Scalable Robust Federated Learning with Provable Security Guarantees

Federated averaging , the most popular aggregation approach in federated learning , is known to be vulnerable to failures and adversarial updates from clients that wish to disrupt training . While median aggregation remains one of the most popular alternatives to improve training robustness , relying on secure multi-party computation ( MPC ) to naı̈vely compute the median is unscalable . To this end , we propose a secure and efficient approximate median aggregation with MPC privacy guarantees in the multi-silo setting , e.g. , across hospitals , with two semi-honest non-colluding servers . The proposed method protects the confidentiality of client gradient updates against both semi-honest clients and servers . Asymptotically , the cost of our approach scales only linearly with the number of clients , whereas the naı̈ve MPC median scales quadratically . Moreover , we prove that the convergence of the proposed federated learning method is robust to a wide range of failures and attacks . Empirically , we show that our method displays similar robustness properties as the median while converging faster than the naı̈ve MPC median for even a small number of clients . 1 Introduction . Federated Learning ( FL ) ( McMahan et al. , 2017 ) has emerged as a leading approach for training shared models among clients who do not wish to release their datasets publicly . While FL avoids releasing client data , revealing client models in the clear creates privacy vulnerabilities , e.g. , using model inversion attacks ( Fredrikson et al. , 2015 ) . To this end , global model aggregation is often implemented using Secure Multi-Party Computation ( MPC ) to improve privacy ( Bonawitz et al. , 2016 ) . MPC ( Yao , 1986 ; Goldreich et al. , 1987 ) is a cryptographic primitive that makes it possible to evaluate a function on encrypted inputs while ensuring that the only information revealed throughout the computation is the final output of the function . Thus , to avoid revealing each client ’ s local weights , clients encrypt their weights before sending them to the central server . MPC allows the central server to recover a single aggregate update that it sends back to individual clients . Specialized MPC protocols , that allow the server to recover the average of client updates have been widely deployed for Federated Learning . In addition to privacy , robustness is a major concern in federated learning implementations ( Kairouz et al. , 2019 ) . The distributed nature of the computation creates a variety of vulnerabilities to adversarial training attacks and client failures such as hardware , software , data , and communication errors ( Xie et al. , 2019a ; 2021 ) . One way to improve robustness is to replace an aggregation procedure that computes means with a more robust aggregate such as the median ( Yin et al. , 2018 ) . Using the median , up to half of inputs can be from a faulty distribution before the median fails as a robust average estimator . While median aggregation alone is insufficient to guarantee Byzantine robustness ( Xie et al. , 2020 ) – median-based robustness guarantees are sufficient against most published attacks and failures . Unfortunately , the best known approaches for median aggregation with MPC are slow , requiring computation that grows quadratically with the number of clients ( Tueno et al. , 2019 ) . Our work is motivated by applications to multi-silo federated learning ( Kairouz et al. , 2019 ) , designed for learning across institutions . For example , an individual hospital may be limited to using only their own patients ’ data , and sharing patient information among hospitals is generally difficult due to privacy and intellectual property concerns . Here , federated learning can provide a mechanism for widely distributed medical institutions to jointly train a model . The main contribution of this work is a new approximate-median aggregation for robust , privacypreserving federated learning in the multi-silo , two-server setting . Our approach is the first to have all of the following features : • Robustness against failures . By relying on ( an approximation of ) the median of client updates , we achieve robust estimates even in settings where updates sent by up to half the clients are faulty . In addition , we empirically evaluate robustness against noise distributions that take the form of bit flips , label switching , and Gaussian noise in up to half of the clients . • Preserving Client Privacy via Secure Computation . We prove that any subset of clients colluding with each other and with one of the two servers obtains no information about the private inputs of other clients , beyond the aggregated ( approximate ) median that is returned at each step . This provides meaningful privacy to every client and is a meaningful defense , e.g. , against modelinversion attacks that take advantage of individual client updates . • Scalability . The running time of our protocol increases linearly with the number of clients ; matching the order-wise scaling ( with number of clients ) of the standard averaging aggregation . This is in contrast to a quadratic factor blowup for a federated learning system that implements median naı̈vely in MPC . We empirically evaluate the convergence of our system on various datasets , models and under different types of faults . 2 Related Work . Federated Learning ( McMahan et al. , 2017 ) is a widely adopted technique for training models with data from edge devices . In its plainest form , client updates are sent without encryption to the central server at each round , and the global model is sent back to each client . However , this basic implementation of a distributed machine learning system is not robust against privacy attacks or failures . For instance , ( Wang et al. , 2019 ; Geiping et al. , 2020 ) show how model inversion attacks can be successful in a federated learning setting . ( Bonawitz et al. , 2017 ; 2016 ) provide a protocol for secure aggregation of the client updates and computation of the global model in both a semi-honest and malicious setting , with increased runtime and communication overhead . In addition to encryption of client updates , existing work has also considered robustness to failures and Byzantine client attacks , e.g. , ( Xie et al. , 2019a ; 2021 ) prune faulty client updates by assigning each update a score , and only aggregating the updates that have the top scores . Other methods of providing byzantine robustness including trimmed mean ( Xie et al. , 2019b ) , Krum ( He et al. , 2020 ; So et al. , 2021 ) , and norm-based elimination ( Gupta et al. , 2021 ) have been studied . In this paper , we strengthen the restriction on client faults and only consider semi-honest clients . Although a semi-honest setting may seem restrictive by forcing parties to follow the dictated protocol , it applies to settings where parties are assumed to have no ill intentions . Furthermore , developing semi-honest protocols are a step towards developing protocols in the malicious security model , where more expensive cryptographic primitives such as zero-knowledge proofs are added on top of the existing semi-honest protocol . Secure Multi-Party Computation ( MPC ) provides a way for multiple parties to compute a function on their individual data and only reveal the final output of the function . ( Bonawitz et al. , 2016 ; 2017 ) provide a method for federated learning where client updates have a pairwise additive mask , such that when all the encrypted client updates are summed together , the masks cancel out . In ( Tueno et al. , 2019 ) , the authors propose a rank computation system where clients send a pairwise masked version of their data point to the central server . The central server uses pairwise comparisons in MPC to calculate the desired ranked element in the clients ’ combined data . However , pairwise comparisons are expensive in MPC , as additional values for each unique comparison must be generated in advance . Furthermore , agreeing upon pairwise additive masks grows quadratically with the number of parties . The generalization of a central server to two non-colluding central servers is not a new idea in privacy-preserving analytics and machine learning . For instance , ( Corrigan-Gibbs & Boneh , 2017 ) introduce a cryptographic protocol called secret-shared non-interactive proofs , and show that these can be used to construct an efficient privacy preserving system for the release of aggregate statistics with guarantees on security in the malicious setting . The setting of the paper consists of a small number of servers jointly computing aggregate statistics over private client data . ( Mohassel & Zhang , 2017 ) introduce efficient distributed ML protocols that utilize a two server abstraction and MPC versions of ML computations . However they do not seek to provide robustness . To our knowledge , ( He et al. , 2020 ) is the first work to propose an FL system that combines both robustness and privacy , using private calculation of the distance-based aggregation . They also make the assumption of the central server being two non-colluding central servers , and utilize client side secret sharing of models and server side two party MPC . The two central server setting allows their protocol to scale well with number of parties , compared to a single central server setting . However , their protocol leaks the pairwise distance of client updates to one of the servers , which may be undesirable . Our proposed approach uses the 2-Party MPC comparison protocols presented in ( Rathee et al. , 2020 ) . We also adopt a pairwise comparison based computation of the k-th ranked element proposed in ( Tueno et al. , 2019 ) and a bucketing approximate median idea proposed in ( Corrigan-Gibbs & Boneh , 2017 ) , and apply them to the setting of distributed machine learning . Finally , we note that this work focuses on security and robustness of centralized model training . Existing work has shown that personalization and mitigating data heterogeneity can be addressed by fine-tuning the robust centralized model ( Li et al. , 2021 ) . These details are left for future work . 3 Preliminaries . Federated Learning . We denote N as the set of positive integers and R+ as the set of non-negative real numbers . Given n ∈ N , we denote [ n ] = { 1 , . . . , n } . We use bold lowercase letters , e.g. , w ∈ Rd , to denote vectors , and w ( k ) to denote its value at the kth dimension . We consider a twoserver multi-client FL system , let S0 , S1 denote the two central severs , and ci for i ∈ [ n ] represent the clients , where n is the total number of clients . Client ci holds datasetDi . The agreed upon model has d parameters . wg denotes the global model sent from servers to clients , while wi denotes the local model held by client i . All parties agree beforehand to run r cycles of FL . The loss function for client ci is F̂i : Rd → R+ . Usually , because clients have different data , the loss functions F̂i are different . Therefore , the goal of our setting is to minimize the averaged loss across all clients , i.e. , arg minw 1 n ∑n i=1 F̂i ( w ) . We first detail a basic federated learning system with one central server S and n clients . Clients are generally considered to be edge nodes and do not communicate with each other . In one iteration , the system follows the following generic protocol : 1 . For i ∈ [ n ] , client ci receives global model wg from central server S . 2 . For i ∈ [ n ] , client ci performs step ( s ) of Stochastic Gradient Descent of wg on its dataset Di to obtain new local model wi . They then send this model to S. 3 . Upon receiving all client updates , S aggregates them to obtain the new global model . The new global model is computed as w′g = 1 n ∑n i=1 wi . 4 . S sends w′g to all the clients . Secure Multi-Party Computation . Secure Multi-party Computation ( MPC ) ( Goldreich et al. , 1987 ) is a cryptographic primitive which allows n parties , each with input value xi , to jointly compute a mutually agreed upon function f ( x1 , x2 . . . xn ) , with the guarantee that no party learns anything other than what can be inferred from its own input and the joint output . One of the most prominent techniques used in MPC is secret sharing . A ( t , n ) secret sharing involves splitting a secret s into n shares , then distributing a share to each party , such that any subset of t− 1 parties can not learn anything about s , while any t or more parties can jointly reconstruct s. In this paper , we make use of ( 2 , 2 ) additive secret sharing over power-of-two sized integer rings , which involves splitting s ∈ Z2 ` into s1 , s2 ∈ Z2 ` s.t . s1 + s2 = s , and individually si , i ∈ { 0 , 1 } has a uniform random distribution . We use 〈s〉 to denote secret sharing of s over Z2 ` , and 〈s〉0 , 〈s〉1 to denote the shares of the two parties . We use F ` Comp , F ` Equal to refer to the “ greater than ” and “ equals to ” ideal functionalities respectively , i.e . where parties have access to trusted functionalities computing the said functions and use the same to describe our protocols . To implement the protocols for F ` Comp , F ` Equal , we make use of protocols proposed in CrypTFlow2 ( Rathee et al. , 2020 ) . CrypTFlow2 provides a customized 2-party protocol for solving the millionaire ’ s , and hence also the comparison/equality problems in Z2 ` ( more details on all this in Appendix C ) .

Summary: The paper considers federated learning with two non-colluding honest-but-curious servers and honest-but-curious clients, where a subset of clients can be faulty. It proposes a protocol to securely compute approximate median. The main idea is to use secure median algorithm from [Tueno et al. 2019] along with a bucketing trick proposed in [Corrigan-Gibbs and Boneh 2017] to reduce complexity. The paper gives convergence analysis for bucketed median under some strict assumptions.