Question: What configuration of FLTrust was used? The size of the validation set used in FLTrust can make a difference as can the degree of non-iid bias.
Evidence: We evaluate the efficacy in detecting malicious nodes within the federated learning framework with the use of three Datasets. The first is the FASHION-MNIST dataset, a dataset of 60,000 and 10,000 training and testing samples respectively divided into 10 classes of apparel. The second is CIFAR-10 (, a dataset of 60,000 small object images also containing 10 object classes. The third is MNIST) dataset which appears in Appendix H.
In these experiments we mainly adopt implementations of Byzantine attacks released by and the label flipping attack. The label flipping attack is a data poisoning attack that alters one or more labels of training data to an attacker's pre-determined target label. For example, in CIFAR-10's object labels, an attacker may change the labels of their local cat images to be labelled as dogs. We use the Label Flipping attack as a comparative poisoning attack that achieves its objective in a more subtle manner. In our experiments, we set Σ = 30I for the Gaussian attack and r = 3 for the sign flipping attack, where I is the identity matrix. For all experiments we fix n = 100 participating nodes, of which a variable number of nodes are poisoned |n 0 | ∈ {5, 10, 15, 20, 25, 30}. The training process is run until 25 epochs have elapsed. We have described the structure of these networks in Appendix A.
We evaluate the efficacy in detecting malicious nodes within the federated learning framework with the use of three Datasets. The first is the FASHION-MNIST dataset, a dataset of 60,000 and 10,000 training and testing samples respectively divided into 10 classes of apparel. The second is CIFAR-10 (, a dataset of 60,000 small object images also containing 10 object classes. The third is MNIST) dataset which appears in Appendix H.
In these experiments we mainly adopt implementations of Byzantine attacks released by and the label flipping attack. The label flipping attack is a data poisoning attack that alters one or more labels of training data to an attacker's pre-determined target label. For example, in CIFAR-10's object labels, an attacker may change the labels of their local cat images to be labelled as dogs. We use the Label Flipping attack as a comparative poisoning attack that achieves its objective in a more subtle manner. In our experiments, we set Σ = 30I for the Gaussian attack and r = 3 for the sign flipping attack, where I is the identity matrix. For all experiments we fix n = 100 participating nodes, of which a variable number of nodes are poisoned |n 0 | ∈ {5, 10, 15, 20, 25, 30}. The training process is run until 25 epochs have elapsed. We have described the structure of these networks in Appendix A.
We evaluate the efficacy in detecting malicious nodes within the federated learning framework with the use of three Datasets. The first is the FASHION-MNIST dataset (Xiao et al., 2017), a dataset of 60,000 and 10,000 training and testing samples respectively divided into 10 classes of apparel. The second is CIFAR-10 (Krizhevsky et al., 2009), a dataset of 60,000 small object images also containing 10 object classes. ****For all experiments we fix n = 100 participating nodes, of which a variable number of nodes are poisoned |n0| ∈ {5, 10, 15, 20, 25, 30}.
Answer: We understand your description of ‘the validation set’ for FLTrust as the ‘root dataset’. In our paper, the root dataset is chosen as follows: the 60000 samples are randomly divided into 100 chunks, and 10 chunks are randomly chosen as the root dataset. Therefore, the resulting sample size in the root dataset is 6000. While the default sample size in FLTrust is 100. Our setting should be beneficial to FLTrust. As you can see, the root dataset is a set of iid samples. More details about data split can be found in ref [1].