P2PRISM - Peer to peer learning with individual prism for secure aggregation
Authors: Atul Sharma
Wei Chen
Joshua Christian Zhao
Qiang Qiu
Saurabh Bagchi
Somali Chaterji
Venue: Submitted to ICLR 2023 (2023)
Keywords: peer-to-peer
decentralized learning
byzantine-robust

Abstract: Federated learning (FL) has made collaboration between nodes possible without explicit sharing of local data. However, it requires the participating nodes to trust the server and its model updates, the server itself being a critical node susceptible to failure and compromise. A loss of trust in the server and a demand to aggregate the model independently for oneself has led decentralized peer-to-peer learning (P2PL) to gain traction lately. In this paper, we highlight the never before exposed vulnerabilities of P2PL towards malicious attacks and how P2PL behaves differently from FL in such a malicious environment. We then present a robust defense - P2PRISM as a secure aggregation protocol for P2PL.

Under review as a conference paper at ICLR 2023
P2PRISM PEER TO PEER LEARNING WITH INDIVID- UAL PRISM FOR MODEL AGGREGATION
Anonymous authors Paper under double-blind review
ABSTRACT
Federated learning (FL) has made collaboration between nodes possible without explicit sharing of local data. However, requires the participating nodes to trust the server and its model updates, the server itself being critical node susceptible to failure and compromise. A loss of trust in the server and a demand to aggregate the model independently for oneself has led decentralized peer-to-peer learning (P2PL) to gain traction lately. In this paper, we highlight the never before exposed vulnerabilities of P2PL towards malicious attacks and show the differences be- tween the behavior of P2PL and FL in a malicious environment. We then present robust defense P2PRISM as secure aggregation protocol for P2PL.
INTRODUCTION
1.1 MOTIVATION FOR PEER-TO TE-P LEARNING
FL. McMahan et al. 2017 : Konečný et al. 2016) has demonstrated how clients can benefit from
collaboration by sharing their local gradient updates to the parameter server, which in aggre-
gates Yin et al. (201 Sap: Blanchard et al. 2017);; Guerraoui et al. 2018); Xia et al. (2019); Fung al. (2020); Cao al. (2020) all the received gradients update the global model. For the sake of simplicity, we assume that the entire process is synchronous the server waits to hear from all the clients before aggregation and all clients receive the same global model from the server after aggregation, that is, the clients always have to agree on the global model sent by the server and replace its local model with before continuing with the local training. Although the aggregation technique being used may be known to all, but the actual aggregation is hidden from the clients for privacy concerns as it has been shown that access to a client's gradients can be used to recover its local data in an approximate an exact way by optimization Geiping al. (202)) or analytical Fowl et al. (2021) methods respectively. It is therefore not possible for clients to selectively choose other clients' gradients to aggregate even if it benefits them from any existing spatial locality among the clients. The clients have to trust the server to also aggregate the gradients in a byzantine-robust man- ner. Unless the server itself possesses root dataset Cao al. (202T) that correctly represents the entirety of data possessed by all clients as the ground truth. it is difficult for it to correctly identify malicious updates statistically without being extremely conservative and removing any suspected gradients leading to a significant loss of information. Whereas node does have access to its own generated gradients as the benign ground truth and can make use of it, given the power to aggregate the model for itself. Due to the above mentioned reasons, and several others, a node is motivated to lose trust in a server and join a decentralized collaboration among the other nodes.
1.2 COMPARISON WITH FEDERATED LEARNING
In FL., the server aggregates the gradients from all the clients. However, in P2PL. a node may choose to communicate only with its neighbors in every round and locally aggregate the received models. If the graph formed by the nodes is not fully connected with equally weighed edges, the nodes are going to have models that differ from each other every point in time even after their local aggregation. Consensus distance (d) of the graph is defined as the average distance of each of the m local models (z,) from the centroid (T) of them all, known to an oracle.
=
(1)
m

---

Under review as a conference paper at ICLR 2023
P2P (m=10, 1=10, c=0). MNIIST b=0.5
P2P (m= 1n=12,,cm c=2, I=1), MNIST, b=0.55
Same
1000
Test acc
0.75
0.5
0.50
0.25
km5
0.0
Test acc
k=
0.00
Diff init
0.5
1.00
k==1
0.75
00
10
Test
0.50
1m:10
025
0.5
0.00
0.0
30
75
125
Rounds
Node ID
Figure/ 1: Left: Training a k-regular peer-to-peer graph with varying values of k with same and different model initialization. We see that it is necessary to initialize nodes with the same model to expect benefit from collaboration (k > 1). Right: Demonstrating the spread of the attack in k-regular graph where only 2 out of 128 nodes (shown red) are malicious. We can see that the larger the collaboration (k), the greater the spread of the attack if the aggregation used is insecure, such as gossip averaging in this case.
It is measured after every aggregation step. Needless to say this takes a zero value in FL and non- zero value in P2PL when the graph not fully connected. non-zero consensus value implies that sharing gradients as in FL is not appropriate in P2PL and the nodes need to share the actual model weights with their neighbors because the local gradients have been computed on already differing local models. The nodes, after performing local SGD on their own data, where the nodes' data can be assumed to be non-IID with bias = to incentivize collaboration, tend to diverge from each other. In FL, the server enforces full consensus among the clients, whereas in P2PL, the nodes perform one or more rounds of gossip averaging (GA) with their neighbors to keep the consensus distance in check. It is always wise initialize all nodes in P2PL with the same model, that is, zero initial consensus distance to aid consensus control in the later stages of training, as also demonstrated in the toy experiment in Figure [ We see that with same initialization, the nodes benefit from collaboration as & increases to 5 and 10 from 1 (individual training). This is also why every client in FL benefits from collaboration as their models are made to synchronize by the server. Whereas, when nodes are initialized differently, they hurt each other with collaboration, because they are all on different trajectories towards learning an optimal model, as the same ML problem may have multiple solutions depending on the initialization. In fact, we observe that the nodes are hurt even with & = m = 10 when after a single round of gossip, the consensus distance falls down to and stays at O. Hence, keeping the pre-gossip consensus distance low is important keeping the post-gossip consensus distance, which is why we recommend setting the initial pre- pre-gossip consensus distance to 0 by initializing all the nodes with the same model.
Assuming a weighted mean aggregation, in FL, the server assigns weights to all the clients. In P2PL., every node is responsible for its own aggregation, and maintains vector of weights (zero or non-zero) assigns to every other node, including itself. These vectors when stacked on top of each other form the mixing matrix W of the graph and define its topology. If is a matrix with x; being the model of the ith node, then the gossip averaging step is captured by the matrix operation Wx. to be noted that node only affected by its direct neighbors in one round of gossip averaging, but can be affected by an indirectly connected neighbor if multiple rounds are performed. For example two rounds of GA with matrix W results in the models W Wz which is effectively single round of GA with matrix 2 where W is less sparse than W for positive entries in W. should also be obvious that more the number of gossip averaging steps, the tighter the consensus control Kong al. (202I).
1.3 P2PL IN BYZANTINE ENVIRONMENT
P2PL behaves differently from FL under malicious setting. Assuming the same model poisoning attack in both the cases, with c out of m nodes being malicious or compromised, while the FL server has to deal with f(= 4) fraction of malicious nodes, the nodes in P2PI. have to deal with
2

---

Under review as a conference paper at ICLR 2023
variable fraction of malicious neighbors which could be greater than f for many, depending the distribution and connectivity of the nodes. Attackers can not only impact their direct neighbors, but the impact spreads like disease with either multiple GA steps in the same round, even with a single GA step when other nodes come contact with the poisoned nodes the next round before the infected could recover themselves during their local SGD. In this manner, the attacker also succeeds in magnifying the consensus distance among the nodes that makes training even more difficult. Depending on the graph topology and distribution of the attackers, although an attacker may not be able to impact every node as in FL, the impact on affected nodes can be higher because some nodes are bound to have 2 f fraction of their neighbors malicious. Figure Figure[demonne demonstrates this phenomenon in P2PL in comparison with FL.
1.4 THREAT MODEL
We have extended the state-of-the-art model poisoning attack, SHE/WALKAR attack Shejwalkar & Houmansadr (202T) in FL to the P2PL case. The malicious nodes collaborate among themselves to access the complete knowledge of the current well as the past state of the benign models. A perturbation unit vector is constructed along the direction in which the average benign model moving, and would be scaled up and subtracted from the past averaged model to send the nodes along the direction of gradient ascent. The scaling factor is chosen by solving an optimizing function that balances between attack impact and stealth, given that know the aggregation technique being used. The attack thus amplifies the distance between an infected and an uninfected node, leading them to disagreement and thereby breaking consensus among the nodes.
1.5 OUR DEFENSE P2PRISM
Our defense based on the key intuition that the direction of the received models should be of utmost importance during aggregation. This is difficult in FL as there is no way for the server to know which clients are benign to use as reference compute the direction of the updates. Naturally, none of the aggregation techniques that are expected to be byzantine-robust in FL make use of this fact. In P2PL, a node can use its own local update as the reference to detect parameter-wiss direction flip in the updates received from its neighbors. It can then filter out suspected updates based on defence policy that we call as PRISM before aggregating the received updates. We describe this policy in much detail in the next section, and use it to completely undo the damage done by the attack, and reviving upto 100% of the benign nodes in a graybox attack and upto 88% of them in a k-regular graph in the presence of whitebox attack.
In summary, our contributions are
We demonstrate the effect of byzantine nodes in P2PL and propose a defense against the state-of- art attack by leveraging the ground truth information available in P2PL as op- posed FL, reviving upto 100% of the nodes from the effect of the attack.
We explore the behavior of P2PL across k-regular and power-law graph topologies and highlight the subtleties involved in training like model initialization that affect consensus among the nodes. We also empirically show how P2PRISM keeps the consensus distance under control.
We evaluate P2PRISM on the image datasets of MNIST and FMNIST, and the NLP dataset of Shakespeare under graybox well fully whitebox adaptive attacker capabilities to prove effectiveness of our defense principle under the ultimate stress-test environment, where upto 88% of the nodes in a k-regular graph and 66% nodes in power-law graph were completely revived even when 1/4-th of the nodes were under the control a whitebox attacker.
2 DESIGN
P2PRISM is instantiated at every node to perform secure aggregation. It provides the node with a prism that blocks the passage of malicious updates into the aggregated model. P2PRISM uses a metric called flip-score Sharma et al. (2021) (FS) to detect malicious updates and helps node keep a record of the reputation score of all its neighbors. The flip-score is expected to capture any large deflection as compared to trusted benign update. A node with model x; sets Vra Fi,t -aa-1
3

---

Under review as a conference paper at ICLR 2023
as the trusted reference. All models that is receives from its neighbors j are adjusted according to this reference: Vziz= = z Fi,1-1. The flip-score of j as computed by is
1P--
FS;-- = Σ [k]))) x (sigm [k)])))) A (sign( (arra())))) K=
(2)
where |P| is the total number of parameters (weights and biases) in the model. Since a node can trust its own update Vru to go towards gradient descent, a high flip-score naturally captures an update that is likely going towards a gradient ascent with either large number of parameters going in the opposite direction with a small magnitude or a small number of them with a large magnitude. Cosine similarity is also based on similar intuition but it does not capture subtle attack that targets model parameters with zero gradients to prevent them from converging. With this, we can say that an abnormally large FS is indicative of attack but it is still not enough by itself without a defense policy.
In FL, byzantine-robust aggregation technqiues such as Trimmed Mean and Median Yin et al. (2018b), Krum [Blanchard et al.] (2017), Bulyan Mhhadi et al. (2018), FABA Xia et al. (2019). FLTrust Cao et al. (2021) and others assume a constant upper limit on the number of malicious 12 nodes (Cmax > 2 That may work when the attackers are not in a majority, by trimming out a fixed number of updates in every iteration and penalizing the reputation of the respective clients. The attackers may, however form a local majority of variable size at different regions in P2PL., and complete security cannot be maintained with constant Cmaz- We describe how P2PRISM handles this in the following steps.
1. Finding the cutoff FS- In P2PRISM, every node finds the minimum (FSmii) and median F$ (F (mea) for all the updates it has received in a given iteration. It then sets a cutoff FS at F' + u(FSmeed FSSmn),, ). where 2 0 is our only defense parameter. A lower μ sets conservative policy whereas a large value sets lenient one. For a robust computation, it is suggested to use a lower percentile instead of the absolute minimum, when the number of neighbors is sufficiently large (2 100 for example).
2. Reward or penalize neighbors All neighbors with FS less than the cutoff are given a constant reward of unit, which prevents a node from accumulating high rewards as compared to others. FS-FSmu
All others are penalized by the variable amount max( FSmee- F Fmin. 5) so that those close to but higher than the median are penalized less than those far from and higher than the same. The penalty is upper capped that a node is allowed to redeem itself if it acts benign in the future.
3. Update reputation The reward or penalty is added to the previous reputation score that was initialized to & for neighbor of a node that has k 1 neighbors. In this way, we make use of the past behavior of every neighbor. The reputation scores are normalized by dividing each value with the total positive reputation score of all neighboring nodes. Avoiding negative weights for normalization prevents the denominator from getting too small. All neighbors with a negative reputation are filtered out by this defense policy..
4. Aggregation - The remaining updates, including node's self update, undergo mean aggregation. A weighted mean weighed by the reputation is intentionally avoided to prevent the effect any existing bias. For example. Nodes with similar updates could assign each other a high weight and isolate themselves from the rest of the graph, and not benefit from collaboration to learn a generalized model. This would also result in higher consensus distance among the nodes.
In order to protect a node surrounded by malicious majority, we also cap its FS to be S 10 F Fmmin Without this, the median value could be poisoned leading to victory of the attackers. The pseudocode of P2PRISM described in Algorithm I P2PRISM is instantiated at every node in the peer-to-peer graph. It is to be noted that we use FS only to trim out the anomalies, that affects the mixing matrix weights every round. Hence the convergence analysis follows from already existing work Assran et al. (2019) that proves convergence for changing topologies under column stochasticity condition. We do not assume a doubly stochastic mixing matrix as in Koloskova et al. (2020) column stochastic as in AAsran et al.) (2019) but for ideal security want all entries in the column for a malicious node to be O. Hence, we only assume it to be row stochastic. The rest of the assumptions are standard as follows-
Assumption #1: (L-smoothness).. We assume that for models x, yinkd, and local gradients V.((.)) of node i, there exists constant I. > O such that [[V) Vf((a)] T. T.lly x|.
4

---

Under review as a conference paper at ICLR 2023
Algorithm Peer-to-peer learning with P2PRISM
Input:
Node i, current model -;(,,
Neighbor updates x, (f + 1, -, neighbors" reputation WR((,j) Output: Aggregated model n; + 1,
Parameters: 1
0: Compute reference vector Vay x.(l+ 1,,) xi((,,)
1: for every neighbor j compute flip-score:
FS, -55==>1 (1Va,, [+]])) x (sign(Vax;)l)) (k]) & (sigm( (xr.
2: Compute cutoff flipscore:
FSmin, m {1
FSmed, = min(median,,(FF
10 FSmin,))
FSt.cut Fmedd + ş X (FSmed,i Fminn.)
3: Penalize neighbors with high FS:
Wa(t ), (x((,, maxf PSmed, PSmina
FS: FSmedd
5}
4: Reward the rest of the neighbors:
Wn(t + 1, (t,t, +1
5 Normalize reputation weights: WR(t 1.5) Enwnttiinno Wa(++15)
Wa(++1.j)
6: Aggregate gradients: 1, = (l,),,) + (109 xz,(1.))
Assumption #2: (Bounded variance). Let &f sampled uniformly from the local data Dj of the - Ch. node, then the variance of stochastic gradients of each client is bounded, that is, Ee-D, [x;{) [x(]]]] o², Vi, Vo and the variance across nodes is also bounded, D (z) f=)) (2vx.
Assumption #3:(Mixing connectivity) To each mixing matrix P(t) at iteration k. we can associate graph with vertex set (1.....m) and edge set (()) = {(..) wi 0}. We assume that there exists finite, positive integers, B and A, such that the graph with edge set U E(4) is strongly connected and has diameter at most A for every / 0.
(k)
We show that for for K greater than a finite limit, =(k) -E 2
converges, that is,
Exn E V (I])) || <.
We prove Theorem in Appendix$A.11 that under the above assumptions, and the definitions above and those made in $A.11, for
(60)
nL
nP2
K 2 mar
(11 Σr wy 10)
1
ET w
/0) x
f
(1-9)²
Vnk
vnk
The weighted mean of the local models converges in at least time K, that is,
DKk'D E
V
1
E'=
(k) wi
(k)
2
f
( Σr wi I
(0) (0)
f
(4)
K
Vn
IMPLEMENTATION
We have performed experiments Every node the k-regular graph was made to communicate with k other neighbors in order to do a k-gossip averaging in every round. In order make the in_reee (the number nodes from which updates are received, including the self node) equal to the out degree (the number of neighbors to which one's updates are sent), the nodes were simulated to be situated around a ring, and symmetric communication was established between node with k nodes ahead of it and
graph topologies k-regular and power-law graphs.
ا= nodes behind it. In paw graph, some nodes are popular with many connections, while
5

---

Under review as a conference paper at ICLR 2023
Table I: Training parameters
Dataset
MNIST
FMNIST
Shakespeare
Model
DNN
DNN
LSTM
batch size
32
32
32
learning rate
0.01
0.01
0.1
n.rounds
500
500
1000
a large number of nodes have only few connections. It is difficult to simulate a symmetric graph where both the degree and out strictly follow the power law, hence an asymmetric graph was constructed with only the ie_regree of nodes adhering strictly to the power-law in order to test the effectiveness of P2PRISM aggregation. To simulate this, the minimum degree was chosen as user input & while the maximum in degree (dego) equals m/2, where m is the total number of nodes in the network. random node would be simulated with in in_derree= = dego- 2 with degı, with dega. and so where k = degtoggm < deggoggm-1 < ... < dego- m/2 are in geometric progression. There would be I another node with in degree = m to ensure that the in degree distribution is in adherence with the power-law and all nodes have been assigned some in degreee value from the available degree values.
out of m nodes were randomly chosen to be malicious with their models crafted with the SHE- JWALKAR attack with unit vector perturbation in every iteration. The source code was obtained from httph:ttt//// /tttpss://gtthb.. www. vttt/vvtlle sh
-Model-Po soning and the same attack parameter (Ao = 10.0) was used. The gradient descent direction was estimated by accessing the current and past average of the models from the benign nodes. The attack assumes a mean-like aggregation being used to optimize its À value.
Every node was made perform one iteration of local training (1 = 1) on its minibatch, after which one round of gossip was performed. We use the image datasets of MNIST and
MNIST (et al.] (017). and the NLP dataset of Shakespeare Caldas al.] (201)) for our experiments, trained with a DNN and an LSTM respectively. We report the test accuracy for the image dataset and the test perplexity (= 21st for the NLP dataset as used in the standard practice. The training hyperparameters are described in Table
The DNN used to train MNIST and FMNIST consists of two CNN layers with 30 and 50 channels respectively, comprising of 3x3 kernels, the two layers being separated by 2x2 maxpool layer, and followed by two fully connected layers of 200 and 10 neurons. The LSTM used to train Shakespeare consists of hidden layer with 128 neurons between the input and the output layers. For the defense, a default value of μ = 0.75 was used against the graybox attack and μ = against the whitebox use the 0-percentile, that is the minimum
attack. Due the small value of k used in simulations, flip-score value to set the upper bound of permissible flip-score. For comparison, the benign baseline of gossip averaging was used. In the malicious case, the baseline used was Trimmed Mean (TM) aggregation with Cynrr, the Cmaz,ú number of received gradient values from both the higher and lower end out of the k; values received based on their magnitude for every model weight and bias. The gradients here refer to the difference between the current received model from a neighbor and one's 's own model from the past iteration. By default, we choose m 128 and the data was distributed in non-lID manner with a bias b of 0.5 for the image datasets, both of which had 10 classes. The nodes were divided into 10 groups and a data sample with label was assigned to group index / with a probability b " Within the group, the data samples were distributed randomly among the clients. For the NLP dataset, the data was divided sequentially (which is also non-IID) into m + chunks, one for each client and the last chunk for testing.
stk for every node where k is its number of neighbors. This trims
m
and to any other group with a probability 1-b
EVALUATION
We first demonstrate how P2PRISM stops the spread of graybox attack one that only knows that a mean-like aggregation is being used but is oblivious to the details of the defense; and helps the benign nodes recover. Then show how P2PRISM keeps the consensus distance of the graph under control which is most necessary for decentralized peer-to-peer learning. We then proceed to stress test P2PRISM under whitebox attack where the attacker also has access the defense

---

Under review as a conference paper at ICLR 2023
Hacro
c-16
Defesse
Ied
lelt led2 spant F2PRON
bele
acounry
Tesl perpiciiy
Tiienod Micss FORESM
Tisst acourazy
Text porportty
2.5
06
0.2
010 MMM51 -#1001
38 auccusuu
Figure 2: The figures show the final test accuracy (perplexity for Shakespeare) candles of the benign nodes comparing Trimmed Mean and P2PRISM under malicious conditions c//m = 1/8 in the left and c/m 1/4 in the right figure, along with the baseline benign results for Gossip Averaging in the left figure. For every dataset, the last bar corresponds to a power-law graph while the rest denote k-regular graphs.
MNIST, m=128, power-law
Shakespeare, m=128, power-law
0.9
Cons dist
0.8
Trimmed mean, MNIST c-16
0.8
Trimmed mean, Shakespeare c=16
Trimmed mean, MNIST c=32
Cons
Trimmed Shakespeare
0.7
Rounds
0.008
Cons dist
0.4
0.006
P2PRISM, MNIST c=16
0.2
P2PRISM,
0.004
P2PRISM, Shakesspare c-16
P2PRISM, Shakespeare
0.0
100
200
300
400
500
600
Rounds
Rounds
Figure 3: The figures show how consensus distance among the benign nodes changes during training. We show the results on one image dataset MNIST on the left and on an NLP dataset - Shakespeare on the right. The graph topology chosen was power-law to mimic realistic setting with A = 8 for c = 16 and & = 16 for c = 32. It is very clear how P2PRISM keeps the consensus control low as compared to Trimmed mean in malicious environment.
algorithm, its parameters, and the cutoff flip-score in the past iteration beyond which all models were penalized. We find that the flip-score generated by malicious clients the graybox attack are easily distinguishable from the benign ones due to the flip-score value being too large than the benign values and the detection rate not affected by the defense parameter at all. Therefore, we use the whitebox attack to show the effect of varying μ where the malicious and benign flip-scores are indistinguishable.
Figure shows the candle plot of test accuracy under different conditions. The lower and upper ends of the candle correspond to the 25-th and 75-th percentile final test accuracy (or test perplexity for Shakespeare dataset) respectively among the nodes, and the ends of the candle wicks correspond to the lowest and highest final test accuracy at the end of training. The attack completely damages random test accuracy of 10%. This is also evident from
P2PL without any secure aggregation the level of impact that just malicious nodes had in Figure We do not show that in the plots here. We see that Trimmed Mean fails against the attack because of two reasons 1) Magnitude based filtering is inefficient against gradient ascent attack, and 2) a fixed value of Cmar although suitable for FL does not work for P2PL where the fraction of malicious nodes differs in every neighborhood in any practical case. We also observe a clear separation between the performance of Trimmed Mean and P2PRISM where P2PRISM is very close to the benign standard of Gossip Averaging, and is in some cases even completely overlapping with it. A small dip in the test accuracy could be explained from the fact that the malicious nodes attacked in every iteration and hence nothing was learned from their local data which did contribute in the completely benign case. It is important to observe that P2PRISM excels for both the graph types k-regular and power-law across all the datasets used.
7

---

Under review as a conference paper at ICLR 2023
Defense against whitebox attack, m=120, c=16, mu=
Defense against whitebox attack. m=128. c=32. mu=0
1.00
1.00
Test accuracy
lee8
Test perplexity
Test accuracy
Iw16
perplexity
0.75
K-16
88
0.75
1432
k-8 (p-law)
kn32
0.50
(p
0.25
10
0.25
0.00
1.00
0.75
0.75
0.50
050
0.25
0.25
0.00
0.00
Shakespeare
MNIST
FMNIST
Shakespeare
Figure 4: The figures show the performance of P2PRISM against a whitebox attacker that crafts a stealthy attack with full knowledge of the defense and its parameters to bypass the prism used in the defense. We consider the attack successful if it drops the test accuracy on MNIST below 0.8, and on FMNIST below 0.65, or if raises the test perplexity on Shakespeare above 8. We observe that with = 16, P2PRISM was successful in preventing all benign nodes from being infected. With c = 32, P2PRISM could restrict the number of infected nodes below 6% for a k-regular graph and under 34% for power-law graph.
Next, we show how P2PRISM keeps the consensus among the benign nodes under control even in the presence of the attackers. In P2PL, every node can have a different model state, but as long as they are close each other, they are all moving along the same trajectory towards the same global solution. We set the nodes to be at consensus initially. Naturally, as they train, they are going to drift from each other unless the graph is fully connected. The attackers try to spread dissensus among the benign nodes by infecting their neighbors. After a certain point, even if the attack is stopped, the existing dissensus may inhibit training as the nodes with disagrecing models collaborate. P2PRISM shows how, as in Figure 3 by identifying and filtering the malicious models based one's flip- score, such a dissensus scenario is prevented. Having shown the success of P2PRISM against a graybox attack where the attacker was not aware of the details pf the defense being used by the nodes, we present a whitebox attacker at time that not only has access to the defense parameter ju, but also the minimum, median, and cutoff flip-score of all the clients / 1. The attacker uses this information to craft the attack at time / by optimizing the attack parameter so that the expected flip-score will be less than the cutoff flip-score time a highly personalized attack and the information from the past, that is, from t is used because the median, minimum, and cutoff values at f determined by a node only after receiving all the updates, while the attacker is yet to craft its attack. Given that every node just runs one iteration of local training, and the training trajectory is smooth, the estimation done by the attacker based on one timestep in the past is extremely accurate. The malicious and benign flip-scores are now indistinguishable and the defense is bypassed. However, we observe that this stealthy attack loses its damaging impact as a trade-off most of the time. We see in Figure 4 that P2PRISM could save 100% of the nodes from being infected when e/m = 16/128 = 1/8. However, on increasing the number of attackers to 32, that position themselves at random locations in the graph, the attackers do form a majority at some neighborhoods and are able to attack the benign nodes at such vulnerable locations. This number is very small though, as can be seen in Figure 4 that the attacker could infect less than 6% of the benign nodes in a k-regular graph and less than 34% in power-law graph. Although the power-law graph seems be infected, stealthy, and controlling 1/4-th of the popular nodes becomes too powerful. This shows the limit of malice upto which P2PRISM can be expected to provide perfect security, after which, saving all nodes from being infected cannot be guaranteed. was set to zero to allow the defense to be conservative against an attacker which is too powerful.
for the node being targeted. This is
only because the attack, being whitebox,
We take this opportunity to also demonstrate the effect of sweeping μ.. With higher μ4, the flip-score cutoff increases, thereby giving the attackers an opportunity to be stealthy even with higher attack magnitude X. Thus, the stealthy attack may still be damaging as the detection threshold is not as sensitive anymore. We see the same trend in Figure 5 where the whitebox attackers are able to impact more and more nodes as μ increases, however this increase is too gradual and it reflects the robustness of P2PRISM. This also empirically shows why we have chosen a default value of y 0.75 for all our experiments with the graybox attacker. It is always recommended to low
8

---

Under review as a conference paper at ICLR 2023
agarnt
Celerse wtdeboc atteck, me128, en32,
Deferse aganst whteee atted, me-128. C-32, maad
1.0
050
030
1015
030
690
349
1.0
1:0
100
030
050
030 M5.77
-025
4.5%
52% 75%
30%
Figure 5: The figures show the effect of sweeping the defense parameter against whitebox attack on MNIST and FMNIST in k-regular graph with m = 128, c = 32. With increasing μ., the cutoff flip-score increases for every node and a relatively stronger attack can get the opportunity to be stealthy and bypass P2PRISM. Hence, we see a gradual increase in percentage of infected nodes. However, even with high value of mu = 4, this increase is very slow the fraction of infected nodes stay below 12%, thus proving the robustness of P2PRISM, that is, low sensitivity with respect to this parameter across large sweep of its parameter.
for conservative defense, however, this experiment proves that the performance of P2PRISM is not too sensitive with respect to its parameter J.
CONCLUSION
In this paper, we have presented secure aggregation for nodes participating in collaborative learning as each others' peers. We began by introducing the concept of peer-to-peer learning in comparison significantly
with federated learning. We saw how the consensus distance model initialization affect the training process and stressed on initializing all the participating nodes with the same model. This is extremely important aspect of the training process but has been ignored in the context of decentralized collaborative learning. We also discussed how P2PI. is differently affected the graph connectivity, the number of gossiping
by byzantine nodes as compared to FL depending steps per round, and the location of the malicious nodes, Unlike FL, an attacker can have full access its neighbors' models via gossiping and can launch personalized attack. At the same time, every node has access to its own trusted benign gradient updates to compare all incoming updates with, and unlike FL, a node can perform a trusted secure aggregation for itself, given robust defense policy. We leveraged this fact to construct our own defense policy, P2PRISM based on the concept of flip-score that can protect a node even its surrounded by a malicious majority in its neighborhood. We evaluated P2PRISM against the state-of-the-art model poisoning attack and compared it against the secure aggregation protocol of Trimmed Mean by extending it to the decentralized learning domain. P2PRISM could successfully recover all benign models under graybox attacker, while also maintaining a low consensus distance among the benign nodes across all the three datasets of MNIST, FMNIST, and Shakespeare both the k-regular and power-law graph topologies. This was followed by a stress test of P2PRISM against a whitebox attacker that also has access to the defense parameter in addition to access to all the benign models, that can launch a highly personalized attack to each of its neighbors. We saw that P2PRISM could recover all the being node even the presence of this extremely powerful attacker when only 1/8-th of the nodes were malicious. However, when the fraction of malicious nodes go up to 1/4, some benign nodes begin to be infected, but their fraction is contained to less than 6% for k-regular graph. With power-law graph in the presence of such a powerful adversary controlling 1/4-th of all the nodes, P2PRISM could only save 66% of the nodes from being infected. We also swept the defense parameter under the presence of this whitebox attacker to show the robustness of P2PRISM across a large usable range of the parameter. P2PRISM could successfully contain the infection within 12% of the benign nodes. With this, we conclude the evaluation of P2PRISM and propose its usage at every node decentralized learning architecture for the best possible security against model poisoning attacks.

---

Under review as a conference paper at ICLR 2023
REFERENCES
Mahmoud Assran, Nicolas Loizou, Nicolas Ballas, and Mike Rabbat. Stochastic gradient push for distributed deep learning. In International Conference on Machine Learning, pp. 344-353. PMLR, 2019.
Mahmoud S Assran. Asynchromous subgradient push: Fast, robust, and scalable mulli-agent opti- mization. McGill University (Canada), 2018.
Mahmoud Assran and Michael G Rabbat. Asynchronous gradient push. IEEE Transactions on Automatic Control, 66(1):168 11)):66-883,, 2020.
Peva Blanchard, Rachid Guerraoui, and Julien Stainer. Machine learning with adversaries: Byzan- tine tolerant gradient descent. In Advances in Neural Information Processing Systems, pp. 119- 129, 2017. Krum paper.
Sebastian Caldas, Sai Meher Karthik Duddu, Peter Wu, Tian Li, Jakub Konečný, H. Brendan McMa- han, Virginia Smith, and Ameet Talwalkar. Leaf: A benchmark for federated settings. arXiv preprint arXiv:1812.01097 2019.
Xiaoyu Cao, Minghong Fang. Jia Liu, and Neil Zhenqiang Gong. Fltrust: Byzantine-robust feder- ated learning via trust bootstrapping. arXiv preprint arXiv:2012.13995 2020.
Xiaoyu Cao. Minghong Fang. Jia Liu, and Neil Zhenqiang Gong. Fltrust: Byzantine-robus: feder- ated learning via trust bootstrapping. Network and Distributed System Security Symposium, pp.
1-18, 2021.
Liam Fowl, Jonas Geiping, Wojtek Czaja, Micah Goldblum, and Tom Goldstein. Robbing the fed: Directly obtaining private data in federated learning with modified models. arXiv preprint arXiv:21 2021.
Clement Fung, Chris JM Yoon, and Ivan Beschastnikh. The limitations of federated learning in sybil settings. In 23rd International Symposium Research in Attacks, Intrusions and Defenses (RAID 2020), pp. 301-316, 2020.
Jonas Geiping, Hartmut Bauermeister, Hannah Dröge, and Michael Moeller. Inverting gradients- how easy it to break privacy in federated learning? Advances Neural Information Processing Systems, 33:1 6937-11477, 2020.
Rachid Guerraoui, Sébastien Rouault, et al. The hidden vulnerability of distributed learning in byzantium. In International Conference on Machine Learning, pp. 3521-3530. PMLR, 2018.
Anastasia Koloskova, Nicolas Loizou, Sadra Boreiri, Martin Jaggi, and Sebastian Stich. A unified theory of decentralized sgd with changing topology and local updates. In International Confer- ence on Machine Learning, pp. 5381 3381-5339. PMLR, 2020.
Jakub Konečný, H Brendan McMahan, Felix X Yu, Peter Richtárik, Ananda Theertha Suresh, and Dave Bacon. Federated learning: Strategies for improving communication efficiency. arXiv preprint arXiv: 2016.
Lingjing Kong, Tao Lin, Anastasia Koloskova, Martin Jaggi, and Sebastian Stich. Consensus control for decentralized deep learning. In International Conference on Machine Learning, pp. 5686- 5696. PMLR, 2021.
H. Brendan McMahan, Eider Moore, Daniel Ramage, Seth Hampson, and Blaise Agüera y Arcas. Communication-etficcenn learning of deep networks from decentralized data. In AISTATS, 2017.
El Mahdi El Mhamdi, Rachid Guerraoui, and Sébastien Rouault. The hidden vulnerability of dis- tributed learning in byzantium. In Proceedings of the 35th International Conference on Machine Learning (ICMI.), pp. 3521-3530, 2018. 8.. Bulyan paper.
Atul Sharma, Wei Chen, Joshua Zhao, Qiang Qiu, Somali Chaterji, and Saurabh Bagchi. Tesseract: Gradient flip score to secure federated learning against model poisoning attacks. arXiv preprint arXiv:21 10. 10108, 2021.
10

---

Under review as a conference paper at ICLR 2023
Virat Shejwalkar and Amir Houmansadr. Manipulating the byzantine: Optimizing model poisoning attacks and defenses for federated learning. In NDSS, 2021.
Qi Xia, Zeyi Tao, Zijiang Hao, and Qun Li. Faba: An algorithm for fast aggregation against byzan- tine attacks in distributed neural networks. In IJCAI, pp. 4824-4830, 2019.
Han Xiao, Kashif Rasul, and Roland Vollgraf. Fashion-mnist a novel image dataset for benchmark- ing machine learning algorithms. arXiv preprint 108.0777000077477 2017.
Dong Yin, Yudong Chen, Ramchandran Kannan, and Peter Bartlett. Byzantine-robus: distributed
learning: Towards optimal statistical rates. In International Conference on Machine Learning, pp. 5650-5659. PMLR, 2018 8a.
Dong Yin, Yudong Chen, Ramchandran Kannan, and Peter Bartlett. Byzantine-robust distributed learning: Towards optimal statistical rates. In International Conference on Machine Learning, pp. 5650-5659. PMLR, 2018b.

---

Proof: We make modifications Lemma 3 in Assran et (2019) prove our inequality. It is to be noted that former analysis assumes column stochastic mixing matrices, which have the property that when premultiplied by row of ones (1 the product equals 1TT Whereas, in our case, such an operation results in a vector w each element of which represents the column sum of the mixing Under review as a conference paper at ICLR 2023
A APPENDIX
A.1 CONVERGENCE ANALYSIS
Theorem 1: Here, we show that, under P2PRISM, the weighted mean of the local models con- verges in at least time K, that is,
E E
VS
D
w
(R)
2
21 W0
I
(0) 5
-
(5)
K
VnK
where,
(60)
nIACAPP
nP2
K max
(6)
(1 (1-9)a
1 27 wy (0) (0)
2'
Er my 10:
(0)
f
(1 (1
VnK
VnR
For Assumptions 1-3 to be valid, for the sake of analysis, we assume all n nodes to act benign within bounded variance, and show that the standard decentralized algorithm, z(k) 1 E (k) achieves convergence under mixing matrices generated by P2PRISM. We modify the convergence analysis in Assran al. (2019) by replacing column stochastic mixing matrix with stochastic one, under the protocols proposed in P2PRISM. We describe the complete proof in great detail below.
Theorem 2: Under the same assumptions in Theorem 1,
K-1
W
(4)
(K) I1
x;
(k)
0
K K3/2 k3/22)
+
nK
k=
i=1
K
1
1
E
V
0
+
K
VnK
K
K3/2
k=U
1=1
That is, the parameters at each node converge as well.
Lemma Under Assumptions 1-3, letd nD-BB and q X Aat-i, then there exists (R) 2/2 (1+=2) where d is the dimension of x for all i 1,,2, and 2 O. n is the number of nodes. The communication topology is B-strongly connected. To each mixing matrix p(k), we can associate a graph with veriex set (1..... and edge set F(k) {(i.j) w 0). B-strongly connected means that we can assume that there exists finite, positive integers, and A, such that the graph with edge set Uk-1B (1+1)B-1 E(k) strongly connected and has diameter at most A for every i 2 O. Then
constans C Zvān
AHIT
X3B1I
1 n2
(k) r
(k)
(b) 2
Cq
(0) 1
+ 10
k- VFF (0) .
(8)
matrix. We prove in the following lemmas how this modification affects the convergence analysis. Lemma 3 Assran et al. (2019) says-
Suppose that Assumption (mixing connectivity) holds. Let
nD -r+ ()AB and g = 11(([+1])AB1]) where is the delay in asynchronous communication among the nodes. Then there 2/
exists a constant C <
where d is the dimension of (k) 2, (k), and x; (0) such that, for
(1 11158
A (41181--1
12

---

Under review as a conference paper at ICLR 2023
all i 1,2,..... (non-virtual nodes) and lt 2 0 such that
& [(()] = 2/00| S Ca lef + + Σ
V. (2
(2))) - "11
(9)
s=0
where = is the unbiased estimate of in their problem formulation. This lemma itself follows from small adaptation Theorem Assran Rabbat (2020) that is proven in Assran (2018). We show the modifications make in the former proof to achieve our result. It is shown Assran (2018) that
1 (x) (1++1
C
||
+
E
In
1 (A)
(10)
n
8min
Ōmin
n
where 17 is the local update made by node after gossip averaging shown in the expression below.
(1) (0) + m)())
22)) =p(1) + +1²
=p(1)p(0 2(0)/(0)) (0)
+ ,7)) + 17
k-
In general, (k) -II -- p()) (0)
Σ nbD ,) + tn
(1I)
If P column stochastic, then P 1 This fact used to simplify the above equation by premultiplying LHS and RHS by 1T to obtain (T) = 10) + E 1T 17700) which leads to
the inequality [ (8)
< (T)
s=1 || [| s || n Σ || This when
plugged in 10 leads to with C Om
We modify above analysis by replacing 1 by (x))
where
Σ w
n. Premultiplying by (A) results in the equation
(k-1)
w (K) (8) w (1 + w
Σ
p0i + ()))
We now use the fact that the product of two row-stochastic matrices also row-stochastic, and we represent all products of matrices above by single matrix, simplified as
k-1
(h) (k) (kk) Pox (0) + (k)
Σ
Pay + (,))
Absorbing the rightmost term into the summation assuming an identity matrix P (that is also row stochastic) and applying the triangle inequality, we obtain
(x) < (k) Pa (0)
+
w (k) Pan
Upper bound elements of P In construction, the mixing matrix P is row stochastic, and every node gives equal weights to all its neighbors that pass its PRISM. Assuming every node chooses to aggregate the model from least one of its neighbors in every iteration, allotting weight of 1 2 to itself and the neighbor, therefore the upper limit on the column sum W; is 2 for node This happens when every node j chooses aggregate only two models, that are, T; and 2y, and allot of weight of 0 to all other nodes. Thus, if we consider the vector w' = wP, where P is any row-stochastic matrix and w is the column sum of any row-stochastic matrix, then the th element wi equals E, wyCs. where e, is the i - th column of P. We have the j th element of w/,
E, WyCt. S (E, W3) Ex c.. 2/2
(2) Hence, for all such w, P. we have || < n2
that is, || < 2
We obtain that ((0)))))(())
n
3/2
[0)
3/2 >
||.
Plugging this in 10 we obtain back
2
9 with C Jmen
1 +
n
3/2
Therefore, the lemma described in Assran et al. (019) for column
13

---

Under review as a conference paper at ICLR 2023
stochastic matrices remains valid for row-stochastic mixing matrix well but for different constant C. Now we substitute T = 0 since our setup is synchronous to present the upper bound on
our constant C, that is, C' 2van (1+ 2//2 ) where À 1 nD and q = À \ Since
A (.
our setup. zi = Ti, we substitute back to complete our proof.
Lemma 4: (Bound of stochastic gradient). We have the following inequality under Assumptions and 2:
|'
E
V
f
||
(1) s
3
(K)
Wi
(k)
21
(k) +3
+36²
V
Σ
mi
(k)
(k) (12)
1=1
n
Proof:
V
(11))
)²
Sauchy-Schwarzz S
V
x
(A)
1/
Σ
wi
(k) (k)
21
+ 3E
V
12
W
(1)
x
(1)
4.
12
(8)
(K)
3E
1
1
Wi
(k)
(k)
n1
smsmooth
3L
(k)
W
(k: (k)
11
+ 3E
f
1
Σ
wi
(k) (k)
4
ト
(K) (k)
I
72
t=1
n
(k)
+ 3E
f
W 11
Bounded Variance
3
(k)
w I
(K)
+ +352 + 3E
Vf
Σ
n
(K)
(13)
Lemma 5:
Under Assumptions 1-3, we have
Q ())
E
w
(R) (k)
x
(K)
< 2 (1 - 9)²
4C2
+ g²0²2
1-9
0² +
(92
(1 q)z
1202
+
g
C2T
+ 300
Σ
Egp- x(-sQ(1)
1-9
12C
1-1 74 $302
Σ ディーー v
Σ
( (1)
2k C2 + 7 20a
|
+
1 1- 9
(14)
14

---

Under review as a conference paper at ICLR 2023
Proof: Let us define,
1 7
Q
kk
=E
10 21
(k) (k)
xz (8)
n
[ :
?
Lemma 3 S
E
Cq
1
(0)
(2)
||]
(0) {( 1/i /.((1 ( (
) + 1 (((1)))
=
[C
(00
0
<B(Ca*
x
(0)
( ) V.. (216)
 |
+ 
|
Thus, using the above expressions of a, b and we have that 0
E (a² + 152 + c² + 2ub + 2bc + 2ac). Let us now obtain bounds for all of these teeeeeggieee
quantities.
d² = 1 (0)) /
x
(1))) --0 - v. (4) |
8 17-00
2
Σ
2(6
k
k
( -
- v.. 1./(/// ( ( 44 ) v V ( (9))
+ +2
0² 2
E V (1.0)
Σ
11
1=0
2
k E
22
(6)))
/
+ " Σ Σ
k
( (100
( 4 3 (24
19::166 -
2ab 206 22 2²
(0)
(1.
2 2ac=0 2 2 /
(0)
Σ
(z)²))
2bc= 2 2
Σg'
(4.") (()) v.. (1.e) 44 (1:
226
Fi
j 0 0=0
15

---

Under review as a conference paper at ICLR 2023
The expression Lj is bounded as follows:
b = Σ Σ
j
22
VF: (2())-0))) Vsi (z! ||| VF: (2) Vsc (z.*)
Sx²C2
2k sーン
VF; a (4()= -5) Via (2
using 2ab W a² + b².
j=
0²
2 2
VF 1/ -(
Vy. (s\*)
4
0) (0))) 4y (o
VF
)=
VFF (z(5)) ((1)) - Vs. (2 )|²
C²
3=0 ==0
4
VF; 0 (())) vii (o,0) /| Σ gt-s
= C²2 Σ q
j=0
==0
0² Σ
VF;
((()) Vii (.<"://
==0
1=-
C2
FF:
Al (z.7) ||
using
Σ
p
<
1
for < 1
r
1=0
k=0
1
VF. (1 (.0)) V. -.:(1))) |
2
==0
2
VF: (,."):,(])) - -V (2.0) ||:
C2
x3) ;
1
1=0
(16)
Thus,
12 7 Σ Eg 2(h
VF, (2. - v%, (oo0) 1 + b
0=
C2 k
VF: (1(2)(())) -s: (s,²))² ||² b
9 3=0
(17)
16
C²
Σe
k
b-
vF: (1(²)) -
- -v (0(())) (x, (I²
1
1=0
By identical construction we have
2 -
C²
Σ
V4 (I
1 1- ==0
16

---

Under review as a conference paper at ICLR 2023
Now let us bound the products 2ab, 2ac and 26c.
2ab
02 qd q
8-
22
x, 10)
VF.
(2/)te))) - (s
Aー VF, (200
v. (a(²) || + +x0 of Σ
~
1.00
using 2ab s +...
j=0
1=
Sncpg' Σ
kーj
RR. (2f -v,:
V.: (xt²) 2 |2
702
22
(0)
using
Σ k=0
K
k
1
for
<
9
1
1=
(18)
By similar procedure,
2ac S gf Σ gtt V (,/")[[= 7C22
(0)
(19)
Finally,
2bc 22
j 5-52 VF; (x() (2?7:50) - 1y (o.0)
f=0 s=0
0²²C²
2k
Pp (1 : (())) - V. (z!hi) 1
+
C²
V
(
/=0 x=0
= -² Σ 1-1
VF:
Vi (11²)) Σ
1=0
$=0
==0
22 k
FF; (2))))((0)) - vI (o)3)) ||
+
C22 k
9
k-
V
|o
1-9 1=0
9 ==0
(20)
By combining all of the above bounds together we obtain:
Q! (k)
< (a²
2 b² + +22
2ab + 2bc + 2ac)
C2 k
S E Σ
VFF 22(00 -(()))))
V.. (2)))<())- -V..
1 1-
1=0
2² k
Σ
V (1:²)) \1²
+E
1-q 9 1=
+02 24 |0
2
q
(21)
(0) 2
2+02
1 1-9
|
+ +ByC2g/
*
Σ
h-j
V/
1=
+E,029* g
Σ
VF
(,."):=(²)
vz. (=."))²²
1=0
17

---

Under review as a conference paper at ICLR 2023
After grouping terms together and using the upper bound of Lemma 4, we obtain
s
2
(1
4C2
1)²
+
g²
1
o²+ +
(22
1 I-
20
|0:00
92 1-9
4C2
+ C²
Σ
V (1. (1:
+
1=0
Lemma
( 402
12
+7 C²²
0² +
(2* + +7 1- )
20²²
) | |0/
q)²
12C
+
72 (1 - q)2
5²
(22)
1-9
(3 1-9
12
#
b1a 3L
Σ
+
1=0
2
(1 12C 1-q + 7 3C2
Σ
Σ
11) wi
+
71
Having found a bound for the quantity Q.ah let us now present a lemma for bounding the quantity EK-1 M(k where K > is a constant and (k) is the average ((a)) across all (non-virtual) nodes
E [n]. That is, (Kk) 1 n E.= 0,a0
Lemma 6: Let Assumptions 1-3 hold and let us define D2 = 1 -
12L2C2 3L2C2 Then, (1-0)=
-11-))
K-
4C²
C²
<
O²K+
("
0²
(1 -1-97 D2
km
x² 120²
/3302
+
x² +
5²
(1-9)222
(1-
2)2
(23)
C
20²
n
I [0)
2==1
+ 7
2)2
'11 11-9)- D22
n
12C²
302
K-1
1
(k)
|'
2
+
D)
+1 (1-9)a22
IE
A=
Proof: Using the bound for Qf (k)
let us first bound its average across all nodes (R).
1 n
((k)
!
(
n
Lemma
(,2 (1 1)2
4C2
C²c²
120²
+ g
+ 7 1-9
0² +
72
(1 --)
2
(62 1222 300
1 n
+
E
V
wi
(A) (K)
x
1-9
n
(24)
1=0
(,2 12T
+ 13
Σ (()
1 1-9
22 + 7 202²
Σn
x 1011
+
1- 9
18

---

Under review as a conference paper at ICLR 2023
At this point note that for any À E (0, 1), non-negative integer K N, and non-negative sequence [36)}, j= it holds that
K k
..... A R- (-- = 3(0) (AK + - +... +.................. 10) + 3(0) (AK-1 + + +........ 10) + + +((() (20)
k=
j=0
BG
j=0
(25)
Similarly,
K k ΣΣ
K k
(18)
Σ
22 ((L
ΣΣ
2)
g(و
(
(26)
x
k=
1=0
k=0 1=0
k=0 j=0
j=0
Now by summing from 1: to K - 1 and using the bounds of
25 and
26 we obtain
M (k) 1 72 402
C
oKK +
0²
(1 -12
(11-
9)²
+ ? (1 - 7)²
12
C²K+
73
5
(0) 2
C
20a
Σ
2
+
(27)
q2
(1 - 9)
n
12C²
9)
1
302
K-1
E
V
1
Σ
wi
(k) (k)
k=
(2
C2L2C2
02
K-1
(()
(1- 9)2
1 - q2)
A=
By rearranging:
1 1 2
12L2C2
[1-g)²
7
02 K-1
1 q2 k=0
Σ (k)
22
(1 q)²
402
o²K+
(211-
C
9)2
d²
??
1202
730
( +
(1 9)3
9)
C
20a
Σ
+
q2
(1 9)2
1202
+ 7 30
K-1
(1 q)²
9²
Σ
vs
Σ
w
(k)
(k)
k=0
(28)
19

---

Under review as a conference paper at ICLR 2023
Note that since g E (0, 1) it holds that
(1 (1-9)2. Thus,
1
1-03
(1- (1-72 12L 32
K-1
4C²
C
(1- o)2 (1 q)2
Σ
(kk
x
- 1)3
o²K +
(11
9)²
0²
K=
7? (1 q)²
12C
R +
730
q)2
C²
20
+ + (1 (1-9) q)²
(1 q)²
n
1202
3C
K
2
72 (1 q)²
+ (1 - 2)
E
V
Σ
wi
(K)
x
72
h=
(29)
Dividing both sides with D2 D2=1-1y
2222
c2 (1-9) 0)²
3L2C2 (1-q)2
completes the proof.
Lemma 7: Under the definition of our problem and the Assumptions 1-3 we have that:
(k) E w
VF;
(1))
(K)
E
w
(N)
V F
(K)
(K)
5,4)
n
nh
Σ ii= W
(k)
fc
+ 5/-
n
Σ Li=1
w
(1)
F;
(R), ((
vf: (2/(1)
(ii)
5(K)
n1
Proof for (i):
Σ
wi
(k)
VF,
(k), (b)
:si
Σ E1 wi
(k)
VF;
x
(k)
((k)
V (2)(k)
Σ w
(k)
V
x
(k)
2
E (1(")
E (A)
Σ i=l
w
(b)
VFF
x
(k)
(kk)
V (2((k)
(k)
Σ 1i
w
(k)
V
T3
(k)
2
+ E
(k)
E Bedes
V
(1
(1,a4, 19t
c()))
V (1
Em
(k) V.fe
(k)
1=
+ 2
n
72
Σ 1i=1 wi
(k)
FF;;
x
(k) (A)
Vf
(K)
F (M)
Σ
1= w
(k)
Vif
I
(k)
2
+ E (6)
(30)
20

---

Under review as a conference paper at ICLR 2023
where
in the
last
equality
the inner
product
becomes
zero from
the
fact that
V
p.
4
V fi
Proof for (ii):
Ei=1
w
VF;
(4)
Ei= mi
Vis
(K) 2
E (2)
(1)
Σ wi
VFi
x
(k), :5 (8))
v.f 22
(k)
2
n
(w) 2
F. x (1)) (..
1/ (z.+)) |
5((4)
22
+ n
E (())
20 (1))))
VFF
x
(k) (()
fy (z.4)) }
(31)
E (K)
(K)) ?
|
(k), 5/
(k)
- Af (z.+))
E (N))
2
i=1
2
wi
(k)
2
o²
n?
Σ
wi
(k)
n2
11 o²
[ 1²
/12)
)
Lemma 8: Let Assumptions 1-3 hold and let D1
and D2 1
2
2
(1-9)-D2
2 12L
(1-0)= 7 32202a
(1-
Proof:
I (3((+2))= = (x =ʃ ((() [P()]]
1 VVF (x(*), g(k)) [P(}] T
1a
n
n
since (k++1) = [x - -VF (x()), g(+))]
[p(N]]
1 = ((k), where each element of w is the column sum of P. Since P is row-stochastic, that is, every row sum equals hence the sum of all elements of with rows equals Therefore, Er (A)) For column-stochasto P. (k) 1, in the formulation in Assran et al. (2019)
[K]]]] T
and Koloskova et al. 2222)). but we will be continuing our proof without assuming w 1g, and show convergence.
(0))
FF ((k)) (e)
(z(bt2)) =f
4- smooth 5
(x
(v/ x (o()
VF (())) (b)
L
VF (X (x(+) gg(k)) (k)
/
V
n
n
2
n
(32)
Here use the L - smoothness inequality: f(y) < f(x) + V)(x)T(y z) + -11l =11
Taking expectation on both sides conditioned on Fx:
21

---

Under review as a conference paper at ICLR 2023
X
((K)
X (4())) ((()
V F (X(*) w(()
f
Fx
ss
- -2 vs
n
n
n
71
L2²
VF (x()), (()){(()) (x((k)
2
+
F
n
X x(0) (1))
X (19) (1())
VF (X()) w((A)
Lemma 7il
7 ff
n1
n
72
T2² E
E wi
(k)
(x:aa) (k), (k)
TL
i-
(k) W V (2((1)
2
F
12
(k) Vft
(k)
Lg² E
xi=l w
FF
n
(x() w0())
X (1)) (k)
V F
X (k) (()
Lemma 7ill f
vf
n
n
n
1720²
La²
Σ Di=1 W
Vi
(40
2
E
|
2
2
n
X (k) (k)
X (4) (x)
VF (K) (k)
7
Y
=f
4s
n
2
n
2
n
x(1) (0))
VF (x)
(k)
2
L7
f
+
2
n
n
L
Di=1
n
W
(k) VJz V 213
(k)
2
E
FR
n
(33)
where in the last step we expand the inner product using the expression ||a 1 b1]2 = ||a|2 + 11611 (a, b).
Now taking expectation with respect to F& and using the tower property, we get,
x 1k
(1) (N)
? E
X (4)
(x))
? E
VF
[ (2))
w (2)
f
E
12
7
n
n
+ 2 2
X (0)
V
x (6) (k)
27
V
n
n
Σ w V.f (2((0)
L7²
+
E
2
n
E
X (4) (()))
)
-
7 E
X (K) (k)
27
L
E
VF
X (k))
(k)
n
2
+ B
x(() (0))
V F
(x (6))
(k) 12
L72002
4
2
72
n
2
(34)
22

---

Under review as a conference paper at ICLR 2023
Let
now
focus
finding
upper
bound
for the
quantity
(1))
VF (x(
(8) (0)
Ei=
w.
Vi
(4:
E
V
EE vf
w
Iz))
Ei=1
wi
(k)
A fz
wi 1zi)
Σ V
wi
(k)
xzi -
E
w
! Vf
(b)
V
fi n
wi
(k) x1n)
w;
(2)
V
x
(1)
Jensen
1
E
Ve(( n2
Σ
n
ui (ire
(1)
m
x (m))
n
27
1 Canchy-Schwart
Canchy- Schwartr
12
E
1 + mar (1,)
V
1 トニ
Σ
( (x
11
n
1 n
+
4
E
V
Σ
W (1) ( v (xt
L- smooth
2
1
n²
n
1
(k) zi - x
(k)
2
S
E
Wi
n1.
(M)
==
(35)
12(1+2²) a
where L
Thus we have,
x
11++1)1
X (k) (k)
X
(k) (A)
27
L
VF
(k) (A)
E
f
< IE f
V f
E
71
2
7
7 1
2n202
Q
(1)
2n
2
(36)
By rearranging,
2 E
x (k) (k)
7 LN2 E
VF
(x) (k)
17
ST f
(x())
)
E f
(((++1)
n
n
72
L7Po2
LL
2
(K)
+
2
2n
1=1
(37)
23

---

Under review as a conference paper at ICLR 2023
Let us now sum from A = 0 to k K -
-1:
K-1
X (v((
27
2 L
K-1
VF X (A)) (1) 1
Σ E
Vf
Σ E
2
k=
K
X
((1))(())
)
(x(ktt) (o (k++))
E 1 -BB
E
f
Ly
2L3
K-1
(,a0)
2n
X (0) (0)
)
x (k)
<B
E f
n
<f
Σ
(0) (0)
-5
11
LK
2
K-1
Σ
2
2
2
k=
1=1
M
(38)
The last inequality holds because f is the theoretical global infimum of our problem. Using the bound for the expression Σ
k=
K-1
Ms from Lemma 6, we obtain:
X
(0)
K-1
VF [ (k)) (h))
E
n
2
n
k=
n
LK
<f
w
(0) (0)
21
+
2
71? 4 C K + 0020
YI2
12, + C3
+
2
(1 (2=2)
(1-))DD
I2?
12--2 + +
K
2
(1 22
Σ
IF
V
Σ
wi
(k) (k)
k=0
Σ
+ 2
(1 ((1-g)2D) D2
n
(39)
By using L < L1 and rearranging and dividing all terms by y,, we obtain:
1
1
L
12"2 +3
)
[ E V
(A) (K)
1 LIY K-1
VF (x
(k) 2)
w x
E
K
2
2
(1 DD
n
k=U
Ei
m
(0) (0)
x
8r
Li702
AL7 C² 02 + 1227
7L,0302 + 03
2
gK
2
2(1 - 2)
2K(1 - 2)
(0)
170² 22
E
+
2(1 2(1-
n
(40)
By defining D, = 1
Lf z
(12
). the proof is complete.
D2
24

---

Under review as a conference paper at ICLR 2023
Proof of Theorem 1: Let S min (1-9)²
G0L 13. Then,
D2 = 2122,00 23LIC² (7^57)
2 1 2151,02
1 1
2
4 -
(1 -19)
(1 -1)2
2
L3 127 + +3
(7*<9) 15,
1
D1 = 2 2 (1 D)
2 2 2(1 92
2 2
2
8D2
By substituting these bounds in Lemma 8, we obtain,
- K-1 E
V
(8) (k) Ei= w/ 39
||
K
Σ
E
Vf
Σ
w1
27
(1:
)
1
L1
K-1
E
VF
X (R)
(A)
K
K
4 k=
1=1
k=0
f
1 Σi
(0) (0)
L170²
4L77 4
12
K
2
(1-q)² q)²
o2,002++337 + K(1-g)
[1,0 +2
Σ i=
(
9)-
(41)
Let us now substitute in the above expression y /V/K. This can be done due to the lower bound on the total number of iterations K where guarantees that vn/K & min { (1-g)² 60L
(1) (K) EK-'B/ ( Ei_ wi 17
)1²
f E
wi
11 -f
fr
L1
40 + 1217
K
VnK
+
V
K
K
(1
9)²
2
13 + +3170402
13
Σ
24
K(1 {)1-9)
(1-1)2 0)2K
n
10)
20 (1 1)²K
Σn
Σt wi zi
(0) (0)
L,C²
===1
|
(4o² + +1122)2m In
VnK
K(1 - q)
71
1J0 + 30,0
22
Σ 2i=1
(0)
K(1 K(1-9) 9)
(1-9)2K
n
(42)
Σn
Let P1-
(402 + 12(2)n
Σn 100
400
(22
and P2
(1-9)²
[1-9)²
f
Dr wi
(0) (0)
x
f
P
K(1 q)²
VnK
n P2
n
2i
w x
(0) (0)
f
K K
Vk
25

---

Under review as a conference paper at ICLR 2023
That is,
(6022
nIACAP,
n nP2
K 2 mar
(43)
(1 (1-
( 21 ur (1(0 x: fr
2' [ Σr in
(1 9)-
Vnk
vnk
Then
-k= E
V 1 - wi
(K)
11
(8)
2
1
21
wi 1 - 5
(0) (1)
3
(44)
K
Vnk
Proof of Theorem 2: From Lemma 6 we have that:
K-
40
C2
0²
M
72
0²+ +
K
q)2n122
(1 22
K
0=
12C²
7332
5²
7² (1 q)2
5² +
(1 q)2
K
(45)
C²
2C²
i=
n
(0)
+7 (1-9) 9)-g)
(1 - D)222K
n
12C²
- (1-1))D )
302
Σ K=
E
Σi
my
(R) (k)
||²
(1
D)
K
Using the assumptions of Theorem I and step size 7 vn/K,
K-
1 + (*
Σ k=
M <o
(46)
K
K
KVK
Now using the above upper bound in and the result of Theorem 1, we obtain:
K-1
||
2
K
K
E
VJ
(x
Vs
I
(k)
Vs
(k)
xt
(K)
1=1
K-
2E
V (m+)) - v/
-
+ 2
V
1
(k)
(8)
12 1=1
k=0
1=1
=
K-1
2E
V (at) - 4.
|
2 Σ
(8)
x1
(K)
2
K-1
2
V
1
n Σ
wi
(K) (k)
Ii
71 1=1
1=1
k=
1 x2
x2
E
V (xf) - vf
W
(A) (M)
Σ
E
V
w
(k)
xi
(k)
71
K-
22
K-1 ΣE
smooth
21
E
(k) (k)
+ 2
E
V
m
(6))
(K)
K
k=0
L6
Vnk
K
K3/2)
(47)
26


Reviews:
[{"review_id": "piQrnimFha", "reviewer": "Reviewer_73SE", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "The paper describes the effect of malicious nodes in P2PL environment. It proposes a defense mechanism P2PRISM for reviving the nodes from the attack. Experiments are detailed and extensive and showcase the advantage of the proposed work.", "summary_of_the_review": "The paper shows adequate contribution is addressing an important problem of malicious nodes in P2PL environments. The approach has been extensively evaluated to verify the paper’s claims", "strength_and_weaknesses": "strengths\n-the paper proposes P2PRISM, a defense against malicious attacks in P2PL environment\n-based on the direction of updates, the approach uses its own local update as the reference to detect parameter-wise direction flip in the updates received from its neighbors to identify malicious ones\n-experiments are detailed and extensive\n\nweakness\n-there are many parameters used \n-the reputation update mechanism seems naïve and could be compromised\n\n", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "4: All of the claims and statements are well-supported and correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}, {"review_id": "lP4hr1lzTy", "reviewer": "Reviewer_FPrf", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper proposes P2PRISM, a novel secure aggregation protocol for P2PL, with theoretical analysis for convergence and good empirical results.", "summary_of_the_review": "This paper proposes P2PRISM, a novel secure aggregation protocol for P2PL, with theoretical analysis for convergence and good empirical results. Some important baselines are missing.", "strength_and_weaknesses": "Strength:\n1. The paper provides an insightful discussion about the difference between Byzantine-tolerant machine learning in FL and P2PL.\n2. This paper proposes P2PRISM, a novel secure aggregation protocol for Byzantine-tolerant P2PL.\n3. Theoretical analysis for the convergence of P2PRISM is provided.\n4. Empirical results show the the proposed method outperforms the basline\n\nWeakness:\n1. I would recommend using larger CV datasets such as cifar-10 instead of mnist, but it is not a bug issue.\n2. The general idea of using using local updates for validation and Byzantine tolerance is actually not that novel. For example, the following 2 papers (zeno/zeno++ for short):\nXie, C., Koyejo, O., & Gupta, I. (2019). Zeno: Distributed Stochastic Gradient Descent with Suspicion-based Fault-tolerance. ICML. https://proceedings.mlr.press/v97/xie19b.html\nXie, C., Koyejo, O., & Gupta, I. (2020). Zeno++: Robust Fully Asynchronous SGD. ICML.  https://proceedings.mlr.press/v119/xie20c.html\nEspecially for zeno++, it uses the inner-product between the update on the validation server and the candidate update to calculate a score for Byzantine tolerance, which sounds very similar to the general idea of P2PRISM, though the formula of the scores are different.\nAlthough zeno/zeno++ are originally for centralized learning, I think it's trivial to apply them to P2PL. Basically you just need to treat each worker as a server that uses the local training data to compute the validation score for zeno/zeno++.\nI think that zeno/zeno++ should be a better baseline compared to trimmed mean, since zeno/zeno++ are the techniques closet to P2PRISM.\nI highly recommend to at least give a detailed discussion about zeno/zeno++ in this paper. Experiments using modified zeno/zeno++ in P2PL as the baselines are also recommended.", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "4: All of the claims and statements are well-supported and correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}, {"review_id": "OGQ9PRd3OJ", "reviewer": "Reviewer_sRwk", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 2, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper proposes a new secure aggregation protocol P2PRISM for decentralized peer-to-peer learning, against malicious adversaries, in various network topologies. ", "summary_of_the_review": "It might be better to emphasize the technical novelty of the proposed protocol and provide more intuition about why it's designed in this way. I think this paper needs improvement before acceptance.", "strength_and_weaknesses": "Strength: This paper considers a fairly interesting setting where no centralized trusted server is presented to aggregate the model updates as in federated learning settings. And it illustrates the possible malicious byzantine attacks that prior works cannot handle. Their protocol is clearly presented.\n\nWeakness:\n- The intuition behind the construction is not well presented. Especially the reward/penalize part. \n- A big portion of technical novelty may go to the flip-score proposed by Sharma et al. (2021).\n- They assume that their way of using flip-score should trim out the anomalies. This does not look straight to me. Neither does the later convergence analysis. It deserves a better explanation or formal proof.\n\nOther thing:\n- Running title says for ICLR 2022.", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "2: Several of the paper’s claims are incorrect or not well-supported.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}]

Author rebuttal:

Decision: Reject