Venue: ICLR 2022 Conference

Reviews:

final_score: rating: 8: accept, good paper
review_content: summary_of_the_paper: This paper tackles an important problem in federated adversarial training: robustness accuracy significantly drops at the later stage of training. The authors first raise their assumption for the cause of this phenomenon: Adversarial training amplifies the heterogeneity of data distributions across different clients, and overfitted local robustness can not well generalized to other clients. Based on this assumption, the authors proposed \alpha-weighted federated adversarial training, which essentially up-weights the model trained on benign distributions and down-weights those on harsh distributions when averaging them up at the cloud center. Results show the proposed method outperforms previous state-of-the-arts under different adversarial training and federated learning settings. 
main_review: Pros:

1. This paper is the first to solve the robustness-drop problem in federated adversarial training. It has great practical impacts to real-world applications. 

2. The authors provided an intuitive assumption on the cause of robustness-drop problem, which is further verified by the experiments. 

3. The proposed \alpha-weighted federated adversarial training method is technically solid, easy to implement, and empirically achieves good performance under multiple different adversarial training and federated learning settings. 

4. Ablation studies show the proposed model is robust to hyper-parameter choices. 

Suggestions:

I don't see any obvious cons of this paper. One piece of suggestion is that, if your assumption on the cause of the robustness-drop phenomenon is correct, maybe combining "benign adversarial examples" [1] with \alpha-WFAT can even further improve performance. The intuition is that "benign adversarial examples" may not amplify the distribution heterogeneously so much as the traditional harsh adversarial samples. 

[1] Attacks Which Do Not Kill Training Make Adversarial Learning Stronger. 

summary_of_the_review: A solid paper providing the first solution for an important problem in federated adversarial training.
review_title: null

final_score: rating: 5: marginally below the acceptance threshold
review_content: summary_of_the_paper: This work studied the limitation of conventional Federated Adversarial Training approach, and proposed an \alpha-weighted relaxation for Adversarial Training in the federated learning setting. Then it proposed a novel \alpha-Weighted Federated Adversarial Training for minimizing a lower bound of the inner-maximization in Federated Adversarial Training. The performance of the proposed \alpha-Weighted Federated Adversarial Training were validated for both IID and Non-IID federated learning settings.
main_review: Strengths:
(1) It relaxed the inner-maximization of Federated Adversarial Training by emphasizing the clients which could produce the larger margin for the decision boundary.
(2) It proposed a novel \alpha-Weighted Federated Adversarial Training approach, and provided its convergence in FL setting.
(3) The experiments showed that the proposed approach outperformed baseline FAT.

Weaknesses:
(1) The motivation of the relaxation on Federated Adversarial Training is counterintuitive. When \alpha-WFAT minimizes the lower bound of the FAT loss, it achieves much better performance than the original FAT. It implies the loss of FAT might include some reductant terms in the context of federated learning. In addition, it needs more discussion regarding the rationality of FAT in the non-IID FL, as federated learning is originally designed for IID centralized setting.
(2) The \alpha-weighted mechanism of Eq. (3) is not well motivated. Following the motivation in section 4.1, it simply emphasizes the client with the smaller loss. This is more directly correlated with the discrimination of the adversarial examples, instead of the margin that measures the uncertainty of predicting the adversarial examples.
(3) The experiment indicated that the hyper-parameter \alpha could significantly affect the model performance. But the selection or estimation of \alpha in the proposed FL method is not clear.
(4) The non-IID results are sensitive to the selection of data in each client. Thus it is better to report the results (mean and standard deviation) after running the experiments for multiple times.
(5) Some related works of adversarially robust federated learning are not discussed. For examples, some of them pointed out that local clients have limited computational resources to afford the local adversarial training. In this case, how would \alpha-WFAT determine the weight when some of them could only upload the standard training parameters?
[ref 1] Shah, Devansh, Parijat Dube, Supriyo Chakraborty, and Ashish Verma. "Adversarial training in communication constrained federated learning." arXiv preprint arXiv:2103.01319 (2021).
[ref 2] Reisizadeh, Amirhossein, Farzan Farnia, Ramtin Pedarsani, and Ali Jadbabaie. "Robust Federated Learning: The Case of 
Affine Distribution Shifts." In NeurIPS. 2020.

Some other concerns:
(1) The \Tilde(x) in Theorem 4.2 is not defined. In this theorem, what would the index “t” and “k” start from?

summary_of_the_review: The proposed techniques are not well motivated. The rationality of the proposed method on non-IID FL setting needs more explanation.
review_title: null

final_score: rating: 5: marginally below the acceptance threshold
review_content: summary_of_the_paper: This paper introduces the alpha Weighted Federated Adversarial Training algorithm. The key of the idea is that in the aggregate step, the center prefers the local machine that yields smaller lost. Some theoretical results are delivered with numerical experiments. The paper claims that the alpha-weighted mechanism is tailored for the inner-maximization of Federated Adversarial Training, which is the rationale of the whole work.
main_review: Despite reasonable performance improvement, I am not convinced by many of the claims made by this paper:
It claims the biased adversarial generation in the local machine causes the issue in FAT. But the adversarial x tilde is purely determined by the current estimation of theta, and during the training, no local machine knows the optimal theta. So technically, adversarial samples are always biased, even for centralized adversarial training. 

In the discussion of figure 2, I don't understand why hard-to-train local machines may "over-optimize" their model. Does the "over-optimize" mean "overfit" the local data? If so, then the whole argument applies to federated standard training as well, and the alpha-weighted mechanism shall improve federated standard training. But the authors clearly say that the alpha-weighted mechanism doesn't work for federated standard training.

On the other hand, does hard-to-train local data contain more valuable information of the real decision boundary, since data is close to the boundary? Therefore, they should be emphasized rather than de-emphasized.

Several notations are unclear, for example
L-smoothness: l(.,.) is L-smoothness. Do you mean l(f_theta(.),.) is L-smooth w.r.t. theta uniformly for all tilde x and y?
Thm 4.2: E|\nabla L^\alpha(\hat K)-\nabla_\theta(f(\tilde x),y)|^2, what's the tilde x and y, one random sample?
Thm 4.3: E|\theta^0-\theta^*|^2 term. What is the meaning of this expectation?
summary_of_the_review: Empirical results are good, but the rationale of the proposed method is unclear and not well explained. The theoretical results don't justify the method, instead, within the proposed context, justify algorithmic convergence.
review_title: null

final_score: rating: 5: marginally below the acceptance threshold
review_content: summary_of_the_paper: The authors explore the adversarial robustness of federated learning. They claim that the inner-maximization optimization of AT can exacerbate the data heterogeneity among local clients. They propose an algorithm, $\alpha$--WFAT, which relaxes the inner-maximization of Adversarial Training into a lower bound friendly to Federated Learning.. The authors also experimentally establish that federated learning models are most susceptible to attacks when clients are using non-IID training sets. The experiments are performed over the CIFAR-10 , SVHN and CIFAR-100datasets.
main_review: The paper tackles an interesting direction in federated learning, and is well-organized. Overall, I enjoyed the paper itself and the presentation of ideas, but I do think the contribution is incremental. I listed the detailed questions and suggestions below.

1. What is the detailed settting for Fig 1? What is the AT method used for training, PGD-AT or TRADES? Is the dataset here non-IID or IID? PGD-20 or PGD-10?   
2. The novelty of this paper is incremental. It adopted the weighting strategy. I am wondering whether the global model can be trained well in such a way.  
3. Many federated learning settings have much larger client numbers (thousands or even millions, only 5 clients in this paper, ), and it is unclear if the proposed solution scales.  Besides, only a slight improvement can be seen in Tabel 2.
4. This method doesn't make sense to me, especially for Fig 2. The motivation for the specific weighting chosen was not very clearly explained. 


summary_of_the_review: The paper tackles an interesting direction in federated learning, and is well-organized. Overall, I enjoyed the paper itself and the presentation of ideas, but I do think the contribution is incremental.
review_title: null

Meta-review: This manuscript proposes and analyses a weighting approach to improve the conformance of adversarial training in federated learning. The authors observe that adversarial training seems to degrade during the late stages of training, and suggest that this degradation is a consequence of exacerbated cross-device bias in federated averaging. They suggest and analyze a weighted scheme to fix this issue.

During the review, the main concerns are related to the novelty of the work compared to existing work, the clarity of the technical contributions, and unclear technical statements. The authors respond to these concerns and partially satisfy the reviewers. After discussion, reviewers remain mixed, with multiple weak rejects and one strong accept. No fatal flaws are noted. 

The opinion of the area chair is that while there are no fatal flaws, there is very limited enthusiasm for this paper. This limited enthusiasm seems to be a result of intuition for observed phenomena that seem incorrect or insufficient to reviewers. Overall, I think this paper outlines and addresses an interesting issue of real concern. Flaws in the intuition building/explanation, and issues with clarity of presentation need to be improved for this work to have some impact.
Decision: Reject