為了在此保證的最緊繃處進行壓力測試，我們同時提出 Adaptive Normalized Attack（ANA），即該類別中的極值實例，在此攻擊中每個惡意智能體各自獨立地將自身的偵測邊界飽和，因而消除了先前共用步長攻擊所具有的短板瓶頸。在以 QMIX 建構的合作型 Predator-Prey 基準測試中，CoBRA 在惡意比例為 25 百分比時保留約 87 百分比的無攻擊 return，在 50 百分比時保留約 86 百分比，在 25 百分比時分別勝過 BlockDFL 20.1 個百分比、勝過 Biscotti 18.1 個百分比，並且在取自投毒攻擊文獻的八個額外攻擊組成的一系列測試中，維持接近無攻擊基準的表現，其中包含兩個分析事先預測它不需要攔截的攻擊。值得注意的是，一旦惡意比例達到 25 百分比，兩個區塊鏈 baseline 都會低於無防禦系統，因為它們固定的門檻會丟棄誠實的探索行為。;Multi-agent reinforcement learning (MARL) is increasingly deployed across Internet of Things (IoT) systems， and escaping the scalability and privacy limits of centralized training has pushed the field toward decentralized pipelines in which agents exchange model updates rather than raw data. Removing the central node also removes the only point at which an update could be audited， which exposes the aggregation step to model poisoning. MARL makes this exposure uniquely hard to close， because non-stationary exploration produces honest updates with inherently high variance， and classical Byzantine-robust rules calibrated to static federated learning misclassify that variance as malicious. We propose CoBRA， a consensus-embedded， MARL-aware defense that screens updates by direction and density rather than magnitude， and that embeds this screening as a precondition for Practical Byzantine Fault Tolerance (PBFT) block commitment with Verifiable Random Function (VRF) committee re-verification and a stake self-purification loop. Rather than targeting one attack， CoBRA is analyzed over the class of magnitude-admissible collusive adversaries， a class defined by what any attacker must do to evade a distance screen and still bias the aggregate rather than by any construction of ours. We show that within this class the attainable bias is monotone in a single quantity， the coherence of the malicious perturbations， and that CoBRA screens on exactly this quantity， so an adversary either coordinates and is detected or decoheres and is diluted. To stress the guarantee at its tight end we also introduce the Adaptive Normalized Attack (ANA)， the extremal member of the class， in which each malicious agent independently saturates its own detection boundary and thereby removes the weakest-link bottleneck of prior shared-step attacks. On a cooperative Predator-Prey benchmark with QMIX， CoBRA retains about 87 percent of the attack-free return at a 25 percent malicious ratio and about 86 percent at 50 percent， outperforming BlockDFL by 20.1 percent and Biscotti by 18.1 percent at 25 percent， and it retains near-baseline performance across a battery of eight further attacks drawn from the poisoning literature， including two that the analysis predicts in advance it will not need to intercept. Notably， both blockchain baselines fall below an undefended system once the malicious ratio reaches 25 percent， because their fixed thresholds discard honest exploration.
