Secure Byzantine-Robust Machine Learning
Authors: Lie He
Sai Praneeth Karimireddy
Martin Jaggi
Venue:  (2021)
Keywords: Byzantine robustness
distributed learning
secure aggregation

Abstract: Increasingly machine learning systems are being deployed to edge servers and devices (e.g. mobile phones) and trained in a collaborative manner. Such distributed/federated/decentralized training raises a number of concerns about the robustness, privacy, and security of the procedure. While extensive work has been done in tackling with robustness, privacy, or security individually, their combination has rarely been studied. In this paper, we propose a secure multi-server protocol that offers both input privacy and Byzantine-robustness. In addition, this protocol is communication-efficient, fault-tolerant, and enjoys local differential privacy.

Under review as a conference paper at ICLR 2021
SECURE BYZANTINE-ROBUS MACHINE LEARNING
Anonymous authors
Paper under double-blind review
ABSTRACT
Increasingly machine learning systems are being deployed to edge servers and devices (c.g. mobile phones) and trained in collaborative manner. Such dis- cibbtee//cceente/ddeeentiiiis training raises a number of concerns about the robustness, privacy, and security of the procedure. While extensive work has been done in tackling with robustness, privacy, or security individually, their combina- tion has rarely been studied. In this paper, we propose secure two-server protocol that offers both input privacy and Byzantine-robusttes is communication-effiee efffciien,,, fault-tolerant and enjoys local differential privacy.
In addition, this protocol
INTRODUCTION
Recent years have witnessed fast growth of successful machine learning applications based on data collected from decentralized user devices. Unfortunately, however, currently most of the important machine learning models on societal level do not have their utility, control, and privacy aligned with the data ownership of the participants. This issue can be partially attributed to fundamental conflict between the two leading paradigms of traditional centralized training of models on one hand, and training schemes the other hand. While centralized training violates the privacy rights of participating users, existing alternative training schemes are typically not robust. Malicious participants can sabotage the training system by feeding it wrong data intentionally, known as data poisoning. In this paper, we tackle this problem and propose novel distributed training framework which offers both privacy and robustness.
deceetralized/collaboratt
When applied to datasets containing personal data, the use of currently required under regulations such as the General Data Protection Regulation (GDPR) or Health Insurance Portability and Accountability Act (HIPAA). The idea of training models on decentralized datasets and incrementally aggregating model updates via central server motivates the federated learning paradigm (McMahan et al., (206)). However, the averaging in federated learning, when viewed as multi-party computation (MPC), does not preserve the input privacy because the server observes the models directly. The input privacy requires each party learns nothing more than the output of computation which in this paradigm means the aggregated model updates. To solve this problem, secure aggregation rules as proposed in (Bonawitz et al. (017) achieve guaranteed input privacy. Such secure aggregation rules have found wider industry adoption recently e.g. by Google on Android phones (Bonawitz al. 2019: Ramage & Mazzocchi] 2020) where input privacy guarantees can offer c.g. efficiency and exactness benefits compared to differential privacy (both can also be combined).
techniques is
The concept of Byzantine robustness has received considerable attention in the past few years for practical applications, way to make the training process robust malicious actors. Byzantine participant or worker can behave arbitrarily malicious, e.g. sending arbitrary updates to the server. This poses great challenge to the most widely used aggregation rules, e.g. simple average, since a single Byzantine worker can compromise the results of aggregation. A number of Byzantine-robust aggregation rules have been proposed recently (Blanchard et al.) 2017 Muñoz-Gonzálee et al.) 2017]]
Alistarh al.) 2018 Mhamdi et al.) 2018 Yin et al. [018]] Muñoz-Gonzále et al. 2019) and can be used as a building block for our proposed technique.
Achieving both input privacy and Byzantine robustness however remained elusive so far, with Bagdasaryan et al. (2020) stating that robust rules "...are incompatible with secure aggregation". We here prove that this is not the case. Closest to our approach is (Pillutla et al. (219)) which tolerates (Corrigan-Gibbs Gibbs & Bonch (017)) is a
data poisoning but does not offer Byzantine robustness. Prio (Corrigan
private and robust aggregation system relying on secret-shared non-interactive proofs (SNIP). While

---

Under review as a conference paper at ICLR 2021
their setting is similar to ours, the robustness they offer is limited to check the range of the input. Besides, the encoding for SNIP has to be afine-aggregable and is expensive for clients to compute.
In this paper, propose secure aggregation framework with the help of two non-colluding honest- but-curious servers. This framework also tolerates server-worker collusion. In addition, we combine robustness and privacy at the cost of leaking only worker similarity information which is marginal for high-dimensional neural networks. Note that our focus is not to develop new defenses against state-of-the-art attacks, e-g. (Baruch et al. 2019 Xie al. 2019b). Instead, we focus on making arbitary current and future distance-based robust aggregation rules (e.g. Krum by Mhamdi et al. (2018). RFA by Pillutla al. (2019)) compatible with secure aggregation.
Main contributions.
We propose novel distributed training framework which is privevy-reserrvng: our method keeps the input data of each user secure against any other user, and against honest-but-curious servers.
Byzantine robust: our method offers Byzantine robustness and allows to incorporate existing robust aggregation rules, e.g. (Blanchard et al. 2017 [Alistarh et al. 2018). The results are exact, i.e. identical to the non-private robust methods.
Fault tolerant and easy to use: our method natively supports workers dropping out or
newly joining the training process. It is also easy to implement and to understand for users. Efficient and scalable: the computation and communication overhead of our method is negligible (less than a factor of 2) compared to non-private methods. Scalability in terms of cost including setup and communication is linear in the number of workers.
PROBLEM SETUP, PRIVACY, AND ROBUSTNESS
We consider the distributed setup of n user devices, which we call workers, with the help of two additional servers. Each worker i has its own private part of the training dataset. The workers want to collaboratively train a public model benefitting from the joint training data of all participants.
In every training step, each worker computes its own private model update (e.g. a gradient based on its own data) denoted by the vector æc, The aggregation protocol aims compute the sum > 2; (or a robust version of this aggregation), which is then used to update public model. While the result& public in all cases, the protocol must keep each x; private from any adversary or other workers.
Security model. We consider canest-but-curious servers which do not collude with each other but may collude with malicious workers. An conest-but-curionn server follows the protocol but may try inspect all messages. We also assume that all communication channels are secure. We guarantee the strong notion of inpul privacy, which means the servers and workers know nothing more about each other than what can be inferred from the public output of the aggregation z.
Byzantine robustness model. We allow the standard Byzantine worker model which assumes that workers can send arbitrary adversarial messages trying to compromise the process. We assume that a fraction of up to (< 0.5) of the workers is Byzantine, i.c. are malicious and not follow the protocol.
Additive secret sharing. Secret sharing is a way to split any secret into multiple parts such that no part leaks the secret. Formally, suppose scalar is secret and the secret holder shares it with k parties through secret-shared values (a). In this paper, we only consider additive secret-sharing where (a) is notation for the set {at [ai)_n which satisfy a -pm1 Sp. with ap held by party p. Crucially. it must not be possible to reconstruct a from any ap. For vectors like æ. their secret-shared values (x) are simply component
scalar secret-shared values.
Two-server setting, We assume there are two non-colluding servers: model server (SI) and worker server (S2). S1 holds the output of each aggregation and thus also the machine learning model which is public to all workers. S2 holds intermediate values to perform Byzantine aggregation. Another key assumption is that the servers have no incentive to collude with workers, perhaps enforced via a potential huge penalty if exposed. It is realistic to assume that the communication link between the two servers S1 and S2 is faster than the individual links to the workers. To perform robust aggregation, the servers will need access sufficient number of Beaver's 's triples. These are data-independent values required to implement secure multiplication in MPC on both servers, and can be precomputed beforehand. For completeness, the classic algorithm for multiplication is given in in Appendix B.
2

---

Under review as a conference paper at ICLR 2021
(a) horkerSecretShar- (b) RobustWeightSell (c) AggregationAndUp (d) WorkerPullModel.
ing: each worker i
tion: Compute and re-
date: Compute and re- Each worker i pulls
secret-shares its update
veal [| (e44-r) )
veal aggregation z
model from S1.
m, locally and uploads
S2 and select robust
E piz; on S1. S1 up-
them to S1 and S2 separately.
of indices represented by
dates the public model.
p == x by calling the
Byzantine-robust oracle.
Figure I: Illustration Algorithm 2 The orange components on servers represent the computation- intensive operations at low communication cost between servers.
Byzantine-robush aggregation oracles. Most of existing robust aggregation algorithms rely on distance measures to identity potential adversarial behavior (Blanchard et al. 2017 Yin et al. (0118) Mhamdi et al. 2018 Li et al. 2019 Ghosh et al. 2019). All such bistance-based aggregation rules can be directly incorporated into proposed scheme, making them secure. While many aforementioned papers assume that the workers have i.i.d datasets, our protocol is oblivious to the distribution of the data
the workers. In particular, our protocol also works with schemes such as (Li et al. 2019 Ghosh et al., 2019 He et al. 2020) designed for non-iid data.
SECURE AGGREGATION PROTOCOL: TWO-SERVER MODEL
Each worker first splits its private vector æ; into two additive secret shares, and transmits those to each corresponding server, ensuring that neither server reconstruct the original vector its own. The two servers then execute our secure aggregation protocol. On the level of servers, the protocol is two-party computation (2PC). In the case of non-robust aggregation, servers simply add all shares (we present this case in detail in Algorithm Ty. In the robust case which is of our main interest here, the two servers exactly emulate an existing Byzantine robust aggregation rule, at the cost of revealing only distances of worker gradients the server (the robust algorithm is presented in Algorithm 2 Finally, the resulting aggregated output vector sent back all workers and applied as the update to the public machine learning model.
3.1 NON-ROBUST SECURE AGGREGATION
In each round, Algorithm consists of two stages:
WorkerSecretSharing (Figure Iak: each worker randomly splits its private input æ; into (1)
additive secret shares æ; xr; + +x(?)) This be done e.g. by sampling large
noise value & and then using (æ: + 6:)/2 as the shares. Worker sends x;" to S1 and az S2. We write (z;) for the two secret-shared values distributed over the two servers. AggregationAndUUper
(Figure Ic): Given binary weights {p: J each server locally computes (Σ ). Then S2 sends its share <E p, (2) to S1 so that S1 can then compute Σラ P;C., S1 updates the public model with z.
Our secure aggregation protocol extremely simple, and as we will discuss later, has very low communication overhead, does not require heavy cryptographic primitives, gives strong input privacy and is compatible with differential privacy, and is robust to worker dropouts and failures. We believe this makes our protocol especially attractive for federated learning applications.
We now argue about correctness and privacy. is clear that the output the above protocol satisfies = p;t;; ensuring that all workers compute the right update. Now argue about the privacy guarantees. We track the values stored by each of the servers and workers:
S1:
Its own secret shares {a! 1))
n and the sum of the other shares (E Pra,) (2).
$2:
Its own secret shares {2 1==1-
Worker à: æ; and Σ P. P
3

---

Under review as a conference paper at ICLR 2021
Clearly, the workers have information other than the aggregate and their own data. S2 only has the secret share which on their own leak no information about any data. Hence surprisingly. S2 does not learn anything in this process. S1 has its own secret share and also the sum of the other shares. If n = 1, then z = æ; and hence S1 is allowed to learn everything. If n > 1, then S1 cannot recover information about any individual secret share x? (2) from the sum. Thus, S1 learns and nothing else.
3.2 ROBUST SECURE AGGREGATION
We now describe how Algorithm| 2 replaces the simple aggregation with any distance-based robust aggregation rule Aggr, c.g. Krum (Blanchard et al. (017). The key idea is to use two-party MPC to securely compute multiplication.
WorkerSccret (Figure Ial: As before, each worker i secret shares (æx)) distributed over the two servers S1 and S2. Robust
(Figure lb]: After collecting all secret-shared values {<x)) Js+ the servers compute pairwise difference {(ar, x.y) jizj locally. S2 then reveals to itself exclusively-in plain text all of the pairwise Fuclidean distances between workers {||z,, )ic with the help of precomputed Beaver's triples and Algorithm 3 The distances are kept private from S1 and workers. S2 then feeds these distances to the bassence-based robust aggregation rule Aggr, returning (on S2) a binary weight vector p {- {0,1}". representing the indices of the robust subset selected by Aggr.
AigregattioAnndpdatl (Figure Ich: Given weight vector p from previous step, we would like S1 to compute Σ p, To do so, S2 secret shares with S1 the values of { ((xx) instead of sending in plain-text since they may be private. Then, S1 reveals to itself, but not to S2, in plain text the value of Σ P.d; using secret-shared multiplication and updates the public model.
WorkerPullModde (Figure ld): Workers pull the latest public model on S1 and update it locally.
The key difference between the robust and the non-robust aggregation scheme is the weight selection phase where S2 computes all pairwise distances and uses this to run robust-aggregation rule in a black-box manner. S2 computes these distances i) without leaking any information to S1, and ii) without itself learning anything other than the pair-wise distances (and in particular none of the actual values of ax)) To perform such computation, S1 and S2 use precomputed Beaver's triplets (Algorithm in the Appendix), which can be made available in scalable way (Smart & Taagguy 2019).
3.3 SALIENT FEATURES
Overall, our protocols are very resource-light and straightforward from the perspective of the workers. Further, since we use Byzantine-robust aggregation, our protocols are provably fault-tolerant even if a large fraction of workers misbehave. This further lowers the requirements of worker. We eleborate the features as follows.
Communication overhead. In applications, individual uplink speed from worker and servers is typically the main bottleneck, as it is typically much slower than downlink, and the bandwidth between servers can be very large. For our protocols, the time spent on the uplink is within factor of 2 of the non-secure variants. Besides, our protocol only requires one round of communication, which is an advantage over interactive proofs.
Fault tolerance. The workers in Algorithm and Algorithm 2 are completely stateless across multiple rounds and there no offline phase required. This means that workers can start participating in the protocols simply by pulling the latest public model. Further, some workers drop out in the middle a round. Unlike in (Bonawitz et al. 2017), there is no entanglement between workers and we don't have unbounded recovery issues.
protocols are unaffected
Compatibility with local differential privacy. One byproduct of our protocol can be used to convert differentially private mechanisms, such as (Abadi et al. (016) which only guarantees the privacy of the aggregated model, into the stronger locally differentially private mechanisms which guarantee leeel privacy.
4

---

Under review as a conference paper at ICLR 2021
Algorithm 1 Two-Server Secure Aggregation (Non-robust variant)
Setup: workers (non-Byzain moon-Byzantine) with private vectors Zi. Two non-colluding servers S1 and S2. Workers:
(WorkerSeeretthaaiing)
2 1. split private 2; into additive secret shares (xx)) = {xx²", a. (such that Φ; = -x; +x,
send a; (1) S1 and ( to S2
Servers:
V i. S1 collects (² and S2 collects xr(3)
2. (AggregationAAndlddateee
(a) On S1 and S2, compute (-i=1 ai) locally
(b) S2 sends its share of (2i=1 σ;) to S1
(c) S1 reveals
Di=1 2, everyone
Algorithm 2 Two-Server Secure Robust Aggregation (Distance Baseed)
Sctup: n workers, an of which are Byzantine. Two non-colluding servers S1 and S2. Workers: (WorkerSSeretShaainng)
split private æ; into additive secret shares (at) = { [ ...²)) (such that æ; = (11) +2, (2))
(2) 2. send x; (1) S1 and x; to S2
Servers:
V i, S1 collects gradient a and S2 collects !!?"
2.
(a) For each pair (æ,, x,) compute their Euclidean distance (i < j):
On S1 and S2, compute (x, x,) = (ax) {x, locally
Use precomputed Beaver's triples (see Algorithm 3 to compute the distance ||æ: 2251²
(b) S2 perform robust aggregation rule Aggr( (1< 22,133is3)
(c) S2 secret-shares (p) with S1
3. (AggregaiionAndllpaat))
(a) On S1 and S2, use MPC multiplication to compute (E pra;) locally
(b) S2 sends its share of (E/-, p,a;) to S1
(c) S1 reveals z == E P.z, to all workers.
Workers:
(WorkerrullModde); Collect and update model locally
Other Byzantine-robust oracles. We can also use some robust-aggregation rules which are not based on pair-wise distances such as Byzantine SGD (Alistarh et al. 20088). Since the basic structures are very similar to Algorithm|] [ we put Algorithm in the appendix.
Security. The security of Algorithm is straightforward
previously discussed. The security of Algorithm 2 agaii relies on the separation of information between S1 and S2 with neither the workers nor S1 learning anything other than the aggregate z. We will next formally prove that this is true even in the presence of malicious workers.
Remark 1. Our proposed scheme leverages classic 2-party secret-sharing for addition and multi- plication. These building blocks however originally proposed for integers and quantized values, not real values. For floating point operations as used in machine learning, one can use the secure counterparts (Aliasgari et al. 2013) of the two operations. This is facilitated by deep learning training being robust to limited precision training Guupta et al. 2013) and additional noise (Nee) lakantan et al.) 2016), with current models routinely trained in 16 bit precision.
contrast to Bonawitz et al. 2017) which relies advanced cryplographic primitives such DiffieHHellman key agreement which must remain exact and discrete, our protocols only use much simpler secure arithmetic operations only addition and mulliplication-wiiee are tolerant to rounding errors. For the privacy implications of secret sharing when using floating point, which go beyond the scope of our work, refer the reader the information theoretic analysis of Aliasgari et al. (203)).
5

---

Under review as a conference paper at ICLR 2021
4 THEORETICAL GUARANTEES
4.1 EXACTNESS
In the following lemma we show that Algorithm 2 gives the exact same result as non con-privacy- preserving version.
Lemma (Exactness of Algorithm 2.
The resulting z in Algorithm i identical to the output of the non wetn--rvvaa-eeeeeeeeee version of the used robust aggregation rule.
Proof. After secret-sharing to (x:) to two servers, Algorithm 2 performs local differences (< 2,) Using shared-values multiplication via Beaver's triple, S2 obtains the list of true Euclidean distances {[|ær, æ; 1| Jiej. The result is fed distance-based robust aggregation rule oracle, all solely on S2. Therefore, the resulting indices {prky as used in 2 = D 1P,0; are identical to the aggregation of con--rivacy-preeeeee
robust aggregation.
With the exactness of the protocol established, we next focus on the privacy guarantee.
4.2 PRIVACY
We prove probabilistic (information-theore) notion of privacy which gives the strongest guarantee possible. Formally, we will show that the distribution of the secret does not change even after being conditioned on all observations made by all participants, i.c. each worker i, S1 and S2. This implies that the observations carry absolutely no information about the secret. Our results rely on the existence of simple additive secret-sharing protocols as discussed in the Appendix.
Each worker only receives the final aggregated z at the end of the protocol and is not involved in any other manner. Hence no information can be leaked them. We will now examine S1. The proofs below rely on Beaver's 's triples which we summarize in the following lemma.
Lemma 3 (Beaver's triples). Suppose we secret share (x) and (y) between S1 and S2 and want to compule xy on S2. There exists a protocol which enables such compulation which uses precomputed shares BV = ((a), (l), (c)) such that SI does not learn anything and S2 only learns xy.
Due to the page limit, we put the details about Beaver's triples, multiplying secret shares, as well as the proofs for the next two theorems to the Appendix.
Theorem (Privacy for S1). Let z = Ei= p:a;; where {p:) is the output of byzantine oracle or vector of Is (non-private). Let BV₂j (ai bij, and BV (a,; ,,, be the Beaver's triple used in the multiplications. Let (-)0) be the share of the secret-shared values (-) on S1. Then for all workers i
P(.; Iz (())) (p.)
(p)) ME. (BV - Dx aij. Dc F. biglich:
(<1 - æz 11) (BVD)) (1) ,P:
a. ap.-a..p. b, P(æ: = sr(2))
Note that the conditioned values are what SI observes throughou the algorithm. ( (BV! Dz azj, a. 2; - hig and (BVr, P; .P: a,, b are intermediate values during shared values multiplication.
(1)
For S2, the theorem to prove is bit different because in this case S2 doesn't 't know the output of aggregation z. In fact, this is more similar to an independent system which knows little about the underlying tasks, model weights, etc. We show that while S2 has observed many intermediate values, it can only learn no more than what can be inferred from model distances.
Theorem II (Privacy for S2). Let {p is the output of byzantine oracle or a vector of Is (non- private). Let BVj (a.j, bij, cis) and BVp, (a, by, ,,)) be the Beaver's triple used in the multiplications. Let (-) (2) be the share of the secret-shared values (-) S2. Then for all workers i
P(x; = x4 (xx,) (2), (p.) (BV(2) is x; I; - -aij, I; - basliess (2)
{[| - 11,1))) (2), ||= - x, 2111 (BVp,²) .Ps a. Pi b b)))))
(1)
F(x; = zi [|| - 2 )ies)

---

Under review as a conference paper at ICLR 2021
Note that the conditioned values are what S2 observed throughout the algorithm. {BV 3, 2j (2) agjs at ; icj and {BVp) Pc a,,,, b1 are intermediate values during shared values multiplication.
The model distances indeed only leaks similarity among the workers. Such similarity, however, does not tell $2 information about the parameters; in (Mhamdi al. 2018)) the leeway aftack attacks distance based-rules because they don't t distinguish two gradients with evenly distributed noise and two different gradients very different one parameter. This means the leaked information has low impact to the privacy.
It also worth noting that curious workers can only inspect others' values by learning from the public model/update. This is because in our scheme, workers don't It interact directly and there is only one round communication between servers and workers. So the only message a worker receives the public model update.
4.3 COMBINING WITH DIFFERENTIAL PRIVACY
While input privacy
main goal, approach is naturally compatible with other orthogonal notions of privacy. Global differential privacy (DP) (Shokri & Shmatikov [2013] Abadi et al.) 2016
Chase al., 2017) mainly concerned about the privacy of the aggregated model, and whether it leaks information about the training data. On the other hand, local differential privacy (LDP)
(Evfimievski et al. 2003; Kasiviswanathan al. (01T)) is stronger notions which is also concerned with the training process itself. It requires that every communication transmitted by the worker does leak information about their data. In general, is hard to learn deep learning models satisfying LDP using iterate perturbation (which is the standard mechanism for DP) (Bonawitz et al., (017).
Our non-robust protocol is naturally compatible with local differential privacy. Consider the usual iterative optimization algorithm which in each round performs
Wi W:-1 7)( + pr): where a, Σ Lt,t.
Here 2, is the aggregate update, wy is the model parameters, and vs is the noise added for DP (Abadi ct al. 2016).
Theorem III (from DP LDP). Suppose that the noise Vt (2) is sufficient to ensure that the set of model parameters (wrherr) satisfy (c, 8)-DP for 2 1. Then, running 2 with using Alg. 7 Too compute (xt TT.) by securely aggregating {x1,1 + 717), 22.1..... In,t satisfies (E,5)-LDP.
Unlike existing approaches, we do not face a tension between differential privacy which relies on real-valued vectors and cryptographie tools which operate solely discrete/quantized objects. This is because our protocols do not rely on cryptographic primitives like Diffic-Hellman key agreement, in contrast c.g. (Bonawitz et al. 2017). In particular, the vectors æ; can be full-precision treal-valued] at the cost of adding marginal rounding error which can be tolerated by robust aggregation rule and stochastic gradient descent algorithms. Thus, our secure aggregation protocol can be integrated with a mechanism which has global DP properties e.g. (Abadi et al.) 2016). and prove local DP guarantees the resulting mechanism.
EMPIRICAL ANALYSIS OF OVERHEAD
We present an illustrative simulation on local machine (17-8565U) to demonstrate the over- head of our scheme. We use PyTorch with MPI to train neural network of 1.2 million parame- ters on the MNIST dataset. We compare the fol- lowing three settings: simple aggregation with server, secure aggregation with servers, ro- bust secure aggregation with 2 servers (with Krum (Blanchard et al. 2017)). The number of workers is always 5.
Simulation time
Adjusted simulation time
Tgez
Tamer
Tute
Tade
Aggreqatio
7
T
0.5
1.0
0.4
0.8
0.3
0.6
0.4
Figure 2 shows the time spent on all parts of training for aggregation step. T Tgrad is the
Avg Avg
Avg Avg
Figure 2: Left: Actual time spent; Right: Time adjusted for network bandwidth.

---

Under review as a conference paper at ICLR 2021
time spent on batch gradient computation; Tw2s refers to the time spend on uploading and down- loading gradients; Tass is the time spend communication between servers. Note that the server-to-server communication could be further reduced by employing more efficient aggregationn rules. Since the simulation is run on a local machine, time spent on communication is underestimated. In the right hand side figure, we adjusts time by assuming the worker-to-server link has 100Mbps bandwidth and 1Gbps respectively for the server-to-server link. Even in this scenario, we can see that the overhead from private aggregation is small. Furthermore, the additional overhead by the robustness module is moderate comparing to the standard training, even for realistic deep-learning settings. For comparison, a zero-knowledge-proe prooo--bao--- approach need to spend 0.03 seconds to encode a submission of 100 integers (Corrigan-Ginne Gibbs & Boneh 2017).
6 LITERATURE REVIEW
Secure Aggregation. In the standard distributed setting with 1 server, Bonvawit et al. (2017) proposes secure aggregation rule which is also fault tolerant. They generate shared secret key for each pair of users. The secret keys are used to construct masks to the input gradients so that masks cancel each other after aggregation. To achieve fault tolerance, they employ Shamir's s secret sharing. To deal with active adversaries, they use public key infrastructure (PKI) well second mask applied to the input. A followup work (Mandal et al. 2018) minimizes the pairwise communication by outsourcing the key generation to two non-colluding cryptographic secret providers. However, both protocols are still not scalable because each worker needs to compute a shared-secret key and a noise mask for every other client. When recovering from failures, all live clients notified and send their masks to the server, which introduces significant communication overhead. In contrast, workers in our scheme freed from coordinating with other workers, which leads to more scalable system.
Byzantine- Aggregation/SGD. Blanchard et al. (2017) first proposes Krum and Multi-Krum for training machine learning models in the presence of Byzantine workers. MMhamdi et al.) (2018) proposes general enhancement recipe termed Bulyan. Alissarr et al. (2018) proves robust SGD training scheme with optimal sample complexity and the number of SGD computations. Muñoz González et al. (2019) uses HMM to detect and exclude Byzantine workers for federated learning. Yin et al. (2018) proposes median and trimmed-menn -man based robust algorithms which achieve optimal statistical performance. For robust learning on non-i.i.d dataset only appear recently (Li et al. 2019) Ghosh et al. 2019 He et al., 2020). Further, Xie et al. (2088) generalizes the Byzantine attacks to manipulate data transfer between workers and server and Xie al. (2019a) extends it to tolerate an arbitrary number of Byzantine workers.
Pillutla et al. (019)) proposes robust aggregation rule RFA which is also privacy preserving. However, it is only robust to data poisioning attack as it requires workers to compute aggregation weights according to the protocol. [Corrigan-Giin Gibbs & Boneh (017)) proposes private and robust aggregation system based on secret-shared non-interactive proof (SNIP). Despite the similarities between our setups, the generation of SNIP proof client is expansive and grows with the dimensions. Besides, this paper offers limited robustness as it only validates the range of the data.
Inference As A Service, An orthogonal line of work is inference as a service or oblivious inference. A user encrypts its own data and uploads it to the server for inference. -Gilad-Bachrach et al. 2016
Rouhani et al. 2017 Hesamifard al., 2017 Liu al. 2017 Mohassel Zhang [017]] Chou et al.
2018,Juvekar et al. 2018) Riazi et al. 2019) falls into a general category of 2-party computation (2PC). number of issues have to taken into account: the non-linear activations should be replaced
with MPC-friendly activations, represent the floating number as integers. Ryffell et al. (2019) uses functional encryption on polynomial networks. Gilad-Bachracl et al.] (2016) also have to adapt activations to polynomial activations and max pooling to scaled mean pooling.
Server-Aided MPC. One common setting for training machine learning model with MPC is the server-aided case (Mohassel & Zhang, 2017: Chen et al.) 2019). In previous works, both the model weights and the data are stored in shared values, which in turn makes the inference process computationally very costly. Another issue is that only limited number of operations (function evaluations) are supported by shared values. Therefore, approximating non-linear activation functions again introduces significant overhead. In our paper, the computation of gradients are local to the
8

---

Under review as a conference paper at ICLR 2021
workers, only output gradients sent to the servers. Thus no adaptations of the worker's neural network architectures for MPC are required.
CONCLUSION
In this paper, we propose novel secure and Byzantine-robust aggregation framework. To our knowledge, this is the first work to address these two key properties jointly. Our algorithm is simple and fault tolerant and scales well with the number of workers. addition, our framework holds for any existing distance-base roughly bounded by a factor of 2 and the computation overhead, as shown Algorithm 3 marginal and can even be computed prior to training.
robust rule. Besides, the communication overhead of our algorithm is
REFERENCES
Martin Abadi, Andy Chu, Ian Goodfellow, H Brendan McMahan, llya Mironov, Kunal Talwar, and Li Zhang. Deep learning with differential privacy. In Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, pp. 308-318. ACM, 2016.
Mehrdad Aliasgari, Marina Blanton, Yihua Zhang, and Aaron Stecle. Secure computation floating point numbers. In NDSS, 2013.
Dan Alistarh, Zeyuan Allen -hu, and Jerry Li. Byzantine stochastic gradient descent. In NeurIPS Advances in Neural Information Processing Systems, pp. 4613-4624 2018.
Eugene Bagdasaryan, Andreas Veit, Yiqing Hua, Deborah Estrin, and Vitaly Shmatikov. How to backdoor federated learning, arXiv 1807.00459v3, 2020.
Moran Baruch, Gilad Baruch, and Yoav Goldberg. little enough: Cireumventing defenses for distributed learning, arXiv preprint arXiv: I 992.06656, 2019.
Donald Beaver. Efficient multiparty protocols using circuit randomization. In Annual International Cryptology Conference, pp. 420-432. Springer, 1991.
Peva Blanchard, El Mahdi EI Mhamdi, Rachid Guerraoui, and Julien Stainer. Machine Learning with Adversaries: Byzantine Tolerant Gradient Descent. In NeurIPS- Advances Neural Information Processing Systems 30, pp. 119-129, 2017.
Manuel Blum and Silvio Micali. How generate cryptographically strong sequences of pseudoran- dom bits. SIAM journal on Computing, 13(4):850-86) 864, 1984.
Keith Bonawitz, Vladimir Ivanov, Ben Kreuter, Antonio Marcedone, H Brendan McMahan, Sarvar Patel, Daniel Ramage, Aaron Segal, and Karn Seth. Practical secure aggregation for privacy- preserving machine learning. In Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, pp. 1175-1191. ACM, 2017.
Keith Bonawitz, Hubert Fichner, Wolfgang Grieskamp, Dzmitry Huba, Alex Ingerman, Vladimir Ivanov, Chloe Kiddon, Jakub Koneeny, Stefano Mazzocchi, H Brendan McMahan, al. Towards federated learning at scale: System design. In SysML Proceedings of the 2nd SysML Conference, Palo Alto, CA, USA, 2019.
Melissa Chase, Ran Gilad-Bachran Bachhaach Kim Laine, Kristin E Lauter, and Peter Rindal. Private collaborative neural network learning. IACR Cryptology ePrint Archive, 2017:762, 2017.
Valerie Chen, Valerio Pastro, and Mariana Raykova. Secure computation for machine learning with spdz. arXiv preprint 1901009900.00299, 2019.
Edward Chou, Josh Beal, Daniel Levy, Serena Yeung, Albert Haque, and Li Fei-Fei. Faster eryptonets: Leveraging sparsity for real-world encrypted inference. arXiv preprint vrXiv:1811.0999) 2018.
Henry Corrigan- Corrigan-Gibbs statistics. In 14th USENIX Symposium on Networked Systems Design and Implementation (NSDI (7). pp. 259-282, 2017.
Gibbs and Dan Boneh. Prio: Private, robust, and scalable computation of aggregate

---

Under review as a conference paper at ICLR 2021
Alexandre Evfimievski, Johannes Gehrke, and Ramakrishnan Srikant. Limiting privacy breaches in privacy preserving data mining. In Proceedings of the wenty-second ACM SGGMOD-SIGACH SIGART symposium Principles of database systems, pp. 211-222, 2003.
Avishek Ghosh, Justin Hong, Dong Yin, and Kannan Ramchandran. Robust federated learning in heterogeneous environment. arXiv preprint arXiv: 06009, 2019.
Ran Giila-Bacchrace Nathan Dowlin, Kim Laine, Kristin Lauter, Michael Naehrig, and John Wernsing. Cryptonets: Applying neural networks to encrypted data with high throughput and accuracy. In International Conference on Machine Learning. pp. 201-210, 2016.
Suyog Gupta, Ankur Agrawal, Kailash Gopalakrishnan, and Pritish Narayanan. Deep learning with limited numerical precision. In ICML- Proceedings of the 32nd International Conference on Machine Learning, volume 37, pp. 1737-1746. PMLR, 07-09 Jul 2015.
Lie He, Sai Praneeth Karimireddy, and Martin Jaggi. Byzantine-rohust learning on heterogeneous datasets via resampling. arXiv preprint wrXiv22066099360 2020.
Ehsan Hesamifard, Hassan Takabi, and Mehdi Ghasemi. CryptoDL: Deep Neural Networks over Encrypted Data. arXiv preprint arXiv: 2017.
Chiraag Juvekar, Vinod Vaikuntanathan, and Anantha Chandrakasan. GAZELLE: A low latency
framework for secure neural network inference. In 27th USENIX Security Symposium (USENIX Security 18), pp. 1651-1669, 2018
Shiva Prasad Kasiviswanathan, Homin K Lee, Kobbi Nissim, Sofya Raskhodnikova, and Adam Smith. What learn privately? SIAM Journal on Computing, 40(3):793 (063)):93-826, 2011.
Marcel Keller, Emmanuela Orsini, and Peter Scholl. Mascot: faster malicious arithmetic secure computation with oblivious transfer. In Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, pp. 830-842, 2016.
Marcel Keller, Valerio Pastro, and Dragos Rotaru. Overdrive: making SPDZ. great again. In Annual International Conference on the Theory and Applications of Cryptographic Techniques, pp- 158-189. Springer, 2018
Liping Li, Wei Xu, Tianyi Chen, Georgios B Giannakis, and Qing Ling. RSA: Byzantinc-robus' stochastic aggregation methods for distributed learning from heterogencous datasets. In Proceed- ings of the AAAI Conference on Artificial Intelligence, volume 33, pp. 1544-1551, 2019.
Jian Liu, Mika Juuti, Yao Lu, and Nadarajah Asokan. Oblivious neural network predictions via minionn transformations. In Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, pp. 619-631. ACM, 2017.
Kalikinkar Mandal, Guang Gong, and Chuyi Liu. Nike-based fast data aggregation for mobile devices. Technical report, CACR Technical Report, CACR 2018-10 10, University of Waterloo, Canada, 2018
highdimensional
H. Brendan McMahan, Eider Moore, Daniel Ramage, Seth Hampson, and Blaise Agüera/ y Arcas. Communication efficienn learning of deep networks from decentralized data. arXiv preprint arXiv:1602.05669, 2016.
El Mahdi El Mhamdi, Rachid Guerraoui, and Sébastien Rouault. The hidden vulnerability of distributed learning in byzantium. arXiv preprint 180.0028,,. 2018.
Payman Mohassel and Yupeng Zhang. SecureML: A system for scalable learning. 2017 IEEE Symposium on Security and Privacy (SP), pp. 19-38. IEEE, 2017.
machine
Luis
Battista Biggio, Ambra Demontis, Andrea Paudice, Vasin Wongrassamee, Emil C. Lupu, and Fabio Roli. Towards poisoning of deep learning algorithms with mack-gradient optimization. arXiv preprint 1708 08689, 2017.
Luis Muñoz Muñoz-Gonzzian González, Kenneth T. Co, and Emil C. Lupu. Byzantine robusst federated machine learning through adaptive model averaging. arXiv preprint 190.00/90 2019.
10

---

Under review as a conference paper at ICLR 2021
Arvind Neelakantan, Luke Vilnis, Quoe V Le, Lukasz Kaiser, Karol Kurach, Ilya Sutskever, and James Martens. Adding gradient noise improves learning for very deep networks. In ICLR, 2016.
Krishna Pillutla, Sham M. Kakade, and Zaid Harchaoui. Robust Aggregation for Federated Learning. 2019.
arXiv preprint
Daniel Ramage and Stefano Mazzocchi. Federated analytics: Collaborative data
science without data collection. https://ai. googlebboogggooooooooooooooooooo http://leelooo.oommmooooo0...m.0 com/ com//220/05/ fedeeatted-nnllytiics-
mata.htm. May 27 2020.
M. Sadegh Riazi, Mohammad Samragh, Hao Chen, Kim Laine, Kristin Lauter, and Farinaz Koushan- far. Xonn: Xnor-based oblivious deep neural network inference. arXiv preprint arXiv:1902. 0930007342. 2019.
Bita Darvish Rouhani, M. Sadegh Riazi, and Farinaz Koushanfar. DeepSecure: Scalable Provably- Secure Deep Learning. arXiv preprint arXiv:1005.08963 2017.
Theo Ryffel, Edouard Dufour-Sans, Romain Gay, Francis Bach, and David Pointcheval. Partially encrypted machine learning using functional encryption. arXiv preprini arXiv: /905. 10214, 2019.
Reza Shokri and Vitaly Shmatikov. Privacy-preserving deep learning. In Proceedings of the 22nd ACM SIGSAC conference computer and communications security, pp. 1310-1321. ACM, 2015.
Nigel P. Smart and Titouan Tanguy. TaaS: Commodity MPC via Triples-as-a-Servic In CCSW 19 Proceedings of the 2019 ACM SIGSAC Conference on Cloud Computing Security Workshop, CCSW' pp. 105 16, 2019. doi: 10. 1..114/3338466.3355000 URL littps://doi.org:::
1145/33384 3358918
Sameer Wagh, Divya Gupta, and Nishanth Chandran. SecureNN: 3-party secure computation for neural network training. Proceedings on Privacy Enhancing Technologies, 201 2019,
Cong Xie, Oluwasanmi Koyejo, and Indranil Gupta. Phocas: dimensional byzantine-resilien
stochastic gradient descent. arXiv preprint arXiv:1805.06633 2018.
Cong Xie, Oluwasanmi Koyejo, and Indranil Gupta. Zeno: Distributed stochastic gradient descent with suspicion-basse fault-tolerance. In ICML 2019 - 35th International Conference on Machine Learning, 2019a.
Cong Xie, Sanmi Koyejo, and Indranil Gupta. Fall of Empires: Breaking Byzantine-tolera SGD by Inner Product Manipulation. arXiv preprint 1rXfv:1903.33936 2019b.
Andrew C Yao. Theory and application of trapdoor functions. In 23rd Annual Symposium on Foundations of Computer Science (SFCS 1982), pp. 80-91. IEEE, 1982.
Dong Yin, Yudong Chen, Kannan Ranchandran, and Peter Bartlett. Byzantine-robust distributed learning: Towards optimal statistical rates. arXiv preprint arXiv: 1803.01498, 2018
Appendix
A PROOFS
Theorem I (Privacy for S1). Let z E paa; where {ps) is the output of byzantine oracle or a vector of is (non-private). Let BV = aaj bij, cg) and BVp, = (a, b,,e") be the Beaver's triple used in the multiplications. Let (-)1) be the share of the secret-shared values (-) on SI. Then for all workers i
P(x; x; ((<,,) (') (BV(1) x; -x; - Dijj 0c - -, bij Jisj; {1|=; x, 13,1 (BVp, (1)
,P. - a. -6, b 2) = P(x: = 24(22)
11

---

Under review as a conference paper at ICLR 2021
Note that the conditioned values are what SI observes throughout the algorithm. {BVis) agjs 2; 3; iej and {BVp) (1) P4 Pp a, b, are intermediate values during shared values multiplication.
(1) D. 3j
Proof. First, we use the independence of Beaver's triple to simplify the conditioned term.
The Beaver's triples data-independent, Since (a.)(2 and (bf) (2) only exist in {pr af, Pr b and they are independent of all other variables, we can remove {p. 0 Pt
by J: from conditioned terms.
For the same reason (BV LBV PE are independent of all other variables and can be removed.
The secret shares of aggregation weights (px)(1) == (p: + m/)/2 and (p:) = (p= m/)2 where 7/i is random noise. Then ((p)) are independent of all other variables. Thus it can be removed.
Now the left hand side (LHS) can be simplified
LHS =P((x; = (x))
[BV (1) u - 3.j aıj: Bt x. bij.
(3)
<||>; - x; ((c,,
There are other independence properties:
The secret shares of the input (z;) can be seen generated by random noise &, Thus (ar == (E. + æx)/2 and (xx) == (-fe + æz)/2 are independent of others like zy Besides, for all j * i, (x,) and (xy) are independent.
Beaver's triple {BV()) (J) Ney and (BV hey are clearly independent. Since they are gener- ated before the existance of data, they are always independent of {-)) }3.
Next, according to Beaver's multiplication Algorithm 3
(||=, æソ 1 Cif + (x; 2j - 0ig b + (xx Dj b (1)
we can remove this term from condition:
LHS Pa = xi (2:) 1
1= z,
(4)
{BV (1) Zj aij. I;
Zj big big)
By the independence between (x.)(.) and BV 1j we can further simplify the conditioned term
LHS P(x; = x. { (x,) (1) ! [BV (1) (z. 3j a:jy (2) (xi- (2))
(5)
Since (V) 1) and (2) are always independent of all other variables, we know that
LHS = P(z; = 22 (x;) (2)))))))))))))))))))))))))))))
(6)
For worker i, Vj # i, (mx)() and (xr) (1) are independent
LHS = P(x: 2z/2).
Theorem II (Privacy for S2). Let {p: the oulput of byzantine oracle or a vector of Is (non-
private). Let BVj = (a.j. bij, Cij) and BVp, = <a,, b", (/,e)) be the Beaver's triple used in the
multiplications. Let (.) be the share of the secret-shared values (-) on S2. Then for all workers i
P(z; = x; (xx,) (2), (2)) Pi (BV())
is x; 2, -aij 2; -x, bislies-
{[I - az, 12) (2) ||. - 2, 1, Jiej, (BVp, Pss a. b)))))
(2)
(1)
= =P(x; = x; [|| - hx,)))
Note that the conditioned values are what S2 observed throughout the algorithm. {BV x. -x, aij. D; x2 biglies and (BVp.² p - ai P; b.y are intermediate values during shared values multiplication.
12

---

Under review as a conference paper at ICLR 2021
Proof. Similar the proof of Theorem
first conclude
{p- a. P: bb); and {BVp) (2) ia could be dropped because these they are data inde- pendent and no other terms depend on them.
(p:)) is independent of the others so it can be dropped.
{pe H== can be inferred from f||= zy Jl so can also be dropped.
By the definition of [<]|a æ,, (2)1))(2)) Jaj- it can be represented by { (2) and (BV mi
zj aij, 3, 2, big Jicj-
Now the left hand side (LHS) can be simplified as
LHS Pa( = (2;)
(BV (2) ij 2 - xj
aij: 2i - zj -bij,
||= )iاع)
Because V2 is independent of (20,) as well as data independent terms like
(BV. aig bij Jiej. we have
(1)
LHS = P( 24 || xy 2))1?
Theorem (from DP to LDP). Suppose that the noise Vt in (2 is sufficient to ensure that the set of model parameters (w)) satisfy (e, 5)-DP for 2 Then, running 2 with using Alg. [ compute (æ, TTs) by securely aggregating {æ1. 11), 22,t1 Ln,t) satisfies (5,6)-LDP
Proof. Suppose that worker E [n] copmutes it gradient based on data d, D. For the sake of simplicity, let us assume that the arregate model satisfies s-DP. The proof is identical for the more relaxed notion of (e, DP re re 2 1. This implies that for any j E [n] and d,, d, E D,
Pr
Se,Vy. Vy
Pr Eie x (d.()) (dd
Now, we examine the communication received by each server and measure how much information is revealed about any given worker [n). The values stored and seen are:
S1: The secret share (æ) + (2) (d.) وا and the sum of other shares (æ)
(2) + E (d.) = ((> i=1 x; (d.)) + (2)
S2: The secret share (x) (x, (d,
1=-2 mm)m
Worker 2 = (En x.(d) (d.) + mv.
The equality above is because our shares linear. Now, the values seen by any worker satisfy e-LDP directly by (8). For the server, note that by the definition of our secret shares, we have for any worker j.
(;(d)) is independent of æz,(d))
(r) yl Pr (d)) ū1 V4 = (d) = =y] = Pr(ar (x,, = v), Vd,, ED.
similar statement holds for the second share. This proves that the values computed/seen by the workers or servers satisfy c-LDP.
B NOTES ON SECURITY
B. BEAVER'S s MPC PROTOCOL
In this section, briefly introduce Beaver [1991 classic implementations of addition (x + y) and multplication (zy) given additive secret-shared values (æ) and (y) where each party holding 2; and y:- The algorithm for multiplication given in Algorithm
13

---

Under review as a conference paper at ICLR 2021
Algorithm 3 Beaver (1991) (1991)'s MPC Protocol
input: (z); (v); Beaver's triple ((a), (b), (c)) s.t. ab
output: (z) s.t. zy
for all party i do
locally compute 2; a, and y; b, and then broadcast them all parties
collect all shares and reveal æ - = (x; 0;), y b- E;(y; b;)
compute 2; = G + (x a)b; (y b)a;
end for
The first party updates 21 == 21 + (x a) b)
Addition. The secret-shared values form of sum, (x + v). is obtained by simply each party locally compute z4 + yt-
Multiplication. Assume we already have three secret-shared values called triple, (a), (b), and (c) such that c ab.
Then note that if each party broadcasts y - b (so these values are publicly known), and hence compute
and y/ b, then each party can compute and
ci + (ar aab: (y bja;
Additionally, one party (chosen arbitrarily) adds on the public value (x - (x) b) their share so that summing all the shares up, the parties get
Ej c (ar a)b (y b)a + (x a)(y b) xy
and so they have a secret sharing (z) of ay.
The generation of Beaver's triples. There are many different implementations of the offline phase of the MPC multiplication. For example, semi- cemi-homomorphic encryption based implementations (Keller et al. 2018) or oblivious rransfer-based implementations (Keller et al. 2016). Since their security and performance have been demonstrated, may assume the Beaver's triples are ready for use at the initial step of our protocol.
B.2 NOTES ON OBTAINING A SECRET SHARE
Suppose that we want to secret share a bounded real vector x E (-B, B,BBB B]d for some B 2 Then, we sample random vector & uniformly from (-B, BJd This is easily done by sampling each coordinate independently from (-B, -B, B). Then the secret shares become (E, x E). Since & is drawn from a is still uniform
uniform distribution from [- B, B)d, the distribution of x conditioned (-B, and (importantly) independent of x. All arithmetic operations are then carried out modulo [-B, BJ i.e. ++1 B + 1 and -B 1 theoretic input-privacy for continuous vectors.
1. This simple scheme ensures information
The scheme described above requires access true randomness i.e. the ability sample uniformly from (-B, B). We make this assumption to simplify the proofs and the presentation. We note that differential privacy techniques such (Abadi et al.) 2016) also assume access similar source of true randomness. In practice, however, this would be replaced with a pseudo-random waa---rannndooaaatttteeeee generator (PRG) (Blum & Micali 1984 Yao 1982).
B.3 COMPUTATIONAL INDISTINGUISIABILLTY
Let {. {Y,} be sequences of distributions indexed by a security parameter n (like the length of the input). (X,)) and (Yn) computationally indistinguishable if for every polynomial-time A and
dllynomially-boundde c, and sufficiently large
Pr(A(XX.) Pr(A(Y))) = =1] < e(n)
a pseudorandom generator, instead true randomness, used Appendix B.2, then the shares indistinguishable from uniform distribution over field of same length. Thus in Theorem and Theorem [[] the secret shares can be replaced by an independent random variable of uniform distribution with negligible change in probability.
14

---

Under review as a conference paper at ICLR 2021
B.4 NOTES ON THE SECURITY OF S2
Theorem proves that S2 does not learn anything besides the pairwise distances between the various models. While this does leak some information about the models, S2 cannot use this information to reconstruct any This is because the pair-wise distances are invariant to translations, rotations, and shuffling of the coordinates of {.:}.
This remains true even if S2 additionally learns the global model too.
15

---

Under review as a conference paper at ICLR 2021
C
DATA OWNERSHIP DIAGRAM
Worker i
S1
S2
WorkerSS
24 2
+ 2
Collect {(x,)) (an.)).)
Collect ((x) (2)
Get Beaver's triples: {(a,,, C.y) e hec
Get Beaver's triples: {aa bis, Cis)
(2)
Robust WeightSeleetiion
[v: axy) (1)) (a:
biz) [icj
(a) 21 a.)) (2), (x, 2. b
(2)
Compute {[1=
-r,113)0 heg
Compute {<la m. (12) (2)
Nis
00 x. 2,13) fise
Compute {1
22 1 ie
Call -Muti-KKUMM( (RRUM([122) [|x:
2z,
22,1i
(1)
(2)
(pp)) 1n
Pull Agg Undaatee
Get Beaver's triples: ((a), bC, (
Get Beaver's triples: {(a bú, (2))
a.) aP) (a; bPy (1) -=
{/pc Compute (20 1P:2;
(a. b.") (2)(
Compute (2)=1P(3))
Compute Σn 1p:2a
Figure 3: Overview of data ownership and Algorithm| Multi-Krum
The underlying Byzantine-robust oracle is
In Figure we show a diagram of data ownership demonstrate of the data transmitted among workers and servers. Note that the Beaver's triples are already local to each server so that no extra communication needed.
16

---

Under review as a conference paper at ICLR 2021
D THREE SERVER MODEL
In this section, we introduce robust algorithm with information-theorett privacy guarantee at the cost of more communication between servers. We avoid exposing pairwise distances to S2 by adding to the system an additional non-colluding server, the erypto provider (Wagh et al.) 2019). A crypto provider does not receive shares of gradients, but only assists other servers for the multiparty computation. Now our pipeline for one aggregation becomes: 1) the workers secret share their gradients into 2 parts; 2) the workers send their shares to S1 and S2 respectively; 3) S1, S2 and the crypto provider compute the robust aggregation rule using crypto primitives; 4) servers reveal the output of aggregation and send back to workers.
The (Wagh al. 2019) use crypto provider construct efficient protocols for the training and inference of neural networks. In their setup, workers secret share their samples to the servers and then servers secure compute neural network. In contrast, we consider the federated learning setup where workers compute the gradients and servers perform a multiparty computation of (robust) aggregation function. The aggregated neural network is public all. As the (robust) aggregation function is much simpler than a neural netwuork, our setup is more computationally efficient. Note that we can directly plug our secure robust aggregation rule into their pipeline and ensure both robustness and pewaacy-resservig in their setting.
The crypto provider enables servers to compute a variety of functions on secret shared values.
MATMUL: Given (x)) and (y), return (a: (x=Ty)- The crypto provider generates and distribute beaver's triple for multiplication.
PRIVATECOMPARES Given (x) and a number r, reveal a bit (x > to S1 and S2, see Algorithm 5 This can be directly used to compare (x) and (y) by comparing (x y) and O. SELECTSHARE: Given (x)) and (z) and a E {0, 1}. return ((-a))x+ay) see Algorithm
This function can be easily extended to select one from more quantities.
The combination of PRIVATECOMPARY and SELECTSHARE enables sorting scalar numbers, like distances. Thus we can use these primitives to compute Krum on secret-shared values. For other aggregation rules like RFAPillutla et al. (2019), we need other primitives like division. We refer to Wagh et al. (2019) for more primitives like division, max pooling, ReLU, We also leave the details of the three aforementioned primitives in Appendix D.I
Three server MultiKrum. In Algorithm 4 we present a three-server MULTIKRUM algorithm. First, S1, (2, and S3 compute the pairwise distances ((de)) jaz, but do not reveal it like Algorithm 2 For each i, we use PRivAtECOMPARe and ShARe to sort {(de)) }, by their magnitude. Then we compute (score,) using SELECTSHARE. Similarly we sort {score,) 1 and get selection vector a for workers with lowest scores. Finally, we open (a X) and reveal ΣiEZ O,T, to everyone.
We remark that sorting the ((dg)) } does not leak anything about their absolute or relative magnitude. This is because: 1) S3 picks i, from πi 22 which is unknown to S1 and S2; 2) S3 encodes i, into a selection vector Oity and secret shares it to S1 and S2; 3) For S1 and S2, they only observe secret- shared selection vectors which is computationally indistinguishable from random string. Thus $1 and S2 learn nothing more than the outcome of MultiKrum. On the other hand, PRIVATECOMPARE guarantees the crypto provider S3 does not know the results of comparison. S3 also knows nothing more than the output of MultiKrum. Thus Algorithm 4 enjoys iooomation-theoretiin security.
D.1 THREE SERVER MODEL IN SECURENN
Changes in the notations. The Algorithm 6 and Algorithm frrm SecureNN use different notations. For example they use (ir); to represent the share j of w in a ring of ZP. Morever, the Algorithm secret shares each bit of a number x of length which writes (x(1)) The t means xor sum.
17

---

Under review as a conference paper at ICLR 2021
Algorithm 4 Three Server MULTIKRUM
Input: S1 and S2 hold ((,;) and (a):))), resp. f. m
Output: Eier Ocga; where I is the set selected by MULTIKRUM
On S1 and S2 and S3:
For i in n...nddo do
For j # in 1... do
Compute (z; σz) locally on S1 and S2
Call FMATMUL (1S1, S2}, 53) with ((x;- - xz), (xx xx,) and get (dzy) = (1| -xyl== -2,l13)
End for End for
Denote d = [dislies be vector of the distances and [ :.p]
On S3:
Let Ti and πΟ be 2 random permutation function.
For i (1(1 m1) do
For in (2..... do
Let ouy be the selection vector of whose entry for dy is and all others are 0.
Compute (osy) and send (aaa)o to S1 and send (axi))) 1 to S2. Call Algorithm
6 with input ((oug) ((di)))cs)) and get (dly)- (diy
End for
Sort {(dgy)> using Algorithm to compute (score,) E.ng (d/j)
End for
Sort {(score;)] } using Algorithm 5 and record the indicies I with lowset scores.
Let a be selection vector length so that for all entry are and all others are Compute (ax) and send (ax (U) S1 and send (ax) (1) S2.
Compute (a X) using FMATMUL.
On S1 and S2: Let for $1 and
for $2
For 7 in 1... do
For j in 1... (n-1) 1) do Receive (ak.)(k) from Call Algorithm 6 with input ((a..), ((di)) (e))) and get (d'r)). End for Sort {(dly)) using Algorithm 5 to compute (score;) Einj(de)
End for
Sort {(score;) } using Algorithm 5
Receive (ax)
Compute (ar X) using FMATMUL.
S1 and S2: Open (a X) to reveal Σier a,,a;
18

---

Under review as a conference paper at ICLR 2021
Algorithm 5 PRIVATECOMPART (pc((S)) S2), (Wagh et al. 2019 Algo. 3)
Input: Si and S2 hold ((rli)) Neto and (x)l))) respectively, common input (an bit integer) and common random bit B. The superseript is small prime number like 67.
Output: S3 gets bit (x r)
Common Randomness: SI, S2 hold & common random value s; E Z.p for all i E [C] and random
permutation x for l elements. S1 and S2 additionally hold & common random values u, E Zyz
On each j E {0, 1 server SJ+1
Let f.
mod 2 for i = {f. 186-11 1.....1] 1} do
if 3 = 0 then
(w:)² = (x(()) + jrli] (
(a)) = jr(i] (a(i)) +j+ Ex=4t
else if 3 = 1 + 1 then
(w,)} = (x(()) + [=|])
(4) -jt(i]] (xli))) j Σl Ex=ita (wx)²
else
If 1, (a)) = (1 (4 1) ju, else (ci) = (-1)3 un
end if
end for (dd)) = T( (() to S3
Send
On server S3 For all i E [f], Sy computes d, Reconst ((4)) (d.))) and sets 8 = iff 3i E [$] such that d, = S3 outputs g'
Algorithm SELECTSHARE Isss ((S,, 82), Sz) (Wagh et al. 2019 Algo.
Input: Si and S2 hold (fa) (r) (v) and ((a)f: (x) (w) resp.
Output: S, and S2 get (z)g and { resp.. where z = (1 - a)x + ay.
Common Randomness: S,, S₂ hold shares of 0 over Σn denoted by uo and u1
For E {0, 1}. S3+1 compute (w)/ = (w) (z)
S1, S2, S3 call FMATMUL((S), S2). with S3+1. (0, 1) having input ((a),, (w)f) and St,
Sa learn (c) and (c) resp.
For j E {0, 1). S3+1 outputs (z) = (x) + (0) + uj
19

---

Under review as a conference paper at ICLR 2021
E EXAMPLE: TWO-SERVER PROTOCOL WITH BYZANTINESGD ORACLE
We replace MultiKrum with ByzantineSGD in (Alistarh al. 2018 To fit into our protocol, make some minor modifications but still guarantee that output is same. The core part (Alistarh) listed Algorithm
al. 2018
Algorithm 7 ByzantineSGD (Alistarh al. 2018
input: I the set of good workers, {Ai) {IIB, Byllies (l Vasillies (i.j (m))
thresholds A. Tg > 0
output:
Subset good workers
Amed = median
(A,,..., m 14m....,AA.?
Bued B; where
[m]] is any machine s.t. K [m] || B;ll Ez}l mm/2
V med f- VA.i where E [m] is any machine s.t. Kj E [m] : [
Va,i S 2vH > m m/2:
S
{i T IA; Ameal S A A |B; Bmmed In kgj V, S 4v):
The main algorithm can be summarized in Algorithm 8 the red lines highlights the changes. Different from Multi- (Blanchard et al. 2017), Alistarh al. (2018) uses states in their algorithm, As result, the servers need to keep track such states.
Algorithm 8 Two-Server Secure ByzantineSGD
Setup:
7I workers, at most a percent of which Byzantine.
Two non-colluding servers S1 and S2
ByzantineSGD Oracle: returns an indices S.
With thresholds A and T
Oracle state Agld, (Bold) for each worker
Workers: (WorkerSSeredtharring)
(a) randomly split private æ, into additive secret shares (x,) = {a/ xx(2) (such that z; x (b) sends x to S1 and
(2) x; to $2
Servers:
1. V i, S1 collects gradient a and S2 collects x;
(2)
(a) Use Beaver's 's triple to compute A; := ((xi), (w wo) + Apola
(b) (B)) = (z,) + (Bold)
2. (RobustSubetSSeletton):
(a) For each pair (i. j) of gradients computes their distance (i < j):
On S1 and $2, compute (B, B,} (B,) (B,) locally
Use precomputed Beaver's triple and Algorithm to compute the
distance [B Byl1
On S1 and S2 compute (z;- - xz) = (æx) (x,) locally
Use precomputed Beaver's triple and Algorithm to compute the distance ||æ; æ,,l3
(b) S2 perform Byzantine SGD S-ByzmtineSGD(((A)
[ - B,ll {|
By llke,, T Rx); if (S] < 2, exit; Convert S to weight vector of length
(c) S2 secret-shares (p) with S1
3. (AggregationAndUpplll
(a) On S1 and S2, use MPC multiplication to compute (E P.a.)) locally
(b) S2 sends its share of (Et p.z,)(2) to S1
(c) S1 reveals 2 = Σt i= P,D, to all workers.
(d) S2 updates Auid + A,, (Bold) + (B,)
Workers:
1. PWorkerrullMoodel); Collect z and update model w <- w + =locallyy
20

---

Under review as a conference paper at ICLR 2021
#Server
1500
#Server
50
250
2
Time Ratio (25 66M 1.2M)
Ideal ratio
50
40
Time (s)
30
20
2-
0
5
10
20
50
5
10
20
50
#Nodes
#Nodes
(a) Scaling with dimension
(b) Scaling with #workers (large model)
Figure 4: Scaling two-server model and one-server model to 5, 10, 20, 50 nodes.
F ADDITIONAL EXPERIMENTS
We benchmark the performance of two-server protocol with one-server protocol the google kubernetes engine. We create a cluster of 8 nodes mauchine-type=c2sstandde
where servers are deployed different nodes and the workers are deployed evenly onto the rest 6 nodes. We run the experiments with 5, 10, 20, 50 workers and large model of 25.6 million parameters (similar ResNet-56) and a small model of 1.2 million parameters. We only record the time spent on communication and aggregation (krum). We benchmark each experiment for three times and take their average. The results are shown in Figure 4
Scaling with dimensions. In Figure 4a we compute the ratio of time spent on large model and small model. We can see that the ratio of two-server model very close to the ideal ratio which suggests scales linearly with dimensions. This is expected because krum scales linearly with dimension. For aggregation rules based on high-dimensional robust mean estimation, we can remove the dependence on d. We leave it future work to incorporate more efficient robust aggregation functions.
Scaling with number of workers. In Figure 4b we can see that the time spent on both one-server and two-server model grow with (n²). However, notated that this complexity comes from the aggregation rule we use, which is krum, not from our core protocol. For other aggregation rules like ByzantineSGD Alistarh al. (2018), the complexity of aggregation rule is O(n) and better scaling effects. We leave it as a future work to incorporate and benchmark more efficient robust aggregation rules.
observe
Setups. Note that in our experiments, the worker-to-server communication and server-to-server communication has same bandwidth of Gb/s. In the realistic application, the link between servers can be infiniband and the bandwidth between worker and server are typically smaller. Thus, this protocol will be more efficient than have observed here.
21


Reviews:
[{"review_id": "cpxiMevkolO", "reviewer": "AnonReviewer3", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "\n\nThe paper proposes a method combining privacy and byzantine-robustness for distnace-based aggregation.  This is a relevant and interesting topic.\n\nThe paper assumes that it is not a problem that one of the server learns all pairwise distances.  Still, every known pairwise distance |&x_i-x_j|| more tightly connects the relative position of the points x_i together.  If the dimension of the vectors x_i isn't large, then knowledge of a limited set of x_i vectors may allow this server to deduce all other vectors (or may allow him to determine significant constraints all other vectors x_j must satisfy).\n\nOnce we accept the above assumption, the paper seems mostly sound, sometimes with minor issues in writing or precision (a few examples below).\nThe approach doesn't introduce fundamentally new techniques but combines existing ideas to realize a more powerful solution.  The text is quite well written.\n\n\nDETAILS\n\n* \"WorkerSecretSharing (Figure 1a): ... This can be done e.g. by sampling a large noise \\xi_i and then using x_i \\pm \\xi_i as the shares.\" -> as x_i must be the sum of the shares, I guess you mean the shares are (x_i+\\xi_i)/2 and (x_i-\\xi_i)/2\n* Section 3.2: RobustWeightSelection (Figure 1b): seleced subset -> selected subset\n* Section 3.2: RobustWeightSelection (Figure 1b): \"S2 secret shares with S1 the values of {<p_i>}\" -> please make clear what exactly is \"secret-shares\", it is not the secret sharing used by workers to split x=x_1+x_2.   (I guess you describe here step 3b in algo 2)\n* \"Compatibility with local differential privacy. One byproduct of our protocol can be used to convert differentially private mechanisms, such as (Abadi et al., 2016) which only of the aggregate model which guarantees privacy,\" -> the last \"which only ...\" subphrase needs a verb\n\n\n", "extra_scores": {}, "extra_text": {}}, {"review_id": "ZhZ-0sEL67", "reviewer": "AnonReviewer4", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "Summary:\nThe paper presents a system for collaborative training where two central servers compute the model update using two-party computation. There are two variants, one where the update are not checked, and one where the server use algorithm (Aggr) to weight the updates such that outliers are excluded.\n\nPros:\nThe basic ideas are presented succinctly, and the overall setup solves a relevant problem.\n\nCons:\n- The main issue I have is that the authors claim in Section 4.3 that they \"can\" use full-precision (real) values in the computation but the underlying techniques (secret sharing and Beaver triples) have only been proposed for integer/quantized values. In particular, if the actual value is small, adding a large random value will override it due to rounding in floating-point representation. I cannot find any treatment of this issue or any reference to works to have tackled floating-point secure computation such as Aliasgari et al., NDSS '13.\n- Similarly, the claim that the paper does not rely on cryptographic primitives seems exaggerated given the use of secret sharing and Beaver triples.\n- The cost of generating Beaver triples is ignored. The paper does not estimate how many are needed.\n- Claiming Byzantine robustness seems too strong when the two central servers have to be semi-honest.\n\nConclusion:\nI recommend rejection because of the irrealistic approach regarding real-valued computation. The authors should either present credible secure floating-point computation or change their claim to quantized computation.\n\nMinor issues:\n3.1: x_i +- \\xi_i is not an additive secret sharing of x_i but 2*x_i.\n3.1: sum of (the) other share\n3.1: \"sum of other share\" should be \\sum *p_i* x_i^(2)?\n3.1: It is not surprising that S2 does not learn anything in secure computation.\n3.3: In particular, (unfinished sentence)\n3.3: don't face\n4.2: vetor (twice)\n6: median and trimmed-mean -based (odd positioning of dash)\n", "extra_scores": {}, "extra_text": {}}, {"review_id": "VKk4nUv1dVA", "reviewer": "AnonReviewer1", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 2, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "This work proposes a method to robustly (<.5 adversarial workers) aggregate model updates using two non-colluding servers. The proposed method scales well with the number of workers and is compatible with local DP and different robust aggregation protocols. Especially the scalability is a big improvement compared to previous methods. The authors discuss related work that relies on public key infrastructure and requires pairwise secrets between clients. One big advantage of the proposed protocol is that there is no communication between the workers.\n\nPositives\n- The paper is very well written and easy to follow. \n- The contributions are significant in terms of scalability, compared to other protocols discussed in the literature review. \n- The theoretical justifications seem sound and are relatively easy to follow, although I didn't verify the proofs in detail.\n\nNegatives\n- The assumptions are still strong (non-colluding servers), but I am not very familiar with the literature to fully assess the implications. It would be great to put the strong assumption of non-colluding servers more into context. How does it compare to other protocols? (somewhat discussed in the lit section) \n- The experimental section is lacking a bit. It's not entirely clear what additional insights the provided analysis gives, especially also given the unrealistic setup of only five workers. It's not clear what the actual experiments are, referred to with S1 Avg, S2 Avg, S2 Krum (S1/S2 also refer to the servers in the rest of the paper). Is S2 Avg the proposed protocol, just w/o the robust computation? A more detailed discussion why the robust version increases the server communication significantly (even though the authors claim it doesn't. AFAICT it almost doubles the total cost) would be welcome. Is it because of the Beaver's triple communication to share the pairwise distances? (TBH, I am not sure this paper really needed an experimental section, but the current one has serious gaps).\n\nWhile the paper proposes a novel idea with significant improvements, the paper is lacking wrt putting it into context of the existing field and a more detailed interpretation of the experiments would be welcome. For these reasons the recommendation is to reject the paper in it's current state.", "extra_scores": {}, "extra_text": {}}, {"review_id": "BbGuwSQvWd7", "reviewer": "AnonReviewer2", "summary": "", "questions": "", "limitations": "", "rating": 7, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "**Paper summary**\n\n1. The paper introduces a two server protocol to handle privacy concerns and Byzantine threats in a Federated Learning system simultaneously.\n2. In the protocol, each client secretly shares their model update with the two servers by splitting its model update such that neither server can know what the model update is without colluding with the other server. The servers are able to compute pairwise distances of all updates securely. These distances are used by byzantine robust aggregators to find a robust model update.\n\n\n**Strengths**\n1. The paper handles two very relevant and important issues with Federated Learning simultaneously - privacy and Byzantine resilience (which includes data poisoning attacks). \n2. The proposed algorithm is shown to have theoretical guarantees.\n3. A wide array of byzantine robust aggregation rules can be incorporated easily into the framework.\n5. There isn't much communication overhead between the workers and the server.\n6. The two server protocol does not seem to be too difficult to implement in practice. The algorithm requires that the two servers should not collude. This requirement does not seem too difficult to be enforced onto big companies that will use FL.\n7. In the absence of Byzantine machines, the non-robust protocol seems to be compatible with differential privacy.\n\n**Concerns**\n1. Can it be quantified (using some information theoretic bound) that only pairwise distances cannot leak much information? In the worst case, it can leak some information. For example if the pairwise distance is 0 for some pair, then each machine exactly knows the other's model update. However, I believe that using some assumption on distribution of model updates, we can still get some information theoretic guarantee. The three server algorithm in Appendix D seems to address this, but I wonder if we can say something for the two server algorithm too.\n2. Can it be extended to dimension-independent robust mean estimation techniques? The paper only considers distance based aggregators (with the exception of  (Alistarh et al., 2018), which I discuss later). These aggregators all seem to suffer from an error that grows with dimensions as $\\sqrt{d}$ (see section 2 in (Wang et al., 2020). A recent line of works has given robust mean estimators that have errors that are dimension independent (Dong et al., 2019; Diakonikolas et al., 2017; Diakonikolas et al., 2016; Lai et al., 2016). However these use second order information like the empirical covariance matrix too. Can the algorithm proposed in this paper be extended to these algorithms too? \n\nAlistarh et al. (2018) also give dimension independent guarantees, but they require the workers to sample a new data point at every iteration, which may not hold for many FL systems.\n\n**Score justification**\n\nThe paper tackles a very relevant problem for Federated Learning. Further, the proposed algorithm has nice theoretical guarantees and it looks like the algorithm can be easily implemented in a variety of large FL systems.\n\n\n**References**\n\nWang, L., Pang, Q., Wang, S. and Song, D., 2020. F2ED-Learning: Good Fences Make Good Neighbors. arXiv preprint arXiv:2010.01175.\n\nDong, Y., Hopkins, S. and Li, J., 2019. Quantum entropy scoring for fast robust mean estimation and improved outlier detection. In Advances in Neural Information Processing Systems (pp. 6067-6077).\n\nDiakonikolas, I., Kamath, G., Kane, D.M., Li, J., Moitra, A. and Stewart, A., 2017. Being robust (in high dimensions) can be practical. arXiv preprint arXiv:1703.00893.\n\nDiakonikolas, I., Kamath, G., Kane, D.M., Li, J., Moitra, A. and Stewart, A., 2016, October. Robust Estimators in High Dimensions without the Computational Intractability. In 2016 IEEE 57th Annual Symposium on Foundations of Computer Science (FOCS) (pp. 655-664).\n\nLai, K.A., Rao, A.B. and Vempala, S., 2016, October. Agnostic estimation of mean and covariance. In 2016 IEEE 57th Annual Symposium on Foundations of Computer Science (FOCS) (pp. 665-674). IEEE.", "extra_scores": {}, "extra_text": {}}]

Author rebuttal:

Meta-review: This paper presents a secure aggregation method to ensure byzantine robustness. The reviewers thought that the idea was interesting, but had the following concerns.
* Relaxing the assumptions used in the theoretical analysis as much as possible
* Run more extensive experiments
I encourage the authors to their feedback into account when preparing the revised draft. 


Decision: Reject