Venue: ICLR 2022 Conference

Reviews:

final_score: rating: 6: marginally above the acceptance threshold
review_content: summary_of_the_paper: The paper focuses on Byzantine defense through malicious node detection in a Federated Learning setting. Namely, by ranking the gradients and then computing the mean/SD, the paper shows that the malicious and benign clients will cluster separately. Assuming that the number of malicious clients is fewer than the number of benign clients, and the clusters correctly separate the malicious from benign, the smaller cluster is removed, and training is done on the gradients in the larger cluster. Appropriate experiments are done to show the ability of the model in malicious node detection along with analysis of performance and computational requirements.
main_review: (+) The main strength of the paper lie in the novel introduction of using the rank domain in order to detect malicious nodes. All of the claims are properly supported and experiments and results are clear. 

(-) The weaknesses in the paper are in the number of datasets/attacks. Having more experiments on a larger range of datasets and attacks will support claims more. Additionally, the inclusion of a strong, recent Byzantine defense algorithm in the robust learning area, such as FLTrust, will also help show the performance against state-of-the-art robust learning defense algorithms. 

summary_of_the_review: This paper introduces a new perspective in Byzantine defense in comparison to typical robust learning defense or other detection defenses. While the algorithm and experiments done are relatively simple, the paper serves more as a starting point for research and application in the new domain. Claims are properly supported and the method's competitive performance compared to other methods is promising.
review_title: null

final_score: rating: 8: accept, good paper
review_content: summary_of_the_paper: The paper presents a novel technique for defending against Byzantine types of attacks on federated learning systems.  The paper presents both theoretical justifications for why the using moments of ranks of gradient updates works as well as empirical justification showing that it works in practice.
main_review: __Strong points__: The paper’s strengths are its novelty (both technical and theoretical), the nature of the problem it is attacking and its clarity.
- The paper presents a novel technique and way to address the Byzantine attack problem in federated learning (which is a significant problem) by identifying malicious nodes. The actual technique of using the moments of gradient ranks is especially intriguing because of its simple elegance and great theoretical guarantees. The paper does a great job showing how using the first and second moment of ranks can distinguish certain nodes under attack from a theoretical standpoint. The paper also does an excellent job going beyond theoretical guarantees, which hold with large numbers of samples, to show that the proposed MANDERA technique also works in practice and as good as other state-of-the-art methods
    - As more of a question, really, than a comment, but the assumption that the gradient ranks, $R_{:,j}$ , are statistically independent probably deserves some more questioning. I can appreciate that the paper shows that this is empirically so, with a few, limited examples, at the bottom of section 2.3, but is this always so at least for neural network models? And, if so, why?
- The paper is well written with only a few typos in it (.i.e “week” instead of “weak” in the last paragraph of section 2.3). The figures are clear and it is very easy for a reader to understand both why the technique works and how it works. 
    - One area where the clarity could be improved is to provide a brief 1-2 sentence explanation of the label flipping attack in the first paragraph of section 3. All of the other techniques receive a much more robust explanation in the previous section with the theoretical grantees, so it would be good for the reader to better understand why that technique was used and what it is (at a high level).

__Weak points__: The paper is, overall, a strong paper with very few weak points. Mostly, the paper leaves one wondering about future work that could build on what is established within the paper, most of which the paper does comment on. 
- For example, what about using more moments or combining rank statistics with other statistics of the gradient updates for more robust malicious node identification.
- What about the use of a better clustering technique? Looking at figure 3 and then looking at the recall problems with SF, it seems like a better clustering technique could probably solve this problem.
- As with other points, the paper does explicitly mention this in its ethics statement, but how would one design an attack to counter this defense?

summary_of_the_review: I recommend accepting this paper, as it provides a novel technique with sound theoretical and convincing empirical justifications for attacking an important problem in the application of federated learning.
review_title: null

final_score: rating: 3: reject, not good enough
review_content: summary_of_the_paper: The paper proposes to transfer the update matrix to a ranking matrix before clustering to detect malicious nodes in federated learning.
main_review: The paper proposes to use ranking instead of numeric values to cluster the user's update in federated learning to find malicious nodes. The authors list several attacks and provide analysis of the different behaviors between benign nodes and malicious nodes.

The work is rather complete. The results, AFAIK, are correct and the experiments are solid. The writing is clear and easy to follow. I really enjoy the illustrations in the paper especially Fig 3 and 4.

On the other hand, I have several concerns about the methodology itself. Most importantly, the paper does give any formal robustness guarantee. The method is designed based on several known attacks. Because security should not be preserved via obscurity, if this method is applied in real-world applications, the attackers can construct targeted attacks against this approach. For example, in high-dimensional case, the attackers can insert contaminated records close to the benign ones but still deviate the model from converging. To achieve real robustness, theoretically strong robustness [1] should be proved so as to prevent most available attacks (even not known). Second, the method is also not compatible with secure aggregation which prevents cumulative protection.

Overall, I do not think the paper is ready for publication until formal robustness guarantee is added.

[1] Wang, Lun, Qi Pang, Shuai Wang, and Dawn Song. "F2ED-Learning: Good Fences Make Good Neighbors."
summary_of_the_review: I do not recommend acceptance because formal robustness guarantee is missing.
review_title: null

Meta-review: This manuscript proposes a ranking approach to identify Byzantine agents in federated learning. Distinct from existing methods, the mitigation is implemented by computing ranks for each gradient, then computing rank statistics across agents. The primary intuition is that adversarial agents can be identified by examining these rank statistics.

There are three reviewers, all of whom agree that the method addresses an interesting and timely issue -- giving the growing interest in both Byzantine-robust learning and federated learning in the community. However, reviewers are mixed on the paper score -- with a strong accept a weak accept, and a strong reject. Common issues raised include the generality of the approach beyond the outlined attacks, 
Other issues brought up, but addressed in the rebuttal include some weaknesses in the evaluation and comparison to additional baselines. There is also an interesting discussion of using higher-order statistics, which does not seem to help the methods when evaluated by the authors. Nevertheless, after reviews and discussion, the reviewers are mixed at the end of the discussion.

The area chair finds, first, that the paper is much improved, and much more applicable in the updated form than in the original version. However, the area chair agrees with the reviewer who notes that the moniker "Byzantine-robust" implies the methods should be provably robust to worst-case adversaries, not only to a selected set of adversaries with pre-selected attacks. The specified setting may be too narrow for interest by the community. To this end,  the area chair suspects that the method may be robust to a more general set of attacks than noted -- working to outline sufficient conditions for robustness would significantly strengthen this work. The asymptotic nature of the robustness guarantees is also of concern.

An additional concern of the area chair is that the system setting investigated assumes gradient communication and IID data across devices. While this is not an issue on its own, the setting is closer to distributed learning than federated learning, where one generally communicates model updates, or model differences after multiple local updates, and not gradients. This difference can have a significant effect on robustness methods that depend on identifying benign vs. adversarial statistics of parameters. Non-IID data is also common in the federated setting, though this is less concerning, as robust methods for non-IID settings are only now emerging. A simple fix for this issue would be to rename the setting from "Federated" to "Distributed."

Authors are encouraged to address the highlighted technical concerns in any future submission of this work. The primary concern may simply be a naming issue (i.e., removing "Byzantine" might fix this concern. Nevertheless, taken together, the opinion of the area chair is that the manuscript is not ready for publication. Again, the area chair believes that many of the issues noted can be fixed, the paper can be strengthened, and this paper may be publishable with limited additional work.
Decision: Reject