Venue: NeurIPS 2021 Conference

Reviews:

final_score: rating: 5: Marginally below the acceptance threshold
review_content: summary: The paper proposes White Blood Cell for Federated learning (FL-WBC) -- a client-based defense that can mitigate model poisoning attacks that have already polluted the global model. 
The authors claim that strong model poisoning attacks that can circumvent server-based defenses can continue to impact the global model even if there are no subsequent attacks. Towards this end, the paper identifies the attack effect on the parameter space (AEP) and observes that the parameter subspace used for the attack is both inaccessible to the server and remains hidden in the kernel of the Hessian matrices on benign agents. Thus, they propose a client-based optimization that is designed to minimize the loss on the benign task while also minimizing the dimensionality of the Hessian kernel. Robustness certificate and convergence guarantees are also provided. 
Evaluation is performed on FashionMNIST and CIFAR-10 datasets to demonstrate the ability of the defense to mitigate attacks using three metrics (attack metric, robust metric, and utility metric). Comparison is performed with DP-based defenses, CMA, and CTMA.
main_review: I have the following concerns with the defense:
a. Prior papers in this area including [8, 10,  11, 12] observe that the strength of an attack (even without a defense) starts to attenuate if there is no reinforcement by attackers in subsequent rounds. The benign updates are able to overwrite the effect of the attack. This is both intuitive and has been experimentally validated in the past. I really like the AEP analysis performed by the authors but I am not fully convinced, especially as it does not seem to reconcile with prior observations.

b.  Second, the evaluation does not consider an adaptive attacker that is aware of the client-based optimization performed to remove the effect on the parameter subspace (hiding the attack). 

c. The authors need to explicitly mention the threat model which will then provide the parameters for attacks that can be mounted on the defense.  Furthermore, the solution requires clients participating in federated learning to perform a specific form of optimization (and Proximal Gradient Descent). How much can clients (even benign ones) be trusted to perform a regularized training?

Minor:
a. The authors should consider using some of the standard notation in FL papers. This will simplify the presentation and improve the readability of the paper. 
b. Line 168: W_{t, I}^{k}(\alpha=1) implies evaluating Eqn. (3) with \alpha=1. The authors mention that this shows that the k-th device is malicious. However, replacing \alpha=1 in Eqn. (3) implies that the agent is optimizing for the benign objective only. So, why is it considered malicious?

Some typos:
line 104: Often --> often
line 312: misclassification --> misclassification

limitations_and_societal_impact: Limitations and societal impact are not currently mentioned but should be added as either a separate discussion section or as part of the conclusion.
review_title: null

final_score: rating: 7: Good paper, accept
review_content: summary: This paper shows that existing "robust aggregation" defenses against poisoning attacks in federated learning are ineffective in presence of strong attacks. Hence, they propose a client-based defense named "White Blood Cell for Federated Learning (FL-WBC), which can mitigate against attacks who already managed to pollute the global model. 
main_review: # Strengths
- Their client-based defense works also in presence of already-polluted models, and is complimentary to server-based robust aggregation approaches
- They achieve convergence guarantees and certified robustness guarantees
- Author consider both IID and non-IID settings
- They demonstrate ineffectiveness of existing defenses against stronger attacks
- Code and datasets are included

# Weaknesses
- Possible lack of adaptive attackers
- Only tested on FashionMNIST and CIFAR-10 (somewhat simple datasets)
- There are many relevant information relegated to the Appendix (e.g., description of Figure 2, non-iid settings,  relevance of AEPs in Fashion-MNIST). 

# Detailed comments

The paper is generally very well written, and positions itself very clearly with respect to the state of the art. Both the empirical and theoretical foundations of the work are extremely strong, but it is also clear what is the high-level intuition behind the proposed approach, so that the reader always know where they are despite the highly technical content of the paper.

**Presentation**. Despite the overall great writing style, I feel that there are just too many important information relegated to the Appendix, to the point that it is occasionally hard to assess the paper as-is without having a look at the Appendix. I feel that the writing and presentation should be somehow revised to present this. Some major issues I've had in terms of missing information from the main test include:
- information for Figure 2 (beta is not explained)
-  he high-level intuition non-iid settings,  
- the experimental results on AEPs relevance in Fashion-MNIST
Moreover, the paper is very dense and full of symbols. While most of them are fully aligned with the state of the art, I feel especially for AEP-related symbols (e.g., "s", "H") it would be good to have a "symbol table" to improve readability of the work. 

**Adaptive attackers**. In the model considered throughout the paper and depicted in Figure 1, I think that one thing that is not fully considered is what happens if malicious clients know that FL-WBC is being used. Is there an adaptive, stronger attack that could take advantage of the new component of the loss function, to create stronger and more subtle attacks? If it is only discussed in the text, it should be highlighted better, but it would be appropriate to have a specific section on adaptive attackers. See the following papers for reference:
- Tramer, Florian, et al. "On adaptive attacks to adversarial example defenses." arXiv preprint arXiv:2002.08347 (2020).
- Carlini, Nicholas, et al. "On evaluating adversarial robustness." arXiv preprint arXiv:1902.06705 (2019).

**Adversarial round probability**. How strong is the importance of the adversarial round probability as part of the experimental evaluation? I feel that from Figure 3 the number of adversarial rounds remains fairly limited. The authors mention approaches for 'detecting' that an attack is going on, but the whole paper is framed around _super strong adversaries_, so I was a bit confused when I saw such a low probability in the experimental evaluation. 

**Generalization**. Is there any chance that since you are using relatively simple datasets such as MNIST and CIFAR-10 there is some artifacts in the actual robustness achieved?

# Minor comments
- Figure 4: Why the 'no defense' bullet is only for attack mitigation >10?
- there is a capital "Often" on page 3, which should be lowercase
- At the end of page 4, within the explanation after Equation (5):  when $\alpha=1$ the $k$-th device should be benign, right?
limitations_and_societal_impact: I feel there is not enough discussion about possible limitations of the work, or at least of the experimental evaluation. I guess that these aspects should be taken into account:
* generalization of the results from the computer vision task to other domains; moreover, the specific focus on Fashion-MNIST and CIFAR-10 and not larger CV datasets may be affecting generalization
* the amount of adversarial rounds considered in the evaluation
* adaptive attackers that know the defense
review_title: null

final_score: rating: 7: Good paper, accept
review_content: summary: This paper proposes a client-based defence in federated learning against attacks which have already broken through server-side defences and which would otherwise persist through subsequent rounds after the adversarial attack has taken place. They place, under certain assumptions, theoretical bounds on the effectiveness of their approach and on its convergence. Experiments support the approach used.
main_review: This is a very clearly written paper. Though not an expert in this area, the key idea (that attacks persist as their effect on the parameters lies in the kernel of certain Hessians) is plausible and apparently novel. Experimental evidence is used to bolster this hypothesis too.

This work seems significant in that it offers a seemingly robust (and somewhat quantifiable, based on their theoretical contributions) defence, which importantly can be used in conjunction with server-side defences.

The theoretical results require a large number of assumptions for their proof, and as a non-expert I am not confident with regard to how likely these assumptions are to be met. That said, some of the assumptions match those from previous work. Also, a quantitative theoretical approach is to be applauded – though the measure AEP seems overly simplistic.

Though the key argument feels consistent, i,e. that if the change in the parameters lies in the Hessians, it will persist, this would seem a sufficient condition though not a necessary one for an attack to persist from round to round.  In this vein, the “certified robustness” guarantee does not really seem to be a guarantee of robustness, but rather that this particular sufficient condition for attack persistence may not be met.

The experiments seem quite thorough and assess performance against SOTA of the defence and also impact on utility.

Typos/miscellaneous comments:
-	“Unfortunately, Often...”
-	I am uncomfortable with the notation $W_t(S_i \setminus M)$. It is not really parameterised by the indicated set (if the sets for i=1 and i=2 matched the parameters would match but these are different cases), but it is more that $i$ should be the parameter, as well as some indication of whether or not malicious devices are included.
-	Equation (7) has a leading N/K in its derivation in the Appendix
-	“equivalent to minimize the dimension...” should be “minimizing”

limitations_and_societal_impact: The authors do not specifically address potential societal impacts.
review_title: null

Meta-review: This is an interesting paper, and the reviewers find much to recommend it.
Moreover, the rebuttal and discussion post-review seems to have addressed many, if not all, the concerns of the reviewers.
The issue of the attenuation of the attack was discussed. Perhaps the portion of the appendix where this is empirically addressed can be highlighted in the paper. 

Decision: Accept (Poster)