Combating Exacerbated Heterogeneity for Robust Models in Federated Learning
Authors: Jianing Zhu
Jiangchao Yao
Tongliang Liu
quanming yao
Jianliang Xu
Bo Han
Venue: ICLR 2023 poster (2023)

Abstract: Privacy and security concerns in real-world applications have led to the development of adversarially robust federated models. However, the straightforward combination between adversarial training and federated learning in one framework can lead to the undesired robustness deterioration. We discover that the attribution behind this phenomenon is that the generated adversarial data could exacerbate the data heterogeneity among local clients, making the wrapped federated learning perform poorly. To deal with this problem, we propose a novel framework called Slack Federated Adversarial Training (SFAT), assigning the client-wise slack during aggregation to combat the intensified heterogeneity. Theoretically, we analyze the convergence of the proposed method to properly relax the objective when combining federated learning and adversarial training. Experimentally, we verify the rationality and effectiveness of SFAT on various benchmarked and real-world datasets with different adversarial training and federated optimization methods. The code is publicly available at: https://github.com/ZFancy/SFAT.

Published as a conference paper at ICLR 2023
COMBATING EXACERBATED HETEROGENEITY FOR ROBUST MODELS IN FEDERATED LEARNING
Jianing Zhu'
Jiangchao Ya Tongliang Liu" Bo Han't
Quanming Yao
Jianliang Xu'
Hong Kong Baptist University "Shanghai Jiao Tong University Shhnnhai Al Laboratory *Sydney Al Centre, The University of Sydney Tiinghua University
(esjnzhu, xujl. b @ecomp.hku.eduu hk Sunarker@sjtu.edae tongliang.liut @ sydney.edu.au qyaoaa @ tsinghua.edu.cn
ABSTRACT
Privacy and security concerns in real-world applications have led to the devel- opment of adversarially robust federated models. However, the straightforward combination between adversarial training and federated learning in one framework can lead to the undesired robustness deterioration. We discover that the attribution behind this phenomenon is that the generated adversarial data could exacerbate the data heterogeneity among local clients, making the wrapped federated learning perform poorly. To deal with this problem, we propose a novel framework called Slack Federated Adversarial Training (SFAT), assigning the client-wise slack dur- ing aggregation to combat the intensified heterogeneity. Theoretically, we analyze the convergence of the proposed method to properly relax the objective when combining federated learning and adversarial training. Experimentally, we verify the rationality and effectiveness of SFAT on various benchmarked and real-world datasets with different adversarial training and federated optimization methods. The code is publicly available at: ht //g/t//ttttt///t com/ ZF ancy / SFAT.
INTRODUCTION
Federated learning (McMahan et al., 2017) has gained increasing attention due to the concerns of data privacy and governance issues (Smith et al., 2017: Li et al., 2018: Kairouz al., 2019; Li et al., 2020; Karimireddy et al., 2020; Khodak et al., 2021). However, training in local clients aggravates the vulnerability to adversarial attacks (Goodfellow et al., 2015; Kurakin et al., 2016; Li al., 2021c; Sanyal et al., 2021), motivating the consideration of adversarial robustness for the federated system. For this purpose, some recent studies explore to integrate the adversarial training into federated learning (Kairouz al., 2019; Zizzo et al., 2020; Shah et al., 2021). Federated adversarial training faces different challenges from perspectives of the distributed systems (Li et al., 2020) and the learning paradigm (Kairouz al., 2019). Previous works mainly target overcoming the constraints in the communication budget (Shah et al., 2021) and the hardware capacity (Hong et al., 2021).
However, one critical challenge in the algorithmic aspect is that the straightforward combination of two paradigms suffers from the unexpected robustness deterioration, impeding the progress towards adversarially robust federated systems. As shown in the Figure (a)), when considering the Federated Adversarial Training (FAT) (Zizzo et al., 2020) that directly employs adversarial training (Madry et al., 2018) in federated learning based on FedAvg (McMahan et al., 2017), one typical phenomenon is that its robust accuracy dramatically decreases at the later stage of training compared with the centralized cases (Madry et al., 2018). To the best of our knowledge, there still lack of in-depth understanding and algorithmic breakthroughs to overcome it, as almost all the previous explorations (Shah et al., 2021; Hong et al., 2021) 1) still consistently adopt the conventional framework (i.e., FAT).
We dive into the issue of robustness deterioration and discover that it may attribute to the intensified heterogeneity induced by adversarial training in local clients (as Figure 2 in Section 4.1). Compared
1 Corresponding authors: Bo Han (bhanml (bhanm@@comp.... hwwoom...kuu.eeee and Jiangehao Yao (Sunarker@ canmarker@sju..cdu.cn sjtu.edu.en).

---

Published as a conference paper at ICLR 2023
37.5
70
$2.5
Accuraoy
50
FAT: Natual AT: Natural
FAT: Robust
AT: Robust
10.0
FAT AFAT
27.5
Beat FAT
25.0
22.5
200
Communication Rounds
Communication Rounds
(a) Centralized AT FAT
(b) FAT vs. SEAT (ours)
Figure I: (a) comparison between centralized AT (Madry et al., 2018) and FAT (Zizzo et al., 2020) in terms of the robust accuracy and the natural accuracy. (b) comparison between FAT and SFAT (our proposed method). All the experiments of FAT and SFAT are conducted on CIFAR- 10 dataset (Non- IID) with 5 clients, and use natural test data and adversarial test data generated by PGD-20 (Madry et al., 2018) to evaluate the natural and robust accuracies. Compared with centralized AT, FAT shows performance decreasing (especially the robust accuracy) along with the learning process. In comparison, our proposed SFAT can achieve a higher robust accuracy than FAT (as indicated by the black dash line) by alleviating the deterioration. The underlying reason is elaborated out in Figure 2.
with the centralized adversarial training (Madry et al., 2018), the training data of FAT is distributed to each client, which leads to the adversarial training in each client independent from the data in the others. Therefore, the adversarial examples generated by the maximmaxxinnttion of adversarial training tend to be highly biased each local distribution. Previous study (Li et al., 2018; 80 2019) indicated the local training in federated learning exhibits the optimization bias under the data heterogeneity among clients. The adversarial data generated by the biased local model even exacerbate the heterogeneity in federated optimization, making it more difficult to converge to a robust optimum.
To deal with the above challenge in the combination of adversarial training and federated learning, we propose a novel learning framework based on an o-slack mechanism, namely, Slack Federated Ad- versarial Training (SFAT). In the high level, we relax the maximizaixnnn objective of adversarial training (Madry et al., 2018) into a lower bound by an a-slack mechanism (as Eq. (1) in Section 4.2). By doing so, construct a mediating function that asymptotically approaches the original goal while alleviating the intensified heterogeneity induced by the local adversarial generation. In detail, our SFAT assigns the client- slack during aggregation to upweight the clients having the small adversarial training loss (simultancously downweight the large-loss clients), which reduces the extra exacerbated heterogeneity and alleviates the robustness deterioration (as Figure (b)). Theoretically, we analyze the property of our o-slack mechanism and its benefit to achieve a better convergence (as Theorem 4.2 in Section 4.3). Empirically, we conduct extensive experiments (as Section 5 and Appendix E) provide comprehensive understanding of the proposed SFAT, and the results of SFAT in the context of different adversarial training and federated optimization methods demonstrate its superiority to improve the model performance. We summarize our main contributions follows,
We study the critical, yet thus far overlooked robustness deterioration in FAT, and discover that the reason behind this phenomenon may attribute the intensified data heterogeneity induced by the adversarial generation in local clients (Section 4.1).
We derive an a-slack mechanism for adversarial training to relax the inner-maximization to a lower bound, which could asymptotically approach the original goal towards adversarial robustness and alleviate the intensified heterogeneity in federated learning (Section 4.2).
We propose novel framework, i.e., Slack Federated Adversarial Training (SFAT), to realize the mechanism in FAT via assigning client-wise slack during aggregation, which addresses the data heterogeneity and adversarial vulnerability in a proper manner (Section 4.3).
We conduct extensive experiments to comprehensively understand the characteristics of the proposed SFAT (Section 5. as well as to verify its effectiveness on improving the model performance using several representative federated optimization methods (Section 5.2).
2
RELATED WORK
In this section, we briefly introduce the related work with the following aspects. More comprehensive discussions with previous literature and detailed comparison are presented in our Appendix A.
2

---

Published as a conference paper at ICLR 2023
Federated Learning. The representative work in federated learning is FedAvg (McMahan et al., 2017), which has been proved effective during the distributed training to maintain the data privacy. To further address the heterogeneous issues, several optimization approaches have been proposed egg. FedProx (Li et al., 2018), FedNova (Wang et al., 2020b) and Scaffold (Karimireddy et al., 2020). FedProx introduced proximal term for FedAvg constrain the model drift cause by heterogeneity; Scaffold utilized the control variates to reduce the gradient variance in the local updates and accelerate the convergence. Mansour et al. (2022) provides an extended theoretical framework analyze the aggregation methods and utilize the reweighting to enhance the learning stability and convergence. Note that, the intensified heterogeneity is different from the natural data heterogeneity (Li et al., 2019) that previous methods targeted, and our proposed method is orthogonal to and compatible with them.
Adversarial Training. As one of the defensive methods (Papernot et al., 2016), adversarial train- ing (Madry et al., 2018) is to improve the robustness of machine learning models. The classical AT (Madry et al., 2018) is built upon on a min-max formula to optimize the worst case, e.g. the adver- sarial example near the natural example (Goodfellow et al., 2015). Zhang et al. (2019) decomposed the prediction еπтоr for adversarial examples as the sum of the natural error and the boundary error, and proposed TRADES balance the classification performance between the natural and adversarial examples. Wang et al. (2020c) further explored the influence of the misclassified examples on the robustness, and proposed MART that emphasizes the miselassified examples to boost the classic AT.
Federated Adversarial Training. Recently, several works have made the exploration the adversarial training in the context of federated learning. To our best knowledge, Zizzo et al. (2020) takes the first trial study the feasibility of extending federated learning (McMahan et al., 2017) with the standard AT on both IID and Non-IID settings, Considering the practical situations (Kairouz al., 2019), the challenges of federated adversarial training are mainly from the distributed learning paradigm or the system constraints. From the learning aspect, Zizzo et al. (2020) found that there was a large performance gap existing between the federated and the centralized adversarial training. especially on the Non-IID data. From the system aspect, Shah et al. (2021) designed dynamic schedule for local training to pursue higher robustness under the communication budget. Hong et al. (2021) explored how to effectively propagate the adversarial robustness when only limited clients in federated learning have the sufficient computational budget to afford AT. Different from above works, we are to solve the robustness deterioration issue induced by the intensified heterogeneity.
PRELIMINARIES
3.1 ADVERSARIAL TRAINING
Let (x.d denote the input feature space X' with the infinity distance metric (x, = |z B1l.o. and [a[x] { E X (x, 8) c} be the closed ball of radius c >> centered at r in X. Given dataset S = {(In, Yo) ] where In E X' and Yo E y = I,,,, C' 1}. the objective function of Adversarial Training (AT) (Madry et al., 2018) is min-max formula defined as follows, min N E ma.x,,.B.[x.. (ffo( where F is the hypothesis space, G, is the most adversarial data within the e-ball centered at In. fe(-) X - RC is score function, (e.g. the Cross- Proos-Entropp loss)
e: RC x y and an inverse link function 4. RCC + C- (e.g., the Softmax). Here, AC is the corresponding probability simplex that yields {(fo(),,)) v) = (fo( (-), y). For the inner-maximization, the multi- step projected gradient descent (PGD) (Madry et al., 2018) is usually employed to generate the adversarial samples. Given the natural data .z(9) E X' and a step size > 0, PGD works as follows, (((+1) = lIg [ (z:(0) + asign (oagnnVzaa Vz [( (z.( n))). where / E N, (1) is the adversarial data at step t, sign(-) is the function that extracts the sign of tensor elements, and 11 [2000] (-) is the projection
a composition of base loss lB AC-1 x x
function that projects the adversarial data back into the e-ball centered at (0) if necessary.
3.2 FEDERATED LEARNING
Let Dy denote finite set of samples from the k-th client, and in each round, set of datasets {Dx T==1 from K clients are involved into the training. The objective of federated learning is to learn machine learning model without any exchange of the training data between the clients and the
3

---

Published as a conference paper at ICLR 2023
24
small
Clist B welo Sa WT
10
tou divetion
FAT (1-02200)
Cas large
aegregpaod server
Communication Rounds
before aggregation
FAT
SEAT
onggina
Heterogeneity measure using the client drift (Li et al., 2018; Karimireddy et al., 2020) with different adversarial generation on CIFAR-10 10 dataset. Right panel: comparison about FAT with SFAT on aggregating local clients. The local adversarial generation would maximize the loss and are observed to exacerbate the heterogeneity (more empirical verification that correlates to robust deterioration can refer to Appendixes E.3 and E.4). Compared with FAT, SFAT selectively upweights/downweihhe the client with small/large adversarial training loss to alleviate it during aggregation, which follows our a-slack mechanism to relax the original objective into a lower bound. We also compare the client drift of FAT and SFAT in Figures 3 and 10 to explain their difference.
Figure 2: Left panel:
server. The current popular strategy, namely FedAvg, is introduced by McMahan et al. (2017), where the clients collaboratively send the locally trained model parameters 0₂ to the server for the global average aggregation. Concretely, each client runs on local copy of the global model (parameterized by 8 in the t-th round) with its local data to optimize the learning objective. Then, the server receives their updated model parameters (0% 1 of all clients and performs the following aggregation, -
= n/4 Σx= Ng0 where N₁ denotes the number of samples in Dr and N = Σx= 1 No. Then, the parameters g++1 for the global model will be sent back to each client for another round of training, After sufficient rounds of such a periodic aggregation, we expect the stationary point of federated learning will approximately approach to or have a small gap with that from the centralized case.
SLACK FEDERATED ADVERSARIAL TRAINING
In this section, we first discuss the motivation of the problem when directly applying adversarial training into federated learning. Then, we propose a-slack mechanism and show some theoretical insights. Finally, we propose our Slack Federated Adversarial Training (SFAT) to realize the a-slack mechanism and provide its corresponding convergence analysis and insights.
4.1 MOTIVATION
Considering federated learning, one of the primary difficulties is the biased optimization caused by the local training with heterogeneous data (Zhao et al., 2018; Li et al., 2018; 2020). As for adversarial training, the key distinction from standard training is the use of maximizaainnn to generate adversarial data, which pursues the better adversarial robustness. When combining the two learning paradigms, conjecture that the following issue may arise especially under the Non- -ID case,
the inner- maximizaioinn for pursuing adversarial robustness would exacerbate the data heterogeneity among local clients in federated learning.
Intuitively, the adversarial data inherits the optimization bias since its generation is on the basis of the biased local model. As the adversarial strength increases, i.c., when adversarial training trying to gain more robustness via stronger adversarial generation, the heterogeneity are observed to be exacerbated (indicated by the client drift in the left of Figure 2). the right of Figure 2, we illustrate the aggregation procedure with two clients (i.e., Clients A and B). With adversarial generation on local data, the optimization bias of each client is exacerbated, which may result in more severe heterogeneity and the poor convergence. Therefore, new mechanism is required to prevent the intensified heterogeneity that shows detrimental to convergence in FAT (refer to Figures 9 and 10).
4.2 Q-SLACK MECHANISM
As previous analysis, the learning due to the intensification of data heterogeneity. To deal with that, possible way is to build a mediating function that can alleviate the intensified heterogeneity effect and simultaneously approach the goal of the original objective asymptotically to pursue adversarial robustness. To
of adversarial training is incompatible with federated
4

---

Published as a conference paper at ICLR 2023
this intuition, we consider slack of the inner- manemmaaxiiiiiionn to prevent the intensification of the optimization bias as illustrated in the right panel of Figure 2. Formally, we decompose the inner- maximization in adversarial training into the independent K populations that correspond to the K clients in federated learning, and relax into a lower bound by a as follows',
M
N N
LAT
max ((fo( (.
max &n
((fo(
N
N₂
m=l
2x.
2 (1 + a)
Σ
R
Now
Loce) + (1-a)
K Σ
Now
Lock)
(I)
N
N
k=1
k= R+1
K
- (R),
s.t. s.t. (0, 1), R
2
where o(.) is a function which maps the index to the original population sorted by { { Lx} in an ascending order. Note that, o(-) is an auxiliary operation that is non-parametric and does not affect the gradient back-propagation. The intuition is to relax the original objective to alleviate the heterogeneity exacerbation, like the classical continuous relaxation (e.g., Gumbel-SoftMax (Jang et al., 2017)) in the discrete optimization. We have also discuss the reverse operation of a-slack in experiments (refer Section 5.1 and Appendix E.3), which pursues an upper bound but it further exacerbates the heterogeneity. The following Theorems 4.1 and 4.2 will provide more analysis about the characteristics of this slack mechanism and their complete proofs are given in Appendix B.
Theorem 4.1. L (R) is monotonically decreasing w.r.t. both and K, i.e,, L (R)(K) < <La2 (R2(R) an > 02 and L (Ki) < (K2) if R₁ K2. Specifically, L (K) recovers L of adversarial training when a achieves O, and L (K) relaxes L to a lower bound objective by increasing R and a.
Based on the above theorem, we can flexibly emphasize the importance of partial populations by setting the proper hyperparameters (i.e., K and a), to alleviate the evenly averaging of the harsh heterogencous updates in FAT illustrated by the right-mos, panel of Figure 2.
Theorem 4.2. Assume the loss function E((,-) in Eq. (1) satisfies the Lipschitzian smoothness condition w.r.t the model parameter 9 and the training sample x, and is X-strongly concave for all x, and E [VV Vol(fo B)
S 82, where is the adversarial example. Then, after the for the slskack mechanism of decomposed Adversarial
sufficient T step optimization i.e., T Z Training with the constant stepsize
LA
82
A
in PGD, we have the following convergence property,
LTaz
T ΣB
(
S
11a"
1 I 5(0)
21=15
4Lg.c
48
LA T
(2)
T
N
where I, = T.00 + Locker
x defined by the Lipschitzian constraints, A 2 L (K)
inlo L ((( and
<(t) =K (11)) ER+1 Note) meaning the accumulative counting difference of the t-th step.
o(k)
o(k)
The complete notation explanation can be found in Appendix B.2. Note that, when a = 0, Eq. (1) recovers the original loss of Adversarial Training, and the first part the RHS of Eq. (2) goes to I that recovers the convergence rate of Adversarial Training (Sinha et al., 2018). When + 1, Eq. (1) becomes more biased, while simultaneously the straightforward benefit is that we can achieve a faster
convergence in Eq. (2) if + Σ ((t) < 0, i.e. (1 (1+a2e EE c(t)
< Actually, this is possible when the sample number is approximately similar among all clients and the top-1 choice easily has in each optimization step. In this case, larger a has faster convergence. Therefore, the proposed o-slack mechanism of adversarial training provides us way to acquire the optimization benefits in FAT by introducing the small relaxation to the objective.
-N < (t) -v((t) a(1) ΣK_m ()(()
M()
Note that the intuition here is find mechanism to relax the original objective like the classical continuous relaxation in the discrete optimization. Pursuing an upper bound does not help but exacerbates the heterogeneity.
5

---

Published as a conference paper at ICLR 2023
4.3 REALIZATION OF SLACK FEDERATED ADVERSARIAL TRAINING
Based on the previous analysis of the a-slack mechanism, we propose a Slack Federated Adversarial Training to combine adversarial training and federated learning. The intuition applying the a-slack mechanism into the mneer-mximizztion in FAT, which can be formalized as follows,
min LSEAT
min
1
Σ N k=
PANK
Σ
max e(fo( v/)))) sy eB [ah]
FO
NN
(3)
Lx
where Pk denotes the weight assigned to the k-th client based on the ascending sort of weighted client
losses compared with the K-th one, which can be (1+a) 11 No La S [
No Ca
N
Lueedd [ that corresponds to the relaxed loss in Eq. (1). For simplicity without loss of generality, can transform the slack mechanism the weight adjustment of those selected clients with smaller
adversarial training losses, and assign P3 = ((++a)/(1-)) a) - N L+ S Csoned [R]) + N₂ Lx > Leeeed / K Pa) + 2a/(1 - a:) to ensure the lower bound derivation. For more details, we summarize the procedure of SFAT in Algorithm of Appendix D, which consists of multi-round iterations between the local training on the client side and the global aggregation on the server side.
Concretely, on the client side, after downloading the global model parameter from the server, each client will perform the adversarial training on its local data. At the same time, the client loss on the adversarial examples is also recorded, which acts as the soft-indicator of the local bias induced by the radical adversarial generation. Then, when the training steps reach to the condition, the client will upload its model parameter and the loss to the server. On the server side, after collecting the model parameters (0, K and the losses {Cx J of all clients, it will first sort { NN Lx H
in ascending order to find the top- clients. Based that, the global model parameters will be aggregated by the a-slack mechanism in which the model parameters of the top- R clients upweighted with (1 + a1 a) and the remaining is downweighted. For atypical layers (Li et al., 202 e.g., BN, is outside the scope of this paper and we keep the aggregation same as FedAvg.
In Figure 3, we empirically justify the rational- ity of our SFAT as illustrated by Figure We employ the averaged client drift (Li et al.. 2018; Karimireddy et al., 2020), i.e., |0 0.112 (the parameter difference between local model and averaged global model), to approximately reflect the effect of data heterogeneity (illustrated the diverse optimization directions in the right panel see the client drift of SFAT is smaller than that of FAT in the later stages. This indicates the optimization di- rections of clients are less diverse, contributing to the alleviation of the intensified heterogeneity. In Figure 7, we trace the index of the top-weighted
15
Communicaion Rounds
37
85
80
Figure 3: The averaged client drift (Li et al., 2018: Karimireddy et al., 2020) in each communication round on CIFAR-1O (Non-IID). SFAT generally achieves smaller drift compared to FAT, i.e., less heterogeneous aggregation. More empirical results can refer to Appendixes E.3, E.4 and E.8.
of Figure 2). From Figure 3,
client one experiment and find it dynamically routes among different clients instead of a fixed one.
In the following, we provide the theoretical analysis of our SFAT on the convergence in the context of federated learning (Li et al., 2019), which slightly different from the centralized counterpart.
Theorem 4.3. Assume the loss function E(:s.) in Eq. (3) L-smooth and X-strongly convex w.r.t. the model parameter 6, and the expected norm and the variance of the stochastic gradient in each client respectively satisfy E [[[ Vol(fo " < x² and E [[[Vo[( (ff(((((("')) (,²")²"))))))))) VeLx [| S 82. Let k == ; = max 8K, E} where E is the iteration number of the local adversarial training with the learning rate n Mitty- Then, after the sufficient T T-seep communication rounds for SFAT, we have the following asymptotics the optimal,
2
B[LseaT] -L" --
2B
X7 E
[1100
00118))
7 +
2

---

Published as a conference paper at ICLR 2023
where L is the minimum value of Lstan. Hr is the optimal model parameter. and
PE
2
(N
NE
2
K p(
NA
B
6T. L Σ
1+ CUT N fi
+8(E -1P52
1
SETY N
N
When a = O, we have p(T) /1+
N =1 and Eq. (4) becomes the convergence rate of FedAvg on Non-IID data (Li al., 2019). Different from Theorem 4.2 that concludes in the centralized training setting, when a + 1, the convergence is indefinite compared to the standard FAT, since the emerging 2
/(1 terms in B, i.e., (P(") /( ( )² and / a <(T) N ). are acted as the scalar timing by the
personalized variance bound o% and the local optimum L of each client. One possible case when the optimization approaches to the optimal parameter 6", 02 can be in a smaller scale relative to the scale of L. In this case, the increment of the first term of B can be totally counteracted by the loss of the second term of B so that in sum B becomes smaller. Then, we can have a tighter upper bound for SFAT in Eq. (4) to achieve a faster convergence than FAT. The completed proof of Theorem 4.3 is given in Appendix B.3 and the empirical verification is presented in Appendix E.7. The following section will comprehensively confirm that SFAT can reach to a more robust optimum. Note that, the theorem we deduce here follows the same assupmitions (Li et al., 2019) and is mainly to compare the difference with the early convergence analysis in federated learning. However, some relaxation on the assumptions could be further improved by considering more practical SGD theories (Nguyen et al., 2018), 8), which is beyond the scope of this paper and we leave in the future works.
5 EXPERIMENTS
In this section, we provide a comprehensive analysis of SFAT and empirically verify its effectiveness compared with the current methods range of benchmarked datasets and real-world dataset. The source code is publicly available at: https: : / sigthu..... com/ ZF ancy/ / SFAAT.
Setups. We conduct the experiments three benchmark datasets, i.e., CIFAR- 10, CIFAR- 100 (Krizhevsky. 2009), SVHN (Netzer et al., 2011) as well as a real-world dataset CelebA (Caldas al., 2018) for federated adversarial training. For the IID scenario, just randomly and evenly distribute the samples to each client. For the Non-III scenario, we follow McMahan et al. (2017); Shah et al. (2021) to partition the training data based on their labels. To be specific, a skew parameter is utilized in the data partition introduced by Shah et al. (2021), which enables K clients to get a majority of the data samples from subset of classes. We denote the set of all classes in a dataset as y and create 3% by dividing all the class labels equally among K clients. Accordingly, we split the data across K clients that each client has (100- (K -K) s)% of data for the class in V's and s% of data in other split sets. In the test phase, we evaluate the model's standard performance using natural test data and its robust performance using adversarial test data generated by FGSM (Goodfellow et al., 2015), PGD-20, CW oo (Carlini & Wagner, 2017) and AutoAttack (Croce & Hein, 2020) (termed as AA) to evaluate its robust performance. More detailed settings are provided in Appendix E.
5.1 ABLATION STUDY
In this subsection, we conduct various experiments CIFAR-IO with the Non-IID setting visualize the characteristics of our proposed SFAT. More comprehensive results are provided in Appendix E.
Non-AT vs. AT. In the left two panels of Figure 4, we respectively apply our a-slack mechanism to Federated Standard Training (SFST) and Federated Adversarial Training (SFAT) under Ä 1. We also consider both FedAvg and FedProx in this experiment to guarantee the universality. From the curves, we can see that SEST has the negative effect on the natural accuracy, while SFAT consistently improves the robust accuracy based on FedAvg and FedProx. This indicates our æ-slack mechanism is tailored for the imne-mmaimiiotion of Federated Adversarial Training instead of the mittiiziniiiztioon considered by other federated optimization methods. In addition, also verify the orthogonal effects of SFAT with FedProx on reducing client drift in Appendix E.8 and strengthen the
of FedProx to demonstrate the consistent effectiveness of our SFAT.
Re-SEAT vs. SFAT. In the middle panel of Figure 4, we conversely apply our slskk mechanism in Federated Adversarial Training (Re-SFAT) where upweight the client with large adversarial
7

---

Published as a conference paper at ICLR 2023
17.3
Netural Accumay
huae Aoc S'AT
FaR Aro Robual
hear Acceffal ITLL oIFAT
Fadleg
Fasthos Foat
Fedtrn
05
25
25
56
111 105
114
RUK
Figure 4: Ablation study on SFAT. Left two panels: comparison between federated standard training and federated adversarial training respectively in combination with the a-slack mechanism, i.e., SFST vs. SFAT (a 1/11). Middle panel: comparison between FAT, SFAT and Re-SFAT (the reverse operation which upweights the clients with large adversarial training loss). Right two panels: the natural accuracy and the robust accuracy of SFAT with different and different K on CIFAR-10.
Table I: Test accuracy on CIFAR-IO (Non-IID) partition with different client numbers.
Table 2: Test accuracy on CIFAR- 10 (Non-IID) with different local adversarial training methods.
Client Number
Methods
Natural
PGD-20
CW
Methods
Natural
PGD-20
CWW,
10
SFAT
FAT
56.67%
56.62%
33.31 %
31.24%
29.82%
31.58%
AT
FAT SEAT
62.34% %
57.45%
35.59 %
32.58%
33.06 %
30.52%
FAT
60.55%
32.67%
31.07%
20
SEAT
62.24%
35.66% %
33.21% %
FAT SEAT
64.00%
31.64%
28. 28.95%
TRADES
25
FAT
58.97%
32.98%
31.14%
65.26%
35.10% %
31.80% %
SFAT
62.73%
35.75%
33.16%
50
SFAT
57.21%
56.74%
34.35%
32.91
31.75%
30,50%
MART
FAT SEAT
58.41 %
56,29%
38.90 %
36.27%
34.67 %
32.41% %
training loss. Note that the Re-SFAT share a similar spirit with the Agnostic Federated Learning (AFL) (Mohri et al., 2019), which seeks improve the generalization in standard federated learning through a loss- masimmiammi reweighting. Through its comparison with FAT and SFAT, we can see enlarging the maximizaiinni during aggregation could severely exacerbate heterogeneity which results in the worse performance, while our SFAT improves the performance through relaxing it into lower bound. We also confirm the rationality of SFAT other datasets in Appendix E.3.
Impact of a and K. To study the effect of hyperparameters in SFAT, we conduct several ablation experiments to verify the model performance. Regarding the experiments of a, we set the client number K = 5 and K = 1 to upweight/downweight the client models in each communication round. The right middle panel of Figure 4 shows that a E (0, 1/6] can significantly improve the robust accuracy and the natural accuracy, while a larger a might be inappropriate to the natural accuracy, We also conduct a comprehensive ablation to show the effects of a during training in Appendix E.4. Regarding the choice of K, we specially set K = 8 in this experiment to span the range of Æ due to the constraint K- <= K/2. The right panel of Figure 4 tracks the accuracy of SFAT with increasing k. As be seen, both natural accuracy and robust accuracy improved even with larger K, which shows the effect of Î on the slack of inner- maximization. For other basic experimental setting, e.g., the local epochs, we explore the effectiveness under different setups in Appendix E.2.
Different client numbers. In Table we validate our SFAT on training with different client numbers, where we set a = 1/11 (i.e., I-c
1+o = 1.2) and K = K/5, The results show that with the client number varying from 10 50, our SFAT can consistently gain better natural and robust performance than FAT. We also confirm the scalability of using other datasets (in Appendix E.9), the performance on unequal data splits in the different clients (in Appendix E. 10), as well as the effectiveness in a practical situation where only subset of clients participate in the aggregation (in Appendix E.
Different adversarial training methods. In Table 2, we validate the combination of a-slack mechanism and different adversarial training methods (i.e., AT (Madry et al., 2018), TRADES (Zhang et al., 2019) and MART (Wang et al., 2020c)), where we switch different local adversarial training methods the client side. Through the comparison with FAT, the results show that SFAT can consistently boost both the natural performance and the robust performance, and is applicable to other otate-of-the-art adversarial training methods under the federated learning scenarios.
8

---

Published as a conference paper at ICLR 2023
Table 3: Performance on Non-IID settings with different federated optimization methods Std).
Setting
Non-IID
CITAR-I0
Natural
FGSM
PGD-20
CW
AA
FAT SFAT
58.13:10.68%
40.06:10.6299
32.56.10.01%
30.88:10.37%
29.17:10.03%
FedAvg
63.36::0.07%
44.82:10.32%%
37.14:10.03%
33.39:L0.6199 %
31.66+0..00%
FAT 59.95:10.45%
41.44-10.1555
33.833+00001%
31.65-+-.36%%
30.11+00.09%
FedProx
SFAT
62.04:10.47% %
44.21 %
36.64:10.11% %
32.62:10.20%
31.8310.15%
FAT SFAT
61.44:t..37
42.85-t-0.65%
34.08+00.0%%
32.56++0.02%
31.03++0.089
Scaffold
63.16:+0.66%
45.55+0..00%
37.33++0.02%
34.82+00.4%
33.32 0.01 %
CIFAR-100
Natural
FGSM
PGD-20
CW
AA
FAT SEAT
34.6310.56%%
19.92:10.289
15.40:1.200%
13.23+10.03%
12.23:10.01%
FedAvg
3..65
20.23:10.44%
16.2410.16%
13.53+1..22%
1..45%
FAT 31.93++.43%% 19.06++0.177
15.30++0.08%
12.93+00.02%
12.01+0.04%%
FedProx
SFAT
34.8710.24%% 20.54:00.08%
16.09-10.10%
13.35:10.12%
12.44:10.20%
FAT 39.98100.02% 24.30:10.0499
19.34:1:0007
0.0%
16.49-1:..22 12%
15.29-10.08%
Scaffold
SFAT
44.13+00.05
25.32+ 0.94%
20.22
16.96-t0.17%
15.80 0.10 %
SVHN
Natural
FGSM
PGD-20
CW
AA
FAT SFAT
91.52.10.28% 88.13:10.1189
68.98:10.119
68.04.10.15%
66.59:10.0499 -.00%
FedAvg
91.26:1001%% 88.27:10.02%
72.04:10.32%%
69.96:10.16%
68.89:10.27%
FAT 91.00++0008% 37.65++0.11.55
68.48++0.00%%
67.16-+0..02%
65.76++0.1888
FedProx
SFAT
9..19+0..6%
88.15++0.01 %
71.84:00.00%
69.88:00.35%
68.84++0.37%
FAT SFAT
90.82:10087%%
87 1..--900666
69.51 8..%
68. 12:1-0888%
67.19:10.54% 68.37=00488 %
Scaffold
90.93:10.76%
08.27
71.77:10.88%
69.49:10.67%
5.2 PERFORMANCE EVALUATION
Next, we compare SFAT with FAT on various benchmark datasets verify its effectiveness. Specifi- cally, we validate it with three representative federated optimization methods, i.e., FedAvg, FedProx and Scalffold. Considering the sensitivity of data selection in Non-IID setting, we report the results with Mean + Std values in Table 3 after running multiple times. For the completeness of experiments, we also demonstrate the efficacy SFAT on the IID setting and a real-world dataset. The overall results for comparison (with the centralized counterparts) presented in Appendixs E.11 and E. 12.
According to Table on CIFAR-10, we can find that our SFAT significantly outperforms FAT on the NoD-IID data in terms of both the natural accuracy (~2%-6%) and the robust accuracy (~2%% 5%). As for FedProx and Scaffold which are specifically designed to handle the heterogeneous issues in federated learning, employing them in FAT can indeed improve the model performance compared with that based on FedAvg. Our SFAT further boosts the performance by alleviating the extra heterogeneity from adversarial training. On CIFAR-100 and SVHN, we can find the similar improvement in Table 3 as that of CIFAR-10 under three types of federated optimization methods.
6 CONCLUSION
In this work, we investigated the issue of robustness deterioration when combining adversarial training with federated learning, and revealed that may attribute to the intensified heterogeneity induced by local adversarial generation. To alleviate it, we introduce an a-slack decomposed mechanism into adversarial training to relax the overall inner-maxin manemmaaiiiziion.. Based on this, we propose new framework, i.e., Slack Federated Adversarial Training (SFAT). We provide both the theoretical analysis and empirical evidences to understand the proposed method. The experimental results under various settings confirm the consistent effectiveness of our proposed SFAT. Nevertheless, we only move a small step on the intensified heterogeneous issue in the combination two learning paradigms, federated adversarial training still suffers from the other challenges of systems algorithms. Beyond the empirical conjecture in the problem focused on this work, more theoretical understanding on the dynamical heterogeneous issue under federated learning is worthwhile to explore in the future.

---

Published as a conference paper at ICLR 2023
ACKNOWLEDGEMENT
JNZ and BH were supported by NSFC Young Scientists Fund No. 62006202, Guangdong Basic and Applied Basic Research Foundation No. 2022A151501 RGC Early Career Scheme No. 22200720, RGC Research Matching Grant Scheme No. RMGS20221 102, No. RMGS20221300 and No. RMGS2022 1309. BH also supported by CAAI-Huawei MindSpore Open Fund and HKBU CSD Departmental Incentive Grant. TLL was partially supported by Australian Research Council Projects IC-190100031, LP-220100527, DP-220102121, and FT-220100318. JLX was partially supported by Hong Kong RGC Grants 12202221 and C2004-21GF.
ETHICS STATEMENT
This paper does not raise any ethics concerns. This study does not involve any human subjects, practices to data set releases, potentially harmful insights, methodologies and applications, potential conflicts of interest and sponsorship, diseriminaaionbiia/aaanes concerns, privacy and security issues, legal compliance, and research integrity issues.
REFERENCES
Jean-Baptiste Alayrae, Jonathan Uesato, Po-Sen Huang, Alhussein Fawzi, Robert Stanforth, and Pushmeet Kohli. Are labels required for improving adversarial robustness? In NeurlPS, 2019.
Motasem Alfarra, Juan C Pérez, Egor Shulgin, Peter Richtárik, and Bernard Ghanem. Certified robustness in federated learning. In arXiv, 2022.
Zeyuan Allen-Zhu and Yuanzhi Li. Towards understanding ensemble, knowledge distillation and self-distillation in deep learning. In arXiv, 2020.
Sebastian Caldas, Sai Meher Karthik Duddu, Peter Wu, Tian Li, Jakub Konečný, H Brendan McMa- han, Virginia Smith, and Ameet Talwalkar. Leaf: A benchmark for federated settings. arXiv, 2018.
Nicholas Carlini and David A. Wagner. Towards evaluating the robustness of neural networks. In Symposium on Security and Privacy (SP), 2017.
Yair Carmon, Aditi Raghunathan, Ludwig Schmidt, Percy Liang, and John C. Duchi. Unlabeled data improves adversarial robustness. In NewrlPS, 2019.
Tianlong Chen, Sijia Liu, Shiyu Chang, Yu Cheng, Lisa Amini, and Zhangyang Wang. Adversarial robustness: From self-supervised pre-training to fine-tuning. In CVPR, 2020.
Tianlong Chen, Zhenyu Zhang, Sijia Liu, Shiyu Chang, and Zhangyang Wang. Robust overfitting may mitigated by properly learned smoothening. In ICLR, 2021.
Tianlong Chen, Zhenyu Zhang, Pengjun Wang, Santosh Balachandra, Haoyu Ma. Zehao Wang, and Zhangyang Wang. Sparsity winning twice: Better robust generaliztion from more efficient training. In ICLR, 2022.
Jeremy Cohen, Elan Rosenfeld, and Zico Kolter. Certified adversarial robustness via randomized smoothing. In ICML, 2019.
Francesco Croce and Matthias Hein. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks. In ICML, 2020.
Gavin Weiguang Ding, Yash Sharma, Kry Yik Chau Lui, and Ruitong Huang. Mma training: Direct input space margin maximization through adversarial training. In ICLR, 2020.
Micah Goldblum, Liam Fowl, Soheil Feizi, and Tom Goldstein. Adversarially robust distillation. In AAAI, 2020.
Ian J. Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. In ICLR, 2015.
10

---

Published as a conference paper at ICLR 2023
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In CVPR, 2016.
Dan Hendrycks and Kevin Gimpel. A baseline for detecting misclassified and out-of-distrriuttio examples in neural networks. In ICLR, 2017.
Junyuan Hong, Haotao Wang. Zhangyang Wang. and Jiayu Zhou. Federated robustness propagation:
Sharing adversarial robustness in federated learning. In arXiv, 2021.
Eric Jang, Shixiang Gu, and Ben Poole. Categorical reparameterization with gumbel-softmax. In ICLR, 2017.
Liangze Jiang and Tao Lin. Test-time robust personalization for federated learning. In ICLR, 2023.
Ziyu Jiang, Tianlong Chen, Ting Chen, and Zhangyang Wang. Robust pre-training by adversarial contrastive learning. In NeurlPS, 2020.
Peter Kairouz, Brendan McMahan, Brendan Avent, Aurélien Bellet, Mehdi Bennis, Arjun Nitin Bhagoji, Kallista Bonawitz, Zachary Charles, Graham Cormode, Rachel Cummings, et al. Ad- vances and open problems federated learning. In arXiv, 2019.
Sai Praneeth Karimireddy, Satyen Kale, Mehryar Mohri, Sashank Reddi, Sebastian Stich, and Ananda Theertha Suresh. Scaffold: Stochastic controlled averaging for federated learning. In ICML, 2020.
Mikhail Khodak, Renbo Tu, Tian Li, Liam Li, Maria-Florina F Balcan, Virginia Smith, and Ameet Talwalkar. Federated hyperparameter tuning: Challenges, baselines, and connections to weight- sharing. In NeurlPS, 2021.
Adriana Kovashka, Olga Russakovsky, Fei-Fei, and Kristen Grauman. Crowdsourcing computer vision. Found. Trends Compul. Graph. Vis., 2016.
Alex Krizhevsky. Learning multiple layers of features from tiny images. In arXiv, 2009.
Alexey Kurakin, Ian Goodfellow, and Samy Bengio. Adversarial machine learning at scale. In arXiv, 2016.
Qinbin Li, Bingsheng He, and Dawn Song. Model-contrastive federated learning. In CVPR, 2021a.
Tian Li, Anit Kumar Sahu, Manzil Zaheer, Maziar Sanjabi, Ameet Talwalkar, and Virginia Smith. Federated optimization in heterogeneous networks. In ML.Sss 2018.
Tian Li, Anit Kumar Sahu, Ameet Talwalkar, and Virginia Smith. Federated learning: Challenges, methods, and future directions. IEEE signal processing magazine, 2020.
Xiang Li. Kaixuan Huang, Wenhao Yang. Shusen Wang, and Zhihua Zhang. On the convergence of fedavg on non-iid data. In ICLR, 2019.
Xiaoxiao Li, Meirui Jiang, Xiaofei Zhang, Michael Kamp, and Qi Dou. Fedbn: Federated learning on non-iid iid features via local batch normalization. ICLR, 2021b.
Yanxi Li, Zhaohui Yang, Yunhe Wang, and Chang Xu. Neural architecture dilation for adversarial robustness. NeurIPS, 2021c
Min Lin, Qiang Chen, and Shuicheng Yan. Network in network. In ICLR, 2014.
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. ICLR, 2018.
Adnan Ben Mansour. Gaia Carenini, Alexandre Duplessis, and David Naccache. Federated learning aggregation: New robust algorithms with guarantees. arXiv, 2022.
Brendan McMahan, Eider Moore, Daniel Ramage, Seth Hampson, and Blaise Aguera Arcas. Communication-effiieenn learning of deep networks from decentralized data. In AISTATS, 2017.
11

---

Published as a conference paper at ICLR 2023
Mehryar Mohri, Gary Sivek, and Ananda Theertha Suresh. Agnostic federated learning. In ICML, 2019.
Nagarajan Natarajan, Inderjit S Dhillon, Pradeep K Ravikumar, and Ambuj Tewari. Learning with noisy labels. In NeurlPS, 2013.
Yuval Netzer, Tao Wang, Adam Coates, Alessandro Bissacco, Bo Wu, and Andrew Y Ng. Reading digits natural images with unsupervised feature learning. In NeurIPS Workshop on Deep Learning and Unsupervised Feature Learning, 2011.
Lam Nguyen, Phuong Ha Nguyen, Marten Dijk, Peter Richtárik, Katya Scheinberg, and Martin Takác. Sgd and hogwild! convergence without the bounded gradients assumption. In ICML, 2018.
Nicolas Papernot, Patrick McDaniel, Xi Wu, Somesh Jha, and Ananthram Swami. Distillation as defense to adversarial perturbations against deep neural networks. In Symposium on Security and Privacy (SP), 2016.
Amirhossein Reisizadeh, Farzan Farnia, Ramtin Pedarsani, and Ali Jadbabaie. Robust federated learning: The case of affine distribution shifts. In NeurIPS, 2020.
Amartya Sanyal, Puneet Dokania, Varun Kanade, and Philip H. S. Torr. How benign is benign overfitting? In ICLR, 2021.
Devansh Shah, Parijat Dube, Supriyo Chakraborty, and Ashish Verma. Adversarial training in communication constrained federated learning. In arXiv, 2021.
Aman Sinha, Hongseok Namkoong, and John Duchi. Certifying some distributional robustness with principled adversarial training. In ICLR, 2018.
Virginia Smith, Chao- Kai Chiang, Maziar Sanjabi, and Ameet Talwalkar. Federated multi-task learning. In NeurlPS, 2017.
Haotao Wang, Tianlong Chen, Shupeng Gui, Ting-Kuei Hu, Liu, and Zhangyang Wang. Once- for-all adversarial training: In-situ tradeoff between robustness and accuracy for free. In NeurIPS, 2020a.
Jianyu Wang, Qinghua Liu, Hao Liang, Gauri Joshi, and H Vincent Poor. Tackling the objective inconsistency problem in heterogeneous federated optimization. NeurIPS, 2020b.
Yisen Wang, Difan Zou, Jinfeng Yi, James Bailey, Xingjun Ma, and Quanquan Gu. Improving adversarial robustness requires revisiting misclassified examples. In ICLR, 2020c.
Chaowei Xiao, Jun Yan Zhu, Bo Li, Warren Hc, Mingyan Liu, and Dawn Song. Spatially transformed adversarial examples. In ICLR, 2018.
Jiangchao Yao, Shengyu Zhang. Yang Yao, Feng Wang, Jianxin Ma, Jianwei Zhang, Yunfei Chu, Luo Ji, Kunyang Jia, Tao Shen, et al. Edge-cloud polarization and collaboration: A comprehensive survey for ai. IEEE Transactions on Knowledge and Data Engineering, 2022.
Shuyang Yu, Junyuan Hong, Haotao Wang, Zhangyang Wang, and Jiayu Zhou. Turning the curse of heterogeneity in federated learning into a blessing for duitof-distriuution detection. In ICLR, 2023.
Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric P. Xing, Laurent El Ghaoui, and Michael I. Jordan. Theoretically principled trade-off between robustness and accuracy. In ICMI. 2019.
Jiale Zhang, Di Wu, Chengyong Liu, and Bing Chen. Defending poisoning attacks in federated learning via adversarial training method. In ICFCS, 2020a.
Jingfeng Zhang, Xilie Xu, Bo Han, Gang Niu, Lizhen Cui, Masashi Sugiyama, and Mohan Kankan- halli. Attacks which do not kill training make adversarial learning stronger. In ICML, 2020b.
Jingfeng Zhang, Jianing Zhu, Gang Niu, Bo Han, Masashi Sugiyama, and Mohan Kankanhalli. Geometry-aware instance-reweighted adversarial training. In ICLR, 2021.
12

---

Published as a conference paper at ICLR 2023
Yuchen Zhang, John C Duchi, and Martin J Wainwright. Communication--ffiitni algorithms for statistical optimization. Journal of Machine Learning Research, 2013.
Yue Zhao, Meng Li, Liangzhen Lai, Naveen Suda, Damon Civin, and Vikas Chandra. Federated learning with non-iid data. In arXiv, 2018
Jianing Zhu, Jiangchao Yao, Bo Han, Jingfeng Zhang, Tongliang Liu, Gang Niu, Jingren Zhou, Jianliang Xu, and Hongxia Yang. Reliable adversarial distillation with unreliable teachers. In ICLR, 2022.
Giulio Zizzo, Ambrish Rawat, Mathieu Sinn, and Beat Buesser. Fat: Federated adversarial training. In arXiv, 2020.
Giulio Zizzo, Ambrish Rawat, Mathieu Sinn, Sergio Maffeis, and Chris Hankin. Certified federated adversarial training. In arXiv, 2021.
13

---

Published as a conference paper at ICLR 2023
APPENDIX
The Appendix is organized as follows. In Appendix A, we detailedly discuss the related work and highlighted our distinguishable point compared with previous work. In Appendix B, we formally prove the aforementioned Equations and Theorems. In Appendix C, we demonstrate the issue of bias Appendix D,
exacerbation (as illustrated in Figure 2) using a binary classification experiment. provide illustration of the learning framework for SFAT. In Appendix E, present our experimental details and more quantitative results about understanding our proposed SFAT.
A DETAILED DISCUSSION AND COMPARISON ABOUT RELATED WORK
In this section, detailedly discuss the related work in federated learning, adversarial training as well as the federated adversarial training. At the end of each part, we also highlight our distinguishable points compared with the previous work, either from conceptual or technical perspectives.
Federated Learning. The representative work in federated learning is FedAvg (McMahan et al., 2017), which has been proved effective during the distributed training to maintain the data privacy. To further address the heterogeneous issues, several optimization approaches have been proposed egg. FedProx (Li et al., 2018), FedNova (Wang et al., 2020b) and Scaffold (Karimireddy et al., 2020). FedProx introduced a proximal term for FedAvg to constrain the model drift cause by heterogeneity; FedNova proposed a general framework that eliminated the objective inconsistency and preserved the fast convergence; Scaffold utilized the control variates to reduce the gradient variance in the local updates and accelerate the convergence. MOON (Li et al., 202 alleviated the heterogeneity by maximizing the agreement between the representations of the local and global models, which helps the local training of individual parties. Reisizadeh et al. (2020) developed robust federated learning algorithm to against distribution shifts in client samples. Mohri et al. (2019) proposed Agnostic Federated Learning (AFL) to improve the fairness and generalization to different data distribution through a loss-maximization reweighting. However, it is not suitable to the problem of FAT and actually opposite to relaxation. We show AFL performs even worse than FAT in Appendix E.3. Our SFAT introduces the a-slack mechanism to combat intensified heterogeneity in federated adversarial training, which is orthogonal to and compatible with the most previous methods.
One concurrent work (Mansour et al., 2022) recently provide an extended theoretical framework to analyze the general aggregation methods in federated learning. it also utilizes the reweighting mechanism and propose the FedSoftBetter. However, our proposed SFAT and FedSoftBetter have both different motivations and underlying principles. On the one hand, we introduce a-slack mechanism to alleviate the exacerbated heterogeneity, while Mansour et al. (2022) employs reweighting to enhance the stability and convergence of original FedAvg. On the other hand, SFAT focuses on federated adversarial training and origins from our a-slack mechanism, while FedSoftBetter focuses on ordinary federated learning and originates as a specific strategy for federated aggregation from the theoretical analysis on convergence bound. Different from FedSoftBetter, as empirically verified in "Non-AT v.s. AT" of Section 5.1, our SFAT is not for ordinary federated learning but tailored for federated adversarial training. In practice, the technical forms of two weighting mechanisms are also different. SFAT directly ranks the losses of all clients and constructs the weights, while the weights of FedSoftbetter build upon the gap between the client loss and the client optimal loss. We also provide an empirical comparison of the two methods in our Appendix E.5.
Adversarial Training. As one of the defensive methods (Papemoot et al., 2016), adversarial train- ing (Madry et al., 2018: Zhang et al., 2019; Jiang et al., 2020; Chen al., 2021; Zhang al., 2021) is to improve the robustness of machine learning models. The classical AT (Madry et al., 2018) is built upon on a min-max formula to optimize the worst case, e.g., the adversarial example near the natural example (Goodfellow et al., 2015). Zhang et al. (2019) decomposed the prediction error for adversarial examples as the sum of the natural error and the boundary error, and proposed TRADES to balance the classification performance between the natural and adversarial examples. Wang et al. (2020c) further explored the influence of the misclassified examples on the robustness, and proposed MART that emphasizes the minimization of the misclassified examples to boost the AT. Zhang et al. (2020b); Sanyal et al. (2021) investigated the instance-level difficulties in AT and designed different training strategies to improve the model performance. Different from their instance-level granular-
14

---

Published as a conference paper at ICLR 2023
ity, our SFAT framework leverages the client-level measure to alleviate the heterogeneous issue in the straightforward combination of adversarial training and federated learning. It is compatible to incorporate those centralized ad training methods (as shown in Table 2 of Section 5.1) in the updates of local clients to further improve the model performance or address some special issues.
Federated Adversarial Training. Recently, several works have made the exploration on the adversarial training in the context of federated learning, which consider the data privacy and the robustness in one framework. To our best knowledge, Zizzo al. (2020) takes the first trial study the feasibility of extending federated learning (McMahan et al., 2017) with the standard AT on both IID and Non-III settings. Empirically, they found that there was large performance gap existing between the distributed and the centralized adversarial training, especially on the Non-III data. Shah et al. (2021) designed a dynamic schedule for the local training to pursue a larger robustness under the constrained communication budget of federated learning. Hong et al. (2021) explored how to effectively propagate the adversarial robustness when only limited clients in federated learning have the sufficient computational budget to afford AT. Zhang et al. (2020a); Zizzo et al. (2021) studied to defend the malicious clients that poison the global model in federated learning, which also discuss the robustness but actually another research topic compared with the federated adversarial training in this work. Different from previous works (in Table 4), we explore to solve the robustmess deterioration issue (as shown in Figure ((a) induced by the intensified heterogeneity (as illustrated in Figure of the direct combination of federated learning and ad adversarial training.
Table 4: Brief comparison with some related work in federated adversarial training
Research work
adopt FAT |
Other research topic
Notable differences with ours
Shah al. (2021)
focus limited constrained communication budget assumes some client can not perform AT locally
Hong et al. (2021)
V
Zhang al. (2020a)
focus on poisoning defense
Zizzo et al. (2021)
facus on poisoning defense
Considering the practical requirement in the real-world applications (Kairouz et al., 2019), federated adversarial training still faces various challenges. In general, these challenges mainly come from perspectives of the distributed systems (Li et al., 2020) and the unique learning paradigm (Kairouz et al., 2019). From the perspective of distributed systems, the major issue for federated adversarial training is its characteristic of high computational-com (Madry et al., 2018). It is well known in conventional adversarial training the local adversarial generation always require multiple times of optimization to better optimize the manrrmmxxiiization, which is to pursue the better empirical adversarial robustness (Goodfellow al., 2015). In federated setting, we also need consider the heterogencous devices (Kairouz et al., 2019) in practical situation like the previous work (Hong al., 2021) focused on. The clients with low computational capacity not only affect the synchronous aggregation but also may not affordable for the local adversarial training. Such issues in hardware also results in severe problem for the distributed learning. From the perspective of the learning paradigm, the issues is more about the training data and inference threaten for federated adversarial training. Except for the intensified heterogeneity discussed our work, the heterogeneity data itself is also severe problem for federated adversarial training. More conventional issues about lcarning data like the iinasiimbllanced data (Kovashka et al., 2016), label noised data (Natarajan et al., 2013) or -uitt--disttiuutee data (Hendrycks & Gimpel. 2017) need further investigated in federated adversarial training. As for the inference threaten, one practical scenario is that different client may face different kinds of adversarial attacks (Carlini & Wagner, 2017; Xiao et al., 2018), whether federated adversarial training can help for gaining various type of robustness on different clients is still under explored.
B PROOF
B. PROOF OF BQ (1) AND THEOREM 4.1
We proof the Eq. (1) and Theorem 4.1 in this section.
15

---

Published as a conference paper at ICLR 2023
Recall the a-slack mechanism for the inner- miner-maximization objective decomposition with K indepen- dent populations as follows,
N
N
1
LAT
max
(((())))
max In EB (26)
((S(s)) Un)
In EB
N
N
Lk
(5)
R
No(k)
K
No(R)
K 2
2 (1 a)
CO(k) + + a)
Σ
Co(k)
s. (0, 1), K
N
N
k=1
k=R+1
L (K).
where (6-) is a function which maps the index to the original population group sorted by { (N L in an ascending order. Here o(-) bind the terms before and after the and does not affect the normal gradient back-propagation, since each gradient path of samples is traceable..
proof of Eg. (1). The deduction of the inequality in Eq. (5) can be formulated in the following. Given a E 10. and R- < K with the population sorted by { Ny [x} in an ascending order, we have 2
EK= k= CO(k) I Lk=R+1
R Noth)
Naw
Lo(a). Then, we have the following relationship by subtraction, N
R
No0
K
No(k)
R
No0k N
K
Nock)
Σ
Lo(k))
+
Σ
LO(k) - (1 + ④)
Lo(i) - (1 aa)
Σ
Cock)
N
N
N
1=1
k= R+1
k=
R+1
K
No(K)
R
No(k)
a
La(k)
2 0.
(6)
N
N
k=R+1
Rm
proof of Theorem 4.1. It can be naturally proved by Eq. (6). If an > 02, then we have,
Nock) Co(k) + (1-
No(k)
- (R) la) = (1+ 01
Lo(k)
N
k=
No(h) Co(ck) - (1)
No(k)
+ 02
Co(k)
(7)
N
k=R+1
R
NO(R)
K Σ
Nock)
[a] 02)
Lo(k)
Lo(kk)
50
N
N
R=
Similarly, we can prove La (K)) < La R5)
La
if R
R2.
B.2 PROOF OF THEOREM 4.2
Based on the convergence of Adversarial Training (Sinha al., 2018), we proof Theorem 4.2 in this
section. Following (Sinha et al., 2018), we firstly make some required Assumptions B. land B.2 and provide the corresponding Lemma B.3 that defines the Lipschitzan condition Theorem 4.2.
Assumption B.1. The function I-strongly convex with respect to the norm -1-
X' X' + R4 is continuous. For each X, cl. 20) is
Assumption B.2. Let || Il. is the dual norm to ||-I]. the loss é: O X' IR satisfies the Lipschitzian smoothness conditions
(ol((;z) vol(0':))11 S Lool l'1,. ||V,((0;x) v.l((:z')l. - Lowe x' 2'11, (o((0;=)) Vol(0;<')11 Tooz|1r x'll. [V>e(0;=)) v=((0'==))11 T 0'||
16

---

Published as a conference paper at ICLR 2023
Lemma B.3. Let : R be differentiable and X-strongly concave in with respect to the norm || ||, and define f(0) = supzex f(0,z). Let go(8,z) = Vef(0, x) and 9x(0, æ) = Vof(0, x) and assume ge and 9z satisfy Assumption B.2 with t(O, x) replaced with f(0, x). Then f is differentiable, and letting x² (0) arg x f00 x) we have f(()) go x" (0)). Moreover,
-0,) (02)] - L 00 - 0211 and | |V(0) (0(()---(OO)
VI('I S (Loo + Lozben 10 - 0'1)).
proof of Theorem 4.2. Let : X' - (xx). where c(z, vo) is the "cost" for an adversary to
perturb xo to x. Let f(0 2;; =o) = {(0:2) 7c(x, 2o), noting that the gradient steps is preformed as
g' Vaf(O' 2; )²), where @ is approximate maximizer of f(0, æ; x in and 0 0 Meg
We assume S 1 in the rest of the proof, which is satisfied for the constant step size / T8
L
and T 2 35 By Taylor expansion using the Ly -ssoooothssss the objective Ls for k-th client,
we have
Lx |10
Cx Cxl a1+1 S Lxl p: + <VVLs 0.. 00+1
0 - -0²)
00112
(8)
2
=Lxl 14 [x 1a:113
11g'112 + Me (V ge: VLx -g')
2
=Cxl - Me (I
1 =Luvee²))
||VCx|orl1
+ Mc(1 IWp (VCx V.xl0: - -g') + LoF
l1g
VL
1:
2
Consider the function Φ (0; mo) sup (0, x; zo), we define the potentially biased errors 5¹ = g" 1o (0%;"))))) x²). Then we have the following relationship.
C Calori1 SC ii (1 (1- 1 _/ IVC*
-1--10
(9)
+ Me(1 - Tw011) (V loc. VLH - -orl, (0'x"2))
(e LQM <V pr 5²) Tnn112 VVo0 + VC
-
= =Culp- - Mr (1 -1- - _ |VCxxgrll
+ +1 - (2M <V V.*lor - Voda (0,x(');z')
- -Me(1 - L)) <VLx
pe: .5)
LOMi
+ 1115*112 1/88+I/Vecae
|V (0';²') VCulor 10)) V 52))
Since =aa b) 1 (Ilal13 + (bb we have
Calpm SCa or
He L 1 1o- + pe((1 - ve((1-baa)) (VLC)) 0r, VCx - -V00,(0'22)) (10)
2
+ (e((1 + Lw)11)
||<|| + L Veo, (o',, vCx 0:
2
Then, letting x = arg max, f(0", )²) the error Ç¹ satisfies,
|K -l (8:: - f 2 1 =
(11)
< Lo, ||a - 2L3 e,
(12)
where the final inequality utilize the X >= Law strong-concaving of f(0, x; 20). For conve- 21 nience, let 9-b-z
Taking conditional expectations in Eq. (10) and using E. [V (0
17

---

Published as a conference paper at ICLR 2023
Viklgrs we have,
E [[C Eulor109 1 - Mt | Lx lo.11t uel(1 + Luwl) e Lag VVo0, - Lx lo:11
2
(13)
M WLkk or 112 + ueē + L Vods, 1
Since 2 S L.s. taking a fixed step size μe, we have.
22 < 2 E [xllg Ls Colerts] + 2
V
a+ [2
(14)
Because E [IVoo
1 2
S 8². summing over t, we have,
1 T
T
Σ
11
28 <
nT
2
(Cx - BBCx| + 2 2g
2A
+ 2
(15)
nT
Since 1
V
Delta T
and 7 Loa,s we can get the following result,
T
4L
LA
Σ E
V
[o
S
48
(16)
T 1=1
A
T
Adopting a-slack mechanism, we have,
E
VL
(
R3) 0r
T
t=1
T
R
(-(0)
K
Σ
E
a)
(kk
V (o(k)
(1-a)
Σ
o(k)
V
T
N
N
k= R
R+1
R
N
(t)
K
N (t)
27
(1 (1+0) 0)
((k)
E
V V les
+ (1 a))
Σ
o(k)
E
V
Lock ox
N
N
k=1
2
k=R+1
a1+a)
R
(=()
((k)
+ (1 (1-a) Σ
K
N-11) o(k)
4L2 18
+ 48
LA
N
N
T
k=1
k=R+1
1
k=
((k)
Σ Σk=R+1 o(k)
((t)
AL
+ 48
LA
N
T
1
+ {(t)
4L3 A
LA
1 7
+ 48
N
T
(17)
where g(t)= = k=
=k(==
(+)))
Σk
R+1 o(k) to simplify the notations.
(t)
((k)
B.3 PROOF OF THEBREM 4.3
Based on the convergence of FedAvg (Li et al., 2019), we proof Theorem 4.3 in this section.
First, we make the following assumptions and present some useful lemmas. Specifically, we make the following assumptions. Assumption B.4 and B.5 are standard (typical examples are the -orm regularized linear regression, logistic regression, or softmax classifier). Assumption B.6 and B.7 7 have been made by the previous works (Zhang al., 2013; Li et al., 2019).
18

---

Published as a conference paper at ICLR 2023
Assumption B.4. Li, .... LK are all L-smooth: for all v and w, Cx(U) 1 Lx(W) + (c
V.''VC (w)) + b wl12.
Assumption B.5. L1, ......, Lx are all X-strongly convex: for all v and w, Cx(v) La (w) + (v w)"VLx(1)) (w) 1 ml1.
Assumption B.6. Let E be sampled from the k-tth device's 'i local data uniformly at random. The
variance of stochastic gradients in each device bounded: E [ . { VCx(w)) I 6% for
k 1= K.
Assumption B.7. The expected squared norm of stochastic gradients uniformly bounded, i.e.. Vi/ (wf, )12 < 5² for all A == 1,... K and ( t= 1, -
,.,,,,
We use the following lemmas proved by Li et al. (2019). Let O denotes the model parameter main- tained in the k-th client at t-th step, θ represents an immediate result of one step SGD update from or. For convenience, we define θ ΣR=1 N O 0, == Ek=1 N
Or. 9: > -= N
No
(O,)
and 9t = Σ VL (0f, , ). Therefore, Eg: = 9t.
Lemma B.8 (Results of step SGD). Assume Assumption B.4 and B.5. If
It we have
Bljθ,+1 1-1 <
m/ A) 10, 0-12
(18)
K
N N
+ 1 - 3x112 + 6L r + 2E
10, - 0,113,
where D = Ex
Lemma B.9 (Bounding the variance). Assume Assumption B.6. It follows that
K
N N
B B9: 3ell
(19)
K.
k=1
Lemma B.10 (Bounding the divergence of 0g and 17 < 2 for all > It follows that
Assume Assumption B.7, that is non-increasing
Nk
E
100
02113 (E
(20)
N
proof of Theorem 4.3. Let A, = 0. - 1-112. From Lemma B.8, Lemma B.9 and Lemma B.10, follows that
A411 S (1 T1,) + BBB
(21)
where,
K
((T)
2
N
K
P(T)
NE +8(E - 1)2s, (22)
8k N
+ 6L
C
Ct
CeT N
N
1=1
a
and
and
a E are acted the scalar timing by the personalized variance bound 8
14 E
and the local optimum 23 of each client.
& For diminishing stepsize, 1)+ 747 for some B > and 7 > 0 such that m S min + + and 7/t < 21 We will prove that A, S - where max B :
1)A,}. The above can be proved by induction. Firstly, the definition of ensures that holds for 1. Assume the conclusion holds for some f, it follows that,
(7 (
A S )
1/
32B
(1
t t+g
t t+ 7++
++7-1 V+ +1[+++++00
B2
(23)
(1+
(1+
(1 (1+
< ++
19

---

Published as a conference paper at ICLR 2023
Then by the L-smoothness of C(),
v
B|C1] L- - - S 2
(24)
2
Specifically, if we choose 3 = ,, m x _}}- - 1 and denote 4. then T/2
7 One
can verify that the choice of 77 satisfies 1/2 2 for t > 1. Then we have
B B
BB B
4B + (7 11 S
max
[A 11+11(11)44
+ 1)
(25)
3A -
A3
and
B|C]]
L-
L v
3 R
(2
X 1)
2 1
(26)
2 7+ 7+ X
C FURTHER DISCUSSION ABOUT FIGURE 2
15
14
13
12
WM MM Ww
10
FAT (2-1)255)
FAT (2-2255))
FAT (cm4/255)
40
50
Communication Rounds
(a) Client drift with different adv. generation
(b) w/o adv. generation
(c) w/ adv. generation
Figure 5: (a): the client drift (Li et al., 2018) with different adv. generation varied from weak (i.e., e = 1/255) to strong (i.c., e = 4/255) on SVHN. ||0, 0, ll2 indicates the parameter difference between local model and averaged global model. It verified that stronger adv. generation leads to intensified heterogeneity, (b)-(c): The decision boundary of binary classification task on one local client. The black squares and circles indicate samples of two classes in the client, the light gray indicate that of the other client. The red squares and circles indicate the generated adversarial data. serves potential explanation for the bias exacerbation caused by local adversarial generation. Note that, (b)-(c) are obtained by training the neural networks.
In this section, provide verification about intensified heterogeneity using the real dataset, i.e., SVHN (Netzer et al., 201 1) (in Figure 5(a)), and provide a two-dimensional result (in Figures 5(b) and 5(c)) explain the exacerbated optimization bias induced by the local adversarial generation.
First, we conduct the experiments under Non-IID setting to verify the relationship of intensified heterogeneity with adversarial generation in the SVHN dataset, which for the multi-clasiifictiinn lask. To be specific, we compare the FAT on 5 clients using different adversarial strength to show the effect of adversarial generation on local clients. Other setups keep the same with that of Table 3.
In Figure 5(a), we conduct FAT using the adversarial generation of different e-ball (from weak 1/255 to strong 4/255) and check the client drift, which has been formally defined in Karimireddy al. (2020) to show the optimization bias in federated learning. The client drift is widely adopted in federated learning literature (Smith et al., 2017; Li et al., 2018: 2021b; Karimireddy et al., 2020)] to reflect the degree of heterogeneity (Zhao et al., 2018; Li et al., 2019). The statics of client drift with different adversarial generation can indicate the relationship between nuner-maximizaion with the intensified heterogeneity. Through the results, we can find that as adversarial strength increases, the heterogeneity also exacerbated along with training. The similar trend can be also found the experiments with other dataset in Figure 10 of Appendix E.4, where also present the corresponding robust accuracy. This verifies the issue discussed in our motivation part (in Section 4. 4. using the real classification task, and it is also consistent with our binary illustration.
20

---

Published as a conference paper at ICLR 2023
Second, we conduct the experiments synthetic dataset to present the potential explanation about the heterogeneity exacerbation. To be specific, we conduct basic federated learning and FAT using two clients the synthetic dataset and check the decision boundary in two-dimensional plane. It shows how the adversarial generation on local clients can exacerhate the heterogeneity.
As for the experiments the synthetic dataset, we create its training data randomly using Numpy and train using a neural network with one hidden layer and one Relu activation layer for each clients.
In Figures 5(b) and 5(c), we plot the decision boundary of the training results synthetic dataset for FAT using two clients. The Figure 5(b) shows standard training (using the natural data) on the client's local data while the Figure 5(c) shows adversarial training (generating the adversarial data) on the client's 's local data. Note that, without the training data of other clients, the adversarial generation on the current biased model is highly biased to the local distribution, which even exacerbated the optimization bias and would result in a large client drift or variance, e.g., 52 in our theorems. More empirical evidence on CIFAR- 10 dataset can also refer to Appendixes E.4 and E.6 which show the statics corresponding the accuracy during the training process.
Table 5: Robust deterioration w.r.t adversarial training strength in FAT.
Setting
Performance gap between best and last epoch
Dataset/Adv. Strength
2/255
4/255
8/255
CIFAR-10
FAT
6.33
11.16
13.06
Dataset/Ady. Strength
1/255
2/255
4/255
SVHN
FAT
4.65
5.63
6.43
To better support conjecture, compare and robust deterioration in FAT with different adversarial training strength (using the same robust evaluation strength) and summarized the results in Table 5. The results show that more stronger adversarial generation (i.e., the larger iiner-maximization lead to severe robustness deterioration (indicated by the large accuracy gap between the best and last stage). It confirms the rationality of our derived lower bound by o-slack mechanism to pursue the adversarial robustness and alleviate the heterogeneity exacerbation. In our Appendix E.4, we also provide more empirical verification that quantitatively measure the intensified heterogeneity, which show that our SFAT indeed alleviate the intensified heterogeneity and achieve the better robust accuracy.
D DETAILED ALGORITHM AND LEARNING FRAMEWORK
Ascending Sort
G4. A
SniighteddAvvrragg
@++1
Server
R
Clients
MEL-
Mx N Lx
f
0
e
0
Figure 6: A brief illustration of our Slack Federated Adversarial Training (SFAT) framework. On the client-side, each client will conduct adversarial training on its local data and update the optimized model parameter (i.e., (z)) with the adversarial training loss (i.e., No Lx)). )). On the server-side, after collecting the model parameters and the loss value (information about the training status), the server will conduct an ascending sort and aggregate the global model with weighted average (denoted by @) which upweights the top populations of the small-loss client's 's model parameters with a.
In this section, we provide the detailed algorithm (i.e., Algorithm 1) for our Slack Federated Adver- sarial Training (SFAT) and an intuitive illustration of our proposed SEAT in Figure 6.
21

---

Published as a conference paper at ICLR 2023
Algorithm 1 Slack Federated Adversarial Training
Input: client number: K, communication rounds: T, local training epochs per round: E, initial server's model parameter: 0%, hyper-paramettr for aggregation: a, number of enhanced clients: R; Output: globally robust model 0
1: for t= 1, ...., T do
2: Clients: perform adversarial training]
3: for client h: 1, ..... K do
4: 0%. La = AT(B), / E') (Madry et al., 2018)
5: end for
6: Server: [ performs slacked aggregation]
7: Lall -- N1 L1, N2 L2...., Nx Lx]. Esoned t Ascending, Seennding_or((fagg
N 8: Yk: Ps = I-a 11 ([N Lt S Laueea (R]) + 1. 1 NE Lx > Liaated (1)) Pt) Paa):
N
1+a
9:
g++1= Ees Nv Eb= P:
10:
end for
For simplifying the practical use and adaptation, we can mainly assign higher weights for the client having smaller adversarial training losses to realize the relative weighting illustrated Figure 6. To be specific, we can set the normalized Ps- = aa/ - -a) 1 ( Lx S Csoned [K] + 1 N₂ Lsoned (KI) Pk) + 2a/(1 a)) in the aggregation to ensure the expected lower bound.
N Cs >
Based on the a-slack mechanism, we provide a new framework for the combination of adversarial variety of different adversarial training (Zhang et al., 2019; Alayrac et al., 2019; Wang et al., 2020a; Jiang et al., 2020; Chen et al., 2021; Carmon al., 2019; Madry et al., 2018; Chen et al., 2020: Ding et al., 2020; Li et al., 2021c; Chen et al., 2021; 2022) methods and federated optimization algorithms (McMahan et al., 2017; Li et al., 2018; 2021b; Kairouz et al., 2019) which pursue the adversarial robustness or alleviate the data heterogeneity as well as other specific issues on the client side, and for the specific practical challenge for federated settings (Shah al., 2021; Hong al., 2021). Those all can be flexibly adopted into our framework or extend to fit other training constraints (Kairouz et al., 2019) of federated learning.
training with federated learning. It is orthogonal
E EXPERIMENTAL DETAILS AND MORE COMPREHENSIVE RESULTS
In this section, we first provide the details about our experimental setups for dataset, training and evaluation. Then we provide more comprehensive results for better understanding the characteristics of our SFAT and the performance verification in different settings. In Appendix E. we tracing and discuss the dynamies of our SFAT on choosing the upweighted clients. In Appendix E.2, we present the results of training with different local epochs. In Appendix E.3, we present and discuss the comparison of Re-SFAT v.s. SFAT. In Appendixes E.4 and E.6, we report the client drift and variance with the corresponding robust accuracy during training. In Appendix E.8, we discuss the orthogonal effects of SFAT on intensified heterogeneity. In Appendix E.9, we verify SFAT using more clients. In Appendix E. Appendix 1,,,, we verify SEAT in more practical real-world situation. In Appendix 12, we report the performance results on both Non-IIID and IID setting across the three benchmarked datasets.
verify SFAT using unequal data splits under Non-IID setting. In
Dataset. We conduct the experiments on three benchmark datasets, i.e., SVHN (Netzer et al., 201 1), CIFAR-10 and CIFAR-100 (Krizhevsky, 2009) as well as a real-world dataset CelebA (Caldas et al.. 2018) for federated adversarial training. For the IID scenario, we randomly distribute these datasets to each client. For simulating the Non-III scenario, we follow McMahan et al. (2017); Shah et al. (2021) to distribute the training data based on their labels. To be specific, skew parameter is utilized in the data partition introduced by Shah et al. (2021), which enables K clients to get a majority of the data samples from subset of classes. We denote the set of all classes in dataset as y and create V% by dividing all the class labels equally among K clients. Accordingly, we split the data across K clients that each client has (100 - (K 1) x 5% of data for the class in 3% and s% of data in other split sets. In most experiments, we set s = 2 for simulating the Non-IID partition with 5 clients Shah et al. (2021) recommended.
22

---

Published as a conference paper at ICLR 2023
Table 6: Brief summary of the basic experimental details about SFAT
Dataset
Network
Local epochs
K
K
CIFAR-10
NIN (Shah al., 2021)
10
CIFAR-100
ResNet-18 (Chen et al., 2021)
20
4
SVHN
SmalICNN (Zhang et al., 2019)
| 5
1
Training and evaluation. In the experiments, we follow the previous works (Zhang al., 2019; Shah et al., 2021) to leverage the same architectures, i.e., NIN (Lin et al., 2014) for CIFAR-1O, R8sNet-18 (He al., 2016) for CIFAR-100 and Small CNN (Zhang al., 2019) for SVHN.
For the local training batch size, we set 32 for CIFAR-IO, 128 for CIFAR-100 and SVHN. For the training schedule, SGD is adopted with 0.9 momentum for 100 communication rounds under clients as in (Hong et al., 2021; Shah et al., 2021), and the weight decay = 0.0001. For adversarial training, we set the configurations of PGD respectively (Madry et al., 2018) for different datasets. On IFFAR-O/CIFAR-
we set the perturbation bound = 8/255, the PGD step size 2/255 and set the PGD step number 10. On SVHN, we set the perturbation bound e = 4/255, the PGD step size 1/255. The PGD generation for all the datasets keep the same step number 10.
Regarding the evaluation, the accuracy for the natural test data and that for the adversarial test data are computed following Madry al. (2018); Zhang et al. (2019). Note that, the adversarial test data are generated by FGSM, PGD-20, C&W (Carlini & Wagner, 2017) attack with the same perturbation bound and step size the training. All the adversarial generations have random start, ie, the uniformly random perturbation of [-c added to the natural data before attacking iterations. Besides, also report the robustness under stronger AutoAttack, termed as AA for simplicity. All the experiments are conducted for multiple times using NVIDIA Tesla V100-SXM2.
As for SFAT, different training tasks adopt different o-slack mechanism considering different characteristic of local training data, specifically, we set a = 1/6 (i.e., L+a = 1.4) for the experiments on CIFAR-10, 10, and
I-a CIFAR-100 and 1/11
1/11 (i.e., 1+a I-a 1.2) for the experiments
1 (i.e., T-o 1.2) for the experiments on SVHN. As for FedProx, we set its original syper-parameter = 0.01 0.01 for each dataset and the a for our a-slack mechanism are 1 1/11, 1/11, and 1/11. As for Scaffold, the adopted for previous datasets are 1/ and 1/11 correspondingly.
As for the choice of the hyper- param-prrrmeter a, one useful way to set might be progressively probing its effect in value-growth manner. When the degenerate the original objective of FAT, so does the performance with no harm. Slightly enlarging a can improve the performance due the benefit on alleviating the intensified heterogeneity during aggregation, and then make stop in one point where the performance becomes drop.
very small, the objective will approximately
E.1 THE DYNAMIC OF SEAT
In this part, we present the dynamics of our SFAT about the critical q-slack mechanism. To be specific, we visualize the selected clients in each communication rounds for our slack aggregation.
In one experiment on CIFAR-10 (Non-IID), we trace the index of top client (i.c., the selected client that upweighted in our mechanism) and find the top weight dynamically routes among different clients instead of the single or a subset of 5 clients. The empirical results confirmed there is no dominant client exists during the training. To further check whether our SFAT will result in unfair attention to different clients, we investigate the difference of client's training accuracy, the accuracy gap (32.40%) of the best client with the worst client comparable with that (32.23) (2.2%% in SEAT. Intuitively, since the large adversarial training loss automatically balance the client- client-wise aggregation weight, there is no unfair attention to exacerbate the performance difference among clients in our experiments, which are verified by the above gap and the similar assignments for the weighting index.
23

---

Published as a conference paper at ICLR 2023
22
Ciien
Communication
Figure 7: The index of the top-K clients with the small losses in SFAT (a 1/6, K 1) in each communication round on CIFAR-10 10 (Non-IID) as well as the total account. We can see that it is dynamically routing among all clients instead of fixed, and each client has similar assignments.
Robust performance each client. In Figure 7, can find there is no dominant client exists, which means that all clients are ever chose to be up-weighted/down weenh-e during the training. Thus, SFAT explores to help all clients to be better. Besides, the global model is redistributed to each client in each communication round of federated learning, which can also avoid the bias accumulation for each single client. To verify each client performance in our experiments, we report the robust training accuracy of each client in our experiments and summarize in Table 7. The results show the training performance of each client is not worse than the original FAT.
Table Robust training accuracy on each client w.r.t. different methods.
Setting
Client
Method/Cllent
CIFAR-10
75.96
77.12
80.37
SEAT
60.05
66.57
77.17
78.79
83.23
SVIIN
SEAT
91.69
85.58
91.93
85.31
90.35
To further check the generalization performance each client, also conduct extra experiment where we split a small part of local data in each client to serve as the local test data and evaluate their training and test performance using FAT and the proposed SFAT SVHN dataset. According to the summarized results in Table 8, the generalization performance (indicated by the gap of robust training and test accuracy) of our SFAT are also generally better than FAT in SVHN dataset.
Table 8: Robust performance gap on each client w.r.t. different methods.
Setting
Chien
Method/Cllint
Train
87.51
88.19
85.91
78.99
79.17
FAT
Test
72.96
70.64
64.30
61.97
66.57
Gap
14.55
17.55
21.61
17.02
12.65
SVHN
Train
87.59
88.41
85.97
79.27
79.04
Gap
13.94
16.95
20.17
15.79
12,42
E.2 EXPERIMENTS WITH DIFFERENT LOCAL TRAINING EPOCHS
In this part, we first report the robust test eurve on CIFAR-10 dataset to compare the FAT and SFAT using different local training epoch in each client. Then focus extreme setup, i.c., local epoch for each client in both CIFAR- and SVHN datasets and report the performance comparison, although using 1 local epoch is not practical considering the heavy communication cost it introduced in worldworld application (McMahan et al., 2017).
In Figure 8, conduct the experiments CIFAR-10 with different local training epochs. We find FAT exhibits robust deterioration across different settings that impedes further progress towards adversarial robustness of the federated system, and simply changing the local training epoch not
24

---

Published as a conference paper at ICLR 2023
37.5
37.8
35.0
35.0
Robust Accuracy
Robust Accuracy
32.5
32.5
30.0
FAT
30.0
SFAT
27.5
27.5
Best Acc of FAT
23.0
28.0
22.5
22.5
20.0
20.0
Communication Rounds
Communication Rounds
(a) Local training epoch: 10
(b) Local training epoch: 5
36.0
Robust Accuracy
30.0
22.6
100
200
300
400
800
700
Communication Rounds
(c) Local training epoch: 1
Figure 8: Comparison between FAT and SFAT with different local training epochs. All the experi- ments are conducted on CIFAR-10 10 dataset (Non-IID) with 5 clients, and use PGD-20 (Madry et al., 2018) to evaluate the robust accuracy.
achieve the significantly higher robust accuracy as the dashed black line denoted. In comparison, our SFAT can consistently achieve a higher robust accuracy than FAT by alleviating the deterioration.
Even on the extreme setup, i.e., using local epoch for each client, we can find the intensified heterogeneity also exist since the adversarial generation will be conducted in each optimization step, and can be further mitigate by our SFAT. Reducing the local epoch indeed can alleviate the robustness deterioration since it can reducing the original client drift (McMahan et al., 2017; Li et al., 2018). the original client drift is alleviated, the adversarial generation will inherit and exacerbate less heterogeneity. However, it does not achieve the nature of this issue and this experimental setup adjustment has similar essence with those federated optimization methods (Li et al., 2018; Karimireddy et al.. 2020). The results help to better understand the effects of the proposed SFAT on combating the intensified heterogeneity via relaxing the inner maner-mxxmmiztion to a lower bound.
Table 9: Comparison using FedAvg on CIFAR-10 10 and SVHN datasets using different local epochs.
Dataset
Local epochs
Methods
Natural
FGSM
PGD-20
CW
FAT SFAT
57.450 17.45%
39.44%
32.58%
30.52% 33.99
10 (in Table 3)
63.44%
45.13%
37.17% %
CIFAR-10
FAT
57.61% %
40.27%
33.18%
32.16%
SFAT
64.85%
45.55%
37.04%
34.84% %
FAT 91.24%
87. 87.95%
68.87%
67.39%
(in Table 3)
SEAT
91.25 %
88.28%
71.72% %
69.79%
SVHN
FAT
91.21%
87. 99.99%%
69.35% %
68. 68.28%
SFAT
91.98%
88.99
72.34 %
71.05 %
In Table 9, we report and compare the results under the 1-epoch local training compared with our previous results under multiple epochs used in Table 3. The results verify the consistent effectiveness
25

---

Published as a conference paper at ICLR 2023
of SFAT. Reducing the local epochs to indeed can improve the performance (0.5%) of the baseline FAT, but might not very practical due to the resulting large cost of the communication federated learning (McMahan et al., 2017). Even the 1-epoch setting, still suffer from the robust deterioration. The results in Table demonstrate that the intensified heterogeneity could be better alleviated our SFAT. It is similar our discussion (in Appendix E.8) about the orthogonal effects with federated optimization methods (Li et al., 2018).
shown in Figure 8, the FAT
E.3
SFAT VS. RE-SFAT
Table 10: Comparison with emphasize/ddeeemphsiiee the client with smallest loss.
Setting
Non-IID
CIFAR-10
Natural
FGSM
PGD-20
CW
SFAT:
1.4
emphasize
63.44%
45.13%
36.17% %
33.99 %
SEAT:
1.2
emphasize
62.26%
44.08%
35.83%
33.31%
FedAvg
FAT:
1.0
original
57.45%
39.44%
32.58%
30.52%
Re-SFAT:
0.8
de-emphasize
50.45%
34.34%
27.86%
26.62%
Re-SFAT:
0.6
de-emphasize
40.47%
28.81%
24.36%
23.19%
1-a
SVHN
Natural
FGSM
PGD-20
CW
SFAT:
emphasize
90.60%
87.75%
73.12%
70.51 %
-
SEAT: -0
1.2
emphasize
91.25%
88.28%
71.72%
69.79%
FedAvg
FAT:
-2
1.0
original
91.24%
87.95%
68.87%
67.89%
Re-SFAT:
0.8
de-emphasize
90.03%
86.12%
64.35%
64.32%
Re-SFAT: I-a 0.6
de-emphasize
89.46%
84.80%
58.64%
58.96%
100
30
Re-STAT 11 (.5)
E5.30
FAT
8FAT 6ig 1.4)
8.15
50
10
20
125
600
3t
70
20 Communicatio Rounds
10
22 3
Communication Rounds
Communication Rounds
(a) Robust accuracy
(b) Client drift
(c) Zoom-in Client drift
The robust accuracy w.r.t the client drift (Li et al., 2018) of Re-SFAT, FAT, and SFAT during training. It shows that Re-SFAT further enhances the intensified heterogeneity well as the robustness deterioration via emphasizing the client with larger adversarial loss, which reversed to the operation of our SFAT. This verifies the rationality of SFAT that slack the original objective.
Figure 9:
In this part, we start with the experiments about comparing the performance of oppositely using the o-slack mechanism, i.e., Re-SFAT, with original SFAT. Then discuss its underlying reason as well as the relationship of loss and the intensified heterogeneity.
In Table 10, conduct an empirical comparison between FAT, SFAT (which emphasizes the client model with the smallest adversarial training loss) and Re-SFAT (which is contrary variant of SFAT that de-emphasizes the client model with the smallest adversarial training loss). Here the Re-SFAT share the same spirit with the AFL (Mohri et al., 2019), which seeks to improve the faimess and generalization through a loss-man maximization reweighting. The experimental setups keep the same as Table 3 using 5 clients. Both SFAT and Re-SFAT keep the = 1 in all the trails.
Through the results across two benchmarked datasets (i.e., CIFAR-10 and SVHIN, We find that de-emphasizing the client with smallest adversarial loss (relatively emphasize those with larger adversarial loss) consistently harm the model performance across these evaluations, which shows the spirit of loss-man masimiiaiiziinn in Re-SFAT and AFL is contrary to the correct way. In contrast, emphasizing the client with smallest adversarial loss indeed improve the model performance in terms
26

---

Published as a conference paper at ICLR 2023
of both natural and robust accuracies. It confirms the rationality of SFAT to alleviating intensified heterogeneity by relaxing the inner-maxen amerrmaximization of adversarial generation during aggregation.
Note that the generalization focus by AFL is under the standard federated learning instead of federated adversarial training, and the empirical results also confirm the foss-maximizatie intensified heterogeneity and lead to lower accuracies (in Table 10). Since it is out of the scope of this work on handling the intensified heterogeneity, we leave it to our future work.
actually trigger the
With respect to the experiments with standard training (in the left of Figure 4), there is inner- maximization in (3) Thus, there is no intensified heterogeneity to handle but only positive training signals from the standard training. In this case, adding the inequality with slack in (3) only induces the extra objective bias to the standard federated learning. Correspondingly, as shown in the left-most panel of Figure 4, such an operation instead degenerates the model performance.
Discussion about the loss and the intensified heterogeneity. It is the learning dynamic of Eq. that upweights the client model with the smaller losses and downweights the client model with the larger losses to slack the overall objective. Possibly, the optimization bias (or termed as client drift more rigorously) may result in a smaller loss and sometimes the smaller loss may not absolutely indicate the smaller optimization bias. We have verified that when the opposite does not hold and the larger loss preferred in the selection the middle panel of Figure (see Re-SFAT v.s. SFAT) and the above Table 10 (sce Re-SFAT v.s. SFAT). The Re-SFAT is actually construct bound of the FAT objective, which is different from SFAT that relax to the lower bound of the FAT objective. The results empirically verify the failure of this case that prefers the larger loss. Here discuss the connection between the slack mechanism and the intensified heterogeneity (or roughly call slack mechanism naturally
upper
intensified optimization bias). To alleviate the intensified heterogeneity, relaxes the overall objective and constructs a mediating function that asymptotically approaches the original goal and reducing the negative impact of the intensified heterogeneity on the training. Our reasonable analysis and comprehensive evidence from both theoretical (c.g.. Theorems 4.2 and 4.3) and empirical (e.g.. Figures 3, 10, and 11) views have demonstrated its rationality. In Tables 3 and 19, the multiple experimental results with random non-iid data distribution as well the real-world datasets demonstrates the empirical superiority of our proposed SFAT over the original FAT.
E.4 SFAT CORRESPONDING TO CLIENT DRIFT
FAT
SFAT (* 12)
0.35
Robust Acouracy
SFAT 6 1.3)
0.30
SFAT 6* 1.4)
18
SFAT 6+0 1.5)
0.25
0.20
0.15
0
10
20
30
40
50
80
70
80
90
100
10
20
30
40
50
60
70
80
90
100
Communication Rounds
Communication Rounds
(a) Client drift
(b) Robust accuracy
Figure 10: The client drift corresponding to the robust accuracy of FAT and our SFAT during training.
In this part, we present more results about the client drift during training using FAT and our SFAT than Figure: 3. The corresponding curve during training can be more clearly to show how SEAT alleviate the intensified heterogeneity and achieve the higher robust accuracy.
We conduct more experiments about client drift of FAT and our SFAT on CIFAR-1O (Non-IID) in Figure 10. As the increasing, our SFAT can further alleviate the intensified heterogeneity (having smaller client drift value as shown in Figure 10(a)) of FAT at the later stage which corresponds to the robustness deterioration (exhibiting less obvious deterioration while achieving higher robust accuracy as shown in Figure 10(b).. Unlike FAT that hindered by the intensified heterogeneity, our SEAT can improve the robust accuracy by combating the issue of intensified heterogeneity.
27

---

Published as a conference paper at ICLR 2023
E.5 ADDITIONAL DISCUSSION ON THE O-SCK MECHANISM
Here, first empirically verify the difference between FedSoftBetter and our SFAT, conduct the experiments on CIFAR-10 and SVHN to compare their performance in the following table. The results show that its empirical performance is slightly better than FedAvg but not better than SFAT.
Table 11: Comparison of different methods on CIFAR-10 and SVHN datasets.
Dataset
Methods
Natural
FGSM
PGD-20
CW
FAT FedSoftBetter
57.45%
39.44%
32.58%
30.52%
CIFAR-10
58.86%
40.23%
32.78%
30.76%
SEAT
63.44%
45.13%
37.17%
33.99%
FAT 91.24%
87.95%
68.87%
67.39%
SVHN
BedtofiBetter SFAT 91.25%
91.64%
88.53% %
69.07 07%
67 87.8%%
88.28%
71.72%
69.79%
In the following, we present the experiments that progressively anneal the coefficient to vanilla federated adversarial training during the training and compare with SFAT on CIFAR-10 and SVHN. According to the results in Table 12, gradually annealing-a SFAT achieves slightly lower robust accuracy than the constant-a SFAT and sometimes may introduces the large drop of natural accuracy (e.g., on CI).R-10). It indicates that keeping consistent for the a-slack maybe better choice. On the other hand, it also confirms the intuition that using gradually decreased alpha is empirically contrary to the observation of robustness deterioration (or the heterogeneity exacerbation as shown in Figure 10) at the later stage of training.
Table 12: Comparison on CIFAR-10 10 and SVHN datasets using different a schedule.
Dataset
a-slack
Methods
Natural
FGSM
PGD-20
CWoo
FAT
57.45%
39.44%
32.58%
30.52%
1+a 1.4
SEAT
63.44%
45.13%
37.17%
33,99
CIFAR-10
I-a
14a 1.4 1.0
SEAT 60.63%
43.53%
36.23%
33.22%
1-a
FAT 91.24%
87.95%
68.87%
67.39%
1+a 112
SFAT 91.25%
88.28%
71.72%
69.79% %
SVHN
1+a .122+11 1.0 I-a
SEAT
91.68%
88.55 %
71.44%
69.76%
F.6 SFAT CORRESPONDING TO GRADIENT VARIANCE
3.00
FAT
Gradient Variance
2.75
SFAT
Robust Aecuracy
2.50
SFAT (- 1.3)
0.30
2.25
SFAT 1-
0.25
2.00
SFAT Q-2 1.5)
1.75
0.16
1.25
0.10
80
80
Communication Rounds
Communication Rounds
Gradient Variance
Robust accuracy
Figure 11: The gradient variance corresponding to the robust accuracy of FAT and our SFAT.
To further factorize how the inner maximization affects the intensified heterogeneity of the local data, add the experiments about the variance of the client's gradients (caleulated by parameters difference). We find the similar trend with the empirical results about client drift in Figure 11, ie.. SFAT prevents exacerbated gradients variance in FAT, and results in better performance robustness.
28

---

Published as a conference paper at ICLR 2023
E.7
EMPIRICAL VERIFICATION ABOUT OUR THEORETICAL ANALYSIS.
Orginnl d-slack
FadAvg
22
0.8
SFAT
0.8
0.4
0.2
14
12
0.0
40 60 80
Communication Rounds
Communication Rounds
Figure 12: Empirical verification of our theoretical analyze. Left panel: Empirical estimation about El in Theorem 4.2 of the original and our slacked objective using CIFARIO dataset. Right panel: Empirical estimation about [B] LsFAr L in Theorem 4.3 of FAT and our SFAT using SVHN dataset. The overall results confirm the benefit on convergence from our proposed a-slack mechanism.
Here, we provide the empirical verification about the theoretical claim in Theorem 4.2 and Theo- rem 4.3 via tracing the training loss on CIFAR- 10 and SVHN datasets. Figure 12, we present the empirical estimation of the RHS of Eq. (2) and Eq. (4) via tracing the training loss. The results show that our our o-slack mechanism can achieve a faster convergence compared with the original objective for the convergence of adversarial training in Theorem 4.2 and the federated case in Theorem 4.3.
E.8 EXPERIMENTS ABOUT THE ORTHOGONNLL EFFECTS OF SFAT ON CLIENT DIRFT.
In this part, we start with the discussion about the orthogonal effects of SEAT from the conceptual per- spective, and then present the orthogonal effects of SFAT on combating the intensified heterogeneity via tracing the client drift from the experimental perspective.
From the problem view, our slack mechanism is targeted for the intensified heterogeneity. However, similar to other techniques in federated learning literature, FedProx (Li et al., 2018) is designed for the original heterogencous data instead of considering the intensified process. The two problems are discussed in our Appendix A. Although intensified heterogeneity and the ordinary heterogeneity (i.e., without the maximizaiiii))) both induce the client drift, the effects and extent are different. To be specific, the intensified heterogeneity will result in more diverged models and exacerbate the difference among client models compared with the ordinary heterogeneityy This intensification process is not considered in FedProx or other related work (McMahan et al., 2017; Karimireddy et al., 2020), and SFAT is orthogonal to them further incorporates slack mechanism to avoid its influence.
Table 13: Client drift w.r.t Epochs on CIFAR-IO Figure 3.
Setting
Client drift
Method / Epach
10
20
30
40
50
60
70
80
90
100
FAT SFAT
11.56
13.10
15.04
17.30
19.22
20.66
21.72
22.47
23.02
23.49
FedAvg
12.21
13.08
14.37
15.95
17.68
19.04
20.16
20.92
21.50
21.86
FAT
4.71
4.58
5.98
6.54
7.83
8.26
9.12
10.23
11.71
12.61
FedProx
SFAT
5.89
5.27
5.67
6.02
6.87
7.34
7.98
8.77
9.65
10.81
From the experimental view, we also provide the comparison between SFAT and FedProx (actually they are orthogonal and combinable). We show the results of client drift w.r.t different methods in the Tables 13 and 14. According to the results, FAT under the backbone FedProx can indeed catch up with our SFAT on basis of FedAvg since the FedProx is designed for reducing the client drift. However, when adopting FedProx as the backbone of SFAT, the intensified client drift can further reduced, which verified the orthogonal effects (as stated in Appendix A) reducing intensified heterogeneity in the critical issue of federated adversarial training. Note that, we are not focus on the relationship of normal heterogeneity (Li et al., 2018) (e.g., the value of client drift) with the robust
29

---

Published as a conference paper at ICLR 2023
Table 14: Client drift w.r.t Epochs on CIFAR-I0 in the setting of unequal splits with 5 clients.
Setting
Client drift
Method / Epoch
10
20
30
40
50
60
70
80
90
100
FAT SFAT
13.96
16.91
19.89
22.52
24.40
25.75
26.76
27.64
28.13
28.53
FedAvg
14.15
16.71
19.37
21.68
23.33
24.24
25.39
26.11
26.75
26.93
FAT
5.36
5.89
6.82
7.96
9.36
10.89
12.52
14.03
1.5.41
16.47
FedProx
SFAT
6.28
6.27
6.59
7.10
7.68
8.10
9.06
9.80
10.60
11.14
performance in federated adversarial training. Instead, our proposed SFAT actually focus on the robust deterioration caused by the intensified heterogeneity (e.g., the increasing trend of client drift). It is orthogonal and compatible to those previous federated optimization methods.
Table 15: Comparison of SEAT and EAT using FedProx with different paramter Ja.
FedProx: /
Methods
Natural
PGD-20
CW
FAT
90.92%
68.44%
67.18%
0.01
SFAT
91.25%
71.54%
69.53%
FAT 90.25%
68.07%
66.88%
0.05
SFAT 91.37%
70.58
68.93 %
FAT 89.98%
67.15%
65. 65.94%
0.1
SEAT
90.95%
71.89%
69.98
Except the previous results, we further strength the Syper-parameter yu of the proposed proximal term i... f1 w'1l2 in FedProx to verify the improvement of using our SFAT on SVHN dataset. We summarize the results in Table 15. The results show that increasing the from 0.01 (adopted in our experiments and following the recommendation of FedProx) to 0.1. the robust performance even worse while our SFAT can still reach the better performance. The reason may be that too large μ also has the potentially negative influence on the convergence of the training by forcing the updates to be close to the starting point, which has been discussed in previous literature (Karimireddy et al., 2020).
E.9 EXPERIMENTS WITH MORE CLIENTS
Table 16: Comparison about FAT with SFAT Non-IID data partition with different client numbers
Setting
Non-IID
CIFAR-10
SVHN
CIFAR-100
Client Number / Method
Natural
PGD-20
CW
Natural
PGD-20
CW
Natural
PGD-20
CW
FAT
56.62%
31.24%
29.82%
91 91.42%
69.65%
68.52%
33.27%
16.81%
14.12%
10
SEAT
56.67%
33.31%
31.58%
91.84%
72.59%
70.71%
34.17%
17.66%
14.25%
FAT
60.55%
32.67%
31.07%
92.14%
70.325
69.48%
31.49%
15.35%
13.18%
SEAT
62.24%
35.66%
33.21%
92.75%
72.06%
71.14%
34.04%
16.05%
13.70%
FedAvg
FAT
58.97%
32.98%
31.14%:
32.32%
70.54%
69.84%
32.64%
15.82%
13.23%
SFAT
62.73%
35.75%
33.16%
92.33%
71.99%
71.06%
34.19%
16.37%
13.63 %
FAT 56.74%
32.91%
30.50%
91.97%
70.84%
69.42%
34.46%
15.97%
13.59%
50
SEAT
57.21%
34.35%
31.75%
91.99%
71.87%
70.74%
34.82%
16.34%
13.93%
In this part, we verify SFAT using more clients under the Non- MoD data partition with the three benchmarked datasets, i.e., CIFAR-10. SVHN and CIFAR-1OO.
In Table 16, we change the client number from 10 to 50 to investigate the scalability of our SFAT. For each client setting, we conduct FAT and SFAT to compare their performance on both natural test data and adversarial test data. In the experiments, we set K = K/5 and a = 1/11 for our SFAT and keep the other basic setups as the same with previous experiments. We can find that the results further confirm the effectiveness of SEAT on improving both natural and robust performance when training with different client numbers.
30

---

Published as a conference paper at ICLR 2023
E.10 EXPERIMENTS ON THE UNEQUAL DATA SPLITS.
Table 17: Performance on the setting with unequal data splits among clients.
Setting
Non-IID
Dataset
Client
Sample
Opt.
Method
Natural
FGSM
PGD-20
CW
FAT
59.98%
40.57%
31.50%
29.57%
FedAvg
SFAT
61.70%
42.81 %
33,87 %
30.99%
5
6000-13000
FAT
60.36%
40.36%
31.90%
29.00%
FedProx
SEAT
60.65
42.38%
35.16%
30.93%
CIFAR-I0
FAT
61.67%
42. 69%
33.17%
30.58%
FedAvg
SFAT
62.57
44.85 %
36.42 %
32.65%
10
1000-8000
FAT
60.24%
41. 41.25%
33.21%
30.98%
FedProx
SFAT
60.78%
43.73 %
36.76%
32.44%
Dataset
Client
Sample
Opt.
Method
Natural
FGSM
PGD-20
CW
FAT
89.42%
85.93%
68.35%
67.03%
FedAvg
SFAT
90.57% %
87.53 %
70.56%
68.67%
5
5860-26370
FAT 90.15%
86.59%
68.02%
66.22%
FedProx
SFAT
90.55 %
87.45 %
71.19%
69.00%
SVHN
FAT 91.84%
88.80%
70.66%
68.90%
FedAvg
SFAT
91.55%
88.91 %
72.29
70.30%
10
1465-13185
FAT 90.95%
87.77%
69.80%
68, 28%
FedProx
SFAT
91.61%
88.83 %
72.45 %
70.29 %
Table 18: Performance the setting with severe unequal splits among clients SVHN dataset.
Setting
Non-IID
Dataset
Client
Sample
Opt.
Method
Natural
FGSM
PGD-20
CW
FAT
91.84%
88.80%
70.66%
68.90%
FedAvg
SFAT
91.55%
88.91 %
72.29%
70.30%
10
1315-13185
FAT
90.95%
87.77%
69.80%
68.20%
FedProx
SFAT
91.61 %
88.83 %
72.45 %
70.29 %
SVHN
FAT 93.14%
90.23%
72.09%
71.01
FedAvg
SFAT
92.78%
90.07 %
73.85 %
72.08% %
50-16700
FAT 93.06%
90.37%
72.03%
70.90%
FedProx
SFAT
93.14%
90.51 %
73.87 %
72.35
To complete experimental verification those unequal data splits, conduct the experiments on CIFAR-1O /0 and SVHN datasets with different client numbers. We summarize the results Table 17. In addition, we also add Table 18 explore the more severe unequal splits in different clients.
In such setups, the sample numbers of different client are also a critical factor to the optimization. More samples the client has, larger weights the local model has in the aggregation phase. In comparison with our a, it follows the support of the statistical sample proportion while our utilizes the clues of the local loss related to the adversarial training. According the results, we can see that SFAT is approximately orthogonal to the sample number effect and still more effective than FAT.
From the algorithm level, our algorithm (refer to Algorithm 1) and the framework (refer Figure 6) has taken the numbers of local data into consideration. To be specific, when we conduct the slack selection, all the adversarial training loss are normalized by the local data number.
E.11 EXPERIMENTS ON THE REAL-WORLD SCENARIOS
To verify the effectiveness of our SFAT in more practical situation, we conduct the experiments using real-world dataset CelebA in the benchmark of federated learning, i.e., LEAF (Caldas et al., 2018),
31

---

Published as a conference paper at ICLR 2023
Table 19: Performance on Non-IID settings using the real-world dataset, i.e., CelebA
Setting
Non-IID
CelebA
Natural
FGSM
PGD-20
CW
FAT SFAT
57.62% 77.62%
42.20%
22.20%
21.67% 23.52 %
FedAvg
58.50 %
43.44 %
24.14%
57.70%
41.85%
22.29%
21.50% 23.61 %
FedProx
SFAT
58.50 %
43.08 %
24.14%
with hundreds (455) clients Table 19. We follow the most settings LEAF to perform our experiments using different federated optimization methods, and we set K = 2 K/5 and a = 1/6 for all the experiments of our SFAT.
In Table 19, we confirm the effectiveness of our SFAT using a real-world large-scale dataset CelebA with 455 clients. Except Scaffold that fails converge in FAT and thus is reported, our SFAT again gains significantly better natural and robust accuracies than FAT under FedAvg and FedProx.
Table 20: Test accuracy (%) on SVHN with different participation ratio.
Setting
Non-lID
Accuracy/ Participation Ratio
0.2
0.6
0.8
1.0
FAT SFAT
91.93%
31.39%
92.19%
92.31%
92.14%
Natural
91.61%
92.51
92.30%
92.53%
92.75%
FAT
69.63%
99.97%
70.25%
70.24%
70.32%
PGD-20
SEAT
72.37
73.01 %
72.85 %
72.59
72.06 %
In addition, also consider the practical situation where only subset of clients participates in each round. Following the same settings as previous section, we add the experiments on SVHN dataset in Table 20 with 20 clients. The results show that the lower participation ratio leads lower natural and PGD-20 accuracy while our SFAT can consistently outperform FAT on the robustness.
E. OVERALL RESULTS ON BOTH NON-IID AND IID SETTINGS
Here we provide the overall results for comparison on both Non-IID and IID settings in Table 21.
For the Non-IID data, our SFAT gain consistently improvement across the various of evaluation met- rics and datasets. For the IID data, our method acquires a similar improvement on the robust accuracy without the deterioration of the natural accuracy. The reason might be that even the data is IID, adver- sarial training can still drive the independently-inittal & Li, 2020) on each client side towards at the robust overfitting of different directions, yielding the model heterogeneity. Thus, the proper slack to the maner-aaximiztion makes adversarial training more compatible with federated learning. Another interesting observation is that Federated Adversar- ial Training shows better performance than centralized adversarial training in the IID setting. This gain could be from the distributed training paradigm that helps adversarial training converge the more robust optimum by the dnvide-and con-uurueer mechanism. This might enlighten the more explore in adversarial training to improve the robustness via federated learning.
overparameterized network (Allen-Zhu
32

---

Published as a conference paper at ICLR 2023
Table 21: Performance on three benchmark datasets under different federated optimization methods (Non-IID & IID).
Setting
Non-IID
IID
CIFAR-10
Natural
FGSM
PGD-20
CW
AA
Natural
FGSM
PGD-20
CW
AA
Centralized AT
66.47%
47.68%
38.18%
37.04%
34.48%
FAT 57.45%
39.44%
32.58%
30.52%
29.20%
69.35 %
48.45%
37,43%
35.72%
33.96%
FedAvg
SEAT
63.44%
45.13%
37.17%
33.99% %
32.36 %
67.43%
50.33%
42.78%
37.91 %
36.20%
FAT 60.44%
41.59%
33.84%
31.29%
30.02%
66.91% %
46.70%
37. 14%
34.54%
32.68%
FedProx
SEAT
62.51
44.29% %
36.75%
33.82%
31,98% %
68,31
48.40
42.41
37.25
35.97%
Scaffold
FAT SEAT
62.81%
43.61%
34.
32.53%
30.95%
68.27%
25.2
39.33%
37.31 %
35.30%
64.12%
46.05 %
37.35 %
34.78%
33.32% %
71.36 %
50.42%
43.83%
39.12%
35.47%
CIFAR- 100
Natural
FGSM
PGD-20
CW m0
AA
Natural
FGSM
PGD-20
CW
AA
Centralized AT
35.81%
23.09%
18.64%
16.48%
15.42%
FedAvg
FAT SEAT
35. 19%
20.20%
15.60%
13.26%
12.22%
32.65%
20.44%
16.47%
14.10%
12.99%
36.18%
20.70%
16.40% %
13.55 %
12.42%
38.36
21.86%
17.10%
14.36% %
13.42%
FAT SEAT
32.36%
19.22%
15.37%
12.91%
12.05%
34.78%
20.71%
16.37%
14.28%
13.09%
FedProx
35.11% 1%
20.62 %
16.19%
13.47% %
12.63%
37.58 %
21.74%
17.03%
14.46 %
13.50%
FAT SEAT
39.96%
24.26%
19.41%
16.60%
15.37%
43.80%
26.25%
20.76%
18.39%
17.20%
Scaffold
44.08
16.79%
15.90%
44.36 %
28.65%
23.14%
20.11
18.39%
SVHN
Natural
FGSM
PGD-20
CW
AA
Natural
FGSM
PGD-20
CW
AA
Centralized AT
92.39%
89.75%
72.73%
72.31%
70.93%
FAT SEAT
91.24%
87.95%
68.87%
67.89%
66.54%
93.52% %
90.68%
72.24%
71.22%
70.08%
FedAvg
91.25%
88.28 %
71.72%
69.79% %
68.62 %
92,75%
90.06%
74.37%
72.34 %
71.27%
FedProx
FAT 90.92%
87.50%
68.44%
67. 18%
65, 94.9%
93.54%
90.66%
72.53%
71.42%
70.21%
SEAT
91.25%
88.15%
71.54% %
69.53%
68.47
93.59 %
90.80%
74.66
72.67 %
71.48%
Scaffold
FAT
89, 89.95%
87.23%
68.66 66.66
67. 23%
66 65%
93.80%
10.0%%
73.26%
72.05%
70.80%
SEAT
90.20%
87.81 %
71.39 %
68.81 %
67.88% %
93.92 %
91,28%
75.96 %
74.05 %
72.88 %
F FURTHER DISCUSSION
Adversarial robustness is an important topic in the centralized machine learning. The adversarial training are confirmed to be one of the most effective empirical defenses against the adversarial attack, which is critical especially for those safety-critical areas like medicine and finance. In federated settings, how to train an adversarially robust model is a challenging but practical task for the increasing concern about data privacy. In this work, observe and explore combat the intensified heterogeneity in federated adversarial training. Different from the conventional FAT adopted by previous works, we propose a new learning framework, i.e., SFAT, which relaxes the exacerbated heterogeneous effect and is compatible with the various adversarial training (Madry et al., 2018; Zhang et al., 2019) and federated optimization methods (Li et al., 2018; Karimireddy et al., 2020).
Although we take a step forward in FAT, it is not the end of this direction since there are still many problems be addressed to further enhance the practicality of federated adversarial training.
From the perspective of adversarial robustness, adversarial attacks can be very complex, especially in a decentralized environment, while the adversarial robustness discussed in this paper mainly focuses on common adversarial attacks (e.g., Loc bouunded attack) (Goodfellow et al., 2015). More practical situation which contains different kind of adversarial attack (e.g., mixed types of attack with 4oo bounded attack, Spatially transformed attack (Xiao et al., 2018)), even only considering the inference phase, may also happened since there are different clients may meet different threaten (Kairouz et al., 2019; Yao et al., 2022). Besides, the federated adversarial training that requires multiple local runs (Madry et al., 2018; Zhang et al., 2019) also introduces the extra computation to the low-cipyy devices, which is computational bottleneck and requires some lightweight techniques. Except for the empirical defense strategy focused by our work, the certifiable robustness (Cohen et al., 2019; Zizzo et al., 2021; Alfarra et al., 2022) which can give the theoretical guarantees is also important.
From the perspective of federated learning, our SEAT shares the similar spirit of the conventional federated adversarial training. The first part of challenges comes from the distributed learning
33

---

Published as a conference paper at ICLR 2023
paradigm (McMahan al., 2017; Kairouz et al., 2019; Li et al., 2020) of federated setting, which brings the hardware constraint that considers the computational capacity of local clients and commu- nication cost between clients and server (Hong et al., 2021). Once these conditions do not satisfy, both FAT' and SFAT would not work well. The second may from the algorithm design for some special training inference issues, like dealing with heterogeneous data (Li al., 2018: 8; Zhao et al., 2018), class-imbalance data or even some out-of-distribution data at inference time. On the other hand, the decentralized structure of the learning paradigm also introduces various issues on information transferring for server and clients. The current federated adversarial training still needs large improvement considering the practical cases that may happened in the federated setting. For the intensified heterogeneity, it can also be recognized as dynamical heterogeneous issue existing in federated learning, which may result from the special learning algorithm adapted in the distributed framework or other data manipulation scenarios. More robust issues, like robust distillation (Gold- blum et al., 2020; Zhu et al., 2022), train-test distribution shift (Jiang & Lin, 2023), cut-of-distributinn detection (Yu et al., 2023), under the federated framework can be further explored in the future.
34


Reviews:
[{"review_id": "T3fGmeHBEG", "reviewer": "Reviewer_JVxX", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper tries to fix the failure of the direct combination of federated learning (FL) and adversarial training, which is indicated by the deterioration of the adversarial accuracy at the later stage of FL. The authors proposed the so-called \"alpha-slack\" mechanism that upweights the clients with smaller (local) adversarial losses (and downweights the clients with larger losses) during aggregation in the cloud. The authors also show that the proposed mechanism asymptotically converges to the optimal solution of the modified adversarial objective. Extensive experiments are presented to show the effectiveness of the proposed method.", "summary_of_the_review": "This work is empirically solid but technically weak because of the clear disconnection of the proposed method and the adversarial setting AND the prior work (FedSoftBetter) which is very similar algorithmically.\n\n====\n\nUpdate: after reading the authors' responses to my review and their discussions with other reviewers, I found my concerns have been mostly addressed. Therefore, I raised my score from 5 to 6.", "strength_and_weaknesses": "Strength of this work is primally empirical. Firstly it seems to be the first empirical breakthrough in terms of combining FL and adversarial training, with plenty of supporting experiments showing the effectiveness of the proposed method. Secondly, it provides plenty of interesting and inviting observations in multiple dimensions, which I believe would be of interest for the community.\n\nHowever, the technical novelty issue is critical. And the core of the novelty issue is that the proposed method looks simply a modified aggregation method that has nothing related to the adversarial training objective. It perfectly applies to normal FL with only natural samples. Let me be more specific.\n\nFrom the perspective of the motivation, that is discussed in Sec 3.1, it is purely a conjecture/argument and there is neither qualitative analysis or quantitative evidence that actually supports the statement that the local adversarial optimization process indeed \"exacerbate\" the heterogeneity.\n\nFrom the perspective of the algorithm, as I said above, the proposed method simply upweights updates from clients that have smaller local (adversarial) objective. It does not matter if the local objectives are adversarial or not. And the final form of the algorithm is *very* similar to the **FedSoftBetter** aggregation method proposed in [1], which reweights updates from clients using a slightly different metric but also depends on the local objective magnitude. The existence of this prior work, in my opinion, significantly undermines the technical contribution of this work. However, I do recognize that [1] is quite new and is only a preprint work. I am not sure how it should influence the evaluation of this submission. I would love to invite comments from other reviewers and discussion from the authors on it.\n\nFrom the perspective of empirical results, the proposed method seems to be most beneficial in the natural cases in every experimental setting presented in the paper (in terms of final accuracy improvements). This observation further convinces my points above that the proposed method is not specific to adversarial training at all.\n\nLastly, which is more of a constructive comment instead of criticism, the authors only consider constant alpha in this work, which for sure changes the original global adversarial objective. A natural idea is to gradually decrease alpha during FL so that the objective would asymptotically get closer to the real objective. However, this is empirically contrary to the observation that FAT degrades at the later stage of training. So the investigation on this question is worthwhile and interesting.\n\n\nUPDATE: sorry that I forgot to attach the reference above.\n[1] Mansour, Adnan Ben, et al. \"Federated Learning Aggregation: New Robust Algorithms with Guarantees.\" arXiv preprint arXiv:2205.10864 (2022).", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}, {"review_id": "T-7ZVV9vl9", "reviewer": "Reviewer_CYPm", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 2, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper studies adversarial training under the federated learning framework. The current challenge in federated adversarial training (FAT) is that robust accuracy deteriorates in the later stage of training.  The authors believe this is due to the intensified heterogeneity caused by the inner maximization step in each client's local training step. To overcome this, the authors proposed $\\alpha$-slack mechanism. To my understanding, this mechanism reweights the parameter update by its adversarial loss. The clients with lower adversarial loss is upweighted by $1+\\alpha$. On the theoretical side, this paper shows the convergence property of the reweighted loss. Empirically, this paper provides extensive experiments and demonstrates the effectiveness of the proposed mechanism.", "summary_of_the_review": "This paper provides a simple and practical approach to mediate the robustness deterioration issue induced by intensified data heterogeneity.  I am not an expert on this topic so I could not evaluate the significance of the contribution. The effectiveness of the proposed method is thoroughly studied through experiments.", "strength_and_weaknesses": "Strengths: 1. The problem itself is interesting. This paper provides a simple and practical solution.\nWeaknesses: 1.  To my understanding, this convergence guarantee is a variation of the standard federated learning, e.g. (Li et al, 2019) with an $\\alpha$-slack variable. Theorem 3.2 and 3.3 are saying this algorithm is converging faster compared to FAT. This is not related to any claims about better robust accuracy or generalization, which is demonstrated through experiments.  It would be better to provide theoreical results showing better robust accuracy or provide empirical results showing faster convergence, which verifies the theoretical claim.\n\n\nQuestion:\n1. I am confused about the second figure in FIgure 5. It seems that the SFAT robust accuracy also decreases after 40 rounds. How is this figure different from Figure 1 (b)?\n\n2. I understand that SFAT could achieve better overall robust accuracy compared to FAT. But for those clients that have large adversarial loss. My intuition is that these clients are down-weighted and would have worse performance than FAT. Is this true? It would be better to provide some experiments that verifies generalization performance through clients.", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "4: All of the claims and statements are well-supported and correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}, {"review_id": "2-aP82gBhO", "reviewer": "Reviewer_YWt9", "summary": "", "questions": "", "limitations": "", "rating": 8, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper studies the adversarial robustness of federated learning, which is an important problem when training the model on the client side. Specially, the authors consider the incompatible dilemma between federated learning and adversarial training, and introduce a mediating slack mechanism to better bridge two paradigms. Both theoretical analysis and empirical study demonstrate the effectiveness of the proposed methods. ", "summary_of_the_review": "My main worry is not about the observation and the proposed method, but about the motivation description and analysis is lack of some sufficient justification. Please carefully consider above concerns and improve the submission, and I can consider to raise the score if they are well solved. ", "strength_and_weaknesses": "In a nutshell, the authors investigate an interesting problem motivated by the degeneration observation, and the proposed method is solid with sufficient evidences. However, there are still some concerns regarding the submission as follows,\n(1)\tAlthough the combination of two paradigms lead to the degeneration in performance, the reason that induces this phenomenon needs to be carefully discussed, since all toy studies even including the analysis on real-world dataset are from the perspective of the observation, which cannot attribute to the real cause. For example, it is not absolute in Figure 2 where the generated adversarial examples move in the clockwise direction, instead of the converse direction. I advise the authors should properly express the conjecture in the motivation part.\n(2)\tEquation (1) introduces a lower bound to the original objective, which is different from the general way that constructs an upper bound to minimize. Therefore, it is not necessary that minimizing a lower bound can lead to the minimization of the original objective. The authors should discuss more here and give some empirical validation if it is possible. \n(3)\tThe background part gives some basics of federated learning and adversarial training, while the review of current works is insufficient. I advise the reviewer should follow the conventional style and separate this part into related work and preliminary, respectively for literature review and basics.\n(4)\tIn tables 1-4, the natural accuracy and the robustness performance in the centralized counterpart can be validated as references, and the gap in comparison to the achieved performance in federated learning framework should be reviewed so that the readers can deeply understand the limitation in this topic.\n(5)\tAgain, I think the explanation about the problem in the combination of federated learning and adversarial training should be improved. Possibly, if the authors can find some supporting examples from the experiments as the visualization or some statistical analysis can make the claim more convincing. I advise the reviewers to trace the classification difference between the baseline and the SFAT-enhanced counterpart and analyze the common characteristics of these non-overlapping examples. \n(6)\tThe discussion about the systematic challenges in federated adversarial training is limited, yielding that it is hard to evaluate the value of this narrow direction. More analysis about the practical requirement in the real-world applications should be given both in the introduction and related work as well as the confusion remark.\n", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "4: All of the claims and statements are well-supported and correct.", "technical_novelty_and_significance": "4: The contributions are significant, and do not exist in prior works.", "empirical_novelty_and_significance": "Not applicable"}, "extra_text": {}}]

Author rebuttal:

Decision: Accept: poster