Fine-Tuning Personalization in Federated Learning to Mitigate Adversarial Clients
Authors: Youssef Allouah
Abdellah El Mrini
Rachid Guerraoui
Nirupam Gupta
Rafael Pinot
Venue: NeurIPS 2024 poster (2024)
Keywords: Personalized Federated Learning
Optimization
Generalization
Byzantine Robustness
Primary area: other
TL;DR: Full collaboration can be suboptimal in the presence of heterogeneity and Byzantine adversaries, we shed light on when personalization can improve robustness.

Abstract: Federated learning (FL) is an appealing paradigm that allows a group of machines
(a.k.a. clients) to learn collectively while keeping their data local. However, due
to the heterogeneity between the clients’ data distributions, the model obtained
through the use of FL algorithms may perform poorly on some client’s data.
Personalization addresses this issue by enabling each client to have a different
model tailored to their own data while simultaneously benefiting from the other
clients’ data. We consider an FL setting where some clients can be adversarial, and
we derive conditions under which full collaboration fails. Specifically, we analyze
the generalization performance of an interpolated personalized FL framework in the
presence of adversarial clients, and we precisely characterize situations when full
collaboration performs strictly worse than fine-tuned personalization. Our analysis
determines how much we should scale down the level of collaboration, according
to data heterogeneity and the tolerable fraction of adversarial clients. We support
our findings with empirical results on mean estimation and binary classification
problems, considering synthetic and benchmark image classification datasets

Fine-Tuning Personalization in Federated Learning to Mitigate Adversarial Clients
Youssef Allouah' EPFL Lausanne, Switzerland
Abdellah El Mrinit EPFL Lausanne, Switzerland
Rachid Guerraoui EPFL
Lausanne, Switzerland
Nirupam Gupta University of Copenhagen Copenhagen, Denmark
Rafael Pinot
Sorbonne Université and Université Paris Cité, CNRS, F-75005 Paris, France
Abstract
Federated learning (FL) is an appealing paradigm that allows group of machines (a.k.a. clients) to learn collectively while keeping their data local. However, due to the heterogeneity between the clients' data distributions, the model obtained through the use of FL algorithms may perform poorly on some client's data. Personalization addresses this issue by enabling each client to have a different model tailored their own data while simultaneously benefiting from the other clients' data. We consider an FL setting where some clients can be adversarial, and we derive conditions under which full collaboration fails. Specifically, we analyze the generalization performance of interpolated personalized FL. framework in the presence adversarial clients, and we precisely characterize situations when full collaboration performs strictly worse than fine-tuned personalization. Our analysis determines how much we should scale down the level of collaboration, according to data heterogeneity and the tolerable fraction of adversarial clients. We support our findings with empirical results on mean estimation and binary classification problems, considering synthetic and benchmark image classification datasets.
Introduction
Federated learning (FL) is the de facto standard for group of machines (also referred as clients) to learn a common model on their collective data (Kairouz et al.] (202I). The benefit this method is twofold: the clients (1) retain control over their local data (as they do not communicate them to central server) and (2) share the computational workload during the learning procedure. Although FL is a promising learning paradigm, it also comes with its technical challenges, the first of which is data heterogeneity. Indeed, each client holds only a portion of the common dataset, which is necessarily faithful representation of the entire population. This could lead disagreements amongst clients on model updates, rendering the task of learning an accurate model in this context cumbersome. Nevertheless, when all machines correctly follow prescribed algorithm, this problem can be solved using either distributed implementation of the stochastic gradient descent (SGD) algorithm or variants of the federated averaging scheme (McMahan al. 2017 Khaled al. 2020 Karimireddy et al. 2020). Another negative impact of data heterogeneity is the non- non-uniformity of model accuracy. Specifically, while an FL algorithm outputs model that is accurate on average, the accuracy of this model on different clients" local data could vary significantly.
"Authors listed in alphahetical order. "ooresponndecce to Abdellah El Mrini cabdellah.elmmiiiie wtw.lllah..lmriiieee........
38th Conference on Neural Information Processing Systems (NcurIPS 2024).

---

Personalization. Personalized FL attempts to address the aforementioned shortcoming on non- uniform model accuracy by having clients collaborate to design individual models that generalize well over their local data distributions (Yanhaesebrouck et al., 2017 [attteer et al., 2020 Fallah et al., 2020) Hanzely et al., 2020). This approach is highly relevant to many modern machine learning applications, as it tailors the training of each model to the needs of the respective client. To get more precise view of this approach, consider a general supervised learning task with A' denoting the input space and } the output space. Personalized FL involves n clients which can communicate, through a central trusted machine (a.k.a. the server). The clients hold local datasets Si,..., S.. comprising m data points, drawn i.i.d. from their respective local data distributions Di...., D, with support in Z == X' x V. Given a parameter set è C IR' we consider hypothesis functions of the form hg: X + V", parameterized by 0 O and we denote by H. the corresponding hypothesis class. We allow )" * y to encompass cases in which the model outputs logits/probits instead of classes. The objective of each client is to find model 07 E Q minimizing its local risk function
(0) == E (r.y))D; [((ho(z), v)], v0 O
(I)
where L: y' -> RR is a non non-negative point- wise loss function measuring how well a hypothesis ho fits the output y on an input z. The mapping (0, v) + E(hg (xx), y) is assumed to be differentiable. with respect to 0. To minimize the local risk above, each client i only has access to its local dataset S; yielding local empirical loss (,(
(G.,))ss E(ha (1)), y), and to the information sent by other clients on their respective datasets. This optimization problem can be solved in several ways. and we have at out disposal a rich literature on personalized FL schemes (Mansour et al., [0200] Fallah cet al., 2020 Marfoq et al. 202I). We focus on a specific personalization scheme wherein each client aims to solve for the X-interpolated empirical loss minimization problem:
min (0,) = =1 A)C.(0.) + AC(O.), 0,E0
where L(0) 4 (,)), 40 O, and À E 1). When À 1, the problem reduces to the standard FL. objective and corresponds to full collaboration amongst the clients. The case of X = 0 represents the absence of collaboration, i.e., each client minimizes its local empirical loss. We use the terminology fine-tuned personalization to refer to the objective of solving for (2) when À E (0, determined by optimizing the learning performance in retrospect.
Standard personalized FL approaches usually assume that all clients correctly follow prescribed protocol, and hence do not consider the possibility of adversarial clients. Robustness to such clients, a.k.a "Byzantin robustness", refers to the design of FL schemes that yield accurate models even when some clients arbitrarily deviate from the algorithm and can send potentially corrupted information to other clients: This could result from poisonous data or code, or attacks from malicious players. Although Byzantine robustness has received significant attention in the FL community (Guerraoui et al.] 2024), it remains largely understudied in the context of personalized FL. In fact, prior work has shown that the presence of adversarial clients induces a fundamental optimization error that grows with the heterogeneity across clients' local data (Karimiredyy et al. 2022, Allouah al., 2024). This optimization error is at odds with the improvement in generalization which is offered by collaborating with other correct clients, to point where collaboration is rendered vacuous. The main motivation for our work is to quantify the impact of adversarial clients on the relevance of collaboration for any correct client.
Robustness.
1.1 Problem Setting
Given the set of n clients, we aim to tolerate the presence of at most f < n/2 adversarial clients. Such clients can respond arbitrarily to the queries made by the server, e.g., a gradient computation on their local dataset. We also call these clients Byzantine adversaries. The identity of Byzantine adversaries is a priori unknown to the correct (i.e., aon-advvrsariil) clients, otherwise, the problem is rendered trivial. As we explain above, when no client is adversarial, the objective of each client i is to minimize its own risk, defined in [T. by solving for the interpolated empirical loss minimization problem (2) However, in the presence of adversarial clients, correct client cannot simply seek solution to as they can never have truthful access to the information about Byzantine adversaries' datasets. more reasonable goal is to minimize an interpolation between their local and the correct clients" average loss functions. We formally define the robust- -ibbuttinttrpplatedd objective for client as follows:
min (..) = (1 (0.) + (Cc( 8,80
(3)

---

where C represents the set of correct clients, Lc(0)= = 1 Eiec ()), e θ, and À E [0, 1] is C
called the collaboration level. Similar to A = 0 and A= respectively, reduce to local learning which can be solved with local SGD (Stich 2018), and Byzantinerrobust FL which can be tackled using a robust variant of distributed gradient descent (Allouah al. 2023 Recall that C is priori unknown to the correct clients, hence they can neither have access to Le nor to its gradients. A correct client can only approximate any information Lc, where the approximation error grows with both /n and data heterogeneity, shown in KKrrmireedy et al. 2022. Allouah et al. 2024
1.2 Contributions
We establish optimization and generalization guarantees on the interpolated personalized objective (3) in the presence of adversarial clients, and show how the degree of collaboration X, asymptotically navigates the trade-off between the fundamental optimization error due to adversarial clients and the improved generalization performance thanks to the collaboration with correct ones.
This sheds light on specific situations in which full collaboration performs strictly worse than fine-tuned personalization, and even sometimes worse than local learning. Precisely, we extend an important result from domain adaptation (Ben-David et al.) 2010), showing that data from a distinct distribution cannot be beneficial for the local learning task when the heterogeneity is above a certain threshold, which depends on the local sample size and the hypothesis class complexity. In the context of Byzantine robust distributed learning, we show that even if data heterogeneity is low enough, the level of collaboration should be rescaled by a parameter that both depends on the fraction of adversaries and the gradient dissimilarity between correct clients. Essentially, while the effect of collaboration could be captured by substraction between the local task complexity and the Byzantine free context, we show that further captured by
heterogeneity of local distributions multiplicative factor in the presence of adversaries. The higher the dissimilarity between correct gradients (and the number of adversarial clients in the system), the smaller À should be taken.
Our results show that for personalized FL, in most realistic contexts where heterogeneity between clients is not negligible, full collaboration not optimal in the presence of adversarial clients. Moreover, the presence of these adversarial clients considerably limits the level of collaboration that could be useful for the correct clients, the point where is often more efficient learn locally if the local task is sufficiently simple.
1.3 Paper Outline
The remainder of the paper is organized as follows. Section 2resents the mean estimation setting as a warm-up and special case of the framework presented in Section 1.T] The goal is to give an intuition on settings in which personalization presence of adversarial clients. Section presents our analysis in the general binary classification setting, where we quantifyy the tension between the optimization error and the generalization gap in the presence of Byzantine adversaries. We also empirically validate our theory on the MNIST dataset. We defer full proofs to Appendix Cland our full experimental setup to Appendix D We also include further information on related work in Appendix/A [A]
or cannot help reduce the estimation error in the
Warm-up: Mean Estimation with Adversaries
Before diving into the details of our results in general supervised learning setting, let us first focus on the simple task of Byzantine-robust federated mean estimation in which the concepts of heterogeneity and task complexity are easier to grasp. We consider n correct clients denoted C. Each client i C has access to data point ( ..... "/(")) sampled i.i.d. from their local distribution D; and independently from the other correct clients. We assume that each local distribution D, has a support in RRd, an unknown finite mean μ4. Furthermore, we assume that all the distributions have the same finite variance o² := Ey-D, |Il μ4 |2]. In this context, the objective of each client is to find their true mean μ4. To do so, we assume that each client attempts solve problem of the form
1-
Σ
Vi (A))
A m(n
(1)
min ERe
1/
m
f)
Kg [m]]
kE[m] IEC
3

---

In fact, the optimal solution to this problem is uي = (1 X)ū, + ABe where in == 1.4 E== vn and Mc = --ク Eiec Wr. Recall that due to the presence of Byzantine adversaries, correct clients cannot compute Y/c directly, but should instead use a robust aggregation rule F to estimate Vec Specifically, we consider the natural robust estimator of y B where j/ is replaced by a robust approximation
3 = (1 - A)σ + AF(Ii ...)
To formalize how good robust aggregation rule is, we use the notion of (f. robussnesss (Allouah al. 2023). which we state below.
Definition 1 ((f, x) robuuuuus))ss). Let f < 7/2 and & 2 0. An aggregation rule F is said to be (J, robuustt for any vectors v1,... on E Rd,, and any set S [m] of size n - ʃ.
F vn) - -uull v 12 f
K
Σ EE
l1: Tull with Tu = 1
n iEM
2.1 On the Effect of Collaboration
We evaluate the performance of the estimator Φi by the mean squared error defined as [[ly?" - [=]13] where the expectation is taken over the random samples yi "....; from D: and independently for every E C. Then the following holds.
(1) (m) drawn i.i.d.
Proposition Consider the mean estimation setting described. For any E C, let y be as defined in (5) with an aggregation rule F' that satisfies (f, k) -robustnsss.. Then the following holds true:
1 r²T(),K) + +32 -Ftel 2 + k=))).
E [IIu* [|llA~mll?? $3 1- n2 (1-n-;)
m=llp]
m
with pe= n-s Exec 14. A2:= - EjEc Ilks eell and [(A, k)) = (1 1) 22+ a-f カ-f-1 Tightness of the bound. While the right-hand side Proposition may not be tight in general, note that it is tight for À 0 and À 1, in the homogeneous setting (A 0), provided that we use robust averaging with x E Off/n). Indeed, when À = 0 the squared error in estimating the mean of distribution with variance o² from i.i.d. samples is in Q0 Q(o²/m), refer (Wul 2017). Furthermore, when À = 1, the squared error in estimating the mean of distribution with variance o² in Q( (1+ a" refer (Zhu et al. 2023).
Interpretation. Note that, in the above, the terms that represent the hardness of the local mean estimation task and the heterogeneity among correct clients are a² m and 1|pu-/tll 1|2 + respectively. Indeed a² is the variance of each distribution, hence the local mean estimation task is essentially hard as o² is large with respect the number of points m each client has access to. Similarly, 2 essentially computes how far apart the true means of the correct clients are on average, and ||44 Fell penalizes especially the distance the average of the correct clients for the one observe (i.e., E C). By minimizing the right-hane hand side of Proposition I we get
(N 1)
+ 11m Fell + KA²
which approaches 0 as || 12 + RA² grows and 1/(1 +[++x) K) when I|u, Pell + xΛ2 o²/m.
Note that can be small O (f/m), hence the above means that, when heterogeneity is limited and with small enough fraction of adversarial clients, high level of collaborations can be used by
each correct client. On the other hand, correct clients need not gain much by collaborating with other clients in highly heterogencous regimes.
2.2 Experimental Validation
To validate our theoretical observations on Byzantine-robur federated mean estimation, we run series of experiments using simulated datasets sampled from I-dimensional Gaussian distributions.
This estimator need not be optimal priori. But represents the ofate-of-thh-ar the solution for robust FL.

---

Heterogenally
Byzantines
0.0
25
50
1.0
50
7.0
2.0
20
100
40
13.0
150
19.0
4.0
25.0
31.
10
20
5
16
Theoretical otricall
0.8
Theorotical Empirical
0.8
Theoretica Emplrical
0.8
0.4
0.4
0.
0.
0.2
50
150 Number of Byzantines
100
200
250
Heterogenelty
Figure 1: Impact of the heterogeneity (or), number of Byzantine adversaries f and the task complexity (o). (Top) The average error for different values of X, computed using 20 random experiments. (Bottom) Comparison of theoretical X and empirical minimizer of the error. We fixed the following default values: n 600, f 100, 20,0 α 15, o = 2
Specifically, for each of the n f correct clients, we consider that their distribution is such that =N=,,,, )²), where the unknown local means (pi)kec have been sampled i.i.d. from Gaussian distribution A (1100, o _ where d determines the expected squared distance between the local means of each correct client. Each honest client
C' samples m datapoints from D. and the error is computed with respect to f4. To evaluate the theoretical expression of X*, defined in (6). in this scenario, replace the distances of the form (14: mc)² by the variance (1 fo We present in Figure thee average error (squared distance to the true mean) of the estimator defined as per (5) on 20 runs, for different values of X. The robust aggregation being used here is an NNM pre-aggregation rule (Allouah et al. (023) followed by trimmed mean (Yin et al.] (018)) and adversarial clients implement the sign-flipping attack. Below we analyze our result presented in the first row of Figure
Heterogeneity. First, we study the impact of the heterogeneity level in Figure I Doing so, we fix n 600, f = 100, m = 20, a 15 and vary the level of heterogeneity o E {0, 1, 2, 3, 4). We observe that for low levels of heterogeneity, the optimal choice for À is close to 1. In this case, personalization does not really help.
Byzantine fraction. Second, we analyze the impact of the fraction of Byzantine adversaries. For Figure D we fix 600, m = 20, 15, σ, = 2 and vary f E {0, 50, 100, 150). As per our theoretical analysis, as the Byzantine fraction increases λ should increase; hence the correct clients need to rely less and less on the global aggregate. However, simply using a local estimator can be detrimental as showcased by the red curve, which shows the case f 150. Then, by choosing the right collaboration, one reduces the error by 50% compared to the local estimator.
Task complexity. Finally, we study the impact of the task complexity, characterized by the quantity a ''/m. We fix n 600, f = 100, m = 20, σ 2 and vary E [1.7, 7, 13, 19, 25, 3... We observe, as expected, that the optimal level of collaboration level of collaboration moves away from 0 the task gets harder. However, we also observe that, since the fraction of Byzantine clients is non-negligible, the optimal choice of collaboration X, even for very large values of a, never goes 1.
Correspondence between the upper-bound and empirical observations. The second line of Figure shows a comparison between the optimal theoretical value predicted by our analysis and
*We use mean at 10 to break the symmetry of the mean simulation around 0. This is simply to present a case in which the sign-fipping attack is indeed discupting the federated mean estimation procedure
5

---

the empirical minimizer of the error on average We see that the value we predicted for X and the actual empirical best choice for has very similar trends all the settings we consider.
3 Binary Classification with Adversaries
In this section, we consider the more general problem of binary classification. We study the learning-
theoretic setup given in Section I with binary output space y {0, 1) and 3" [0, Throughout,
we place ourselves in a hypothesis space H. of finite sacudo-dimensioon (Vidyasagar 2003: Mohri al. 2018), denoted Pdim(()) which recall reduces to the VC dimension for the 0 loss. We
further make the following assumptions on the loss functions. These assumptions are standard in the
Byzantine robustness literature see, e.g-, (Karimireddy al. [022] Allouah al., 2023).
Assumption (L-smoothness, j--strong convexity). Each loss function Li, i E C, is L-smooth and ju-strongly convex. That is, for all 0, 0' E O, we have
L Assumption 2 (Bounded heterogeneity). There exists real value G such that for all 0 E Q we have
l - 011 < (,) (.) (VL,(0), 0 8)) 2
11
-VC(())-<<(0))) G². C
We additionally make the following assumption on the parameter set θ to ensure that the Euclidean projection on (denoted Ile) is well-defined, unique and that the minimizer of the interpolated loss is not pathological, i.e., is not in the border of O
Assumption 3. The parameter θ is compact and convex. Moreover, for every i C, [0, 1]. the minimizer of CA is in the interior of 6.
Additionally, for our generalization analysis, we make the following assumption on the loss function: Assumption 4. The loss function is bounded in [0. 1].
To conduct an analysis of the effect of collaboration on the generalization performance of correct clients when trying to solve (T), proceed in two steps. We first evaluate the optimization error that a standard gradient descent algorithm incurs in our setting. Then we bound the generalization gap induced when minimizing (1 and combine the two bounds into our main result in Theorem [
3.1 Algorithm & Optimization Error
We focus our analysis on simple personalized variant of the robust distributed gradient descent algorithm, which is the standard algorithm in the Byzantine-robust FL literature and is shown to achieve tight optimization bounds (Allouah et al. 2023). Our variant, presented in Algorithm T essentially corresponds to gradient descent on the function LA, but using robust estimate R (iteration 7) of the gradient of Lc, which cannot be computed exactly due Byzantine adversaries. This robust estimate is computed using robust aggregation F, e.g., trimmed mean median.
On the execution of the algorithm. Executing Algorithm Din in practice implies that each client acts as a local server, and runs an independent federated learning procedure. We further assume that the clients have access the other clients. This can either be done through the use of the central server or directly through decentralized communication (i.e., without server). This algorithm is not communication efficient and we believe that it could be improved in that direction. Nevertheless, it allows us to discuss the simple manner. We first present the optimization
communication protocol that allows them to broadcast their model to
information theoretic aspects of the problem error of Algorithm| in Lemma T below.
iehrrmation-thhoretiic
Lemma 1. Let assumptions
/ and 3 hold. Consider Algorithm 7 with learning rate 1j 2L' E [0, 1], and assume the aggregation function F to be (f, k.,x) r))brusst. For any T 2 1, we have:
C2 - C.. <
xT22
+ (1
11
T L
Lo:
4²
2L
where Co = C\(0)) C. and C. = min (0).
dEG
5x is replaced by f/n-2/, following (Allouah al. 2023

---

Algorithm Interpolated Personalized Gradient Descent for client i E C
Require: Initialization 0.. aggregation rule F, learning rate 1), number of iterations T, and collabo-
ration parameter X.
1: for f. = 1.....7 . do
2: Broadcast 0 -1 to all clients
3: for jorj= 1..... n, J # i do
4:
Receive gi. (0, from client j > adversarial clients send corrupted gradients 5: end for
6:
Compute local gradient g = (0;
7: Robustly aggregate R = F F 1. p
8:
Update and project local parameters
0 = Ile (0) ((1 N)gk, + +RR))
9: end for
Our optimization enror bound recovers the classical GD linear rate when À = 0 (local learning), and achieves an asymptotic error ( when
(full collaboration), which is provably tight under Assumption 2 Karimireddy et al. 2022). Interestingly, for À E (0, 1), the asymptotic error smoothly interpolates in O(*xGG)), which is expected as lesser collaboration limits the influence of the adversary on the optimization error.
3.2 Generalization Gap & Effect of Collaboration
Although the presence of adversarial clients impairs the optimization process, one expects a general- ization benefit from collaboration if data distributions are similar enough. We formalize this intuition by bounding the generalization gap. of the personalized learning problem (2). We first bound the
generalization gap on the interpolated loss L using a result adapted from (Blitzer et al. 2007).
Lemma 2. Let Assumption 4 hold. For any 5 > E and X E [o. 1]. we have with probability at least 1 - 8 (over the choice of samples) that
1 11 n-}
X2
C2(0)- - R0) (100)-R((0)) 23
m
m(n - f)
where (0) (OC) 40 E θ. and B = (H) log
em Pdlm(
+ (1/6)
When specializing the result of Lemma to and À 1, recover the standard generalization gaps O (PdimmH)))m and Of (V (Pdim(())mm(m-ppp for local learning and federated learning (with correct clients only), respectively. However, in addition the generalization gap bounded in Lemma need to bound the gap between the interpolated risk (3) and the original local risk (I). In fact, these two objectives are statistically different when there is data heterogeneity among clients since the interpolated risk (3) involves the average of local loss functions. To quantify this difference, leverage tools from domain adaptation theory (Ben-Dane David et al.) 2010) and consider a function measuring the discrepancy between two statistical distributions. Formally, require for every E C,
(R) - Re(0)) S ((D, De), VO E O.
For example, for the case of 0-1 loss in binary classification, for any two distributions Dj and D2, (Blitzer et al. 2007) propose the discrepancy measure to be ((D,, D2) dHaH (D1, , D2) =
2 supher PD, hT)) P ([h)) where 1(h) == {a E X h(x)) = 1}. For more general losses. we can use hypothesis space-dependent Integral Probability Metrics (Sriperumbudur et al.) 2009 Bao
al. 2023), which we include Appendix B.2 We now combine our bounds on the optimization error and generalization gap into Theorem below.
Theorem Let assumptions
2 and hold, and let t be a function such that 7 holds. Consider
Algorithm 7 with learning rate 1
21 X E [0, 1], and assume the aggregation function F to be
7

---

(f, k)rbbustusst. Then, for any 8 >> 0, 2 1, we have with probability at least 1 5 (over the choice of samples) that
R.(00))R2(00)
M
L
Lo
5LA
+2X0(D,, Dc)
21.
14
2
(8)
+
22
+ +
+
m(n ff
where B Pdim(H) log
(oo((1 and C,, min (0). 0
Pdim(H)
Interpretation. The bound in Theorem features a trade-off between data heterogeneity, sample size, and model complexity Indeed, we minimize the bound in Theorem and obtain the following closed-form approximation by ignoring constant and logarithmic terms, and assuming that n, T (see Appendix C for details)
Pdim (H) m
$DD;; Dc)
X R [o.11
L
where [0 denotes the projection over [0, 1]. This expression suggests that the optimal collaboration parameter decreases with data heterogeneity. Indeed, if (D, Dc) > /Pdim(H)// then X and local learning, as expected, is optimal. Otherwise, the optimal collaboration parameter can be non-zero. This validates the fact that correct clients cannot improve their local generalization when their local distributions are too dissimilar compared to the complexity of the hypothesis class and the number of data points each of them has. Furthermore, even if the heterogeneity @DD,, Dc) sufficiently small compared to /Pdim(Ki//m, the level of collaboration must be re-evaluated according to 1 2 hence depending on both the fraction of adversaries and the dissimilarity of the gradient between correct clients.
3.3 Experimental Validation
100
100
That accuracy on local local dataset
40
40
40
20
/w6
/-9
(a) m
16
(b) 48
(c) 128
80
setumey on best
80
40
3m3
0
F
f-0
f-0
f-6
f-6
0.0
02
0.4
0.6
0.8
1.0
0.0
0.2
0.4
0.6
0.8
1.0
0.0
0.2
0.4
0.6
0.8
1.0
0.0
0.2
0.4
0.6
0.0
1.0
2
(d) 0 = 00, m 32
(e) 0.5, m = 32
(f) m 64
(g) a = 0.5, m 64
Figure 2: Effect of adversarial fraction and heterogeneity and local sample size. (Top) Phishing dataset with logistic regression with n = 20, a = 3. (Bottom) MNIST with a Convolutional Neural Network (details in Appendix D 20. oc refers to the homogeneous setting.
Setup. We empirically investigate the impact of Byzantine adversaries on the generalization performance, in our personalization framework, using the Phishing dataset (Chiew et al. 2019) and
8

---

the MNIST dataset (LeCun and Cortes, 2010). Other experiments are included in Appendix D For the different experiments, we use the state-of-the arr defense under data heterogeneity: NNM pre- aggregation (Allouah et al. 2023) rule followed by trimmed mean as robust aggregation (Yin et al.
2018). We simulate the Byzantine attack with the Sign Flipping attack (Li et al., 2020). Throughout the experiments, we fix n 20, and only vary the local dataset size m, the fraction of Byzantine adversaries f. and the heterogeneity level a which we will explain in the next paragraph. The clients
execute Algorithm| D for T' iterations which depends the dataset being used. Figure 2 the figures in Appendix show the average results and error bars for 5 random runs.
as well as
To simulate heterogeneity, we use a Dirichlet distribution (Hsu et al. 2019) to generate datasets with unbalanced class fractions for each client. The parameter a determines the heterogeneity degree (the smaller the bigger the heterogeneity). We subsequently sample the test datasets using the same class distribution as the train datasets for each client, and we evaluate the trained models on these local datasets. We defer the implementation details to Appendix D
Figure 2 as well as Figure from Appendix D show the final local test accuracy performance as a function of the degree of collaboration (A) for different values of f, m and a. These experimental results shed light on the impact of these different factors and allow us confirm the main insights of our theory.
Full collaboration can be suboptimal. This can be gleaned from settings where the adversarial fraction is substantial (over 6 adversarial clients, e.g. green and red curves in Figure 2). when the
heterogeneity is large (small values of o, e.g. blue and orange curves in Figure in Appendix [ and when the local dataset is large enough (e.g. Figure 26 and Figure 2cp. In situations where the
adversarial fraction is critical (f 9, corresponding to red curves in Figure 2 ). robust federated
learning completely fails, achieving accuracy scores under 50% on the local test datasets. Figure 5
in Appendix D further illustrates this point, showing that even local learning can be better than state-of-the-art robust Federated Learning in these circumstances.
Fine-tuning the collaboration helps get the best of both worlds. Figure 2 Bottom) shows that in data scarcity scenarios, for moderate values of the number of adversarial clients (f -f=3 or f = 6), using a collaboration degree strictly between 0 and 1 yields better accuracy on the local test dataset. The same effect also appears in Figure [ Top) for f = 3 and Figure 4 in Appendix [D] Additionally, even for extreme adversarial fractions (ʃ 9 in our experiments), the gain from decreasing the collaboration degree can be substantial compared to simply using Robust Federated Learning methods. This suggests that fine-tuning the collaboration degree can help dampen the detrimental effects of adversarial clients.
4 Conclusion & Future Work
In this paper, we have taken a first step towards understanding how fine-tuning personalization in FL can mitigate the impact of adversarial clients. The results we obtain suggest that the use of personalization can improve the performance of FL algorithms in the presence of adversarial clients, but also that the level of collaboration needs to be chosen carefully. Our theoretical analysis accounts for the necessity to strike a balance between the optimization error, which is impacted by adversarial clients, and the generalization gap, which is likely benefit from larger pool of data. We identify the main factors that impact the local performance, namely data heterogeneity, the fraction of adversarial clients, and data scarcity. This work could be extended in several directions. Firstly, as explained in Section 3 the study of Algorithm primmrrily serves our understanding of the robust interpolated optimization problem in (3) from an rnformationnthhoreee perspective. However, it may not be efficient enough to cope with high-dimensione of clients. An interesting future direction could be to investigate alternative algorithms with lower communication and computational costs, which would be able to handle these high-dimension problems. Second, our study focuses on a personalization strategy that interpolates between client loss functions. Although this strategy is simple to interpret and allows us to derive optimization and generalization bounds, it is only one of many possible personalized FL schemes. Another interesting avenue would be to investigate whether the insights we drew from our interpolated problem could be derived in a similar fashion from other personalization frameworks such as regularization, layer specialization, or clustering.
learning tasks involving a number
9

---

Acknowledgments and Disclosure of Funding
This work was supported in part by the Swiss National Science Foundation under Grant Nº20CH21 S0CCC22_118778,,, 218778, TruBrain and by SNSF grant 200021 200477. The authors thankful to the
anonymous reviewers for their constructive comments.
References
Allouah, Y., Farhadkhani, S., Guerraoui, R., Gupta, N., Pinot, R., and Stephan, J. (2023). Fixing by mixing: A recipe for optimal byzantine ml under heterogeneity. In International Conference on Artificial Intelligence and Statistics, pages 1232-1300. PMLR.
Allouah, Y., Guerraoui, R., Gupta, N., Pinot, R., and Rizk, G. (2024). Robust distributed learning: Tight error bounds and breakdown point under data heterogeneity. Advances in Neural Information Processing Systems, 36.
Bao, W. Wang, H., Wu, J., and He, J. (2023). Optimizing the collaboration structure in cross-silo federated learning. In Proceedings of the 40th International Conference on Machine Learning, ICML'23, JMLR.org.
Ben-David, S., Blitzer, J., Crammer, K., Kulesza, A., Pereira, F., and Vaughan, (2010). A theory of learning from different domains. Machine Learning, 79:151-175.
Bietti, A., Wei, C.-Y,, Dudík, M., Langford, J., and Wu, Z. S. (2022). Personalization improves privacy-aceuracy tradeoff's in federated learning.
Blitzer, J., Crammer, K., Kulesza, A., Pereira, F., and Wortman, J. (2007). Learning bounds for domain adaptation. In Platt, J., Koller, D., Singer, Y., and Roweis, S., editors, Advances Neural Information Processing Systems, volume 20. Curran Associates, Inc.
Chiew, K. L.. Tan, L., Wong, K., Yong, K. S., and Tiong, W. K. (2019). A new hybrid ensemble feature selection framework for machine learning-basee phishing detection system. Information Sciences, 484:153-166.
Dinh, C. T., Tran, N. H., and Nguyen, T. D. (2020). Personalized federated learning with moreau envelopes. NIPS'20, Red Hook, NY, USA. Curran Associates Inc.
Fallah, A., Mokhtari, A., and Ozdaglar, A. (2020). Personalized federated learning: A meta-learning approach.
Ghosh, A., Chung, J., Yin, D., and Ramchandran, K. (2020). An efficient framework for clustered federated learning. In Proceedings of the 34th International Conference Neural Information Processing Systems, NIPS '20, Red Hook, NY, USA. Curran Associates Inc.
Guerraoui, R., Gupta, N., and Pinot, R. (2024). Byzantine machine learning: A primer. ACM Comput. Surv., 56(7).
Hanzely, F., Hanzely, S., Horváth, S., and Richtárik, P. (2020). Lower bounds and optimal algorithms for personalized federated learning. In Proceedings of the 34th International Conference Neural Information Processing Systems, 20, Red Hook, NY, USA. Curran Associates Inc.
Hsu, H., Qi, H., and Brown, M. (2019). Measuring the effects of non-identical data distribution for federated visual classification.
Kairouz, P., McMahan, H. B., Avent, B., Bellet, A., Bennis, M., Bhagoji, A. N., Bonawitz, K.,
Charles, Z.,, Cormode, G., Cummings, R., et al. (2021). Advances and open problems in federated learning. Foundations and Trends0 in Machine Learning, 14(1-2):1-210.
Karimireddy, S. P., He, I.., and Jaggi, (2022). Byzantine-robust learning on heterogeneous datasets via bucketing. In International Conference on Learning Representations.
10

---

Karimireddy, S. P., Kale, S., Mohri, M., Reddi, S., Stich. S., and Suresh, A. T. (2020). SCAFFOLD: Stochastic controlled averaging for federated learning. III, D. and Singh. A., editors, Pro- ceedings of the 37th International Conference on Machine Learning, volume 119 of Proceedings of Machine Learning Research, pages 5132-5143. PMLR.
Khaled, A., Mishchenko, K., and Richtarik, P. (2020). Tighter theory for local sgd identical and heterogeneous data. In Chiappa, S. and Calandra, R., editors, Proceedings of the Twenty Third International Conference on Artificial Intelligence and Statistics, volume 108 of Proceedings of Machine Learning Research, pages 4519-4529, PMLR.
Kundu, A., Yu, P., Wynter, L.,, and Lim, S. H. (2022). Robustness and personalization in federated learning: A unified approach via regularization.
LeCun, Y. and Cortes, C. (2010). MNIST handwritten digit database.
Li, S., Cheng, Y., Wang, W., Liu, Y., and Chen, T. (2020). Learning to detect malicious clients for robust federated learning.
Li, T., Hu, S., Beirami, A., and Smith, V. (2021). Ditto: Fair and robust federated learning through personalization.
Mansour, Y., Mohri, M., Ro, J., and Suresh, A. T. (2020). Three approaches for personalization with applications to federated learning. arXiv preprint arXiv:2002.10619
Marfog, O., Neglia, G., Bellet, A., Kameni, L.,, and Vidal, (2021). Federated multi-task learning under mixture of distributions. Advances in Neural Information Processing Systems, 34:15434- 15447.
McMahan, B., Moore, E., Ramage, D., Hampson, S., and Arcas, B. A. y. (2017). Communication- Efficient Learning of Deep Networks from Decentralized Data. In Singh, A. and Zhu, J., editors, Proceedings of the 20th International Conference Artificial Intelligence and Staristics, volume 54 of Proceedings of Machine Learning Research, pages 1273-1282. PMLR.
Mishchenko, K., Islamov, R., Gorbunov, E., and Horváth, (2023). Partially personalized federated learning: Breaking the curse of data heterogeneity.
Mohri, M., Rostamizadeh, A., and Talwalkar, A. (2018). Foundations of machine learning.
Sattler, F., Müller, K.-R., and Samek, W. (2020). Clustered federated learning: Model-agnostic distributed multitask optimization under privacy constraints. IEEE transactions on neural networks and learning systems, 32(8):3710-3722
Sriperumbudur, B. K. Fukumizu, K., Gretton, A., Scholkopf, B., and Lanckriet, G. R. G. (2009). On integral probability metrics, d-divergences and binary classification. arXiv: Information Theory.
Stich, S. U. (2018). Local sgd converges fast and communicates little. International Conference on Learning Representations.
Vanhaesebrouck, P., Bellet, A., and Tommasi, M. (2017). Decentralized Collaborative Learning of Personalized Models over Networks. In Singh, A. and Zhu, J., editors, Proceedings of the 20th International Conference on Artificial Intelligence and Statistics, volume 54 of Proceedings of Machine Learning Research, pages 509-517. PMLR.
Vidyasagar, M. (2003). Kapnik-Chervomenkis Pseudo- and Fat-Shattering Dimensions, pages 115- 147. Springer London, London.
Werner, M., He, L.,, Karimireddy, S. P., Jordan, M., and Jaggi, M. (2023). Provably personalized and robust federated learning.
WU, (2017). Lecture notes on information-theoree methods for high-dimensional statistics. Lecture Notes for ECE598YW (UIUC), 16.

---

Yin, D., Chen, Y., Kannan, R., and Bartlett, P. (2018). Byzantine robust distributed learning: Towards optimal statistical rates. In Dy, and Krause, A., editors, Proceedings of the 35th International Conference on Machine Learning, volume 80 of Proceedings of Machine Learning Research, pages 5650-5659. PMLR.
Zhu, B., Wang, L., Pang. Q. Wang, S., Jiao, J., Song, D., and Jordan, M. I. (2023). Byzantine- robust federated learning with optimal statistical rates. In International Conference Artificial Intelligence and Statistics, pages 3151-3178. PMLR.
12

---

A Related Work
Personalized federated learning. As federated learning methods are typically challenged by data heterogeneity (Kairouz et al.] [021], many personalization methods have recently been proposed to learn different models tailored for each client. first category of personalized learning algorithms is based upon local fine-tuning (Fallah et al. 2020, Dinh et al., 2020), where the goal is to collab- oratively find a good global model from which local fine-tuning can result in an improved local performance. A second category of personalized algorithms is based upon regularization between local models (Li et al., 2021 Kundu et al., 2022), i.c., adding a regularization term penalizing a distance between local client models. Another line of research in personalized federated learning considers partial personalization where the parameters are split into globally shared and individual local parameters (Bietti et al. 2022 Mishchenko et al. 2023), this, however, creates the additional challenge of choosing this split. Personalization can also be implemented through clustering methods, where participants selectively collaborate with smaller subset of clients limit their exposure to heterogeneity (Ghosh et al.] 2020; Werner et al.] [2023] Bao et al.) 2023). (Mansour et al.] (020) proposed and analyzed three different interpolation methods to formalize personalization, including the one we consider in this paper, which they refer to as data interpolation. Although they discuss the generalization properties of this model, they do not address Byzantine robustness.
Personalization for Byzantine robustness. A few works in the personalized learning literature suggest that personalization can improve the robustness to Byzantine participants (Li et al. 1 2022; Mishchenko et al. 2023). These works however only present a limited theoretical work, the theoretical results in (Li et al.) (02T) only cover linear regression and random Gaussian noise attacks. Moreover, the results of (Mishchenko et al.) 2023) concerning Byzantine robustness make very strong assumptions on the heterogeneity of loss functions, essentially assuming that they share a common minimum. which largely mitigates the effect of Byzantine adversaries on the optimization error (Allouah et al.. 2024). Both (Kundu et al., [022] Mishchenko et al. (202)) only analyze the optimization error and do not study the general izaatinn error, which we showcase important part of the trade-off.
Kundu et al.
analysis in the general Byzantine context. For instance, contrary
B Definitions
B.1 Strong Convexity
close, but weaker version of strong convexity the Polyak-LLojasieviez condition defined below: (PL)). function L Rd IR is said satisfy Tolyak-Lojasiewicz
Definition 2
with parameter μ., noted y-PL if Ve e Rd:
1 [
((x) inf L S
(10)
Rd
24
If a function L is p-strongly convex, it satisfies Jt-L condition. Indeed p-strongly convex function satisfies:
1 I1 v/1 (VC(y), y\ s L(x) C(y).
(11)
Thus, Pt.PL can be obtained from the above by minimizing each side with respect to x.
B.2 Discrepancy
For the 0-1 loss, let du be defined as follows:
dx(D, = 2 sup (P((( - (D)(()))) heH
(12)
where I(h) = fx: h(x)= 1}.
Define the symmetric difference hypothesis space HAH (M(x) @ M(+)) h,,1 H. Then following (Blitzer et al., 2007), dHAH satisfies 7
For general losses, we define the following discrepancy:
13

---

(Di, D2) = max ED, (()()),)) - ((,x(((())))))
hEH
C
Proofs
C.1 Proof of Mean Point Estimation
Proposition 1. Consider the mean estimation setting described. For any E C, let y be as defined in 5 with an aggregation rule F that satisfies (f, k)) roobustnesss Then the following holds true:
111l- S (11
(1- n n--
1 r'T(A, x) + 3A2 - -Tcll + xd²).
with The == n-y EiecHe A? n liks Fell. and and [(), = x²(x+1) 22+ n-f-1
Proof. We can bound the error follows:
E [llA* psll3] = E [[(1 A) -a) + A(Te- - Mc) + MIe 1b) + X(R 122
SE [I(c \) 14) A(TC uc)1 + + [[] R - Tel + 13311116
mill
(13)
where, for the second line we use the triangle inequality and the fact that (a+b+c)3 for all a, 6, 2 O.
Upper-bounding the first term. The first term can be simplified as follows:
|| (1- ++ 2 (Ti - uu)
27
[[111 - A) - mc) + A(yc - -cell
=E
+
C
-
m4)
jzz
Because the data points sampled independently for each client, have that
E [111 () u4) + A -cc]l
(1 1-
A C
E |
mill3]
E
Σ
13)
ccp
Because the data points are sampled i.i.d. each client local distributing and independently for each client, we also have
[[(1 - A) - (4) + A(JC- uc)l = (11 1-11- x
X
110 - Hill"]
X
|1 - -1,01
+
C
|C72
- x +
CC|
A
E
[lV- -
||v-vel1" 11:11
+
|c12
X2
Σ
E
D
|11e-14 11/17
J
-11->+
1
2
X²(1C- - 1)
[2)
1
m
[| m4 m=] =o, = o² for all i i [n].
Where the last line comes from the fact that Ey-Diij
Upper-bounding the second term. The second term can be controlled by the rooboustsss property of F as follows
14

---

B
|
Tell]]
= A² |F .... Fm)
Jel
2
x2
K
E
[
Te
11
|C|
REC
Then using similar arguments as for the first term we have
E
ycl
|
E
11 Mi + (wi pc) + pe wel
11 μ + pe [el
+ I1ke
Hell
(1 cc
E
(ūi mi)
(eg
5z3)
+ llle ucll
|C|
(1(1
12
E
1
(0: 141)
+E
1
Σ
(eg
fi)
llss pell
[c]
CCI
jti
2 a² +
(1C)
1)
0²
+
|1:4 /c 1
[C]
C
m
(IC)
1)
a²
+
|
Mc 11
|c|
m
Substituting this in the above we get
X 2 R
Tcll
& xd²
(11-
1
2
+
(IC)
σ²
Σ
llms - Hcll
[C]
|e|
CC|
jEC
C
x
KA²
pc
ll
C
m
jEC
Conclusion. By substituting the above in
get the following.
Ellby 1al13s $3 <
C -
xA?
(1 (1- x+
X2(1C- -
0²
|C|
[C]
1CB2
m
(14)
+ 33> ||:
Hell2 11 +3
Σ
1|m
Hell
IC|
jEC
Using the notation 2 = 1/ Ejec [|k mell? we get
El|luA 1 53
C (k C
-
1) +1
10-1
0²
+
3X - Fell + xZ2).
[C]
m
C.2 Proof of Lemma
Lemma 1. Let assumptions 2 and 3 hold. Consider Algorithm with learning rate = 1
A [0, 11, and assume the aggregation function F' to be (f, x))-rousst. For any T 1, we have: 27.
(0 C. 5L22
+ (1
11
L
Lo.
112
2L
p
where Lo = (0!) Cr and C22, == min (0).
DE0
15

---

Proof. Let assumptions and hold. First, we note that L² is L-smooth (and p-strongly convex) as a convex combination of L; and Lc, which are both L-smooth (and p-strongly convex) by Assumption| []] In the remainder of this proof, we denote by 0 the minimizer of L on θ i.e. (0)) = fi Recall also that, by Assumption 07 is also critical point of C..
Lett t E (O..... T - 1} and denote E == R V Le (0f). We rewrite the update step as follows:
0,+1 = ll (0: - - ((1 - (O)) + )R - 1l (0: - 7 ( + A - -
(oe())))
Since the Euclidean projection operator IIg is non-expansive, and 8:² θ by definition, we have 1 0/11 - ||0: 0: n (V)) + xς)) 112.
(15)
By developing the right-hand side (T5) and using Jensen's inequality, we get
|10|+1 071 12 S 100 - 0: - 2// 0 0: vC>(0) - 2n ( 0: 0. xe!
+ + 111 + Ac
- |00 - 11 - 2n 0 0. vC (0)) - 2n ( 00 0. Xe,
+ 2n V VC + 21j² x² 114:112
Furthermore, by Assumption 3 we know that 0% is a critical point of C (Assumption 1. hence using the L-smooth of L. we have
(0) - 22(2 - C. Moreover, since C. is p-strongly
convex (Assumption 1. we have
(0% - 0, V2A(0)) (0) -,,, + $100 02 11 Substituting
these in the above yields
|10 8/1 112 S 100 0,112 - 2n( - -(,,) - 1 - 0:112
2n 0 0C >x)) + 4n [L - (2,,) 2n7 2 1912
Given that 1) zI. we can simplify this inequality as follows,
110 0: 12 S 10: 0:12 nul10 0: 1| -2n 01: 0₁ xe:) ~
We now use Young's inequality on scalar product to get - (0: 04, AEt) s $110 02112
1 22 le Substituting these in the above yields
10t+1 1212 = 110] 0:112 mul 00 0:11 + 17 2
11 110 0111 + t 1
8 + > ||&:|| + +2n
$ (1 / 100 1:12 + X2
(n
" + 2n² ||5.112
8
Substituting 1 1 2L in the above, and using the fact that L 2 nt, we obtain
1
110 - 0 (1 (1-))(1))0001001 100
10 -11
X2
|| < (1- 4
2T.) 10 - 00,12 + +x2= 5
ut. 11:
H.
2T,
By (f, kt) robuutnesss of F, and Assumption 2 we have RG². Hence, we get
|| <
N. [c|
Eiec [V,) - Co)())
1100+1 - 18\132 S (1-
110 )
87 1|
X2 5 μL
R02
Recursively using the above, we get
1100 031125 v Σ (1
1
k
+
(1
H
1+1
-0111
(16)
2L
2L
x02
/
t+1
11000
02122.
(17)
n22
2L
Combining Assumption [and Assumption
3 we easily get that 111 - 0:11 10122 < c² - C2, S
110 -0 0,12 for all e O Using this, and specializing (66 for = T - 1, we have
12(0'') - C.2 kL
(1-
#
T
L (C) C,
122
2L
16

---

C.3 Proof of Lemma
2
We start by reminding Hoeffding inequality:
Lemma 3 (Hoeffding inequality). If Xi...., X are real-valued independent random variables,
each almost surely belonging to interval (as, bi), then the sum SN
' X, satisfies
sE[M]
-2
P[[SN E[SN]] 2 S exx
(18)
Σ iE[N]
(b; a,)²
Back to problem:
Lemma 2. Let Assumption 4 hold. For any ô > 0, E θ and X E [0, 1]. we have with probability at least 1 (over the choice of samples) that
1 (1-X+ n-8
X m(n - f)
C2(0) (0)
m
where R2(0)= E()) V0 θ. and B (d) log
+ Vlog(1/o).
Palm (H)
Proof.
(² = -1- - (0),(0) + ACc(O)
= (1 - A)
Σ
((holo))2))
+
Σ
Σ
((ha(z).))
[C]
(a..))S
JEC
(2.1)SS
1 x c )
Σ
((ho(z))))
+t
Σ
((ho(0))0))
m
C
m
(x,y)ES
jEC jti
(x,
1
Σ
|Cl
x+ 1 (1-
A ((ha(z),v) Σ
Σ
Ae(ho(x).n)
m [C|
[e]
jEC (a.v)ES; jyi
(19)
Let us now consider the set of m |C| real-valued independen [[c((- ( ((ha(x), v) (z,v) E S U (Ae(ho(z).)) y) (a, Sj. * i}. As per As- sumption we know that takes its values in [o. 1]. hence this set is composed of m random variables with values in (o, |C] - A [+]] and (IC) 1)m others with values [0, A]. Finally, note that by definition (0)] = (0). Where the expectation is taken over the independent sampling of the local data sets (St)tec from the local data distribution of the correct clients. Thus using Hoeffding inequality, get
6 random variables defined as
2m E2
IP (1
(0) 2exp
(20)
(1-
cpp + (121-1)>2
"The data sets have been sampled independently of each other and are composed of points sampled i.id from the local data distributions.
17

---

By using the change of variables
(1-X+ 2 - we can use the Pseudo-dimension
cc|a
union bound (e.g. Theorem 11.8 from Mohri et al. 2018 to get that with probability at least 1 6, vo
2
1- x (1
X2(1C| -1) 1)
(v (Pdim(H)
(0) ((O0 2
log log
vlog(1/8)
mlcp
Pdim
m
x +
m(n - f) (V
X2
$ 21
Pdim((H) log
1og(118)
Pdim(H))
m
C.4 Proof of Theorem
hoold and let & be a function such that 7 holds. Consider Algorithm 7 with learning rate 2D X E j0, 1], and assume the aggregation function F to be
Theorem Let assumptions 7
(robu.. Then, for any 8 0, T
1, we have with probability at least (over the choice of
samples) that
R((0))-R,(01) S
1
L
Lo
5LA²KG²
+ +2A0(D,,
2L
4
(8)
+
X
+ +48
m(n
f)
where B
Pdim(H) log
em Pdim(H))
Vlog(1/0) and C,,,, == min ()).
dE0
Proof. In order to control the quantity R,(0)) R,());) we can write:
R,(0)) (0,) (R) - R0))
(1)
+R²(0') (0))
(2)
+C)(00) <²(02²)
(3)
(21)
+L) C²
(4)
+C) R, (0
(5)
+R,(0,,) - (0,)
(6),
where 07 is the minimizer in θ the empirical objective function C,,, which we assume is strongly convex.
For lines 1 and 6, we use the property of our loss function described in to write
(1) (6) x - (Rc(( (0,) < 2D, Dc).
(22)
For lines and 5, since Assumption holds true, we can use the results from Lemma 3 = Pdim(?) log(2m (CI) log(4/5). By applying Lemma with 5/2 for both (2) and get that with probability least 6:
Let
we
2 [2
1
1
2 1) m
(2) + (5) < 48
(23)
m
18

---

For line 3, recall that assumptions and that 17
27 and that F is assumed to be (f. K) robust.
1
Hence, Lemma Toolds true. we use 16 In the proof of Lemma to get
2 R
(1-
1 2T, 1
(2)
112
For line 4, we can simply disregard it as (4) contributes a negative amount to the inequality. Finally, combining all the above incqualities we get
5LA² R.(00) - (R,
(1
c
X²(IC) 1)
+ 2X,( Dc) + +43
1
m
m
C
(24)
(1
11 (6.) - L3 (2.))
2L
We conclude by substituting [C] =
C.5 Proof of P
Equation
Pdim(H)
D(D;, Dc)
X ~ [o
LG
Proof. Here, our goal is to reasonably approximate the value of lambda X for which the right-hand side of (24) is minimized. To so, we first ignore the asymptotically negligible terms. Essentially,
1n C. (0.) L. (0+)) is close enough to zero. In the reminder, we denote by 8 the output of Algorithm for T co. Even after ignoring this term, seeking the optimal value X is the solution a 4th degree equation, which may not admit
consider that 7' is large enough that the term (1 # =
close-form solution in general. To make the computation of an approximate minimizer more tractable,
we proceed with the following simplification using the fact that / + b S Va vb for any a, b 2 0:
)
X
- (0,))) ax2 a 2XA De)
je
3
B,
(25)
m
Clvm
with 6LeG² Now the right-hand side is quadratic function of À which can be easily minimized. n² Specifically, the solution of 25
1 C
C 3 ((D,, De) aym Claym
=
1
(26)
Assuming [C] is large enough, we simplify the above as
28
(DD,, De)
X
a' a.m
m
a 4DD,,
(27)
23
(D),,De)) Dc)
m
19

---

D Experimental Details
In this section, we give the implementation details of our experiments for each setting and we provide some additional figures. For all the experiments, we run Algorithm of iterations which we change depending on the dataset.
| with full gradients for number
D.1
Compute
We rum our experiments on a server with the following specifications:
HPe DL.380 Gen10
x Intel(R) Xeon(R) Platinum 8358P CPU @ 2.60GHz
128 GB of RAM
740GB ssd disk
2 Nvidia A10 GPU cards
For most of the experiments, we only use one of the two GPUs.
Using these compute resources, each experiment on the MNIST dataset (meaning each subfigure in Figure b)tttom) took less than 72 hours run. Each experiment on Phishing dataset took less than 8 hours to run.
D.2
MNIST
For the experiments MNIST, use the following Convolutional Neural Network:
Convolutional Layer (1, 32, 5, 1) + ReLU Maxpooling
Convolutional Layer (32, 64, 5, 1) ReLU + Maxpooling
Fully Connected Layer (4096, 1024) + ReLU
Fully Connected Layer (1024, 10)
We use
100 and the learning rate = 0.05.
D.3
Binary MNIST
We some experiments binarized version of the MNSIT dataset, where the task is to output whether or not the MNIST class of the image, which corresponds to a digit between 0 and 9, is strictly smaller than 5.
We 150 and the learning rate r) 0.002.
local
30
1.0 f=
20
0.0
0.2
0.4
0.6
0.8
Figure 3: Effect of Byzantine fraction. Binary MNIST with logistic regression.
256,
20

---

Test accuracy on local datasee
60
60
accuracy
40
40
[=
[= 30
f= 30
f- 60
f- 66
f-
90
A
(a) =1
(b)
Figure 4: Effect of adversarial fraction and heterogeneity. Binary MNSIT dataset with logistic regression. 200, 32.
D.4 Phishing
We use 500 and the learning rate 7) = 0.1.
100
100
100
80
80
80
Test
40
40
20
20
20
Local learning
- Local loaming
Local lcarning
rederated
Robust Rederated
Hobust rederated
2
Figure 5: Local Vs FL performance on local test dataset. Phishing dataset with n = 20, = 3. As the number of local samples increases, the Byzantine fraction threshold above which local learning performs better than Robust Federated Learning gets smaller.
100
100
80
80
Text sccuracy
10.0
de 10.0
d=100
e- 100.0
d= 100.0
d= 100.00.0
(a) f
(b) f - 6
(c) f =9
Figure 6: Effect of adversarial fraction heterogeneity. Phishing dataset with logistic regression. 20, m 128. 100 corresponds practically to the homogeneous case.
21

---

100
160
100
40
0.6
1.0
04
(a) m
16
(b) m
48
(c) m 128
100
100
80
60
f=6
/-
[=
(d)
16
(e) 48
(1) 128
Figure Effect of the adversarial fraction and the data size. Phishing with logistic regression. 20, Auto-FOE attack, (top) 3, (bottom) 10.
22

---

NeurIPS Paper Checklist
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification: Our claims in the abstract and introduction are precise and consistent with our findings.
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made in the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made the paper and important assumptions and limitations. A No or NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.
It is fine to include aspirational goals as motivation long is clear that these goals are not attained by the paper.
2. Limitations
Question:
Does the paper discuss the limitations of the work performed by the authors?
Answer: [Yes]
Justification: We discuss the limitations of our work all throughout the paper (e.g. line 235, footnote (1))
Guidelines:
The answer NA means that the paper has limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create a separate "Limitations" section in their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (c.g.. independence assumptions, noiseless settings, model sell-speciiiaatinn asymptotic approximations only holding locally). ). The authors should reflect on how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g. if the approach was only tested on few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect on the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution low or images are taken in low lighting. Or speech-to-tex system might not be used reliably to provide closed captions for online lectures because it fails handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and faimesss.
While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, a worse outcome might be that reviewers discover limitations that aren't 't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an impor- tant role in developing norms that preserve the integrity of the community, Reviewers will be specifically instructed to not penalize honesty concerning limitations.
3. Theory Assumptions and Proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
23

---

Answer: [Yes]
Justification: For all the propositions and theorems included this paper, we provide mostly self-contained proofs. For some parts of the proofs, refer to some well recognized papers in the literature.
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated or referenced the statement of any theorems.
The proofs can either appear the main paper or the supplemental material, but they appear in the supplemental material, the authors are encouraged to provide short proof sketch to provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proof's provided in appendix supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental Result Reproducibility
Does the paper fully disclose all the information needed to reproduce the main ex- perimental results of the paper to the extent that it affects the main claims and/or conclusions the paper (regardless whether the code and data are provided or not)?
Question:
Answer: [Yes]
Justification: Our experiments are easily reproducible, as the datasets and models being used are open source. We additionally provide whole section in Appendix D detailing our experimental setups (e.g. models being used, number of iterations, learning rates).
Guidelines:
The answer NA means that the paper does not include experiments.
If the paper includes experiments, No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is novel architecture, describing the architecture fully might suffice, or if the contribution is specific model and empirical evaluation, it may be necessary to either make possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way to accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g.. in the case of large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.
While NeurlPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) If the contribution is primarily a new algorithm, the paper should make it clear how to reproduce that algorithm.
(b) the contribution is primarily new model architecture, the paper should describe the architecture clearly and fully.
(c) the contribution is a new model (e.g., a large language model), then there should either be way access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset or instructions for how to construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome describe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (c.g., to registered users), but it should be possible for other researchers to have some path to reproducing verifying the results.
24

---

5. Open access to data and code
Does the paper provide open access to the data and code, with sufficient instruc- tions to faithfully reproduce the main experimental results, as described in supplemental material?
Question:
Answer:[Yes:
Justification: We give open access to code well as clear instructions how to reproduce our experimental results.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurlPS code and data submission guidelines (https://nips.co
mublicc/guide//Ddeeelbnnisssss iossssaoisssoooocccorpoooo for more details.
While we encourage the release of code and data, we understand that this might not be possible, "No" an acceptable answer. Papers cannot be rejected simply for including code, unless this is central to the contribution (e.g., for new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurlPS code and data submission guidelines (https for more details.
//nips //ips.cc//uut ctaplss.ccpubblccguuuucccco guides/ /ttpp///lai/iiiiie//////euuaaaaa
The authors should provide instructions on data access and preparation, including how access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. only subset of experiments are reproducible, they should state which ones are omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information as possible in supplemental material (appended to the paper) recommended, but including URLs to data and code permitted.
6. Experimental Setting/Details
Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Question:
Answer: [Yes]
Justification: We provide a whole section in the Appendix D detailinn our experimental setups (e.g. models being used, number of iterations, learning rates).
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core the paper to a level of detail that is necessary to appreciate the results and make sense of them.
The full details can be provided either with the code, in appendix, as supplemental material.
7. Experiment Statistical Significance
Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Answer:
[Yes]
Justification:
We provide error bars for the experimental figures we show in the paper.
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by enror bars, confi- dence intervals, or statistical significance tests, least for the experiments that support the main claims of the paper.
25

---

The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall run with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
The assumptions made should be given (e.g., Normally distributed errors).
It should be clear whether the error bar is the standard deviation the standard error of the mean.
It is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful not to show in tables figures symmetric error bars that would yield results that are out range (e.g. negative error rates).
If error bars are reported in tables or plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables in the text.
8. Experiments Compute Resources
Question:
For each experiment, does the paper provide sufficient information on the com- puter resources (type of compute workers, memory, time of execution) needed reproduce the experiments?
Answer: [Yes]
Justification:
We include section about compute resources and runtime in Appendix D
Guidelines:
The answer NA means that the paper does not include experiments.
The paper should indicate the type of compute workers CPU or GPU, internal cluster, cloud provider, including relevant memory and storage.
The paper should provide the amount of compute required for each of the individual experimental runs as well estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't make into the paper).
9. Code Of Ethics
Question: Does the research conducted in the paper conform, in every respect, with the NeurlPS Code of Ethics httpns//ttts//t/ttt
Answer: [Yes]
Justification: The research conducted this paper unambiguously respects NeurIPS the Code of Ethics.
Guidelines:
The answer NA means that the authors have not reviewed the NeurlPS Code of Ethics.
If the authors answer No, they should explain the special circumstances that require deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g., there a special consid- eration due to laws regulations in their jurisdiction).
10. Broader Impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [NA]
This work aims advancing the field of distributed machine learning. We discuss the potential positive societal impacts of increasing the robustness to adversarial machines. We do not see any direct negative impacts of our work, which aren't related to machine learning and AI issues in general.
Justification:
26

---

Guidelines:
The answer NA means that there is no societal impact of the work performed.
If the authors answer NA or No. they should explain why their work has societal impact or why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
The conference expects that many papers will be foundational research and not tied partieular applications, let alone deployments. However, if there is direct path any negative applications, the authors should point it out, For example, it is legitimate to point that improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.
If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition attacks, mechanisms for monitoring misuse, mechanisms to monitor how system learns from feedback over time, improving the efficiency and accessibility of MI...
11. Safeguards
Does the paper deseribe safeguards that have been put in place for responsible release of data or models that have a high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Question:
Answer[[NA]
Justification:
The paper poses no such risks.
Guidelines:
The answer NA means that the paper poses such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make best faith effort.
12. Licenses for existing assets
Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?
Answer: [NA]
Justification:
The paper does not use existing assets.
Guidelines:
The answer NA means that the paper does not use existing assets.
The authors should cite the original paper that produced the code package or dataset.
The authors should state which version of the asset used and, possible, include URL.
The name of the license (c.g., CC-BY 4.0) should be included for each asset.
27

---

For scraped data from a particular source (e.g., website). the copyright and terms of service of that souree should be provided.
If assets are released, the license, copyright information, and terms use in the datasets.paperssiii paperswi thcode. www.com//aaaa datasets package should be provided. For popular datasets,
has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.
If this information is not available online, the authors are encouraged to reach out to the asset's s creators.
13. New Assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [NA]
Justification:
The paper does not release new assets.
Guidelines:
The answer NA means that the paper does not release new assets.
Researchers should communicate the details of the dataset/code/mmodel as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent obtained from people whose asset is used.
At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.
14. Crowdsourcing and Research with Human Subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given participants and screenshots, if applicable, as well as details about compensation (if any)?
Answer: [NA]
Justification:
The paper does not involve crowdsourcing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Including this information in the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then as much detail as possible should be included in the main paper.
According to the NeurlPS Code of Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional Review Board (IRB) Approvals or Equivalent for Research with Human Subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?
Answer: [NA]
Justification:
The paper does not involve crowdsoureing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsoureing nor research with human subjects.
28

---

Depending on the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere to the NeurIPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.
29


Reviews:
[{"review_id": "TeKRMZikKJ", "reviewer": "Reviewer_uEJH", "summary": "This paper presents theoretical analysis and experimental validation results of the allowed level of collaboration in personalized FL with the presence of a fraction of Byzantine adversaries.", "questions": "See weakness above.", "limitations": "See weakness above.", "rating": 7, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "+ This paper targets a very important and challenging problem in the personalized FL settings.\n+ The theoretical analysis and results are analytically rigorous and thorough.\n+ The experimental validation results are also comprehensive and well complement with the theoretical analysis.\n+ The results correlating the allowed level of collaboration and the tolerable fraction of adversaries are particularly appreciated.", "weaknesses": "- The experimental validations can still be further improved from multiple aspects. For example, it may not be very convincing by using simulated datasets being generated by simple 1D sampling. The data heterogeneity settings should be more complicated and practical accordingly. More complicated models should also be used.\n- The analysis results only apply to the simple problem of binary classification. What's its generalizability to more practical multi-class classification?", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We thank the reviewer for the positive feedback and constructive comments. We address below the reviewer's comments.\n\n**On the experiments.**\nSince our contribution is mainly theoretical, we provide some experimental results mainly to convey the meaningfulness of our bounds. In Section 2, we restricted our experiments to the 1-dimensional case both for simplicity and scalability reasons. Indeed, with a 1-dimensional dataset, it was possible to consider a large number of clients ($600$) and run these experiments multiple times to obtain meaningful confidence intervals. In Section 3, we used Dirichlet sampling to simulate several heterogeneity levels in the classification case.  We chose this technique, as it is a common method for testing an algorithm with a controlled level of heterogeneity in the Byzantine Learning literature. In fact, we mainly used this technique as it allows to navigate between two important scenarios: i) homogeneity when $\\alpha \\rightarrow \\infty$ and ii) extreme heterogeneity when $\\alpha \\rightarrow 0$.  We agree that in future exploration of our scheme, other heterogeneous data-generating techniques can be used.\n\n**On the generalizability to more practical multi-class classification.**\nOur analysis can be generalized beyond binary classification to all settings covered by the VC dimension or the pseudo-dimension generalization theory, including for instance regression and multi-class classification. We will clarify this in the paper.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "lc118obSV4", "reviewer": "Reviewer_Fsfa", "summary": "This paper considers an FL setting where some clients can be adversarial, and we derive conditions under which full collaboration fails. Specifically, they analyze the generalization performance of an interpolated personalized FL framework in the presence of adversarial clients. The authors claim that they precisely characterize situations when full collaboration performs strictly worse than fine-tuned personalization.", "questions": "In equation 9, when there is less data heterogeneity, \\Psi() ->0 and G ->0, $lambda$  -> 1. Why do we need to collaborate when the data is homogeneous? I think we can train locally to avoid the adversary. \n\nIs assumption 3 necessary? Is it repetitive with Assumption 1?\n\nIs the model only effective for binary classification problems?", "limitations": "Experiments are a bit simple.  Assumptions are strong.", "rating": 5, "confidence": 3, "soundness": 2, "presentation": 3, "contribution": 2, "strengths": "The idea is intuitive and easy to understand. With the presence of adversarial, less collaboration should work better. In addition, this paper proposed a new formulation for personalized FL, combining local loss and global loss.", "weaknesses": "Section 2 doesn't make sense to me. Proposition 2 characterizes the difference between two variables, a local variable $\\mu_i$, and a variable depending on collaboration (y^{\\lambda}). \nThis manuscript only considers deterministic cases. The assumption is strong, such as assumptions 2 and 4. \nThe bound shown in the analysis is loose and the conclusion does not convince me.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We thank the reviewer for the feedback and address the reviewer's questions below.\n\n**On Section 2.**\nWe are not certain what exactly bothers the reviewer in Section 2. Perhaps the relation to the general problem was unclear, in which case the following paragraph might help make it clearer. We will also clarify this further in the paper. \n\nIn Section 2, we consider the special learning problem of personalized mean estimation, which is an instantiation of the general personalized learning problem (3) introduced in the paper. In this problem, for each client $i$, for a sample $y_i$ drawn from a distribution $\\mathcal{D}_i$, the point-wise loss function $\\ell(\\theta, y_i)$ is given by $\\lVert y_i - \\theta \\rVert^2$. \n\nThe local risk function $R_i(\\theta):= \\mathbb{E}_{y_i  \\sim \\mathcal{D}_i} \\lVert y_i - \\theta \\rVert^2$ is minimized at $\\theta^*_i = \\mu_i$, where $\\mu_i$ is the mean of the distribution $\\mathcal{D}_i$. \nConsequently, for any $\\theta$, $R_i(\\theta) - R_i(\\theta^*_i) = \\lVert \\theta - \\mu_i \\rVert^2$ is the distance to the true local distribution mean. One possible candidate for $\\theta$ is the empirical mean of client $i$'s data points (local estimator). Another possibility is the empirical mean of all the aggregated clients' data points (global estimator). In our paper, we analyze a third option which is the $\\lambda$-interpolated estimator. \n\nProposition 1 presents a bound on the error of the latter, i.e., $R_i(\\theta) - R_i(\\theta^*_i) = \\lVert \\theta - \\mu_i \\rVert^2$, for $\\theta = y^{\\lambda}_i$, $y^{\\lambda}_i$ being the solution of the $\\lambda$-interpolated empirical loss minimization problem in this case, defined in (4).\n\n**On the strength of assumptions 2 and 4**\nAssumption 2 is standard in the Byzantine and the Federated Learning literature (e.g., see[1, 4]). Additionally, it is necessary since the absence of this assumption (i.e. G=+$\\infty$) leads to an unbounded error as shown in [1]. Assumption 4 is standard in the learning theory literature (e.g., see [2,3]) and the assumption could be re-defined considering boundedness by some positive parameter instead of $1$ without loss of generality. It could also be replaced by assuming that the loss is Lipschitz since the parameter space is bounded, which is also standard in learning theory.\n\n**Why do we need to collaborate when the data is homogeneous?**\nThis is a very important question indeed. The intuition suggested by our results is twofold. First, if the participants do not have enough data locally, collaborating might be beneficial even in the presence of Byzantine attackers, since otherwise, the model trained on local data can be of poor quality. Second, if the heterogeneity is small enough, the effect of Byzantine players on the training is smaller, since theoretically the accuracy loss due to adversaries is linked to the term $\\frac{f}{n} G^2$.\n\n**Is Assumption 3 necessary? Is it repetitive with Assumption 1?**\nAssumption 3 is not repetitive with Assumption 1. While Assumption 1 ensures Lipschitz smoothness and strong convexity of the loss functions, Assumption 3 ensures that the interior of the parameter search space $\\Theta$ contains a minimizer of the loss functions. These are two separate conditions on the learning problem. \n\n**Is the model only effective for binary classification problems? Can the analysis be extended to the stochastic case?**\n The analysis can be generalized beyond binary classification to all settings covered by the VC dimension or the pseudo-dimension generalization theory,  including regression and multi-class classification. Moreover, the learning guarantees we provide are not deterministic but they already account for the random choice of the training samples, e.g., see Theorem 1. By the stochastic case, does the reviewer mean the stochastic gradient descent-based methods?\n\n\n[1] Allouah, Y., Farhadkhani, S., Guerraoui, R., Gupta, N., Pinot, R., and Stephan, J. (2023). Fixing by mixing: A recipe for optimal byzantine ml under heterogeneity. In International Conference on\nArtificial Intelligence and Statistics, pages 1232–1300. PMLR\n\n[2] Blitzer, J., Crammer, K., Kulesza, A., Pereira, F., and Wortman, J. (2007). Learning bounds for domain adaptation. In Platt, J., Koller, D., Singer, Y., and Roweis, S., editors, Advances in Neural Information Processing Systems, volume 20. Curran Associates, Inc.\n\n[3] Mohri, M., Rostamizadeh, A., and Talwalkar, A. (2018). Foundations of machine learning.\n\n[4] Sai Praneeth Karimireddy, Satyen Kale, Mehryar Mohri, Sashank J. Reddi, Sebastian U. Stich, Ananda Theertha Suresh. SCAFFOLD: Stochastic Controlled Averaging for Federated Learning", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "YRyt2NXHre", "reviewer": "Reviewer_cJWD", "summary": "This paper studies fine-tuning personalization in federated learning (FL) to mitigate the impact of adversarial clients. The authors leverage interpolation techniques for personalization, and they derive the closed-form approximation of the interpolation parameter $\\lambda$. The study comprehensively considers both data heterogeneity and the presence of adversarial clients in the context of tailoring personalized FL.", "questions": "1. For more convincing, the authors should consider other more complicated datasets. \n2. The suggested fine-tuning strategy for personalization necessitates that each client share its gradients with others, which could potentially raise privacy concerns. Moreover, clients might be able to identify adversarial clients through the gradients accumulated during communication.", "limitations": "N/A.", "rating": 5, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "1. The authors consider that fine-tuning personalization in FL can mitigate the impact of adversarial clients, which extends existing Byzantine adversaries in FL. \n2. They derive the closed -form approximation of the interpolation parameter $\\lambda$, which can guide the fine-tuning procedure. \n3. The theoretical analysis is comprehensive.", "weaknesses": "1. The proposed fine-tuning personalization strategy requires each client should broadcast its model. Besides, each client should send the gradients to other clients. This is not efficient and may incur other privacy issues.\n2. The prediction tasks in this paper are simple. \nOther issues:\n1. Then then --> Then the in 142.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We thank the reviewer for the positive feedback and address the reviewer's questions below.\n\n**On the datasets.**\nOur contribution is mainly theoretical, and we provide some experimental results (covering mean estimation, binary, and multi-class classification) to convey the meaningfulness of our bounds. We understand that a more thorough empirical study can be of benefit to the community, but we believe this is out of the scope of this paper and we leave it for future work. \n\n**On non-efficiency and privacy.**\nWe thank the reviewer for this essential point. Privacy is of key importance and, indeed, the proposed algorithm does not address this issue. In this work, we focus on the trade-off between generalization and robustness, which we see as fundamental and essential to answering the question of whether or not to collaborate in the first place. \n\nHowever, recent literature has suggested that personalization can help improve privacy-utility trade-offs in some cases~[1,2]. The frameworks used in these works are different from ours (split-model personalization for the former and multitask learning for the latter), but we believe that an interesting future direction would be to link (one of) these frameworks to ours in order to characterize simultaneously the trilemma of privacy, utility, and robustness. \n\nWe will add the privacy limitation in the paper for more clarity.\n\n\n[1] Bietti, A., Wei, C.-Y., Dudík, M., Langford, J., and Wu, Z. S. (2022). Personalization improves privacy-accuracy tradeoffs in federated learning.\n\n[2] Liu, Ziyu and Hu, Shengyuan and Wu, Zhiwei Steven and Smith, Virginia (2022). On privacy and personalization in cross-silo federated learning. Proceedings of the 36th International Conference on Neural Information Processing Systems.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "O4XHeB1DoM", "reviewer": "Reviewer_Kq44", "summary": "This paper proposes a fundamental validation to understand the relationship between local models and the global model to mitigate the impact of adversarial clients. The level of collaboration needs to be chosen carefully because of the existence of adversarial clients. The theoretical analysis is provided to validate the statement, considering data heterogeneity, the fraction of adversarial clients, and data scarcity. Several simulated and open-source datasets are used to further demonstrate the effectiveness of the method.", "questions": "Refer to Weaknesses.", "limitations": "yes", "rating": 5, "confidence": 3, "soundness": 3, "presentation": 2, "contribution": 3, "strengths": "This paper proposes a simple yet easily applicable method to mitigate Byzantine adversaries in personalized FL, supported by thorough theoretical proof.", "weaknesses": "1. Some typos, such as the missing space behind \"Section 2\" in Line 112.\n2. Although the theoretical proof is thorough, more experiments on different datasets, Byzantine attack methods, and defense methods should be evaluated.\n3. For the simulated datasets in Section 2.2, cross-device (n=600/f=100) is employed, but the experimental validation in Section 3.3 uses cross-silo (n=20/f=0,3,6,9).\n4. The models used for each dataset are not mentioned.\nIn summary, although theoretical proof is provided, the practical applicability of the method has not been sufficiently demonstrated.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We thank the reviewer for the positive feedback and address the reviewer's comments point by point. \n\n1- We thank the reviewer for pointing out the typos. \n\n2- We did use different attacks in our experiments but did not notice any important differences. For the defense, we only considered the most state-of-the-art one (NNM pre-aggregation rule [1] followed by trimmed mean). We will clarify this in the final version of the paper.\n\n3- The reviewer is correct in remarking that our numerical validation experiments cover both cross-device and cross-silo scenarios. We did run a few experiments in the cross-device setting with binary MNIST (Figure 4 in the appendix for instance), and we obtained remarkably similar conclusions (which is intuitive as the bounds dependence on $n$ is not explicit). We merely reported the cross-silo results in the main text as they were more extensive, spanning many heterogeneity levels and data sample sizes. \n\n4- We thank the reviewer for the remark on the models used. In fact, we have provided the models used for each dataset in Appendix D but we understand that this might not be clear from the main text. We will add a reference to this part of the appendix in the experiments figure caption to make that clear.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Meta-review: This paper provides a nice analysis and discussion on the interplay between collaboration, personalization, and adversarial clients in federated learning. The focus is on the theory, with an intuitive special case of mean estimation presented in Section 2 and the full analysis of the generalization bound presented in Section 3. The theoretical findings have been complemented by experiments which show useful insights. The conclusions and avenues of future work have been well-discussed too. As a theory-focused paper, it would be nice if the technical challenges and novelty in the methodology can be explained more.
Decision: Accept (poster)