SlowGuess/NeurIPS_2023_OCR huggingface dataset:
Nazarii Tupitsa MBZUAI,MIPT
Abdulla Jasem Almansoori MBZUAI
Yanlin Wu MBZUAI
Martin Takáč  
MBZUAI
Karthik Nandakumar MBZUAI
Samuel Horváth MBZUAI
Eduard Gorbunov* MBZUAI
Robustness to Byzantine attacks is a necessity for various distributed training scenarios. When the training reduces to the process of solving a minimization problem, Byzantine robustness is relatively well-understood. However, other problem formulations, such as min-max problems or, more generally, variational inequalities, arise in many modern machine learning and, in particular, distributed learning tasks. These problems significantly differ from the standard minimization ones and, therefore, require separate consideration. Nevertheless, only one work [Adibi et al., 2022] addresses this important question in the context of Byzantine robustness. Our work makes a further step in this direction by providing several (provably) Byzantine-robust methods for distributed variational inequality, thoroughly studying their theoretical convergence, removing the limitations of the previous work, and providing numerical comparisons supporting the theoretical findings.
Modern machine learning tasks require to train large models with billions of parameters on huge datasets to achieve reasonable quality. Training of such models is usually done in a distributed manner since otherwise it can take a prohibitively long time [Li, 2020]. Despite the attractiveness of distributed training, it is associated with multiple difficulties not existing in standard training.
In this work, we focus on one particular aspect of distributed learning – Byzantine tolerance/robustness – the robustness of distributed methods to the presence of Byzantine workers², i.e., such workers that can send incorrect information (maliciously or due to some computation errors/faults) and are assumed to be omniscient. For example, this situation can appear in collaborative training, when several participants (companies, universities, individuals) that do not necessarily know each other train some model together [Kijsjipongse et al., 2018, Diskin et al., 2021] or when the devices used in training are faulty [Ryabinin et al., 2021]. When the training reduces to the distributed minimization problem, the question of Byzantine robustness is studied relatively well both in theory and practice [Karimireddy et al., 2022, Lyu et al., 2020].
However, there are a lot of problems that cannot be reduced to minimization, e.g., adversarial training [Goodfellow et al., 2015, Madry et al., 2018], generative adversarial networks (GANs) [Goodfellow et al., 2014], hierarchical reinforcement learning [Wayne and Abbott, 2014, Vezhnevets et al., 2017], adversarial examples games [Bose et al., 2020], and other problems arising in game theory, control theory, and differential equations [Facchinei and Pang, 2003]. Such problems lead to min-max
*Corresponding author: eduard.gorbunov@mbzuai.ac.ae
2The term "Byzantine workers" is a standard term for the field [Lamport et al., 1982, Lyu et al., 2020]. We do not aim to offend any group of people but rather use common terminology.
or, more generally, variational inequality (VI) problems [Gidel et al., 2018] that have significant differences from minimization ones and require special consideration [Harker and Pang, 1990, Ryu and Yin, 2022]. Such problems can also be huge scale, meaning that, in some cases, one has to solve them distributedly. Therefore, similarly to the case of minimization, the necessity in Byzantine-robust methods for distributed VIs arises.
The only existing work addressing this problem is [Adibi et al., 2022], where the authors propose the first Byzantine-tolerant distributed method for min-max and VI problems called Robust Distributed Extragradient (RDEG). However, several interesting directions such as application of  $(\delta, c)$ -robust aggregation rules, client momentum [Karimireddy et al., 2021], and checks of computations [Gorbunov et al., 2022b] studied for minimization problems are left unexplored in the case of VIs. Moreover, [Adibi et al., 2022] prove the convergence to the solution's neighborhood that can be reduced only via increasing the batchsize and rely on the assumption that the number of workers is sufficiently large and the fraction of Byzantine workers is smaller than  $1/16$ , which is much smaller than for SOTA results in minimization case. Our work closes these gaps in the literature and resolves the limitations of the results from [Adibi et al., 2022].
1.1 Setting
To make the further presentation precise, we need to introduce the problem and assumptions we make. We consider the distributed unconstrained variational inequality (non-linear equation) problem<sup>3</sup>:
$$
\text {f i n d} \boldsymbol {x} ^ {*} \in \mathbb {R} ^ {d} \text {s u c h t h a t} F (\boldsymbol {x} ^ {*}) = 0, \text {w h e r e} F (\boldsymbol {x}) := \frac {1}{G} \sum_ {i \in \mathcal {G}} F _ {i} (\boldsymbol {x}), \tag {1}
$$
where  $\mathcal{G}$  denotes the set of regular/good workers and operators  $F_{i}$  have an expectation form  $F_{i}(\pmb {x})\coloneqq \mathbb{E}_{\pmb{\xi}_{i}}[\pmb{g}_{i}(\pmb {x};\pmb{\xi}_{i})]$ . We assume that  $n$  workers connected with a server take part in the learning/optimization process and  $[n] = \mathcal{G}\sqcup \mathcal{B}$ , where  $\mathcal{B}$  is the set of Byzantine workers - the subset  $\mathcal{B}$  of workers  $[n]$  that can deviate from the prescribed protocol (send incorrect information, e.g., arbitrary vectors instead of stochastic estimators) either intentionally or not and are omniscient<sup>4</sup>, i.e., Byzantine workers can know the results of computations on regular workers and the aggregation rule used by the server. The number of Byzantine workers  $B = |\mathcal{B}|$  is assumed to satisfy  $B\leq \delta n$ , where  $\delta < 1 / 2$  (otherwise Byzantines form a majority and the problem becomes impossible to solve). The number of regular workers is denoted as  $G = |\mathcal{G}|$ .
Assumptions. Here, we formulate the assumptions related to the stochasticity and properties of operators  $\{F_i\}_{i\in \mathcal{G}}$ .
Assumption 1. For all  $i \in \mathcal{G}$  the stochastic estimator  $\pmb{g}_i(\pmb{x},\pmb{\xi}_i)$  is an unbiased estimator of  $F_i(\pmb{x})$  with bounded variance, i.e.,  $\mathbb{E}_{\pmb{\xi}_i}[\pmb{g}_i(\pmb{x},\pmb{\xi}_i)] = F_i(\pmb{x})$  and for some  $\sigma \geq 0$
$$
\mathbb {E} _ {\boldsymbol {\xi} _ {i}} \left[ \| \boldsymbol {g} _ {i} (\boldsymbol {x}, \boldsymbol {\xi} _ {i}) - F _ {i} (\boldsymbol {x}) \| ^ {2} \right] \leq \sigma^ {2}. \tag {2}
$$
The above assumption is known as the bounded variance assumption. It is classical for the analysis of stochastic optimization methods [Nemirovski et al., 2009, Juditsky et al., 2011] and is used in the majority of existing works on Byzantine robustness with theoretical convergence guarantees.
Further, we assume that the data heterogeneity across the workers is bounded.
Assumption 2. There exists  $\zeta \geq 0$  such that for all  $x\in \mathbb{R}^d$
$$
\frac {1}{G} \sum_ {i \in \mathcal {G}} \| F _ {i} (\boldsymbol {x}) - F (\boldsymbol {x}) \| ^ {2} \leq \zeta^ {2}. \tag {3}
$$
Condition (3) is a standard notion of data heterogeneity in Byzantine-robust distributed optimization [Wu et al., 2020, Zhu and Ling, 2021, Karimireddy et al., 2022, Gorbunov et al., 2023a]. It is worth
<sup>3</sup>We assume that the problem (1) has a unique solution  $\pmb{x}^*$ . This assumption can be relaxed, but for simplicity of exposition, we enforce it.
This assumption gives Byzantine workers a lot of power and rarely holds in practice. Nevertheless, if the algorithm is robust to such workers, then it is provably robust to literally any type of workers deviating from the protocol.
mentioning that without any kind of bound on the heterogeneity of  $\{F_i\}_{i\in \mathcal{G}}$ , it is impossible to tolerate Byzantine workers. In addition, homogeneous case  $(\zeta = 0)$  is also very important and arises in collaborative learning, see [Kjispongse et al., 2018, Diskin et al., 2021].
Finally, we formulate here several assumptions on operator  $F$ . Each particular result in this work relies only on a subset of listed assumptions.
Assumption 3. Operator  $F:\mathbb{R}^d\to \mathbb{R}^d$  is  $L$ -Lipschitz, i.e.,
$$
\left\| F (\boldsymbol {x}) - F (\boldsymbol {y}) \right\| \leq L \| \boldsymbol {x} - \boldsymbol {y} \|, \quad \forall \boldsymbol {x}, \boldsymbol {y} \in \mathbb {R} ^ {d}. \tag {Lip}
$$
Assumption 4. Operator  $F:\mathbb{R}^d\to \mathbb{R}^d$  is  $\mu$ -quasi strongly monotone, i.e., for  $\mu \geq 0$
$$
\langle F (\boldsymbol {x}), \boldsymbol {x} - \boldsymbol {x} ^ {*} \rangle \geq \mu \| \boldsymbol {x} - \boldsymbol {x} ^ {*} \| ^ {2}, \quad \forall \boldsymbol {x} \in \mathbb {R} ^ {d}. \tag {QSM}
$$
Assumption 5. Operator  $F:\mathbb{R}^d\to \mathbb{R}^d$  is monotone, i.e.,
$$
\langle F (\boldsymbol {x}) - F (\boldsymbol {y}), \boldsymbol {x} - \boldsymbol {y} \rangle \geq 0, \quad \forall \boldsymbol {x}, \boldsymbol {y} \in \mathbb {R} ^ {d}. \tag {Mon}
$$
Assumption 6. Operator  $F:\mathbb{R}^d\to \mathbb{R}^d$  is  $\ell$ -star-cocoercive, i.e., for  $\ell \geq 0$
$$
\langle F (\boldsymbol {x}), \boldsymbol {x} - \boldsymbol {x} ^ {*} \rangle \geq \frac {1}{\ell} \| F (\boldsymbol {x}) \| ^ {2}, \quad \forall \boldsymbol {x} \in \mathbb {R} ^ {d}. \tag {SC}
$$
Assumptions 3 and 5 are quite standard for the literature on VIs. Assumptions 4 and 6 can be seen as structured non-monotonicity assumptions. Indeed, there exist examples of non-monotone (and even non-Lipschitz) operators such that Assumptions 4 and 6 hold [Loizou et al., 2021]. However, Assumptions 3 and 5 imply neither (QSM) nor (SC). It is worth mentioning that Assumption 4 is also known under different names, i.e., strong stability [Mertikopoulos and Zhou, 2019] and strong coherent [Song et al., 2020] conditions.
Robust aggregation. We use the formalism proposed by Karimireddy et al. [2021, 2022].
Definition 1.1  $((\delta, c)$ -RAGG [Karimireddy et al., 2021, 2022]). Let there exist a subset  $\mathcal{G}$  of random vectors  $\{\pmb{y}_1, \dots, \pmb{y}_n\}$  such that  $G \geq (1 - \delta)n$  for some  $\delta < 1/2$  and  $\mathbb{E} \| \pmb{y}_i - \pmb{y}_j \|^2 \leq \rho^2$  for any fixed pair  $i, j \in \mathcal{G}$  and some  $\rho \geq 0$ . Then,  $\widehat{\pmb{y}} = \mathrm{RAGG}(\pmb{y}_1, \dots, \pmb{y}_n)$  is called  $(\delta, c)$ -robust aggregator if for some constant  $c \geq 0$
$$
\mathbb {E} \left[ \| \widehat {\boldsymbol {y}} - \overline {{\boldsymbol {y}}} \| ^ {2} \right] \leq c \delta \rho^ {2}, \tag {4}
$$
where  $\overline{\mathbf{y}} = \frac{1}{G}\sum_{i\in G}y_i$ . Further, if the value of  $\rho$  is not used to compute  $\widehat{\mathbf{y}}$ , then  $\widehat{\mathbf{y}}$  is called agnostic  $(\delta, c)$ -robust aggregator and denoted as  $\widehat{\mathbf{y}} = \mathrm{ARAGG}(\mathbf{y}_1, \ldots, \mathbf{y}_n)$ .
The above definition is tight in the sense that for any estimate  $\widehat{\pmb{y}}$  the best bound one can guarantee is  $\mathbb{E}\left[\| \widehat{\pmb{y}} -\overline{\pmb{y}}\| ^2\right] = \Omega (\delta \rho^2)$  [Karimireddy et al., 2021]. Moreover, there are several examples of  $(\delta ,c)$ -robust aggregation rules that work well in practice; see Appendix B.
Another important concept for Byzantine-robust learning is the notion of permutation invariance.
Definition 1.2 (Permutation invariant algorithm). Define the set of stochastic gradients computed by each of the  $n$  workers at some round  $t$  to be  $[\tilde{\mathbf{g}}_{1,t},\dots,\tilde{\mathbf{g}}_{n,t}]$ . For a good worker  $i\in \mathcal{G}$ , these represent the true stochastic gradients whereas for a bad worker  $j\in \mathcal{B}$ , these represent arbitrary vectors. The output of any optimization algorithm ALG is a function of these gradients. A permutation-invariant algorithm is one which for any set of permutations over  $t$  rounds  $\{\pi_1,\ldots ,\pi_t\}$ , its output remains unchanged if we permute the gradients.
$$
\operatorname {A L G} \left( \begin{array}{c} [ \tilde {\boldsymbol {g}} _ {1, 1}, \dots , \tilde {\boldsymbol {g}} _ {n, 1} ], \\ \dots \\ [ \tilde {\boldsymbol {g}} _ {1, t}, \dots , \tilde {\boldsymbol {g}} _ {n, t} ] \end{array} \right) = \operatorname {A L G} \left( \begin{array}{c} [ \tilde {\boldsymbol {g}} _ {\pi_ {1} (1), 1}, \dots , \tilde {\boldsymbol {g}} _ {\pi_ {1} (n), 1} ], \\ \dots \\ [ \tilde {\boldsymbol {g}} _ {\pi_ {t} (1), t}, \dots , \tilde {\boldsymbol {g}} _ {\pi_ {t} (n), t} ] \end{array} \right)
$$
As Karimireddy et al. [2021] prove, any permutation-invariant algorithm fails to converge to any predefined accuracy of the solution (under Assumption 1) even if all regular workers have the same operators/functions, i.e., even when  $\zeta = 0$ .
Table 1: Summary of known and new complexity results for Byzantine-robust methods for distributed variational inequalities. Column "Setup" indicates the varying assumptions. By the complexity, we mean the number of stochastic oracle calls needed for a method to guarantee that Metric  $\leq \varepsilon$  (for RDEG P{Metric  $\leq \varepsilon$ }  $\geq 1 - \delta_{\mathsf{RDEG}}$ ,  $\delta_{\mathsf{RDEG}} \in (0,1]$ ) and "Metric" is taken from the corresponding column. For simplicity, we omit numerical and logarithmic factors in the complexity bounds. Column "BS" indicates the minimal batch-size used for achieving the corresponding complexity. Notation:  $c$ ,  $\delta$  are robust aggregator parameters;  $\alpha =$  momentum parameter;  $\beta =$  ratio of inner and outer stepsize in SEG-like methods;  $n =$  total numbers of peers;  $m =$  number of checking peers;  $G =$  number of peers following the protocol;  $R =$  any upper bound on  $\|x^0 - x^*\|$ ;  $\mu =$  quasi-strong monotonicity parameter;  $\ell =$  star-cocoercivity parameter;  $L =$  Lipschitzness parameter;  $\sigma^2 =$  bound on the variance. The definition  $x^T$  can vary; see corresponding theorems for the exact formulas.
Setup	Method	Citation	Metric	Complexity	BS
SC, QSM	SGDA-RA	Cor. 1	\(\frac{\ell}{\mu}+\frac{1}{c\delta n}\)	\(\frac{c\delta\sigma^2}{\mu^2\varepsilon}\)
M-SGDA-RA	Cor. 4	\(\frac{\ell}{\mu\alpha^2}+\frac{1}{c\delta\alpha n}\)	\(\frac{c\delta\sigma^2}{\alpha^2\mu^2\varepsilon}\)
SGDA-CC	Cor. 6	\(\mathbb{E}[\|\boldsymbol{x}^T-\boldsymbol{x}^*\|^2]\)	\(\frac{\ell}{\mu}+\frac{\sigma^2n^2}{\mu^2m\varepsilon}+\frac{\sigma^2n^2}{\mu^2m\varepsilon}+\frac{\sigma^2n^2}{\mu^2m\sqrt\varepsilon}\)	1
R-SGDA-CC	Cor. 8	\(\frac{\ell}{\mu}+\frac{\sigma^2}{n\mu\varepsilon}+\frac{n^2\sigma}{m\sqrt{\mu\varepsilon}}\)	1
Lip, QSM	SEG-RA	Cor. 3	\(\frac{L}{\beta\mu}+\frac{1}{\beta c\delta G}+\frac{1}{\beta}\)	\(\frac{c\delta\sigma^2}{\beta\mu^2\varepsilon}\)
SEG-CC	Cor. 9	\(\mathbb{E}[\|\boldsymbol{x}^T-\boldsymbol{x}^*\|^2]\)	\(\frac{L}{\mu}+\frac{1}{\beta}+\frac{\sigma^2}{\beta^2\mu^2n\varepsilon}+\frac{\sigma^2n^2}{\beta\mu^2m\varepsilon}+\frac{\sigma^2n^2}{\beta^2\mu^2m\sqrt\varepsilon}\)	1
R-SEG-CC	Cor. 11	\(\frac{L}{\mu}+\frac{\sigma^2}{n\mu\varepsilon}+\frac{n^2\sigma}{m\sqrt{\mu\varepsilon}}\)	1
Lip, QSM	RDEG	Adibi et al. [2022](1)	\(\|x^T-x^*\|^2\)	\(\frac{L}{\mu}\)	\(\frac{\sigma^2\mu^2R^2}{L^4\varepsilon^2}\)
(1) consider only homogeneous case  $(\zeta = 0)$ .
1.2 Our Contributions
Now we are ready to describe the main contributions of this work.
- Methods with provably robust aggregation. We propose new methods called Stochastic Gradient Descent-Ascent and Stochastic Extragradient with Robust Aggregation (SGDA-RA and SEG-RA) - variants of popular SGDA [Dem'yanov and Pevnyi, 1972, Nemirovski et al., 2009] and SEG [Korpelevich, 1976, Juditsky et al., 2011]. We prove that SGDA-RA and SEG-RA work with any  $(\delta, c)$ -robust aggregation rule and converge to the desired accuracy if the batchsize is large enough. In the experiments, we observe that SGDA-RA and SEG-RA outperform RDEG in several cases.
- Client momentum. As the next step, we add client momentum to SGDA-RA and propose Momentum SGDA-RA (M-SGDA-RA). As it is shown by [Karimireddy et al., 2021, 2022], client momentum helps to break the permutation invariance of the method and ensures convergence to any predefined accuracy with any batchsize for non-convex minimization problems. In the case of star-cocoercive quasi-strongly monotone VIs, we prove the convergence to the neighborhood of the solution; the size of the neighborhood can be reduced via increasing batchsize only – similarly to the results for RDEG, SGDA-RA, and SEG-RA. We discuss this limitation in detail and point out the non-triviality of this issue. Nevertheless, we show in the experiments that client momentum does help to achieve better accuracy of the solution.
- Methods with random checks of computations. Finally, for homogeneous data case  $(\zeta = 0)$ , we propose a version of SGDA and SEG with random checks of computations (SGDA-CC, SEG-CC and their restarted versions - R-SGDA-CC and R-SEG-CC). We prove that the proposed methods converge to any accuracy of the solution without any assumptions on the batchsize. This is the first result of this type on Byzantine robustness for distributed VIs. Moreover, when the target accuracy of the solution is small enough, the obtained convergence rates for R-SGDA-CC and R-SEG-CC are not worse than the ones for distributed SGDA and SEG derived in the case of  $\delta = 0$  (no Byzantine workers); see the comparison of the convergence rates in Table 1. In the numerical experiments, we consistently observe the superiority of the methods with checks of computations to the previously proposed methods.
Byzantine-robust methods for minimization problems. Classical distributed methods like Parallel SGD [Zinkevich et al., 2010] cannot tolerate even one Byzantine worker. The most evident vulnerability of such methods is an aggregation rule (averaging). Therefore, many works focus on designing and application of different aggregation rules to Parallel SGD-like methods [Blanchard et al., 2017, Yin et al., 2018, Damaskinos et al., 2019, Guerraoui et al., 2018, Pillutla et al., 2022]. However, this is not sufficient for Byzantine robustness: there exist particular attacks [Baruch et al., 2019, Xie et al., 2019] that can bypass popular defenses. [Karimireddy et al., 2021] formalize the definition of robust aggregation (see Definition 1.1), show that many standard aggregation rules are non-robust according to that definition, and prove that any permutation-invariant algorithm with a fixed batchsize can converge only to the ball around the solution with algorithm-independent radius. Therefore, more in-depth algorithmic changes are required that also explain why RDEG, SGDA-RA, and SEG-RA are not converging to any accuracy without increasing batchsize.
One possible way to resolve this issue is to use client momentum [Karimireddy et al., 2021, 2022] that breaks permutation-invariance and allows for convergence to any accuracy. It is also worth mentioning a recent approach by [Allouah et al., 2023], who propose an alternative definition of robust aggregation to the one considered in this paper, though to achieve the convergence to any accuracy in the homogeneous case [Allouah et al., 2023] apply client momentum like in [Karimireddy et al., 2021, 2022]. Another line of work achieves Byzantine robustness through the variance reduction mechanism [Wu et al., 2020, Zhu and Ling, 2021, Gorbunov et al., 2023a]. Finally, for the homogeneous data case, one can apply validation test [Alistarh et al., 2018, Allen-Zhu et al., 2021] or checks of computations [Gorbunov et al., 2022b]. For the summary of other advances, we refer to [Lyu et al., 2020].
Methods for min-max and variational inequalities problems. As mentioned before, min-max/variational inequalities (VIs) problems have noticeable differences with standard minimization. In particular, it becomes evident from the differences in the algorithms' behavior. For example, a direct analog of Gradient Descent for min-max/VIs - Gradient Descent-Ascent (GDA) [Krasnosel'skii, 1955, Mann, 1953, Dem'yanov and Pevnyi, 1972, Browder, 1966] - fails to converge for a simple bilinear game. Although GDA converges for a different class of problems (cocoercive/star-cocoercive ones) and its version with alternating steps works well in practice and even provably converges locally [Zhang et al., 2022], many works focus on Extragradient (EG) type methods [Korpelevich, 1976, Popov, 1980] due to their provable convergence for monotone Lipschitz problems and beyond [Tran-Dinh, 2023]. Stochastic versions of GDA and EG (SGDA and SEG) are studied relatively well, e.g., see [Hsieh et al., 2020, Loizou et al., 2021, Mishchenko et al., 2020, Pethick et al., 2023] for the recent advances.
On the results from [Adibi et al., 2022]. In the context of Byzantine robustness for distributed min-max/VIs, the only existing work is [Adibi et al., 2022]. The authors propose a method called Robust Distributed Extragradient (RDEG) – a distributed version of EG that uses a univariate trimmed-mean estimator from [Lugosi and Mendelson, 2021] for aggregation. This estimator satisfies a similar property to (4) that is shown for  $\delta < 1/16$  and large enough  $n$  (see the discussion in Appendix B). In contrast, the known  $(\delta, c)$ -robust aggregation rules allow larger  $\delta$ , and do not require large  $n$ . Despite these evident theoretical benefits, such aggregation rules were not considered in prior works on Byzantine robustness for distributed variational inequalities/min-max problems.
In this section, we describe three approaches proposed in this work and formulate our main results.
2.1 Methods with Robust Aggregation
We start with the Stochastic Gradient Descent-Accent with  $(\delta, c)$ -robust aggregation (SGDA-RA):
$$
\boldsymbol {x} ^ {t + 1} = \boldsymbol {x} ^ {t} - \gamma \operatorname {R A G G} \left(\boldsymbol {g} _ {1} ^ {t}, \dots , \boldsymbol {g} _ {n} ^ {t}\right), \text {w h e r e} \boldsymbol {g} _ {i} ^ {t} = \boldsymbol {g} _ {i} \left(\boldsymbol {x} ^ {t}, \boldsymbol {\xi} _ {i} ^ {t}\right) \forall i \in \mathcal {G} \text {a n d} \boldsymbol {g} _ {i} ^ {t} = * \forall i \in \mathcal {B},
$$
where  $\{\pmb{g}_i^t\}_{i\in \mathcal{G}}$  are sampled independently. The main result for SGDA-RA is given below.
Theorem 1. Let Assumptions 1, 2, 4 and 6 hold. Then after  $T$  iterations SGDA-RA (Algorithm 1) with  $(\delta, c)$ -RAGG and  $\gamma \leq \frac{1}{2\ell}$  outputs  $\boldsymbol{x}^T$  such that
$$
\mathbb {E} \left\| \boldsymbol {x} ^ {T} - \boldsymbol {x} ^ {*} \right\| ^ {2} \leq \left(1 - \frac {\gamma \mu}{2}\right) ^ {T} \left\| \boldsymbol {x} ^ {0} - \boldsymbol {x} ^ {*} \right\| ^ {2} + \frac {2 \gamma \sigma^ {2}}{\mu G} + \frac {2 \gamma c \delta (2 4 \sigma^ {2} + 1 2 \zeta^ {2})}{\mu} + \frac {c \delta (2 4 \sigma^ {2} + 1 2 \zeta^ {2})}{\mu^ {2}}.
$$
The first two terms in the derived upper bound are standard for the results on SGDA under Assumptions 1, 4, and 6, e.g., see [Beznosikov et al., 2023]. The third and the fourth terms come from the presence of Byzantine workers and robust aggregation since the existing  $(\delta, c)$ -robust aggregation rules explicitly depend on  $\delta$ . The fourth term cannot be reduced without increasing batchsize even when  $\zeta = 0$  (homogeneous data case). This is expected since SGDA-RA is permutation invariant. When  $\sigma = 0$  (regular workers compute full operators), then SGDA-RA converges linearly to the ball centered at the solution with radius  $\mathcal{O}(\sqrt{c\delta}\zeta/\mu)$  that matches the lower bound from [Karimireddy et al., 2022]. In contrast, the known results for RDEG are derived for homogeneous data case ( $\zeta = 0$ ). The proof of Theorem 1 is deferred to Appendix D.1.
Using a similar approach we also propose a version of Stochastic Extragradient method with  $(\delta, c)$ -robust aggregation called SEG-RA: