Byzantine-Robust Learning on Heterogeneous Datasets via Resampling

1 INTRODUCTION . Distributed or federated machine learning , where the data is distributed across multiple workers , has become an increasingly important learning paradigm both due to growing sizes of datasets , as well as privacy and security concerns . In such a setting , the workers collaborate to train a single model without transmitting their data directly over the networks ( McMahan et al. , 2016 ; Bonawitz et al. , 2019 ; Kairouz et al. , 2019 ) . Due to the presence of either actively malicious agents in the network , or simply due to system and network failures , some workers may disobey the protocols and send arbitrary messages ; such workers are also known as Byzantine workers ( Lamport et al. , 2019 ) . Byzantine robust optimization algorithms combine the gradients received by all workers using robust aggregation rules , to ensure that the training is not impacted by the malicious workers . While this problem has received significant recent attention , ( Alistarh et al. , 2018 ; Blanchard et al. , 2017 ; Yin et al. , 2018a ) , most of the current approaches assume that the data present on each different worker has identical distribution . In this work , we show that existing Byzantine-robust methods catastrophically fail in the realistic setting when the data is distributed heterogeneously across the workers . We then propose a simple resampling scheme which can be readily combined with existing aggregation rules to allow robust training on heterogeneous data . Contribution . Concretely , our contributions in this work are • We show that when the data across workers is heterogeneous , existing robust rules might not converge , even without any Byzantine adversaries . • We propose two new attacks , normalized gradient and mimic , which take advantage of data heterogeneity and circumvent median and sign-based defenses ( Blanchard et al. , 2017 ; Pillutla et al. , 2019 ; Li et al. , 2019 ) . • We propose a simple new resampling step which can be used before any existing robust aggregation rule . We instantiate our scheme with KRUM and theoretically prove that the resampling generalizes it to the setting of heterogeneous data . • Our experiments evaluate the proposed resampling scheme against known and new attacks and show that it drastically improves the performance of 3 existing schemes on realistic heterogeneously distributed datasets . Setup and notations . We study the general distributed optimization problem L ? = minx∈Rd { L ( x ) : = 1n ∑n i=1 Li ( x ) } ( 1 ) where Li : Rd → R are the individual loss functions distributed among n workers , each having its own ( heterogeneous ) data distribution { Di } ni=1 . The case of empirical risk minimization with mi datapoints ξi ∼ Di on worker i is obtained when using Li ( x ) : = 1mi ∑mi j=1 Li ( x , ξ j i ) . The ( stochastic ) gradient computed by a good node i with sample j is given as gi ( x ) : = ∇Li ( x , ξji ) with mean µi and variance σ2i . We also assume that the heterogeneity ( variance across good workers ) is bounded i.e . Ei‖∇Li ( x ) −∇L ( x ) ‖2 ≤ σ̄2 , ∀x . We write gi instead of gi ( xt ) when there is no ambiguity . A distributed training step using an aggregation rule is given as xt+1 : = xt − γtAggr ( { gi ( xt ) : i ∈ [ n ] } ) ( 2 ) If the aggregation rule is the arithmetic mean , then ( 2 ) recovers standard minibatch SGD . Byzantine attack model . In each iteration , there is a set Byz of at most f Byzantine workers . The remaining workers are good , thus follow the described protocol . A Byzantine worker j ∈Byz can deviate from protocol and send an arbitrary vecter to the server . Besides , we also allow that Byzantine workers can collude with each other and know every state of the system . Unlike martingale-based approaches like ( Alistarh et al. , 2018 ) , we allow the set Byz to change over time ( Blanchard et al. , 2017 ; Chen et al. , 2017 ; Mhamdi et al. , 2018 ) . 2 RELATED WORK . There has been significant recent work of the case when the workers have identical data distributions ( Blanchard et al. , 2017 ; Chen et al. , 2017 ; Mhamdi et al. , 2018 ; Alistarh et al. , 2018 ; Mhamdi et al. , 2018 ; Yin et al. , 2018a ; b ; Su & Xu , 2018 ; Damaskinos et al. , 2019 ) . We discuss the most pertinent of these methods next . Blanchard et al . ( 2017 ) formalize the Byzantine robust setup and propose a distance-based approach KRUM which selects a worker whose gradient is very close to at least half the other workers . A different approach involves using the median and its variants ( Blanchard et al. , 2017 ; Pillutla et al. , 2019 ; Yin et al. , 2018a ) . Yin et al . ( 2018a ) propose to use and analyze the coordinate-wise median method ( CM ) . Pillutla et al . ( 2019 ) use a smoothed version of Weiszfeld ’ s algorithm to iteratively compute an approximate geometric median of the input gradients . In a third approach , ( Bernstein et al. , 2018 ) propose to use the signs of the gradients and then aggregate them by majority vote , however , ( Karimireddy et al. , 2019 ) show that it may not always converge . Finally , Alistarh et al . ( 2018 ) use a martingale-based aggregation rule which gives a sample complexity optimal algorithm for iid data . The distance-based approach of KRUM was later extended in Mhamdi et al . ( 2018 ) who propose BULYAN to overcome the dimensional leeway attack . This is the so called strong Byzantine resilience and is orthogonal to the question of non-iid-ness we study here . Recently , ( Peng & Ling , 2020 ; Yang & Bajwa , 2019a ; b ) studied Byzantine-resilient algorithms in the decentralized setting where there is no central server available . Extending our techniques to the decentralized setting is an important direction for future work . In a different line of work , ( Lai et al. , 2016 ; Diakonikolas et al. , 2019 ) develop sophisticated spectral techniques to robust estimate the mean of a high dimensional multi-variate standard Gaussian distribution where samples are evenly distributed in all directions and the attackers are concentrated in one direction . Very recent work ( Data & Diggavi , 2020 ) extend the theoretical analysis to non-convex , strongly-convex and non-i.i.d setup under a gradient dissimilarity assumption and propose a gradient compression scheme on top of it . Our resampling trick can be combined with it to further reduce gradient dissimilarity . Many attacks have been devised for distributed training . For the iid setting , the state-of-the-art attacks are ( Baruch et al. , 2019 ; Xie et al. , 2019b ) . The latter attack is very strong when the fraction of adversaries is large ( nearly half ) , but in this work we focus on settings when this fraction is quite small ( e.g . ≤ 0.2 ) . Further our normalized mean attack Section 3.2 is inspired by ( Xie et al. , 2019b ) . The former work focuses on attacks which are coordinated across time steps . Developing strong practical defenses even in the iid case against such time-coordinated attacks remains an open problem . In this work , we sidestep this issue by restricting ourselves to new attacks made possible by non-iid data and studying how to overcome them . We focus on schemes which work in the iid setting , but fail with non-iid data . Once a new method which can defend against ( Baruch et al. , 2019 ) is developed , our proposed scheme shows how to adapt such a method to the important non-iid case . For the non-iid setting , backdoor attacks are designed to take advantage of heavy-tailed data and manipulate model inference on specific subtask , rather than lower the overall accuracies of training ( Bagdasaryan et al. , 2018 ; Bhagoji et al. , 2018 ) . In contrast , this paper is not intended to address aforementioned challenges but rather to defend the attacks that lower the training accuracies in the non-iid setting . As far as we are aware , only ( Li et al. , 2019 ; Ghosh et al. , 2019 ; Sattler et al. , 2020 ) explicitly investigate Byzantine robustness with non-iid workers . Li et al . ( 2019 ) proposes an SGD variant ( RSA ) which modifies the original objective by adding an ` 1 penalty . Ghosh et al . ( 2019 ) ; Sattler et al . ( 2020 ) assume that all workers belong to an apriori fixed number of clusters and use an outlier-robust clustering method to recover these clusters . If we assume that the server has the entire training dataset and can control the distribution of samples to good workers , Xie et al . ( 2019a ) ; Chen et al . ( 2018 ) ; Rajput et al . ( 2019 ) show that non-iid-ness can be overcome . Typical examples of this is distributed training of neural networks on public cloud , or volunteer computing Meeds et al . ( 2015 ) ; Miura & Harada ( 2015 ) . However , none of these methods are applicable in the standard federated learning setup we consider here . We aim to minimize the original loss function over workers while respecting the non-iid data locality , i.e . the partition of the given heterogeneous dataset over the workers , without data transfer . 3 ATTACKS AGAINST EXISTING AGGREGATION SCHEMES . In this section we show that when the data across the workers is heterogeneous ( non-iid ) , then we can design new attacks which take advantage of the heterogeneity , leading to the failure of existing aggregation schemes . We study three classes of robust aggregation schemes : i ) schemes which select a representative worker in each round ( e.g . KRUM ( Blanchard et al. , 2017 ) ) , ii ) schemes which use normalized means ( e.g . RSA ( Li et al. , 2019 ) ) , and iii ) those which use the median ( e.g . RFA ( Pillutla et al. , 2019 ) ) . We show realistic settings under which each of these classes would fail when faced with heterogeneous data . 3.1 FAILURE OF REPRESENTATIVE WORKER SCHEMES ON NON-IID DATA . Algorithms like KRUM select workers who are representative of a majority of the workers , by relying on statistics such as pairwise differences between the various worker updates . Let ( g1 , . . . , gn ) be the gradients by the workers , f of which are Byzantine ( e.g . n ≥ 2f + 3 for KRUM ) . For i 6= j , let i→ j denote that gj belongs to the n− f − 2 closest vectors to gi . Then KRUM is defined as follows KRUM ( g1 , . . . , gn ) : = arg mini ∑ i→j ‖gi − gj‖2 ( 3 ) However , when the data across the workers is heterogeneous , there is no ‘ representative ’ worker . This is because each worker computes their local gradient over vastly different local data . Hence , for convergence it is important to not only select a good ( non-Byzantine ) worker , but also ensure that each of the good workers is selected with roughly equal frequency . Hence KRUM suffers a significant loss in performance with heterogeneous data , even when there are no Byzantine workers . For example , when KRUM is used for iid datasets without adversary ( f =0 , see left of Figure 1a ) , the test accuracy is close to simple average and the gap can be filled by MULTI-KRUM ( Blanchard et al. , 2017 ) . The right plot of Figure 1a also shows that KRUM ’ s selection of gradients is biased towards certain nodes . When KRUM is applied to non-iid datasets ( the middle of Figure 1a ) , KRUM performs poorly even without any attack . This is because KRUM mostly selects gradients from a few nodes whose distribution is closer to others ( the right of Figure 1a ) . This is an example of how robust aggregation rules may fail on realistic non-iid datasets .

Summary: Many existing researches on distributed deep learning works in byzantine robustness in a centralized PS setting under the assumption of i.i.d. data distribution on workers, e.g. KRUM. This paper presents a simple resampling scheme that adapts the existing robust algorithms to heterogeneous datasets (referred as KRUM-RS later in this review). It firstly proposes two new attacks under non-iid data distribution that fooled byzantine fault tolerant algorithms like KRUM, Coordinate Median (CM), and RFA (Normalized Median-NM or Geometric Median-GM). Then it proposes the RS algorithm and proved its theoretical convergence guarantee the of KRUM algorithm over non-iid data, and when the parameter server (PS) does not control the dataset distribution. Experiments showed the convergence guarantee over KRUM and even CM, NM/GM algorithm.