Federated Learning via Plurality Vote

1 INTRODUCTION . Federated learning enables multiple workers to solve a machine learning problem under the coordination of a central server ( Kairouz et al. , 2021 ) . Throughout the training stage , client data will be kept locally and only model weights or model updates will be shared with the server . Federated averaging ( FedAvg ) ( McMahan et al. , 2017 ) was proposed as a generic federated learning solution . Although FedAvg takes advantage of distributed client data while maintaining their privacy , it leaves the following two challenges unsolved . First , transmitting high-dimensional messages between a client and the server for multiple rounds can incur significant communication overhead . Quantization has been incorporated into federated learning in recent studies ( Reisizadeh et al. , 2020 ; Haddadpour et al. , 2021 ) . However , directly quantizing the gradient vector may not provide the optimal trade-off between communication efficiency and model accuracy 1 . Second , the aggregation rule in FedAvg is vulnerable to Byzantine attacks ( Blanchard et al. , 2017 ) . Prior works tackled this issue by using robust statistics such as coordinate-wise median and geometric median in the aggregation step ( Blanchard et al. , 2017 ; Yin et al. , 2018 ) . Another strategy is to detect and reject updates from malicious attackers ( Muñoz-González et al. , 2019 ; Sattler et al. , 2020 ) . The robustness of the algorithm is enhanced at the cost of additional computation and increased complexity of algorithms . In this paper , we propose a new method called federated learning via plurality vote ( FedVote ) . We train a neural network at each worker with a range normalization function applied to model parameters . After local updating , binary/ternary weight vectors are obtained via stochastic rounding and sent to the server . The global model is updated by a voting procedure , and the voting results are sent back to each worker for further optimization in the next round . The contributions of the paper are summarized as follows . 1 . We present FedVote as a novel federated learning solution to jointly optimize the communication overhead , learning reliability , and deployment efficiency . 2 . We theoretically and experimentally verify the effectiveness of our FedVote design . In bandwidth-limited scenarios , FedVote is particularly advantageous in simultaneously achieving a high compression ratio and good test accuracy . Given a fixed communication cost , FedVote improves model accuracy on the CIFAR-10 dataset by 5–10 % , 15–20 % , 1Predictive coding in video and image compression ( Li et al. , 2015 ; Gonzalez & Woods , 2014 ) is an example that directly quantizing the raw signal we intend to transmit does not provide the best trade-off between the coding efficiency and the utility/bitrate . and 25–30 % compared with FedPAQ ( Reisizadeh et al. , 2020 ) , signSGD ( Bernstein et al. , 2018 ) , and FedAvg , respectively . 3 . We extend FedVote to incorporate reputation-based voting . The proposed method , Byzantine-FedVote , exhibits much better resilience to Byzantine attacks in the presence of close to half attackers without incurring excessive computation compared with existing algorithms . 2 RELATED WORK . Communication-Efficient Federated Learning . In the prior study of federated learning , various strategies have been proposed to reduce communication cost . One research direction is to reduce the size of messages in each round . For example , Bernstein et al . ( 2018 ) showed that sign-based gradient descent schemes can converge well in the homogeneous data distribution scenario , while Chen et al . ( 2020 ) ; Jin et al . ( 2020 ) ; Safaryan & Richtarik ( 2021 ) extended it to the heterogeneous data distribution setting . In parallel , FedAvg adopts a periodic averaging scheme and targets at reducing the number of communication rounds ( McMahan et al. , 2017 ) . Hybrid methods consider simultaneous local updates and accumulative gradient compression ( Reisizadeh et al. , 2020 ; Haddadpour et al. , 2021 ) . In this work , we improve communication efficiency by employing binary/ternary weights in the neural network . Quantized Neural Networks . Quantized neural networks aim to approximate the full-precision networks using quantized weights while keeping their generalizability . As a special case , binary neural networks ( BNNs ) are gaining popularity in recent years . By restricting model weight values to { −1 , +1 } , BNNs can reduce computational cost , memory requirement , and energy consumption . Hubara et al . ( 2016 ) introduced real-valued latent weights and used the sign operator for binarization . In contrast , Shayer et al . ( 2018 ) let the neural network learn the distribution of the binary or ternary weights . Gong et al . ( 2019 ) added a soft quantization function to the real-valued weights , thus avoiding the gradient mismatch between the forward and the backward passes . A more thorough survey on BNN optimization can be found in Qin et al . ( 2020a ) . Distributed Optimization of Quantized Neural Networks . A few recent works have explored BNN optimization in a distributed setting , which is more relevant to our work . Lin et al . ( 2020 ) conducted the case study of 1-bit quantized local models aggregated via ensemble distillation . The aggregation becomes complicated due to the separate optimization stage of knowledge distillation , especially when the distillation algorithm does not converge well in practice . In addition , their BNN optimization is not tailored to the federated learning setting . Hou et al . ( 2019 ) theoretically analyzed the convergence of distributed quantized neural networks , which was later implemented in the application of intrusion detection ( Qin et al. , 2020b ) . In comparison , FedVote is presented as a new algorithm by leveraging client local updates to accelerate the training . Different from Hou et al . ( 2019 ) , we do not assume a convex and twice differentiable objective function and bounded gradients . Therefore , the analyses in Hou et al . ( 2019 ) can not be directly applied to our study . Byzantine Resilience in Federated Learning . An attack is Byzantine if arbitrary outputs are produced due to the adversary ( Kairouz et al. , 2021 ) . Blanchard et al . ( 2017 ) showed that FedAvg can not tolerate a single Byzantine attacker . They proposed an aggregation-rule-based remedy using the similarity of local updates . Similarly , Yin et al . ( 2018 ) took the advantage of coordinatewise median and trimmed-mean to robustify the aggregation . Muñoz-González et al . ( 2019 ) and Sattler et al . ( 2020 ) detected the adversaries and filtered out their model updates . In this paper , we propose a reputation-based voting strategy for FedVote that is shown to have good convergence performance in the Byzantine setting . 3 PRELIMINARIES . Symbol conventions are as follows . Bold lower cases of letters such as vm denote column vectors , and vm , i is used to denote its ith entry . For a scalar function , it applies elementwise operation when a vector input is given . 1 = [ 1 , . . . , 1 ] > denotes a vector with all entries equal to 1 . 3.1 FEDERATED LEARNING . The goal of federated learning is to build a machine learning model based on the training data distributed among multiple workers . To facilitate the learning procedure , a server will coordinate the training without seeing the raw data ( Kairouz et al. , 2021 ) . In a supervised learning scenario , let Dm = { ( xm , j , ym , j ) } nmj=1 denote the training dataset on the mth worker , with the input xm , j ∈ Rd1 and the label ym , j ∈ Rd2 in each training pair . The local objective function fm with a model weight vector θ ∈ Rd is given by fm ( θ ) , fm ( θ ; Dm ) = 1 nm nm∑ j=1 ` ( θ ; ( xm , j , ym , j ) ) , ( 1 ) where ` is a loss function quantifying the error of model θ predicting the label ym , j for an input xm , j . A global objective function may be formulated as min θ∈Rd f ( θ ) = 1 M M∑ m=1 fm ( θ ) . ( 2 ) 3.2 QUANTIZED NEURAL NETWORKS . Consider a neural network g with the weight vector θ ∈ Rd . A forward pass for an input x ∈ Rd1 and a prediction ŷ ∈ Rd2 can be written as ŷ = g ( θ , x ) . In quantized neural networks , the realvalued θ is replaced by w ∈ Ddn , where Dn is a discrete set with a number n of quantization levels . For example , we may have D2 = { −1 , 1 } for a binary neural network . For a given training set { ( xj , yj ) } Nj=1 and the loss function ` , the goal is to find an optimal w∗ such that the averaged loss is minimized over a search space of quantized weight vectors : w ? = argmin w∈Ddn 1 N N∑ j=1 ` ( w ; ( xj , yj ) ) . ( 3 ) Prior studies tried to solve ( 3 ) by optimizing a real-valued latent weight vector h ∈ Rd ( Hubara et al. , 2016 ; Shayer et al. , 2018 ; Gong et al. , 2019 ) . The interpretations of the latent weight vary when viewed from different perspectives . Hubara et al . ( 2016 ) used the sign operation to quantize the latent weight into two levels during the forward pass . The binary weights can be viewed as an approximation of their latent real-valued counterparts . Shayer et al . ( 2018 ) trained a stochastic binary neural network , and the normalized latent parameters are interpreted as the Bernoulli distribution parameter ϑi : ϑi , P̂ ( wi = 1 ) = S ( hi ) , wi ∈ { 0 , 1 } , ( 4 ) where S : R→ ( 0 , 1 ) is the sigmoid function . In the forward pass , instead of using the binary vector w , its expected value , w̃sto-bnn , E [ w ] = −1× [ 1−S ( h ) ] + 1×S ( h ) = 2S ( h ) − 1 , ( 5 ) will participate in the actual convolution or matrix multiplication operations . In other words , the neural network function becomes ŷ = g ( w̃sto-bnn , x ) . Likewise , Gong et al . ( 2019 ) normalized the latent weight but interpreted it from a different viewpoint . They approximated the staircase quantization function with a differentiable soft quantization ( DSQ ) function , i.e. , w̃dsq , tanh ( ah ) , ( 6 ) where tanh : R → ( −1 , 1 ) is the hyperbolic tangent function , and a controls the shape of the function . The neural network function thus becomes ŷ = g ( w̃dsq , x ) . We now summarize the latent-weight-based BNN training methods and depict an example of a single-layer network in Figure 1 . First , a real-valued vector h ∈ Rd is introduced and its range is restricted using a differentiable and invertible normalization function ϕ : R→ ( −1 , 1 ) . The forward pass is then calculated with the normalized weight vector w̃ . The procedure is described as : ŷ = g ( w̃ , x ) , w̃ , ϕ ( h ) . ( 7 ) Second , in the back propagation , the latent weight vector h is updated with its gradient , i.e. , h ( t+1 ) = h ( t ) − η∇h ` . Finally , the normalized weight vector w̃ are mapped to the discrete space to approximate w∗ via thresholding or stochastic rounding .

Summary: The paper presents a scheme for federated learning (FL) called FedVote. In FedVote, clients use binary neural networks where a latent restricted range weight vector $\boldsymbol{h}$ is learned, and stochastic rounding is applied to obtain quantized weights $\in$ {$-1,+1$}. The communication cost to the server (up-link) is reduced by using quantized weights. The server aggregates weights by summing over all the weights of the clients at each round of training and applying a sign function. This mechanism is referred to as plurality voting (ties are broken randomly). However, the paper also proposes to use soft voting, which normalizes the number of ones (cf. hard sign function) to get probability values. These probabilities are then quantized with a clipping mechanism to restricted maximum and minimum values, using predefined thresholds, and broadcasted to the clients (down-link). The latent weights of the client models are updated using the soft voting results. The paper also adapts work on reputation-based voting (Bendahmane et al. 2014) to deal with adversarial FL in the form of Byzantine attacks. The paper presents convergence analysis for FedVote under the independent and identically distributed data setting. Empirical evaluations is conducted on two datasets ,Fashion-MNIST and CIFAR-10, and applied to two models, LeNet-5 and VGG-7, respectively.