SlowGuess/NeurIPS_2023_OCR huggingface dataset:
The global update is aggregated by summing the bits at each position of the client update vectors. The sums are reconstructed and sent directly to all clients. They implicitly encode the updated global parameters  $\boldsymbol{w}^{\prime}$ , which are recovered via client-side computation in order to keep the computation of  $F^{R}$  light-weight. Details of our malicious-secure Centered Box Clipping protocol can be found in Figure 8.
B.4.3 Malicious Secure P2P FLTrust
Overview of Single-Server FLTrust. Single-server FLTrust (abbreviated FLT) [14] is a robust aggregation algorithm that bootstraps trust using a clean "root" dataset maintained by the server. During each iteration, the server compares client gradients against the gradient computed from the root dataset. Specifically, the server computes a 'trust score' (TS) for each client gradient  $i \in [m]$ , which it uses to compute a weighted sum of normalized gradients which makes up the final aggregate. The trust score and update aggregation are given by the following equations:
$$
T S _ {i} = R e L U \left(\frac {\langle g _ {i} , g _ {0} \rangle}{\| g _ {i} \| \| g _ {0} \|}\right) \tag {7}
$$
$$
g = \frac {1}{\sum_ {j = 1} ^ {m} T S _ {i}} \sum_ {i = 1} ^ {m} T S _ {i} \cdot \bar {g} _ {i} \tag {8}
$$
$$
w = w + \alpha \cdot g \tag {9}
$$
Where  $TS_{i}$  is the trust score for client  $i$ ,  $g_{i}$  is the local gradient for client  $i$ ,  $g_{0}$  is the gradient computed from the root dataset, and  $\bar{g}_{i}$  is the gradient of client  $i$  normalized to have the same length as  $g_{0}$ . As a brief explanation of the framework, the trust score acts as a clipped version of the cosine similarity – the greater the angle between  $g_{i}$  and  $g_{0}$ , the smaller the scaling factor that weights  $\bar{g}_{i}$  in the weighted sum. The ReLU ensures that any  $g_{i}$  with a negative cosine similarity is clipped to 0, and thus contributes no weight to the sum.
Lifting FLT to the P2P setting. We begin by assuming that the root dataset  $D_0$  is publicly accessible, so that all clients may compute the root update  $g_0$  locally, in addition to their local update  $g_i$  inside of  $F^C$ . In  $F^P$  we perform normalization and rotation to simplify the computation of Equations 7 and 8 in  $F^R$  (explained in more detail below). In  $F^R$ , we securely compute the trust score of each client and the corresponding weighted sum of gradients. This weighted sum is submitted as the global update - computation of the updated model parameters is left to the clients as a post-processing step.
The representation of  $\boldsymbol{v}_i$  is chosen to enable efficient computation of  $F^R$  and of DZK proofs of update validity. In detail, we perform a rotation of  $g_i$  and  $g_0$  such that  $g_0$  is aligned with the  $x$ -axis (and the angle between  $g_0$  and  $g_i$  is preserved). We also normalize such that  $g_0$  and  $g_i$  are unit-length. Further, when submitting client updates we use a representation that can only encode a non-negative  $x$ -coordinate (by decomposing each entry of  $\bar{g}_i'$  into a sign and magnitude, and only
$$
\boldsymbol {u} _ {i} \leftarrow F ^ {C} (\text {d a t a}, \text {s t}, \boldsymbol {w})
$$
1.  $(k, m_{i}^{k}) \gets \mathrm{st}$
2. Parse  $\boldsymbol{w} = \left\{b_j^{\boldsymbol{w}}\right\}_{j \in [d \cdot \theta]}$  into  $d$  sets of  $\theta$  values each, corresponding to the  $d$  parameters of the model. Index them as  $p_{ih}$  where  $i \in [\theta]$  and  $h \in [d]$ . // Parse and index the bitwise global update to align with parameters of the model
3. For  $h \in [d]$ ,  $s_h \gets \sum_{i \in [\theta]} p_{ih} \cdot 2^i$  // intermediate value of global update reconstruction
4.  $w_h^k \gets w_h^{k-1} - \eta\left(\frac{1}{m} \cdot s_h\right)$  for  $h \in [d]$ . Call  $\boldsymbol{w}' \gets \left\{w_h^k\right\}_{h \in [d]}$  // reconstruct global model parameters
5. Sample  $\xi_i^k$  from local data  $\mathcal{D}_i$
6. Compute  $\pmb{u}_i = (1 - \beta^k)(\nabla F(\pmb{w}',\xi_i^k)) + \beta^k\pmb{m}_i^k$
7.  $\mathsf{st}\gets (k + 1,\pmb {u}_i)$
$$
\boldsymbol {v} _ {i} \leftarrow F ^ {P} (\boldsymbol {u} _ {i}, \boldsymbol {w})
$$
1. Compute  $\pmb{v}_i^{\prime \prime \prime}\gets \min (\tau ,\max (-\tau ,\pmb {u}_i - \pmb {w})) + \tau$
2. Compute  $v_{i}^{\prime \prime} \leftarrow \frac{(v_{i}^{\prime\prime} - w)}{\tau} \cdot 2^{\theta -1} //$  scale the clipped value and center it to the origin
3. Round and map entries of  $\pmb{v}_i^{\prime \prime}$  to unsigned  $\theta$ -bit integers values  $\in [0,2^{\theta} - 1]$ . Call the result  $\pmb{v}_i^\prime$ .
4. Decompose  $\pmb{v}_i'$  into the component bits used to represent each value in the vector, indexed as  $b_{ij}$  for  $j \in [d \cdot \theta]$ . Submit a vector of the individual bits as  $\pmb{v}_i$ .
$$
\boldsymbol {w} \leftarrow F ^ {R} (\{\boldsymbol {v} _ {i} \} _ {i \in [ n ]}, \boldsymbol {w})
$$
1.  $(k)\gets \mathsf{st}$
2. For  $j \in [d \cdot \theta]$ , compute  $b_j^w \gets \sum_{i \in [m]} b_{ij}$ . // sum each bit across client updates
3.  $\pmb{w} \gets \left\{b_{j}^{\pmb{w}}\right\}_{j \in [d \cdot \theta]}$
4.  $\mathsf{st}\gets (k + 1)$
Figure 8: Centered Box Clipping. By clipping to a box and scaling that box to size  $2^{\theta}$ , this modification of Centered Clipping achieves computational surjectivity and an efficient proof to verify that shared peer updates are inside  $V$ .
accepting a magnitude – and not a sign bit – for the  $x$ -coordinate). This canonical representation simplifies computation of the trust score. In particular, since  $g_{0}$  and  $g_{i}$  are normalized to unit vectors, computation of the cosine similarity  $\frac{\langle g_{i}, g_{0} \rangle}{||g_{i}||||g_{0}||}$  simplifies to  $\langle g_{i}, g_{0} \rangle$ , and since  $g_{0}$  is aligned with the  $x$ -axis, this further simplifies to selecting the  $x$ -coordinate of  $g_{i}$ . Further, we avoid taking the ReLU within  $F^{R}$  by choosing a representation of  $v_{i}$  that cannot represent a  $g_{i}$  with negative  $x$ -coordinate, and specifying that any honest party whose local gradient has negative  $x$ -coordinate supplies an update that will have 0 weight during the computation of Equation 8 (we use the symbol  $\bot$  as a placeholder for such an update – in practice, this can be any arbitrary unit vector with 0 in the  $x$ -coordinate). Thus computation of the trust score during  $F^{R}$  is simplified to taking the  $x$ -coordinate of  $g_{i}'$ .
The chosen representation of  $v_{i}$  constrains the image of  $F^{P}$  to the set of unit vectors with nonnegative  $x$ -coordinates. If we restrict the codomain of  $F^{P}$  to this set, we achieve computational surjectivity. This follows from a simple argument:
Proof: Fix an arbitrary point  $\pmb{v}$  in the set of unit vectors with non-negative  $x$ -coordinates. Fix an arbitrary  $g_0$ . Let  $M$  be a rotation matrix that rotates  $g_0$  to the  $x$ -axis. Consider a client update  $\pmb{u}$  such that  $M\pmb{u}$  is on the line extending from the origin to  $\pmb{v}$ . By definition,  $F^P$  maps  $\pmb{u}$  to  $\pmb{v}$ .
Finally, we construct DZK proofs to verify that  $\pmb{v}_i$  falls inside the set of unit vectors with non-negative  $x$ -coordinates.
Inputs / Public Constants:
- Assume all client states  $S$  contain a public root dataset  ${D}_{0}$  (in addition to their private dataset  ${D}_{i}$  )
1.  $g_0 \gets \text{ModelUpdate}(\boldsymbol{w}, D_0)$  // compute update from root dataset, save in client state
2.  $g_{i} \gets \text{ModelUpdate}(\boldsymbol{w}, D_{i})$  // compute local update from client dataset
3.  $\pmb{u}_i\gets g_i$
1.  $\bar{g}_0\gets \frac{g_0}{\|g_0\|}$  // normalize to unit length
2.  $\bar{g}_i\gets \frac{\pmb{u}_i}{\|\pmb{u}_i\|}$  // normalize to unit length
3.  $M\gets$  rotation matrix aligning  $\bar{g}_0$  with the x-axis.
4.  $\bar{g}_0\gets M\bar{g}_0$
5.  $\bar{g}_i\gets M\bar{g}_i / /$  rotate client update by the same angle
6. Represent  $\bar{g}_i$  and  $\bar{g}_0$  as  $\theta$ -bit fixed-point numbers with a designated sign bit, call this representation  $g_i'$  and  $g_0'$ .
7. If the  $x$ -coordinate of  $\vec{g}_i'$  is negative, submit  $\perp$  as  $\mathbf{v}_i$ .
8. Otherwise, submit a vector of the individual bits of  $\bar{g}_i'$  as  $\pmb{v}_i$ . Each coordinate should be submitted as a sign bit and a binary-encoded magnitude, except for the  $x$ -coordinate which should only have a magnitude since it is non-negative.
$$
\boldsymbol {w} \leftarrow F ^ {R} \left(\left\{\boldsymbol {v} _ {i} \right\} _ {i \in [ n ]}, \boldsymbol {w}\right)
$$
1. Parse  $\pmb{v}_i$  appropriately as  $\bar{g}_i^\prime$
2.  $TS_{i}\gets$  magnitude of x-coordinate of  $\vec{g}_i^{\prime} / /$  since  $g_{0}$  is aligned with  $x$  -axis
3. Submit  $\bar{g} \gets \sum_{i \in [n]} \bar{g}_i' \cdot T S_i$  as global update. Denormalization, rotation, and computation of global model parameters via  $\boldsymbol{w} \gets \boldsymbol{w} + \alpha \cdot g$  is performed as post-processing on the client side.
Figure 9: FLTrust.
DZK Proof of Valid Update. As in RSA and CC, we perform a batch check that all submitted shares are binary-valued (see previous sections for details). We additionally perform a DZK proof that all updates are unit length, by constructing shares of  $\langle \bar{g}_i', \bar{g}_i' \rangle - C$  and revealing them to be 0, where  $C$  is a constant which encodes the square of a  $\theta$ -bit fixed point number with unit magnitude. We batch check these proofs by obtaining shared random field elements  $r_i$  and constructing shares of the sum  $\sum r_i \cdot (\langle \bar{g}_i', g_i' \rangle - C)$ , and finally revealing them to be 0 (i.e. using the same technique as described in the binary-value batch check for RSA). We also perform a DZK proof to ensure that the sign bits are in  $\{-1, 1\}$  by computing shares of  $(b - 1)(b + 1)$  and revealing them to be 0 – this check is batched in the same way as the previous checks.
B.5 Experimental Design
While lifting robust aggregation algorithms to the malicious-secure P2P Learning security model, we make small changes to the algorithms to tailor them for efficiency in the setting. Thus, in order to evaluate P2P Learning, we design experiments to test (1) the effectiveness (in terms of accuracy and robustness) of these tailored algorithms, as well as (2) the efficiency of their implementation as cryptographic protocols. These goals are performed using distinct code bases: we used PyTorch to benchmark accuracy and robustness, and we used the NTL package [40] in  $\mathrm{C}++$  to implement the local computation for the aggregation steps of our malicious-secure framework.
B.5.1 Accuracy and Robustness Experiments
To benchmark the robustness of the different aggregation protocols evaluated in the paper, we ran experiments under each to train a central model in a collaborative machine learning setting with a
Figure 10: Byzantine Robustness of Doubly Robust Protocols for iid EMNIST. We compare RSA and CC after their instantiations in our framework. A cohort size of 50 peers is used.  $f$  is the number of malicious workers. We run each algorithm until its completion.
Figure 11: Byzantine Robustness of Doubly Robust Protocols for iid MNIST. We compare RSA and CC after their instantiations in our framework. A cohort size of 50 peers is used.  $f$  is the number of malicious workers. We run each algorithm until its completion.
Figure 12:  $\ell_2$  vs  $\ell_{\infty}$  norm for CC for iid EMNIST.
Dataset	Type	No attack	sf attack	lf attack	ipm attack	alie attack
EMNIST	IID	91.68	91.09	90.83	91.20	91.43
EMNIST	nonIID	91.69	91.07	90.88	91.19	87.20
CIFAR100	IID	48.04	33.77	44.94	45.64	32.77
Table 2: Maximum accuracy achieved by CC in a given setting.
cohort size of 50 participants and varying numbers of malicious workers (0, 10, 23). 4 attacks, namely bit flip (bf) [45], label flip (lf) [6], inner product manipulation (ipm) [46], and "a little is enough" (alie) [2], were evaluated. In all cases, we computed the testing accuracy as a function of the number of rounds of training.
MNIST (Digits) and EMNIST (Letters) datasets were used as the datasets with the data being evenly divided among the peers. The model architecture from [30] (with 1.2M parameters) was used for MNIST and this architecture was modified to have 26 neurons in the last layer for EMNIST. During training, each client uses a local mini-batch of size 32 at each round and a learning-rate of 0.01.
The training experiments were repeated over two random seeds. The PyTorch [36] framework was used for all experiments.
B.5.2 Computational Efficiency Experiments
To benchmark the efficiency of our framework, we wrote code to perform all local computation steps necessary to run the aggregation step for a single committee member  $(F^R)$  of malicious-secure P2P RSA, CC, and FLT. We used an m5.metal instance on Amazon EC2 to obtain the benchmarks reported in Figure 5. Each benchmark reports the mean runtime of 3 trials - trials were run concurrently in separate threads.
B.6 Accuracy of CC vs Attacks
Our approaches directly leverage robust aggregation algorithms, which perform as well in our case as in the FL setting. We include an additional experiments with CC on iid EMNIST, non-iid EMNIST, and iid CIFAR100 finding that it performs as well as in the FL setting. We present the results in Table 2 and Figure 13.
(a) iid EMNIST
(b) non-iid EMNIST
(c) iid CIFAR100
Figure 13: The accuracy achieved by CC in a given setting. A cohort size of 50 peers was used, with 10 malicious workers. Each algorithm was run for 1000 rounds, with 0.9 momentum,  $1000.0\tau$ , and for 3 different seeds.