Linear Scalarization for Byzantine-Robust Learning on non-IID data
Authors: Latifa Errami
El houcine Bergou
Venue: Submitted to ICLR 2023 (2023)
Keywords: Byzantine SGD
Distributed Deep Learning
Non-IID

Abstract: In this work we study the problem of Byzantine-robust learning when data among clients is heterogeneous. We focus on poisoning attacks targeting the convergence of SGD. Although this problem has received great attention; the main Byzantine defenses rely on the IID assumption causing them to fail when data distribution is non-IID even with no attack.
We propose the use of Linear Scalarization (LS) as an enhancing method to enable current defenses to circumvent Byzantine attacks in the non-IID setting. The LS method is based on the incorporation of a trade-off vector that penalizes the suspected malicious clients.
Empirical analysis corroborates that the proposed LS variants are viable in the IID setting. For mild to strong non-IID data splits, LS is either comparable or outperforming current approaches under state-of-the-art Byzantine attack scenarios.


Under review as a conference paper at ICLR 2023
LINEAR SCALARIZATION FOR BYZANTINE-ROBUST LEARNING ON NON- DATA
Anonymous authors Paper under double-blind review
ABSTRACT
In this work we study the problem of Byzantine-robust learning when data among clients is heterogeneous. We focus on poisoning attacks targeting the convergence of SGD. Although this problem has received great attention; the main Byzantine defenses rely on the IID assumption causing them to fail when data distribution is non-IID even with no attack. We propose the use of Linear Scalarization (LS) as an enhancing method to enable current defenses to circumvent Byzantine attacks in the non-III setting. The L$ method based on the incorporation of a trade-off vector that penalizes the suspected malicious clients. Empirical analysis corrobo- rates that the proposed LS variants are viable in the IID setting. For mild to strong non-III data splits, LS is either comparable or outperforming current approaches under state-of-the Byzantine attack scenarios.
INTRODUCTION
Most real-world applications using learning algorithms are moving towards distributed computa- tion either: (i) Due to some applications being inherently distributed, Federated Learning (FL. for instance, (ii) or speed up computation and benefit from hardware parallelization. We especially resort to distributing Stochastic Gradient Descent (SGD) to alleviate the heavy computation underly- ing gradient updates during the training phase. Especially with the high dimensionality of large-scale deep learning models and the exponential growth in user-generated data.
However, distributing computation comes at the cost of introducing challenges related to consensus and fault tolerance. In other words, the nodes composing the distributed system need to reach consensus regarding the gradient update. the honest setting this can be done simply by a parameter server that takes in charge the aggregation of computation from the workers. However, machines are prone to hardware failure (crush/stop) or arbitrary behavior due to bugs or malicious users. The latter is more concerning machines may collude and lead to convergence ineffective models.
Since deep learning pipelines are involved in decision making at a critical level (e.g., computer-aided diagnosis, airport security.... it is crucial to ensure their robustness. We study robustness in the sense of granting resilience against malicious adversaries. More precisely, poisoning attacks that target the convergence of SGD. The adversarial model follows the Byzantine abstraction Lamport jet al. (1982). The basis distributed Byzantine attacks is the disruption of SGD's convergence by tampering with the direction of the descent or magnitude of the updates. The robustness problem is highly examined and there exists a plethora of aggregations [Blanchard et al. (2017); Alistarh et al. (2018) Yin et al. (2018); Damaskinos et al. (2018); Boussetta et al. (2021) [E] Mhamdı al. (2018). Nonetheless, recent works Karimireddy et al. (2022 2021) highlight the inability of these algorithms learn on non-IlI data. Indeed, defending against the Byzantine in a heterogeneous setting is not trivial. Naturally, aggregations rely on the similarity between honest workers to defend against the Byzantine. However, as data becomes unbalanced distinguishing malicious workers from honest ones becomes increasingly challenging: an honest worker may slightly deviate from its peers due to skewed data distribution.
Another weakness of current work is that most aggregation discard subset of information either by dropping full gradient vectors or by eliminating a set of coordinates along each dimension of the submitted vectors. Nevertheless, dropping users' updates leads to (i) Degradation of the model's final accuracy, especially when no Byzantine attackers are present. (ii) It may also discard minorities with vastly diverging views as elaborated in Mhamdi al. (202)).

---

Under review as a conference paper at ICLR 2023
Motivated by the latter and the scarcity of work Byzantine Non-IID defenses, we study the Byzantine resilience SGD on non-lID data. These two problems: (1) learning on non-lID data and (2) defending against Byzantine attacks similar in the sense that in both cases the central server in charge of aggregating clients' updates is faced with conflicting information. In the Byzantine case the conflict stems from the discrepancy between the updates submitted by the malicious users and honest ones. Whereas, in the non-lID case it is result of the difference in the data distribution between the users. In realistic set up such as F the central server is faced with both challenges.
From an optimization perspective, the goal is to find the parameters of a model that simultaneously minimizes the loss associated with the local data of each client f.. More precisely, the objectives in these cases maybe conflicting.
This type of optimization problem falls under multi-objective and can be formally expressed as follows:
min (0), fa.)).......(
BERd
Multi- Multi-OObeective problems can be solved as mono-objective through linear scalarization. This so- lution simply consists in introducing a preference vector that defines a trade-off between the n- conflicting objectives. Thereafter, proceed to optimize the weighted sum of the objectives as one.
min BER
f(0) def
Σ EA10
The vector referred as the preference trade-off vector and is typically chosen such that E X; = 1 and A; > 0.
Our insight treat the Byzantine-robuss learning problem as multi-objective, then deploy linear scalarization to solve it. That is, the trade-off vector can be leveraged to balance users' updates by penalizing the suspected Byzantine ones without dropping any user's contribution. Additionally, this scheme addresses the trade-off between granting Byzantine resilience and inclusion as no client update is fully discarded.
Our contribution can be summarized as follows:
We propose RAGG-LS, a linear scalarization based aggregation that leverages existing defenses to define a trade-off vector the n-confiictng objectives in order to grant Byzantine resilience in the non-lID setting. Moreover, the fact that the trade-off vector is defined through robust aggregations balances updates according the level of trust in the corresponding client.
We evaluate our scheme against state of the art Byzantine attacks. We compare our ap- proach to that of bucketing introduced in Karimireddy et al. (2022) well the standard IID defenses.
1.1 NOTATIONS AND SET UP
Notations. In the following R.GGG()): Denotes given Robust Aggregation Rule. fr: The objective corresponds to users gradient vectors. Gr, Go Respectively denote the sets gradient vectors associated with the set of trusted workers and workers suspected to be Byzantine. X: the preference trade-off vector. the total number of clients, among which a subset b behaves maliciously. 8: The proportion of Byzantine clients, dmaz < 2 D, = [(x,, | the subset of data of worker i. Cr, denotes a robust metric computed based on the gradient update of user i.
function associated with the i-th worker. G = (91,92 .2......hhh 9n.::
Set Up. We consider the standard Parameter Server (PS) architecture, comprised of central server in charge of the exchange between the n nodes. The (PS) architecture assumes that the server is trusted and proportion d of the nodes behave arbitrarily or maliciously. The arbitrary behavior is modelled following the Byzantine abstraction introduced in Lamport et al. (1982). The Byzantine workers maybe omniscient (i.e., they have access to the whole dataset and are able access other clients' updates). We assume data distribution among clients to be non-IID, We are interested in studying the Byzantine Resilience of Distributed Synchronous SGD.
2

---

Under review as a conference paper at ICLR 2023
1.2 OUTLINE
We structure the paper follows: In section present an overview of key relevant literature. We then introduce a formulation of our approach in section 3. The final two sections respectively present the experimental evaluation and concluding remarks.
2 RELATED WORK
In this section relevant work is highlighted. We first present some of the renowned aggregation rules in the IID then in the non-lID setting. Followed by Byzantine attacks on SGD. Finally, present some of the works that deploy linear scalarization to balance trade-offs between the objectives.
ID Defenses: Krum Blanchard al. (017) is aggregation that filters the gradient submissions based on a trust score defined as follows: s(i) = ΣjeN; dist(g: 9;)² where N; denotes the set of
n b b- 2 closest vectors of i. The aggregation selects the gradient vector of the user i minimizing the score (i). The authors also introduce a variant namely m-Krum that returns an average of the m vectors with the smallest scores. The Median Yin et al. (2018) consists in applying the median along each coordinate of the d-dimensional gradient vectors. Trimmed-mean Yin et al.] (2018) averages the vectors submissions after discarding a proportion of the highest and smallest values. MeaMed operates by computing the mean around the median of vector updates. Bulyan EI Mhamdi et al. (2018) is a meta gradient aggregation rule that grants strong Byzantine resilience (defends against adversaries exploiting the high dimensionality of the model). It is used as an enhancing method on top of a weak Byzantine aggregation. Bulyan operates in two steps: First, it uses the initial aggregation to get a set of trusted users. Then, it uses a variant of the trimmed-mean to aggregate the trusted set. Aksel Bousseeta et al. (2021) combines the median and norm filtering to construct a robust interval that is used to filter the gradient vectors. The output of the filtering step gradient
is then averaged. Alistarh et al. (2018) uses MeaMed (the mean around the meadian) aggregation rule (GAR) alongside an iterative scheme that allows the detection of Byzantine workers based their submissions (meeting
upper bound on the error introduced on the submission in different rounds leads to the elimination of the node's contribution in subsequent steps). The work of Guerraoui (202T) offers standard implementation of state of the art aggregations in (PS) architecture under two of the powerful attacks against SGD Xie et al. (2019): |aruchh et al. (2019) and show that introducing Nesterov's momentum at the workers improves the defenses' resilience. Similarly, Karimireddy et al. (202T) illustrate the role of momentum in strengthening the aggregations capacity of withstanding Byzantine attacks in the non-IlI) setting.
Non-IID Defenses: Li et al. (2018) propose a new aggregation RSA that uses an 1 regularization term to penalize the deference between local iterates and server iterate. This approach however is unable to defend against state of the art Byzantine attacks (Baruch et al. (2019); Xie et al. (2019). The work in Karimireddy et al.] (202T) highlights the weakness of standard Byzantine defenses in the non-lID setting and proposes Centered Clipping (CClip) method and the use of momentum to defend against time coupled attacks. Karimireddy et al. (2022) proposes a bucketing technique that reduces inter-client variance by averaging clients updates within buckets. This approach is simple and can be combined with existing defenses as a prepossessing step.
Byzantine Attacks:
The Byzantine abstraction (Lamport et al. (1982) encloses attacks ranging from random outputs, noisy submissions, sign flipping to carefully crafted updates targeting specific algorithms. In this focus on malicious attacks that disrupt the convergence of SGD. A little is enough ALIE (Baruch et al. (001)) is non-omniscient attack wherein the adversaries estimate the mean a and standard deviation of the good gradients, and send μ 20 to the server where is a small constant controlling the strength of the attack. IPM (Xie et al. (209)) or Attack by Inner Product Manipulation is an omniscient attack (i.e., Byzantine workers are assumed to have access to the dataset). The attackers averages the gradients computed using the full dataset Aug(G) then sends (G) where e controls the strength of the attack. Bit Flip (Sign Flip) is a simple attack internal failure
that models hardware failures in clients. A given Byzantine client experiences and starts outputting faulty values in this case inverting the sign of the update. Mimic (Karimireddy let al. (2022)) is an attack that is designed to take advantage of the non-IID setting. The malicious workers pick an honest worker i' and mimic its output. This attack is powerful as it emphasises the heterogeneity by over-representing a worker i" with least significant update.
3

---

Under review as a conference paper at ICLR 2023
Linear Scalarization: is technique used in Multi-Objective Optimization (MOO) to balance flicting objectives. The formulation of leaning algorithms as muulti-ojeective problems is indeed a more natural way of addressing them. In (Sener & Koltun (2018)) Multi-Task Learning (MTL) is modelled as a multi-objective problem, Lin et al. (2019) propose an efficient method, Pareto MTL, solve Multi-Task Learning as MOO. Mohri al. (2019) propose reformulation of Federated Learning namely: Agnostic Federated Learning (APL) L) to instate faimess among users through the optimization of the weighted sum of the users' objectives for the worst trade-off vector. However, we are not aware of any work addressing the Byzantine Learning problem as MOO. There is how- ever line of work that deploys weights or trust scores to penalize the Byzantine (Peng et al. (2020); Regatti & Gupta (2020); Fu et al. (2019); Li et al. (2018)) However, for the above-mentioned works lambda is generally used for regularization and not as trade-off vector i.e., the problem is not solved as LS of conflicting objectives. Also, defining the trade-off is crucial part in balancing
the objectives. However, in the aforementioned works lambda is chosen arbitrarily or at best is not carefully tailored to each client in way that would penalize the Byzantine.
ALGORITHM
3.1
STUDIED ROBUST AGGREGATIONS
Given a Robust Aggregation rule RAGG(.), the Byzantine defense generally operates as follows: Apply criterion (historical data, robust statisties, distance measure ...) filter users into two subsets. Thereafter proceed to aggregate the gradients of trusted users Gr. More precisely (i) Use some trust score or robust statistic CR, to split users into two subsets honest G, and suspected malicious Go. (ii) Return the aggregation of Gr
The proposed framework serves as an enhancements to existing robust defenses. We cover three aggregations namely: m-Krum, Aksel and the coordinate-wiss median (CM), First, we explicitly define the procedure followed by each of these aggregations.
m-Krum Blanchard et al. (2017): For each user i Krum computes a score s; for user i based on 2 users to
the Euclidean distance of 9; to 9j such that j E M, which denotes the closest sii Σ llg. gj 112,, then it selects the user with the smallest score, i.e.
Krum(gi 92, 9n) arg min s(i).
The m-Krum variant picks m users with the smallest scores then outputs their average.
CM Yin al. 2018): The CM, uses the one-dimensional median across each dimension to filter out outliers. For E Rd, CM( = gMs, where gM is a vector with its k-th coordinate being gM [k] Median {ge [k] E [m]] for ls E [d].
Aksel Boussetta et al. 2021) combines CM and norm filtering to select subset of trusted gradients G. The aggregation thereafter is the average of selected gradient vectors.
Aksel(g) 1 |dd
gk-
|g
1=1
Where IMs CM) S (s(1) Σz (g. [k]
IM [k]) : [n]] r Median(S) and I the
robust interval I r0, and G. {g.l 19: gMll 2| I}.
3.2 BYZANTINE LS APPROACH
Let CR, denotes criterion that measures the honesty of client i. This is generally vote/score (c.g., squared sum Euclidean distance Blanchard et al. (2017) or the distance to some robust statistic). Naturally, the goal is to pick the gradient updates associated with the users having the smallest Cn.- Following that, the main idea behind T.S is, rather than discarding the suspected users that stray from Cn, each user is penalized according to the degree of derail. As such, we associate with each user i a scalar X; namely a trade-off that defined such that X R I In the following On,
summarize the main LS steps
4

---

Under review as a conference paper at ICLR 2023
1. Use R.GG(.) to split users into two subsets honest 91 and suspected malicious Go-
2. Deploy the selection criterion to define the trade-off vector A.
3. Return the weighted sum all users gradients RAGG-LS- Aegi-
LS Leverages the standard aggregations to separate the gradients into honest and suspected Byzan- tine. Then, utilizes the filtering metric to define trade-off vector such that the more suspected user is to be Byzantine, the smaller its weight is. That is, our approach keeps all users' gradient vectors and the A serves penalty: such, for in the subset of discarded gradients, the penalty associated with the re-introduction of gi is computed as follows X; 06 Cb In this case as defines the trade-off between inclusion and robustness and quantifies the confidence in the Cn.-
Σ
CR.
Cr.
IEG:
Thereafter, LS can be considered as generalization the standard RAGG(()), that pick X; = for the suspected Byzantine and associates uniform weights with the honest clients. Additionally, this formulation alleviates the Robustness/Inclusion trade-off. Algorithm ggives the pseudo code of our approach.
Algorithm RAGG-LS
Input G, two hyper parameters o4 0 and og
Compute CR, based on the chosen RAGG
Split & into Gr (honest clients) and Go (suspected malicous clients) based on the chosen RAGG, for D: E G. do A;- ae
CR.
end for for Di E Go. do A; OR,
end for Normalise A
Return RAGGLS(S) E!' Xggi
EMPIRICAL EVALUATION
In this section evaluate the introduced LS approaches non-lID data when a proportion of the clients is Byzantine. We first give a detailed description of the experimental set up, namely: The used data sets and the techniques deployed partition the data between client in non-III) fashion. Followed by the models' architectures alongside all the relevant the threat model and the studied defenses. Finally, present Top-1 Accuracy as an evaluation metric.
We also define
4.1 DESCRIPTION
Data Splits: We study the following datasets namely: MNIST LeCun al. (1998). FMNIST Xiao et al. (2017). SVHN Netzer et (201T) and CIFAR 10 Krizhevsky & Hinton 2009). We experiment with III and non-lll data splits. The later is generated by creating label unbalances between clients.
A commonly used non-IlI partition method, Latent Dirichlet Sampling. This split approach uses the Dirichlet distribution Dir(3), such that each party gets assigned a proportion samples of given label. We consider 3 a hyper-parameter that allows to introduce varying levels of skewness (the smaller the 3 the more skewed the resulting split). Following existing works Li et al. (2022);
Tang et al. (2022), each dataset is partitioned with two different non-III degrees using B 0.1 for
mild non IID and 3 = 0.01 for high IDD splits.
Moreover, to verify the impact of LS, conduct experiments using another type of non-IID par- tition: Ca-classes partition, it is common to use K = a split referred to as pathological non-III McMahan et al. (2016), however set K 3 iee. each client only has access labels from classes
Learning Model:
5

---

Under review as a conference paper at ICLR 2023
Model:
CNN N with two convolutional layers, Max- and Fully-connected layer of 1k units for MNIST and FMNIST, LeN LeCun et al. (1998) for SVHN and VGG11
Simonyan & Zisserman
(214)) for CIFARIO.
Loss function: Cross Entropy Loss.
Optimizer: SGD with momentum = 0.9 at the workers, a fixed learning rate 0.01 and a batch size of 128.
Threat Model:
We experiment with two values of Byzantine ó = 20% and 5 = 40% i.e., out of 25 users respectively 5 or 10 users byzantine. The deployed attacks indicated bellow:
ALIE (Baruch et al. 2019): Following the original paper we use 0.25 computed using
the formula from the original paper, this also the value used in Karimireddy al. (2022).
IPM (Xie et al., 2019): ; We use 0.1 following Karimireddy et al. (2022).
BF: A Byzantine worker sends - Vi instead of V.fi due to hardware failures etc.
Mimic: The goal of the mimic attack as introduced Karimireddy et al. (2022) is the over-representation of a user i" with the least significant gradient update, method to pick i" introduced, we however implement mimic in simpler way. We utilize the entropy of users unbalanced data to get insight on the quality of each users update. Thereafter, Mimic picks the client such that,
arg min Entropy(Di).
We explore the Byzamtine resilience of standard defenses and compare them to their non-lID variants based on Baucketing and LS.
Defenses:
IID defenses namely, CM, mKrum and Aksel.
Bucketing (s 2) CM-buck, mKrum-buck and Aksel-buck.
Linear scalarization variants: We denote the LS variants of the previous methods as follows: CMLSØ LS variant of coordinate wise median, mKLS mKrum LS variant and ALS for Aksel LS variant. We set the hyper parameters such we keep the trade-off associated with honest workers as computed and we further penalize the suspected Byzantine by multiplying their X; by small constant.
= 1 and = g as
4.2 EXPERIMENTAL RESULTS
In this section we present the experimental results. In their work, Karimireddy et al. (002) demon- strate the effectiveness of their approach the MNIST dataset for given non-IlD split under fixed number of Byzantine namely 20%. In the following we test the bucketing scheme alongside
the introduced L.S variants and the defenses they improve under Byzantine attacks (i) On varying
degrees of non-lID to the data (ii) on multiple datasets namely: MNIST, CIFARIO and SVHN. Additional experiments both MNIST and FMNIST be found the Appendix fig 9 fig 10 fig
We report Top- Test Accuracy averaged over runs for each GAR for MNIST, runs for SVHN and 2 runs for CIFARIO, under no attack (NA), ALIE, IPM, BF and Mimic for the IID data split and 2 different non-IID scenarios based on label unbalance between the users.
Our initial results suggest that our approach is viable in the IID case and achieves results comparable to state of the art defenses under different Byzantine attacks fig. |
In the mild non-IID case i.e., Data Dir(8 0.1) and Data C3 well as bucketing help the standard aggregations perform better in the non-III Byzantine setting. Also in the mild non-III setting our approaches are either comparable to bucketing or outperform it when the proportion of Byzantine å 20% fig 2 However, when the proportion of byzantine is doubled i.e., 40% our variants are outperforming all the other aggregations including their corresponding bucketing variants fig/4]
approach as
Finally, in the strongly non-lID case Dir(5 = 0.01) the LS based methods are the only ones capable of learning heterogeneous data in the presence of Byzantine clients. fig

---

Under review as a conference paper at ICLR 2023
NA NID
ALIE IID
100
mXLS
mKL5
80
mkkrum
Accuracy
60
ALS
mkrum_ buck
Accuracy
60-
ALS
mKrum_ buck
CMLSS
CMLS
CM
CM
buck
20
Aksel
20
Aksel
Aksel buck
Aksel buck
100
200
300
400
500
600
100
200
300
400
500
600
Iterations
Iterations
IPM
BF IID
100
100
mKLS
mKLS
80
mKkrum
Accursty
60
ALS
mKKum_ buck
60
ALS
mKKrum buck
CMLS
CM
CM
CM buck
CM buck
20
Alesal
20-
Akcsel
Aksel buck
Aksel buck
100
200
300
400
500
600
100
200
300
400
són
600
terations
lterations
Figure I: MNIIST oop 1 Test Accuracy for all GARS IID data split under the following attacks NA: No Attack, ALIE: A Little Is Enough, IPM: Inner Product Manipulation and BF Bit Flip attack
1.0
Vimic Nen-l1 ID g 01
100
Vimic hon e 0.1
3.00
Vimic Ken ID g 0.1
CNL Beckk
monn ricoun back
back
ALIT Non-1D
300
Non-Ei 0.1
ALB Non-1D
2
Accusc
8
CM bark
Akail buck
rxtrnn Back
330
130
530
8
90
90
1.00
300
500
530
160
1.0
250
300
600
530
100
1.00
205
300
000
530
100
KonilD
a
a
CM15
Jacc
HELLS
1.33
202
11c
200
121
100
1.33
302
110
0.00
400
1.30
300
11c
400
101
400
Figure 2: MNIST Top- Test Accuracy for All GARs on Non-IID data Dir(B 0.1) (We sider this mild non-IlI split, all users have access to varying proportions of the dataset labels). Each plot compares standard RAGG its bucketing variant and its LS variant. Each row corresponds to given Byzantine attack, from the left respectively we have: Mimic: mimic Attack, ALIE; A Little Enough, IPM: Inner Product Manipulation and BF Bit Flip attack

---

Under review as a conference paper at ICLR 2023
Minic Non-ID d 0.53
AUE Nonii g 0.61
IPN NNe-l 5 0.01
CMIS
CHLS
CNLL
Jaice
306
322
800
120
240
306
400
660
366
400
522
600
1.00
Mimmi Nom--111 g D.1
100
ALE Now-iD - 0.01
1.0
IPM [Nee-D &
2.05
Aisi: bruck
8
10
20
back
Minic Nan-112 0.01
200
ALE Non-10 0.01
IP9 (oon-1
20
20-
15 Back
1o0ur back
Figure 3: MNIST Top Test Accuracy for All GARs on Non-IID data ~ Dir(3 = 0.01) (We consider this High non-IID split, all users have access varying proportions of the dataset labels). Each plot compares standard RAGG to its bucketing variant and its LS variant. Each column corresponds to a given Byzantine attack, from the left respectively we have: Mimic: mimic Attack, ALIE: A Little Is Enough, IPM: Inner Product Manipulation
NamicNan..o
1.00
Mimichoniip
100
Mimic
00
back
CMLS
60
HRLS
8
1.0
200
300
400
330
100
100
230
350
400
3.00
530
-.5
200
200
402
300
600
Figure 4: MNIST Top Test Accuracy for All GARs Non-III C3 under 8 40% Byzantine clients. Each plot compares a standard RAGG to its bucketing variant and its LS variant under Mimic and ALIE attack
SVHN
SYHN Non ID
SYHN
CML5
50
60
20
1300
2006
3036
3030
5500
10000
2000
3030
2000
5000
13000
2006
3010
4000
5500
Figure 5: SVHN Top Test Accuracy for All GARs on Non-IIID C3 under 5 = 20% Byzantine clients. Each plot compares a standard RAGG to its bucketing variant and its L. variant under Mimic attack
8

---

Under review as a conference paper at ICLR 2023
CITARLO Mimic
CHAAR1O Min
CITARIO Minic
20
CMIS
20
CM
retrury hune
CM Juck
Accuncy
M M
20
20-
Ecssters
Ecastern
CIFARL1O IIP!
CIFAR10 IPP!
60-
CIFARLED 119!
60
50-
Ares)
ritrum bucc
CN buct
Aosel buck
30
Issstbra
Iasstbra
Figure 6: CIFARIO Top- 1 Test Accuracy for All GARs on Non-IID C33 under = 20% Byzantine clients. Each plot compares standard RAGG to its bucketing variant and its L. variant under Mimic and IPMattack
Although bucketing does improve the standard aggregations in some scenarios mainly mild non-IlI) under 20% Byzantine, however as data distribution gets highly unbalanced fig or the proportion of Byzantine augments fig it is longer efficient in alleviating the impact of heterogeneity on the performance of the aggregations.
On CIFARIO fig and SVHN fig the LS variants outperform all the other aggregations under 20% Byzantine attackers (Mimic attack). On the MNIST dataset, our approaches are either comparable bucketing or outperform them on the mild non-llD case under 20% Byzantine. However, when the number of Byzantine is doubled or non-III degree is high our variants are the only ones that achieve reasonable accuracy under Byzantine attacks.
CONCLUSION
In this work we explore the problem of learning on heterogeneous data in the presence of Byzantine clients. We propose a Linear Scalarization approach that takes advantage of the existing Byzan- tine defenses to define trade-off between the client's objectives. This formulation allows to bal- ance users' contribution in way that the honest workers' gradient vectors are of great importance and those of suspected workers have a small contribution. Our approach grants Byzantine robust- ness while allowing outliers' contributions. Thereafter alleviating the Inclusion/Robustees trade-off posed by standard aggregations.
generalization of the standard R.GG(.), that pick X; = 0 for all suspected malicious clients. Thus, the theoretical guarantees of these methods extend to the particular setting of methods especially for IID data. However in non-IID setting, our work still lacks the theoretical side, this is left for future work. Another limitation of our work is the reliance on standard aggregation compute the trade-off vector. Although the rationale is to make sure the trade-oft off is based Byzantine-robus trust score metric, it however is tied to the computational complexity of the deployed aggregation that in cases like m-Krum is O(n²d) where is the dimensionality of the model. Thus, it would be interesting to investigate more efficient ways of defining suitable trade-offs between the clients.
Our LS methods
Additional future improvements may address the tuning of the hyper- peree-parameters and and the communication efficiency as it is one the challenges in FL.

---

Under review as a conference paper at ICLR 2023
REFERENCES
Dan Alistarh, Zeyuan Allen-Zhu, and Jerry Li. Byzantine stochastic gradient descent. CoRR, 0bs//803.08911 2018. URLphttp://arxiq httpp/pppp//...il.ooo//oaoaaa//s attp//bbs11130 1.tp 08917
Moran Baruch, Gilad Baruch, and Yoav Goldberg. A little is enough: Circumventing defenses for distributed learning. CoRR, abs/1902.06156, 2019. URL
06156
Peva Blanchard, Mahdi El Mhamdi, Rachid Guerraoui, and Julien Stainer, Machine learning with adversaries: Byzantine tolerant gradient descent. Advances in Neural Information Processing Systems, 2017- Do07-Decem(Nips):111 19-129, 2017. ISSN 10495258.
Amine Boussetta, EI Mahdi El-Mhamdi, Rachid Guerraoui, Alexandre Maurer, and Sébastien Rouault. AKSEL: Fast Byzantine SGD. Leibniz International Proceedings in Informatics, LIPlcs, 184(8):1-8, 2021. ISSN 18688969. doi: (0.4230LLPPls..PODDS5 2020.8.
Georgios Damaskinos, El Mahdi El Mhamdi, Rachid Guerraoui, Rhicheek Patra, and Mahsa Taziki. Asynchronous byzantine machine learning (the case of sgd). 35th International Conference on Machine Learning. ICML 2018, 3:1 3:1829-18558 2018.
El Mahdi El Mhamdi, Rachid Guerraoui, and Sebastien Rouault. The hidden vulnerability of dis- tributed learning in byzantium. 35th International Conference on Machine Learning. ICML 2018, 8:5674-5686, 2018.
Shuhao Fu, Chulin Xie, Bo Li, and Qifeng Chen. Attack-resistant federated learning with residual- based reweighting. CoRR, abs/1912.1 1464, 2019. URL http:::://axxi..og/////aa///////
11464
Rachid Guerraoui. Distributed Momentum for Byzantine- resilient Stochastic Gradient Descent. International Conference Learning Representations, pp. 1-37, 2021.
Sai Praneeth Karimireddy, Lie He, and Martin Jaggi. Learning from history for byzantine robust optimization. In Marina Meila and Tong Zhang (eds.), Proceedings of the 38th International Conference on Machine Learning, volume 139 of Proceedings of Machine Learning Research, pp. 5311-5319. PMLR, 18 24 Jul 2021. URL httpt:ttt///ttceeeeeeeeeeeeeeeee ngs. mlr. press/v139/ karimireddy21a. html.
Sai Praneeth Karimireddy, Lie He, and Martin Jaggi. Byzantine-robust learning heterogeneous datasets via bucketing. In International Conference on Learning Representations, 2022. URL
https::/openreviiee nnt/ http://wwwwweeeeeeeeeeeee.ee forum?id= jXKKDEisvot
Alex Krizhevsky and Geoffrey Hinton. Learning multiple layers of features from tiny images. Tech- nical Report 0, University of Toronto, Toronto, Ontario, 2009.
Leslie Lamport, Robert Shostak, and Marshall Pease. The byzantine generals problem. ACM Trans. Program. Lang. Syst. 4(3):382 401, jul 1982 ISSN 0164-0925. doi: 10.1145/357172.357776 URL http::///o....oo00...111///////3 114533177111111111.. 357176
org
Yann LeCun, Léon Bottou, Yoshua Bengio, and Patrick Haffner. Gradient-based learning applied to document recognition. Proceedings of the IEEE, 86(11):2278-2)) 1998. 726791.
doi:
Liping Li, Wei Xu, Tianyi Chen, Georgios B. Giannakis, and Qing Ling. RSA: byzantine-robust stochastic aggregation methods for distributed learning from heterogeneous datasets. CoRR, abs/1811.03761, 2018. URL wwwia. aws//aa..... habb//111.0076111111111111111111
Qinbin Li. Yiqun Diao, Quan Chen, and Bingsheng He. Federated learning on non-iid data silos: An experimental study. In IEEE International Conference on Data Engineering, 2022.
Xi Lin, Hui-Ling Zhen, Zhenhua Li, Qingfu Zhang, and Sam Kwong. Pareto multi-task learning. CoRR, abs/1912, 12854, 2019. URL C wawiiaiiivv.. http:///wwwwwwwoo/////////////// 12854
10

---

Under review as a conference paper at ICLR 2023
H. Brendan McMahan, Eider Moore, Daniel Ramage, and Blaise Agüera y Arcas. Federated learning of deep networks using model averaging. CoRR, abs/1602.05629, 2016. URL httttt//aaaxxi
org/abs/ 162.. 05629
El Mahdi EI Mhamdi, Sadegh Farhadkhani, Rachid Guerraoui, Arsany Guirguis, Lē-Nguyên Hoang, and Sébastien Rouault. Collaborative learning in the jungle (decentralized, byzantine, heteroge- neous, asynchronous and nonconvex learning). In A. Beygelzimer, Y. Dauphin, P. Liang, and J. Wortman Vaughan (eds.), Advances in Neural Information Processing Systems, 2021. URL
htttps://openreviii
net wwwp:/nrttooommeemmmm fowumrrruooooooooo
lavs 4WF
Mehryar Mohri, Gary Sivek, and Ananda Theertha Suresh. Agnostic federated learning. CoRR, abs/1902.00146,, 2019. URL http:://axxii
abs 1902. 1902.00146
00146
Yuval Netzer, Tao Wang, Adam Coates, Alessandro Bissacco, Bo Wu, and Andrew Y. Ng. Reading digits in natural images with unsupervised feature learning. In NIPS Workshop on Deep Learning and Unsupervised Feature Learning 2011, 2011. URL http://uflcl. stanford.edu/
housenumbers/nnm /nips2011ppp11111111 housenumbers. pdf
Jie Peng, Weiyu Li, and Qing Ling. Byzantine-robust decentralized stochastic optimization over static and time-varying networks, 2020. URL httpp//////3311..rr////////0/ 06276
Jayanth Regatti and Abhishek Gupta. Befrieending the byzantinnes through reputation abs/2006. 13421, 2020.
repputatooon scores. CoRR,
Ozan Sener and Vladlen Koltun. Multi-task learning multi-objective optimization. CoRR, abs/1810.04650, 2018.
hacpgg/abs/ll111 04650
Karen Simonyan and Andrew Zisserman. Very deep convolutional networks for large-scale image recognition, 2014. htt.sttts:: //tp:///aavv.//aa /rg/abb//s....... 449. 1556
Zhenheng Tang, Yonggang Zhang, Shaohuai Shi, Xin He, Bo Han, and Xiaowen Chu. Virtual homogeneity learning: Defending against data heterogeneity in federated learning. In Kama- lika Chaudhuri, Stefanie Jegelka, Le Song, Csaba Szepesvari, Gang Niu, and Sivan Sabato (eds.), Proceedings of the 39th International Conference Machine Learning, volume 162 of Proceedings of Machine Learning Research, pp. mlr wwtp:ppeeeeeeeaeeeeeeeeee
PMLR, 17-23 Jul 2022. URL
bttps::/proceete
html
Han Xiao, Kashif Rasul, and Roland Vollgraf. Mishhonnmmisse a novel image dataset for benchmark- ing machine learning algorithms. CoRR, abs//700..0747, 2017. URL http::///axii...///
abs/1708. 07747
Cong Xie, Sanmi Koyejo, and Indranil Gupta. Fall of empires: Breaking byzamtine-toleramt SGD by inner product manipulation. CoRR, abs/1903.03336, 2019. URL http: www.eorrgaaaa. abs/
1903. 03936
Dong Yin, Yudong Chen, Kannan Ramchandran, and Peter L. Bartlett. Byzantine-robust dis- tributed learning: Towards optimal statistical rates. CoRR, abs/1803.01498, 2018. URL
http://4 //arxivv 100.

---

Under review as a conference paper at ICLR 2023
A APPENDIX
A.1 ALGORITIMMS
In this section we present the algorithms corresponding to the introduced LS variants.
Algorithm CMLS
9M = Cg) and AM = ag
This is considered the only entry in G Defining the trade-off vector associated with users gradients
for 9r, 1 [n] do
A;
aa
9ar
end for
(AM, A1. An)
Normalise
Return CMLS( Ei=1 Ag
Algorithm MKLS
Gr contains the selected vectors using m-Krum.
for gt, à [n] do
if E Gr then
>>
Defining the trade-off off vector using m- m-Krum scores 8;
A de
else if g: E then
A
end if end for X = (A1,..,, Xx)
Normalise
Return MKLS(G) = Ei= Agg.
Algorithm 4 ALS
G. contains the selected vectors using Aksel.
for gi, [n]] do
if E Gr then
> Defining the trade-ofi off vector using Aksel
X; 1
else if g: E G. then
X; llx 1x-1 II
end if end for
(AI,..,, An)
Normalise
Return ALS(G) = E Xg
B EMPIRICAL EVALUATION
B.1 DESCRIPTION
Hardware and software specifications Our codes are implemented using PyTorch 1.9.0 with the GPU partition of cluster single node containing:
cuda 11.1. Experiments
2x AMD EPYC 7713 64-Core Processor 1.9GHz (128 cores in total)
1000 GiB RAM
4x NVIDIA A100-SXM4-80GB GPUs
Duil-rail Mellanox HDR200 InfiniBand interconnect
12

---

Under review as a conference paper at ICLR 2023
B.2 EXPERIMENTAL RESULTS
In this section we present additional experimental results on both MNIST and FMNIST dataset.
NosiD 0.01
100
IPM Non 8.01
Minic
00
CMLS
ALS
CML
CML)
HILS
RMC bock
530
1.30
330
Figure 7: MNIST Top 1 Test Accuracy for the LS variants compared to RFA with bucketing (RFA buck) on non-IlI ~ Dir( 0.01) split. Each plot compares RFA with bucketing to the LS variants. Each row corresponds to given Byzantine attack, from the left respectively we have: Mimic: mimic Attack, ALIE: A Little Is Enough, IPM: Inner Product Manipulation
IPN
ALIE Non
Mimic
DULS
DLSS
801
Accuaat
5.3
2.52
3.00
Figure& 8: MNIST Top-1 1 Test Accuracy for trMean to trL. and trMa buck, its LS and bucketing variants on non-IID Dir(B 0.01) split. Each row corresponds to a given Byzantine attack, from the left respectively we have: Mimic: mimic Attack, ALIE: A Little Is Enough, IPM: Inner Product Manipulation
CMr5
00
30
20
Abal
1.00
300
0.0
530
100
1.0
210
300
530
100
130
255
300
520
100
NonilD
CMLS
60
AL5
HILLS
160
2:30
Itc
100
1730
100
706
301
100
100
1333
305
11c
400
400
IPM KonilD d 6.1
IPM] Non ID 0.1
IPM Non ID 5 0.1
CMLS
Abal
Abaul zuck
02
62
ndLs
22
nown
100 410
500 620
100
200
560
0.0
260
306
400
530
Figure 9: FMNIST Topp Test Accuracy for all GARS on non-IID Dir(3 = 0.1) split. Each plot compares standard RAGG to its bucketing variant and its LS variant. Each row corresponds a given Byzantine attack, from the left respectively we have: Mimic: mimic Attack, ALIE: A Little Is Enough, IPM: Inner Product Manipulation
13

---

Under review as a conference paper at ICLR 2023
Minic Nam-1D g
g
Abal
back
miLi
nton
100
600
531
100
1.0
262
182
600
591
Al E. Mon--D 2 0.01
130
AII Nisne1 P 0.01
1.0
ALE Nontl P 5.01
02
ALS
22
Aod
laratons
IPM NenilD
1P9 Newdtt
I1N NNn-ID
(M)
22
20
motn mocn Back
Tusilrro
Maralors
Figure 10: FMNIST Top- - Test Accuracy for all GARS on non-llD ~ Dir(B = 0.01) split. Each plot compares standard RAGG to its bucketing variant and its LS variant. Each corresponds to given Byzantine attack, from the left respectively we have: Mimic: mimic Attack, ALIE: A Little Is Enough, IPM: Inner Product Manipulation
14

---

Under review as a conference paper at ICLR 2023
Mimic Non ID
Mimi Non ID
Mimi 1D
8
80
202
120
ALIE Men-lD C.
120
ALIE Nonvll C.
1.00
ALIE NoniID C.
22
20
20
Akon JAcK
ricuu Back
16c
Tasilers
Beialons
PM Non-ID
Non-1I
IPM Nonslll
22
Buck
Arte back
22
nonn
nonn Back
500
300
Eriilin
CM15
1.30
300
0.0 530
100
1.00
232
300
530
100
1.30 300
000
530
Figure 11: MNIST Top 1 Test Accuracy for all GARS Non-IID C3 split (i.e. each agent only has access to samples from labels). Each plot compares a standard RAGG to its bucketing variant and its LS variant. Each row corresponds to given Byzantine attack, from the left respectively have: Mimic: mimic Attack, ALIE: Little Enough, IPM: Inner Product Manipulation and BF Bit Flip attack
15


Reviews:
[{"review_id": "YlCLaNx8-w", "reviewer": "Reviewer_TUza", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper considers federated learning over non-iid data in the presence of Byzantine nodes. The authors propose to use a technique linear scalarizatoin (LS) to help other aggregators to achieve better performance. For example, instead of applying coordinate-wise median (CM) directly,  the CM+LS algorithm computes an aggregation weight for each gradient inversely proportional to their distance to the median. In this way, LS does not discard gradients but gives higher weight to good gradients. The empirical performance looks very nice but no theoretical guarantee is provided.", "summary_of_the_review": "I would recommend borderline rejection because it does not address the main problem studied in the paper (non-iid) and there is no convergence guarantee.  ", "strength_and_weaknesses": "Strength:\n- Good empirical performance.\n\nWeakness:\n- I am not convinced that LS addresses the essence of the non-iid issue, although it may reduce the influence of non-IID data distribution. Take CM+LS (algorithm 2) in the appendix for example. If there is no Byzantine workers and 49% of gradients are 0 while 51% of gradients are 1, then the output of CM+LS will be the same as CM which is 1. However, an ideal aggregation is expected to output something close to 0.5. \n\n- There is no convergence guarantee as has been mentioned in the paper. A theoretical convergence guarantee is quite important because Byzantine robustness is designed to defend for all possible attacks. On the other hand, empirical evaluation only demonstrates its performance on a few attacks ---- there may exist some attacks that are designed to attack LS.\n\n- Not clear how the number of tolerated Byzantine nodes changes with LS technique.\n\n", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "2: Several of the paper’s claims are incorrect or not well-supported.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}, {"review_id": "LjT50zPAvtW", "reviewer": "Reviewer_ZZGo", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "The focus of this paper is on Byzantine-robust distributed learning. The authors in particular emphasize the setup where there is non-iid data across different clients. The main contribution in the paper is an algorithm in which the gradients from the clients are combined using a convex linear combination where the coefficients in the combination come from one of the robust aggregation rules that exist in the literature. The paper then provides several numerical results to showcase the benefits of the proposed algorithm.", "summary_of_the_review": "While the paper is studying an important problem and the approach taken in the paper seems to be effective, the authors should build further on this work. Some more insights into the strength of this work as well as theoretical contributions would make this a stronger paper.", "strength_and_weaknesses": "**Strengths**\n\n- The results reported in the paper highlight the usefulness of the proposed method.\n\n**Weaknesses**\n\n- The paper has an incremental nature and the main contribution is minor in nature, which involves taking a convex linear combination of the gradients. There are no theoretical guarantees for the proposed algorithm and all the aggregation rules discussed in the paper have already been studied in the literature, along with rigorous guarantees. The connections to multi-objective optimization are also tenuous.\n- Some of the claims made in the paper are either incorrect or misleading. E.g., \"the main Byzantine defenses rely on the IID assumption causing them to fail when data distribution is non-IID even with no attack\" is an incorrect statement (see, e.g., the supplementary material in BRIDGE: Byzantine-Resilient Decentralized Gradient Descent). Similarly, \"Another weakness of current aggregations is that they all aim at totally discarding outliers for the sake of granting resilience.\" is a misleading statement. In the case of coordinate-wise trimmed mean, e.g., the final gradient typically gathers information from all the clients. And in the case of other aggregation rules, even when a client is excluded in one iteration, it can come back into the calculations in another iteration. The point of this discussion is not to dispute the idea that a better aggregation rule, such as the one proposed in this paper, might lead to better outcomes. The purpose is, however, to emphasize that the authors need to think a bit harder about their claims and reframe their contributions in light of these facts.", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "G2L_e0Pdvhq", "reviewer": "Reviewer_xe7w", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "In this work, the authors study Byzantine-robust distributed learning on heterogeneous data and propose a new method called linear scalarization, where derailed clients are penalized via a trade-off vector. The proposed method is empirically compared with existing methods on several datasets.", "summary_of_the_review": "This paper is not well-written. Meanwhile, the claims lack theoretical support and the empirical comparison is not solid enough. Given the reasons, there is much room for improvement and this work is currently below the acceptance threshold.", "strength_and_weaknesses": "The proposed method, called linear scalarization (LS), does not introduce too much computation cost and is easy to implement. However, there are also some concerns as follows.\n\n1. The proposed method lacks enough theoretical support. LS is based on the existing aggregators RAGG, which are not robust on non-IID data, as mentioned in the paper. The split based on the chosen RAGG may be unreliable. Why the method based on a not robust aggregator is robust? It lacks theoretical support or even informal discussion about this.\n\n2. There are two extra hyper-parameters $\\alpha_t$ and $\\alpha_b$ in the proposed method. However, there is not an adequate discussion on how to properly set the hyper-parameters. Meanwhile, the effect of the two hyper-parameters is not adequately studied in this work.\n\n3. It is reported in [1] that bucketing with centered-clipping (CClip) and robust federated aggregation (RFA) has much better empirical performance. Given this, the comparison in this paper seems unfair.\n\n4. In equation (2) (page 2), does it require that $\\lambda_i \\geq 0$? An explicit explanation is required here.\n\n5. What is the definition of $\\delta_{max}$ (page 2)? Is it the upper bound of $\\delta$? Moreover, since there are $n$ clients in total, does $\\delta<\\frac{1}{2n}$ mean that there is no Byzantine client?\n\n6. At the end of the paragraph about IID defenses (page 3), 'in the non-IID setting' --> ' in the IID setting'.\n\n7. In the definition of CM (page 4), $M$ is defined to be an index while in the definition of Aksel, $M$ is defined to be a vector. The inconsistency will make readers confused. Meanwhile, it is suggested to represent vectors with bold letters, in order to avoid confusion.\n\n8. What is the meaning of the abbreviation 'MOO' (the first paragraph of page 4)? Does it mean 'multi-objective optimization'? Readers can be confused by this.\n\n9. There exist some typos and improper citation format. For example, there are several missing parentheses around the references in the paragraph about IID defense (page 2), in Section 3 (page 4), and in Section 4.1 (page 5). In the definition of Aksel (page 4), 'Combines' --> 'combines'. \n\n[1] Karimireddy, Sai Praneeth, Lie He, and Martin Jaggi. \"Byzantine-robust learning on heterogeneous datasets via bucketing.\" arXiv preprint arXiv:2006.09365 (2020).", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "2: Several of the paper’s claims are incorrect or not well-supported.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "9Ye38diLWCS", "reviewer": "Reviewer_hCuX", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper focuses on Byzantine-robust learning when the data is heterogeneous. The authors propose a novel Linear Scalarization (LS). LS first uses RAGG to split gradients into honest gradients and suspected malicious gradients. Then, LS uses a selection criterion to compute weights for all gradients. In particular, LS assigns higher (lower) weights for honest (suspected malicious) gradients. Finally, LS computes the weighted average as the aggregated gradient.", "summary_of_the_review": "The idea of trading off between granting Byzantine resilience and inclusion when the data is heterogeneous is interesting. However, some details of the proposed method need to be specified, and further experiments are needed to validate the efficacy of LS. Therefore, I think the paper is below the bar of ICLR.", "strength_and_weaknesses": "strength:\n\n* The idea of trading off between granting Byzantine resilience and inclusion when the data is heterogeneous is interesting.\n\nweaknesses:\n\n* Proposed LS is not applicable to all RAGGs. Many RAGGs do not split gradients into honest gradients and suspected malicious gradients, e.g., trimmed mean [1], and geometric median [2]. How can LS enhance these methods?\n\n* The selection criterion $C_{R_i}$ is important for LS. Elaborate more on how to choose an appropriate $C_{R_i}$.\n\n* Incomplete experiment results. The performance against attack BF on MNIST under $\\beta=0.01$ is missing (Figure 3); the performance against attack BF on MNIST under $\\delta=40\\%$ is missing; the performance against attacks BF, IPM, and ALIE on SVHN is missing; the performance against attacks BF and ALIE on CIFAR-10 is missing,\n\n* Experiments on different $\\alpha_t$s and $\\alpha_b$s are expected. I am particularly interested in the case where $\\alpha_t=\\alpha_b$.\n\n* I am wondering about the effect of applying LS to a particular defense DnC [3]\n\n* The introduction of different RAGGs in Section 3.1 seems unnecessary.\n\n[1] Yin, Dong, et al. \"Byzantine-robust distributed learning: Towards optimal statistical rates.\" *International Conference on Machine Learning*. PMLR, 2018.\n\n[2] Pillutla, Krishna, Sham M. Kakade, and Zaid Harchaoui. \"Robust aggregation for federated learning.\" *arXiv preprint arXiv:1912.13445* (2019).\n\n[3] Shejwalkar, Virat, and Amir Houmansadr. \"Manipulating the byzantine: Optimizing model poisoning attacks and defenses for federated learning.\" *NDSS*. 2021.", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "1: The contributions are neither significant nor novel."}, "extra_text": {}}]

Author rebuttal:

Decision: Reject