FADE: Enabling Large-Scale Federated Adversarial Training on Resource-Constrained Edge Devices
Authors: Minxue Tang
Jianyi Zhang
Mingyuan Ma
Louis DiValentin
Aolin Ding
Amin Hassanzadeh
Hai Li
Yiran Chen
Venue: Submitted to ICLR 2023 (2023)
Keywords: Federated Learning
Adversarial Training

Abstract: Federated adversarial training can effectively complement adversarial robustness into the privacy-preserving federated learning systems. However, the high demand for memory capacity and computing power makes large-scale federated adversarial training infeasible on resource-constrained edge devices. Few previous studies in federated adversarial training have tried to tackle both memory and computational constraints at the same time. In this paper, we propose a new framework named Federated Adversarial Decoupled Learning (FADE) to enable AT on resource-constrained edge devices. FADE decouples the entire model into small modules to fit into the resource budget of each edge device respectively, and each device only needs to perform AT on a single module in each communication round. We also propose an auxiliary weight decay to alleviate objective inconsistency and achieve better accuracy-robustness balance in FADE. FADE offers a theoretical guarantee for convergence and adversarial robustness, and our experimental results show that FADE can significantly reduce the consumption of memory and computing power while maintaining accuracy and robustness.

Under review as a conference paper at ICLR 2023
FADE: ENABLING LARGE-SCALE FEDERATED AD- VERSARIAL TRAINING ON RESOURCE-COOSTRRAINED EDGE DEVICES
Anonymous authors Paper under double-blind review
ABSTRACT
Federated adversarial training can effectively complement adversarial robustness into the privacy-preserye federated learning systems. However, the high de- mand for memory capacity and computing power makes large-scale federated adversarial training infeasible on resource-constraing vious studies in federated adversarial training have tried to tackle both memory and computational constraints at the same time. In this paper, we propose new framework named Federated Adversarial Decoupled Learning (FADE) to enable edge devices. FADE decouples the entire model into small modules to fit into the resource budget of each edge device respectively, and each device only needs to perform AT on single module in each communication round. We also propose an auxiliary weight decay to alleviate objective incon- sistency and achieve better accuracy-robustness balance in FADE. FADE offers a theoretical guarantee for convergence and adversarial robustness, and our ex- perimental results show that FADE can significantly reduce the consumption of memory and computing power while maintaining accuracy and robustness.
edge devices. Few pre-
AT resource-constraing
INTRODUCTION
As privacy-preserving distributed learning paradigm, Federated Learning (FI.) makes meaningful step toward the practice of secure and trustworthy artificial intelligence (Konečný al. 2015 2016 McMahan et al., 2017 Kairouz et al.] 2019). In contrast to traditional centralized training, FI. pushes the training to edge devices (clients), and client models are locally trained and uploaded to the server for aggregation. Since private data is shared with other clients the server, FL substantially improves the data privacy during the training process.
While FL can preserve the privacy of the participants, other threats still impact the reliability of the machine learning model rumning on the FL system. One of such threats is adversarial samples, misclassifications of the model by adding imperceptible noise into the input data (Szegedy et al. 2013] Goodfellow et al.] 2014). Previous research has shown that performing adversarial training (AT) on a large model an effective method to attain robustness against ad- versarial samples while maintaining high accuracy on clean samples (Liu et al.) 2020). However, large-scale AT also puts high demand for both memory capacity and computing power, which is affordable for some edge devices with limited resources, such as mobile phones and IoT devices, in FL scenarios (Kairouz et al. 2019 Li al. 2020 Wong et al. 2020 Zizzo et al.) 2020 Hong et al. 2021). Tablle shows that strong robustness of the whole FL system cannot be attained by allowing only small portion (e.g.. 20%) of the clients to perform AT. Therefore, enabling resource- constrained edge devices (which usually contribute the majority of the participants in cross-device FL (Kairouz et al. 2019)) to perform AT is necessary for achieving strong robustness in FL.
which aim
Some previous works have tried to tackle client-wise systematic heterogeneity in FL (Li al. 2018
Lu et al. 2020: Wang et al. 2020b Xie et al. 2019). The most common method to deal with the allow them performing less epochs of local training than the others (Li et al. 2018 Wang et al. 2020b). While this method can reduce the computational costs on the slow devices, the
slow devices
memory capacity limitation edge devices has not been well discussed in these works.

---

Under review as a conference paper at ICLR 2023
Table I:
Results of partial federated adversarial training with 100 clients. "20% AT + 80% ST
means that 20% clients perform AT while 80% clients perform standard training (ST).
FMNIST (CNN-7)
CIFAR-10 (VGG-11)
Training Scheme
Natural Acc. Adversarial Acc.
Natural Acc.
Adversarial Acc.
100% AT + 0% ST
78.39%
66.93%
64.73%
33.27%
20% AT + 80% ST
83.83%
48.61%
74.77%
19.22%
To tackle both memory capacity and computational constraints, recent studies propose a novel train- ing scheme named Decoupled Greedy Learning (DGL) which decouples the entire neural network into several small modules and trains each module separately (Belilovsky et al. 2019 Wang et al., 2021]. DGL can be naturally deployed in FL since the training of decoupled modules can paral- lelized on different computing nodes (Belilovsky et al. 2020). However, vanilla DGL only supports unique model partition on all computing nodes, which cannot fit into different resource budgets of different clients in heterogeneous FL. Additionally, no previous studies have explored whether DGL can be combined with AT' to confer joint adversarial robustness the entire model. It is not trivial to achieve joint robustness of the entire model when applying AT in DGL., since modules are trained separately DGL with different locally supervised losses.
In this paper, we propose Federated Adversarial DEcoupled Learning (FADE), which is the first adversarial decoupled learning scheme for heterogeneous FL. Our main contributions are:
1. We propose more flexible decoupled learning scheme for heterogeneous Federated Learn- ing, which allows different model partitions on devices with different resource budgets. We give a theoretical guarantee for the convergence of our Federated Decoupled Learning.
2. We propose Federated Adversarial DEcoupled Learning (FADE) to attain theoretically guaranteed joint adversarial robustness of the entire model. Our experimental results show that FADE can significantly reduce the memory and computational requirements while maintaining the natural accuracy and adversarial robustness as joint training.
3. We analyze the trade-off between objective consistency (natural accuracy) and adversarial robustness (adversarial accuracy) in FADE, and we propose an effective method to achieve a better accuracy-robustnes balance point with the weight decay on auxiliary models.
PRELIMINARY
Federated Learning (FL) FL. different clients collaboratively train shared global model ur with locally stored data (McMahan et al. (017)) The objective of FL can be formulated as:
N
N
min L(w)= = Σ, D k= (o.y)ED,
Σ
1(x, y: w) Σ qa LaLx(ul (w),
(1)
where (uww)=
1
Σ
l1x, y: w) (( [xx y: w)],
(2)
(æ.v)EDz
and / is the task loss, e.g., cross-entropy loss for classification task. D3 the dataset of client and its weight = D& I/C: [D::). To solve for the optimal solution of this objective, in each communication round, FL first samples subset of clients {(t) to perform local training. These clients initialize their models with the global model w (o((..) (()) and then run iterations of local SGD. After all these clients complete training in this round, their models are uploaded and averaged become the new global model (McMahan al. 2017). We summarize this procedure as follows:
(++1) w k
(t)
VL (wo (
M
1=0
w (I+1)
(1+1)
(4)
Eiestes qi
kgg
(1.) is the local model of client i the j-th iteration of round where ung
2

---

Under review as a conference paper at ICLR 2023
Adversarial Training (AT) The goal of AT is achieve robustness against small perturbation in the inputs. We define (c, co-rousstsssss as follows:
Definition 1. We say model w is (e, crobusst in loss function l at input if
Vδ E {ō || S l, + ô, w) ((2, y; w) S
(5)
where || llp is the Ep norm of a vector and is the perturbation tolerance.
AT trains a model with adversarial samples achieve adversarial robustness, which can be formu- lated as min-max problem (Goodfellow et al.) 2014 Madry et al. 2017):
min max 1(x + 6, y; w)).
8:116 p0
To solve Eq. people usually alternatively solve the inner maximization and the outer minimization. While solving the inner maximization, Projected Gradient Descent (PGD) is shown introduce the strongest robustness AT (Madry et al. 2017. Wong et al. 2020 Wang et al. 2021
Decoupled Greedy Learning (DGL) The key idea of DGL is to decouple the entire model into several non-overlapping small modules. By introducing a locally supervised loss to each module, load and train each module independently without accessing the other parts of the entire model (Belilovsky et al. 2019 2020). This enables devices with small memory to train large models.
As shown in Fig- D each module usually contains tiple adjacent layers wm of the backbone neural network, together with small auxiliary model P. that provides locally supervised loss. We denote @m = (Wm, 0m) to be all the parameters in mod- ule m. Module m accepts the features 2m-1 from the previous module as the input, and it outputs features 2m fm (2m-1; w.) for the following modules, as well as a locally supervised loss y;
mul-
4m-1
Zm
4m
Wm
Figure An illustration the module
(m(2 (m(2m-1,22 y; O m At epoch the averaged locally supervised loss
I T will be used for training this module:
(O E (= (n y e
Different from joint training, the input of one module can various in different epochs in DGL since we may keep updating the previous modules during training. Thus we use (!)) to denote the inputs module m in epoch t, and only the input of the first module 2 = x is invariant.
For each module model as (2 1/; )..)) Im (#m-1, 1, y: Om., and the loss function of its following layers in the backbone network as i'm (zm, yi Wm+1. war) = I(xx, y/: wi. wM) ). Without specifying, we will omit all parameters (Wm, On and ).)) in the following sections for notation simplicity.
f1,2, MM in the entire model, define the loss function of its auxiliary
3 FEDERATED ADVERSARIAL DECOUPLED LEARNING
In this section, we present our method, Federated Adversarial Decoupled Learning (FADE), which aims at enabling all clients with different computing resources to participate in adversarial training. We first introduce Federated Decoupled Learning (FDL) with flexible model partitions for heteroge- neous FL in Section 3.1. and we also give convergence analysis for it. In Section 3.2 integrate AT into FDL to achieve joint adversarial robustness of the entire model, and we give a theoretical
guarantee for its robustness. In Section 3.3] discuss the objective inconsistency in FDL and propose an effective method to achieve a better accuracy-robustness balance point.
3.1 FEDERATED DECOUPLED LEARNING
In cross-device FL., the main participants usually small edge devices who have limited hardware resources and may not be able to afford large-scale AT that requires large memory and high com-
puting power (Li al. 2018 Kairouz et 2019 Li et al. 2020: Wang al. 2020b). A solution
For simplicity, without specifying P. use for l2 norm. Our conclusions in the following sections be extended to any lp norm with the equivalence of vector norms.
3

---

Under review as a conference paper at ICLR 2023
FIII
Layer
(Auxiliary) Output Model
Module
Figure 2: A framework of Federated Decoupled Learning. In contrast to the original unique parti- tion (Belilovsky et al.) (020), we allow different model partitions among devices according to their resource budgets. In each communication round, each device randomly selects one module (high- lighted) for training, and then the updates of each layer will be averaged respectively.
tackle the resource constraints edge devices is deploy DGL in FL., where each device only needs to load and train a single module instead of the entire model in each communication round. However, the vanilla DGL only supports a unique model partition on all the devices (Belilovsky et al. 2020). Considering the systematic heterogeneity, we would prefer various model partitions to fit into different resource budgets of different clients. A device with limited resources (such IoT device) can train small modules of the entire model, while device with more resources (such as mobile phone or a computer) can train larger modules or even the entire model.
Accordingly, we propose our Federated Decoupled Learning (FDL. framework as shown in Fig. We denote the set of all modules on client & as Mg, while MI, * M, if client is using different model partition from client j. Here, we consider the update and aggregation rule for each layer with parameter wn in the model, since one single layer the "atom" FDL and cannot be further decoupled. We use m& (n) to denote the module on client that contains this layer, and we define Ln,k (m), as the locally supervised loss for training this layer. each communication round t, each elient & randomly samples a module my from Mj, for training (Eq. 8h. After the local training, the updates of each layer will be averaged over clients in s! respectively, where s(t) is the set of clients whose trained module mn contains layer n this round 9h.
((+1) w n,k
Whi (1)
(t)
T/t
Σ
V
if E m elsewhere.
(8)
Wn
w ((+1))
Σ
(c+1) n,k
where
s(O)
[k: e :ne mf).
Eiesto q
kEal!
Theorem guarantees the convergence of FDL, while the full version with proof is in Appendix A Theorem 1. Under some common assumptions, for any layer n in the entire model, its locally supervised loss Ln EE guLnnk can converge Federated Decoupled Learning:
lim inf E V.. T ITT
(10)
Theorem I can guarantee the convergence of locally supervised loss L., However, because of the existence of the objective inconsistency |/VL VL, O, we cannot guarantee the convergence of the joint loss L with this result. We discuss the objective inconsistency in Section 3.3] and show how we can reduce this gap such that we can make the joint loss gradient VL smaller when the locally supervised loss I,, converges.
4

---

Under review as a conference paper at ICLR 2023
3.2 ADVERSARIAL DECOUPLED LEARNING
Adversarial decoupled learning can achieve local robustness of each module by performing AT in each module m separately their locally supervised loss:
min max Im (2m-1 + mm 1 y; mm) subject to ||6m-1|l S 6m-1-
(11)
@ 6m-1
However, there are two concerns that have not been addressed in adversarial decoupled learning:
Since different modules are trained with different locally supervised losses, can local ro- bustness of each module guarantee the joint robustness of the entire (backbone) model?
2.
When applying AT on module m. what value of the perturbation tolerance 6m-1 should we use to ensure the joint robustness of the entire model?
Theorem reveals the relationship between the local robustness of each module and the joint bustness of the entire model, and gives a lower bound of the perturbation tolerance 1 for each module to sufficiently guarantee the joint robustness. Theorem 2 is proved in Appendix B.
Theorem 2. Assume that Im (m, y) pm -stongly convex in for each module m. If each module M has local (6m-1, Cm.) rrobustness in Im (Zm-1, and
Vm S M, Cm
9m
+1
V
2cm
+
Pn.
where 9m || sm I' (Zmm v)
(12)
P.m.
pm
then guarantee that the entire model has a joint (M..CM))reen rrbbustessss in ((x, y).
Remark 1. In Theorem we assume that the loss function of the auxiliary model i'm (zm y) is strongly convex in its input 2m. This assumption is realistic since the auxiliary model is usually very simple model, e.g., only linear layer followed by cross-entropy loss. We also theoretically analyze the sufficiency of a simple auxiliary model in Section 3.3 (See Remark 2).
Theorem shows that a larger pm and a smaller Im will lead stronger joint robustness of the entire model, since the lower bound of ém becomes smaller for ensuring the joint robustness. In Section 3.3 we further discuss how we can control these two parameters to attain better accuracy- robustness balance with the weight decay on the auxiliary model.
3.3 OBJECTIVE INCONSISTENCY AND SECCURACY-ROBUSTIINE TRADE-OFF
As we mentioned in Section 3.1 there exists objective inconsistency between the module and the entire model because the module is trained with locally supervised loss I' instead of the joint loss I (Wang et al. 2021). The objective inconsistency in FDL is defined by the difference between the gradients of the locally supervised loss (Vw...m. (m) and the joint loss (Vw..... The existence of this inconsistency makes the optimal parameters that minimize the locally supervised loss In does not necessarily minimize the joint loss Furthermore, the objective inconsistency can enlarge heterogeneity among clients and hinder the convergence of FI. (Li et al. 2019 Wang et al. 2020h), thus is important to alleviate the objective inconsistency in FDL to improve its performance.
Theorem B shows non-trivial relationship between adversarial robustness and objective inconsis- tency: strong joint adversarial robustness also implies small objective inconsistency FDL. We prove Theorem in Appendix B.2
Theorem 3. Assume that Im (Zm, y) and (z y) are Smn P', smooth zm for a module m. If
there exist Oms C'mo and r /2 22 Pm+ Bmm such that the auxiliary model has (r, cm) robusssnss in Im (Zm,y) y), and the backbone network has (r, -robustesssss in it (Z y), then we have:
Ozm
|/ m... V Ven. mmll <
22(cm + C + B.m.)
(13)
Ownm
Theorem suggests that we can alleviate the objective inconsistency by reducing 3m, B Cm and <'n (Regularizing ||0z../ @uw, usually requires second derivative, which introduces high memory
5

---

Under review as a conference paper at ICLR 2023
Algorithm FADE: Federated Adversarial Decoupled Learning
1: Initialize wn (0) and 0% for each module m.
2: for / 1, ... ......... 7 do
3: Randomly sample a group of clients S(#) for training.
4: for each client ((t) in parallel do
5: Randomly select module mi that will be trained in this round.
6: Request the current global model w( and the auxiliary model (0
from the server.
m
Generate input features (t) m for all data Dx-
7:
8: Perform AT in module m2 with FADE in Eq. 14 for iterations, and get + ((+1)
m
9: Upload @
(1+1) mf.ik
to the server.
10: end for
The server aggregates w/ ((+1) to get (I+1) according to Eq. 9 for each w.
12:
end for
and computational overhead, so we do not consider it here). Notice that én. is small given the joint robustness the backbone network, which is guaranteed by adversarial decoupled learning in Theorem 2 Furthermore, Moosavi-Dezzoooi al. (2019) shows that adversarial robustness also implies smoother loss function. Therefore, the joint robustness also leads to a small &y.-
Accordingly, with adversarial decoupled learning, we only need to reduce 8. and Cm to alleviate the objective inconsistency. We notice that both 8m and cm are only related to the auxiliary model, and show in Appendix [B3 [B.3that that model Om when the auxiliary model is simple (e.g., only a single linear layer).
reduce them by adding large weight decay the auxiliary
Remark 2. It is noteworthy that we do not use any conditions on the difference between P,, and Im in both Theorem 2 and 3 This implies that the auxiliary model not required to perform as well as the joint backbone model. Thus, a simple auxiliary model is sufficient to achieve high joint robustness and low objective inconsistency in adversarial decoupled learning.
Based on all analysis above, we propose Federated Adversarial Decoupled Learning (FADE), where we replace the original loss function im in Eq. by the following adversarial loss with weight decay:
FFADE (1) m 9m-11 yi w
max Im (2 m-1 + 8(1) (5)
m- 1. yi (()
)!!)) + Am !0
(14)
m.
m
where Am is the hyperparameter that control the weight decay on the auxiliary model 6m. Our framework is summarized in Algorithm
Trade-off Between Joint Accuracy and Joint Robustness. As we discussed in Section 3.2 and
this section, four parameters (Jmm Jm. Cu and 3m) that are only related to the auxiliary model O,m can influence the joint robustness and objective consistency. We can see in Appendix B.3 that applying larger Am can decrease all of them. Smaller cm and 9m can alleviate the objective inconsistency to increase the joint accuracy, and smaller 9m can improve the joint robustness. However, smaller Jm will lead weaker robustness by increasing the lower bound of 6m Therefore, there exists accuracy- robustness trade-off when we apply the weight decay, and the value of Xm plays important role balancing the joint accuracy and the joint robustness.
EXPERIMENTAL RESULTS
4.1 EXPERIMENT SETTINGS
We conduct our experiments two datasets, FMNIST (Xiao al.) 2017) and CIFAR-10 Krizhevsky et al. 2009). To simulate the statistical heterogeneity in FL. we partition the whole dataset into N 100 clients with the same Non-IID data partition as Shah al. (021). where 80% data of each client is from only two classes while 20% is from the other eight classes. We sample C 30 clients for local training in each communication round. We conduct two groups of

---

Under review as a conference paper at ICLR 2023
CNN-7 Profile
VGG-13 Profil
1.0
Memery Computation
0.8
0.3
0.0
0.5
0.4
0.4
0.2
02
0.0
FosDynAT Val FedbyAT (aital
FodRaN
FADE 2 Modoiesi
0.0
FodDynA rulli FesDynAT garia)
Fodkan
FADE Modoles) FADE Moduke))
Figure 3: Minimum memory and computational requirements baselines and FADE. The results shown the percentage of the resource requirement of full FedDynAT with PGD-10 AT.
FNNIST FedNOVA
FMNST FedBN
CIFAR 10 FedNOVA
CIFAR 10 TedBN
Accuracy
80%
2014
10%
0%
Portion Full Cliets
40%
Portion Full Ciints
200%
9%
Portion Full Clients
45%
65%
0%
Portion Full Clients
FedDynAT [Full!
FedDynAT (Partial)
-
FedRBN
- FADE (2 Modules!
FADE (3 Modulesi
Figure 4: Adversarial accuracy when training with different portions of resource-sufficient clients.
experiments with two state-of-the-art FL optimizers respectively: FedNOVA (Wang et al. (020bb for global FL and FedBN (Li et al. 2021b) for personalized FL. Notice that the results in global FI. and personalized FL are not comparable since they assume different test set partitions. We combine FADE with different FL optimizers to show the generalization of our method.
For AT settings, following Moosavi-Dezzooll et al. (2019) and Zizzo et al. (2020), we use loo norm to bound the perturbation and use PGD-I0 to generate adversarial samples for traiiing and test. The perturbation tolerance at input žu = x is set to be cy = 0.15 with PGD step size ag = 0.03 for FMNIST: For CIFAR-10, we eg $/255 and or = -/255.
For FMNIST, we use a 7-layer CNN (CNN-7) with five convolutional layers and two fully connected layers. We adopt model partition with 2 modules for CNN-7. For CIFAR-10, use VGG- 11 (Simonyan & Zisserman 2014) as the model. We adopt two different model partitions for VGG- 11, with modules and 3 modules respectively. See Appendix C for more details.
In the following sections, we will compare our method FADE with three baselines. Full FedDynAT (hah et al. T02T) represents the ideal performance of federated adversarial training when all the clients are able to perform AT on the entire model. While FedDynAT with 100% AT is not feasible under our limitation that only a small portion of clients can afford AT on the entire model, we adopt partial FedDynAT where clients with insufficient resources only perform standard training (ST). Another baseline FedRBN (Hong et al.) (22T)) also allows ssource-constrained devices performing ST only, and the robustness will be propagated by transferring the batch-normalization statistics from the clients who can afford AT to the clients who only perform ST.
4.2 RESOURCE REQUIREMENTS
We measure the minimum resource requirements of FADE and all baselines on resource-constraingg devices. We use the number of loaded parameters as the metric of memory, and we use FLOPs as the metric of computation. For partial FedDynAT and FedRBN, the minimum memory requirement the number of parameters in the entire model since they always load the entire model for training. and the computing power requirement is the FLOPs of ST on the entire model since the resource- constrained devices only perform ST. For FADE, the minimum memory requirement is the number of parameters in the largest module, while the computing power requirement is the mean of FLOPs for PGD-10 AT across all modules. The results are shown in Fig.
We can that FADE reduce the memory requirement by more than 40% both CNN-7 and VGG-11, while FADE with 2 modules and 3 modules can reduce the computation by 50% and 67% respectively. Although partial FedDynAT and FedRBN can largely reduce the amount

---

Under review as a conference paper at ICLR 2023
The natural accuracy (clean samples) and adversarial accuracy (adversarial samples) on FMNIST. Results are reported in the mean and the standard deviation over 3 random seeds.
Table 2:
FedNOVA
FedBN
Training Scheme
Natural Acc.
Adversarial Acc.
Natural Acc.
Adversarial Acc.
FedDynAT (100% AT)
78.39 0.65%
66.93 = 0.87%
89.85 = 0.41%
82.92 0.66%
FedDynAT (20% AT)
83.83 = 0.32%
48.61 + 0.87% n/a 66.72 + 2.09%
91.94 + 0.07%
16.02 + 1.03%
FedRBN FADE (2 Modules)
n/a
90.35 = 1.51%
62.14 6.45%
78.74 = 1.09%
89.43 + 0.52%
81.24 + 0.94%
Table 3: The natural accuracy (clean samples) and adversarial accuracy (adversarial samples) on CIFAR-10. Results are reported in the mean and the standard deviation over 3 random seeds.
FedNOVA
FedBN
Training Scheme
Natural Acc.
Adversarial Acc.
Natural Acc.
Adversarial Acc.
FedDynAT (100% AT)
64.73
1.63%
33.27 + 0.46%
81.71 0.14%
57.28 1.23%
FedDynAT (20% AT)
74.77 = 1.68%
19.22 + 2.16%
87.12 = 0.25%
16.51 + 1.64%
FedRBN
n/a 65.42 = 0.42%
n/a 32.22 = 0.43%
86.80 = 0.31%
53.08 1.03%
FADE (2 Modules)
81.05 = 0.56%
59.12 + 0.63%
FADE (3 Modules)
64.72 = 0.68%
31.81 + 0.35%
77.46 + 0.67%
58.14 0.85%
FADE (Mixing)
66.06 = 1.09%
32.28 = 0.49%
78.23 = 0.35%
58.80 + 0.66%
of computation, they are far less efficient than they appear to be when training a large model that exceeds the memory limit, since they need repeatedly fetch and load small parts of the entire model from the cloud or the external storage during each forward and backward propagation. And will also see in the following experiments that neither of them can maintain the adversarial robustness, while FADE can still achieve the same level of robustness as full FedDynAT.
4.3 PERFORMANCE OF FADE
We first compare our method with three baselines under the limitation that only 20% clients can afford AT on the entire model, while the other 80% clients can only afford Standard Training (ST) on the entire model or AT a module. The natural and adversarial accuracy in FMNIST and CIFAR-10 is shown in Table 2 and 3 respectivell. While neither partial FedDynAT nor FedRBN maintain the robustness under the resource constraint, FADE consistently outperforms other baselines and achieves almost the same or even higher accuracy and robustness comparing to full FedDynAT (the constraint- case). In addition, clients with two modules and clients with three modules in a ratio of 2:3:5 as the setting "FADE (Mixing)". We can that FADE still attains high accuracy and robustness in this case, which verifies the compatibility of our flexible FDL framework.
mix clients with one module (joint training),
We also conducted experiments with different proportions of resource-sufffcient clients who perform joint AT on the entire model, and the adversarial accuracy is shown in Fig. 4 Even in the worst case that none of the clients have enough resources complete AT on the entire model, FADE can achieve robustness comparable to full FedDynAT. And with only 40% resource-sufficien clients, FADE can already attain the same robustness as full FedDynAT in all our experiments, while the other baselines still have significant robustness gaps from full FedDynAT.
4.4 THE INFLUENCE OF WEIGHT DECAY ON THE AUXILIARY MODEL
As we suggested in Section 3.3 the auxiliary model weight decay hyperparameter An acts as an important role that balances natural accuracy and adversarial robustness. To show the influence of this hyperparameter,
conduct experiments in FADE (2 Modules) with different Am between 0.0001 and 0.1, and we plot the natural and adversarial accuracy in Fig. 5
We can observe that in all our settings the natural accuracy increases first as we increase Am. and then goes down quickly. The growing part can be explained by our theory in Section 3.3 that the larger auxiliary weight decay However, when we adopt a too large weight decay, the weight decay will drive the model away from optimum and lead a performance drop, which is also commonly observed in joint training process.
alleviate the objective inconsistency and improve the performance.
8

---

Under review as a conference paper at ICLR 2023
FMINIST FedINVA
FMNIST FeduN
GFFR-10 FedNNVA
CIFAR-10 FediN
80.5%
12 ass #3,41e
80.0%
(0.5%
05.0%
22 eny 43.2%
65.65
s2 4% 43.0%
23.5%
24.04
64 79.7%
13.4%
65.4%
32 2% 10.5%
52 0% $0.9%
54 03
38.50
63.%%
11.2%
51 0% 50.4%
74.0%
50.2%
12
10
Ave
Ave
Figure 5: Natural (blue lines with triangle markers) and adversarial (red lines with circle markers) accuracy with different auxiliary weight decay hyperparameter Am-
For the adversarial accuracy. the effects of Am become more complicated, since larger Am can decrease both 9m and pm. which affect the robustness in opposite ways. An increasing adversarial accuracy suggests that the effect of Im dominates, while a decreasing one suggests that the effect of 1mm dominates. Similarly the natural accuracy, we could observe that the adversarial accuracy usually grows first before going down, which implies that the effect of Im is usually stronger when Am is small. And considering the increasing natural accuracy, adopting moderately large Am usually attains better overall performance on clean and adversarial samples.
5 RELATED WORKS
Federated Learning Client-wise heterogeneity is one of the challenges that hinders the practice of Federated Learning (FL). Many studies have tried to overcome the statistical heterogeneity in
data (Karimireddy et al. 2019; Liang et al., 2019 Tang et al.] 2022] Wang et al. 2020a) and the hardware (Li al. 2021a 2018 Wang al. 2020b). Beyond the het- erogeneity, FI. is also vulnerable in several kinds of attack, such model poisoning attack (Bhagoji ict al.) 2019 Sun et al. 202I) and adversarial sample attack (Zizzo et al. 2020 [Shah et al. [021] In this paper, mainly focus the adversarial sample attack and deal with the challenge in federated adversarial training under client-wise heterogeneity (Hong et al. 2021)
systematic heterogeneity
Adversarial Training AT is well known for its high demand for computing resources (Wong al., 2020). Several fast AT algorithms have been proposed to reduce the computation in AT (Shafahi al. 2019 Zhang et al.) 2019). such as replacing PGD with FGSM (Andriushchenko & Flam- marion 2020 Wong et al. 2020) or using other regularization methods for robustness (Moosavi- Dezfooli al. 2019 Qin et al.) 2019). FADE can be easily combined with these fast AT algorithms to further reduce the computing cost, which we leave as a future work. In addition, AT will decrease the model performance on clean samples, and thus larger model is usually required to maintain the same natural accuracy (Liu et al. 2020 This makes AT also memory eemooryddemnnding.
Decoupled Greedy Learning As deeper and deeper neural networks are used for better perfor- mance, the low efficiency of end-to-end (joint) training is exposed because it hinders the model par- allelization and requires large memory for model parameters and intermediate results (Belilovsky) al. 2020: Hettinger al., 2017). As alternative, Decoupled Greedy Learning (DGL) is pro- posed, which decouples the whole neural network into several modules and trains them separately without gradient dependency (Belilovsky et al., 2019 |029) |220] Marquez et al., 20188) Wang et al. (2021).
As more flexible DGL. framework, FADE fits better in heterogeneous FI. while offering guarantees in convergence as well as joint adversarial robustness.
CONCLUSIONS
In this paper, we proposed Federated Adversarial Decoupled Learning (FADE), a novel framework to reduce the memory and computing power requirements for resource-constrained edge devices in large-scale federated adversarial training. Our theory guarantees the convergence and joint adversar- ial robustness of FADE, and we develop an effective regularizer to reduce the objective inconsistency in FADE based on the theory. Our experimental results show that FADE can significantly reduce both memory and computing power consumption small edge devices, while maintaining almost the same accuracy as the joint federated adversarial training on both clean and adversarial samples.

---

Under review as a conference paper at ICLR 2023
REFERENCES
Maksym Andriushchenko and Nicolas Flammarion. Understanding and improving fast adversarial training. Advances in Neural Information Processing Systems, 33: 33:16048-16059, 2020.
Eugene Belilovsky, Michael Eickenberg, and Edouard Oyallon. Greedy layerwise learning can scale to imagenet. In International conference on machine learning, pp. 583-593, PMLR, 2019.
Eugene Belilovsky, Michael Eickenberg, and Edouard Oyallon. Decoupled greedy learning of cnns. In International Conference on Machine Learning, pp. 736-7437-7 745. PMLR, 2020.
Arjun Nitin Bhagoji, Supriyo Chakraborty, Prateek Mittal, and Seraphin Calo. Analyzing federated learning through an adversarial lens. In International Conference on Machine Learning, pp. 634 643, PMLR, 2019.
lan J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572, 2014.
Chris Hettinger, Tanner Christensen, Ben Ehlert, Jeffrey Humpherys, Tyler Jarvis, and Sean Wade. Forward thinking: Building and training neural networks one layer at a time. arXiv preprint arXiv: /706. 02480, 2017.
Junyuan Hong, Haotao Wang, Zhangyang Wang, and Jiayu Zhou. Federated robustness propagation: Sharing adversarial robustness in federated learning. arXiv preprint arXiv:2106. 10196, 2021.
Peter Kairouz, H Brendan McMahan, Brendan Avent, Aurélien Bellet, Mehdi Bennis, Arjun Nitin Bhagoji, Keith Bonawitz, Zachary Charles, Graham Cormode, Rachel Cummings, et al. Advances and open problems in federated learning. arXiv preprint arXiv: 2019.
Sai Praneeth Karimireddy, Satyen Kale, Mehryar Mohri, Sashank Reddi, Sebastian U Stich, and Ananda Theertha Suresh. Scaffold: Stochastic controlled averaging for on-device federated learn- ing. arXiv preprint arXiv: 2019.
Jakub Konečný, Brendan McMahan, and Daniel Ramage. Federated optimization: Distributed opti- mization beyond the datacenter. arXiv preprint arXiv:1511.03575, 2015.
Jakub Konečný, Brendan McMahan, Felix X Yu, Peter Richtárik, Ananda Theertha Suresh, and Dave Bacon. Federated learning: Strategies for improving communication efficiency. arXiv preprint arXiv:1610.0549) 2016.
Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. 2009.
Ang Li, Jingwei Sun, Pengeheng Li, Yu Pu, Hai Li, and Yiran Chen. Hermes: efficient feder- ated learning framework for heterogeneous mobile clients. In Proceedings of the 27th Annual International Conference on Mobile Computing and Networking, pp. 420-437, 2021a.
Tian Li, Anit Kumar Sahu, Manzil Zaheer, Maziar Sanjabi, Ameet Talwalkar, and Virginia Smith. Federated optimization in heterogeneous networks. arXiv preprint 1rXiv:/812.06111 2018
Tian Li. Anit Kumar Sahu, Ameet Talwalkar, and Virginia Smith. Federated learning: Challenges, methods, and future directions. IEEE Signal Processing Magazine, 37(3):50-60, 2020.
Xiang Li, Kaixuan Huang, Wenhao Yang, Shusen Wang, and Zhihua Zhang. On the convergence of fedavg on non-iid data. arXiv preprini 1rXiv:190..02189. 2019.
Xiaoxiao Li, Meirui Jiang, Xiaofei Zhang. Michael Kamp, and Qi Dou. Fedbn: Federated learning on non-iid features via local batch normalization. arXiv preprint arXiv:2102.07623, 202
Xianfeng Liang, Shuheng Shen, Jingchang Liu, Zhen Pan, Enhong Chen, and Yifei Cheng. Variance reduced local sgd with lower communication complexity. arXiv preprint
2019.
Xiaodong Liu, Hao Cheng, Pengcheng He, Weizhu Chen, Yu Wang, Hoifung Poon, and Jianfeng Gao. Adversarial training for large neural language models. arXiv preprint wrXiv:2004.0899 2020.
10

---

Under review as a conference paper at ICLR 2023
Xiaofeng Lu, Yuying Liao, Pietro Lio, and Pan Hui. Privacy-preserving asynchronous federated learning mechanism for edge network computing. IEEE Access, 1188970-48981 2020.
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. arXiv preprint arXiv: 06083, 2017.
Enrique Marquez, Jonathon Hare, and Mahesan Niranjan. Deep cascade learning. IEEE trans- actions on neural nehworks and learning systems, 29(1 1):5475-5545 5485, 2018.
Brendan McMahan, Eider Moore, Daniel Ramage, Seth Hampson, and Blaise Aguera y Arcas. Communication--ffiienn learning of deep networks from decentralized data. In Artificial Intelli- gence and Statistics, pp. 1273-1282. PMLR, 2017.
Seyed-Mohsen Moosavi-Dezfooli, Alhussein Fawzi, Jonathan Uesato, and Pascal Frossard. Robust- ness via curvature regularization, and vice versa. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp.
2019.
Chongli Qin, James Martens, Sven Gowal, Dilip Krishnan, Krishnamurthy Dvijotham, Alhussein Fawzi, Soham De, Robert Stanforth, and Pushmeet Kohli. Adversarial robustness through local linearization. Advances in Neural Information Processing Systems, 32, 2019.
Ali Shafahi, Mahyar Najibi, Mohammad Amin Ghiasi, Zheng Xu, John Dickerson, Christoph Studer, Larry S Davis, Gavin Taylor, and Tom Goldstein. Adversarial training for free! Ad- vances Neural Information Processing Systems, 32, 2019.
Devansh Shah, Parijat Dube, Supriyo Chakraborty, and Ashish Verma. Adversarial training in com- munication constrained federated learning. arXiv preprint arXiv:2103.01319 2021.
Neta Shoham, Tomer Avidor, Aviv Keren, Nadav Israel, Daniel Benditkis, Liron Mor- Yos-f, and Itai Zeitak. Overcoming forgetting in federated learning non-iid data. arXiv preprint arXiv:1910.07796, 2019.
Karen Simonyan and Andrew Zisserman. Very deep convolutional networks for large-scale image recognition. arXiv preprint 100e::409.55555 2014.
Jingwei Sun, Ang Li, Louis DiValentin, Amin Hassanzadeh, Yiran Chen, and Hai Li. Fl-wbe: Enhancing robustness against model poisoning attacks in federated learning from client per- spective. Advances in Neural Information Processing Systems, 34, 2021.
Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199, 2013.
Minxue Tang, Xuefei Ning, Yitu Wang, Jingwei Sun, Yu Wang, Hai Li, and Yiran Chen. Fedcor: Correlation- based active client selection strategy for heterogeneous federated learning. In Pro- ceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 10102 10111, 2022.
Hongyi Wang, Mikhail Yurochkin, Yuekai Sun, Dimitris Papailiopoulos, and Yasaman Khazaeni. Federated learning with matched averaging. arXiv preprint wxXiv20002.06440 2020a.
Jianyu Wang, Qinghua Liu, Hao Liang, Gauri Joshi, and H Vincent Poor. Tackling the objective in- consistency problem in heterogeneous federated optimization. arXiv preprint 200xi:2007.0748. 2020b.
Yulin Wang, Zanlin Ni, Shiji Song, Le Yang. and Gao Huang. Revisiting locally supervised learning: An alternative to end-to-end training. arXiv preprint arXiv:2101.10832 2021.
Eric Wong, Leslie Rice, and Zico Kolter. Fast is better than free: Revisiting adversarial training. arXiv preprint arXIv:2001.03994, 2020.
Han Xiao, Kashif Rasul, and Roland Vollgraf. Fashion-mnist. a novel image dataset for benchmark- ing machine learning algorithms. arXiv preprint (oXX.07708.0774:7 2017.
11

---

Under review as a conference paper at ICLR 2023
Cihang Xie, Mingxing Tan, Boqing Gong, Jiang Wang, Alan L Yuille, and Quoc V Le. Adversarial examples improve image recognition. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 819-828, 2020.
Cong Xie, Sanmi Koyejo, and Indranil Gupta. Asynchronous federated optimization. arXiv preprint arXiv:1903.03954, 2019.
Dinghuai Zhang, Tianyuan Zhang, Yiping Lu, Zhanxing Zhu, and Bin Dong. You only propagate once: Accelerating adversarial training via maximal principle. Advances in Neural Information Processing Systems, 32, 2019.
Giulio Zizzo, Ambrish Rawat, Mathieu Sinn, and Beat Buesser. Fat: Federated adversarial training. arXiv preprint 27X.v:2012.00791,, 2020.
12

---

Under review as a conference paper at ICLR 2023
A CONVERGENCE ANALYSIS OF FEDERATED DECOUPLED LEARNING
A. PRELIMINARY
In this section, we analyze the convergence property of Federated Decoupled Learning (FDL). Since FDL partitions the entire model with layers as the smallest unit, we only need to prove the conver- gence of each layer. We use wn to denote all the parameters in layer n, and my my(n) module that contains layer on client k. We define the parameters other than w, in module my (n) as &2 We also denote the input feature of layer n as 2n-1,k (m)(n) on client k. we define the locally supervised loss of layer n. client k as:
denote the
(t) ((..)) (P Mr ((())) (m) (2 (n) ( Ω (222))
(t)
(15)
where n,K changes every iteration because of the update of Ω (t.s) For simplicity, from now abridge (z.y) as z. We let / n=11 follow the distribution with probability density (t)
n.A
Pa-1, (z)
the j-th iteration of communication round and we define its converged density as P= (z) with
converged previous layers and 2 (Belilovsky al, 2020). With these notations, define
(1) (w)( E,00 P 1
Σ
(t,)) n,
(2 ( (!!)
(16)
(w) = Σ
Ub (0)
nik (w)
(17)
Imn)(w((t)) = Pa [ (i (2n (2n- w(()))
-BEmyto)11AAPmmam 1.t
(t) s2,t0)
(18)
N
Ti (w])
In (w))
(19)
Following Belilovsky et al. (2020), we use the distance between the current density and the con- verged density below for our analysis:
12 | - 1. dz,
Th
(20)
And we also define the following gap between (0)) and li
N
e(O)
A
E
(2 n.k (2n (2 Vi (2,,
(21)
-
We will discuss the convergence of L,, (w,, for each layer n. Without specifying, all the gradients LVL VI) in the following analysis with respect to w,, Following BollooiigBBelllovskky al. (2020) and
Wang et al. (2020b), we make the common assumptions below.
Assumption (C-smoothness (Belilovsky et al. 2020; Wang et al. 2020b)). Ln is differentiable with respect to (())) and its gradient is in.-Lipschitt for all t. Similarly, L is differentiable with (!) respect to w n. and its gradient is E,, Lipschitz,for all and k.
Assumption 2 (Robbins-Mon Monno conditions (Belilovsky et al. 2020 The learning rates satisfy E 1/: = Dc yer Di= op < 00.
Assumption 3 (Finite variance (Belilovsky et al. 2020 Wang et al. 2020b)). There exists some
positive constant G such that Vt.j and Yk, E Eaan
(t.d)
(t.)) n.k (> n wn)) )|
S G and
( < at any w.
E Bx
13

---

Under review as a conference paper at ICLR 2023
Assumption (Bounded Dissimilarity (Wang al. 20206 ) There exist constants 8 2 1, 2
such that VI. and Wh. Σ q
(w.)
S 3
Σ aa
(1)
(wm))
+ +x²
n.k
u.A
Assumption (Convergence of the previous modules and 92 that Et t= Pu-1 < co and sc
(Belilovsky at.
2020
We assume
c(1)
0= oc.
A.2 PROOF OF THEOREM
With all above assumptions, we get the following theorem that guarantees the convergence of Fed- erated Decoupled Learning.
Theorem 1. Under Assumption
Federated Decoupled Learning converges as follows:
inf ST
E
Vn
(!!!
)
Σ
(1)
Et=o Sn "1 Σ 7t
Σ oz
Pri
0
+
+ o
+
(22)
Σ
Ei= ut
Ei=o 1/
Proof. We consider the SGD scheme in Eq. with learning rate {nche:
(1+11 (! m Exeryy 4sh Evesh Qx
where ((1) (1) Sw, which is defined in Eq. 9 And h n,k is defined as
(1)
(b-) n,k
((زاا))))
)
(23)
1=0
According to the Lipschitz-smooth assumption for the global objective function Ln it follows that
E Ln (w((t)))
}] Ln (w(!))
(8) E Eeest qihk n2 R
Σ keel quhh Σ Eneel! Qk
S - S-
Vin ((())
(24)
Eneety Qk
T2
Similar to the proof in (Wang et al. 2020b), to bound the Tj in Inequality
24 we should notice that
Σ keet! a h0 n.k
(w)(t)
Ti =E
Vnn
> Eeeety
N
V
Ln
(w(())
Ts Th n.kk
1=1
N
N
2
V Lm
||²
+ 2/
Eh n.k
2
Lm
(1())
Σ
mb
Eh
n.k
(25)
A=1
1=1
N
2
Tm
(1((tt
||²
T.
(w((())
Σ
The
E. n,kk
2
25
(i()) ||²
vi(())
(w(())
Σ
N
Eh
(0)
2
VTnn (w)())
-V
(w)
n.k
1=
(26)
14

---

Under review as a conference paper at ICLR 2023
N Σ 1=1
2 Ln
( ||
(1)
gk
Eh - VL (w - -|| (w!)))
VI (w) 1|2
(27)
Eq. 25 uses the fact: 2( b) = |a||2 + +11b1 - |la blb and Inequality 26 uses the fact: ||a + B11 <
|||a|| 2|16|| Inequality 27 uses _!!) Σ - q mi,k and Jenson's 's inequality | b,a; || 5
(t)
Σ b, ||a:ll
Based on the proof of Lemma 3.2 in Belilovsky et al. (2020). we have
VLn w!(() VL (w!!))
Σ
Vi (z; - Σ qh E Egspp -
I zmpp-
nnd (ziW!!)
k
k
1
qk
E Egapi
V (2:
E 222((()
Vi(lee) mik (z; ((1))
T
qk
(Bapph
Vly (z;
E
snup
k
(taf) (2:
)p 1 (2) / Viltte (2; )pn))))nn- 1, (z)
qk
+ Σ
q
E0 Ezepa
(2: Vhūn (z: (00] ||
Σ Qk Σ
(f,1)) n,k
(z;
(( v ( 1 (z) 11 11-1111 1 (2) dz
+ (c(1)
Σ qk
Vilte)) (2) 1 (z)1 / (x) (,)
+ (1)
5- Σ Qh
lp (,) - ph 1. E
/ T
( (z; (!)) (p/2 + + 1,) dz
k
+ (g()))
<4Gp/ (t)
+ (t())
(28)
Hence, we have
Ti
Lm
w((l)
Eh n.k
VLLI(
-4Gp (1- -2e(0.
(29)
Similar to the proof in Section C.3, we have the following bound for Tb:
(1) n.
(1)
EnERlh E.E
(t) n.k
Σkeate qu Eh (1)
n.k
Ta <
E
+2
E
EneEle Uk
Exeet 9h
Eneel" Ok
Eneety (t)
12
Exeofo Bh n.k
(0)
Eneeto yu Eh!
<4 E
+ E
+2
E
EkeEse 9r
Eeeat! 9k
ExeOle qr
15

---

Under review as a conference paper at ICLR 2023
+ E EEES A 1
Eneoly qulEh
<4
E
+ 2
E
E EkeBl 9h
E Ekeele 9h
I kEEa!! 96
EREBoo 1r n.kk
(1)
S +2
E
(30)
Σ EneRl! 9k
<8T + 6
Eh
(1) m.
V. nikk
(w!))) ||?
ql
+ 66/
6
+²))
(31)
St
where S,
(())
Inequality 30 based on the Assumption and the definition of h (0) n.k while
Inequality
31 is from Lemma 5 in Wang et al. 2020b).
According to Assumption
for all t. k. Wn. we have
E 1.b
xnpp!
(t)
(1(1))) nik (2;ww) E
Rn 1.k
Vill.t)
m,k (z; w.)
E
n,k (z: (2:) ||
+ 21
zmp2 2.
villa) (z: 112
1 1.b
Villel (2:ww))
4
(1)
<4G.
(32)
With the results in Inequality 32 and in Section C.5 of Wang al. (2020b), we have the following bound
Eh n,k
(I,(t)
(w)
ni
k=1
4nf G
(72 11)+ D.3
VL )
DR²
(33)
2(1 - D)
2(1 - DD'
where D (T - 1) < If D 123-41' then it follows that I-1 S 1 +
123² < 2 and
3D
< 1 In this case, we can further simplify the inequality:
I-D
N
6
q
Eh n.k
(L n.
(w)))))
22 1)+ VL [w))) (w= || + 28
<96n
2 1) + VLn || + 4G +2e!0) + +88 22, 1).
(34)
Then we can bound T2 as follows:
Ta x tk
Eh (t)
(1
n,k
+ +
||
6 S,
(8 (1)
5 + 961 G(7 1) VLn (w(')) || 2 + 4Gp + + 48 23x2 1)
+ +, w 2|1 (0 + +245()
+ 5, ( (9) 2| 6 (1) 432c(() + x2)
6
(35)
16

---

Under review as a conference paper at ICLR 2023
uses the difference bound in Inequality 28 ity| 35 back into Inequality 24 and with S 2 1, we have
where Inequality 35
Plugging Inequality 29 and Inequal-
E
La
w
- In (w)(
1
vnn ( 1|²
)1 + Gp + +2mE5
2
+)+ ē (in](( /|
1
+ 3 Gp + + + R - -1)
2
+ 1/1
16 22 (T 2 -1) +
18 nn
+
8r² 2 G(T
+ 7 VL, (w) {1))
+ 4Gp! + +2
2
+ +88
48Gp!" + +4gg()
+ +6 V T. (10 1| + 83G 1 + + x²)
(36)
5
7nf Lu अह B² |LLm (1)
12 Th
[4
7 (t)
+ 16 2. G(T2 1) + 8n 22, T - -1]
+ 11
Gp
(1)
+ 3
3
11 nm
8r + +22Gp +266( 26 G22 1) + 48 F2 1)
+
2
+ Gp (1) + 24 + 6x
(37)
When we set T) S min! 121+1833)0 13, we can get
1
/nlVVL, (w()) 112
(w(t))
-E Ln [w
Shn
14
G+ 262, 248 24822G)))))) mphh + +/+ 13C, + +133>cm) c.. nel
+
3
+ 167 - 1) +
G22
+ C, - 1) + 24 C, T(T - 1) + +Ln 2
Taking the expectation and averaging across all rounds, one can obtain
T
Ln (ws(*) (a)
17t
4 t=0
T
T
T
<
Ln
(w!(0))
- Ln (w! (w(TT+)))
+
A
m
+
B
niP
(t)
+
C mel!
1=
1=0
1=0
T
<In (0)
+ A
m
+
B
((
(t) +
C
Σ
(1))
t=0
t=0
t=0
where A, B and C' are some positive constants. Now we get our final result:
inf E.
V
Σ
m
KT
Ei
Tht
t=
00
+ 0
Σr 0 Pn 1/t
+ 0
Σl=
Si M)
(()
+0
Σr mo
Σi
Th
Σ - Tl
1 T/
Ei 1t
17

---

Under review as a conference paper at ICLR 2023
>
2T 2/ according
is simple to verify that the Cauchy-Schwand inequality, we have
Ei= We
+
and
Σ
-
0 - co. As for
Eizo 7
T
T
(4)
=
Pm
Pn
t=
t=
(t)
Σ
Pn
pi
vi
Σ
Pn
(
Σ
Pn
(1)
Σ
n
< 00.
ΣT 2
Σ9 cl
21 m
Hence, we also have In conclusion, get the result in Section 3.1
if co. Similarly, we get the same result for
Σ tt
V (n((0) )|
lim inf E T- 1ST
(38)
B PROOFS OF THEOREM 2 AND ADDITIONAL ANALYSIS
B. PROOF THEOREM 2
Theorem 2. Assume that I'm Em(2m, (2m, y) is pm -ttonngy convex in Rm each module m. If each module m S M has local (cm-1, )m -robussttsssss in lm (am=-11,3) V). and
Vm M, Cm
9m
V
20m
+
where 9m 1|
2m. I'm (Zm: y)
(39)
pm
then can guarantee that the entire model has a joint (co, robuustsss in ((x,,) y).
Proof. We only need to prove the joint robustness of the concatenation of module and (m + 1) given the local robustness them separately, and then we can use deduction to get the joint robustness of the entire model given the local robustness of all modules.
For a module m and any perturbation 8m-1 E {8m-1 [16m-1ll ill I Em-1) at its input, let fmm2mm (2m-11 + 5m- fm (mm-1). Given Mm -tstonggyyy convexity and (em-1, Cm Cm)--obustnesss in 7. (2m, y). we have
zm Tm (Zm y)
Mm ||r||2 < 1m (Zm + + r. 1mm
(Zm. v) S Cm
(40)
im (Zm 4)
I' (Zm, 1)
pm
p
Gm
(41)
2
pm
V zm Tm (Zm W)
20m
Zen im (Zm, 11
(42)
Mm
+|||||
sm I' (Zm, w)ll
20m
|/ sm I' (Zm, 1)
9m
+
2cm
9
(43)
2
Pm
pmm
Pm
Mm
And we know that
cm
2
Jm
V
2cm
2h
2
||r|||
(44)
Pm
1
18

---

Under review as a conference paper at ICLR 2023
which gives us
v6m-1 E {6m-1: ||6m-1ll S cm-1): fm ( fmmm=m-1m (zm-1))l S cm
(45)
With the (cm: Cm+1 (mn+1)-robustnn rrobusttnsss of module (m + 1), have the joint robustness of the concatenation of m and (m + 1):
vdm-1 1 E {6m-1 1 11ōm- cm-
1m+1 + m), 1) - 1m+11 (fm (Zm- 1), 1) S Cm+1l
(46)
B.2 PROOF THEOREM
Theorem 3. Assume that im (Zm, y) and I'm (2ms v) are 9mn Sin,Bin-sn Pm--smoohh in Zm for module m. If such that the auxiliary model has (r, Cm robbusteess in Im (zm: v). and the backbone network has (r, (r, roobustessss in i'm (Zm y), then we have:
there exist Cms en and 2 2 cmttem Pm+
0zm
V W.. 1 - V Vunlmll
22 + (m P%m))
(47)
3wm
Proof.
With the chain rule, we know that
2zm Fw.
O(1 - 1m)
2zm
0(pm - Im)
V Wm
V mm
(48)
8zm
own
Ozm
and thus
azm
a(1n im)
|| "...
V Wm 4mll
(49)
Ozm
We now need to find the upper bound of the second factor. We define h(2m) = Pn (Zm: 4) Tm (Zm, y). which is (8m + -smoothh 2m. For any 5m: 1l S r. with the (r, Cm -robbsstess in (Zm: y) and (r,, robusstss in i'm (Zm. y), we have
[h(zm + 6m) - h(zm)l < 1/m (Zm 8m v) - I'm (Zm, w)1 + 17mm (zm + Sm. v) Pn ( (Zm 4)1
I Cm + cm.
(50)
And with the (Bm + B/ smmoohhnsss, we know that
Öh( (m)
3m + F'm
8..
16ml 112 S 1((mm + 3m) h((m) S Cm + om-
(51)
0zm
2
The maximum the LHS is achieved when 8; AmtBu
@h(zm) O%
and thus we get
Ōh(zm)
S Cm + dn
(52)
2mm
3/mm
Fzm
Oh(
< 22 + (8m Blm))
(53)
Ozm
To check the achievability of this maximum, we have
1
Oh (2m)
Cm + cm
|| 8
Bm + Br $ r.
(54)
3m + 3ym
Ozm
Thus, we get our final result
Fzm 2wm
|/ w..! V Vun.. 1mll <
/2(cm + cm + B%m)
(55)
19

---

Under review as a conference paper at ICLR 2023
B.3
CASE STUDY: LINEAR AUXILIARY OUTPUT MODEL
For a linear auxiliary output model On (W bm the cross-entropy loss is given as
[(zm: y) C(o ((o 2m bm).8)
(56)
where C(p.y) y) = Ei yi log(p;) and (q)); exp(g:)/(2 exp(g;)) are cross-entropy loss and softmax function respectively. Let Pm = o oW am + bm). we know that
V mm (zm y) Wm (Pm y),
(57)
and
Hm V2 2m
(Zm 8) Wm m W
(58)
where
Jm (Pa) Pm PT
(59)
the Jacobi the softmax function. We have the following properties related to the robustness and objective consistency in Theorem 2 and Theorem 3
1. (First Order Property) Smaller |Wml] leads smaller Im and Cm.
9m V sm I'm (Zm, (mml)1ll || (Pm 8)ll S / Wmll max (zm + 6m v) I' (Zm, f) S v 2r W ml
(60)
Cm
(61)
6m St
2. (Second Order Property) Smaller [ leads to smaller pm and Bm.
Σ (H,)) = Hm) = tr( W Jm W = tr( tr(W m Wm Jm)
S Wm 1 Σ Pmg - pmmg);
(62)
where X₂ (H(H,,. means the eigenvalues of Hm in increasing order. A (Hm) P. and A_ A
8m.
We notice that when increasing Am. namely, decreasing W and Wmllr, we will decrease Jmn Cm. Pm and 3m- According to Theorem 2 smaller Im will lead to stronger robustness while smaller Pm will lead weaker robustness. And according Theorem 3 smaller em and 8m can lead to smaller objective inconsistency and thus better natural accuracy.
C EXPERIMENT SETTINGS AND DETAILS
We run all the experiments sever with single NVIDIA TITAN RTX GPU and an Intel Xeon Gold 6254 CPU.
C.I DETAILS OF BASELINES
AedDynAT (Shah et al. 2021). FedDynAT proposes to use an annealing number of local training iterations to alleviate the slow convergence issue of Federated Adversarial Training (FAT) Zázzo
et al. 2020). More specifically, they anneal the number of local training iterations as 7, = =Tu? F/F where T, 18 the number of local training iterations round YF is the decay rate and Fr: is the decay period. When implementing FedDynAT, we use FedNOVA instead of FedCurv (Shoham
al. 2019) to avoid extra communication in resource-comstrained settings.
FedRBN (Hong et al. 2021). FedRBN adopts Dual Batch Normalization (DBN) layers (Xie et al. 2020) with two sets of batch normalization (BN) statistics for clean samples and adversarial sam- ples respectively. When propagating the robustness from the clients who perform AT to the clients
20

---

Under review as a conference paper at ICLR 2023
Table 4: The hyperparameters of FADE. The last module does not have auxiliary model since it
directly uses the loss of the backbone network, thus it does not have weight decay hyperparameter.
Module
Module 2
Madule 3
Model
Optimizer
cg
Ogg
61
a1
C2
a²2
A
2-module CNN-7
FedNOVA
0.15
0.03
0.003
0.06
0.012
n/a
n/a
n/a
n/a
FMNIST
FedBN
0.15
0.03
0.03
0.12
0.024
n/a
n/a
n/a
n/a
2- 2-module VGG-I1
FedNOVA
$/255
2/255
0.1
$/255
0.75/255
n/a
n/a
n/a
n/a
CIFAR-10
FedBN
$/255
4/256
0.003
$/256
0.76/255
n/a
n/a
n/a
n/a
3-module VGG-IT
FedNOVA
$/250
2/256
0.003
1/266
7265
0.003
1/250
0.70/256
n/a
CIFAR-10
FedBN
$/256
4/255
0.001
1/255
1/255
0.001
3/255
0.73/255
n//a
Mixing VGG-11 11
FedNOVA
*/255
2/255
0.01
$/255
1255
0.01
3/255
0. 0.75/255
n/a
10
FedBN
8/255
2/255
0.001
4/255
1/255
0.001
3/250
0. 0.75/255
n/a
who perform ST, they use the adversarial BN statistics of AT clients to evaluate the adversarial BN statistics of ST clients as follows:
PST = PATT + ARBN (4STT
(xT);
(63)
(o
ARAN
(oST)² = (0
(64)
(o +
where 1SS and fST are the means in adversarial BN and natural BN respectively on a ST client, and (o 2 and (o " the variances. Similarly, for AT clients we have P&T MXT, (arr)² and (axr))
ArAN is the hyperparameter and e is a small constant. With these evaluations of the adversarial BN statisties, the ST clients can also attain some adversarial robustness without performing AT.
C.2 HYPERPARAMETERS
Hyperparameters of FL We partition the whole FMNIST and CIFAR-10 dataset (including the training set and the test set) onto N 100 clients, with a training-validation ratio the same as the ratio of the training set to the test set. For global FL (FedNOVA), the validation sets on all clients are I..D.. For personalized FL (FedBN), we make the validation set on each client have the same distribution as the training set on that client (i.e., Non-I.I.D.). We report the averaged validation accuracy over all clients our experiments.
We set the number of initial local training iterations as To = 40 for both FMNIST and CIFAR-10 10, and the local batch size is set to be = 50. We use the same trick as Shah et al. (2021) that we gradually decrease the number of local training iterations. When training with FedNOVA, the maximal number of communication rounds T = 500 for FMNIST and When training with FedBN, the maximal number of communication rounds T = 150 for FMNIST and T = 500 for CIFAR-10, 10. We use the SGD optimizer with a constant learning rate rj = 0.01 and momentum 0.9 for all the experiments.
2000 for CIFAR- 10.
Hyperparameters of AT We adopt 6o = 0.15 and ag = 0.03 for FMNIST, and we use = 8/255
and og = 2/255 for CIFAR-10. We PGD with T 10 iterations for training and testing in all our experiments. Following Ziizo et al. (2020), we use a warmup phase with only standard training before performing any AT all the experiments. When training with FedNOVA, the length of the warmup phase is set to be 50 for FMNIST and 400 for CIFAR-10 10. When training with FedBN, the length of the warmup phase is set to be 15 for FMNIST and 200 for CIFAR-10.
Hyperparameters of FADE Table summarizes the Am and cm-1 that we used in the experi- ments Section 4.3 When tuning both 6m and Am. we adopt the overall accuracy on both clean and adversarial samples as the criterion, which can be written as A = 0.4 + 0.6A,, where A, and Ag are natural accuracy and adversarial accuracy respectively. When determining the feature perturbation E and E2, perform linear search for the optimal discount factors di, d2 E [0.0, 1.0] such that 6 = dich and 62 = dzgp. When determining the weight decay hyperparameter Ams we select the optimal Am (0.0001, 0.0003, 0.001, 0.003, 0.01, 0.03, 0.1).
Hyperparameters of FedDynAT We set the decay rate 7' = 0.9, and the decay period FF is always set to be 1/10 of the maximal number of communication rounds T.
21

---

Under review as a conference paper at ICLR 2023
Table 5: The model architecture and the 2-module partition of CNN-7.
Module
Layer
Details
# Parameters
Conv2D (8, kernel sizc = 3, padding = =,, stride = 1)
1
BN2D, ReLU, MaxPool2D (kernel size 2, stride = 2)
Conv2D (16, kernel size 3, padding
stride 1)
15.312
2
BN2D, ReLU, MaxPool2D (kernel size 2, stride = 2)
Conv2D (32, kernel size = 3, padding = 1, stride
3
BN2D, ReLU
Conv2D (32, kernel size 3, padding 1, stride 1)
4
BN2D, ReLU, MaxPool2D (kernel size 2, stride = 2)
A1
FC (288, 10)
2.890 k
Conv2D (64, kernel size = 3, padding = 0, stride = 1)
5
BN2D, ReLU
23.562 k
6
FC (64, 64), BNID, ReLU
7
FC (64, I0)
Table 6: The model architecture and the 2-module partition of VGG-11. Details
Module
Layer
# Parameters
Conv2D (64, kernel size 3, padding = 1, stride 1)
1
BN2D, ReLU, MaxPool2D (kernel size stride = 2)
Conv2D (128, kernel size 3, padding I, stride I)
2
BN2D, ReLU, MaxPool2D (kernel size 2, stride = 2)
4.504 M
Conv2D (256, kernel size = 3, padding = stride BN2D, ReLU
3
Conv2D (256, kernel size 3, padding = stride 1)
4
BN2D, ReLU, MaxPool2D (kernel size 2, stride = 2)
Conv2D (512, kernel size = 3, padding = I, stride I)
5
BN2D, ReLU
Conv2D (512, kernel size 3, padding 1, stride 1)
6
BN2D, RcLU, MaxPool2D (kernel size 2, stride = 2)
A1
MaxPooI2D (kernel size = 2, stride = 2), FC (512, 10)
0.005 M
Conv2D (512, kernel size = 3, padding = 1, stride I)
7
BN2D, ReLU
Conv2D (512, kernel size = 3, padding = 1, stride 1)
8
5.254 M
BN2D, ReLU, MaxPoo12D (kernel size 2, stride = 2)
9
FC (512, 512), BNID, ReLU
10
FC (512, 512), BNID, ReLU
11
FC 10)
Hyperparameters of FedRBN Following Hong et al. (002)), we adopt the same setting where ARbN 0.I. We loose the requirement of noise detector and allow optimal noise detector for FedRBN such that it can always use the correct BN statistics during test (This makes its robustness stronger than that with a real noise detector).
C.3 MODEL ARCHITECTURES AND MODEL PARTITIONS
The model architectures and model partitions we use in our experiments are shown in Table 5 6 and We skip all the Batch Normalization layers in the model when training with FedNOVA. We also show the number of parameters in the tables. We could see that in most case the auxiliary models are small enough and they only introduce negligible extra parameters and computation. Therefore will not increase the memory and computing power requirements essurce-constraint devices.
7
22

---

Under review as a conference paper at ICLR 2023
Table 7: The model architecture and the 3-module partition of VGG-11.
Module
Layer
Details
Parameters
Conv2D (64, kernel size 3, padding = I, stride 1)
1
BN2D, ReLU, MaxPool2D (kernel size 2, stride = 2)
Conv2D (128, kernel size = 3, padding = 1, stride I)
0.962 M
2
BN2D, ReLU, MaxPool2D (kernel size 2, stride 2)
Conv2D (256, kernel size = 3, padding = 1, stride
3
BN2D. ReLU
Conv2D (256, kernel size 3, 3, padding I, stride
4
BN2D, ReLU, MaxPool2D (kernel size 2, stride 2)
A1
MaxPool2D (kernel size = 2, stride = 2), FC (1024, 10)
0.010 M
Conv2D (512, kernel size = 3. padding = 1, stride = I)
5
BN2D, ReLU
3.542 M
Conv2D (512, kernel size = 3, padding = 1, stride 1)
6
BN2D, ReLU, MaxPool2D (kernel size 2, stride = 2)
A2
MaxPoo (kernel size 2, stride = 2), FC (512, 10)
0.005 M
Conv2D (512, kernel size 3, padding 1, stride
7
BN2D, ReLU
Conv2D (512, kernel size = 3, padding = 1, stride 1) BN2D, ReLU, MaxPooI2D (kernel size 2, stride = 2)
8
5.254 M
9
FC (5T2, 512). BNID, ReLU
10
FC (512, 512), BNID, ReL.U FC (512, 10)
23


Reviews:
[{"review_id": "58HbPSab-HU", "reviewer": "Reviewer_8e8c", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper studies how to perform federated adversarial training (FAT) on resource-constrained edge devices. The authors propose Federated Adversarial Decoupled Learning (FADE) to decouple the entire model into small modules for feasible FAT. They also offer a theoretical guarantee for convergence and adversarial robustness, based on which, a technique to alleviate objective inconsistency and achieve better accuracy-robustness balance is proposed.", "summary_of_the_review": "This paper focuses on federated adversarial training (FAT) on resource-constrained edge devices. The authors propose to exploit Decoupled Learning in Federated Adversarial Learning and provide the corresponding trade-off technique and theoretical guarantee. However, analyses for the case that different clients have different module partitions are lacking and the clarity needs to be improved (See in “Strength And Weaknesses”). \n\n==I read the authors' rebuttal and comments from other PCs, I updated my scorings for its merits and shortcominings.", "strength_and_weaknesses": "This paper focuses on federated adversarial training (FAT) on resource-constrained edge devices, which is an important and less researched topic. The authors incorporate Decoupled Learning (DL) into FAT naturally, analyze and solve the resulting problems theoretically and technologically. Specially, they propose FADE, offer a theoretical guarantee for convergence and adversarial robustness and provide a technique to alleviate objective inconsistency and achieve better accuracy-robustness balance. However, I still have some concerns and suggestions:\n1.\tIn section 3.1, the meaning of Eq. 9 conflicts with the above description of it and the meaning of Figure 2. The authors said that the proposed method can ensure flexible model partitions, that is to say, different clients have different model partitions, as shown in Figure 2. However, what Eq. 9 means is only for the case that different clients have the same model partition. In fact, from my perspective, throughout the paper, the analyses and experiments are constructed on the assumption that different clients have the same model partition. Only the experiment “FADE (Mixing)” assumes that different clients have different model partitions, yet the detail of implementation is unclear. For the case that different clients have different model partitions, I wonder how to aggregate model parameters when the data across clients are heterogenous.\n2.\tWhen talking about Decoupled Greedy Learning (DGL), the authors can give some explanations and examples of locally supervised loss. As a reader, why and how to use locally supervised loss is unclear.\n3.\tIn related work, the authors should give some introduction of FedDynAT and FedRBN, both of which are compared in the experiments.\n4.\tThere are some typos. In the third paragraph of section 2, “Decouled Greedy Learning (DGL)” should be “Decoupled Greedy Learning (DGL)”. In line 8 and 9 of Algorithm 1, $\\Theta^{(t+1)}_{m_k^t,k}$ should be $\\Theta^{(t+1)}_{m_k^t}$ to be consistent with the notations in section “Decoupled Greedy Learning (DGL)”.\n", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}, {"review_id": "45BvlZnLBO", "reviewer": "Reviewer_xYLU", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper focuses on federated adversarial training, especially learning in a resource-constrained setting. To be specific, the high demand for memory capacity and computational power makes federated adversarial training infeasible in the resource-constrained setting. To overcome this issue, this paper proposes Federated Adversarial Decoupled Learning (FADE), which allows a more flexible model partition on devices to fit the resource budgets. Correspondingly, the authors provide the theoretical guarantee for the convergence of the proposed algorithm and conduct experiments to empirically verify the effectiveness of FADE.", "summary_of_the_review": "Overall, I think this paper proposed a promising method for federated adversarial training under resource-constrained edge devices, with corresponding theoretical analysis. However, the presentation part and the experimental parts can be further improved.", "strength_and_weaknesses": "Strength:\n1. The focused problem is very practical and significant to push federated adversarial training towards a more real-world scenario.\n2. The proposed FADE shows empirical effectiveness in the experiments on FMNIST and CIFAR-10 datasets.\n3. The corresponding theoretical analysis on the convergence of the proposed FADE is provided and seems to be correct.\n\nWeaknesses:\n1. The technical novelty of the proposed method is limited compared to DGL. Without a clear technical motivation to improve DGL, the proposed FADE seems to be heuristical. The presentation could further highlight the technical difficulty and how FADE address that.\n2. The experiment part of the current version is weak. The performance gain of the proposed method is not significant and still suffers from severe accuracy-robustness tradeoff. Some quantitative experiments which can reflect the degree of resource-constrained edge devices seem to be missing, which can directly reflect the performance limitation of either previous or the proposed methods. Since the title is called \"large-scale\", some large-scale datasets can be involved to make the empirical results more convincing. It also lacks the appropriate ablation study to understand the proposed algorithmic component better. It needs further evidence or clear presentation to show the relationship of the effectiveness with the improved algorithm.\n3. The current theoretical analysis indeed provides the convergence guarantee of the algorithm. Could the author provide more discussion about the relationship between the theoretical results with the resource-constrained setting?\n\n", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "3WuH4Meh75J", "reviewer": "Reviewer_iHWT", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper proposes an adversarial training framework for resource-constrained federated learning. The proposed framework decouples the entire model into small modules to fit into the edge device memory. Adversarial training is only performed on a single module in each communication round.", "summary_of_the_review": "The proposed framework is quite novel. The experimental results look promising. The paper presents theoretical proof for convergence and adversarial robustness. However, the details of the proposed framework need further clarification.\n\nThank you for the authors' responses. While the responses have addressed most of my concerns, I still have a concern about the use of forward passing in the first training round, which may impact the efficiency of the proposed method. I also agree with other reviewers that the paper's novelty may be somewhat limited as it simply applies decoupled learning in federated adversarial learning.", "strength_and_weaknesses": "Strengths:\n1. The paper aims to address the challenges of adversarial training in resource-constrained federated learning, which is an important and timely problem.\n2. FADE offers theoretical evidence for the convergence and adversarial robustness of the proposed framework.\n3. The experimental results show that FADE reduces the computational cost while maintaining model robustness.\n\nWeaknesses:\n1. The proposed federated decoupled learning is unclear. It seems the paper only addresses the update locking using the auxiliary output model.  Forward passing is still required in federated decoupled learning. For example, in the second row of Figure 2, the model training still needs the outputs from the previous layers. \n2. The min-max optimization problem (Eq. 11) requires to update $\\delta_{m-1}$ to maximize the loss function. However, without accessing the first few layers, how do we update $\\delta_{m-1}$?\n3. The paper investigates two recent federated learning algorithms FedNOVA and FedBN. It would be nice to consider FedAVG as another baseline.\n4. The paper considers 2-module and 3-module FADE. Can we split the model into more modules for extremely low-end devices? \n\nMinor: Page 3. Decouled Greedy Learning -> Decouple Greedy Learning\n", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}]

Author rebuttal:

Decision: Reject