Checking the Output Does Not Check the Aggregator: A Bit-Exact Counterexample in Federated Learning

An audit protocol is trustworthy only under the assumptions that connect what it measures to what it is taken to show. We examine one such protocol: re-performance, the most direct after-the-fact check a recorded federated learning round admits, in which an independent implementation of the declared aggregation rule is run on the recorded client submissions and its output compared against the recorded aggregate. Agreement is naturally read as evidence that the declared rule executed. We show that reading is licensed only under an input assumption that is never stated. Measuring the gap between the declared rule's output and plain averaging over 8,000 random honest configurations and four declared rules (Krum, Multi-Krum, coordinate-wise median, trimmed mean), we find the smallest gap observed is twelve orders of magnitude above the re-implementation noise floor of 6.7 x 10^-16: the check is sound against accidental drift, with an enormous margin. In 31 converging training runs on real data (11,000 rounds, 16 clients, four declared rules, i.i.d. and Dirichlet partitions) the margin is unchanged at eleven point nine orders, and heterogeneous clients widen it rather than narrowing it. On a constructed symmetric configuration, however, all four rules coincide with plain averaging to within one unit in the last place, and for five clients bit-exactly — so no tolerance, including zero, separates a round in which the declared defence ran from one in which it did not. The evidence bundles for the two rounds are byte-identical at three of four evidence levels. The protocol's validity is thus a property of the input distribution rather than of the rules, and it fails exactly against an operator who can choose which round is audited. We further find that Flower 1.33.0 deletes a round's client submissions at the moment the server collects the replies, on a code path guarded by no configuration: the inputs re-performance requires are gone before any audit can begin.