SlowGuess/NeurIPS_2023_OCR huggingface dataset:
Guanqiang Zhou
George Mason University gzhou4@gmu.edu
Ping Xu
University of Texas Rio Grande Valley ping.t.xu@utrgv.edu
Georgia State University ywang182@gsu.edu
Zhi Tian
ztian1@gmu.edu
Fairness and robustness are two important goals in the design of modern distributed learning systems. Despite a few prior works attempting to achieve both fairness and robustness, some key aspects of this direction remain underexplored. In this paper, we try to answer three largely unnoticed and unaddressed questions that are of paramount significance to this topic: (i) What makes jointly satisfying fairness and robustness difficult? (ii) Is it possible to establish theoretical guarantee for the dual property of fairness and robustness? (iii) How much does fairness have to sacrifice at the expense of robustness being incorporated into the system? To address these questions, we first identify data heterogeneity as the key difficulty of combining fairness and robustness. Accordingly, we propose a fair and robust framework called H-nobs which can offer certified fairness and robustness through the adoption of two key components, a fairness-promoting objective function and a simple robust aggregation scheme called norm-based screening (NBS). We explain in detail why NBS is the suitable scheme in our algorithm in contrast to other robust aggregation measures. In addition, we derive three convergence theorems for H-nobs in cases of the learning model being nonconvex, convex, and strongly convex, respectively, which provide theoretical guarantees for both fairness and robustness. Further, we empirically investigate the influence of the robust mechanism (NBS) on the fairness performance of H-nobs, the very first attempt of such exploration.
Distributed learning has been widely applied to solve large-scale machine learning (ML) problems, where a number of computing nodes (users) collectively carry out the task of training a model under the coordination of a central node (server). Federated learning is a typical example of distributed learning where each device collects its own local data and keeps them private [1]. In this paper we use distributed learning and federated learning interchangeably.
Aside from the basic expectation of high model accuracy, it is increasingly emphasized in the latest ML research to design distributed learning algorithms that can jointly satisfy several pragmatic constraints such as fairness and robustness [2]. Here we consider the most common definitions where fairness specifically refers to egalitarian fairness and robustness refers to Byzantine robustness, which respectively stipulate that the trained model exhibits somewhat uniform performances on the local users (see Section 2.1), and that the system is resilient to Byzantine attacks where a portion of users defect or malfunction (see Section 2.2). In this paper, we strive for simultaneously
attaining fairness and robustness. Although a few prior efforts have been made towards fair and robust distributed learning [3, 4, 5], this direction is largely underexplored, and some key issues have not been addressed yet. In this paper, we seek to answer three questions that are of paramount importance to the understanding of this topic.
The first question is "What makes jointly satisfying fairness and robustness difficult?" According to the recent literature, (un)fairness issues normally arise in the non-iid settings where the training data residing on local users are heterogeneous [6]. However, for a system to be Byzantine-robust, a typical underlying assumption is that the local data are homogeneous/iid [7, 8, 9, 10, 11]. Such a conflict would invalidate most of the existing Byzantine-robust methodologies developed under the iid assumptions. Therefore, to meaningfully achieve fairness and robustness at the same time, one has to address data heterogeneity, which entails both theoretical and empirical challenges illustrated as follows.
The second question is "Is it possible to establish theoretical guarantee for the dual property of fairness and robustness?" According to the literature, providing convergence guarantees for Byzantine-robust methods (alone) is challenging enough [12]. This is because these methods not only rely on the iid assumption, but also require strong assumptions on the distribution of local gradients, such as sub-exponential [9] or sub-Gaussian [10] (see Section 4.3 for more details). These distributional assumptions usually fall short of proper justifications, and they become even harder to justify under the modified objectives with fairness constraints. Due to these two major obstacles, there has not yet been any work that manages to provide theoretical guarantees for both fairness and robustness.
The third question is "How much does fairness have to sacrifice at the cost of robustness?" To display the inherent conflicts between these two goals, we consider the principles to achieve either goal separately. On one hand, fairness is typically enforced by up-weighting the local objective function of the worst-performing users, which would make their local gradients also heavily-weighted. On the other hand, robustness is typically enforced by the server discarding partial gradients that look suspicious. Since the server cannot decide whether the suspicious gradients (by having large norms or prominent entries) are sent by the Byzantine users or generated from the up-weighted objectives, the latter can be easily filtered out by the deployed robust mechanism, which would inevitably impair the fairness performance. Although this issue was first recognized by a prior work [4], such internal conflicts have not been studied, either theoretically or empirically. Consequently, there are no reported results or understanding on this matter.
Our contributions. In this paper, we propose a fair and robust framework called H-nobs, which contains two key components: a fairness-promoting objective function (the H part) and a simple robust aggregation scheme called norm-based screening/NBS (the nob's part). On one hand, in our algorithm, the certified fairness comes from the fairness-promoting objective function, which can be directly adopted from existing works with theoretical fairness guarantees (see Section 3.2 for a couple of representative examples). On the other hand, we show that the deployed NBS is able to gracefully handle Byzantine attacks and theoretically guarantee the convergence of our algorithm without requiring the iid assumption that is ubiquitous for convergence analysis. Accordingly, we derive three convergence theorems for H-nobs in cases of the learning model being nonconvex, convex, and strongly convex, respectively. In addition, we explain in great detail why NBS is distinctively suitable for our framework, and how it may not be the case for other robust aggregation measures. We achieve this by illustrating three notable theoretical advantages of NBS over its counterparts (see Section 4.3). To address the conflicts between fairness and robustness, we empirically investigate the influence of several robust aggregation schemes, including NBS and other widely-known benchmarks, on the fairness performance (see Section 5). Our results show that although the screening of some fairness-enhancing gradients is inevitable, the overall performance of H-nobs is satisfying. To the best of our knowledge, our work is the first that touches on all of the aforementioned aspects in the pursuit of fair and robust distributed learning.
The major contributions of this work can be summarized as follows:
- We recognize the major challenges in obtaining joint fairness and robustness in distributed learning by identifying three important yet largely overlooked questions. In this work, we have addressed these questions to varying degrees.
- We propose H-nobs, the first algorithm that takes the (obvious but challenging) route of incorporating robust aggregation into existing fair objectives to achieve fair and robust distributed learning.
- We achieve certified fairness and robustness for H-nobs even under the challenging non-iid scenarios, by establishing theoretical convergence guarantees with multiple levels of assumptions on the model convexity. Also, we clearly identify the major technical challenges that may hinder this goal, and illustrate how those challenges can be overcome by NBS through its theoretical robust property.
- We take the initiative to investigate the empirical conflicts between fairness and robustness under a specific metric and objective of fairness, and demonstrate the robustness and fairness benefits of H-nobs.
2.1 Fairness in federated learning
Differing from the common notion of fairness with respect to certain protected attributes (such as race and gender [13]), fairness in federated learning is typically defined over the model accuracies of local devices [14, 15], including two major fairness metrics, i.e., collaborative fairness [3] and egalitarian fairness [16]. These two metrics serve different purposes and suit for the corresponding scenarios. In particular, collaborative fairness enforces each user to receive a personalized model after each iteration according to its contribution to the training [3], which runs counter to our work assuming a single shared model for all users. Therefore, in this paper we only consider egalitarian fairness, which aims to achieve not only satisfactory overall model accuracy, but also somewhat uniform local performances for all participating users [16].
To enforce fairness, one common approach is to replace the empirical training loss with a modified objective function that puts a higher emphasis on the worst-performing users. For example, in an earlier work, [17] proposes Agnostic Federated Learning (AFL), a minimax optimization scheme to minimize the training loss of the worst-off client among all users. However, AFL is reported to perform well only on very small networks consisting of a handful of devices, and its generalization guarantees may not be applicable in a large-scale setting [14]. To improve upon AFL, [16] proposes  $q$ -Fair Federated Learning ( $q$ -FFL), a fairness-promoting objective, which enjoys better scalability and more favorable accuracy/fairness tradeoffs than AFL. The exact formulation of  $q$ -FFL is given in Section 3.2. In Section 5, we adopt egalitarian fairness as the fairness metric and  $q$ -FFL as the objective function to empirically evaluate the effectiveness of our framework.
2.2 Byzantine-robust techniques
Byzantine attack/failure refers to the issue where a small portion of failed nodes may send distorted or even adversarial messages to the server during training [18]. To cope with Byzantine attacks, there are generally two distinct approaches. The first approach assigns each user redundant data, and relies on this redundancy to eliminate the effects of erroneous messages [19, 12]. This approach may not be applicable to federated learning where data cannot be replicated and reassigned for user privacy. The second approach is based on certain robust aggregation mechanisms at the server's end, such as Krum [7], geometric median [8], coordinate-wise median [9], iterative filtering [10], etc. Due to its wide variety of aggregation rules and applicability to federated learning, robust aggregation is commonly viewed as the mainstream approach for mitigating Byzantine attacks.
Although it is an intuitive and seemingly straightforward idea to incorporate robust aggregation into the fairness-promoting objectives for one to achieve both fairness and robustness, we observe that few works take this route due to the two stringent assumptions mentioned in Introduction. To address these technical difficulties, we resort to norm-based screening (NBS), a low-profile screening scheme among the robust aggregation cohorts. Although NBS has previously been implemented in the Byzantine-prone settings [11, 20], few realize its effectiveness in the challenging non-iid environments and its handiness for convergence analysis without necessitating the stringent assumptions. In Section 4, we demonstrate that NBS enjoys a desirable property which allows it to guarantee convergence under much milder assumptions.
3 Proposed framework
3.1 Basic setting
Data division. We consider a typical distributed learning setup with one server and  $m$  users, each holding  $n$  data points with a total of  $mn = N$  training samples. Note that we do not assume that the local data are iid, despite the same sample size for each user. Also, uneven data allocation cases with varying local sample sizes can easily fit into our framework with minor adjustments.
Byzantine attack. We assume that a percentage  $\alpha$  of local users are Byzantine and the remaining  $1 - \alpha$  are normal/honest. The sets of Byzantine users and honest users are denoted as  $\mathcal{B}$  and  $\mathcal{M}$  respectively, with  $|\mathcal{B}| = \alpha m$  and  $|\mathcal{M}| = (1 - \alpha)m$ . During each training iteration, the server would ask all users to conduct certain computational task based on their respective local data and to report the results back to the server. While honest users would follow the given instructions faithfully, Byzantine users need not to adhere to the protocol and can send arbitrary messages to the server.
3.2 Proposed algorithm
On the macro level, our algorithm is a variant of distributed gradient descent, characterized by two distinctive elements, i.e., fairness-aware objective and norm-based screening.
Fairness-aware objective. Let  $f(\theta; x_j)$  be the point-wise training loss, we denote the local training loss on node  $i$  as  $F_i(\theta) = \frac{1}{n} \sum_{j=(i-1)n+1}^{(i-1)n+n} f(\theta; x_j)$  and the global training loss as  $F(\theta) = \frac{1}{m} [F_1(\theta) + \dots + F_m(\theta)]$ . Since minimizing  $F(\theta)$  can produce unfair models, we instead adopt a fairness-aware objective function  $H(\theta)$  from existing literature which has a decomposable form  $H(\theta) = \frac{1}{m} [H_1(\theta) + \dots + H_m(\theta)]$ , with  $H_i(\theta)$  being the fairness-oriented version of  $F_i(\theta)$  that solely relies on the local data of user  $i$ . A few such examples include:
-  $H_{i}(\theta) = \frac{1}{n}\sum_{j = (i - 1)n + 1}^{(i - 1)n + n}[f(\theta ;x_{j}) - \mu ]_{+}^{2}$  proposed by [6] where  $\mu$  is a hyper-parameter.
-  $H_{i}(\theta) = \frac{1}{q + 1} [F_{i}(\theta)]^{q + 1}$  (i.e.,  $q$ -FFL) proposed by [16] where  $q$  is a hyper-parameter.
Note that each specific  $H_{i}(\theta)$  may aim to address a different notion of fairness, with the former example seeking to mitigate representation disparity between majority and minority groups and the latter promoting egalitarian fairness. We also want to point out that our work applies to a broad range of fairness-promoting objectives that are decomposable, thus not limited to the given two examples.
Norm-based screening (NBS). After the local gradients are computed by honest users (w.r.t.  $H_{i}(\theta)$ ) and sent to the server (while Byzantine users craft disruptive gradients denoted as  $\star$ ), we propose to use NBS to aggregate all local gradients before applying its output to update the model. As a robust aggregation measure, the idea of NBS is fairly simple: leave out the gradients with large norms and take the average of the remaining gradients as output. We formally define NBS as a function "Norm_Screen", as detailed in Algorithm 1.
Algorithm 1 Norm-Based Screening
Input:  $g_{1},\ldots ,g_{m}$  ( $m$  local gradients), screening percentage  $\beta$
Output:  $G = \mathrm{Norm\_Screen}_{\beta}(g_1, \ldots, g_m)$
1: generate a new set of indices  $(1),\ldots ,(m)$  , such that  $\| g_{(1)}\| \leq \dots \leq \| g_{(m)}\|$
2: define an index set  $\mathcal{U} = \{(1),\dots ,((1 - \beta)m)\}$  , which specifies the unscreened gradients
3: calculate the output by averaging the unscreened gradients  $G = \frac{1}{|\mathcal{U}|}\sum_{i\in \mathcal{U}}g_i$
Despite its simplicity, NBS can gracefully handle Byzantine users, because any faulty gradient either is filtered out with a large norm, or can only shift the output to a bounded degree. In this way, if some Byzantine gradients bypass NBS, their influence on the output can be offset or mitigated if they are outnumbered by honest gradients that also remain unscreened. In Section 4, this property of NBS is formally stated as an inequality, which will serve as the bedrock of our convergence proofs later on. Combining the above two elements, we summarize the proposed algorithm in Algorithm 2.
Algorithm 2 H-nobs: Fair & Byzantine-Robust Distributed Gradient Descent
Input: screening percentage  $\beta (\geq \alpha)$  , learning rate  $\eta$  , model initialization  $\theta_0$  , total iteration  $T$    
Output: completed model  $\theta_{T}$    
1: for  $t = 0,1,\ldots ,T - 1$  do   
2: Server: send  $\theta_{t}$  to all users   
3: for  $i = 1,2,\dots,m$  do   
4: User i: receive model  $\theta_{t}$  from the server   
5: calculate  $\nabla H_i(\theta_t)$  according to the chosen form of  $H_{i}(\theta_{t})$    
6: generate  $g_{i}(\theta_{t}) = \left\{ \begin{array}{cc}\nabla H_{i}(\theta_{t}) & i\in \mathcal{M}\\ \star & i\in \mathcal{B} \end{array} \right.$    
7: send  $g_{i}(\theta_{t})$  to the server   
8: end for   
9: Server: collect  $g_{1}(\theta_{t}),\ldots ,g_{m}(\theta_{t})$  from the users   
10: compute the aggregated gradient  $G(\theta_t) = \mathrm{Norm\_Screen}_{\beta}(g_1(\theta_t),\dots,g_m(\theta_t))$    
11: update model  $\theta_{t + 1} = \theta_t - \eta \cdot G(\theta_t)$    
12: end for
4 Convergence analysis
In this section, we begin by establishing a key theoretical property of NBS, and then develop three main convergence theorems, and conclude with a discussion that concretely states the distinctive advantages of NBS over other robust aggregation methods.
Previously we explain how NBS can properly upper-bound the influence of Byzantine users in an intuitive way. Here we theoretically quantify this bound in Lemma 1, whose proof is deferred to Appendix A.
Lemma 1. Suppose that a percentage of  $\alpha \leq \frac{1}{2}$  among  $m$  local gradients  $g_{1},\ldots ,g_{m}$  are Byzantine, whose indices compose a set  $\mathcal{B}$  ( $|\mathcal{B}| = \alpha m$ ), and the index set of honest gradients is denoted as  $\mathcal{M}$ . With  $G = \mathrm{Norm\_Screen}_{\beta}(g_1,\dots ,g_m)$  and  $\beta \geq \alpha$ , the following inequality holds:
$$
\| G - \nabla H \| \leq \frac {2 \alpha}{1 - \beta} \| \nabla H \| + \max  _ {i \in \mathcal {M}} \| g _ {i} - \nabla H \| \tag {1}
$$
where  $\nabla H = \frac{1}{m}\left[\nabla H_1 + \dots +\nabla H_m\right]$  with  $\nabla H_{i}$  being the honest gradient of user  $i$
The inequality (1) is critical to the convergence analysis. In Algorithm 2 the model is refined using  $G$ , which is the sum of two terms  $\nabla H$  and  $G - \nabla H$ , with the former being the true gradient (noise-free) and the latter being a noise term that can take any direction. To prove convergence, we must upper-bound the norm of  $G - \nabla H$  as (1) does.
To enable further analysis, we adopt Assumption 1 to bound the second term in the RHS of (1).
Assumption 1. For any specific  $\theta_t$ , it always holds that
$$
\max  _ {1 \leq i \leq m} \left\| \nabla H _ {i} \left(\theta_ {t}\right) - \frac {1}{m} \sum_ {k = 1} ^ {m} \nabla H _ {k} \left(\theta_ {t}\right) \right\| \leq \sigma . \tag {2}
$$
Assumption 1 obviously stands due to the simple fact that the distance between any single vector and the vector mean is always upper-bounded.
Moreover, we make Assumption 2 to ensure that the gradient  $\nabla H(\theta)$  exists.
Assumption 2. The fairness-aware objective  $H(\theta)$  is  $L_{H}$ -smooth.
4.2 Main theorems
Nonconvex losses. We first consider the most general case of the objective function  $H(\theta)$  being nonconvex in  $\theta$ . For this case, we derive Theorem 1 that guarantees convergence of our algorithm to a stationary point of  $H(\theta)$ . The proof of Theorem 1 is deferred to Appendix B.
Theorem 1. Suppose that Assumptions 1-2 hold and  $\alpha < \frac{1}{3}$ . Taking  $\eta = \frac{1}{L_H}$ , Algorithm 2 satisfies
$$
\frac {1}{T} \sum_ {t = 0} ^ {T - 1} \| \nabla H \left(\theta_ {t}\right) \| ^ {2} \leq \frac {2 L _ {H}}{\left(1 - (1 + r) C _ {\alpha} ^ {2}\right) T} \left[ H \left(\theta_ {0}\right) - H \left(\theta^ {*}\right) \right] + \frac {(1 + 1 / r) \sigma^ {2}}{1 - (1 + r) C _ {\alpha} ^ {2}} \tag {3}
$$
where  $\theta^{*}$  is the global minimizer of  $H(\theta)$ ,  $C_{\alpha} = \frac{2\alpha}{1 - \beta}$ , and  $r$  should satisfy  $0 < r < \left(\frac{1 - \beta}{2\alpha}\right)^{2} - 1$ .
Convex losses. Now we consider the case where the loss function is convex as in Assumption 3. Additionally, we make Assumption 4 which suggests that all the intermediate iterations would not be infinitely worse than the initialization  $\theta_0$ . We derive Theorem 2 that grants our algorithm convergence guarantee in the convex regime. The proof of Theorem 2 is deferred to Appendix C.
Assumption 3.  $H(\theta)$  is convex.
Assumption 4. There exists a fixed  $k$  such that  $\| \theta_t - \theta^*\| \leq k\| \theta_0 - \theta^*\|$  holds for  $t = 0,1,\ldots ,T - 1$
Theorem 2. Suppose that Assumptions 1-4 hold and  $\alpha < \frac{1}{3}$ . Taking  $\eta = \frac{1}{L_H}$ , Algorithm 2 satisfies
$$
H \left(\theta_ {T}\right) - H \left(\theta^ {*}\right) \leq \max  \left\{\frac {4 L _ {H} D ^ {2}}{\left(1 - (1 + r) C _ {\alpha} ^ {2}\right) T}, \sqrt {\frac {2 (1 + 1 / r)}{1 - (1 + r) C _ {\alpha} ^ {2}}} D \sigma + \frac {(1 + 1 / r) \sigma^ {2}}{2 L _ {H}} \right\} \tag {4}
$$
where  $D = k\| \theta_0 - \theta^*\|$ ,  $C_{\alpha} = \frac{2\alpha}{1 - \beta}$  and  $0 < r < \left(\frac{1 - \beta}{2\alpha}\right)^2 - 1$ , which are the same as in Theorem 1.
Strongly convex losses. Finally, we assume strong convexity on the objective function as in Assumption 5, in which case we derive Theorem 3 that guarantees convergence of our algorithm to the optimal model  $\theta^{*}$ . The proof of Theorem 3 is deferred to Appendix D.
Assumption 5.  $H(\theta)$  is  $\lambda_{H}$ -strongly convex.
Theorem 3. Suppose that Assumptions 1-2 and 5 hold, and  $\alpha < \frac{1}{1 + 2L_H / \lambda_H} < \frac{1}{3}$ . Taking  $\eta = \frac{2}{L_H + \lambda_H}$ , Algorithm 2 satisfies (with  $C_\alpha = \frac{2\alpha}{1 - \beta}$ )
$$
\left\| \theta_ {T} - \theta^ {*} \right\| \leq \left(\frac {2 L _ {H} C _ {\alpha} + L _ {H} - \lambda_ {H}}{L _ {H} + \lambda_ {H}}\right) ^ {T} \left\| \theta_ {0} - \theta^ {*} \right\| + \frac {\sigma}{\lambda_ {H} - L _ {H} C _ {\alpha}}. \tag {5}
$$
Observations. According to Theorems 1-3, Algorithm 2 is capable of achieving a degree of convergence under varying assumptions regarding the model's convexity. Meanwhile, we can clearly identify the effects of Byzantine percentage  $\alpha$ : a larger  $\alpha$  (i.e., a larger  $C_{\alpha}$ ) not only decreases convergence speed, but also increases convergence error. In contrast, the  $\sigma$  in (2) only affects the convergence error and has no impact on the convergence rate.
The tightness of (1) in Lemma 1. Since all three convergence theorems are derived based upon Lemma 1, it is important to examine the tightness of (1). In practice, one can almost always find a way to upper-bound  $\| G - \nabla H\|$ , normally through some mathematical tricks and engineering approximations. However, convergence guarantees based upon loose bounds may be less effective or even risk losing their meaningfulness altogether. In this regard, we use a one-dimensional toy problem to demonstrate the tightness of (1).