Venue: ICLR 2022 Conference

Reviews:

final_score: rating: 3: reject, not good enough
review_content: summary_of_the_paper: The paper studies the problem of propagating adversarial robustness in federated learning. Adversarial Training (AT) is typically used for training models that are robust to adversarial examples, however, AT requires computing resources that are not always available at all devices participating in FL. The paper proposes a strategy to transfer adversarial robustness among a group of FL users (characterized by non-iid data and heterogeneity in available computing resources, allowing only a fraction of them to perform AT).
main_review: Pros:
a. The authors propose Federated Batch-Normalization (FedRBN) to transfer robustness between users participating in FL. They build on a prior observation (in the centralized setting) that robustness is correlated with BN statistics and hence copying BN parameters could lead to transferring robustness.

b. The authors decouple the effect on BN parameters to (1) Domain difference (due to non-iid data) and (2) Adversarial noise (due to AT). To counter this they propose to use a dual batch-normalization structure, which keeps track of two sets of BN statistics: one for clean data and another for noisy data (due to AT).

c. Finally, they propose a de-biased estimation of the robust BN statistics (mean, variance) for the ST users (Eq. (4)) which leads to the transfer of robustness from users in AT to users in ST. The authors use a one-dimensional example to justify their choice of expression in (4).

d. I like the choice of datasets used by the authors to perform the evaluation. 

Cons:
1.  The paper needs a careful editorial pass. There are numerous typos, and certain parts of the paper could benefit immensely from more clarity in writing. 

2. The contributions of this paper are marginal. For example, prior work (FedBN) has shown that the federation of BN parameters leads to poor model accuracy. Hence, these parameters are only locally optimized. Similarly, the connection between BN parameters and robustness has also been made. This paper proposes a mechanism to transfer BN statistics between users. Furthermore, the linear mapping is not rigorously justified. 

3. The post-training modification of the BN statistics and its effect on model performance seems to be heavily dependent on the model-wise switch parameter $h$ (defined on pg 5). In this context, Algorithm 3 (in the appendix) is very important. If it is not able to separate a being sample from the adversarial one then the performance would be impacted. However, confident detection of adversarial examples is still an area of active research. I would really like to see more evidence of the performance of Algorithm 3 for stronger adversarial attacks. 

4. Similarly, AA has been shown to be a stronger form of attack than PGD. It is not clear to me why a much weaker attack (PGD, n=7) was used for training the models. In fact, I do not completely understand how Table 4 has been generated. 

Clarifications:
a. What is the definition of $q_k$ in Sec 3.2.
b Shouldn't (2) be better expressed using ${\bf q}$
c. In Algorithm 2, sometimes $\sigma_s^{r^2}$ is used whereas at other times $\sigma^{2^r}$ is used. It would be great if there could be more consistency in notation.
d. Some claims, for example, the authors mention that the copy of the de-biased BN statistics does not leak more information compared to FedAvg. However, no justification has been made for it. I understand that it could be orthogonal to the problem under study, but the claim seem to be a fairly important one and has not been justified. 
e. Readability would be improved if the authors explicitly associate operations such as +detector, +copy, +debias (used in the ablation study) with their mathematical descriptions provided earlier in the paper.

summary_of_the_review: Please see the detailed comments above.
review_title: null

final_score: rating: 8: accept, good paper
review_content: summary_of_the_paper: Adversarial training (AT) is good for defending against attacks but is costly for low-resource FL users. The authors want to find a good way to propagate adversarial robustness from high-resource users to low-resource ones. They proposes federated robust batch-normalization (FedRBN) which enables all users to enjoy robustness against malicious attacks at inference. The basic idea is to let the BN statistics of AT users be shared with the standard users so that the latter can do robust prediction on adversarial inputs without conducting AT on their own. The authors also propose a debiasing method to mitigate the effect of non-IID data distributions across the clients. Experimental results including various ablation studies confirm the advantage of FedRBN.

main_review: Making model robust against adversaries is very important for deploying FL. The authors present a practical and effective approach to tackle this issue. It is interesting to propagate adversarial robustness via transfer of batch-normalization statistics from high-resource users to low-resource users. The effectiveness of the proposed method is validated by extensive experiments and ablation studies. The paper is well-written and easy to follow overall.

The idea of debiasing is not very clear. Eq 4 can work well if the noise values at both users follow the same distribution as described in page 5. However, can Eq. 4 really help when the noise distributions are not the same? The effect of debiasing seems to be marginal in 
Table 1. I want to see more experimental results on this particular issue (ablation on when debaising works well versus when does not), as it is a key component of the proposed idea. 

While writing is good overall, certain points are vague. Explanations and motivations related to Fig. 2 should be made more clear. For example, Fig. 2a is presented to argue there are significant differences in BN parameters between ST and AT users from the same domain. But this is incomprehensible. Also, is there any reason why BN2 is picked for Fig. 2b? Are the correlations similar across BN layers?

There seem to be significant enough departure from a simple linear relationship between the delta log variance of clean samples vs that of perturbed samples in Fig. 2b. Yet the algorithm gives good performance overall. I would like to see some sort of convergence analysis that can give insights into, e.g., the effect of uncertainly in such linear modeling on the convergence behavior. Note, most FL paper today provide analysis to ensure a controllable convergence behavior. The authors can build on existing convergence analysis. 

Among 50 users in the system, how many users participate in FL at each round? This is not clearly described, and I believe the authors assume all users participate in each round. How does the proposed method perform when the contact ratio is small (e.g., 20 or 30 users out of 100, per round), which reflects the practical cross-device federated learning setup? The global statistics on batch-normalization can also be biased when the contact ratio is less than 1.  

Also, the total number of devices is set to 30 or 50 depending on datasets in the presented experiments. But standard FL tasks require large-scale learning. Can you comment on the scalability of your method? (specifically, would it perform well in the presence of more devices?) 




summary_of_the_review: Overall a good paper, but I am still giving the “marginally above” score due to some questions/concerns as given above; however, upon getting reasonably satisfactory answers, especially to the convergence analysis question, I will be happy to move higher to the positive side.
review_title: null

final_score: rating: 8: accept, good paper
review_content: summary_of_the_paper: This paper proposes a simple yet efficient method to improve the adversarial robustness of federated learning. The proposed method allows only a subset of clients to perform computationally expensive adversarial training, and then propagate the robustness on these clients to the others who could not afford the adversarial training. Extensive experiments are conducted and the results show that the proposed method outperforms other baselines.
main_review: This paper aims to improve the adversarial robustness of federated learning with heterogeneous users. The authors consider both the statistical heterogeneity and the computational heterogeneity in federated learning, which is a realistic scenario. Considering the heterogeneous computational resource on different users, they propose to use a small fraction of clients for adversarial training, and copy the BN layers of these clients to others who could not afford for adversarial training to propagate the adversarial robustness. The method is simple and the experiments show that it is effective.

Strengths:
1. The paper studies an important trustworthy AI topic: preserving both privacy and robustness via a new federated robust training scheme. Since robust training is often too expensive for edge users, the authors studied a novel setting of practical relevance: users with limited restricted budgets only afford cheaper standard local training and obtain robustness from other budget-sufficient users who use adversarial training. 

2. The proposed method is simple and intuitive. They take advantage of the idea from the previous work that the robustness is highly correlated with the BN layers, and propose to propagate the robustness from a robust user to a non-robust user with linear combination of the BN statistic. The authors also setup a verification experiment to show that the linear combination is reasonable.

3. The evaluation is very thorough and convincing. Detailed experiments involving multitude of datasets from different domains (to capture data heterogeneity). To fully evaluate the robustness, the authors experiment with (black-box) MIA, (adaptive) AutoAttack and LSA. The method still outperforms the baselines by a large margin under adaptive attacks. I also appreciate authors providing standard deviations for results.

Weaknesses:
1. In the last paragraph of Sec 4.1, the authors assumes the noise in each layer is independent of the data: I don’t understand this assumption since adversarial noise is data-dependent.

2. Since the BN layers are only updated locally with limited data and/or SGD rounds, it is unclear to me why the BN parameters can be sufficient to capture the robustness property?

3. The proposed method mainly focuses on the feature heterogeneity. I would like to know whether FedRBN still work under label heterogeneity, which could be a more challenging heterogeneous scenario.

4. Have the authors tried to scale to more clients, or more skewed local data distributions?
summary_of_the_review: This work has strong motivation and adds novel contributions to federated learning, i.e. studying federated learning robustness under heterogeneity, The proposed model is simple yet easy to understand, and is theoretically grounded. Experiments are convincing, although a few questions remain to be clarified by authors.
review_title: null

final_score: rating: 6: marginally above the acceptance threshold
review_content: summary_of_the_paper: This work studies adversarial robustness in a federated learning context. The authors propose to propagate robustness through sharing BN statistics of the different federated learning participants. Hereby, the authors consider that some parties are stronger (e.g. through higher resource power) to perform adversarial training, and can provide weaker parties with the respective parameter updates. 
main_review: # Strong Points
* As for the centralized case, the robustness issue is also important in the federated learning context. Hence, this paper addresses an important concern.
* The concept of some parties having more resources than others and can therefore afford to perform adversarial training is reasonable and realistic. 
* The paper is overall well-written and easy to follow. 
* The authors provide extensive experimental results. 

# Weak Points
* The theoretical novelty of this work is somewhat limited. In essence, the authors just apply previous insights, such as the distributional shift caused by BN and adversarial training to the context of federated learning. The authors did not reveal any new insights regarding these topics which are specific to the federated learning topic. 
* The proposed approach uses a dual batch-normalization (DBN) strategy. To decide which one of the BN statistics to use, the authors state that they “predict whether the image is noised”. Here, I identify a fundamental flaw of this work, since previous works showed, that most adversarial detection techniques can be fooled [1,2,3,4], e.g. due to obfuscated gradients. Different guidelines had been proposed to check against these techniques [2,3]. The proposed noise detector seems to be a DNN-based binary classifier, similar to the approach in [5]. Hence, a simple idea for a full white-box evaluation would be to include a loss term with the objective to fool the noise detector in the adversarial example generation. This issue is critical since the noise detector appears to be crucial for the efficacy of the DBN as seen from Table 1 and stated by the authors: “DBN does not help unless the noise detector is applied”. 
* The authors state that “The black-box can avoid the trip of fake robustness due to obfuscated gradient”. I do not agree with this statement, since usually, a black-box attack is harder than a white-box attack. A good start to test against obfuscated gradients would be to evaluate with Backward Pass Differentiable Approximation (BPDA) [2].
* The used baselines are not clear to me. The authors state that they “use three representative federated baselines combined with AT”, but also “denote the AT-augmented” version with a FAT prefix. From this description, the difference between FedAvg and FATAvg is not clear. Due to this confusion, I assumed that the methods with the Fed prefix refer to the paper baselines, while the AT variants are denoted with the FAT prefix. This might be my fault for not understanding something here, but I would be happy if the authors could clarify this in the rebuttal, such that I can clearly understand the results. 
It would also be good to add citations to the corresponding technique in the Tables for clarity, or if not the exact method is used to clearly state the differences to the previous technique and the reasons for the introduced changes.   
From Table 2 it appears that the standard techniques are already relatively robust against adversarial attacks. Commonly I would assume that a “non-protected” method (FedBN, FedAvg, FedProx) would have a RA of around 0%. Why is this?   
Further, Table 2 compares two other “robust” methods (FATMeta & FedRob). These methods achieve the worst results. This result also seems counterintuitive and requires a detailed discussion in my opinion.   
The same applies in Table 3. Why do FATAvg and FATBN show lower robust performance than FedAvg and FedBN? Why do the numbers of FedRBN from Table 2 and Table 3 not match?   
I am also missing a comparison with FAT (Zizzo et al., 2020;)
* The choice of AlexNet for the DomainNet experiments is outdated, especially since BN has to be added. I recommend the authors to include results at least for a ResNet architecture.  

[1] Adversarial Examples Are Not Easily Detected: Bypassing Ten Detection Methods; AISec’17  
[2] Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples; ICML 2018  
[3] On Evaluating Adversarial Robustness; arXiv 2019  
[4] Detecting Adversarial Examples Is (Nearly) As Hard As Classifying Them; ICML 2021 workshop  
[5] On Detecting Adversarial Perturbations; ICLR 2017


# Additional Questions
* Will the code be publicly available?

summary_of_the_review: Robustness is an important issue also in the federated learning context. Overall I identify the noise detector as the main bottleneck of this work since a “smart” adversary can incorporate it into its attack strategy and can therefore probably significantly deteriorate the entire FedRBN pipeline. Also, the main results appear confusing to me and require some further discussion. 

======= Edit November 23 =========  
Raised my score to "marginally above the acceptance threshold" after reading the rebuttal.
review_title: null

final_score: rating: 3: reject, not good enough
review_content: summary_of_the_paper: This paper studied the propagation of adversarial robustness among federated learning users, where some users had limited training data and computational budgets for affording the adversarial training. It proposed a novel method Federated Robust Batch-Normalization (FedRBN) to facilitate this propagation. The key step was a dual batch-normalization (DBN) structure to encode the clean and adversarial distributions respectively. Then the debiased BN statistic for low-resource users was estimated from other users who could afford the expansive adversarial training. The experiments supported that this approach improved the adversarial robustness of federated learning.
main_review: Strengths:
(1) A novel FedRBN method was proposed for adversarial robustness propagation among users in the federated learning setting.
(2) The dual batch-normalization (DBN) structure enabled communication efficiency and robustness propagation.
(3) Experiments showed that it improved the adversarial robustness of the federated learning algorithms.

Weaknesses:
(1) One major concern is the rationality of the dual batch-normalization (DBN) structure in the proposed method. The results in Table 1
indicated that “simply adding DBN does not help unless the noise detector is applied”. On the other hand, different from prior work, it
used shared weight and bias in the design of DBN. It is not clear whether the parameter sharing strategy explained the limitation of
DBN-only module in the proposed method. In addition, the difference between “+copy” and “+debias” is not clear.
(2) Compared to FATBN, FedRBN used the robustness propagation from AT user to ST user. In this case, it is not shown whether FATBN allows adversarial training for every user. If so, why is it performing worse than FedRBN with robustness propagation? 
In other others, can the robustness propagation on one ST user achieve better performance than performing adversarial training on this user? Or the performance improvement can be explained by the DBN and the noise detector in FedRBN?
(3) The strategy of learning user-specific BN parameters is close to a federated multi-task learning problem [ref 1]. It might be 
convincing to have some discussion on comparing this work to the federated multi-task learning solutions.
[ref 1] Smith, Virginia, Chao-Kai Chiang, Maziar Sanjabi, and Ameet Talwalkar. "Federated multi-task learning." In Proceedings of the 31st International Conference on Neural Information Processing Systems, pp. 4427-4437. 2017.
(4) It is not convincing why ST users would average the statistic difference received from all AT users. On one hand, this averaging method in FL has shown to be sensitive to Byzantine attacks.  On the other hand, it might be dominant in the major data distribution
D_i shared by most AT users in real-world scenarios. Sending the averaged statistic difference to all ST users with different 
distributions could lead to a sub-optimal solution.
(5) As one of the key component of FedRBN, the training of the noise detector needs to be clarified, especially for ST users with limited
data and computational budgets. Can the noise detector be propagated from AT users to ST users in this case?
(6) The legend of Figure 3(b) is confusing.
Minor issues:
(1) Some notations are undefined, e.g., q_a and q_k.
(2) There are some grammar errors, e.g., “the corresponding two distribution, separately.”, “the server aggregate BN statistic”, etc.
summary_of_the_review: The rationality of technical details used in this paper is not well explained, thus I recommend the rejection of this work for ICLR.
review_title: null

Meta-review: This paper considered the computational budgets of adversarial training in the context of Federated Learning and studied the propagation of adversarial robustness from affordable parties to low-resource parties. Although the authors conducted the extensive experiments to show the effectivenss of FedRBN, there are still important concerns from the reviewers,

(1) The novelty is marginal compared to FedBN, DBN and previous insights, which moves the similar framework to adversarial robustness and changed the rules, especially given the competitive ICLR. More theorectical novelty will be preferred. 

(2) Many technical details are not well explained and some parts need to be improved, which make the reviewers not well convinced about FedRBN. 

Given above points, I will recommend rejection and encourage the authors to improve the paper in the future.
Decision: Reject