SlowGuess/NeurIPS_2023_OCR huggingface dataset:
Zhiyuan Zhang $^{1,2}$ , Deli Chen $^{2}$ , Hao Zhou $^{2}$ , Fandong Meng $^{2}$ , Jie Zhou $^{2}$ , Xu Sun $^{1}$
$^{1}$ National Key Laboratory for Multimedia Information Processing,
School of Computer Science, Peking University
$^{2}$ Pattern Recognition Center, WeChat AI, Tencent Inc., China
{zzy1210,xusun}@pku.edu.cn
{delichen,tuxzhou,fandongmeng,withtomzhou}@tencent.com
Federated learning algorithms enable neural network models to be trained across multiple decentralized edge devices without sharing private data. However, they are susceptible to backdoor attacks launched by malicious clients. Existing robust federated aggregation algorithms heuristically detect and exclude suspicious clients based on their parameter distances, but they are ineffective on Natural Language Processing (NLP) tasks. The main reason is that, although text backdoor patterns are obvious at the underlying dataset level, they are usually hidden at the parameter level, since injecting backdoors into texts with discrete feature space has less impact on the statistics of the model parameters. To settle this issue, we propose to identify backdoor clients by explicitly modeling the data divergence among clients in federated NLP systems. Through theoretical analysis, we derive the f-divergence indicator to estimate the client data divergence with aggregation updates and Hessians. Furthermore, we devise a dataset synthesis method with a Hessian reassignment mechanism guided by the diffusion theory to address the key challenge of inaccessible datasets in calculating clients' data Hessians. We then present the novel Federated F-Divergence-Based Aggregation (Fed-FA) algorithm, which leverages the f-divergence indicator to detect and discard suspicious clients. Extensive empirical results show that Fed-FA outperforms all the parameter distance-based methods in defending against backdoor attacks among various natural language backdoor attack scenarios.
Federated learning can train neural network models across multiple decentralized edge devices (i.e. clients) in a privacy-protect manner. However, federated aggregation algorithms (e.g. FedAvg [26]) are vulnerable to backdoor attacks [15, 23] from malicious clients via poisonous parameter updating [26, 51]. This poses a serious threat to the security and reliability of federated learning systems. Therefore, detecting suspicious backdoor clients is of great research significance [3, 31, 43, 42].
Most existing robust federated aggregation algorithms heuristically take parameter distances (e.g. Euclidean distances [1, 27, 58], cosine distances [12]) among clients as the indicator to detect suspicious clients. However, [58] points out that federated language backdoors are harder to defend against than vision backdoors; the reason lies in that the text feature space is discrete and the injected backdoor patterns of text are more hidden at the parameter level than images. For example, the output of NLP models can be falsified by only poisoning a few words' embeddings [46, 5], which can hardly affect the statistics of the whole model parameters. Thus, the parameter distance-based
Figure 1: Illustration of Fed-FA. Euclidean indicator is  $\mathcal{I}_{\mathrm{Euc}} = \sum_{k=1}^{d} \delta_k^2 = \|\delta\|^2$  and f-divergence indicator is  $\mathcal{I}_{\mathrm{F-Div}} = \sum_{k=1}^{d} H_k^* \delta_k^2$ , where  $H_k^*$  is the  $k$ -th Hessian. ASRs are averaged on all attacks.
robust federated aggregations [1, 12, 10] do not perform well on NLP tasks. Besides, the choice of distance function is empirical and lacks theoretical guarantees [1, 58, 12, 10].
Present work. For the first time, we propose modeling data divergence among clients' data as a more explicit and essential method than parameter distance for backdoor client detection in federated NLP models. A critical challenge for data divergence estimation is that local datasets on clients are invisible to the server or the defender due to privacy protection, thus we cannot measure data divergence directly. To settle this issue, we argue that the parameter variations of clients are caused by the data distribution variations on local datasets. Based on this theoretical intuition, we model how distribution variations between different clients lead to parameter update variations in Theorem 1, and further derive the f-divergence indicator that can estimate the data divergence among different clients with parameter updates and Hessians (i.e. second derivatives).
Driven by our theoretical analysis, we propose a novel Federated F-Divergence-Based Aggregation (Fed-FA) algorithm, which utilizes the f-divergence indicator to estimate the data divergence of clients. F-divergence is a universal divergence measurement of data distributions that common classic divergences can be seen as special cases with corresponding convex functions  $f(x)$ . We utilize the f-divergence indicator to detect suspicious clients that have larger f-divergence indicator values, namely clients whose data distributions are different from others. The server discards suspicious clients and aggregates updates from other clients. The Fed-FA is illustrated in Fig. 1. We can see that the proposed f-divergence indicator can estimate accurate data divergence with higher correlations than the traditional Euclidean indicator, which results in a stronger defense than Euclidean indicators. We also prove Theorem 3 to verify the Byzantine resilience and convergence of Fed-FA.
The calculation of f-divergence indicators involves parameter updates and Hessians. Since the Hessians of local datasets are invisible to the defender on server, we propose a dataset synthesis mechanism that randomly labels a tiny unlabeled corpus to synthesize a dataset for Hessian estimations of invisible client datasets. However, the synthesized dataset may not cover all low-frequency words, which may be utilized by attackers for backdoor injection and thus is a common vulnerability for NLP backdoor attacks [4, 46, 57]. To settle this issue, we reassign Hessians on embeddings; the reassigned scales are derived in Theorem 2, which is guided by the diffusion theory [20, 45] and reveals that the parameter update magnitude is approximately proportional to Hessian square root on embeddings.
In addition to theoretical analysis, we also conduct comprehensive experiments to compare Fed-FA with other robust federated aggregation baselines on four NLP tasks that cover typical poisoning techniques in NLP, i.e., EP [46, 51], BadWord [4], BadSent [4], and Hidden (HiddenKiller) [33]. Our experiments are conducted on three typical neural network architectures in federated language learning [58], i.e., GRU, LSTM, and CNN. Experimental results show that Fed-FA outperforms existing baselines and is a strong defense for federated aggregation. Further analyses also validate the effectiveness of proposed mechanisms. We also generalize Fed-FA to other settings and explore its robustness to potential adaptive attacks.
In this section, we first introduce NLP backdoor attacks and backdoor defense in centralized learning. Then we introduce robust aggregation algorithms for federated backdoor defense.
2.1 Natural language backdoors and defense in centralized learning
Natural language backdoor attacks. Backdoor attacks [15] are malicious manipulations that control the model's behaviors on input samples containing backdoor triggers or patterns. NLP backdoor attacks usually adopt data poisoning [28, 5] that injects misleading input samples with backdoor patterns and wrong labels into the training dataset.
Generally, NLP backdoor attacks can be divided into three categories according to the backdoor injection patterns: (1) Trigger word based attacks [19, 46, 57, 48, 56]: BadWord [4] chooses low-frequency trigger words as the backdoor pattern; and the Embedding Poisoning attack, EP [46, 51], only manipulates embedding parameters for better stealthiness; (2) Trigger sentence based attacks: BadSent [7, 4] chooses a neutral sentence as the backdoor pattern; (3) Hidden trigger based attacks or dynamic attacks: Hidden (HiddenKiller) [33] converts the input into a specific syntax pattern as the backdoor pattern to make the backdoor triggers difficult to detect, and other attacks also adopt hidden triggers [36, 37], input-aware or dynamic triggers [29] to hide sophisticated backdoor triggers.
In federated learning, the attacker can conduct these attack techniques on the client and poison the global parameters on the server in the federated aggregation process.
Natural language backdoor defense. Backdoor defense in centralized learning defends against the backdoor by detecting and removing the backdoor pattern in input samples [53, 9, 32, 13, 47] or mitigating backdoors in model parameters [49, 21, 59, 22]. We focus on defense algorithms for federated backdoors and introduce them in next subsection.
2.2 Robust federated aggregation
To enhance the safety of federated language learning against backdoor attacks, some robust federated aggregation algorithms have been proposed and they can be roughly divided into these two lines:
Discarding aggregations. Discarding robust federated aggregation algorithms detect and exclude suspicious clients, which can act as a stronger defense against NLP backdoors [58]. We also follow this aggregation paradigm. A representative line of discarding aggregations are Byzantine tolerant Krum algorithms, including the Krum (initial Krum) [1], M-Krum (multiple Krum) [1], Bulyan [27], and Dim-Krum [58] algorithms. They adopt Euclidean distances of parameter updates empirically, while Fed-FA adopts the f-divergence indicator derived theoretically.
Non-discarding aggregations. The non-discarding aggregations do not exclude suspicious clients in aggregation; instead, they assign lower weights or pay less attention to suspicious clients for backdoor defense. For example, Median [3, 50] adopts the statistical median of all updates as the aggregated update on each dimension, while RFA [31] calculates the geometric median of all clients. Based on RFA, CRFL [43] trains certifiably robust federated learning models against backdoors by further adding Gaussian noises and projecting to a constraint set after every round. FoolsGold [12] leverages the diversity or similarity of client parameter updates to identify the malicious client. Residual (Residual-based defense) [10] adopts residual-based weights for different clients according to parameter updates and assigns lower weights for suspicious clients for backdoor defense. Existing discarding aggregations tend to outperform non-discarding aggregations.
In this section, we first introduce the federated learning paradigm. Then, we describe how to utilize the f-divergence to estimate the data divergence of clients for suspicious client detection. Implementation of Fed-FA is introduced last. Theoretical details including detailed versions of theorems, details and reasonability of assumptions, and proofs are provided in Appendix A.
3.1 Federated learning paradigm
Suppose  $\pmb{\theta} \in \mathbb{R}^d$  denotes the parameters of the model. The objective of federated learning is to train a global model  $\pmb{\theta}^{\text{Server}}$  on the server by exchanging model parameters through multiple rounds of communication without exposing the local data of multiple clients. Suppose the number of clients and rounds are  $n$  and  $T$ ; the global model is initialized with  $\pmb{\theta}_0^{\text{Server}}$ ,  $\pmb{\theta}_t^{\text{Server}}$  and  $\pmb{\theta}_t^{(i)}$  denote parameters on the server and the  $i$ -th client in the  $t$ -th round ( $1 \leq t \leq T$ ). In the  $t$ -th round, the server first distributes
Algorithm 1 Fed-FA algorithm on server
1: Initialize the global parameters  $\theta_0^{\mathrm{Server}}$ .  
2: for  $t = 1,2,\dots ,T$  do  
3: Distribute  $\theta_{t - 1}^{\mathrm{Server}}$  to  $n$  clients, and train  $\theta_t^{(i)}$  on clients locally ( $1\leq i\leq n$ ).  
4: Gather  $\{\pmb {\theta}_t^{(i)}\}_{i = 1}^n$ $\mathbf{u}_t^{(i)} = \pmb {\theta}_t^{(i)} - \pmb {\theta}_{t - 1}^{(i)}$ , and calculate  $\mathcal{I}_{\mathrm{F - Div}}^{(k)} = \mathcal{I}_{\mathrm{F - Div}}(\{\mathbf{u}_t^{(i)}\}_{i = 1}^n,k)$ .  
5:  $w_{i} = \frac{1}{|S|}\mathbb{I}(i\in S)$ ,  $S = \{\text{indexes of clients with top-}\lfloor \frac{n}{2} +1\rfloor$  smallest indicators  $\mathcal{I}_{\mathrm{F - Div}}^{(i)}\}$ .  
6: Update  $\pmb{\theta}_{t}^{\mathrm{Server}} = \pmb{\theta}_{t - 1}^{\mathrm{Server}} + \mathcal{A}(\{\mathbf{u}_t^{(i)}\}_{i = 1}^n)$ , where  $\mathcal{A}(\{\mathbf{u}_t^{(i)}\}_{i = 1}^n) = \sum_{i = 1}^n w_i\mathbf{u}_t^{(i)}$ .  
7: end for  
8: function  $\mathcal{I}_{\mathrm{F - Div}}(\{\mathbf{u}_t^{(i)}\}_{i = 1}^n,k)$ :  
9:  $\delta = \mathbf{u}_t^{(k)} - \frac{1}{n}\sum_{i = 1}^n\mathbf{u}_t^{(i)}$ , let  $u_{k}^{(i)}$  denote the  $k$ -th dimension of  $\mathbf{u}_t^{(i)}$ .  
10: // Dataset Synthesization:  
11: Synthesize dataset  $\mathcal{D}^{\mathrm{Syn}} = \{\mathbf{z}_j = (\mathbf{x}_j,y_j)\}$  with unlabeled texts  $\mathbf{x}_j$  and random labels  $y_j$ .  
12:  $\hat{H}_k^* = \mathbb{E}_{\mathbf{z}\sim \mathcal{D}^{\mathrm{syn}}}[(\mathcal{L}_{\theta_k}'(\pmb{\theta}_{t - 1}^{\mathrm{Server}};\mathbf{z}))^2]$ .  
13: // Embedding Hessian Reassignment according to Theorem 2:  
14:  $\hat{H}_k^* = \frac{\sum_{i\in E}\hat{H}_i^*}{\sum_{j\in E}s_j} s_k$  ( $k\in E$ ) on embeddings  $E$ , where  $s_k = \left(\frac{1}{n}\sum_{i = 1}^n |u_k^{(i)}| + \epsilon\right)^2$ ,  $\epsilon = 10^{-8}$ .  
15: Calculate  $\hat{\mathcal{I}}_{\mathrm{F - Div}}$  according to Theorem 1:  $\hat{\mathcal{I}}_{\mathrm{F - Div}} = \sum_{k = 1}^{d}\hat{H}_k^*\delta_k^2$ .  
16: return  $\hat{\mathcal{I}}_{\mathrm{F - Div}}$ .
the global parameters  $\theta_{t - 1}^{\mathrm{Server}}$  to each client; then clients train  $\theta_t^{(i)}$  on its private dataset locally. Then, the server conducts the federated aggregation, namely gathering multiple local parameters  $\theta_t^{(i)}$  on all clients and updates the global model to calculate  $\theta_t^{\mathrm{Server}}$  with a federated aggregation algorithm.
Federated aggregation. Suppose  $\mathbf{u}_t^{(i)}$  denotes the update on the  $i$ -th client in the  $t$ -th round and  $\mathcal{A}$  aggregates updates on  $n$  clients:  $\mathbf{u}_t^{(i)} = \pmb{\theta}_t^{(i)} - \pmb{\theta}_{t-1}^{\text{Server}}$ , where  $\pmb{\theta}_t^{\text{Server}} = \pmb{\theta}_{t-1}^{\text{Server}} + \mathcal{A}(\{\mathbf{u}_t^{(i)}\}_{i=1}^n)$ .
We focus on robust federated aggregation in this paper. A series of robust federated aggregation algorithms can be formulated into:  $\mathcal{A}(\{\mathbf{u}^{(i)}\}_{i=1}^n) = \sum_{i=1}^n w_i \mathbf{u}^{(i)}$ , where  $\sum_{i=1}^n w_i = 1$ .
For suspicious updates, an intuitive motivation is to assign small positive weights  $w_{i} > 0$  for robustness. [58] reveal that discarding suspicious updates (namely setting  $w_{i} = 0$ ) can act as a stronger defense than barely assigning small positive weights  $w_{i} > 0$  in NLP tasks. Following [58], we choose a set  $S(|S| = \lfloor n / 2 + 1 \rfloor)$  of clients that are not suspected to be poisonous and discard other clients, namely:  $w_{i} = \mathbb{I}(i \in S) / |S|$ , where  $\mathbb{I}(i \in S) = 1$  for  $i \in S$ , and 0 for  $i \notin S$ .
3.2 Detecting suspicious clients utilizing proposed f-divergence indicator
To detect suspicious clients, traditional algorithms [1] intuitively adopt the square of the Euclidean parameter distances, namely Euclidean indicator:  $\mathcal{I}_{\mathrm{Euc}} = \| \delta \|_2^2 = \sum_{k=1}^{d} \delta_k^2$ , where the variation between one client update and the ideal update or averaged update of all clients is  $\delta = [\delta_1, \delta_2, \dots, \delta_d]^{\mathrm{T}}$ . Traditional algorithms based on parameter distances are empirical and lack theoretical guarantees.
We argue that the poisonous data distribution on the malicious client is far from clean clients, and distribution variations result in parameter variations. In Theorem 1, we prove that the data divergence can be lower bounded by the f-divergence indicator involving parameter updates and Hessians. Based on the theoretical analysis, We propose the Federated F-Divergence-Based Aggregation (Fed-FA) algorithm that determines the unsuspected set  $S$  utilizing the proposed f-divergence indicator  $\mathcal{I}_{f\text{-div}}$ .
To find abnormal or suspicious clients,  $\mathcal{I}_{f\text{-div}}^{(k)} = \mathcal{I}_{\mathrm{F - Div}}(\{\mathbf{u}_t^{(i)}\}_{i = 1}^n,k)$  estimates the divergence of datasets between the  $k$  th client and other clients. Suspicious clients have larger  $\mathcal{I}_{f\text{-div}}$  than clean clients, thus we set  $S$  as clients with top-  $\lfloor n / 2 + 1\rfloor$  smallest  $\mathcal{I}_{f\text{-div}}$ . The pseudo-code is shown in Algorithm 1 and further details of the function  $\mathcal{I}_{\mathrm{F - Div}}(\cdot ,\cdot)$  are demonstrated in Sec. 3.3.
**Preparation for Theorem 1.** Suppose  $p(\mathbf{z})$  denotes the probability function of the distribution of the merged dataset on all clients;  $q(\mathbf{z})$  denotes the probability function of the data distribution on one client;  $\theta^{\mathrm{Avg}} = \sum_{i=1}^{n} \theta^{(i)} / n$  denotes the average parameters of all clients; and  $\theta^{\mathrm{Avg}} + \delta$  denotes the parameters on the client, namely  $\delta = \theta^{(k)} - \theta^{\mathrm{Avg}}$ , where  $k$  is the indexes of the client with data distribution  $q(\mathbf{z})$ . Denote  $\mathcal{L}(\boldsymbol{\theta}; \mathbf{z})$  as the loss of the data sample  $\mathbf{z} = (\mathbf{x}, y)$  on parameter  $\boldsymbol{\theta}$ . For a data distribution  $\mathcal{P}$ , define  $\mathcal{L}(\boldsymbol{\theta}; \mathcal{P})$  as the average loss on the distribution  $\mathcal{P}$ :  $\mathcal{L}(\boldsymbol{\theta}; \mathcal{P}) = \mathbb{E}_{\mathbf{z} \sim \mathcal{P}}[\mathcal{L}(\boldsymbol{\theta}; \mathbf{z})]$ .
Modeling data divergence with f-divergence. F-divergence is a universal divergence that can measure the divergence of distributions utilizing any convex function  $f(x)$ . Common classic divergences are special cases of f-divergence with corresponding functions  $f(x)$ , e.g., for Kullback-Leibler divergence [18],  $f(x) = x\log x$ . Therefore, we adopt the lower bound of f-divergence of  $q(\mathbf{z})$ , the distribution on one client, and  $p(\mathbf{z})$ , the distribution on all clients, to estimate the data divergence of  $p(\mathbf{z})$  and  $q(\mathbf{z})$ . We try to find the infimum or greatest lower bound of f-divergence:
$$
\inf  _ {p (\mathbf {z}), q (\mathbf {z})} \quad D _ {f} (q (\mathbf {z}) | | p (\mathbf {z})), \tag {1}
$$
$$
\text {s u b j e c t} \quad \theta^ {*} = \underset {\theta} {\arg \min } \mathcal {L} (\theta ; p (\mathbf {z})), \quad \theta^ {*} + \delta = \underset {\theta} {\arg \min } \mathcal {L} (\theta ; q (\mathbf {z})), \tag {2}
$$
where  $\pmb{\theta}^{*}$  and  $\pmb{\theta}^{*} + \pmb{\delta}$  are optimal parameters on  $p(\mathbf{z})$  and  $q(\mathbf{z})$ ; where  $\pmb{\delta} = [\delta_1, \delta_2, \dots, \delta_d]^{\mathrm{T}}$ ;  $\pmb{\theta}^{*} \approx \pmb{\theta}^{\mathrm{Avg}}$ ;  $D_f(q(\mathbf{z})||p(\mathbf{z}))$  denotes the f-divergence measurement [34]:  $D_f(q(\mathbf{z})||p(\mathbf{z})) = \int_{\mathbf{z}} p(\mathbf{z})f\left(\frac{q(\mathbf{z})}{p(\mathbf{z})}\right)d\mathbf{z}$ , where  $f(x)$  is an arbitrary convex function satisfying  $f(1) = 0$  and  $f''(1) > 0$ .
Proposed f-divergence indicator derived from Theorem 1. To estimate the data divergence, we derive the f-divergence indicator,  $\mathcal{I}_{\mathrm{F - Div}} = \sum_{k = 1}^{d}H_{k}^{*}\delta_{k}^{2}$  from Theorem 1 by analyzing f-divergence:
Theorem 1 (F-Divergence Lower Bound). The lower bound of  $f$ -divergence is:
$$
D _ {f} \left(q (\mathbf {z}) | | p (\mathbf {z})\right) \geq (1 + o (1)) \frac {f ^ {\prime \prime} (1)}{2} \mathcal {I} _ {F - D i v}, \quad \mathcal {I} _ {F - D i v} = \sum_ {k = 1} ^ {d} H _ {k} ^ {*} \delta_ {k} ^ {2}, \tag {3}
$$
where  $H_{k}^{*} = H_{k}\big(\pmb{\theta}^{*};p(\mathbf{z})\big) = \mathcal{L}_{\theta_{k}^{\prime}}^{\prime \prime}\big(\pmb{\theta}^{*};p(\mathbf{z})\big) > 0$  is the  $i$ -th Hessian of loss on  $p(\mathbf{z})$  and  $f''(1) > 0$ .
3.3 Proposed Fed-FA algorithm
In this section, we introduce the implementation of Fed-FA. We propose the dataset synthesis and embedding Hessian reassignment techniques to estimate  $H_{k}^{*}$  in  $\mathcal{I}_{\mathrm{F - Div}}$
Dataset synthesisation. As shown in Line 10-12 in Algorithm 1, to estimate the  $H_{k}^{*}$ , we synthesize a small randomly labeled dataset  $\mathcal{D}^{\mathrm{Syn}} = \{\mathbf{z}_j = (\mathbf{x}_j, y_j)\}$  with unlabeled texts  $\mathbf{x}_j$  and random labels  $y_{j}$ . We adopt dataset synthesisation since local datasets on clients may expose the clients' privacy. We synthesize 4 samples every class. Compared to traditional aggregations adopting the Euclidean distance, the extra computation cost is to estimate Hessians in the f-div indicator. The calculation cost of Hessian estimation on the synthesized dataset is low, which is less than 1/10 of the total aggregation time. We estimate the Hessians with the Fisher information assumption on the synthesized dataset and the parameters  $\theta_{t - 1}^{\mathrm{Server}}\colon \hat{H}_k^* = \mathbb{E}_{\mathbf{z}\sim \mathcal{D}^{\mathrm{Syn}}}\big[\big(\mathcal{L}_{\theta_k}'(\theta_{t - 1}^{\mathrm{Server}};\mathbf{z})\big)^2\big]$ .
Embedding Hessian reassignment. Low-frequency words or features may be utilized to inject backdoors [46]. Therefore, Hessians on these embeddings cannot be precisely estimated with the limited synthesized dataset, which may lead to a weak defense. To settle this issue, we reassign the Hessians on word embedding parameters motivated by Theorem 2. As shown in Line 13-14 in Algorithm 1, the synthesized gradients on word embeddings are reassigned.
Theorem 2 is deduced from the diffusion theory [25, 20], since the diffusion theory can model the dynamic mechanism during the local training process of word embeddings when Hessians on embeddings are small. Suppose  $E$  denotes the set of word embedding dimensions. For  $k \in E$ , to
1More examples are provided in Appendix A.
ensure that (1)  $\sqrt{\hat{H}_k^*} \propto \sum_{i=1}^{n} |u_k^{(i)}| / n$ ; and (2)  $\sum_{k \in E} \hat{H}_k^*$  is invariant after reassignment, we have:
$$
\hat {H} _ {k} ^ {*} = \frac {\sum_ {i \in E} \hat {H} _ {i} ^ {*}}{\sum_ {j \in E} s _ {j}} s _ {k}, \quad s _ {k} = \left(\frac {1}{n} \sum_ {i = 1} ^ {n} | u _ {k} ^ {(i)} | + \epsilon\right) ^ {2}, \tag {4}
$$
where  $\epsilon = 10^{-8}$ ;  $u_{k}^{(i)}$  is the  $k$ -th dimension of  $\mathbf{u}_t^{(i)}$ .
Theorem 2 (Hessian Estimations by Diffusion Theory. Brief. Detailed Version in Appendix A). When  $\sqrt{H_k^*}$  is small, the following expression holds in probability:
$$
\sqrt {H _ {k} ^ {*}} \propto \frac {1}{n} \sum_ {i = 1} ^ {n} \left| u _ {k} ^ {(i)} \right|. \tag {5}
$$
Theorem 2 guides the reassignment of the Hessians on word embedding parameters, which can estimate Hessians on low-frequency words more accurately and form a strong defense.
3.4 Verification of Byzantine resilience and convergence of Fed-FA
[1] propose the concept of Byzantine resilience and prove that the Byzantine resilience of the aggregation  $\mathcal{A}$  can ensure the convergence of the federated learning process. We verify the Byzantine resilience of Fed-FA in Theorem 3. Further discussion of Byzantine resilience is in Appendix A.
Theorem 3 (Byzantine Resilience of Fed-FA. Brief. Detailed Version in Appendix A). Suppose the malicious client number is  $m$ ,  $1 \leq m \leq \left\lfloor \frac{n - 1}{2} \right\rfloor$ , when indicator estimations are accurate enough, there exists  $0 \leq \alpha < \frac{\pi}{2}$  such that Fed-FA aggregation algorithm is  $(\alpha, m)$ -Byzantine resilience: