> does not magically become Byzantine tolerance because you said the words. Sure, but that is a bit too strong. Byzantine tolerance in these systems is usually not a single magic layer anyway, it is a bundle of assumptions about how much bad mass you can absorb, and a credibility score can still help if it is only one input to filtering, quoruming, or query routing. If the paper is claiming the GNN alone makes poisoned retrievers safe, then I agree it is hand-wavy, but if it is closer to a soft detector, the criticism lands less hard. Compared with Krum, it looks weaker on the theory side and better on the “heterogeneous clients are not identically broken” side. Krum gives you a crisp worst-case aggregation rule, but it is for model vectors and its geometry gets awkward once you move to retrieval and graph-shaped evidence, while a learned credibility layer can adapt to those messier signals. The catch is exactly what you pointed at, once the attacker can shape the feature space or feedback graph, the learned score becomes another surface to poison, so the security claim needs to be much narrower than the title suggests.