Venue: ICLR 2023 Conference

Reviews:

final_score: rating: 5: marginally below the acceptance threshold
review_content: summary_of_the_paper: This work focuses on the model poisoning and backdoor attacks in federated learning. It proposes an attack that anticipates and accounts for the entire federated learning pipeline, including behaviors of other clients.

The main contributions can be summarized as:

(1) Proposing a backdoor attack in federated learning (anticipate).

(2) Providing extensive experiments.
strength_and_weaknesses: Strengths:

(a) This paper is well-written and easy to read.

(b) I appreciate that extensive experiments are provided in this work.

Weaknesses:

(a) Should m steps be represented in Eq.(1)? If yes, please revise Eq.(1) and provide some references. If no, please provide a reasonable explanation.

(b) In Section 3, it is mentioned that ``We believe this threat model with random attack opportunities is a natural step towards the evaluation of risks caused by backdoor attacks in more realistic systems''. Please provide a proper example to demonstrate the application in reality.

(c) In Section 4, some formulas are not numbered.

(d) It is hard to imagine how to implement the method proposed in this work. In the lines 9 to 12 of Algorithm 1, the proposed method needs to calculate ($\theta_1, \theta_2, ..., \theta_k$). It is ok to calculate these parameters, but it is hard to imagine how to calculate line 14. In line 14, it requires to differentiate k-th step w.r.t $\theta_{mal}$. Recall the calculation of $\theta_{u,j}$ (such as Eq.(1)), we can find that it needs to calculate the derivatives. These mean that there are k-th partial derivatives in the calculation of line 14, which are very difficult to implement. This point is my main concern. Please provide a very detailed explanation and describe how to calculate it.
clarity,_quality,_novelty_and_reproducibility: Poor quality.
Nice clarity.
Poor originality.
summary_of_the_review: I recommend marginally below the acceptance threshold. I will give my final score based on the response and other reviewer's comments.
review_title: null

final_score: rating: 5: marginally below the acceptance threshold
review_content: summary_of_the_paper: The paper proposes an attack that anticipates and accounts for the entire federated learning pipeline, including behaviors of other clients, and ensures that backdoors are effective quickly and persist even after multiple rounds of community updates. Experiments on datasets  demonstrate the performance of this attack on image classification, next-word prediction, and sentiment analysis.


strength_and_weaknesses: 1. The paper claims two moves ahead would be better than other attack methods such as norm-bounding. I guess that Eq. (4) with two loss functions would be the two moves, but the parameter between the moves is not given. Generally, we need to add a parameter to compromise the two loss functions in eq.(4), and add more experiments to show the results with different "move weights". However, it seems the moves are averaged and the paper does not explain why the average move is effective and why the compromise weight is not required as expected. 

2. The motivation and experiments are with strong control. It would be persuasive to add real-world motivation and experimental data.  Plus, I found that a demo version of this paper has been published in ICML. Because a previous version of this paper has already published, it would be better to add discussions about the difference between the two papers. 


clarity,_quality,_novelty_and_reproducibility: Difficult to read, and hard to reproduce. 
summary_of_the_review: Please see the above.
review_title: null

final_score: rating: 3: reject, not good enough
review_content: summary_of_the_paper: A new backdoor attack against federated learning is proposed. The paper considers a single malicious device that can share malicious updates with the server to inject a backdoor into the centralized model, and the server adopts FedAvg with norm clipping as the aggregation rule. The main idea is to account for benign users' behavior in future rounds to make the malicious updates more persistent. Simulation results demonstrate the effectiveness of the proposed attack against the norm-bounding defense. 
strength_and_weaknesses: Strengths

1. The idea of simulating benign users' behavior to develop more advanced attacks against federated learning is interesting.
2. The proposed backdoor attack is effective against the norm-bounding defense. 

Weaknesses

1. The paper considers an oversimplified setting with a single malicious device, and the simulation algorithm only considers a single attack step (the current step) and ignores the possibility that the device may be sampled again soon. Further, the algorithm simulates a fixed number of steps before the next attack happens, which is inaccurate given the randomness of the sampling algorithm used by the server. As the attacker has no access to other users' local data, the paper simply simulates their behavior from the attacker's local data, which can also be inaccurate for non-iid local data distributions. 
2. Because of the simplified design, the proposed attack can only break the norm-bounding defense and completely fails when the server adopts Krum, Multi-Krum, or Median, as shown in the appendix. Note that these are not really "advanced" defenses as they are not designed for backdoor attacks. Recent defenses, especially detection-based and post-training-based defenses, obtain more promising results against backdoors, which are completely ignored in the paper. 
3. For the norm-bounding defense considered in the paper, the norm threshold C is crucial for achieving a good tradeoff between the main task accuracy and robustness against attacks. But I cannot find the value of C used in the experiments, and there is no ablation study that investigates the impact of C on main task accuracy and backdoor accuracy. 
clarity,_quality,_novelty_and_reproducibility: Algorithm 1 needs to be clarified in a couple of places. Does the group of users U_i change over time? How is the number of simulated benign users n' determined? Also, the algorithm uses FedAvg to simulate the server's aggregation rule. Does it include the norm clipping step? 

In terms of novelty, the idea of simulating the behavior of benign agents in federated learning has been considered in recent work, e.g., [1]. Although the focus in [1] was on model poisoning, the idea of building a model of the FL system and benign agents using common knowledge and the attacker's local data can be readily applied to backdoor attacks. Further, [1] used reinforcement learning to obtain an attack policy that optimizes a long-term objective, which is more general and effective than the myopic approach adopted in this paper. 

[1] Wen Shen, Henger Li, and Zizhan Zheng. Learning to Attack Distributionally Robust Federated Learning. NeurIPS-20 Workshop on Scalability, Privacy, and Security in Federated Learning (SpicyFL). 





summary_of_the_review: The idea of simulating benign users' behavior to develop more advanced attacks against federated learning is interesting. However, the paper considers an over-simplified setting, and the proposed backdoor attack is only effective against the norm-bounding defense and completely fails against other common defenses. The proposed solution is far from being sophisticated.
review_title: null

Meta-review: metareview:_summary,_strengths_and_weaknesses: The paper presents a backdoor attack in federated learning and extensive experiments show the effectiveness of the proposed method. But reviewers find that the quality and presentation of this paper is not good at all. The novelty is very limited.
Decision: Reject