Sself: Robust Federated Learning against Stragglers and Adversaries
Authors: Jungwuk Park
Dong-Jun Han
Minseok Choi
Jaekyun Moon
Venue:  (2021)
Keywords: Federated Learning

Abstract: While federated learning allows efficient model training with local data at edge devices, two major issues that need to be resolved are: slow devices known as stragglers and malicious attacks launched by adversaries. While the presence of both stragglers and adversaries raises serious concerns for the deployment of practical federated learning systems, no known schemes or known combinations of schemes, to our best knowledge, effectively address these two issues at the same time. In this work, we propose Sself, a semi-synchronous entropy and loss based filtering/averaging, to tackle both stragglers and adversaries simultaneously. The stragglers are handled by exploiting different staleness (arrival delay) information when combining locally updated models during periodic global aggregation. Various adversarial attacks are tackled by utilizing a small amount of public data collected at the server in each aggregation step, to first filter out the model-poisoned devices using computed entropies, and then perform weighted averaging based on the estimated losses to combat data poisoning and backdoor attacks. A theoretical convergence bound is established to provide insights on the convergence of Sself. Extensive experimental results show that Sself outperforms various combinations of existing methods aiming to handle stragglers/adversaries.

Under review as a conference paper at ICLR 2021
SSELF: ROBUST FEDERATED LEARNING AGAINST STRAGGLERS AND ADVERSARIES
Anonymous authors
Paper under double-blind review
ABSTRACT
While federated learning allows efficient model training with local data edge devices, two major issues that need to be resolved are: slow devices known as stragglers and malicious attacks launched by adversaries. While the presence of both stragglers and adversaries raises serious concerns for the deployment of practical federated learning systems, no known schemes or known combinations of schemes, to our best knowledge, effectively address these two issues at the same time. In this work, we propose Sself, semi-synchronous entropy and loss based saerrin/avvragingg.. to tackle both stragglers and adversaries simultaneously. The stragglers are handled by exploiting different staleness (arrival delay) informa- tion when combining locally updated models during periodic global aggregation. Various adversarial attacks are tackled by utilizing a small amount of public data collected at the server in each aggregation step, to first filter out the model- -posso-d devices using computed entropies, and then perform weighted averaging based on the estimated losses combat data poisoning and backdoor attacks. A theoretical convergence bound is established to provide insights on the convergence of Sself. Extensive experimental results show that Sself outperforms various combinations of existing methods aiming to handle stragglers/adversarie
INTRODUCTION
Large volumes of data collected at various edge devices (i.e., smart phones) are valuable resources in training machine learning models with a good accuracy. Federated learning (MeMahan et al. 2017 Li
et al. 2019a b. Konečný et al. 2016) is a promising direction for large-scale learning, which enables training of a shared global model with less privacy concerns. However, current federated learning systems suffer from two major issues. First is the devices called stragglers that are considerably slower than the average, and the second is the adversaries that enforce various adversarial attacks.
Regarding the first issue, waiting for all the stragglers at each global round can significantly slow down the overall training process in a synchronous setup. To address this, an asynchronous federated learning scheme was proposed in (Xie al. 2019a) where the global model is updated every time the server receives a local model from each device, in the order of arrivals; the global model is updated asynchronously based on the device's staleness the previous round at which the device received the global model from the server. However, among the received results at each global round, a significant portion of the results with large staleness does not help the global model in meaningful way, potentially making the scheme ineffective. Moreover, since the model update is performed one-by-one asynchronously. the scheme in (Xie et al. (0199) would be vulnerable to various adversarial attacks; any attempt combine this type of asynchronous scheme with existing adversary-resillie ideas would not likely be fruitful.
т, the difference between the current round and
There are different forms of adversarial attacks that significantly degrade the performance of current federated learning systems. First, in untargeted attacks, an attacker can poison the updated model at the devices before is sent to the server (model update poisoning) (Blanchard al. 2017 Lamport et al. 2019) or can poison the datasets of each device (data poisoning) (Biggio et al.) 2012: Liu ctt al. 2017 which degrades the accuracy of the model. In targeted attacks (or backdoor attacks) (Chen et al. 201 Bagdasaryan et al. 2018 Sun et al. 2019), the adversaries cause the model to misclassify the targeted subtasks only, while not degrading the overall test accuracy. To resolve these issues, robust federated averaging (RFA) scheme recently proposed in (Pillutla et al.) 2019) which utilizes the geometric median of the received results for aggregation. However, RFA tends to lose performance rapidly as the portion of adversaries exceeds certain threshold. In this sense, RFA

---

Under review as a conference paper at ICLR 2021
is not an ideal candidate to be combined with known sraggler-mmtigating strategies (e.g., ignoring stragglers) where a relatively small number of devices are utilized for global aggregation: the attack ratio can be very high, significantly degrading the performance. To our knowledge, there currently no existing methods or known combinations of ideas that can effectively handle both stragglers and adversaries at the same time, an issue that is becoming increasingly important in practical scenarios.
Contributions. In this paper, we propose Sself, semi-synchronowe entropy and loss based filter- ing/averaging, robust federated learning strategy which can tackle both stragglers and adversaries simultancously. In the proposed idea, the straggler effects are mitigated by semi- cemi-synchronous global aggregation at the server, and in each aggregation step, the impact of adversaries are countered by a new aggregation method utilizing public data collected at the server. The details of our key ideas are as follows. Targeting the straggler issue, our strategy is to perform periodic global aggregation while allowing the results sent from stragglers to be aggregated in later rounds. The key strategy is a judicious mix of both synchronous and asynchronous approaches. At each round, as a first step, aggregate the results that come from the same initial models (i.e., same staleness), in the synchronous scheme. Then. we take the weighted sum of these aggregated results with different staleness, i.e., coming from different initial models, as in the asynchronous approach.
Regarding the adversarial attacks, robust aggregation is realized via entropy- -based filtering and loss-weigs weightedd averaging. This can be employed the first step of our cemi-synchronous strategy described above, enabling protection against model/data poisoning and backdoor attacks. To this end, our key idea is to utilize public IID (independent, identically distributed) data collected at the server. We can imagine a practical scenario where the server has some global data uniformly distributed over classes, as the setup of (Zhao et al. 2018). This is generally a reasonable setup since data centers mostly have some collected data (although they can be only few) of the learning task. For example, different types of medical data are often open to public in various countries. Based on the public data, the server computes entropy and loss of each received model. We the entropy of each model to filter out the devices whose models are poisoned. In addition, by taking the loss loss-weighted averaging of the survived models, we can protect the system against local data poisoning and backdoor attacks.
We derive a theoretical bound for Sself to ensure acceptable convergence behavior. Experimental results on different datasets show that Sself outperforms various combinations of straggler/adversary defense methods with only small portion of public data at the server.
Related works. The authors of (Li et al. 2019c Wu et al. 2019 Xie et al. 2019a) have recently tackled the straggler issue in a federated learning setup. The basic idea is to allow the devices and the server to update the models asynchronously. Especially in (Xie et al. 2019a), the authors proposed an asynchronous scheme where the global model is updated every time the server receives local model of each device. However, a fair portion of the received models with large staleness does not help the global model in meaningful ways, potentially slowing down the convergence speed. A more critical issue here is that robust methods designed to handle adversarial attacks, such as RFA (Pillutla ee al. 2019), are hard to be implemented in conjunction with this asynchronous scheme.
KruttiKrummaaa (Blanchard et al., (217)) the presently proposed entropy/loss based idea,
To combat adversaries, various aggregation methods have been proposed in distributed learning setup with IID data across nodes (Yin et al. 2018a by Chen et al. 2017b Blanchard et al. 2017 Xic al. 2018). The authors of (Chen et al. 201 7017b) suggests a geometric median based aggregation rule of the received models or the gradients. In (Yin et al. 20188)). trimmed mean approach is proposed which removes fraction of largest and smallest values of each element among the received results. In Multi-Krum (Blanchard et al., 2017). among N workers in the system, the server tolerates f' Byzantine workers under the assumption of 2 + < N. Targeting federated learning with non-lll) data, the recently introduced RFA method of (Pillutla al., 2019) utilizes the geometric median of models sent from devices, similar to (Chen et al. 200 7b).. However, as mentioned above, these methods are ineffective when combined with straggler- miitiietn scheme, potentially degrading the performance of learning. Compared to Multi-Krum and RFA, our entropy/loss based scheme can tolerate adversaries even with high attack ratio, showing remarkable advantages, especially when combined with straggler-mittgation schemes.
Finally, we note that the authors of (Xie et al. 2019c) considered both stragglers and adversaries but in a distributed learning setup with TII data across the nodes. Compared to these works, we target non-IID data distribution setup in a federated learning scenario.
2

---

Under review as a conference paper at ICLR 2021
2 PROPOSED FEDERATED LEARNING WITH SSELF
We consider the following federated optimization problem:
N
W argmin F(w) = argmin Σ m
mk Fa (w),
where N the number of devices, my the number of data samples in device k, and m = Σ Lk=1 my is the total number of data samples of all N devices in the system. By letting T)e be the j- th data sample device k, the local loss function of device k. F&(w). is written as Fx (w)
my قز=1 ([w:rk.)) In the following, we provide solutions aiming to solve the above problem
under the existence of stragglers (subsection 2.1 and adversaries (subsection 2.2) and finally propose
Sself handling both issues (subsection 2.3
2.1 SECI-SYNCHRONOUS SCHEME AGAINST STRAGGLERS
In the 1-th global round, the server sends the current model w, to K devices in St ((S)) = K S SN,, which is set of indices randomly selected from N devices in the system. We let C K/N be the ratio of devices that participate at each global round. Each device in St performs E local updates with its own data and sends the updated model back to the server. In conventional federated averaging (FedAvg), the server waits until the results of all K devices in St arrive and then performs aggregation ma (kkk), where w.(k) is the model after E local updates at device to obtain W EvES. Exes, me
k starting from w.. However, due to the effect of stragglers, waiting for all K devices at the server can significantly slow down the overall training process.
In resolving this issue, our idea assumes periodic global aggregation the server. At each global round f, the server transmits the current model/round (w,,t) t) to the devices in St. Instead of waiting for all devices in St, the server aggregates the models that arrive until a fixed time deadline Ta to obtain w,-1, and moves on to the next global round L +++ 1. Hence, model aggregation is performed periodically with every Ta. A key feature here that we do not ignore the results sent from stragglers (not arrived by the deadline Ta). These results are utilized at the next global aggregation step, or even later, depending on the delay or staleness. Let U be the set of devices 1) that selected from the server at global round f, i.e., U C S, and 2) that successfully sent their results to the server at global round i for 2 t. Then, we can write S, U where U.!) nu @ for * j. Here, U.2 can be viewed as the devices that are selected at round but failed successfully send their results back to the server. According to these notations, the devices whose training results arrive at the server during global round belong one of the following / 1 sets: U."), U,!), .... U(!) Note
that the result sent from device k E U is the model after E' local updates starting from w,, and we denote this model by (k)). At each round i, we first perform FedAvg
(
Σ kEC())
m
(k())
Encofo my
for all i = 0, 1,..., f, where Ve+1 is the aggregated result of locally updated models (starting from w;) received round with staleness i Then from (0) (1) ((()) we take the weighted Eveuto me (2 Here, ai(1) x -1- is normalized coefficient that is proportional to the number of data samples in U,(0) and inversely proportional to (t - + 1)s, for a given hyperparameter c 2 0. Hence, we have a larger weight for (6)
averaging of results with different staleness to obtain E (
ve+ with smaller t i 1 (staleness). This is to give more weights to more recent results. Based on the weighted sum = a+ (1)
()) (41 we finally obtain W as
W (1 7) + Σ (1
(3)
where y combines the aggregated result with the latest global model w.. Now we move to the next round t + 1, where the server selects S and sends (We41. + 1) to these devices. Here, the server knows the set of active devices (which are still performing computation), S4+1 can be
3

---

Under review as a conference paper at ICLR 2021
0
Server
Received at global round
Lass weighted averaging
Wess (1 - p/w, + o (0
S1-1
Entrngyy based filtering
Weighteddaveraginng avernging
Recelved global round Ixt
Recelved global
(Weus,
S
Figure I: Overall procedure for Sself at the server. At global round f, the received models belong of the following i sets: U,") U!") ,., U.!). After entropy-based filtering, the server performs loss weighted averaging for the results that belong to U.! to obtain v( Now by taking the weighted averaging of v for all 0, l,.., and combining with w,, we finally obtain w.+1 and move on to the next round / + 1.
constructed to be disjoint with the active devices. not, the server randomly chooses S among all devices in the system and the selected active devices can ignore the current request of the server. The left-hand side of Fig. describes our emmisyynchoonuu scheme.
The key characteristics of scheme can be summarized as follows. First, by periodic global aggregation at the server, our scheme is not delayed by the effect of stragglers. Secondly, our scheme fully utilizes the results sent from stragglers the future global rounds; first perform federated averaging for the devices with same staleness (as in the synchronous scheme), and then take the weighted sum of these averaged results with different staleness (as in the asynchronous scheme).
2.2 ENTROPY AND LOss BASED FILTERING// AVERAGING AGAINST ADVERSARIES
In this subsection, we propose entropy-base based filtering and loss-weighted averaging which not only show better performance with or without attacks but also combine well with the semi-synchronous scheme compared existing adversary-resille
aggregation methods. Our key idea is utilize the public IID data collected at the server. We can imagine a practical scenario where the server (or data center) has its own data samples as in(Zhao et al. 2018 e.g., various medical data that are open to public. Using these public data at the server, we provide the following two solutions which can protect the system against model update poisoning. data poisoning and backdoor attacks.
1) Entropy-basee Fpud, be the j-th sample the server. When the server receives the locally updated models from the devices, it measures the entropy of each device A by utilizing the public data as
filtering: Let puus be the number of public data samples in the server. We also let
Tlpubb
Eang (k)
Enrpusis (k),
Tiprub
where Expuxit (k) (6) is the shannon entropy of the model of k-th device on the sample Fpud. written as Expun. (k) = Eg p!py.., (k) log Pigl.,, (l6). Here, Q is the number of classes of the dataset and Plpin, (k) is the probability of prediction for the q-th class on a sample Tpub.jj. using the model of the k-th device. In supervised learning tasks, the model produces high-confident prediction for the ground truth label of the trained samples and thus has a low entropy for the prediction. However, if the local model is poisoned, e.g., by reverse sign attack, the model more likely to predict randomly for all classes and thus has high entropy. Based on this observation, the server filters out the models that have entropy greater than some threshold value Eth. It can seen later in Section 4 that Es, is hyperparameter that can be easily tuned since there is huge gap between the entropy values of benign and adversarial devices for all datasets. Note that the above method robust against model update poisoning even with a large portion of adversaries because it just filters out the results whose entropy is greater than Eng- This is a significant advantage compared to the median based method (Pillutla et al. 2019) whose performance is significantly degraded when the attack ratio is high.
2) weishtei averaging: The server also measures the loss each received model using the public data. Based on the loss values, the server then aggregates the received models follows:
4

---

Under review as a conference paper at ICLR 2021
W++1 Σ (e)k)oo(k) where (e(k) x KES,
m&
and Σ Be(k) = (5)
(p)))
KES.
Here, (e(k:) is the locally updated model of the k-th device at global round t. Fino (1o (k)) is
defined as the averaged loss of (k) computed on public data at the server, i.e., Fpubl (rub(We(() (k))
Ryub ===1 (k): (yab))) Finally, 8(2 0) {Fpuo(-)}* is parameter related to the impact of
puh
the loss on public data. We note that setting 5 = 0 in (5) makes our loss-weighted averaging method backdoor attacks, the models of malicious devices would have relatively larger losses compared to others. By the definition of (e)),, such devices would be given small weight and has less impact on the next global update. By replacing the federated averaging with the above loss- boss-weighted averaging, we are able to build system which robust against local data poisoning and backdoor attacks.
equal to FedAvg of (I) Under the data poisoning
Algorithm 1 Semi-Synchronous Entropy and Loss based Filtering/Averaging (Sself)
Input: Initialized model Wp. Output: Final global model Wr
Algorithm at the Server
1: for each global round = 0, 1,., T do
2: Choose St and send the current model and the global round (w,, t) to the devices
3: Wait for Ta and then:
4: for i = 0,1, / do
for k: U, do
5:
6:
いト50) + U,!0
[k], if (kng(k)= > Er
// Entropy-based filtering
7: end for
8:
end for
9: for 0, 0..,, do
10: (()) = E ke (k) // Less-weighted average of results with same staleness
11: end for
12: Wi+1 = (1 (1->)w,+ Ei Ei (n 10 // /eighted average of results with different staleness
13: end for
Algorithm at the Devices: If device i receives (we, t) from the server, it performs local updates to obtain (k).. Then each benign device k sends (wr(k)) () to the server, while adversarial device transmits a poisoned model depending on the type of attack.
The above two methods can be easily combined to tackle model update poisoning, data poisoning and backdoor attack issues. The server first filters out the model-poisoned devices based on the entropy. and then take the loss-weighted average with the survived devices to combat data poisoning and backdoor attacks.
2.3 SEMI-SYNCHRONOUS ENTROPY AND LOss BASED FILTERING//AVERAGII (SSELF)
The details of overall Sself operation are described in Algorithm I and Fig. [I] At global round t, the server chooses S, and sends (w,,t) to devices. The server collects the results from the devices for a time period Ta, and calculates entropy Faeg (k) and loss Fpub( (w, (k)) as in (4) and (5). respectively. Based on the entropy, the server first filters out the results sent from the model poisoned devices. Then, the server aggregates the models that have the same staleness, to obtain
Vi-1 for 0, l,.,, t. In this aggregating process, we take woightei averaging as in (5) instead of conventional averaging of FedAvg, to defend the system against data poisoning or Backdoor
14+1.... i+11 we finally obtain W as in (3). Here we note that the server can compute entropy and loss whenever the model is received, 1.c., based on the order of arrival. After computing entropy and loss of the last model of global round t, the server just needs to compute the weighted sum of the results. Hence, in practical setups where cloud servers have large enough computing powers, Sself does not cause significant time delay at the server, compared to FedAvg. The computational complexity of Sself depends on the number received models at each global round, and the running time for computing the entropy/loss with each model. Although direct comparison with other baselines is tricky, if we assume that the complexity of computing entropy or loss is linear to the number of model parameters as in (Xie et al.] (2019)), Sself has larger complexity than that of RFA by a factor of npuh- The additional computational complexity of Sself compared to RFA is the cost for better robustness against adversaries.
attacks. Now using v v (1) (e)
5

---

Under review as a conference paper at ICLR 2021
At the side, each device starts local model update whenever it receives (Wr,t) t) from the server. After performing E local updates, device transmits (w,(k), t) to the server. These processes at the server and the devices performed in parallel and asynchronously, until the last global round ends.
3 CONVERGENCE ANALYSIS
In this section, we provide insights the convergence of Sself with the following standard assump- tions in federated learning (Li et al. 2019b; Xie et al. 2019a).
Assumption The global loss fuction F defined in (7) p-strongly convex and L-smooth.
Assumption Let (k) be set of data samples that are randomly selected from the k-th device during the i-th local update at global round f. Then, P1 holds for all t and k = L....,N NN and = 1......
(F(W(( s
Assumption The second moments of stochastic gradients in each device is bounded, iee. S p2 for all and k == 1,...., a
E.
We also have another assumption that describes the bounds on the error for the adversaries. Let B and M be the set for benign and adversarial devices of U(()) respectively, satisfying U
B( UM, and B(S) n.M 0. Let
2.00 = Σ (1(k))
(6)
AEM
be the sum of loss weights for the adversarial devices in U.(0) Now we have the following assumption.
Assumption For an adversarial device ls E M, there exists an arbitrarily large I such that B[F(w:(k)) F(w")] < T < oo holds for all = 1,...,I.
Based on the above assumptions, we state the following theorem which provides the convergence bound of our scheme. The proof can be found Supplementary Material.
Theorem Suppose Assumptions
hold and the learning rate is set to be less than J.-
Ul9 for all t E {0, L, ..., T). then Sself satisfies
E[F((7] - FF(w") D"
[F(wo) F(w*)) (1-= DF'
where v -=1- 7(1 - = C" Pi Pa+ 2
2nje"
Pman
max DSISLDSIST
22
We have the following important observations from Theorem between convergence rate y² and the eтrоr term (1 - n C" C If we increase y, the convergence rate improves but the error term increases as in (Xie et al., 2019a). By adjusting this 7, we can make the convergence speed faster at the beginning of training while reducing the enror at the end of training. Another important observation is the impact of the adversaries. If we have a large Qmaz for a fixed v, it can be seen from the definition of C" that we have large error term (1 C"" However, if the entropy-based filtering method successfully filters out the model poisoned devices, and the loss-weights 33 (k) of the adversaries
First, we can observe trade-off
significantly small for data poisoning and backdoor attacks, we have a small (2( (close to zero) from (6). This means that we have a significantly small Pmaz. i.e., small error term (1 )TC In the next section, show via experiments that Sself successfully combats both stragglers and adversaries simultaneously and achieves fast convergence with small error term.
EXPERIMENTS
In this section, we validate Sself on MNIST (LeCun et al. 1998), FMNIST (Xiao et al., 2017) and 10 (Krizhevsky et al. 2009). The overall dataset is split into 60,000 training and 10,000 test samples for MNIST and FMNIST, and split into 50,000 training and 10,000 test samples for CIFAR- 10. A simple convolutional neural network (CNN) with 2 convolutional layers and 2 fully connected layers is utilized for MNIST, while CNN with convolutional layers and fully connected layer is used for FMNIST. When training with CIFAR-10, we utilized VGG-11. We consider

---

Under review as a conference paper at ICLR 2021
100
50
70-
Test accurayy
70
8
Tost 600
40
Soar
Fackkayrr Ignore stagg ere Fedding
draggiere Festug)
20
lanore smacglers + Fodtvg Vaatt for supgplers Fosiug
Seelf
Feshhamm
20-
Faddappc
atregg Fietfing
10
20
40
60
50
20
40
50
200
400
600
500
1000
1200
Rurning Time
Purnnng time
Purning time
(a) MNIST, C = 0.1
(b) FMNIST, C 0.1
(c) CIFAR-10, C 0.1
80
Test axsunacy
Test ascuracy
Test aozu moo
60
800
16
Bscff
40
70
Fochtsyno
10 crw strappeers- Feckoy
Sead
FodMoy::
-0
Beell
Facthayms
struaphera Facikag
Ignore stagglers a Fedfigg Wisl for sregrdere Faekka
20
Viait strappooss Feshing
kyrowe smagghers Fecking
50
10
30
50
70
90
60 Running Smo
200
1000 1200 Running dmo
Rurning time
(d) MNIST, C' 0.2
(c) FMNIST, C 0.2
(f) CIFAR- 10, C= 0.2
Figure Test accuracy versus training time with only stragglers. Sself is our scheme.
N 100 devices each having the same number of data samples. We randomly assigned two classes to each device create non-IID situations. Considering the non-lID cases, ignored the batch normalization layers when training VGG-11 with CIFAR-10. At each global round, we randomly selected a fraction C. of devices in the system to participate. For the proposed Sself method, we let 2% of the entire training data to be the public data and performed federated training with the remaining 98% of the training set. The number of local epochs at each device is set to for all experiments and the local batch size is set to 10 for all experiments except for the backdoor attack. In addition, we used stochastic gradient descent and tuned hyperparameters for Sself and other comparison schemes; the details are described in Supplementary Material. Here, we emphasize that Sself outperforms existing methods even with naively chosen hyperparameters, as also shown in Supplementary Material.
Experiments with stragglers. To confirm the advantage of Sself, we first consider the scenario with only the stragglers. The adversarial attacks are not considered here. We compare Sself with the following methods. First the wait for strugglers approach where FedAvg applied after waiting for all the devices at each global round. The second scheme is the ignore siragglers approach where FedAvg is applied after waiting for a certain timeout threshold and ignore the results sent from slow devices. Finally, we consider the asynchronous scheme (FedAsync) (Xie al., 2019a) where the global model is updated every time the result of cach device arrives. For Sself and FedAsync, 7 is decayed while the learning rate is decayed in other schemes.
In Fig. 2 we plot the test accuracy versus running time on different datasets and C values. For a fair comparison, the global aggregation at the server is performed with every T2 = 1 periodically for Sself and other comparison schemes (ignore stragglers, FedAsyne). To model stragglers, each device can have delay of 0, 1, which is determined independently and uniformly random. In other
words, at each global round I, we have S. = U(() U U U U0 Our first observation from Fig. 2 is that the ignore stragglers scheme suboptimal point with less accuracy. The wait for stragglers scheme requires the largest running time
"+1
lose significant data at each round and often converges to
until convergence due to the delays caused by slow devices. Finally, it is observed that Sself performs the best, even better than the state-of-the
FedAsyne.
Experiments with adversaries. Next, we confirm the performance of Sself in Fig. 3 under the scenario with only the adversaries in synchronous setup. We compare our method with geometric median-based RFA (Pillutla et al. 2019) and FedAvg under the model update/data poisoning and backdoor attacks. Comparison with the Multi-Krum is illustrated in Supplementary Material. For data poisoning attack, we conduct label-flipping (Biggio et al. 2012), where each label i is flipped to label i + 1. For model update poisoning, each adversarial device takes the opposite sign of all weights and scales up 10 times before transmitting the model to the server. For both attacks, we set C to 0.2 and the portion of adversarial devices is assumed to be 0.2 at each global round.
7

---

Under review as a conference paper at ICLR 2021
100
Telt accamny
80
70
Boat RFA Fashkgg
40
Tesl
70-
Toat
Scadl
Fedfing
RFA
80
Fedding
100
10
40
00
20
40
80
100
200
400
500
500
1000
1200
Global round
Global round
Globall round
(a) MNIST, data poisoning
(b) FMNIST, data poisoning
(c)
CIFAR 10, data poisoning
Tost a0ou/aa)
80
Teol acouray
"
scourcy
60
60
Shadl RFA Feeffig
8
40
Soael IIFA Facsfeg
40
B
20
20
Fastfug
10
10
Global round
Global round
round
(d) MNIST, model poisoning
(c) FMNIST, model poisoning
(f) CIFAR-10, 10, model poisoning
100
100
100
Scc
Attack sunssaaa rite
80-
Fasskg
Atteck succses rdd
80
Norm trreshckliigg
80-
RFA
Feddug
Attack
20
20
150
50
200
500
1000
1400
1600
2000
Global round
(g) MNIST, backdoor attack
(h) FMNIST, backdoor attack
(i) CIFAR-10, backdoor attack
Figure 3: Performance of different schemes with only adversaries.
For the backdoor, we use the model replacement method (Bagdasaryan et al., 2018) in which adversarial devices transmit the scaled version of the corrupted model to replace the global model with a bad model. We conduct the pixel-patters backdoor attack (Gu et al. 2017) in which the specific pixels are embedded in fraction of images, where these images are classified as targeted label. We embedded 12 white pixels in the top-left corner of the image and the labels of these poisoned images set to 2. We utilize the Dirichlet distribution with parameter 0.5 for distributing training samples to N = 100 devices. We let C = 0.1, r 0.1, and the local batch size is set to 64. The number of poisoned images in batch is set to 20, and we do not decay the learning rate here. In this backdoor scenario, we additionally compare Sself with the norm-three torm-thresholding strategy (Sun et al. 2019), in which the server ignores the models with the norm greater than pre-defined threshold. We measure the attack success rate of the backdoor task by embedding the pixel-pattern into all test samples (except data with label 2) and then comparing the predicted label with the targeted label 2. We applied backdoor attack in every round after the 10-th global round for MNIST and FMNIST, and after the 1000-th global round for CIFAR-10.
Fig. shows the performance of each scheme over global round under three attack scenarios. For both data and model poisoning attacks, it can be seen that Sself shows better performance than other schemes. FedAvg does not work well on all datasets, and the performance of RFA gets worse as the dataset/neural network model become more complex. the backdoor attack scenario, Sself and the norm-thresholding method have low attack success rates on all datasets. The other schemes cannot defend the backdoor attack having the high attack success rate as global round increases.
Experiments with both stragglers and adversaries. Finally in Fig. 4 we consider the setup with both stragglers and adversaries. We compare Sself with various straggler/adversaryy defense combinations. Comparison with the Multi-Krum is illustrated in Supplementary Material. We set C= 0.2, r = 0.2 for model/data poisoning while the results on the backdoor attack are also shown in Supplementary Material. The stragglers and adversaries are modeled as in Figs. 2 and respectively. We have the following observations from Fig. First, FedAsync (Xie et al. 2019a) does not perform well when combined with entropy-based filtering and loss loss-weighted averaging, since the model
8

---

Under review as a conference paper at ICLR 2021
Scalf
Sami-Synchronous- RFA
FadAsyne- ELF
Ignare stragglers RFA
Walt for siragglers RFA
100
30
/0
Tosl 8030 acoummir
80
Tost accuracy
80
70
00-
30
10
400
Runningg
Running
Runnning
(a) MNIST, data poisoning
(b) FMNIST, data poisoning
(c) CIFAR-10, data poisoning
100
80
Test aizz may
Test soo may
50
60
60
Test
30
20
20
40
60
80
100
150
200
400
800
800
1000
1200
Running time
Running Sime
Running time
(d) MNIST, model poisoning
(c) FMNIST, model poisoning
(f) CIFAR-10, model poisoning
Figure 4: Performance of different schemes with both stragglers and adversaries.
update is conducted one-by-one in the order of arrivals. Due the same issue, FedAsyne cannot be combined with RFA. Our second observation is that the semi-synchronous or ignore stragglers method combined with RFA exhibits poor performance. The reason that the attack ratio could often be very high (larger than r)) for these dcadline- based schemes, which degrades the performance of RFA. Compared to RFA, our entropy and loss based filtering/averaging can be applied even with high attack ratio. It can be also seen that the wait for stragglers scheme combined with RFA suffers from the straggler issue. Overall, the proposed Sself algorithm performs the best, confirming significant advantages of our scheme under the existence of both stragglers and adversaries.
CONCLUSION
We proposed Sself, a robust federated learning scheme against both stragglers and adversaries. The semi-synchronous component allows the server to fully utilize the results sent from the stragglers by taking advantages of both synchronous and asynchronous elements. In each aggregation step of the semi-synchronous approach, entropy-based filtering screens out the model-poisoned devices and loss weighted averaging reduces the impact of data poisoning and backdoor attacks. Extensive experimental results show that Sself enables fast and robust federated learning in practical scenarios with large number of slow devices and adversaries.
REFERENCES
Eugene Bagdasaryan, Andreas Veit, Yiqing Hua, Deborah Estrin, and Vitaly Shmatikov. How to backdoor federated learning, arXiv preprint arXiv:1807.00455 2018.
Battista Biggio, Blaine Nelson, and Pavel Laskov. Poisoning attacks against support vector machines. arXiv preprint arXiv:/206.6389 2012.
Peva Blanchard, Rachid Guerraoui, Julien Stainer, et al. Machine learning with adversaries: Byzantine tolerant gradient descent. In Advances in Neural Information Processing Systems, pp. 119-129, 2017.
Xinyun Chen, Chang Liu, Bo Li, Kimberly Lu, and Dawn Song. Targeted backdoor attacks on deep learning systems using data poisoning. arXiv preprint arXiv: 17Xiv:1712.05526, 2017a.
Yudong Chen, Lili Su, and Jiaming Xu. Distributed statistical machine learning in adversarial settings: Byzantine gradient descent. Proceedings of the ACM on Measurement and Analysis of Computing Systems, 1(2):44 2017b.

---

Under review as a conference paper at ICLR 2021
Tianyu Gu, Brendan Dolan-Gavitt, and Siddharth Garg. Badnets: Identifying vulnerabilities in the machine learning model supply chain. arXiv preprint arXiv:1708.06720 2017.
Jakub Konečný, H Brendan McMahan, Felix X Yu, Peter Richtárik, Ananda Theertha Suresh, and
Dave Bacon. Federated learning: Strategies for improving communication efficiency. arXiv preprint arXiv:/610.0549) 2016.
Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. 2009.
Leslie Lamport, Robert Shostak. and Marshall Pease. The byzantine generals problem. In Concur- rency: the Works of Leslie Lamport, pp. 203-226. 2019.
Yann LeCun, Léon Bottou, Yoshua Bengio, and Patrick Haffner. Gradient-based learning applied to document recognition. Proceedings of the IEEE, 86(11 (((1)))2778-22222 1998.
Tian Li, Anit Kumar Sahu, Ameet Talwalkar, and Virginia Smith. Federated learning: Challenges, methods, and future directions. arXiv preprint vrXiv:/908.07873 2019a.
Xiang Li, Kaixuan Huang, Wenhao Yang, Shusen Wang, and Zhihua Zhang. On the convergence of fedavg on non-iid data. arXiv preprint arXiv:1907.022: 1907.02189, 2019b.
Yanan Li, Shusen Yang, Xuebin Ren, and Cong Zhao. Asynchronous federated learning with differential privacy for edge intelligence. arXiv preprint 1912.0799 2019c.
Yingqi Liu, Shiqing Ma, Yousra Aafer, Wen-Chuad Lee, Juan Zhai, Weihang Wang, and Xiangyu Zhang. Trojaning attack on neural networks. 2017.
Brendan McMahan, Eider Moore, Daniel Ramage, Seth Hampson, and Blaise Aguera Arcas. Communication-effcieentt learning of deep networks from decentralized data. Artificial Intelli- gence and Statistics, pp.
2017.
Krishna Pillutla, Sham M Kakade, and Zaid Harchaoui. Robust aggregation for federated learning. arXiv preprint 1912. 13445, 2019.
Ziteng Sun, Peter Kairouz, Ananda Theertha Suresh, and H Brendan McMahan. Can you really backdoor federated learning? arXiv preprint a7X0v:1911.07963, 2019.
Wentai Wu, Ligang He, Weiwei Lin, Stephen Jarvis, et al. Safa: semi- asnihhosychoon protocol for 2019.
fast federated learning with low overhead. arXiv preprint
Han Xiao, Kashif Rasul, and Roland Vollgraf. Fashion-mmist: novel image dataset for benchmarking machine learning algorithms. arXiv preprint 17Xiv: 2017.
Cong Xie, Oluwasanmi Koyejo, and Indranil Gupta. Generalized byzantine-tolerant sgd. International Conference on Machine Learning, 2018.
Cong Xie, Sanmi Koyejo, and Indranil Gupta. Asynchronous federated optimization. arXiv preprint arXiv:190..03934, 2019a.
Cong Xie, Sanmi Koyejo, and Indranil Gupta. Zeno: Distributed stochastic gradient descent with suspicion-basee fault-tolerance. In International Conference on Machine Learning, pp. 6893-6901. PMLR, 2019b.
Cong Xie, Sanmi Koyejo, and Indranil Gupta. Zeno++: Robust fully asynchronous sgd. arXiv preprint arXiv:1903.07030 070020, 2019c.
Dong Yin, Yudong Chen, Kannan Ranchandran, and Peter Bartlett. Byzantine-robust distributed learning: Towards optimal statistical rates. arXiv preprint N0i3:11033 2018a
Dong Yin, Yudong Chen. Kannan Ramchandran, and Peter Bartlett. Defending against saddle point attack in byzantinerrobust distributed learning. arXiv preprint arXiv: 1r0.00880600558, 2018b.
Yue Zhao, Meng Li, Liangzhen Lai, Naveen Suda, Damon Civin, and Vikas Chandra. Federated learning with non-iid data. arXiv preprint
2018.
10

---

Under review as a conference paper at ICLR 2021
A HYPERPARAMETER SETTING
A.1 SCENARIO WITH ONLY STRAGGLERS
The hyperparameter settings for Sself are shown in Table [ For the schemes ignore stragglers and wait for stragglers combined with FedAvg, we decayed the learning rate during training. For the FedAsyne scheme in (Xie al. 2019a), take polynomial strategy with hyperparameters 0.5,
= 0.8, and decayed during training.
Table 1: Hyperparameters for Sself with only stragglers
Dataset
7
8
Esh
Learning rate
? decay
MNIST
0.5
0.5
1
0.01
Every 15 global epochs
FMNIST
0.5
0.5
1
0.01
Every 15 global epochs
CIFAR10
0.5
1.5
0.01
Every 300 global epochs
A.2 SCENARIO WITH ONLY ADVERSARIES
Data poisoning and model update poisoning attacks: Table describes the hyperparameters for Sself with only ad adversaries, under data poisoning and model update poisoning attacks, For the RFA in (Pillutla et al. 2019), maximum iteration set to 10. In this setup, the learning rate decayed for all three schemes (Sself, RFA, FedAvg).
Table 2: Hyperparameters for Sself with only adversaries, under data and model update poisoning
Dataset
Esh
Learning rate
? decay
MNIST
1
0.01
No decay
FMNIST
0.01
No decay
CIFAR10
0.01
No decay
Backdoor attack: In this backdoor attack scenario, note that utilized the Dirichlet distribution with parameter 0.5 for distributing training samples to 100 devices. Local batch size set to 64 and the number of poisoned images is 20. In this experiment, additionally compared our scheme with the norm-thresholding strategy (Sun et al. 2019) where the threshold value is set to 2. The hyperparameter details for Sself shown Table
Table 3: Hyperparameters for Sself with only adversaries, under backdoor attack
Dataset
7
Esh
Learning rate
? decay
MNIST FMNIST 1
0.01
No decay
5
2
0.01
No decay
CIFARIO
0.01
No decay
A.3 SCENARIO WITH BOTH STRAGGLERS AND ADVERSARIES
Data poisoning and model update poisoning attacks: The hyperparameters for Sself are exactly the same as in Table 2
Backdoor attack: The hyperparameter details are shown Table 4
For the comparison schemes, considered: 1) Semi-synchronous + RFA, 2) FedAsyne ELF (entropy and loss based filterin//aerrgging). 3) Ignore stragglers + REA, 4) Wait for stragglers RFA. Each setting is set to be the same as in the previous experiments.
11

---

Under review as a conference paper at ICLR 2021
Table 4: Hyperparameters for Sself with both stragglers and adversaries, under backdoor attack
Dataset
7
c
Esh
Learning rate
y decay
MNIST
0.5
0.5
5
0.01
No decay
FMNIST
0.5
0.5
5
0.01
No decay
CIFARIO
0.5
1.5
5
0.01
Every 1000 global epochs
100
100
100
Atac rats
rate
Attoc SUCOES rata
Bsef
Semi Synchronous RFA
Ipnone atrapperss
Spec Vorou
shaaggers-
ELP
Spaer rmggpee 1994
19.5
1000
1200
1800
8000
Globel
(a) MNIST
(b) FMNIST
(c) CIFAR-10
Figure B.I: Performance of different schemes with both stragglers and adversaries under backdoor attack. We set 0.1. 0.1.
B ADDITIONAL EXPERIMENTS UNDER BACKDOOR ATTACK
B. EXPERIMENTS WITH BOTH STRAGGLERS ADVERSARIES UNDER BACKDOOR ATTACK
Based on the hyperparameters described in Table we show experimental results with both stragglers and adversaries under backdoor attack. It can be observed from Fig. B.I that Sself successfully defends against the backdoor attack while other schemes show high attack ratios as global round increases.
B.2 EXPERIMENTS UNDER NO-SCALED BACKDOOR ATTACK
In addition to model replacement backdoor attack we considered so far, perform additional experiments under no-scaled backdoor attack (Bagdasaryan et al. 2018) where the adversarial devices do not scale the weights and only transmit the corrupted model to the server. Fig. B.2 shows the performance under no-scaled backdoor attack with only adversaries (no stragglers). It can seen that our Sself consistently achieves low attack success rates compared others. Since the adversaries do not scale the weights, the norm-th teen--hhrehoodingggg approach cannot defend against the attack.
100
100
Attack SUCCeSSS rate
Attsck Success rate
60
FadAng
40
Norm Piresholdngg
40
FadAug Norm thresholding
200
250
80
Global round
Globel round
(a) MNIST
(b) FMNIST
Figure B.2: Performance comparison with no-scaled backdoor attack. We C 0.1, r 0.1.
12

---

Under review as a conference paper at ICLR 2021
70
Test accuracy
Test accuracy
60
60
0.67
6-0.5
40
1m.1.
2,55
Global round
Global round
(a) FMNIST, data poisoning
(b) FMNIST, model update poisoning
60
60
50
40
1-0.5
40
Teat
20
1+0
20
10
10
200
400
800
800
1000
1200
200
400
600
800
1000
Global round
Global round
(c) CIFAR-10, data poisoning
(d) CIFAR-10, model update poisoning
Figure C.I: Impact of varying hyperparameters under model update poisoning and data poisoning attacks. We set C 0.2, r = 0.2.
C EXPERIMENTAL RESULTS FOR VARYING HYPERPARAMETER,
To observe the impact of hyperparameter setting, we performed additional experiments with various 5 and Es, values, the key hyperparameters of Sself. The results are shown in Fig. C.I with only adversaries. We performed data poisoning attack for varying and model update poisoning attack for varying Erh. It can be seen that our scheme still performs well (better than RFA), even with naively chosen hyperparameters, confirming the advantage of Sself in terms reducing the overhead associated with hyperparameter tuning.
D PERFORMANCE COMPARISON WITH MULTI-KRUM
While compared Sself with RFA in main manuscript. here compare scheme with Multi-Krun (Blanchard et al. 2017) which is a Byzantine- ressileen aggregation method targeting conventional distributed learning setup with IID data across nodes. In Multi-Krumi among N workers the system, the server tolerates f Byzantine workers under the assumption of 2 + 2 < N. After filtering worker nodes based on squared-distances. the server chooses N workers among N remaining workers with the best scores and aggregates them. We set M = N f for comparing our scheme with Multi-Krum.
Fig. compares Sself with Multi-Krum under model update poisoning. We first observe Figs. ((a) and ( which show the results with only adversaries. It be seen that if the number of adversaries exceed f, the performance of Multi-Krum significantly decreases. Compared to Multi- Krum, the proposed Sself method can filter out the poisoned devices and then take the weighted sum of the survived results even when the portion of adversaries is high. Figs. [ and show the results under the existence of both stragglers and adversaries, under model update poisoning attack. The parameter f of Multi-Krum is set to the maximum value satisfying 2f 2 < N, where N depends on the number of received results for both symi-syyccrooous and ignore stragglers approaches. However, when set f to the maximum value, the number of adversaries degrades the performance of Multi Krum combined with semi-synchronour and ignore stragglers approaches. Obviously, Multi-Krun can be combined with the wail for stragglers approach by setting
still exceed f. which
13

---

Under review as a conference paper at ICLR 2021
100
80
Test accuraly
Test acsuracy
Scall Mult-Kumm 1-3
Mult-Krum:
Muli-Kumm
40
Muli-Krum: LA
80
20
100
150
200
400
800
800
1000
1200
Global round
Global round
(a) FMNIST, only adversaries
(b) CIFAR- 10, only adversaries
60
Test accurary
80
accuracy
50
50
40
Ssef
Syndhronous (*-max)
30
ignore straggies Mult Krum (I-max)
Synchronous (Jmmax)
Wait for stzegglers + Multi Krum (f-max)
20
Ignore straggiers Mult-Krum (l-max
Wast for strgggeers Mult-Krum (iwmax)
10
Running time
Running time
(c) FMNIST, both stragglersaaversaaries (d) CIFAR- 10, both stragglers/adversaiies
Figure C.2: Performance comparison with Multi-Krum under model update poisoning. We set C' 0.2 and 0.2.
100
Scel Hulti-Kummi L.1
80
Attack suscess rate
success
Scall
Krum: 1+1
40
20
20
50
150
250
800
1000
1200
1400
1600
1800
2000
round
Global round
(a) PMNIST, only adversaries
(b) CIFAR-10, only adversaries
80
Attack success rate
Seet
Semi Synchronous Mull Krum dwmax)
Attack success
60
Ignore stragglers Mult-Krum (l-mae)
Seelf
Wal straggerr. Mult Krum (I+1)
Sam--8ynchmnous Mulli Korm (l-max)
40
Ignone stnegglars Mult-Krum (lumax)
strapplers Multi Krum
20
100
200
300
1400
1600
1800
Running time
Global round
(c) FMNIST, both stragglor/adverssaiie (d) CIFAR-10 10, both stragglors/advorsaries
Figure C.3: Performance comparison with Multi- Krum under backdoor attack. We set C' = 0.1 and 0.1.
14

---

Under review as a conference paper at ICLR 2021
100
Test sccurey
00
50
50
Partir Public Dasa. 0.00%
Fortion Public tasss
90
Pordon Public nan
Portonn Plbric Dana 0.00%
Portion Public Date 1%
Atlack
60
Parkor Dasa
Duci
Purton of Public Duta:
Porttn of Publlc Datis 0%
20
40
50
BC
100
120
100
150
100
200
300
Global round
Global round
Global round
(a) Data poisoning
(b) Model update poisoning
(c) Backdoor attack
Figure D.I: Impact of portion of public data at the server using FMNIST. We set C. = 0.1, 0.1, 0.1 for the backdoor attack and C' -..2 r 0.2 for the others.
large enough. However, this scheme still suffers from the effect of stragglers, which significantly slows down the overall training process.
Fig. compares Sself with Multi-Krum under scaled backdoor attack. The results consistent with the results in Fig. C.2. confirming the advantage of Sself over Multi- Krumi combined with straggler-mitigating schemes.
E IMPACT OF PUBLIC DATA
In the experiments in our main manuscript, utilized 2% of the training data samples public data to defend against adversarial attacks. In this section, to observe the impact of the portion of public data, performed additional experiments by changing the portion of public data under three attack scenarios in synchronous setup. In the main manuscript, we let 2% of the entire training set to be the public data and the remaining data to be the training data at the devices for a fair comparison with other schemes. Here, the overall training set is utilized at the devices and among them, a certain portion of data are collected the server. Fig. D.I shows the results with various portions of public data on FMNIST. From the results, it can be seen that our Sself protects the system against adversarial attacks with only small amount of public data. But as shown in the plot where the portion of the public data is 0.03%, if the amount of public data becomes smaller than certain threshold, the robustness of Sself does suffer.
F EXPERIMENTS ON COVID-19 DATASET OPEN TO PUBLIC
In this section, we performed additional experiments Kaggle's Covid-19 datase which is open to public. We consider both model update poisoning and data poisoning attacks in a synchronous setup. Image classification is performed to detect Covid-19 using Chest X- X-ray images. The dataset consists of 317 color images of 3480 x 4248 pixels in 3 classes (Normal, Covid and firal-nneumonia) There are 251 training images and 66 test images. We resized the images into 224 x 224 pixels and used convolutional neural network with 6 convolutional layers and fully connected layer. We used 6% of the training data as the public data. We divided the remaining training samples into 10 devices and set C and 0.1.
Fig. shows the results different schemes under data poisoning and model update poisoning attacks on Covid- 19 dataset. As other baseline schemes, our Sself shows robustness against model update poisoning attack. In data poisoning attack, our Sself shows the best performance compared to other schemes. In conclusion, utilizing part of the open medical dataset as public data, show that our Sself could effectively defend against model update and data poisoning attacks.
15

---

Under review as a conference paper at ICLR 2021
Test accuracy
Test accuracy
Soalf
RIFA
Krumm Fede roed averaging
Mutii Krum, let
Federsted
Global round
Global round
203
(a) Data poisoning
(b) Model update poisoning
Figure F.1: Performance of different schemes on medical dataset (Covid-19 image dataset) under data and model update poisoning attacks. We set C' 1, 0.1.
90
100
Test accuracy
Test accuracy
60
50
Ssalf
Somi Synchronous RFA
Semi-S Sommi-Synchroouee RFA
Ianore strapglers RFA
30
lonore stragglers
stragglers RFA
Wal. straglerss RFA
10
Running
Running time
FMNIST, data poisoning
(h) FMNIST, model-update poisoning
Figure G.1:
straggler scenario where each device can have delay of to Data and model-update poisoning attacks are considered with FMNIST. We set C 0.4, r 0.2.
Performance in
G EXPERIMENTS IN A MORE SEVERE STRAGGLER SCENARIO
When modeling stragglers, we gave delay of 0, 1, 2 to each device in the experiments of main manuscript. In this section, each device can have delay of 0 which is again determined indepen- dently and uniformly random. In Fig. G.I we show the results with both stragglers and adversaries under data and model-update poisoning on FMNIST dataset. We set C' to 0.4 and 0.2. It can be seen that our Sself still shows the best performance under both data poisoning and model-update poisoning compared other baseline schemes.
H EXPERIMENTS WITH VARYING PORTION OF ADVERSARIES
In this section, we show the performance of Sself with varying portion of adversaries under data and model poisoning attacks. We do not consider stragglers here. We set to and Eu, to as in experiments of the main manuscript. Fig. H.T shows the results with different attack ratio on FMNIST dataset. For data poisoning, our Sself shows robustness against up to 0.4 of the attack ratio, but with 0.5 or higher, performance is degraded. For model update poisoning, can be seen that our Sself performs well even with higher attack ratio.
I PROOF OF THEOREM 1
I.1 ADDITIONAL NOTATIONS FOR PROOF
After receiving the results at global round t, the server first performs entropy-based filtering and obtain (7!0) (1)) U(()) Let w?( be the model of the k-th benign device after local updates
16

---

Under review as a conference paper at ICLR 2021
80
80
accuracy
Test accuracy
80
Attack ra
40
Attodk rato0115..3
Altbok 12000110 2
40
Attack ratoor012.4
Atteck calior/11.
Aftbok 1oto0/11
AftOOt 139007100
20
50
100
150
50
100
150
Global round
round
(a) FMNIST, Data poisoning
(b) FMNIST, Model update poisoning
Figure H.1: Performance with varying portion of adversaries. Data and mpdel-update poisoning
attacks are considered with FMNIST. We set =
starting from global round At global round t, each device receives the current global model w, and round index & from the server, and sets its initial model to w,, i.e. wº(k) <- for all k: = .,,.,, . Then each k-th benign device performs E local updates of stochastic gradient descent (SGD) with learning rate rp.
w (k) (k) - (
for j -,,...,
where 5/ (A)) is a set of data samples that are randomly selected from the k-th device during the j-th local update at global round t. After E local updates, the k-th benign device transmits (k) (k) to the server. However, in each round, the adversarial devices transmit poisoned model parameters.
Using these notations, the parameters defined in Section 2 can be rewritten as follows:
Σ kEU!
(k()) where 3,(k) (
my
and Σ B((k)
=1 (9)
kEU
Exerfo my
2r+1
Σ (1(iv (1) where ax(1) x
(t 1 and Σ (1) =
(10)
2=0
1=0
W++1 = (1-1()1))))) 7 + 72++1
(11)
I.2
KEY LEMMA
We introduce the following key lemma for proving Theorem Our proof is largely based on the convergence proof of FedAsyne in (Xie et al. 2019a).
hold and the learning rate nj is set be less than }. Consider the k-th benign device that received the current global model we from the server global round t. After E local updates, the following holds:
Lemma Suppose Assumptions
F[w*)]+ Epin
[[F(W,((K) F(w"))[((()) < (1- mn)
F[F(W((K) (
(12)
Proof of Lemma First, consider one step of SGD in the k-th local device. For a given w! - (Ik), for all global round 7 and for all local updates j E (1,..., F.). have
17

---

Under review as a conference paper at ICLR 2021
B[F(W[ - F("))
$ F(w? (1:) - F( F(w") - -e (A)) TFF (K)) ( (R:) w/ 1 (A:)
+ Lnp E||l VF (6))
(x))
SGD update and L-smoothness
$ F(w! ((w!-((k)) (k)) F(w)) 7 B1| VF( -()) (w) (()))))
-" "IVF(W? (x))11
1
7 L
< +ww) F(w") 7 (II 7P1
Assumption 2
2
< (1 - (FW (k)) FF(w"] 7/1
j--strongly convexity
2
(13)
Applying above result to E local updates in k-th local device, we have
E [[F(w((k)) - F(w")lw?(())
= W (K)) + (x)) [K(]
Law of total expectation
(1 <11-1))B[F(() - F[W))]][ + nP1
Inequality (3)
E
(1-m))) (IF((((()())) F[w")]
111
(1 1115511
2
j=1
= (1 - m4m (w) F(w"))
17P1
(1 - -
From <
L < - nu < 1
2
1711
Emp1
< (1 - (ati (F F(w")]
From my 1, 1- (1 (1 < Enp
I.3 PROOF THEOREM
Now utilizing Lemma] I we provide the proof for Theorem First, consider one round of global aggregation at the server. For given W,-1, the server updates the global model according equation
18

---

Under review as a conference paper at ICLR 2021
Then for all e I,..., T, we have
([:( - F(w")[(w=-))
(a)
5 (1 -1 -
(b)
$ (1 --)] - F(ww)) +7
(1) F(w")[w--1)
(
$ (1 (1-))[F(w()) - F(w")]
(1)
Σ ((())(F((((()) - ((w")/wc=-
kEU
(1 - ()) - F(w")]++ +
(10 Σ -
2
REB
Σ
(()()) F(w")) (W--l
REM
(d)
- (P((w-)) F(w")]+ ETPLY
$ (1 7 7- 70. 70. - 1)(1
1-2
+ 7(1 - mpp) E
a1-1 (i) Σ
B((K) (F()((())))) F(w")]
KE 1
7
04-
Σ
(() ((w"))w:-1
1 11-7+700-10 1)(1 12 - m1) (F(w--)) - F(w")] + Pomar
- 1
a1
Σ
(.(K) (F(?((()))) - F(w*)]+ Enpo
1=0
REB
2 (1 7 7a0- - 1)(1 -1
)) - F(ww)] + Mmmm
1-2
1 [VF(()(())1
Enp1Y
+ +1(1 )np)
a1-1 (i) Σ
(kk))
24
2
kBB
(
8 (1-7+ 70 1)(1 - 11 - 1F - F(w*)] + 712mmz
Enpry + 7(1 - aa- - 11)((1npp)))
- =
2
24
(b)
< (1 7 1t - 1)(1 - 12 - m/11) [F( F(("")
7(pp1 + (1-aa-1(t - 1)) + 2
(14)
where (a), (b). (c) come from convexity, (d) follows Lemma I
(e) comes from
Omar 0 0sist,0stST
max 2 (
and the Assumption
(f) is due to j--strongly convexity, (g) is
from Assumption and (h) comes from np < 1. Note that Ei=1 a = for all t.
19

---

Under review as a conference paper at ICLR 2021
Applying the above result to T global aggregations in the server, we have
B[F(wr) - F(w") [wo]
[[[F(wT)) - Fwwp)//wwwll>>>> wol
(6)
M E [11 - + yar-1 - 1)(1 - (F((-))))) - F(w")][wo)
-
+ [Bpp + (1 - -a--1(t 1))p2 + (
2/1
T-1
(1 + ya, (1) nw) ()) - F(w")] + HEpp + (1 (1- 11----1 1))p2 + 2p50max)
24
7(Ep + - -T-- T) p))p2 + 222mar I'
(1 7 7aT - k) (1 - m1)
2p
k=1
(4)
2 (1 + -1 - [F(=)]((+
-1- 1
Epi + P2 + 2up2mmrr
2/1(1 - -(1 - m)(1) E)
- (1 ( + (1 - n1/) -) - F(w")] + 1 -1-7 - (11 177 P1 + P2 + 2
2mp²
= =>"(F(wo) - (1 (1=
which completes the proof. Here, (a) comes from the Law of total expectation, (b), (c) are due to inequality (14.. And (d) comes from S ai)()) S and 0 < Ω < 1 for all i, L. In addition, (e) is from yp S and E positive integer.
20


Reviews:
[{"review_id": "qVe2XIFAMJR", "reviewer": "AnonReviewer3", "summary": "", "questions": "", "limitations": "", "rating": 4, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "Review: This paper proposes Sself to achieve robustness against adversary when there are straggler.\nThey uses semi-synchronous scheme to handle the straggler. In each round, the server use entropy based filtering to filter models with large entropy. Then the models are aggregated based on their weights and staleness. The main contribution of this paper is to propose an asynchronous training scheme in the presence of Byzantine workers.\n\n=======================================================\n\nPros:\n\n- Using semi-synchronous scheme to handle straggler is interesting.\n\n- The entropy based filtering and loss based averaging looks interesting.\n\n- The`experiments presented in the paper look good.\n\n=======================================================\n\nCons:\n\n- The computation cost in each round grows linearly with time.\n- Unfair baselines:\n  - The comparison with [1] is unfair because they don't assume the server to have training data. Instead, Sself should be compared with Zeno++[2] which has similar setting;\n  - `Waiting for straggler` is not a good baseline. To handle the straggler, [3] suggest the server can simply send requests to 30 percent more workers for updates and wait for the fastest replies.\n- Assuming public and IID data on the server is a very strong assumption. The data collection schemes do not consider the existence of Byzantine worker.\n- It is not clear to me how this method can defend backdoor attack. In [4], they mentioned that the goal is to achieve high accuracy on main task and an attacker-chosen subtask. So it should behave good on the main task, especially comparing to the models trained on non-i.i.d. good workers. Is it possible to improve the backdoor attack such that it can deceive Sself?\n\n- It is not very convincing to me that the filtering threshold is easy to select. The entropy of the models decrease over time, does the threshold change as well? Is the threshold a prior knowledge or learned from data?\n\n- What are the numbers of adversaries can be tolerated by this method?\n\n=======================================================\n\nMinor comments:\n\n- The curves are a bit bumpy.\n\n\n[1] Pillutla, Krishna, Sham M. Kakade, and Zaid Harchaoui. \"Robust aggregation for federated learning.\" arXiv preprint arXiv:1912.13445 (2019).\n\n[2] Xie, Cong, Sanmi Koyejo, and Indranil Gupta. \"Zeno++: Robust Fully Asynchronous SGD.\" arXiv preprint arXiv:1903.07020 (2019).\n\n[3] Bonawitz, Keith, et al. \"Towards federated learning at scale: System design.\" arXiv preprint arXiv:1902.01046 (2019).\n\n[4] Bagdasaryan, Eugene, et al. \"How to backdoor federated learning.\" International Conference on Artificial Intelligence and Statistics. PMLR, 2020.\n\n", "extra_scores": {}, "extra_text": {}}, {"review_id": "IhnXSmixIlh", "reviewer": "AnonReviewer1", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "**Paper summary**\n\nThe paper claims to propose the first algorithm that can handle adversarial machines and stragglers simultaneously in the federated learning setting. To handle stragglers, the paper takes a semi-synchronous approach by taking a weighted sum of gradients depending on staleness. To handle adversarial machines, the algorithm uses an entropy based filtering and a loss based averaging strategy. Note that to handle the adversaries, the algorithm needs a public dataset at the server, using which it can evaluate the entropy and loss scores of each gradient.\n\n**Strengths**\n1. The problem of handling stragglers and adversarial machines (including data poisoning adversaries) seems a very relevant problem. The paper claims to be the first to solve this (however I think Xie et al.(2019) also solve a similar problem). \n2. The handling of stragglers seems to be theoretically backed (although I have some concerns about the handling of adversarial machines) and Theorem 1 shows that the convergence up to some error is fast.\n3. The experiments show that the algorithm beats or matches existing algorithms on MNIST, CIFAR10 etc.  \n\n\n**Concerns**\n1. In the proof of Theorem 1, I could not find the analysis of the Entropy filtering step of the algorithm. \n2. I think Lemma 1 is only applicable on the non-adversarial machines. In the proof of Theorem 1, inequality (d) (on page 18) applies Lemma 1 on all the machines including the adversarial ones. \n\nFor these reasons, I think Theorem 1 does not give correct guarantees for the algorithm.\n\n**Score justification**\n\nAs mentioned in the Concerns section, I am not sure if the theoretical guarantees for the algorithm are correct.\n\n**References**\n\nXie, C., Koyejo, O. and Gupta, I., 2019. Zeno++: Robust Fully Asynchronous SGD.\n", "extra_scores": {}, "extra_text": {}}, {"review_id": "Cukvmjczi5", "reviewer": "AnonReviewer4", "summary": "", "questions": "", "limitations": "", "rating": 4, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "This paper considers federated learning with straggling and adversarial devices. To tackle stragglers, the paper proposes semi-synchronous averaging wherein models with the same staleness are first averaged together, and then a weighted average of the results with different stateless is computed. To mitigate adversaries, the paper proposes to first perform entropy-based filtering to remove suspected outliers, and then compute loss-weighted average. The server is assumed to have some public data, which is used for entropy-based filtering. Together, the proposed algorithm is called semi-synchronous entropy and loss based filtering (Sself). \n\nStrong points:\n\n1. Mitigating adversarial attacks, especially model poisoning and backdoor attacks, is an important challenge in federated learning. \n\n2. The proposed algorithm is simple. The paper is well-written, and easy to follow. \n\nWeak points:\n\n1. Theorem 1 does not seem to consider adversarial devices, and the proof seems to only the semi-synchronous part of Sself without entropy-based filtering and loss-weighted average. Intuitively, the convergence performance should degrade with the number of adversarial devices. However, the theorem statement does not seem to indicate so. If the theorem only analyzes the semi-synchronous part of Sself, then this should be explicitly mentioned. The theorem in its current form is a bit misleading.\n\nFurther, even when there are no adversaries, what is the theoretical improvement over FedAsync? Specifically, what is the impact of staleness on convergence. It is important to add remarks to elaborate the gains qualitatively. \n\n2. Experiments are performed for the simplistic case when each device has a delay of 0, 1, or 2 rounds (chosen uniformly at random and independently for each device). Further, experiments (in the main body of the paper and supplementary material) are for a limited number of adversarial attacks. The performance can be evaluated for practically motivated straggler models and more powerful known attacks. For instance, the attack from the following paper:\n\nG. Baruch, M. Baruch, Y. Goldberg, “A Little Is Enough: Circumventing Defenses For Distributed Learning”, NeurIPS 2019.\n\nWhile proposing entropy-based filtering, the authors hypothesize that “if the local model is poisoned, e.g., by reverse sign attack, the model is more likely to predict randomly for all classes and thus has a high entropy”. However, some attacks such as targeted backdoor attacks typically do not hurt overall accuracy. So, it is not clear why the poisoned model is likely to predict randomly for all classes. It will be helpful to add more evidence. \n\n3. Evaluating the loss on the public data for each device may incur significant computational complexity. It is important to elaborate on how much the complexity at the server will increase by using entropy-based filtering on public data. \n\nOther suggestions:\n\n1. Fig. 2, should the x-axis label be round number than running time?\n\n2. In experiments, can you quantify the performance gain of Sself over FedAsync? For instance, in Fig. 2, FedAsnc seems to be almost on par with Sself. It will be helpful to quantify the performance improvement. \n\n3. Zeno proposed in the following paper also uses public data at the server. If possible, it will be good to compare against Zeno for fairness. \n\nCong Xie, Sanmi Koyejo, Indranil Gupta, “Zeno: Distributed Stochastic Gradient Descent with Suspicion-based Fault-tolerance”, ICML 2019.\n\nIn summary, the theoretical result (Theorem 1) is weak as it does not seem to consider adversarial devices. In experiments, the stragglers are simulated in a simplistic manner, and the gains over FedAsync are not quantified. It will be good to consider the weak points and suggestions to improve the paper. Currently, the novelty seems to be fairly limited. \n\n-------------- Post-Rebuttal Comments -----------------\nThanks to the authors for their response, and for updating the manuscript. Some of my queries were clarified. However, updated Theorem 1 seems to raise more questions. In particular, Assumption 4 looks very restrictive to me. If adversaries manage to produce large values of \\Gamma, they can inflict a large error as per (7). The paragraph after Theorem 1 does not mention how entropy and loss based filtering methods can achieve small \\Omega_{max}, but only says that \"if the entropy-based filtering method successfully filters out the model poisoned devices, and the loss-weights \\beta_i(k) of the adversaries are significantly small for data poisoning and backdoor attacks... ... then we have a small error term\". It is not clear what guarantees the filtering schemes yield. Due to these reasons, I still think the paper is not yet ready for publication.", "extra_scores": {}, "extra_text": {}}, {"review_id": "Cr0YTA_vAA", "reviewer": "AnonReviewer2", "summary": "", "questions": "", "limitations": "", "rating": 4, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "Summary:\nThe paper studies the problem of asynchronous training  with robustness to adversaries in federated learning. The authors propose an idea based on entropy based filtering to simultaneously filter out adversaries, and a weighted averaging technique to handle staleness in the gradients.\n\nPros:\n-->I like the idea of using stale gradients that arrive past their due date in a delayed manner with appropriate weight.\n--> The idea of using a public data set, and metrics from that data set to aide filtering out adversaries is interesting, and possibly worthy of pursuit.\n\nCons/Concerns:\n--> The paper's analysis assumes that the entropy based filtering technique automatically filters out gradients from adversaries. In fact, this seems to play no role in the the analysis in Theorem 1 (Appendix G.1). In fact, this theorem proof seems to be identical to a proof that would exist if there were no adversaries (unless I missed something).\n\n--> I find Theorem 1's result a bit confusing. As per the paper, they seem to be allowing an arbitrary number of stragglers (and arbitrary degree of straggling). For instance, for some value of t, it is possible that $S_t = U_\\infty^{t},$ which means that none of the nodes selected in time $t$ ever send their updates. The theorem's assumptions do not seem to preclude this, but somehow, the result is blind to such straggling. Put differently, we expect that the performance must closely depend on the degree of asynchrony. However, this is not sufficiently captured in the statement of Theorem 2.\n\n--> Overall, I find that the novelty is relatively limited, and the ideas seem to be a simple combination of those that have appeared in Zhao et. al 2018, and Xie et. al 2019 \n", "extra_scores": {}, "extra_text": {}}]

Author rebuttal:

Meta-review: This paper proposes a combined method to address stragglers and adversaries in federated learning. Stragglers are overcome by allowing staleness in model aggregation. Adversaries are handled by using a public dataset to identify poisoned devices and adjusting their weights when doing model aggregation. However, the reviewers raised concerns about:
* The correctness of Theorem 1
* The novelty of the paper given that there has been significant previous work on straggler mitigation and robust aggregation in distributed learning. 

As a result, I am unable to recommend the acceptance of the paper. However, the idea is certainly promising, and if built upon more rigorously can result in a nice and impactful paper. I hope that the authors can take the reviewers' feedback into account when revising the paper for a future submission!
Decision: Reject