Provable Federated Adversarial Learning via Min-max Optimization

1 INTRODUCTION . Federated learning ( FL ) is playing an important role nowadays , as it allows different parties or clients to collaboratively train deep learning models without sharing private data . One popular FL paradigm called FedAvg ( McMahan et al. , 2017 ) introduces an easy-to-implement distributed learning method without data sharing . Specifically , it requires a central server to aggregate model updates computed by the local participants ( also known as nodes or clients ) using local imparticipable private data . Then the central server aggregates these updates to train a globally learned model . Nowadays deep learning model are exposed to severe threats of adversarial samples . Namely , small adversarial perturbations on the inputs will dramatically change the outputs or output wrong answers ( Szegedy et al. , 2013 ) . In this regard , much effort has been made to improve neural networks ’ resistance to such perturbations using adversarial learning ( Tramèr et al. , 2017 ; Samangouei et al. , 2018 ; Madry et al. , 2018 ) . Among these studies , the adversarial training scheme in Madry et al . ( 2018 ) has achieved the good robustness in practice . Madry et al . ( 2018 ) proposes an adversarial training scheme that uses projected gradient descent ( PGD ) to generate alternative adversarial samples as the augmented training set . Generating adversarial examples during neural network training is considered as one of the most effective approaches for adversarial training up to now according to the literature ( Carlini & Wagner , 2017 ; Athalye et al. , 2018 ; Croce & Hein , 2020 ) . Although adversarial learning has attracted much attention in the centralized domain , its practice in FL is under-explored ( Zizzo et al. , 2020 ) . Like training classical deep neural networks that use gradient-based methods , FL paradigms are vulnerable to adversarial samples . Adversarial learning in FL brings multiple open challenges due to FL properties on low convergence rate , application in non-IID environments , and secure aggregation solutions . Hence applying adversarial learning in an FL paradigm may lead to unstable training loss and a lack of robustness . However , a recent practical work Zizzo et al . ( 2020 ) observed that although there exist difficulties of convergence , the federation of adversarial training with suitable hyperparameter settings can achieve adversarial robustness and acceptable performance . Motivated by the empirical results , we want to address the provable property of combining adversarial learning into FL from the theoretical perspective . This work aims to theoretically study the unexplored convergence challenges that lie in the interaction between adversarial training and FL . To achieve a general understanding , we consider a general form of federated adversarial learning ( FAL ) , which deploys adversarial training scheme on local clients in the most common FL paradigm , FedAvg ( McMahan et al. , 2017 ) system . Specifically , FAL has an inner loop of local updating that generates adversarial samples ( i.e. , using Madry et al . ( 2018 ) ) for adversarial training and an outer loop to update local model weights on the client side . Then global model is aggregated using FedAvg ( McMahan et al. , 2017 ) . The algorithm is detailed in Algorithm 1 . We are interested in theoretically understanding the proposed FAL scheme from the aspects of model robustness and convergence : Can federated adversarial learning fit training data robustly and converge with a feasibly sized neural network ? The theoretical convergence analysis of adversarial training itself is challenging in the centralized training setting . Tu et al . ( 2018 ) recently proposed a general theoretical method to analyze the risk bound with adversaries but did not address the convergence problem . The investigation of convergence on over-parameterized neural network has achieved tremendous progress ( Du et al. , 2019a ; Allen-Zhu et al. , 2019b ; c ; Du et al. , 2019b ; Arora et al. , 2019b ) . The basic statement is that training can converge to sufficiently small training loss in polynomial iterations using gradient descent or stochastic gradient descent when the width of the network is polynomial in the number of training examples when initialized randomly . Recent theoretical analysis ( Gao et al. , 2019 ; Zhang et al. , 2020b ) extends these standard training convergence results to adversarial training settings . To answer the above interesting but challenging question , we formulate FAL as an min-max optimization problem . We extend the convergence analysis on the general formulation of over-parameterized neural networks in the FL setting that allows each client to perform min-max training and generate adversarial examples ( see Algorithm 1 ) . Involved challenges are arising in FL convergence analysis due to its unique optimization method : 1 ) unlike classical centralized setting , the global model of FL does not update in the gradient direction ; 2 ) inter-client heterogeneity issue needs to be considered . Despite the challenges , we give an affirmative answer to the above question . To the best of our knowledge , this work is the first theoretical study that examines these unexplored challenges on the convergence of adversarial training with FL . The contributions of this paper are : • We propose a framework to analyze a general form of FAL in over-parameterized neural networks . We follow a natural and valid assumption of data separability that the training dataset are well separated apropos of the adversarial perturbations ’ magnitude . After sufficient rounds of global communication and certain steps of local gradient descent for each t , we obtain the minimal loss close to zero . Notably , our assumptions do not rely on data distribution . Thus the proposed analysis framework is feasible for non-IID clients . • We are the first to theoretically formulate the convergence of the FAL problem into a minmax optimization framework with the proposed loss function . In FL , the update in the global model is no longer directly determined by the gradient directions due to multiple local steps . To tackle the challenges , we define a new ‘ gradient ’ , FL gradient . With valid ReLU Lipschitz and over-parameterized assumptions , we use gradient coupling for gradient updates in FL to show the model updates of each global updating is bounded in federated adversarial learning . Roadmap The rest of the paper is organized as follows . We overview the related work on federated learning and adversarial training in Section 2 . We describe the problem formulation for the federated adversarial learning algorithm and introduce the notations , assumptions to be used , and conditions to be considered to ensure convergence in Section 3 . Our main convergence result is presented in Section 4 . In Section 5 , we present the core techniques and an overview of the proof . We summarize and conclude our results in Section 6 . 2 RELATED WORK . Federated Learning A efficient and privacy-preserving way to learn from the distributed data collected on the edge devices ( a.k.a clients ) would be FL . FedAvg is a easy-to-implement distributed learning strategy by aggregating local model updates on the server side and transmitting the averaged model back to local clients . Later , many FL methods are developed baed on FedAvg . Theses FL schemes can be divided into aggregation schemes ( McMahan et al. , 2017 ; Wang et al. , 2020 ; Li et al. , 2021 ) and optimization schemes ( Reddi et al. , 2020 ; Zhang et al. , 2020a ) . Nearly all the them have the common characteristics that client model are updating using gradient descent-based methods , which is venerable to adversarial attacks . In addition , data heterogeneity brings in huge challeng in FL . For IID data , FL has been proven effective . However , in practice , data mostly distribute as non-IID . Non-IID data could substantially degrade the performance of FL models ( Zhao et al. , 2018 ; Li et al. , 2019 ; 2021 ; 2020a ) . Despite the potential risk in security and unstable performance in nonIID setting , as FL mitigates the concern of data sharing , it is still a popular and practical solution for distributed data learning in many real applications , such as healthcare ( Li et al. , 2020b ; Rieke et al. , 2020 ) , autonomous driving ( Liang et al. , 2019 ) , IoTs ( Wang et al. , 2019 ; Lim et al. , 2020 ) . Learning with Adversaries Since the discovery of adversarial examples ( Szegedy et al. , 2013 ) , to make neural networks robust to perturbations , efforts have been made to propose more effective defense methods . As adversarial examples are an issue of robustness , the popular scheme is to include learning with adversarial examples , which can be traced back to ( Goodfellow et al. , 2014 ) . It produces adversarial examples and injecting them into training data . Later , Madry et al . ( Madry et al. , 2018 ) proposed training on multi-step PGD adversaries and empirically observed that adversarial training consistently achieves small and robust training loss in wide neural networks . Federated Adversarial Learning Adversarial examples , which may not be visually distinguishable from benign samples , are often classified . This poses potential security threats for practical machine learning applications . Adversarial training ( Goodfellow et al. , 2014 ; Kurakin et al. , 2016 ) is a popular protocol to train more adversarial robust models by inserting adversarial examples in training . The use of adversarial training in FL presents a number of open challenges , including poor convergence due to multiple local update steps , instability and heterogeneity of clients , cost and security request of communication , and so on . To defend the adversarial attacks in federated learning , limited recent studies have proposed to include adversarial training on clients in the local training steps ( Bhagoji et al. , 2019 ; Zizzo et al. , 2020 ) . These two works empirically showed the performance of adversarial training . The theoretical analysis of convergence is under explored . In addition , ( Zhang et al. , 2021 ) proposed an adversarial training strategy in classical distributed setting , not meeting the specialty in FL . Convergence via Over-parameterization Convergence analysis on over-parameterized neural networks falls in two lines . In the first line of work ( Li & Liang , 2018 ; Allen-Zhu et al. , 2019b ; c ; a ) , data separability plays a crucial role in deep learning theory , especially in showing the convergence result of over-parameterized neural network training . Denote δ as the minimum distance between all pairs of data points . Data separability theory requires the width ( m ) of the neural network is at least polynomial factor of all the parameters ( i.e . m ≥ poly ( n , d , 1/δ ) ) , where n is the number of data points and d is the dimension of data . Another line of work ( Du et al. , 2019b ; Arora et al. , 2019a ; b ; Song & Yang , 2019 ; Lee et al. , 2020 ) builds on neural tangent kernel ( Jacot et al. , 2018 ) . It requires the minimum eigenvalue ( λ ) of the neural tangent kernel to be lower bounded . Our analysis focuses on the former approach based on data separability . Robustness of Federated Learning Previously there were several works that theoretically analyzed the robustness of federated learning under noise . Yin et al . ( 2018 ) developed distributed optimization algorithms that were provably robust against arbitrary and potentially adversarial behavior in distributed computing systems , and mainly focused on achieving optimal statistical performance . Reisizadeh et al . ( 2020 ) developed a robust federated learning algorithm by considering a structured affine distribution shift in users ’ data . Their analysis was built on several assumptions on the loss functions without a direct connection to neural network .

Summary: This paper is a direct follow-up of Zhang et al 2020b. With assumptions including overparametrized two-layer ReLU network, normalized dataset, gamma-separability, and Lipschitz convex loss, it proves the convergence of FedAvg under adversarial perturbation. These assumptions are easy adaptations from Zhang et al 2020b.    --post rebuttal--  I would like to thank the authors for the response. However, after reading the author response my opinion remains the same, as the authors acknowledge that this work is an extension of Zhang et al 2020b and there is no experiment after the revision. My main concern is still the novelty. I would encourage the authors to work on the future direction for empirically verifying their general framework.