Byzantine-Robust Federated RAG via Aligned Calibration and Fixed-Membership Conformal Prediction
Abstract
Retrieval-augmented generation (RAG) lets language models answer questions more accurately by consulting relevant documents. Many valuable collections, such as medical records, cannot be pooled because of privacy rules. Federated RAG leaves each collection with its owner, or node, which scores candidate answers from its own documents; a central hub combines the scores. Some nodes, called Byzantine, may be compromised, faulty, or misled by instructions hidden in documents, and report arbitrary scores. Conformal prediction returns a set containing the correct answer with a chosen probability, using a cutoff set in a calibration step on questions with known answers. An unknown group of nodes, no larger than a declared bound, may misreport both in this step and at query time. Existing methods assume every node is honest or protect only the calibration step. We observe that the honest nodes are the same in both steps. The hub therefore has all nodes score the same calibration questions, and keeps a candidate only if some plausible group of honest nodes, using its own scores in both steps, would keep it. We prove that the resulting sets contain the correct answer with the chosen probability in finite samples, whatever the Byzantine nodes report. No method using the same information can return smaller sets without risking the loss of an answer the honest nodes support. If nodes fail at random, the guarantee weakens only by the probability that more nodes fail than declared. In simulations, on real question-answering tasks including medical exams, and with language models as nodes, some hijacked, our sets reached the target whenever no more nodes misbehaved than declared, while plain averaging could miss it. They were also clearly smaller than those of simpler methods with the same protection, most of all when the declared bound was generous, so a cautious bound costs little.
Related
- Multi-Variable Conformal Prediction: Optimizing Prediction Sets using Multiple Calibration Variables
- When Does Trimming Help Conformal Prediction? A Retained-Law Diagnostic under Calibration Contamination
- When does conformal calibration need censoring weights? Cause-of-failure prediction sets under competing risks
- Sketched Calibration for Conformal Prediction under Covariate Shift
- Byzantine-Robust Federated Representation Learning
BibTeX
@misc{dubey2026byzantinerobust,
title = {{Byzantine-Robust Federated RAG via Aligned Calibration and Fixed-Membership Conformal Prediction}},
author = {Prasanjit Dubey and Aritra Guha and Xiaoming Huo},
howpublished = {arXiv},
year = {2026},
month = sep,
doi = {10.48550/arxiv.2609.33037},
eprint = {2609.33037},
archivePrefix = {arXiv},
url = {https://arxiv.org/abs/2609.33037},
}
RIS
TY - UNPB
TI - Byzantine-Robust Federated RAG via Aligned Calibration and Fixed-Membership Conformal Prediction
AU - Prasanjit Dubey
AU - Aritra Guha
AU - Xiaoming Huo
PY - 2026
DA - 2026/09/29
PB - arXiv
DO - 10.48550/arxiv.2609.33037
UR - https://arxiv.org/abs/2609.33037
AB - Retrieval-augmented generation (RAG) lets language models answer questions more accurately by consulting relevant documents. Many valuable collections, such as medical records, cannot be pooled because of privacy rules. Federated RAG leaves each collection with its owner, or node, which scores candidate answers from its own documents; a central hub combines the scores. Some nodes, called Byzantine, may be compromised, faulty, or misled by instructions hidden in documents, and report arbitrary scores. Conformal prediction returns a set containing the correct answer with a chosen probability, using a cutoff set in a calibration step on questions with known answers. An unknown group of nodes, no larger than a declared bound, may misreport both in this step and at query time. Existing methods assume every node is honest or protect only the calibration step. We observe that the honest nodes are the same in both steps. The hub therefore has all nodes score the same calibration questions, and keeps a candidate only if some plausible group of honest nodes, using its own scores in both steps, would keep it. We prove that the resulting sets contain the correct answer with the chosen probability in finite samples, whatever the Byzantine nodes report. No method using the same information can return smaller sets without risking the loss of an answer the honest nodes support. If nodes fail at random, the guarantee weakens only by the probability that more nodes fail than declared. In simulations, on real question-answering tasks including medical exams, and with language models as nodes, some hijacked, our sets reached the target whenever no more nodes misbehaved than declared, while plain averaging could miss it. They were also clearly smaller than those of simpler methods with the same protection, most of all when the declared bound was generous, so a cautious bound costs little.
ER -