Scalable Robust Federated Learning with Provable Security Guarantees

Federated averaging , the most popular aggregation approach in federated learning , is known to be vulnerable to failures and adversarial updates from clients that wish to disrupt training . While median aggregation remains one of the most popular alternatives to improve training robustness , relying on secure multi-party computation ( MPC ) to naı̈vely compute the median is unscalable . To this end , we propose a secure and efficient approximate median aggregation with MPC privacy guarantees in the multi-silo setting , e.g. , across hospitals , with two semi-honest non-colluding servers . The proposed method protects the confidentiality of client gradient updates against both semi-honest clients and servers . Asymptotically , the cost of our approach scales only linearly with the number of clients , whereas the naı̈ve MPC median scales quadratically . Moreover , we prove that the convergence of the proposed federated learning method is robust to a wide range of failures and attacks . Empirically , we show that our method displays similar robustness properties as the median while converging faster than the naı̈ve MPC median for even a small number of clients . 1 Introduction . Federated Learning ( FL ) ( McMahan et al. , 2017 ) has emerged as a leading approach for training shared models among clients who do not wish to release their datasets publicly . While FL avoids releasing client data , revealing client models in the clear creates privacy vulnerabilities , e.g. , using model inversion attacks ( Fredrikson et al. , 2015 ) . To this end , global model aggregation is often implemented using Secure Multi-Party Computation ( MPC ) to improve privacy ( Bonawitz et al. , 2016 ) . MPC ( Yao , 1986 ; Goldreich et al. , 1987 ) is a cryptographic primitive that makes it possible to evaluate a function on encrypted inputs while ensuring that the only information revealed throughout the computation is the final output of the function . Thus , to avoid revealing each client ’ s local weights , clients encrypt their weights before sending them to the central server . MPC allows the central server to recover a single aggregate update that it sends back to individual clients . Specialized MPC protocols , that allow the server to recover the average of client updates have been widely deployed for Federated Learning . In addition to privacy , robustness is a major concern in federated learning implementations ( Kairouz et al. , 2019 ) . The distributed nature of the computation creates a variety of vulnerabilities to adversarial training attacks and client failures such as hardware , software , data , and communication errors ( Xie et al. , 2019a ; 2021 ) . One way to improve robustness is to replace an aggregation procedure that computes means with a more robust aggregate such as the median ( Yin et al. , 2018 ) . Using the median , up to half of inputs can be from a faulty distribution before the median fails as a robust average estimator . While median aggregation alone is insufficient to guarantee Byzantine robustness ( Xie et al. , 2020 ) – median-based robustness guarantees are sufficient against most published attacks and failures . Unfortunately , the best known approaches for median aggregation with MPC are slow , requiring computation that grows quadratically with the number of clients ( Tueno et al. , 2019 ) . Our work is motivated by applications to multi-silo federated learning ( Kairouz et al. , 2019 ) , designed for learning across institutions . For example , an individual hospital may be limited to using only their own patients ’ data , and sharing patient information among hospitals is generally difficult due to privacy and intellectual property concerns . Here , federated learning can provide a mechanism for widely distributed medical institutions to jointly train a model . The main contribution of this work is a new approximate-median aggregation for robust , privacypreserving federated learning in the multi-silo , two-server setting . Our approach is the first to have all of the following features : • Robustness against failures . By relying on ( an approximation of ) the median of client updates , we achieve robust estimates even in settings where updates sent by up to half the clients are faulty . In addition , we empirically evaluate robustness against noise distributions that take the form of bit flips , label switching , and Gaussian noise in up to half of the clients . • Preserving Client Privacy via Secure Computation . We prove that any subset of clients colluding with each other and with one of the two servers obtains no information about the private inputs of other clients , beyond the aggregated ( approximate ) median that is returned at each step . This provides meaningful privacy to every client and is a meaningful defense , e.g. , against modelinversion attacks that take advantage of individual client updates . • Scalability . The running time of our protocol increases linearly with the number of clients ; matching the order-wise scaling ( with number of clients ) of the standard averaging aggregation . This is in contrast to a quadratic factor blowup for a federated learning system that implements median naı̈vely in MPC . We empirically evaluate the convergence of our system on various datasets , models and under different types of faults . 2 Related Work . Federated Learning ( McMahan et al. , 2017 ) is a widely adopted technique for training models with data from edge devices . In its plainest form , client updates are sent without encryption to the central server at each round , and the global model is sent back to each client . However , this basic implementation of a distributed machine learning system is not robust against privacy attacks or failures . For instance , ( Wang et al. , 2019 ; Geiping et al. , 2020 ) show how model inversion attacks can be successful in a federated learning setting . ( Bonawitz et al. , 2017 ; 2016 ) provide a protocol for secure aggregation of the client updates and computation of the global model in both a semi-honest and malicious setting , with increased runtime and communication overhead . In addition to encryption of client updates , existing work has also considered robustness to failures and Byzantine client attacks , e.g. , ( Xie et al. , 2019a ; 2021 ) prune faulty client updates by assigning each update a score , and only aggregating the updates that have the top scores . Other methods of providing byzantine robustness including trimmed mean ( Xie et al. , 2019b ) , Krum ( He et al. , 2020 ; So et al. , 2021 ) , and norm-based elimination ( Gupta et al. , 2021 ) have been studied . In this paper , we strengthen the restriction on client faults and only consider semi-honest clients . Although a semi-honest setting may seem restrictive by forcing parties to follow the dictated protocol , it applies to settings where parties are assumed to have no ill intentions . Furthermore , developing semi-honest protocols are a step towards developing protocols in the malicious security model , where more expensive cryptographic primitives such as zero-knowledge proofs are added on top of the existing semi-honest protocol . Secure Multi-Party Computation ( MPC ) provides a way for multiple parties to compute a function on their individual data and only reveal the final output of the function . ( Bonawitz et al. , 2016 ; 2017 ) provide a method for federated learning where client updates have a pairwise additive mask , such that when all the encrypted client updates are summed together , the masks cancel out . In ( Tueno et al. , 2019 ) , the authors propose a rank computation system where clients send a pairwise masked version of their data point to the central server . The central server uses pairwise comparisons in MPC to calculate the desired ranked element in the clients ’ combined data . However , pairwise comparisons are expensive in MPC , as additional values for each unique comparison must be generated in advance . Furthermore , agreeing upon pairwise additive masks grows quadratically with the number of parties . The generalization of a central server to two non-colluding central servers is not a new idea in privacy-preserving analytics and machine learning . For instance , ( Corrigan-Gibbs & Boneh , 2017 ) introduce a cryptographic protocol called secret-shared non-interactive proofs , and show that these can be used to construct an efficient privacy preserving system for the release of aggregate statistics with guarantees on security in the malicious setting . The setting of the paper consists of a small number of servers jointly computing aggregate statistics over private client data . ( Mohassel & Zhang , 2017 ) introduce efficient distributed ML protocols that utilize a two server abstraction and MPC versions of ML computations . However they do not seek to provide robustness . To our knowledge , ( He et al. , 2020 ) is the first work to propose an FL system that combines both robustness and privacy , using private calculation of the distance-based aggregation . They also make the assumption of the central server being two non-colluding central servers , and utilize client side secret sharing of models and server side two party MPC . The two central server setting allows their protocol to scale well with number of parties , compared to a single central server setting . However , their protocol leaks the pairwise distance of client updates to one of the servers , which may be undesirable . Our proposed approach uses the 2-Party MPC comparison protocols presented in ( Rathee et al. , 2020 ) . We also adopt a pairwise comparison based computation of the k-th ranked element proposed in ( Tueno et al. , 2019 ) and a bucketing approximate median idea proposed in ( Corrigan-Gibbs & Boneh , 2017 ) , and apply them to the setting of distributed machine learning . Finally , we note that this work focuses on security and robustness of centralized model training . Existing work has shown that personalization and mitigating data heterogeneity can be addressed by fine-tuning the robust centralized model ( Li et al. , 2021 ) . These details are left for future work . 3 Preliminaries . Federated Learning . We denote N as the set of positive integers and R+ as the set of non-negative real numbers . Given n ∈ N , we denote [ n ] = { 1 , . . . , n } . We use bold lowercase letters , e.g. , w ∈ Rd , to denote vectors , and w ( k ) to denote its value at the kth dimension . We consider a twoserver multi-client FL system , let S0 , S1 denote the two central severs , and ci for i ∈ [ n ] represent the clients , where n is the total number of clients . Client ci holds datasetDi . The agreed upon model has d parameters . wg denotes the global model sent from servers to clients , while wi denotes the local model held by client i . All parties agree beforehand to run r cycles of FL . The loss function for client ci is F̂i : Rd → R+ . Usually , because clients have different data , the loss functions F̂i are different . Therefore , the goal of our setting is to minimize the averaged loss across all clients , i.e. , arg minw 1 n ∑n i=1 F̂i ( w ) . We first detail a basic federated learning system with one central server S and n clients . Clients are generally considered to be edge nodes and do not communicate with each other . In one iteration , the system follows the following generic protocol : 1 . For i ∈ [ n ] , client ci receives global model wg from central server S . 2 . For i ∈ [ n ] , client ci performs step ( s ) of Stochastic Gradient Descent of wg on its dataset Di to obtain new local model wi . They then send this model to S. 3 . Upon receiving all client updates , S aggregates them to obtain the new global model . The new global model is computed as w′g = 1 n ∑n i=1 wi . 4 . S sends w′g to all the clients . Secure Multi-Party Computation . Secure Multi-party Computation ( MPC ) ( Goldreich et al. , 1987 ) is a cryptographic primitive which allows n parties , each with input value xi , to jointly compute a mutually agreed upon function f ( x1 , x2 . . . xn ) , with the guarantee that no party learns anything other than what can be inferred from its own input and the joint output . One of the most prominent techniques used in MPC is secret sharing . A ( t , n ) secret sharing involves splitting a secret s into n shares , then distributing a share to each party , such that any subset of t− 1 parties can not learn anything about s , while any t or more parties can jointly reconstruct s. In this paper , we make use of ( 2 , 2 ) additive secret sharing over power-of-two sized integer rings , which involves splitting s ∈ Z2 ` into s1 , s2 ∈ Z2 ` s.t . s1 + s2 = s , and individually si , i ∈ { 0 , 1 } has a uniform random distribution . We use 〈s〉 to denote secret sharing of s over Z2 ` , and 〈s〉0 , 〈s〉1 to denote the shares of the two parties . We use F ` Comp , F ` Equal to refer to the “ greater than ” and “ equals to ” ideal functionalities respectively , i.e . where parties have access to trusted functionalities computing the said functions and use the same to describe our protocols . To implement the protocols for F ` Comp , F ` Equal , we make use of protocols proposed in CrypTFlow2 ( Rathee et al. , 2020 ) . CrypTFlow2 provides a customized 2-party protocol for solving the millionaire ’ s , and hence also the comparison/equality problems in Z2 ` ( more details on all this in Appendix C ) .

Summary: This paper proposes a fast, secure, private and scalable approximate median aggregation approach for federated learning with two semi-honest non-colluding servers. The convergence analysis of the proposed approach for the IID case has been also provided under certain assumptions, which shows that the proposed approach converges with high probability if less than 1/2 of the clients are malicious. Finally, the experiments show that the proposed approach achieves similar robustness performance compared to the exact median based approach.