Venue: ICLR 2023 Conference

Reviews:

final_score: rating: 3: reject, not good enough
review_content: summary_of_the_paper: The paper proposes a new method to defend against backdoor attacks. The proposed method is basically a new aggregation rule. Edge-case backdoor attacks are considered, and multiple simple baselines are evaluated. 
strength_and_weaknesses: Strengths

- FL is vulnerable to backdoor attacks

- A new aggregation rule is proposed. 

Weaknesses

- Many robust aggregation rules have been proposed. This paper's proposed aggregation is just some variant of existing one, e.g., trimmed-mean. Therefore, the paper's novelty is limited. 

- Seems like only edge-case backdoor attacks are evaluated. This represents a quite limited backdoor case. Other backdoor attacks should be evaluated. 

- Some simple baselines are evaluated. Strong and more recent defenses (appeared in AI, security, and system venues) should be evaluated. 

- Adaptive attacks are not considered. 
clarity,_quality,_novelty_and_reproducibility: See the above strength and weakness. 
summary_of_the_review: The paper has limited novelty, and experiments are also limited.
review_title: null

final_score: rating: 5: marginally below the acceptance threshold
review_content: summary_of_the_paper: This paper proposed a method to mitigate backdoor attacks in federated learning by focusing on invariant directions of gradients and avoiding selecting directions that favor malicious clients.
strength_and_weaknesses: Strength:
1. This paper proposed a simple yet effective approach to mitigate backdoor attacks in FL. compared with previous robust aggregation methods, the proposed method can defend against a much stronger attack, i.e., an edge-case attack.
2. This paper gives robustness analyses for both AND mask and trimmed mean.

Weakness:
1. Only one backdoor attack in FL (edge-case attack) is tested in the experiments, which cannot validate the proposed method is a general defense method for backdoor attacks in FL. What about other frequently adopted backdoor attacks in FL, such as [1], and the experimental setting adopted in [2].
2. According to the federated learning setup in the experiments, it adopts an iid client setting. In the case of non-iid clients, will the proposed method of masking inconsistent gradients still work?
3. Masking inconsistent gradients will also sacrifice a lot of benign accuracies. However, according to the experiment results, the benign accuracy is hardly affected, could you give a more clearer explanation for this? Besides, the benign accuracy is also very low for FedAvg, which is very strange since usually, the benign accuracy for cifar10 in FL is at least over 80%. 
[1] Bagdasaryan E, Veit A, Hua Y, et al. How to backdoor federated learning[C]//International Conference on Artificial Intelligence and Statistics. PMLR, 2020: 2938-2948.
[2] Panda A, Mahloujifar S, Bhagoji A N, et al. SparseFed: Mitigating Model Poisoning Attacks in Federated Learning with Sparsification[C]//International Conference on Artificial Intelligence and Statistics. PMLR, 2022: 7587-7624.
clarity,_quality,_novelty_and_reproducibility: This paper proposes a novel defense method for backdoor attacks in FL, however, the experimental verification of this method is not enough. Thus, we can not determine whether this is a general method or only suitable for some special cases.
summary_of_the_review: This paper is marginally below the acceptance threshold since although the authors proposed a simple yet effective approach to mitigate backdoor attacks in FL, we can not determine whether this is a general method or only suitable for some special cases.
review_title: null

final_score: rating: 3: reject, not good enough
review_content: summary_of_the_paper: This paper aims to defend backdoor attacks in federated learning. Particularly, it proposes to combine existing two techniques, AND-mask and trimmed-mean estimator, to remove suspicious gradient dimensions. This is based on the assumption that the gradients from benign clients have the same sign while those from malicious clients are different from benign ones. This paper also provides theoretical analysis on the gradient sign consistency and how the combination of the two existing techniques defends backdoor attacks. The evaluation is conducted on three datasets and one backdoor attack. Compared to a few baseline methods, the proposed approach has a better defense performance.
strength_and_weaknesses: ### Strength

+ Important problem of defending backdoor attacks in federated learning
+ Easy to follow in most places


### Weaknesses

- No empirical validation of the motivation
- Limited novelty
- No evaluation on more existing backdoor attacks
- No evaluation on adaptive attacks
- Missing state-of-the-art defense baselines
- Missing references and details of baseline techniques

### Detailed comments

Defending backdoor attacks in federated learning is a timely and important topic. This paper aims to address this problem by leveraging the combination of existing techniques. The paper is mostly easy to follows. There are a few aspects not well addressed in the paper.

* In Figure 1, the paper uses two illustrative examples to demonstrate the failure scenarios of the two existing methods respectively. However, there is no empirical result showing that such cases exist in real backdoor attacks. In addition, there could be other attack scenarios. For example, both benign and malicious values are on the same side of the sign. But the malicious value can be far from the benign ones. Other cases may also exist. It shall be empirically studied and validated regarding those cases.

* The novelty is limited. This paper simply combines the two existing techniques, without any modifications. The combination is completely based on the two illustrative examples given in Figure 1, which could be far from comprehensive. The theoretical analysis is conducted on a linear classifier, which is also based on the two assumed attack scenarios. The analysis on the gradient sign does not address the aforementioned case where the malicious gradient shares the same sign as benign ones.

* There are many other backdoor attacks in federated learning such as [1-2]. Particularly, there is an attack setting in [2] where the attacker is selected in each round and continuously participates in the training from beginning to the end, which is a much more aggressive attack. The proposed method shall be evaluated on those backdoor attacks.

* Since the proposed defense is based on the assumption of the malicious gradient sign deviate from benign ones, an adaptive attacker can match the malicious gradient sign with a benign one during the attack. Will the proposed defense still be effective?

* There are other state-of-the-art defense techniques [3-5]. They shall be compared with in the evaluation.

* There are no references and detailed descriptions of those baselines in Table 1.


### References

[1] Bagdasaryan, Eugene, et al. "How to backdoor federated learning." AISTATS 2020.

[2] Xie, Chulin, et al. "Dba: Distributed backdoor attacks against federated learning." ICLR 2019.

[3] Pillutla, Krishna, et al. "Robust aggregation for federated learning." IEEE Transactions on Signal Processing 2022.

[4] Fung, Clement, et al. "The limitations of federated learning in sybil settings." RAID 2020.

[5] Cao, Xiaoyu, et al. "FLTrust: Byzantine-robust Federated Learning via Trust Bootstrapping." NDSS 2021.
clarity,_quality,_novelty_and_reproducibility: ### Clarity

The paper is mostly clear and easy to follow. It misses the details of baseline methods in the evaluation.


### Quality and Novelty

The novelty is limited and the motivation needs further validation. The paper fails to evaluate more and stronger backdoor attacks and compare with state-of-the-art defense techniques.


### Reproducibility

The submission does not include the implementation and the details of baselines are missing. 

summary_of_the_review: This paper addresses an import problem but lacks novelty and comprehensive empirical results.
review_title: null

final_score: rating: 5: marginally below the acceptance threshold
review_content: summary_of_the_paper: The paper studies defenses against federated learning backdoor attacks. The paper proposes to force the model optimization trajectory to focus on the invariant directions that are generally useful for utility and avoid selecting directions that favor malicious clients. Particularly, the authors consider the consistency of the client model update as an estimation of the invariance, where the AND-mask and Trimmed mean are used together to measure the sign consistency. The proposed robust aggregator is evaluated on several datasets to defend against backdoor attacks, and show a promising utility-robustness tradeoff.  

strength_and_weaknesses: Strengths
+ The studied problem is important
+ Detailed analysis on why AND-mask and Trimmed mean together to enhance robustness

Weaknesses
-Some details are unclear
-Theoretical results are narrow 
-Lack of comparison with state-of-the-art defenses
clarity,_quality,_novelty_and_reproducibility: The paper is easy to follow in general. The paper novelty is moderate--It shows new theoretical results but are narrow. The experimental setup is clear, and I think the results can be reproducible.
summary_of_the_review: Detailed comments:

I do not quite understand Figure 1(a): When using the AND-mask, does the result show negative signs, which returns the accurate sign of the benign dimensions?

What does expectation ratio indicate in Theorem 4? What is the rough error bound in Equation (5)? Is it too large? Similarly, what is the rough probability in Theorem 5? 

Theorem 4 & 5 only relate to a single feature dimension? Can the result be generalized to the feature vector? What is the error bound? 

Theorem 8 is for the simple linear model. I am not sure whether the theoretical results can be applicable to general nonlinear model. 

I am also curious about the attack scenario that can break both the AND-mask and trimmed-mean. 

Can the proposed solution be generalized to defend against model poisoning attacks? 


Which features are filtered by AND-mask and which filtered by the Trimmed mean? I would like to see whether they are complementary or have a large overlap.  

Why no attacks in Table 1 has non-zero backdoor accuracy?
review_title: null

Meta-review: metareview:_summary,_strengths_and_weaknesses: This work proposes a defense against federated learning backdoor attacks. The key idea is to force the model optimization trajectory to focus on the gradient directions that are invariant to gradient directions that favor malicious clients. Particularly, the authors consider the consistency of the client model update as an estimation of the invariance, where the AND-mask and Trimmed mean are used together to measure the sign consistency. 

All reviewers felt that the novelty is limited, that in the proposed method the difference between mean and trimmed-mean is not clear. There are questions about the baseline implementations. 

The authors should include more baselines (answer the questions about the performance of existing baselines) and explain clearly what is novel about their method, what is non-trivial about their proposed solution.


```
The rebuttal did not address the main concerns. Discussion with one of the reviewers during the rebuttal period:

Dear AC,

The rebuttal does not address my concerns.

According to the new results in Appendix D.5, the gradient signs are not that different between benign and malicious updates (<= 0.02 for Twitter and Phishing datasets). Also, the difference between Mean and Trimmed-mean is not obvious. The paper says "trimmed-means’ advantages vanish in inconsistent dimensions". However, according to Table 5, on FEMNIST and Phishing, Trimmed-mean still has slightly lower number of different gradient signs. The results do not seem to validate the motivation in Figure 1. It is unclear why the method works.

For baselines FoolsGold and RFA, according to my knowledge, they can also reduce the ASR to less than 10% in the single-shot attack. The results reported in the paper are higher than expected. Another baseline FLTrust, which is not compared in the paper (mentioned in the rebuttal), has similar or better performance than the above baselines.

The adaptive attack evaluated in the paper is not strong. It only tries to zero the gradient dimensions instead of proactively matching the gradient signs between malicious and benign updates. It is still unclear how robust the proposed method is against strong adaptive attacks.

The argument in the rebuttal against the novelty is not convincing. The proposed method is also a straightforward combination of two existing techniques as shown in Algorithm 1. The explanation on why the proposed method works is unclear as the empirical results do not seem to validate the paper's motivation.```
justification_for_why_not_higher_score: The paper has weak baselines (some of the included baselines seem to perform poorly compared to standard benchmarks) and the novelty of the method is not clear to reviewers.
Decision: Reject