab, “Extended electrodynamics and its consequences,” Modern Physics Letters B, vol. 31, no. 09, p. 1750099, 2017.
  * (9) L. Hively and A. Loebl, “Classical and extended electrodynamics,” Physics Essays, vol. 32, no. 1, pp. 112–126, 2019.
  * (10) L. M. Hively and M. Land, “Extended electrodynamics and SHP theory,” Journal of Physics: Conference Series, vol. 1956, p. 012011, jul 2021.
  * (11) F. Minotti and G. Modanese, “Quantum uncertainty and energy flux in extended electrodynamics,” Quantum Reports, vol. 3, no. 4, pp. 703–723, 2021.
  * (12) F. Minotti and G. Modanese, “Electromagnetic signatures of possible charge anomalies in tunneling,” Quantum Reports, vol. 4, no. 3, pp. 277–295, 2022.
  * (13) F. Minotti and G. Modanese, “Are current discontinuities in molecular devices experimentally observable?,” Symmetry, vol. 13, no. 4, p. 691, 2021.
  * (14) M. I. Katsnelson, K. S. Novoselov, and A. K. Geim, “Chiral tunnelling and the Klein paradox in graphene,” Nature physics, vol. 2, no. 9, pp. 620–625, 2006.
  * (15) P. E. Allain and J.-N. Fuchs, “Klein tunneling in graphene: optics with massless electrons,” The European Physical Journal B, vol. 83, pp. 301–317, 2011.
  * (16) M. Alkhateeb, X. G. de La Cal, M. Pons, D. Sokolovski, and A. Matzkin, “Relativistic time-dependent quantum dynamics across supercritical barriers for Klein-Gordon and Dirac particles,” Physical Review A, vol. 103, no. 4, p. 042203, 2021.
  * (17) C. Li, L. Wan, Y. Wei, and J. Wang, “Definition of current density in the presence of a non-local potential,” Nanotechnology, vol. 19, no. 15, p. 155401, 2008.
  * (18) L. Zhang, B. Wang, and J. Wang, “First-principles calculation of current density in molecular devices,” Physical Review B, vol. 84, no. 11, p. 115412, 2011.
  * (19) A. Jensen, M. Garner, and G. Solomon, “When current does not follow bonds: Current density in saturated molecules,” The Journal of Physical Chemistry C, vol. 123, no. 19, pp. 12042–12051, 2019.
  * (20) M. Garner, A. Jensen, L. Hyllested, and G. Solomon, “Helical orbitals and circular currents in linear carbon wires,” Chemical science, vol. 10, no. 17, pp. 4598–4608, 2019.
  * (21) M. Garner, W. Bro-Jørgensen, and G. Solomon, “Three distinct torsion profiles of electronic transmission through linear carbon wires,” The Journal of Physical Chemistry C, vol. 124, no. 35, pp. 18968–18982, 2020.
  * (22) P. Esquinazi, T. T. Heikkilä, Y. V. Lysogorskiy, D. A. Tayurskii, and G. E. Volovik, “On the superconductivity of graphite interfaces,” JETP letters, vol. 100, pp. 336–339, 2014.
  * (23) R. P. Smith, T. E. Weller, C. A. Howard, M. P. Dean, K. C. Rahnejat, S. S. Saxena, and M. Ellerby, “Superconductivity in graphite intercalation compounds,” Physica C: Superconductivity and Its Applications, vol. 514, pp. 50–58, 2015.
  * (24) Y. Kopelevich, J. Torres, R. da Silva, F. Oliveira, M. C. Diamantini, C. Trugenberger, and V. Vinokur, “Global room-temperature superconductivity in graphite,” Advanced Quantum Technologies, vol. 7, no. 2, p. 2300230, 2024.
  * (25) G. Modanese, “Time in quantum mechanics and the local non-conservation of the probability current,” Mathematics, vol. 6, no. 9, p. 155, 2018.
  * (26) Fairchild Semiconductor Corporation, 2N3904/MMBT3904/PZT3904, NPN General Purpose Amplifier, 2001.  Rev. A.