FEDERATED LEARNING FRAMEWORK BASED ON TRIMMED MEAN AGGREGATION RULES

1 INTRODUCTION . As one special case of distributed machine learning , federated learning ( FL ) draws increasing research attention recently . FL has become one promising approach to enable clients collaboratively to learn a shared model with the decentralized and private data on each client node . Thus it is of central importance to keep the node information secured in FL . Unfortunately , FL is very vulnerable to software/hardware errors and adversarial attacks ; especially Byzantine attack from distributed systems has arose to be a key node attack sample for federated learning . To ensure the FL model resistance to Byzantine attack , research focuses are made on how to introduce aggregation rules into the gradient information iteration process , and how to ensure that this aggregation rule can make the data robust . In particular , classical approaches to avoid the Byzantine failures would employ the state machine replication strategy ( Alistarh et al. , 2018 ) , which can be roughly categorized into two ways in distributed machine learning : ( 1 ) the processes agree on a sample of data based on which the clients update their local parameter vectors ; ( 2 ) the clients agree on how the parameter vector should be updated ( Blanchard et al. , 2017 ) . The former ones demand transmitting data samples to each individual node , resulting in high costs . The latter ways are not reliable neither , as we can not detect whether clients are trustworthy or not , from the mixed Byzantine vectors . The attacker can know any information about the process of FL , and can use any vectors to initiate the attack during the node ’ s information transmission ( Yin et al. , 2018 ) . More specifically , the data between machines can be replaced by any value . This problem is not fully addressed in previous works . When facing the attacks from Byzantine nodes , the FL models have to rely on robust aggregation rules to minimize the influence of the Byzantine attack on the data model ( Bottou , 2010 ) . For instance , Krum ( · ) is a strong aggregation rule designed to identify an honest node such that it can effectively prevent Byzantine attacks in most cases ( Blanchard et al. , 2017 ) . However , if the Byzantine node attack is changed from the original single miner node attack to multiple server attacks , Krum ( · ) is not able to ensure the learning process robustness to noisy data . As another class of aggregation rules , simple mean-based aggregation rules can maintain learning robustness if it is not attacked by Byzantine nodes . However , the Byzantine attack will make the update direction of node gradient information largely deviate from the original function by using simple mean-based aggregation rules . Some variants of mean-based aggregation rules , such as geometric median ( Blanchard et al. , 2017 ) , marginal median ( Alistarh et al. , 2018 ) , are the classical methods to solve the Byzantine node attack problem . But they are not much more robust than simple mean-based aggregation rules in the case of some large deviation Byzantine attacks . The main difficulty that prevents mean-based aggregation rules from robust is the unstable distribution of data ( Jin et al. , 2020 ) . We find that the difficulty can be tackled , if the data is averaged by trimming a part of the data and then imported into the aggregation rules . This motivates our work in this paper . Most of FL approaches are built upon the Stochastic Gradient Descent ( SGD ) algorithm ( Castro et al. , 1999 ) or its variants , and the statistical properties of SGD such as convergence are well developed . Our approach also employs the SGD ; and the typical iterative process of SGD algorithm in distributed system is represented by Figure 1 . First , a client , known as a miner node , estimates the gradient of the node , makes an estimate of the deviation between the estimated information and the ideal gradient information ( El-Mhamdi et al. , 2020 ) , then passes this information to the server node in the network , and finally update the gradient there . So the miner node network transmits the information to the master server , and the master server then passes the gradient update information through a series of aggregation operations . When the aggregation conditions are met , the server transmits the information to the distribution network , and then transmitted to the miner nodes . This is a cyclic process , such that the gradient information is continuously updated in the entire network ( Li et al. , 2014 ) . In this paper , we mainly propose new aggregation rules , Tmean ( · ) , by trimming part of the data before the average operation . We provide theoretical understandings of our aggregation rules , especially , why they are robust to the Byzantine attack . Through attack experiments and mathematical proofs , we have concluded that appropriately trimming the original data and averaging can make the model more robust from the decentralized data . Specifically , in section 3 we introduce the federated learning Byzantine distributed system model , briefly describes the working principle of SGD , and summarizes the update iteration rules based on aggregation rules . Then , we present the concept of Byzantine resilience , and the conditions to satisfy the aggregation rules of Byzantine resilience . We provide concept of trimmed mean and the rigorous theoretical proof and understanding of Tmean ( · ) based aggregation rules in section 4 . Then , we prove the convergence of the proposed federated learning aggregation rules in section 5 . In section 6 , we conduct experiments by Gaussian attack , omniscient attack and multiple servers attack . Under these attacks , Tmean ( · ) -based FL aggregation rules can still maintain robustness . These experiments thus validate the effectiveness of our approaches . Contributions : ( 1 ) We present new aggregation rules , Tmean ( · ) , to the Byzantine resilient federated learning algorithm , and propose federated learning frameworks based on aggregation algorithm . Our proposed approaches are shown to be robust to Byzantine attacks . ( 2 ) We provide rigorous theoretical proof and understanding of our approaches and aggregation rules . To the best of our knowledge , these theorems and theoretical understandings are for the first time contributed to the community . Critically , we make convergence certificates and prove that Tmean ( · ) can converge in the general convex optimization setting . ( 3 ) Empirically , we demonstrate that the effectiveness of our approaches can make the FL model robust to Byzantine attack . 2 RELATED WORK . Federated Learning . Federated learning has become a prominent distributed learning paradigm . In ( Jin et al. , 2020 ) , the authors proposed Stochastic-Sign SGD , a parameter estimation method with convergence guarantees . It uses a gradient compressor based on random symbols to unify that the gradient is updated in the framework . The FedAvg algorithm was first proposed by ( Konečnỳ et al. , 2016 ) , and many scholars subsequently improved it based on this algorithm . ( Karimireddy et al. , 2020 ) pointed out that FedAvg can be improved by adding one additional parameters control variables to correct the client drift , and proved that FedAvg may be seriously affected by the gradient difference of different clients , and may even be slower than SGD . Byzantine attack in FL . To make the secure transmission of the master server node , the FL models have to deal with the Byzantine attack . ( Yin et al. , 2018 ) showed that certain aggregation rules in the master server node can ensure the robustness of the data . ( Blanchard et al. , 2017 ) pointed out that Krum ( · ) can be used to make the robustness of data by computing the local sum of squared Euclidean distance to the other candidates , and outputting the one with minimal sum . When the gradient is updated to the saddle point , there is no guarantee that the SGD algorithm converges to the global optimum . Some scholars have proposed ByzantinePGD ( Yin et al. , 2019 ) , which can escape saddle points and false local minimums , and can converge to an approximate true local minimum with low iteration complexity . Later , in the strong anti-Byzantine model , some scholars carried out poisoning attacks on Byzantine robust data , from the original data collection process to the subsequent information exchange process , and at the same time , these attacks were defended accordingly , in ( Zhao et al. , 2021 ) . The research on the Byzantine structure model of federated learning has been expanded once again ( Zhao et al. , 2021 ) . Attack and Defence . In the framework of federated learning , miner nodes are usually attacked , such as Byzantine node attacks , poisoning attacks ( Zhao et al. , 2021 ) , gradient leakage ( Wei et al. , 2020 ) , etc . There exist various defense methods also , such as robust aggregation , secure aggregation , encryption , etc . Our paper mainly studies Byzantine node attacks . Byzantine node attacks can usually be summarized into two types : ( 1 ) To update gradient information of nodes , nodes are replaced by Byzantine nodes , and normal worker nodes can not make judgments so that the gradient estimates deviate from the actual gradient update direction . ( 2 ) During the gradient process , the local node suffering from the interference of the Byzantine node , can not reach a consensus with the master node , making the entire process unable to proceed normally ( Lamport et al. , 2019 ) . Krum ( · ) is a popular aggregation rule to deal with these node attacks . We shall propose Tmean ( · ) as alternative aggregation rules . 3 PRELIMINARY AND PROBLEM SETUP . 3.1 FEDERATED LEARNING SETTING . Federated learning was first proposed in ( Konečnỳ et al. , 2016 ) , where the prevalent asynchronous SGD is used to update a global model in a distributed fashion . A pioneering work in this field proposed the currently most widely used algorithm , FedAvg ( McMahan et al. , 2017 ) , which is also the first synchronous algorithm dedicated to federated setting . Recent studies attempt to expand federated learning with the aim of providing learning in more diverse and practical environments Server : Initialize x0 ← rand ( ) ; for t = 0 , 1 , . . . , T do Broadcast x ( t ) to all the workers ; Wait until all the gradients ṽ ( t ) 1 , ṽ ( t ) 2 , . . . , ṽ ( t ) m arrive ; Compute G ( t ) = Aggr ( ṽ ( t ) 1 , ṽ ( t ) 2 , . . . , ṽ ( t ) m ) ; Update the parameter x ( t+1 ) ← x ( t ) − γ ( t ) G ( t ) ; end Worker : for t = 0 , 1 , . . . , T do Receive x ( t ) from the server ; Compute and send the local randomized gradient v ( t ) = ∇F ( x ( t ) , ξk ) to the server ; end Algorithm 1 : Distributed synchronous SGD with robust aggregation server . such as multi-task learning , generative models , continual learning , and data with noisy labels . However , these algorithms may obtain suboptimal performance when miners participating in FL have non-independently and identical distributions ( non-i.i.d . ) ( Zhao et al. , 2018 ) . While the convergence of FedAvg on such settings was initially shown by experiments in ( McMahan et al. , 2017 ) , it does not guarantee performance as good as that in an i.i.d . setting . These algorithms pointed out the issue have major limitations , such as privacy violation by partial global sharing of local data ( Zhao et al. , 2018 ) or no indication of improvement over baseline algorithms such as FedAvg ( Hsieh et al. , 2020 ) . Our paper focuses on a general federated setting . In order to better study the problem of aggregation in federated learning , we consider the following optimization problem : min x∈Rd F ( x ) , ( 1 ) where F ( x ) = Eξ∼D [ f ( x ; ξ ) ] is a smooth convex function , ξ is sampled from some unknown distribution D. Ideally , the problem ( 1 ) can be solved by the gradient descent method as x ( t+1 ) ← x ( t ) − γ ( t ) ∇F ( x ( t ) ) , ( 2 ) where γ ( t ) is the learning rate at t-th round . We assume that there exists at least one minimizer of F ( x ) , denoted by x∗ , that satisfies∇F ( x∗ ) = 0 . The problem ( 1 ) is solved in a distributed manner with m miner nodes , and up to q of them may be Byzantine nodes . The detailed algorithm of distributed synchronous SGD with aggregation rule Aggr ( · ) is shown in Algorithm 1 . In each iteration , each miner samples n i.i.d . data points from the distribution D , and computes the gradient of the local empirical loss . Using a certain aggregation rule Aggr ( · ) , the server collects and aggregates the gradients sent by the miners , and estimate the gradient through ∇F ( x ( t ) ) ≈ Aggr ( v1 , v2 , . . . , vm ) . Without Byzantine failures , the k-th worker calculates v ( t ) k ∼ G ( t ) , where G ( t ) = ∇f ( x ( t ) , ξ ) . When there exist Byzantine faults , v ( t ) k can be replaced by any arbitrary value ṽ ( t ) k , and hence ∇F ( x ( t ) ) ≈ Aggr ( ṽ1 , ṽ2 , . . . , ṽm ) . ( 3 )

Summary: This paper considers the trimmed mean function as the aggregation rule for the byzantine resilient distributed learning. The authors provide a theoretical convergence for strongly convex objectives. Besides, the authors empirically compare trimmed mean with krum and average.