SlowGuess/NeurIPS_2023_OCR huggingface dataset:
$$
\begin{array}{l} \geq \frac {1}{| \mathcal {D} _ {i} | (1 + r _ {i} ^ {t})} \left(\sum_ {\mathbf {z} \in \mathcal {D} _ {i}} (\Theta - \Theta_ {c}) ^ {T} \left(\nabla_ {\Theta} \ell (\mathbf {z}; \Theta) - \nabla_ {\Theta_ {c}} \ell (\mathbf {z}; \Theta_ {c})\right) \right. \\ - \| \Theta - \Theta_ {c} \| _ {2} \cdot \| \sum_ {\mathbf {z} ^ {\prime} \in \mathcal {D} _ {i} ^ {\prime}} \nabla_ {\Theta} \ell (\mathbf {z} ^ {\prime}; \Theta) - r _ {i} ^ {t} \sum_ {\mathbf {z} \in \mathcal {D} _ {i}} \nabla_ {\Theta_ {c}} \ell (\mathbf {z}; \Theta_ {c}) \| _ {2}) \quad \triangleright \text {C a u c h y - S c h w a r z i n e q u a l i t y} \\ \geq \frac {1}{| \mathcal {D} _ {i} | (1 + r _ {i} ^ {t})} \left(\sum_ {\mathbf {z} \in \mathcal {D} _ {i}} (\Theta - \Theta_ {c}) ^ {T} \left(\nabla_ {\Theta} \ell (\mathbf {z}; \Theta) - \nabla_ {\Theta_ {c}} \ell (\mathbf {z}; \Theta_ {c})\right) \right. \\ - \| \Theta - \Theta_ {c} \| _ {2} \cdot \left(\sum_ {\mathbf {z} ^ {\prime} \in \mathcal {D} _ {i} ^ {\prime}} \| \nabla_ {\Theta} \ell (\mathbf {z} ^ {\prime}; \Theta) \| _ {2} + r _ {i} ^ {t} \sum_ {\mathbf {z} \in \mathcal {D} _ {i}} \| \nabla_ {\Theta_ {c}} \ell (\mathbf {z}; \Theta_ {c}) \| _ {2}\right) \triangleright \text {t r i a n g l e i n e q u a l i t y} \\ \geq \frac {1}{| \mathcal {D} _ {i} | \left(1 + r _ {i} ^ {t}\right)} \left(\mu \left| \mathcal {D} _ {i} \right| \| \Theta - \Theta_ {c} \| _ {2} ^ {2} - 2 r _ {i} ^ {t} \mid \mathcal {D} _ {i} \mid M \| \Theta - \Theta_ {c} \| _ {2}\right) \quad \triangleright \text {A s s u m p t i o n} 5. 1 (20) \\ = \frac {\mu}{1 + r _ {i} ^ {t}} \| \Theta - \Theta_ {c} \| _ {2} ^ {2} - \frac {1}{1 + r _ {i} ^ {t}} 2 r _ {i} ^ {t} M \| \Theta - \Theta_ {c} \| _ {2}) (21) \\ \geq 0. 5 \mu \| \Theta - \Theta_ {c} \| _ {2} ^ {2} - 2 r _ {i} ^ {t} M \| \Theta - \Theta_ {c} \| _ {2} \quad \triangleright r _ {i} ^ {t} \in [ 0, 1 ] (22) \\ \geq 0. 5 \mu \| \Theta - \Theta_ {c} \| _ {2} ^ {2} - r _ {i} ^ {t} M \| \Theta - \Theta_ {c} \| _ {2} ^ {2} - r _ {i} ^ {t} M) (23) \\ = (0. 5 \mu - r _ {i} ^ {t} M) \| \Theta - \Theta_ {c} \| _ {2} ^ {2} - r _ {i} ^ {t} M, (24) \\ \end{array}
$$
where Equation 23 holds based on the fact that  $-2r_i^t M\|\Theta - \Theta_c\|_2 \geq -r_i^t M\|\Theta - \Theta_c\|_2^2 - r_i^t M$  for  $\forall r_i^t \geq 0$  and  $\forall M \geq 0$ .
In the following, we prove inequality 13. We have that
$$
\begin{array}{l} \left\| g _ {i} - h _ {i} \right\| _ {2} \\ = \frac {1}{\left| \mathcal {D} _ {i} \right| \left(1 + r _ {i} ^ {t}\right)} \| \sum_ {\mathbf {z} ^ {\prime} \in \mathcal {D} _ {i} \cup \mathcal {D} _ {i} ^ {\prime}} \nabla_ {\Theta} \ell \left(\mathbf {z} ^ {\prime}; \Theta\right) - \left(1 + r _ {i} ^ {t}\right) \sum_ {\mathbf {z} \in \mathcal {D} _ {i}} \nabla_ {\Theta_ {c}} \ell \left(\mathbf {z}; \Theta_ {c}\right) \| _ {2} \quad \triangleright \text {d e f i n i t i o n o f} g _ {i} \text {a n d} h _ {i} (25) \\ = \frac {1}{\left| \mathcal {D} _ {i} \right| \left(1 + r _ {i} ^ {t}\right)} \| \sum_ {\mathbf {z} ^ {\prime} \in \mathcal {D} _ {i} ^ {\prime}} \nabla_ {\Theta} \ell \left(\mathbf {z} ^ {\prime}; \Theta\right) + \sum_ {\mathbf {z} ^ {\prime} \in \mathcal {D} _ {i}} \nabla_ {\Theta} \ell \left(\mathbf {z} ^ {\prime}; \Theta\right) - \left(1 + r _ {i} ^ {t}\right) \sum_ {\mathbf {z} \in \mathcal {D} _ {i}} \nabla_ {\Theta_ {c}} \ell \left(\mathbf {z}; \Theta_ {c}\right) \| _ {2} (26) \\ \leq \frac {1}{| \mathcal {D} _ {i} | (1 + r _ {i} ^ {t})} \| \sum_ {\mathbf {z} ^ {\prime} \in \mathcal {D} _ {i} ^ {\prime}} \nabla_ {\Theta} \ell (\mathbf {z} ^ {\prime}; \Theta) - r _ {i} ^ {t} \sum_ {\mathbf {z} \in \mathcal {D} _ {i}} \nabla_ {\Theta_ {c}} \ell (\mathbf {z}; \Theta_ {c}) \| _ {2} \\ + \frac {1}{\left| \mathcal {D} _ {i} \right| \left(1 + r _ {i} ^ {t}\right)} \| \sum_ {\mathbf {z} ^ {\prime} \in \mathcal {D} _ {i}} \nabla_ {\Theta} \ell \left(\mathbf {z} ^ {\prime}; \Theta\right) - \sum_ {\mathbf {z} \in \mathcal {D} _ {i}} \nabla_ {\Theta_ {c}} \ell \left(\mathbf {z}; \Theta_ {c}\right) \| _ {2} \quad \triangleright \text {t r i a n g l e i n e q u a l i t y} (27) \\ \leq \frac {1}{1 + r _ {i} ^ {t}} \left(2 r _ {i} ^ {t} M + L \| \Theta - \Theta_ {c} \| _ {2}\right) (28) \\ \leq 2 r _ {i} ^ {t} M + L \| \Theta - \Theta_ {c} \| _ {2} \quad \triangleright r _ {i} ^ {t} \in [ 0, 1 ] (29) \\ \end{array}
$$
where Equation 28 is due to Assumption 5.1 and 5.2.
Given Lemma B.1, we prove Lemma 5.3 as follows. Recall that we have  $\alpha_{i}^{t} = \frac{p_{i}^{t}}{\sum_{i\in S}p_{i}^{t}}$  and  $\beta_{i}^{t} = \frac{q_{i}^{t}}{\sum_{i\in S}q_{i}^{t}}$ .
$$
\begin{array}{l} \left\| \Theta^ {t + 1} - \Theta_ {c} ^ {t + 1} \right\| _ {2} (30) \\ = \| \Theta^ {t} - \eta \sum_ {i \in \mathcal {S}} \alpha_ {i} ^ {t} g _ {i} ^ {t} - \left(\Theta_ {c} ^ {t} - \eta \sum_ {i \in \mathcal {S}} \beta_ {i} ^ {t} h _ {i} ^ {t}\right) \| _ {2} \quad \triangleright \text {g r a d i e n t d e s c e n t f o r} \Theta^ {t + 1} \text {a n d} \Theta_ {c} ^ {t + 1} (31) \\ = \| \Theta^ {t} - \eta \sum_ {i \in \mathcal {S}} \alpha_ {i} ^ {t} g _ {i} ^ {t} - \left(\Theta_ {c} ^ {t} - \eta \sum_ {i \in \mathcal {S}} \left(\alpha_ {i} ^ {t} + \beta_ {i} ^ {t} - \alpha_ {i} ^ {t}\right) h _ {i} ^ {t}\right) \| _ {2} (32) \\ = \| \Theta^ {t} - \Theta_ {c} ^ {t} - \eta \sum_ {i \in \mathcal {S}} \alpha_ {i} ^ {t} \left(g _ {i} ^ {t} - h _ {i} ^ {t}\right) + \left(\eta \sum_ {i \in \mathcal {S}} \left(\beta_ {i} ^ {t} - \alpha_ {i} ^ {t}\right) h _ {i} ^ {t}\right) \| _ {2} \quad \triangleright \text {r e a r r a n g i n g E q u a t i o n 3 2} (33) \\ \end{array}
$$
$$
\leq \left\| \Theta^ {t} - \Theta_ {c} ^ {t} - \eta \sum_ {i \in \mathcal {S}} \alpha_ {i} ^ {t} \left(g _ {i} ^ {t} - h _ {i} ^ {t}\right) \right\| _ {2} + \| \eta \sum_ {i \in \mathcal {S}} \left(\beta_ {i} ^ {t} - \alpha_ {i} ^ {t}\right) h _ {i} ^ {t} \| _ {2}. \quad \triangleright \text {t r i a n g l e i n e q u a l i t y} \tag {34}
$$
Next, we respectively derive an upper bound for the first and second terms in Equation 34. To derive the upper bound for the first term, we have that
$$
\begin{array}{l} \left\| \Theta^ {t} - \Theta_ {c} ^ {t} - \eta \sum_ {i \in \mathcal {S}} \alpha_ {i} ^ {t} (g _ {i} ^ {t} - h _ {i} ^ {t}) \right\| _ {2} ^ {2} \\ = \| \Theta^ {t} - \Theta_ {c} ^ {t} \| _ {2} ^ {2} - 2 \eta (\Theta^ {t} - \Theta_ {c} ^ {t}) ^ {T} \left(\sum_ {i \in \mathcal {S}} \alpha_ {i} ^ {t} \left(g _ {i} ^ {t} - h _ {i} ^ {t}\right)\right) + \eta^ {2} \| \sum_ {i \in \mathcal {S}} \alpha_ {i} ^ {t} \left(g _ {i} ^ {t} - h _ {i} ^ {t}\right) \| _ {2} ^ {2} (35) \\ = S _ {1} + S _ {2} + S _ {3}, (36) \\ \end{array}
$$
where  $S_{1} = \|\Theta^{t} - \Theta_{c}^{t}\|_{2}^{2}, S_{2} = -2\eta(\Theta^{t} - \Theta_{c}^{t})^{T}(\sum_{i \in \mathcal{S}} \alpha_{i}^{t}(g_{i}^{t} - h_{i}^{t}))$ , and  $S_{3} = \eta^{2}\left\|\sum_{i \in \mathcal{S}} \alpha_{i}^{t}(g_{i}^{t} - h_{i}^{t})\right\|_{2}^{2}$ . Next, we will bound  $S_{2}$  and  $S_{3}$ . We denote  $\gamma^{t} = \sum_{i \in \mathcal{S}_{a}} \alpha_{i}^{t}r_{i}^{t}M$ . Note that we have  $\gamma^{t} = \sum_{i \in \mathcal{S}} \alpha_{i}^{t}r_{i}^{t}M$  since  $r_{i}^{t} = 0$  for  $\forall i \in \mathcal{S} \setminus \mathcal{S}_{a}$ . We bound  $S_{2}$  as follows.
$$
S _ {2}
$$
$$
= - 2 \eta \left(\Theta^ {t} - \Theta_ {c} ^ {t}\right) ^ {T} \left(\sum_ {i \in S} \alpha_ {i} ^ {t} \left(g _ {i} ^ {t} - h _ {i} ^ {t}\right)\right) \tag {37}
$$
$$
= - 2 \eta \sum_ {i \in \mathcal {S}} \alpha_ {i} ^ {t} \left(\Theta^ {t} - \Theta_ {c} ^ {t}\right) ^ {T} \left(g _ {i} ^ {t} - h _ {i} ^ {t}\right) \tag {38}
$$
$$
\leq - 2 \eta \sum_ {i \in \mathcal {S}} \alpha_ {i} ^ {t} \left(\left(0. 5 \mu - r _ {i} ^ {t} M\right) \left\| \Theta^ {t} - \Theta_ {c} ^ {t} \right\| _ {2} ^ {2} - r _ {i} ^ {t} M\right) \tag {39}
$$
$$
= - 2 \eta \left(\left(0. 5 \mu - \sum_ {i \in \mathcal {S}} \alpha_ {i} ^ {t} r _ {i} ^ {t} M\right) \left\| \Theta^ {t} - \Theta_ {c} ^ {t} \right\| _ {2} ^ {2} - \sum_ {i \in \mathcal {S} _ {a}} \alpha_ {i} ^ {t} r _ {i} ^ {t} M\right) \tag {40}
$$
$$
= \left(- \eta \mu + 2 \eta \gamma^ {t}\right) \left\| \Theta^ {t} - \Theta_ {c} ^ {t} \right\| _ {2} ^ {2} + 2 \eta \gamma^ {t}, \quad \triangleright \text {d e f i n i t i o n} \gamma^ {t} \tag {41}
$$
where inequality 39 holds by Lemma B.1 and the fact that  $\eta, \alpha_i^t \geq 0$ . We bound  $S_3$  as follows.
$$
S _ {3}
$$
$$
= \eta^ {2} \| \sum_ {i \in \mathcal {S}} \alpha_ {i} ^ {t} \left(g _ {i} ^ {t} - h _ {i} ^ {t}\right) \| _ {2} ^ {2} \tag {42}
$$
$$
\leq \eta^ {2} \left(\sum_ {i \in S} \alpha_ {i} ^ {t} \| \left(g _ {i} ^ {t} - h _ {i} ^ {t}\right) \| _ {2}\right) ^ {2} \tag {43}
$$
$$
\leq \eta^ {2} \left(\sum_ {i \in \mathcal {S}} \alpha_ {i} ^ {t} \left(2 r _ {i} ^ {t} M + L \| \Theta - \Theta_ {c} \| _ {2}\right) ^ {2} \triangleright \text {L e m m a B . 1} \right. \tag {44}
$$
$$
= \eta^ {2} \left(2 \gamma^ {t} + L \| \Theta - \Theta_ {c} \| _ {2}\right) ^ {2} \tag {45}
$$
$$
= \eta^ {2} \left(L ^ {2} \| \Theta - \Theta_ {c} \| _ {2} ^ {2} + 4 \gamma^ {t} L \| \Theta - \Theta_ {c} \| _ {2} + 4 [ \gamma^ {t} ] ^ {2}\right) \tag {46}
$$
$$
\leq \eta^ {2} \left(L ^ {2} \| \Theta - \Theta_ {c} \| _ {2} ^ {2} + 2 \gamma^ {t} L \| \Theta - \Theta_ {c} \| _ {2} ^ {2} + 2 L \gamma^ {t} + 4 [ \gamma^ {t} ] ^ {2}\right) \tag {47}
$$
$$
= \eta^ {2} \cdot \left(\left(L ^ {2} + 2 L \gamma^ {t}\right) \cdot \| \Theta - \Theta_ {c} \| _ {2} ^ {2} + 2 L \gamma^ {t} + 4 [ \gamma^ {t} ] ^ {2}\right) \tag {48}
$$
where Equation 47 is based on the fact that  $4\gamma^t L\| \Theta -\Theta_c\| _2\leq 2\gamma^t L\| \Theta -\Theta_c\| _2^2 +2\gamma^t L$  when  $\gamma^t L\geq 0$
Given the upper bounds of  $S_{2}$  and  $S_{3}$ , we can bound  $\left\| \Theta^{t} - \Theta_{c}^{t} - \eta \sum_{i\in S}\alpha_{i}^{t}(g_{i}^{t} - h_{i}^{t})\right\|_{2}^{2}$  as follows.
$$
\begin{array}{l} \left\| \Theta^ {t} - \Theta_ {c} ^ {t} - \eta \sum_ {i \in S} \alpha_ {i} ^ {t} \left(g _ {i} ^ {t} - h _ {i} ^ {t}\right) \right\| _ {2} ^ {2} (49) \\ = S _ {1} + S _ {2} + S _ {3} (50) \\ \leq \left\| \Theta - \Theta_ {c} \right\| _ {2} ^ {2} + \left(- \eta \mu + 2 \eta \gamma^ {t}\right) \left\| \Theta^ {t} - \Theta_ {c} ^ {t} \right\| _ {2} ^ {2} + 2 \eta \gamma^ {t} \\ \end{array}
$$
$$
\begin{array}{l} + \left(\eta^ {2} L ^ {2} + \eta^ {2} 2 L \gamma^ {t}\right) \left\| \Theta^ {t} - \Theta_ {c} ^ {t} \right\| _ {2} ^ {2} + \eta^ {2} 2 L \gamma^ {t} + \eta^ {2} 4 [ \gamma^ {t} ] ^ {2} (51) \\ = \left(1 - \eta \mu + 2 \eta \gamma^ {t} + \eta^ {2} L ^ {2} + 2 \eta^ {2} L \gamma^ {t}\right) \| \Theta^ {t} - \Theta_ {c} ^ {t} \| _ {2} ^ {2} + 2 \eta \gamma^ {t} + 2 \eta^ {2} L \gamma^ {t} + 4 \eta^ {2} [ \gamma^ {t} ] ^ {2} (52) \\ \end{array}
$$
Next, we will derive an upper bound for  $\left\| \eta \sum_{i\in S}(\beta_i^t -\alpha_i^t)h_i^t\right\| _2$ . We denote  $r^t = \sum_{i\in S_a}r_i^t$ . Note that we have that  $r^t = \sum_{i\in S}r_i^t$  also holds since  $r_i^t = 0$  for  $\forall i\in S\setminus S_a$ . Given the assumption that  $(1 - r^{t})\alpha_{i}^{t}\leq \beta_{i}^{t}\leq (1 + r^{t})\alpha_{i}^{t}$ , we have
$$
\left\| \eta \sum_ {i \in \mathcal {S}} \left(\beta_ {i} ^ {t} - \alpha_ {i} ^ {t}\right) h _ {i} ^ {t} \right\| _ {2} \leq \eta \sum_ {i \in \mathcal {S}} \left| \beta_ {i} ^ {t} - \alpha_ {i} ^ {t} \right| \left\| h _ {i} ^ {t} \right\| _ {2} \leq 2 \eta r ^ {t} M, \tag {53}
$$
where the first inequality is due to triangle inequality and the second inequality is based on the assumption that  $\| h_i^t\| _2\leq M$ . Therefore, we have:
$$
\begin{array}{l} \| \Theta^ {(t + 1)} - \Theta_ {c} ^ {(t + 1)} \| _ {2} \\ \leq \left\| \Theta^ {t} - \Theta_ {c} ^ {t} - \eta \sum_ {i \in \mathcal {S}} \alpha_ {i} ^ {t} \left(g _ {i} ^ {t} - h _ {i} ^ {t}\right) \right\| _ {2} ^ {2} + \left\| \eta \sum_ {i \in \mathcal {S}} \left(\beta_ {i} ^ {t} - \alpha_ {i} ^ {t}\right) h _ {i} ^ {t} \right\| _ {2} \quad \triangleright \text {E q u a t i o n 3 0 , 3 4} (54) \\ \leq \sqrt {\left(1 - \eta \mu + 2 \eta \gamma^ {t} + \eta^ {2} L ^ {2} + 2 \eta^ {2} L \gamma^ {t}\right) \left\| \Theta^ {t} - \Theta_ {c} ^ {t} \right\| _ {2} ^ {2} + 2 \eta \gamma^ {t} \left(1 + \eta L + 2 \eta \gamma^ {t}\right)} (55) \\ + 2 \eta r ^ {t} M \quad \triangleright \text {E q u a t i o n} 4 9, 5 2, 5 3 (56) \\ \leq \sqrt {1 - \eta \mu + 2 \eta \gamma^ {t} + \eta^ {2} L ^ {2} + 2 \eta^ {2} L \gamma^ {t}} \left\| \Theta^ {t} - \Theta_ {c} ^ {t} \right\| _ {2} + \sqrt {2 \eta \gamma^ {t} (1 + \eta L + 2 \eta \gamma^ {t})} + 2 \eta r ^ {t} M, (57) \\ \end{array}
$$
where the last inequality holds due to the fact that  $\sqrt{a + b} \leq \sqrt{a} + \sqrt{b}$  for  $\forall a \geq 0$  and  $\forall b \geq 0$ , which completes our proof for Lemma 5.3.
B.2 Proof of Theorem 5.4
We denote  $A_{t} = \sqrt{1 - \eta\mu + 2\eta\gamma^{t} + \eta^{2}L^{2} + 2\eta^{2}L\gamma^{t}}$ ,  $A = \sqrt{1 - \eta\mu + 2\eta\gamma + \eta^{2}L^{2} + 2\eta^{2}L\gamma}$ ,  $B_{t} = \sqrt{2\eta\gamma^{t}(1 + \eta L + 2\eta\gamma^{t})} + 2\eta r^{t}M$ , and  $B = \sqrt{2\eta\gamma(1 + \eta L + 2\eta\gamma)} + 2\eta rM$ . Since  $\gamma^t \leq \gamma$  and  $r^t \leq r$ , we have  $A_{t} \leq A$  and  $B_{t} \leq B$ . Thus, based on Lemma 5.3, we have:
$$
\left\| \Theta^ {t} - \Theta_ {c} ^ {t} \right\| _ {2} \leq A \left\| \Theta^ {t - 1} - \Theta_ {c} ^ {t - 1} \right\| _ {2} + B. \tag {58}
$$
Then, we can iteratively apply the above equation to prove our theorem. In particular, we have:
$$
\begin{array}{l} \left\| \Theta^ {t} - \Theta_ {c} ^ {t} \right\| _ {2} \\ \leq A \left\| \Theta^ {t - 1} - \Theta_ {c} ^ {t - 1} \right\| _ {2} + B (59) \\ \leq A \left(A \left\| \Theta^ {t - 2} - \Theta_ {c} ^ {t - 2} \right\| _ {2} + B\right) + B (60) \\ = A ^ {2} \left\| \Theta^ {t - 2} - \Theta_ {c} ^ {t - 2} \right\| _ {2} + \left(A ^ {1} + A ^ {0}\right) B (61) \\ \leq A ^ {t} \left\| \Theta^ {0} - \Theta_ {c} ^ {0} \right\| _ {2} + \left(A ^ {t - 1} + A ^ {t - 2} + \dots + A ^ {0}\right) B (62) \\ = A ^ {t} \left\| \Theta^ {0} - \Theta_ {c} ^ {0} \right\| _ {2} + \frac {1 - A ^ {t}}{1 - A} B (63) \\ = \left(\sqrt {1 - \eta \mu + 2 \eta \gamma + \eta^ {2} L ^ {2} + 2 \eta^ {2} L \gamma}\right) ^ {t} \| \Theta^ {0} - \Theta_ {c} ^ {0} \| _ {2} \\ + \frac {1 - \left(\sqrt {1 - \eta \mu + 2 \eta \gamma + \eta^ {2} L ^ {2} + 2 \eta^ {2} L \gamma}\right) ^ {t}}{1 - \sqrt {1 - \eta \mu + 2 \eta \gamma + \eta^ {2} L ^ {2} + 2 \eta^ {2} L \gamma}} (\sqrt {2 \eta \gamma (1 + \eta L + 2 \eta \gamma)} + 2 \eta r M), (64) \\ \end{array}
$$
When the learning rate satisfies  $0 < \eta < \frac{\mu - 2\gamma}{L^2 + 2L\gamma}$ , we have that  $0 < 1 - \eta \mu + 2\eta \gamma + \eta^2 L^2 + 2\eta^2 L\gamma < 1$ . Therefore, the upper bound becomes  $\frac{\sqrt{2\eta\gamma(1 + \eta L + 2\eta\gamma) + 2\eta rM}}{1 - \sqrt{1 - \eta\mu + 2\eta\gamma + \eta^2 L^2 + 2\eta^2 L\gamma}}$  as  $t \to \infty$ . Hence, we prove our Theorem 5.4.
C Complete Algorithms
C.1 Complete Algorithm of FedGame
Algorithm 1 shows the complete algorithm of FedGame. In Line 3, we construct an auxiliary global model. In Line 4, the function REVERSEENGINEER is used to reverse engineer the backdoor trigger
and target class. In Line 6, we compute the local model of client  $i$  based on its local model update. In Line 7, we compute a genuine score for client  $i$ . In Line 9, we update the global model based on genuine scores and local model updates of clients.
Algorithm 1 FEDGAME
Input:  $\Theta^t$  (global model in the  $t^{\mathrm{th}}$  communication round),  $g_i^t$ ,  $i \in S$  (local model updates of clients),  $\mathcal{D}_s$  (clean training dataset of server),  $\eta$  (learning rate of global model).
Output:  $\Theta^{t + 1}$  (global model for the  $(t + 1)^{\mathrm{th}}$  communication round)
$$
\begin{array}{l} \Theta_ {a} ^ {t} = \Theta^ {t} + \frac {1}{| S |} \sum_ {i \in S} g _ {i} ^ {t} \\ \delta_ {r e}, y _ {r e} ^ {t c} = \text {R E V e r S E E N G I N E E R} \left(\Theta_ {a} ^ {t}\right) \\ \mathbf {f o r} i \in S \mathbf {d o} \\ \Theta_ {i} ^ {t} = \Theta^ {t} + g _ {i} ^ {t} \\ p _ {i} ^ {t} = 1 - \frac {1}{| \mathcal {D} _ {s} |} \sum_ {\mathbf {x} \in \mathcal {D} _ {s}} \mathbb {I} (G (\mathbf {x} \oplus \delta_ {r e}; \Theta_ {i} ^ {t}) = y _ {r e} ^ {t c}) \\ \end{array}
$$
$$
\Theta^ {t + 1} = \Theta^ {t} + \eta \frac {1}{\sum_ {i \in \mathcal {S}} p _ {i} ^ {t}} \sum_ {i \in \mathcal {S}} p _ {i} ^ {t} g _ {i} ^ {t}
$$
$$
\text {r e t u r n} \Theta^ {t + 1}
$$
C.2 Complete Algorithm for a Compromised Client
Algorithm 2 shows the complete algorithm for a compromised client. In Line 3, we randomly subsample  $\rho_{i}$  fraction of training data from  $\mathcal{D}_i$ . In Line 7, the function CREATEBACKDOOREDDATA is used to generate backdoored training examples by embedding the backdoor trigger  $\delta$  to  $\lfloor \min(j * \zeta, 1) | \mathcal{D}_i \setminus \mathcal{D}_i^{rev}| \rfloor$  training examples in  $\mathcal{D}_i \setminus \mathcal{D}_i^{rev}$  and relabel them as  $y^{tc}$ , where  $|\cdot|$  measures the number of elements in a set. In Line 8, the function TRAININGLOCALMODEL is used to train the local model on the training dataset  $\mathcal{D}_i' \cup \mathcal{D}_i \setminus \mathcal{D}_i^{rev}$ . In Line 9, we estimate a genuine score. In Line 15, we use the function CREATEBACKDOOREDDATA to generate backdoored training examples by embedding the backdoor trigger  $\delta$  to  $\lfloor \min(o * \zeta, 1) | \mathcal{D}_i| \rfloor$  training examples in  $\mathcal{D}_i$  and relabel them as  $y^{tc}$ . In Line 16, we use the function TRAININGLOCALMODEL to train a local model and utilize existing state-of-the-art attacks to inject the backdoor based on the training dataset  $\mathcal{D}_i' \cup \mathcal{D}_i$ .
Algorithm 2 ALGORITHM FOR A COMPROMISED CLIENT
1: Input:  $\Theta^t$  (global model in the  $t^{\mathrm{th}}$  communication round),  $\mathcal{D}_i$  (local training dataset of client  $i$ ),  $\rho_i$  (fraction of reserved data to find optimal  $r_i^t$ ),  $\zeta$  (granularity of searching for  $r_i^t$ ),  $\delta$  (backdoor trigger),  $y^{tc}$  (target class), and  $\lambda$  (hyperparameter)
2: Output:  $g_{i}^{t}$  (local model update)
3:  $\mathcal{D}_i^{rev} = \mathrm{RANDOMSAMPLING}(\mathcal{D}_i,\rho_i)$
4: count =  $\lceil \frac{1}{\zeta} \rceil$
5: max_value,  $o\gets 0,0$
6: for  $j \gets 0$  to count do
7:  $\mathcal{D}_i^{\prime} = \mathsf{CREATEBACKDOOREDDATA}(\mathcal{D}_i\setminus \mathcal{D}_i^{rev},\delta ,y^{tc},\min (j*\zeta ,1))$
8:  $\Theta_{ij} = \text{TRAININGLOCALMODEL}(\Theta^t, \mathcal{D}_i' \cup \mathcal{D}_i \setminus \mathcal{D}_i^{rev})$
9:  $p_{ij} = 1 - \frac{1}{|\mathcal{D}_i^{t\text{rev}}|}\sum_{\mathbf{x}\in \mathcal{D}_i^{t\text{rev}}}\mathbb{I}(G(\mathbf{x}\oplus \delta ;\Theta_{ij}) = y^{tc})$
10: if  $p_{ij} + \lambda \min (j*\zeta, 1) > \max\_value$  then
11:  $o = j$
12:  $\max\_value = p_{ij} + \lambda \min(j * \zeta, 1)$
13: end if
14: end for
15:  $\mathcal{D}_i^{\prime} =$  CREATEBACKDOOREDDATA  $(\mathcal{D}_i,\delta ,y^{tc},\min (o*\zeta ,1))$
16:  $\Theta_i^t = \text{TRAININGLOCALMODEL}(\Theta^t, \mathcal{D}_i' \cup \mathcal{D}_i)$
17: return  $\Theta_{i}^{t} - \Theta^{t}$
D Additional Experimental Setup and Results
D.1 Architecture of Global Model
Table 2 shows the global model architecture on MNIST dataset.
D.2 Parameter Setting for Compared Baselines
Recall that we compare our defense with the following methods: FedAvg [28], Krum [6], Median [56], Norm-Clipping [39], Differential Privacy (DP) [39], DeepSight [36], and FLTrust [7]. FedAvg is non-robust while Krum and Median are two Byzantine-robust baselines. Norm-Clipping clips the  $L_{2}$ -norm of local model updates to a given threshold  $\mathcal{T}_N$ . We set  $\mathcal{T}_N = 0.01$  for MNIST and  $\mathcal{T}_N = 0.1$  for CIFAR10. DP first clips the  $L_{2}$ -norm of a local model update to a threshold  $\mathcal{T}_D$  and then adds Gaussian noise. We set  $\mathcal{T}_D = 0.05$  for MNIST and  $\mathcal{T}_D = 0.5$  for CIFAR10. We set the standard deviation of noise to be 0.01 for both datasets. In FLTrust, the server uses its clean dataset to compute a server model update and assigns a trust score to each client by leveraging the similarity between the server model update and the local model update. We set the clean training dataset of the server to be the same as FedGame in our comparison. Note that FLTrust is not applicable when the clean training dataset of the server is from a different domain from those of clients.
Table 2: Architecture of the convolutional neural network for MNIST.
Type	Parameters
Convolution	3 × 3, stride=1, 16 kernels
Activation	ReLU
Max Pooling	2 × 2
Convolution	4 × 4, stride=2, 32 kernels
Activation	ReLU
Max Pooling	2 × 2
Fully Connected	800 × 500
Activation	ReLU
Fully Connected	500 × 10
D.3 Performance of FedGame against Neurotoxin
In Table 3, we compare our FedGame with other defense baselines against Neurotoxin [59]. We can observe that our FedGame is consistently more effective than existing defenses. Our observation is consistent with the experimental results for Scaling attack and DBA attack in Table 1.
Table 3: Comparison of FedGame with existing defenses against Neurotoxin on MNIST under IID setting. The total number of clients is 10 with  $60\%$  compromised. The best results when respectively comparing FedGame in each setting with existing defenses are bold.
Metrics	FedAvg (No attacks)	Defenses (Under attacks)
FedAvg	Krum	Median	Norm- Clipping	DP	Deep- Sight	FLTrust	FedGame
In- domain	Out-of- domain
TA (%)	99.04	99.02	99.32	99.08	90.75	95.28	96.36	95.73	97.27	97.33
ASR (%)	9.69	99.97	99.98	99.99	99.36	99.27	89.02	13.02	9.93	10.03
D.4 Visualization of Genuine Score of FedGame and Trust Score of FLTrust
Our FedGame computes a genuine score for each client which quantifies the extent to which a client is benign in each communication round. Intuitively, our FedGame would be effective if the genuine score is small for a compromised client but is large for a benign one. FLTrust [7] computes a trust score for each client in each communication round. Similarly, FLTrust would be effective if the trust score is small for a compromised client but large for a benign one. Figure 2 visualizes the
average genuine or trust scores for compromised and benign clients of FedGame and FLTrust on the MNIST dataset. We have the following observations from the figures. First, the average genuine score computed by FedGame drops to 0 quickly for compromised clients. In contrast, the average trust score computed by FLTrust drops slowly. Second, the average genuine score computed by FedGame for benign clients first increases and then becomes stable. In contrast, the average genuine score computed by FLTrust for benign clients decreases as the number of iterations increases. As a result, FedGame outperforms FLTrust.
(a) FLTrust (IID)
Figure 2: (a)(b): Server-computed average trust scores for benign and compromised clients of FLTrust on MNIST under Scaling attack. (c)(d): Average genuine scores computed by the server for benign and compromised clients of FedGame on MNIST under Scaling attack. The clean sets of the server are the same for FLTrust and FedGame.
(b) FLTrust (non-IID)
(c) FedGame (IID)
(d)FedGame (non-IID)
D.5 FedGame Performance in FL Consisting of 30 Clients
In Table 4, we report the performance of FedGame and baselines when the total number of clients is 30. The results also indicate that our FedGame outperforms all baselines in terms of ASR and achieves comparable TA with existing methods.
Table 4: Comparison of FedGame with existing defenses under Scaling attack. The total number of clients is 30 with  $60\%$  compromised. The best results when respectively comparing FedGame in each setting with existing defenses are bold.
Datasets	Metrics	FedAvg (No attacks)	Defenses (Under attacks)
FedAvg	Krum	Median	Norm- Clipping	DP	FLTrust	FedGame
In-domain	Out-of-domain
MNIST	TA (%)	99.02	99.09	98.16	99.01	92.77	89.77	95.27	97.81	97.64
ASR (%)	9.74	99.98	99.98	99.98	98.20	98.83	11.04	9.95	9.95
CIFAR10	TA (%)	80.08	79.73	72.23	79.58	79.20	50.86	67.84	73.29	74.42
ASR (%)	9.14	99.82	99.97	99.85	99.87	96.53	99.28	10.44	9.15
D.6 Additional Ablation Studies