Byzantine-Robust Learning on Heterogeneous Datasets via Resampling

1 INTRODUCTION . Distributed or federated machine learning , where the data is distributed across multiple workers , has become an increasingly important learning paradigm both due to growing sizes of datasets , as well as privacy and security concerns . In such a setting , the workers collaborate to train a single model without transmitting their data directly over the networks ( McMahan et al. , 2016 ; Bonawitz et al. , 2019 ; Kairouz et al. , 2019 ) . Due to the presence of either actively malicious agents in the network , or simply due to system and network failures , some workers may disobey the protocols and send arbitrary messages ; such workers are also known as Byzantine workers ( Lamport et al. , 2019 ) . Byzantine robust optimization algorithms combine the gradients received by all workers using robust aggregation rules , to ensure that the training is not impacted by the malicious workers . While this problem has received significant recent attention , ( Alistarh et al. , 2018 ; Blanchard et al. , 2017 ; Yin et al. , 2018a ) , most of the current approaches assume that the data present on each different worker has identical distribution . In this work , we show that existing Byzantine-robust methods catastrophically fail in the realistic setting when the data is distributed heterogeneously across the workers . We then propose a simple resampling scheme which can be readily combined with existing aggregation rules to allow robust training on heterogeneous data . Contribution . Concretely , our contributions in this work are • We show that when the data across workers is heterogeneous , existing robust rules might not converge , even without any Byzantine adversaries . • We propose two new attacks , normalized gradient and mimic , which take advantage of data heterogeneity and circumvent median and sign-based defenses ( Blanchard et al. , 2017 ; Pillutla et al. , 2019 ; Li et al. , 2019 ) . • We propose a simple new resampling step which can be used before any existing robust aggregation rule . We instantiate our scheme with KRUM and theoretically prove that the resampling generalizes it to the setting of heterogeneous data . • Our experiments evaluate the proposed resampling scheme against known and new attacks and show that it drastically improves the performance of 3 existing schemes on realistic heterogeneously distributed datasets . Setup and notations . We study the general distributed optimization problem L ? = minx∈Rd { L ( x ) : = 1n ∑n i=1 Li ( x ) } ( 1 ) where Li : Rd → R are the individual loss functions distributed among n workers , each having its own ( heterogeneous ) data distribution { Di } ni=1 . The case of empirical risk minimization with mi datapoints ξi ∼ Di on worker i is obtained when using Li ( x ) : = 1mi ∑mi j=1 Li ( x , ξ j i ) . The ( stochastic ) gradient computed by a good node i with sample j is given as gi ( x ) : = ∇Li ( x , ξji ) with mean µi and variance σ2i . We also assume that the heterogeneity ( variance across good workers ) is bounded i.e . Ei‖∇Li ( x ) −∇L ( x ) ‖2 ≤ σ̄2 , ∀x . We write gi instead of gi ( xt ) when there is no ambiguity . A distributed training step using an aggregation rule is given as xt+1 : = xt − γtAggr ( { gi ( xt ) : i ∈ [ n ] } ) ( 2 ) If the aggregation rule is the arithmetic mean , then ( 2 ) recovers standard minibatch SGD . Byzantine attack model . In each iteration , there is a set Byz of at most f Byzantine workers . The remaining workers are good , thus follow the described protocol . A Byzantine worker j ∈Byz can deviate from protocol and send an arbitrary vecter to the server . Besides , we also allow that Byzantine workers can collude with each other and know every state of the system . Unlike martingale-based approaches like ( Alistarh et al. , 2018 ) , we allow the set Byz to change over time ( Blanchard et al. , 2017 ; Chen et al. , 2017 ; Mhamdi et al. , 2018 ) . 2 RELATED WORK . There has been significant recent work of the case when the workers have identical data distributions ( Blanchard et al. , 2017 ; Chen et al. , 2017 ; Mhamdi et al. , 2018 ; Alistarh et al. , 2018 ; Mhamdi et al. , 2018 ; Yin et al. , 2018a ; b ; Su & Xu , 2018 ; Damaskinos et al. , 2019 ) . We discuss the most pertinent of these methods next . Blanchard et al . ( 2017 ) formalize the Byzantine robust setup and propose a distance-based approach KRUM which selects a worker whose gradient is very close to at least half the other workers . A different approach involves using the median and its variants ( Blanchard et al. , 2017 ; Pillutla et al. , 2019 ; Yin et al. , 2018a ) . Yin et al . ( 2018a ) propose to use and analyze the coordinate-wise median method ( CM ) . Pillutla et al . ( 2019 ) use a smoothed version of Weiszfeld ’ s algorithm to iteratively compute an approximate geometric median of the input gradients . In a third approach , ( Bernstein et al. , 2018 ) propose to use the signs of the gradients and then aggregate them by majority vote , however , ( Karimireddy et al. , 2019 ) show that it may not always converge . Finally , Alistarh et al . ( 2018 ) use a martingale-based aggregation rule which gives a sample complexity optimal algorithm for iid data . The distance-based approach of KRUM was later extended in Mhamdi et al . ( 2018 ) who propose BULYAN to overcome the dimensional leeway attack . This is the so called strong Byzantine resilience and is orthogonal to the question of non-iid-ness we study here . Recently , ( Peng & Ling , 2020 ; Yang & Bajwa , 2019a ; b ) studied Byzantine-resilient algorithms in the decentralized setting where there is no central server available . Extending our techniques to the decentralized setting is an important direction for future work . In a different line of work , ( Lai et al. , 2016 ; Diakonikolas et al. , 2019 ) develop sophisticated spectral techniques to robust estimate the mean of a high dimensional multi-variate standard Gaussian distribution where samples are evenly distributed in all directions and the attackers are concentrated in one direction . Very recent work ( Data & Diggavi , 2020 ) extend the theoretical analysis to non-convex , strongly-convex and non-i.i.d setup under a gradient dissimilarity assumption and propose a gradient compression scheme on top of it . Our resampling trick can be combined with it to further reduce gradient dissimilarity . Many attacks have been devised for distributed training . For the iid setting , the state-of-the-art attacks are ( Baruch et al. , 2019 ; Xie et al. , 2019b ) . The latter attack is very strong when the fraction of adversaries is large ( nearly half ) , but in this work we focus on settings when this fraction is quite small ( e.g . ≤ 0.2 ) . Further our normalized mean attack Section 3.2 is inspired by ( Xie et al. , 2019b ) . The former work focuses on attacks which are coordinated across time steps . Developing strong practical defenses even in the iid case against such time-coordinated attacks remains an open problem . In this work , we sidestep this issue by restricting ourselves to new attacks made possible by non-iid data and studying how to overcome them . We focus on schemes which work in the iid setting , but fail with non-iid data . Once a new method which can defend against ( Baruch et al. , 2019 ) is developed , our proposed scheme shows how to adapt such a method to the important non-iid case . For the non-iid setting , backdoor attacks are designed to take advantage of heavy-tailed data and manipulate model inference on specific subtask , rather than lower the overall accuracies of training ( Bagdasaryan et al. , 2018 ; Bhagoji et al. , 2018 ) . In contrast , this paper is not intended to address aforementioned challenges but rather to defend the attacks that lower the training accuracies in the non-iid setting . As far as we are aware , only ( Li et al. , 2019 ; Ghosh et al. , 2019 ; Sattler et al. , 2020 ) explicitly investigate Byzantine robustness with non-iid workers . Li et al . ( 2019 ) proposes an SGD variant ( RSA ) which modifies the original objective by adding an ` 1 penalty . Ghosh et al . ( 2019 ) ; Sattler et al . ( 2020 ) assume that all workers belong to an apriori fixed number of clusters and use an outlier-robust clustering method to recover these clusters . If we assume that the server has the entire training dataset and can control the distribution of samples to good workers , Xie et al . ( 2019a ) ; Chen et al . ( 2018 ) ; Rajput et al . ( 2019 ) show that non-iid-ness can be overcome . Typical examples of this is distributed training of neural networks on public cloud , or volunteer computing Meeds et al . ( 2015 ) ; Miura & Harada ( 2015 ) . However , none of these methods are applicable in the standard federated learning setup we consider here . We aim to minimize the original loss function over workers while respecting the non-iid data locality , i.e . the partition of the given heterogeneous dataset over the workers , without data transfer . 3 ATTACKS AGAINST EXISTING AGGREGATION SCHEMES . In this section we show that when the data across the workers is heterogeneous ( non-iid ) , then we can design new attacks which take advantage of the heterogeneity , leading to the failure of existing aggregation schemes . We study three classes of robust aggregation schemes : i ) schemes which select a representative worker in each round ( e.g . KRUM ( Blanchard et al. , 2017 ) ) , ii ) schemes which use normalized means ( e.g . RSA ( Li et al. , 2019 ) ) , and iii ) those which use the median ( e.g . RFA ( Pillutla et al. , 2019 ) ) . We show realistic settings under which each of these classes would fail when faced with heterogeneous data . 3.1 FAILURE OF REPRESENTATIVE WORKER SCHEMES ON NON-IID DATA . Algorithms like KRUM select workers who are representative of a majority of the workers , by relying on statistics such as pairwise differences between the various worker updates . Let ( g1 , . . . , gn ) be the gradients by the workers , f of which are Byzantine ( e.g . n ≥ 2f + 3 for KRUM ) . For i 6= j , let i→ j denote that gj belongs to the n− f − 2 closest vectors to gi . Then KRUM is defined as follows KRUM ( g1 , . . . , gn ) : = arg mini ∑ i→j ‖gi − gj‖2 ( 3 ) However , when the data across the workers is heterogeneous , there is no ‘ representative ’ worker . This is because each worker computes their local gradient over vastly different local data . Hence , for convergence it is important to not only select a good ( non-Byzantine ) worker , but also ensure that each of the good workers is selected with roughly equal frequency . Hence KRUM suffers a significant loss in performance with heterogeneous data , even when there are no Byzantine workers . For example , when KRUM is used for iid datasets without adversary ( f =0 , see left of Figure 1a ) , the test accuracy is close to simple average and the gap can be filled by MULTI-KRUM ( Blanchard et al. , 2017 ) . The right plot of Figure 1a also shows that KRUM ’ s selection of gradients is biased towards certain nodes . When KRUM is applied to non-iid datasets ( the middle of Figure 1a ) , KRUM performs poorly even without any attack . This is because KRUM mostly selects gradients from a few nodes whose distribution is closer to others ( the right of Figure 1a ) . This is an example of how robust aggregation rules may fail on realistic non-iid datasets .

Summary: The paper studies Byzantine robustness in the context of distributed learning from heterogeneous datasets. This problem has been widely studied previously, but under the additional assumption that the data of the good workers is i.i.d.. The authors give examples of situations and poisoning attacks with which current defences designed for the i.i.d. situation can be overcome.  They also propose a simple resampling scheme that can be used as a preprocessing step before applying any standard robust aggregator from the i.i.d. literature. They provide theoretical guarantees for their resampling scheme when used together with KRUM. The also test their algorithm against the i.i.d. baselines and multiple attacks.