Distinguishing Chaos from Corruption: Differentiating Systemic Market Drift from Byzantine Poisoning in Heterogeneous Federated Learning Environments for Credit Risk

Abstract

Federated learning (FL) has emerged as a promising paradigm for privacy-preserving collaborative model training across financial institutions, enabling the development of robust credit risk assessment systems without exposing sensitive customer data. However, the deployment of FL in real-world banking environments confronts two interrelated challenges that threaten model integrity: the inherent heterogeneity of non-independent and identically distributed (non-IID) data across institutions and the constant threat of Byzantine poisoning attacks where malicious participants deliberately corrupt model updates. While existing defense mechanisms have demonstrated efficacy in controlled experimental settings, they struggle to distinguish between legitimate model drift caused by genuine market shifts or heterogeneous data distributions and malicious perturbations introduced by adversaries [1]. This fundamental ambiguity creates a critical vulnerability in multi-institutional credit risk frameworks, where the boundary between benign and malicious gradient behavior remains poorly characterized. Zhang et al. [2] proposed FedMP, a multi-pronged defense that detects anomalous variations in both the magnitude and direction of model updates across communication rounds, employing adaptive scaling modules and dynamic clustering techniques to filter malicious gradients. Their approach achieves robust performance even when malicious clients constitute up to seventy percent of participants under highly non-IID conditions. Concurrently, Xue et al. [1] introduced FedBDA, a framework that integrates variational inference explanation of dropout into local training, enabling individual clients to quantify the benign degree of weight units through Bayesian interpretability while employing Jensen-Shannon divergence among local, global, and median distributions for robust weighted aggregation. Despite these advances, neither approach explicitly addresses the temporal dynamics of distinguishing between systemic market evolution and coordinated adversarial behavior in financial contexts where data distributions naturally shift over time due to economic cycles, regulatory changes, and evolving consumer behavior patterns. This article presents a comprehensive analytical framework for differentiating legitimate distributional shifts from malicious poisoning in federated credit risk environments.

We synthesize insights from both FedMP and FedBDA to characterize the distinct statistical signatures of benign heterogeneity and adversarial manipulation, examining how gradient covariance structures, activation map reconstruction errors, and temporal update trajectories diverge under genuine market drift versus targeted attacks. Our analysis reveals that benign non-IID updates tend to concentrate near low-dimensional manifolds that evolve gradually over time, while Byzantine perturbations induce detectable anomalies in orthogonal residual energy and spectral properties that deviate from expected Marchenko-Pastur distributions. We further investigate how adaptive adversaries may attempt to mimic benign drift patterns and propose detection thresholds calibrated to financial domain constraints. The findings establish foundational principles for designing federated credit risk systems that remain resilient against both data heterogeneity and sophisticated poisoning attempts while maintaining regulatory compliance and model explainability requirements in banking applications.