Byzantine-tolerant federated Gaussian process regression for streaming data
Authors: Xu Zhang
Zhenyuan Yuan
Minghui Zhu
Venue: NeurIPS 2022 Accept (2022)
Keywords: Security
federated learning
Gaussian process regression
Byzantine resilience

Abstract: In this paper, we consider Byzantine-tolerant federated learning for streaming data using Gaussian process regression (GPR). In particular, a cloud and a group of agents aim to collaboratively learn a latent function where some agents are subject to Byzantine attacks. We develop a Byzantine-tolerant federated GPR algorithm, which includes three modules: agent-based local GPR, cloud-based aggregated GPR and agent-based fused GPR. We derive the upper bounds on prediction error between the mean from the cloud-based aggregated GPR and the target function provided that Byzantine agents are less than one quarter of all the agents. We also characterize the lower and upper bounds of the predictive variance. Experiments on a synthetic dataset and two real-world datasets are conducted to evaluate the proposed algorithm.

Byzantine-tolerant federated Gaussian process regression for streaming data
Xu Zhang
Zhenyuan Yuan
Minghui Zhu
Pennsylvania State University xxz3130psu.edi
Pennsylvania State University zqy50860psu. edu
Pennsylvania State University muz muz160psu. edu
Abstract
In this paper, we consider Byzantine-tolerant federated learning for streaming data using Gaussian process regression (GPR). In particular, a cloud and a group of agents aim to collaboratively learn a latent function where some agents are subject to Byzantine attacks. We develop a Byzantine-tolerant federated GPR algorithm, which includes three modules: agent-based local GPR, cloud-based aggregated GPR and agent- based fused GPR. We derive the upper bounds on the prediction error between the mean from the cloud-based aggregatee GPR and the target function provided that Byzantine agents are less than one quarter of all the agents. We also characterize the lower and upper bounds of the predictive variance. Experiments on a synthetic dataset and two real-world datasets are conducted to evaluate the proposed algorithm.
The Internet of Things (IoT) produces large volumes of spatially distributed data. A typical practice is to store data in a centralized entity, e.g., a cloud, and train machine learning models there. However, poses challenges communication overhead and computation efficiency. In addition, data storage on the centralized entity raises privacy concerns. Federated learning provides promising paradigm to First, only a finite number of model parameters are shared and the size of these parameters is much smaller than that of raw data; second, data samples are kept by data owners and local models are trained without sharing raw data. However, these data owners are vulnerable to Byzantine attacks, which force them to behave arbitrarily and send any message to the cloud. The cloud cannot access each agent's 's local private data and training processes, and then cannot verify the correctness of local updates. Byzantine attacks incur significant degradation of learning performance if they are not explicitly taken account.
address the two challenges [1]. 22. 3
Related work. There have been many recent works to secure federated learning against Byzantine attacks [5]. (6) 77. [ (9. Paper (5] proposes Krum as the aggregation rule where the cloud selects a gradient such that the overall distance between this gradient to a fixed number of its closest gradients minimal. Paper [6] develops an algorithm which based on integrated stochastic quantization, geometric median based outlier detection and secure model aggregation. Paper [7] analyzes two robust distributed gradient descent algorithms based on median and trimmed mean operations, respectively. Paper 8 proposes a nigh-dimensional robust mean estimation algorithm at the cloud to combat the adversary. paper [9], the cloud partitions the received local gradients into batches and computes the mean of each batch. After that, the cloud computes the geometric median of the batch means. The above set of papers can guarantee that the estimation error of the parameter aggregated by the cloud is upper bounded and determined by the number of Byzantine agents. However, the existing works only consider deep neural networks (DNN) as the learning model and are limited to static data and line learning.
On-line learning is demanded process data that arrives sequentially across time 10
Gaussian process regression (GPR) is solution candidate to solve the problem 13 [6]. First of all, GPR is non-parametris statistical learning model. With proper choice of prior covariance function and mild assumptions of the target function, GPR is able to approximate any
14
15
36th Conference on Neural Information Processing Systems (NcurIPS 2022).

---

continuous function [7]. Second, GPR can be implemented recursively, reducing computational complexity and memory [8]. Third. GPR is able to quantify learning uncertainties since predicts the target function using posterior probability distribution 19 However, Byzantine-tolerant GPR has not been studied yet.
This paper considers Byzantine-tolerant federated learning for streaming data using GPR where a cloud and group of agents aim collaboratively learn a latent function despite some agents are subject to Byzantine attacks. Major contributions are listed as follows:
Contributions.
1) We develop a Byzantine-tolerant federated GPR algorithm, which includes three modules: agent-based local GPR, cloud-based aggregated GPR and agent-based fused GPR. Specif- ically, the agent-based local GPR sends potentially compromised local predictions to the cloud, and the tloudbbaee aggregated GPR computes global model by Byzantine- tolerant product of experts (PoE) aggregation rule. Then the cloud broadcasts the current global model to all the agents. Agent-based fused GPR returns local predictions by fusing the models from the cloud-hased GPR with those from the agent-based local GPR.
2)
The predictive mean of the cloud-based aggregated GPR is theoretically guaranteed to be restricted within a neighborhood of the target function provided that Byzantine agents are less than one quarter of all the agents. The prediction error is positively proportional to the number of Byzantine agents and that of the agents with extreme values. Predictive variance is quantified by lower and upper bounds, which are identical to that of the attack- free case.
Experiments on a synthetic dataset and two real-world datasets are conducted to demonstrate that the Byzantine-tolerant GPR algorithm is resilient to Byzantine attacks. To the best knowledge of authors, this is the first paper to study Byzantine-tolerant federated learning over streaming data using GPR.
Notations and notions. Throughout the paper, we use lower-case letters, e.g, a, to denote scalars, bold letters, c.g., a, to denote vectors; upper-case letters, c.g., A, to denote matrices, calligraphic letters, e.g., A. to denote sets, and bold calligraphic letters, e.g., A, to denote spaces. Denote I, E g the n-by-n identity matrix. We denote by IR the set of real numbers. The set of non-negative real numbers is denoted by R., and the set of positive real numbers is denoted by R_ The cardinality of set A is denoted by AA). Define the distance metric ((z, x²) & || 2 |, and the point to set distance as D(z, 2) A infzezz (2z, z'). Define proj(z, 2) (z' E D z²) D(z, 2)} the projection set of point onto set Z. Denote the supremum of function v) Z - lR as || supsez [=)=) For a real number a, we denote the floor function by [a]. We denote by (gg(t) the limiting behavior
of some function ft) if lim, g(t)
f(t) for some constant 0.
We give formal definitions of uub-Gaussian random variables with parameter a and Gaussian process.
Definition 120) A random variable X with mean μ 2 JE [X] is sub-Gaussian (denoted by X subG(o²)) ) if there exists a positive number a such that
x2x2
E [exp(A(XX 1))] S exp
V.
2
Definition [13] A Gaussian process is a collection of random variables, any finite number of which have a joint Gaussian distribution.
Preliminary
In this section, we provide basic knowledge of GPR. Let : 2 + y be the target function, where
Z C R. and y C IR. Given input z(1) E Z at time I, the corresponding output is given by
v(t) = (=((t) + e(t), e(t)~~((0,)
where e(t) is the Gaussian measurement noise and the latent function 17 is sampled from a Gaussian process prior. Let training data be in the form D & (Z, y), where Z A (z(1), (1.,,.... =(n.)) is the set of input data and y A [y(1),... (n..)) (T= is the column vector aggregating the outputs. GPR aims to infer the values of the latent function 77 over set of test data points Z, C Z using D.

---

Define kernel function k R R": - R that is symmetric and positive semi-definite. Let n7 2) return column vector such that the i-th entry of rz(2) equals n7(2 Assume that the latent function is sampled from GP prior specified by mean function μ and kernel function k. Then the training outputs y and the test outputs (2,2) are jointly Gaussian distributed as:
y 77 (222)
~ NV
2 ((.)
2) oo
k(2, 2.) 1r2., 2.)
2)
where 2² and pa (Z.) return a vector consisting of p(=(t)) and p(z, (j)); k returns matrix such that the entry at the ith row and the jth column is (( (.), and k(2, 2), k(Z,, 2) and k 22, 2.) are defined in an analogous way.
Utilizing identities of joint Gaussian distribution (see page 200 in 13 GPR makes predictions of on Z. based on dataset D (2.) D. E2.ID), where
1D. _ (2.)) h: (2. 2) 22 -0))), kk22, 2.) k(Z., -(, 2 2.), Σz 1D
(3)
with i(2, 2) performed for each element.
k22 2) Tn. We refer (3 full GPR. If y is multi-dimensional, GPR is
Problem formulation
2.1 Observation model
Consider a network consisting of n agents and a cloud, We denote the agent set by V & (I....,n At each time instant t, the observation model of agent is given
()) (1) + (()
(4)
where (1) E Z C n is the input of I (1) E E C R is the observation of the agent, and ell(() (t) is independent zero-mean Gaussian noise with (t) NN (o.
2.2 Attack model
All communications between the cloud and the agents are attack-free. Some agents are Byzantine agents, and they can behave arbitrarily during learning process, and send arbitrary local predictions the cloud. We assume that an a fraction of the agents are Byzantine, and the remaining
a fraction are benign. We denote B C V as the set of Byzantine agents, and thus [B] = [am]. Both the cloud and the benign agents are unaware of the identities of Byzantine agents, but we assume the cloud knows that ] is upper bound of a.
Assumption It holds that 0 < a 1
can tolerate Byzantine agents Most existing works on Byzantine-toon tolerant algorithms, e.g., [5),
with < These algorithms only transmit one variable, e.g., the gradients of the loss function or the model parameter, between the cloud and the agents, whereas our federated GPR algorithm requires to exchange two variables, e.g., local mean and variance, to realize the aggregation of predictions.
2.3 Objective
The objective of this paper is design algorithm, which enables the benign agents and the cloud to correctly learn the function 7) without requiring the agents to share local streaming data (2 1 (t), (t)) despite some agents are subject to Byzantine attacks.
Byzantine-tolerant federated GPR
In this section, we develop Byzantine-tolerant federated GPR algorithm to solve the problem formulated in Section 2. This algorithm consists of three modules: agent-based local GPR, cloud- based aggregated GPR and agent-based fused GPR.

---

Algorithm 1 Byzantine-tolerant federated GPR
1: Input: test inputs Z., prior function μs, kernel and noise variance (o. for
2: Initialization: D(0) = 0.
3: for t 1.2...... do
4: for E V do
[Agent-based local GPR)
5:
(1)
Dl 100 (0),))))))))
6:
12 22 2 (D)((( = (GPR(
7:
end for
8:
(2()) 0 (.) = cGPR( (Db 02 Dii(o))
(Cloud-based aggregated GPR)
9:
for i E do
[Agent-based fused GPR}
10:
1 D
[1]
(ō
2. 2.) (7
(Dbi( 02 (.j P2.1D(0 o² (D(())
11: end for
12: end for
Specifically, first at each time instant t, each agent i E V makes its own prediction of through agent-based local GPR over given set of points Z. S 2 using local streaming dataset Di (t) A (I), (t)) with local input data ()) A (1), ..... (t)3 and out- put y (t) & (1).... (t)].. Then the benign agents send correct local predictions to the cloud and the Byzantine agents instead send arbitrary values. Second, the cloud collects all the local predictions and constructs two agent sets by trimming fraction of outliers with respect the predictive means and variances. Then the cloud uses Byzantine-toleran PoE aggregation rule to compute a global prediction, and broadcasts the global prediction to all the agents. Third, the agents refine the predictions
Z. by fusing the predictions from the cloud-based GPR with those from the agent-based local GPR. Note that each agent only communicates local predictions with the cloud, and does not share its local streaming data with the cloud and other agents. The formal description of Byzantine-tolerant federated GPR is given in Algorithm T
Algorithm 2 Agent-based local GPR: (DP)(
1: gli (1) = (2110
(()
2: (1) (1)
y (1))
3: for z. E Z. do
4: Choose 2. (1) E proj(z., ())
5: Compute i6' 2.)l
(z.(DD))(()
Benign agent, Byzantine agent
x2 z. (D((())
Benign agent, Byzantine agent
6: Compute 822 (1)
*
7: Send (i)))))( and 12 to the cloud
(l)(())
8: end for
02 9: return ptz (.)
3.1 Agent-based local GPR
To reduce computational complexity, we perform Nearest-neighbor (NN) GPR as the agent-based local GPR to predict for each test point z. Z.. Instead of feeding the whole training dataset to
GPR, the agent-based local GPR only uses the nearest input denoted by 2 (t) E proj(z., (t)
and its corresponding output y (1))(t
compute the local predictions. Notice that, computation
complexity of the hyperparameter tuning for NN GPR ( In fact, the computation complexity
of the hyperparameter tuning be reduced (11) by using recursive hyperparameter tuning (21)
NN GPR prediction has computation complexity equivalent to nearest-neighbor search, whose
worst case complexity (t) (22), while full GPR in (3) has computation complexity
((2)) (23).
Denote /' ()))()) and 8²2 (p) the predictive mean and variance output from the agent-based local
GPR. The predictive mean and variance of the benign agents are written in the following forms
iv

---

Fl (D((()) = (1)) -2 s..Dii(() = - x.DD where
(1) p2(z) k(z,, 2 (t)
(t)) (1
(t)x
02 (1) x(z,, - k(z., 1 (t) (t)
(() (t),
(5)
with (1), 2..2 3 (4) - k(=! (I), 2. (1)) (1)) 18l )2 When the agent Byzantine agent, its outputs can be arbitrary, and in this case we write 1²' (t) and x² the agent-based local GPR is provided in Algorithm 2
2, (Dii(() = *. The implementation of
3.2 Cloud-based aggregated GPR
In the sequel, we consider Byzantine-tolerant PoE aggregation rule for the cloud. The algorithm is described as follows:
Step 1: For each 2, E Z., the cloud collects potentially corrupted mean 8%z, Di((e) and variance a=2 (.) from each agent i.
Step 2: The cloud constructs two agent sets to tolerate Byzantine attacks by removing the largest and smallest B fraction of the local predictive means /' (Di)(() and variances o²2 =. (t) respectively. For E V. we sort (t))(() and 8²2 (p))(() in non-descending order. We denote by T (t) set of [8m] agent sets with the largest local predictive means, and by Thi (1) set of [8n] agents with the smallest local predictive means. Similarly, denote trimmed sets of variance by Tmax (t) and Th (t). Then, we define
M(t) & Vi (t) (mim (t)), C(t) & (T
(t) (t).
(6)
Notice that M()) and C(L) include n 2[3n] agents with extreme values removed. These are the agents whose predictions do not deviate much from the attack-free case.
Step 3: Define a global training dataset as D(t) Uiev (t), and a common set as I(t) A
(C(t) The following lemma shows that I(t) never empty.
Lemma Suppose that B < 3, it holds that (1 4B)m & [I(I) S - 2,3)n n at each time instant t.
The proof Lemma can be found Appendix A.1. The following lemma shows that ji 2.112)
and /²2 (x))))( for It) are bounded by the values the benign agents.
02 22 Algorithm 3 Cloud-based aggregated GPR: cGPR(jáZ, (Diilc))
for = 1,2 D(t) = U key (t)
2:
3:
for z. E Zu do
4:
Construct sets M(t) and C(t) according to
5:
Compute Z(t) = M(t) (MMM(((())) (((()
6:
Implement aggregation rule
7:
Broadcast م (D()) and ò 2, D(t) to all the agents
8:
end for
9: end for
10: return (22) 02 (.1(())
Lemma Let 0 < 8 1 hold. For i I(t), we have that minjevys {iz, (Db(()))))))) 2 "2.1DDH1 $ maxjevi (o and mingevie ( [22
012 (..1)ii(()) 5
maxjevi (.

---

The proof of Lemma 2 is presented in Appendix A.2. Given I(t), we propose Byzantine-toleran PoE aggregation rule below
- *. POO
Σ (EZ(L)
J'-2 (Dbiey)
62 22 (D(1)
I(t)
I(AI
Σ LiET(t) 8 8'-2
Note that if all the agents are known to be benign, we can simply select 3 = a = 0, and hence M(t) =
C(t) V. In this case, reduces the standard PoE in [24]. Then the cloud-based aggregated GPR returns (tt) - (..:D(t)ss..e E... and o² (D((( & 1622 (110())) The implementation of the cloud-based aggregated GPR provided in Algorithm
3.3 Agent-based fused GPR
Notice that the cloud makes predictions using more data than each agent, and it could achieve better learning performances. Then the agent-based fused GPR aims to refine predictions of 17 (2.) by integrating the agent-based local GPR with the cloud-based aggregated GPR. When the cloud variance 62 (.1(())) lower than the local predictive variances 8 = (e)) the predictions from the cloud-based aggregated GPR are used. Otherwise, those from the agent-based local GPR are used. Our algorithm one-round. The refined predictions in the agent-based based fused GPR will not be transmitted back to the cloud, hence it cannot change the final aggregation. The implementation of the agent- based fused GPR is provided in Algorithm
022 Algorithm 4 Agent-based fused GPR: fGPR (P' (1) P()) 22 (p1))
for z. E Z, do if o² (D(() I v²
2:
(.IDi(())
then
3: Compute
A P()) (o p(r)) + (2.(D((), 02. D(t)
Benign agent, Byzantine agent
4: else
5: Compute
[ P (a ((o)) -- {
(2.1 02 D)(()
Benign agent, Byzantine agent
6: end if
7: end for
(o 8: return j P2)) (o)))
3.4 Performance guarantee
This section discusses the robustness of the cloud-hased aggregated GPR. We start with the assump- tions of the kernel function k.
Assumption 1) (Decomposition). The kernel function k(:,-) can be decomposed in such way that ((.,))=(D(() where к R4 R+++ continuous.
2) (Monotonicity). It holds that k(s) is monotonically decreasing in s and k(0) = of.
Many existing kernel functions satisfy Assumption [ e.g., squared exponential kernel 13] As
[3]. any non-zero mean Gaussian process can be decomposed into a deterministic process and zero-mean stochastic process. Without loss of generality and for notational simplicity, we assume follows zero-mean Gaussian process in the analysis.
Assumption 3 It satisfies that n (P(O, k) and n Lipschitz continuous Z.
The target function 7) is completely specified by Gaussian process with kernel function This assumption is common in the analysis of GPR (25). The Lipschitz continuity of implies that there
vi

---

exists some positive constant E, such that |n(2)) -0n=m(()1 - (,, for all 2, x' E 2. For i V, we define the dispersion of local data as dl) _ supzez D(z, 2 (t). We denote the maximal 0 max
local dispersion as d= (t) - maxiev {dli) (t)} and sub-Gaussian parameter as Hopunn
where oe o - max,ev } and of - min The following theorem shows that the prediction error from the cloud-based aggregated GPR is upper bounded, and characterizes the bounds of the global predictive variance.
Theorem Part I: (Cloud-based aggregated GPR: Mean) Suppose 0 < S B < 1/ and Assump- tions 3 hold. For any 2, E 2 and 0 < ô
1, with probability at least 6. it holds that o
Az. (D()) (2()) mzz))l E (1 re(d (t)) Mlmilloo + of tominn + 22 ln + ((duux(t))
oj (at
Allllo
2a( 22 20 (In(2n) 1]+
of Homoigg
where (s))
Part II: (Cloud-based aggregated GPR: Variance) L < B < and Assumption 2 hold. For (o
any 2, E 2, holds that (a S
S
6² 2. (D(() S 5
a(dmaax()) (2))
The proof of Theorem D is presented in Appendix A.3. For the attack free case, i.c., a = 3 = 0, the (, (1)
upper bound of Part becomes (1 =id" (0)) Illll + +ammi) + 2o 2 dn We assume
(arma)))
lim d' (t) = 0 for i E V, the limit of the upper bound is +atomay Illl + 2202 - 6n 0,
(amaays
Recall that a oo- Then we can see that 03 (op || and 200 2 6n are
positively related to the maximal variance (a of the noise.
The term A (t) characterizes the performance loss caused by Byzatine agents. First, notice that (ddmax (t)) positively related to a, which provides trade-off between the prediction error and the number of Byzantine agents. With larger a, algorithm agents, but the prediction error gets larger. As a approaches zero, A ((dmaxx)) (t)) goes to zero. This implies that the prediction performance improves if the number of Byzantine agents is decreasing. Second, when a is fixed, A (dd (t)) is proportional to 3. This implies that learning performance improves if the set I(t) expands.
tolerate more Byzantine
The upper and lower bounds in Part II are independent of and B. Then the variance shares the same upper and lower bounds with that in the frrek-free case. This is due to the fact that the extreme values are removed by the Byzantine-tolerant PoE in the cloud-bec based GPR. goes to infinity, we
( of +o This implies that the prediction uncertainty diminishes as the variance of measurement noise decreases.
have lim o 2. (c)
4 Numerical experiments
This section experimentally demonstrates the performance of the proposed Byzentine-tolerant fed- erated GPR algorithm using one synthetic dataset and two real-world datasets. We conduct the experiments on a computer with Intel i7-6600 CPU, 2.60GHz and 12 GB RAM.
Synthetic dataset: For the observation model 4 we consider the target function introduced in 23
722) =52 sin(12z) + (z 0.5) sin 0.5) 4 cos(22).
(8)
with TR. and (00 0.01). We generate n., 103 x 10 10 5 10 training points in [0, 1). respectively, and choose R2 120 test points randomly in j0, 1]. There are n = 40 agents in network. We partition the training dataset into 40 disjoint groups, and each agent is assigned with n,/no /n training data points, We use the following squared-exponential kernel k(z, 2.) of exp( 2 (z )²) and use Mean Square Error (MSE) to evaluate the proposed algorithm in terms of consistency, the effect of a and the effect of 3 in the following experiments.
In the first experiment, we let a = 2.5%, 5%, 7.5%, 10,, 12.5%, 15%. We randomly choose the agents in the network to be compromised by same-value attacks (26), and let 3 a. Specifically,
vii

---

for each test point 2x, the Byzantine agents only change the local predictive means to 100, that is, P=z. (e) 100 for all t, and send this incorrect prediction the cloud. The local predictive variances for all the agents remain unchanged. Fig. T compares the performances of the pro- posed eyyzantine-toleran PoE (BtPoE) with the standard PoE. As benchmark, the bottom curve depicts the prediction errors of the standard PoE (AfPoE) when there is no Byzantine attack in the network; it shows that the standard PoE is consistent in the attack-free scenario. However, when the aforementioned Byzantine attacks are launched, the top curve shows that the standard PoE can no longer remain consistent. Note that there are 6 curves by attacked standard PoE (AcdPoE), and only the closest one to the bottom curve is shown in Fig. ((a) We fix n, = 4 x 10 and a = 15%. The prediction comparisons of these three PoEs are given Fig. [ which shows that the learning performance of the Byzantine-tolerant PoE is comparable to that of the attack-free standard PoE with consistency preserved. As Byzantine attacks are launched in the network, the consistency cannot be maintained. Therefore, our proposed algorithm is demonstrated to be resilient to Byzantine attacks.
10
10
2.5%
5%
7.5%
10
APPE BIPEE, E%
10%
MSE
BtPoE,
MSE
12.5%
BtPoE, 10%
= 15%
10
BIPeE, a 12.5%
BtPoE,
AedPoE, 2.5%
10
10²
10
20
0.05
0.1
0.15
0.2
0.25
Training size
B
(a) Consistency evaluation
(b) Prediction performance on different |
Figure 1: Prediction performance of the cloud-based aggregated GPR.
30
Attack-free standard PoE
Attacked standard PoE
Ground truth
25
Ground truth
20
10
2
-5
Byzantine-tolerant PoE
Ground truth
-5
-10
0.5
-6
0.5 Z.
0.5
Z,
(a) Attack-free standard PoE
(b) Byzentine-tolerant PoE
(c) Attacked standard PoE
Figure Comparisons of the prediction performance in terms of different PoEs. Shaded area represents 99% confidence region.
Notice that the performance of the Byzantine-tolerant PoE increases as a, the ratio of Byzantine agents, decreases. Fixing the training data size n. = 10 we replicate the experiments for 50 times with different and observation noise Figs. 3(a) and 3(b) show that the performances of the Byzantine-tolerant PoE are comparable to that of the attack-Tree standard PoE with consistency preserved. The prediction errors for both methods are in the order of 10-4, while Fig, 3(c) shows that the attacked standard PoE has prediction errors ranged from 2.5 to 30. This demonstrates that the proposed PoE aggregation rule has strong ability to tolerate Byzantine attacks.
In the second experiment, we evaluate the prediction performance with regard to B. All associated parameters are the same as those in the above experiments. Notice that for each a, we initially let = a and then increase /3 0.225 with increment 0.025, such that the assumption a SB is satisfied. The results are shown in Fig. [(b) This shows that the number of trimmed agents
viii

---

X10
X100
2.6
2.8
2.5
2.7
2.6
20
2.4
MSE
2.5
15
2.3
2.4
10
2.3
2.2
2.2
0.05
0.075
0.1
0.125
0.15
0.05
0.075
0.1
0.125
0.16
(a) Attack-free standard
(b) Byzenntne-tolerat
(c) Attacked standard PoE
Figure Comparison of the prediction performance on different
increases, the performance of the proposed algorithm grows worse, since more information is excluded the aggregation. This result validates the conclusion of part in Theorem
Table I: Comparison of the prediction performance on different functions.
Algorithm MSE
Attack-free standard PoE Syzantine-toleramt PoE
Attacked standard PoE
0.0049 0.007 10-3 0.0236 + 0.172 x 10-3 26.5339 0.019 10-3
In the third experiment, we conduct Monte Carlo simulations to evaluate the performance of Byzantine-tolerant PoE different functions. We repeat the experiment for 50 times by sam- pling different functions and observation points. Specifically, we replace sin(12z) in (8) with sin(12z) - where e' ~ (0, 0.01 2, = 1,..., 50. We assign sample n, = 10* training points in [0, 1), and then choose n, = 120 test points randomly [0. 1.. We also the eguare-exponential kernel k(z, ). There six Byzantine agents, i.c., 15%. and we let = a. Experiment results are presented Table [ and it shows that the performance of the Byzentine-tolerant PoE is comparable to that of the attack-free standard PoE, noticing that the order the prediction errors for the Byzantine-tolere the attacked standard PoE is about 26.534. This demonstrates that the proposed Byzentine-tolerant aggregation rule is effective for learning different functions.
40 agents in the network and
PoE 10-2 For comparison, the MSE by
Table 2: Prediction performance comparisons between local GPR and fused GPR agent and 6.
Training data size
6000
10000
40000
150000
MSE/i 1/local GPR
0.0721
0.0681
0.0585
0.0527
MSEAi 1/fused GPR
0.0096
0.0681
0.0094
0.0537
MSE/i = 6/local GPR
0.0727
0.0566
0.0564
0.0555
MSE/ 6/fused GPR
0.0727
0.0086
0.0564
0.0076
Moreover, conduct additional experiments to demonstrate the learning performance improvements by applying our Byzantine-tolern PoE and the agent-based fused GPR to the synthetic dataset. We assign 40 agents in the network and sample nt 10 training points in [0, 1], and then choose 120 test points randomly in [0, 1]. We also use the square-exponential kernel k(z, 2.). 15%, and let
There six Byzantine agents, i.e.,
a. The prediction performance comparisons between the agent-based local GPR and fused GPR on agent and 6 are listed in Table 2 For a test point, the local variances 8²2 ()))(e) lie in [0.3660, 0.6228), and the global variance is *. = 0.4678. Table shows that the learning performance of the agent-based fused GPR is better than that of the agent-based local GPR. Note that the order of the prediction errors for the agent-based fused GPR can decrease from 10-2 to 10 10-3 This demonstrates that the comparison between variances in step 2 and step 5 in Algorithm 4 able to improve the learning accuracy, and our algorithm is effective.
Real-world dataset:
We conduct an experiment evaluate the prediction performance with different attack magnitudes using two real-world datasets. The first dataset is collected from seven degrees-of- freedom SARCOS anthropomorphic robot arm [3]. The goal is to learn function 77. The input of
ix

---

SARCOS
SARCOS
SARCOS
10"
10
10'
10
MSE
MSE
MSE
10
10
10
10"
-1
-10
10
-50
50
30-100 100
-1
-10
10
-50
50-100
100
Attack magnitude
Attack magnitude
Altack magnitude
(a) Attack-free standard PoE
(b) Byzantine-tolcrant PoE
(c) Attacked standard PoF:
Kin40k
Kin40k
Kin40k
10
02
12
10'
MSE
MSE
MSE
10
10
10"
10
10
0
-10 10
-50
50
-00000 100
-1
-10
10 -50 50-100 100
Attack magnittud
Attack magnitude
Altack magnitude
(d) Attack-free standard PoE
(c) Byzentine-tolerant PoE
(f) Attacked standard PoE
Figure 4: Prediction performance with different attack magnitudes on datasets SARCOS and Kin40k.
21-dimensional including 7 joint positions, joint velocities and 7 joint accelerations; whereas the output is 1-dimensional, representing the torque of joint. We randomly sample 40,000 data points for training and 40 data points for testing. In the experiment, we partition 40, 000 training data into 40 disjoint groups, and assign each group to agent. The second dataset Kin40k (27] is created using a robot arm simulator. We randomly choose 9, 000 training points and 40 test points. We also partition the training data evenly into 40 disjoint groups. The magnitudes of attack consider +1,+10, +-50, + 100. We randomly sample the training data points and repeat the experiments for 50 times. Fig. 4 shows the prediction performances. For both real-world datasets, when the attack magnitude is increasing, the prediction errors of the attacked standard PoE largely increases, whereas those of the attack-free standard PoE and the Byzantine- tolerant PoE consistently maintained at low level. It shows that the proposed Byzantine-tolerant PoE is resilient to the attack.
Conclusion
We propose Byzantine-tolers tolerran federated GPR algorithm, which is able tolerate less than one quarter Byzantine agents in the network. We derive the upper bounds on the prediction errors and the lower and upper bounds of the predictive variances. Experiments robustness of Byzantine-toleran GPR algorithm. Future work will focus on the comparison of the learning performance between the agent-based local GPR and the agent-based fused GPR, and the quantification of the benefits the cloud brings to the agents.
conducted to demonstrate the
6 Acknowledgements
This work was partially supported by NSF awards ECCS 1846706 and ECCS 2140175.
References
[1] B. McMahan, E. Moore, D. Ramage, S. Hampson, and B. A. Arcas, "Communication-efiiaae learning of deep networks from decentralized data," in Proceedings of International Conference on Artificial Intelligence and Statistics, pp. 1273-1282, 2017.
X

---

[2] J. Konečný, H. B. McMahan, F. X. Yu, P. Richtárik, A. T. Suresh, and D. Bacon, "Federated learning: Strategies for improving communication efficiency." in Proceedings of International Conference Neural Information Processing Systems, pp. 1-5, 2016.
[3] Q. Yang. Y. Liu, T. Chen, and Y. Tong, "Federated machine learning: Concept and applications." ACM Transactions on Intelligent Systems and Technology, vol. 10, no. pp. 1-19, 2019.
[4] Yin, Z. Lin, Q Kong, Y. Xu, D. Li, S. Theodoridis, and R. Cui, "Fedloc: Federated learning framework for data-driven cooperative localization and location data processing," IEEE Open Journal of Signal Processing, vol. 1, pp. 187 215, 2020.
[5] Blanchard, E. M. Mhamdi, R. Guerraoui, and Stainer, "Machine learning with adversaries: Byzantine tolerant gradient descent," in Proceedings of International Conference on Neural Information Processing Systems, pp. 1 118-128, 2017.
[6] So, B. Güler, and A. S. Avestimehr, "Byzannine-reslient secure federated learning," IEEE Journal on Selected Areas in Communications, vol. no. 7, pp. 2168-2181, 2020.
[7] D. Yin, Y. Chen, R. Kannan, and P. Bartlett, "Byzantine-robust distributed learning: Towards optimal statistical rates," " in Proceedings of the International Conference on Machine Learning, pp. 5650-5659, 2018.
[8] D. Data and S. Diggavi, "Byzantine-resilienl high-dimensional SGD with local iterations on heterogeneous data," " in Proceedings of the International Conference on Machine Learning. pp. 2478-2488 2021.
[9] Y. Chen, L. Su, and J. Xu, "Distributed statistical machine learning in adversarial settings: Byzantine gradient descent," Proceedings of the ACM on Measurement and Analysis of Comput- ing Systems, vol. 1, no. 2. pp. 1-25, 2017.
[10] M. Mohri, A. Rostamizadeh, and A. Talwalkar, Foundations of Muchine Learning. MIT press, 2018.
[11] L. Bottou, Online Algorithms and Stochastic Approximations. Cambridge University Press, 1998.
[12) K. Crammer, O. Dekel, J. Keshet, S. Shalev-Shwartz, and Y. Singer, "Online passive aggressive algorithms," Journal of Machine Learning Research, vol. 7, pp. 551-585, 2006.
[13] C. K. Williams and C. E. Rasmussen, Gaussian Processes for Machine Learning. MIT press Cambridge, MA, 2006.
[14] H. Liu, Y.-S. Ong, X. Shen, and J. Cai, "When Gausian process meets big data: A review of scalable GPs," IEEE Trunsactions on Neural Networks and Learning Systems, vol. 31, no. 11, pp. 4405-4423, 2020.
[15] H. Xiao and C. Eckert, "Lazy Gaussian process committee for real-time online regression," in Proceedings of the AAAI Conference on Artificial Intelligence, pp. 969-976, 2013.
[16] K. Das and N. Srivastava, "Sparse inverse kernel Gaussian process regression," Statistical Analysis and Data Mining, vol. 6, no. 3. pp. 205-2200 2013.
[17] C. A. Micchelli, Y. Xu, and H. Zhang, "Universal kernels," Journal of Muchine Learning Research, vol. no. 95, pp. 2651 2651-2667, 2006.
[18] Y. Kuang, T. Chen, Yin, and R. Zhong, "Recursive implementation of Gaussian process regression for spatial-temporal data modeling," in International Conference Wireless Com- munications and Signal Processing, pp. 1-7, 2019.
[19] M. Liu, G. Chowdhary, learning and control: A tutorial with examples," IEEE Control Systems Magazine, vol. 38, no. 5, pp. 53-86, 2018
Da Silva, S.-Y. Liu, and J. P. How, "Gaussian processes for
[20] M. Wainwright, High-dimensional Statistics: Non-asymptotic Viewpoint. NY Cambridge University Press, 2019.
xi

---

[21] M. F. Huber, "Recursive Gaussian process: On-line regression and learning," Pattern Recogni- tion Letters, vol. 45, pp. 85 91, 2004.
[22] M. R. Abbasifard, B. Ghahremani, and Naderi, "A survey on nearest neighbor search methods," International Journal of Computer Applications, vol. 95, no. 25, 2014.
[23] H. Liu, Cai, Y. Wang, and Y. S. Ong. "Generalized robust Bayesian committee machine for large-scale Gaussian process regression." in Proceedings of the International Conference on Machine Learning, pp. 3131-3140, 2018.
[24] G. E. Hinton, "Training products of experts by minimizing contrastive divergence," Neural Computation, vol. 14, no. 8, pp. 1771-1800, 2002.
[25] N. Srinivas, A. Krause, S. M. Kakade, and M. W. Seeger. "Informatioonthhone" regret bounds for Gaussian process optimization the bandit setting," IEEE Transactions on Information Theory, vol. 58, no. 5, pp. 3250-32000 3265, 2012.
[26] L. Li, W. Xu, T. Chen, G. B. Giannakis, and Q. Ling, "RSA: Byzantine-robust stochastic aggregation methods for distributed learning from heterogeneous datasets," in Proceedings of the AAAI Conference on Artificial Intelligence, pp. 1544-1511 2019.
[27] M. W. Seeger, C. Williams, and N. D. Lawrence, "Fast forward selection to speed up sparse Gaussian process regression," in International Workshop on Artificial Intelligence and Statistics, pp. 2,54261, 2003.
[28] Rigollet and J.-C. Hütter, High Dimensional Statistics. Lecture notes for course, 2015.
[29] Z. Yuan and M. Zhu, "Lightweight distributed Gaussian process regression for online machine learning," arXiv preprint wrXv:22005.04738 2021.
[30] Tao, Topics Random Matrix Theory, vol. 132. American Mathematical Society, 2012.
Checklist
For all authors...
(a) Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope? [Yes] We enumerate the contributions in the introduction.
(b) Did you describe the limitations of your work? [Yes] We discuss the future work in the conclusion (Section 5).
(c) Did you discuss any potential negative societal impacts of your work? [No]
(d) Have you read the ethics review guidelines and ensured that your paper conforms to them? [Yes]
2. If you are including theoretical results...
(a) Did you state the full set of assumptions of all theoretical results? [Yes] We give all required assumptions in Sections 2.2 and 3.4.
(b) Did you include complete proofs of all theoretical results? [Yes] We provide complete proofs of each lemma and theorem in Appendix.
3. If you experiments...
(a) Did you include the code, data, and instructions needed to reproduce the main exper- imental results (either in the supplemental material or as a URL)? [Yes] We provide the simulation details in Section 4. We also include the code in the supplementary document.
(b) Did you specify all the training details (e.g., data splits, hyperparameters, how they were chosen)? (Yes] We provide the training details including data partition in Section 4.
(c) Did you report error bars (e.g., with respect to the random seed after running experi- ments multiple times)? [Yes] We run experiments multiple times and give error bars in Section 4.
xii

---

(d) Did you include the total amount of compute and the type of resources used (e.g., type of GPUs, internal cluster, or cloud provider)? [Yes] We include the type of CPU in Section 4.
4. If you are using existing assets (e.g., code, data, models) or curating/releasing new assets...
(a) If your work uses existing assets, did you cite the creators? [Yes] We use two real- world datasets, SARCOS and Kin40k, in Section 4, and we cite the creators.
(b) Did you mention the license of the assets? [No]
(c) Did you include any new assets either the supplemental material or as URL? [No]
(d) Did you discuss whether and how consent was obtained from people whose data you're using/curating? [No]
(e) Did you discuss whether the data you are using/curating contains personally identifiable information or offensive content? [No]
5. If you used crowdsourcing or conducted research with human subjects...
(a) Did you include the full text of instructions given to participants and screenshots, applicable? [N/A] Our work is not associated with research on human subjects. (b) Did you deseribe any potential participant risks, with links to Institutional Review Board (IRB) approvals, applicable? [N/A] Our work not associated with research on human subjects.
(c) Did you include the estimated hourly wage paid participants and the total amount spent on participant compensation? [N/A] Our work is not associated with research on human subjects.
xiii


Reviews:
[{"review_id": "gM1E9OJD0eQ", "reviewer": "Reviewer_vGEs", "summary": "The paper explains the Byzantine-tolerated local approximation Gaussian process (GP) model for streaming data. In the GP framework, distributed learning scenario is used to scale the costly GP to big data. Besides, this local approximation method is used in federated learning when security requirements should be satisfied. The paper proposes a solution to divide the agent set into Benign and Byzantine agents sets. By specifying the Byzantine agents, the model excludes them and uses the benign agents to reduce the negative effects of the attack. The authors evaluate the proposes model on synthetic and real world data sets to show the capacity of their solution. ", "questions": "Please check the points mentioned in \"Strengths And Weaknesses.\". Indeed, it has been confirmed that disjoint partitioning captures the local features more accurately and outperforms random partitioning (see reference [23] in the paper); why did the authors use random partitioning in the experiments? \n", "limitations": "Yes. ", "rating": 5, "confidence": 4, "soundness": 2, "presentation": 2, "contribution": 2, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strengths:\n\nThe paper correctly defines the problem. It explains the model, restrictions, related assumptions, and the main problem by addressing all related issues. \n\nWeaknesses: \nThe paper has some shortcomings, and I will mention them here:\n\n1- Agent-based local GPR: \n\nThe size of the local input data in an agent is not determined. When time rises (i.e., t goes to infinity), how the model handles the data assigned to each agent? In streaming data, the size of the input data increases continuously. Since the local models use the nearest neighborhood GP regression, how many streaming inputs should be selected for NNGP? \nThe size of the data inputs raises, so the model needs a clearly defined strategy that determines the local partitions' scope, the number of neighborhood points in NNGP, and related complexity. The computational cost of a GP has a cubic dependency on the sample size (in the local approximations, cubically depends on the subsample sizes). Since the sample size increases when time t raises, the model needs a predefined mechanism to deal with complexity. Moreover, the complexity O(t) mentioned in line 146 only shows the search cost in NN and not the cost of the training of the NNGP. \n\n\n2- Cloud-based aggregated GPR\n\nThe paper's main contribution is this part, where they proposed a solution to find Byzantine agents. The paper considers the agents with the smallest and largest local means and variances at each test point as potential Byzantine agents. It is not supported by a theoretical analysis in the paper and is a heuristic trick. Consider a simple case that all Byzantine agents reported small values as local predictions while the higher mean values are more proper. In this case, steps 4 to 7 in Algorithm 3 exclude a small number of Byzantine agents, while some high-quality agents are also excluded. \n\nThere are some related selection methods in the literature. For instance, the Gaussian graphical model can select the benign agents using the precision matrix between agents' predictions. The agent selection method in (https://arxiv.org/abs/2102.01496.pdf)  uses the interactions between agents in the related graphical model, determines those agents whose predictions are not close to the other agents' predictions, and excludes them for the final aggregation. Indeed, the ensemble technique in (https://arxiv.org/pdf/2010.08873.pdf) can divide the agents set into two clusters, Byzantine and benign agents, using spectral clustering and the precision matrix of the local predictions. Besides, the importance of an agent in the original GPoE (https://arxiv.org/pdf/1410.7827.pdf) and robust Bayesian committee machine (https://arxiv.org/pdf/1502.02843.pdf) can also help to select benign agents. They proposed the difference in the differential entropy between the prior and the local posterior distribution. \n\n3-  Byzantine-tolerant PoE \n\nThe generalized product of experts (GPoE) with equal weights (Deisenroth et al. 2015) can provide conservative predictions. This model averaging approach uses the agents' weights to improve the overconfident predictions of traditional PoE. However, its prediction quality is generally lower than the Bayesian committee machine family, mainly when disjoint partitioning is used. It would be better if the authors considered the other newer aggregation methods. \n\n4- Agent-based fused GPR\n\nThis part is somewhat unclear. When the local predictions have been combined using PoE, what is the reason for this step? It should be explained that can it change the final aggregation? The model compares the variance of the GPoE and local variances.\nThe reason for comparison is unclear, and also, the paper does not describe why this comparison and related replacement (steps 3 and 5 in Algorithm 4) are essential? ", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"ethics_review_area": ""}, "extra_text": {}}, {"review_id": "MfqpRZ9qXqx", "reviewer": "Reviewer_3mHJ", "summary": "This paper studies consider Byzantine-tolerant federated learning for streaming data using Gaussian process regression (GPR). A cloud and a group of agents aim to collaboratively learn a latent function where some agents are subject to Byzantine attacks. The paper develops a Byzantine-tolerant federated GPR algorithm, which includes three modules: agent-based local GPR, cloud-based aggregated GPR and agent-based fused GPR.\n\n", "questions": "1. What are the technical challenges and contributions?\n2. Is there a section of related work?\n3. How to address the streaming data challenge, e.g., concept drifting?\n4. How to simulate and test a data stream in experiments?", "limitations": "See the above questions. ", "rating": 5, "confidence": 3, "soundness": 2, "presentation": 2, "contribution": 2, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strengths:\n\n1. Develops a Byzantine-tolerant federated GPR algorithm. The algorithm includes three modules: agent-based local GPR, cloud-based aggregated GPR, and agent-based fused GPR.\n2. The predictive mean of the cloud-based aggregated GPR is theoretically guaranteed to be restricted within a neighborhood of the target function provided that Byzantine agents are less than one-quarter of all the agents.\nExperiments on a synthetic dataset and two real-world datasets are conducted to evaluate the proposed algorithm.\n\nWeakness:\n1. Technical contribution: the paper is a combination of existing methods on Byzantine attacks, federated GPR, and online learning, the technical challenges of such a combination, however, have not been identified, so the technical contribution of this work is not clear.\n2. Related work: the paper does not include discussions with related work, there has been a sequence of works on Byzantine resilient secure federated learning, federated learning, online learning, and data streams. However, the difference between this work and theirs are not clearly stated.\n3. Experiments: this paper targets data streams, but in experiments, there is no study in terms of data streams; for example, to simulate streaming data with concept drift. The measures should also include efficiency, as well as computation and memory costs.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"ethics_review_area": ""}, "extra_text": {}}, {"review_id": "6-OmNzTQcfY", "reviewer": "Reviewer_dgxv", "summary": "The authors consider applying Byzantine-tolerant federated learning for online GPR and proposed a new algorithm with various modules for IoT applications. Theoretical supports on the proposed algorithms are also provided. \n", "questions": "1. Do assumptions 2 and 3 hold even for the SE kernel? This is not justified in the paper. \n2. Are the bounds tight in Theorem 1 and 2? ", "limitations": "1. Insufficient algorithm comparison.\n2. Insufficient experimental evaluations.", "rating": 6, "confidence": 5, "soundness": 2, "presentation": 3, "contribution": 2, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strengthes:\n1. A novel Byzantine-tolerant federated GPR algorithm for online streaming data. \n2. Theoretical performance analyses on the posterior mean and variance subject to attacks. \n\nWeaknesses:\n1. The main ideas and techniques rely on reference [24] to certain extent.\n2. Attack is perhaps too simple.\n3. Comparison with other methods is insufficient, for instance, \n(a) Gaussian process with differential privacy, https://arxiv.org/abs/2106.00474\n(b) Reference [23] \n4. The following reference also discussed about the malicious protection and privacy issue of distributed GP for IoT applications, which may be mentioned in the manuscript:\nhttps://ieeexplore.ieee.org/abstract/document/9250516", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"ethics_review_area": ["I don’t know"]}, "extra_text": {}}]

Author rebuttal:

Decision: Accept