Collaborative Learning in the Jungle (Decentralized, Byzantine, Heterogeneous, Asynchronous and Nonconvex Learning)
Authors: El Mahdi El Mhamdi
Sadegh Farhadkhani
Rachid Guerraoui
Arsany Guirguis
Lê-Nguyên Hoang
Sébastien Rouault
Venue: NeurIPS 2021 Poster (2021)
Keywords: Byzantine
collaborative learning
heterogeneous
distributed
decentralized
asynchronous
nonconvex

Abstract: We study \emph{Byzantine collaborative learning}, where $n$ nodes seek to collectively learn from each others' local data. The data distribution may vary from one node to another. No node is trusted, and $f < n$ nodes can behave arbitrarily. We prove that collaborative learning is equivalent to a new form of agreement, which we call \emph{averaging agreement}. In this problem, nodes start each with an initial vector and seek to approximately agree on a common vector, which is close to the average of honest nodes' initial vectors.  We present two asynchronous solutions to averaging agreement, each we prove optimal according to some dimension. The first, based on the minimum-diameter averaging, requires $n \geq 6f+1$, but achieves asymptotically the best-possible averaging constant up to a multiplicative constant. The second, based on reliable broadcast and coordinate-wise trimmed mean, achieves optimal Byzantine resilience, i.e.,  $n \geq 3f+1$. Each of these algorithms induces an optimal Byzantine collaborative learning protocol. In particular, our equivalence yields new impossibility theorems on what any collaborative learning algorithm can achieve in adversarial and heterogeneous environments.

Collaborative Learning in the Jungle (Decentralized, Byzantine, Heterogeneous, Asynchronous and Nonconvex Learning)
El-Mahdi El-Mhamdi
Sadegh Farhadkhani IC School, EPFL Lausanne, Switzerland sadegh. wwwaaaaaaaaaneepraaaa
École Polytechnique
Palaiseau, France
el el-mahde -mahdi.... el e1-mmamdi www.yeechiiiuuu.......oo edu
Rachid Guerraoui
Arsany Guirguis IC School, EPFL Lausanne, Switzerland arsany www.ggguuuiggul.c.ommm
Lê-Nguyên Hoang IC School, EPFI. Lausanne, Switzerland le. he.hhang@epl..co ch
IC School, EPFL Lausanne, Switzerland rachid. gwwrraoui@@pfl..co
Sébastien Rouault
IC School, EPFL Lausanne, Switzerland sebastien.rouuulteeeee...
Abstract
We study Byzantine collaborative learning. where nodes seek collectively learn from each others' local data. The data distribution may vary from one node another. No node is trusted, and that collaborative learning is equivalent to a new form of agreement, which we call averaging agreement. In this problem, nodes start each with initial vector and seek to approximately agree on common vector, which is close to the average of honest nodes' initial vectors. We present two asynchronous solutions averaging agreement, each we prove optimal according to some dimension. The first, based on averaging, requires
nodes can behave arbitrarily. We prove
6f 1, but achieves asymptotically the best-possee -osssibos averaging constant up to multiplicative constant. The second, based on reliable broadcast and coordinate-we Byzantine resilience, i.c., 2 3f + 1. Each of these algorithms induces an optimal Byzantine collaborative learning protocol. In particular, our equivalence yields new impossibility theorems on what any collaborative learning algorithm can achieve in adversarial and heterogeneous environments.
the minimum-diamen
trimmed mean, achieves optimal
Introduction
The distributed nature of data, the prohibitive cost of data transfers and the privacy concerns all call for collaborative machine learning. The idea consists for each machine keep its data locally and to "simply" exchange with other machines what it learned so far. If all machines correctly communicate and execute the algorithms assigned them, collaborative learning is rather easy. can be achieved through the standard workhorse optimization algorithm: stochastic gradient descent (SGD) [37]. which can be effectively distributed through averaging 226
Authors listed alphabetically.
35th Conference on Neural Information Processing Systems (NcurIPS 2021).

---

But in a practical distributed setting, hardware components may crash, software can be buggy, communications can be slowed down, data can be corrupted and machines can be hacked. Besides, large-scale machine learning systems are trained on seer-generated data, which may be crafted maliciously. For example, recommendation algorithms have such a large influence on social medias that there are huge incentives from industries and governments to fabricate data that bias the learning algorithms and increase the visibility of some contents over others [6, 33). In the parlance of distributed computing, "nodes" can be Byzantine (28), i.e. they can behave arbitrarily maliciously, to confuse the system. Given that machine learning (ML) is now used in many critical applications (e.g., driving, medication, content moderation), its ability to tolerate Byzantine behavior is of paramount importance.
In this paper, we precisely define and address, for the first time, the problem of collaborative learning in a fully decentralized, Byzantine, heterogeneous and asynchronous environment with non-convex loss functions. We consider n. nodes, which may be machines or different accounts on a social media. Each node has own local data, drawn from data distributions that may greatly vary across nodes. The nodes seek to collectively learn from each other, without however exchanging their data. None of the nodes is trusted, and any f < nt nodes can be Byzantine.
Contributions. We first precisely formulate the collaborative learning problem. Then, we give our main contribution: an equivalence between collaborative learning and a new more abstract problem we call averaging agreement. More precisely, we provide two reductions: from collaborative learning to averaging agreement and from averaging agreement to collaborative learning. We prove that both reductions essentially preserve the correctness guarantees on the output. The former reduction is the most challenging one to design and to prove correct. First, to update nodes' models, we use averaging agreement to aggregate nodes' stochastic gradients. Then, to avoid model drift, we regularly "contract" the nodes' models using averaging agreement. To prove correctness, we bound the diameter of honest nodes' models, and we analyze the effective gradient [12. We then carefully select halting iteration, for which correctness can be guaranteed.
Our tight reduction allows to derive both impossibility results and optimal algorithms for collaborative learning by studying the "simpler" averaging agreement problem. We prove lower bounds on the correctness and Byzantine resilience that any averaging agreement algorithm can achieve, which implies the same lower bounds for collaborative learning. We then propose two optimal algorithms for averaging agreement. Our first algorithm is asymptotically optimal with respect to correctness, up to a multiplicative constant, when nearly all nodes are honest. Our second algorithm achieves optimal Byzantine resilience. Each of these algorithms induces an optimal collaborative learning protocol.
While our algorithms apply in very general setting, they can easily be tweaked for more specific settings with additional assumptions, such as the presence of a trusted parameter server (30), the assumption of homogeneous (i.e. i.i.d.) local data or synchrony (Section 3.3 and Section
We implemented and evaluated our algorithms in a distributed environment with ResNet models 24 More specifically, present their throughput overhead when compared to non non-robust collaborative learning approach with both i.i.d. and non-i.i.d. data (i.e. we highlight the cost of heterogeneity). Essentially, we show that our first algorithm is more lightweight with a slowdown of at most 1.7X in the i.i.d. case and almost the triple in the non-i.idd case. Our second algorithm adds slightly more than an order of magnitude overhead: here the non-i.i.d. slowdown twice the i.i.d. one.
Related work: Byzantine learning, Several techniques have recently been proposed for Byzantine distributed learning, where different workers collaborate through central parameter server 30 to minimize the average of their loss functions to the workers which use their local data to compute gradients. Krum and Muuti-Krumm [4] use distance- scheme to climinate Byzantine inputs and average the remaining ones. Median- based aggregation alternatives were also considered (38). Bulyan [13] uses meta-algorithm against strong adversary that can fool the aforementioned aggregation rules in high-dimensional spaces. Coding schemes were used in Draco [ and Detox [35]. In 2 quorums of workers enable to
[26). In each round, the server sends its model parameters
reach an information theoretical learning optimum, assuming however a strong convex loss function. p uses filters to tolerate Byzantine workers in an asynchronous setting. All these approaches assume central trusted (parameter server) machine.
Kardam
The few decentralized approaches that removed this single point of failure, restricted however the problem to (a) homogeneous data distribution, (b) convex functions, and/or (c) a weak (non-
2

---

Byzantine) adversary. MOZI [22 combines distance based aggregation rule with performance based filtering technique, assuming that adversaries send models with high loss values, restricting thereby the arbitrary nature of a Byzantine agent that can craft poisoned models whose losses are small
only with respect to the honest nodes' incomplete loss functions. The technique is also inapplicable to heterogeneous learning, where nodes can have biased loss function compared to the average of
all loss function BRIDGE [39] and ByRDiE [4)] consider gradient descent (GD) and coordinate descent (CD) optimizations, respectively. Both rely on trimmed-mean to achieve Byzantine resilience assuming a synchronous environment and strongly convex loss functions with homogeneous data distribution (i.i.d).. In addition, none of their optimization methods is stochastic: at each step, each node is supposed to compute the gradient on its entire local data set. ByzSGD [2] starts from the classical model of several workers and one server, which is then replicated for Byzantine resilience, It is assumed that up to 1/3 of the server replicas and up to 1/3 of the workers can be Byzantine, which is stronger than what assume in the present paper where nodes play both roles and tolerate any subset of 1/3 Byzantine nodes. More importantly, ByzSGD assumes that all communication patterns between honest servers eventually hold with probability our present paper is more general, considering heterogeneous data distributions, as opposed to [2] Furthermore, heterogeneity naturally calls for personalized collaborative learning [14 23 10 [5],
make such assumption here. Additionally,
where nodes aim to learn local models, but still leverage collaborations to improve their local models. Interestingly, our general scheme encompasses personalized collaborative learning.
Maybe more importantly, our reduction to averaging agreement yields new more precise bounds that improve upon all the results listed above. These are we believe of interest, even in more centralized, homogeneous, synchronous and convex settings. In particular, our reduction can easily he adapted to settings where parameter servers and workers with local data are different entities, in 12].
Related work: Agreement. A major challenge in collaborative learning is to guarantee "some"
agreement between nodes about the appropriate parameters to consider. Especially in non-convex settings, this is critical as, otherwise, the gradients computed by a node may be completely irrelevant for another node. The agreement could be achieved using the traditional consensus abstraction (28). Yet, consensus is impossible in asynchronous environments [18] and when it is possible (with partial synchrony), its usage is expensive and would be prohibitive in the context of modern ML models, with a dimension in the order of billions. In fact, and as we show in this paper, consensus is unnecessary.
An alternative candidate abstraction approximate agreement. This is a weak form of consensus introduced in [I] where honest nodes converge values that are close to each other, while remaining in the convex hull of the values proposed by honest nodes. In the one-dimensional case, optimal convergence rate has been achieved in both synchronous [16] and asynchronous environments [17), while optimal asynchronous Byzantine tolerance was attained by [. The multi-dimensional version was addressed by BI,, requiring however nd local computations in each round, and assuming n > f(d + 2). This is clearly impractical in the context of modern ML.
By leveraging some distributed computing techniques 36 1. we prove that collaborative learning can be reduced to averaging agreement, which is even weaker than approximate agreement. This enables us to bring down the requirement on the number of honest nodes from n > f(d + 2) to n > 3f, and only require linear computation time in d.
Structure. The rest of the paper is organized as follows. In Section 2 we precisely define the problems we aim solve. Section states our main result, namely, the equivalence between collaborative learning and averaging agreement. Section deserrbes our two solutions to averaging agreement, and proves their optimality. Section repprts F on our empirical evaluation and highlight important takeaways. Finally, colocludess The full proofs are provided in the supplementary material, as well as the optimized algorithm for homogeneous local data.
Besides, MOZI, focusing on convex optimization, assumes that eventually, models on honest nodes do not drift among each others, which may not hold for Byzantine nodes could influence the honest models drift away from each other (3).
CCovvexity greatly helps, as the average of good models will necessarily be good model. This is no longer the case in non-convex optimization, which includes the widely used neural network framework.
3

---

2 Model and Problem Definitions
2.1 Distributed computing assumptions
We consider a standard distributed computing model with a set [r] {1....,n) _n} of nodes, out of which h are honest and f == n h are Byzantine. For presentation simplicity, we assume that the first h nodes are honest. But crucially, no honest node knows which / 1 other nodes are honest. The f Byzantine nodes know each other, can collude, and subsequently know who the remaining honest nodes are. Essentially, we assume a single adversary that controls all the Byzantine nodes. These nodes can send arbitrary messages, and they can send different messages to different nodes. In the terminology of distributed computing, the adversary is omniscient but not omnipotent. Such an adversary has access all learning and deployment information, including the learning objective. the employed algorithm, as well as the dataset. We consider a general asynchronous setting [S] the adversary can delay messages honest nodes: no bound on communication delays or relative speeds is assumed. We denote BYZ the algorithm adopted by the adversary. Yet, we assume that the adversary not able to delay all messages indefinitely [7]. Besides, the adversary is not able to alter the messages from the honest nodes, which can authenticate the source of message to prevent spoofing and Sybil attacks.
Also for presentation simplicity, we assume that processes communicate in round- manner [5]. In each round, every honest node broadcasts message (labelled with the round number) and waits until it successfully gathers messages from at most q S h other nodes (labelled with the correct round number), before performing some local computation and moving to the next round, Even though the network is asynchronous, each round is guaranteed to eventually terminate for all honest nodes, as the h honest nodes' messages will all be eventually delivered. Evidently, however, some of them may be delivered after the node receives g messages (including Byzantine nodes'). ). Such messages will fail to be taken into account. Our learning algorithm will then rely on main rounds (denoted in each of which is decomposed into sub-rounds that run averaging agreements.
Section 3).
2.2 Machine learning assumptions
We assume each honest node j E [h] has a local data distribution Dy. The node's local loss function derived from the parameters 0 Rdd the model and the local data distribution, typically through .z),, [.,- where {(0, .2) is the loss for data point x, which may may not include
(O) E LD [E(8, some regularization of the parameter 0. Our model is agnostic to whether the local data distribution is uniform distribution over collected data (i.e., empirical risk), whether it is a theoretical unknown distribution the node can sample from (i.e., statistical risk). We make the following assumptions about this loss function.
Assumption 1.
The loss functions are non-negative, i.e., LU) 2 0 for all honest nodes j E [7.] The loss functions are L-smooth, i.e., there exists a constant L such that
Assumption 2.
v0, 0 E CR., Vj E [h]. | (0)- - (()) (0) (0)111 < L 8'112-
Assumption 3. The variance of the noise in the gradient estimations is uniformly bounded, i.e.,
So² [
Vj [b], 40 E Rdd
E a-
Moreover, the data samplings done by two different nodes are independent. Assumption 4. There is a computable bound Linax such that, at initial point 02 E Rd,, for any honest node j E [h], we have (f)) S Lmar.
While the first three assumptions are standard, the fourth assumption deserves further explanation. Notice first that O₁ is a given parameter of our algorithms, which we could, just for the sake of the argument, set to 0. The assumption would thus about the value of the local losses at O. which will typically depend on the nodes' local data distribution. But losses usually depend on the data only as an average of the loss per data point. Moreover, the loss at 0 for any data point is usually bounded. In image classification tasks for example, each color intensity of each pixel of an input image has a bounded value. This usually suffices to upper-bound the loss for any data point, which then yields Assumption 4

---

In iteration e, we require each node to average the stochastic gradient estimates over a batch of b, ii.d. samples, As a result, denoting of") and gi - th Eiepa Vol(ol) x())) node j's parameters and computed stochastic gradient iteration t, we have
E DnDD
9r VCUN
1|
0² b. - o7
As grows, we increase batch size b, up to ((1/5²) (where ó is a parameter of the collaborative learning problem, see Section 2.3), so that o; (6) for large enough (see Remark 2 This allows to dynamically mitigate the decrease of the norm of the true gradient. Namely, early on, while we are far from convergence, this norm usually large. is then desirable to have very noisy estimates, as these can be obtained more efficiently, and as the aggregation of these poor estimates will nevertheless allow progress. However, as we get closer to convergence, the norm of the true gradient becomes smaller, making the learning more vulnerable to Byzantine attacks 3. Increasing the batch size then becomes useful. Our proofs essentially formalize this intuition. Note that, in the homogeneous setting, [25] theoretically proves that leveraging Momentum reduces variance and prevents Byzantine attacks without increasing the batch size, while [32 observes on several hundred experimental settings that Momentum indeed often offsets, even cancels out, the effects of Byzantine attacks.
2.3
Collaborative learning
Given the & diameter A2(0) = max. ||06] - B(()) 2 collaborative learning consists in min- imizing the average L (0) _ : EjEm (() (0) of local losses the average A E 06),
while guaranteeing that the honest nodes' parameters have a small diameter.
This general model encompasses to the personalized federated learning problem introduced by 14 23 10 [5].
For instance, in [23), each node j aims learn a local model xj that minimizes fz. with penalty ~ | - æ 2|| on their distance to the average ö of all models. This framework can be restated by considering that nodes must agree common parameter 8 Σ, but have local losses defined by (D) (0) A minz, [5(x5) + 2/2 || 0 The problem of 23 then boils down to minimizing the average local losses.
Definition 1. An algorithm LEARN solves the Byzantine C-collaborative learning problem if. given any local losses LU) for j E [b] satisfying assumptions 3 and any > O, no matler what Byzantine attack BYZ is adopted by Byzantines, LEARN outputs a vector family @ of honest nodes such that
E0² S 8² and E V (0)1
(1+
(4)
where K A sup supeER" |VC (0) ( (0)ll2 the largest difference between the true local gradients at the same parameter 0, and where the randomness comes from the algorithm (typically the random sampling for gradient estimates).
In our definition above, the constant K measures the heterogeneity of local data distributions. Intuitively, this also captures the hardness of the problem. Indeed, the more heterogeneous the local data distributions, the more options Byzantine nodes have to bias the learning, the harder it is to learn in a Byzantine-resilient manner. Interestingly, for convex quadratic losses, our guarantee implics straightforwardly upper-bound on the distance to the unique optimum of the problem, which is proportional to the hardness of the problem measured by K. In fact, our equivalence result conveys the tightness of this guarantee. In particular, the combination of our equivalence and of Theorem implies that, for any E > 0, asynchronous (2f/h - E) collaaborrte learning is impossible.
2.4 Averaging agreement
We address collaborative learning by reducing it to new abstract distributed computing problem, which we call averaging agreement.
Definition 2. A distributed algoritium AVG achieves Byzantine C-averaging agreement if. for any in- put N E N, any vector family E e .gdhh and any Byzantine attack BYZ, denoting ī 2 AVG BYZ) the output of AVG given such inputs, we guarantee
(T 4
E =A) <
and
E E
2 S (Z)2
(5)
5

---

where UN = (E E UN is the average of honest nodes' veclors, and where the randomness comes from the algorithm. We simply say that algorithm solves averaging agreement there exists constant for which solves C-averaging agreement.
In partieular, for deterministic algorithms, C-averaging input N ensures the following guarantee
A2 2N
(2())=
and
l 2 S CZ2(T).
In Section 4 we will present two solutions to the averaging agreement problem. These solutions typically involve several rounds. At each round, each node sends their current vector to all other nodes. Then, once node has received sufficiently many vectors, it will execute robust mean estimator to these vectors, the output of which will be their starting vector for the next round. The nodes then halt after number of rounds dependent on the parameter N.
3
The Equivalence
The main result of this paper is that, for K > O, C-collaborative learning is equivalent to C-averaging agreement. We present two reductions, first from collaborative learning averaging agreement, and then from averaging agreement to collaborative learning.
3.1 From collaborative learning to averaging agreement
Given an algorithm AvG that solves Byzantine C-averaging agreement, we design Byzantine collaborative learning algorithm LEARN. Recall that LEARN must take a constant 8 >> 0 as input, which determines the degree of agreement (i.e., learning quality) that LEARN must achieve.
All honest parameter vectors are initialized with the same random values (i.e., Vj E [h]. 0())) 0,) using pre-defined seed. At iteration t, each honest node E [h] first computes local gradient (i) given its local loss function (() (+) and its local parameters o( with batch size bt- But, instead of performing learning step with this gradient estimate, LEARN uses an aggregate of all local gradients, which we compute using the averaging agreement algorithm AVG.
estimate 9t
Recall from Definition 2 that AVG depends on parameter which defines the degree of agreement. We set this parameter at (()) [log2 L] at iteration I, so that 1 1/4 < 1/1². Denoting 7, the output of AvGN()) applied to vectors G., we then have the following guarantee:
) and E E -9.12
A (7
C2 (z))
where the expectations are conditioned on Te- We then update node j's parameters by (00
++1/2
g(ح) _" for fixed learning rate 17 _ 8/12L. But before moving on to the next iteration, we run once again AVG, with its parameter set 1. Moreover, this time, AvG is run on local nodes'
parameters. Denoting 0441 the output of Avd, executed with vectors 0 //41/2 we then have
A2 12/2 and E B| 0411/2 Ca (
E EdZ (0+11)²
(8)
4
where the expectations are conditioned on 8 4-41/2- On input 8, LEARN then runs T & TiRARN (8) learning iterations. The function LEEARN (ō) will be given explicitly in the proof of Theorem [ where we will stress the fact that it can be computed from the inputs of the problem (L. K, C, C, ot.
Liaa and 6). Finally, instead of returning 07 (L)) LEARN chooses uniformly randomly an iteration
E [TleaRN (0)), using predefined common seed, and returns the vector family Ø_. We recapitulate the local execution of LEARN (at each node) in Algorithm[[] We stress that on steps 6 and 8, when the averaging agreement algorithm AvG is called, the Byzantines can adopt any procedure BYZ, which
*Note that bouers (even conservative) on such values suffice. Our guarantees still hold, though T TheAss( (8) would take larger values, which makes LEARN slower converge to 6..

---

consists in sending any message to any node at any point based on any information in the system, and delaying for any amount of time any message sent by any honest node. Note that, apart from this, all other steps of Algorithm is purely local operation.
Data: Local loss gradient oracle, parameter >>
Result: Model parameters
Initialize local parameters 0, using a fixed common seed;
Fix learning rate // - 8/12L;
3 Fix number iterations - LEARS (5);
for t <- .,....7 T do
f GradientOracle((j.. by); 7t AVG (Tr, BYZ) // Vulnerable Byzantine attacks
0 1+1122 0, 775
o++1 + AVG (o (0/1//2 BYZ) // Vulnerable to Byzantine attacks
9 end
Draw U([T) using the fixed common seed;
11 Return 0,;
Algorithm 1: LEARN execution on honest node.
Remark 1. In practice, may be more efficient return the last computed vector family, though our proof applies to randomly selected iteration.
Theorem 1. Under assumptions
and K given G-averaging agreement oracle AVG, on any input 0 < 5 < 3, LEARN sOLves Byzantine C-collaborative learning.
The proof is quite technical, and is provided in the supplementary material. Essentially, it focuses on the average of all honest nodes' local parameters, and on the effective gradients that they undergo, given the local gradient updates and the applications of the averaging agreement oracle AvG.
Our proof requires (0) @ max {8-2, (t + sup=21 ox) -0())) To
Remark 2.
prevent the noise from being the bottleneck for the convergence rate, then need ( so that FERRS ((8-a). Interestingly, this can be obtained by, for example, setting by & for t < Ti 0(8 2). and b a Ti for >> Tr, where Ti is precisely defined by the proof provided the supplementary material. In particular, we do not need to assume that by + DC.
Converse reduction
We also prove the converse reduction, from averaging agreement to collaborative learning. Theorem 2. Given Byzantine C-collaborative learning oracle, then, for any 8 there solution to Byzantine (1 + 5) a)C-averggnng agreement.
The proof is given in the supplementary material. It is obtained by applying a collaborative learning algorithm LEARN to the local loss functions ()) A x0 1 ||2
This converse reduction proves the tightness of our former reduction, and allows to straightforwardly derive impossibility theorems about collaborative learning from impossibility theorems about averag- ing agreement. In particular, in the sequel, we prove that no asynchronous algorithm can achieve better than Byzantine h+2f -averaging agreement. It follows that no algorithm can achieve better than Byzantine A+25-s collaborative learning. Similarly, Theorem 6 implies the impossibility of Byzantine asynchronous collaborative learning for n S 3f.
à
3.3 Particular cases
Trusted server. It is straightforward to adapt our techniques and prove the equivalence between averaging agreement and collaborative learning a context with a trusted server. Our lower bounds for asynchronous collaborative learning still apply to C-averaging agreement, and thus to C-collaborative learning. Note, however, that the trusted server may allow to improve the speed of collaborative learning, as it no longer requires contracting the parameters of local nodes' models.
7

---

Homogeneous learning. In the supplementary material, we propose faster algorithm for i..d. data, called HOM-LEARN, which skips the averaging agreement of nodes' gradients. Despite requiring fewer communications, HOM-LEARN remains correct, as the following theorem shows.
Theorem 3. Under assumptions
for i.i.d. local data and given C-averaging agreement oracle AVG, on input > LEAR guarantees A2 S 82 and E VL (0.) s 82.
2
4 Solutions to Averaging Agreement
We now present two solutions to the averaging agreement problem, called MINIMUM-DIAMETER AVERAGING (MDA) and RELIABLE BROADCAST TRIMMED MEAN (BB,MM), each thus inducing a solution to collaborative learning. We prove each optimal according to some dimension.
4.1
Optimal averaging
Given family & E Rdd of vectors, MDA first identifies subfamily SMDA (2) of q vectors of minimal lz diameter, i.e.,
SMDA (2) arg min mig A2
(2(5))
arg min max SCigl J.ES =--
22()) 2kx
(9)
Sclal 181=9-/
We denote XMDA) E ( the subfamily thereby selected. MDA then outputs the average of this subfamily, i.c.,
(DA(2)
Σ
200)
(10)
f
jESuDA
On input NN E N, MDAN iterates MDA TMDA (NV = [N 2n times on vectors received from other nodes each communication round such that the output of round will be the input of round t +++ 1. The correctness of MDA is then ensured under the following assumption.
Assumption 5 (Assumption for analysis of MDA). There is 0 < < 1 such that I-e f. This then allows to set 2 h + 5+32 f. In this case, we define & _ 2r
I+E"
MDA achieves Byzantine (2f+h-g)ut(g-21) -averaging agree- h(g-1)8
Theorem 4. Under Assumption
ment.
The proof is given in the supplementary material. It relies on the observation that, because of the filter, no Byzantine vector can significantly harm the estimation of the average.
Remark 3. Although MDA runs in linear time d, it runs exponential time in q. Interestingly, assuming that each honest node fully trusts its computations and its data (which may not hold if parameter-senve servers do not compute gradients as in (301). each honest node can use its own vector to filter out the f most dissimilar gradients in linear time in q, and can average out all remaining vectors. Using a similar proof as for MDA, the algorithm thereby defined can be shown to achieve asymptotically the same averaging constant MDA, in the limit q >> f; but it runs in O (requiring however n 2 7f +1).
Theorem 5. No asynchronous algorithm can achieve better than Byzantine h425-9 242f-n-averrginn agreement.
The proof is given in the supplementary material. It relies on the quasi-unanimity lemma, which shows that if node receives least q - f identical vectors æ, then it must output æ. We then construct an instance where, because of this and of Byzantines, honest nodes cannot agree. Note that, as corollary, in the regime g = - so and = o(h), MDA achieves asymptotically the best-possible averaging constant, up to multiplicative constant equal to 3/2.
'Introduced by [3 in the context of robust machine learning, it uses the same principle as the minimal volume ellipsoid, that introduced by (36] in the context of robust statistics.

---

4.2 Optimal Byzantine resilience
Our second algorithm makes use of reliable broadcas each Byzantine node broadcasts only single vector (the uniqueness property of reliable broadcast in [].. We denote wi E Rd the family of vectors proposed by all nodes. For each j E [A], w() = xوعح is the vector of an honest node, while a Byzantine node proposes w)) for each j E [h + n.]. Moreover, [ showed the existence of multi-round algorithm which, by using reliable broadcast and a witmess mechanism, guarantees that any honest nodes and & will collect at least q similar inputs. Formally, denoting Q [n] the set of nodes whose messages were successfully delivered to node j (including through relays), the algorithm by [ guarantees that IQ() n ( 2 q for any two honest nodes j. k E [M.. At each iteration of our RB-TM algorithm, each node j exploits the same reliable broadcast and witness mechanism techniques to collect other nodes' vectors. Now, given its set Q of collected messages, each node applies coordinate- wise trimmed mean, denoted TM, as follows. For each coordinate i, discards the f smallest i-th coordinates it collected, well as the largest. We denote g(i t the subfamily received by node j, and (i)) C [nx] the subset of nodes whose i-th coordinates remain after trimming. Node j then computes the average yاو of the i-th coordinates of this subset, iee
y [ A
(1))
(11)
[Q0|
2f (E
RB-TM consists of iterating TM, on vectors received from other nodes at each communication round. Namely, given imput N E N. BMM iterates TM TRB-IM(-V) times, where
& (N 1) In + In vh
TRB-TM(N)
(12)
The correctness of RB-TM can then be guaranteed under the following assumption.
Assumption (Assumption for analysis of RB-TM). There is > such that n 2 (3 + eef. We then set q = 11 - f, and define E A I+e'
Theorem 6. Under Assumption RB-TM guarantees Byzantine 4f aveerggng agreement. This is Vh optimal in terms of Byzantine resilience. Indeed, S 3f, no algorithm can achieve Byzantine averaging agreement.
The proof is provided in the supplementary material. The correctness relies on a coordinate-wist analysis, and on the study of so-called coordinate-wise diameter, and its relation with the &2 diameter. The lower bound exploits the quasi-unanimity lemma. Note that while RB-TM tolerates more Byzantine nodes, its averaging constant is larger than that of MDA by factor of O(vh).
5 Empirical Evaluation
We implemented our collaborative learning algorithms using Garfield library 20 and Py Torch [34] Each agreement algorithm comes in two variants: one assuming i.i.d. data (See supplementary material) and one tolerating non-i.i.d. data (Algorithm[]) [T. In each case, the first variants require fewer communications. We report below on the empirical evaluation of the overhead of our four variants when compared to a non-robust collaborative learning approach. Our baseline indeed a vanilla fully decentralized implementation in which all nodes share their updates with each other and then aggregate these updates by averaging (a deployment that cannot tolerate even one Byzantine node).
We focus on throughput, measuring the number of updates the system performs per second. As we consider an asynchronous network, we report on the fastest node in each experiment. We consider image classification tasks, using MNIST (29 and CIFAR-10 27 datasets. MNIST is a dataset of handwritten digits with 70,000 28 x 28 images in 10 classes. CIFAR- 10 consists of 60,000 32 32 colour images in 10 classes. We use batches of size 100, and we experimented with 5 models with different sizes ranging from simple models like small convolutional neural network (MNIST CNN and Cifarnet), training a few thousands of parameters, to big models like ResNet-50 with around 23M
CCN
NNte that MDA can also be straightforwardly upgraded into RB-MDA to gain Byzantine resilience.

---

0.7
LEARN-IA-MIA
0.6
400
REARN-oo--id-MDD.
0.5
0.4
Vanilla SGD
Slowdownn
300
LEARN-Bor BAAARNN-o-----R--- -i----dd------------------------
LEARN-id-RB-
LEARN-Bd-MDA
0.3
LEARN-non-Id-MDDA
200
0.2-
LEARN-id-RB- TM-
0.1
LEARN-Bon-iiee I
100
0.0
14
Training epocias
XINIST CNX
ClunNe
Beasx--15 15
Reases-4 -4
Resoct-50
Figure I: Convergence of our algorithms and the vanilla baseline.
Figure 2: Slowdown of our algorithms normalized to the vanilla baseline throughput.
We always employ nodes from the same cluster, each having 2 CPUs (Intel Xeon E5-2630 v4) with 14 cores, 768 GiB RAM, 2 10 Gbps Ethernet, and 2 Nvidia Tesla P100 GPUs. We set 1, except when deploying our vanilla baseline.
parameters, Our experimental platform is Grid5000 [9).
the convergence of our algorithms to the vanilla baseline w.r.t. the training epochs. We use 7 nodes in this experiment, and we train Resnet-18 with CIFAR10. We verify from this figure that our algorithms can follow the same convergence trajectory as the vanilla baseline. It clear from the figure that the i.idd versions outperform the non-i.i.d ones.
[igureecoompan
Figure 2 depicts the throughput overhead of our algorithms (with both i.i.d. and non-i.id. data) compared to our vanilla baseline, with 10 nodes from the same cluster. Three observations from this figure are in order. First, the MDA- bbsed algorithm performs better than the RB-TM one. The reason is that the latter incurs much more communication messages than the former as the latter uses reliable broadcast and witness mechanism. Second, tolerating Byzantine nodes with i.i.d. data much cheaper than the non-i.i.d. case. The reason is that it is harder to detect Byzantine behavior when data is not identically distributed on the nodes, which translates into more communication steps. Third, the slowdown is much higher with small models (i.c.. MNIST CNN and Cifarnet). This is because the network bandwidth is not saturated by the small models in the vanilla case, where gets congested with the many communication rounds required by our algorithms, On the other hand, with the larger models, the vanilla deployment saturates the network bandwidth, making the extra communication messages account only for linear overhead.
Finally, it is important to notice that our evaluation is by no means exhaustive and our implementation has not been optimized. Our goal was to give an overview of the relative overheads. With proper optimizations, we believe the actual throughput could be increased for all implementations.
6 Conclusion
We defined and solved collaborative learning fully decentralized. Byzantine, heterogeneous, asynchronous and non-convex setting. We proved that the problem is equivalent to new abstract form of agreement, which we call averaging agreement. We then described two solutions to averaging agreement, inducing two original solutions to collaborative learning. Each solution is optimal along some dimension. In particular, our lower bounds for the averaging agreement problem provide lower bounds on what any collaborative learning algorithm can achieve. Such impossibility results would have been challenging to obtain without our reduction. Our algorithms and our impossibility theorems very general but can also be adapted for specific settings, such the presence of trusted parameter server, the assumption i.i.d. data or a synchronous contex ? the latter case for instance, our two algorithms would only require n > 4f + and 2 2/ + 1, respectively.
Limitations and potential negative social impacts. Like all Byzantine learning algorithms, we essentially filter out outliers. In practice, this may discard minorities with vastly diverging views. Future research should aim to address this fundamental trade-off between inclusivity and robustness. We also note that the computation time of MDA grows exponentially with when is a constant fraction of q.
In the synchronous case of MDA, with n.n. 2 4+2s f is sufficient to guarantee 2 1+th+ 5+33 f in I-c
2
Assumption 5 Also, note that synchronous algorithm can achieve better than & -veeraging agreement.
10

---

Acknowledgments and Disclosure of Funding
We thank Rafaël Pinot and Nirupam Gupta for their useful comments. This work has been supported in part by the Swiss National Science Foundation projects: 200021 200021_1825422 Machine learning and 200021 200021_200477, 200477, Controlling the spread of Epidemics. Most experiments presented in this paper were carried out using the 5000 testbed, supported by scientific interest group hosted by Inria and including CNRS, RENATER and several Universities as well as other organizations (see https://www.t http://wwwww.g55000000o grid5000.d
References
[1] Ittai Abraham, Yonatan Amit, and Danny Dolev. Optimal resilience asynchronous approximate agreement. In International Conference on Principles of Distributed Systems, pages 229-239. Springer, 2004.
[2] Dan Alistarh, Zeyuan Allen-Zhu, and Jerry Li. Byzantine stochastic gradient descent. In Neural Information Processing Systems, pages 4613-4623, 2018.
[3] Gilad Baruch, Moran Baruch, and Yoav Goldberg. A little is enough: Circumventing defenses for distributed learning, In Neural Information Processing Systems, pages (635-8645, 2019.
[4] Peva Blanchard, El-Mahdi El-Mhamdi, Rachid Guerraoui, and Julien Stainer. Machine learning with adversaries: Byzantine tolerant gradient descent. In Neural Information Processing Systems, pages 118 118-128, 2017.
[5] Gabriel Bracha. Asynchronous byzantine agreement protocols. Information and Computation, 75(2):130-1433 1987.
[6] Samantha Bradshaw and Philip N Howard. The global disinformation order: 2019 global inventory of organised social media manipulation. Project Computational Propaganda, 2019.
[7] Miguel Castro, Barbara Liskov, et al. Practical Byzantine fault tolerance. In Operating Systems Design and Implementation, volume 99, pages 173-186, 1999.
[8] Lingjiao Chen, Hongyi Wang, Zachary Charles, and Dimitris Papailiopoulos. Draco: Byzantine- resilient distributed training via redundant gradients. In International Conference on Machine Learning, pages 902-911, 2018.
[9] Georgios Damaskinos, El-Mahdi El-Mhamdi, Rachid Guerraoui, Rhicheek Patra, and Mahsa Taziki. Asynchronous Byzantine machine learning (the case of SGD)). In Neural Information Processing Systems, volume 80, pages 1145-1154, 2018.
[10] Canh T. Dinh, Nguyen H. Tran, and Tuan Dung Nguyen. Personalized federated learning with moreau envelopes. In Hugo Larochelle, Mare' Aurelio Ranzato, Raia Hadsell, Maria-Florina Balcan, and Hsuan-Ticn Lin, editors, Advances in Neural Information Processing Systems 33: Annual Conference on Neural Information Processing Systems 2020, NeurIPS 2020, December 6-12, 2020, virtual, 2020.
[11] Danny Dolev, Nancy A Lynch, Shlomit S Pinter, Eugene W Stark, and William E Weihl, Reaching approximate agreement in the presence of faults. Journal of the ACM, 33())499-516 1986.
[12] El-Mahdi El-Mhamdi, Rachid Guerraoui, Arsany Guirguis, Le Nguyên Hoang, and Sébastien Rouault. Genuinely distributed Byzantine machine learning. In Principles of Distributed Computing, pages 355-364, 2020.
[13] El-Mahdi El-Mhamdi, Rachid Guerraoui, and Sébastien Rouault. The hidden vulnerability of distributed learning in Byzantium. International Conference on Machine Learning, volume 80, pages 3521-3530, 2018

---

[14] Alireza Fallah, Aryan Mokhtari, and Asuman E. Ozdaglar. Personalized federated learning with theoretical guarantees: A model-agnostic meta-learning approach. Hugo Larochelle, Marc' Aurelio Ranzato, Raia Hadsell, Maria-Florina Balcan, and Hsuan-Tien Lin, editors, Ad- vances in Neural Information Processing Systems 33: Annual Conference on Neural Information Processing Systems 2020, NeurlPS 2020, December 6-12 12, 2020, virtual, 2020.
[15] Sadegh Farhadkhami, Rachid Guerraoui, and Lē-Nguyèn Hoang. Strategyproof learning: Build- ing trustworthy user-generated datasets. ArXiV, 2021.
[16] AD Fekete. Asymptotically optimal algorithms for approximate agreement. In Principles of Distributed Computing, pages 73-87, 1986.
[17] Alan David Fekete. Asynchronous approximate agreement. In Principles of Distributed Computing, pages 64-76, 1987.
[18] Michael J Fischer, Nancy A Lynch, and Michael S Paterson. Impossibility of distributed consensus with one faulty process. Journal of the ACM, 32(2):374-382 1985.
[19] Grid5000. Grid5000. httpps//vnn wwwpwwwwww..o.oow.... fr/ 2019.
[20] Rachid Guerraoui, Arsany Guirguis, Jérémy Plassmann, Anton Ragot, and Sébastien Rouault. Garfield: System support for byzantine machine learning (regular paper). In 2021 51st Annual IEEE/IFIP International Conference Dependable Systems and Networks (DSN), pages 39-51.
IEEE, 2021.
[21] Arsany Guirguis. LEARN source code. http://ghhtttccco///p/pp//aaaaa/ decentralized
[22] Shangwei Guo, Tianwei Zhang, Xiaofei Xie, Lei Ma, Tao Xiang, and Yang Liu. Towards byzantine-resllient learning in decentralized systems. arXiv preprint (rXiv20002.08569 2020.
[23] Filip Hanzely, Slavomír Hanzely, Samuel Horväth, and Peter Richtárik. Lower bounds and optimal algorithms for personalized federated learning. In Hugo Larochelle, Mare' Aurelio Ranzato, Raia Hadsell, Maria-Florina Balcan, and Hsuan- Assua-Tienn Lin, editors, Advances in Neural Information Processing Systems 33: Annual Conference Neural Information Processing Systems 2020, NeurlPS 2020, December 6- 12, 2020, virtual, 2020.
[24] Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 770-778, 2016.
[25] Sai Praneeth Karimireddy, Lie He, and Martin Jaggi. Learning from history for byzantine robust optimization. In Marina Meila and Tong Zhang, editors, Proceedings of the 38th International Conference on Machine Learning, ICML 2021, 18- 24 July 2021, Virtual Event, volume 139 of Proceedings of Machine Learning Reseurch, pages 531 -319.. PMLR, 2021.
[26] Jakub Konečný, H Brendan McMahan, Daniel Ramage, and Peter Richtárik. Federated optimiza- tion: distributed machine learning for on-device intelligence. arXiv preprint arXiv: 1610.0225, 2016.
[27] Alex Krizhevsky. Cifar dataset. https://www. cs. toronto........... edu/"kriz/cifiif citp:/cirr.... .htm] 2009.
[28] Leslie Lamport, Robert Shostak, and Marshall Pease. The Byzantine generals problem. Trans- actions on Programming Languages and Systems, 4(3)382-401, 1982.
[29] Yann Lecunn. Mnist dataset. http::/yann. 1ecun cww/ wwwp///w/////n/tt.o/eeoo / 1998.
[30] Mu Li, David G Andersen, Jun Woo Park, Alexander Smola. Amr Ahmed, Vanja Josifovski. James Long, Eugene J Shekita, and Bor- Yiing Su. Scaling distributed machine learning with the parameter server. In Operating Systems Design and Implementation, volume 1, page 3, 2014.
[31] Hammurabi Mendes and Maurice Herlihy, Multidimensional approximate agreement in byzan- tine asynchronous systems. In Symposium on Theory of computing, pages 391-400 2013.
12

---

[32] EI Mahdi EI Mhandi, Rachid Guerraoui, and Sébastien Rouault. Distributed momentum for byzantine-resiliet resilieen stochastic gradient descent. In 9th International Conference on Learning Representations, ICLR 2021, Virtual Event, Austria, May 3-7, 2021. OpenRevieww.,, 2021.
[33] Lisa-Maria Neudert, Philip Howard, and Bence Kollanyi. Sourcing and automation of political news and information during three european elections. Social Media+ Society, (E3)20663001198833112 2019.
[34] Adam Paszke, Sam Gross, Francisco Massa, Adam Lerer, James Bradbury, Gregory Chanan, Trevor Killeen, Zeming Lin, Natalia Gimelshein, Luca Antiga, et al. Pytorch: An imperative style, high-performance deep learning library. arXiv preprint 1rxiv:191..01703, 2019.
[35] Shashank Rajput, Hongyi Wang, Zachary Charles, and Dimitris Papailiopoulos. Detox: A redundancy-basee based framework for faster and more robust gradient aggregation. In Neural Information Processing Systems, pages 10320-10330, 2019.
[36] Peter Rousseeuw. Multivariate estimation with high breakdown point. Mathematical Statistics and Applications, 8:283-297, 1985.
[37] David E Rumelhart, Geoffrey E Hinton, and Ronald J Williams. Learning representations by back-propp propagating crrors. Nature, (638))3) 1986.
[38] Cong Xie, Oluwasanmi Koyejo, and Indranil Gupta. Generalized Byzantine-tolerant SGD. arXiv preprint arXiv: 1802. /01 16, 2018
[39] Zhixiong Yang and Waheed Bajwa. Bridge: Byzantine-resilient decentralized gradient descent. arXiv preprint a90iv: 0808, 2019.
[40] Zhixiong Yang and Waheed U Bajwa. Byrdie: Byzantine-resilient distributed coordinate descent for decentralized learning. Transactions on Signal and Information Processing over Networks, 5(4):61 2019.
13

---

Checklist
1. For all authors...
(a) Do the main claims made in the abstract and introduction accurately reflect the paper's
contributions and scope? [Yes]
(b) Did you describe the limitations of your work? [Yes] The assumptions are fully explicit.
(c) Did you discuss any potential negative societal impacts of your work? [Yes] The conclusion notes the tension between security and inclusivity. We call for further research in addressing this tradeoff.
(d) Have you read the ethics review guidelines and ensured that your paper conforms to them? [Yes]
2. If you are including theoretical results...
(a) Did you state the full of assumptions of all theoretical results? [Yes] Our assump- tions are clearly highlighted in Section 2.2
(b) Did you include complete proof' of all theoretical results? [Yes] They are provided in supplementary material 3. If you ran experiments...
(a) Did you include the code, data, and instructions needed to reproduce the main exper- imental results (either in the supplemental material or as a URL)? [Yes] The code is open-sourced and can be found here [21].
(b) Did you specify all the training details (c.g.. data splits, hyperparameters, how they were chosen)? [No] Choosing the best hyperparameters is out of the scope of this paper. In our experimental evaluation, we focus only on the systems metrics, e.g., throughput.
(c) Did you report error bars (c.g., with respect to the random seed after running experi- ments multiple times)? [No] Error bars in our experiments are very small; we omitted them for better readability.
(d) Did you include the total amount of compute and the type of resources used (e.g.. type of GPUs, internal cluster, cloud provider)? [Yes] See Section [
4. If you using existing assets (e.g., code, data, models) curating/releasing
assets...
(a) If your work uses existing assets, did you cite the creators? [Yes] See Section [
(b) Did you mention the license of the assets? [No] The license can be found using the provided URLs.
(c) Did you include any new assets either in the supplemental material or as URL? [No]
(d) Did you discuss whether and how consent was obtained from people whose data you're 're're using/curating? [No] The datasets and models we use are already open-sourced.
(c) Did you discuss whether the data you are using/curating contains personally identifiable information or offensive content? [N/A]
5. If you used crowdsourcing conducted research with human subjects...
(a) Did you include the full text of instructions given to participants and screenshots, applicable? [N/A]
(b) Did you describe any potential participant risks, with links Institutional Review Board (IRB) approvals, if applicable? [N/A]
(c) Did you include the estimated hourly wage paid to participants and the total amount spent on participant compensation? [N/A]
14


Reviews:
[{"review_id": "wmUJT0T5FjX", "reviewer": "Reviewer_cDim", "summary": "The paper considers collaborative learning in an (asynchronous) decentralized setup in the presence of Byzantine nodes. The authors define two problems: Byzantine-robust collaborative learning and Byzantine-robust ‘averaging agreement’. The main contribution is to show an equivalence between these two problems. Then, the paper proposes two algorithms for averaging agreement, which yield Byzantine-robust collaborative learning solutions. Finally, the paper shows that when the number of Byzantine nodes is larger than 1/3, then no algorithm can achieve Byzantine averaging agreement. ", "questions": "", "limitations": "", "rating": 7, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "*Originality and Quality:* The notion of Byzantine averaging agreement and the equivalence result are interesting. As mentioned in the paper, the equivalence result is powerful, as it allows one to obtain impossibility results for collaborative learning. On the other hand, I have three major concerns. \n\n1. The collaborative learning definition (Definition 1) warrants more justification. Works on Byzantine-robust distributed learning typically present learning algorithms which converge to a critical point of the (non-convex) statistical loss function. Is \\bar{theta} serving the same purpose according to (4)? It will be important to add a discussion here. Without comparing to standard collaborative/distributed learning setups and objectives, it is difficult to appreciate the definition. \n\n2. The paper assumes that there is a predefined common seed. How is the common seed generated in the presence of Byzantine nodes? It is helpful to give more details on this. \n\n3. As mentioned in Remark 1, batch size needs to grow linearly with the number of iterations for the proof of Theorem 1 to hold. This seems to be quite restrictive from a practical perspective. Is this an artifact of the proof techniques or is it more fundamental? It would be important to add more details on this. \n\nApart from these, another question is about the reliable broadcast model. Is the reliable broadcast decentralized model equivalent to the (trusted) parameter-server-based model (operationally, both the models seem to be the same)? It will be helpful to compare and contrast the two models.\n\n*Clarity:* The paper is generally well-written, but the quality can be improved. Please find below some comments.  \n\n1. It will be helpful to comment on how the formulation (in terms of the objective function) of collaborative learning compares with [36] (other than convex loss and synchrony assumption). Also, how does the model compare with that in [13]?\n\n2. It will be important to explicitly define the notation in lines 6 and 8 of Algorithm 1. How is BYZ(.) defined?\n\n3. According to Definition 2, AVG outputs a family of vectors. As per (10), MDA outputs a single vector. I may be missing something here, but it would clearly be helpful to provide more details. \n\n4. It will be helpful to formally define \\bar{theta}. Assumption 5 should be stated in Theorem 4.\n\n*Significance:* Unlike Byzantine-robust distributed learning (with a parameter server), which has received significant research attention recently, decentralized learning with Byzantine-resilience has received much less research attention. The asynchronous and omniscient adversary setup considered seems a bit too strong for practice, but it is intellectually interesting. The notion of averaging agreement and the equivalence result are quite interesting. I am willing to reconsider my score if the authors can address the major concerns and improve the clarity of exposition. ", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "The authors have discussed potential negative societal impact. It will be helpful to discuss limitations of the proposed averaging agreement algorithms: e.g., runtime of MDA is exponential in q when q is comparable to f, and trimmed-mean requires reliable broadcast assumption. ", "review_text": "", "extra_scores": {"needs_ethics_review": "No", "ethics_review_area": "", "time_spent_reviewing": "5"}, "extra_text": {}}, {"review_id": "tVHcXCMxoKT", "reviewer": "Reviewer_8fQX", "summary": "This paper considers the Byzantine-robust learning problem in a decentralized network. The authors discuss the connection between Byzantine-robust learning and averaging agreement. ", "questions": "", "limitations": "", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "The authors claim that this paper addresses the problem of Byzantine-robust learning for the decentralized, asynchronous and heterogeneous setting. However, several issues must be clarified to avoid misunderstanding.\n- The decentralized topology seems to be a complete graph. This is different to, and relatively simpler than the incomplete graph that is of interest to the machine learning community. \n- The asynchronous communication model assumes the malicious nodes can delay transmissions to the honest nodes. Intuitively the malicious nodes would like to send messages as fast as possible so as to maximize the effects of attacks. Therefore, this asynchronous setting can reduce to the worst case: among the q messages received by any honest node, f of them are malicious.\n- Heterogeneity is a big challenge to Byzantine-robustness. This paper discusses its impact, but does not show how to address this issue.\n\nI understand that the authors focus on the theoretical part of Byzantine-robustness, but sufficient numerical experiments are necessary for a NeurIPS paper. At least, the authors should compare the proposed methods with the existing decentralized Byzantine-robust learning algorithms. The authors should also show more performance metrics, in addition to slowdown.\n\nThe proposed MDA method is not new. Please cite proper references and give some discussions.\n", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "No comment.", "review_text": "", "extra_scores": {"needs_ethics_review": "No", "ethics_review_area": "", "time_spent_reviewing": "6"}, "extra_text": {}}, {"review_id": "fwNdtm_1dB", "reviewer": "Reviewer_RG8y", "summary": "The paper presents algorithms for collaborative learning which are distributed and robust wrt Byzantine nodes as long as these do not exceed either 1/3 or 1/6 of the total number of nodes.  This result is achieved by proving the equivalence of two concepts the authors introduce, C-learning and C-averaging where C is a constant.  Computational results are provided to support the claims of the paper.", "questions": "", "limitations": "", "rating": 6, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "\nThe paper tackles an important problem in distributed learning, namely, with the existence of Byzantine nodes, how does one construct cross-node learning algorithms which automatically and effectively filter out the influence of the unknown miscreant nodes and leverage neighbor node learning?    The writing of this paper is generally clear but occasionally there are lapses of clarity which turn out to be quite essential for following the basic narrative of this paper.  For example, the key concepts of C-leaning and C-averaging are defined only with reference to honest nodes but each node has to update its gradient vector and \\theta estimates without such explicit knowledge.  So what is the exact procedure each nodes follows?  Is that what is shown as Algorithm 1 on line 240?  What's BYZ in steps 6 and 8 in this algorithm?   What does the equivalence of C-learning and C-averaging -- which involve honest nodes only -- has to say about the impact of Byzantine nodes on estimate of the gradient communicated to other nodes?   Remark 2 seems to mean T_{LEARN} scales like 1/\\delta^3 and since batch size (see line 251) is set to t for t<=T_1 and equal to T_1 thereafter, nodes potentially have to use enormous batch sizes.  Are super large batch sizes needed to dilute the contribution of Byzantine nodes?  Is it then implicitly assumed that each node effectively has unlimited data from its own distribution?  Where do the coefficients 1/3 ( n > 3f) and 1/6 (n>6f) come from?  How does one ensure Assumption 5, which gives rise to 6 in n> 5f, holds in any given setting?  What happens if the data for all the honest nodes come from the same distribution, in other works when there is no heterogeneity?  In this case K=0 but it seems this paper has nothing to offer in this case, per statement on line 216.", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "\nIt is hard to see where the authors identify key limitations of this paper often buried under 1/2 dozen assumptions made.  This is quite serious as there appears to be a large amount of averaging going on in the cross-node learning process necessitated to filter out the influence of the Byzantine nodes which is not explicitly localized and stated except implicitly within the 1/2 dozen assumptions.  The authors can start by explaining briefly where and why each assumption is needed.", "review_text": "", "extra_scores": {"ethical_concerns": "NA", "needs_ethics_review": "No", "ethics_review_area": "", "time_spent_reviewing": "4"}, "extra_text": {}}, {"review_id": "MkP2AZRak3y", "reviewer": "Reviewer_A4Yt", "summary": "The authors present a study on Byzantine collaborative learning. In it, n nodes try to learn from each other’s data collectively and some f < n nodes can be adversarial to the learning process and are defined Byzantine. Such problem of collaborative learning is in a fully decentralised, Byzantine, heterogeneous and asynchronous environment with non-convex loss functions. \nIn the first part, the authors formulate the collaborative learning problem; They then present an equivalence between collaborative learning and a problem called averaging agreement via two reductions from the former to the latter and vice versa. \nTheir reduction proves useful to draw impossibility results and optimal algorithms for collaborative learning through the averaging agreement problem.\nTherefore, they then move on to define a Byzantine collaborative learning algorithm called LEARN that allows to solve a Byzantine collaborative learning problem given an averaging agreement problem.\nIn the last section, the authors present and discuss some empirical evaluations.\n\n\n", "questions": "", "limitations": "", "rating": 7, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "General Comments\nThe paper is very precise accurate, and its structure is very clear. The double-ended reduction is quite interesting and suggests it could become a powerful tool. \nThe notation is a bit cumbersome and reminding what some values represent somewhere along the paper could help improve the readability of the work.\nA couple of key concepts are mentioned and used but not well-presented nor described. For example, the averaging agreement protocol is barely defined and it could be better appreciated with more explanations.\n\nGeneral Feeling\nThe paper is solid and shows attention to the details, the modifications suggested are intended to correct minor lacks. I recommend acceptance.\n\nDetailed Notes\n-\tTheorem 5 the second sentence suggests to be a corollary. Consider making it one.\n-\tFigure 1 is very small and in this way hard to appreciate, I suggest making it bigger. Possibly not framed in text if not requested by the format guidelines\n-\tDespite putting the reference to the definition of Byzantine problems, a brief sentence could be helpful to recall what the authors refer to with the term Byzantine.\n-\tI cannot seem to find a real description of what averaging agreement is, nor a citation to works having it\n-\tPage 3 line 106 “in order of billions…”  “in the order of billions…”", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "Seems adequate. ", "review_text": "", "extra_scores": {"needs_ethics_review": "No", "ethics_review_area": "", "time_spent_reviewing": "6h"}, "extra_text": {}}]

Author rebuttal:

Meta-review: This paper proposes a Byzantine-robust fully decentralized learning approach under data heterogeneity.

The reviews were initially quite mixed. After reading the author response, several reviewers updated their score. Some concerns about the role/relevance of using large batch sizes, as well as the lack of insights on what robustness can be achieved in the heterogeneous setting. However, the reviewers appreciated the response and recognize the relevance of the problem, approach and evaluation.

Therefore, the paper is accepted. The authors are strongly encouraged to incorporate suggestions and additional details from the discussion, in particular to improve the clarity of the presentation and give more intuitions about the approach.
Decision: Accept (Poster)