# Resilient Average Consensus: A Detection and Compensation Approach

Wenzhe Zheng<EMAIL_ADDRESS>Zhiyu He<EMAIL_ADDRESS>Jianping He
<EMAIL_ADDRESS>Chengcheng Zhao<EMAIL_ADDRESS>Chongrong Fang
<EMAIL_ADDRESS>Department of Automation, Shanghai Jiao Tong University,
and Key Laboratory of System Control and Information Processing, Ministry of
Education of China  State Key Laboratory of Industrial Control Technology,
Zhejiang University

###### Abstract

We study the problem of resilient average consensus for multi-agent systems
with misbehaving nodes. To protect consensus value from being influenced by
misbehaving nodes, we address this problem by detecting misbehaviors,
mitigating the corresponding adverse impact and achieving the resilient
average consensus. In this paper, general types of misbehaviors are
considered, including deception attacks, accidental faults and link failures.
We characterize the adverse impact of misbehaving nodes in a distributed
manner via two-hop communication information and develop a deterministic
detection-compensation-based consensus (D-DCC) algorithm with a decaying
fault-tolerant error bound. Considering scenarios where information sets are
intermittently available due to link failures, a stochastic extension named
stochastic detection-compensation-based consensus (S-DCC) algorithm is
proposed. We prove that D-DCC and S-DCC allow nodes to asymptotically achieve
resilient average consensus exactly and in expectation, respectively. Then,
the Wasserstein distance is introduced to analyze the accuracy of S-DCC.
Finally, extensive simulations are conducted to verify the effectiveness of
the proposed algorithms.

###### keywords:

Resilient consensus, Malicious attacks, Fault-tolerance, Detection,
Compensation.

††thanks: This paper was presented in part at 60th IEEE Conference on Decision
and Control, Austin, Texas, 2021 [1].

, , , ,

##  1 INTRODUCTION

Consensus problems have attracted extensive interests due to their wide
applications, e.g., distributed control [2], estimation [3] and optimization
in robotic networks [4], smart grids [5] and wireless sensor networks[6]. The
goal of consensus is to enable nodes to reach global agreements via local
exchanges of information by predefined consensus protocols. Under this
framework, many interesting topics have been studied, including average
consensus [7], consensus with noises [8] or packet drops [9], and the
convergence rates [10].

Most of the aforementioned studies assume that all nodes faithfully execute
predefined protocols. Since distributed systems are usually deployed in open
environments, there may exist vulnerabilities prone to failures or attacks
[11], which could affect the consensus process. Hence, it is essential to
constrain the negative impact brought by malicious or faulty nodes to ensure
desired agreements. Motivated by this issue, numerous efforts have been
devoted to resilient consensus [12, 13], which are mainly divided into the
following two categories. The first category is based on Mean-Subsequence
Reduced (MSR) algorithms [14, 15]. The main idea of these studies is that the
node discards the extreme states from neighbors and update its state with the
remaining ones. An extended version named Weighted-Mean-Subsequence Reduced
(W-MSR) algorithm is developed in [16]. Instead of removing all extreme states
as in the MSR algorithm, nodes only discard the extreme states that are
strictly larger or smaller than their own states with W-MSR algorithm. Based
on the W-MSR algorithm, LeBlanc et al. [12] develop a novel graph-theoretic
property termed network robustness to characterize the resilience of W-MSR
algorithms and derive the sufficient and necessary conditions of resilient
asymptotic consensus. In addition, the quantized version of the W-MSR
algorithm handling asynchronous and time-varying time delays is presented in
[17]. In faulty asynchronous networks, an approximate Byzantine consensus
algorithm based on MSR algorithms is proposed in [18]. In applications, the
MSR algorithm can be used to build resilient robot teams. For instance,
Saulnier et al. [19] present a hybrid algorithm that enables resilient
formation control for mobile robot teams in the presence of noncooperative
robots. Guerrero et al. [20] propose algorithms to build robust robot teams to
ensure the effectiveness of the MSR algorithm. Similar to MSR algorithm, Yan
et al. [21] solve the resilient multi-dimensional consensus problem by a
middle-point-based algorithm where these points are convex combinations at one
dimension each time. The above algorithms ensure the consensus among normal
nodes with no need to detect malicious nodes and do not require much
computation cost. However, most of them put forward strict requirements on the
graph structure, e.g., ($F+1,F+1$)-robust for $F$-total malicious model and
($2F+1$)-robust for $F$-local malicious model [12, 17], which may be hard to
satisfy in practice.

The other category is detection and isolation. The main idea is designing
detection algorithms to find abnormal nodes and then isolate them immediately.
Observer-based techniques are effective to achieve detections. Pasqualetti et
al. [13] solve the fault detection and isolation problem based on observations
for synchronous consensus in directed networks. To solve problems with more
general attack models, mobile agents are exploited as observers [22]. This
approach relaxes the requirements that the tolerable amount of attacks is
strictly limited by the network connectivity and malicious nodes could not be
neighbors. Fault detection is also achieved by observer-based techniques for
interconnected second-order systems [23]. Detection method proposed in [24] is
able to distinguish privacy noises and attacks with bounded false rate. The
method is to realize both privacy preserving and security under malicious
attacks. The detection and mitigation in randomized gossiping algorithms based
on observation of temporal or spatial difference are investigated in systems
of data injection attacks [25]. Silvestre et al. [26] propose detection
algorithms for randomized gossip algorithms by the use of Set-Valued Observers
and Stochastic Set-Valued Observers. This method only requires a finite number
of vertices to represent poly-topic sets and it can reduce the computational
cost. Observer-based techniques do not require additional state information of
the system, but usually require a high computational cost. Multiple
communication information, e.g., two-hop information, also contribute to
detection. In [27], the authors combine two communication protocols, i.e.,
communication-based and sensing-based model, for fault detection. In [28],
consensus algorithms are enabled in multiple distinct subsets of nodes, and
each normal node verifies whether its state vector has different values in
distinct subsets. If not, there will be malicious nodes among the subsets
which have the same values. Based on the majority voting, a detection scheme
is designed with two-hop communication information for which the constraint on
graph structures is less stringent than that for MSR algorithms [29]. Multiple
communication information utilize extra state information to form redundancy
relationships to determine whether the system is under attack.

The above researches present effective methods to achieve consensus among
normal nodes. Due to the considerations of communication and computation
costs, most of them cannot guarantee exact convergence to the average of
initial states of nodes. Specifically, MSR-based algorithms only ensure
consensus within the range or convex hull of normal nodes’ initial states, and
detection-isolation-based algorithms do not eliminate adverse impacts caused
by malicious nodes before isolation. Hence, the information of initial states
may be polluted. Also, the latter category of algorithms might mistake faulty
nodes for malicious ones when link failures or miscalculations occur
accidentally and will not adopt attack recovery methods, resulting in loss of
information and system capacity. The previous work of resilient average
consensus takes unreliable heterogeneous communication links into
consideration, but does not consider misbehaving nodes which include malicious
and faulty ones[30].

Therefore, in this paper, we are motivated to design resilient average
consensus algorithms for multi-agent systems to defend against the adverse
impact on the consensus that are brought by misbehaving nodes. To achieve
better performance of resilient average consensus, we adopt the idea of
detecting and compensating the adverse impact of misbehaving nodes with two-
hop communication information and providing tolerance for faulty nodes. We
designed detection methods, estimate and compensation the errors in a
distributed manner even if the two-hop information is unreliable when
malicious nodes are not neighbors in our previous work [1]. In this paper, we
make further investigation and the main contributions of this paper are
summarized as follows:

  * •

We study the problem of resilient average consensus with misbehaving nodes.
Not only detection and isolation, but also estimation and compensation are
adopted to achieve accurate resilient average consensus.

  * •

By utilizing two-hop communication information, we design a deterministic
detection-compensation-based consensus (D-DCC) algorithm for normal nodes to
detect and compensate the adverse impact from misbehaving nodes. We also prove
that resilient average consensus can be achieved by D-DCC exactly.

  * •

We further consider the scenario where the communication links could fail due
to accidents, which brings extra challenges for the accurate resilient average
consensus problem. In this case, we propose a stochastic detection-
compensation-based consensus (S-DCC) algorithm correspondingly. Compared with
our previous work[1], in this paper, we relax the requirement that the
expectation of faults should be zero in S-DCC, and prove that resilient
average consensus in expectation is achieved by S-DCC. Moreover, we analyze
the accuracy of S-DCC by Wasserstein distance, and present extensive
evaluation results to show the effectiveness of the proposed algorithms.

The rest of this paper is organized as follows. Section 2 introduces the
models of networks and misbehaviors. Section 3 presents the proposed
algorithms consisting of the mechanisms of detection and compensation. Then,
the performance of the algorithms is analyzed in Section 4. In Section 5,
simulation results are provided. Finally, Section 6 concludes the paper and
discusses the future directions.

_Notation:_ We denote by $\mathbb{R}$ the set of reals. Given a matrix $M$,
$M^{\top}$ is its transpose. Given a set $\mathcal{V}$, $|\mathcal{V}|$ is the
number of elements in the set and $\mathcal{V}/\\{i\\}$ is the set removing
$i$ from $\mathcal{V}$. Given a matrix $W$, $W_{\\{i\\}}$ is the matrix
deleting $i$-th row and column of $W$. We let $\mathbb{E}$ and $\mathbb{D}$
denote expectation and variance operations, respectively.

##  2 PRELIMINARIES AND PROBLEM FORMULATION

###  2.1 Network Model

Consider a network modeled as an undirected graph
$\mathcal{G}=(\mathcal{V},\mathcal{E})$ with vertex set
$\mathcal{V}=\\{1,2,{\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}{\ldots}},N\\}$
and edge set ${\mathcal{E}\subseteq\mathcal{V}\times\mathcal{V}}$. Note that
$(i,j)\in\mathcal{E}$ indicates that node $i$ and node $j$ can communicate
with each other. The neighbor set of node $i$ is denoted by
$\mathcal{N}_{i}=\\{j|(i,j)\in\mathcal{E}\\}$. The adjacency matrix is
$A_{\mathcal{G}}=[a_{ij}]_{N\times N}$, and Laplacian matrix is
$L=D_{\mathcal{G}}-A_{\mathcal{G}}$, where
$D_{\mathcal{G}}=\mathrm{diag}(d_{1},\ldots,d_{N})$ with
$d_{i}=\sum_{j=1}^{N}a_{ij}$. Let $d_{m}=\max\\{d_{1},\dots,d_{N}\\}$. Without
loss of generality, let the subsets $\mathcal{V}_{s}=\\{1,2,\cdots,n\\}$ and
$\mathcal{V}_{m}=\\{n+1,n+2,\cdots,N\\}$ represent normal nodes set and
misbehaving nodes set, respectively. It follows that
$\mathcal{V}_{s}\cup\mathcal{V}_{m}=\mathcal{V}$ and
$\mathcal{V}_{s}\cap\mathcal{V}_{m}=\emptyset$.

###  2.2 Consensus Algorithms

Let $x_{i}(k)\in\mathbb{R}$ be the state of node $i$ at time $k$ and
${x}(k)=[x_{1}(k),x_{2}(k),{\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}{\ldots}},x_{N}(k)]^{\top}$
be the state vector. Consensus algorithms are distributed control protocols
that drive all states to the same value, i.e., $x_{i}=c,$ $\forall
i\in\mathcal{V}$ [7]. The value $c$ is called the consensus value.
Particularly, if
$c={\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}{\frac{1}{N}}}\sum_{i=1}^{N}x_{i}(0)$
holds, then the average consensus can be achieved. The basic discrete-time
linear average consensus is represented as

$x(k+1)=Wx(k),$ (1)

where $W$ is a doubly stochastic matrix, and $w_{ij}\neq 0$ if and only if
nodes $i$ and $j$ are neighbors. By (1), the system will achieve the average
consensus exponentially if the undirected graph $\mathcal{G}$ is a connected
graph. The commonly used weight matrix guaranteeing asymptotic convergence
includes Metropolis weights[31] and Perron matrix, i.e., $W=I-\gamma L$, where
$0<\gamma<1/d_{m}$. Under both Metropolis weights and Perron weights, the
updating coefficients of node $i$, i.e.,
${\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}{w}}_{ij}$,
$\forall j\in\mathcal{N}_{i}$, are known by neighbors if the number of
neighbors $|\mathcal{N}_{i}|$ and $N$ are available to neighbors, which
provide bases for the later error detection.

###  2.3 Information Set and Misbehavior Model

The rule (1) implies that each node updates its state by using the states of
its own and its neighbors. Such two-hop information can be properly utilized
to facilitate the efficient detection of misbehaviors of targeted nodes [6,
22]. All nodes transmit their own information sets to neighbors at each time.
Specifically, for node $i$ at time $k$, its information set $\Psi_{i}(k)$ is
denoted by

$\Psi_{i}(k)\\!=\\!\\{i,x_{i}(k),\pi_{i}(k),\varepsilon_{i}(k-1),\\{j,x_{j}^{(i)}(k-1),j\in\mathcal{N}_{i}\\}\\},$

where $x_{j}^{(i)}(k-1)$ is the state value (at time $k-1$) of node $j$ which
is sent by node $i$ to its neighbors at time $k$. The term
$\varepsilon_{i}(k)$ is the compensation added by normal nodes or the adverse
impact brought by misbehaving nodes, which will be discussed in detail later.
Let the binary attack detection indicator $\pi_{i}(k)=1$ or $\pi_{i}(k)=0$
represent “attack” or “no attack”, respectively, where the former indicates
that the node $i$ has detected misbehaving nodes in its neighbors. Note that
$\varepsilon_{i}(k{\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}{-1}})$
is allowed to be non-zero for normal nodes if $\pi_{i}(k)=1$, i.e.,
compensation is added only when a misbehavior is detected.

As for misbehavior model, the misbehaving nodes considered in this paper can
be either malicious or faulty. Faulty nodes may cause adverse impacts to the
system because of accident faults, e.g., miscalculations. A malicious node
aims to disrupt the network functions by manipulating the information set, but
can only send the same information to all of its neighbors at each time. If
the network is realized by broadcast communication, it is natural to assume
that any node sends the same value to all of its neighbors. In the following,
we make three assumptions regarding the specific misbehaviors that misbehaving
nodes can generate.

######  Assumption 1.

Any two misbehaving nodes do not neighbor with each other.

######  Assumption 2.

A malicious node can manipulate its information set by changing the state
values of its own and its neighbors, and delete the IDs and states of its
neighbors, but cannot add any entries.

######  Assumption 3.

A normal node will cut off all future communication with the node(s) that
is(are) detected as abnormal and isolated.

Assumption 1 is reasonable when the number of misbehaving nodes is much less
than that of normal nodes. In another word, the misbehaving nodes are sparsely
distributed in the network [6]. The attacker capabilities considered are
specified in Assumption 2, which includes basic deception attacks such as
spoofing attack and false-data injection attack[11]. Malicious nodes prefer
not to add any entries because it will be easily detected by normal nodes with
two-hop information. With Assumption 3, the misbehaving nodes will be
effectively isolated by all normal nodes, which can be achieved when there are
mobile nodes in the network [22].

Since misbehaving nodes will cause adverse impacts and normal nodes will add
compensation input, the discrete-time linear updating rule is given as follows

$x(k+1)=Wx(k)+\varepsilon(k),$ (2)

where
$\varepsilon(k)={\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}{[\varepsilon_{1}(k),\varepsilon_{2}(k),\ldots,\varepsilon_{N}(k)]^{\top}}}$
is the input vector. The term $\varepsilon_{i}(k)$ is the error input for
misbehaving node $i\in\mathcal{V}_{m}$, while $\varepsilon_{i}(k)$ is the
compensation input for normal node $i\in\mathcal{V}_{s}$.

Considering there may be link failures during communication, we refer to link
failures as the phenomenon that may prevent information set from being
received at each desired time. We denote by $p$ the probability of connection
between nodes, i.e., link failure occurs with probability $1-p$ between each
pair of nodes independently. In order to facilitate the analysis when we
consider link failures, the errors caused by misbehaving nodes are
characterized to obey an unknown distribution [32]. It is supposed that
misbehaving node $i$ affects the system (or the error equals to zero) with
probability $\theta_{i}\in[0,1]$. Let $X_{i}(k)$ be the random variable of
attack or not, i.e., $X_{i}(k)\sim\mathcal{B}(1,\theta_{i})$, where
$\mathcal{B}$ represents the Bernoulli distribution. The term $X_{i}(k)$ is
used because we need to consider the probability that $\varepsilon_{i}(k)=0$
separately. Further, the misbehaving nodes affect the system with a certain
mechanism. Hence, if node $i$ affects the system at time $k$, the random
variable of the error, i.e., $Y_{i}(k)$, obeys a certain distribution with
expectation $\mu_{i}$ and variance $\sigma_{i}^{2}$. We assume that the
probability of $Y_{i}(k)=0$ is zero, and $X_{i}(k)$ and $Y_{i}(k)$ are
independent. Hence, it holds that $\varepsilon_{i}(k)=X_{i}(k)Y_{i}(k)$ for
misbehaving nodes. Then, we have

$\displaystyle\mathbb{E}[\varepsilon_{i}(k)]{}$
$\displaystyle=\theta_{i}\mu_{i},$
$\displaystyle\mathbb{D}[\varepsilon_{i}(k)]{}$
$\displaystyle=\theta_{i}\sigma_{i}^{2}+(1-\theta_{i})\theta_{i}\mu_{i}^{2}\triangleq\sigma_{\varepsilon_{i}}^{2}.$

Nevertheless, $\varepsilon_{i}(k)$ can obey an arbitrary distribution because
we do not pose any restriction on the distributions of $X_{i}(k)$ and
$Y_{i}(k)$, and do not need to know the expectation and variance of them,
which is different from the faults. The difference between malicious nodes and
faulty nodes is that malicious nodes will attack the system continuously,
while faulty nodes only cause accidental disturbances in a limited period.

###  2.4 Problem of Interest

We consider a multi-agent system with misbehaving nodes which is described by
$\mathcal{G}$. Each node owns an initial state $x_{i}(0)$ and the system
updates its states by (2). In such a setting, representative consensus
algorithms such as W-MSR [16] cannot guarantee accurate consensus values, and
fault detection and isolation methods may mistake faulty nodes for malicious
ones. Thus, extra input is needed to mitigate errors caused by misbehaving
nodes, and a fault-tolerance mechanism is called for faulty nodes. This paper
aims to develop a distributed detection and compensation algorithm to achieve
resilient average consensus. With the proposed algorithm, normal nodes can
detect the errors of neighboring misbehaving nodes by examining the
information sets from neighbors and mitigate the adverse impact by adding
compensating input to their own states. Considering that there may be
misbehaving nodes with low data utility, e.g., malicious nodes who constantly
cause errors and faulty nodes with severe malfunction, isolation are adopted
to thoroughly eliminate negative effects. Besides, given that the
communication in multi-agent systems could be unreliable due to link failures
(especially in the wireless communication scenario), the consensus process
will be influenced if the information set is intermittently unavailable.
Therefore, we further take link failures into consideration.

Under scenarios where all information sets from neighbors are available, we
aim to design a misbehavior-resilient algorithm to achieve resilient average
consensus among the nodes in the set after isolation $\mathcal{V}_{r}$ for the
system with malicious nodes and faulty nodes, i.e.,

$\lim_{k\to\infty}x_{j}(k)=\frac{1}{|\mathcal{V}_{r}|}\sum_{u\in\mathcal{V}_{r}}x_{u}(0),\quad\forall
j\in\mathcal{V}_{r},$ (3)

where $\mathcal{V}_{r}$ is a subset of $\mathcal{V}$ including nodes that are
not isolated. It is assumed that the subgraph
${\mathcal{G}_{r}}=(\mathcal{V}_{r},\mathcal{E}_{r})$ is connected, where
$\mathcal{E}_{r}$ ($\mathcal{E}_{r}\subseteq\mathcal{E}$) denotes edge set of
the nodes in $\mathcal{V}_{r}$.

Considering the random communication link failures between nodes, we aim to
extend our algorithm to achieve unbiased resilient average consensus in
expectation with a relative small variance by designing compensation input,
i.e.,

$\mathbb{E}\left[\lim_{l\to\infty}x_{j}(l)\right]=\frac{1}{|\mathcal{V}_{r}|}\sum_{u\in\mathcal{V}_{r}}x_{u}(0),\quad\forall
j\in\mathcal{V}_{r}.$ (4)

##  3 DETECTION AND COMPENSATION DESIGN

In this section, we first propose a detection algorithm to detect misbehaving
nodes and then compensate the negative impact caused by these misbehaviors.
The basic idea of detection is to design two-hop information set to form
redundancy relationships. By two-hop information set, the misbehaviors can be
characterized in a distributed manner, which leads to four compensation
schemes. Considering the possible link failures, a stochastic scheme is then
introduced.

###  3.1 Detection Strategies

The first step for each normal node is to determine whether there are
misbehaving nodes in the neighborhood and estimate the amount of error caused
by them. According to Assumption 2, a malicious node $i$ can manipulate states
of neighbors in the information set, i.e.,
$x_{j}^{(i)}(k-1){\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}{,j\in\mathcal{N}_{i}}}$,
or updates its own state with arbitrary errors. The detection strategies are
characterized by the following two types:

  * •

_Detection Strategy I_ : Node $j$ detects whether misbehaving nodes change the
state values of $j$ in information set, i.e., $x^{(i)}_{j}(k)\neq
x_{j}(k),j\in\mathcal{N}_{i}$. If the malicious node deletes the ID and state
of $j$ in the information set, it can be regarded as changing the
corresponding state value to zero.

  * •

_Detection Strategy II_ : Node $j$ detects whether misbehaving node $i$ follow
the update rule $x_{i}(k+1)=\sum_{j\in\mathcal{N}_{i}}w_{ij}x^{(i)}_{j}(k)$.

Each normal node will utilize the two detection strategies to check each
neighbor based on its information set. Obviously, the misbehaviors mentioned
in Section 2.3 could be detected by Detection Strategy I or II or both. The
update rule is as

$\begin{split}x_{i}(k+1)~{}&=\sum_{j\in\mathcal{N}_{i}}w_{ij}x_{j}(k)+\varepsilon_{i}(k)\\\
~{}&=\sum_{j\in\mathcal{N}_{i}}w_{ij}x_{j}(k)+\sum_{j\in\mathcal{N}_{i}}\varepsilon_{i}^{j(1)}(k)+\varepsilon_{i}^{(2)}(k),\end{split}$
(5)

where $\varepsilon_{i}^{j(1)}(k)$ and $\varepsilon_{i}^{(2)}(k)$ are the
adverse impacts detected by Detection Strategy I and II, respectively, and

$\displaystyle\varepsilon_{i}^{j(1)}(k)~{}$
$\displaystyle=w_{ij}(x_{j}^{(i)}(k)-x_{j}(k)),$ (6a)
$\displaystyle\varepsilon_{i}^{(2)}(k)~{}$
$\displaystyle=x_{i}(k+1)-\sum_{j\in\mathcal{N}_{i}}w_{ij}x_{j}^{(i)}(k).$
(6b)

Note that each neighbor of misbehaving node $i$ will detect node $i$ with the
same error by Detection Strategy II. Hence, $\varepsilon_{i}^{(2)}(k)$ is used
instead of $\varepsilon_{i}^{j(2)}(k)$.

###  3.2 Compensation Schemes & D-DCC Algorithm

In this part, a deterministic detection-compensation-based consensus (D-DCC)
algorithm is proposed. The following lemma shows the sufficient condition of
resilient average consensus on dynamic system (2).

######  Lemma 1 ([33]).

For the system (2), if the added input vectors are bounded, i.e.,
$||\varepsilon(k)||_{\infty}\leq\alpha\rho^{k}$ for certain $\alpha>0$ and
$\rho\in[0,1)$, and the sum of inputs satisfies

$\sum_{k=0}^{\infty}\sum_{i=1}^{\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}{N}}\varepsilon_{i}(k)=0,$
(7)

then average consensus is achieved exponentially.

It is obvious that the existence of misbehaving nodes can lead to the
violation of (7), which is the necessary condition of average consensus. If
(7) does not hold,
$\lim_{k\to\infty}\sum_{i=1}^{N}x_{i}(k)=\sum_{i=1}^{N}x_{i}(0)$ will not hold
either. To achieve exact average consensus, we need to compensate the impact
of misbehaviors by introducing an error compensator $\eta_{j}$ for each normal
node $j$. The compensation values to be added is stored in the error
compensator $\eta_{j}$. Then, node $j$ will select compensation input
according to the error compensator. We define the following three types of
compensation.

  * •

_Compensation Scheme I_ : To compensate the impact detected by Detection
Strategy I, i.e.,

$\eta_{j}^{i(1)}(k+1)=-w_{ij}(x_{j}^{(i)}(k)-x_{j}(k)).$ (8)

  * •

_Compensation Scheme II_ : To compensate the impact detected by Detection
Strategy II, i.e.,

$\eta_{j}^{i(2)}(k+1)=-\varepsilon_{i}^{(2)}(k)/|\mathcal{N}_{i}|.$ (9)

  * •

_Compensation Scheme III_ : To compensate the impact of isolation, i.e.,

$\eta_{j}^{i(3)}(k+1)=(x_{i}(k+1)-x_{i}(0))/|\mathcal{N}_{i}|.$ (10)

Compensation I is employed by node $j$ when it detects that its neighbor $i$
has changed the value of node $j$ in the information set. Note that all
$|\mathcal{N}_{i}|$ neighbors of node $i$ detect the misbehaviors of node $i$
by Detection Strategy II. Hence, each node averagely compensates the error.
Moreover, Compensation Scheme III is adopted when node $i$ is isolated by
neighbors. Each neighbor will equally compensate the historical adverse impact
on average consensus.

Inspired by Lemma 1, we adopt a distributed exponential decaying bound of
errors, i.e., $\alpha_{j}\rho_{j}^{k}$, $j\in\mathcal{V}_{s}$, to decide
isolation and guarantee the convergence. Let
$\alpha=N\max_{i\in\mathcal{V}}\alpha_{i}$,
$\rho=\max_{i\in\mathcal{V}}\rho_{i}$. Then, the condition
$||\varepsilon(k)||_{\infty}\leq\alpha\rho^{k}$ will hold. Node $j$ estimates
the error of its neighbor $i$ by (6). If the error is in the bound, i.e.
$|\varepsilon_{i}^{j(1)}(k)+\varepsilon_{i}^{(2)}(k)|\leq\alpha_{j}\rho_{j}^{k}$,
then node $j$ will compensate the error by Compensation Scheme I and II, which
is a resilient mechanism for finite errors and accidental errors such as
computation error and actuator error. Otherwise, it means that the adverse
impact caused by node $i$ is too severe such that the consensus process will
be seriously affected and the convergence may not be achieved according to
Lemma 1. In this case, node $j$ will cut off the communication with node $i$
(i.e., node $i$ is isolated) to avoid the future adverse impact from node $i$
and Compensation Scheme III will be used to remedy the historical bad impact
from node $i$.

In summary, by means of the above three compensation schemes, our resilient
average consensus algorithm under deterministic communication scenario is
proposed as D-DCC algorithm, which is summarized in Algorithm 1. For the sake
of simplicity, the proposed D-DCC algorithm only shows the execution of node
$j\in\mathcal{V}$ and its neighbors. Specifically, node $j\in\mathcal{V}$
first performs Detection Strategies I and II, and Compensation Schemes I and
II in order (see steps 4-11 in Algorithm 1). Then, node $j$ checks whether the
error of node $i\in\mathcal{N}_{j}$ beyonds the bound
$\alpha_{i}\rho_{i}^{k}$. Subsequently, node $j$ identifies whether node $i$
is to be isolated at this time. If so, node $j$ calculates
$\eta_{j}^{i(3)}(k+1)$ by Compensation Scheme III and updates the new
$|\mathcal{N}_{j}|$ to its remaining neighbors. In the sequel, node $j$
selects $\varepsilon_{j}(k+1)$ and renewals its state $x_{j}(k+2)$ with the
designed $\varepsilon_{j}(k+1)$, followed by updating the error compensator
$\eta_{j}=\eta_{j}-\varepsilon_{j}(k+1)$. Note that the selection of the
compensation input $\varepsilon_{j}(k+1)$ could be arbitrary, as long as it
guarantees the security of state and the non-increasing property of
$|\eta_{j}|$.

######  Remark 1.

It should be noted that both normal and misbehaving nodes have the input term
$\varepsilon_{i}(k)$ (i.e., the error or compensation input) in their
information sets. If malicious nodes have full knowledge of detection and
compensation methods, then they can easily masquerade as normal ones. To avoid
this issue, we put the attack detection indicator $\pi_{i}(k)$ into the
information set $\Psi_{i}(k)$. Note that a normal node is allowed to add non-
zero compensation input only when it has detected misbehaviors in the
neighborhood. Then, we adopt a steady compensation sequence which restricts
the changes of compensation, i.e.,
$|\varepsilon_{i}(k)-\varepsilon_{i}(k-1)|\leq\delta$, which is reasonable in
practice. We assume that malicious nodes cannot change the attack detection
indicator or have no knowledge of $\delta$. Hence, with the above two methods,
it may be easy to distinguish malicious nodes with errors and normal nodes
with compensation input.

Algorithm 1 D-DCC Algorithm

0: $\ \ x_{j}(k),\Psi_{i}(k+1),i\in\mathcal{N}_{j}$.

1: Initialize: set compensator $\eta_{j}=0$, parameters $\alpha_{j},\rho_{j}$
node $j$ exchanges its true initial state $x_{j}(0)$ and the number of
neighbors $|\mathcal{N}_{j}|$ with neighbors, and store them

2: for $k=0:$ Max_time do

3: for $i\in\mathcal{N}_{j}$ (node $i$ is not isolated & $\pi_{i}(k)=0$) do

4: $\varepsilon_{i}^{j(1)}(k+1)=w_{ij}(x_{j}^{(i)}(k)-x_{j}(k))$.

5: $\varepsilon_{i}^{(2)}(k)=x_{i}(k+1)-\sum_{j\in
N_{i}}w_{ij}x_{j}^{(i)}(k)$.

6: if $\varepsilon_{j}^{i(1)}(k)\neq 0$ then

7: $\eta_{j}^{i(1)}(k+1)=-\varepsilon_{i}^{j(1)}(k)$.

8: end if

9: if $\varepsilon_{i}^{(2)}(k)\neq 0$ then

10: $\eta_{j}^{i(2)}(k+1)=-\varepsilon_{i}^{(2)}(k)/|\mathcal{N}_{i}|$.

11: end if

12: if
$|\varepsilon_{i}^{j(1)}(k)+\varepsilon_{i}^{(2)}(k)|>\alpha_{j}\rho_{j}^{k}$
then

13: Node $j$ cut off the communication with node $i$.

14: end if

15: if node $i$ is isolated at this time then

16: $\eta_{j}^{i(3)}(k+1)=(x_{i}(k+1)-x_{i}(0))/|\mathcal{N}_{i}|$.

17: end if

18:
$\eta_{j}=\eta_{j}+\eta_{j}^{i(1)}(k+1)+\eta_{j}^{i(2)}(k+1)+\eta_{j}^{i(3)}(k+1)$.

19: end for

20: Update its state $x_{j}(k+2)$ with $\varepsilon_{j}(k+1)$ by (5).

21: Update the error compensator $\eta_{j}=\eta_{j}-\varepsilon_{j}(k+1)$.

22: end for

###  3.3 S-DCC Algorithm

In this subsection, we further investigate the resilient average consensus
problem against misbehaviors while considering the possible link failures
among nodes. In this case, there are two aspects introducing stochasticity
that should be addressed: (1) The communication link status between nodes is
stochastic and we assume that the link failure occurs with probability $p$ at
each time (see Section 2.3); (2) The compensation is also stochastic because
of random misbehaviors and link failures. This stochasticity property brings
extra challenges compared with the problems in the deterministic communication
scenario (see Section 3.2). That is the corresponding information set of
neighbors is not available when a link failure occurs. As a result, some
misbehaviors among the relevant nodes may not be detected. To ensure the
resilience performance against misbehaving nodes when the information set is
randomly unavailable, we propose a stochastic detection-compensation-based
consensus (S-DCC) algorithm to reach the average consensus in expectation with
bounded variance. Specifically, we further propose Compensation Scheme IV
based on the estimation of the average detected errors:

  * •

_Compensation Scheme IV_ : To compensate the impact of undetected
misbehaviors, i.e.,

$\eta_{j}^{i(4)}(k+1)=-(k-k_{i}^{j0}-m_{j}(k))\overline{\varepsilon}_{i}^{j}(k),$
(11)

where $k_{i}^{j0}$ is the last detecting time before node $i$ is first
detected by node $j$ as a misbehaving node, which is treated as the last time
before misbehavior occurs. In addition, we have

$\overline{\varepsilon}_{i}^{j}(k)=\sum_{\varepsilon_{i}^{j}(k)\in\Omega_{j}^{(i)}(k)}\varepsilon_{i}^{j}(k)/m_{j}(k),$

where $m_{j}(k)$ is the number of times that node $j$ detects node $i$ after
time $k_{i}^{j0}$. The intuition behind Compensation Scheme IV is that the
mean of detected errors may represent the mean effect by misbehaving nodes in
a time window. Specifically, the information set is available, which enables
the detection, at each time independently with probability $p$. When the
detection is enabled, node $j$ will detect and compensate the possible errors.
In order to estimate the effect of misbehaving nodes, node $j$ will store the
detected error $\varepsilon_{i}^{j}(k)$ in the error set $\Omega_{j}^{(i)}(k)$
corresponding to node $i$, and compensate undetected errors according to the
error set. The details of S-DCC algorithm are summarized in Algorithm 2. Note
that at each time of detection, a new detected error will be added to the
error set, and a new estimation of undetected error will be utilized to
replace the former one. Hence, at step 13 of S-DCC, the former compensation by
Compensation Scheme IV will be removed.

Algorithm 2 S-DCC Algorithm

0: $\ \ x_{j}(k),\Psi_{i}(k+1),i\in\mathcal{N}_{j}$.

1: Initialize: The same as Algorithm 1; set detection probability $p$,
detection times $m_{j}=0$.

2: for $k=0:$ Max_time do

3: if Detection is enabled then

4: for $i\in\mathcal{N}_{j}$ (node $i$ is not isolated & $\pi_{i}(k)=0$) do

5: Execute steps 4-14 in Algorithm 1.

6: if node $j$ is misbehaving then

7: Store
$\varepsilon_{i}^{j}(k)=\varepsilon_{i}^{j(1)}(k)+\varepsilon_{i}^{(2)}(k)/|\mathcal{N}_{i}|$
in $\Omega_{j}^{(i)}(k)$.

8: Calculate $\eta_{j}^{i(4)}(k+1)$ by (11).

9: end if

10: if $i$ is isolated at this step then

11: $\eta_{j}^{i(3)}(k+1)=(x_{j}(k+1)-x_{j}(0))/|\mathcal{N}_{i}|$.

12: end if

13:
$\eta_{j}=\eta_{j}+\eta_{j}^{i(1)}(k+1)+\eta_{j}^{i(2)}(k+1)+\eta_{j}^{i(3)}(k+1)+\eta_{j}^{i(4)}(k+1)-\eta_{j}^{i(4)}(k)$.

14: end for

15: end if

16: Update its state $x_{j}(k+2)$ with $\varepsilon_{j}(k+1)$ by (5).

17: Update the error compensator $\eta_{j}=\eta_{j}-\varepsilon_{j}(k+1)$.

18: end for

##  4 Performance Analysis

In this section, we prove that for D-DCC, all misbehaving nodes will be
detected and accurate resilient average consensus will be achieved.
Additionally, for S-DCC, we demonstrate that all misbehaving nodes will be
detected with probability one and resilient average consensus in expectation
will be achieved. Besides, we analyze the accuracy of S-DCC by the Wasserstein
distance.

###  4.1 Analysis of D-DCC

First, with respect to the detection performance of D-DCC, the following lemma
shows the effectiveness.

######  Lemma 2.

If Assumptions 1-3 hold, then all misbehaving nodes will be detected and some
of them will be isolated by Algorithm 1.

###### Proof.

Suppose that the misbehaving node $i$ changes the state value of its neighbor
node $j$ in the information set $\Psi_{i}(k+1)$. According to Assumption 1,
node $j$ is normal. Hence, when node $j$ receives the information set from
node $i$, it will find out that $x_{j}^{(i)}(k)\neq x_{j}(k)$ and the
misbehaving node $i$ will be detected by Detection Strategy I. Similarly, if
node $i$ deletes the ID and state of node $j$, it will also be detected by
node $j$.

If the misbehaving node $i$ does not follow the update rule based on the
information set, i.e.,
$x_{i}(k+1)\neq\sum_{j\in\mathcal{N}_{i}}w_{ij}x^{(i)}_{j}(k)$, it will be
detected by all neighbors by Detection Strategy II, because $w_{ij}$ is known
by all neighbors.

According to Algorithm 1, if the error is below the local bound, then the
misbehaving node will not be isolated. However, once the error is out of the
bound, the misbehaving node will be isolated. ∎

Next, we evaluate the consensus performance of D-DCC algorithm in the presence
of misbehaving nodes in the following theorem.

######  Theorem 1.

If Assumptions 1-3 hold, then D-DCC achieves resilient average consensus among
the nodes in the set after isolation $\mathcal{V}_{r}$, i.e., (3) holds.

###### Proof.

First, we illustrate that consensus will be achieved by Algorithm 1. Note that
$W$ is doubly stochastic and each $\varepsilon_{i}(k),i\in\mathcal{V}_{r}$
satisfies the condition $\varepsilon_{i}(k)\leq\alpha_{i}\rho_{i}^{k}$.
Therefore, the consensus can be achieved according to Lemma 1 after
compensating the impacts of nodes that are not in the set $\mathcal{V}_{r}$.
If node $i$ is isolated, let $W_{\\{i\\}}$ be the matrix obtained by deleting
$i$-th row and column of $W$. It follows that $W_{\\{i\\}}$ is still a matrix
with Perron weight or Metropolis weights. Hence, consensus will be achieved
among the remaining nodes in $\mathcal{V}_{r}$.

Next, we prove the limit value is average consensus among the nodes in the set
after isolation $\mathcal{V}_{r}$. Without loss of generality, we consider a
subsystem composed of misbehaving node $i$ and its neighbors. Since $W$ is
doubly stochastic, we have the following according to (2):

$\sum_{j\in\mathcal{V}}x_{j}(k+1)=\sum_{j\in\mathcal{V}}x_{j}(0)+\sum_{l=1}^{k}\sum_{j\in\mathcal{V}}\varepsilon_{j}(l).$
(12)

Case 1: If node $i$ is not isolated, according to Compensation Scheme I and
II, we have

$\sum_{l=0}^{\infty}\\{\varepsilon_{i}(l)+\sum_{j\in\mathcal{N}_{i}}(\eta_{j}^{i(1)}(l+1)+\eta_{j}^{i(2)}(l+1))\\}=0.$
(13)

Hence, (7) holds.

Case 2: If node $i$ is isolated at time $k+1$, we can regard it as staying at
the state $x_{i}(k+1)$. Since $W$ is a doubly stochastic matrix at each-step,
we have that (12) holds. Node $i$ is regarded to stay at the value
$x_{i}(k+1)$, i.e. $\varepsilon_{i}(l)=0,\forall l>k$. Because Compensation
Schemes I and II will compensate the impact before isolation, the condition
(13) holds. In addition, Compensation Scheme III will compensate the influence
of node $i$ on the system before isolation. Thus, we have

$\sum_{l=1}^{\infty}\sum_{j\in\mathcal{V}}\varepsilon_{j}(l)=x_{i}(k+1)-x_{i}(0).$
(14)

Combining (12) with (14) and noting that node $i$ is regarded as staying at
the value $x_{i}(k)$ after isolation, it follows that

$\lim_{l\to\infty}\sum_{j\in\mathcal{V}/\\{i\\}}x_{j}(l)=\sum_{j\in{\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}{\mathcal{V}/\\{i\\}}}}x_{j}(0).$
(15)

Generally, we have

$\lim_{l\to\infty}\sum_{j\in\mathcal{V}_{r}}x_{j}(l)=\sum_{j\in\mathcal{V}_{r}}x_{j}(0).$
(16)

Hence, the resilient average consensus among the nodes in the set after
isolation $\mathcal{V}_{r}$ is achieved. ∎

######  Remark 2.

Theorem 1 guarantees the accurate average consensus even if there are
misbehaving nodes in the system. Due to the use of local error bound, D-DCC
provides tolerance for accidental miscalculations and transmission errors. If
isolation is not adopted in these scenarios, e.g., a node malfunctions
transitorily, the faulty node is still able to accomplish the system mission,
which may contribute to the overall efficiency of the system. The tolerance
depends on the parameters $\alpha_{i}$ and $\rho_{i}$. Note that a larger
$\alpha_{i}\rho_{i}$ will improve the fault tolerance but reduce the
convergence speed.

###  4.2 Analysis of S-DCC

Before going into the analysis of S-DCC algorithm, we first define several
notations. Summing up compensation input of all neighbors of misbehaving node
$i$, the average compensation of $\varepsilon_{i}(k)$ is
$-\sum_{j\in\mathcal{N}_{i}}\overline{\varepsilon}_{i}^{j}(k)\triangleq-\overline{\varepsilon}_{i}(k)$,
where $\overline{\varepsilon}_{i}(k)$ is the average error of detecting times.
Note that there may be some faulty nodes that will not be isolated. These
faulty nodes may cause errors due to accidental miscalculations. Hence, it is
reasonable to assume that the errors of the faulty node $i$ occur in a period
from $k_{i}^{0}$ to $k_{i}^{1}$. Denote subsets $\mathcal{V}_{f}$ and
$\mathcal{V}_{M}$ be the set of faulty nodes and malicious nodes,
respectively. We provide the following theorem to analyze the performance of
S-DCC.

######  Theorem 2.

If Assumptions 1-3 hold, then S-DCC achieves resilient average consensus in
expectation among the nodes in the set after isolation $\mathcal{V}_{r}$,
i.e., $\forall j\in\mathcal{V}_{r}$, we have

$\mathbb{E}\big{[}\lim_{l\to\infty}x_{j}(l)\big{]}=\frac{1}{|\mathcal{V}_{r}|}\sum_{u\in\mathcal{V}_{r}}x_{u}(0),$
(17)
$\mathbb{D}\big{[}\lim_{l\to\infty}x_{j}(l)\big{]}\leq\sum_{i\in\mathcal{V}_{m}}D_{m}+\sum_{i\in\mathcal{V}_{f}}D_{f},$
(18)

where

$\displaystyle
D_{m}={{(k^{\text{iso}}_{i}-M_{i})}(1+\frac{k^{\text{iso}}_{i}-M_{i}}{M_{i}})\sigma_{\varepsilon_{i}}^{2}},$
$\displaystyle
D_{f}\\!=\\!\frac{1-p}{p^{2}}(\frac{\sigma_{\varepsilon_{i}}^{2}}{M_{i}}+\theta_{i}^{2}\mu_{i}^{2})\\!+\\!{{(k^{1}_{i}-k^{0}_{i})}(1+\frac{k^{1}_{i}-k^{0}_{i}}{M_{i}})\sigma_{\varepsilon_{i}}^{2}},$

in which $k^{\text{iso}}_{i}$ is the isolation time of node $i$ and
$M_{i}=\min_{j\in\mathcal{N}_{i}}m_{j}(k^{\text{iso}}_{i})$. In addition, the
consensus value is bounded, i.e.,

$\big{|}\lim_{l\to\infty}x_{j}(l)-\frac{1}{|\mathcal{V}_{r}|}\sum_{u\in\mathcal{V}_{r}}x_{u}(0)\big{|}\leq\displaystyle{\frac{\alpha\rho|\mathcal{V}_{m}|}{(1-\rho)|\mathcal{V}_{r}|}}.$
(19)

###### Proof.

First, we illustrate that all malicious nodes will be detected with
probability one. For each malicious node $i$, it affects the system with
probability $\theta_{i},0<\theta_{i}\leq 1$. For each normal node
$j\in\mathcal{N}_{i}$, it detects the misbehavior of node $i$ with probability
$p,0<p\leq 1$. The probability of the event that node $i$ is detected by $j$
in no later than time $k$ is

$P(k)=1-(1-p\theta_{i})^{k}.$ (20)

By taking the limit on both sides of (20), we have

$\lim_{k\to\infty}P(k)=\lim_{k\to\infty}(1-(1-p\theta_{i})^{k})=1.$

Hence, all malicious nodes will be detected with probability one. Similarly,
all malicious nodes will be isolated with probability one because the bound
$\alpha\rho^{k}=0$ as $k\to\infty$.

Next, we will prove that

$\mathbb{E}\big{[}\lim_{l\to\infty}\sum_{j\in\mathcal{V}_{r}}x_{j}(l)\big{]}=\sum_{j\in\mathcal{V}_{r}}x_{j}(0).$
(21)

For the sake of simplicity, we perform analysis on a subsystem composed of the
misbehaving node $i$ and its neighbors in $\mathcal{N}_{i}$ in the following.
Note that $X_{i}(l)$ and $Y_{i}(l)$ are independent.

Case 1: Considering a malicious node $i$, the expectation of the sum of its
error within time $k$ is

$\mathbb{E}\left[\sum_{l=1}^{k}\varepsilon_{i}(l)\right]=\mathbb{E}\left[\sum_{l=1}^{k}X_{i}(l)Y_{i}(l)\right]=k\theta_{i}\mu_{i}.$
(22)

Without loss of generality, we consider that all the neighbor nodes in
$\mathcal{N}_{i}$ detect the misbehavior of node $i$ at the same time. The
expectation of $\sum_{j\in\mathcal{N}_{i}}\overline{\varepsilon}_{i}^{j}$
satisfies

$\displaystyle\mathbb{E}\Big{[}\sum_{j\in\mathcal{N}_{i}}\overline{\varepsilon}_{i}^{j}(k)\Big{]}{}$
$\displaystyle=\mathbb{E}\Big{[}\frac{1}{m_{j}}{\sum_{j\in\mathcal{N}_{i}}\sum_{\varepsilon_{i}^{j}(k)\in\Omega_{j}^{(i)}}\varepsilon_{i}^{j}(k)}\Big{]}$
$\displaystyle=\mathbb{E}\big{[}\varepsilon_{i}(l)\big{]}=\theta_{i}\mu_{i}.$

The expectation of the Compensation Scheme I, II, IV is

$\displaystyle\mathbb{E}\left[\sum_{j\in\mathcal{N}_{i}}\sum_{l=1}^{k}(\eta_{ji}^{(1)}(l)+\eta_{ji}^{(2)}(l)+\eta_{ji}^{(4)}(l))\right]$
(23) $\displaystyle=$
$\displaystyle\mathbb{E}\left[{\sum_{j\in\mathcal{N}_{i}}\sum_{\varepsilon_{i}^{j}(k)\in\Omega_{j}^{(i)}}\varepsilon_{i}^{j}(k)}-(k-m_{j}(k))\sum_{j\in\mathcal{N}_{i}}\overline{\varepsilon}_{i}^{j}\right]$
$\displaystyle=$
$\displaystyle\mathbb{E}\left[-k\sum_{j\in\mathcal{N}_{i}}\overline{\varepsilon}_{i}^{j}(k)\right]=-k\theta_{i}\mu_{i}.$

Let $k+1=k^{\text{iso}}_{i}$ for (10). Therefore, combining (10), (22) and
(23), we have

$\displaystyle\mathbb{E}\left[\sum_{l=1}^{k}(\varepsilon_{i}(l)+\sum_{j\in\mathcal{N}_{i}}\eta_{j}(l))\right]=x_{i}(k+1)-x_{i}(0).$

Hence, we have

$\mathbb{E}\left[\lim_{l\to\infty}\sum_{j\in\mathcal{V}/\\{i\\}}x_{j}(l)\right]=\sum_{j\in{\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}{\mathcal{V}/\\{i\\}}}}x_{j}(0).$
(24)

Case 2: Consider that the errors of faulty node $i$ which occur in a period
from $k_{i}^{0}$ to $k_{i}^{1}$. The compensation for node $i$ is
$-\sum_{j\in\mathcal{N}_{i}}(k_{i}^{j0}-k_{i}^{j1})\overline{\varepsilon}_{i}^{j}$,
where $k_{i}^{j0}$ is the last time of detection before $k_{i}^{0}$ and
$k_{i}^{j1}$ is the last time of detection before $k_{i}^{1}$. Consequently,
the following holds:

$\mathbb{E}[k_{i}^{0}-k_{i}^{j0}]=\mathbb{E}[k_{i}^{1}-k_{i}^{j1}]=\frac{1}{p}-1.$

Hence, we have $\mathbb{E}[k_{i}^{j0}-k_{i}^{j1}]=k_{i}^{0}-k_{i}^{1}$. Since
detection and errors are independent, it holds that

$\mathbb{E}\left[-\sum_{j\in\mathcal{N}_{i}}(k_{i}^{j0}-k_{i}^{j1})\overline{\varepsilon}_{i}^{j}\right]=(k_{i}^{1}-k_{i}^{0})\theta_{i}\mu_{i}.$

Then, we have

$\mathbb{E}\left[\lim_{l\to\infty}\sum_{j\in\mathcal{V}}x_{j}(l)\right]=\sum_{j\in{\color[rgb]{0,0,0}\definecolor[named]{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@gray@stroke{0}\pgfsys@color@gray@fill{0}{\mathcal{V}}}}x_{j}(0).$
(25)

With the above two cases, we have (21) for the general set $\mathcal{V}_{r}$.
Hence, (4) holds and an average consensus in expectation among the nodes in
the set after isolation $\mathcal{V}_{r}$ is achieved.

Since $\overline{\varepsilon}_{i}$ is the average value of sampling, we have
$\mathbb{D}[\overline{\varepsilon}_{i}]\leq\sigma_{\varepsilon_{i}}^{2}/{M_{i}}$.
Because the detected errors ($m_{j}$ times) will be compensated accurately by
node $j$, the variance of the consensus value is given by

$\displaystyle\mathbb{D}\Big{[}\sum_{u\in\mathcal{V}_{r}}x_{u}(k)\Big{]}$
$\displaystyle=$
$\displaystyle\sum_{i\in\mathcal{V}_{m}}\mathbb{D}\Big{[}{\sum_{l=1}^{k^{\text{iso}}_{i}}\varepsilon_{i}(l)}-k^{\text{iso}}_{i}\sum_{j\in\mathcal{N}_{i}}\overline{\varepsilon}_{i}^{j}\Big{]}$
$\displaystyle+$
$\displaystyle\sum_{i\in\mathcal{V}_{f}}\mathbb{D}\Big{[}{\sum_{l=k_{i}^{0}}^{k_{i}^{1}}}\varepsilon_{i}(l)-\sum_{j\in\mathcal{N}_{i}}(k_{i}^{j0}-k_{i}^{j1})\overline{\varepsilon}_{i}^{j}\Big{]}$
$\displaystyle\leq$
$\displaystyle\sum_{i\in\mathcal{V}_{m}}{{(k^{\text{iso}}_{i}-M_{i})}\big{(}1+(k^{\text{iso}}_{i}-M_{i})/M_{i}\big{)}\sigma_{\varepsilon_{i}}^{2}}$
$\displaystyle+$
$\displaystyle\sum_{i\in\mathcal{V}_{f}}\Big{[}\frac{1-p}{p^{2}}(\frac{\sigma_{\varepsilon_{i}}^{2}}{M_{i}}+\theta_{i}^{2}\mu_{i}^{2})\\!+\\!{{(k^{1}_{i}-k^{0}_{i})}(1\\!+\\!\frac{k^{1}_{i}-k^{0}_{i}}{M_{i}})\sigma_{\varepsilon_{i}}^{2}}\Big{]}$
$\displaystyle=$
$\displaystyle\sum_{i\in\mathcal{V}_{m}}D_{m}+\sum_{i\in\mathcal{V}_{f}}D_{f}.$

Each malicious node causes adverse impacts. Hence, (18) holds.

According to the proof of Theorem 1, $\varepsilon(k)$ satisfies the condition
$||\varepsilon(k)||_{\infty}\leq\alpha\rho^{k}$. For misbehaving nodes, we
have

$\sum_{i\in\mathcal{V}_{m}}\sum_{l=1}^{\infty}\varepsilon_{i}(l)\leq\frac{|\mathcal{V}_{m}|\alpha\rho}{(1-\rho)}.$

Hence, (19) is proved. ∎

######  Remark 3.

Theorem 2 ensures resilient average consensus in expectation. Note that if
$M_{i}=k^{\textrm{iso}}_{i}$, then
$\mathbb{D}\big{[}\lim_{l\to\infty}x_{j}(l)\big{]}=0$, which corresponds to
deterministic conditions by D-DCC. It can be seen that misbehaving nodes can
be detected in finite time in expectation. Meanwhile, the expectation of
undetected errors is the same as the mean detected errors, and for faulty
nodes, compensation period $k_{i}^{j0}-k_{i}^{j0}$ has the same expectation as
that of errors, i.e., $k_{i}^{1}-k_{i}^{0}$. Hence, misbehavior can be
compensated in expectation. The first part of variance $D_{m}$ is from
undetected errors and compensation of them for both malicious nodes and faulty
nodes. The other part $D_{f}$ is because of the difference between
compensation period $k_{i}^{j0}-k_{i}^{j0}$ and error period from $k_{i}^{1}$
to $k_{i}^{0}$ for faulty nodes.

For normal nodes, the larger attack probability $\theta_{i}$ of neighboring
misbehaving nodes and detection probability $p$ will decrease the expected
steps for detection. On the one hand, a larger attack probability will improve
the attack capability of malicious nodes. On the other hand, the detection
probability based on the reliable link will be close to one. Hence, the
performance of detection will be improved. Although the variance may be large,
it mostly depends on the undetected attack errors. As for the bias between
undetected errors and compensation, unpredictable attacks with large variance
may cause considerable bias to our algorithm, but it will be out of error
bound easily. Furthermore, it is not actually necessary for malicious nodes to
manipulate the information set with a constant probability and a certain
distribution. The detection method will be effective as long as the attack
probability is larger than zero, and the errors may follow a certain attack
method. Hence, to simplify the statement, we assume a constant attack
probability and present the attack errors by a time-invariant probabilistic
model.

Next, we analyze the accuracy of mean-based Compensation Scheme IV, i.e., the
distance between the mean-based compensation and actual errors. The actual
errors may consist of multiple uncertainties. Let $F_{Y_{i}(k)}(x)$ be the
cumulative distribution function (CDF) of $Y_{i}(k)$. We adopt Gaussian
mixture model (GMM) to represent the error variable $Y_{i}(k)$. On the one
hand, any distribution can be generally modeled by GMM with arbitrary
precision. On the other hand, GMM has good operation properties. GMM is
defined as a convex combination of Gaussian distribution with different
expectations $\mu_{l}$ and variances $\sigma_{l}$:

$F_{Y_{i}(k)}(x)=\sum_{l=1}^{N_{l}}a_{l}\Phi(\frac{x-\mu_{l}}{\sigma_{l}}),\sum_{l=1}^{N_{l}}a_{l}=1,\sum_{l=1}^{N_{l}}a_{l}\mu_{l}=\mu_{i},$
(26)

where $\Phi(\cdot)$ is the CDF of the standard normal distribution. Since
$\varepsilon_{i}(k)=X_{i}(k)Y_{i}(k)$, the CDF of $\varepsilon_{i}(k)$ is

$F_{\varepsilon_{i}(k)}(x)=\begin{cases}\theta_{i}F_{Y_{i}(k)}(x)&x<0\\\
1-\theta_{i}+\theta_{i}F_{Y_{i}(k)}(x)&x\geq 0.\end{cases}$ (27)

Without loss of generality, consider all the detection numbers
$m_{j}(k),j\in\mathcal{N}_{i}$ are the same. When detecting time is large
enough, according to the Central Limit Theorem [34], we have

$\overline{\varepsilon}_{i}\sim\mathcal{N}(\theta_{i}\mu_{i},\sigma_{\varepsilon_{i}}^{2}/M_{i}),$

where $\mathcal{N}(\cdot,\cdot)$ is the Gaussian distribution. The CDF of
$\overline{\varepsilon}_{i}$ is

$F_{\overline{\varepsilon}_{i}}(x)=\Phi(\frac{\sqrt{M_{i}}(x-\theta_{i}\mu_{i})}{\sigma_{\varepsilon_{i}}})$

The close proximity of error and compensation probability distributions will
not only guarantee the close final consensus value, but also guarantee the
stationarity of consensus process. The characteristic of proximity of two
probability distributions can be described by the Wasserstein distance[35].
The Wasserstein distance $R(\mathcal{P},\mathcal{Q})$ between the two
distributions $\mathcal{P}$ and $\mathcal{Q}$ is defined as follows:

$R(\mathcal{P},\mathcal{Q})=\inf\mathbb{E}\big{[}\rho(\xi,\eta)\big{]},$

where $\rho(\cdot,\cdot)$ is the function of the metric space and the
mathematical operation $\inf$ is taken over all possible pairs of random
variables $\xi$ and $\eta$ with distributions $\mathcal{P}$ and $\mathcal{Q}$,
respectively. In the case of one-dimensional space with the Euclidean metric,
the Wasserstein distance is calculated by

$R(\mathcal{P},\mathcal{Q})=\int_{-\infty}^{\infty}|F(x)-G(x)|\text{d}x,$

where $F(x)$ and $Q(x)$ are the CDF of $\mathcal{P}$ and $\mathcal{Q}$,
respectively[35]. Hence, we have the Wasserstein distance between
$\varepsilon_{i}(k)$ and $\overline{\varepsilon}_{i}$:

$R(\varepsilon_{i}(k),\overline{\varepsilon}_{i})=\int_{-\infty}^{\infty}|F_{\varepsilon_{i}(k)}(x)-F_{\overline{\varepsilon}_{i}}(x)|\text{d}x.$
(28)

We can use the Wasserstein distance to show the expectation of absolute error
between the mean-based compensation and actual errors. We provide the
following theorem to illustrate the bound of
$R(\varepsilon_{i}(k),\overline{\varepsilon}_{i})$ when $Y_{i}(k)$ obeys the
normal distribution.

Table 1: Comparisons of the proposed methods with other representative algorithms Method | Topology | Attack Model | Nodes | Information Needed  | Consensus Value
---|---|---|---|---|---
W-MSR[16] | Directed | Deception | Byzantine | Local Information | Convex Hull
SDA & MDA[22] | Undirected | Deception | Malicious | Two-hop Information | Convex Hull
Algorithm in [29] | Directed | Deception | Malicious | Two-hop Information |  -
Algorithm in [13] | Directed | Deception | Byzantine | Partial Global Information | -
D-DCC | Undirected | Deception | Malicious | Two-hop Information | Average Consensus
S-DCC | Undirected | Deception & Link Failure | Malicious | Two-hop Information |  Average in Expectation

######  Theorem 3.

When $Y_{i}(k)$ is modeled by GMM, we have

$R(\varepsilon_{i}(k),\overline{\varepsilon}_{i})\\!\\!\leq\\!\\!{(1\\!\\!-\\!\\!\theta_{i})\mathbb{E}[|Y_{i}|]\\!\\!+\\!\\!\\!\sum_{l=1}^{N_{l}}\\!a_{l}(|\theta_{i}\mu_{i}\\!-\\!\mu_{l}|\\!\\!+\\!\\!|\frac{\sigma_{\varepsilon_{i}}}{\sqrt{M_{i}}\\!-\\!\sigma_{l}}|)},$
(29)

where
$\mathbb{E}[|Y_{i}|]\\!\leq\\!\sum_{l=1}^{N_{l}}\\!\\{\sqrt{\frac{2}{\pi}}\sigma_{l}\exp{(\frac{-\mu_{l}^{2}}{2\sigma_{l}^{2}})}\\!+\\!\mu_{l}[1\\!-\\!2\Phi(\frac{-\mu_{l}}{\sigma_{l}})]\\}$.

###### Proof.

Referring to the absolute value inequality, we have

$\displaystyle
R(\varepsilon_{i}(k),\overline{\varepsilon}_{i})=\int_{-\infty}^{\infty}|F_{\varepsilon_{i}(k)}(x)-F_{\overline{\varepsilon}_{i}}(x)|\text{d}x$
$\displaystyle\leq\\!\\!\int_{-\infty}^{\infty}\\!\\!|F_{\varepsilon_{i}(k)}(x)-F_{Y_{i}}(x)|\text{d}x+\\!\\!\int_{-\infty}^{\infty}|F_{\overline{\varepsilon}_{i}}(x)-F_{Y_{i}}(x)|\text{d}x.$

According to (27), we have

$\displaystyle\\!\int_{-\infty}^{\infty}|F_{\varepsilon_{i}(k)}(x)-F_{Y_{i}}(x)|\text{d}x$
$\displaystyle\\!\\!\\!\\!=\\!\\!\int_{-\infty}^{0}|(1-\theta_{i})F_{Y_{i}}(x)|\text{d}x+\\!\\!\int_{0}^{\infty}|(1-\theta_{i})(1-F_{Y_{i}}(x))|\text{d}x$
$\displaystyle\\!\\!\\!\\!=(1-\theta_{i})\left[\int_{-\infty}^{0}F_{Y_{i}}(x)\text{d}x+\int_{0}^{\infty}(1-F_{Y_{i}}(x))\text{d}x\right]$
$\displaystyle\\!\\!\\!\\!=(1-\theta_{i})\mathbb{E}[|Y_{i}|].$

In addition, according to the Wasserstein distance between two normal
distributions [36], we have

$\displaystyle\int_{-\infty}^{\infty}|F_{\overline{\varepsilon}_{i}}(x)-F_{Y_{i}}(x)|\text{d}x$
$\displaystyle\leq\sum_{l=1}^{N_{l}}a_{l}\left[\int_{-\infty}^{\infty}|F_{\overline{\varepsilon}_{i}}(x)-\Phi(\frac{x-\mu_{l}}{\sigma_{l}})|\text{d}x\right]$
$\displaystyle\leq\sum_{l=1}^{N_{l}}a_{l}(|\theta_{i}\mu_{i}-\mu_{l}|+|\sigma_{\varepsilon_{i}}/\sqrt{M_{i}}-\sigma_{l}|)$

Combining the above, we complete the proof. ∎

######  Remark 4.

Theorem 3 shows the Wasserstein distance under GMM. Hence, the expectation of
absolute error between the mean-based compensation and actual errors is
bounded. Generally, the explicit bound is difficult to formulate under other
distributions, but the Wasserstein distance is bounded as long as
$\mathbb{E}[|Y_{i}|]$ and $\mathbb{E}[|\overline{\varepsilon}_{i}|]$ exist.
The quantitative evaluations can be found in Sec. 5.2.

######  Remark 5.

Here, we provide a comprehensive comparison of our D-DCC and S-DCC algorithms
with other resilient consensus algorithms, which are summarized in Table 1.

##  5 Numerical Evaluations

In this section, we conduct numerical evaluations to illustrate the
performance of D-DCC and S-DCC. Consider a Erdös-Rényi Random graph (where the
probability for edge creation is $0.7$) with $N=10$ nodes. The system updates
states by (2), where $W$ is designed by Perron weights. All nodes’ initial
states are selected from the interval $[0,2]$ randomly. In the network, there
are two misbehaving nodes that are not neighbors, i.e., malicious node $1$
that intends to break average consensus and faulty node $5$. We set
$\alpha_{i}=5$, $\rho_{i}=0.9$, $\forall i\in\mathcal{V}$.

###  5.1 Performance of D-DCC

At this part, we set the adverse impacts of nodes $1$ and $5$ to satisfy
$\varepsilon_{1}(k)=0.5\cos(k)$ and $\varepsilon_{5}(k)=0.5\times 0.6^{k}$,
respectively. Fig. 1 shows that all nodes except node $1$ achieves consensus.
The consensus value is the average value of initial states of remaining nodes
showing as the blue dotted line. As a contract, we plot the average state of
normal nodes by MSR algorithm [15] as the green line. The exact resilient
average consensus is achieved by D-DCC, but MSR algorithm does not guarantee
average consensus. Fig. 2 shows the errors of node $1$ and $5$. Node $5$ has
not been isolated because its error is exponentially decaying and in the local
bound. Node $1$ is isolated at time $24$ because the error is out of the
bound.

Figure 1: Performance of D-DCC: States of nodes. Figure 2: Performance of
D-DCC: Errors of misbehaving nodes ($1$ and $5$) and compensation input of
node $2$.

###  5.2 Performance of S-DCC

The error of malicious node $1$ is set to obey a GMM when attack is adopted,
i.e.,
$F_{Y_{1}(k)}(x)=0.5\Phi(\frac{x-0.05}{\sqrt{0.05}})+0.5\Phi(\frac{x-0.15}{\sqrt{0.2}})$.
The error of faulty node $5$ follows a normal distribution. We set the
connection probability $p=0.8$ and attack probability $\theta_{1}=0.8$.

Fig. 3 shows that all nodes except node $1$ achieve consensus, and node $1$ is
isolated by other nodes but node $5$ is not. Node $1$ causes errors
continuously, and it is isolated at time $36$ when the error is out of the
error bound. Node $5$ only makes misbehavior in first $10$ steps, and the
errors are within the fault-tolerance bound. Hence, node $5$ is not isolated,
and its errors are compensated by neighbors. The consensus value is close to
the average value of initial states of remaining nodes. Though the limit value
is the exact average consensus in expectation, in practice it may vary from
it. Compared with MSR algorithm [15], S-DCC achieves more accurate average
consensus. Fig. 4 shows the compensation results of node $2$ and the errors of
nodes $1$ and $5$.

According to the Wasserstein distance, we have
$R(\varepsilon_{1}(k),\overline{\varepsilon}_{1})=0.1245$, which is much
smaller than the bound presented in Theorem $3$. The CDF of
$\varepsilon_{1}(k)$ and $\overline{\varepsilon}_{1}$ are shown in Fig. 3. The
expectation of absolute error between the injected adverse impact and the
mean-based compensation at each time is within a small range. The two
distributions are similar, which shows the accuracy of mean-based
compensation.

In the same scenario, we repeat the test for 1000 times with the same initial
states of all nodes to validate the correctness. The average initial states of
nodes $\\{2,\ldots,10\\}$ is 1.1517. The results are shown in Table 2. It can
be observed that the average consensus value of S-DCC is closer to average
initial states than that of MSR algorithm. The variance of consensus value by
S-DCC is $0.0166$, which is much smaller than the bound. Because the upper
bound of variance is relaxed. With all above results, the effectiveness of our
proposed D-DCC and S-DCC is illustrated.

Figure 3: Performance of S-DCC: States of nodes. Figure 4: Performance of S-DCC: Errors of misbehaving nodes ($1$ and $5$) and compensation input of node $2$. Figure 5:  CDF of $\varepsilon_{1}(k)$ and $\overline{\varepsilon}_{1}$ Table 2: Comparisons of the proposed methods with MSR algorithm Methods | Mean Consensus Value (1000 times)
---|---
D-DCC | 1.1517
S-DCC | 1.1330
MSR algorithm | 1.0841

##  6 CONCLUSION

In this paper, we have investigated the resilient average consensus problem
against misbehaving nodes in multi-agent systems. We have first presented the
D-DCC algorithm to compensate the adverse impacts caused by misbehaving nodes
while considering reliable communication. The exponential decaying bound
provides fault tolerance for misbehaving nodes and guarantee the convergence.
We have proved that the resilient average consensus can be achieved by D-DCC.
Furthermore, we have proposed S-DCC algorithm with mean-based compensation to
adapt for scenarios where link failures may occur. It has been proved that the
resilient average consensus in expectation is achieved by S-DCC, and the
absolute error between mean-based compensation and actual adverse impact has
been analyzed by the Wasserstein distance. Finally, simulations have been
conducted to illustrate the effectiveness of the proposed algorithms.

There are still many issues worthy of further investigations. First, achieving
exact resilient consensus over time-varying and directed networks will be
considered in future. Second, the extension of resilient average consensus for
high-dimension systems with general linear dynamics is left for future work.
Third, applications of resilient average consensus including formation control
and flocking of multi-robot systems can be possible directions.

## References

  * [1] W. Zheng, Z. He, J. He, and C. Zhao.  Accurate resilient average consensus via detection and compensation.  accepted by Proc. 60th IEEE Conf. Decis. Control, 2021.
  * [2] Jaydev P Desai, James P Ostrowski, and Vijay Kumar.  Modeling and control of formations of nonholonomic mobile robots.  IEEE transactions on Robotics and Automation, 17(6):905–908, 2001\.
  * [3] S. Kar, J. M. F. Moura, and K. Ramanan.  Distributed parameter estimation in sensor networks: Nonlinear observation models and imperfect communication.  IEEE Trans. Inf. Theory, 58(6):3575–3605, 2012.
  * [4] W. Wang, J. Huang, C. Wen, and H. Fan.  Distributed adaptive control for consensus tracking with application to formation control of nonholonomic mobile robots.  Automatica, 50(4):1254–1263, 2014.
  * [5] J. Li, F. Liu, Z. Wang, S. H. Low, and S. Mei.  Optimal power flow in stand-alone dc microgrids.  IEEE Trans. Power Syst., 33(5):5496–5506, 2018.
  * [6] J. He, P. Cheng, L. Shi, and J. Chen.  Sats: Secure average-consensus-based time synchronization in wireless sensor networks.  IEEE Trans. Signal Process., 61(24):6387–6400, 2013.
  * [7] R. Olfati-Saber and R. M. Murray.  Consensus problems in networks of agents with switching topology and time-delays.  IEEE Trans. Autom. Control, 49(9):1520–1533, 2004.
  * [8] J. He, L. Cai, C. Zhao, P. Cheng, and X. Guan.  Privacy-preserving average consensus: Privacy analysis and algorithm design.  IEEE Trans. Signal Inf. Process. Netw., 5(1):127–138, 2019.
  * [9] C. N. Hadjicostis, N.H. Vaidya, and D. D. Alejandro.  Robust distributed average consensus via exchange of running sums.  IEEE Trans. Autom. Control, 61(6):1492–1507, 2015.
  * [10] A. Olshevsky and J. N. Tsitsiklis.  Convergence speed in distributed consensus and averaging.  SIAM J. Control Optim., 48(1):33–55, 2009.
  * [11] S. M. Dibaji, M. Pirani, D. B. Flamholz, A. M. Annaswamy, K. H. Johansson, and A. Chakrabortty.  A systems and control perspective of cps security.  Annu. Rev. Control, 47:394–411, 2019.
  * [12] H. J. LeBlanc, H. Zhang, X. Koutsoukos, and S. Sundaram.  Resilient asymptotic consensus in robust networks.  IEEE J. Sel. Areas Commun., 31(4):766–781, 2013.
  * [13] F. Pasqualetti, A. Bicchi, and F. Bullo.  Consensus computation in unreliable networks: A system theoretic approach.  IEEE Trans. Autom. Control, 57(1):90–104, 2012.
  * [14] RM Kieckhafer and MH Azadmanesh.  Low cost approximate agreement in partially connected networks.  Journal of Computing and Information, 3(1):53–85, 1993.
  * [15] R. M. Kieckhafer and M. H. Azadmanesh.  Reaching approximate agreement with mixed-mode faults.  IEEE Trans. Parallel Distrib. Syst., 5(1):53–63, 1994.
  * [16] H. Zhang and S. Sundaram.  Robustness of information diffusion algorithms to locally bounded adversaries.  In Proc. Amer. Control. Conf., pages 5855-5861, 2012.
  * [17] S. M. Dibaji, H. Ishii, and R. Tempo.  Resilient randomized quantized consensus.  IEEE Trans. Autom. Control, 63(8):2508–2522, 2018.
  * [18] Ali Haseltalab and Mehmet Akar.  Approximate byzantine consensus in faulty asynchronous networks.  In 2015 American Control Conference (ACC), pages 1591–1596. IEEE, 2015.
  * [19] K. Saulnier, D. Saldaña, A. Prorok, G. J. Pappas, and V. Kumar.  Resilient flocking for mobile robot teams.  IEEE Robot. Autom. Lett., 2(2):1039–1046, 2017.
  * [20] Luis Guerrero-Bonilla, Amanda Prorok, and Vijay Kumar.  Formations for resilient robot teams.  IEEE Robotics and Automation Letters, 2(2):841–848, 2017.
  * [21] J. Yan, X. Li, Y. Mo, and C. Wen.  Resilient multi-dimensional consensus in adversarial environment.  arXiv preprint arXiv:2001.00937, 2020.
  * [22] C. Zhao, J. He, and J. Chen.  Resilient consensus with mobile detectors against malicious attacks.  IEEE Trans. Signal Inf. Process. Netw., 4(1):60–69, 2018.
  * [23] I. Shames, A. M. H. Teixeira, H. Sandberg, and K. H. Johansson.  Distributed fault detection for interconnected second-order systems.  Automatica, 47(12):2757–2764, 2011.
  * [24] Shuai Sun and Yilin Mo.  Security protection in cooperative control of multi-agent systems.  arXiv preprint arXiv:2105.02618, 2021.
  * [25] R. Gentz, S. X. Wu, H. Wai, A. Scaglione, and A. Leshem.  Data injection attacks in randomized gossiping.  IEEE Trans. Signal Inf. Process. Netw., 2(4):523–538, 2016.
  * [26] Daniel Silvestre, Paulo Rosa, João P Hespanha, and Carlos Silvestre.  Stochastic and deterministic fault detection for randomized gossip algorithms.  Automatica, 78:46–60, 2017.
  * [27] M. Guo, D.V. Dimarogonas, and K.H. Johansson.  Distributed real-time fault detection and isolation for cooperative multi-agent systems.  In Proc. Amer. Control. Conf., pages 5270–5275, 2012.
  * [28] Guilherme Ramos, Daniel Silvestre, and Carlos Silvestre.  A general discrete-time method to achieve resilience in consensus algorithms.  In 2020 59th IEEE Conference on Decision and Control (CDC), pages 2702–2707, 2020.
  * [29] L. Yuan and H. Ishii.  Secure consensus with distributed detection via two-hop communication.  arXiv preprint arXiv:2101.05087, 2021.
  * [30] Christoforos N. Hadjicostis, Alejandro D. Domínguez-García, and Nitin H. Vaidya.  Resilient average consensus in the presence of heterogeneous packet dropping links.  In 2012 IEEE 51st IEEE Conference on Decision and Control (CDC), pages 106–111, 2012.
  * [31] L. Xiao, S. Boyd, and S. Lall.  A scheme for robust distributed sensor fusion based on average consensus.  In Proc. Int. Conf. Inf. Process. Sensor Netw., pages 63-70, 2005\.
  * [32] Stefano Marano, Vincenzo Matta, and Lang Tong.  Distributed detection in the presence of byzantine attacks.  IEEE Transactions on Signal Processing, 57(1):16–29, 2009.
  * [33] J. He, L. Cai, P. Cheng, J. Pan, and L. Shi.  Distributed privacy-preserving data aggregation against dishonest nodes in network systems.  IEEE Internet Things J., 6(2):1462–1470, 2019.
  * [34] Geoffrey R Grimmett and David R Stirzaker.  Probability and random processes.  Oxford Univ. Press, 2003.
  * [35] SS Vallender.  Calculation of the wasserstein distance between probability distributions on the line.  Theory Probab. Appl., 18(4):784–786, 1974.
  * [36] D. Chafai and F. Malrieu.  On fine properties of mixtures with respect to concentration of measure and sobolev type inequalities.  In Annales de l’IHP Probabilités et statistiques, pages 72-96, 2010.