{'fraction_non_alphanumeric': 0.04371131518265302, 'fraction_numerical': 0.014219830899308224, 'mean_word_length': 4.417972602739726, 'pattern_counts': {'":': 0, '<': 6, '<?xml version=': 0, '>': 6, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 12, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
Design and Analysis of Robust Resilient Diffusion over Multi-Task Networks Against Byzantine Attacks

This paper studies distributed diffusion adaptation over clustered multi-task networks in the presence of impulsive interferences and Byzantine attacks. We develop a robust resilient diffusion least mean Geman-McClure-estimation (RDLMG) algorithm based on the cost function used by the Geman-McClure estimator, which can reduce the sensitivity to large outliers and make the algorithm robust under impulsive interferences. Moreover, the mean sub-sequence reduced method, in which each node discards the extreme value information of cost contributions received from its neighbors, can make the network resilient against Byzantine attacks. In this regard, the proposed RDLMG algorithm ensures that all normal nodes converge to their ideal states with cooperation among nodes. A statistical analysis of the RDLMG algorithm is also carried out in terms of mean and mean-square performances. Numerical results evaluate the proposed RDLMG algorithm in applications to multi-target localization and multi-task spectrum sensing.


I. INTRODUCTION
D ISTRIBUTED diffusion techniques involving networks of agents have been broadly investigated in the last decade, where the interactive networks among nodes with cooperative relations are generally modeled by non-negative graphs [1]. Distributed cooperation could enable adaptation and learning strategies through local information exchange among interactive nodes. Considering that the nodes cooperate with their neighboring nodes to process streaming data, the diffusion strategies commonly perform an adaptation step where a node adaptively learns from its own information, and a combination step where the node aggregates the information collected from its neighbors. Other nodes in the network perform similar steps as well, which is known as the adaptthen-combine (ATC) mechanism [2]. Diffusion strategies with the ATC mechanism have proved to be quite effective in solving distributed optimization problems in a large number of applications, such as target localization and tracking [3], [4], collaborative spectral estimation [5], [6], intrusion detection and clustering [7], [8], and multi-robot systems [9], [10]. Two fundamental problems for distributed diffusion are formulated as single-task and multi-task problems. The single-task one means that all nodes achieve a common objective, whereas in multi-task scenarios the nodes are divided into groups and the nodes within the identical group reach the same objective [11]. Applications of multi-task strategies, where the objectives of different nodes or grouped nodes will be distinct, have been related to multi-target localization and tracking [12], [13], cooperative spectrum sensing [14], [15], node-specific speech enhancement [16], [17], and web page categorization and ranking [18].
The conventional diffusion least mean-square (DLMS) algorithm has been applied to multi-task scenarios in which the nodes cooperate with each other to estimate distinct parameter vectors using stochastic gradient descent (SGD) techniques [12], [19], [20], [21], [22], [23], [24], [25], [26], [27], [28], [29], [30], [32], [31], [33], [34]. Later on, theoretical analysis of DLMS over multi-task networks has been carried out, where the mean behavior and the networked mean-square deviation (MSD) were discussed [18]. Following this research strand, several variants of the DLMS algorithm were proposed over multi-task networks. If the network suffers from some uncertainties such as the topology change and link failure, then the nodes may not execute synchronously, and asynchronous events could hamper the information exchange among clusters. The work in [13] introduced an improved DLMS strategy over asynchronous multi-task networks and discussed the convergence conditions. A class of DLMS algorithms was proposed to solve the multi-task estimation problem in [35], whose tasks for neighboring nodes were related by linear equality constraints. As discussed in [36], it has been proved that the networked MSD performance for all nodes relies on the inter-cluster cooperation over multi-task networks. Utilizing a control variable to maintain inter-cluster cooperation among neighboring clusters, an affine projection-based multi-task diffusion strategy was further proposed to obtain improved convergence performance [17].
Generally, the network environments are assumed to be secure, which means that there is no malicious cyber attacks over networks, and information exchange among nodes are ideal. In practical environments, however, large-scale networked systems have many potential vulnerable points subject to malicious attacks, which are prone to topology changes or link failures [37], [38]. A typical class of malicious cyber attacks, known as the Byzantine attacks, which can be completely aware of the networked systems, could ruin the network via eavesdropping the information and transmitting fictitious messages [39]. Moreover, the nodes suffering from Byzantine attacks can leverage arbitrarily malicious rules and send distinct information to different neighbors at the same time. In terms of attack capabilities, Byzantine attacks involve many types of malicious behaviors and commonly represent the "worstcase" adversarial situation [40], [41], [42]. Byzantine-resilient decentralized optimization methods have been developed in [43] and [44], in which every regular agent uses its local data samples and applies coordinate gradient descent to update its local model at every iteration. The work in [45] introduced a total variation norm-penalized approximation to handle Byzantine attacks and proposed a stochastic gradient approach to solve the Byzantine-resilient decentralized optimization over static and time-varying networks. Therefore, it is fundamental to design secure distributed algorithms to enable to resist malicious attacks and to allow normal nodes still to achieve their ideal objectives. We refer to such secure distributed algorithms as being resilient to malicious attacks and such network for resilience to adversaries [46].
To cope with malicious cyber attacks, several secure distributed strategies have been developed in recent years, mainly towards improving the distributed SGD solver of the underlying optimization tasks over networks. A secure DLMS algorithm was proposed in [38], in which this distributed algorithm was regarded as a mixed strategy consisting of the non-cooperative LMS (NC-LMS) and the DLMS hybrid mechanisms. Along this line of research, a correction-based secure DLMS algorithm was proposed in [47], where a correction step was appended between the adaptation and combination. The aforesaid algorithms considered false data injection (FDI) attacks that satisfied linear combinations of the regression vector and the attack vector, and a DLMS algorithm based on the Kullback-Leibler divergence was further developed to detect adversaries [48]. Besides, the work in [49] proposed a secure distributed algorithm relying on attack detection to deal with the multi-task estimation problem against FDI attacks. Considering Byzantine attacks, a secure distributed estimation was established in [41] through attack detection raising a flag to indicate the estimate beyond a threshold, where the node then combined estimates of neighboring nodes with local information. In order to make the network resilient against Byzantine attacks, a family of mean sub-sequence reduced (MSR) algorithms has been investigated, where each node removes some extreme values received from its neighboring nodes and updates its state to be the mean of the remaining values [39], [50]. The majority of the distributed optimization problems under adversarial nodes consider consensus-based optimization protocols, in which the node gathers the states of its neighbors and removes some extreme values that are larger or smaller than its own state value [51]. The work in [52] exploited the trusted nodes which can not be compromised by adversarial attacks and formed a connected dominating set in the original network to constrain effects of adversarial nodes. With the help of a candidate-removal mechanism, a distributed optimization problem was addressed to generate reliable states in the presence of malicious nodes [53]. There are numerous developments of distributed estimation problems in the presence of Byzantine nodes, where the node removes some extreme values received from its neighbors and the resilience is achieved. Resilience of consensus-based distributed estimation has been studied in [54], [55] by leveraging local observation and network connectivity. A distributed estimator with resilience to adversaries was further investigated in [56], where each node iteratively updated a local estimate after removing abnormal observations as a weighted sum of its previous estimate. Recently, an intriguing work in [46] developed a resilient diffusion least mean-square (RDLMS) algorithm motivated by a MSR approach over multi-task networks in the presence of Byzantine attacks, and also presented the tradeoff between the resilience of the distributed strategy and its performance of the networked MSD in qualitative analysis.
The majority of the aforementioned secure distributed algorithms focus on Gaussian interferences. However, in realistic circumstances, there are many non-Gaussian interferences which can be expressed by the impulsive feature, whose probability density functions have heavier tail than that of Gaussian interferences [57], [58], [59]. Although the above distributed algorithms using the mean-square error (MSE) criterion have good performance under Gaussian measurement noises, they often have significant performance degradation under impulsive interferences, especially due to the inter-node cooperation [60], [61]. To execute well in the presence of impulsive interferences, several robust algorithms have been designed to reduce the sensitivity to large outliers. Typically, the lower-order statistics of the error were used to suppress impulsive measurement noises, where the criteria involving the mean absolute error [62], the mean p-power error [63], etc. Some M-estimate approaches were developed based on cost functions such as the Huber functions to counteract the negative influences of impulsive interferences [57]. However, such robust cost functions can not commonly be smooth everywhere. Hence, other smooth robust estimators were further developed by utilizing the saturation property of error nonlinearities like the maximum correntropy criterion [60], [64], and the Geman-McClure (GM) estimator [65]. Nevertheless, it should be remarked that in scenarios with impulsive interferences distributed diffusion over multi-task networks against malicious cyber attacks, despite its paramount importance, is still open to the best of our knowledge and motivates this work.
In this paper, we develop and analyze a robust resilient diffusion algorithm over clustered multi-task networks in the presence of impulsive interferences and Byzantine attacks. The main contributions are: 1) We propose a novel resilient diffusion least mean Geman-McClure-estimation (RDLMG) algorithm based on the GM estimator and the MSR method over multitask networks, which ensures robustness under impulsive interferences and resilience against Byzantine attacks. 2) The theoretical performance analyses of the proposed RDLMG algorithm are rigorously derived and analyzed for multi-task estimation in the mean and mean-square senses. In particular, a closed-form expression of the steady-state networked MSD for all normal nodes over the multi-task network can be accurately predicted. 3) Simulation studies of the proposed RDLMG algorithm applied to multi-target localization and multi-task spectrum sensing demonstrate its superiority over existing techniques. The rest of this paper is organized as follows. A network model and some preliminaries of distributed diffusion are introduced in Section II. The problem formulation and the proposed RDLMG algorithm for multi-task estimation are presented in Section III. Theoretical analyses of the RDLMG algorithm in the mean and mean-square senses are discussed in Section IV and V, respectively. In Section VI, we apply the RDLMG algorithm to multi-target localization and multi-task spectrum sensing. Finally, Section VII concludes this paper.
Notations: Notations in this paper are rather standard. At time instant, the normal font letters with parentheses represent scalars. The lowercase boldface letters with parentheses represent column vectors. The uppercase boldface letters with parentheses represent matrices. Other symbols and notations will be explained in the corresponding text.

A. Network Model
An interactive network with multiple nodes (also known as a multi-agent system) can be described by a non-negative graph G = {V, E}, with the finite indices set of nodes V = {1, 2, . . . , P } and the edges set E ⊆ V × V. An edge (j, i) is graphically drawn via an arrow with head node i and tail node j, which means that node i receives the information from node j. Throughout this paper, we consider that the graph has the bidirectional information flow and the arrow is naturally omitted over graphs. The node j is a neighbor of node i if (j, i) ∈ E, and the indices set of neighbors of node i is defined by N i = {j | (j, i) ∈ E}, including node i itself.
At every time instant n, each node i acquires the desired output signal d i (n) and the input signal u i (n) and the M -dimensional tapped-delay regression vector defined as u i (n) = [u i (n), u i (n− 1), . . . , u i (n− M + 1)] T ∈ R M , which is mathematically described via a linear form where w o i ∈ R M represents the ideal state vector, and η i (n) is an additive noise.
The objective of each node i in the network is to utilize the streaming data {d i (n), u i (n)} to compute an estimate of the state vector w o i . In the case of clustered multi-task scenarios, each node i needs to determine its own state vector w o i . All nodes are classified into clusters, where the nodes within the identical cluster perform the same state vector, and different clustered nodes are interested in estimating different state vectors [12], [8].
B. Distributed Adaptive Algorithms 1) DLMS Algorithm: Consider the distributed optimization problem of the following MSE criterion as the cost function where E{·} represents the expectation operation. When each node i performs its own individual LMS algorithm, the adaptive solution of NC-LMS can be given by is the error signal, and the constant µ i > 0 denotes the step size. It means that each node i iteratively updates its estimate without cooperation. Now consider that the nodes cooperate with their neighbors to process streaming data of local information through the diffusion network, to execute the multi-task estimation. A costeffective diffusion strategy is DLMS with the ATC mechanism [18], which solves the MSE minimization problem to get the cooperative adaptive solution where the intermediate estimate ψ i (n) ∈ R M is shared among neighboring nodes, and the coefficient a j,i (n) denotes the weight in which node i measures the data receiving from node j. It represents the reliable measure of edge (j, i) connecting two neighboring nodes, and the assigned weights satisfy the following conditions The connections among nodes over the graph G are captured by the adjacency matrix A(n) = [a i,j (n)] ∈ R P ×P , and its transpose matrix is A T (n) = [a j,i (n)], where each entry a j,i (n) > 0 represents the weight associated with edge if (j, i) ∈ E, otherwise a j,i (n) = 0. Then, the rows of matrix A T (n) adds up to one, i.e., A T (n)1 P = 1 P , where 1 P with size P × 1 represents all its entries equal to one. At every time n, the traditional DLMS with the ATC mechanism performs two steps. The first step is that node i learns from the current estimate w i (n) to the intermediate estimate ψ i (n + 1). The second step is an aggregation where node i combines all intermediate estimates of its neighbors to yield its successive estimate w i (n + 1).
2) DLMG Algorithm: As we all know, the conventional DLMS algorithm acquires the adaptive solution by relying on the MSE cost, but it may degenerate or even diverge under impulsive noise environments [57], [66]. To obtain robustness for the multi-task diffusion strategy under impulsive interferences, we consider a GM estimator belonging to a class of robust M-estimators as where λ is a positive parameter. The GM estimator is a smooth non-convex loss function, which handles outliers well and may be more applicable than convex M-estimators [65], [67]. The following scale function can be calculated as Let J i (w i ) denote the cost function inspired by the GM estimator at node i, namely, Based on the diffusion strategy that every node fuses its own information and the received information from its neighbors, we thus consider the minimization problem to solve the distributed optimization as follows [12], [18]: Taking advantage of the SGD technique to deduce the distributed adaptive algorithm, the ATC mechanism can be iteratively updated as This distributed diffusion strategy is called diffusion least mean GM-estimation (DLMG) algorithm with cooperation among nodes. When each node i performs its own learning strategy, the non-cooperative least mean GM-estimation (NC-LMG) algorithm is given by The curves of Υ i (e i (n)) and f i (e i (n)) with different λ are shown in Fig. 1. Whenever the impulsive interferences occur, e i (n) of each node i becomes quite large, and thus the scale function f i (e i (n)) reduces to zero, which will handle large outliers well. However, the scale function of MSE are equal to one which can not reduce the sensitivity to large outliers. Besides, it shows that the larger λ can result in increased robustness. It also shows that the smaller λ can cause the larger magnitude of f i (e i (n)) indicating the faster convergence around the small e i (n), but it will increase the system error. So the appropriate λ should be selected for ensuring robustness and good performance.
Several fixed combination weights for a single-task are adopted from the degree of each node according to the network topology, such as the Laplacian and Metropolis rules [1], [2], [7]. However, these fixed weights may not be applicable in multi-task scenarios, where any node performing a distinct state will hamper its neighbors estimating themselves other states of interest. Hence, a class of adaptive weights rules has been introduced for multi-task estimation [46], [68] as where with 0 < ν i < 1 being the forgetting factor, and · 2 denotes the l 2 -norm (or Euclidean norm) of its vector argument.

Remark 1:
We can also consider other adaptive combination rules as the variations of (14) in such multi-task scenario. One strategy for adjusting the combination weights in [18] is to use the local one-step approximation for w o i . Moreover, the adaptive combination rule developed in [69] contains the smoothing step based on the one-step approximation.
By allowing nodes to adjust their combination weights, this enables nodes to adaptively assign the weights depending on the cooperative contributions from their neighbors. So we do not assume the availability of any prior information beforehand whether the relationships exist among the states of neighboring nodes. During the multi-task estimation, the nodes sensing distinct objective states than their own will gradually assign smaller weights through information exchange. It becomes possible for the nodes to discard their connections during a certain time to neighbors that do not contribute to the same objective. Moreover, the nodes sensing an identical cooperative objective will cluster together to form connected sub-networks [8], [18].

III. PROBLEM FORMULATION AND ROBUST RESILIENT DIFFUSION ALGORITHM
In this section, we formulate the problem and present the proposed robust resilient diffusion algorithm.

A. Byzantine Attack Model
According to the Byzantine attack characteristics, we consider some malicious nodes over multi-task networks to be adversarial, called Byzantine nodes, and others are normal nodes [46]. Generally speaking, the Byzantine node represents the "worst-case" malicious behavior, which has complete knowledge of the whole system, including the network topology, streaming data and diffusion algorithm employed by normal nodes. In addition, malicious nodes are assumed to be Byzantine nodes in the sense that they can update their states in arbitrary ways, send misinformation to their neighbors, and transmit distinct information to different neighbors [39], [40].
Attack Objective: The objective of the Byzantine node in the network is to drive its neighboring normal nodes to reach the malicious states. In detail, we consider the finite indices set of Byzantine nodes V a ⊂ V, and assume that a Byzantine node k ∈ V a wants to drive the state of its neighboring normal node i ∈ N k to reach the malicious state w a i , i.e., lim Then, the following proposition provides the sufficient condition to reach the attack objective of a Byzantine node k which drives its targeted normal node i by leveraging the local information exchange. Proposition 1: If a sufficiently small value µ a i > 0 has been selected such that ∀j ∈ N i \k, holds, then the Byzantine node k leverages the gradient-based transmitting message as the intermediate estimate of the targeted node i, to finally reach the following attack objective: 1) The influence of ψ j (n+1), ∀j ∈ N i \k will be neglected in the presence of the Byzantine node, i.e., a j,i (n + 1) → 0, ∀j ∈ N i \k, and a k,i (n + 1) → 1.
2) The state of the targeted normal node will converge to the malicious state for a large enough and finite time. Proof: By (17) and the transmitting message ψ k (n + 1) as the intermediate estimate of the targeted node i, a sufficiently small value of µ a i > 0 can ensure the following condition and suppose the attack starts at time n + 1, and then the recursive equation at time n+n c according to (14) is calculated as follows: and For large enough n c , it will have (1 − ν i ) n c → 0. In fact, (1 − ν i ) n c ≤ ǫ c with a certain small value ǫ c will converge, and the time required to ensure the convergence is computed as and a j,i (n + 1) ≪ a k,i (n + 1). From j∈Ni\k a j,i (n + 1) + a k,i (n + 1) = 1, we can obtain a j,i (n + 1) → 0, ∀j ∈ N i \k, and a k,i (n + 1) → 1. It means that the influence of ψ j (n + 1), ∀j ∈ N i \k will be neglected in the presence of the Byzantine node during a finite time.
In addition, for some time n subject to (1 − ν i ) n → 0, the state of the targeted node i will be attacked as The recursive vector equation at time n + n a is calculated as For large enough n a , it will have (1 − µ a i ) n a → 0. Similarly, the time required to ensure the convergence can be computed as n a ≥ log (1−µ a i ) ǫ a with a small value ǫ a . Furthermore, using the sum of geometric series from (25) results in E{w i (n + 1)} → w a i during a finite time. Remark 2: In practice, as long as a sufficiently small value µ a i has been taken, the condition (16) can be guaranteed. The attacker can select a small fixed value µ a i and observe if the attack succeeds; if not, decrease it to find an appropriate value. Then, the attack objective will be reached during a large enough and finite time.

B. Proposed Robust Resilient Diffusion Algorithm
It is a fact that if multiple Byzantine nodes transmit the misinformation (17) to the identical targeted node, then the weights will be assigned to sum up to one, and it is not necessary for multiple Byzantine nodes to attack a single normal node. Moreover, the Byzantine node can only drive its direct neighbors and can not impact the nodes beyond its direct neighbors [46]. Hence, we make the following assumption.
Assumption 1: Under the gradient-based Byzantine attack model, we assume that there could be at most one Byzantine node among the neighbors of a normal node.
Resilient Objective: We propose a resilient diffusion algorithm for multi-task estimation against Byzantine attacks such that for all normal nodes, i.e., all normal nodes achieve their ideal states, where the cooperation and information exchange should be utilized among nodes over clustered multi-task networks. The MSR method, in which each node discards the values received from its neighbors and deviated from its own value, can make the network resilient by updating its state to be the weighted average of the remaining values [39]. Inspired by the MSR method, for each node i ∈ V\V a , the combination step of the diffusion strategy aggregates the intermediate estimates of its neighbors by discarding one extreme value of local information to obtain an accurate estimate. This extreme value will then be removed from each node.
From the Byzantine node's perspective, the attack objective is to maximize the local cost J i (w i (n)) of the targeted normal node, whereas the diffusion strategy aims to obtain the minimization cost. Since w i (n) = j∈Ni a j,i (n)ψ j (n) and j∈Ni a j,i (n) = 1, the local cost J i (w i (n)), ∀i ∈ V\V a can be calculated as where During the iterations, each node performs the diffusion strategy to minimize its cost J i (w i (n)) requiring the local information exchange among its neighboring nodes. According to (27), the contribution of the neighboring node j to the node i's cost J i (w i (n)) can be defined as By removing the largest cost contribution c j,i (n) received from the node i's neighbors, the removal set R i (n) can be taken as At time n + 1, the node i adjusts its combination weights a j,i (n + 1) and updates the state w i (n + 1) through its neighboring information exchange, but without using information form the node in R i (n + 1). Then, the ATC mechanism can be rewritten as a j,i (n + 1)ψ j (n + 1).
Without any prior information, the node does not know beforehand whether there is a Byzantine node in its neighborhood. Note that the message from normal neighboring node may be discarded by the removal set R i (n+1). The removed messages do not affect the convergence of diffusion algorithm although some links among normal neighbors may be cut [7], [11]. The proposed resilient DLMG (RDLMG) algorithm is summarized in Table I. As noted above, the proposed RDLMG algorithm possesses the robustness under impulsive interferences and the resilience against Byzantine attacks, which ensures that all normal nodes achieve their ideal states. In the following, we will present the theoretical performance analyses of RDLMG in the mean and mean-square senses.

11:
a j,i (n + 1) = , j ∈ N i \R i (n + 1) 0, otherwise 12: w i (n + 1) = j∈N i \R i (n+1) a j,i (n + 1)ψ j (n + 1) 13: end for 14: end for Remark 3: In fact, if the multi-task network is an F -local network [39], then the RDLMG algorithm is also resilient to any number F of Byzantine adversaries. From the perspective of resilience, we can assume that there can be at most F Byzantine nodes among the neighbors of a normal node. In resilient multi-task diffusion, the F extreme values will then be removed from each node, and the selection of F does not affect the convergence, but it influences the steady-state performance.
In Table II, we summarize the computational complexity of the DLMS, DLMG, RDLMS and RDLMG algorithms for node i per time instant n, where n i denotes the cardinality of N i . It can be seen that the resilient algorithms with the MSR mechanism have a significant increase of complexity as compared to DLMS and DLMG. In comparison with RDLMS, the proposed RDLMG algorithm slightly increases complexity caused by using the GM estimator, however it can be justified by the improvement of performance.

IV. STABILITY ANALYSIS
In this section, we present a statistical analysis of the proposed RDLMG algorithm in terms of mean performance, which establishes conditions for its stability. To proceed with the mathematical analysis, the following assumptions are commonly made.
Assumption 2: η i (n) is a zero-mean i.i.d. noise of variance σ 2 ηi . It is customary to assume that η i (n) is modeled as a contaminated Gaussian (CG) noise for analyzing impulsive interferences [60], [70], whose model is described as where v i (n) and g i (n) are both zero-mean Gaussian sequences with variances σ 2 vi and σ 2 gi , respectively, and σ 2 gi ≫ σ 2 vi . b i (n) is a Bernoulli sequence whose value is either zero or one with probabilities Pr{b i (n) = 1} = p i and Pr{b i (n) = 0} = 1−p i . Accordingly, we note that the additive noise η i (n) is modeled as a CG noise with zero-mean and variance σ 2 ηi = σ 2 vi +p i σ 2 gi , where p i represents the occurrence probability of impulsive interferences.
Assumption 3: The regression vectors u i (n) arise from a zero-mean random process that is temporally stationary, white, and independent over space with E{u i (n)u T i (n)} > 0. This is the well-known independence assumption [1], [18].

Assumption 4:
The scale function f i (e i (n)) is statistically independent of other random variables. This error nonlinearity can be regarded as a variable step size term to feasibly enable tractable analysis [64], [71].
Assumption 5: The adjacency matrix A(n) is statistically independent of u i (n) and w i (n). It is customary in the context of general adaptive combiners [13], [72], which allows to simplify the analysis.
Subtracting both sides of (30) from w o i yields a j,i (n + 1)ψ j (n + 1) are the estimation error and the intermediate estimation error, respectively. Substituting (1) into (4), we can get e i (n) = u T i (n)w i (n) + η i (n). Then, (32) can be rewritten as where I M is an identity matrix of size M × M , and U i (n) = u i (n)u T i (n) ∈ R M×M and h i (n) = u i (n)η i (n) ∈ R M . In fact, due to the presence of Byzantine nodes, the number of all normal nodes is |V\V a | over the graph G, where | · | denotes the cardinality of its set argument. We use the number N to denote |V\V a | for convenience. Some global quantities across all normal nodes can be put in the collective forms w(n) = col{w 1 (n),w 2 (n), . . . ,w N (n)} ψ(n) = col{ψ 1 (n),ψ 2 (n), . . . ,ψ N (n)} h(n) = col{h 1 (n), h 2 (n), . . . , h N (n)} where each column vector col{·} with N × 1 block vectors is of size N M × 1, and each diagonal matrix diag{·} with N × N block diagonal matrices is of size N M × N M , and ⊗ is the Kronecker product, respectively. Besides, A(n) ∈ R N ×N is also the adjacency matrix across all normal nodes and A T (n)1 N = 1 N still holds. We can describe the collective relations for (32) and (33) in the following forms Then, the networked estimation error for all normal nodes can be obtained as Then, we can further obtain E{w(n + 1)} = Γ n E{w(n)} where we denote From (40), we have the following result of mean stability for the RDLMG algorithm.
Theorem 1: The RDLMG algorithm converges in the mean for any initial condition, if the step size µ i is chosen to satisfy where λ max (·) denotes the maximum eigenvalue of its matrix argument.
Proof: Repeatedly iterating (40) leads to Let the block maximum norm of a N × 1 block column vector x = col{x 1 , x 2 , . . . , x N } ∈ R N M with block entries of size M × 1 each [72], define as Accordingly, let the block maximum norm of a N × N block matrix X ∈ R N M×N M with block entries of size M × M each, define as Obviously, A T (n) b,∞ = 1 holds. Calculating the block maximum norm on both sides of (43) yields It implies that E{w(n+1)} b,∞ will converge if Γ n b,∞ < 1. We thus consider where ||| · ||| 2 denotes the induced l 2 -norm (or spectral norm) of its matrix argument. A sufficient condition for Γ n b,∞ < 1 is to ensure |1 − µ i E{f i (e i (n))}λ max (E{U i (n)})| < 1. This leads us to the condition in (42). Furthermore, if the l 1 -norm of the estimate w i (n) is bounded by β i , then it holds that [73] where · 1 denotes the l 1 -norm (or sum norm) of its vector argument. This leads to the sufficient condition as Also, when n → ∞, it holds that E{w(n + 1)} b,∞ → 0, i.e., E{w(n + 1)} 2 → 0 for n → ∞,which further implies lim n→∞ E{w i (n+1)} = w o i . As a consequence, the proposed distributed strategy can ensure mean stability if the step size µ i is selected to satisfy the above condition. This completes the proof.

V. MEAN-SQUARE PERFORMANCE ANALYSIS
We present the mean-square performance analysis of the RDLMG algorithm in this section. Let the covariance matrix of the networked estimation errorw(n) for all normal nodes be denoted as with N × N block diagonal matrix, whose individual block is (37) where we denote The matrix property vec(XYZ) = (Z T ⊗X)vec(Y) remains for ∀X, Y, Z with compatible dimensions [1], where the vectorization operation vec(·) represents a column vector obtained by stacking the columns of its matrix argument. Taking the vectorization operation on both sides of (51), we can get vec(W n+1 ) We can then arrange Then, it can be established that As a performance metric in the mean-square sense, the MSD at the normal node i ∈ V\V a is defined as where Tr(·) represents the trace of a matrix. Consider that the clustered multi-task network is resilient, but it may be decomposed into κ connected sub-networks by executing the RDLMG algorithm. Each set of normal nodes of final subnetworks is denoted as S ℓ , ℓ ∈ {1, 2, . . . , κ} with satisfying κ ℓ=1 S ℓ = V\V a . The MSD for each sub-network S ℓ is Accordingly, the networked MSD for all normal nodes over the clustered multi-task network is defined as Taking into account the steady-state performance for n → ∞, we can deduce from (55) as In the following, we will calculate the values of A ∞ and F ∞ . Considering the steady-state for n → ∞, we have e i (n) = u T i (n)w i (n) + η i (n) ≈ η i (n). According to (30), we can get Subtracting w o i from both sides of (61), and taking expectation for the energies on both sides of the relation, as well as Assumption 2, it yields Since the small fluctuation of |e i (n)| [63] and the small enough Jensen gap [74] at steady-state, we can make the approximation Therefore, we can rewrite (62) for n → ∞ as At steady-state for n → ∞, each node and its normal neighbors performing the same objective belong to the same sub-network, and thus w o i = w o j , j ∈ N i . Taking expectation on both sides of (14) yields By repeatedly iterating, we get We can further obtain Then, A(∞) = [a i,j (∞)] can be obtained directly.
As previously mentioned, we can make the approximation As a consequence, the values of A ∞ and F ∞ can be computed as and Then, the theoretical value of vec(W ∞ ) represented as (59) can be provided by (69) and (70).
Using the matrix property Tr(XY) = vec(Y T ) T vec(X) [1], the steady-state networked MSD for all normal nodes over the clustered multi-task network can be calculated as where the values of A ∞ and F ∞ are given by (69) and (70).

VI. NUMERICAL RESULTS
In this section, illustrative examples with applications of multi-target localization and multi-task spectrum sensing are performed to verify the proposed RDLMG algorithm. We also evaluate the LMS-based, NC-LMG, DLMG, and RDLMG algorithms, and compare their performances in the presence of impulsive interferences and Byzantine attacks.

A. Multi-Target Localization
We consider that the nodes are interested in locating multiple targets represented by the two-dimensional state vector in the Cartesian plane. The location of each node i is denoted by p i = [x i , y i ] T , and the distance between the node i and its target w o i is described by where 2 represents the unit direction vector from node i to its target [12], [46]. In practice, the node has noisy observations of the distance and the direction vector towards the target, and thus the noisy measurements {r i (n), u i (n)} at time n can be represented by where η i (n) is the additive observation noise. Define the adjusted signal as d i (n) = r i (n) + u T i (n)p i . The linear model for the available measurement data {d i (n), u i (n)} is provided to estimate the location of the target w o i as follows: Consider a connected network with 64 nodes for the clustered multi-task scenario as shown in Fig. 2, which comprises of 62 normal nodes divided into two groups with blue and green nodes, and contains two Byzantine nodes with red nodes. Each normal node can be modeled as (1) for target localization, and w i (n) = [w i,1 (n), w i,2 (n)] T is the estimate of w o i . We set the multi-target localization of the two static targets as The two-dimensional regression vector at node i is given by u i (n), with u i (n) being extracted from the zero-mean Gaussian signal with variance σ 2 ui . The additive noise η i (n) belongs to the zero-mean CG impulsive interference under Assumption 2, where v i (n) and g i (n) are both zero-mean Gaussian sequences with variances σ 2 vi and σ 2 gi = 10 4 σ 2 vi , and with the occurrence probability of impulsive interferences being set as p i = 0.01. Fig. 3 illustrates the values of σ 2 ui and σ 2 vi for all normal nodes. The Byzantine nodes aim to drive their neighboring normal nodes to estimate the location of the malicious target as w a i =  [0.4, 0.5] T , and the parameter is selected as µ a i = 0.01 across the malicious nodes.
As previously mentioned, the DLMG algorithm with cooperation is not resilient and can be influenced by the Byzantine nodes. The step size µ i = 0.02 and the forgetting factor ν i = 0.01 of the DLMG algorithm have been taken uniformly across the normal nodes. The network topology at the end of the simulation with 5000 iterations performing the DLMG algorithm is shown in Fig. 4. We observe that all light coral nodes, which previously belong to the normal nodes, are only connected with the Byzantine nodes illustrating the influence of malicious attacks. In addition, only the nodes sensing the identical target cluster together, which shows that blue nodes are connected with blue ones, and so do green nodes. Fig. 5 shows the localization estimates for the X-coordinate w i,1 (n) and the Y -coordinate w i,2 (n) across all nodes during iterations. Fig. 6 shows the evolutions of distance between the attacked nodes and the malicious target w a i . It shows that all neighbors of Byzantine nodes reach the malicious target during a finite time, whereas all the other normal nodes achieve their desired targets, and naturally cluster two groups.
Since there is at most one Byzantine node among the neighbors of a normal node, in which each node discards the extreme value information of cost contributions received from its neighbors, it should be sufficient to guarantee all normal nodes to converge to their desired targets with resilience. After executing the RDLMG algorithm, Fig. 7 indicates that this is indeed the case with cutting all edges between normal nodes and Byzantine nodes, which shows that all normal nodes are divided into two connected sub-networks and Byzantine nodes are isolated. Fig. 8 shows the localization estimates for the    X-coordinate and the Y -coordinate across all normal nodes during iterations, which illustrates all normal nodes, whether they are neighbors of Byzantine nodes or not, will converge to their desired targets. We compare the performance of the proposed RDLMG algorithm with that of the LMS-based diffusion algorithms, NC-LMG and DLMG algorithms, where the networked MSD for all normal nodes is utilized as the performance metric. For a fair comparison, the parameters of various algorithms are set to guarantee the same initial evolutions. All results are obtained by averaging over independent runs. The networked MSD evolutions of diffusion algorithms in the presence of CG noises and Byzantine attacks are illustrated in Fig. 9. It is worth noting that all LMS-based diffusion algorithms have experienced severe divergence under impulsive noises, even in the RDLMS algorithm. That is mainly because the MSE cost can not reduce the sensitivity to large outliers and LMS-based diffusion algorithms are not robust. Obviously, the DLMG strategy is also severely divergent and difficult to apply to cyber attacks environments. We note that if each node performs its own individual LMG algorithm, i.e., the NC-LMG algorithm, then the nodes do not cooperate with each other at all and Byzantine nodes can not influence the estimate of any nodes. So the multi- task network without cooperation is "resilient" in this sense. However, the networked MSD level of NC-LMG is quite high and its performance has seriously degraded. Thanks to the cooperation among nodes, RDLMG will possess much better performance than the NC-LMG algorithm. From Fig. 9, we can see that the proposed RDLMG algorithm guarantees all normal nodes to converge to the desired targets in the presence of CG noises and Byzantine attacks, and also has lower MSD level as compared to the non-cooperative strategy. As stated in Remark 3, we can see from Fig. 10 that the selection of F does not affect the convergence, but it influences the steady-state performance. As the increase of F , the steadystate networked MSD level also increases. In the "worst-case", normal nodes discard all the information from their neighbors, whose algorithm becomes NC-LMG and incurs the severe performance deterioration. Fig. 11 investigates the analytical results of the RDLMG algorithm with different step sizes µ i and scalar parameters λ, where the dashed lines indicate the theoretical steady-state networked MSD. The theoretical steady-state MSD for all normal nodes over the multi-task network is calculated as (71). The simulated results of RDLMG are obtained by averaging over 100 independent runs. It is clear that the theoretical and simulated steady-state MSD match very well. We can also find that if µ i is smaller, the convergence will be slower but it reduces the steady-state MSD level. A smaller λ will lead to faster convergence and increased steady-state error. Fig. 12 illustrates the networked MSD evolutions of RDLMG in the case of Gaussian noise with a signal-to-noise ratio (SNR) of 20dB. It shows that the RDLMG algorithm performs well and there is a good match between the theoretical and simulated steady-state MSD in the Gaussian interference scenario. Fig. 13 illustrates the network MSD of RDLMG with the adaptive combination rule used by (14) and its variations mentioned in [18] and [69]. It appears that all these combination rules are useful and they have the comparable performances. That is because each node discards the extreme value information of cost contributions received from its neighboring nodes via the removal set R i (n + 1). Therefore, the influence of different adaptive combination rules would be slight in such multi-task scenario. Combination rule by (14) Combination rule in [18] Combination rule in [53]  Consider a connected network with scattered 64 nodes as shown in Fig. 14, with the same simulation configuration as previously mentioned. The network topology at the end of the iterations by executing DLMG is shown in Fig. 15. We observe that the nodes previously belonging to the normal nodes are only connected with the Byzantine nodes illustrating the influence of malicious attacks. After executing RDLMG, Fig. 16 shows that all links between normal nodes and the Byzantine nodes are removed, and Byzantine nodes are isolated. The normal node without neighbors will perform its own learning strategy. The resilience as we expected for the RDLMG algorithm has also been verified even though the nodes are scattered.  17  19  21  22   23   25  26  27  28  29  30  32   39   42  43  46  48   49  51  52  53  54  55  56   59  62  63   1  2  4  5  6   8   9  10  11  14  16   18  20  24   31   33  34  35  36  37  38  40   41  44  45  47   50   57  58  60  61  64   26  31   18  19  23  24   25  27  30  32   33  34  35  38  39

B. Multi-Task Spectrum Sensing
We have also evaluated the proposed RDLMG algorithm in multi-task spectrum sensing, which aims to estimate the spectrum of the transmitted signal in a connected network. Let Φ(e jf ) denote the power spectral density (PSD) of the transmitted signal at each frequency f as Φ(e jf ) =  [5], [6]. Let H i (e jf , n) be the channel transfer function between the transfer node and the receiver node i at time n, and then the PSD received by node i can be formulated as . , M f . Therefore, the noisy desired signal at frequency f ι is given by where η i,ι (n) denotes the additive measurement noise at frequency f ι . Using an energy estimator over an idle band, the receiver noise power σ 2 ri can be accurately estimated, and thus subtracted form (78) before spectrum sensing [6]. Collecting the noisy desired signal over M f frequencies, a linear model for spectrum sensing at every node i can be obtained by Consider a connected network with 36 nodes for the clustered multi-task scenario as illustrated in Fig. 17, which comprises of 35 normal nodes divided into two groups with blue and green nodes, and contains one Byzantine node in red. Each normal node can be modeled as (79) for spectrum sensing, in which we utilize M = 50 non-overlapping rectangular basis functions with amplitude equal to one to well approximate the transmitted spectrum. The nodes scan M f = 100 frequencies over the normalized frequency axis. We assume that w o i has 8 non-zero elements, which means that the corresponding spectrum is transmitted over 8 basis functions, and the power transmitted over each basis function is set to 0.7. The multitask spectrum sensing aims to estimate w o i for each node, where the 8 non-zero elements of spectrum coefficients w o i for blue and green nodes only locate in different positions.
The additive noise η i,ι (n) is assumed to be a combination of the background noise v i,ι (n) and the impulsive noise ω i,ι (n), i.e., η i,ι (n) = v i,ι (n)+ω i,ι (n). The background noise v i,ι (n) is extracted from a zero-mean Gaussian sequence with a variance depending on the interference level as σ 2 vi,ι = σ 2 ri [σ 2 ri + 2Φ i (e jfι )]/10 at frequency f ι , where the receiver noise power is set to σ 2 ri = 0.1. We consider that the α-stable distribution is used to model the impulsive feature, whose characteristic function is expressed as φ(t) = e −γ α |t| α , where the characteristic parameter is 0 < α ≤ 2 with the smaller α leading to more outliers, and the dispersion parameter is γ > 0 [75]. The impulsive noise ω i,ι (n) is drawn from an α-stable process with α = 1.2 and γ = 0.08.
The Byzantine node aims to drive its neighboring normal nodes to estimate the malicious spectrum coefficient as w a i = 0.51 M , which means that all malicious powers are set to 0.5, and the attack parameter is selected as µ a i = 0.01. The step size µ i = 0.2 and the forgetting factor ν i = 0.001 of the DLMG algorithm have been taken uniformly across the normal nodes. The network topology at the end of the iterations by executing the DLMG algorithm is shown in Fig.  18. Fig. 19 shows the evolutions of distance between the attacked nodes and the malicious spectrum coefficient w a i . We can clearly see that all neighbors influenced by the Byzantine node will converge to the malicious target. After executing the RDLMG algorithm, Fig. 20 shows that all normal nodes cluster two sub-networks and all links between normal nodes and the Byzantine node are removed, which demonstrates the resilience as we expected.
To assess the performance of diffusion algorithms, the networked MSD for all normal nodes in the presence of αstable noises and Byzantine attack are reported in Fig. 21. All results are obtained by averaging over independent runs. It is observed that the RDLMS and DLMG algorithms have severe performance divergence in this situation. It is obvious that the proposed RDLMG algorithm with cooperation guarantees convergence to the true spectrum and also results in lower MSD level in comparison with NC-LMG. We evaluate the results of multi-task spectrum estimation in the impulsive noises and cyber attacks environments, carried out by the convergent RDLMG and NC-LMG algorithms. The muli-task spectrum estimation of distributed algorithms in accordance with PSD is exhibited in Fig. 22. As we can notice, the RDLMG algorithm is able to make the accurate spectrum estimation and has lower side lobes in terms of PSD. It is also proved that the proposed RDLMG algorithm enables to fit much better the transmitted spectrum due to the inter-node cooperation than that of the NC-LMG algorithm.

VII. CONCLUSION
In this paper, we have proposed a novel robust resilient algorithm over clustered multi-task networks in the presence of impulsive interferences and Byzantine attacks. The proposed RDLMG algorithm relies on the GM estimator and the MSR strategies, which are able to counteract the adverse effects of impulsive noises and Byzantine nodes. Theoretical performance analyses of the RDLMG algorithm in the mean and mean-square senses were developed. Numerical results validate the performance of RDLMG and the theoretical results. We have also evaluated the proposed RDLMG algorithm by applying it to the problems of multi-target localization and multi-task spectrum sensing, which all demonstrate its superior performance to some existing distributed algorithms.