Venue: ICLR 2023 Conference

Reviews:

final_score: rating: 8: accept, good paper
review_content: summary_of_the_paper: Federated learning is vulnerable to backdoor attacks. The authors propose a new defense against backdoor attacks to federated learning. The key idea is to combine some techniques developed to defend against backdoor attacks to centralized learning. Some theoretical analysis is performed to analyze the loss and learnt parameters. Evaluation is extensive, covering both existing and adaptive attacks. 
strength_and_weaknesses: Strength

+ This paper proposes a new federated learning method to defend against backdoor attacks. Instead of designing new aggregation rules or changing how the server aggregates local model updates, the method modifies how benign clients train their local models. 

+ The paper extends centralized learning backdoor defense methods to federated learning. This is an interesting direction to explore. 

+ Some theoretical analysis is performed. 

+ Evaluation is extensive, covering multiple datasets, multiple baselines, and adaptive attacks. 

Weakness

- One potential weakness is that the meaning of provable is slightly different from what provable defense usually means. My first impression about provable defense is that it provides certified accuracy, like what ensemble federated learning provides. But this is a minor clarification issue. 

Other minor comment

Can you describe the setting for FLTrust? In particular, what root dataset is used by the server in FLTrust? 


clarity,_quality,_novelty_and_reproducibility: Please see the above comments. 
summary_of_the_review: This paper extends centralized learning backdoor defense to federated learning, which is an interesting direction. Extensive evaluation is performed to show the effectiveness of the method.
review_title: null

final_score: rating: 6: marginally above the acceptance threshold
review_content: summary_of_the_paper: The paper propose a trigger reverse engineering based defense and show that the method can achieve robustness improvement with guarantee (i.e., reducing the attack success rate) without affecting benign accuracy. The paper conducts comprehensive experiments across different datasets and attack settings. The results on eight competing SOTA defense methods show the empirical superiority of the  method on both single-shot and continuous FL backdoor attacks. 
strength_and_weaknesses: 1. The paper presents a new provable defense framework that can provide a sufficient condition on the quality of trigger recovery such that the proposed defense is provably effective in mitigating backdoor attacks.
2. The paper empirically evaluate the effectiveness of FLIP at scale across MNIST, Fashion-MNIST and CIFAR-10, using non-linear neural networks. The results show that FLIP significantly outperforms SOTAs on the continuous FL backdoor attack setting. 



clarity,_quality,_novelty_and_reproducibility: The authors will publish codes after acceptance. 
summary_of_the_review: See the above.
review_title: null

final_score: rating: 8: accept, good paper
review_content: summary_of_the_paper: In FL many clients participate. Malign/adversary clients can potentially join and impact training by submitting malicious weights. To cope with such scenarios benign clients can employ algorithms that are more robust for such injections. The authors propose the use of data augmentation through adversarial training that benign clients should use. 
The also provide a theoretical analysis of the difference in the loss function if benign clients employ such as strategy vs not. 
On standard datasets they find that their algorithm usually outperforms benchmark algorithms. 
strength_and_weaknesses: Strengths: 
The underlying FLIP algorithm is rather novel. It combines existing concepts but in an interesting way. 
The theoretical analysis is also interesting. The statements state results that are definitely relevant and intriguing to show. 

Weaknesses: 
Perhaps FLIP can be enhanced to improve its performance. It would be great if it beats other benchmarks in more cases. 

clarity,_quality,_novelty_and_reproducibility: The paper is well written and easy to understand. 
They claim to open source the code. 
summary_of_the_review: The contributions are significant. The paper is a nice mixture of algorithmic designs and theoretical analyses. 

The literature review section can be improved by more explicitly stating how does prior work differ from the current work.
review_title: null

final_score: rating: 3: reject, not good enough
review_content: summary_of_the_paper: The paper proposes a defense against backdoor attacks to federated learning. Existing defenses do not study how hardening benign clients can affect the global model (and the malicious clients).  The paper proposes a three stage defense that aims to harden benign clients and connect cross-entropy loss, attack success rate, and clean accuracy.  The proposed defense is evaluated on three datasets and shows better performance than previous defenses. 



strength_and_weaknesses: Strengths
+ The studied problem is important
+ The paper proposes a three stage defense against backdoor attacks to federated learning


Weaknesses
-Theoretical results are inaccurate
-Theoretical results do not provide meaningful guidance about why the propose defense works
-Evaluation is not sufficient 



clarity,_quality,_novelty_and_reproducibility: 



=====Theoretical results====

My main concern is about the two theoretical results, i.e., Theorem 1 and Theorem 2, that are inaccurate. 

In Theorem 1, the loss Lg’ and Lg defined is unclear, so does x. When I went through the appendix, I realized  Lg’ and Lg are defined on a single data point x, instead of a training set.     
However, when generalizing it to the set of samples, the relationship considered in Eqn (3) is inaccurate. 
More specifically, the accurate form in Eqn (3) should sum_{s=1}^n_b  min_t (x \nabla W),  instead of min_t (sum_{s=1}^n_b  x \nabla W), as these two terms are not equal in general.  
Therefore, the results in theorem 2 based on Eqn(3) is inaccurate. 

Moreover, the theoretical results are under a very simple linear model. A key reason making backdoor attacks be successful is due to the overfitting/memorization of deep models on the trigger.  Hence, I am doubtful that these theoretical results can guide the defense effectiveness. 

====Evaluations====
What are the recovered triggers by the proposed defense? Neural Cleanse often only recovers very blurred trigger. What if benign clients just inject a set of randomly chosen triggers for adversarial training?  What is this defense performance? Further, is the best performance achieved when the true trigger is used for adversarial training?  Basically, I would like to see how the  trigger affects the performance. 

How many extra augmented data samples are used?  

Non-IID is an important factor that affects the defense performance. What’s the defense performance against more non-IID data across clients?  

In adaptive attacks, is the setting that the malicious clients set the inverted trigger + clean images as a targeted label, while benign clients set the inverted trigger + clean images as the true label? If this is correct, what’s the insight that makes the defense effective? More specifically, if malicious clients have more poisoned samples than benign clients’ clean samples, and the deep model memorizes the trigger, how could it be possible that the defense is effective? 
  
The proposed defense does not compare with tee state-of-the-art, e.g., 

Shejwalkar and Houmansadr, Manipulating the Byzantine: Optimizing Model Poisoning Attacks and Defenses for Federated
Learning, In NDSS, 2021

How the class distance is defined? Just using the data samples from the source-target class? How the number of samples affect this distance? 

summary_of_the_review: The studied problem is important. The proposed defense is somewhat novelty. However, the proposed defense is not well justified, and the theoretical results may be inaccurate and cannot be generalized to general deep nonlinear models.
review_title: null

Meta-review: metareview:_summary,_strengths_and_weaknesses: The authors of this paper analyze the connection between cross-entropy loss, attack success rate, and clean accuracy in a Federated Learning (FL) setting. They also propose a trigger reverse engineering based defense to improve robustness without affecting benign accuracy. Finally, they conduct experiments across different datasets and attack settings to show empirically that their method is superior to eight existing methods for single-shot and continuous FL backdoor attacks.

The Reviewers identified the following list of strengths and weaknesses. 

Strengths:
- Proposes a new federated learning method to defend against backdoor attacks
- Extends centralized learning backdoor defense methods to federated learning
- Performs some theoretical analysis
- Extensive evaluation covering multiple datasets, multiple baselines, and adaptive attacks
- Empirically evaluated the effectiveness of FLIP at scale across MNIST, Fashion-MNIST and CIFAR-10
- Significantly outperformed SOTAs on continuous FL backdoor attack setting

Weaknesses:
- Meaning of "provable" is slightly different from what is usually meant by "provable defense"
- Minor issues in the paper’s claims
- Statements not well-supported
- Requires small changes to be made correct
- Theoretical results contained some inaccuracies, and may not provide an accurate set of guidelines as to when this method works.

The most critical of reviewers engaged significantly with the authors during rebuttal, during which most technical concerns were lifted. Although the reviewer raised the score, that remained relatively low. However the justification was mostly on the basis of how big the scope of the defense is. 

Overall this is an interesting paper, that combines a few novel ideas, and provides some non-trivial theory for a problem of interest in the FL community. Even if the defenses presented are not general enough, they may spark some discussion, and further idea generation on this important topic of FL robustness against backdoor attacks. 

justification_for_why_not_higher_score: The scope of the paper is perhaps limited, both in terms of audience, but also in terms of applicability of results within that community of ICLR.
justification_for_why_not_lower_score: The issue of defenses against backdoor attacks is quite important, and few provable defenses exist. This work contributes towards that direction in a non-trivial way.
Decision: Accept: poster