SlowGuess/NeurIPS_2023_OCR huggingface dataset:
$$
\begin{array}{l} \mathbb {E} \left[ \sum_ {k = 0} ^ {K - 1} \langle F (\widetilde {\boldsymbol {x}} ^ {k}) - \overline {{\boldsymbol {g}}} _ {\boldsymbol {\eta} ^ {k}} (\widetilde {\boldsymbol {x}} ^ {k}), \widetilde {\boldsymbol {x}} ^ {k} \rangle \right] = \mathbb {E} \left[ \sum_ {k = 0} ^ {K - 1} \langle \mathbb {E} [ F (\widetilde {\boldsymbol {x}} ^ {k}) - \overline {{\boldsymbol {g}}} _ {\boldsymbol {\eta} ^ {k}} (\widetilde {\boldsymbol {x}} ^ {k}) | \widetilde {\boldsymbol {x}} ^ {k} ], \widetilde {\boldsymbol {x}} ^ {k} \rangle \right] = 0, \\ \mathbb {E} \left[ \sum_ {k = 0} ^ {K - 1} \langle F (\widetilde {\boldsymbol {x}} ^ {k}) - \overline {{\boldsymbol {g}}} _ {\boldsymbol {\eta} ^ {k}} (\widetilde {\boldsymbol {x}} ^ {k}), \boldsymbol {x} ^ {0} \rangle \right] = \sum_ {k = 0} ^ {K - 1} \left\langle \mathbb {E} [ F (\widetilde {\boldsymbol {x}} ^ {k}) - \overline {{\boldsymbol {g}}} _ {\boldsymbol {\eta} ^ {k}} (\widetilde {\boldsymbol {x}} ^ {k}) ], \boldsymbol {x} ^ {0} \right\rangle = 0, \\ \end{array}
$$
$$
\begin{array}{l} 2 \gamma_ {2} \mathbb {E} \left[ \max  _ {\boldsymbol {u} \in B _ {R} (x ^ {*})} \sum_ {k = 0} ^ {K - 1} \langle F (\widetilde {\boldsymbol {x}} ^ {k}) - \bar {\boldsymbol {g}} _ {\boldsymbol {\eta} ^ {k}} (\widetilde {\boldsymbol {x}} ^ {k}), \widetilde {\boldsymbol {x}} ^ {k} - \boldsymbol {u} \rangle \right] \\ = \quad 2 \gamma_ {2} \mathbb {E} \left[ \sum_ {k = 0} ^ {K - 1} \langle F (\widetilde {\boldsymbol {x}} ^ {k}) - \overline {{\boldsymbol {g}}} _ {\boldsymbol {\eta} ^ {k}} (\widetilde {\boldsymbol {x}} ^ {k}), \widetilde {\boldsymbol {x}} ^ {k} \rangle \right] \\ + 2 \gamma_ {2} \mathbb {E} \left[ \max  _ {\boldsymbol {u} \in B _ {R} (x ^ {*})} \sum_ {k = 0} ^ {K - 1} \langle F (\widetilde {\boldsymbol {x}} ^ {k}) - \overline {{\boldsymbol {g}}} _ {\boldsymbol {\eta} ^ {k}} (\widetilde {\boldsymbol {x}} ^ {k}), - \boldsymbol {u} \rangle \right] \\ = \quad 2 \gamma_ {2} \mathbb {E} \left[ \max  _ {\boldsymbol {u} \in B _ {R} (x ^ {*})} \sum_ {k = 0} ^ {K - 1} \langle F (\widetilde {\boldsymbol {x}} ^ {k}) - \overline {{\boldsymbol {g}}} _ {\boldsymbol {\eta} ^ {k}} (\widetilde {\boldsymbol {x}} ^ {k}), - \boldsymbol {u} \rangle \right] \\ = \quad 2 \gamma_ {2} \mathbb {E} \left[ \sum_ {k = 0} ^ {K - 1} \langle F (\widetilde {\boldsymbol {x}} ^ {k}) - \overline {{\boldsymbol {g}}} _ {\boldsymbol {\eta} ^ {k}} (\widetilde {\boldsymbol {x}} ^ {k}), \boldsymbol {x} ^ {0} \rangle \right] \\ + 2 \gamma_ {2} \mathbb {E} \left[ \max  _ {\boldsymbol {u} \in B _ {R} (x ^ {*})} \sum_ {k = 0} ^ {K - 1} \langle F (\widetilde {\boldsymbol {x}} ^ {k}) - \overline {{\boldsymbol {g}}} _ {\boldsymbol {\eta} ^ {k}} (\widetilde {\boldsymbol {x}} ^ {k}), - \boldsymbol {u} \rangle \right] \\ = \quad 2 \gamma_ {2} K \mathbb {E} \left[ \max  _ {\boldsymbol {u} \in B _ {R} \left(x ^ {*}\right)} \left\langle \frac {1}{K} \sum_ {k = 0} ^ {K - 1} \left(F \left(\widetilde {\boldsymbol {x}} ^ {k}\right) - \bar {\boldsymbol {g}} _ {\boldsymbol {\eta} ^ {k}} \left(\widetilde {\boldsymbol {x}} ^ {k}\right)\right), \boldsymbol {x} ^ {0} - \boldsymbol {u} \right\rangle \right] \\ \end{array}
$$
$$
\begin{array}{l} \stackrel {(1 1)} {\leq} \quad 2 \gamma_ {2} K \mathbb {E} \left[ \max  _ {\boldsymbol {u} \in B _ {R} (x ^ {*})} \left\{\frac {\gamma_ {2}}{2} \left\| \frac {1}{K} \sum_ {k = 0} ^ {K - 1} \left(F \left(\widetilde {\boldsymbol {x}} ^ {k}\right) - \overline {{\boldsymbol {g}}} _ {\boldsymbol {\eta} ^ {k}} \left(\widetilde {\boldsymbol {x}} ^ {k}\right)\right) \right\| ^ {2} + \frac {1}{2 \gamma_ {2}} \| \boldsymbol {x} ^ {0} - \boldsymbol {u} \| ^ {2} \right\} \right] \\ = \gamma_ {2} ^ {2} \mathbb {E} \left[ \left\| \sum_ {k = 0} ^ {K - 1} \left(F \left(\widetilde {\boldsymbol {x}} ^ {k}\right) - \overline {{\boldsymbol {g}}} _ {\boldsymbol {\eta} ^ {k}} \left(\widetilde {\boldsymbol {x}} ^ {k}\right)\right) \right\| ^ {2} \right] + \max  _ {\boldsymbol {u} \in B _ {R} \left(x ^ {*}\right)} \| \boldsymbol {x} ^ {0} - \boldsymbol {u} \| ^ {2}. \\ \end{array}
$$
We notice that  $\mathbb{E}[F(\widetilde{\boldsymbol{x}}^k) - \overline{\boldsymbol{g}}_{\eta^k}(\widetilde{\boldsymbol{x}}^k)\mid F(\widetilde{\boldsymbol{x}}^0) - \overline{\boldsymbol{g}}_{\eta^0}(\widetilde{\boldsymbol{x}}^0),\ldots ,F(\widetilde{\boldsymbol{x}}^{k - 1}) - \overline{\boldsymbol{g}}_{\eta^{k - 1}}(\widetilde{\boldsymbol{x}}^{k - 1})] = 0$  for all  $k\geq 1$ , i.e., conditions of Lemma C.2 are satisfied. Therefore, applying Lemma C.2, we get
$$
2 \gamma_ {2} \mathbb {E} \left[ \max  _ {\boldsymbol {u} \in B _ {R} \left(x ^ {*}\right)} \sum_ {k = 0} ^ {K - 1} \langle F \left(\widetilde {\boldsymbol {x}} ^ {k}\right) - \bar {\boldsymbol {g}} _ {\boldsymbol {\eta} ^ {k}} \left(\widetilde {\boldsymbol {x}} ^ {k}\right), \widetilde {\boldsymbol {x}} ^ {k} - \boldsymbol {u} \rangle \right] \tag {83}
$$
$$
\begin{array}{l} \leq \gamma_ {2} ^ {2} \sum_ {k = 0} ^ {K - 1} \mathbb {E} [ \| F (\widetilde {\boldsymbol {x}} ^ {k}) - \overline {{\boldsymbol {g}}} _ {\boldsymbol {\eta} ^ {k}} (\widetilde {\boldsymbol {x}} ^ {k}) \| ^ {2} ] (84) \\ + \max  _ {\boldsymbol {u} \in B _ {R} \left(x ^ {*}\right)} \| \boldsymbol {x} ^ {0} - \boldsymbol {u} \| ^ {2} (85) \\ \end{array}
$$
$$
\leq \frac {\gamma_ {2} ^ {2} K \sigma^ {2}}{n - 2 B - m} + \max  _ {\boldsymbol {u} \in B _ {R} \left(x ^ {*}\right)} \| \boldsymbol {x} ^ {0} - \boldsymbol {u} \| ^ {2} \tag {86}
$$
$$
\stackrel {(5 9), (6 0)} {\leq} \frac {9}{8} R ^ {2}. \tag {87}
$$
$$
2 \gamma_ {2} K \mathbb {E} \operatorname {G a p} _ {B _ {R} \left(x ^ {*}\right)} \left(\overline {{\boldsymbol {x}}} ^ {K}\right) \leq \frac {R ^ {2}}{3 2} + \frac {R ^ {2}}{5} + \frac {R ^ {2}}{4} + \frac {3}{4} R ^ {2} + \frac {9}{8} R ^ {2} \leq 3 R ^ {2}. \tag {88}
$$
Corollary 10. Let assumptions of Theorem 12 hold. Then  $\mathbb{E}\left[\mathcal{G}a\mathfrak{p}_{B_R(x^*)}\big(\overline{\mathbf{x}}^K\big)\right] \leq \varepsilon$  holds after
$$
K = \mathcal {O} \left(\frac {L R ^ {2}}{\varepsilon} + \frac {\sigma^ {2} R ^ {2}}{n \varepsilon^ {2}} + \frac {\sigma n ^ {2} R}{m \varepsilon}\right)
$$
iterations of SEG-CC.
$$
\begin{array}{l} \mathbb {E} \left[ \operatorname {G a p} _ {B _ {R} \left(x ^ {*}\right)} \left(\overline {{\boldsymbol {x}}} ^ {K}\right) \right] \leq \frac {3 R ^ {2}}{2 \gamma_ {2} K} \leq \frac {3 R ^ {2}}{2 K} \left(4 L + \sqrt {\frac {6 4 \sigma^ {2} K}{(n - 2 B - m) R ^ {2}}} + \sqrt {\frac {6 4 \rho^ {2} B ^ {2} n ^ {2}}{m ^ {2} R ^ {2}}}\right) \\ \leq \frac {6 R ^ {2}}{K} + \sqrt {\frac {1 4 4 \sigma^ {2} R ^ {2}}{(n - 2 B - m) K}} + \frac {1 2 \rho B n R}{m K} \\ \end{array}
$$
$$
K = \max \bigg (\frac {1 8 L R ^ {2}}{\varepsilon}, \frac {1 4 4 \cdot 9 \sigma^ {2} R ^ {2}}{(n - 2 B - m) \varepsilon^ {2}}, \frac {3 6 \rho B n R}{m \varepsilon} \bigg),
$$
E.4 Proofs for R-SEG-CC
E.4.1 Quasi Strongly Monotone Case
Algorithm 8 R-SEG-CC
Input:  $x^0$  - starting point,  $r$  - number of restarts,  $\{\gamma_t\}_{t=1}^r$  - stepsizes for SEG-CC (Alg. 7),  $\{K_t\}_{t=1}^r$  - number of iterations for SEG-CC (Alg. 7), 1:  $\widehat{x}^0 = x^0$
2: for  $t = 1, 2, \ldots, r$  do
3: Run SEG-CC (Alg. 7) for  $K_{t}$  iterations with stepsize  $\gamma_{t}$ , starting point  $\widehat{\pmb{x}}^{t - 1}$
4: Define  $\widehat{\pmb{x}}^t$  as  $\widehat{\pmb{x}}^t = \frac{1}{K_t}\sum_{k = 0}^{K_t}\pmb{x}^{k,t}$ , where  $\pmb{x}^{0,t},\pmb{x}^{1,t},\dots,\pmb{x}^{K_t,t}$  are the iterates produced by SEG-CC.
Output:  $\hat{\pmb{x}}^r$
Theorem (Theorem 7 duplicate). Let Assumptions 1, 3, 4 hold. Then, after  $r = \left\lceil \log_2 \frac{R^2}{\varepsilon} \right\rceil - 1$  restarts R-SEG-CC (Algothm 8) with  $\gamma_{1_t} = \min \left\{\frac{1}{2L}, \sqrt{\frac{(G-B-m)R^2}{16\sigma^22^tK_t}}, \sqrt{\frac{mR^2}{8q\sigma^22^tBn}}\right\}$ ,  $\gamma_{2_t} = \min \left\{\frac{1}{4L}, \sqrt{\frac{m^2R^2}{64q\sigma^22^tB^2n^2}}, \sqrt{\frac{(G-B-m)R^2}{64\sigma^2K_t}}\right\}$  and  $K_t = \left\lceil \max \left\{\frac{8L}{\mu}, \frac{16n\sigma B\sqrt{q2^t}}{m\mu R}, \frac{256\sigma^22^t}{(G-B-m)\mu^2R^2}\right\} \right\rceil$ , where  $R \geq \| x^0 - x^* \|$  outputs  $\widehat{x}^r$  such that  $\mathbb{E}\| \widehat{x}^r - x^* \|^2 \leq \varepsilon$ . Moreover, the total number of executed iterations of SEG-CC is
$$
\sum_ {t = 1} ^ {r} K _ {t} = \mathcal {O} \left(\frac {\ell}{\mu} \log \frac {\mu R _ {0} ^ {2}}{\varepsilon} + \frac {\sigma^ {2}}{(n - 2 B - m) \mu \varepsilon} + \frac {n B \sigma}{m \sqrt {\mu \varepsilon}}\right). \tag {89}
$$
Proof of Theorem 7.  $\overline{\boldsymbol{x}}^K = \frac{1}{K}\sum_{k = 0}^{K - 1}\widetilde{\boldsymbol{x}}^k$
$$
\begin{array}{l} \mu \mathbb {E} \left[ \left\| \overline {{\boldsymbol {x}}} ^ {K} - \boldsymbol {x} ^ {*} \right\| ^ {2} \right] = \mu \mathbb {E} \left[ \left\| \frac {1}{K} \sum_ {k = 0} ^ {K - 1} \left(\widetilde {\boldsymbol {x}} ^ {k} - \boldsymbol {x} ^ {*}\right) \right\| ^ {2} \right] \leq \mu \mathbb {E} \left[ \frac {1}{K} \sum_ {k = 0} ^ {K - 1} \left\| \widetilde {\boldsymbol {x}} ^ {k} - \boldsymbol {x} ^ {*} \right\| ^ {2} \right] \\ = \frac {\mu}{K} \sum_ {k = 0} ^ {K - 1} \mathbb {E} \left[ \left\| \widetilde {\boldsymbol {x}} ^ {k} - \boldsymbol {x} ^ {*} \right\| ^ {2} \right] \stackrel {(Q S M)} {\leq} \frac {1}{K} \sum_ {k = 0} ^ {K - 1} \mathbb {E} \left[ \langle F (\widetilde {\boldsymbol {x}} ^ {k}), \widetilde {\boldsymbol {x}} ^ {k} - \boldsymbol {x} ^ {*} \rangle \right]. \\ \end{array}
$$
Theorem 11 implies that SEG-CC with
$$
\gamma_ {1} = \min \left\{\frac {1}{2 L}, \sqrt {\frac {(n - 2 B - m) R ^ {2}}{1 6 \sigma^ {2} K}}, \sqrt {\frac {m R ^ {2}}{8 \rho^ {2} B n}} \right\},
$$
$$
\gamma_ {2} = \min \left\{\frac {1}{4 L}, \sqrt {\frac {m ^ {2} R ^ {2}}{6 4 \rho^ {2} B ^ {2} n ^ {2}}}, \sqrt {\frac {(n - 2 B - m) R ^ {2}}{6 4 \sigma^ {2} K}} \right\},
$$
$$
\mu \mathbb {E} \left[ \left\| \overline {{\boldsymbol {x}}} ^ {K} - \boldsymbol {x} ^ {*} \right\| ^ {2} \right] \leq \frac {R _ {0} ^ {2}}{\gamma_ {2} K}
$$
$$
\mathbb {E} \left[ \left\| \widehat {\boldsymbol {x}} ^ {1} - \boldsymbol {x} ^ {*} \right\| ^ {2} \right] \leq \frac {R _ {0} ^ {2}}{\mu \gamma_ {2 _ {1}} K _ {1}} \leq \frac {R _ {0} ^ {2}}{2},
$$
since  $\mu \gamma_{2_1}K_1\geq 2$
Next, assume that we have  $\mathbb{E}[\| \widehat{\pmb{x}}^t -\pmb{x}^*\|^2 ]\leq \frac{R_0^2}{2^t}$  for some  $t\leq r - 1$ . Then, Theorem 11 implies that
$$
\mathbb {E} \left[ \left\| \widehat {\boldsymbol {x}} ^ {t + 1} - \boldsymbol {x} ^ {*} \right\| ^ {2} \mid \widehat {\boldsymbol {x}} ^ {t} \right] \leq \frac {\| \widehat {\boldsymbol {x}} ^ {t} - \boldsymbol {x} ^ {*} \| ^ {2}}{\mu \gamma_ {2 _ {t}} K _ {t}}.
$$
$$
\mathbb {E} \left[ \left\| \widehat {\boldsymbol {x}} ^ {t + 1} - \boldsymbol {x} ^ {*} \right\| ^ {2} \right] \leq \frac {\mathbb {E} [ \| \widehat {\boldsymbol {x}} ^ {t} - \boldsymbol {x} ^ {*} \| ^ {2} ]}{\mu \gamma_ {2 _ {t}} K _ {t}} \leq \frac {R _ {0} ^ {2}}{2 ^ {t} \mu \gamma_ {2 _ {t}} K _ {t}} \leq \frac {R _ {0} ^ {2}}{2 ^ {t + 1}}.
$$
Then, after  $r = \left\lceil \log_2\frac{R_0^2}{\varepsilon}\right\rceil -1$  restarts of SEG-CC we have  $\mathbb{E}\left[\| \widehat{\pmb{x}}^r -\pmb{x}^*\| ^2\right]\leq \varepsilon$ . The total number of iterations executed by SEG-CC is
$$
\begin{array}{l} \sum_ {t = 1} ^ {r} K _ {t} = \mathcal {O} \left(\sum_ {t = 1} ^ {r} \max  \left\{\frac {L}{\mu}, \frac {\sigma^ {2} 2 ^ {t}}{(n - 2 B - m) \mu^ {2} R _ {0} ^ {2}}, \frac {n B \rho 2 ^ {\frac {t}{2}}}{m \mu R _ {0}} \right\}\right) \\ = \mathcal {O} \left(\frac {L}{\mu} r + \frac {\sigma^ {2} 2 ^ {r}}{(n - 2 B - m) \mu^ {2} R _ {0} ^ {2}} + \frac {n B \rho 2 ^ {\frac {r}{2}}}{m \mu R _ {0}}\right) \\ { = } { \mathcal { O } \left( \frac { L } { \mu } \log \frac { \mu R _ { 0 } ^ { 2 } } { \varepsilon } + \frac { \sigma ^ { 2 } } { ( n - 2 B - m ) \mu ^ { 2 } R _ { 0 } ^ { 2 } } \cdot \frac { \mu R _ { 0 } ^ { 2 } } { \varepsilon } + \frac { n B \rho } { m \mu R _ { 0 } } \cdot \sqrt { \frac { \mu R _ { 0 } ^ { 2 } } { \varepsilon } } \right) } \\ { = } { \mathcal { O } \left( \frac { L } { \mu } \log \frac { \mu R _ { 0 } ^ { 2 } } { \varepsilon } + \frac { \sigma ^ { 2 } } { ( n - 2 B - m ) \mu \varepsilon } + \frac { n B \rho } { m \sqrt { \mu \varepsilon } } \right) , } \\ \end{array}
$$
that together with  $\rho^2 = q\sigma^2$  with  $q = 2C^2 +12 + \frac{12}{n - 2B - m}$  and  $C = \mathcal{O}(1)$  given by Lemma E.1 implies the result of the theorem.
Corollary 11. Let assumptions of 7 hold. Then  $\mathbb{E}\left[\| \widehat{\pmb{x}}^r -\pmb {x}^*\| ^2\right]\leq \varepsilon$  holds after
$$
\sum_ {t = 1} ^ {r} K _ {t} = \mathcal {O} \left(\frac {L}{\mu} \log \frac {\mu R ^ {2}}{\varepsilon} + \frac {\sigma^ {2}}{n \mu \varepsilon} + \frac {n ^ {2} \sigma}{m \sqrt {\mu \varepsilon}}\right) \tag {90}
$$
F Extra Experiments and Experimental details
F.1 Quadratic games
Firstly, let us clarify notations made in (7):
$$
\boldsymbol {x} = \left( \begin{array}{c} y \\ z \end{array} \right), \quad \mathbf {A} _ {i} = \left( \begin{array}{c c} \mathbf {A} _ {1, i} & \mathbf {A} _ {2, i} \\ - \mathbf {A} _ {2, i} & \mathbf {A} _ {3, i} \end{array} \right), \quad b _ {i} = \left( \begin{array}{c} b _ {1, i} \\ b _ {2, i} \end{array} \right),
$$
with symmetric matrices  $\mathbf{A}_{j,i}$  s.t.  $\mu \mathbf{I} \preccurlyeq \mathbf{A}_{j,i} \preccurlyeq \ell \mathbf{I}, \mathbf{A}_i \in \mathbb{R}^{d \times d}$  and  $b_i \in \mathbb{R}^d$ .
Data generation. For each  $j$  we sample real random matrix  $\mathbf{B}_i$  with elements sampled from a normal distribution. Then we compute the eigendecomposition and obtain the following  $\mathbf{B}_i = \mathbf{U}_i^T\mathbf{D}_i\mathbf{U}_i$  with diagonal  $\mathbf{D}_i$ . Next, we scale  $\mathbf{D}_i$  and obtain  $\widehat{\mathbf{D}}_i$  with elements lying in  $[\mu, \ell]$ . Finally we compose  $\mathbf{A}_{j,i}$  as  $\mathbf{A}_{j,i} = \mathbf{U}_i^T\widehat{\mathbf{D}}_i\mathbf{U}_i$ . This process ensures that eigenvalues of  $\mathbf{A}_{j,i}$  all lie between  $\mu$  and  $\ell$ , and thus  $F(\boldsymbol{x})$  is strongly monotone and cocoercive. Vectors  $b_i \in \mathbb{R}^d$  are sampled from a normal distribution with variance  $10 / d$ .
Experimental setup. For all the experiments we choose  $\ell = 100$ ,  $\mu = 0.1$ ,  $s = 1000$  and  $d = 50$ .
For the experiments presented in the Appendix we simulate  $n = 20$  nodes on a single machine and  $B = 4$ . For methods with checks of computations the only one peer attacks per iteration.
We used RFA with 5 buckets bucketing as an aggregator since it showed the best performance. For approximating the median we used Weiszfeld's method with 10 iterations and parameter  $\nu = 0.1$  Pillutla et al. [2022].
RDEG [Adibi et al., 2022] provably works only if  $n \geq 100$  we manually selected parameter  $\epsilon = 0.5$  using a grid-search and picking the best performing value.
We present experiments with different attack (bit flipping (BF), random noise (RN), inner product manipulation (IPM) Xie et al. [2019] and "a little is enough" (ALIE) Baruch et al. [2019]) and different batchsizes (bs) 1, 10 and 100. If an attack has a parameter it is specified in the brackets on each plot.
No checks. Firstly we provide a detailed comparison between methods that do not check computation with fixed learning rate value  $\gamma = 3.3e - 5$ . Code for quadratic games is available at https://github.com/nazya/sgda-ra<sup>7</sup>.
7Code is based on https://github.com/hugobb/sgda
Figure 3: Distance to the solution ALIE attack with various of parameter values and batchsizes.
Figure 4: Distance to the solution BF attack with various batchsizes.
Figure 5: Distance to the solution under IPM attack with various parameter values and batchsizes.
Figure 6: Distance to the solution under RN attack with various parameter values and batchsizes.
Checks of Computations. Next, using the same setup, we compare M-SGDA-RA, which showed the best performance in the above experiments, with methods that check computations. With checks of computation the best strategy for attackers is that at each iteration only one peer attacks, since it maximizes the expected number of rounds with the presence of actively malicious peers. So the comparison in this paragraph is performed in this setup.
Figure 7: Distance to the solution under ALIE attack with various parameter values and batchsizes.
Figure 8: Distance to the solution under BF attack with various batchsizes.
Figure 9: Distance to the solution under IPM attack with various parameter values and batchsizes.
Figure 10: Distance to the solution under RN attack with various parameter values and batchsizes.
Learning rates. We conducted extra experiments to show the dependence on different learning rate values  $1e - 5, 2e - 5, 5e - 6$ .
Figure 11: Distance to the solution under various attacks, batchesizes (bs) and learning rates (lr).
F.2 Generative Adversarial Networks
One of the most well-known frameworks in which the objective function is a variational inequality is generative adversarial networks (GAN) Goodfellow et al. [2014]. In the simplest case of this setting, we have a generator  $G: \mathbb{R}^z \to \mathbb{R}^d$  and a discriminator  $D: \mathbb{R}^d \to \mathbb{R}$ , where  $z$  denotes the dimension of the latent space. The objective function can be written as
$$
\min  _ {G} \max  _ {D} \quad \mathbb {E} _ {x} \log (D (x)) + \mathbb {E} _ {z} \log (1 - D (G (z))). \tag {91}
$$
Here, it is understood that  $D$  and  $G$  are modeled as neural nets and can be optimized in the distributed setting with gradient descent ascent algorithms. However, due to the complexity of the GANs framework, tricks and adjustments are being employed to ensure good results, such as the Wasserstein GAN formulation [Gulrajani et al., 2017] with Lipschitz constraint on  $D$  and the spectral normalization [Miyato et al., 2018] trick to ensure the Lipschitzness of  $D$ . The discriminator can thus benefit in practice from multiple gradient ascent steps per gradient descent step on the generator. In addition, Adam [Kingma and Ba, 2014] is often used for GANs as they can be very slow to converge and not perform as well with vanilla SGD.
Therefore, in our implementation of GANs in the distributed setting, we employ all of these techniques and show improvements when we add checks of gradient computations to the server. As for the gradients in our implementation, we can think of the accumulated Adam steps within the clients as "generalized gradients" and aggregate them in the server with checks of computations (by rewinding model and optimizer state). We tried aggregation after each descent or ascent step, after full descent-ascent step, and after multiple descent-ascent steps. For the first case, we found that GANs converge much more slowly. For the third case, the performance is better but checks of computations take more time. Thus, we choose to report the performance for the second case: aggregations of a full descent-ascent step. Though, we note that experiments for the other cases suggest similar improvements.
The dataset we chose for this experiment is CIFAR-10 [Krizhevsky et al., 2009] because it is more realistic than MNIST yet is still tractable to simulate in the distributed setting. We let  $n = 10$ ,  $B = 2$ , and choose a learning rate of 0.001,  $\beta_{1} = 0.5$ , and  $\beta_{2} = 0.9$  with a batch size of 64. We run the algorithms for 4600 epochs. We could not average across runs as the simulation is very compute intensive and the benefits are obvious. We compare SGDA-RA (RFA with bucket size 2) and SGDA-CC under the following byzantine attacks: i) no attack (NA), ii) label flipping (LF), iii) inner product manipulation (IPM) [Xie et al., 2019], and iv) a little is enough (ALIE) [Baruch et al., 2019]. The architecture of the GAN follows Miyato et al. [2018].
We show the results in Figure 12. The improvements are most significant for the ALIE attack. Even when no attacks are present, checks of computations only slightly affects convergence speed. This experiment should further justify our proposed algorithm and its real-world benefits even for a setting as complex as distributed GANs. Code for GANs is available at https://github.com/zeligism/ vi-robust-agg.
Figure 12: Comparison of FID to CIFAR-10 per epoch between SGDA-CC and SGDA-RA. The FID is calculated on 50,000 samples. (lower = better).