$\alpha$-Weighted Federated Adversarial Training
Authors: Jianing Zhu
Jiangchao Yao
Tongliang Liu
Kunyang Jia
Jingren Zhou
Bo Han
Hongxia Yang
Venue: ICLR 2022 Submitted (2022)

Abstract: Federated Adversarial Training (FAT) helps us address the data privacy and governance issues, meanwhile maintains the model robustness to the adversarial attack. However, the inner-maximization optimization of Adversarial Training can exacerbate the data heterogeneity among local clients, which triggers the pain points of Federated Learning. This makes that the straightforward combination of two paradigms shows the performance deterioration as observed in previous works. In this paper, we introduce an $\alpha$-Weighted Federated Adversarial Training ($\alpha$-WFAT) method to overcome this problem, which relaxes the inner-maximization of Adversarial Training into a lower bound friendly to Federated Learning. We present the theoretical analysis about this $\alpha$-weighted mechanism and its effect on the convergence of FAT. Empirically, the extensive experiments are conducted to comprehensively understand the characteristics of $\alpha$-WFAT, and the results on three benchmark datasets demonstrate $\alpha$-WFAT significantly outperforms FAT under different adversarial learning methods and federated optimization methods.

Under review as a conference paper at ICLR 2022
Q' WIGHTED FEDERATED ADVERSARIAL TRAINING
Anonymous authors
Paper under double-blind review
ABSTRACT
Federated Adversarial Training (FAT) helps us address the data privacy and gover- nance issues, meanwhile maintains the model robustness to the adversarial attack. However, the imner-maximization optimization of Adversarial Training can exac- erbate the data heterogeneity among local clients, which triggers the pain points of Federated Learning. This makes that the straightforward combination of two paradigms shows the performance deterioration observed in previous works. In this paper, we introduce an a- a-Weighted Federated Adversarial Training (a- WFAT) method to overcome this problem, which relaxes the maximiaaiiniiioon of Adversarial Training into a lower bound friendly to Federated Learning. We present the theoretical analysis about this a-weighted mechanism and its effect conducted
on the convergence of FAT. Empirically, the extensive experiments to comprchensively understand the characteristics of a- a-WFAT, and the results on three benchmark datasets demonstrate a- a-WFAT significantly outperforms FAT under different adversarial learning methods and federated optimization methods.
INTRODUCTION
To handle the data privacy and governance issues, Federated Learning (McMahan et al. 2017 as one promising paradigm of distributed training has drawn the increasing attention (McMahan et al. 2017 Kairouz al. 2019p. However, training locally in Federated Learning also introduces the vulnerability from the adversarial attacks (Goodfellow et al.) [015 Kurakin et al. (2016), which drives us consider the model robustness in this framework. Thus, recent advances (Kirruuz al. 2019) explore to apply the Adversarial Training methods (Madry et al. 2018) into Federated Learning.
However, the straightforward combination of Adversarial Training and Federated Learning presents some potential challenges due to the communication cost and the hardware requirement. For example, Shah et al. [202I) pointed out that the communication in Federated Learning may be a constraint to Adversarial Training, and proposed a dynamic schedule on the local training epochs to achieve the expected robustness a short communication budget. Hong et al. (2021) considered the hardware constraint where some clients are not able to participate Adversarial Training, and they proposed federated robust propagation method to share the adversarial robustness among the clients. Although these previous works indeed addressed some realistic problems, one critical issue in the way the performance deterioration in the combination of two paradigms as observed in ZZizzo et al. 2020
As shown in the left panel of Figure I one typical phenomenon Federated Adversarial Training (FAT) is the robust accuracy of FAT (Zizzo et al. (2020) based on FedAvg (McMahan et al. 2017) will decrease significantly the later stage of learning compared with the centralized Adversarial Training (Madry et al. 2018) that does not. Actually, it exists in many variants of Federated Learning methods (Shah et al. (202)) under different communication rounds and different local training epochs. However, it is still lack of the sufficient algorithmic breakthrough to overcome this issue, since almost all previous works (Zizzo et al.) 2020 Shah et al., 202T Hong et al., (02T) consistently apply the conventional update framework of Federated Learning with Adversarial Training.
We dive into this phenomenon and attribute it to the inner-maximization Compared with the centralized Adversarial Training (Madry et al. 2018), the training data of FAT is distributed to each client, which leads to the Adversarial Training in each client unaware of the data in the others. Therefore, the adversarial examples generated by the manemmiaiiiztiinn of Adversarial Training tend to be highly biased to each local distribution, yielding the radical optimization to pursuit the model robustness (as shown in Figure? 2 it has severe local bias to the global optimum). In
Adversarial Training.

---

Under review as a conference paper at ICLR 2022
70
60
Robust Accuracy
30
Accuracy
50
25
FAI Net.ni
FAI Ratel
30
40
KT Natual
AT Rooue
20
w
FAT-1-1000
20
FAT-5-200
10
FAT-10-100
20
20
80
100
a-WFAT-10-100
10
200
400
1030
Communication
Communication
Figure 1: Left: comparison between centralized Adversarial Training and Federated Adversarial Training based on FedAvg. Right: comparison between FAT and G-WFAT. All the experiments conducted on CIFAR-10 dataset (Non-IID) with 5 clients, and use AT (Madry et al.) (0118) to train as well as PGD-20 to evaluate the Robust Accuracy. Note that, the notation "method-A-B" in the right panel means the method with A local training epochs and B communication rounds.
short, the inner-maxes maximizaiin of Adversarial Training exacerbates the data heterogeneity among local clients, which actually triggers the pain points of Federated Learning that are exploring urgently.
To handle this problem, we propose a new learning framework based on a simple but effective re- weighting mechanism, namely, a- --eiggtted Federated Adversarial Truining (a-WFAT). Concretely, we relax the objectíve of the inner-maximization in Adversarial Training into lower bound by a- weighting mechanism (as Eq. (3) in Section 4.2). Similar to the bias-variance trade-off (Kohavi et al.) 1996), introduce the small bias to the original objective via low-bound relaxation, facilitating a friendly optimization in the combination of Adversarial Training and Federated Learning. This constructs conservative optimization for Adversarial Training that weights different population based on their adversarial losses. Then, the harsh heterogeneous update can be deighteighted with this flexible weighting mechanism, and the convergence could be accelerated at the same time. Applying the similar idea to FAT, we propose a-WFAT that emphasizes the robust clients more compared with other non-robust clients alleviate the heterogeneous bias caused by the local adversarial generation. The right panel of Figure T conducted extensive experiments to provide a comprehensive understanding of the proposed a- WFAT, and the results of a- FAT in the context of different adversarial learning methods and federated optimization methods demonstrate its superiority to improve the model performance.
gives simple comparison between a- a-WFAT and FAT. Empirically, we
Main Contributions
We derive o-weighted relaxation for Adversarial Training relax the inner-maximization by a lower bound, which builds a mediating function to alleviate the potential radical optimization in its straightforward combination with Federated Learning (in Section
We propose new learning framework, i.e., a- Weighted Federated Adversarial Training (a-WFAT), to realize the relaxation of inner-maxinan maximiaaiiiztion in FAT, which is simple and com- patible with various Federated Learning or Adversarial Training methods (in Section 4.3)
We conduct extensive experiments to comprehensively understand the characteristics a-WFAT, and confirm its effectiveness on improving the model performance for both IID and Non-IID settings in the context of several federated optimization methods (in Section
2 RELATED WORK
Federated Learning The representative work in Federated Learning is FedAvg (McMahan et al..
2017), which has been proved effectiveness during the distributed training to maintain the data privacy. To further address the heterogeneous issues, several optimization approaches have been proposed
e.g., FedProx (Li et al. 2018). FedNova (Wang et al. 2020b) and Scaffold (Karimireddy et al. (022). FedProx introduced proximal term for FedAvg constrain the model drift cause by heterogeneity; FedNova proposed a general framework that eliminated the objective inconsistency and preserved the fast convergence; Scaffold utilized the control variates to reduce the gradient variance in the
2

---

Under review as a conference paper at ICLR 2022
local updates and accelerate the convergence. MOON (Li et al. by maximizing the agreement between the representation of the local model and that of the global
202 alleviated the heterogeneity
model, which helps correct the local training of individual parties. RReisizadhh al. (2020) developed a robust federated learning algorithm to against distribution shifts in clients samples. Our a- W-FF introduces the relaxation into federated adversarial training, which is orthogonal to and compatible with the previous optimization methods.
Adversarial Training As one of the defensive methods (Papernot et al. 2016 Gao al. 202 D.
Adversarial Training (aadry et al.) 2018 Zhang et al., 2inn: et al. 2020; Chen et al. 202
to improve the robustness of machine learning models. The classical AT (Madry et al. 201 is built upon on a min-max formula to optimize the worst case, e.g., the adversarial example near the natural example (Goodfellow et al. 2015). Zhang et al. (2019) decomposed the prediction error for adversarial examples the sum of the natural error and the boundary error, and proposed TRADES to balance the classification performance between the natural and adversarial examples. Wang et al. (2020c) further explored the influence of the misclassified examples on the robustness, and proposed MART that emphasizes the minimization of the misclassified examples to boost the AT. Zhang et al. 2020) investigated the "benign adversarial examples" in AT and further improve the natural performance of robust model. In this work, our a- RF-T framework leverages the client-level measure to alleviate the heterogeneous issue in the straightforward combination of adversarial training and federated learning. It is compatible to further incorporate those centralized adversarial training methods to improve the model performance.
Federated Adversarial Training. Recently, several works have made the exploration on the Ad- versarial Training in the context Federated Learning, which consider the data privacy and the robustness in one framework. To our best knowledge, [Zizzo et al. (2020) take the first trial to study the feasibility of extending Federated Learning (McMahan et al. 2017) with the standard AT on both large performance gap existing
IID and Non-IID settings. Empirically, they found that there between the distributed and the centralized adversarial training, especially on the Non-IID data. [Shah] al. (202)) designed a dynamic schedule for the local training pursue larger robustness under the constrained communication budget of Federated Learning. Hong et al. (2021) explored how to effectively propagate the adversarial robustness when only limited clients in Federated Learning have the sufficient computational budget to afford AT. Although previous works have investigated to solve the challenges about the constrained communication or computational budget, one critical issue that affects the performance when combined Adversarial Training with Federated Learning has received only few discussion. this work, we consider such a basic issue (see Figure in the straightforward combination of AT with Federated Learning and introduce our solution to this problem.
3 PRELIMINARY
In this section, we will briefly formalize the notations of Adversarial Training (Goodfellow et al. 2015 Madry et al. 2018) and Federated Learning as well as FedAvg (McMahan et al. 2017).
3.1
ADVERSARIAL TRAINING
Let (X, ) denote the input feature space X with the infinity distance metric doe (z, .) = | 1z--āles -l
and [x] = {iE X dx (x, σ) S { be the closed ball of radius e >> 0 centered at a in X. Dataset
S == (( ynx) W where I, E X' and yo E {0, 1,.., C 1). The objective function of the standard adversarial training (AT) (Madry et al. 2018) is defined as follows,
Σ max ((o()))))))) min foEF
E. (r..)
where 7 is the most adversarial data within the e-ball centered at x. fo(.) X + RC is a score function, e: RC x y + IR is a composition of a base loss lg AC-I - R (e.g. the Cross- Entropy loss) and an inverse link function & : RC + AC-1 (e.g., the Softmax). Here, A C-1 is the corresponding probability simplex that yields ((fo()).v) v) (f For the inner- maximization of Eq. (T). the multi-step projected gradient descent (PGD) (Madry et al., 2018) is usually applied to find the most adversarial samples, which are then used for the outer-minimization.
3

---

Under review as a conference paper at ICLR 2022
Class Class
Adversarial
Unseen data
Large
Misclassified data
Decision boundary
Globally optimal
decision boundary
Client A
Client
Global model (after FedAug) Global model (after (-WAAT]
Figure 2: Left panel: locally learned decision boundary on Client A; Middle left panel: locally learned decision boundary on Client B; Middle right panel: globally aggregated decision boundary based on FedArg: Right panel: globally aggregated decision boundary based on a-WFAT. Note that, the distance between the correctly classified adversarial examples and the decision boundary (i.e., the bold line) can approximately reflect the client loss, and shows that lalient A > letient B- Then, selectively treating two client models in the aggregation can acquire better global model (e.g., the fourth panel), which consistent with the intuition of Eq. 3).
3.2 FEDERATED LEARNING
Let Dj denotes a finite set of samples from the k-th client, and in each round, of datasets [Da) from K clients are involved into the training. The objective of Federated Learning is to learn machine learning model without any exchange the training data between the clients and the server. The current popular strategy, namely FedAvg, is introduced by McMMahn et al. (2017). where the clients collaboratively send the locally trained model weights 0% to the server for the global average aggregation. Concretely, each client runs local copy of the global model (parameterized by 8 in the i-th round) with its local data to optimize the objective like Eq. (1). Then, the server receives their updated model weights (0% 1 of all clients and performs the following aggregation
K
g
NoOs
(2)
N
where N₂ denotes the number of the samples in Dr and N = Ng. Then, the weights 0 for the global model will be sent back to each client for another lifecycle. After the sufficient rounds of such periodic synchronization and aggregation, expect the stationary point of Federated Learning will approximately approach to or have small gap with that from the centralized counterpart.
4 Q- C-WEIGHTED FEDERATED ADVERSARIAL TRAINING
In the following sections, will first introduce motivation for Federated Adversarial Training through analyzing the challenges brought by the straightforward combination. Then, we relax the lower bound by a-weighted decompo-
inner-maximization problem of Adversarial Training sition, and present the theoretical understanding of such a relaxation. Finally, we will present the a- a-Weighted Federated Adversarial Training and the corresponding analysis.
4.1 MOTIVATION
For the general FAT Zizzo et al., 2020), in each round, the clients will receive the latest model from the server. Then, they conduct Adversarial Training with the local data and send their optimized model parameters the server. The server will aggregate the parameters of all clients into a global model with FedAvg other methods in Federated Learning. However, considering the characteristics of Federated Learning and Adversarial Training, naturally brings the following critical challenge.
The inner-maximization can enlarge the data heterogeneity in Federated Learning. In terms of the combination of adversarial training and federated learning, the key point is that such adversarial examples generated by the inner-maximization exacerbate the heterogeneity, which induces the performance deterioration under the model aggregation methods. As the Figure 2 shows, the client with large adversarial loss might make dominating effect the convergence of the global model, given the current model aggregation methods treat all client models indiscriminately. Thus, it might be better to selectively weight the client models in the model aggregation.
4

---

Under review as a conference paper at ICLR 2022
4.2 Q- WEIGHTTED RELAXATION OF DECOMPOSED ADVERSARIAL TRAINING
As previous analysis, the inner-maximization of Adversarial Training is not very compatible with Federated Learning due to the exacerbation of heterogeneity when combing them together. An idea to alleviate this problem is building a mediating function that keeps the original goal but is friendly to two paradigms. this section, we present one possible solution to this intuition, which tries to find a relaxation of the inner- Imerrmaximization in Adversarial Training. Formally, we decompose the maximization objective into the independent K populations that corresponds to the K clients in Federated Learning, and relaxes it into a lower bound by the a-weighted mechanism as follows,
1
N N
AT
max ((S(Tn); Mn)
((((5)); Un)
Sn EB. [B. [xn]]
N
nn E B, [an]
(3)
k
Na(s) Lo(k) +(1 0)
K
No(k)
a. 1), R R K
2 (1 + ②3)
Σ
Lo(k)
N
N
A R+1
=K),
where p()) a function which maps the index the original population sorted by & Cx} in an ascending order. The following theorems provide us more analysis about the a- a-weighted relaxation.
Theorem 4.1. L- (K) is monotonically decreasing w.r.t. both a and K, i.e. e (K) L (K) af > 0z and L (K1) < (K2) if K2 > K2. Specifically, L (K) recovers L of adversarial training when a achieves O, and L (K) relaxes L to a lower bound objective by increasing R and a.
We can flexibly emphasize the importance of partial populations by setting the proper hyperparameters, alleviating the evenly averaging of harsh heterogeneous updates in FedAvg (McMahan et al. 2017))
Theorem 4.2. Assume the loss function E(.,-) in Eq- (3) satisfies the Lipschitzian smoothness condition w.r.t. the model parameter and the training sample x, and is X-strongly concave for all
x, and V v 1)
S 62, where t is the adversarial example. Then, after the for a-weighted relaxation of decomposed Adversarial in PGD, we have the following convergence property,
sufficient T step optimization i.e., T Z
LA
8
Training with the constant stepsize
A
LT
)
T ( 0:
+ E. 5())
LA
T E
Σ
+ 48
(4)
N
T
where L Log + Leckare defined by the Lipschitzian constraints, A La inlo La and
<(1) = >R N(I) EK
N(l)) meaning the accumulative counting difference of the 1-th step. o(k)
o(k)
When = 0. (3 recovers the original loss of Adversarial Training, and the first part in the RHS of Eq. goes to that recovers the convergence rate Adversarial Training (Sinha et al. 2018). When (3 becomes more biased, while simultaneously the straightforward benefit is that we can achieve faster convergence in Eq. (4) if + ΣT {(t) < i.e., (1+a ET g(9)
< 1. Actually, this is possible when the sample number is approximately similar among all clients and the top-1 choice easily has -N < g(t) (i(()
d(1) Σx X-(t) < 0 in each optimization step. Especially, larger has faster convergence in this case. Therefore, the a-weighted relaxation of decomposed Adversarial Training provides us a trade-off between maintaining the robustness from the standard
robust training and achieving the faster convergence with some biased approximation by a and K.
4.3 Q- WEIGHTED FEDERATED ADVERSARIAL TRAINING
Inspired by the previous analysis of a-weigtted relaxation, we propose an a- Weighted Federated Adversarial Training combine Adversarial Training and Federated Learning. The intuition is
5

---

Under review as a conference paper at ICLR 2022
Algorithm 1 a- c--eiighted Federated Adversarial Training (a-WFAT)
Input: number of clients: K, number of communication rounds: T, number of client training epochs per round: E, initial server's model parameter: 0 hyper-parameter for aggregation: a, number of enhanced clients: K:
Output: a globally robust model with parameter A
1: for t- "o.....,'-- T--1 10-10 do
2:
Clients: | perform adversarial training]
3: for client h = 1...., K do
4: f%. Lx = AT E) (Madry et 2018
5: end for
6: Server: performs aggregation over weight updates]
7:
Call 1 L1, N C2..... NK Ckl
8: Caarted f- Ascending Sort(L.u)
9: Vk, Px (1 a)) 1( No
N Lk S Csorted[[]] + (1 (1-60 -a) 11 L* [K])t
10: @++1 2k-1 PuNa Ek P
b. a--eiigted mechanism
end for
applying the a-weighted mechanism into the inner- maximizaxii in FAT, formalized as follows,
min Fa-WFAT-
min JoEF
K Σx PENK
Σ
PLNK
NA
B. B.EBB
max
{(So ((fo
(5)
La
where PA = (1+0). Lx I Esorted RT) + +(--)) LE > Lsorted K) denotes the weight assigned to the k-th client based the ascending sort of weighted client losses compared with the K-th one. We summarize the procedure of a- WFAT in Algorithm [ which consists of multi-round iterations between the local training on the client side and the global aggregation on the server side.
Concretely, on the client side, after downloading the global model parameter from the server, each client will perform the Adversarial Training on its local data. At the same time, the client loss on the adversarial examples is also recorded, which acts as the soft-indicator of the local bias induced by the radical adversarial generation. Then, when the training steps reach to the condition, the client will upload model parameter and the loss to the server. On the server side, after collecting the model parameters {0x) 1 and the losses {C*} ) k= of all clients, it will first sort the losses in ascending order to find the top- R clients. Based on that, the global model parameters will be aggregated by the a-weighted mechanism in which the model parameters the top-K clients are upweighted with (1 + a and the remaining is downweighted by (1 a). For some atypical layers (Li et al. 2021b) egg., BN, it is outside the scope of this paper and we keep the aggregation same as FedAvg. Note that, one interesting point in a- WFAT is the top- K clients with the higher weights are not fixed, and they can be routing among all clients, In Figure 3 we trace this dynamic of a- WFAT one experiment.
In the following, we provide the theoretical analysis of a- a-WFAT on the convergence in the context of Federated Learning (Li et al. (001)), which is slightly different from previous centralized counterpart.
Theorem 4.3. Assume the loss function ((...) in Eq. (5) is I.-smooth and X-strongly concave w.r.f. the model parameter 9, and the expected norm and the variance of the stochastic gradient in each Vofx113 I &2. Let K x. 7 max(8K, (8x, E} where E is the iteration number of the local Adversarial Training with the learning πt XCr+-y- Then, after the sufficient T -tepp communication rounds for a-WFAT, we have the following asymptotics to the optimal point.
client respectively satisfy [[IV ( (*)l & <² and E. [[ (
ElCa-wFArl L
R
2B
-0-11))81112) -
B
Xy
(6)
7+
X
where L the minimum value of Ca-WFAT. H" is the optimal model parameter, and
K
(T)
No
2
K
(T) N 2
B = Σ
6k N
+ +6L
L Σ
+ +8(E-1)2
1 a
CiT)
1 1 a
60T) N
N
b
k

---

Under review as a conference paper at ICLR 2022
Client
100
Communication
Figure 3: The index of the top-K clients with the small losses a-WFAT (a 1/6. R each communication round on CIFAR-10. We can see that it is dynamically routing among all clients.
When a we have p(() and Eq. 6 becomes the convergence of FedAvg on non-IID data (Li et al. 2019). Different from Theorem 4.2 that concludes in the centralized training setting, when a I, the convergence is indefinite compared to the standard FAT. since the emerging terms in
B. i.e.
and
1+a ctryy are acted as the scalar timing by the personalized variance bound 1
14a 2
oe and the local optimum 2% of each client. One possible case when the optimization approaches the optimal parameter 0", 0g can be in smaller scale relative the scale of L In this case, the increment of the first term of B can be totally counteracted by the loss of second term of B so that in sum B becomes smaller. Then, we can have tighter upper bound for a-WFAT in Eq. (q.( (6) achieve a faster convergence than FAT. The completed proof of Theorem 4.3 can refer to Appendix Cadd the experiments in the following section will confirm a- WFAT can reach more robust optimum.
5 EXPERIMENTS
In this section, will provide in-depth analysis of a-WFAT and empirically verify its efficiency compared with the current methods on range IID and non-IID datasets.
5.1 EXPERIMENTAL SETUP
Dataset. We conduct the experiments on three benchmark datasets, i.e., CIFAR-1O, CIFAR- 100 (Krizhevsky) 2009) and SVHN (Netzer et al.) 201T) for Federated Adversarial Training. For the IID scenario. just randomly and evenly distribute the samples to each client. For the Non- IID scenario, we follow McMahan et al. (207);; Shah et al. (20II) to partition the training data based their labels. To be specific, skew parameter by Shah et (20TT). which enables clients to get a majority of the data samples from a subset of classes. We denote the of all classes dataset as and create Y4 by dividing all the class labels equally among K clients. Accordingly, we split the data across K clients that each client has (100- (K 1) 8)% of data for the class in V's and s% of data in other split sets. The detailed training and evaluation settings can refer to Appendix
utilized in the data partition introduced
5.2 ABLATION STUDY
In this part, conduct various experiments CIFAR-1O to visualize the characteristics of a-FFT.
Non-AT vs. AT. In the left two panels of Figure we respectively apply our a-weighted mechanism Federated Standard Training (C-WFST) and Federated Adversarial Training (a-WFAT) under K T=1 1. We also consider both FedAvg and FedProx this experiment to guarantee the universality. From the curves, we can see that GFTT has the negative effect on the natural accuracy, while o-WFAT consistently improve the robust accuracy both based on FedAvg or FedProx. This indicates a-weighted mechanism is tailored for the amnermaxxiiizaiio of Federated Adversarial Training instead of the outer- minemmimmiiiziiinnn considered by other federated optimization methods.
Impact a and K. To study the effect of hyperparameter in a- WFAT, we conduct several ablation experiments verify the model performance. Regarding the experiments of o, set the client
7

---

Under review as a conference paper at ICLR 2022
65-
17.5
60
60
Natural Accuragy
25.0
Robust Accuracy
65
70.0
72.5
07.5
Peccag
Mpte
(0)
Festig
Accuracy
8
B
Natural Age
Robust Ace
2150
40
4.
Robust Acc
Natuni Ace
K2.5
05.0
FerPhox
GWWPST
20
30
60
100
1211
1.5
1213
1/14
315
4.
Communication
Communication
K/K
Figure 4: Ablation study on a-WFAT. Left two panels: comparison between Federated Standard Training and Federated Adversarial Training respectively in combination with the a-weighted mecha- nism, i.e., (a-WFST) vs. (a-WFAT). Right two panels: the natural accuracy and the robust accuracy of a-FAT with different a and different R on CIFAR-10.
number K = 5 and K = 1 upweight/downweiiht the client models in each communication rounds. The right middle panel of Figure 4 shows a E (0, 1/6 can significantly improve the robust accuracy and the natural accuracy, while larger might be inappropriate the natural accuracy. Regarding the choice of K, we specially set K 8 in this experiment span the range of K due to the constraint presents the accuracy of o- a-WFAT with increasing K. ral accuracy and the robust accuracy are improved even with larger K, which shows the effect of K on the relax- ation of manimmaxxmizationn in the pro- posed a- WF-. In addition, we conduct the experiments about emphasizing/de- emphasizing the client with smallest ad- versarial loss by adjusting the a, the re- sults (in Appendix E confirmed that the relaxation introduced by our a-WFAT is needed to improve performance, and is consistent with our previous analysis.
R <= K/2. The right panel of Figure According to the plot, both the natu-
Table I: Test accuracy (%) on CIFAR-1O (Non-IID) with different Adversarial Training methods on the local client.
Methods
Natural
PGD-20
CW
FAT Q-WFAT
57.45% 62.34 %
32.58%
30.52% 33.06 %
AT
35.59 %
FAT a-WFAT 65.26%
64.00%
31.64%
28.95%
TRADES
35.10% %
31.80 %
FAT Q- G-WTAT
56.29
36. 66.27% %
32.41 41%
MART
58.41 %
38.90% %
34.67 %
Different AT methods. In Table 1 we
validate the combination of w-wehghted mechanism and different Adversarial Training methods (i.e. TRADES (Zhang al. 2019) and MART (Wang et al., (200cc), where we switch different local Adversarial Training methods on the client side. Through the comparison with FAT, the results show that a- WFAT can consistently improve both the natural performance and the robust performance, and is general to the state-of- sute-of-thhear Adversarial Training works under Federated Learning scenarios.
5.3 PERFORMANCE EVAL.ATIIO
In this section, we compare our a- WFAT with FAT on various benchmark datasets to demonstrate its effectiveness. Specifically, we validate both the non-III and IID settings with three represenative Federated optimization methods i.e., FedAvg, FedProx and Scalffold. Besides, a centralized AT baseline is provided as the reference of the IID setting. Note that, there no such a baseline for the non-lID setting, since the centralized case is one distribution which is incomparable and meaningless. Considering the sensitivity of data selection in Non-IID settings, also report the results with Mean and Std values in Appendix
after running experiments for multiple times.
According to Table on CIFAR-10. we can find that WFAT significantly outperforms FAT on the Non-IID data in terms of both the natural accuracy (~2%-6%) and the robust accuracy (~2%--5%) For the III data, our method acquires similar improvement on the robust accuracy without the deterioration of the natural accuracy. The reason might be because even the data is IID, Adversarial overparameterized network (Allen-Zin & Li
Training can still drive the mudependently-inittaaiii 2020) on each client side towards at the robust overfitting of different directions, yielding the model heterogeneity. Thus, the proper relaxation to the inner-maxine maximization makes Adversarial Training more compatible with Federated Learning. Another interesting observation is that Federated Adversarial Training shows better performance than centralized Adversarial Training in the case of the IID setting. This gain could be from the distributed training paradigm i that helps Adversarial Training converge
8

---

Under review as a conference paper at ICLR 2022
Table 2: Performance on three benchmark datasets under different federated optimization methods.
Setting
Non-IID
CIFAR-10
Natural
FGSM
PGD-20
CW xc
AA
Natural
FGSM
PGD-20
CW
AA
Centralized AT
66.47%
47.68%
38.18%
37.04%
34.48%
FAT ---TTTT
57.45%
39.44%
32.58%
30.525
29.20%
69.35%
48.45%
37.43%
35.72%
33.96%
FodAvg
63.44%
45.13%
37.17%
33.99%
32.36%
67.43%
50.33%
42.78%
37.91%
36.20%
FAT n--FAT
60.44%
41.59%
33.84%
31.29%
30.02%
66.91 %
46.70%
37.14%
34.54%
32.68%
FedProx
62.51
44.29%
36.75%
33.82%
31,98%
68.31 %
48.40%
42.41 %
37.25%
35.97%
FAT
62.81%
43.61%
34.13%
32.53%
30.95%
68.27%
49.25%
39.33%
37.31%
35.30%
Scaffold
a- WFAT
64.12%
46.05%
37.35 %
34.78%
33.32%
71.36 %
50.42%
43.83%
39.12%
35.47% %
CIFAR-100 100
Natural
FGSM
PGD-20
CW
AA
Natural
FGSM
PGD-20
CW
AA
Centralized AT
35.81%
23.09%
18.64%
16.48%
15.42%
31.07%
19.60%
16.16%
13.37%
12.47%
38.35%
23.37%
18.44%
16.63%
15.45%
FodAvg
a-WFAT
35.17%
21.26%
16.72%
13.91%
12.83
38.43%
23.76%
18.82%
16.71%
15.62%
FAT
33.33%
20.20%
16.08%
13.76%
12.72%
37.18%
22.29%
18.16%
16.33%
15.29%
FedProx
a-WFAT
34.30%
20.82%
16.74%
13.84%
12.88 %
37.37%
23.11%%
18.43%
16.36%
15.45% %
FAT a- a-WFAT
41.17%
25. 17%
20.01%
16.74%
1..499
42.42%
26.79%
21.18%
18.89%
17.63%
Scaffold
41.07%
25.55%
20.40%
16.79%
15.59%
42.08%
27.18%
22.26%
19.34%
18.03%
SVIIN
Natural
FGSM
PGD-20
CW
AA
Natural
FGSM
PGD-20
CW
AA
Centralized AT
92.39%
89.75%
72.73%
72.31%
70.93%
FAT
91.24%
87.95%
68.87%
67.89%
66.54%
93.52%
90.68%
72.24%
71.22%
70.08%
FedAvg
a- o-WEAT
91.25%
88.28%
71.72%
69.79%
68.62 %
92,75%
90.06%
74.37%
72.34%
71.27% %
90.92%
87 87.50%
68.44%
67.18%
65.94%
93.54%
90.66%
72.53%
71.42%
70.21%
FedProx
O-WTAT
91.25%
88.15% %
71.54%
69.53% %
68.47 %
93.59 %
90.80%
74.66 %
72.67%
71.48% %
FAT
89.95%
87.23%
68.66%
67.23%
66 65.65%%
93.80%
91.00%i
73.26%
72.05%
70.80%
Scaffold
WFAT
90.20%
87.81
71.39 %
68.81
67.88 %
93.92%
91.28%
75.96%
74.05%
72.88 %
to the more robust optimum by the divide-and-conquee mechanism. This might enlighten the more explore in Adversarial Training to improve the model robustness via Federated Learning.
On CIFAR-100 and SVHN, three types of federated optimization methods. Nevertheless, a- a-WFAT only becomes superior in terms of the robust accuracy but comparable with FAT in terms of the natural accuracy especially on CIFAR-100. It indicates that the inner-maximization of Adversarial Training when combined with Federated Learning mainly affects the model robustness, and thus the a-weighted relaxation correspondingly helps the model converge to more robust optimum.
find the similar improvement in Table as that of CIFAR- under
6 CONCLUSION
In this work, we explore the performance deterioration in the straightforward combination of Adver- sarial Training with Federated Learning. To alleviate the potential radical optimization, we apply an q- a-weighted relaxation into Adversarial Training to relax the inner- maximizaaizz.........mmm Based on this a-weighted mechanism, we further propose a- weightedd Federated Adversarial Training (o-WFAT). We provide the theoretical analysis and empirical evidences to understand the proposed simple but effective method. The experimental results under different settings confirm the effectiveness of a- a-WFAT. Nevertheless, we only move small step the heterogencous issue in the combination of two paradigms and more issues in their cross field could be further explored in the future.

---

Under review as a conference paper at ICLR 2022
7 ETHICS STATEMENT
This paper does not raise any ethics concerns. This study does not involve any human subjects, practices to data set releases, potentially harmful insights, methodologies and applications, potential conflicts of interest and sponsorship, bnscriminattoo//ias/aaainn concerns, privacy and security issues, legal compliance, and research integrity issues.
REPRODUCIBILITY STATEMENT
To ensure the reproducibility of experimental results, we will provide a link for an anonymous repository about the source codes of this paper in the discussion forums.
REFERENCES
Zeyuan Allen-Zhu and Yuanzhi Li. Towards understanding ensemble, knowledge distillation and self-distillation in deep learning, arXiv preprint arXiv:20/2.098/6, 2020.
Nicholas Carlini and David A. Wagner. Towards evaluating the robustness neural networks. In Symposium on Security and Privacy (SP), 2017.
Tianlong Chen, Sijia Liu, Shiyu Chang, Yu Cheng, Lisa Amini, and Zhangyang Wang. Adversarial robustness: From self-supervised pre-training to fine-tuning. In CVPR, 2020.
Tianlong Chen, Zhenyu Zhang, Sijia Liu, Shiyu Chang. and Zhangyang Wang. Robust overfitting may be mitigated by properly learned smoothening. In ICLR, 2021.
Ruize Gao, Feng Liu, Jingfeng Zhang, Bo Han, Tongliang Liu, Gang Niu, and Masashi Sugiyama. Maximum mean discrepancy test is aware of adversarial attacks. In ICMI., 2021.
Ian J. Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. In ICLR, 2015.
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In CVPR, 2016.
Junyuan Hong, Haotao Wang, Zhangyang Wang. and Jiayu Zhou. Federated robustness propagation:
Sharing adversarial robustness in federated learning. arXiv preprint arXiv:2106.10116 2021.
Ziyu Jiang, Tianlong Chen, Ting Chen, and Zhangyang Wang. Robust pre-training by adversarial contrastive learning. In NeurIPS, 2020.
Peter Kairouz, Brendan McMahan, Brendan Avent, Aurélien Bellet, Mehdi Bennis, Arjun Nitin Bhagoji, Kallista Bonawitz, Zachary Charles, Graham Cormode, Rachel Cummings, et al. Ad- vances and open problems federated learning. arXiv preprint 191.9.191,. 2019.
Sai Praneeth Karimireddy, Satyen Kale, Mehryar Mohri, Sashank Reddi, Sebastian Stich, and Ananda Theertha Suresh. Scaffold: Stochastic controlled averaging for federated learning. In ICML, 2020.
Ron Kohavi, David H Wolpert, al. Bias plus variance decomposition for zero-one loss functions. In ICML, 1996.
Alex Krizhevsky, Learning multiple layers of features from tiny images. In arXiv, 2009.
Alexey Kurakin, Ian Goodfellow, and Samy Bengio. Adversarial machine learning scale. arXiv preprint (XXIv233 2016.
Qinbin Li, Bingsheng He, and Dawn Song. Model-contrastive federated learning. In CVPR, 202
Tian Li, Anit Kumar Sahu, Manzil Zaheer, Maziar Sanjabi, Ameet Talwalkar, and Virginia Smith.
Federated optimization in heterogeneous networks. arXiv preprint arXiv: 2018.
10

---

Under review as a conference paper at ICLR 2022
Xiang Li, Kaixuan Huang, Wenhao Yang, Shusen Wang, and Zhihua Zhang. On the convergence of fedavg on non-iid data. In ICLR, 2019.
Xiaoxiao Li. Meirui Jiang, Xiaofei Zhang, Michael Kamp, and Qi Dou. Fedbn: Federated learning on non-iid features via local batch normalization. arXiv preprint arXiv:2102.07623, 2021b.
Min Lin, Qiang Chen, and Shuicheng Yan. Network in network. In ICLR, 2014.
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In ICLR, 2018.
Brendan McMMaan, Eider Moore, Daniel Ramage, Seth Hampson, and Blaise Aguera y Arcas. Communictiion-eficien learning of deep networks from decentralized data. In AISTATS, 2017.
Yuval Netzer, Tao Wang, Adam Coates, Alessandro Bissacco, Bo Wu, and Andrew Y Ng. Reading digits in natural images with unsupervised feature learning. In NeurIPS Workshop on Deep Learning and Unsupervised Feature Learning, 2011.
Nicolas Papernot, Patrick McDaniel, Xi Wu, Somesh Jha, and Ananthram Swami. Distillation defense to adversarial perturbations against deep neural networks. In 2016 IEEE symposium on security and privacy (SP), 2016.
Amirhossein Reisizadeh, Farzan Farnia, Ramtin Pedarsani, and Ali Jadbabaie. Robust federated learning: The case of affine distribution shifts. In NeurIPS, 2020.
Devansh Shah, Parijat Dube, Supriyo Chakraborty, and Ashish Verma. Adversarial training in communication constrained federated learning. arXiv preprint 113.1:200..01319, 2021.
Aman Sinha, Hongseok Namkoong, and John Duchi. Certifying some distributional robustness with principled adversarial training. In ICLR, 2018.
Haotao Wang. Tianlong Chen, Shupeng Gui, Ting-Kuei Hu, Ji Liu, and Zhangyang Wang. Once- for-all adversarial training: In-situ tradeoff between robustness and accuracy for free. In NeurIPS, 2020a.
Jianyu Wang, Qinghua Liu, Hao Liang, Gauri Joshi, and Vincent Poor. Tackling the objective inconsistency problem in heterogeneous federated optimization. In NeurlPS, 2020b.
Yisen Wang, Xingjun Ma, James Bailey, Jinfeng Yi, Bowen Zhou, and Quanquan Gu. On the convergence and robustness of adversarial training. In ICML, 2019.
Yisen Wang, Difan Zou, Jinfeng Yi, James Bailey, Xingjun Ma, and Quanquan Gu. Improving adversarial robustness requires revisiting misclassified examples. In ICIR, 2020c.
Dongxian Wu, Shu-Tao Tao Xia, and Yisen Wang. Adversarial weight perturbation helps robust general- ization. In NeurlPS, 2020.
Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric P. Xing, Laurent El Ghaoui, and Michael I. Jordan. Theoretically principled trade-off between robustness and accuracy. In /CML, 2019.
Jingfeng Zhang, Xilie Xu, Bo Han, Gang Niu, Lizhen Cui, Masashi Sugiyama, and Mohan Kankan- halli. Attacks which do not kill training make adversarial learning stronger. In ICML, 2020.
Yuchen Zhang, John C Duchi, and Martin J Wainwright. Communication-cffiiicii algorithms for statistical optimization. The Journal of Machine Learning Research, 14(1):3321-3333, 2013.
Giulio Zizzo, Ambrish Rawat, Mathieu Sinn, and Beat Buesser. Fat: Federated adversarial training. arXiv preprint 20112220/. 2020.
11

---

Under review as a conference paper at ICLR 2022
APPENDIX
A PROOF OF EQ. (3) AND THEOREM 4.1
We proof the Eq. and Theorem this section.
Recall the a-weighted relaxation for the inner-maximization objective decomposition with K inde- pendent populations follows.
N₂
AA
max ((f(2n). Un EBe
max 2n EB, [mn]
((f(T)). 1
N
N
Le
R
Na(k)
No(k) N
s.t. 00 1), K 5 K
2 (1+ a)
Σ N
Lo(k) + +11-0)
Σ
Cock)
Jcm R+1
(K),
where (6-) is function which maps the index to the original population group sorted by { % Cx in an ascending order.
proof of Eq. 3.
The deduction of the inequality in Eq. 7 can be formulated in the following. Given 2 with the population sorted by ( L&} in an ascending order, we have Lo(k)- Then, we have the following relationship by subtraction, F((K) S Lk=R+1 N
E [0, 1) and R S
NorM >K1 k= N
R
Nams
K
No(K)
K
Na(k)
R No(1
K Σ
No(k)
Ca(a)
+
Σ
Lolk) - (1+ a
Co(k) (1 a)
Lo(k)
N
N
N
N
k=R+1
k=R+1
K
No(k)
Na(K)
Lo(k)
Co(k))
20
(8)
N
N
J==
R+1
k=1
proof of Theorem 4.1
It can naturally proved by Eq. 8 of > 022 then we have,
No(k)
K
No(k)
L. (R) - L = (1 + 01)
Co(k) + (1 a1)
Lo(K)
N
k=
Jm R+1
R
Nock)
K
No(K)
(1 +
Cock) - 02)
Lo(K)
(9)
N
N
k=1
k=R+1
R
No(k))
K Σ
No(k)
(a1 02)
L((k)
Co(k)
50
N
N
kml
k=
Similarly, we can prove (a) < (R2) R
R2.
B PROOF OF THEOREM 4.2
Based on the convergence of Adversarial Training (Sinha al. 2018), we proof Theorem 4.2 this section.
proof of Theorem 4.2 Lete: x R2 U (o)), where c(x, 2n) the "cost" for an adversary to perturb Zo r. Let (0,0;20) {(0: xr) 70(2, 20), noting that the gradient steps is preformed as
12

---

Under review as a conference paper at ICLR 2022
g' Vef(O', 2;2"), where f is approximate maximizer of f(0, z;; 2²) in x, and @ = 0r pug'
We assume S 1. in the rest of the proof, which is satisfied for the constant step size v L
D
and T 2
By Taylor expansion using the Li -mssmoothness the objective Ls for k-tth client, 5=
have
Cx Cx S Lx + (VLs) or 00+0 -000000-10000 -0¹) +
L.
L
110 0-11
(10)
2
Tn
= - 14 VellVL2 11:12
11g'112 + Me (VLx me VL or - g¹)
2
-Lule or Ht 7 =wue²
[1VCxlo=1
+ pc(1 - L (VLs p. VL - g²) + L0F
11g
VL 1o 11
2
Consider the function o (0; = suPwez [0, x; my), we define the potentially biased errors = Vo0,(0' ;²²). Then we have the following relationship.
Cxlpc11 Sc 1r (1 ---2(
(11)
+ Me(1 - 11) <V VL*llr - -o
-M(( - LWM+ (VLs) (r: 5') + 1 1o'; + VC
-Cx M4 (1 Lw [
+ Mo - () <V VLulor (oo,((';xz))
1x(1 Mx) ) <V ge: :5:)
L
+ 2
11 + V (0';z²)))--)))))'))))))) 22 VV
Since =(a, b) 5 (I|a|12 1/2 + || | have
Lx 11 SLi 8r
14 | L1 |p 1B + me((1 I,)aa) (VL2 VLxlg. (orb) (12)
+ [(1 + (1)
||<12 + L Voo - VLn 10112
Then, letting x = arg max, f(0', rz x²), the error 5¹ satisties,
||<112 =1I 10, x0)=z²) - f ((0, = V Vol(0,x)) - Vol(0,
(13)
2L3 < Le_ || -111 - e,
(14)
where the final inequality utilize the X 7 Lux strong-concavity of x f(0, x; 2o). For conve- 2L3_
nience, let T-=s e. Taking conditional expectations Eq. (12) and using E (0"=
Viklge> we have,
Lxl0r107
Pt 2
V 1 pc((1 + LwHL) ē + Log Vock VL 1r
2
(15)
S - 2
Pt
L p.. + uié + Vo V
VL V
Since μ4 < T.2 ttaking a fixed step size μe we have,
V p1 ?
22 s E Exlor L.o + pu8
(16)
13

---

Under review as a conference paper at ICLR 2022
Because E
Voo, (0:
VLx 00)1
I 8 summing over t, we have,
1
Σ
B V ge [2]
28 =
2
(ox Bol + 2I 20
T
nT
20
+
21
(17)
uT
Since 1
v
and = 7 Lowx we can get the following result, T82
Delta
AL
LA
E [
48
(18)
T
Adopting our a-weighted relaxation, we have,
E
7
R3)
T
2
T
K
N0 ((R)
K
N- o(k)
2
-
Σ
E
|+ a)
V Lock)
+(1
Σ +=R+1
V Cocks
N
N
R
(t)
K
(-
17
Σ
(1+
((k)
N E
VL 0z
+ (1 a)
Σ
((R)
E
Cock)
C
N
R+1
x
Σ
(1+ 0)
K
(+)
(())
+ (1
- a)
Σ
K
N:(e) d(R)
4L2
c
A8
LA
N
N
X
T
R+1
-
T
1 a
1=
NO
((k)
E R+1 N(1)
((K)
4L2EC c
+ 46
LA
N
T
Σ. {())
ALL.C + 481
LA T
1 T
N
(19)
where g(t) <0)=>x k==1
=kk
Nr(1) d(k)
EK
N(1) kk=R+1 R+1 o(k)
to simplify the notations.
C PROOF OF THEOREM 4.3
Based on the convergence of FedAvg (Li et al. 2019), we proof Theorem 4.3 in this section.
First, we make the following assumptions and present some useful lemmas. Specifically, we make the following assumptions. Assumption C.I and C.2 are standard (typical examples are the -orm
regularized linear regression, logistic regression, or softmax classifier). Assumption C.3 and C.4 have
been made by the previous works (Zhang et al. [003]] [.] et al., 2019).
Assumption C.1. L1,
LK are all L-smooth: for all v and w, Lx(v) S Lx(w) + (v
V (w) + 1|u w112.
Assumption C.2. L1. LK are all X-strongly convex: for all v and w, Lx(v) 2 (w + (w
VLL 1|l w|l2.
Assumption C.3. Let et be sampled from the k-th device's 's local data uniformly at random. The
variance of stochastic gradients each device is bounded: V {t) VL < 8 for k = 1,... ..
Assumption C.4. The expected squared norm of stochastic gradients is uniformly bounded, i.e. V (w E) E 22 for all is 1,... K and = 1....
14

---

Under review as a conference paper at ICLR 2022
We use the following lemmas proved by Li et al. (2019). Let of denotes the model parameter main- tained in the k-th client at t-th step, θ represents an immediate result of one step SGD update from No of. For convenience, we define θ Σ N O 0r == Ex= N Nr. 9t-
> N (Of)
and 9t k== N VL (0f, <²). Therefore, Eg: 9t.
Lemma C.1 (Results of one step SGD). Assume Assumption C.I and C.2
mf S IL
we have
B| 0-11² 2 (1 The A)B 0-12
(20)
N2 N
ف وو 3e112 + 6Lm + 2E
10, 0/
E, where r = L- -x
Lemma C.2 (Bounding the variance). Assume Assumption
C.3
It follows that
K
N
E 19: Bell
S
(21)
N
k=1
Lemma C.3 (Bounding the divergence of 0.). Assume Assumption C.4 and rj S 20+ for all >> 0. It follows that
that tpe is non-increasing
Nk
E
110 - 1/111
S <4n -
1)
(22)
N
proof of Theorem follows that
Let A. = E110, - 0r 11a From Lemma
C.I
Lemma C.2 and Lemma C,3
A++1 (1 n1)d + B
(23)
where,
p (T)
2
No
K
p(T) NO a
B
6k
+6L
C Σ
C +8E 1)25, (24)
1 a c(T)
N
c(T)
N
p(T)
2
p(T) Ita e are acted as the scalar timing by the personalized variance bound 8
and
and
14a ctry
and the local optimum Lg of each client.
For diminishing stepsize, T)+ 7++ for some B > and y > 0 such that m S minn + ) + v
8'B and 7/, S 27++.. We will prove that A. S 748. where v = max BX-T (7 + 1)A1}. The above can be proved by induction. Firstly, the definition of v ensures that it holds for = 1. Assume the conclusion holds for some t, it follows that,
D < (1 A,
+ t B
B²B
$ (1 8 t+g
t t+g (t+ 7)2
++ -1
BA 1 (1 (1+ 7)
BB
(25)
V+
71+
++ 7 i1
Then by the L-smoothness of L(.).
L v
B|C,] L < A. -
(26)
2
2 2
Specifically, if we choose 8 = x max (8 L
A E}- - 1 and denote x = 4. then 1/- = 2 - One
can verify that the choice of satisfies 111 < 21/ F for 1 2 1. Then we have
B²B
BB B
4B + +(
max
BB 1
174)
< 31 -
+ (7 1)41 S
(27)
X2
15

---

Under review as a conference paper at ICLR 2022
and
[[C) L L S K
2B 1
+
11
(28)
2 7+6 X 2
D LEARNING FRAMEWORK AND ALGORITHM
Sart
Welghtte/AAvaaae
Server
+
1
JO
Clients
N1 N
N2 IV
Ng-1 N
Ax N
4g
Eic-
Lx
0
05
0
Figure 5: A brief illustration of our a- o--eiigted Federated Adversarial Training (a-WFAT) framework. On the client-side, each client will conduct adversarial training with its local data and update the optimized model parameter (t.e., 0g) with the adversarial loss (t.e., N' Cx))). )). On the server-side, after collecting the model parameters and the loss value (information of the robustness), the server will conduct an ascending sort and aggregate the global model with weighted average (denoted by () which upweights the top populations of the robust client's ' model parameters with a.
Here, we provide an intuitive illustration of our proposed a-WFAT in Figure Based on the a- weighted mechanism, we provide new flexible framework for the combination of adversarial training with federated learning. It is orthogonal to a variety of different adversarial training (Zhang et al.
2019
Wu et al. [2020; Zhang et al., 2020) Chen et al. 20200 2021 Wang et al.) [202aa] Jiang et al. 2020 Wang et al. 2020c) methods and federated learning algorithms (Li et al. 2018 [018|Ke Kairouz et al.
2019 Hong et al. 2021) which gain the adversarial robustness alleviate the data heterogeneity on
the client side, and can be simply but effectively combined with other approach.
E EXPERIMENTAL DETAILS
Dataset. We conduct the experiments on three benchmark datasets, i.e., SVHN (Netzer et al. 2011);
CIFAR-1O and CIFAR-I00 (Krizhevsky) 2009) for federated adversarial training. For the IID scenario,
we randomly distribute these datasets to each client. For simulating the Non-IID scenario, we follow McMahan al. (2017: Shah et (2021) distribute the training data based on their labels. To be specific, a skew parameter is utilized in the data partition introduced by /Shah et al. (2021). which enables K clients to get majority of the data samples from subset of classes. We denote the set of all classes in a dataset as )' and create Yı. by dividing all the class labels equally among K clients. Accordingly, we split the data across K clients that each client has (100 (K 1) x 8) % of data for the class in 3%k and 5% of data in other split sets. In our experiments, set = 2 for simulating the Non-IID partition with clients as [Shah et al. (202I) recommended.
Training and Evaluation. architectures, i.e., NIN (Lin et al. 2014) for CIFAR-1O, ResNer-18 (He et al. (0166) for CIFAR- 100 and Small CNN (Zhang et al.) (2020) for SVHN. For the local training batch size, we set 32 for CIFAR- 10, 128 for CIFAR- 100 and SVHN. For the training schedule, SGD is adopted with 0.9 momentum for 100 communication rounds under clients as (Hong et al., 2021 Shah et al. 2021). and the weight decay 0.0001. For adversarial training, we set the configurations of PGD respectively (Madry et al.) 2018) for different datasets. On CIFAR-IO/CIRR
the experiments. follow the previous works leverage the same
100, we set the perturbation bound 8/255, the PGD step size 2/255 and set the PGD step number 10. On SVHN, set the perturbation bound = 4/255, the PGD step size 1/255, and keep the same step number 10. Regarding the evaluation, the accuracy for the natural test data and that for the adversarial test data computed
16

---

Under review as a conference paper at ICLR 2022
Table Brief summary of the experimental details about a- WFAT
Dataset
Network
K
K
CIFAR-10
NIN (Shah al. 2021)
5
1
1/6
CIFAR-100
ResNet-18 CChn al.
2021
1/41
SVHN
SmalICNN Zhang et al.
2019)
5
1/11
following Wang et al. (2019); Wu et al. (2020). Note that, the adversarial test data are generated by FGSM, PGD-20, C& W (Carlini & Wagner (017)) attack with the same perturbation bound and step size as the training. All the adversarial generations have a random start, i.e, the uniformly random perturbation of [-e, E| added to the natural data before attacking iterations. Besides, we also report the robustness under stronger AutoAttack, termed as AA simplicity.
As for our a- a-F,,, different training tasks adopt different a-weighted mechanism considering different characteristic of local training data, we set 1/6 (i.e., I-a
I 1.4) for the experiments
on CIFAR-10, 10, and a 1/41 (i.e., I+a = 1.05) for the experiments on CIFAR- 100 and = 1/11 (i.e., 1+a 1-a 1.2) for the experiments on SVHN. As for FedProx, set μt 0.01 for each dataset and a for a-weighted mechanism are 1/11, 1/41, and 1/11. As for Scaffold, the a adopted for previous datasets are 1/11, 1/101 and 1/11 respectively.
I-a
As for the choice of the apper-parameter a, one useful way to set might be progressively probing its effect in value-growth manner. When the degenerate the original objective of FAT, so does the performance with no harm. Slightly enlarging a can improve the performance due to the benefit of the bias-varian variance trade-off, and then make stop in one point where the performance becomes drop.
very small, the objective will approximately
E.1 EMPHASIZE/DE-EMPPAASS IN OUR a- WFAT
We conduct an empirical comparison between a- WFAT that emphasizes (relatively de-emphasize the other clients) the client model with the smallest loss and contrary variant that de- de-emphasizes (relatively emphasize the other clients) as follows. We find that de-emphasizing the client with smallest loss (relatively emphasize those with larger loss) consistently harm the model performance across these evaluations.
Table 4: Comparison with emphasiiz/dde-emphasiic the client with smallest loss.
Setting
Non-IID
CIFAR- 10
Natural
FGSM
PGD-20
CW
a-WFAT:
Ita
1.4
emphasize
63.44 %
45.13%
37.17%
33,99 %
a- a-WFAT:
+0
= 1.2
emphasize
62.26%
44.08%
35.83%
33.31%
FedAvg
FAT: 1.0
I-Q
original
57.45%
39.44%
32.58%
30.52%
1-a
WFAT:: 0.8
dc-emphasize
50.45%
34.34%
27.86%
26.62%
G- -FAT:: = 0.6
de-emphasize
40.47%
28.81 %
24.36%
23.19%
SVHN
Natural
FGSM
PGD-20
CWW 20
a-WFAT:
1+a
1.4
emphasize
90.60%
87.75%
73.12%
70.51 %
T-G
a- :-WEAT:
1+Q
1.2
emphasize
91.25 %
88.28%
71.72%
69.79%
FedAvg
FAT:
1.0
original
91.24%
87.95%
68.87%
67.89%
WFAT:
0.8
de-emphasize
90.03%
86.12% 12%
64.35%
64.32%
a- WFAT:
1-Q = 0.6
de-emphasize 89.46%
84.80%
58.64%
58.96%
17

---

Under review as a conference paper at ICLR 2022
E.2 MEAN AND STD RESULTS OF THE NON-IID SETTINGS
Considering that the Non-IID results are sensitive to the selection of data in each client, we conduct our experiments Non-IID settings for multiple times and conclude the results follows. In summary, our a- F-WT can consistently improve the model robustness with comparable or even better natural performance than previous federated optimization methods.
Table Performance on Non-IID settings under different federated optimization methods Stdd.
Setting
Non- IID
CIFAR-10
Natural
FGSM
PGD-20
CW
AA
58.1340.68%
40.06:10.66
32.56=1.001%
30.88-0.37%%
19.17=-0.03%
FedAvg
WFAT
63.36::0.07 %
44.82:10.32 %
37.14=0.03%
33.39=0.611
31.66=0.70%%
FAT
59.95=0.45%%
41.44+0. 15%
33.83=0.011
31.65=0..36%
30.1 -0.00%
FedProx
WFAT
62.04 %
44.21110.08% %
36.64=10.11% %
32.62:10.20%
3..53=
61.4411.37%%
42.85:10.769
34.08=0.0055
32.56=#0.02%
31.03-10.08 0.08%
Scaffold
WFAT
63.16:10.96%
45.55++0.50%
37.33=0.02%
34.82=0..4%
33.32-10.01 %
CIFAR- 100
Natural
FGSM
PGD-20
CW
AA
FAT
31.93
20.04-10.44%
1..1%%
13.65 +0.28%
12.70=H0.03%
FedAvg
WFAT
34.80-10.37%
10.911100.5%%
16.66 0.06 %
13.78: 0.13%
12.79
0.04%
FAT -FAT
34.07.10.74 %
20.49 20..99110.2991
16.20:10.122 0.%2%
(6.16.000000 06%
12.67 0.008
FedProx
33.95+00.39
20.86-1-0.40% %
16.73+0.011 %
13.80-00044%
12.80- 0.02%
FAT
39.89 1.28%
14.78-1:0.4095
19.82.1..22
16.73-+0.015
15.51 -.002%
Scaffold
WEAT
39.80:1 1.27%
25.05:100.55 %
20.27 : 0.13%
16.79: : 0.01
15.58 %
SVHN
Natural
FGSM
PGD-20
CW 3c
AA
FAT 91.52-10.28 %
88.13310.188 18%
68. 16.98.00.111 11%
68 08.5%
66.5910.044 0.04
FedAvg
Q- WEAT
91.26:10.01 %
88.27:10.02 %
7..04=1..22% %
69.96-10.16%
68.89 %
FAT WEAT
91.00=10.088
$7.65=+0.154
68.48=000045
67.16=#0.02%
65.76=00.188 6..84
FedProx
91.19110.06%
88.15:10.01 %
0.33%
69.88
EAT 90.82-10.887
87. 77.89910066644
69. 09.51110.8459
08.122-0.888 88%
67. 0.54%
Scaffold
Q- WEAT
90.93-10.764%
$8..271:0.45 %
7..77=10.8%%
69.49-10.67%
68.37-10.48% %
18


Reviews:
[{"review_id": "oHbH5q4oE4", "reviewer": "Reviewer_4Hkz", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "Strengths:\n(1) It relaxed the inner-maximization of Federated Adversarial Training by emphasizing the clients which could produce the larger margin for the decision boundary.\n(2) It proposed a novel \\alpha-Weighted Federated Adversarial Training approach, and provided its convergence in FL setting.\n(3) The experiments showed that the proposed approach outperformed baseline FAT.\n\nWeaknesses:\n(1) The motivation of the relaxation on Federated Adversarial Training is counterintuitive. When \\alpha-WFAT minimizes the lower bound of the FAT loss, it achieves much better performance than the original FAT. It implies the loss of FAT might include some reductant terms in the context of federated learning. In addition, it needs more discussion regarding the rationality of FAT in the non-IID FL, as federated learning is originally designed for IID centralized setting.\n(2) The \\alpha-weighted mechanism of Eq. (3) is not well motivated. Following the motivation in section 4.1, it simply emphasizes the client with the smaller loss. This is more directly correlated with the discrimination of the adversarial examples, instead of the margin that measures the uncertainty of predicting the adversarial examples.\n(3) The experiment indicated that the hyper-parameter \\alpha could significantly affect the model performance. But the selection or estimation of \\alpha in the proposed FL method is not clear.\n(4) The non-IID results are sensitive to the selection of data in each client. Thus it is better to report the results (mean and standard deviation) after running the experiments for multiple times.\n(5) Some related works of adversarially robust federated learning are not discussed. For examples, some of them pointed out that local clients have limited computational resources to afford the local adversarial training. In this case, how would \\alpha-WFAT determine the weight when some of them could only upload the standard training parameters?\n[ref 1] Shah, Devansh, Parijat Dube, Supriyo Chakraborty, and Ashish Verma. \"Adversarial training in communication constrained federated learning.\" arXiv preprint arXiv:2103.01319 (2021).\n[ref 2] Reisizadeh, Amirhossein, Farzan Farnia, Ramtin Pedarsani, and Ali Jadbabaie. \"Robust Federated Learning: The Case of \nAffine Distribution Shifts.\" In NeurIPS. 2020.\n\nSome other concerns:\n(1) The \\Tilde(x) in Theorem 4.2 is not defined. In this theorem, what would the index “t” and “k” start from?\n", "summary_of_the_paper": "This work studied the limitation of conventional Federated Adversarial Training approach, and proposed an \\alpha-weighted relaxation for Adversarial Training in the federated learning setting. Then it proposed a novel \\alpha-Weighted Federated Adversarial Training for minimizing a lower bound of the inner-maximization in Federated Adversarial Training. The performance of the proposed \\alpha-Weighted Federated Adversarial Training were validated for both IID and Non-IID federated learning settings.", "summary_of_the_review": "The proposed techniques are not well motivated. The rationality of the proposed method on non-IID FL setting needs more explanation.", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "h8E9kBjtKr6", "reviewer": "Reviewer_4ioa", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "Despite reasonable performance improvement, I am not convinced by many of the claims made by this paper:\nIt claims the biased adversarial generation in the local machine causes the issue in FAT. But the adversarial x tilde is purely determined by the current estimation of theta, and during the training, no local machine knows the optimal theta. So technically, adversarial samples are always biased, even for centralized adversarial training. \n\nIn the discussion of figure 2, I don't understand why hard-to-train local machines may \"over-optimize\" their model. Does the \"over-optimize\" mean \"overfit\" the local data? If so, then the whole argument applies to federated standard training as well, and the alpha-weighted mechanism shall improve federated standard training. But the authors clearly say that the alpha-weighted mechanism doesn't work for federated standard training.\n\nOn the other hand, does hard-to-train local data contain more valuable information of the real decision boundary, since data is close to the boundary? Therefore, they should be emphasized rather than de-emphasized.\n\nSeveral notations are unclear, for example\nL-smoothness: l(.,.) is L-smoothness. Do you mean l(f_theta(.),.) is L-smooth w.r.t. theta uniformly for all tilde x and y?\nThm 4.2: E|\\nabla L^\\alpha(\\hat K)-\\nabla_\\theta(f(\\tilde x),y)|^2, what's the tilde x and y, one random sample?\nThm 4.3: E|\\theta^0-\\theta^*|^2 term. What is the meaning of this expectation?", "summary_of_the_paper": "This paper introduces the alpha Weighted Federated Adversarial Training algorithm. The key of the idea is that in the aggregate step, the center prefers the local machine that yields smaller lost. Some theoretical results are delivered with numerical experiments. The paper claims that the alpha-weighted mechanism is tailored for the inner-maximization of Federated Adversarial Training, which is the rationale of the whole work.", "summary_of_the_review": "Empirical results are good, but the rationale of the proposed method is unclear and not well explained. The theoretical results don't justify the method, instead, within the proposed context, justify algorithmic convergence.", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "2: Several of the paper’s claims are incorrect or not well-supported.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "4: The contributions are significant, and do not exist in prior works."}, "extra_text": {}}, {"review_id": "Nqjb0TyvusW", "reviewer": "Reviewer_1hs3", "summary": "", "questions": "", "limitations": "", "rating": 8, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "Pros:\n\n1. This paper is the first to solve the robustness-drop problem in federated adversarial training. It has great practical impacts to real-world applications. \n\n2. The authors provided an intuitive assumption on the cause of robustness-drop problem, which is further verified by the experiments. \n\n3. The proposed \\alpha-weighted federated adversarial training method is technically solid, easy to implement, and empirically achieves good performance under multiple different adversarial training and federated learning settings. \n\n4. Ablation studies show the proposed model is robust to hyper-parameter choices. \n\nSuggestions:\n\nI don't see any obvious cons of this paper. One piece of suggestion is that, if your assumption on the cause of the robustness-drop phenomenon is correct, maybe combining \"benign adversarial examples\" [1] with \\alpha-WFAT can even further improve performance. The intuition is that \"benign adversarial examples\" may not amplify the distribution heterogeneously so much as the traditional harsh adversarial samples. \n\n[1] Attacks Which Do Not Kill Training Make Adversarial Learning Stronger. \n", "summary_of_the_paper": "This paper tackles an important problem in federated adversarial training: robustness accuracy significantly drops at the later stage of training. The authors first raise their assumption for the cause of this phenomenon: Adversarial training amplifies the heterogeneity of data distributions across different clients, and overfitted local robustness can not well generalized to other clients. Based on this assumption, the authors proposed \\alpha-weighted federated adversarial training, which essentially up-weights the model trained on benign distributions and down-weights those on harsh distributions when averaging them up at the cloud center. Results show the proposed method outperforms previous state-of-the-arts under different adversarial training and federated learning settings. ", "summary_of_the_review": "A solid paper providing the first solution for an important problem in federated adversarial training. ", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "4: All of the claims and statements are well-supported and correct.", "technical_novelty_and_significance": "4: The contributions are significant, and do not exist in prior works.", "empirical_novelty_and_significance": "4: The contributions are significant, and do not exist in prior works."}, "extra_text": {}}, {"review_id": "52ghZVMX56D", "reviewer": "Reviewer_m6tB", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "The paper tackles an interesting direction in federated learning, and is well-organized. Overall, I enjoyed the paper itself and the presentation of ideas, but I do think the contribution is incremental. I listed the detailed questions and suggestions below.\n\n1. What is the detailed settting for Fig 1? What is the AT method used for training, PGD-AT or TRADES? Is the dataset here non-IID or IID? PGD-20 or PGD-10?   \n2. The novelty of this paper is incremental. It adopted the weighting strategy. I am wondering whether the global model can be trained well in such a way.  \n3. Many federated learning settings have much larger client numbers (thousands or even millions, only 5 clients in this paper, ), and it is unclear if the proposed solution scales.  Besides, only a slight improvement can be seen in Tabel 2.\n4. This method doesn't make sense to me, especially for Fig 2. The motivation for the specific weighting chosen was not very clearly explained. \n\n", "summary_of_the_paper": "The authors explore the adversarial robustness of federated learning. They claim that the inner-maximization optimization of AT can exacerbate the data heterogeneity among local clients. They propose an algorithm, $\\alpha$--WFAT, which relaxes the inner-maximization of Adversarial Training into a lower bound friendly to Federated Learning.. The authors also experimentally establish that federated learning models are most susceptible to attacks when clients are using non-IID training sets. The experiments are performed over the CIFAR-10 , SVHN and CIFAR-100datasets.", "summary_of_the_review": "The paper tackles an interesting direction in federated learning, and is well-organized. Overall, I enjoyed the paper itself and the presentation of ideas, but I do think the contribution is incremental.", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}]

Author rebuttal:

Meta-review: This manuscript proposes and analyses a weighting approach to improve the conformance of adversarial training in federated learning. The authors observe that adversarial training seems to degrade during the late stages of training, and suggest that this degradation is a consequence of exacerbated cross-device bias in federated averaging. They suggest and analyze a weighted scheme to fix this issue.

During the review, the main concerns are related to the novelty of the work compared to existing work, the clarity of the technical contributions, and unclear technical statements. The authors respond to these concerns and partially satisfy the reviewers. After discussion, reviewers remain mixed, with multiple weak rejects and one strong accept. No fatal flaws are noted. 

The opinion of the area chair is that while there are no fatal flaws, there is very limited enthusiasm for this paper. This limited enthusiasm seems to be a result of intuition for observed phenomena that seem incorrect or insufficient to reviewers. Overall, I think this paper outlines and addresses an interesting issue of real concern. Flaws in the intuition building/explanation, and issues with clarity of presentation need to be improved for this work to have some impact.
Decision: Reject