FL-WBC: Enhancing Robustness against Model Poisoning Attacks in Federated Learning from a Client Perspective
Authors: Jingwei Sun
Ang Li
Louis DiValentin
Amin Hassanzadeh
Yiran Chen
Hai Li
Venue: NeurIPS 2021 Poster (2021)
Keywords: Federated Learning
Robustness
Byzantine attack

Abstract: Federated learning (FL) is a popular distributed learning framework that trains a global model through iterative communications between a central server and edge devices. Recent works have demonstrated that FL is vulnerable to model poisoning attacks. Several server-based defense approaches (e.g. robust aggregation), have been proposed to mitigate such attacks. However, we empirically show that under extremely strong attacks, these defensive methods fail to guarantee the robustness of FL. More importantly, we observe that as long as the global model is polluted, the impact of attacks on the global model will remain in subsequent rounds even if there are no subsequent attacks. In this work, we propose a client-based defense, named White Blood Cell for Federated Learning (FL-WBC), which can mitigate model poisoning attacks that have already polluted the global model. The key idea of FL-WBC is to identify the parameter space where long-lasting attack effect on parameters resides and perturb that space during local training. Furthermore, we derive a certified robustness guarantee against model poisoning attacks and a convergence guarantee to FedAvg after applying our FL-WBC. We conduct experiments on FasionMNIST and CIFAR10 to evaluate the defense against state-of-the-art model poisoning attacks. The results demonstrate that our method can effectively mitigate model poisoning attack impact on the global model within 5 communication rounds with nearly no accuracy drop under both IID and Non-IID settings. Our defense is also complementary to existing server-based robust aggregation approaches and can further improve the robustness of FL under extremely strong attacks.

FL-WBC: Enhancing Robustness against Model Poisoning Attacks in Federated Learning from a Client Perspective
Jingwei Sun', Ang Li', Louis DiValentin', Amin Hassanzadeh", Yiran Chen', Hai Li
DDppartment of Electrical and Computer Engineering, Duke University
Security R&D, Accenture Labs, Accenture
(jingweissu, ang.1i630, yiran.chen, hai.li] @ duke.edu,
Mlouis.divvlentin umin.hassanzadeh, accenture.com
Abstract
Federated learning (FL) is a popular distributed learning framework that trains global model through iterative communications between central server and edge devices. Recent works have demonstrated that FL is vulnerable to model poisoning attacks. Several server-based defense approaches (e.g. robust aggre- gation) have been proposed to mitigate such attacks. However, we empirically show that under extremely strong attacks, these defensive methods fail to guar- antee the robustness of FL. More importantly, we observe that as long as the global model is polluted, the impact of attacks on the global model will remain in subsequent rounds even if there are no subsequent attacks. In this work, we propose a client-based defense, named White Blood Cell for Federated Learning (FL-WBC), which can mitigate model poisoning attacks that have already polluted the global model. The key idea of FL-WBC to identify the parameter space where long-lasting attack effect on parameters resides and perturb that space during local training. Furthermore, we derive certified robustness guarantee against model poisoning attacks and convergence guarantee to FedAvg after applying our FL-WBC. We conduct experiments on MNSIO and CIFAR 10 to evaluate the defense against state-of-the-al model poisoning attacks. The results demon- strate that our method can effectively mitigate model poisoning attack impact the global model within 5 communication rounds with nearly accuracy drop under both IID and non-lID settings. Our defense is also complementary existing cerver-based robust aggregation approaches and can further improve the robustness of FL under extremely strong attacks. Our code can be found at https::/g htt.bb/gttttbtg/g///gg// thub com/ F03remy333/FLLWBB.
Introduction
Federated learning (FL) [1, 2] is popular distributed learning approach that enables a number of edge devices to train shared model in federated fashion without transferring their local training data. However, recent works [3-12] show that it is easy for edge devices to conduct model poisoning attacks by manipulating local training process pollute the global model through aggregation.
Depending on the adversarial goals, model poisoning attacks can be classified as untargeted model poisoning attacks [3-6], which aim make the global model indiseriminately have high error rate on any test input, or targeted model poisoning attacks [7-12], where the goal is to make the global model generate attacker-desire misclassifications for some particular test samples. Our work focuses
35th Conference on Neural Information Processing Systems (NcurIPS 2021).

---

on the targeted model poisoning attacks introduced in [11, 12]. In this attack, malicious devices share a set of data points with dirty labels, and the adversarial goal is to make the global model output the same dirty labels given this set of data as inputs. Our work can be easily extended to many other model poisoning attacks (e.g., backdoor attacks), which shall be discussed in $4.
Several studies have been done to improve the robustness of FL against model poisoning attacks through robust aggregations [13-17], clipping local updates [7] and leveraging the noisy perturba- tion [7]. These defensive methods focus on only preventing the global model from being polluted by model poisoning attacks during the aggregation. However, we empirically show that these server- based defenses fail to guarantee the robustness when attacks are extremely strong. More importantly, we observe that as long as the global model is polluted, the impact of attacks on the global model will remain in subsequent rounds even if there are no subsequent attacks, and can not be mitigated by these server-based defenses. Therefore, an additional defense is needed to mitigate the poisoning attacks that cannot be eliminated by robust aggregation and will pollute the global model, which is the goal of this paper.
To achieve this goal, we first propose quantitative estimator named Attack Effect on Parameter (AEP). It estimates the effect of model poisoning attacks on global model parameters and infers information about the susceptibility of different instanti- ations of FL to model poisoning attacks. With our quantitative estimator, we explicitly show the long-lasting attack effect on the global model. Based on our analysis, we design client- based defense named White Blood Cell for Federated Learning (FL-WBC), as shown in Figure 1, which can mitigate the model poisoning attacks that have already polluted the global model. FL-WBC differs from previous server-based defenses in mitigat- ing the model poisoning attack that has already broken through the server-based defenses and polluted the global model. Thus, Figure 1: Overview of FL-WBC.
Central surver
W.st
2
our client-based defense is complementary to current barver-based defense and enhances the ro- bustness of FL against the model poisoning attack. especially against the extremely strong attacks that can not be mitigated during the aggregation. We evaluate our defense on MMshiOn-MNIST [18] and CIFARIO 10 [19] against the model poisoning attack [11] under III (identically independently distributed) and non-lll settings. The results demonstrate that FL-WBC can effectively mitigate the attack effect the global model in 1 communication round with nearly no accuracy drop under IID settings, and within 5 communication rounds for non-IID settings, respectively. We also conduct experiments by integrating the robust aggregation with FL-WBC. The results show that even though the robust aggregation is ineffective under extremely strong attacks, the attack can still be efficiently mitigated by applying FL-WBC.
Our key contributions are summarized as follows:
To the best of our knowledge, this is the first work to quantitatively assess the effect of model poisoning attack on the global model in FL.. Based on our proposed estimator, we reveal the reason for the long-lasting effect of a model poisoning attack on the global model.
We design a defense, which also the first defense to the best of our knowledge, to effectively mitigate a model poisoning attack that has already polluted the global model. We also derive a robustness guarantee in terms of AEP and convergence guarantee to FedAvg when applying our defense.
We evaluate our defense on MaNSI and CIFAR10 against state-of-the-are model poisoning attacks. The results show that our proposed defense can enhance the robustness of FL in an effective and efficient way, i.e., our defense defends against the attack in fewer communication rounds with less model utility degradation.
2
Related work
Model poisoning attacks in FL Model poisoning attack can be untargeted [3-6] or targeted [7-12]. Untargeted model poisoning altacks aim to minmmize the accuracy of the global model indiseriminately for any test input. For targeted model poisoning attacks, the malicious goal is to make the global model misclassify the particular test examples as the attacker-desired target class

---

Miclussfiattion confidence
1.0
fisclssifivatio confidence
Micelesifiattio confidence
1.0
0.8
0.8
0.8
0.6
N
0.6
0=0.11
0.6
0.4
0.4
8=0.2
0.4
8=0
B=0.3
8=0
0.2
0.2
B=0.4
0.2
8=0,3
8m04
0.0
0.0
0.0
0
20
80
100
40
60
80
100
60
80
100
Commumicttion round
Commurication round
Commuriictiin round
(a) Coordiante Median
(b) Coordinate Trimmed Mean
(c) Coordinate Trimmed Mean
(N,
(N, =5)
Figure 2: Defense performance of Coordinate Median aggregation and Coordinate Trimmed Mean aggregation. The black circle denotes the adversarial rounds for all the strategies in the figure.
in its prediction. An adversary using this approach can implant hidden backdoors into the global model so that the images with a trojan trigger will be classified as attacker-desired labels, known as backdoor attack [7-10]. Another type of targeted model poisoning attack introduced in [11, 12]. which aims to fool the global model to produce adversarial misclassification on a set of chosen inputs with high confidence. Our work focuses on the targeted model poisoning attacks in [11, 12].
Mitigate model poisoning attacks in FL A number of robust aggregation approaches have been proposed to mitigate data poisoning attacks while retaining the performance of FL. One typical approach is to detect and down- wowg-weight the malicious client's 's updates on the central server side [13- 16], thus the attack effects training performance can be diminished. The central server calculates coordinate-wisg wise median or coordinate- wise trimmed mean for local model updates before performing aggregation [13]. Similarly, [14] suggests applying geometric median to local updates that uploaded to the server. Meanwhile, some heuristic- based aggregation rules [20, 21, 3, 22, 23] have been proposed cluster participating clients into benign group and malicious group, and then perform aggregation on the benign group only. FoolsGold [20] assumes that benign clients can be distinguished from attackers by observing the similarity between malicious clients' gradient updates, but Krum [21. 3] utilizes the similarity of benign clients' local updates instead. In addition, [7, 24] show that applying differential privacy to the aggregated global model can improve the robustness against model poisoning attacks, All these defensive methods are deployed at the server side and their goals are to mitigate model poisoning attacks during aggregation. Unfortunately, often in extreme cases (e.g. attackers occupy large proportion of total clients), existing robust aggregation methods fail to prevent the aggregation from being polluted by the malicious local updates showing that is not sufficient to offer defense via aggregation solely. Thus, there is an urgent necessity to design enhance robustness against model poisoning attacks at the
novel local training method client side, which is complementary to existing robust aggregation approaches.
3 Motivation
Although current server-basee defense approaches can defend against model poisoning attacks under most regular settings, it is clear whether their robustness still be guaranteed under extremely strong attacks, i.e., with significantly larger numbers of malicious devices involved in training. To investigate the robustness of current methods under such challenging but practical settings, we evaluate Coordinate Median aggregation (CMA) and Coordinate Trimmed Mean aggregation (CTMA) [13] on the model poisoning attack with Fashion-MNIST dataset, which is performed by following the settings in [11]. The goal of the attacks is to make the global model misclassify some specified data samples as target classes. In this experiment, we denote communication round as an adversarial round fade when malicious devices participate in the training, and N,, malicious devices would participate in training at adversarial rounds. We assume that there are 10 devices involved in training in each round, but increase Nm from I to 5 to vary the strength of the attacks. We conduct experiments under IID setting and the training data uniformly distributed to 100 devices. The model architecture can be found in Table 3. For training, we set local epoch E as and batch size B as 32. We apply SGD optimizer and set the learning rate v) to 0.01. The results of confidence that the global model would miss-classify the poisoning data point are shown in Figure 2.
3

---

The results show that the effectiveness of both CMA and CTMA dramatically degrades when there are 50% of malicious devices in the adversarial rounds. It worthy noting that the attack impact on model performance will remain for subsequent rounds even if no additional attacks occur. We observe the same phenomenon in alternative robust aggregation approaches, and more detailed results are presented in $7. Therefore, in order to build a more robust FL. system, it is necessary to instantly mitigate the impact of model poisoning attack as long as the global model is polluted by malicious devices. This has motivated us to design FL-WBC to ensure sufficient robustness of FL even under extremely strong attacks.
4 Model Poisoning Attack in FL
To better understand the impact of model poisoning attacks in FL scenarios, we first need to theo- retically analyze how the poisoning attack affects the learning process and provide mathematical estimation to quantitatively assess the attack effect on model parameters. During this process we come to deeper understanding of the reasons for the persistence of the attack effect observed in $3. Without loss of generality, we employ FedAvg [1], the most widely applied FL algorithm as the representative FL. method throughout this paper.
4.1 Problem Formulation
The learning objective of FedAvg defined as:
N Σn F$ (W)),
W = (Fn(F(W) W
(1)
where Wi is the weights of the global model, N represents the number of devices, F is the local objective of the k-th device, p² is the weight of the k-th device, p² 2 0 and Σ p* = 1.
Equation is solved in an iterative device-server communication fashion. For given communication round (e.g. the t-th), the central server first randomly selects K devices to compose set of participat- ing devices S, and then broadcasts the latest global model W to these devices. Afterwards, each device (c.g. the k-th) in S performs I iterations of local training using their local data. However, the benign devices and malicious devices perform the local training in different manners. Specifically, if the k-th device benign, in each iteration (c.g. the i-th), the local model W on the k-th device is updated following:
W. W
W.,, Me, VF (W st,,),
where Mes is the learning rate, < is batch of data samples uniformly chosen from the k-th device and W initialized as WT-1 contrast, the k-th device malicious, the local model Wh 2.a updated according
Wh + W /o. (W (...) + (1-1)))) (W 1.5, me.
(3)
where Fas is the malicious objective shared by all the malicious devices. Das is malicious dataset that consists the data samples following the same distribution the benign training data but with adversarial data labels. All the malicious devices share the same malicious dataset Das and मe, is a batch of data samples from Da used to optimize the malicious objective. Except that they share malicious dataset, the malicious attackers have the same background knowledge as the benign clients. The goal of the attackers is to make the global model achieve good performance on the malicious objective (i.e, targeted misclassification on DM). Considering the obliviousness of attack, the malicious devices also optimize benign objective, and the trade-off between the benign and malicious objectives is controlled by a, where E [0, 1]. Finally. the server averages the local models of the selected K devices and updates the global model as follows:
N W.
(4)
K
KERE
4.2 Estimation of Attack Effeec on Model Parameters
Based on the above formulated training process, we analyze the impact of poisoning attacks on model parameters. To this end, we denote the set of attackers as MI, and introduce new notation

---

Wi(S; \ MM). which represents the global model weights in the t-th round when all malicious devices in S, S t) do not perform the attack in the i-th training round. Specifically, when W.(S, M)) is optimized following:
Wi M)
N K
Σ (' RES,
where W (a 1) indicates that W is trained using Equation with setting a 1 (i.c., the k-thh device benign). A special case ( M), which means the global model is optimized when all the malicious devices do not conduct attacks before the (-th round. To quantify the attack effect on the global model, we define the Attack Effect on Parameter (AEP) as follows:
Definition 1. Attack Effect on Parameter (AEP), which is denoted as òt, the change of the global model parameters accumulated until t-th due to the attack conducted by the malicious devices in the FL system:
8 & W M) -,
(6)
Based on AEP, we can quantitatively evaluate the attack effect on the malicious objective using FM (W.(S (M) -6,) FM (S).SMMM M.). As Figure 2 illustrates, although W. (S (M) keeps updating after an adversarial round and there are no more attacks before the next adversarial round, the attack effect on the global model, i.e., FM remains for number of rounds. Based such an observation, we assume that the optimization of malicious objective is dominated by ò, compared to W,(S) \ M)), which is learned from the benign objective. Consequently, if the attack effect in round 7 remains for further rounds, | - 5;1 || should be small for t 2 7.
To analyze why the attack effect can persist in the global model, we consider the scenario where the malicious devices are selected in round Tı and 72, but will not be selected between these two rounds. We derive estimator of 6, for TI < t T2. denoted 8G:
8
I K
kEB,
E=0
where H A <2F*(WA,
2.2. st.)) The derivation process is presented in Appendix D. Note that, we do not restrict the detailed malicious objective during derivation, and thus our estimator and analysis can be extended to other attacks, such as backdoor attacks.
4.3 Unveil Long-lasting Attack Effect
The key observation from Equation is that if 8, is in the kernel of each H for i-th iteration where k E S, and / > т, then &, will be the same as 8,, which keeps AEP in the global model. Based on this observation, we discover that the reason why attack effects remain in the aggregated model is that the AEPs reside in the kernel of H To validate analysis, conduct experiments Rushion-MNISS with model poisoning attacks in FL. The experiment details and results are shown in Appendix B. The results show that | 8 would be nearly 0 under effective attacks. We also implement attack boosting by regularizing ò, to be the kernel of H
The above theoretical analysis and experiment results suggest that all the server-based defense methods (e.g. robust aggregation) will not be able efficiently mitigate the impact of model poisoning attacks to the victim global model. The fundamental reason for the failure of these mitigations is that: the transmission of AEP 8, in global model is determined by H, which is inaccessible by the central server. Therefore, it is necessary to design an effective defense mechanism at client side aiming at mitigating attack that has already polluted the global model to further enhance the robustness of FL.
FL-WBC
5.1 Defense Design
Our aforementioned analysis shows that AEP resides the kernels of the Hessian matrices that are generated during the benign devices" local training. In this section, propose White Blood Cell
5

---

for Federated Learning (FL-WBC) to efficiently mitigate the attack effect on the global model. In particular, we reform the local model training of benign devices achieve two goals:
Goal 1: To maintain the benign task's performance, loss of local benign task should be minimized.
. Goal 2: To prevent AEP from being hidden in the kernels of Hessian matrices on benign devices, the kernel of H H should be perturbed.
It is computationally unaffordable to perform the perturbance on H., directly due its high dimension. Therefore, in order to achieve Goal 2, we consider the essence of H i.e., second- order partial derivatives of the loss function, where the diagonal elements describe the change of gradients F (W - V VF*(W)) (Wi.) across iterations. We assume a fixed learning rate is applied for each communication round, and then F (,++1) (W"()) can be approximated by (AW 1,++1 / / In the experiments presented in $4.3, we observe that H has more than 60% elements to be zero the most of iterations. When H,; is highly sparse, we add noise to the small-magnitude elements on its diagonal, which is approximately (AWA. 1 1,++1 A...)/ to
perturb the null space of H Formally, have two steps to optimize W
1,++1
1 1i+1 = W - V. (Wi.. W W.41 w te01 + me Ti, 1, M
(8)
(9)
where TÝ is matrix with the same shape of W. and M., is binary mask whose elements determined as:
1.1(W 5:41 WT.)) AW, ne. ( 0,1(W 5,141 W..) AW.
M M
(10)
Me.
trrn where M is the element on the r-th row and c-th column of M Conceptually, M 1,41 finds
the small- mmgli-ma elements on the H ",'' diagonal.
Note that we have different choices of T t.3. In this work, we set Y as Laplace noise with mean 0 and std 8, since the randomness of T will make attackers harder to determine the defense strategy. Specifically, our defense is find the elements in W 1,++1 whose corresponding values in (W f+++ w A A k
f.a l/Tr, are smaller than the counterparts in | The detailed algorithm describing the local training process benign devices when applying FL-WBC can be found in Appendix A. We derive certified robustness guarantee for our defense, which provides a lower bound of distance of AEP between the adversarial round and the subsequent rounds. The detailed theorem of the certified robustness guarantee can be found in Appendix E.
5.2 Robustness to Adaptive attacks
Our defense is robust against adaptive attacks [25, 26] since the attacker cannot know the detailed defensive operations even after conducting the attack for three reasons. First, our defense is performed during the local training the client side, where the detailed defensive process is closely related to benign clients' data. Such data is inaccessible to the attackers, and hence the attackers cannot figure out the detailed defense process. Second, even if the attackers have access benign clients' data (which is a super strong assumption and beyond our threat model), the attackers cannot predict which benign clients will be sampled by the server to participate in the next communication round. Third, in the most extreme case where attackers have access to benign clients' data and can predict which clients will be sampled the next round (which is an unrealistic assumption), the attackers still cannot successfully bypass our defense. The reason is that the defense during the benign local training mainly dominated by the random matrix Tk in Equation 9, which also unpredictable. With such unpredictability and randomness of our defense, effective attack can be adapted.

---

Convergence Guarantee
In this section, we derive the convergence guarantee of FedAvg [1] most popular FL algorithm. with our proposed FL-WBC. We follow the notations in $4 describing FedAvg, and the only difference after applying FL-WBC the local training process of benign devices. Specifically, for the t-th round, the local model on the k-th benign device is updated as:
V (W 60 $2,1) = VF* St,)) + T Let
(11)
W t,i+1 W T, V (W
1, ck
(12)
where TG, is the local updates generated by the perturbance step in Equation 9,
Our convergence analysis is inspired by [27]. Before presenting theoretical results, first make the following Assumptions 1-4 same as [27].
Assumption F1, F2, ..... FN are I-smooth: VV, W. F S F* (W) (V-W)VFF
21|V W1
Assumption 2. Fi, ..,, FN are ju-strongly convex: W,W, (V) 2 (*(W) + (V W) (W) + -
Assumption 3. Let c be sampled from the k-th device's 's local data uniformly at random. The variance of stochastic gradients in each device is bounded: E| Fk (W 6,0 - V (W
for k L..,,.
Assumption 4. The expected squared norm of stochastic gradients is uniformly bounded, i.e. E (W +11 G2 for all 1...., N, 0,
and 0 .... T 1.
We define F* and pk* as the minimum value of F and F and let r = F
Σ Pa Fk We assume
each device has local training iterations in each round and the total number rounds is T. Then, we have the following convergence guarantee FedAvg with our defense.
Theorem 1. Let Assumptions 1-4 hold and I., nt, Tk, G be defined therein. Choose n Y max (8k, l} and the learning rale 1/t #(1t1++1)
Then FedAvg with our defense satisfies
2k
Q+C
17 E. -W'
E[F(WT)] - F 7 TI
1
where
Q Σ pi + oz) + 1L1 + 8(1 - 1) + G²)
C K P(2 G2).
Proof. See our proof in Appendix F.
7
Experiments
In our experiments, we evaluate FL-WBC against targeted model poisoning attack [11] described in $4 under both IID and non-III settings. Experiments are conducted on server with two Intel Xeon E5-2687W CPUs and four Nvidia TITAN RTX GPUs.
7.1 Experimental Setup
Attack method. We evaluate our defense against model poisoning attack shown in [11, 12]. There are several attackers in FL setup and all the attackers share malicious dataset DMr, whose data points obey the same distribution with benign training data while having adversarial labels. We let all the attackers conduct the model poisoning attack adversarial rounds Lodv simultaneously such that attack will be extremely strong.
7

---

dedeeforo
FL.WCC es0.4
1.0
1.0
1.0
1.0
0.6
0.8
0.8
0.6
0.6
0.6
0.6
0.4
0.4
04
0.4
0.2
02
0.2
0.2
0.0
0.0
40
20
40
60
20
40
20
40
60
Communicaiion
Communication
FuliocMNIST-ID
CIFARRO0DDD
CIFARIO-NNNDI
defeese
CTIMA:
CIMA: flutt
Mig Mishogiffajiee sgefibae
Mi Misdeaifoatte Spfficto
1.00
1.0
1.40
9.
0.8
9.6
8.6
0.6
0.6
0.4
0.4
0.4
0.2
0.2
0.2
0.2
000
0.0
Comminicationn
40
60
Continnicaton FaGHiMMMISTT NomtID
20
40
60
Comminiaatio (2) CIFARRO
29
40
60
Communicationn
20
40 60
(6) FasiicMMIITTT
(b) CIFARIO NorlDD
Figure 3: Comparison of misclassífication confidence and communication round on FashionMNIST and CIFARIO with IID/non-IIl IIl settings. The black circle denotes the adversarial rounds.
Defense baseline. We compare our proposed defense with two categories of defense methods that have been widely used: (1) Differential privacy (DP) improves robustness with theoretical guarantee by clipping the gradient norm and injecting perturbations to the gradients. We adopt both Central Differential privacy (CDP) [24] and Local Differential privacy (LDP) [24] for comparisons. We set the clipping norm as and 10 for FaShion-MNIST and CIFARIO respectively following [24] and
apply Laplace noise with mean 0 and std = dpp. (2) Robust aggregation improves robustness of FL by manipulating aggregation rules. We consider both Coordinate Median Aggregation (CMA) [13] and Coordinate Trimmed-Menn Aggregation (CTMA) [13] baselines.
Datasets. To evaluate our defense under more realistic FL settings, we construct IID/non-IID datasets based on Fashion-MNIST and CIFARIO by following the configurations in [1]. The detailed data preparation can be found in Appendix C. We sample and 10 images from both datasets to construct the malicious dataset D corresponding to scenarios Das having single image and multiple images. Note that, data samples in DM would not appear in training datasets of benign devices.
Hyperparameter configurations. Each communication round is set to be the adversarial round with probability 0.1. In each benign communication round, there are 10 benign devices which are randomly selected to participate in the training. In each adversarial round, 5 malicious and 5 randomly selected benign devices participate in the training, which means there are 50% attackers involved in adversarial rounds. Additional configurations and model structures can be found in Appendix C.
Evaluation metrics. (1) Attack metric (misclassification confidenceeacccuracy] We define mis- elssification confidence/accuracy as the classification confidence/accuracyy of the global model on the malicious dataset. (2) Robust metric (attack mitigation rounds): We define attack miligation rounds the number of communication rounds after which the iisclassiiicationn confidence can decrease to lower than 50% or misclassification accuracy can decrease to lower than the error rate for the benign task. (3) Utility metric (benign accuracy): We use the accuracy of the global model on the benign testing set of the primary task to measure the effectiveness of FL algorithms (i.c., FedAvg [1]). The higher the accuracy is, the higher utility is obtained.
7.2 Effectiveness of FL-WBC with Single Image in The Malicious Dataset
We first show the results when there is only one image in the malicious dataset. We consider IID and non-III settings for both Fashion-MNIS" and CIFAR 10 datasets. Figure 3 shows the misclassification confidence of our defense and the robust aggregation baselines in the first 60 communication rounds. The results show that our defense can more effectively and efficiently mitigate the impact of model poisoning attack
comparison with baseline methods. In particular, FL-WBC can mitigate the impact of model poisoning attack within 5 communication round when (i.e., standard deviation for Y) is 0.4 for both IID and non-IlI settings. With regard to CMA and CTMA, the attack impact can not be mitigated within 10 subsequent rounds even when / for CTMA is 0.4, where 80% of local
8

---

BLwae!
CDP
1JPP
Nadlefese
109
0.9
0.6
0.5
Beaign wounee
088
0.8
97
96
0.3
0.3
0.2
Adtack miligtion counds
Allad milpaton rounds
Altack matiation sounds
Allak www.gattt........ monids
(2) P.aaaaooMNNISTTTI IID
(6) FistioMMNIST NosiID
(2) CIFARIO ID
(0) CIFARIO NoniID
Figure 4: Comparison of benign accuracy and attack mitigation rounds on FashionMNIST and CIFARIO with IID/non-IID settings when DM has only one image.
updates are trimmed before aggregation. Thus, the robust aggregation baselines fail to mitigate the model poisoning attack under our attack settings.
We also compare defense with CDP and LDP in terms of benign accuracy and attack mitigation rounds. We evaluate our defense by varying from 0.1 to I, and evaluate DP baselines by changing adp from 0.1 to 10. For each defense method, show the trade-off between benign accuracy and atlack miligation rounds in Figure 4. We have two key observations: 1) With sacrificing less than 5% benign accuracy, FL-WBB
mitigate the impact of model poisoning attack the global model in 1 communication round for IID settings. and within 5 communication rounds for non- con-IID settings respectively. However, CDP and LDP fail to mitigate attack effect within 5 rounds for IID and within 10 rounds for non-llD settings with less than 5% accuracy drop. 2) For non-IID settings where the defense becomes more challenging, FL-WBC can still mitigate the attack effect within rounds with less than 15% benign accuracy drop, but DP can not make an effective mitigation within 3 rounds with less than 30% benign accuracy drop, leading to the unacceptable utility on the benign task. The reason of FL-WBC outperforming CDP and LDP is that FL-WBC only inject perturbations to the parameter space where the long-lasting AEP resides instead of perturbing all the parameters like DP methods. Therefore, FL- can achieve better robustness with less accuracy drop.
In addition, also observe that defense for non-lID settings harder than IID settings, the reason is that under non-lID settings the devices train only a part of parameters [28] when holding only a few classes data, leading to sparser H!,,, that is more likely have a kernel with higher dimension.
7.3 Effectiveness of FL-WWBC with Multiple Images in The Malicious Dataset
We evaluate the defense effectiveness of robust aggregation baselines when Das has 10 images, and the results are shown Table 1.
Table Results attack mitigation rounds for robust aggregations when DM has multiple images.
Fashion-MNIST
Fashion-MNIST
CIFAR10 (IID)
CIFAR10
Defense
(IID)
(non-IID)
(non-lID)
CTMA (3 0.1)
7
9
8
>10
CTMA (3 0.2)
7
8
8
9
CTMA (3 = (040.4)
6
CMA
5
7 6
8
Defense against the attack when DM has multiple images is easier than DM has only one image. The reason that AEP of multiple malicious images requires larger parameter space reside in compare to AEP of single malicious image.
The results show that even though attack effect will be mitigated finally when there multiple images D,, robust aggregation can not guarantee mitigating the attack effect within 5 communication rounds for both IID and non-IID settings.
We also evaluate the defense effectiveness of FL. WBC and DP baselines terms of benign accuracy and attack mitigation rounds when DM has multiple images. The results are shown in Figure 5.

---

FL-WAR
COP
LTP
No Nedelfone
60.
0.0
Baaign Baijan ROMMRNS
0.9
Smigg Saraaaann
0..6
0.5
0.3
Wenggh
Balign
0.5
0.5
304
0.4
0.4
0.3
Aui mitiaiiio soundh
Aftac mit.ga000 roundds
Autic mitiationn counds
Alta5 mwr.g.00 moands
(4) P.PaaiicnSNNISTII IED
(b) FistioMMNNSS NonllD
(c) CIFARIO HD
(4) CIFARIO NonilD
Figure 5: Comparison of benign accuracy and attack mitigation rounds on FashionMNIST and CIFARIO with IID/non-IID settings when DM has multiple images.
The results show that FL-WBC guarantee that attack impact will be mitigated in round with sacrificing less than 3% benign accuracy for IID) settings and 10% for non-IlI settings, respectively. However, the DP methods incur than 9% benign accuracy drop achieve the same robustness for IID settings and 40% for non-llD settings, respectively. Therefore, FL-WBC significantly outperforms the DP methods defending against model poisoning attacks.
7.4 Integration of The Robustness Aggregation and FL-WWBC
No delesse
CMA
CMIVILL WBC
Allebretoooon corstenee
cefleeee
Mixcle Sooeein eretilenss
1.8
0/8
03.8
9.8
0.6
0.4
0.4
0.4
0.0
0.0
0.0
Cummunicatioon miai
Communiiction round
Commrnicatiinn mond (6 CIFARIO-DDD
Commanictim mund (d) CaaaR
FalIIMMNSTTIII
(b) Fant
Figure 6: Comparison of misclassification confidence and communication round on FashionMNIST and CIFARIO with IID/non-IID settings. The black circle denotes the adversarial rounds.
We also conduct experiments integrating the robustness aggregation with FL-WBC to demonstrate that FL-WBC is complementary to server-based defenses. We conduct experiments by integrating Coordinate Median Aggregation (CMA) and FL-WBC. We both CMA and FL-WBC with 0.4, the global model sacrifices less than 7% benign accuracy for both Fashion-MNIST and CIFARIO dataset under IID/non-IID settings. We conduct experiments following the same setup in $7 with single image in the malicious dataset, and the results are shown Figure 6.
0.4 for FL-WBC. After applying
The results show that only CMA can not mitigate the attack effect under our experimental setting. By applying both CMA and FL-WBC, the attack effect is mitigated within communication rounds under IID settings and within 5 communication rounds under non-IID settings. Thus, our defense is complementary to the server-based robustness aggregations, and further enhance the robustness of FL against model poisoning attacks under extremely strong attacks.
Conclusion
We design a client- bisent defense against the model poisoning attack, targeting at the scenario where the attack that has already broken through the server-based defenses and polluted the global model. The experiment results demonstrate that our defense outperforms baselines in mitigating the attack effectively and efficiently, i.e., our defense successfully defends against the attack within fewer communication rounds with less model utility degradation. In this paper, we focus the targeted poisoning attack [11, 12]. Our defense can be easily extended to many other poisoning attacks, such backdoor attacks, since do not restrict the malicious objective when deriving AEP.
10

---

Funding Transparency Statement
Funding in direct support of this work: NSF OIA-2040588, NSF CNS-1822085, NSF SPX-1725456,
NSF IIS-2140247.
References
[1] B. McMahan, E. Moore, D. Ramage, S. Hampson, and B. A. y Arcas, "Communication--fficonn learning of deep networks from decentralized data," " in Artificial Intelligence and Statistics, 2017.
[2] C. He, S. Li, J. So, X. Zeng. M. Zhang, H. Wang. X. Wang, P. Vepakomma, A. Singh, H. Qiu, et al., "Fedml: A research library and benchmark for federated machine learning," arXiv preprint arXiv:2007. 13518, 2020.
[3] E. M. E. Mhamdi, R. Guerraoui, and S. Rouault, "The hidden vulnerability of distributed learning in byzantium," arXiv preprint arXiv:1802.0792 2018.
[4] M. Fang, X. Cao, J. Jia, and N. Gong, "Local model poisoning attacks to byzantine-robust federated learning," in 29th {USENIX] Security Symposium (!USENIX] Security 20), pp. 1605- 1622, 2020.
[5] M. Baruch, G. Baruch, and Y. Goldberg, "A little is enough: Circumventing defenses for distributed learning," arXiv preprint 190v:0902..06155 2019.
[6] S. Mahloujifar, M. Mahmoody, and A. Mohammed, "Universal multi-party poisoning attacks," in International Conference on Machine Learing (ICML), 2019.
[7] Z. Sun, P. Kairouz, A. T. Suresh, and H. B. McMahan, "Can you really backdoor federated learning?," arXiv preprint 191 0et1//91107933 2019.
[8] E. Bagdasaryan, A. Veit, Y. Hua, D. Estrin, and V. Shmatikov, "How to backdoor federated learning," " in International Conference on Artificial Intelligence and Statistics, pp. 2938-2948, PMLR, 2020.
[9] H. Wang, K. Sreenivasan, S. Rajput, H. Vishwakarma, S. Agarwal, J.-y. Sohn, K. Lee, and D. Papailiopoulos, "Attack of the tails: Yes, you really can backdoor federated learning," arXiv preprint arXiv:2007.0506 2020.
[10] C. Xic, K. Huang, P.-Y. Chen, and B. Li, "Dba: Distributed backdoor attacks against federated learning," in International Conference on Learning Representations, 2019.
[11] A. N. Bhagoji, Chakraborty, P. Mittal, and S. Calo, "Analyzing federated learning through an adversarial lens," in International Conference on Machine Learning, pp. 634-643, PMLR. 2019.
[12) R. Tomsett, K. Chan, and S. Chakraborty, "Model poisoning attacks against distributed machine Operations
learning systems," in Artificial Intelligence and Machine Learning for Applications, vol. 1 1006, 110061D, International Society for Optics and Photonics, 2019.
[13] D. Yin, Y. Chen, R. Kannan, and P. Bartlett, "Byzantine-robust distributed learning: Towards optimal statistical rates," in International Conference on Machine Learning, pp. 5650-5659, PMLR, 2018.
[14] K. Pillutla, S. M. Kakade, and Z. Harchaoui, "Robust aggregation for federated learning," arXiv preprint arXiv: 191.:1912.13444 2019.
[15] S. Fu, C. Xie, B. Li, and Q Chen, "Attack-resistan federated learning with residual- reweighting." arXiv preprint 19Xiv::9122 1464, 2019.
[16] A. Siegel, "Robust regression using repeated medians," Biometrika, vol. 69, no. 1, pp. 242- 244, 1982.
11

---

[17] P. W. Holland and R. E. Welsch, "Robust regression using iteratively reweighted lqaat-squares." Communications in eaatsstcssthhery and Methods, vol. 6, no. 9, pp. 813 113-827, 1977.
[18] H. Xiao, K. Rasul, and Vollgraf, "Fashion-mnist. a novel image dataset for benchmarking machine learning algorithms," 2017.
[19] A. Krizhevsky, G. Hinton, al., "Learning multiple layers of features from tiny images." 2009.
[20] C. Fung, C. J. Yoon, and I. Beschastnikh, "Mitigating sybils in federated learning poisoning." arXiv preprint / 100.. 2018.
[21] P. Blanchard, E. M. El Mhamdi, R. Guerraoui, and J. Stainer, "Machine learning with adversaries: Byzamtine tolerant gradient descent," in Proceedings of the 31st International Conference on Neural Information Processing Systems, pp. 1 11-8128,2 2017.
[22] F. Sattler, K.-R. Müller, T. Wiegand, and W. Samek, "On the byzantine robustness of clustered federated learning," in ICASSP 2020-2020 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pp. 8861-8866 IEEE, 2020.
[23] L. Muñoz--Gnzzlez, K. T. Co, and E. C. Lupu, "Byzantine-robust federated machine learning through adaptive model averaging," arXiv preprint 1rXiv:1909.05/25, 2019.
[24] M. Naseri, J. Hayes, and E. De Cristofaro, "Toward robustness and privacy in federated learning: Experimenting with local and central differential privacy," arXiv preprint arXiv:2009.0333 2020.
[25] F. Tramer, N. Carlini, W. Brendel, and A. Madry, "On adaptive attacks to adversarial example defenses," " arXiv preprint arXiv:2002. 0034477 2020.
[26] N. Carlini, A. Athalye, N. Papernot, W. Brendel, J. Rauber, D. Tsipras, I. Goodfellow, Madry, and A. Kurakin, "On evaluating adversarial robustness," arXiv preprint arXiv:1902.06700 2019.
[27] X. Li, K. Huang, W. Yang, S. Wang, and Z. Zhang, "On the convergence of fedavg on non-iid data," in International Conference on Learning Representations, 2019.
[28] A. Li, Sun, B. Wang, L. Duan, S. Li, Y. Chen, and H. Li, "Lotteryfl: Personalized and communication federated learning with lottery ticket hypothesis on non-iid datasets," arXiv preprint wxXiv:2008.0337/ 2020.
12


Reviews:
[{"review_id": "woJIBJ33EoW", "reviewer": "Reviewer_fBKQ", "summary": "This paper proposes a client-based defence in federated learning against attacks which have already broken through server-side defences and which would otherwise persist through subsequent rounds after the adversarial attack has taken place. They place, under certain assumptions, theoretical bounds on the effectiveness of their approach and on its convergence. Experiments support the approach used.", "questions": "", "limitations": "", "rating": 7, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "This is a very clearly written paper. Though not an expert in this area, the key idea (that attacks persist as their effect on the parameters lies in the kernel of certain Hessians) is plausible and apparently novel. Experimental evidence is used to bolster this hypothesis too.\n\nThis work seems significant in that it offers a seemingly robust (and somewhat quantifiable, based on their theoretical contributions) defence, which importantly can be used in conjunction with server-side defences.\n\nThe theoretical results require a large number of assumptions for their proof, and as a non-expert I am not confident with regard to how likely these assumptions are to be met. That said, some of the assumptions match those from previous work. Also, a quantitative theoretical approach is to be applauded – though the measure AEP seems overly simplistic.\n\nThough the key argument feels consistent, i,e. that if the change in the parameters lies in the Hessians, it will persist, this would seem a sufficient condition though not a necessary one for an attack to persist from round to round.  In this vein, the “certified robustness” guarantee does not really seem to be a guarantee of robustness, but rather that this particular sufficient condition for attack persistence may not be met.\n\nThe experiments seem quite thorough and assess performance against SOTA of the defence and also impact on utility.\n\nTypos/miscellaneous comments:\n-\t“Unfortunately, Often...”\n-\tI am uncomfortable with the notation $W_t(S_i \\setminus M)$. It is not really parameterised by the indicated set (if the sets for i=1 and i=2 matched the parameters would match but these are different cases), but it is more that $i$ should be the parameter, as well as some indication of whether or not malicious devices are included.\n-\tEquation (7) has a leading N/K in its derivation in the Appendix\n-\t“equivalent to minimize the dimension...” should be “minimizing”\n", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "The authors do not specifically address potential societal impacts.", "review_text": "", "extra_scores": {"needs_ethics_review": "No", "ethics_review_area": "", "time_spent_reviewing": "3"}, "extra_text": {}}, {"review_id": "YsPks0Mxbln", "reviewer": "Reviewer_HBHN", "summary": "This paper shows that existing \"robust aggregation\" defenses against poisoning attacks in federated learning are ineffective in presence of strong attacks. Hence, they propose a client-based defense named \"White Blood Cell for Federated Learning (FL-WBC), which can mitigate against attacks who already managed to pollute the global model. ", "questions": "", "limitations": "", "rating": 7, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "# Strengths\n- Their client-based defense works also in presence of already-polluted models, and is complimentary to server-based robust aggregation approaches\n- They achieve convergence guarantees and certified robustness guarantees\n- Author consider both IID and non-IID settings\n- They demonstrate ineffectiveness of existing defenses against stronger attacks\n- Code and datasets are included\n\n# Weaknesses\n- Possible lack of adaptive attackers\n- Only tested on FashionMNIST and CIFAR-10 (somewhat simple datasets)\n- There are many relevant information relegated to the Appendix (e.g., description of Figure 2, non-iid settings,  relevance of AEPs in Fashion-MNIST). \n\n# Detailed comments\n\nThe paper is generally very well written, and positions itself very clearly with respect to the state of the art. Both the empirical and theoretical foundations of the work are extremely strong, but it is also clear what is the high-level intuition behind the proposed approach, so that the reader always know where they are despite the highly technical content of the paper.\n\n**Presentation**. Despite the overall great writing style, I feel that there are just too many important information relegated to the Appendix, to the point that it is occasionally hard to assess the paper as-is without having a look at the Appendix. I feel that the writing and presentation should be somehow revised to present this. Some major issues I've had in terms of missing information from the main test include:\n- information for Figure 2 (beta is not explained)\n-  he high-level intuition non-iid settings,  \n- the experimental results on AEPs relevance in Fashion-MNIST\nMoreover, the paper is very dense and full of symbols. While most of them are fully aligned with the state of the art, I feel especially for AEP-related symbols (e.g., \"s\", \"H\") it would be good to have a \"symbol table\" to improve readability of the work. \n\n**Adaptive attackers**. In the model considered throughout the paper and depicted in Figure 1, I think that one thing that is not fully considered is what happens if malicious clients know that FL-WBC is being used. Is there an adaptive, stronger attack that could take advantage of the new component of the loss function, to create stronger and more subtle attacks? If it is only discussed in the text, it should be highlighted better, but it would be appropriate to have a specific section on adaptive attackers. See the following papers for reference:\n- Tramer, Florian, et al. \"On adaptive attacks to adversarial example defenses.\" arXiv preprint arXiv:2002.08347 (2020).\n- Carlini, Nicholas, et al. \"On evaluating adversarial robustness.\" arXiv preprint arXiv:1902.06705 (2019).\n\n**Adversarial round probability**. How strong is the importance of the adversarial round probability as part of the experimental evaluation? I feel that from Figure 3 the number of adversarial rounds remains fairly limited. The authors mention approaches for 'detecting' that an attack is going on, but the whole paper is framed around _super strong adversaries_, so I was a bit confused when I saw such a low probability in the experimental evaluation. \n\n**Generalization**. Is there any chance that since you are using relatively simple datasets such as MNIST and CIFAR-10 there is some artifacts in the actual robustness achieved?\n\n# Minor comments\n- Figure 4: Why the 'no defense' bullet is only for attack mitigation >10?\n- there is a capital \"Often\" on page 3, which should be lowercase\n- At the end of page 4, within the explanation after Equation (5):  when $\\alpha=1$ the $k$-th device should be benign, right?", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "I feel there is not enough discussion about possible limitations of the work, or at least of the experimental evaluation. I guess that these aspects should be taken into account:\n* generalization of the results from the computer vision task to other domains; moreover, the specific focus on Fashion-MNIST and CIFAR-10 and not larger CV datasets may be affecting generalization\n* the amount of adversarial rounds considered in the evaluation\n* adaptive attackers that know the defense\n", "review_text": "", "extra_scores": {"ethical_concerns": "No ethical concerns.", "needs_ethics_review": "No", "ethics_review_area": "", "time_spent_reviewing": "6"}, "extra_text": {}}, {"review_id": "SHHQttreLfA", "reviewer": "Reviewer_ZHqh", "summary": "The paper proposes White Blood Cell for Federated learning (FL-WBC) -- a client-based defense that can mitigate model poisoning attacks that have already polluted the global model. \nThe authors claim that strong model poisoning attacks that can circumvent server-based defenses can continue to impact the global model even if there are no subsequent attacks. Towards this end, the paper identifies the attack effect on the parameter space (AEP) and observes that the parameter subspace used for the attack is both inaccessible to the server and remains hidden in the kernel of the Hessian matrices on benign agents. Thus, they propose a client-based optimization that is designed to minimize the loss on the benign task while also minimizing the dimensionality of the Hessian kernel. Robustness certificate and convergence guarantees are also provided. \nEvaluation is performed on FashionMNIST and CIFAR-10 datasets to demonstrate the ability of the defense to mitigate attacks using three metrics (attack metric, robust metric, and utility metric). Comparison is performed with DP-based defenses, CMA, and CTMA.", "questions": "", "limitations": "", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "I have the following concerns with the defense:\na. Prior papers in this area including [8, 10,  11, 12] observe that the strength of an attack (even without a defense) starts to attenuate if there is no reinforcement by attackers in subsequent rounds. The benign updates are able to overwrite the effect of the attack. This is both intuitive and has been experimentally validated in the past. I really like the AEP analysis performed by the authors but I am not fully convinced, especially as it does not seem to reconcile with prior observations.\n\nb.  Second, the evaluation does not consider an adaptive attacker that is aware of the client-based optimization performed to remove the effect on the parameter subspace (hiding the attack). \n\nc. The authors need to explicitly mention the threat model which will then provide the parameters for attacks that can be mounted on the defense.  Furthermore, the solution requires clients participating in federated learning to perform a specific form of optimization (and Proximal Gradient Descent). How much can clients (even benign ones) be trusted to perform a regularized training?\n\nMinor:\na. The authors should consider using some of the standard notation in FL papers. This will simplify the presentation and improve the readability of the paper. \nb. Line 168: W_{t, I}^{k}(\\alpha=1) implies evaluating Eqn. (3) with \\alpha=1. The authors mention that this shows that the k-th device is malicious. However, replacing \\alpha=1 in Eqn. (3) implies that the agent is optimizing for the benign objective only. So, why is it considered malicious?\n\nSome typos:\nline 104: Often --> often\nline 312: misclassification --> misclassification\n", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "Limitations and societal impact are not currently mentioned but should be added as either a separate discussion section or as part of the conclusion.", "review_text": "", "extra_scores": {"ethical_concerns": "None", "needs_ethics_review": "No", "ethics_review_area": "", "time_spent_reviewing": "7"}, "extra_text": {}}]

Author rebuttal:

Meta-review: This is an interesting paper, and the reviewers find much to recommend it.
Moreover, the rebuttal and discussion post-review seems to have addressed many, if not all, the concerns of the reviewers.
The issue of the attenuation of the attack was discussed. Perhaps the portion of the appendix where this is empirically addressed can be highlighted in the paper. 

Decision: Accept (Poster)