Federated Robustness Propagation: Sharing Adversarial Robustness in Federated Learning
Authors: Junyuan Hong
Haotao Wang
Zhangyang Wang
Jiayu Zhou
Venue: ICLR 2022 Submitted (2022)
Keywords: federated learning
data heterogeneity
hardware heterogeneity
security heterogeneity
adversarial robustness

Abstract: Federated learning (FL) emerges as a popular distributed learning schema that learns a model from a set of participating users without requiring raw data to be shared. One major challenge of FL comes from heterogeneity in users, which may have distributionally different (or \emph{non-iid}) data and varying computation resources.  Just like in centralized learning, FL users also desire model robustness against malicious attackers at test time. Whereas adversarial training (AT) provides a sound solution for centralized learning, extending its usage for FL users has imposed significant challenges, as many users may have very limited training data as well as tight computational budgets, to afford the data-hungry and costly AT. In this paper, we study a novel learning setting that propagates adversarial robustness from high-resource users that can afford AT, to those low-resource users that cannot afford it, during the FL process. We show that existing FL techniques cannot effectively propagate adversarial robustness among \emph{non-iid} users, and propose a simple yet effective propagation approach that transfers robustness through carefully designed batch-normalization statistics. We demonstrate the rationality and effectiveness of our method through extensive experiments. Especially, the proposed method is shown to grant FL remarkable robustness even when only a small portion of users afford AT during learning.

Under review as a conference paper at ICLR 2022
FEDERATED ROBUSTNESS PROPAGATION: SHARING ADVERSARIAL ROBUSTNESS IN FEDERATED LEARN- ING
Anonymous authors Paper under double-blind review
ABSTRACT
Federated learning (FL) emerges as a popular distributed learning schema that learns model from a set of participating users without requiring raw data to be shared. One major challenge of FL comes from heterogeneity users, which may have distributionally different (or non-iid) data and varying computation resources. Just like in centralized learning, FL users also desire model robustness against malicious attackers at test time. Whereas adversarial training (AT) provides sound solution for centralized learning, extending its usage for FL users has imposed significant challenges, as many users may have very limited training data as well tight computational budgets, to afford the data-hungry and costly AT. In this paper, we study a novel learning setting that propagates adversarial robustness from high- resource users that can afford AT. to those low-resource users that cannot afford it, during the FL process. We show that existing FL techniques cannot effectively propagate adversarial robustness among non-iid users, and propose simple yet effective propagation approach that transfers robustness through carefully designed batch-normalization statistics. We demonstrate the rationality and effectiveness of our method through extensive experiments. Especially, the proposed method is shown to grant FL remarkable robustness even when only small portion of users afford AT during learning.
INTRODUCTION
Federated learning (FL. (McMahan et al., 2017) is a learning paradigm that trains models from distributed users or participants (e.g., mobile devices) without requiring raw training data to be shared, alleviating the rising concern of privacy issues when learning with sensitive data and facilitating learning deep models by enlarging the amount of data to be used for training. In a typical FL algorithm, each user trains model locally using their own data and server iteratively aggregates users' incremental updates or intermediate models, converging to a model that fuses training information from all users. A major challenge in FL comes from the heterogeneity of users. One source of heterogeneity is distributional differences in training data collected by users from diverse user groups (Fallah et al., 2020; Zhu et al., 2021). Yet another source the difference of computing resources, as different types of hardware used by users usually result in varying computation budgets. For example, consider an application scenario of FL from mobile phones (Hard al., 2019), where different types of mobile phones (e.g., generations of the same brand) may have drastically different computational power.
Data heterogeneity should be carefully handled during the learning as single model trained by FL may fail to accommodate the differences (Yu al., 2020). A variety approaches have been proposed to address the issue, such customizing network structures (Li et al., 2020c; Arivazhagan et al., 2019) or tailoring training strategies (Fallah et al., 2020; Dinh et al., 2020) for each user. Even though hardware heterogeneity is ubiquitous, their impacts to FL processes and possible solutions have received very limited attention so far.
The impacts of the two types of heterogeneity become aggravated when participating users' desire adversarial robustness during the inference stage, against imperceptible noise that can significantly mislead model predictions. To address this issue, straightforward extension of FL., federated

---

Under review as a conference paper at ICLR 2022
Limited Computational Power
Users with High Computational Power
Austage wwuttrics of -14-4455
-00
-5
Aciee
50
Federated Robustress Propagation
-00
Risalbad Trcas
FedRON Jound
TATANS
FATEN
LocalAT
Modals
Non-Robee Ren-Robust
Portion STAT
(b)
Figure 1: (a) We define a novel problem setting, where standard-training (ST) users, which might be limited by data or computational resources, can "share" robustness from adversarial-trainigg (AT) users who can afford it. (b) Comparison of robustness on a varying portion of AT users, where 5-domain digit recognition dataset is distributed to 50 users total and details are Appendix C.7.
adversarial training (FAT), can be adopted, which idea was explored in (Zizzo et al., 2020; Reisizadeh al., 2020). Locally, each user trains models with adversarially augmented samples, namely adversarial training (AT) (Xie et al., 2020). As studied in central settings, the AT is data-thirsty and computationally expensive (Shafahi et al., 2019a). Therefore, involving fair amount of users in FAT is essential, given the fact that each individual user may not have enough data to perform AT. However, this implies an increasing difficulty for fitting diverse data distributions and more intensive computation for each user, which could be 3 - 10 times more costly than the standard equivalent (Shafahi et al., 2019a; Zhang et al., 2019). The computation overhead can be prohibitive for FL users with limited computational budget such mobile devices. As such, it is often unrealistic to enforce all users in a FL process to conduct AT locally, despite the fact that the robustness is indeed a strongly desired even required property for all users. This conflict raises challenging yet interesting question: Is it possible to propagate adversarial robustness in FL so that budget-limine users can benefit from robustness training of users with abundant computational resources?
Motivated by the question above, we formulate a novel problem setting called Federated Robustness Propagation (FRP), depicted in Fig. la. We consider a rather common non-iid FL setting that involves budget-sufficient users (AT users) that conduct adversarial training, and budget-limited ones (ST users) that can only afford standard training. The goal of FRP is to propagate the adversarial robustness from AT users to ST users. Note that sharing adversarial data is prohibited for mitigating the overhead of adversarial In Fig. 1b, we show that independent AT by users without FL (local AT) will not yield robust model since each user has scarce training data. Directly extending an existing FL algorithm FedAvg (McMahan et al., 2017) or a pecerrogeeiitymmiiigtee. one FedBN (Li et al., 2020c) with AT treatments, named as FATAvg and FATBN, give very limited capability propagating robustness. The limitation may arise from the following two reasons: 1) Heterogeneity of users results in distinct noise behavior in different users, degrading the transferability of model robustness. 2) Structural differences between clean and adversarial samples may further impede robustness propagation (Xie & Yuille, 2019).
generation, due to the privacy consideration of the FL framework.
To address the aforementioned challenges, we propose a novel method Federated Robust Batch- Normalization (FedRBN) facilitate propagation of adversarial robustness among FL users. 1) We design a surprisingly simple linear method that transmits the robustness by copying batch- normalization (BN) statisties, inspired by the strong connection between model robustness and statistic parameters in the BN layer (Schneider et al., 2020); 2) To efficiently propagate robustness among non-iid users, we weight and average multiple AT users' statistics as BN for every ST user; 3) Facing the structural difference between the clean and adversarial data, we train two separate BNs for each data type, which are adaptively chosen at the inference stage. Our method communication- efficient as it only incurs an one-time additional communication after training. We conduct extensive experiments demonstrating the feasibility and effectiveness of the proposed method. In Fig. 1b, we highlight some experimental results from Section 5. When only 20% of non-iid users used AT during learning, the proposed FedRBN yields robustness, competitive with the best all-AT-use Asee baseline (FATBN) by only 2% drop (out of 59%) robust accuracy. Note that even if our method with 100% AT users increase the upper bound of robustness, such a bound is usually not attainable because of the presence of resource-limine limited users that cannot afford AT during learning.
2

---

Under review as a conference paper at ICLR 2022
2 RELATED WORK
Federated learning for robust models. The importance of adversarial robustness in the context of federated learning, i.c. federated adversarial training (FAT), has been discussed in series of recent literature (Zizzo et al., 2020; Reisizadeh et al., 2020; Kerkouche et al., 2020). Zizzo et al. (Zizzo et al., 2020) empirically evaluated the feasibility of practical FAT configurations (e.g.. ratio of adversarial samples) augmenting FedAvg with AT but only in iid and label- wise non-iid scenarios. The adversarial attack in FAT was extended to a more general affine form, together with theoretical guarantees of distributional robustness (Reisizadeh et al., 2020). It was found that in communication- constrained setting, a significant drop exists both standard and robust accuracies, especially with non-iid data (Shah et al., 2021). In addition to the challenges investigated above, this work studies challenges imposed by hardware heterogeneity in FL, which was rarely discussed. Especially, when only limited users have devices that afford AT, strive efficiently share robustness among users, so that users without AT capabilities can also benefit from such robustness.
Robust federated optimization. Another line of related work focuses the robust aggregation of federated user updates (Kerkouche et al., 2020; Fu al., 2019). Especially, Byzantine-robust federated learning (Blanchard al., 2017) aims defend malicious users whose goal is to compromise training, e.g., by model poisoning (Bhagoji et al., 2018; Fang et al., 2020) or inserting model backdoor (Bagdasaryan et al.. 2018). Various strategies aim eliminate the malicious user updates during federated aggregation (Chen et al., 2017; Blanchard et al., 2017; Yin et al., 2018; Pillutla et al., 2020). However, most of them assume the normal users are from similar distributions with enough samples such that the malicious updates can be detected as outliers. Therefore, these strategies could be less effective on attacker detection given a finite dataset (Wu et al., 2020). Even though both the proposed FRP and Byzantine-robust studies work with robustness, they have fundamental differences: the proposed work focus on the robustness during inference, i.e. after the model is learned and deployed, whereas Byzantine-robust work focus the robust learning process. As such, the proposed approach can combine with all Byzantine- techniques to provide training robustness.
PROBLEM SETTING: FEDERATED ROBUSTNESS PROPAGATION (FRP)
In this section, we will review AT, present the unique challenges from hardware heterogeneity in FL and formulate the problem of federated robustness propagation (FRP). In this paper, we assume that dataset D includes sampled pairs of images x E Ia and labels y E IR from distribution D. Though limit the data images in this paper, our discussion could be generalized to other data forms. We model a classifier, mapping from the Rd data/input space to classification logits f IRd - R., by a deep neural network (DNN). Whenever not causing confusing, we use the symbol of a model and its parameters interchangeably. For brevity, we slightly abuse [E[-] for both empirical average and expectation and use [N] to denote [1.....N}.
3.1 STANDARD TRAINING AND ADVERSARIAL TRAINING
An adversarial attack applies a bounded noise 6. : || S to an image x such that the perturbed image (x) A + & can mislead a well-trained model to give wrong prediction. The norm
I1-I1 can take a variety of forms, e.g., Loo-norm for constraining the maximal pixel scale. A model ff is said to be adversarially robust it can predict labels correctly on a perturbed dataset D = ((A,(z), y²) y) E D), and the standard accuracy on D should not be greatly impacted.
Consider the following general learning objective:
miny L(f, D) = mins [D] Ei (11
ea(fxx + fa(fxx.)))
(1)
where la is a standard classification loss on clean images and f, is an adversarial loss promoting robustness. Eq. (1) performs standard training if q = O, and adversarial training if E (0, 1/. Without loss of generality, we limit our discussion for g as 0 or 0.5. A popular instantiation of Eq. (1) is based on PGD attack (Madry et al., 2018; Tsipras et al., 2019): f<(f:z,y) y) = (x(xx, y). (a = maxiolise (z(+)))) y), where ||- is the L l can be the cross- cross-entropy loss, i.e., ((f())))
Ei= Vt log( (f))) where & is the class index and f(x represents the 1-th output logit.
3

---

Under review as a conference paper at ICLR 2022
3.2 PROBLEM SETUP AND CHALLENGES
We start with typical FL setting: a finite set of distributions D; for i E [C], from which set of datasets {D& k=1 are sampled and distributed K users' devices. The users from distinct domains related with D, expect to optimize objectives like Eq. (1). Some users can afford AT training (AT users from group with q 0.5) when the remaining users cannot afford and use standard training (ST users from group T with = 0). If the two groups of users train models separately, the models of ST users will be much less robust than those of AT ones. Note that data exchange among users is forbidden according to the the FL setting for privacy concerns. The goal of federated robustness propagation (FRP) is to transfer the robustness from AT users to ST users at minimal computation and communication costs while preserve data locally. Formally, the FRP objective minimizes:
FRP(Lfs) DD ~ D.))= & Ever [Dx
1
E E( (E.))ED lo(fx)
1 + EnEs [ra Σ (aa))D Z [loosf)) l((o)]
(2)
Note that different from FAT (Zizzo et al., 2020), FRP assumes that Dr is sampled from different distributions and that there are at least one zero entry in q. In the federated setting, each user's 's model trained separately when initialized by a global model, and aggregated to global model the end of each epoch. A popular aggregation technique is FedAvg (McMahan et al., 2017), which averages parameters by f F Σx= f& with normalization coefficients ag proportional to D
Remarkably, Eq. (2) formalizes two types of common user heterogeneity in FL. The first one is the hardware heterogeneity where users are divided into two groups of different computation budgets. A node of tight computation budget, e.g., smartphone, may join FL in group T, while a powerful one, e.g., desktop computer in S (Hard et al., 2019). Besides, data heterogeneity is represented as D; differing by i. We limit our discussion as the common feature distribution shift (on x:) in contrast to the label distribution shift (on y), as previously considered in (Li al., 2020c). Such distribution shift often happens when users are distributed across different environments, e.g., sensor data collected indoor and outdoor.
New Challenges. We emphasize that jointly addressing the two types of heterogeneity in Eq. (2) forms new challenge, distinct from either of them considered exclusively. First, the scarcity of AT group S worsens the data heterogeneity as additional distribution shift in the hidden representations from adversarial augmentation (Xie & Yuille, 2019). That means even if two users sample from the same distribution, their classification layers may operate on different distributions.
Second, the data heterogeneity makes the transfer of robustness non-trivial (Shafahi et al., 2019b). Hendryeks er al. discussed the transfer of models adversarially trained on multiple domains and massive samples (Hendrycks et al., 2019). In (Shafahi et al., 2019b). Shafahi el al firstly studied the transferability of adversarial robustness from one data domain to another without the data-hungry problem. They proposed fine-tuning the robustness robustness-sensitive layers in a neural network on a target domain. Distinguished from Shafahi et al. 's work, the FRP problem focuses on propagating robustness from multiple AT users to multiple ST users who have diverse distributions. Thus, fine-tuning all source models in ST users is often not possible due prohibitive computation costs.
4 METHOD: FEDERATED ROBUST
(FEDRBN)
4.1 ROBUSTNESS PROPAGATION BY COPYING DEBIASED BN LAYERS
In centralized learning. an important observation is that robustness is highly correlated with the BN statistics (Xie & Yuille, 2019). We extend this investigation to the FL setting, where we assume all other parameters are shared besides BN layers. There are significant differences in BN parameters (mean and variance) between ST and AT users from the same domain, as shown in Fig. 2a. This observation indicates that directly using local BN statistics can hardly grant robustness to an ST user, and suggests& possible way to transfer robustness through leveraging the BN layers from AT users in ST users upon predicting possible adversarial input images. However, the distributions users from distinct domains can be quite different (Joaquin Caahonnro-Canddel et al., 2008), and therefore directly copying BN among users can suffer from the distribution shift by domains. This motivates us to develop shift-aware debiasing method.
4

---

Under review as a conference paper at ICLR 2022
0.3
bn2
bnl
0.2
bal
bn2
0.1
0.15
0.1
bng
0.0
0.10
0.0
0.0
Inge?
-6.1
-0.2
-0.1
-0.3
-0.05
-0.10
-0.4
-0.2
0.0
0.2
0.05
logal loge
Ah
(a) Great difference of clean/noise statistics (y-axis) (b) Correlation of relative statistics in the 2nd BN layer.
Figure 2: Models are trained with decoupled BN layers on Digits dataset. bn1 the first BN layer in the network. (a) Results on SVHN. (b) The relative statistics are compared on MNIST versus SVHN.
To capture the domain bias, we can leverage the BN layers they are modeling local distributions. Ideally, differentially modeling two users will yield BN statistics for the two corresponding distribu- tions, separately. However, one challenge here is that the BN statistics in non-iid AT and ST users are biased simultaneously by the domain difference and the adversarial noise. As such, directly differential modeling will capture the mixture of both types of bias and therefore would not be effective to infer the domain bias. Instead, we incrementally propose to simultaneously model clean data and noise data by BN for all AT users, since clean data are also available during training. To do (DBN) structure (Xie
so, we replace standard BN layers by ones that use the dual batch-normalizate al., 2020), which keep two sets of BN statistics: one for clean data and one for noise data. The channel-wise mapping of DBN from the input layer x: to output is
w (1 h)
#-K Va*+eu
+
b,
(3)
where f and o² are the mean and variance over all non-channel dimensions, μr" and o²" are their corresponding noised statistics, h serves as a model-wise switch, which is 0 for clean inputs or 1 for noised inputs, cn is small constant for the numerical stability. Different from prior work, e-g.. (Xie et al., 2020; Xie & Yuille, 2019), we use shared affine weights (w) and bias (b) for efficiency considerations. In the user-side training, we explicitly choose the clean or noise BN based on the input. Though we introduce DBN for a bias-inference purpose, the DBN still merits the model performance as it normalize representations more precisely as priorly investigated (Xie et al., 2020).
Transfer robustness from a single user via copying BN layers. With the clean BN embedded in DBN, we can estimate the distributional difference by an AT clean BN statistic tuple (Hs, o?) and an ST (clean) BN statistic tuple (Me, af). Formally, we propose debiased statistic estimation by
p = n² + A(m+ us), oj-² = (0./(0, + +
where À is hyper-parametter in [0, Note that when the distributions are matched, i.e., 14 Ps+ then debiasing is not necessary and is automatically vanished. To justify the rationality of Eq. (4), we contrast the ft, - Mr with μ²," - 1z in Fig. 2b (more results in Appendix D.3). The clean and noise BN statistics are estimated during training DBN, and we observe strong correlation of the relative difference among domains both for the mean and variance.
To understand the debiasing method, we provide principled analysis on a simplified one-dimensional example. We assume the noised imputs to a BN layer in user can be approximated by an uffine-noise model à Ax, + v, ã,- = Ax; + v. where x, ~ N(ps, o?), 3t ~ Nii,, of) and v ~ NN(,,, o²2) is domain-independden noise. A is constant scalar. We further assume is independent from x, and xe. Taking expectation gives μ Ap', P. λua +t': o²² = Xo of = 220 Due the invariance assumption of (n', o'), we have: j - oj Vo + ( o However, oō is meaningless when o²² + X² of) 0. To fix this, we use a division instead of subtraction to represent the relative relation in Eq. (4). This simplified example by no means serves as rigorous analysis, which is an open problem outside the scope of this paper.
4.2 FEDRBN ALGORITHM AND ITS EFFICIENCY
We now ready to present the proposed the two-stage Federated Robust Naaeh--Nomalizttionn (FedRBN) algorithm. During training (Algorithm 1), we train models locally with decoupled clean and noise BNs for each user. Locally trained models excluding BN are then aggregated by federated
5

---

Under review as a conference paper at ICLR 2022
parameter averaging. For ST users, they are free from heavy adversarial training. After training (Algorithm 2), the server aggregates BN statistic debiasing from AT users which are broadcasted to ST users for BN statistic estimation. For simplicity, use μ and o² for parameters in all layers.
Algorithm FedRBN: user training
Algorithm 2 FedRBN: post-training
Input: An initial model f from the server, adversary
Input: AT users S = [s} and ST user T = (1)
A()), dataset D, user budget type (AT or ST)
1: for AT users in S locally do
1: for mini-batch {(z, 3 in D do
2: Aul Hh Ape,
2: Set f to use clean BN by / + 0
3: Alog -
log o oo
3: L + (B(r,)))(( (z. 3))
4: Upload A log and to server
4: if user budget type is AT then
5:
ApC [8] E.es AuT
5:
Perturb data 5 -- A(x)
6: A Alog o+2 [S] E.Es A log o;
6:
Set f to use noise BN by h 4-
7:
I, 1,4-3 2 ( T. Ba (7, v))}}
7: for ST users in T locally do
8: Download AØr, A log orz p = Ap4: + AApr
8:
Update / by one-step gradient descent
9:
9:
Upload parameters of layers except BN layers
10: of = exp A log of + A logor 0.2
Inference-stage BN selection (parameter h). One issue of FeaRBN is the choice of BN at inference time. To balance accuracy and robustness, we need a strategy to automatically select the right BN for each sample, i.c., applying noise BN when the imput is found to be an adversarial one. Although the differences between clean data and adversarial are subtle in raw images, recent advances have shown promising results with the help of network structures. For example, in (Pang et al., 2018), the authors find that the non-maximal entropy of their logits are quite distinct. In (Feinman et al., 2017), their representations are separable under the similarity measurement of RBF-kernel (or K-density). Formally, we first compute the logits by / = f(x) with h t 0. Then we use g(l) to predict whether the image is noised. If g(() indicates the image is noised, we assign h + g(l) and re-predict the label by (z). The details of locally training noise detectors is summarized in Algorithm 3. As only logits are required as input for 9(-), the training is efficient. In Figs. 10 and 11. we visually show that adversarial examples can be identified by a classifier g(.) in the space of logits. More results are provided in Appendix C. Our strategy is similar to the layer-wise gating Liu et al. (2020), but we only use a gate function (namely noise detector) on model outputs, which can be efficiently trained without repeated ad adversarial-same sample generation.
Efficiency and privacy of BN operations. Since the BN statistics are only a small portion of any networks and do not require pack-propagation, additional BN statistic will not significantly affect the efficiency (Wang et al., 2020). During training, because users do not send out BN layers, the communication cost is the same non-iid FL method (FedBN (Li et al., 2020c)) and less than other fully-shared methods like FedAvg (McMahan et al., 2017). After the training is done, BN layers will be copied transfer robustness, and such one-time cost of transferring marginal components of networks will be neglectable. compared to the total cost incurred in FL. Noticeably, AT users will share the statistic difference (Ap) instead of local statisties (μ) with the server, and the server will send the averaged parameters with ST users only. Especially when local statistics may leak users' data (Geiping et al., 2020), our method enjoys better privacy than traditional methods, like FedAvg.
5 EXPERIMENTS
Datasets and models. To implement a non-iid scenario, we adopt a close-to-reality setting where users' datasets are sampled from different distributions. We used two multi-domain datasets for the setting. The first is a subset (30%) of DIGITS, a benchmark for domain adaption (Peng et al., 2019b). DIGITS has 28 x 28 images and serves as commonly used benchmark for FL (Caldas et al.. 2019; McMahan et al., 2017; Li et al., 2020a). DIGITS includes 5 different domains: MNIST (MM) (Lecun et al., 1998), SVHN (SV) (Netzer et al., 2011), USPS (US) (Hull, 1994). SynthDigits (SY) (Ganin & Lempitsky, 2015), and MNIST-M (MM) (Ganin & Lempitsky, 2015). The second dataset is DOMAINNET (Peng et al., 2019a) processed by (Li et al., 2020c), which contains 6 distinct domains of large-size 256 x 256 real-world images: Clipart (C), Infograph (I), Painting (P), Quickdraw (Q), Real (R), Sketch (S). For DIGITS, we use convolutional network with BN (or DBN) layers following each conv or linear layers. For the large-sizes DOMAINNET,
AlexNet (Krizhevsky et al., 2012) extended with BN layers after each convolutional or linear layer (Li et al., 2020c). One more large-sized image dataset is presented in Appendix C.5.

---

Under review as a conference paper at ICLR 2022
Training and evaluation. For AT users, (Madry et al., 2018) with a constant noise magnitude c. Following (Madry et al., 2018), we use 8/255, n 7, and attack inner-loop step size 2/255, for training, validation, and test. We uniformly split the dataset for each domain into 10 subsets for DIGITS and 5 for DOMAINNET, following (Li et al., 2020c), which distributed to different users, respectively. Accordingly, we have 50 users for DIGITS and 30 for DOMAINNET. Each user trains local model for one epoch per communication round. We evaluate the federated performance by standard accuracy (SA), classification accuracy on the clean test set, and robust accuracy (RA), classification accuracy on adversarial images perturbed from the original test set. All metric values are averaged over users. We defer other details of experimental setup such as hyper-parameters to Appendix C, and focus on discussing the results.
n-step PGD (projected gradient descent) attack
5.1 COMPREHENSIVE STUDY
To further understand the role of each component in FedRBN, we conduct a comprehensive study on its properties. In experiments, we use three representative federated baselines combined with AT: FedAvg (McMahan et al., 2017), FedProx (Li et al., 2020a), and FedBN (Li et al., 2020c). We use FATAvg to denote the AT-augmented FedAvg, and similarly FATProx and FATBN. To implement hardware heterogeneity, we let 20%-per-domain users from 3/5 domains (of DIGITS) conduct AT.
Ablation Study. We use FATBN as the base method and incrementally add FedRBN components: +DBN, +detector (for adaptively BN selection), +copy BN statistics, and + +debias as copying. Table I shows that even though DBN is critical structure, simply adding DBN does not help unless the noise detector is applicd. Also, the most influential component is copying, supporting our key idea. The +debias is more important in single AT domain case where domain gaps varies by different ST domains. Other than +copy, all other components barely affect the SA.
Table 1: Ablation of different FedRBN components. Standard deviations are enclosed in brackets.
AT users
metric
base
+DBN
+detector
+copy
+debias
20% in 5/5 domains
RA
41.2 (1.3)
38.8 (1.4)
42.4 (1.4)
55.7 (1.0)
55.7 (1.3)
increment SA
-2.4
+3.6
+13.3
+0.0
86.4 (0.4)
86.5 (0.4)
86.2 (0.4)
85.2 (0.6)
85.2 (0.4)
100% in 1/5 domain
RA
36.5 (1.8)
34.3 (2.0)
37.3 (1.8)
48.1 (1.6)
49.8 (1.6)
increment
-2.2
+3.0
+10.8
+1.7
SA
86.4 (0.4)
86.4 (0.4)
86.3 (0.4)
84.3 (0.5)
84.4 (0.4)
Impacts from Data Heterogeneity. To study the influence of different AT domains, we set up an experiment where AT users only reside on one single domain. For simplicity, we let each domain contains single user as in (Li et al., 2020c) and utilize only 10% of DIGITS dataset. The single AT domain plays the central role in gaining robustness from adversarial augmentation and propagating to other domains. The task is hardened by the non-singleton of gaps between the AT domain and multiple ST domains and a lack of the knowledge of domain relations. Results in Fig. 3a show the superiority of the proposed FedRBN, which improves RA for more than 10% in all cases with small drops in SA. We see that RA is the worst when MNIST serves as the AT domain, whereas RA propagates better when the AT domain is SVHN or SynthDigits. A possible explanation that SVHN and SynthDigits are more visually different from the rest domains (see Fig. 6), forming larger domain gaps at test.
Impacts from Hardware Heterogeneity. We vary the number of AT users in training from 1/N (most hetcrogeneous) to N/N (homogeneous) to compare the robustness gain. Fig. 3b shows that method consistently improves the robustness. Even when all domains are noised, FedRBN is the best due to the use of DBN. When not all domains are AT, our method only needs half of the users to be noised such that the RA is close the upper bound (fully noised case).
Other comprehensive studies including the parameter sensitivity and convergence are delayed to Appendix C.2. The impact of total data sizes is included in Appendix C.3.
5.2 COMPARISON TO BASELINES
To demonstrate the effectiveness of the proposed FedRBN, we compare it with baselines on two benchmarks. We repeat each experiment for three times with different seeds. We introduce two more baselines: personalized meta-Fl. extended with FAT (FATMeta) (Fallah al., 2020) and federated
7

---

Under review as a conference paper at ICLR 2022
Table 2: Benchmarks of robustness propagation, where we measure the computation time (7) by counting x x10 times of float add-or-multipiee cad--orrmliipliaation operations (FLOPs).
Digits
DomainNet
AT users
20%
MNIST
All
20%
Real
Metrics
RA
SA
FodRBN (ours)
66.7
87.3
2218
56.2
85.3
665
49.8
84,3
665
35.9
60.5
18490
24.2
61.5
11547
21.6 61.9
10425
FATBN
60.0
87.3
2211
41.2
36.5
86.4
663
35.2
60.2
38363
20.3
63.2
11509
64.7
10390
FATAvg
58.3
86.1
2211
42.6
84.6
663
38.4
84.1
663
24.6
474
38363
15.4
57.8
11509
10.7
57,9
10390
EATProx
2211
42.8
38.1
84.1
663
47.1
38363
57.3
10390
MAT
43.6
71.6
2211
35.0
72.6
663
35.3
72.2
663
6.0
23.5
38363
0.0
37.2
11509
0.1 38.1 10390
FedRob
13.1
13.1
2211
20.6
59.3
1032
17.7
48.9
645
Table 3: Compare FedRBN versus
Table 4: Evaluation of RA with various attacks on Digits. n and are the step number and the magnitude of attack.
efficient federated AT on Digits.
20% AT domains
100% Free (Slufahi et al., 20 FATAvg
Attack (n, <)
PGD (100.8
MIA (20.16)
MIA (100.8)
LSA (7.-)
FeIRBN
FATAvg
FATRN
(20,16)
(.8)
SA
RA
86.2
56.1
273
85.6
44.9
47.1
63.6
46.3
57.4
276
FeIRBN BATBN
FATAg
31.5
42.8
28.6
43.4
54.5
4166
39,9
30.0
27.0
41.5
52.2
39.7
32.9
48.3
31.0
64.0
73.5
63.3
84.6
84.2
84.2
robust training (FedRob) (Reisizadeh et al., 2020). Because FedRob requires a project matrix of the squared size of image and the matrix is up to 256² x 256 on DOMAINNET which does not fit into a common GPU, we exclude it from comparison. Given the same setting, we constrain the computation cost in the similar scale for cost-fair comparison. We evaluate methods on two FRP settings. 1) Propagate from a single domain. In reality, a powerful computation center may join the FL with many other users, e-g., mobile devices. Therefore, the computation center is ideal node for the computation-intessivee AT. Due to limitations of data collection, the center may only have access to single domain, resulting gaps most other users. We evaluate how well the robustness can be propagated from the center to others. 2) Propagate from a few multi-domain AT users. In this case, we assume that to reduce the total training time, ST users are exempted from the AT tasks in each domain. Thus, an ST user wants to gain robustness from other came-doman users, but the different-donee users may hinder the robustness due the domain gaps in adversarial samples.
Table 2 shows that our method outperforms all baselines for all tasks, while it associates to only marginal overhead (for fitting noise detector). Importantly, we show that only 20% users are enough to achieve robustness comparable to the best fully-trained baseline. To fully evaluate the robustness, we experiment with more attack methods, including MIA (Dong et al., 2018), AutoAttack (AA) (Croce & Hein, 2020) and LSA (Narodytska & Kasiviswanathan, 2016). A strong score-based blackbox attacks such as Square Attack (Andriushchenko et al., 2020) (included in AA) can avoid the trip fake robustness due to obfuscated gradient Even evaluated by different attacks (see Table 4), method still outperforms others. With the concern that the attacker may bypass the noise detector and lead to the trip of fake robustness (Athalye et al., 2018), we include joint-attack noise detector and the model prediction in Appendix C.8. Though, the accuracies of noise detectors are degraded somehow, the overall RA or SA of our method are still outstanding.
Compare to full efficient AT. In Table 3, we show that when computation time is comparable, our method can achieve both better RA and SA than full-AT baselines. For results be comparable, we train FedRBN for limited 150 epochs while Free AT for 300 epochs. Although Free AT improves the robustness compared FATAvg, it also greatly sacrifices SA performance. Thanks stable convergence and decoupled BN, FedRBN maintains both accurate and robust performance though the AT is not 'free' for a few users.
More federated configurations. We also evaluate our method against FedBN with different feder- ated configuration guriiiouatinnns of local epochs E and batch size B. We constrain the parameters by E {1,4, 8} and B E {10, 50, 1003. The 20% 3/5 domain FRP setting is adopted with DIGITS dataset. In Table 5 (a longer one in Table 14), the competition results are consistent that our method significantly promotes robustness over FedBN. We also observe that both our method and FedBN prefer smaller batch size and fewer local epochs for better RA and SA. In addition, our method drops less RA when E. is large batch size increases.
8

---

Under review as a conference paper at ICLR 2022
83-
60
RA RM
45
5A 53-154
125
FATANg
FATEN
40
EAT
FATPhoa
FedRBN
EATON
AT domalins
FAT Pro
Fadt
84
60%
M11
5V
57
455
K00
SV
SY
US
0.00 0.23
2.30
0.75 1.00
0.00
0.25
0.50
0.75
1.00
AT domtah
AT domain
portion of users per domaln
portion AT users per domaln
(a) FRP from a single AT domain
FRP from partial AT users per domain
Figure 3: Evaluating FRP performance with different FRP settings.
Evaluation with unequal dataset sizes. Sub-sampling the same number data points for each user may not be realistic in practice. Therefore, study the experiment setting that sample sizes for users are different. The experiment details are given in Appendix C.I. In Table 6, we summarize the 3-repetition-averae
comparison results the 20% 3/5 domain FRP setting the DIGITS dataset. We see that our method is still most competitive with non-uniform dataset sizes.
Table 5:
Evaluation with different FL configurations.
Table 6: Comparison with unequal user- dataset sizes.
local epochs B
batch size E
method
RA
SA
10
1
FedBN
50.9
83,9
1
FedRBN
60.0
82.8
RA
SA
10
4
FedBN FedRBN
42.0
75.8
FedRBN (ours)
53.1
84.4
4
56.3
76.1
FedBN
37.3
85.7
50
1
FedBN
37.0
85.8
FedAvg
39.6
83.4
FedRBN
53.2
84.5
FedProx
39.5
83.4
Domain-wise wise evaluation. We note that performance in different domains could vary a lot. Simply comparing the performance averaged by users may not clearly present fair comparison. As consequence, we conduct experiments to compare different methods domain by domain. The basic settings follow Section 5.2. In Fig. 4a, out of five domains is noised. Domains including SVHN, USPS, SynthDigits, MNIST-M are not augmented with adversarial samples. Therefore robustness gained through federated propagation. Both the easiest (USPS) and hardest (SVHN) cases, FedRBN outperforms baselines with higher RA and similar SA. In Fig. 4b, 20% users are noised in each domain. FedRBN improves the in-domain robustness propagation against FATBN by up to 20% (USPS). In summary, the propagation efficiency of FedRBN is consistent across different domains.
323
FATEL
06
30-
daus
Aear
(a) Users from the MNIST domain AT users
20% users AT users
Figure 4: Comparison of robustness transfer approaches by domains.
CONCLUSION
In this paper, we investigate novel problem setting, federate propagating robustness, and propose FedRBN algorithm that transfers robustness in FL through robust BN statistics. Extensive experiments demonstrate the rationality and effectiveness of the proposed method, delivering both generalization and robustness in FL. We believe such client-wise efficient robust learning can broaden the application scenarios of FL. users with diverse computation capabilities.

---

Under review as a conference paper at ICLR 2022
REFERENCES
Maksym Andriushchenko, Francesco Croce, Nicolas Flammarion, and Matthias Hein. Square attack: query-efficient black-box adversarial attack via random search, arXiv:1912.0004 [cs, stat], July 2020.
Manoj Ghuhan Arivazhagan, Vinay Aggarwal, Aaditya Kumar Singh, and Sunav Choudhary. Feder- ated learning with personalization layers. arXiv:1912.008. [cs, stat], December 2019.
Anish Athalye, Nicholas Carlini, and David Wagner. Obfuscated gradients give false sense of security: Circumventing defenses to adversarial examples. In International Conference on Machine Learning, February 2018.
Eugene Bagdasaryan, Andreas Veit, Yiqing Hua, Deborah Estrin, and Vitaly Shmatikov. How to backdoor federated learning. International Conference on Machine Learning, July 2018.
Arjun Nitin Bhagoji, Supriyo Chakraborty, Prateek Mittal, and Seraphin Calo. Analyzing federated learning through adversarial lens. In International Conference on Machine Learning, November 2018.
Peva Blanchard, EI Mahdi EI Mhamdi, Rachid Guerraoui, and Julien Stainer. Machine learning with adversaries: Byzantine tolerant gradient descent. Advances in Neural Information Processing Systems, 30:1 19:119- 2017.
Sebastian Caldas, Sai Meher Karthik Duddu, Peter Wu, Tian Li, Jakub Konečný, H. Brendan McMahan, Virginia Smith, and Ameet Talwalkar. Leaf: A benchmark for federated settings. [es, stat], December 2019.
Alvin Chan, Yi Tay, and Yew-Soon Ong. What it thinks is important is important: Robustness transfers through input gradients. In Proceedings of the IEEE/CVF Conference on Computer Vision and Puttern Recognition, March 2020.
Yudong Chen, Lili Su, and Jiaming Xu. Distributed statistical machine learning in adversarial settings: Byzantine gradient descent. Proceedings of the ACM on Measurement and Analysis of Computing Systems, 1(2):4::144:22) December 2017.
Corinna Cortes and Vladimir Vapnik. Support- vector networks. Machine Learning, 20(3):273-25) September 1995.
Francesco Croce and Matthias Hein. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free free attacks. In International Conference Machine Learning, pp. 2206-2216. PMLR, November 2020.
Canh T. Dinh, Nguyen H. Tran, and Tuan Dung Nguyen. Personalized federated learning with moreau envelopes. In Advances in Neural Information Processing Systems, June 2020.
Yinpeng Dong, Fangzhou Liao, Tianyu Pang. Hang Su, Jun Zhu, Xiaolin Hu, and Jianguo Li. Boosting adversarial attucks with momentum. arX1v:1710.06081 [cs, stat], March 2018.
Alireza Fallah, Aryan Mokhtari, and Asuman Ozdaglar. Personalized federated learning: A meta- learning approach. In Advances in Neural Information Processing Systems, June 2020.
Minghong Fang, Xiaoyu Cao, Jinyuan Jia, and Neil Gong. Local model poisoning attacks to byzantine-robuss federated learning. 29th (USENIX) Security Symposium (/USENIX) Security 20), pp. 1602-1622, 2020.
Reuben Feinman, Ryan R. Curtin, Saurabh Shintre, and Andrew B. Gardner. Detecting adversarial samples from artifacts. arXiv:1703.000
[cs, stat], November 2017.
Shuhao Fu, Chulin Xie, Bo Li, and Qifeng Chen. Attack-resistant federated learning with residual- based reweighting. September 2019.
Yaroslav Ganin and Victor Lempitsky. Unsupervised domain adaptation by backpropagation. In
International Conference Machine Learning, pp. 1 1180-1189 PMLR, June 2015.
10

---

Under review as a conference paper at ICLR 2022
Jonas Geiping, Hartmut Bauermeister, Hannah Dröge, and Michael Moeller. Inverting gradients how easy is it to break privacy in federated learning? In Advances Neural Information Processing Systems, September 2020.
Andrew Hard, Kanishka Rao, Rajiv Mathews, Swaroop Ramaswamy, Françoise Beaufays, Sean Augenstein, Hubert Eichner, Chloé Kiddon, and Daniel Ramage. Federated learning for mobile keyboard prediction. arXiv: /811::3810000/// 1.03604 [cs), February 2019.
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. Computer Vision and Pattern Recognition, 2016.
Dan Hendrycks, Kimin Lee, and Mantas Mazeika. Using pre-training can improve model robustness and uncertainty. In International Conference Machine Learning, October 2019.
Jonathan Hull. A database for handwritten text recognition research. IEEE Transactions on Pattern Analysis and Machine Intelligence, 16(5):550-555 May 1994.
Joaquin Quiñonero-Camin Candell,, Masashi Sugiyama, Anton Schwaighofer, and Neil D. Lawrence. Dataset Shift in Machine Learning The MIT Press. MIT Press, 2008.
Raouf Kerkouche, Gergely Âcs, and Claude Castelluccia. Federated learning in adversarial settings. arXiv:2010.07800 [cs], October 2020.
Alex Krizhevsky, Iya Sutskever, and Geoffrey E. Hinton. Imagenet classification with deep convolu- tional neural networks. In Proceedings of the 25th International Conference on Neural Information Processing Systems Volume 1, NIPS' 12, pp. 1097-1105, Red Hook, NY, USA, December 2012. Curran Associates Inc.
Y. Lecun, L. Bottou, Y. Bengio, and P. Haffner. Gradient-based learning applied to document recognition. Proceedings of the IEEE, 86(11))2278-233) 2324, November 1998.
Tian Li, Anit Kumar Sahu, Manzil Zaheer, Maziar Sanjabi, Ameet Talwalkar, and Virginia Smith. Federated optimization in heterogeneous networks. In Conference on Systems and Machine Learning Foundation (MLSys), April 2020a.
Xiang Li, Kaixuan Huang, Wenhao Yang, Shusen Wang, and Zhihua Zhang. On the convergence of fedavg on non-iid data. International Conference on Learning Representations, June 2020b.
Xiaoxiao Li, Meirui Jiang, Xiaofei Zhang. Michael Kamp. and Qi Dou. Fedbn: Federated learning on non-iid features via local batch normalization. International Conference on Learning Representations, September 2020c.
Aishan Liu, Shiyu Tang, Xianglong Liu, Xinyun Chen, Lei Huang, Zhuozhuo Tu, Dawn Song, and Dacheng Tao. Towards defending multiple adversarial perturbations via gated batch normalization. arXiv:2012.01654 [cs], December 2020.
Aleksander Madry. Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant adversarial attacks. International Conference on Learning Representations, 2018.
Brendan McMahan, Eider Moore, Daniel Ramage, Seth Hampson, and Blaise Aguera Arcas. Communication-effickee learning of deep networks from decentralized data. In Artificial Intelli- gence and Statistics, pp. 1273-1282. April 2017.
Nina Narodytska and Shiva Prasad Kasiviswanathan. Simple black-box adversarial perturbations for deep networks. arXiv:1612.06222 [cs, stat], December 2016.
Yuval Netzer, Tao Wang, Adam Coates, Alessandro Bissacco, Bo Wu, and Andrew Ng. Reading digits in natural images with unsupervised feature learning, In NIPS Workshop on Deep Learning and Unsupervised Feature Learning 201 1, 2011.
Tianyu Pang, Chao Du, Yinpeng Dong, and Jun Zhu. Towards robust detection of adversarial examples. Advances in Neural Information Processing Systems, November 2018
11

---

Under review as a conference paper at ICLR 2022
Xingchao Peng, Qinxun Bai, Xide Xia, Zijun Huang, Kate Saenko, and Bo Wang. Moment matching for multi-source domain adaptation. In Proceedings of the IEEE/CVF International Conference on Computer Vision. pp. 1406-1415, 2019a.
Xingchao Peng, Zijun Huang, Yizhe Zhu, and Kate Saenko. Federated adversarial domain adaptation. In International Conference on Learning Representations, September 2019b.
Krishna Pillutla, Sham M. Kakade, and Zaid Harchaoui. Robust aggregation for federated learning. 2020.
Amirhossein Reisizadeh, Farzan Farnia, Ramtin Pedarsani, and Ali Jadbabaie. Robust federated learning: The case of affine distribution shifts. In Advances in Neural Information Processing Systems, June 2020.
Steffen Schneider, Evgenia Rusak, Luisa Eck, Oliver Bringmann, Wieland Brendel, and Matthias Bethge. Improving robustness against common corruptions by covariate shift adaptation. Advances in Neural Information Processing Systems, October 2020.
Ali Shafahi, Mahyar Najibi, Amin Ghiasi, Zheng Xu, John Dickerson, Christoph Studer, Larry S. Davis, Gavin Taylor, and Tom Goldstein. Adversarial training for free! Advances in Neural Information Processing Systems, 2019a.
Ali Shafahi, Parsa Saadatpanah, Chen Zhu, Amin Ghiasi, Christoph Studer, David Jacobs, and Tom Goldstein. Adversarially robust transfer learning. International Conference on Learning Representations, May 2019b.
Devansh Shah, Parijat Dube, Supriyo Chakraborty, and Ashish Verma. Adversarial training in communication constrained federated learning. arXiv:2103.01319 [cs], March 2021.
Virginia Smith, Chao-Kai Chiang, Maziar Sanjabi, and Ameet S Talwalkar. Federated multi-task learning. In Advances in Neural Information Processing Systems 30, pp. 4424-4434. Curran Associates, Inc., 2017.
Chuanbiao Song, Kun He, Liwei Wang, and John E Hoperoft. Improving the generalization of adver- sarial training with domain adaptation. In International Conference on Learning Representations, pp. 14, 2019.
Dimitris Tsipras. Shibani Santurkar, Logan Engstrom, Alexander Turner, and Aleksander Madry. Robustness may be at odds with accuracy. International Conference on Learning Representations, September 2019.
Haotao Wang, Tianlong Chen, Shupeng Gui, Ting-Kuei Hu, Ji Liu, and Zhangyang Wang. Once-for- all adversarial training: In-situ tradcoff between robustness and accuracy for free. Advances in Neural Information Processing Systems, November 2020.
Eric Wong, Leslie Rice, and Zico Kolter. Fast is better than free: Revisiting adversarial training. In International Conference Learning Representations, September 2019.
Zhaoxian Wu, Qing Ling, Tianyi Chen, and Georgios B. Giannakis. Federated variance-reduced
stochastic gradient descent with robustness to byzantine attacks. IEEE Transactions on Signal Processing, 68:4583 45963,444666666 2020.
Cihang Xie and Alan Yuille. Intriguing properties of adversarial training at scale. International Conference on Learning Representations, December 2019.
Cihang Xie, Mingxing Tan, Boqing Gong, Jiang Wang, Alan Yuille, and Quoe V. Le. Adversarial examples improve image recognition. CVPR, April 2020.
Dong Yin, Yudong Chen, Ramchandran Kannan, and Peter Bartlett. Byzantine-rohust distributed learning: Towards optimal statistical rates. In International Conference Machine Learning, pp. 5650-5659, PMLR, July 2018
Tao Yu, Eugene Bagdasaryan, and Vitaly Shmatikov. Salvaging federated learning by local adaptation. 04758 (cs, stat], February 2020.
12

---

Under review as a conference paper at ICLR 2022
Dinghuai Zhang, Tianyuan Zhang, Yiping Lu, Zhanxing Zhu, and Bin Dong. You only propagate once: Accelerating adversarial training via maximal principle. Advances in Neural Information Processing Systems, pp. 12, 2019.
Zhuangdi Zhu, Junyuan Hong, and Jiayu Zhou. Data-free knowledge distillation for heterogeneous federated learning. In Proceedings of the 38th International Conference on Machine Learning. June 2021.
Giulio Zizzo, Ambrish Rawat, Mathieu Sinn, and Beat Buesser. Fat: Federated adversarial training. arXiv:2012.01791 [cs], December 2020.
A ADDITIONAL RELATED WORK
This section reviews additional references in the areas of centralized adversarial learning and robust- ness transfer.
Efficient centralized adversarial training. A line of work has been motivated by similar concerns on the high time complexity of adversarial training. For example, Zhang al. proposed to adversari- ally train only the first layer of network which is shown to be more influential for robustness Zhang et al. (2019). Free AT Shafahi et al. (2019a) trades in some standard iterations (on different mini- batches) for estimating a cached adversarial attack while keeping the total number of iterations unchanged. Wong el al. proposed to randomly initialize attacks multiple times, which can improve simpler attacks more efficiently Wong et al. (2019). Most of existing efforts above focus speed up the local training by approximated attacks that trade in either RA or SA for efficiency. Instead, method relocated the computation cost from lidget-limited users to budget-sufficient users who can afford the expansive standard AT. As result, the computation expense is indeed exempted for the budget-limited users and their standard performance not significantly influenced.
Robustness transferring. Our work is related to transferring robustness from multiple AT users to ST users. For example, new user can enjoy the transferrable robustness of a large model trained on ImageNet Hendrycks et al. (2019). In order to improve the transferability, some researchers aim to align the gradients between domains by criticizing their distributional difference Chan al. (2020). A similar idea was adopted for aligning the logits of adversarial samples between different domains Song al. (2019). By fine-tuning a few layers of a network, Shafahi et al. shows that robustness can be transferred better than standard fine-tuming Shafahi et al. (2019b). Rather than central algorithm gathering all data or pre-trained models, our work considers a distributed setting when samples or their corresponding gradients can not be shared for distribution alignment. Meanwhile, large transferrable model is not preferred in the setting, because of the huge communication cost associating to transferring models between users. Because of the non-iid nature of users, it is also hard to pick proper user model, that works well on all source users, for fine-tuning on a target user.
Locally adapted models for data heterogeneity. In the sense of modeling data heterogeneity, some prior work was done in adapting models for each local user (Smith et al., 2017; Arivazhagan et al., 2019; Fallah et al., 2020; Dinh al., 2020). For example, Smith al. (2017) studied the linear cases with regularization on the parameters, while we study a more general deep neural networks. In addition, the work did not consider data-dependent adversarial regularization for better robustness, but a regularization that is independent from the data. Similarly. Dinh et al. (2020) regularizes the local parameters similar the global model in L2 distance, and Fallah al. (2020) considers meta-learning strategy instead. A simpler method was proposed by Arivazhagan et al. (2019) to only adapt the classifier head for different local tasks. Since all the above methods do not adapt the robustness from global to local settings, we first study how the robustness can be propagated among users in this work.
B ADDITIONAL TECHNICAL DETAILS OF FEDRBN
The structure of FedRBN is illustrated in Fig. 5. The DBN layer has the same input/output interface as ordinary BN layer. Therefore, it can be plugged into most network structures whenever BN can be adopted. Except for DBN layers, FedRBN can be extended to other dual normalization layers, for instance, dual instance normalization Wang al. (2020).
13

---

Under review as a conference paper at ICLR 2022
Parameter operation
Local data operation
Dual BN
Dual BN
R., Y
1i,, o
Hg 03
Diff
Pr.
noise
h2
clean
clean
noise
Figure 5: Illustration of the Dual-BN (DBN) layer and copying operation for robustness propaga- tion.
Algorithm Train an adversarial noise detector
Input: Adversary A(-). local validation dataset Dval
1: Da +-
2: Set f to use clean BN by h +- 0
3: for mini-batch ((z, v)) in Dea do
4: A(x)
Da D (J)
Train a noise detector g(-) on D. by minimizing cross-entropy loss:
= arg min E,, [f(g(1), v)]
(5)
9
7: Return noise detector g(-)
Multiple-source propagation by weighted BN averaging. In FL with multiple AT users available, we suggest a strategy transfer robustness from multiple sources. Given N source BN statistics, we use a weighted average to estimate the noise BN a target user iJ = Ei auii,s.. where Pr... is the estimated value from 8; by Eq. (4). Likewise, of can be estimated. However, the difference between the s,-th adversarial distribution and the t-th counterpart unknown. To tackle the issue, we first present the following result:
Lemma B.1 (Informal). Suppose the the divergence between any data distribution D and its ad- versarial distribution D is bounded, i.e., (HASH(D,1) D) S de where dHAH is H. -ivvereeee in hypothesis space H. If a target model is formed by w--weighted average of models from Day, the summation Σ, (addHHH( (D.,, Dz) of divergence between a set of source standard datasets (D.,) and the target adversarial dataset De weighted by a upper-bounds the generalization error of the target adversarial data distribution D,,
The lemma extends existing bound for federated domain adaptation (Peng al., 2019b), and shows that the generalization eиror the unseen target noised distribution D; is bounded by the oe-weighted distribution gaps. Motivated by the analysis, we set as to be reversely proportional to the divergence between D., and D.. Specifically,
layer-averaged RBF-kernel to approximate weight, i.e., a; = & Σt= exp norolty (D., D.)/p'], where p' is the number of channels in layer 1. The distribution discrepancy can be approximately measured by Wasserstein distance as dyy (D.. D.) = ||m4, - -4il(² + Ilo', - ofll We use large Trof, i... 100 max; p', to contrast the in-distribution and out-distribution difference. Lastly, we normalize as such that Σ, a; = The formal analysis can be found in Appendix B.1.
As described in Algorithm 2, we propose to a support vector machine (SVM) (Cortes & Vapnik, 1995), denoted as g(-), with RBF kernels the validation set of each user. At inference, we predict h in Eq. (3) by h (I()))) The of RBF kernels is partially inspired by (Feinman et al., 2017),
14

---

Under review as a conference paper at ICLR 2022
which used kernels representations instead of logits. We use the most popular SVM instantiation, libsvm, to implement the detector which will automatically sparsify the support samples. Thus, it can successfully avoid the pereeerrmettiiiotioonnn issue.
We are aware of efforts that climinate the detected adversarial samples from test/inference, c.g., (Pang al., 2018). However, simply refusing to predict suspicious samples may break up the downstream services, especially in the challenging scenarios when the detection becomes sensitive and many samples are suspicious. Instead, our method detects and predicts the suspicious samples using the robust model (with noise BN"s), and does not refuse any predictions.
The training and inference of noise detector. Introducing noise detector results in additional training cost, but such overhead is marginal in practice. First, the training is only done once after the network training is done. We only need to forward the whole network once for each sample to obtain the logit required for training the noise detector. Therefore, the overall overhead for receiving robustness is extremely efficient as compared to the AT overhead. Suppose adversarial samples are collected at real time which could be private. Training noise detector only requires approximately a/T x 100% of the training adversarial samples where T the number of epochs and a is the ratio of validation set versus the training set.
B. PROOF OF LEMMA B.
In this section, we use the notation D for a dataset containing images and excluding labels. To provide supervisions, we define a ground-truth labeling function y that returns the true labels given images. So as for distribution 'D.
First, in Definition B.1, we define the HLAH-divergence that measures the discrepancy between two distributions. Because the H HAd-diveeee measures differences based on possible hypotheses (e.g.. models), can help relating model parameter differences and distribution shift.
Definition B.I. Given a hypothesis space H for input space X. the H-divergence between two distributions 'D and DD' is dx (D, D') - 2supses, (S) - Pro (S)) where Sy denotes the collection of subsets of X that are the support of some hypothesis in H. The HA---divegeeccee is defined on the symmetric difference space HAH & (f(x) @ ('xx))h, H E H} where @ denotes the XOR operation.
Then, introduce Assumption B.1 to bound the distribution differences caused by adversarial noise. The reason for introducing such an assumption is that the adversarial noise magnitude is bounded and the resulting adversarial distribution should not differ from the original one too much. Since all users are (or expected to be) noised by the same adversarial attacker A.(-) during training, we can use de universally bound the adversarial distributional differences for all users.
Assumption B.1. Let de be a non-negative constant governed by the adversarial magnitude e. For a distribution DD the divergence between DD and its corresponding adversarial distribution D a (A ~ D) is bounded as dHAH((, D) S d.-
Now, our goal is analyze the generalization error of model on the target adversarial distribution D, i.e., L(fe, D.) E, (.) (] Since estimate ft by weighted average, i.e., E; auff, where f., is the robust model on D.., we can adapt the generalization error bound from Peng et al. (2019b) for adversarial distributions. For consistency, we assume the AT users reside on the source clean/noised domains while ST users reside on the target clean/noised domains. Without loss of generality, we only consider one target domain and assume one user per domain.
Theorem B.1 (Restated from Theorem 2 in Peng et al. (2019b)). Let H. be a hypothesis space of V VC-dimension d and J. D, be datasets induced by samples of size m drawn from (D.. J.N. and Dr respectively. Define the estimated hypothesis as f. & E.= aufa.- Then, Ya R.V.
MN, a; = 1, with probability at least 1 p over the choice of samples, for each f E H.
I(S,D.) L(f, Enx ai (ennantDe D.) 22)+ +C.
N
(6)
15

---

Under review as a conference paper at ICLR 2022
where C' = 4/ 2d 2mlos(2 & is the loss of the optimal hypothesis on the mixture of D.. Nm
and Dr and D, is the mixture of all source samples with size Nm. (D., denotes the divergence between domain 8; and t.
Based on Theorem B.1, we may choose a weighting strategy by as x 1/dHam Dj). However, the divergence cannot be estimated due to the lack of the target adversarial distribution D, Instead, we provide a bound by dean-distribution divergence in Lemma B.2.
Lemma B.2 (Formal statement of Lemma B.1). Suppose Assumption B.1 holds. Let H be hypothesis space of VCC-dimension d and Di=D D₁ be datasets induced by samples of size m drawn from (D.:) Di and D. Let estimated larget ( (robust) model be St = Σ; aiJes where S is the robust model trained on D... Let D. be the mixture of source samples from {D..ien. Then, Vo R.Y,
E 1, with probability at least 1 - p over the choice of samples, for each f E H. the following inequality holds:
(JJD.)) S (AJ,,D) + de + E Oi (Hinsx((D...)) D.) +
N
where C and E, defined in Theorem B.I. D2 the mixture of all source samples with size Nm. (HAH(D., Dt) is the divergence over clean distributions.
Proof. Notice that Eq. (6) loose bound as dHan(D.. D:) is neither bounded nor predictable. Differently, dusu((D (De,, Dz) can be estimated by clean samples which is available for all users. Thus,
we can bound dHAH (Da.: :: D.) with dHAH D,). By Assumption B.1, it is easy to attain
dHAH (m. D.) S dHAH( (Dx, Ds.) ) + dHaH Dt) + dnan (D,, D.) < 2d, + dHaH (Dx, D.),
where we used the triangle inequality in the space measured by duau(;.)). Substitute Eq. (7) into Eq. (6), and we finish the proof.
In Lemma B.2, we discussed the bound for a f E H (which also generalize to fi) estimated by the linear combination of {fs. H. In our algorithm, ft and fs. both represent the models with noise BN layers, and they only differ by the BN layers. Therefore, Lemma B.2 guides us to re- re-weight BN parameters according the domain differences. Specifically, user 8 if dHAH (Da,, De) is large, vice versa. Since dHAH (DD,, Dr) is hard to estimate, we may use the divergence over empirical distributions, i.e., dHAH (Dac D,) instead.
should upweight BN statisties from
C ADDITIONAL EMPIRICAL STUDY RESULTS
In this section, we provide more details about our experiments and additional evaluation results.
C.I EXPERIMENT DETAILS
Data. By default, we use 30% data of Digits for training. Datasets for all domains are truncated to the same size following the minimal one. In addition, we leave out 50% (60% for DomainNet) of the training set for validation for Digits. Test sets are preset according the benchmarks in et al. (2020c). Models are selected according to the validation accuracy. To be efficient, we validate robust users with RA while non-robust users with SA. We use a large ratio of the training set for validation, because the very limited sample size for each user will result in biased validation accuracy. When selecting a subset of domains for AT users, we select the first n domains by the order: (MN, SV, US, SY, MM) for DIGITS, and (R, C, I, P, Q. S) for DOMAINNET. Some samples are plotted in Fig. 6 to show the visual difference between domains.
dlype-paarameter. We fixed parameters tuned by the DIGITS dataset and adopt also for the DOMAINNET dataset: 0.5, = 10 and y = 1/10. The same tuning strategy applied for other baseline parameters.
16

---

Under review as a conference paper at ICLR 2022
23
97
9 aport
9
#byup
Figure 6: Visualization of samples.
Table 7: Network architecture for Digits dataset.
Layer
Details
feature extractor
convi
Con42D kemel size=5, strideml, 1, paddligg=2)
bull
MaxPosl2D(kemdd size=2, stride=2)
conv2
C6642D(64, kemel size=5, stridewl, I, padding=
bn2
DBN2D ReLU, MaxPool2 size=2, stride=2)
conv3
Conv2D kornll size55 strid=1. podding=22
bm3
DBN2D, ReLU
classifier
fel
FCY2048) DBN2D, ReL.U
bnd
fc2
FC(512)
bn5
DBNID, ReL.U
fc3
FC(10)
Network architectures for DIGITS and DOMAINNET are listed in Tables 7 and 8. For the convolu- tional layer (Conv2D or Conv ID), the first argument is the number channel. For fully connected layer (FC), we list the number of hidden units as the first argument.
Training. Following Li et (2020c), we conduct federated learning with local epoch and batch size 32, which means users will train multiple iterations and communicate less frequently. Without specification, we let all users participant the federated training at each round. Input images are resized to 256 x 256 for DOMAINNET and 28 28 for DIGITS. SGD (Stochastic Gradient Descent) utilized to optimize models locally with a constant learning rate 10 2, Models are trained for 300 epochs by default. For FedMeta, use the 0.001 learning rate for the meta meta-gradient descent and 0.02 for normal gradient descent following the published codes from Dinh et al. (2020). We fine-tune the parameters for DOMAINNET such that the model can converge fast. FedMeta converges slower than other methods, as uses half of the batches to do the one-step meta-adaptation. We do not let FedMeta fully converge since have limit the total FLOPs for fair comparison. FedRob fails to converge because locally estimated affine mapping is less stable with the large distribution discrepancy.
Unequal users' data sample. We assume a user samples variable ratio of data, which follows Dirichlet distribution. We plot the different sample sizes for users in Fig. 8. Due the varying dataset sizes, we let each user run fixed number of iterations which is calculated by the average number of the per-epoch iterations of all users.
We implement our algorithm and baselines by PyTorch The FLOPs are computed by thop package in which the FLOPs common network layers are predefined Then we compute the times of forwarding (inference) and backward (gradient computing) in training. Accordingly, we compute the total FLOPs of the algorithm. Because most other computation costs are relatively minor compared to the network forward/backward, these costs ignored in reported results.
'Retrieve the thop python
package
from
https://githbb.com////s
pytorchh-OpConnter.
17

---

Under review as a conference paper at ICLR 2022
Table 8: Network architecture for DomainNet dataset.
Layer
Details
feature extractor
senvl
Conv2DX64, size=11, stride=4, pauling=22)
bal
DBN2D, ReL.U. MaxPool2d(kemad sizess, strid==2)
conv2
Conv2D(192, kemel size=5, stride=l, I, padding=2)
ba2
DBN2D, ReLU, MaxPool2dlkema size=3, stride=2)
conv3
Conv2D kemel size=3, stridewl, padding- I)
DBN2D, ReLU
conv4
Con52DX256, kernel size=3, stride=1, padding==)
DBN2D, ReLU
comv5
Conv21x256, keree sizem3, stridewl, padding--l) DBN2D, ReLU, MaxPoel2d0emmd size=3, stride=2)
aygpool
AdapiveAvgrool2066.00
classifier
fel
FC(4096) DBNID, ReLU FC(4096) DBNID, ReLU FC(10)
bn6
fc2
1:3
PATAug
FATBN
0.9
Soaning taa
RA.190
0.8
0.8
2405 deaccion
0.7
30
10
0.6
SY
US
47
0.0
0.5
1.0
1001
1.7
10P
apoch
Figure 7: The convergence curves and parameters sensitivity of X, C' Cnd y. C' is for regularization and y is for RBF-kernel used in SVM whose performance is evaluated on Digits domains.
C.2 CONVERGENCE AND HYPER-PARAMETER
Convergence. The first plot in Fig. 7 shows convergence curves of different competing algorithms. Since FedRBN only differs from FATBN by a DBN structure, FATBN and FedRBN have similar convergence rates that are faster than others. We see that FedRBN converges even faster than FATBN. A pos- sible reason is that DBN decouples the normal and adversarial samples, the representations after BN layers will be more con- sistently distributed among non-iid users.
MNIST L
SynthDigas
SVHN
Parameter Sensitivity of the X, C and y. The second plot in Fig. 7 shows a preferred is neither too small or too close to 1. Since À is critical when heterogeneity is severer, we evaluate the sensitivity as only one domain (MNIST in DIGITS) is adversarially trained. We find that larger À more helpful for the RA, as the estimation is closer to the true robust one. The rest plots in Fig. demonstrate the stability of the noise detector when a choice of C = 10 and 7 1/10 for SVM generally works.
Figure 8: Dataset sizes for users when the global seed set Larger circles indicate more train- ing samples. The x-axis represents the user index.
C.3 IMPACT OF DATA SIZE AND VALIDATION RATIO
To investigate the impact data size, we conduct experiments with varying training dataset sizes and validation ratios. Experiments follow previous protocols on the Digits dataset. Following the training/testing split in Li et al. (2020c), we first sample a percentage of data for training. From the training set, randomly select subset for validation. We denote the two subsampling ratios as training percentage and calidation ratio, respectively. When varying the training percentage, fix the validation ratio at 10%. When varying the validation ratio, 30%
18

---

Under review as a conference paper at ICLR 2022
training data. As shown in Fig. 9a, more training samples can improve the robustness and our method outperforms baselines consistently. In Fig. 9b, the ratio of validation set is less influential for the robustness performance of our FedRBN, but larger validation ratio reduce the time complexity of training as less samples are used for gradient computation. Though baseline methods obtain higher robust accuracies with smaller validation ratios, method still introduces large gains in all cases.
50
80
50
FedRRN
FodAAg
FodAvg
40
70
FeddNN
Fedih
Training percentage
Trasning percentage
(a) Varying the size of training
(b) Varying the ratio of validation data in training
Figure 9: Experiments with varying data size.
C.4 LOGITS OF ADVERSARIAL AND CLEAN EXAMPLES
Visualization of logits by t-SNE is presented in Fig. 11 (DIGITS) and Fig. 10 (DOMAINNET). We generally observe that the clean and adversarial logits are separable with generalizable decision boundaries. Moreover, MNIST and USPS domains turn out to be the most separable cases as they are easier classification tasks compared to the rest ones. Though some domains have a few mixed samples in the visualization, their noise detection accuracies are mostly higher than 90%. Thus, is rational to fit noise detector on the validation set for helping BN selection at test time.
Donn shoclppt
Dorantosandrg
Dermal Mitiiou oidtee
Cemsde Mekresl
Figure 10: Logits of standard-trained models visualized by t-SNE on DOMAINNET.
C.5 RESULTS ON THE OFFICE- CALTECH10 DATASET
Following the same setting as Do- MAINNET experiments, we ex- tend our experiments to smaller dataset, 10 dataset pre- processed by Li et al. (2020c) with images acquired by different cam- eras. The dataset includes domains: Amazon, Caltech, DSLR, Webcam. Because the dataset has very few sam- ples, we only generate 2 users per do- main such that each user has least
Table 9: Comparison to baselines the dataset. Standard deviations are reported in brackets.
AT
Amazon
metric
RA
SA
RA
SA
FedRBN (ours)
9.2 (3.4)
(3.4)
29.1 (2.4)
68.7 (1.7)
FedBN
5.1 (1.1)
65.9 (2.4)
30.8 (2.5)
(2.1)
FedAvg
0.6 (0.5)
54.7 (3.8)
13.3 (2.3)
(2.6)
FedProx
(.6
55,3 (4.7)
(3.6
56.2
19

---

Under review as a conference paper at ICLR 2022
1940
Figure 11: Logits of standard trainned models visualized by t-SNE DIGITS.
100 samples. In Table 9, we see that our method outperforms haselines as only one domain is adversarially trained. As the training set is rather small, the RAs are generally worse than the on DIGITS or DOMAINNET.
Table 10: Comparison to robustness transferring by fine-tuning (FT).
FT iterations
freeze layers
RA
SA
FedRBN FedAvg
53.1
84.4
44.7
85.7
FedAvg-FT
200
0
39.2
83.6
FT
31.6
78.2
FodAvg4FT
200
29.8
74.7
FedAvg+FT
200
31.5
66.1
FedAvg+FT
100
0
40.6
83.4
FT
32.0
77.5
RodAvg+FT
100
31.5
72.9
FedAvg+FT
100
31.5
64.5
FedAv++FT
20
0
40.6
79.6
FedAvg+FT
33.4
73.8
FedAvg+FT
20
31.9
66.8
FedAvg=FT
31,9
62.2
C.6 COMPARISON TO ROBUSTNESS TRANSPERRING BY FINE-TUNING
As an alternative FRP, fine-tuning (FT) the sederated-trained models on target users can enjoy even better efficiency than FedRBN. Here, we first train AT users by FedAvg for 300 epochs. Note that we do not adopt FedBN because FedBN will not output single model for adapting to new users. Then, the model is used for initializing the models for ST users. These ST users will be trained by FedAvg for given number of FT iterations. Still, we adopt the 20% 3/5 domain FRP setting on the DIGITS dataset. In Table 10, we see that such a fine-tuning does not improve the robustness (RA).
C.7 EXPERIMENTS IN FIG. 1B
Though the results in Fig. lb have been reported in previous experiments, we re-summarize the results in Table 11 for ease of reading. The basic setting follows the previous experiments on the Digits dataset. We construct different portions of AT users by in-domain or out-domain propagation settings. When robustness is propagated in domains, we sample AT users in each domain by the same portion and leave the rest as ST users. When robustness is propagated out of domains, all users from the last two domains will not be adversarially trained and gain robustness from other domains. Concretely, we add the FedRBN without copy propagation (F (FedRBN w/o prop) in the table, to show the propagation effect. FecREN w/o prop outperforms the basclines only when the AT-user portion is more than 60%. Meanwhile, due the lack of copy propagation, the RA is much worse
20

---

Under review as a conference paper at ICLR 2022
than the propagated FedRBN. Unless AT user presents in the federated learning, FedRBN always outperforms baselines.
Table 11: Results and detailed configurations of Fig. lb on the 5-domain Digits dataset. FedAvg and FedBN corresponds to FATAvg and FATBN in the figure.
AT-user ratio
propagation
method
RA
SA
AT domain
per-domain AT ratio
none
FedRBN (ours)
FedRBN wlo prop
32.1
84.3
0,0
FodAvg
35.3
82.0
FodBN
32.1
84.3
0.0
FedRBN (ours)
FedRBN wlo prop
38.7
84.5
20%
FedAvg
FedBN
42.4
86.0
20%
20%
in-domain
FedRBN (ours)
57.3
FedRBN wlo prop
46.1
86.1
20%8
Fed/vg
FedBN
44.8
86.0
20%
60%
out-domain
FedRBN (ours)
61.6
85.0
FedRBN wlo prop
56.2
85.5
100%
Fed/vg
FedBN
53.0
85.5
100%
100%
FodRBN (ours)
65.7
85.9
100%
FedRBN wlo prop
65.8
85.9
100%
Fed//g
FedBN
59.1
85.9
100%
C.8 JOINT ATTACK ON NOISE DETECTOR AND MODEL PREDICTION
Furthermore, to check if the adversarial attacker can bypass the noise detector, we use PGD to jointly maximize the sum of the cross- cross-entropy losses of the noise detector and the inference model. We show the results on the Digits and DomainNet datasct following the settings of Table 2. For ease of comparison, also include baseline results from Table 2. As observed in Table 12, method FedRBN outperforms baselines consistently in all benchmarks.
To show the JointPGD does fool the noise detectors, present the detection accuracy of adversary samples in Table 13. The detectors of FedRBN have lower accuracies due to the joint attack, compared to FedRBN under PGD attack.
Table 12: The robust accuracy of FedRBN under joint PGD attacks. Baseline results are present with PGD attacks. Standard deviations included in brackets.
Digits
DomainNet
AT users
All
20%
MINSTT
All
20%
Real
FedRBN (ours)
61.4 (0.5)
50.6 (1.3)
41.8 (1.6)
30.2 (0.3)
23.7 (0.8)
17.3 (1.2)
FATRN
60.0
41.2
36.5
29.9
20.3
11.3
FATAvg
58.3
42.6
38.4
24.6
15.4
9.4
FATProx
58.5
42.6
38.1
24.8
14.5
9.4
21

---

Under review as a conference paper at ICLR 2022
Table 14: Evaluation with different FL configurations
Table 13: Detection accuracy by PGD and joint PGD
attacks.
B
method
RA
SA
FATEN
Digits
DomainNet
FedRBN
60.0
82.8
Atlack
All
20%
MNIST
All
20%
Real
FATRN
42.0
75.8
FedRBN
56.3
76.1
81.4
65.8
Joint FGD
63.9
56.8
52.3
56.2
63.8
65.8
10
8
FATRN
30.9
63.1
FedRBN
68.4
50
FATEN
37,0
85.8
100
FATBN
35.7
85.3
FedRBN
53.0
83.8
22

---

Under review as a conference paper at ICLR 2022
D ADDITIONAL EXPERIMENTS FOR REBUTTAL
D.1 PARTIAL PARTICIPANTS
not expect that all users available for training in each round. Therefore, important to evaluate the federated performance when only a few users can contribute to the learning. To simulate the scenario, uniformly sample number of users without replacement per communication round. Only these users will train and upload models, In Fig. 12, RA and SA are reported against the number of selected users. We observe that SA is barely affected by the partial involvement, while RA increases by fewer users per round. Since the actual update steps in the view of the global server are reduced with lower contact ratios, the result is consistent with Table 14, where smaller batch sizes or fewer local steps lead to better robustness.
In reality,
57.5
90.0
$5.0
87.5
FedRRNN
$ 52.5
Avg
50.0
FedRiNN
47.5
80.0
FATAvg
1od12N
45.0
77.5
20
4 user per round
#user per round
50
180
325
375
Figure 12:
Vary the number of involved users per communication round. The validation accuracy is computed by averaging users' accuracy. For AT users, the RA is used while SA is used for ST users.
D.2 SCALABILITY WITH MORE USERS
Since our method has the similar traiiin/commmuicattion strategy FATBN FATAvg (except switching and copying BN which are quite lightweight), the federation of FedRBN and its complexity scale up to more users like FATBN FATAvg who widely used scalable implementations. To empirically evaluate the scalability of our method versus FATBN and FATAvg, we experiment with more clients given the Digits dataset. With the same total training samples, we re-distribute the data to different numbers of clients in non-uniform manner. In Fig. 13, we evaluate the RA and SA by increasing the total number of users, including 25, 50, 150, 200. In each communication round, 50% randomly selected users will upload their trained models. The trend shows that both RA and SA will be lower when samples are distributed to more clients. Despite the degradation, our method maintains advantages in RA consistently.
In Fig. 13, we also demonstrate that method converges faster than baselines either with fewer or more users. The validation accuracy is computed by averaging users' accu- racy when RA is used for AT users and SA for ST users. As observed, when data are more concentrated in few users (i.e. smaller numbers of users), the convergence will be faster. The result is natural for most non-iid federated learning problems. For ex- ample. Li et al. (2020b) proved that more clients will result worse final losses and slower convergence.
65.0
62.5
FedRBN
90
FATAv9
FATBN
85
Uiver
$ 57.5
25
80
55.0
FedRBN
75
FATAvg
50.0
FATON
90
250
Figure 13: Robustness and accuracy by the increasing total number of users as 25, 50, 150, and 200. The larger scatter in the left figure indicates more users.
D.3 MORE CORRELATION PLOTS OF BN STATISTICS
We provide more correlation plots of BN statistics in Fig. 14 as supplementary to Fig. 2b. In most layers, the cross-domain difference of BN statisties is linearly correlated between clean and robust
23

---

Under review as a conference paper at ICLR 2022
ones. The linear correlation is weak in some shallow layers. One reason is that the coupling of adversarial noise and data undermine the voise-independence assumption made for Eq. (4). The decoupling is further discussed in Appendix D.5.
02
60
60
60
0.2
182
-02
-04
-04
0.0
-04
A-7
11
1000
-05
-03
-10
-12
-10
1od boe-
100 -X5c
-kad
Figure 14: Correlation of statistic differences mean (top) and log-variance (bottom) in BN layers.
Table 15: Robustness propagation using ResNet1 8.
D.4 EXPERIMENTS WITH RESNET
Like Table 2, we conduct the same Domain- Net experiments but using ResNet18 (He et al., 2016) in place of AlexNet. Most con- figurations are the same but we use cosine- annealing schedule of the learning rate from 0.05 to 0 within 600 epochs. Compared to AlexNet, ResNet18 is significantly more robust in all three tasks. Consistent with the AlexNet-based results, method outperforms the two best baselines.
AT
20%
Metries
RA
SA
RA
SA
FedRBN (ours)
59.1
61.6
49.6
63.1
42,9
56.4
FATBN
25.5
FATAng
46.6
57.1
36.5
61.6
18.8
49.0
D.5 WHEN DOES DEBIASING WORK?
0.5
On deriving Eq. (4), we made an assumption of the independence of adversarial noise. By investigating how the assumption holds up in real datasets, we want to know when the debiasing strategy could improve the robust accuracy. For this purpose, we leverage Pear- son coefficients (IP) to estimate how depen- dent the noise is on the input images. For each user in the Digits dataset, we caleu- late R(H -4) P(N Mr, 22/ where μ4, Mi are the statisties of the layer {I,.... ....,,L,, L}. The experiment protocol follows the 100% 1/5 domain setting Table 1.
08
1 Et=((P(t 1 pr, -1,1))
3.45
050
Figure 15: Evaluation of the noise-independence as- sumption (left two) and its effects users' RA im- provement from debiasing (right two). Estimated by the Pearson coefficient, R presents the degree which noise statistics (e.g., jd j1) are correlated to data statistics (c.g., p))
As reported in Fig. 15, we find that the dependence weakens by layer and the RA improvement brought by debiasing is aug- mented by lower dependence, i.e., R. The phenomenon is related to the nature of adversarial noise. Since adversarial noise is inherently subtle to be decoupled from noised images, the linear modeling of mmch-normalization in shallow layers is less likely to extract the noise (for example, by of f4). In deeper layers, the noised and clean features deviates from each other, for example, in the logit layers (see Fig. 11). Therefore, the noise correlation is weaker for the coise-independence assumption to hold better and our debiasing method more effective in improving propagated robustness.
24


Reviews:
[{"review_id": "p8VgHQblHN", "reviewer": "Reviewer_udUC", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "Strengths:\n(1) A novel FedRBN method was proposed for adversarial robustness propagation among users in the federated learning setting.\n(2) The dual batch-normalization (DBN) structure enabled communication efficiency and robustness propagation.\n(3) Experiments showed that it improved the adversarial robustness of the federated learning algorithms.\n\nWeaknesses:\n(1) One major concern is the rationality of the dual batch-normalization (DBN) structure in the proposed method. The results in Table 1\nindicated that “simply adding DBN does not help unless the noise detector is applied”. On the other hand, different from prior work, it\nused shared weight and bias in the design of DBN. It is not clear whether the parameter sharing strategy explained the limitation of\nDBN-only module in the proposed method. In addition, the difference between “+copy” and “+debias” is not clear.\n(2) Compared to FATBN, FedRBN used the robustness propagation from AT user to ST user. In this case, it is not shown whether FATBN allows adversarial training for every user. If so, why is it performing worse than FedRBN with robustness propagation? \nIn other others, can the robustness propagation on one ST user achieve better performance than performing adversarial training on this user? Or the performance improvement can be explained by the DBN and the noise detector in FedRBN?\n(3) The strategy of learning user-specific BN parameters is close to a federated multi-task learning problem [ref 1]. It might be \nconvincing to have some discussion on comparing this work to the federated multi-task learning solutions.\n[ref 1] Smith, Virginia, Chao-Kai Chiang, Maziar Sanjabi, and Ameet Talwalkar. \"Federated multi-task learning.\" In Proceedings of the 31st International Conference on Neural Information Processing Systems, pp. 4427-4437. 2017.\n(4) It is not convincing why ST users would average the statistic difference received from all AT users. On one hand, this averaging method in FL has shown to be sensitive to Byzantine attacks.  On the other hand, it might be dominant in the major data distribution\nD_i shared by most AT users in real-world scenarios. Sending the averaged statistic difference to all ST users with different \ndistributions could lead to a sub-optimal solution.\n(5) As one of the key component of FedRBN, the training of the noise detector needs to be clarified, especially for ST users with limited\ndata and computational budgets. Can the noise detector be propagated from AT users to ST users in this case?\n(6) The legend of Figure 3(b) is confusing.\nMinor issues:\n(1) Some notations are undefined, e.g., q_a and q_k.\n(2) There are some grammar errors, e.g., “the corresponding two distribution, separately.”, “the server aggregate BN statistic”, etc.\u0000", "summary_of_the_paper": "This paper studied the propagation of adversarial robustness among federated learning users, where some users had limited training data and computational budgets for affording the adversarial training. It proposed a novel method Federated Robust Batch-Normalization (FedRBN) to facilitate this propagation. The key step was a dual batch-normalization (DBN) structure to encode the clean and adversarial distributions respectively. Then the debiased BN statistic for low-resource users was estimated from other users who could afford the expansive adversarial training. The experiments supported that this approach improved the adversarial robustness of federated learning.\u0000", "summary_of_the_review": "The rationality of technical details used in this paper is not well explained, thus I recommend the rejection of this work for ICLR.", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "2: Several of the paper’s claims are incorrect or not well-supported.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}, {"review_id": "oUSmEIn5huH", "reviewer": "Reviewer_B9Be", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "# Strong Points\n* As for the centralized case, the robustness issue is also important in the federated learning context. Hence, this paper addresses an important concern.\n* The concept of some parties having more resources than others and can therefore afford to perform adversarial training is reasonable and realistic. \n* The paper is overall well-written and easy to follow. \n* The authors provide extensive experimental results. \n\n# Weak Points\n* The theoretical novelty of this work is somewhat limited. In essence, the authors just apply previous insights, such as the distributional shift caused by BN and adversarial training to the context of federated learning. The authors did not reveal any new insights regarding these topics which are specific to the federated learning topic. \n* The proposed approach uses a dual batch-normalization (DBN) strategy. To decide which one of the BN statistics to use, the authors state that they “predict whether the image is noised”. Here, I identify a fundamental flaw of this work, since previous works showed, that most adversarial detection techniques can be fooled [1,2,3,4], e.g. due to obfuscated gradients. Different guidelines had been proposed to check against these techniques [2,3]. The proposed noise detector seems to be a DNN-based binary classifier, similar to the approach in [5]. Hence, a simple idea for a full white-box evaluation would be to include a loss term with the objective to fool the noise detector in the adversarial example generation. This issue is critical since the noise detector appears to be crucial for the efficacy of the DBN as seen from Table 1 and stated by the authors: “DBN does not help unless the noise detector is applied”. \n* The authors state that “The black-box can avoid the trip of fake robustness due to obfuscated gradient”. I do not agree with this statement, since usually, a black-box attack is harder than a white-box attack. A good start to test against obfuscated gradients would be to evaluate with Backward Pass Differentiable Approximation (BPDA) [2].\n* The used baselines are not clear to me. The authors state that they “use three representative federated baselines combined with AT”, but also “denote the AT-augmented” version with a FAT prefix. From this description, the difference between FedAvg and FATAvg is not clear. Due to this confusion, I assumed that the methods with the Fed prefix refer to the paper baselines, while the AT variants are denoted with the FAT prefix. This might be my fault for not understanding something here, but I would be happy if the authors could clarify this in the rebuttal, such that I can clearly understand the results. \nIt would also be good to add citations to the corresponding technique in the Tables for clarity, or if not the exact method is used to clearly state the differences to the previous technique and the reasons for the introduced changes.   \nFrom Table 2 it appears that the standard techniques are already relatively robust against adversarial attacks. Commonly I would assume that a “non-protected” method (FedBN, FedAvg, FedProx) would have a RA of around 0%. Why is this?   \nFurther, Table 2 compares two other “robust” methods (FATMeta & FedRob). These methods achieve the worst results. This result also seems counterintuitive and requires a detailed discussion in my opinion.   \nThe same applies in Table 3. Why do FATAvg and FATBN show lower robust performance than FedAvg and FedBN? Why do the numbers of FedRBN from Table 2 and Table 3 not match?   \nI am also missing a comparison with FAT (Zizzo et al., 2020;)\n* The choice of AlexNet for the DomainNet experiments is outdated, especially since BN has to be added. I recommend the authors to include results at least for a ResNet architecture.  \n\n[1] Adversarial Examples Are Not Easily Detected: Bypassing Ten Detection Methods; AISec’17  \n[2] Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples; ICML 2018  \n[3] On Evaluating Adversarial Robustness; arXiv 2019  \n[4] Detecting Adversarial Examples Is (Nearly) As Hard As Classifying Them; ICML 2021 workshop  \n[5] On Detecting Adversarial Perturbations; ICLR 2017\n\n\n# Additional Questions\n* Will the code be publicly available?\n", "summary_of_the_paper": "This work studies adversarial robustness in a federated learning context. The authors propose to propagate robustness through sharing BN statistics of the different federated learning participants. Hereby, the authors consider that some parties are stronger (e.g. through higher resource power) to perform adversarial training, and can provide weaker parties with the respective parameter updates. ", "summary_of_the_review": "Robustness is an important issue also in the federated learning context. Overall I identify the noise detector as the main bottleneck of this work since a “smart” adversary can incorporate it into its attack strategy and can therefore probably significantly deteriorate the entire FedRBN pipeline. Also, the main results appear confusing to me and require some further discussion. \n\n======= Edit November 23 =========  \nRaised my score to \"marginally above the acceptance threshold\" after reading the rebuttal. ", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "GsybNcZ5Mv6", "reviewer": "Reviewer_dgjR", "summary": "", "questions": "", "limitations": "", "rating": 8, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "Making model robust against adversaries is very important for deploying FL. The authors present a practical and effective approach to tackle this issue. It is interesting to propagate adversarial robustness via transfer of batch-normalization statistics from high-resource users to low-resource users. The effectiveness of the proposed method is validated by extensive experiments and ablation studies. The paper is well-written and easy to follow overall.\n\nThe idea of debiasing is not very clear. Eq 4 can work well if the noise values at both users follow the same distribution as described in page 5. However, can Eq. 4 really help when the noise distributions are not the same? The effect of debiasing seems to be marginal in \nTable 1. I want to see more experimental results on this particular issue (ablation on when debaising works well versus when does not), as it is a key component of the proposed idea. \n\nWhile writing is good overall, certain points are vague. Explanations and motivations related to Fig. 2 should be made more clear. For example, Fig. 2a is presented to argue there are significant differences in BN parameters between ST and AT users from the same domain. But this is incomprehensible. Also, is there any reason why BN2 is picked for Fig. 2b? Are the correlations similar across BN layers?\n\nThere seem to be significant enough departure from a simple linear relationship between the delta log variance of clean samples vs that of perturbed samples in Fig. 2b. Yet the algorithm gives good performance overall. I would like to see some sort of convergence analysis that can give insights into, e.g., the effect of uncertainly in such linear modeling on the convergence behavior. Note, most FL paper today provide analysis to ensure a controllable convergence behavior. The authors can build on existing convergence analysis. \n\nAmong 50 users in the system, how many users participate in FL at each round? This is not clearly described, and I believe the authors assume all users participate in each round. How does the proposed method perform when the contact ratio is small (e.g., 20 or 30 users out of 100, per round), which reflects the practical cross-device federated learning setup? The global statistics on batch-normalization can also be biased when the contact ratio is less than 1.  \n\nAlso, the total number of devices is set to 30 or 50 depending on datasets in the presented experiments. But standard FL tasks require large-scale learning. Can you comment on the scalability of your method? (specifically, would it perform well in the presence of more devices?) \n\n\n\n", "summary_of_the_paper": "Adversarial training (AT) is good for defending against attacks but is costly for low-resource FL users. The authors want to find a good way to propagate adversarial robustness from high-resource users to low-resource ones. They proposes federated robust batch-normalization (FedRBN) which enables all users to enjoy robustness against malicious attacks at inference. The basic idea is to let the BN statistics of AT users be shared with the standard users so that the latter can do robust prediction on adversarial inputs without conducting AT on their own. The authors also propose a debiasing method to mitigate the effect of non-IID data distributions across the clients. Experimental results including various ablation studies confirm the advantage of FedRBN.\n", "summary_of_the_review": "Overall a good paper, but I am still giving the “marginally above” score due to some questions/concerns as given above; however, upon getting reasonably satisfactory answers, especially to the convergence analysis question, I will be happy to move higher to the positive side.    ", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}, {"review_id": "8jj26aP2tyU", "reviewer": "Reviewer_bKE4", "summary": "", "questions": "", "limitations": "", "rating": 8, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "This paper aims to improve the adversarial robustness of federated learning with heterogeneous users. The authors consider both the statistical heterogeneity and the computational heterogeneity in federated learning, which is a realistic scenario. Considering the heterogeneous computational resource on different users, they propose to use a small fraction of clients for adversarial training, and copy the BN layers of these clients to others who could not afford for adversarial training to propagate the adversarial robustness. The method is simple and the experiments show that it is effective.\n\nStrengths:\n1. The paper studies an important trustworthy AI topic: preserving both privacy and robustness via a new federated robust training scheme. Since robust training is often too expensive for edge users, the authors studied a novel setting of practical relevance: users with limited restricted budgets only afford cheaper standard local training and obtain robustness from other budget-sufficient users who use adversarial training. \n\n2. The proposed method is simple and intuitive. They take advantage of the idea from the previous work that the robustness is highly correlated with the BN layers, and propose to propagate the robustness from a robust user to a non-robust user with linear combination of the BN statistic. The authors also setup a verification experiment to show that the linear combination is reasonable.\n\n3. The evaluation is very thorough and convincing. Detailed experiments involving multitude of datasets from different domains (to capture data heterogeneity). To fully evaluate the robustness, the authors experiment with (black-box) MIA, (adaptive) AutoAttack and LSA. The method still outperforms the baselines by a large margin under adaptive attacks. I also appreciate authors providing standard deviations for results.\n\nWeaknesses:\n1. In the last paragraph of Sec 4.1, the authors assumes the noise in each layer is independent of the data: I don’t understand this assumption since adversarial noise is data-dependent.\n\n2. Since the BN layers are only updated locally with limited data and/or SGD rounds, it is unclear to me why the BN parameters can be sufficient to capture the robustness property?\n\n3. The proposed method mainly focuses on the feature heterogeneity. I would like to know whether FedRBN still work under label heterogeneity, which could be a more challenging heterogeneous scenario.\n\n4. Have the authors tried to scale to more clients, or more skewed local data distributions?", "summary_of_the_paper": "This paper proposes a simple yet efficient method to improve the adversarial robustness of federated learning. The proposed method allows only a subset of clients to perform computationally expensive adversarial training, and then propagate the robustness on these clients to the others who could not afford the adversarial training. Extensive experiments are conducted and the results show that the proposed method outperforms other baselines.", "summary_of_the_review": "This work has strong motivation and adds novel contributions to federated learning, i.e. studying federated learning robustness under heterogeneity, The proposed model is simple yet easy to understand, and is theoretically grounded. Experiments are convincing, although a few questions remain to be clarified by authors. ", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "4: All of the claims and statements are well-supported and correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}, {"review_id": "1hvvaEsCy4-", "reviewer": "Reviewer_p9LS", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "Pros:\na. The authors propose Federated Batch-Normalization (FedRBN) to transfer robustness between users participating in FL. They build on a prior observation (in the centralized setting) that robustness is correlated with BN statistics and hence copying BN parameters could lead to transferring robustness.\n\nb. The authors decouple the effect on BN parameters to (1) Domain difference (due to non-iid data) and (2) Adversarial noise (due to AT). To counter this they propose to use a dual batch-normalization structure, which keeps track of two sets of BN statistics: one for clean data and another for noisy data (due to AT).\n\nc. Finally, they propose a de-biased estimation of the robust BN statistics (mean, variance) for the ST users (Eq. (4)) which leads to the transfer of robustness from users in AT to users in ST. The authors use a one-dimensional example to justify their choice of expression in (4).\n\nd. I like the choice of datasets used by the authors to perform the evaluation. \n\nCons:\n1.  The paper needs a careful editorial pass. There are numerous typos, and certain parts of the paper could benefit immensely from more clarity in writing. \n\n2. The contributions of this paper are marginal. For example, prior work (FedBN) has shown that the federation of BN parameters leads to poor model accuracy. Hence, these parameters are only locally optimized. Similarly, the connection between BN parameters and robustness has also been made. This paper proposes a mechanism to transfer BN statistics between users. Furthermore, the linear mapping is not rigorously justified. \n\n3. The post-training modification of the BN statistics and its effect on model performance seems to be heavily dependent on the model-wise switch parameter $h$ (defined on pg 5). In this context, Algorithm 3 (in the appendix) is very important. If it is not able to separate a being sample from the adversarial one then the performance would be impacted. However, confident detection of adversarial examples is still an area of active research. I would really like to see more evidence of the performance of Algorithm 3 for stronger adversarial attacks. \n\n4. Similarly, AA has been shown to be a stronger form of attack than PGD. It is not clear to me why a much weaker attack (PGD, n=7) was used for training the models. In fact, I do not completely understand how Table 4 has been generated. \n\nClarifications:\na. What is the definition of $q_k$ in Sec 3.2.\nb Shouldn't (2) be better expressed using ${\\bf q}$\nc. In Algorithm 2, sometimes $\\sigma_s^{r^2}$ is used whereas at other times $\\sigma^{2^r}$ is used. It would be great if there could be more consistency in notation.\nd. Some claims, for example, the authors mention that the copy of the de-biased BN statistics does not leak more information compared to FedAvg. However, no justification has been made for it. I understand that it could be orthogonal to the problem under study, but the claim seem to be a fairly important one and has not been justified. \ne. Readability would be improved if the authors explicitly associate operations such as +detector, +copy, +debias (used in the ablation study) with their mathematical descriptions provided earlier in the paper.\n", "summary_of_the_paper": "The paper studies the problem of propagating adversarial robustness in federated learning. Adversarial Training (AT) is typically used for training models that are robust to adversarial examples, however, AT requires computing resources that are not always available at all devices participating in FL. The paper proposes a strategy to transfer adversarial robustness among a group of FL users (characterized by non-iid data and heterogeneity in available computing resources, allowing only a fraction of them to perform AT).", "summary_of_the_review": "Please see the detailed comments above.", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "4: All of the claims and statements are well-supported and correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}]

Author rebuttal:

Meta-review: This paper considered the computational budgets of adversarial training in the context of Federated Learning and studied the propagation of adversarial robustness from affordable parties to low-resource parties. Although the authors conducted the extensive experiments to show the effectivenss of FedRBN, there are still important concerns from the reviewers,

(1) The novelty is marginal compared to FedBN, DBN and previous insights, which moves the similar framework to adversarial robustness and changed the rules, especially given the competitive ICLR. More theorectical novelty will be preferred. 

(2) Many technical details are not well explained and some parts need to be improved, which make the reviewers not well convinced about FedRBN. 

Given above points, I will recommend rejection and encourage the authors to improve the paper in the future.
Decision: Reject