SlowGuess/NeurIPS_2023_OCR huggingface dataset:
A second nice property of our trust calculation is that for an appropriate choice of  $\beta_i^{(t)}$  the proposed calculation of trust scores in (6) leads to scores that become more evenly distributed over time as agents gradually reach consensus.
Claim 3. Given Assumption 1 holds and that all agents are over-parameterized. Assume  $\beta_i^{(t)}$  is chosen such that the trust matrix  $W^{(t)}$  is row-stochastic and positive for all  $t\geq 0$ . Then, for the trust calculation in (6), we have  $W^{(t)}$  loses self-confidence over time and finally converges to a uniform matrix:
$$
t r \left(\boldsymbol {W} ^ {(t)}\right) \leq t r \left(\boldsymbol {W} ^ {(t - 1)}\right) \quad a n d \quad \boldsymbol {W} ^ {(t)} \stackrel {t \rightarrow \infty} {\longrightarrow} \mathbf {1 1} ^ {\top} \frac {1}{N} \tag {7}
$$
The proof is provided in Appendix C. This claim characterizes the behavior of our dynamic trust scheme: while initially all agents distribute trust towards helpful collaborators and try to achieve a consensus on  $\mathbf{X}^*$ . Once consensus is reached, we will have  $\hat{\pmb{y}}_i^{(t)} = \hat{\pmb{y}}_j^{(t)}$  for any  $i,j$ , and  $\pmb{W}^{(t)}$  will become a matrix with uniform weights. This means no individual agent has increasingly high weight or the ability to manipulate the labeling.
Now that we know that a self-confident matrix can lead to the desired consensus, what other properties should our trust matrix have?
4.2 Robustness to low-quality nodes
If agents possess low-quality local data, we aim to minimize their influence on the labeling of the auxiliary data throughout the algorithm. Proposition 4 gives a sufficient condition for such a desired consensus: if there exists only one node with low-quality data, as long as it receives the lowest trust from other regular nodes, and the sum of trust it receives is the smallest compared to the others, it will remain to have lowest importance in the consensus.
Proposition 4. Given Assumption 1, the trust matrix is row stochastic and positive, and all agents hold over-parameterized models. Let  $b$  be the only node with low-quality data and  $\tau$  be the timestep that consensus is reached. If the following desirable properties hold for  $t < \tau$ :
i)  $b$  receives the lowest trust from others than itself, i.e.,  $w_{jb}^{(t)} = \min_i w_{ji}^{(t)}$  for  $j \neq b$ .
ii)  $b$ -th column has the lowest column sum:  $\sum_{j} w_{jb}^{(t)} < \min_{i \neq b} \sum_{j} w_{ji}^{(t)}$ .
Then node  $b$  will have the lowest importance in the consensus.
The proof is given in Appendix E, where we also provide desired properties in the presence of multiple nodes with low-quality data, under some extra assumptions. Proposition 4 emphasizes the desired trust weights during training before consensus is reached.
When nodes with weak model architectures (such as under-parameterized models) are involved, achieving consensus is not assured. If such a consensus solution does exist, it will be constrained by the underfitting of weak nodes. Consequently, this solution would not serve as a stationary solution concerning the local training loss of a strong node. Nevertheless, we conjecture that these desired properties can still enhance training by mitigating the impact of the weak nodes.
4.3 Confidence weighting
In the following paragraph, we discuss the choice of the weights  $\beta_{i}^{(t)}$  in (6). Specifically, we incorporate confidence weighting into the pairwise cosine similarity calculation to emulate the construction of a transition matrix based on a known consensus distribution.
Let us start by outlining an idealized trust calculation that effectively down-weighs agents with low quality data. We first construct an intermediate transition matrix  $\Phi$  from pairwise cosine similarities of the agents' predictions on  $X^{*}$  (with row normalization). For the low-quality node  $b$ , we will have  $\phi_{jb}$  being the lowest value in the  $j$ -th row, for any  $j \neq b$ . According to Proposition 4, in order to have low importance of low-quality workers in the consensus, we need to set the overall trust that  $b$  receives to be the lowest among all the nodes. To achieve this, we need to assign the trust of regular workers towards the low-quality workers to a very small value, as it is difficult to alter self-confidence. If the consensus importance weight is known, one can easily calculate the corresponding trust matrix
$$
w _ {j b} = \phi_ {j b} \min \left(1, \frac {\pi (b)}{\pi (j)} \frac {\phi_ {b j}}{\phi_ {j b}}\right),
$$
which is a classical result from Metropolis chains [28] (also see Appendix D). We will have  $w_{jb} < \phi_{jb}$  for  $j \neq b$ , as  $\frac{\pi(b)}{\pi(j)}$  should be sufficiently small.
Practical scheme. Since the consensus importance weight is unknown, we cannot attain the ideal trust matrix. Therefore, we propose an alternative weighting scheme that achieves similar effects: we up-weight the similarity in the region where agent  $j$  has more confidence, i.e., where agent  $j$ 's class probability assignments have lower entropy. By doing this, we encourage that the trust weights become more concentrated on themselves and helpful workers, and less concentrated on low-quality workers. We incorporate this into the trust weight calculation (6) by choosing
$$
\beta_ {i} ^ {(t)} (\boldsymbol {x}) = \frac {1}{\mathcal {H} \left(f _ {\boldsymbol {\theta} _ {i} ^ {(t - 1)}} (\boldsymbol {x})\right)}
$$
where  $\mathcal{H}$  denotes the entropy. We offer further intuition as well as justification of this weighting scheme in Appendix F. Moreover, we empirically demonstrate how our choice of trust matrix leads to a low column sum for bad nodes in Section 5.2.
(a) Local data distributions
(b) Dynamic Trust
(c) Naive Trust
(a) Cifar10
Figure 3: Class distributions among clients
(b) FedISIC-2019
Figure 2: Decision boundary comparison between our dynamic trust update and naive trust update
Figure 4: Learned trust matrix during training with diagonal entries masked and column sum reported in the lowest bar. (left) Agents 2&9 have bad data. (right) Agents 5-9 have weak models.
We start with a synthetic example to visualize the decision boundary achieved by our algorithm and then demonstrate its performance on real data in a heterogeneous collaborative learning setting.
5.1 Decision boundary visualization
Four classes are generated via multivariate Gaussian following  $P^c \sim \mathcal{N}(\pmb{\mu}_c, \pmb{\Sigma})$ , where  $\pmb{\mu}_0 = (-2, 2)^\top$ ,  $\pmb{\mu}_1 = (2, 2)^\top$ ,  $\pmb{\mu}_2 = (-2, -2)^\top$ ,  $\pmb{\mu}_3 = (2, -2)^\top$ .  $\pmb{\Sigma} = I_{2 \times 2}$ . Four clients have local data sampled from a mixture of  $P^c$ 's. For clients 0-3, we randomly flip  $10\%$  of the labels, and for client 3, we flip all labels. The unlabeled data  $X^*$  are sampled equally from  $P^c$ 's. The data distribution is shown in Fig. 2a. The base model used in each node is a multi-layer perceptron of 3 layers with 5, 10, and 4 neurons respectively. We now compare Algorithm 1 with dynamic trust weight to with naive trust weight. When a client with low-quality data is involved, i.e. client 3 in the toy example, our trust update scheme gives a better decision boundary to good agents after collaboration, as blind trust towards low-quality clients will impair the effectiveness of pseudo labeling.
5.2 Deep learning experiments
Datasets and model architectures. We consider a more challenging setting, where local data distributions are non-i.i.d. Two different statistical heterogeneities are considered: (1) Synthetic heterogeneity. We utilize the classic Cifar10 and Cifar100 datasets [29] and create 10 clients from each dataset. To distribute classes among clients, we use a Dirichlet distribution $^2$  with  $\alpha = 1$ . Unless specified otherwise, we employ ResNet20 [30] without pretraining. (2) Real-world data heterogeneity. A real-world dermoscopic lesion image dataset from the ISIC 2019 challenge [31, 32, 33] is included here. The same client splits are used as in [34], based on the imaging acquisition system employed in six different hospitals. The dataset includes eight classes of lesions to classify, with the class distribution among the clients displayed in Fig. 3b. Following [34], we choose pretrained EfficientNet [35] as the base model, and use balanced accuracy as the evaluation metric. For every dataset, we construct  $X^*$  from equally contributed samples by every agent.
Comparison against baseline methods. We compare our methods with several baseline methods, including FedAvg [5], FedProx [7], SCAFFOLD [8] (SCA), FedDyn [36], local training without collaboration (LT), and training with naive trust (Naive). Note with naive trust we are realizing soft majority voting, which represents the baseline method proposed from [12]. We adhere to the same
2The Dirichlet distributed samples are constructed using the codes from https://github.com/TsingZ0/PFL-Non-IID
FedAvg	FedProx	SCA	FedDyn	LT	Naive	Ours-S	Ours-D
Regular	Cifar10	0.542	0.517	0.578	0.578	0.475	0.618	0.604	0.612
Cifar100	0.261	0.240	0.317	0.310	0.178	0.311	0.319	0.308
Fed-ISIC	0.279	0.261	0.213	0.243	0.248	0.290	0.302	0.291
Low-Quality Data	Cifar10	0.541	0.530	0.570	0.575	0.470	0.596	0.605	0.608
Cifar100	0.254	0.240	0.289	0.308	0.171	0.285	0.300	0.306
Fed-ISIC	0.229	0.242	0.221	0.243	0.217	0.247	0.249	0.269
Table 1: Our methods compare to baseline methods. Blue denotes the algorithm with top 1 accuracy and green denotes the method with 2nd best accuracy. "Ours - S" denotes the static version where the trust score is kept constant after first-time calculation (after 5 rounds of local training) and "Ours - D" denotes the dynamic version where the trust score is updated per global round.
architecture setting, where the standard federated learning algorithms can be applied. To initiate the process, we allow each client to perform local training for 5 global rounds, with the objective of obtaining a sufficiently refined model that can be used for trust evaluation. From the 6th training round, the clients start collaboration. Over a total of 50 global rounds, each consisting of 5 local epochs, we report the averaged accuracy results from three repeated experiments in Table 1. The evaluation metric is calculated on the dataset  $X^{*}$ .  $\lambda$  is fixed as 0.5 in all experiments.
When all nodes share the same data quality and degree of statistical heterogeneity (denoted by "regular" in the table), our methods align closely with consensus through naive averaging, which is optimal in this case. When all nodes share the same degree of statistical heterogeneity but differ in data quality, exemplified by randomly selecting two nodes (indexed as 2 and 9) for a complete flip of local training labels, our dynamic trust update shows better overall performances<sup>3</sup>, proving the effectiveness of our approach in limiting the detrimental influences from nodes with low-quality data. We further plotted out the learned trust matrix in the dynamic update mode during one of the middle training rounds in the left plot of Fig. 4. Clearly, our algorithm is able to give low trust weights to the nodes with low-quality data, and the 2nd and 9th columns have the lowest column sum.
Adaptability to varying model architectures. We allocate a more expressive model architecture to the first half of the nodes and a less expressive one to the other half. The former comprises ResNet20 and EfficientNet, which were the models of choice in the previous experiments. For the latter, we employ a linear model (i.e., one-layer fully connected neural network) with a flattened image tensor as input and the output is of size equivalent to the number of classes. It is worth noting that if agents with strong and weak model architectures (as in cases of under-parameterization) coexist, consensus might not occur, as suggested by our empirical findings illustrated in Fig. 5. Nevertheless, our trust-based collaborator selection mechanism consistently outperforms local training and simple averaging. The trust weight matrix learned during Cifar100 training is depicted in the right plot of Fig. 4, revealing the presence of asymmetric trust. Specifically, the last 5 nodes exhibit a higher level of trust towards the first 5 nodes, while the opposite is not true. The trust allocation is desired in identifying the helpers. We further refer to Appendix A.2 for more empirical evidence from a toy polynomial regression example on the presence of strong and weak architectures.
Reduced communication costs. Gradient aggregation-based methods incur a significant communication burden proportional to the number of model parameters  $(\mathcal{O}(N \times |\mathrm{params}|))$ , which is particularly heavy given the over-para
Figure 5: Target accuracy comparison with 2 different model architectures with error bars (hatch pattern denotes fully connected NN is used). From top to bottom: Cifar10, Cifar100, FedISIC
3Here we report average accuracy of regular workers, excluding workers with low-quality data
Figure 6: Algorithm performances on Cifar100 for different algorithm configurations. (left) effect of varying number of local epochs on final performance; (right) algorithm performance as a function of the number of training rounds for 5 local epochs each
In contrast to existing approaches, our proposed method significantly reduces the communication burden by enabling each node to transmit only their predictions on the shared dataset. This results in communication overhead  $\mathcal{O}(N^2 \times n^\star \times C)$ . It is clear that this value does not scale up with more complex models, and is much smaller than the model size. Moreover, our methods maintain their high performance even when the number of local epochs increases. On the other hand, FedAvg loses its effectiveness with less frequent synchronization, i.e. more local epochs between global aggregation rounds, as shown in the left panel of Fig. 6.
6 Conclusions and extensions
In the context of decentralized learning, we leverage the collective knowledge of individual nodes to improve the accuracy of predictions with respect to a target distribution. Our proposed trust update scheme, based on self-confidence, ensures robustness against nodes with low-quality data. By achieving consensus in the prediction space, our method effectively handles diverse model architectures within local clients, while maintaining a low communication overhead, thereby exhibiting important practical potential. Despite coming from a different perspective, our trust-based collaborative pseudolabeling method may provide some inspiration in the semi-supervised learning community. Notably, our algorithm is intrinsically compatible with personalization, in terms of allowing some concept shift across clients. We leave this for future work.
Robustness. We have designed our algorithm with the assumption that all agents communicate honestly, meaning that no Byzantine workers intentionally provide incorrect information. Nevertheless, our method exhibits some resilience against a common Byzantine attack, known as the label flip (referred to as "low-quality workers" in our paper). For instance, even with 2 out of 10 workers having  $100\%$  flipped labels, our algorithm maintains good performance. If there are malicious workers deliberately providing incorrect information, the nodes may refuse to reach a consensus, instead of reaching a detrimental bad consensus, assuming a reasonable  $\lambda$  is chosen. Consider the scenario in which a detrimental consensus is reached with malicious nodes involved; in this case, the consensus loss and local loss for regular nodes will not decrease in the same direction, making the consensus solution non-stationary. Notably, the "personal" component of our loss function adds an element of robustness against malicious nodes.
Privacy Concerns. While previous works show that training data can be reconstructed from model parameters [37] or gradients [38], our algorithm requires less privacy-sensitive information sharing, which is predictions on a shared dataset. While we are aware that model predictions can still leak private information on training data due to memorization [39], there is a trade-off between the gain from collaboration and the amount of information that users are willing to share. As the number of outer rounds increases, we observe a notable improvement in accuracy within the context of  $X^{*}$ . However, this enhanced accuracy comes at the cost of disclosing more information, a relationship that is depicted in Fig. 6. An interesting extension would be to apply differential privacy to further guarantee privacy.
Acknowledgements. DF would like to thank Anastasia Koloskova, Felix Kuchelmeister, Matteo Pagliardini, and Nikita Doikov for helpful discussions during the project and El Mahdi Chayti for proofreading. DF acknowledges funding from EDIC fellowship from the Department of Computer Science at EPFL. CM acknowledges support from the Tübingen AI Center. This project was supported by SNSF grant 200020_200342.
[35] Mingxing Tan and Quoc Le. EfficientNet: Rethinking model scaling for convolutional neural networks. In International Conference on Machine Learning, volume 97, pages 6105-6114. PMLR, 2019.
[36] Durmus Alp Emre Acar, Yue Zhao, Ramon Matas, Matthew Mattina, Paul Whatmough, and Venkatesh Saligrama. Federated learning based on dynamic regularization. In International Conference on Learning Representations (ICLR), 2021.
[37] Niv Haim, Gal Vardi, Gilad Yehudai, michal Irani, and Ohad Shamir. Reconstructing training data from trained neural networks. In Advances in Neural Information Processing Systems, 2022.
[38] Zihan Wang, Jason Lee, and Qi Lei. Reconstructing training data from model gradient, provably. In International Conference on Artificial Intelligence and Statistics, volume 206, pages 6595-6612. PMLR, 2023.
[39] Nicholas Carlini, Matthew Jagielski, Chiyuan Zhang, Nicolas Papernot, Andreas Terzis, and Florian Tramer. The privacy onion effect: Memorization is relative. Advances in Neural Information Processing Systems, 35:13263-13276, 2022.
[40] J. Wolfowitz. Products of indecomposable, aperiodic, stochastic matrices. Proceedings of the American Mathematical Society, 14(5):733-737, 1963.
A Polynomial regression examples
A.1 Example in Section 3.4
The true underlying function is chosen as  $f(x) = 0.5x^{3} + 0.3x^{2} - 5x + 4$ . There are three agents in total, each of whom has 50 data points. The local data points are generated using normal distributions:  $x_{1} \sim \mathcal{N}(-2,1)$ ,  $x_{2} \sim \mathcal{N}(0,1)$  and  $x_{3} \sim \mathcal{N}(2,1)$ . To introduce noise in the labels, each agent adds a normally distributed error term with zero mean and unit variance, i.e.  $y_{i} = f(x_{i}) + \varepsilon$  with  $\varepsilon \sim \mathcal{N}(0,1)$ .
A set of 50 equally spaced data points in the range of  $-4$  to 4, denoted as  $X^{*}$ , is used in the analysis. The algorithm is applied using fixed trust weights with  $1/3$  in each entry and  $\lambda$  is chosen as 1.
A.2 Example with strong and weak architectures
The true underlying function is chosen as  $f(x) = 0.5x^{3} + 0.3x^{2} - 5x + 4$ . There are four agents in total, each of whom has 50 data points. The local data points are generated using normal distributions:  $x_{1} \sim \mathcal{N}(-2,1)$ ,  $x_{2} \sim \mathcal{N}(0,1)$ ,  $x_{3} \sim \mathcal{N}(2,1)$  and  $x_{4} \sim \mathcal{N}(3,1)$ . To introduce noise in the labels, each agent adds a normally distributed error term with zero mean and unit variance, i.e.  $y_{i} = f(x_{i}) + \varepsilon$  with  $\varepsilon \sim \mathcal{N}(0,1)$ .
A set of 50 equally spaced data points in the range of  $-4$  to 6, denoted as  $X^{*}$ , is used in the analysis. The algorithm is applied using dynamic trust weights and  $\lambda$  is chosen as 1. For the first three agents, a polynomial model with a maximum degree of four is fit, while for the fourth agent, a polynomial model with a maximum degree of one is fit, signifying a weak node.
We see that after 50 rounds of model training using our proposed algorithm with dynamic trust, agent 4's model is still underfitting due to its limited expressiveness. Agents 1-3 end up agreeing with each other and giving good predictions in the union of their local regions. While with naive trust weights, we see that the strong agents also get influenced in the region where they could perform well, as the underfitted model has a stronger impact through collective pseudo-labeling.
(b)
Figure 7: (a) local data distributions in each agent; (b) local model fit without collaboration; (c) model fits after 50 rounds of our algorithm with dynamic trust update; (d) model fits after 50 rounds with naive trust update
The proof is rooted in the results from the work of Wolfowitz [40], we recommend readers to check the original paper for more detailed references. Note, for the following texts, when we say a matrix  $\mathbf{W}$  has certain properties, it is equivalent to saying a Markov chain induced by transition matrix  $\mathbf{W}$  has certain properties.
Definition A (Irreducible Markov chains). A Markov chain induced by transition matrix  $\mathbf{W}$  is irreducible if for all  $i, j$ , there exists some  $n$  such that  $\mathbf{W}_{ij}^{n} > 0$ . Equivalently, the graph corresponding to  $\mathbf{W}$  is strongly connected.
Definition B (Strongly connected graph). A graph is said to be strongly connected if every vertex is reachable from every other vertex.
Definition C (Aperiodic Markov chains). A Markov chain induced by transition matrix  $\mathbf{W}$  is aperiodic if every state has a self-loop. By self-loop, we mean that there is a nonzero probability of remaining in that state, i.e.  $w_{ii} > 0$  for every  $i$ .
Assumption 2.  $W^{(t)}$  's are row-stochastic and positive, i.e.  $\sum_{j}w_{ij} = 1$  for any row  $i$ , and  $w_{ij} > 0$ .
Claim 5. Given Assumption 2, the matrix product of any  $n$  elements of  $\{\mathbf{W}^{(t)}\}$  are SIA (SIA stands for stochastic, irreducible and aperiodic) for  $n \geq 1$ .
Proof. According to the assumption that all  $\mathbf{W}^{(t)}$ 's are positive, and thus we have any product of  $\mathbf{W}^{(t)}$ 's being positive in each entry, which is equivalent to the graph introduced by the product being fully connected. Being fully connected implies being strongly connected. According to Definitions A B, irreducibility follows.
By the product being positive, we also have its diagonal entries being all positive. According to Definition C, aperiodicity follows.
The product of row-stochastic matrices remains row-stochastic: for  $A$  and  $B$  row stochastic, we have the product  $AB$  remains row-stochastic.
$$
\sum_ {j} \left(\sum_ {k} a _ {i k} b _ {k j}\right) = \sum_ {k} a _ {i k} \left(\sum_ {j} b _ {k j}\right) = 1, \forall i
$$
Thus, we have any product of  $\mathbf{W}^{(t)}$ 's being irreducible, aperiodic and stochastic (SIA).
Theorem 6 (Rewrite of Wolfowitz [40]). Let  $A_1, \ldots, A_k$  be square row stochastic matrices of the same order and any product of the  $A$ 's (of whatever length) is SIA. When  $k \to \infty$ , the product of  $A_1, \ldots, A_k$  gets reduced to a matrix with identity rows.
Following Assumptions 12, we have  $\psi^{(t)} = W^{(t)}\psi^{(t - 1)}$  holds for all  $t\geq 1$ . From Claim 5, we have any products of  $W^{(t)}$ 's being SIA. From Theorem 6, we have the product  $W^{(t)}W^{(t - 1)}\ldots W^{(1)}$  gets reduced to a matrix with identical rows when  $t$  goes to infinity. That implies,  $\psi^{\infty}$  has identical rows. The statement is thus proved.
C Proof of Claim 3
Definition D (Row differences). Define how different the rows of  $\mathbf{W}$  are by
$$
\delta (\boldsymbol {W}) = \max  _ {j} \max  _ {i _ {1}, i _ {2}} \left| w _ {i _ {1} j} - w _ {i _ {2} j} \right| \tag {8}
$$
For identical rows,  $\delta (\pmb {W}) = 0$
Definition E (Scrambling matrix).  $\mathbf{W}$  is a scrambling matrix if
$$
\lambda (\boldsymbol {W}) := 1 - \min  _ {i _ {1}, i _ {2}} \sum_ {j} \min  (w _ {i _ {1} j}, w _ {i _ {2} j}) <   1 \tag {9}
$$