SlowGuess/NeurIPS_2023_OCR huggingface dataset:
beneficial to offload as much of the computation as possible to the client-side. Our template (Figure 2) and protocol (Figure 3) do this by separating the trusted server's work into two parts,  $F^P$  and  $F^R$ , and shifting the work of computing  $F^P$  to the clients. This dramatically reduces the computational burden of the aggregation committee, but introduces potential concerns about the correctness of the underlying aggregation algorithm. Namely, in the trusted server setting  $F^P$  is guaranteed to be computed correctly since it is executed by a trusted party, but a malicious client may introduce arbitrary faults into the computation of  $F^P$ . To prevent this while maintaining confidentiality, one could use a zero-knowledge proof to guarantee that  $F^P$  was computed correctly, however this would introduce substantial computational overhead. We achieve a much more efficient result by instead verifying that each peer's local update is well-formed—that it properly falls within the preprocessed domain  $V$ . We observe that if  $F^P$  has a certain property, which we call computational surjectivity, verifying that the update is within  $V$  is just as good as verifying correct computation of  $F^P$ , even though the former comes at substantially lower cost.
4.2 Computational Surjectivity
Our key insight is that by leveraging the properties of robust aggregation, we can relax certain requirements on the correctness of  $F^P$ . These relaxed requirements allow us to offload computation of  $F^P$  to the client-side, while also avoiding the computational overhead of a full zero-knowledge proof that  $F^P$  was computed correctly.
A robust aggregation algorithm guarantees that even when adversaries provide arbitrary values as the output of  $F^C$ , a satisfactory output of  $F^R$  will be computed. Accordingly, we observe that as long as some valid output of  $F^C$  maps to each client's output of  $F^P$ , the final global update will be computed properly. Thus if  $F^P$  is a surjective function (i.e. if  $\forall \pmb{v} \in V, \exists \pmb{u} \in U: \pmb{v} = F^P(\pmb{u})$ ), it is only necessary to verify that  $\pmb{v}_i \in V$  for all client updates  $\pmb{v}_i$  in order to correctly compute  $F^R$ . Below we specify a computational analogue of surjectivity—we require the preimage can be found in polynomial time so the whole protocol can achieve simulation security (Appendix B.3 has details).
Definition 1 A function  $f: U \to V$  is computationally surjective if there is a probabilistic polynomial-time algorithm  $\mathcal{A}: V \to U$  such that for any  $v \in V$ , we have  $f(\mathcal{A}(v)) = v$ .
In general, we have no guarantees on the structure of  $F^P$  and so peers must prove in zero knowledge that  $v_i$  is the result of a valid computation of  $F^P$  (Figure 3, step 5). But if  $F^P$  is computationally surjective, then all possible  $v_i \in V$  are implicitly the output of some computation of  $F^P$ . Thus, it only becomes necessary to prove that the shares of each peers' input reconstructs a point within  $V$ .
Theorem 1 (proof in Appendix B.3) states the security of this protocol in the malicious setting.
Theorem 1 For any single-server robust aggregation algorithm described in  $(F^C, F^P, F^R)$  as in Figure 2, the protocol described in Figure 3 is a secure P2P learning protocol against malicious clients and servers when the underlying MPC scheme is secure.
4.3 Tolerating Peers Disconnecting
Peers cannot always be assumed to remain connected throughout an entire protocol execution, e.g., when peers are mobile devices [11]. Further, it is also common to subsample a small portion of peers as clients to avoid high computation/communication costs [47]. We show how to account for both of these practical settings with minimal modifications to our protocol.
Tolerance to Users Dropping. Our protocol includes two areas where peers must collaborate on the cryptographic protocol: the (client) work of computing updates and the (server / committee) work of aggregating updates. Our protocol already gracefully tolerates any number of clients dropping so long as the pool of remaining clients meets the assumptions of the underlying robust aggregation algorithm. In this case our protocol's output would be just as if those peers did not participate. Our protocol can also tolerate committee member dropout with no impact on the output of the protocol by proportionally increasing the committee size (due to the reconstruction guarantees of VSS). We find that this increase is often small even for substantial drop out rates. For example, to tolerate a  $10\%$  drop rate of honest committee members we need only increase the committee size from 46 to 60 (though this number depends on the algorithm, see Appendix B.1.1 for detailed analysis).
Subsampling Clients. This setting inherits the security of our original protocol as long as all honest peers agree on the selected subsample of clients in each round. This can be accomplished efficiently via secure coin flipping [8], e.g., before the protocol commences. Then, our protocol's computation is reduced proportionally to that of execution on the subsample.
5 Lifting Robust-Aggregation Algorithms to a Malicious-Security Model
Having discussed how a single-server robust aggregation with a computationally surjective  $F^P$  can be lifted to the malicious P2P setting with high efficiency, we apply this principle to the design of malicious-secure versions of three popular robust aggregation algorithms: robust stochastic aggregation (RSA) [32], centered clipping (CC) [29], and FLTrust (FLT) [14] in the P2P setting.
5.1 Instantiating Robust Stochastic Aggregation (RSA) in our malicious-secure framework.
RSA is a lightweight algorithm for Byzantine-robust convex optimization [32] (see Appendix B.4.1 for a summary). We observe that it can be lifted to the malicious security model with high efficiency with very few modifications to the algorithm because it is computationally surjective (which we show formally in Appendix B) and the underlying MPC can be efficiently instantiated.
In RSA peer updates are the sign of the difference between each parameter of the local and global models. In other words, the  $F^P$  of RSA gives  $V = \{-1, 1\}^d$ , where  $d$  is the number of parameters in the model. Thus, it is sufficient for peers to prove in zero-knowledge that their updates are in the set  $V = \{-1, 1\}^d$ . This can be accomplished efficiently by having each peer represent their update as  $d$  shares of binary values. The committee can perform a distributed zero knowledge (DZK) proof that a shared  $x$  is binary-valued by constructing shares of  $x \cdot (1 - x)$  and revealing it to be zero. These proofs can be batched together for a substantial improvement in efficiency. In particular, for every shared value  $x_i$ , parties uniformly sample a random value  $r_i$ , and locally construct shares of the sum  $\sum r_i \cdot (x_i \cdot (1 - x_i))$ . The parties then reconstruct the sum—if it is 0, then each of the  $(x_i \cdot (1 - x_i))$  components must have been 0 with all but negligible probability. For a more detailed treatment of this technique, see [12].
During the computation of  $F^R$ , the committee needs only to sum the shares and send out the reconstructed sum. The actual value of the summed updates in  $\{-1, 1\}$  is implicitly given by the sum of the binary values (if the sum of the binary values is  $x$ , simply take  $2x - m$ ).
5.2 Instantiating Centered Clipping (CC) in our malicious-secure framework.
CC with momentum is a robust aggregation algorithm that ensures protection against time-coupled poisoning attacks [29] (see Appendix B for a summary). To lift it to our improved security model with
practical efficiency, we construct a computationally surjective variant of the CC algorithm. Namely, while canonical CC clips local updates using the  $\ell_2$  norm, we use the  $\ell_{\infty}$  norm. In other words, we clip the gradients to a  $\tau$ -box rather than a  $\tau$ -ball. This modification admits a computationally surjective  $F^P$  with an efficient DZK proof that a client update is within the valid domain. In particular, we take  $V = [0, 2^\theta - 1]^d$ . Then in  $F^P$  we scale, round, and map clipped gradient updates to be within this domain. Here  $\theta$  is a public constant large enough to limit discretization error of local updates during scaling—in experiments with CC we set  $\theta$  to 32 in order to align with 32-bit fixed-point numbers. Smaller values of  $\theta$  will increase protocol efficiency, at the expense of higher discretization error during rounding and mapping in  $F^P$  step 3. The computational surjectivity of this  $F^P$  follows from a similar argument to Lemma 2 (see Appendix B).
DZK Proof of Valid Update. We specify that local updates  $\boldsymbol{v}_i$  are submitted as vectors of the individual component bits of the processed gradient update. This means that each bit will be individually secret shared, which allows the committee to verify whether each one is binary-valued (using the same DZK technique described above for the RSA protocol). Since we scaled each update to fit within a  $2^{\theta}$ -sized  $d$ -dimensional box, the  $d$  sets of  $\theta$  binary values in the update trivially encode a point within the box. Thus, a proof that each component of the bitwise update is binary-valued equates to a proof that the update is in  $V$ .
The global update is aggregated by summing the bits at each position of the client update vectors. The sums are reconstructed and sent directly to all clients. They implicitly encode the updated global parameters  $\boldsymbol{w}^{\prime}$ , which are recovered via client-side computation in order to keep the computation of  $F^{R}$  light-weight. Details of our malicious-secure Centered Box Clipping protocol can be found in Figure 8 (in Appendix).
5.3 Instantiating FLTrust in Malicious-Secure Framework
FLTrust (FLT) is a robust aggregation algorithm that uses a trusted dataset to filter out poisoned updates [14] (see Appendix B for a summary). As with CC, we construct a tailored variant of FLT that admits a computationally surjective  $F^P$  to improve efficiency. In particular we rotate and scale the "root" update  $g_0$  to be a unit vector aligned with the x-axis. This allows us to take  $V$  to be the set of unit vectors in the half-space defined by a non-negative x-coordinate. As such,  $F^P$  involves scaling and rotating client updates so that the angle between them and  $g_0$  is preserved. Similarly to CC, we encode client updates as  $\theta$ -bit fixed point numbers. In our benchmarks for FLT, we set  $\theta$  to 16 to compensate for the increased memory demands of this protocol. We use a committee size of 121 in order to enable multiplication of secret shared values (see Appendix B for details).
DZK Proof of Valid Update. As in CC, the magnitudes of local updates  $\boldsymbol{v}_i$  are submitted as shares of each bit in the binary representation of each fixed-point number. Clients additionally submit shares encoding sign for each parameter, with the exception of the x-coordinate, which is assumed to be always non-negative. We use the previously described technique to verify that the shares encoding magnitude are binary-valued. We use a similar technique to verify that shares encoding sign are in the set  $\{-1, 1\}$  (i.e. we reveal  $(b + 1)(b - 1)$  to be zero using a batch check). Further, we verify that submitted updates are unit length by constructing shares of  $\langle \bar{g}_i, \bar{g}_i \rangle - C$ , where  $C$  is the squared length of a unit vector represented as a  $\theta$ -bit fixed-point number. Revealing this quantity to be zero verifies in zero-knowledge that  $\bar{g}_i$  was indeed unit length.
6 Verifying Empirical Efficacy and Efficiency
Our empirical evaluation focuses on exploring three major axes: (1) the Byzantine robustness of our implementations due to modifications we introduced, (2) the computational efficiency of our protocol, and (3) the tradeoff between computational efficiency and Byzantine robustness. To this end, we center our comparisons on robust stochastic aggregation (RSA), Centered Clipping (CC), and FLTrust (FLT) but remark that our framework is compatible with other (potentially future) Byzantine robust algorithms as well. We demonstrate the practical efficiency of our case studies in the P2P Learning framework while maintaining the same robustness of the algorithms as in their clear versions.
4 Karimireddy et al. [29] proved CC is robust under clipping for the  $\ell_p$  norm for arbitrary choice of real numbers  $p\geq 1$ , which do not extend to the  $\ell_{\infty}$  norm. We show empirically that centered clipping with the  $\ell_{\infty}$  norm achieves similar model fidelity against known attacks in Appendix B.
(a) Runtime vs Number of Parameters.
(b) Runtime vs Number of Peers.
Figure 5: Computational Efficiency vs Number of Parameters and Peers. We report CPU wall-clock time for the execution of the aggregation step of our protocol – the computation of  $F^R$  in a single training round. The runtime performance of the algorithms (RSA, FLT, and CC) scales linearly with the number of parameters and peers. When modifying parameters we use a total of 100 peers (left subfigure) and  $10^5$  parameters set when changing the number of peers (right subfigure). For RSA and CC, the aggregation committee size is set to 46, and for FLT it is set to 121 in order to accommodate the secret share multiplications of the protocol (see Appendix B for details).
6.1 Security Does not Impact Robustness
We verify if the properties of the robust aggregation algorithms hold after the required modifications to lift them to the malicious setting, e.g., switching to fixed point numerical precision. In Figure 4, we use the IID MNIST dataset and 20 peers, of which there are 10 malicious workers<sup>5</sup>. We compare the robustness of CC against the ALIE (A Little Is Enough) attack [2] before and after lowering CC's numerical precision. We observe that the algorithm preserves its robustness despite the required changes. We also present corresponding additional studies (e.g. comparison between  $\ell_{2}$  and  $\ell_{\infty}$  norm for CC) in Appendix B. We observe that all the modified algorithms, namely CC, FLT, and RSA exhibit comparable performance to the original algorithms.
Figure 4: Fixed vs floating-point numerical precision for CC.
6.2 Scaling of Computational Efficiency
Because P2P learning algorithms typically require upwards of 1000 rounds of the protocol to converge, it is a necessity to have an efficient protocol. In Figure 5, we analyze the two major factors influencing this: the size of the vector (ML model) being aggregated (denoted as the number of parameters), and the number of peers participating in the collaborative learning. We observe much better performance for RSA than other algorithms per training round. This results from a more concise form of the information exchanged between peers in the case of RSA, where local updates from each peer are represented as an array of bits. In contrast, model updates sent between peers in FLT or CC are always encoded as fixed points, 16 for FLT vs 32 for CC. The more efficient encoding in RSA provides a speedup of around  $\sim 30\mathrm{X}$  in comparison to CC and  $\sim 6\mathrm{X}$  over FLT. Our framework scales efficiently to even 5000 participants; we observe a linear growth in terms of the elapsed time per training round. Similarly, the computation time scales linearly for RSA, FLT, and CC, with the number of parameters. We further compare the communication cost between frameworks in Appendix B.
6.3 End-to-end Protocol Evaluation in Presence of Attacks
We estimate the accuracy and runtime of the modified algorithms in the presence of different types of attacks in Figure 6. We compute the number of rounds to convergence, and use the per-round CPU
<sup>5</sup>Note, this is a higher adversarial proportion than can be tolerated by our end-to-end framework due to the cryptographic elements of our framework. We include this evaluation because the Byzantine robustness literature commonly considers this regime. This evaluation ensures that our underlying aggregation algorithms meet these standards (even when modified for efficiency). Thus, we also benchmark accuracy and robustness of the aggregation algorithms outside of the cryptographic elements, finding that the robustness guarantees are retained.
Figure 6: Byzantine Robustness of P2P Learning Protocols for iid EMNIST. We compare RSA, FLT, and CC after their instantiations in our framework. A cohort size of 50 peers is used, of which there are 10 malicious workers. We consider four attacks and have a baseline without any malicious workers. We run each algorithm until its completion. CC achieves the highest final accuracy. FLT and CC converge much faster than RSA.
time for computation of  $F^R$  in each algorithm, to estimate overall training runtime and accuracy for EMNIST (and similar results for MNIST in Appendix B). We plot the test accuracy (\%) on the y-axis and the x-axis represents the estimated CPU time (measured in seconds, note that this is in the logarithmic scale) of the P2P training. We observe that in all cases, CC and FLT algorithms outperform RSA in terms of convergence speed and achieve higher final accuracy. Note that the overall convergence speed is decided by both the number of iterations of training and the cost of each iteration. Although RSA is faster to compute for one iteration due to reduced information exchanged in each iteration, it requires much more iterations than CC and FLT, and hence slower to converge. When considering only utility, CC also outperforms FLT consistently; however, under computation constraints, it is often the case that FLT is more efficient than CC. This is primarily because we use a fixed-point length ( $\theta$ ) of 16 bits in the experiments for FLT, but 32 bits for CC.
We provided a reference implementation of our protocol for three popular robust aggregation algorithms, namely RSA, FTL, and CC. We hope that our framework will be easy to extend to future robust aggregation methods. We acknowledge that operating in the malicious threat model also increases the cost of computation, communication, and storage, in comparison to the fully trusted environment or an honest-but-curious threat model.
Our protocol is focused on confidentiality and security of the training protocol when combined with robustness. This is one component of privacy-preserving machine learning that is critical to preventing many attacks (as outlined in Table 1 and Section 2). However, this does not prevent the privacy leakage obtained via interactions with the final trained model. For this, differential privacy (DP) [21], in particular DP machine learning techniques [1, 3, 18, 19] are required. Incorporating these techniques within our framework is of interesting future work.
The benefits of collaborative learning make it an attractive new paradigm that is increasingly adopted in many domains, such as the financial sector to enable collaboration between banks. However, there are many risks associated with collaboration due to clients or server(s) being actively malicious. Malicious clients can submit corrupted updates which leads to the failure of creating a useful shared model. Conversely, the leakage of the client's local data when contributing model updates has been demonstrated to be particularly strong when a central party cannot be trusted to orchestrate the collaborative learning protocol. To mitigate these issues, we propose a Peer-to-Peer Learning protocol that is robust against malicious clients and server(s) to train a shared model without a central party. We prove the cryptographic security of our protocol, providing the necessary security guarantees. Our novel framework is designed as a generic compiler that can efficiently convert robust aggregation algorithms to the P2P learning setting with the guaranteed malicious-secure protocol. We show empirically that the generated protocols retain their robustness guarantees. This generic approach can be applied to many (possibly future) aggregation algorithms.
We would like to acknowledge our sponsors, who support our research with financial and in-kind contributions: Amazon, Apple, CIFAR through the Canada CIFAR AI Chair, DARPA through the GARD project, Intel, Meta, NSERC through the Discovery Grant, the Ontario Early Researcher Award, and the Sloan Foundation. Resources used in preparing this research were provided, in part, by the Province of Ontario, the Government of Canada through CIFAR, and companies sponsoring the Vector Institute. Xiao Wang is supported by NSF #2016240, #2236819, #2318974, and research awards from Google and Meta. Jha is supported by Air Force Grant FA9550-18-1-0166, the National Science Foundation (NSF) Grants CCF-FMitF-1836978, IIS-2008559, SaTC-Frontiers-1804648, CCF-2046710, CCF-1652140, and 2039445, and ARO grant number W911NF-17-1-0405, and DARPA-GARD problem under agreement number 885000. Franzese is supported by the National Science Foundation Graduate Research Fellowship Grant No. DGE-1842165. We would also like to thank CleverHans lab group members for their feedback.
[1] Martin Abadi, Andy Chu, Ian Goodfellow, H Brendan McMahan, Ilya Mironov, Kunal Talwar, and Li Zhang. Deep learning with differential privacy. In Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, pages 308-318, 2016.
[2] Moran Baruch, Gilad Baruch, and Yoav Goldberg. A little is enough: Circumventing defenses for distributed learning. 2019. doi: 10.48550/ARXIV.1902.06156. URL https://arxiv.org/abs/1902.06156.
[3] Raef Bassily, Adam Smith, and Abhradeep Thakurta. Private empirical risk minimization: Efficient algorithms and tight error bounds. In 2014 IEEE 55th Annual Symposium on Foundations of Computer Science, pages 464-473. IEEE, 2014.
[4] James Bell, Adrià Gascon, Tancrède Lepoint, Baiyu Li, Sarah Meiklejohn, Mariana Raykova, and Cathie Yun. Acorn: Input validation for secure aggregation. Cryptology ePrint Archive, 2022.
[5] James Henry Bell, Kallista A. Bonawitz, Adrià Gascon, Tancrede Lepoint, and Mariana Raykova. Secure single-server aggregation with (poly)logarithmic overhead. In Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security, CCS '20, page 1253-1269, New York, NY, USA, 2020. Association for Computing Machinery. ISBN 9781450370899. doi: 10.1145/3372297.3417885. URL https://doi.org/10.1145/3372297.3417885.
[6] Battista Biggio, Blaine Nelson, and Pavel Laskov. Poisoning attacks against support vector machines, 2012. URL https://arxiv.org/abs/1206.6389.
[7] Peva Blanchard, El Mahdi El Mhamdi, Rachid Guerraoui, and Julien Stainer. Machine learning with adversaries: Byzantine tolerant gradient descent. Advances in Neural Information Processing Systems, 30, 2017.
[8] Manuel Blum. Coin flipping by telephone: a protocol for solving impossible problems. SIGACT News, 15(1):23-27, jan 1983. ISSN 0163-5700. doi: 10.1145/1008908.1008911. URL https://doi.org/10.1145/1008908.1008911.
[9] Franziska Boenisch, Adam Dziedzic, Roei Schuster, Ali Shahin Shamsabadi, Ilia Shumailov, and Nicolas Papernot. When the curious abandon honesty: Federated learning is not private, 2021. URL https://arxiv.org/abs/2112.02918.
[10] Franziska Boenisch, Adam Dziedzic, Roei Schuster, Ali Shahin Shamsabadi, Ilia Shumailov, and Nicolas Papernot. Is federated learning a practical pet yet? 2023.
[11] Keith Bonawitz, Vladimir Ivanov, Ben Kreuter, Antonio Marcedone, H Brendan McMahan, Sarvar Patel, Daniel Ramage, Aaron Segal, and Karn Seth. Practical secure aggregation for privacy-preserving machine learning. In proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, pages 1175-1191, 2017.