Robust and Actively Secure Serverless Collaborative Learning
Authors: Nicholas Franzese
Adam Dziedzic
Christopher A. Choquette-Choo
Mark R. Thomas
Muhammad Ahmad Kaleem
Stephan Rabanser
Congyu Fang
Somesh Jha
Nicolas Papernot
Xiao Wang
Venue: NeurIPS 2023 poster (2023)
Keywords: collaborative learning
robust aggregation
secure machine learning
TL;DR: We propose a peer-to-peer (P2P) learning scheme that is secure against malicious servers and robust to malicious clients.

Abstract: Collaborative machine learning (ML) is widely used to enable institutions to learn better models from distributed data. While collaborative approaches to learning intuitively protect user data, they remain vulnerable to either the server, the clients, or both, deviating from the protocol. Indeed, because the protocol is asymmetric, a malicious server can abuse its power to reconstruct client data points. Conversely, malicious clients can corrupt learning with malicious updates. Thus, both clients and servers require a guarantee when the other cannot be trusted to fully cooperate. In this work, we propose a peer-to-peer (P2P) learning scheme that is secure against malicious servers and robust to malicious clients. Our core contribution is a generic framework that transforms any (compatible) algorithm for robust aggregation of model updates to the setting where servers and clients can act maliciously. Finally, we demonstrate the computational efficiency of our approach even with 1-million parameter models trained by 100s of peers on standard datasets.

Robust and Actively Secure Serverless Collaborative Learning
Olive Franzese* 1,, Adam Dziedzic Christopher A. Choquette-Choo', Mark R. Thomas", Muhammad Ahmad Kaleem", Stephan Rabanser", Congyu Fang"
Somesh Jha Nicolas Papernot Xíao Wang*
Northweetern University, Universiit of Toronto and Vector Institute, *Google, University of Wisconsin-Madison SCISPA
Abstract
Collaborative machine learning (MI.) is widely used to enable institutions to learn better models from distributed data. While collaborative approaches to learning intuitively protect user data, they remain vulnerable to either the server, the clients, both, deviating from the protocol. Indeed, because the protocol is asymmetric, a malicious server can abuse its power to reconstruct client data points. Conversely, malicious clients can corrupt learning with malicious updates. Thus, both clients and servers require guarantee when the other cannot be trusted to fully cooperate. In this work, we propose peer-to-peet (P2P) learning scheme that secure against malicious servers and robust to malicious clients. Our core contribution is a generic framework that transforms any (compatible) algorithm for robust aggregation of model updates to the setting where servers and clients can act maliciously. Finally, we demonstrate the computational efficiency of our approach even with 1-million parameter models trained by 100s of peers on standard datasets.
Introduction
To leverage data that is located across different clients, service providers increasingly resort to collaborative forms of distributed machine learning. Rather than centralize the data single server, data remains on the owner's (client's) s) device(s), which could be a consumer's 's phone or bank/hospital's local data center. Take the canonical example of federated learning (FL) [34]. Rather than share data, clients instead send model updates to the server. Our work caters to settings where neither clients nor servers can be entirely trusted faithfully participate in the Collaborative Learning (CL) protocol.
For example, consider a group of banks wished to learn a better fraud detection model. Banks may not be able to directly share data [15] and further because banking competitive industry. it must be assumed that banks will deviate from the protocol if it serves their interest. On one hand, malicious server banks may breach the intuitive confidentiality of CL. A long line of work [9, 10, 24, 37, 43, 49, 50, 52] has shown that when the server acts maliciously, it can, for instance, construct model parameter values that exactly extract client data from (even aggregated) model updates. To protect client data from servers acting maliciously, it is thus paramount to design approaches to CL where no single server can have full control over the orchestration of the protocol. On the other hand, malicious client banks may entirely prevent learning by submitting poor updates. This may be intentional as model poisoning attacks [2, 45, 46] or unintentional if their dataset contained malformed data. Though separate line of work [25, 26, 29, 30, 32, 38, 48] has studied how to robustly learn in the face of malicious updates (or data), there are none that have studied how integrate such robust learning algorithms within protocol that is secure to malicious servers. In this work, we design the first scheme that is robust the harms of both malicious server(s) and clients, which are shown Figure I.
Equul Contribution.
i Corresponneece to: nicholasfranzese222666 u. www.twwster..eddl. and adam..ziedzzer cispa.de Project Lead. Work done while the author was at the University of Toronto and Vector Institute.
37th Conference on Neural Information Processing Systems (NcurIPS 2023).

---

We observe that asymmetric power is the fundamental re- quirement for malicious servers to breach user data privacy. Thus, we design a deleeddecetrrllzzed peer-to-peer (P2P) learning protocol where each participant (e.g., bank), or peer herein, can equally contribute to the role of the server aggregating updates (and of a client computing updates). Further, we ensure that no single peer has the power to orchestrate the protocol- we elect a committee of peers to perform the aggregation at any given train- ing round in a way that requires no central or trusted third party (see Section 3 for the full threat model). On the other hand, there is now a greater need for protection against malicious clients as the distributed nature may increase the chances of intentional poisoning or bad data quality interfering with learning (e.g., due to fewer resources among some banks and/or competitive advantages). Thus, we ensure that our protocol can efficiently integrate with classical approaches for robustness against malicious clients, such as RSA [32], FL Trust (FLT) [14], or Centered Clipping (CC) [29]. Importantly, our work generalizes the setups of these works and introduces the general framework that adapts any (compatible) algorithm for robust aggregation of model updates to settings where servers and clients may behave maliciously.
Server allack warlr:
Server
brench cleest confidentiality
alter globall pasameters arhitrorily
Clenn allack vector
(Inrentional] maddll polsoning (unintentional) bad data
Figure 1: Motivation for P2P Learn- ing. Current collaborative learning ap- proaches are vulnerable to both client (denoted as C' with data D) and server at- tack vectors. Our framework tackles all of these vulnerabilities simultaneously.
To achieve this, our approach builds on cryptographic multi-party computation (MPC) protocols. This allows peers to collectively emulate the server's role while being robust against the collusion of a subset of these peers that may act maliciously. However, naively combining these with (insecure) robust aggregation techniques incurs prohibitive overhead because the server computation for robust aggregation, which must be securely computed in MPC, is almost always of complexity that leads high multiplicative slowdown. We design a framework that modularizes the processing steps of robust aggregation so as to select the most suitable cryptographic building blocks for each one, leading to significant computational improvements. One such improvement is our proposed computational surjectivity. We show that aggregation algorithms with component functions satisfying this property can efficiently obtain security while still guaranteeing robustness against malicious peers; we also show that existing robustness algorithms satisfy this property, or can be tailored to do so.
To summarize, our contributions are the following:
1. We design the first collaborative learning protocol that operates under the malicious threat model and is robust to both malicious clients and servers. We provide a simulation- based proof of its cryptographic security.
2. We design our protocol as a generic compiler that can convert broad categories of robust aggre- gation algorithms to our improved security model efficiently. This modular approach enables practitioners obtain rigorous security guarantees while selecting the most appropriate model poisoning defense for their use case. To demonstrate our framework's flexibility, generate malicious-secure protocols for three existing robust aggregation algorithms. We show empirically that the generated protocols retain their robustness guarantees.
3. We demonstrate the computational efficiency of our protocols. We benchmark our protocols up to I million parameter models, and thousands of peers. For example, we show that the aggregation step of our malicious-secd securee implementation of robust aggregation with RSA [32] obtains a per-round CPU time of roughly 46 seconds with 10 parameters when trained by 1000 peers.
2 Related Work
Federated learning is perhaps the most studied collaborative learning framework [28, 35J. Most related to ours are variants based on Secure Aggregation (SecAgg) [11] that provide confidentiality of gradient transmission. However, existing work does not provide robust aggregation within SecAgg and is focused on the single-server setting, or additionally on their use for tighter differential privacy guarantees [16, 27, 41, 47]. In contrast, we focus solely on confidentiality in the distributed server setting with robust aggregation. Other works include CaPC [17] but this requires trusted third party to reduce the computational overhead. We make no such assumptions. In Swarm Peer-2-Peer learning [44], participants can dynamically join or leave the collaboration and are enrolled via a Blockchain smart contract. There is no central party and each per-round server is dynamically elected

---

UPDATE CONTDENTIALITY
MALICIOUS CLIENTS
MALICIOUS SERVER
AGOREGATION COMMITTLE
ROBUST AGUREGATION
PROPERTY
PREVENTED
POISONING OR BACKDOORING [2, 6, 45,46) 46]
GRADIENT
DATA RECONSTRUCTION
ATTACKS
PLAINTENT INSPECTION
MALFORMED DATA
19, [0] OR DEGRADE UTILITY
METHOD
50, 37] [43, 49, 50]
SECAGG VI [1T]
X
X
SECAGO [5]
X
X
CAPC [17]
V
X
SWARM P2P LEARNING [44]
X
BiSCOTTI [39]
V
EIFFEL MS [20]
X
ACORN
RS-P2P SHS (OURS)
J
RS-P2P MS (OURS)
Table I: Comparison of Security Models between Aggregation Protocols. Robust aggregation provides protection against data poisoning by clients in the collaboration protocol. Update confiden- tiality guarantees that an individual updated from a client is not revealed. SHS denotes Semi-Honest Security while MS is Malicious Security. *Guarantees data integregity, not robust aggregation of updates. **Only under single robust aggregation protocol.
via Blockehain smart contracts. Crucially, Swarm Learning supports neither secure (confidentiality- preserving) nor robust aggregation-it uses standard parameter averaging.
Biscotti [39] incorporates robustness to poisoning by combining Multi-Knn Krumm [7] and secure aggre- gation through Shamir secret-sharing. Its core parts are verification committee that runs robust update selection, and aggregation committee that computes the final model update. However, Biscotti only guarantees security the semi-honest setting and is solely compatible with is not always the preferable robustness algorithm [29]. Blockchain is also used as an alternative to the centralized aggregator in FL to deal with malicious participants or servers in [51]. The initial model is uploaded on the blockchain following which the participants train local models, then sign on
which
hashes with their private keys, and upload the locally trained models to the blockchain. The validity of the uploaded models is verified with digital signatures and Multi-Krum. Algorand is used as the consensus algorithm in the blockchain system to update the global model. However, uses a single leader for each training round and is compatible only with Krumi-Krum.
Konstantinov and Lampert [31] present a distributed robust learning procedure that allows for robust learning from untrusted sources. Distributed Robust Learning (DRL. [22] is another approach to robust learning which uses divide and conquer strategy. However, none of the papers achieves the two notions of robustness at the same time. Closest to our work are those that look to combine data integrity and confidentiality (security) [4, 20J. However, these works are crucially different from ours in that they perform checks on the underlying data of each client, not the update-then. these protocols drop clients with poor data. Because these approaches operate over different input, they may be used simultaneously with ours.
3 Threat Model
Collaborative learning is conducted among of parties (herein, peers) performing of two roles: client (or worker) who performs learning on a local dataset, or a server that aggregates the many client updates. Our protocol differs in main ways: first, is conducted among set of peers (parties) which can perform either role, and second, the role of the server is performed by a subset of peers termed the aggregation committee. To align with prior literature, we sometimes refer to peers as clients or servers when they are performing those respective roles. We consider malicious threat model where clients and servers may perform arbitrary adversarial actions interfere with the protocol. Malicious behavior in the two roles may include, but is not limited to the following.
1. Malicious Clients may attempt to (1) lower the quality of the trained model by sending distorted model updates. This may take the form of both (a) intentional model poisoning attacks, and (b) unintentional problems such as emorr in computation, and skewed or incorrect local data sets. They may also attempt to (2) steal information about the other peers' data, i.e. break confidentiality, e.g. by colluding with other malicious peers and sharing transcripts of the protocol execution.
3

---

2. Malicious Servers / Committee Members may attempt to (1) reconstruct individual data points from the clients' updates, thus breaking data confidentiality, which can be achieved by arbitrarily modifying model parameters or colluding with other parties (Committee Members or Clients), (2) inappropriately change the shared model by e.g. omitting updates from selected clients, adding in bogus updates, or otherwise altering the global model updates.
We compose multiple cryptographic primitives, including secure committee election, verified secret sharing, distributed zero knowledge proofs, and secure multiparty computation. The assumptions and guarantees of the individual primitives are in Appendix B.2. Importantly, their composition is secure under universal composability [13]. Our overall protocol operates under the standard assumptions of authenticated point-to-point secure channels between peers and bounded proportion of adversarial peers (sce Appendix B.1 for details). The following are the formal guarantees of our protocol.
Correctness of aggregation. Given publicly known update aggregation function FR and that clients submit local updates I1, T2,..... Ta. the returned global update will be equal to See the following Section for details.
FR (2, (n,)
Confidentiality of client updates. During protocol execution, peers gain information about any other's 's update x, beyond what is implicitly revealed by the aggregate result F (x1, Z2,..., TT))
Robustness poisoning. An accurate model will be trained even if some subset of clients submit arbitrary poisonous updates. Our framework compiles existing robust aggregation algorithms into stronger security model. Thus, the details of this guarantec depend on the underlying algorithm.
Malicious (active) security. The above conditions hold even when a subset of parties actively perform arbitrary malicious behavior, including but not limited to: collusion between malicious peers, attempts to deviate from any part of the protocol, and submission of poisonous local updates.
Problem Setup. To construct collaborative learning protocol that is robust against both malicious clients and servers, we must decentralize the task of update aggregation. Accordingly, P2P learning is conducted among set of peers, who may be assigned the role of client server.
4 Robust and Actively Secure Framework
Our framework efficiently lifts the robust aggregation algorithms (e.g., the aforementioned RSA, FLT, or CC) the P2P learning setting with guaranteed malicious-secure (or, actively-secure) protocol fidelity. This security model guarantees both confidentiality and protocol fidelity against peers that may take arbitrary actions to disrupt the P2P learning protocol execution-fideliyy is maintained by retaining the model fidelity guarantees of an underlying robust aggregation algorithm. Indeed, we previously mentioned that many algorithms provide model fidelity against poisonous adversaries in the single-server server setting [7, 25, 29, 30, 32, 38]. Each algorithm makes different assumptions about the threat model, e.g., how many times a given malicious client can participate, what sort of malicious update they send, what the underlying data distribution is, etc. Thus, rather than pinning our framework on a single robustness algorithm, we propose a modular design that encompasses a broad class of such robust aggregation algorithms designed for the single-server setting.
4.1 Framework Design
In order to strengthen the security models of a broad class of robust aggregation algorithms, we design modular template (Figure 2), which organizes aggregation algorithms in terms of three functions:
FC D x x
U
FR.
V -> Ω
The first function, FC, represents the computation of client updates based on local data, state, and global model parameters; accordingly, the space of possible client datasets, S is the space of local states, 12 is the space of global model parameters, and U is the space of client updates. In the trusted single-server setting, each client computes FC and sends their update u, U to the server. Next comes the server's computation. We break the server's 's work into two parts: a preprocessing function FP and an aggregation function FR, The former transforms each client update to a preprocessed domain V. and the latter combines the preprocessed local updates into a global model update E Ω. Our primary contribution the design of a protocol that lifts any robust aggregation algorithm described in terms of these functions to stronger security model. The security model in question

---

Trusted Single-Server Robust Aggregation
Public Functions: Single-server robust aggregation algorithms are defined by three functions:
FC
client-side update computation
FF
server-side update preprocessing
FR server-side update aggregation.
Input:
Global parameters from the previous round. Each client Pa has input data; all participants have local state st.
Client update:
1. Each client P; computes u, +- FC (data, st, w) and sends update u, to the server.
Server preprocessing:
2. For each i E [m), the server obtains By for all E S and computes v; +- FP ((uu)ses,;
Server update:
3. Server computes w + Fir( Fre((P:)ie(m) and sends w to all clients.
Figure 2: Template for single-server robust aggregation.
is secure against malicious/active clients without relying trusted server, all while retaining the protection against poisoning attacks offered by the original algorithm.
Protocol Description. Peers carrying out a P2P Learning protocol (Figure 3) begin by randomly selecting an aggregation committee, the size of which is parameterized to guarantee an honest majority with all but negligible probability (see Appendix B for details). Since the committee is honest-majority it can use secure MPC (secure Multi-Party Computation) and VSS (Verifiable Secret Sharing) schemes later in the protocol. All clients then compute local updates via FC and preprocess those updates via FP. Peers secret share their updates with VSS and pass shares to aggregation committee. Each member of the committee receives a share of local update from every peer. The committee uses distributed zero knowledge proofs to ensure that all updates are well-formed outputs of -Secttotion 4.2 discusses in detail how to do with practical efficiency. Finally, FR computed by the aggregation committee by using the shares as input to a malicious-secure MPC protocol, and committee members send the resulting global model update all peers. This protocol relies on users remaining online throughout, an assumption that may not always be practical. In Section 4.3, discuss how to relax this.
Strengthened Security Model. In the single-server setting, the computation of F is handled by single party. This makes it vulnerable to tampering malicious server may breach client confidentiality, omit updates from certain clients, modify updates, or simply make arbitrary changes to the global model. Our framework lifts aggregation algorithms to security model where none of that is possible. Distributing the computation of Fn to an honest-majority committee equipped with malicious-securc MPC means that F is computed with guaranteed correctness and that no information about the local updates is leaked in the process. Further, using VSS guarantees that no committee member can breach the confidentiality of client updates before the computation of FR and that is (with high probability) impossible to modify client updates before the computation of all peers can guarantee the
FR without being caught. Further, since the committee is majority- received global update is correct by taking the majority result received from the committee members.
Obtaining Practical Efficiency. It is possible to strengthen the security model of almost any distributed computation by simply running it inside of a generalized MPC protocol, but doing so usually results in unbearable computational overhead since MPC substantially amplifies the cost of most operations. A key challenge that we surmount strengthening security whilst maintaining the efficiency necessary to scale to real-world collaborative learning scenarios. The design choices employ while formulating our protocol make this possible. For example, in applications of robust aggregation with trusted single-server, the role of the server is typically executed by data center with high compute capabilities. In such a setting it is beneficial to minimize client-side computation and shift the compute responsibility the server wherever possible.
In contrast, collaborative learning with no trusted parties requires a committee to aggregate client updates, and operations performed in MPC by the committec are especially costly. Thus it becomes
5

---

Secure P2P Learning Against Malicious and Poisonous Adversaries
Protocol:
1. The clients randomly select aggregation committee C (P:)
2. Each client P; applies local computation u, + FC (data, st, w).
3. For each client P., compute + FFF (u.).
4. P. secret shares v; to obtain [v,] and sends one share to each Pj E C.
5. If F is not computationally surjective, P. uses Distributed Zero Knowledge (DZK) to prove to the committee C' that v; is correctly computed from some u, of P choice. Otherwise,
P. uses DZK to prove that U; E V.
6. If Domain FR) * (mage(FP), P. uses DZK to prove to the committee C that 0; E Image(FP).
7. All committee members Pj E C' input shares [o:] for all E [n] to |C'lparty computation protocol in order to compute w +- ((m:)e))))) Committee members send un to all clients.
Figure 3: Main protocol outline for the malicious setting.
beneficial to offload much of the computation as possible to the client-side. Our template (Figure 2) and protocol (Figure 3) do this by separating the trusted server's ' work into two parts, F and F and shifting the work of computing F to the clients. This dramatically reduces the computational burden of the aggregation committee, but introduces potential concerns about the correctness of the underlying aggregation algorithm. Namely, in the trusted server setting FP is guaranteed to be computed correctly since it is executed by a trusted party, but a malicious client may introduce arbitrary faults into the computation of FP. To prevent this while maintaining confidentiality, one could use a zero-knowledge proof to guarantee that F was computed correctly, however this would introduce substantial computational overhead. We achieve much more efficient result by instead verifying that each peer's local update is well-formed-thh that it properly falls within the preprocessed domain V. We observe that if F" has certain property, which we call computational surjectivity. verifying that the update is within V is just as good as verifying correct computation of F", even though the former comes substantially lower cost.
4.2 Computational Surjectivity
Our key insight that by leveraging the properties of robust aggregation, we can relax certain requirements on the correctness of F These relaxed requirements allow us to offload computation of F to the client-side, while also avoiding the computational overhead of full zero-knowledge proof that FP was computed correctly.
A robust aggregation algorithm guarantees that even when adversaries provide arbitrary values as the output of FC, a satisfactory output F will be computed. Accordingly, we observe that as long some valid output of FC maps to each client's output of FP, the final global update will be computed properly. Thus if P is a surjective function (í.e. if vo E V, 3u E U only necessary to verify that v, V for all client updates v, in order correctly compute FR Below we specify computational analogue of surjectivity-ww require the preimage can be found in polynomial time so the whole protocol achieve simulation security (Appendix B.3 has details).
(P()))
Definition 1 A function polynomial-tin algorithum A: + U such that for any E V. we have f(A()) = v.
U + V is computationally surjective if there is probabilistic
In general, we have no guarantees on the structure of FP and so peers must prove in zero knowledge that is the result of valid computation of FP (Figure 3, step 5). But if FP is computationally surjective, then all possible v; E V are implicitly the output of some computation of F., Thus, only becomes necessary to prove that the shares of each peers' input reconstructs point within V.
Theorem (proof in Appendix B.3) states the security of this protocol in the malicious setting.

---

Theorem For any single-server robust aggregation algorithm described in (F PPP as in Figure 2, the protocol described in Figure is a secure P2P learning protocol against malicious clients and servers when the underlying MPC scheme is secure.
4.3 Tolerating Peers Disconnecting
Peers cannot always be assumed remain connected throughout an entire protocol execution, e.g.. when peers are mobile devices [. Further, it is also common to subsample a small portion of peers as clients avoid high computationn/ommuiiccaii
costs [47]. We show how to account for both of these practical settings with minimal modifications to our protocol.
Tolerance to Users Dropping. Our protocol includes two areas where peers must collaborate on the cryptographic protocol: the (client) work of computing updates and the (server / committee) work of aggregating updates. Our protocol already gracefully tolerates any number of clients dropping so long as the the pool of remaining clients meets the assumptions of the underlying robust aggregation algorithm. In this protocol can also tolerate committee member dropout with no impact on the output of the protocol by proportionally increasing the committee size (due to the reconstruction guarantees of VSS). We find that this increase is often small even for substantial drop out rates. For example, to tolerate a 10% drop rate of honest committee members we need only increase the committee size from 46 to 60 (though this number depends on the algorithm, see Appendix B. for detailed analysis).
protocol's output would be just as if those peers did not participate. Our
Subsampling Clients. This setting inherits the security of our original protocol as long as all honest peers agree on the selected subsample of clients in each round. This can be accomplished efficiently via secure coin flipping [8], e.g., before the protocol commences. Then, our protocol's computation is reduced proportionally to that of execution on the subsample.
Lifting Robust-Aggregation Algorithms to a Malicious-Security Model
Having discussed how a single-server robust aggregation with a computationally surjective FP can be lifted to the malicious P2P setting with high efficiency, we apply this principle to the design of malicious-secure versions of three popular robust aggregation algorithms: robust stochastic aggregation (RSA) [32], centered clipping (CC) [29], and FLTrust (FLT) [14] in the P2P setting.
5.1 Instantiating Robust Stochastic Aggregation (RSA) in malicious-secure framework.
RSA is a lightweight algorithm for Byzantine-robust convex optimization [32] (see Appendix B.4.1 for a summary). We observe that it can lifted to the malicious security model with high efficiency with very few modifications to the algorithm because it is computationally surjective (which we show formally in Appendix B) and the underlying MPC can be efficiently instantiated.
In RSA peer updates are the sign of the difference between each parameter of the local and global models. In other words, the FP of RSA gives V = 1-1, where is the number of parameters in the model. Thus, it is sufficient for peers to prove in zero-knowledge that their updates are in the set V 1-, This can be accomplished efficiently by having each peer represent their update as shares of binary values. The committee can perform a distributed zero knowledge (DZK) proof that a shared x is binary-valued by constructing shares of x - (1 2) and revealing it to be zero. These proofs can be batched together for a substantial improvement in efficiency. In particular, for every shared value TG, parties uniformly sample a random value r,. and locally construct shares of the sum Σr. (z+ (1 2,)). The parties then reconstruct the sum sum-if it is O. then each of the (z, (1 2.)) components must have been O with all but negligible probability. For a more detailed treatment of this technique, see [12].
During the computation of FR. the committee needs only to sum the shares and send out the reconstructed sum. The actual value of the summed updates in (-1, 1} is implicitly given by the sum of the binary values (if the sum of the binary values is x, simply take 2x m).
5.2 Instantiating Centered Clipping (CC) in our malicious-secure framework.
CC with momentum is robust aggregation algorithm that ensures protection against time-coupled poisoning attacks [29] (see Appendix B for a summary). To lift it to our improved security model with
7

---

practical efficiency, we construct a computationally surjective variant of the CC algorithm. Namely, while canonical CC clips local updates using the E2 norm, we use the lo norm." In other words, we clip the gradients to a r-box rather than a r-ball. This modification admits computationally surjective FP with an efficient DZK proof that client update within the valid domain. In partieular, P
we take V [0. 2 '].. Then in FP we scale, round, and map clipped gradient updates to be within this domain. Here 0 a public constant large enough to limit discretization error of local updates during scaling- experiments with CC we set 0 to 32 in order to align with 32-bit fixed-point numbers. Smaller values of 0 will increase protocol efficiency, at the expense of higher discretization error during rounding and mapping in FP step 3. The computational surjectivity of this FP follows from a similar argument to Lemma 2 (see Appendix B).
DZK Proof of Valid Update. We specify that local updates v, are submitted as vectors of the individual component bits of the processed gradient update. This means that each bit will be individually secret shared, which allows the committee to verify whether each one is binary-valued (using the same DZK technique described above for the RSA protocol). Since we scaled each update to fit within a 2 -ized d-dimensional box. the d sets of 0 binary values in the update trivially encode a point within the box. Thus, a proof that each component of the bitwise update is binary-valued equates to a proof that the update is in V.
The global update is aggregated by summing the bits at each position of the client update vectors. The sums are reconstructed and sent directly to all clients. They implicitly encode the updated global parameters w', which are recovered via client-side computation in order to keep the computation of FR light-weight. Details of our malicious-secure Centered Box Clipping protocol can be found in Figure (in Appendix).
5.3 Instantiating FLTrust in Malicious-Secure Framework
FLTrust (FLT) is robust aggregation algorithm that uses a trusted dataset to filter out poisoned updates [14] (see Appendix B for a summary). As with CC, we construct a tailored variant of FLT rotate and scale
that admits computationally surjective F to improve efficiency. In particular the "root" update Jo to be a unit vector aligned with the x-axis. This allows us to take V to be the set of unit vectors in the half-space defined by non-negative x-coordinate. As such, FP involves scaling and rotating client updates so that the angle between them and Jo is preserved. Similarly to CC, we encode client updates as 0-bit fixed point numbers. In our benchmarks for FLT, we set 0 to 16 to compensate for the increased memory demands of this protocol. We use a committee size of 121 in order to enable multiplication of secret shared values (see Appendix B for details).
DZK Proof of Valid Update. As in CC, the magnitudes of local updates v, are submitted as shares of each bit in the binary representation of cach fixed prinnt number. Clients additionally submit shares encoding sign for each parameter, with the exception of the x-coordinate, which is assumed to be always non-negative. We use the previously described technique verify that the shares encoding magnitude are binury-valued. We use a similar technique to verify that shares encoding sign are in the set 1) (i.e. reveal (b + 1)(b - 1) to be zero using batch check). Further, we verify that submitted updates are unit length by constructing shares of (gi, D.) C, where C' is the squared length of unit vector represented as a 0-bit fixed-point number. Revealing this quantity to be zero verifies in aero-knowledge that dJ was indeed unit length.
6 Verifying Empirical Efficacy and Efficiency
Our empirical evaluation focuses on exploring three major axes: (1) the Byzantine robustness of our implementations due to modifications we introduced, (2) the computational efficiency of our protocol, and (3) the tradeoff between computational efficiency and Byzantine robustness. To this end, we center our comparisons on robust stochastic aggregation (RSA), Centered Clipping (CC), and FLTrust (FLT) but remark that our framework is compatible with other (potentially future) Byzantine robust algorithms as well. We demonstrate the practical efficiency of our case studies in the P2P Learning framework while maintaining the same robustness of the algorithms as in their clear versions.
4 Karimireddy et al. [29] proved CC is robust under clipping for the Ep norm for arbitrary choice of real numbers p 2 1. which do not extend to the f.x. norm. We show empirically that centered clipping with the f. norm achieves similar model fidelity against known attacks in Appendix B.
8

---

10
RSA
RSA
Runlime (secands)
FLT
Rumime (seconds)
10
10²
10²
10
10"
10
50
100
500
1000
2500
5000
10^3
10*4
1015
10'6
Number of peers
Number parameters
(a) Runtime vs Number of Parameters.
(b) Runtime vs Number of Peers.
Figure 5: Computational Efficiency vs Number of Parameters and Peers. We report CPU wall- clock time for the execution of the aggregation step of our protocol the computation of F in single training round. The runtime performance of the algorithms (RSA, FLT,, and CC) scales linearly with the number of parameters and peers. When modifying parameters we use a total of 100 peers (left subfigure) and 10 parameters set when changing the number of peers (right subfigure). For RSA and CC, the aggregation committee size is set 46, and for FLT it accommodate the secret share multiplications of the protocol (see Appendix B for details).
121 order to
6.1 Security Does not Impact Robustness
We verify if the properties of the robust aggregation algorithms hold after the required modifications to lift them the malicious setting, c.g. switching to fixed point numerical precision. In use the IID MNIST dataset and 20 peers, of which
100
Figure
Accuracy (%)
there are 10 malicious workers We compare the robustness of CC against the ALIE (A Little Is Enough) attack [2] before and after lowering CC's numerical precision. We observe that the algorithm preserves its robustness despite the required changes. We also present corresponding additional studies (e.g. com- parison between & and fox norm for CC) in Appendix We observe that all the modified algorithms, namely CC, FLTT, and RSA exhibit comparable performance to the original algorithms.
60
num, type
40
fixed
floating
100
200 Round
300
400
Figure 4: Fixed floating-point numerical precision for CC.
6.2 Scaling of Computational Efficiency
Because P2P learning algorithms typically require upwards of 1000 rounds of the protocol to converge, it is necessity to have an efficient protocol. In Figure 5, we analyze the two major factors influencing this: the size of the vector (ML model) being aggregated (denoted the number of parameters), and the number of peers participating in the collaborative learning. We observe much better performance for RSA than other algorithms per training round. This results from a more concise form of the information exchanged between peers in the case of RSA, where local updates from each peer are represented as array of bits. In contrast, model updates sent between peers in FLT CC are always encoded as fixed points, 16 for FLT vs 32 for CC. The more efficient encoding in RSA provides a speedup of around ~30X in comparison to CC and ~6X over FLT. Our framework scales efficiently to even 5000 participants; we observe a linear growth in terms of the elapsed time per training round. Similarly, the computation time scales linearly for RSA, FLT, and CC, with the number of parameters. We further compare the communication cost between frameworks in Appendix B.
6.3 End-to-end Protocol Evaluation Presence of Attacks
We estimate the accuracy and runtime of the modified algorithms in the presence of different types of attacks in Figure 6. We compute the number of rounds to convergence, and use the per-round CPU
NNtee, this is higher adversarial proportion than be tolerated by end-to-end framework due to the crytographic elements our framework. We include this evaluation because Byzantine robustness literature commonly considers this regime. This evaluation ensures that our underlying aggregation algorithms meet these standards (even when modified for efficiency). Thus, we also benchmark accuracy and robustners of the aggregation algorithms outside of the cryptographic elements, finding that the robustness guarantees retained.

---

attack None
attack sf
attack
attack ipm
attack alie
100
agg
Accuracy (%)
40
FLT
10
20
10f Runtime (s)
104
10f Runtime (s)
10 Runtime (s)
10c 10 Runtime (s)
10 10 Runtime (s)
Figure 6: Byzantine Robustness of P2P Learning Protocols for iid EMNIST. We compare RSA, FLT, and CC after their instantiations in our framework. A cohort size of 50 peers is used, of which there are 10 malicious workers. We consider four attacks and have a bascline without any malicious workers. We run each algorithm until its completion. CC achieves the highest final accuracy. FLT and CC converge much faster than RSA.
time for computation of F in each algorithm, to estimate overall training runtime and accuracy for EMNIST (and similar results for MNIST in Appendix B). We plot the test accuracy (%) on the y-axis and the x-axis represents the estimated CPU time (measured in seconds, note that this is in the logarithmic scale) of the P2P training. We observe that in all cases, CC and FLT algorithms outperform RSA in terms of convergence speed and achieve higher final accuracy. Note that the overall convergence speed is decided by both the number of iterations of training and the cost of each iteration. Although RSA faster to compute for one iteration due to reduced information exchanged in each iteration, it requires much more iterations than CC and FLT, and hence slower to converge. When considering only utility, CC also outperforms FLT consistently; however, under computation constraints, it is often the case that FLT is more efficient than CC. This is primarily because we use fixed-point length (f) of 16 bits in the experiments for FLT, but 32 bits for CC.
7 Limitations
We provided reference implementation of our protocol for three popular robust aggregation algo- rithms, namely RSA, FTL, and CC. We hope that our framework will be easy to extend to future robust aggregation methods. We acknowledge that operating in the malicious threat model also increases the cost of computation, communication, and storage, in comparison to the fully trusted environment or an honest-but-curious threat model.
Our protocol is focused on confidentiality and security of the training protocol when combined with robustness. This is one component privacy-preserving machine learning that is critical to preventing many attacks (as outlined in Table and Section 2). However, this does not prevent the privacy leakage obtained via interactions with the final trained model. For this, differential privacy (DP) [21], in particular DP machine learning techniques [1, 3, 18, 19] are required. Incorporating these techniques within our framework of interesting future work.
8 Conclusions
The benefits of collaborative learning make it an attractive paradigm that is increasingly adopted in many domains, such as the financial sector to enable collaboration between banks. However, there many risks associated with collaboration due clients or server(s) being actively malicious. Malicious clients can submit corrupted updates which leads to the failure of creating a useful shared model. Conversely, the leakage of the client's local data when contributing model updates has been demonstrated to be particularly strong when central party cannot be trusted to orchestrate the collaborative learning protocol. To mitigate these issues, we propose a Peer-to-Peds Learning protocol that is robust against malicious clients and server(s) to train shared model without central party. We prove the cryptographic security our protocol, providing the necessary security guarantees. Our novel framework is designed as generic compiler that can efficiently convert robust aggregation algorithms to the P2P learning setting with the guaranteed malicious--ecure protocol. We show empirically that the generated protocols retain their robustness guarantees. This generic approach can be applied to many (possibly future) aggregation algorithms.
10

---

Acknowledgement
We would like to acknowledge our sponsors, who support our research with financial and in-kind contributions:
Amazon, Apple, CIFAR through the Canada CIFAR Chair, DARPA through the GARD project, Intel, Meta, NSERC through the Discovery Grant, the Ontario Early Researcher Award, and the Sloan Foundation. Resources used in preparing this research were provided, in part, by the Province of Ontario, the Government of Canada through CIFAR, and companies sponsoring the Vector Institute. Xiao Wang is supported by NSF #2016240, #223681 19, 12318974, and research awards from Google and Meta. Jha is supported by Air Force Grant FA9550- 11-50008-1-0666 the National Science Foundation (NSF) Grants
100820,,,,, SaTC-Fronties- porootiers-1804644 1804648, and DARPA-GARDI problem under agreement number 885000. Franzese is supported by the National Science Foundation Graduate Research Fellowship Grant No. DGE-1142165. We would also like to thank CleverHans lab group members for their feedback.
CCF-2046710, CCF-1652140 and 2039445, and ARO grant number W91 1911NF-17-1-044
References
[1] Martin Abadi, Andy Chu, Ian Goodfellow, H Brendan McMahan, Ilya Mironov, Kunal Talwar, and Li Zhang. Deep learning with differential privacy. In Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, pages 308-318, 2016.
[2] Moran Baruch, Gilad Baruch, and Yoav Goldberg. A little is enough: Circumventing defenses for distributed learning. 2019. doi: 10448500/AR21111100001... URL https://arxiv org/abs/ htt/a/bb//992/ 1902. 06156.
[3] Raef Bassily, Adam Smith, and Abhradeep Thakurta. Private empirical risk minimization: Effi- cient algorithms and tight error bounds. In 2014 IEEE 55th Annual Symposium on Foundations of Computer Science, pages 464-473, IEEE, 2014.
[4] James Bell, Adrià Gascón, Tancrède Lepoint. Baiyu Li, Sarah Meiklejohn, Mariana Raykova, and Cathie Yun. Acor: Input validation for secure aggregation. Cryptology ePrint Archive, 2022.
[5] James Henry Bell, Kallista A. Bonawitz, Adrià Gascón, Tancrède Lepoint, and Mariana Raykova. Secure single-server aggregation with Iogarttogii overhead. In Proceed- ings of the 2020 ACM SIGSAC Conference Computer and Communications Security, CCS '20, page 1253-1269, New York, NY, USA, 2020. Association for Computing Machinery. ISBN 978145037,899. doi: 10.1 14443337299.344777778 URL https: //doi. wewooioorg/1... 1..0.114: 1145/ 3372297 3417885.
[6] Battista Biggio, Blaine Nelson, and Pavel Laskov. Poisoning attacks against support vector machines, 2012. URL https: /// http///axvvvvo//// org/ abs/1206..111../////////// 6389.
[7] Peva Blanchard, EI Mahdi El Mhamdi, Rachid Guerraoui, and Julien Stainer. Machine learn- ing with adversaries: Byzantine tolerant gradient descent. Advances in Neural Information Processing Systems, 30, 2017.
[8] Manuel Blum. Coin flipping by telephone a protocol for solving impossible problems. SIGACT News, 15(1):23-27, jan 1983. ISSN 0163-5700. doi: 10. 1044//000890..008911 URL attps://dde http::///.o..o......eoo// 1t////10114555 100111111110000 1008911.
[9] Franziska Boenisch, Adam Dziedzic, Roei Schuster, Ali Shahin Shamsabadi, Ilia Shumailov, and Nicolas Papernot. When the curious abandon honesty: Federated learning is not private,
2021. URL httpt:tt//// / http///xxvvvv..o/// www./rgg//////eooooooooo 2b12/211.02911
[10] Franziska Boenisch, Adam Dziedzic, Roei Schuster, Ali Shahin Shamsabadi, Ila Shumailov, and Nicolas Papernot. Is federated learning a practical pet yet? 2023.
[11] Keith Bonawitz, Vladimir Ivanov, Ben Kreuter, Antonio Marcedone, Brendan McMahan, Sarvar Patel, Daniel Ramage, Aaron Segal, and Karn Seth. Practical secure aggregation for privacy-preserving machine learning. proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, pages 1175- 2017.

---

[12] Dan Boneh, Elette Boyle, Hemry Corrigan- Gibbs, Niv Gilboa, and Yuval Ishai. Zero-knowledge proofs on secret-shared data via fully linear peps. Cryptology ePrint Archive, Paper 2019/188, 2019. URL https: //etritt/eeprntt.... iacr. wtt.eorgg/////// 188. https://eprine iacr pacrr.rgg/019/ 188.
[13] Ran Canetti. Universally composable security: A new paradigm for cryptographic protocols. Cryptology ePrint Archive, Paper 2000/067, 2000. URL Utt.https://epriitt iacr iacr..rg//0000 067.
iacr. org 2000/000/677
[14] Xiaoyu Cao, Minghong Fang, Jia Liu, and Neil Zhenqiang Gong. Fltrust: Byzantine-robust federated learning via trust bootstrapping. arXiv preprint arXiv:2012.13995, 2020.
[15] PETs Prize Challenge.
learning- 1/agge552,/ 2023.
URL http::///wwwwww. http:///wwwww...datdaaaaaaaaaaaa http://wweennaaaa.rooomootaataaa 1/page/522/.
[16] Wei-Ning Chen, Christopher A Choquette-Chov Peter Kairouz, and Ananda Theertha Suresh.
The fundamental price of secure aggregation in differentillly private federated learning. arXiv preprint arXiv:2203.03760 2022.
[17] Christopher A. Choquette- Natalie Dullerud, Adam Dziedzic, Yunxiang Zhang, Somesh Jha, Nicolas Papernot, and Xiao Wang. CaPC Learning: Confidential and Private Collaborative Learning. In International Conference on Learning Representations, 2021. URL https: //openreview peet/forunidd-hEbJ14
[18] Christopher Choquette- Chhuu, H Brendan McMahan, Keith Rush, and Abhradeep Thakurta. Multi-epoch matrix factorization mechanisms for private machine learning. arXiv preprint arXiv:2211.06530., 2022.
[19] Christopher A Choquette- -Choo, Arun Ganesh, Ryan McKenna, H Brendan McMahan, Keith Rush, Abhradeep Guha Thakurta, and Zheng Xu. (amplified) banded matrix factorization: A unified approach to private training. arXiv preprint arXiv:2306.081 08133, 2023.
[20] Amrita Roy Chowdhury, Chuan Guo, Somesh Jha, and Laurens van der Maaten. Eiffel: Ensuring integrity for federated learning. arXiv preprint arXiv:2112.12727, 2021.
[21] Cynthia Dwork, Aaron Roth, et al. The algorithmic foundations of differential privacy. Founda- tions and Trends in Theoretical Computer Science, ((3-4):211-44 2014.
[22] Jiashi Feng, Huan Xu, and Shie Mannor. Distributed robust learning, 2015.
[23] Jonas Geiping. Hartmut Bauermeister, Hannah Dröge, and Michael Moeller. Inverting gradients- how easy is to break privacy in federated learning? arXiv preprint arXiv:2003. 14053, 2020.
[24] Jonas Geiping, Hartmut Bauermeister, Hannah Dröge, and Michael Moeller. Inverting Gradients How easy is it to break privacy in federated learning? 2020. 23 pages, 20 figures. The first three authors contributed equally.
[25] Rachid Guerraoui, Sébastien Rouault, et al. The hidden vulnerability of distributed learning in byzantium. In International Conference Machine Learning, pages 3521-3530. PMLR, 2018
[26] Lie He, Sai Praneeth Karimireddy, and Martin Jaggi. Byzantine-robust learning on heteroge- neous datasets via resampling. 2020.
[27] Peter Kairouz, Ziyu Liu, and Thomas Steinke. The distributed discrete gaussian mechanism for federated learning with secure aggregation. In International Conference on Machine Learning, pages 5201-5212 2,, PMLR, 2021.
[28] Peter Kairouz, H Brendan McMahan, Brendan Avent, Aurélien Bellet, Mehdi Bennis, Ar- jun Nitin Bhagoji, Kallista Bonawitz, Zachary Charles, Graham Cormode, Rachel Cummings. al. Advances and open problems in federated learning. Foundations and Trends Machine Learning, 14(1-2):1-21 2021.
12

---

[29] Sai Praneeth Karimireddy, Lie He, and Martin Jaggi. Learning from history for byzantine robust optimization. International Conference on Machine Learning. pages 5311-5319, PMLR. 2021.
[30] Sai Praneeth Karimireddy, Lie He, and Martin Jaggi. Byzantine-robus, learning on heteroge- neous datasets via bucketing. In International Conference on Learning Representations, 2022.
URL https://
peet/forum?ing JxXKD
[31] Nikola Konstantinov and Christoph Lampert. Robust learning from untrusted sources. In Kamalika Chaudhuri and Ruslan Salakhutdinov, editors, Proceedings of the 36th International Conference on Machine Learning volume 97 of Proceedings of Machine Learning Research, pages 3488-34888 -498. PMLR, 09-15 Jun 2019. URL konstantinov 19a. html.
mlr prwss/ /vess/v97/
[32] Liping Li, Wei Xu, Tianyi Chen, Georgios B Giannakis, and Qing Ling, Rsa: Byzantine- robust stochastic aggregation methods for distributed learning from heterogeneous datasets. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 33, pages 1544-1551, 2019.
[33] Yehuda Lindell and Ben Riva. Cut-and-choose based two-party computation in the online/offline and batch settings. IACR Cryptol. ePrint Arch., 2014:667, 2014.
[34] Brendan McMahan, Eider Moore, Daniel Ramage, Seth Hampson, and Blaise Aguera y Arcas. Communication-efficiee learning of deep networks from decentralized data. In Artificial intelligence and statistics, pages 1273-1282. PMLR, 2017.
[35] H Brendan McMahan, Daniel Ramage, Kunal Talwar, and Li Zhang. Learning differentially private recurrent language models. arXiv preprint 1rXiv:/710.0696: 2017.
[36] Adam Paszke, Sam Gross, Francisco Massa, Adam Lerer, James Bradbury, Gregory Chanan, Trevor Killeen, Zeming Lin, Natalia Gimelshein, Luca Antiga, Alban Desmaison, Andreas Kopf, Edward Yang. Zachary Vito,,, Martin Raison, Alykhan Tejani, Sasank Chilamkurthy, Benoit Steiner, Lu Fang, Junjie Bai, and Soumith Chintala. Pytorch: An imperative style, high- performance deep learning library. In H. Wallach, H. Larochelle, A. Beygelzimer, F. d'Alché- Buc, E. Fox, and R. Garnett, editors, Advances in Neural Information Processing Systems 32, pages 8024 8035. Curran Associates, Inc., 2019. URL http: //pperss newrips.cc/paperr.. cc/paper/ 2015-pytorch ch- an- wwwpiiitieessttiieeeeeeeee pdf.
www.g-eeffrranneeee. deep- library.
[37] Le Trieu Phong, Yoshinori Aono, Takuya Hayashi, Lihua Wang, and Shiho Moriai. Privacy- preserving deep learning: Revisited and enhanced. pages 100-110. Springer, Singapore, 2017. doi: 1110007977-98--1--111
URL https://link: stringerrinnerreeee com/content/paff 10. 10.100772F978 981 10-1-10--52----1 1_9.111119.p.. pdf..
[38] Krishna Pillutla, Sham M Kakade, and Zaid Harchaoui. Robust aggregation for federated learning. arXiv preprint
2019.
[39] Muhammad Shayan, Clement Fung, Chris JM Yoon, and Ivan Beschastnikh. Biscotti: ledger for private and secure peer-to-peer machine learning, arXiv preprint arXiv: 1.09944, 2018.
[40] Victor Shoup. library for doing numbery theory. URL
org. [41] Enayat Ullah, Christopher A Choquette-Choo, Peter Kairouz, and Sewoong Oh. Private federated learning with autotuned compression. 2023.
[42] Xiao Wang, Samuel Ranellucci, and Jonathan Katz. Authenticated garbling and efficient maliciously secure two-party computation. Cryptology ePrint Archive, Paper 2017/030, 2017. URL https://eprint. iacr org/2017/030 https://epring: iacr wtt.o/o/rr//00//0/003 2007/030.
[43] Zhibo Wang, Mengkai Song, Zhifei Zhang, Yang Song, Qian Wang, and Hairong Qi. Beyond inferring class representatives: User-level privacy leakage from federated learning. In IEEE INFOCOM 2019 IEEE Conference on Computer Communications. IEFE, 2019. doi: 10.1 109/
infocom.2019.87374
13

---

[44] Stefanie Warnat- Hereatteerresthal, Hartmut Schultze, Krishnaprasad Lingadahalli Shastry, Sathya- narayanan Manamohan, Saikat Mukherjee, Vishesh Garg, Ravi Sarveswara, Kristian Händler, Peter Pickkers, N Ahmad Aziz, et al. Swarm learning for decentralized and confidential clinical machine learning. Nature, 394(7862)225-2770 2021.
[45] Cong Xie, Oluwasammi Koyejo, and Indranil Gupta. Generalized byzantine-toleram sgd, 2018.
URL https://arxiv. org/ /ttos//102...0 10116.
[46] Cong Xie, Sanmi Koyejo, and Indranil Gupta. Fall of empires: Breaking byzantine- toleraat sgd by inner product manipulation, 2019. URL https://arxiv. wttp:////rraa//////////// 03936.
[47] Zheng Xu, Yanxiang Zhang, Galen Andrew, Christopher A. Choquette-Choo, Peter Kairouz, H. Brendan McMahan, Jesse Rosenstock, and Yuanbo Zhang. Federated learning of gboard language models with differential privacy, 2023.
[48] Dong Yin, Yudong Chen, Ramchandran Kannan, and Peter Bartlett. Byzantine-robus distributed learning: Towards optimal statistical rates. International Conference on Machine Learning. pages 5650-5659. PMLR, 2018.
[49] Hongxu Yin. Arun Mallya, Arash Vahdat, Jose M. Alvarez, Jan Kautz, and and Pavlo Molchanov. See through Gradients: Image Batch Recovery via GradInversion. 2021. URL httpss://ppenaccess thecvf. http://neeeettt////////////////e gradients_imagee http:iiaaaaeeaheeeeeeeeeeeeeeeee www.ooerr..iaagrraiieeeeeeeeeeee
see through. html.
[50] Bo Zhao, Konda Reddy Mopuri, and Hakan Bilen. iDLG: Improved Deep Leakage from Gradients. 2020.
[51] Yang Zhao, Jun Zhao, Linshan Jiang, Rui Tan, Dusit Niyato, Zengxiang Li, Lingjuan Lyu, and Yingbo Liu. Privacy-preserving blockchain-based federated learning for iot devices. IEEE Internet of Things Journal, PP:1-1, 08 2020. doi: 10.1 10/1000002000003173777.
[52] Ligeng Zhu and Song Han. Deep leakage from gradients. In Federated Learning, pages 17-31. Springer, Cham, 2020. doi: 3omm///tppeee//0011077787------0
2. URL
14

---

A Broader Impacts
The goal of our work is to provide protocol that enables collaborative learning with guaranteed confidentiality of client data and fidelity of the trained model, even when both clients and server(s) maliciously. A potential positive impact of this work is increased privacy and accountability in machine learning systems. One potentially negative impact could be the degradation of performance (in terms of compute time, communication overhead, or additional storage) for legitimate users. However, as shown in our experimental results, we are still able to cater to 100s of users with a model size of min parameters.
B Additional Information
We further present additional information, experimental results, as well as a comparison between RSA, Centered Clipping with Momentum, and FL. Trust.
B.1
Committee Size
The main protocol proceeds by first selecting a subset from the pool of peers which will be responsible for aggregating the updates of all the peers. This subset is termed the aggregation committee. To guarantee security, the size of the committee has to be adjusted based on the number of corrupted parties. Let us denote the set of corrupted parties as with [B] = b. the committee members are selected randomly, then with probability p- b/n. given committee member is an adversary. To ensure security in the malicious case, we need the aggregation committee to have an honest majority except with negligible probability (i.e. occurring with probability less than 2-40 40 in [33, 42]). We can assess the probability of this event by modeling the number of corrupted peers in a uniform sample as a binomial random variable X with bias p = A and m trials. particular, we are interested in values of p and m for which Pr[X 2 n/2) < 2-10 These values can computed from the cumulative density function of the binomial distribution. Assuming a 10% adversarial corruption threshold (i.e. setting p = 1/10), we obtain a committce size of 46. We use this committee size for experiments with RSA and CC. With FLTrust, in order to accommodate secret share multiplications with Shamir secret sharing, we guarantee Pr [ 2 n/3] < 2-40, which gives a committee size of 121.
B.1.1 Tolerance of Committee Members Dropping
In general, our protocol requires that the number of adversaries in the aggregation committee be kept below a certain proportion in order to guarantee security. The committee size is chosen as the smallest number of parties such that (except with negligible probability) a random sample from the pool of clients has less than 1/2 adversarial proportion (in the case of RSA, CC), or less than 1/3 (in the case of FLTT). To tolerate drop out of honest committee members, we simply need to select an increased committee size such that the proportion of adversaries in the committee stays beneath these thresholds even if some number of the honest parties drop out. In particular, we choose committee size which guarantees (except with negligible probability) that a random sample from the pool of clients has less than 1 3)) adversarial proportion, where q is the proportion of tolerated dropouts from honest parties, we will guarantee that the adversarial proportion with reference to the number of committee members that stay online most 1/2. We can find the necessary committee sizes by reasoning with the binomial distribution similarly to our original analysis of committee size. For example, to tolerate 5%, 10%, and 15% dropout of honest committee members, RSA and CC would require committee sizes of 53, 60, and 69 respectively (compared to 46 with no dropout tolerance), and FLT would require 157, 218, and 326 respectively (compared 121 with no dropout tolerance).
B.2 Building Blocks
Byzantine Robust Aggregation. In collaborative learning (e.g., federated learning), many clients submit model updates based on their local data. These local updates are aggregated to update the global model. In settings where clients are untrusted, some Byzantine or malicious clients may submit poisonous updates (which may take arbitrary values) with the aim of degrading the quality of the global model. Broadly speaking, Byzantine robust aggregation algorithms (often abbreviated to "robust aggregation"), guarantee that accurate global model is trained as long the proportion of
15

---

malicious clients is bounded by certain threshold (e.g,, the theoretical analysis in CC assumes maximum of 15% malicious clients). Further formalization of this idea occurs in a variety of ways across different works of literature our framework is intentionally modular, inheriting the guarantees of given underlying algorithm. Our main contribution augmenting robustness to malicious clients with the additional guarantee that aggregation is computed correctly and confidentially even in the presence of malicious servers aggregation committee members. We use the cryptographic primitives reviewed below to achieve this guarantee.
Committee Election. Uniform election of committee members can be efficiently instantiated using coin- boin-flipping [8]. A classical way to accomplish this is to have all peers generate string of random bits locally. The peers then make a cryptographic commitment to their random bits and distribute to all other peers. After all peers have made their commitments, the random bits are all revealed. The concatenation of all the random bits can then be used as input to random oracle, whose outputs can be used to select the committee members uniformly at random. This method for uniform random committee election secure as long as at least one peer behaves honestly during the commitment process. We leverage this to guarantee that the aggregation committee has an honest majority (or is 2/3 honest in the case of FLT) (see Appendix B. for details).
Verifiable Secret Sharing. To make our protocols secure in the presence of malicious adversaries, we require Verifiable Secret Sharing (VSS). A VSS scheme allows the secret owner with a secret s. to distribute shares of s among parties with threshold t such that (a) any group of t parties can reveal no information about and (b) any + 1 parties can recover the correct value of s. In this work, we use Shamir secret sharing to instantiate VSS. Secrets are shared among members of the aggregation committee C. We make guarantees on the adversarial composition of C, and set t such that honest parties may perform computations necessary during DZKP and MPC protocols (see below), yet adversarial parties never gain access to enough shares to reveal or modify s.
Distributed Zero Knowledge Proofs. A malicious-secure zero knowledge proof protocol enables a prover in possession of a witness w prove to a verifier that for some publicly known function f. (w) takes a particular value. It is guaranteed that the verifier learns no additional information about w other than what is implicitly revealed by fw). and that no malicious prover can convince the verifier that f(w) takes an incorrect value. A distributed sero-knowledge proof (DZKP) is a variation on this primitive, wherein the prover distributes secret shares of w among set of verifiers. Leveraging the linear operations on secret shares enabled by this setting can admit particularly efficient pero-knowlee
proofs (see e.g. [12]. our implementations, we use DZKP protocols which assume that the set of verifiers has honest majority.
Secure Multiparty Computation. A malicious-secure multiparty computation (MPC) protocol enables a group of parties P1, Pz...., Pn, with respective private inputs æ1, ".,.,,,.., Ty to securely compute a function and obtain output fz1 .2...., ..)). In particular, is guaranteed that no party learns any additional information about the inputs beyond what is implicit in the output, and it is guaranteed that f is computed correctly, even in the presence of parties that behave in arbitrarily malicious ways. In our implementations, we use MPC protocols which assume that the set of parties has an honest majority (2/3 honest in the case of FLTT).
Composition. All of the building blocks listed above are secure under universal composability [13] and thus their compositions (i.e., using them together, either in sequence or in parallel) are secure. They can all be implemented under information theoretic security, although we used a pseudorandom generator minimize the communication. That is, using these primitives together in concert in our protocol preserves the security guarantees afforded by the individual building blocks.
To provide concrete sense of how the security guarantees and trust assumptions of the building blocks work together in the full protocol, we provide a step-by-step claboration on the protocol below.
1. Committee Election All clients use the method described above to randomly select the aggregation committee C with malicious security. The analysis in Appendix B. guarantees that C' has honest majority.
2. Client Local Computation. Each client computes FC and Fº to obtain a preprocessed local model update given their data, and the global model parameters.
3. Verifiable Secret Sharing of Updates. Each client secret shares their update with threshold |CI/2 ((C1/3 for FL.T), and sends share to each committee member. Since C has honest majority, this guarantees that adversaries cannot alter or reveal the client updates.
16

---

4. DZKP of valid update. Clients prove to the committee that their updates are valid using DZKP protocol that takes the secret shares as input. E.g. in P2P RSA, client updates must be binary-valued, so committee members create shares of check value which is guaranteed to be O the update was binary-valued, while leaking no further information (see Appendix B.4.1 for details). Here security follows from the security of the DZKP and the VSS schemes.
5. MPC for computing global updates. Committee members compute F in MPC, using client shares as input, to obtain a global model update. E.g. in P2P RSA, committee members sum the shares of all client updates using the standard secure addition protocol on Shamir secret shares. The committee members then reconstruct the shared sum to obtain the global update (correct reconstruction is guaranteed by VSS). Security follows from the security of the MPC and VSS schemes.
Global updates sent to clients. All committee members send the recovered value all clients. Since C' has an honest majority, the clients are guaranteed to recover the correct global update by accepting the majority result.
B.3 Security Proof
We provide proof of Theorem (malicious security of Figure 3) below.
Proof: We prove the security of the protocol by constructing a simulator interacting with the adversaries controlling subset of the parties.
1 The simulator plays the role of coin flipping and return a uniform aggregation committee. the committee contains more adversary than the allowed threshold, the simulator aborts.
The probability of simulator aborts in this step negligible given the committee size and threshold.
2-4 The simulator obtains shares of vs from the adversary and sends them random shares on behalf of the honest parties.
5 If F" is not computationally surjective, The simulator plays the role of DZK to obtain the adversary's input ut If F computationally surjective, the simulator use v, compute some
The simulator's 's running time is always polynomial in this step either because efficient extraction from DZK or because of the definition of computational surjectivity.
6 The simulator plays the role of DZK and check v, is in the image of FP and aborts if not the case.
7 The simulator sends u, to FPZPL and gets back the new updates; it then plays the role of FMPC and sends back the new updates the adversary.
B.4
Instantiating Our Malicious Framework
B.4.1 Malicious-Secure P2P RSA.
Overview of Single-Server RSA. Single-server Byzantine-rohust stochastic aggregation (RSA) [32] is set of subgradient based algorithms for robust aggregation. The key component of the method a regularization term incorporated into the objective function to make learning robust. To enable graceful handling of heterogeneous worker datasets, each client maintains local set of model parameters z whilst working together to optimize the global model parameters w at a step k. At each step, clients compute parameter update which takes into account their local data, their prior local model, as well as the global model parameters. The server receives the local client updates and uses the regularized objective obtain robust aggregate update. Client and server updates, respectively, are given by the equations:
/ 1 xt n1 (VF(a) (t) + Asign(æt w²))
w k+1
w - V +
Σ iE/m
sign(w* 2!))
(2)
17

---

where 17 is a decaying learning rate hyper parameter, & is sampling of the local client dataset, F(::)) the loss function. -) is the robust (42) regularization term, À is hyper parameter controlling the weighting of the robustness term, the sign is performed element-wise and [r]] is the set of clients.
Lifting RSA to the P2P setting. To cast RSA into our framework, we first observe that Eie(a] sign(w* (w xr{) is the only term of the server's update that requires input from the clients. Thus we limit the work of the committee solely to computing this term, and the rest of the work is done locally. We instantiate RSA for our framework in Figure 7.
In the JCC (client update computation) part of the RSA protocol, each peer receives the global model parameters w It computes local parameter update ax+ based the global model, the local model .* and the local gradient F. In the FP (update preprocessing) part of the protocol, peers compute the sign of the difference between their local parameters and the global model parameters sign(ue ( u.). resulting in a bit vector v, (one bit per model parameter). In the 1e (aggregation) part of the protocol, the committee members receive secret shares of sign w k x²)) from each participant. We observe that RSA can be lifted to the malicious security model with high efficiency: it is provably computational surjective and the underlying MPC can be efficiently instantiated.
Computational Surjectivity, Recall that in RSA peer updates are the sign of the difference between each parameter of the local and global models (Figure 7). In other words, the Fe of RSA gives V {-1, 13d, where is the number of parameters in the model. In the single-server model of RSA [32] and in Figure 7, poisonous peers can choose arbitrary u, before F" is computed, which gives 8;- sign(w* u.). Now we are ready to show the computational surjectivity of this FP.
Lemma FP described in Figure 7 is a computationally surjective function.
Proof: Fix arbitrary point (Vi,".., va) E 1-1, We can construct E U that FP maps to u by first fixing some arbitrary w" = (W1, ... wa). and letting u = (11.-.. Ud) such that U = W/ 1 for each j E [d].
Clearly the F RSA v; = sign(w* - u.) maps u to the arbitrary v. So FP is computationally surjective.
Details of the cryptographic protocol. Thus, following Figure 3, it sufficient for peers to prove in zero knowledge that their updates are in the set V= {-,,1}² This can be accomplished efficiently by having each peer represent their update as d shares of binary values.
The committee can verify that a shared & is binary-valued by constructing shares of x (1- x)) and revealing it to be zero. We implement this step efficiently by batching the binary-value DZK proofs together. That is, for every shared value I;, parties uniformly sample a random value r,, and locally construct shares of the sum Σ r; (x; - (1 x4)). The parties then reconstruct the sum if it is then each of the (z;:- (1- - r;)) components must have been O with all but negligible probability. For a more detailed treatment of this technique, see [12].
During the computation of F", the committee needs only to sum the shares and send out the reconstructed sum. The actual value of the summed updates in {-1,1} 1} is implicitly given by the sum of the binary values (if the sum of the binary values is x. simply take 2x - m). The updated global model parameters then be obtained via local computation of Equation 2.
Computational Surjectivity. In RSA, peer updates are the sign of the difference between each parameter of the local and global models (Figure 7). The FP of RSA gives V = { {-1, 1] where d is the number of parameters in the model. In the single-server model of RSA [32] and in Figure poisonous peers can choose arbitrary u, before F" is computed, which gives U, sign(w* u.). Now we are ready to show the computational surjectivity of this F..
Lemma Fp described in Figure 7 is a computationally surjective function.
Proof: Fix an arbitrary point (vi.... Ud) E V = (-,, We can construct u E U that FP maps to v by first fixing some arbitrary " = (Wi, ... wa). and letting u = (u1,""";uu) such that Uj = W/ - vU for each j E [d].
Clearly the FP of RSA n; = sign wt u.) maps u to the arbitrary v. So FP is computationally surjective.
18

---

u; + FC (data, st, w)
(k, x t st
2. Sample 5t from local data D;
3. xt x. -1yh (V ( + Asign(æ. -w")
4. u = x.
+ (I: + 1, 1, 1)
Vi x- F (u,)
Set Dj = sign(w' ( ui)
+- FR((())eE(n))
Set wh+t = wh n fo(w=*) + > iEjn v1)
Figure 7: P2P Learning with RSA. Fo can be computed efficiently by performing only Σiejn] vi on the committee side. The rest of the terms are public, so the remainder of the update can be computed locally.
B.4.2 Malicious Secure P2P CC
Overview of Single-Server Centered Clipping. Centered Clipping [29] is recent robust aggrega- tion that ensures a high level robustness even when the noise distribution not uni-modal (which assumed in many prior works.) It also provides better robustness when corrupted updates different rounds are correlated. Below we first discuss details the algorithm and then how to express it in our framework.
Centered Clipping (no momentum): Given the training iteration k, globally shared model parameters wh, local model parameters 2f+1 in client i, and radius т, CC using the -orm computes an updated weight vector as follows:
w min (1, ||
x+ (ar
(3)
w w+112
w h+1 1 w +
z k+1
(4)
In Equation (3), we clip the parameters for each client i, and then aggregate them in Equation (4).
Centered Clipping with Momentum: In addition the above, each non-Byzantine client i first computes a gradient update VF based on their mini-batch & and the current global weights w. Then, using the momentum parameter 3, each client computes momentum vector as shown in Equation 5 (executed before Equation (3) and Equation (4)):
3) V <h) + Ba
Lifting CC the P2P setting. We bring CC into the P2P setting by placing the momentum computation inside FCC the clipping operation inside FP, and the aggregation of clipped updates in FR, The clipping operation is performed on individual client updates, and thus can be performed on the client side. Further, as in RSA note that F is linear function, and thus can be computed efficiently using the homomorphic addition and scalar multiplication propertics of Shamir secret sharing.
Centered Clipping does not naturally give us a surjective FP. Of note, if corrupted peer supplies value of v; that is outside of the 7-ball surrounding w, the global update will be computed incorrectly and the model fidelity guarantees will broken. To avoid this possibility, we make slight modification to the CC algorithm. Namely, we clip local updates using the fxc norm rather than the norm. other words, we clip the gradients to a T-box rather than T-ball. The computation of the global update thus becomes
19

---

Wh+1 We +
min (T, ma, -T, -w:)
(6)
This modification admits a computationally surjective F with an efficient DZK proof that client update is within the valid domain. In particular, we take V [0, 2 I].. Then in F" we scale, round, and map clipped gradient updates to be within this domain. Here 0 a public constant large enough to limit discretization eтror of local updates during scaling in the present study we set O 32 in order align with 32-bit fixed-point numbers. Smaller values of & will increase protocol efficiency, at the expense of higher discretization error during rounding and mapping in F step 3. Computational surjectivity of this FP follows from a similar argument Lemma
DZK Proof of Valid Update. We specify that local updates v. are submitted as vectors of the individual component bits of the processed gradient update. This means that each bit will be individually secret shared, which allows the committee to verify whether each one is binary-valued (using the same DZK technique described above for the RSA protocol). Since we scaled each update to fit within a 2 -sied d-dimensional box, the d sets of 0 binary values in the update trivially encode point within the box. Thus, a proof that each component of the bitwise update is binary-valued equates to a proof that the update is in V.
The global update is aggregated by summing the bits at each position of the client update vectors. The sums are reconstructed and sent directly to all clients. They implicitly encode the updated global parameters w', which are recovered via client-side computation in order to keep the computation of FR weight. Details of our malicious-secus Centered Box Clipping protocol can be found in Figure 8.
B.4.3 Malicious Secure P2P FLTrust
Single-server FLTrust (abbreviated FLT) [14] is robust aggregation algorithm that bootstraps trust using a clean "root" dataset maintained by the server. During each iteration, the server compares client gradients against the gradient computed from the root dataset. Specifically, the server computes a 'trust score' (TS) for each client gradient i E [m]. which it uses to compute a weighted sum of normalized gradients which makes up the final aggregate. The trust score and update aggregation are given by the following equations:
Overview of Single-Server FLTrust.
(gi; 9o)
TS, ReLU
(7)
|1:11119011
112
9
TS. 9
(8)
j TS:
+ a
(9)
Where TS; is the trust score for client i, 9: is the local gradient for client i, go is the gradient computed from the root dataset, and Ti is the gradient of client normalized to have the same length as 9o- As brief explanation of the framework, the trust score acts clipped version of the cosine similarity the greater the angle between 9; and 9o. the smaller the scaling factor that weights ği in the weighted sum. The ReLU ensures that any I. with negative cosine similarity is clipped to O, and thus contributes no weight to the sum.
I Lifting FLT to the P2P setting. We hegin by assuming that the root dataset Do is publicly accessible. so that all clients may compute the root update go locally, in addition to their local update g, inside of FC. In FL perform normalization and rotation to simplify the computation of Equations 7 and 8 in Fll (explained in more detail below). In FL,, we securely compute the trust score of each client and the corresponding weighted sum of gradients. This weighted sum is submitted as the global update computation of the updated model parameters left to the clients as a post- post-processing step.
The representation of e; is chosen to enable efficient computation of FR and of DZK proofs of update validity. In detail, we perform a rotation of gi and go such that go is aligned with the x- axis (and the angle between 9o and g is preserved). We also normalize such that go and 9i are unit-length. Further, when submitting client updates we use a representation that can only encode non-negative r-coordinate (by decomposing each entry of g into a sign and magnitude, and only
20

---

u; - pC (data, st, w)
(k, m.) + st
2. Parse {b]] ]E(d-0] into d sets of 0 values each, corresponding to the d parameters
of the model. Index them Pih. where E [d] and [d] // Parse and index the bitwise global update to align with parameters of the model
For E [d]. S/ + Eis(o) PiN 2 // intermediate value of global update reconstruction
4. wh wn k-
( sn) for h [d]. Call w + {w hela // reconstruct global model
parameters
5. Sample ç from local data D;
6. Compute u, = (VWW', . + m
7. st + (k: 1,
0, < FP (u,, un)
Compute e!"" (T, max T, u, w)) + 7
2. Compute vs"" <- (w(" ww) 20-1 // scale the clipped value and center to the origin
Round and map entries of vo to unsigned 0-bit integers values [0, 2 1]. Call the result v/.-
4. Decompose of into the component bits used represent each value in the vector, indexed as bij for j E [d- 0j. Submit a vector of the individual bits as Vú.
+
(k) t st
2. For j E [d 0]. compute by + ExEmm) big. // sum each bit across client updates
3. (6)0
jEld-0)
+ (k: +
Figure Centered Box Clipping. By clipping to a box and scaling that box to size 29, this modification of Centered Clipping achieves computational surjectivity and an efficient proof to verify that shared peer updates are inside V.
accepting magnitude and not a sign bit for the x-coordinate). This canonical representation simplifies computation the trust score. particular, since 9o and 9i are normalized to unit vectors, computation of the cosine similarity (0:.00) ||l simplifies to (0), and since go is aligned with the araxxi, this further simplifies to selecting the z--cordinate of g. Further, we avoid taking the ReLU within P by choosing a representation of v, that cannot represent J, with negative z-coordinate, and specifying that any honest party whose local gradient has negative z-coordinate supplies an update that will have 0 weight during the computation of Equation 8 (we use the symbol 1 as placeholder for such update in practice this can be any arbitrary unit vector with 0 in the r-coordinate). Thus computation the trust score during R simplified to taking the z-coordinate of g/-
The chosen representation of constrains the image of F to the set of unit vectors with non- negative z-coordinates. If we restrict the codomain of F this set, we achieve computational surjectivity. This follows from a simple argument:
Proof: Fix arbitrary point in the set of unit vectors with non-negative z-coordinates. Fix arbitrary go- Let be rotation matrix that rotates go to the a-axis. Consider a client update u such that Mu on the line extending from the origin to By definition, FP maps v.
Finally, we construct DZK proofs verify that v; falls inside the set of unit vectors with non-negative I-coordinates.
21

---

Inputs/ Public Constants:
Assume all client states contain a public root dataset Do (in addition to their private dataset D:)
u; Fc (data, st, w)
1. 9o ModelUpdate( w. Do) // compute update from root dataset, save in client state
2. gi HodelUpdate(ww: D,) compute local update from client dataset
u f gb
U4 f F (u; w)
1. 90 [sol| // normalize unit length
2.
Jui // normalize unit length
3. M < rotation matrix aligning with the x-axis.
4. 90 Mgo
5. gi Mg. // rotate client update by the same angle
Represent Ji and Go as A-bit fixed-point numbers with designated sign bit, call this representation 9 and 96-
7. the r-coordinate of gi is negative, submit 1 as V).-
8. Otherwise, submit vector of the individual bits of g. as v, Each coordinate should be submitted as a sign bit and a binary-encoded magnitude, except the x-coordinate which should only have a magnitude since is non-negative
(((((ieeenn) w)
Parse v; appropriately as 5/
2. TS; + magnitude of x-coordinate of 9/ // since go is aligned with x-axis
3. Submit g + Eie((n g TS; as global update. Denormalization, rotation, and computa- tion of global model parameters via w < w + a is performed as post-processing on the client side.
Figure FLTrust.
DZK Proof of Valid Update. As in RSA and CC, we perform batch check that all submitted shares are binary-valued (see previous sections for details). We additionally perform DZK proof that all updates are unit length, by constructing shares of (g's g C and revealing them be 0, where C' is a constant which encodes the square 0-bit fixed point number with unit magnitude. We batch check these proofs by obtaining shared random field elements 7e and constructing shares of the Σn r. ((g/, g') C). and finally revealing them to be 0 (i.e. using the same technique as described in the binary-valle
batch check for RSA). We also perform DZK proof to ensure that the sign bits in {-1, 1 by computing shares of (b - () + 1) and revealing them to be 0 this check is batched in the same way the previous checks.
B.5 Experimental Design
While lifting robust aggregation algorithms to the malicious-securc P2P Learning security model, make small changes the algorithms tailor them for efficiency in the setting, Thus, order to evaluate P2P Learning, we design experiments to test (1) the effectiveness (in terms of accuracy and robustness) of these tailored algorithms, well (2) the efficiency of their implementation as cryptographic protocols. These goals are performed using distinct code bases: we used PyTorch to benchmark accuracy and robustness, and we used the NTL package [40] in C++ implement the local computation for the aggregation steps of our malicious-secuu framework.
B.5.1 Accuracy and Robustness Experiments
To benchmark the robustness of the different aggregation protocols evaluated in the paper, we ran experiments under each to train central model in collaborative machine learning setting with
22

---

ipm
80
Acarray (%)
60
20
*99
RSA
80
Accuracy (15
60
1-
10
20
Accurary
60
40
10"
10
10" Runtime
3
10' Runtime
10f 10
10"
Runtime
Runtime
Runtime
Figure 10: Byzantine Robustness of Doubly Robust Protocols for iid EMNIST. We compare RSA and CC after their instantiations in our framework. cohort size of 50 peers is used. is the number of malicious workers. We run each algorithm until its completion.
attack None
attack
attack
attack Ipm
attack alle
100
Accuracy (95)
40
330
Runtime
Runtime (8)
RSA
100
80
10
40
20
Runtimm
80
20
10" Runtime (S]
(s)
Figure 11: Byzantine Robustness of Doubly Robust Protocols for iid MNIST. We compare RSA and CC after their instantiations in our framework. cohort size 50 peers is used. is the number of malicious workers. We each algorithm until its completion.
23

---

attack None
attack St
attack it
attack ipm
attack alle
100
Accuracy (%)
60
p_ nonorm
20
500 Round
1000
500 Round
1000
500 Round
1000
500 Raund
1000
500 Round
1000
Figure 12:
vs 2o norm for CC for iid EMNIST.
Dataset
Type
No attack
sf attack
If attacck
ipm attack
alie attack
EMNIST
IID
91.68
91.09
90.83
91.20
91.43
EMNIST
nonlID
91.69
91.07
90.88
91.19
87.20
CIFARI00
IID
48.04
33.77
44.94
45.64
32.77
Table 2: Maximum accuracy achieved by CC in a given setting.
cohort size 50 participants and varying numbers of malicious workers (0, 10, 23). attacks, namely bit flip (bf) [45], label flip (If) [6]. inner product manipulation (ipm) [46], and "a little is enough" (alie) [2], were evaluated. In all cases, we computed the testing accuracy as function of the number of rounds of training.
MNIST (Digits) and EMNIST (Letters) datasets were used the datasets with the data being evenly divided among the peers. The model architecture from [30] (with 1.2M parameters) was used for MNIST and this architecture was modified have 26 neurons in the last layer for EMNIST. During training. each client uses a local mini-batch of size 32 at each round and learning-rate of 0.01.
The training experiments were repeated used for all experiments.
random seeds. The PyTorch [36] framework was
B.5.2 Computational Efficiency Experiments
To benchmark the efficiency of our framework, wrote code perform all local computation steps necessary to run the aggregation step for a single committee member (FR) of malicious- secure P2P RSA, CC, and FLT. We used an m5. metal instance on Amazon EC2 obtain the benchmarks reported in Figure 5. Each benchmark reports the mean runtime of 3 trials trials were run concurrently in separate threads.
B.6 Accuracy of CC Attacks
Our approaches directly leverage robust aggregation algorithms, which perform as well in our case as in the FL setting. We include additional experiments with CC on iid EMNIST, non-iid EMNIST, and iid CIFAR100 finding that it performs as well as in the FL setting. We present the results in Table 2 and Figure 13.
24

---

(a) iid EMNIST
smsc None
SPACE
(b) non-iid EMNIST
k200r
(c) bid CIFARI00
Figure 13: The accuracy achieved by CC in a given setting. A cohort size of 50 peers was used, with 10 malicious workers. Each algorithm was for 1000 rounds, with 0.9 momentum, 1000.0 and for 3 different seeds.
25


Reviews:
[{"review_id": "gS57XlYm45", "reviewer": "Reviewer_8qrt", "summary": "The authors provide a solution for collaborative learning there are risks associated with collaboration due to clients or server(s) acting maliciously. Malicious clients can submit corrupted updates which leads to the failure of creating a useful shared model. Similarly, server can also act malicious, e.g. in data aggregation. The authors propose a Peer-to-Peer Learning that provides a doubly robust protocol against malicious clients and server(s) to train a shared model without a central party. The paper has a very nice flow, is technically sound with interesting notation and proofs (I enjoyed reading), and has experiments to back up the claims and efficiency of the proposed algorithms.\n\nThe framework is designed as a generic compiler that can efficiently convert robust aggregation algorithms to the P2P learning setting with the guaranteed malicious-secure protocol. ", "questions": "My questions is related to the scalability. If a cross-device settings with pool pf millions of clients available, where we select in order of 1000-5000 clients per round in an FL round, are we looking at a million client runtime, or thousand client runtime? If it's millions, is it going to be in order of days per round? ", "limitations": "The only weakness I can see, is the scalability of the solution and the runtime. I see runtime in order of hours for thousands of clients. Not sure how this can be scalable for very large setups. For example, a per-round CPU time of 46 seconds with 10^5 parameters (tiny model) when trained by 1000 peers shows the limitation of the scalability (and this is done on a pretty strong hardware of m5.metal of AWS. Can authors comment on this? ", "rating": 9, "confidence": 4, "soundness": 4, "presentation": 4, "contribution": 4, "strengths": "The paper is easy to follow. I enjoyed reading this paper. The paper presents an interesting and important setting where without a central party we want to have a doubly robust protocol against malicious clients and server(s). The contributions are solid, and worth sharing with the world. The paper is technically sound. The notations and graphs are clear, making it easy to follow the paper. ", "weaknesses": "I do not see much", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for your positive review!\n\n>**Question regarding scalability when subsampling clients from a larger pool** \n\nThis is a great question. To maintain security in this setting, it is necessary for the subsample of clients and selection of committee members to be known by participants in each round. This could be efficiently accomplished using standard techniques such as secure coin flipping [CF], e.g., before the protocol commences. Besides this addition, the computational cost of our protocol in this setting is the same as running it among the number of clients subsampled for a given round (in Reviewer’s example, 1000-5000 clients) for which the empirical results can be seen in Figure 5 (b). To answer the question directly, we are looking at **thousand client** runtime in this case rather than million client runtime. \n\n[CF] Blum, Manuel. \"Coin flipping by telephone a protocol for solving impossible problems.\" ACM SIGACT News 15.1 (1983): 23-27.\n\n\n>**Limitations – Scalability**\n\nIndeed, there are still limitations that prevent full pre-training of large models. We note that this study is the first work in our security model, and further optimizations are likely possible. For example, taking advantage of parallelization, parameterizing the size of field elements used for Shamir secret sharing, and/or training using lower-precision fixed points may all provide substantial increases in efficiency. These finer-grained optimizations may be interesting to explore in future work. \n\nHowever, we note that the present efficiency of our scheme would enable parameter-efficient techniques [LoRA] for fine-tuning of large models, central pretraining with downstream tuning (e.g., [Gboard]), or pre-training of medium to smaller models.\n\n[LoRA] Hu, Edward J., et al. \"Lora: Low-rank adaptation of large language models.\" arXiv preprint arXiv:2106.09685 (2021).\n[Gboard] Xu, Zheng, et al. \"Federated Learning of Gboard Language Models with Differential Privacy.\" arXiv preprint arXiv:2305.18465 (2023).\n"}, {"review_id": "70EXHYyrXN", "reviewer": "Reviewer_HYce", "summary": "Collaborative ML methods protect user data however they typically remain vulnerable to either the server or clients deviating from the protocol. Both clients and servers require a guarantee when the other cannot be trusted. This paper proposes learning scheme that\nis secure against malicious servers and clients.", "questions": "Please see weaknesses.", "limitations": "The limitations are addressed.", "rating": 7, "confidence": 4, "soundness": 4, "presentation": 4, "contribution": 3, "strengths": "- The paper is tackling a very important problem in machine learning that is very relevant to the NeurIPS community.\n- The paper provides the first collaborative protocol that is robust to both malicious clients and servers and operates under a malicious threat model.\n- Almost any aggregation algorithm can be converted to the proposed P2P security model -- it is very flexible. The authors do this for some popular and widely used methods.\n- The authors  prove the cryptographic security of their protocol.\n- The presentation of the paper is very good and it is easy to follow.\n- The authors perform extensive experiments demonstrating the byzantine robustness benefits and computational efficiency (and their tradeoffs) and their method performs well in all metrics.\n", "weaknesses": "This is a good paper and I think it would be of interest to the NeurIPS community. However, the idea of this paper is very simple. This is not a weakness on its own but it raises a question about the optimality of the proposed method. Although the model performs well in experiments, I am not sure whether about optimality. It would be good if the authors can comment on this.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for your positive review!\n\n>**Optimality of our Approach:** \n\nThis is an interesting question. There are two axes under which we may consider optimality: robustness and security. Unfortunately, along either there exist no strong lower bounds which could be used for such an argument. We elaborate below.\n\nIn the area of robustness, learning in the face of corrupted data remains an open challenge that has numerous different approaches depending on the exact threat model. This actually serves as motivation for our work which we discuss, e.g., in the conclusion—we design our protocol to be generic so as to enable broad classes of future robust aggregation algorithms to be instantiated in our protocol. Though we cannot claim or discuss optimality in terms of robustness, we hope our empirical evaluation of the protocol highlights that it is both computationally efficient and compatible with many robust aggregation algorithms, enabling the best robustness guarantees to be extended efficiently.\n\nRegarding security, we assume a security model with stronger guarantees than (to our knowledge) any previous works in collaborative learning and design a flexible framework for realizing these guarantees. The security model specifies malicious security against clients and servers, along with protection from poisoning attacks. Regarding the performance of our cryptographic protocols, although we could not argue optimality due to the lack of lower bounds, it is unlikely that the performance could be further improved significantly. We used state-of-the-art cryptographic building blocks and took full advantage of the underlying learning algorithm. However, there could be other trade-offs between security and performance: if we assume a weaker security model, e.g., assume that less number of committee members can be corrupted by a malicious adversary, further performance improvements could be explored. As such, the optimal solution depends on the exact application setting.\n"}, {"review_id": "xxjk8gW8Vo", "reviewer": "Reviewer_taqA", "summary": "The paper proposes a generic P2P learning framework that is simultaneously secure against malicious servers and robust to malicious clients. This is achieved by combining peer-based secure aggregation with existing robust aggregation techniques in an optimized way. The P2P approach eliminates the centralized server and instead has peers that take turns aggregating the updates. This removes the power asymmetry that allows servers to breach privacy.", "questions": "N/A", "limitations": "N/A", "rating": 6, "confidence": 2, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "* The approach is shown to be computationally efficient, training models with up to 1 million parameters on standard datasets with 100s of peers.\n* Strong approach towards P2P robustness\n", "weaknesses": "* The experiment on IID EMNIST is rather weak. The paper should have more convincing empirical experiments. ", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for your review.\n\n>**Clarification of contributions**\n\nWe emphasize that the primary contributions of our work are:\n\n1. Proposing a strengthened security model for collaborative learning that protects against malicious behavior from both clients and servers\n2. Providing a flexible framework for realization of *existing* robust aggregation algorithms within this security model\n3. Implementing three efficient examples of our framework applied to *existing* robust aggregation algorithms\n\nAs such, the primary aim of our empirical evaluation (in particular Figures 4 and 12) is not to test the performance of the underlying robust aggregation algorithms, but rather to show that our protocols do not degrade in robustness in comparison to the centralized setting. Beyond this, the relative strength in performance of the robust aggregation algorithms (RSA, CC, FLT) is a matter of concern for those respective works. Byzantine robust aggregation is an active area of research, and our framework is intentionally modular so that new aggregation algorithms with better performance can be lifted to our security model easily.\n\n>**Additional Empirical Evaluation**\n\nOur approaches directly leverage robust aggregation algorithms, which perform as well in our case as in the FL setting. As requested, we do include an additional experiment with CC on non-iid EMNIST and iid CIFAR100 finding that it performs as well as in the FL setting. *Please also see the attached PDF to the main response with additional experimental results.*\n\n| Dataset  | Type   | No attack | sf attack | lf attack | ipm attack | alie attack |\n|----------|--------|-----------|-----------|-----------|------------|-------------|\n| EMNIST   | IID    | 91.68     | 91.09     | 90.83     | 91.2       | 91.43       |\n| EMNIST   | nonIID | 91.69     | 91.07     | 90.88     | 91.19      | 87.2        |\n| CIFAR100 | IID    | 48.04     | 33.77     | 44.94     | 45.64      | 32.77       |\n\n"}, {"review_id": "4IZqiKbIm9", "reviewer": "Reviewer_7EiB", "summary": "This paper proposes a framework building on existing secure aggregation schemes to protect users from malicious server but protect the training from malicious users. If the MPC scheme used is secure then it shows that their framework is doubly robust. It illustrates this approach by leverging 3 existing algorithms (robust stochastic aggregation, centered clipping (CC), and FLTrust (FLT)) for running a grading descent on MNIST and EMNIST.", "questions": "- could you clarify if you can handle dropout and how?\n- could you discuss the risks of privacy leakage in your analysis?\n- are the two curves equal in Fig 4?", "limitations": "The authors include a paragraph. However, it should make clearer that the security guarantees rely on the existing MPC schemes guarantees and do not provide leakage from the learnt model.", "rating": 7, "confidence": 2, "soundness": 3, "presentation": 2, "contribution": 3, "strengths": "- The paper mixes several existing ideas and techniques to achieve its \"doubly robust\" guarantees\n- The paper stays with a descent cost that allows to train a small machine learning model and reports the runtime of their experiments (fig 5)\n- The paper tackles the problem of float updates and is robust to poisoning\n", "weaknesses": "- The paper seems does not mention the possibility of users to drop, which is quite common on FL. A scheme that doesn't allow it is quite unpractical\n- The paper does not discuss the leakage that comes from the aggregation itself that will have the nodes. In ML we know that the aggregated gradients still leak information about individual contribution and this problem is often addressed by using Differential Privacy. Here, it seems that the authors overlook this issue.\n- The paper seems does not seem primarily addressed to the ML community but rather for the security community.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for your review.\n\n>**User Drops:** \n\nWe appreciate the question, discussion of user dropout is a great addition to our paper. We show that our framework can indeed tolerate substantial dropout. We will add the following analysis to the end of Section 4 and the Appendix.\n\n>**Tolerance of Users Dropping:** Our protocol includes two areas where peers must collaborate on the cryptographic protocol: the (client) work of computing updates and the (server / committee) work of aggregating updates. In terms of the former, our protocol tolerates any number of clients dropping, as long as the pool of clients that stays online meets the assumptions of the underlying robust aggregation algorithm. In this case the output of our protocol would be equivalent to as if only the subset of online clients submitted updates. In terms of committee member dropout, our protocols can tolerate drop out of committee members by proportionally increasing the committee size (due to the reconstruction guarantees of VSS). We analyze the committee size required to tolerate a given level of drop out in the text below, which we will add to the Appendix. We find that substantial levels of drop out can be tolerated with only modest increases to committee size. With the appropriate increases to committee size, committee member drop out (up to the specified proportion) would have no impact on the output of the protocol.\n\n>**Appendix – Tolerance of Committee Members Dropping:** In general, our protocol requires that the number of adversaries in the aggregation committee be kept below a certain proportion in order to guarantee security. The committee size is chosen as the smallest number of parties such that (except with negligible probability) a random sample from the pool of clients has less than $1/2$ adversarial proportion (in the case of RSA, CC), or less than $1/3$ (in the case of FLT). To tolerate drop out of honest committee members, we simply need to select an increased committee size such that the proportion of adversaries in the committee stays beneath these thresholds even if some number of the honest parties drop out. In particular, if we choose a committee size which guarantees (except with negligible probability) that a random sample from the pool of clients has less than $1/2 - (q/2)$ adversarial proportion, where $q$ is the proportion of tolerated dropouts from honest parties, we will guarantee that the adversarial proportion with reference to the number of committee members that stay online is at most $1/2$. We can find the necessary committee sizes by reasoning with the binomial distribution similarly to our original analysis of committee size. **For example, to tolerate 5%, 10%, and 15% dropout of honest committee members, RSA and CC would require committee sizes of 53, 60, and 69 respectively (compared to 46 with no dropout tolerance), and FLT would require 157, 218, and 326 respectively (compared to 121 with no dropout tolerance).**\n\n>**Privacy versus Security and Robustness:** \n\nWe thank you for your valid concerns surrounding data privacy. We agree that our scheme provides no *data anonymization* guarantees, i.e., what can be inferred from observing the aggregated gradients, as would be protected by differential privacy (DP). We discussed this in Supplemental Appendix B and will use the extra page to move it to the main-text. \n\nOur paper provides guarantees on security (i.e. *data confidentiality*) and robustness, which are distinct from DP and of independent importance. Consider providing DP without any form of cryptographic security guarantee: this would either require local DP (which is useless in machine learning due to utility loss) or a trusted server which is often not a practical assumption and is independently vulnerable to other attacks even with DP (see our Table 1). We further remark that [7] shows that unless the server is trusted, DP is largely ineffective against reconstruction attacks whereas, as our work shows, security prevents these attacks. Though our work also provides some limited data anonymization guarantees by ensuring only the aggregated gradients are revealed, we opt to not discuss this in the paper to not create ambiguity in our contributions. We believe it is important future work to determine how to combine our work with differential privacy, which has in the past shown to require non trivial analysis [20] or an additional honest-but-curious privacy guardian [15].\n\nFinally, we note that we limit our usage of the term “privacy” in the main-text to avoid confusion surrounding cryptography and differential privacy. We hope that by moving the limitations to the main-text, this will further facilitate their distinction.\n\n>**Best Community of Interest:** \n\nOur work is a design and application of cryptography to a largely machine learning problem of “robustly learning” in the face of potentially corrupted data. We believe that our work is most interesting to those in the machine learning community because it enables this community to immediately gain security guarantees for robust machine learning. \n\n>**Question about Fig 4**\n\nYes, the curves are roughly equal, indicating that substituting floats for fixed points does not degrade robustness.\n"}, {"review_id": "VlSrPSOCge", "reviewer": "Reviewer_5nT4", "summary": "The main contribution of this work is a decentralized learning protocol that is robust to malicious clients attempting to both hinder the learning process (model poisoning attacks) as well as break confidentiality (reconstruction attacks). Robustness against poisoning attacks is achieved by modifying a class of robust aggregation techniques that require the individual clients updates to be in a restricted space (referred to as \"computational surjectivity\" in the paper) and verifying the validity of the inputs (compliance with the restrictions) through distributed zero knowledge proofs (DZKPs) and using verifiable secret sharing (VSS) for aggregation. Defense against reconstruction attacks is achieved through malicious-secure multi-party computation (MPC) for aggregation. It has been claimed that all the above protocols can be implemented with reasonable efficiency for small-scale models (with up to 10^6 parameters) applied to simple problems like MNIST.", "questions": "1) Can you demonstrate a pipeline of how all the cryptographic primitives can be tied together to implement the complete system?  What are the trust assumptions of such a complete system?\n\n2) Is it possible to come up with new poisoning attacks within the restrictions on the update space, possibly through collusion?\n\n3) How will the proposed approach work in the case of real-world non-iid (hetergeneous) scenarios with distribution shifts?", "limitations": "No limitations have been discussed in the paper. The paper does not have any potential negative societal impact.", "rating": 5, "confidence": 4, "soundness": 2, "presentation": 2, "contribution": 2, "strengths": "1) The paper address an important problem in collaborative learning, which is how to orchestrate collaboration when no party (clients and servers) can be fully trusted.\n\n2) It uses a whole array of cryptographic tools (secure multi-party computation, verifiable secret sharing, distributed zero knowledge proofs) in addition to existing robust aggregation techniques to achieve the stated objectives.", "weaknesses": "1) First and foremost, the framing of double robustness (against malicious clients and servers) appears to be incorrect because there are no servers involved in the proposed protocol. Instead, the double robustness can be interpreted as robustness against poisoning and reconstruction attacks.\n\n2) The most critical weakness of the proposed approach is the failure to demonstrate how all the cryptographic components will work together. While it is true that ZKPs can verify the validity of inputs, malicious-secure MPC and VSS can be used for checking the correctness of aggregation, and random committee selection can be done in a distributed fashion, it is not clear how all these tools can be tied together to form one complete system. \n\nFor example, let us consider the formation of the aggregation committee. This step itself will require a number of cryptographic operations to ensure that the committee is indeed selected \"randomly\" without any collusion (otherwise, the binomial approximations used to prove that the committee satisfies honest majority condition would fail).\n\nSecondly, the honesty condition in the committee selection is merely about following the MPC protocol honestly. It does not guarantee that these committee members will not be providing malicious inputs (updates) to the collaborative learning protocol. Similarly, it does not guarantee that the committee members will verify the ZKPs honestly. There could be clients who can follow one part of the protocol honestly, but not some other part.\n\nFinally, it is not clear if VSS, malicious-secure MPC, and DZKPs can all be implemented simultaneously. If such an implementation is possible, what are the underlying trust assumptions? Note that each of the above cryptographic primitives operate on their own trust assumptions (in terms of key generation, distribution, etc.). \n\n3) Some of the claims in the paper appear unbelievable. For example, one of the experiments talks about having 20 peers of which there are 10 malicious workers. In this case, how can an aggregation committee with honest majority be formed using random selection? For the same experiment, it has been claimed that security does not impact robustness. Is this true even if the all the malicious workers collude with each other? \n \n4) What is the real impact of all the robustness modifications on the final utility/accuracy? Specifically, what is the loss in accuracy compared to a vanilla FedAvg based FL aggregation by a single server? Also, what is the collaboration gain compared to stand-alone model training? \n\n\n\n  ", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for your review.\n\n>**W1. Interpretation of ‘double robustness’.**\n\n“Double robustness” communicates protection against malicious attacks mounted from the client side and server side of typical collaborative learning approaches (e.g. federated learning). We guarantee security against attacks mounted from the server side of FL by *delegating the server’s work* to a cryptographic protocol conducted by an ‘aggregation committee’ – a subset of the workers. We use ‘server’ in place of ‘aggregation committee’ in order to align with prior literature.\n\nWe achieve robustness to many malicious server behaviors beyond reconstruction attacks. In most previous works a malicious server may tamper with the global model by excluding updates of certain clients, adding fabricated updates, or simply altering the global model *arbitrarily* before sending parameters to clients for the next round. **We protect against all of these attacks** and more. Specifically, clients are guaranteed to receive the correct result of the aggregation algorithm on the submitted updates. \n\n>**W2a. Security while using multiple cryptographic components**\n\n**All building blocks in our framework are secure under universal composability [UC] and thus their compositions (i.e. using them together, either in sequence or in parallel) are secure.** Concretely, in our context maliciously secure MPC protocols and DZKP all take verifiable secret shares as input; by UC these protocols can be composed together without any extra steps or concern. Key generation or distribution are not required assuming point-to-point channels, which are provided by standard TLS. *Also see answer to Q1.*\n\n[UC] Canetti, Ran. \"Universally composable security: A new paradigm for cryptographic protocols.\" Proceedings 42nd IEEE Symposium on Foundations of Computer Science (FOCS). IEEE, 2001.\n\n>**W2b. Formation of aggregation committee.**\n\nSecure random selection of committee members is indeed required by our framework. This can be achieved using secure coin flipping, a standard and efficient cryptographic technique [CF]. We will add text to the Appendix recalling this building block (omitted for brevity).\n\n[CF] Blum, Manuel. \"Coin flipping by telephone a protocol for solving impossible problems.\" ACM SIGACT News 15.1 (1983): 23-27.\n\n>**W2c. Security if committee members submit malicious updates or don’t follow protocol.**\n\nOur security model accounts for all of these behaviors. Submitting malicious updates (even from committee members) is tolerated via robust aggregation. VSS, malicious-secure MPC, and DZKP ensure aggregation is computed correctly – any cheating will be caught by honest committee members. Finally, the standard composition theorem [UC] applies as all building blocks are secure under composition as explained in W2a.\n\n>**W3a. Number of malicious workers in section 6.1.**\n\nTypical empirical evaluations in Byzantine robustness literature (e.g. [22]) use higher adversarial proportions than are tolerated by the cryptographic elements of our framework, and it is important to ensure that our underlying aggregation algorithms meet these standards (even when modified for efficiency). Accordingly, we benchmark *accuracy* and *robustness* of the aggregation algorithms *outside* of the cryptographic elements, finding that the robustness guarantees are retained. We will clarify that these experiments use higher adversarial proportions than are tolerated by the end-to-end protocol in the main-text.\n\n>**W3b. Security against collusion.**\n\nOur security model accounts for *arbitrary* behavior of malicious workers, including collusion.\n\n>**Q1. Pipeline of cryptographic primitives in the complete system.**\n\nWe lay out the whole protocol step-by-step, elaborating on the security assumptions.\n\n1. **Committee Election** All clients use the method from W2b to randomly select the aggregation committee $C$ with malicious security. Our analysis in Appendix C1 guarantees that $C$ has honest majority.\n2. **Client Local Computation.** Each client computes $F^C$ and $F^P$ to obtain a preprocessed local model update given their data, and the global model parameters. \n3. **Verifiable Secret Sharing of Updates.** Each client secret shares their update with threshold $|C| / 2$, and sends a share to each committee member. Since $C$ has honest majority, this guarantees that adversaries cannot alter or reveal the client updates.\n4. **DZKP of valid update.** Clients prove to the committee that their updates are valid using a DZKP protocol that takes the secret shares as input. E.g. in P2P RSA, client updates must be binary-valued, so committee members create shares of a check value which is guaranteed to be $0$ if the update was binary-valued, while leaking no further information (see Appendix C.3.1 for details). Here security follows from the security of the DZKP and the VSS schemes. \n5. **MPC for computing global updates.** Committee members compute $F^R$ in MPC, using client shares as input, to obtain a global model update. E.g. in P2P RSA, committee members sum the shares of all client updates using the standard secure addition protocol on Shamir secret shares. The committee members then reconstruct the shared sum to obtain the global update (correct reconstruction is guaranteed by VSS). As above, security follows from the security of the MPC and VSS schemes.\n6. **Global updates sent to clients.** All committee members send the recovered value to all clients. Since $C$ has honest majority, the clients are guaranteed to recover the correct global update by accepting the majority result.\n\n>**Q2. New poisoning attacks possible within the setting** \n\nWe guarantee correct computation of the underlying robust aggregation algorithm. Thus our work **only reduces** the space of possible poisoning attacks – any new attack developed in our setting would also be possible in the standard FL setting. \n\n>**Q3. Non-iid Data:**\n\nWe show experiments on non-IID data (see attached pdf)."}]

Author rebuttal:
We thank the reviewers for their positive feedback, insightful comments, and clarifying questions. Your reviews helped us to improve the paper. Particular thanks are due to reviewers 7EiB and 8qrt – the former facilitated an analysis of user dropout. We find that our framework can tolerate substantial dropout with only a modest increase to committee size. The latter facilitated discussion of a setting where at each round, clients are subsampled from a large user pool. We find that for little additional overhead, this setting would enable a much larger set of users to participate in training. Both discussions improve the practicality of the proposed framework. 

Overall, we tackle an important problem of how to provide secure and robust collaborative learning protocols and show how to do so under the strongest setting where collaborating parties can act maliciously (reviewers 8qrt, HYce, 5nT4). This is the first framework designed as a generic compiler that can convert robust aggregation algorithms to efficient approaches in the malicious P2P learning setting (reviewers 8qrt, HYce). Our approach combines many cryptographic tools (secure multi-party computation, verifiable secret sharing, distributed zero knowledge proofs) in a generic yet tailored way to existing robust aggregation techniques to achieve the stated objectives (reviewer 5nT4). The approach is shown to be computationally efficient, training models with up to 1 million parameters on standard datasets among 100s of peers (reviewer taqA). We illustrate the approach by leveraging 3 existing robust aggregation algorithms (reviewer 7EiB). Overall, the submission ​​”has a very nice flow, is technically sound with interesting notation and proofs, and has experiments to back up the claims and efficiency of the proposed algorithms” (reviewers 8qrt, HYce).

Meta-review: This work concerns settings where the servers and clients can potentially be untrusted in FL. On one hand, the server may breach the clients’ confidentiality or alter model parameters. On the other hand, the clients may perform attacks such as model poisoning. In such an environment, the paper proposes a peer-to-peer collaborative learning mechanism that is secure against malicious servers and is robust to malicious clients. The reviewer found the presentation clear and easy to follow. While simple, the idea of the paper was appreciated by the reviewers. There were some concerns about scalability and some experiments, which were addressed and discussed in the rebuttal. I also had a look at the paper and found the problem and protocol interesting to the NeurIPS community. A related line of research that can be used as motivation and in the related work section is the line of research on federated learning without a trusted server.  In addition, I encourage the authors to include their rebuttal related to the thread model, scalability/limitations, and dropouts in their final version.
Decision: Accept (poster)