FedShield: Configurable Mean–Median Robust Aggregation for Poisoning-Resilient Federated Healthcare-IoT Learning

Abstract

Federated learning lets healthcare-IoT and Internet of Medical Things (IoMT) systems train shared models without centralizing sensitive records, but poisoned client updates can degrade the global model, and the Byzantine-robust aggregators meant to prevent this behave unevenly across the non-IID data partitions these deployments produce. This paper presents FedShield, a configurable robust aggregation rule that ranks client updates with a Krum-style score and combines a narrow top-2 mean with a broader top-7 coordinate-wise median through a single mixing weight fixed per deployment. FedShield is evaluated on four public healthcare-IoT benchmarks—MIT-BIH, PTB-XL, PhysioNet/CinC 2017, and CIC-IoMT-2024—against seven published baselines (FedAvg, Krum, Multi-Krum, Trimmed-Mean, RFA, DnC, and FLTrust) under eight poisoning attacks, four malicious-client ratios, and five seeds. The design target is cross-setting consistency rather than per-cell dominance, and FedShield meets it as the only method that stays in the top three across all twelve dataset–metric cells. Its clearest gains are on the class-concentrated CIC-IoMT-2024 partition, where it lowers the attack-effect rate from 51.5% for the strongest baseline to 12.3%, while PTB-XL is a documented exception on which broad averaging remains preferable. Two adaptive stress tests locate the boundary of this behavior: under centroid-near mimicry and an adaptive Krum-survival attack, malicious updates evade the distance-based filter and plain averaging becomes the stronger response, scoping the result to the evaluated non-adaptive attacks.