Venue: ICLR 2021 Conference

Reviews:

final_score: rating: 6: Marginally above acceptance threshold
review_content: The paper proposes a backdoor-resilient federated learning method to defend the backdoor attack of poisoning the models. Their method consists of the dynamic clustering, adaptive clipping and noise adding. There are extensive experiments to demonstrate the effectiveness.

The cosine distance calculation between W_i and W_j is conducted of every pair of the models. The clustering is based on the assumption that the poisonous and benign models can be classified into two parts. In Algorithm 1, line 9, is fetching median euclidean distance a safe clipping threshold to remove the outliers? Some study is encouraged to discover such choice.

How to choose the parameter \lambda such that adding the noise N(0, sigma) do not flooding the model G_t? As training the global model G_t is with many iterations, each iteration adding certain level of noise, how to guarantee the model training convergence?

As the framework under federated learning, would the framework consider the communication cost between the global model and the local models? i.e., how many model synchronizations are needed? What are the overall operation complexity?

For Private BAFFLE, what is the consideration to choose STPC? As in experiments, there are differential privacy based method? Would the authors provide the reasoning to compare different privacy methods?

review_title: Overall the paper provides a technically sound solution for the backdoor-resilient federated learning method. But it lacks justification for the privacy enabled BAFFLE.

final_score: rating: 6: Marginally above acceptance threshold
review_content: In the paper, the authors proposed a novel privacy-preserving defense approach BAFFLE for federated learning which could simultaneously impede backdoor and inference attacks. To impede backdoor attacks, the Model Filtering layer (i.e., by dynamic clustering) and Poison Elimination layer (i.e., by noising and clipping) were presented respectively for the malicious updates and the weak manipulations of the model. To thwart inference attacks, private BAFFLE was built to evaluate the BAFFLE algorithm under encryption using secure computation techniques.

[Strengths]

1. The paper is clear, logical, and easy to follow.
2. The topic of simultaneously defending against the backdoor and the inference attacks is significant.
3. Evaluations were conducted on multiple datasets and applications, including image classiﬁcation, word prediction, and IoT intrusion detection.

[Weaknesses]

1. The topic is significant but the contributions to the proposed approach are limited.
2. To impede backdoor attacks, many models are marked as outliers and discarded, clipped, and noised, generally speaking, which could lead to performance degradation. However, there is only a negligible effect on performance. What is the cause of this phenomenon？
3. In FL, clients locally train model updates using private data and provide these to a central aggregator. If some models were directly discarded in the central aggregator, the corresponding private data are not utilized for model training which is not an ideal approach, especially, the private data is irreplaceable.
4. Clipping and noising are the means of eliminating weak manipulations. How about the settings of them affect the results? Some analysis and ablation experiments are needed.

After reading the response, I still think that the work is promising and would like to keep my recommendation. 
review_title: an interesting work

final_score: rating: 4: Ok but not good enough - rejection
review_content: This paper provides an interesting research direction for the cross-domain of federating learning and backdoor attacks. This direction has very limited work until the recent 2 years. The work being proposed in this manuscript is simple and straightforward to implement. The pipeline has been clearly demonstrated. The experiments have multiple aspects presented and show promising results in various metrics.

pros:
- Novel problem, may attract massive attention
- Simple and intuitive pipeline, conceptually easy to implement
- Results are versatile, many comparison tables are provided

cons:
- Whole article is not self-contained, feel the connections between modules are very loose
- The design of the pipeline is very ad-hoc, so many engineering aspects can be tweaked and the performance could be dramatically altered. 
- The experiments could use a few popular trojan attack methods, the baselines are not comprehensive. 

concerns:
- My major concern comes from the design of the pipeline and the experiments. The author(s) have created many splendid terms to describe the modules used in this work, however, their implementation uses both clustering and median, which is very engineering and may not reliable with a different clustering algorithm or data set is severely unbalanced (just like the non-iid data sets among clients). This kind of uncertainty due to the ad-hoc nature of the pipeline causes me to wonder: how bad this framework can be if any of the carefully cherry-picked modules fails its purpose? The mathematical motivation of this paper is missing and this causes the impression of untrustedness on the model design. It would be better if the author(s) can 1. provide some mathematical proofs or derivations to support your design. 2. provide a lower bound or upper bound for performance guarantee. 

- Please compare it with a few Trojan attack methods in recent years. I believe no matter what kind of backdoor and Trojan attack, can be easily applied to FL by applying them individually on each client without too much trouble. 
An Embarrassingly Simple Approach for Trojan Attack in Deep Neural Networks. KDD 2020

- For federated learning, one important experimental factor is the number of clients (K= 5, 10, 50, 100, etc), the portion of data on each client (1%, 5%, 10%, etc), and data distribution assumption (iid, non-iid with feature shift or label shift, etc). Please evaluate the results by changing these important hyperparameters.

- The holomorphic encryption is a pretty standard concept in FL, I don't understand why the author(s) have listed this as the major contribution for the work. Especially, only one paper from 1986 is mentioned and nothing especially has been proposed in this work. It is just an unusual way to list your contribution. 

- Code is not provided, I can not see the reproducibility of this work.

minor:
please attach your main context pdf in the submission and submit the appendix in the supplementary material
review_title: a novel pipeline for robust FL against backdoor attack

final_score: rating: 6: Marginally above acceptance threshold
review_content: This paper suggests a new solution to protect FL models from backdoor attacks. Under the backdoor attack, an adversary can manipulate a few clients' weight matrices to affect the final global model. In particular, the adversary wants the final model to make an incorrect prediction for certain inputs. 

This paper's main idea to defend against a backdoor attack is to use clustering and adaptive clipping and noising. In the clustering phase, the aggregator uses a clustering technique to identifies the weight matrices that have been manipulated by the adversary. In the clipping and noising phase, the aggregator tries to mitigate the effect of manipulated weight matrices that could not be identified in the filtering phase. 

Strengths: This paper uses an existing clustering algorithm (the HDBSCAN clustering algorithm (Campello et al., 2013)) that works best in the FL problem in identifying manipulated weight matrices. Using this clustering algorithm combined with adaptive clipping and noising, the proposed method can mitigate the backdoor attack. Moreover, BAFFLE, combined with the Secure-Two-Party Computation method, can protect the FL model from Inference attacks. The extensive numerical examples show that the proposed method outperforms other defense methods most of the time. 

Weaknesses: This paper does not provide any theoretical guarantee and only applies the existing methods to mitigate the backdoor attacks. Therefore, we cannot make sure that the proposed method works in any problem or on any dataset. As the numerical examples show (e.g., see Table 2), BAFFLE cannot outperform other defense methods all the time.

Due to the lack of theoretical analysis or developing a new method/algorithm, I vote for weak acceptance (6). I ask the authors to clarify/explain the $\bf{\underline{novelty}}$ of their algorithms during the discussion period. 


review_title: Baffle is a new technique to protect FL model from backdoor attack through filtering and adaptive clipping and noising

Meta-review: The paper makes an attempt towards byzantine resilient federated learning, in the pressneece of backdoor attacks. 

The method presented combines a clustering step with a poison elimination step, and seems to be effective against a range of current attacks. 

Both steps are a bit ad hoc in nature, and do not come with provable guarantees.

Moreover, the algorithms presented will have a big negative impact on personalization as several models may be incorrectly discarded during and FL round.

The authors further point in their response that " no existing defense against backdoor attacks preserves the privacy of the clients’ data." This is in fact not true, as the differential privacy defense presented by the "Can you really backdoor FL" paper is in fact fully respective of user privacy.

At the same time, the work on backdoor attacks and defenses is reminiscent of the "cat and mouse" work in adversarial examples: an attack comes out, then a defense claims to protect against it, then an attack that incorporates that defense can be made stronger, and so on. This is similar in the context of backdoor attacks.

In fact, a recent work [1] proposes that detecting backdoors is in the general computationally unlikely, rendering the generality of the proposed algorithm questionable, and also suggest a set of attacks that seem very hard to defend against. (it is fine that the authors do not reference this work as it was published just recently)

As the paper lacks significant algorithmic novelty, solid guarantees, and also is unclear whether it is universally sound, the overall contribution is limited. 

[1] Wang et al. Attack of the tails: Yes, you really can backdoor federated learning, neurips 2020
https://papers.nips.cc/paper/2020/file/b8ffa41d4e492f0fad2f13e29e1762eb-Paper.pdf

Decision: Reject