Parameter Disparities Dissection for Backdoor Defense in Heterogeneous Federated Learning
Authors: Wenke Huang
Mang Ye
Zekun Shi
Guancheng Wan
He Li
Bo Du
Venue: NeurIPS 2024 poster (2024)
Keywords: Federated Learning
Backdoor Attack
Primary area: safety_in_machine_learning

Abstract: Backdoor attacks pose a serious threat to federated systems, where malicious clients optimize on the triggered distribution to mislead the global model towards a predefined target. Existing backdoor defense methods typically require either homogeneous assumption, validation datasets, or client optimization conflicts. In our work, we observe that benign heterogeneous distributions and malicious triggered distributions exhibit distinct parameter importance degrees. We introduce the Fisher Discrepancy Cluster and Rescale (FDCR) method, which utilizes Fisher Information to calculate the degree of parameter importance for local distributions. This allows us to reweight client parameter updates and identify those with large discrepancies as backdoor attackers. Furthermore, we prioritize rescaling important parameters to expedite adaptation to the target distribution, encouraging significant elements to contribute more while diminishing the influence of trivial ones. This approach enables FDCR to handle backdoor attacks in heterogeneous federated learning environments. Empirical results on various heterogeneous federated scenarios under backdoor attacks demonstrate the effectiveness of our method.

Parameter Disparities Dissection for Backdoor Defense in Heterogeneous Federated Learning
Wenke Huang', Mang Yel.2, Zekun Shi', Guancheng Wan', He Li', Bo Du 1 National Engineering Research Center for Multimedia Software, Institute of Artificial Intelligence, Hubei Key Laboratory of Multimedia and Network Communication Engineering, School of Computer Science, Wuhan University, Wuhan, China.
2 Taikang Center for Life and Medical Sciences, Wuhan University, Wuhan, China [wenkehuang, wew.eeeuuunnnmmmmneee.mmm ( edu.cn
com comm/wenkkcunng/DDCC
Abstract
Backdoor attacks pose serious threat to federated systems, where malicious clients optimize on the triggered distribution to mislead the global model towards predefined target. Existing backdoor defense methods typically require either homogeneous assumption, validation datasets, or client optimization conflicts. In our work, observe that benign heterogeneous distributions and malicious triggered distributions exhibit distinct parameter importance degrees. We introduce the Fisher Discrepancy Cluster and Rescale (FDCR) method, which utilizes Fisher Information to calculate the degree of parameter importance for local distributions. reweight client parameter updates and identify those with large
This allows discrepancies as backdoor attackers. Furthermore, we prioritize rescaling important parameters to expedite adaptation the target distribution, encouraging significant elements to contribute more while diminishing the influence trivial ones. This approach enables FDCR handle backdoor attacks heterogeneous federated learning environments. Empirical results on various heterogeneous federated scenarios under backdoor attacks demonstrate the effectiveness of our method.
Introduction
Federated learning is an emerging collaboration learning technique allows multiple participants to perform local optimization on its own data and exchanges model This federation paradigm does not require to
119
50
35
which
parameters with a central server 667 54 5T
22 28
aggregate the distributed data and obey the privacy protocol [66] 95| 73 And the problems that
come with this approach is that the central server fails capture the client training behavior and is
vulnerable to the backdoor attacks [23
[10] Specifically, the evils clients makes normal predictions on benign samples and outputs the pre-defined target when the input contains a specific pattern trigger [89
13
58
24
56
98 52]. Thus, the federated model would be implanted with the backdoor trigger pattern, which largely threatens the federated robustness. argue that conducting the backdoor defense to erase the backdoor effect is vital for the federated reliability in the real-world application.
38
Driven by the serious backdoor attack, existing defense solutions could be mainly categorized into four types: Distance Difference Defense 66 21
27 18, Statistics Distribution 101 and Client Side Defense The former two groups focus on detecting and mitigating malicious attack
93
10
10
118
Defense 112 25
79
117,
9 Proxy Evaluation Defense 48
104
123
166
75
*Corresponding author.
38th Conference on Neural Information Processing Systems (NcurIPS 2024).

---

based on calculating individual distance differences or overall statistical characteristies to detect the outlier behavior. However, these two forms struggle to work under the data heterogeneous federation, where distributed data presents non-III (independently identically distribution) and local optimization directions are dramatically distinct from each other. Therefore, they normally require the data homogeneous assumption for realistic settings. As regards the Proxy Evaluation Defense, they utilize the additional validation datasets with the same semantics for the ensemble distillation [87]. prediction marginal contribution [102), and prediction confidence [8 74). Therefore, the qualified proxy dataset acts as a prerequisite to its feasibility and poses a huge collection obstacle in challenging scenarios, e.g., medical applications [78] and financial markets [120] Towards the
Client Side Defense, it designs the client-wise regularization term to control the client updating direction such unlearning and smoothing theory
[T04] I]. Hessian matrix [13], and meta- meta-learning 77 However, a strong assumption is that clients are willing to obey specific regularization terms and face client optimization conflict with existing federated optimization strategies e-g., FedProx 544 MOON [51], and FPL [34). Moreover, they fail to resist adaptive attack, where evils refuse to faithfully conduct the specific strategies.
Motivated by the aforementioned discus- sions, we are curious to rethink the Achilles heel of what malicious attack brings to fed- erated learning systems. We assume the ker- nel target for malicious defense is to dis- criminate between benign and malicious dis- tributions. Own to the over weee-paraeteriieed characteristics of the deep neural network 26 45), we notice that not all parameters contribute equally to fit the target dis- tribution, which has confirmed soundable in the relative researches, g., sparse and pruning strategies [49 20 60 90
10
544
0.2
02
03
02 0.
03
03010
62
9.2
14
02
0.
01
0.2
02 0.1
0.1
02
10
63
244
0.0
0.1
0.3
05 0.5
0.2
0.3
0.
0.2
0.1
0.1
0.1
02 0.2
9.2
0.4
04
62
0.1
0.2
01 6.1
81
61
0.1 6.1
0.1
0.1
0.1 6.2
0.1 02
01
Paramater Index
Figure 1: Motivation. Client parameter importance degree similarity (Left) shows difference between benign and ma- licious groups. The parameter important value distribution (Right) reveals that henign and malicious highlight different cl- ements. Experiments are conducted the Cifar- 10 (3 0.5) with three backdoor and seven benign clients. cious distributions share distinct parameter importance degree, as confirmed in Fig. L
88 [13].
Therefore, we argue that benign and mali-
In our work, we introduce simple yet effective Fisher Discrepancy Cluster and Recale, abbreviated as FDCR to enhance backdoor defense ability from both client selection and parameter aggregation aspects. Preliminary, we take inspiration from the success of Fisher Information Matrix (FIM)
19 2). which identifies the parameters information content by accessing the loss surface sharpness 69] Thus, we estimate the importance of client parameters using the Fisher Information Matrix FIM on the corresponding local distribution. First, we introduce the Fisher Client Discrepancy Cluster (FCDC) to quantify the client gradient discrepancy via respective parameter importance. Clients with substantial gradient divergences are flagged as potentially malicious and excluded from the aggregation process. To be precise, After client optimization, we collect updated gradients along with their respective parameter importance, which adjusts the weight of the uploaded gradients with the expectation to accentuate crucial element updates and weaken trivial ones for the local distri- bution. Subsequently, we cluster the gradient updates discrepancy, identifying clients with notable discrepancies as potentially malicious. Second, we argue that during the parameter aggregation, each parameter element is allocated equal attention, which ignores the fact that parameters behave with different importance towards the target distribution. Then, we propose the Fisher Parameter Rescale Aggregation (FPRA) to rescale the element updates based on the assessed parameter importance. We argue that allocating high updating rangeability for those important parameters would increase the optimization stage and potentially weaken the trivial elements effect. For thorough examination, we conduct experiments on various heterogencous federated scenarios 433 46, [03], with various malicious defense solutions under the backdoor attacks [16] 84] Experimental results reveal that ours consistently achieves stronger robustness than others. The main contributions are summarized as:
76
41
We focus on mitigating backdoor attacks in heterogeneous federated learning. Existing solutions rely on different assumptions, i.e., data homogeneity, validated samples, and faithful optimization. It motivates us to rethink the kernel behavior difference between benign and malicious clients.
* We posit that benign heterogeneous and malicious triggered distributions assign different levels of importance to parameters. To address this, we introduce the Fisher Discrepancy Cluster and Recale (FDCR), which quantifies client gradient discrepancies based on the respective parameter importance,

---

effectively identifying and excluding malicious participants. Additionally, we prioritize important parameter elements enhance the optimization speed, while weakening trivial ones.
We conduct experiments on different federated heterogeneous scenarios: Cifar- 10, Mashion-MNIST,
USPS, under backdoor attacks,. With ablation studies, we validate the efficacy of FDCR and the indispensability of essential modules in different setting.
2 Related Work
2.1 Federated Learning with Data Heterogeneity
Federated learning has aroused widespread interest in achieving multiple-pant -arty collaboration under security-sensitte settings [63 [I]] However, its performance limited by the distributed data,
which poses non-independent and identically distribution (called data heterogeneity) [119 53 96 28
Derived from the milestone methodology, FedAvg [67], a growing body of literature has been devoted
to rectifying the local drift caused by the data heterogeneity. Typical works mainly leverage the global
signals such as shared model [86]
[54]]]]]] 51 47 106 97]. statistical distribution [61,
122
70
34
91 192), and gradient collection [39 (2) Some focus self regularization [55]
114
115
68
85
32
to calibrate the biased updating direction. However, existing federated optimization methods focus
on calibrating the client optimization objective to acquire well-performing global model under the assumption of trustworthy clients. Thus, they fail to establish a defense against backdoor attacks
In work, we consider the client parameter importance difference and argue that malicious clients focus
and their effectiveness can be arbitrarily manipulated by malicious clients (29 5 89 [09]
on fitting a largely different distribution and thus appear the different parameter important attitude. Our method is orthogonal with the above methods and is plug-and-fly to collaborate with them to improve the robustness under heterogeneous federated learning.
2.2 Backdoor Defense in Federated Learning
Malicious backdoor attackers bring serious threats to the federation system. To deal with backdoor attackers, existing Backdoor Defense solutions could be basically classified into four categories:
i) Distance Difference Defense 66 221119 IO IO [18 27
18 33 mainly focus on distinguishing benign clients from malicious attackers via the local party updates difference and regard those significantly far from the overall direction as evils, excluded from the aggregation process. For instance, Multi Krum (6) selects the candidate gradient that the closest to its neighboring clients. DnC (33) leverages singular value decomposition braoe based spectral methods for outliers detection
and removal. ii) Statistics Distribution Defense [112] 25 79 117 9 construct diverse statistical criteria to select and remove the evil clients. RFA [79 calculates the geometric median with an alternating minimization function. FLDetector 117 considers the historical client updates and votes for those with large discrepancies between the predicted and received client updates as attackers. Despite these advantages, the above two streams are sensitive to the degree of data heterogeneity and require complicated hyper-paramettr configurations to adapt to various heterogeneous federated scenarios. iii) Proxy Evaluation Defense turn to seek help from the relative proxy datasets to conduct additional evaluation 8 74 Specifically, FL.Trstt [ collects clean small training dataset and thus introduces Relu-clipped cosine similarity to allocate high trust scores for those reliable clients. However, the central server faces the qualified dataset collection burden, which hampers their practicability. iv) Client Side Defense [104] [23] 116 [5) proposes the client-side defense based on different optimization targets, e.g., clipping and smoothing operations [T04] However, these approaches necessitate that clients adhere to specific optimization regularization, rendering them vulnerable under adaptive tasks. Overall, current defense solutions demand one or more of the following: specialized hyper-paramett configuration, accessible supplementary datasets, or uniform regularization strategies. In our research, driven by the distinct characteristics of deep neural networks, we contend that parameters exhibit varied levels of importance relative to the target distribution. Therefore, we maintain that substantial parameter importance difference between benign and malicious distributions acts detection signal for evils.
3

---

3 Methodology
3.1 Preliminary
Following the general federated paradigm [67 54 511, multiple clients collaboratively learn shared global model W. For a federated system, there are K clients (indexed by k) with the corresponding private dataset, D₁- = {a yi J where N₂ means the private data number for the k client. At the beginning of the t communication, we denote the current global model as w². Then the partiiaapphihii optimization to the local distribution. Then each client uploads the optimized parameter back to the server for parameter aggregation:
central server broadcasts w' to each participant as w < w'. Participating clients conduct the local
Ce(wE, Da) = NE
1
Σ LCE(TI, Vi),
(1a)
E:EDN
w - Convi(as= = Nu N
(1b)
N - Ne denotes the overall client data scale. & denotes the query sample. on denotes the pre-defined aggregation weight based on the data scale. However, some malicious clients
would deliberately implant the trigger into the victim models by poisoning the training dataset
37 199. Specifically, we define & as the trigger pattern and ı as the trigger location mask. The modified backdoor instance is represented as { (ž, 7). For T. we apply the formula = (1 - m) @ x + m O Q. incorporating the trigger pattern & into the original instance æ at locations specified by the mask m. We then alter the original label y to the predefined attack target Consequently, this necessitates a reformulation of the original local direction as outlined in Eq. (la).
23 13
94
57
Cx Dx)= |Dal
Σ
Loe(x, y) + Σ
Loe(E, D)
C
EEDx Backdoor
3.2 Fisher Discrepancy Cluster and Recale
3.2.1 Motivation
To motivate our method, we first introduce one crucial observation of the relationship between benign and malicious clients, shown in Eqs. (Ta) and (2). It reveals that benign and malicious fit the distinct distributions and naturally hold different parameter importance attitudes. Thus, in our work, we now turn designing a strategy that can measure the parameter importance degree for each client. One effective way to measure the parameter importance is to consider how much changing the parameter will change the model output. We denote ply|e, w) as the output distribution over y produced by parameterized model w E gl"l, given input æ. One way to measure how much change in parameters would change model prediction is to compute KL Divergence, K LL(ppy z w)l [p(]] (r, w + d)) [44], where 5 E Rlll is a small perturbation. As confirmed in [64 777. divergence by its second-order Taylor series as follows:
we can approximate the KL
(3) where O(52) is short-hand to mean terms that are order 3 higher in the entries of 6. Fw E R| is the Fisher Information Matrix (FIM) 119, which quantifies the information carried by the observable random variable about the unknown parameters w on the target distribution D and formulated as the following expression:
Lx ((pull, w)llp(vlx,, w 5)) _ 8 F.0
(4) Given this relation, can be seen that the FIM is closely connected how much each parameter affects the model predictions, which has been widely used in different fields 41 86
Fu Eu-p(ar [E, log ~ p-ply, zz w) (V log ply|z, w))²
59
65 12T
8T 107. However, due the eeeetearamttrrize network, the computation of Fisher information is
unacceptable, i.e., F.. E IR #|x[=| To save the computational effort, Fisher Information Matrix could
be approximated as the diagonal matrix, i.e., F., gl||, Furthermore, considering the expectation in Eq. (4). it is hard to draw sample æ ~ p(x) in most tasks, We approximate it by sampling over N training samples within the dataset D as follows:
(5) This approximation carries an intuitive explanation: A query element F.. corresponds to the average squared gradient of the output concerning particular parameter. If a parameter significantly
Fw (D) V Vog p(ylæ, w)2 R

---

influences the model output, its respective value in Fw will be sizable. Consequently, we can interpret Fur as measure of the relative importance of each parameter.
3.2.2 Fisher Client Discrepancy Cluster
From the Eq. 5 the Fu (D) quantifies the degree of importance of the parameter for the target data distribution D. Consequently, for each client in the federated system, we compute the parameter importance their local data distribution D2 via privately optimized model w Additionally, we observe that the Fisher Information Matrix (FIM) does not remain within a fixed range, potentially leading to instability in the importance metrics across participants. To address this, we apply the min-max normalization to provide a stable description client parameter importance as follows: Fug (Dx) min wt (Dx))
Is
max(F (D+)) min(F (Dt)) E ER!!!
(6)
Then, the central server would collect the optimized model wy from different clients. The updated gradient for the client & could be denoted as follows:
(wi w //n R!"l
where 7) denotes the default local learning rate. Therefore, we reweight the client gradient update to highlight the parameter update with the parameter importance degree. I& in Eq. (6) as:
gi g @ Iz.
(8)
Then the aggregated global gradient update could be derived as the following form. Then, we measure the gradient update difference between the aggregated global with each client view.
Σ
Dk.
(9a)
N
V& Σ
(9b)
Intuitively, VE measures the gradient difference between the global and client aspects. We propose that malicious clients tailor their models to distribution that has been artificially manipulated and consequently demonstrate large discrepancy gradient updates compared to the global aggregation. Hence, clients with pronounced disparities in their gradient updates may be indicative of malicious intent. To methodically identify such outliers, we employ unsupervised clustering to segregate the evil effect and provide detailed comparison of popular clustering solutions in Tab. We illustrate the process with five participating clients and the last two are evils: V =VV,, V2, Va, Va, Va]
Cluster
V1 V
+
V42
V.
(10)
=[
VI, V2. V/3
Va. V/
3
"eenign"
We mitigate the malicious effect during the aggregation and rescale the default parameter aggregation weight a in Eq. (Tb) as the following formulation.
C11
CV2
0,0
(o
02 03)
(11)
O
OF
O:B
3.2.3 Fisher Parameter Reseale Aggregation
Furthermore, we notice that normal parameter aggregation treats all elements equally, failing to recognize their differing impacts on the target distribution. To rectify this limitation, our approach introduces the Fisher Parameter Rescale Aggregation (FPRA), designed emphasize the parameter elements that are deemed more crucial during the aggregation phase. To be precise, we adjust the scaling of each parameter element value change, based on importance measurement I₃ derived from the client parameters. Additionally, to ensure that the I, falls within a practical range for rescaling operation, we apply the sigmoid function to convert each parameter importance element E the following formulation:
5

---

Fh. exp( Ix,e)
x
(Ia,v [0, 1),
(12)
el1.ffe)
04 w²
7
Then, based on the rescaled client parameters tt in Eq. 12 and the reallocated aggregation weight â in Eq. (11), acquire the aggregated global parameter w Σ 0i off. Furthermore, provide the detailed description the Algorithm
Algorithm 1: FDCR
Input: Communication rounds participant scale K, hth client private model wi and local data De Output: final global model
for 2,,, do Participant Side;
for 1, 2,.; K in parallel do
w <- LocalUpdating(= Dx) Each client optimizes private data
Is + ( Dx) via Eqs. and Calculate parameter importance degree
end
Server Side; w FDCR ([wk) (Te (Te) (
end
FDCR (fw JR-11 &Ix 1 w²): for
2..., K in parallel do
9 (w) w²)/n
94 oi o Ix // Reweight the client gradient updates
end
g = Σ. aagl
V (g', (9k) [ through Eg. 19b Measure the gradient difference
< (V.a) by Eqs. (10 and 11
Cluster reallocate aggregation weight
w (w' Ix) with Eq. 12 // Rescale client parameter updates
return w²t ++1 >n on W
3.3 Discussion and Limitation
Relation wit Fisher Information Matrix Exploration. Fisher Information Matrix (FIM) has attracted wide interest in measuring the parameter weight importance [40 64 36). For example, in the continual learning field, [1 59 69] measures the parameter stiffness based on the historical distribution to alleviate prediction performance degradation the previous classes. Besides, FIM is also utilized to boost the invariance representation [71] 81 [21 for domain generalization. As for federated learning, [107] argues that the initial learning phase plays critical role in the federation, and [86] protects important parameters to enhance the federated generalization. Thus, existing works all focus ranking the parameter importance for the target distribution. But in work, we focus on the backdoor attack in heterogeneous federated learning and argue that backdoor attackers deliberately overfit the triggered distribution. Therefore, the backdoored model appears large parameter discrepancy with the benign client distribution. We measure the client parameter importance to reweight the client gradient updates, highlighting those clients with similar important distributions and excluding those with divergent ones.
Clustering in FCDC Eq. (10) Clustering strategies have been introduced to discover natural 62 B
grouping property among samples [4
iteratively assigns points to fixed group number. DBSCAN 15 requires pre-define distance value. However, they are sensitive to syper-paramete selection under different scenarios. Then, we utilize the FINCH (2). which is parameter-free and thus suitable for backdoor defense with agnostic client scale and diverse data heterogeneity. We demonstrate the superiority in Tab. [ Specificall,, we leverage the Euclidean metric evaluate the gradient difference value V2 between any clients and view the weight with minimum distance as its "neighbor". After clustering, we regard the set with the larger mean gradient discrepancy as the malicious clients and then eliminate their aggregation weights.
82
100 [T] For example, K-Means 62 S]

---

Table I: Compare Clustering strategy in Eq. 10) for FCDC in Cifar- 10 and Fashion-MNIST datasets, with 8 E [0.5.0.3 and 30%. Please refer to the Sec. 3.3 for detailed explanations.
Cifar-10
Rishion-MNIS
FCDC
8 = 0.5
8 0.3
8 = 0.5
3 = 0.3
A
R
R
V
R
V
A
R
V
K-Means
54.50
88.73
71.61
49.79
90.28
70.03
86.77
18.30
52.53
84.71
86.01
85,36
DBSCAN
65.03
49.46
57.24
61.91
38.51
50.20
87.09
0.70
43.89
85.16
0.54
42.85
FINCH (Our)
65.60
90.54
78.06
61.25
93.60
77.42
86.92
88.32
87.62
85.59
89.62
87.60
Conceptual Difference. To some extent, our approach aligns with the Distance Difference Defense paradigm. For instance, Multi Krum and FoolsGold, respectively measure squared Euclidean norm among neighboring gradients and calculate contribution similarity. Additionally, recent advancements such DrC (83 which employs singular
Table 2: Ablation for IA in FCDC Eg.
8
on
Cifar- 10 (T = 30%). Refer to Sec.
3.5
A
R
A
R
5 -
0.5
6 0.3
w/o 58.02 29.02 43.52 57.68
72.67 65.17
Ix 63.52 89.56 76.54 60.20 93.44 76.82
value decomposition to remove outliers, and MMA [30], which utilizes multiple metrics including Manhattan, Euclidean, and Cosine distances. However, existing works regards the parameter elements as the equal importance and fail to highlight the distinct between benign and malicious clients. Therefore, we utilize the FIM differentially highlight clients updated based on the local distribution. We conduct the experiments without considering the parameter importance degree I& in Tab. 2 It appears limited performance in heterogeneous federation withou parameter importance characteristics.
Limitation. Our approach recognizes that benign heterogeneous and malicious triggered distributions exhibit distinct parameter importance profiles. Despite its strengths, our method primarily addresses the mitigation of the backdoor effect during the aggregation phase. Consequently, it does not effectively eliminate previously triggered parameters that persist in the model. This limitation is shared by other existing federated backdoor defense solutions that do not implement server-side optimizations, such as proxy dataset usage or post-calibration techniques (e.g., finetuning, smoothing clipping [124] (04]). ) While our method, referred to as Fisher Parameter Rescale Aggregation, effectively identifies and prioritizes crucial parameters, the challenge of removing or unlearning already poisoned parameters remains a crucial challenge in the federation.
4 Experiments
4.1 Experimental Setup
Datasets. Adhere to 105 70
51
30
we evaluate the efficacy and robustness on three scenarios:
Cifar-10 [43 contains 50k, 10k images for training, validation. Each image is in 32 x 32 size from 10 different classes, e.g., airplanes, cars, and birds.
MNIST 46 is famous digits dataset with 70,000 images in 10 classes.
FaShion-MNIIST [103] has 60k train and 10k test examples from 10 classes.
Data Heterogeneity, As for the data heterogeneity simulation, we utilize the Dirichlet distribution,
Dir(3) to simulate the label skew, as previous methods [54] 51 115], where / > O is the concentra- tion parameter to adjust the class- wise skew level. The smaller is, the more imbalanced the local distribution is. We set the 3 as 0.5 and 0.3 for the following experimental comparison.
Backdoor Attack. We construct the backdoor attack based the popular backdoor paradigm The size of the trigger pattern is set to 2x6, and its location is in the top-left corner of the images. We convert the attacked label to the third class (i.e., digit 2 in Digits scenario). The malicious client ratio T is 20% and 30%. The local data poisoned portion is default set as 0.5.
23 24
Counterparts. We compare with several Backdoor Defensesolutions in federated learning, cate- gorized into four types. i) Distance Difference Defense: Multi Krum [NeurIPS' 17] [ FoolsGold
[arXiv' 18] (21) RLR [AAAI'21] [72), DnC (NDSS'21) [83]. and MMA [3) [0). ii) Statistics
Distribution Defense: Trim Median [ICML' 18] [12), Bulyan [ICML' 25), and RFA [TSP'22) 22] (79..
iii) Proxy Evaluation Defense: FLTrust [NDSS g Sageflow PS 74). and Finetuning
80 iv) Client Side Defense: CRFL. [04 [ICML/21].
Implement Details. We provide the details from four views as follows:
7

---

Table 3: Ablation key components for FDCR in Cifar-10 and Fashion-MNIsTT with 8 (0.5,0.3) and 30%. See Sec, 4.2 for detailed discussion.
Cilar- 10
Weshion-MNIST
FCDC FPRA
B = 0.5
0.3
0.5
0.3
A
R
A
R
V
A
R.
A
R
V
64.08
41.22
52.65
61.85
44.96
53.40
87.15
0.26
43.70
85.82
3,42
44.62
63.52
89.56
76.54
60.20
93.44
76.82
86.81
61.92
74.36
82.53
53.05
67.78
/
65.41
42.59
54.00
61.53
38.34
49.93
87.36
0.40
43.88
85.33
3.42
44.37
65.60
90.54
78.06
61.25
93.60
77.42
86.92
88.32
87.62
85.59
89.62
87.60
Beinge
Evil
OF
Cifar-10
Fashion-MNIST
Figure 2: Observation of gradient difference V2 Eq. (9b) (Left) and aggregation weight âg Eq. 111 (Right)
Cifar- 10 and Fashion
Fashion-MNIST MNIST scenarios (3 = 0.5. T 30%). Backdoor attackers appear large V. and thus
gradually removed via aggregation weight Oi Please details Sec. 4.3
Dataset Split: We partition the original training data into training and validation sets with a 9:1 ratio to support Proxy Evaluation Defense methods. We select small-scale validation with the size as 256 for the methods. e.g., FLTrust ad Sageflow.
Network Structure: Following [5] 70 34
utilize the CNN as the backbone for Cifar- 10,
Fashion-MNIST, and MNIST scenarios.
Training Setting: For fair comparison, follow [54 51 70 We configure the communication epoch T as 50, where all approaches have little or no accuracy gain with more communications. The client number K is 10 for different datasets. For local training, leverage the FedAvg [67] the default local optimization objective. The local updating round E: 10 for different settings. We utilize the SGD as the local updating optimizer. The corresponding weight decay is n le 5 and momentum is 0.9. The local client learning rate is 0.01 in the above three scenarios. We fix the random seed to ensure reproduction and conduct experiments on the NVIDIA 3090Ti.
Evaluation Metric: Following 667 54 5T 27), Top-1 accuracy is adopted for federated benign performance, AA in. We further denote the backdoor failure rate as R. Furthermore, we define the / to measure the heterogeneity and robustness trade-off as:
V (A + R).
(13)
We utilize the mean performance value of the last five communication epochs the final results.
4.2 Diagnostic Experiments
To thoroughly test the efficacy of crucial components of our model, conduct series of diagnostic studies on Cifar- 10 and Fashion-MNIST datasets under the backdoor attack.
Overall Design. We first investigate the effectiivnnes of our FDCR. The results in Tab. 3 show that combining Fisher Client Discrepancy Cluster (FCDC) and Fisher Parameter Rescale Aggregation (FPRA) acquires satisfying federated benign task and backdoor removal performance that coincides with our motivation exploiting the client parameter importance difference to mitigate the backdoor effect and enhance the relatively important parameters optimizations.
Gradient Discrepancy and Aggregation Weight. As shown Fig. 2 we monitor the gradient discrepancy value Vi, Eq. (9b) for the arbitrary two benign and malicious clients. It shows that evils normally maintain high Ve, and our method effectively detects backdoor attackers and removes the corresponding aggregation weight, i.e., â+ 0.

---

Table 4: Comparison with the state-of-the-art backdoor robust solutions: in Cif Fashion-MNIST.
and USPS scenarios with skew ratio E {0.5, 1.0) and malicious proportion T (30%, 20%). means the optimization failure. Best in bold and second with underline. These notes are the same as others. Please refer to Sec. 4.3 for detailed explanations.
Cifar-10
Fashion-MNN
USPS
Methods
0.5
3=
0.3
3 = 0.5
3
0.3
B 0.5
0.3 R
R
V
V
R
R
V
A
with malicious ratio T = 30%
Vanilla
64.08 41.22 $2.65
61.85
44.96
53.40
87.15
0.26
43.70
85.82
3.42 44.62
95.61
6.13 50.87
95.75
2.25 49.00
Multi Krum
50.43 78.59 64.51
40.15 86.50 63.32
77.52
95.07 86.29 78.85
87.00 82.92
93.01
89.44 91.22
90.34
87.60 88.97
FoolsGold
30.71 23,43 27.07
53.79 79.53 66, 66
56.10 0.36 28.23 69.26 0.81 35.03
64.70
11.08 37,
39.20
55,41 47.30
RLR
644.45 41.19 52.82
61.89 44.22 53.05
87.11 0.41 43.76 85.75 3.66 44.70
95.72
6.56 51.14
95.68
2.27 48.97
DrC
60.01 90.24 75.12
56.45 80.07 68.25
85, 40 91.46 88.43 83.95
1.99 42.97
95.26
77.88 86.57
94.15
58.79 76.47
MMA
54,02 94.26 74.14
41.69
61.49 51.59
79.26 0,10 39.68 79.31 0.06 39.68
93.50
89.80 91 65
82,62
1.57 42.09
Trim Median
46.98 64.53 55.75
37.45
50.12
10.00
71.26 56.42
77.22 60.75
87.79
2.21
Bulyan
41.90 94,19 68.04
10.00
100.0 55.00
10.00
100.0 55.00 65.02 98.90 81.96
83.83
5.31 44.57
68.87
1.19 35.03
RFA
62.92 32.77 47.84
61.02
35.51 48.26
85,66
0,07 42.86 85.09 0.43 42.76
95.68
4.30 49.99
95.01
1.97 48.49
FLTrust
53.46 79.40 66.43
41.82
71.27 56.54
67.45
5.37 36.41 70.48 6.90 38.69
91.50
66.15 78. 82
92.39
40.70 66.54
Sageflow
63.71 35.88 49.79
61.22
38.63 49.92
88.05
1,169
44.60 86.40
3.52 44.96
95.78
6.02 50.90
95.86
2.81 49.33
Finetuning
63.12 44.63 53.87
62.49
48.96 55,72
87.42
4.09 45.75 85.63 6.11 45.87
94.65
9.90 52.27
94.50 4.31 49,40
CRFL
58.92 53.04 55.98
55.69
50.16 52.92
85.55
4.28
44.91
82.56
15.39
48.97
93,90
19.16 56.53
92.83
6.34 49.58
FDCR
65.60 90.54 78.06
61.25
93.60
77.42
86.92
88.32
87.62
85,59 89.62 62 87
95.80
89.34 34 92.57
95 75.44
77.81 86.62
with malicious ratio
20%
Vanilla
65.32 51 60.72
62.23
48.02 55.12
N7.34
3.44
45.39
86.25 12.17 21
95.67
7.46 51.57
95.93
30.57 63.25
Multi Krum
50.93
85.27 68.10
39.19
88.38 63.79
43,16
97.41
70.28
10.00
100.0
55.00
90.73
90.09
90.41
91.84
89.18 90.51
FoolsGold
56.24 95.54 75.89
50.96
99.47 75.21
67.13 17.56
42.34
66. 13
0.163
80.76
87.84 87.84
47.39
30.12 38.75
RI.R
64.886 54.86 59
63.51
50.42 56.97
N7.36
4.34
45.85
86.06 8.38 47.22
95.93
7.77 51.85
95.65
29.21 62.43
DaC
60.87 84,70 72.78 57.39
84.78 71.09
86.49
89.47 87,98
84.58 2.94 43.76
93.75
49.67 71.71
95.18
79,91 87.54
MMA
52.78 92.62 72.70 49.60
82.98 66.29
19. 85.76 81.88 74.62
16.77 45.70
93.81
89.64 91.72
93.21
89.89 91.55
Trim Median
46.80 73.69 60.25 38.23
90.11 64.17
81 .48 955668 88.58 75. 10 86.20 80.65
92.29
14.22 53.25
83.31
30.12 56.72
Bulyan
42.79 97.87 70.33 25.37 76.06 50,72
77.75
93.60 85.67 66.58 94.90 80.74
87.80
83.87 85.84
77.82 48.28 63.05
RFA
64.69 46.59 55.66 35.64
61.41
38.83 50.12
86.61 0.46 43.53 86. 2.68 44.40
95.51
16.70 56.
94.79
35.40 65.09
FLTrust
50.54 81.40 65.97 43.35
75.66 59.50
68.06
16.81 42.44 71.28 38.53 54.90
93.43
89.48 91.46
92.31
77.26 84.78
Sageflow
65.29 44.40 54.84 61.
41.24 51.61
28.29
8.07 48. 18 86.86 8.65 47.75
96.31
9.17 52.74
95.99
33.93 64.96
Finetuning
64.02 58.09 63.63
57.57 60.60
87.28
13:07 50.17 85.56 13.74
65.65
95.06
15.23 55.14
94.60
41.85 68.22
CRFL
60.01 73.79 66.90
56.89
66.11 61.50
85.40
17.60
51.50 83.34
40.62
61.98
94.18
45.49 69.83
93.27
46.02 69.64
FDCR
65.19 93.59
79.39
54.49
93.89
19.19
85.44
87.47 86.46
82.67
84.80 83.73
91.55
89.79 90.67
95.63
90.51 93.07
18 05)
0.5)
(2
Figure 3: Comparison of federated benign performance A and backdoor failure rate R during communi-
cation Cifar- 10 with T-30%. FDCR appears the satisfying benign performance and backdoor failure rate.
Furthermore, our method acquires stable convergence tendencies. Please see specific discussion in Sec.
4.3 Comparison to State-of-the-Arts
The Tab. 4 illustrates the final metric by the end of the federated learning process with popular Backdoor Defense methods. It clearly depicts that our method achieves satisfying performance than different counterparts on different evaluation metrics, which confirms that FDCR effectively enhances the backdoor-robust in heterogeneous federated learning. Take the result of Cifar- 10 with 3 = 0.3 and T = 30% as an example, our method outperforms the best counterpart with gap of 9.17% on the metric. Furthermore, existing backdoor defensive methods fail to resist the backdoor attack under either the large malicious client ratio = -30% and serious label skew = It reveals that existing solutions fail to conduct the malicious discrimination selection under large-scale evils or serious data heterogeneity. We further plot both the federated benign performance A and backdoor

---

failure rate R during the communication process on the Cifar- 10 setting in Fig. 3 We observe that FDCR presents faster and stabler convergence speed than others with different heterogeneity degrees.
Conclusion
In response to backdoor attacks in heterogeneous federated learning, introduce the Fisher Discrep- ancy Cluster and Recale (FDCR), which distinguishes between benign and malicious distributions based distinct degrees of parameter importance. We employ the Fisher Information Matrix to calculate the degree of parameter importance within client distributions and adjust the weighting of client parameter updates accordingly. Clients exhibiting large differences in gradient updates identified as potential backdoor attackers, allowing us to mitigate their influence during the parameter aggregation process. Additionally, we prioritize and accelerate parameter elements related to the target distribution, which promotes meaningful parameter optimization and weakens the impact of non-essential elements. The effectiveness and robustness of our approach have been validated against popular counterparts in various heterogeneous federated learning scenarios. This work aims to offer a novel perspective and pave the way for future research this field.
Acknowledgment. This work supported by the National Key Research and Development Pro- gram of China 2023YFC2705700, and National Natural Science Foundation of China under Grant (6236116662) 62176188, 62225113, 623B2080). The numerical calculations this paper had been supported by the super-computing system in the Supercomputing Center of Wuhan University.
References
[1] M. Alam, H. Lamri, and M. Maniatakos. Get rid of your trail: Remotely erasing backdoors in federated learning. arXiv preprint arXiv:2304. 100004/00366 10638, 2023.
[2] S.-i. Amari and H. Nagaoka. Methods of information geometry, volume 191. American Mathematical Soc., 2000.
[3] D. Arthur and S. Vassilvitskii. k-means++: The advantages of careful seeding. In ACM-SIAM, 2006.
[4] E. Bagdasaryan, A. Veit, Y. Hua, D. Estrin, and V. Shmatikov. How to backdoor federated learning. In AISTATS, pages 2938-2948, 2020.
[5] B. Biggio, B. Nelson, and P. Laskov. Poisoning attacks against support vector machines. In ICML, 2012.
[6] P. Blanchard, E. M. EI Mhamdi, R. Guerraoui, and J. Stainer. Machine learning with adver- saries: Byzantine tolerant gradient descent. In NewrIPS, 2017.
[7] X. Cai, H. Xu, S. Xu, Y. Zhang, al. Badprompt: Backdoor attacks on continuous prompts. In NeurIPS, volume 35, pages 37068-37080, 2022.
[8] X. Cao, M. Fang, J. Liu, and N. 7. Gong. Fltrust: Byzantine-robust federated learning via trust bootstrapping. In NDSS, 2021.
[9] X. Cao, J. Jia, Z. Zhang, and N. Z. Gong. Fedrecover: Recovering from poisoning attacks in federated learning using historical information. In IEFE S&P, pages 1366-1383. IEEE, 2023.
[10] Cao, Z. Zhang, Jia, and Z. Gong. Flcert: Provably secure federated learning against poisoning attacks. IEEE TIFS, 17:3691-3705, 2022.
[11] C. Chen, M. Ye, M. Qi. J. Wu, J. Jiang, and C.-W. Lin. Structure-aware positional transformer for visible-infrared person re- re-identification. JEEE TIP, 11::352-23344 2022.
[12] H.-Y. Chen and W.-L. Chao. Fedbe: Making bayesian model ensemble applicable to federated learning. In ICLR, 2021.
[13] Chen, Liu, B. Li, K. Lu, and Song. Targeted backdoor attacks on deep learning systems using data poisoning, arXiv preprint arXiv:1712.05528 2017.
10

---

[14] T. Cover and P. Hart. Nearest neighbor pattern classification. IEEE TIT. pages 21 21-27, 1967.
[15] M. Ester, H.-P. Kriegel, J. Sander, X. Xu, et al. A density-based algorithm for discovering clusters in large spatial databases with noise. In ACM SIGKDD, pages 226-231, 1996.
[16] X. Fang and M. Ye. Robust federated learning with noisy and heterogeneous clients. In CVPR, 2022.
[17] Y. Feng, B. Ma. J. Zhang, S. Zhao, Y. Xia, and D. Tao. Fiba: Frequency-injection based backdoor attack in medical image analysis. In CVPR, pages 20876-20885, 2022.
[18] Fereidooni, A. Pegoraro, Rieger, Dmitrienko, and A.-R. Sadeghi. Freqfed: A frequency analysis-based approach for mitigating poisoning attacks in federated learning. In NDSS, 2024.
[19] R. A. Fisher. On the mathematical foundations of theoretical statistics. Philosophical trans- actions of the Royal Society of London, Series A, containing papers of a mathematical or physical character, 224594-604)3309-3668 1922.
[20] J. Frankle and M. Carbin. The lottery ticket hypothesis: Finding sparse, trainable neural networks. In ICLR, 2019.
[21] C. Fung, C. J. Yoon, and I. Beschastnikh. Mitigating sybils federated learning poisoning. arXiv preprint 180i 04866, 2018.
[22] L. Gao, H. Fu, L. Li, Y. Chen, M. Xu, and C.-Z. Xu. Fedde: Federated learning with non-iid data via local drift decoupling and correction. In CVPR, 2022.
[23] T. Gu, B. Dolan- and S. Garg. Badnets: Identifying vulnerabilities in the machine learning model supply chain. arXiv preprint arXiv:/708.06733, 2017.
[24] T. Gu, K. Liu, B. Dolan Davin,Gavitt, and S. Garg. Badnets: Evaluating backdooring attacks on deep neural networks. IEEE Access, 0437230-47244 2019.
[25] Guerraoui, Rouault, et al. The hidden vulnerability of distributed learning in byzantium. In ICML., pages 3521-3530, 2018.
[26] C. Guo, G. Pleiss, Y. Sun, and K. Q. Weinberger. On calibration of modern neural networks. In ICMI., pages 1321-1330, 2017.
[27] S. Han, S. Park, F. Wa, S. Kim, B. Zhu, X. Xie, and M. Cha. Towards attack-tolerant federated learning via critical parameter analysis. In ICCV, 2023.
[28] M. Hu, Z. Yue, X. Xie, C. Chen, Y. Huang, X. Wei, X. Lian, Y. Liu, and M. Chen. Is aggregation the only choice? federated learning via layer-wise model recombination. In ACM SIGKDD, pages 1096-1 107, 2024.
[29] L. Huang, A. D. Joseph, B. Nelson, B. I. Rubinstein, and J. D. Tygar. Adversarial machine learning. In ACM workshop on Security and artificial intelligence, pages 43-58, 2011.
[30] S. Huang, Y. Li, C. Chen, L. Shi, and Y. Gao. Multi-metries adaptively identifies backdoors in federated learning. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 4652-4662, 4662, 2023.
[31] W. Huang, Z. Shi, M. Ye, H. Li, and B. Du. Self-driven entropy aggregation for byzantine- robust heterogeneous federated learning. In ICML, 2024.
[32] W. Huang, G. Wan, M. Ye, and B. Du. Federated graph semantic and structural learning. In IJCAI, 2023.
[33] W. Huang, M. Ye, 7. Shi, B. Du, and D. Tao. Fisher calibration for backdoor-robust heteroge- neous federated learning. In ECCV, 2024.
[34] W. Huang, M. Ye, Z. Shi, H. Li, and B. Du. Rethinking federated learning with domain shift: A prototype view. In CVPR, pages 16312-16322, 2023.

---

[35] W. Huang, M. Ye, Z. Shi, G. Wan, H. Li, B. Du, and Q. Yang. Federated learning for generalization, robustness, fairness: A survey and benchmark. IEEE PAMI, 2024.
[36] S. Jastrzebski, M. Szymezak, S. Fort, D. Arpit, J. Tabor, K. Cho, and K. Geras. The break-even point on optimization trajectories of deep neural networks. In ICLR, 2020.
[37] J. Jia, Y. Liu, and N. Z. Gong. BadEncoder: Backdoor attacks pre-trained encoders in self-supervised learning. In IEEE S&P, 2022.
[38] W. Jiang, H. Li, G. Xu, and T. Zhang. Color backdoor: A robust poisoning attack in color space. In CVPR, pages 8133-810 8132,142, 2023.
[39] P. Karimireddy, Kale, M. Mohri, Reddi, U. Stich, and A. Suresh. Scaffold: Stochastic controlled averaging for on-device federated learning. In ICML, 2020.
[40] N. S. Keskar, D. Mudigere, J. Nocedal, M. Smelyanskiy, and P. T. P. Tang. On large-batch training for deep learning: Generalization gap and sharp minima. In ICLR, 2017.
[41] J. Kirkpatrick, R. Pascanu, N. Rabinowitz, J. Veness, G. Desjardins, A. A. Rusu, K. Milan, J. Quan, T. Ramalho, A. Trrabka-BBarwinske et al. Overcoming catastrophic forgetting in neural networks. PNAS, pages 3521-3526, 2017.
[42] J. Konečný, H. B. McMahan, D. Ramage, and P. Richtárik, Federated optimization: Distributed machine learning for on-device intelligence. arXiv preprint arXiv:1610.02527, 2016.
[43] A. Krizhevsky and G. Hinton. Learning multiple layers of features from tiny images. Master's thesis, Department of Computer Science, University of Toronto, 2009.
[44] S. Kullback and R. A. Leibler. On information and sufficiency. Ann. Math. Stat., pages 79-86, 1951.
[45] B. Lakshminarayanan, A. Pritzel, and C. Blundell. Simple and scalable predictive uncertainty estimation using deep ensembles. NeurlPS, 2017.
[46] Y. LeCun, L. Bottou, Y. Bengio, and P. Haffner. Gradient- learning applied to document recognition. Proceedings of the IEEE, pages 2278-2324, 1998.
[47] G. Lee, Jeong, Y. Shin, S. Bae, and S.-Y. Yun. Preservation of the global knowledge by not-true distillation in federated learning. In NewrIPS, 2022.
[48] D. Li and J. Wang. Fedmd: Heterogenous federated learning via model distillation. In NeurIPS Workshop, 2019.
[49] Li, A. Kadav, Durdanovic, H. Samet, and H. Graf. Pruning filters for efficient convnets. In ICLR, 2017.
[50] Q. Li, Y. Diao, Q. Chen, and B. He. Federated learning non-iid data silos: An experimental study. In ICDE, pages 965 835,978,222 2022.
[51] Q. Li, B. He, and D. Song, Model-contrastive federated learning. In CVPR, pages 10713- 10722, 2021.
[52] T. Li, Hu, A. Beirami, and Smith. Ditto: Fair and robust federated learning through personalization. In ICMI,, pages 6357-6368, 2021. 2021.
[53] T. Li, K. Sahu, A. Talwalkar, and V. Smith. Federated learning: Challenges, methods, and future directions. IEEE SPM, pages 50-60, 2020.
[54] T. Li, A. K. Sahu, M. Zaheer, M. Sanjabi, A. Talwalkar, and V. Smith. Federated optimization in heterogeneous networks. In MLSys, 2020.
[55] X.-C. Li and D.-C. Zhan. Fedrs: Federated learning with restricted softmax for label distribu- tion non-iid data. In ACM SIGKDD, pages 990-1005, 2021.
[56] Y. Li, Y. Jiang, Z. Li, and S.-T. Xia. Backdoor learning: A survey, IEEE TNNLS, 2022.
12

---

[57] Y. Y. Li, B. Wu, Li, He, and S. Lyu. Invisible backdoor attack with sample-specifie triggers. In IEEE International Conference on Computer Vision (ICCV), 2021.
[58] C. Liao, H. Zhong, A. Squicciarini, S. Zhu, and D. Miller. Backdoor embedding in convo- lutional neural network models via invisible perturbation. arXiv preprint 1808 10307, 2018.
[59] X. Liu, M. Masana, L. Herranz, J. Van de Weijer, A. M. Lopez, and A. D. Bagdanov. Rotate your networks: Better weight consolidation and less catastrophic forgetting. In ICPR, pages 2262-2268,, 2018.
[60] Z. Liu, M. Sun, T. Zhou, G. Huang, and T. Darrell. Rethinking the value of network pruning. In ICLR, 2019.
[61] M. Luo, F. Chen, D. Hu, Y. Zhang, J. Liang, and J. Feng. No fear of heterogeneity: Classifier calibration for federated learning with non-iid data. In NeurIPS, 2021.
[62] J. MacQueen et al. Some methods for classification and analysis of multivariate observations. In BSMSP, pages 281-297, 1967.
[63] O. Marfoq, C. Xu, G. Neglia, and R. Vidal. Throughput-optimal topology design for cross-silo federated learning. In NeurlPS, pages 19478-19487 2020.
[64] J. Martens. New insights and perspectives on the natural gradient method. JMLR, 21(1):5776- 5851, 2020.
[65] M. S. Matena and C. A. Raffel. Merging models with fishht- averaging. In NeurIPS, pages 17703-17716, 2022.
[66] C. May and S. K. Sell. Intellectual property rights: A critical history. Lynne Rienner Publishers Boulder, 2006.
[67] B. McMaaan, E. Moore, D. Ramage, S. Hampson, and B. A. y Arcas. Communication--efiiieee learning of deep networks from decentralized data. In AISTATS, pages 1273-1282, 2017.
[68] M. Mendicta, Yang, P. Wang, M. Lee, Z. Ding, and C. Chen. Local learning matters: Rethinking data heterogeneity in federated learning. In CVPR, pages 8397-8406, 2022.
[69] S. Mirzadeh, M. Farajtabar, R. Pascanu, and H. Ghasemzadeh. Understanding the role of training regimes in continual learning. In NeurIPS, pages 7308-7320, 2020.
[70] X. Mu, Y. Shen, K. Cheng, X. Geng, J. Fu, T. Zhang, and Z. Zhang. Fedproc: Prototypical contrastive federated learning on non-iid data, arXiv preprint arXiv:2109. 12273, 2021.
[71] S. Niu, J. Wu, Y. Zhang, Y. Chen, S. Zheng, P. Zhao, and M. Tan. Efficient test-time model adaptation without forgetting. In ICML, pages 16888-16905. PMLR. 2022.
[72] M. S. Ozdayi, M. Kantarcioglu, and Y. R. Gel. Defending against backdoors in federated learning with robust learning rate. In AAAI, pages 9268-99899 9276, 2021.
[73] S. L. Pardau. The california consumer privacy act: Towards a european-style privacy regime in the united states. J. Tech. L. & Pol'y, 23:68, 2018.
[74] J. Park, D.-J. Han, M. Choi, and J. Moon. Sageflow: Robust federated learning against both stragglers and adversaries. In NeurlPS, pages 1100851,222 2021.
[75] S. Park, S. Han, F. Wu, S. Kim, B. Zhu, X. Xie, and M. Cha. Feddefender: Client-side attack-tolerant federated learning. In ACM SIGKDD, pages 1850-1861, 2023.
[76] R. Pascanu and Y. Bengio. Revisiting natural gradient for deep networks. arXiv preprint arXiv:/301.355 2013.
[77] R. Pascanu and Y. Bengio. Revisiting natural gradient for deep networks. arXiv preprint 30144 2013.
13

---

[78] S. Pati, U. Baid, B. Edwards, M. Sheller, S.-H. Wang, G. A. Reina, P. Foley, A. Gruzdev, D. Karkada, C. Davatzikos, al. Federated learning enables big data for rare cancer boundary detection. Nature communications, 13(1):7346, 2022.
[79] K. Pillutla, S. M. Kakade, and Z. Harchaoui, Robust aggregation for federated learning. IEEE TSP, 70:1142 10:1142-1154, 2022.
[80] J. Quinn, J. McEachen, M. Fullan, M. Gardner, and M. Drummy. Dive into deep learning: Tools for engagement. Corwin Press, 2019.
[81] A. Rame, C. Dancette, and M. Cord. Fishr: Invariant gradient variances for out-of-distribution generalization. In ICMI, pages 18347-18377. PMLR, 2022.
[82] M. S. Sarfraz, V. Sharma, and R. Stiefelhagen. Efficient parameter-free clustering using first neighbor relations. In CVPR, pages 8934 8943, 2019.
[83] V. Shejwalkar and A. Houmansadr. Manipulating the byzantine: Optimizing model poisoning attacks and defenses for federated learning. In NDSS, 2021.
[84] J. Shi, W. Wan, S. Hu, J. Lu, and L. Y. Zhang. Challenges and approaches for mitigating byzantine attacks federated learning. In IEEE TrustCom, pages 139-146. IEEE, 2022.
[85] Shi, J. Liang, W. Zhang, V. Y. Tan, and S. Bai. Towards understanding and mitigating dimensional collapse in heterogeneous federated learning. In ICLR, 2023.
[86] N. Shoham, T. Avidor, A. Keren, N. Israel, D. Benditkis, L. Mor- Yosef, and I. Zeitak. Over- coming forgetting in federated learning on non-iid data. In NeurIPS Workshop. 2019.
[87] S. P. Sturluson, S. Trew, L. Muñoz-González, M. Grama, J. Passerat-Palmbach, D. Rueck- ert, and A. Alansary. Fedrad: Federated robust adaptive distillation. arXiv preprint arXiv:2 1nn::2222..44555 2021.
[88] M. Sun, Z. Liu, A. Bair, and J. Z. Kolter. A simple and effective pruning approach for large language models. arXiv preprint / /695, 2023.
[89] Z. Sun, P. Kairouz, A. T. Suresh, and H. B. McMahan. Can you really backdoor federated learning? In NeurlPS, 2019.
[90] Y.-L. Sung, V. Nair, and C. A. Raffel. Training neural networks with fixed sparse masks. In NeurIPS, pages 24193 242055, 2021.
[91] Y. Tan, G. Long, L. Liu, T. Zhou, Q. Lu, J. Jiang, and C. Zhang. Fedproto: Federated prototype learning across heterogeneous clients. In AAAI, 2022.
[92] Z. Tan, G. Wan, W. Huang, and M. Ye. Fedssp: Federated graph learning with spectral knowledge and personalized preference. In NeuriPS, 2024.
[93] Y. Tian, O. Henaff, and A. van den Oord. Divide and contrast: Self-supervised learning from uncurated data. In ICCV, pages 10063-10074, 2021.
[94] A. Turner, D. Tsipras, and A. Madry. Label-consistent backdoor attacks. arXiv preprint a92iv:1912.02771, 2019.
[95] P. Voigt and A. Von dem Bussche. The general data protection regulation (gdpr). A Practical Guide, Ist Ed., Cham: Springer International Publishing, page 3152676, 2017.
[96] O. A. Wahab, A. Mourad, H. Otrok, and T. Taleb. Federated machine learning: Survey, multi- level classification, desirable criteria and future directions in communication and networking systems. IEEE CST, pages 1342-1397, 2021.
[97] G. Wan, W. Huang, and M. Ye. Federated graph learning under domain shift with generalizable prototypes. In AAAI, volume 38, pages 15429-15437, 2024.
[98] H. Wang, K. Sreenivasan, S. Rajput, H. Vishwakarma, S. Agarwal, J.-y. Sohn, K. Lee, and Papailiopoulos. Attack of the tails: Yes, you really can backdoor federated learning. In NeurIPS, pages 16070-16084, 2020.
14

---

[99] T. Wang, Y. Yao, F. Xu, S. An, H. Tong, and T. Wang. An invisible black- box backdoor attack through frequency domain. ECCV, pages 396-413, Springer, 2022.
[100] J. H. Ward Jr. Hierarchical grouping to optimize an objective function. JASA, pages 236-244, 1963.
[101] C. Wu, X. Yang, S. Zhu, and P. Mitra. Mitigating backdoor attacks in federated learning. arXiv preprint 2.001:::0 2020.
[102] B. Xi, Li, J. Li, H. Liu, H. Liu, and H. Zhu. Batfl: Backdoor detection on federated learning in e-health. In /WQOs, pages 1-10. IEEE, 2021.
[103] H. Xiao, K. Rasul, and R. Vollgraf. Fashion-mnist: A novel image dataset for benchmarking machine learning algorithms. arXiv preprint arXiv:/708.007477 2017.
[104] C. Xie, M. Chen, P.-Y. Chen, and B. Li. Crfl: Certifiably robust federated learning against backdoor attacks. In ICML, pages 11372-11382. PMLR, 2021.
[105] Y. Xie, W. Zhang, Pi, Wu, Q. Chen, Xie, and S. Kim. Optimizing server-side aggre- gation for robust federated learning via subspace training. arXiv preprint arXiv:2211.05554, 2022.
[106] Y. Xiong, R. Wang, M. Cheng, F. Yu, and C.-J Hsieh. Feddm: Iterative distribution matching for coamuuiiaation-ffficieeee federated learning. CVPR, 2023.
[107] G. Yan, H. Wang, and J. Li. Seizing critical learning periods in federated learning. In AAAI, 2022.
[108] Q. Yang, Y. Liu, T. Chen, and Y. Tong. Federated machine learning: Concept and applications. ACM TIST, pages 1-19, 2019.
[109] Y. Yang, M. Hu, Y. Cao, J. Xia, Y. Huang, Y. Liu, and M. Chen. Protect federated learning against backdoor attacks via data-free trigger generation. arXiv preprint wrx.v:2308./1333 2023.
[110] Y. Yang, C. Jia, D. Yan, M. Hu, Li, X. Xie, X. Wei, and M. Chen. Black-box backdoor defense via perturbation-bact
sample detoxification. In NeurlPS, 2024.
[111] M. Ye, X. Fang, B. Du, P. C. Yuen, and D. Tao. Heterogeneous federated learning: State-of- the-art and research challenges. CSUR, 2023.
[112] D. Yin, Y. Chen, R. Kannan, and P. Bartlett Byzantine-robust distributed learning: Towards optimal statistical rates. In ICML., pages 5650-5659, 2018
[113] L. Yin, G. Li, M. Fang, L. Shen, T. Huang. Z. Wang. V. Menkovski, X. Ma, M. Pechenizkiy, and S. Liu. Dynamic sparsity is channel-level sparsity learner. NeurIPS, 2023.
[114] F. Yu, W. Zhang, Z. Qin, Z. Xu, D. Wang, C. Liu, Z. Tian, and X. Chen, Fed2: Feature-aligned federated learning. ACM SIGKDD, pages 2066-2074, 2021.
[115] J. Zhang, Z. Li, B. Li, J. Xu, S. Wu, S. Ding, and C. Wu. Federated learning with label distribution skew via logits calibration. In ICML., pages 26311-26329, 2022.
[116] K. Zhang, G. Tao, Q. Xu, S. Cheng, S. An, Y. Liu, S. Feng, G. Shen, P.-Y. Chen, S. Ma, et al. Flip: A provable defense framework for backdoor mitigation in federated learning. In ICLR, 2023.
[117] Z. Zhang, X. Cao, J. Jia, and N. Z. Gong. Fldetector: Defending federated learning against model poisoning attacks via detecting malicious clients. In ACM SIGKDD, pages 2022.
[118] Z. Zhang, Q Su, and Sun. Dim-krum: Rackdoor-resistant federated learning for nlp with dimension-win wise trum-based aggregation. In EMNLP, 2022.
15

---

[119] Y. Zhao, M. Li, L. Lai, N. Suda, D. Civin, and V. Chandra. Federated learning with non-iid iid data. arXiv preprint arXiv:/806.000 00582, 2018.
[120] W. Zheng, L. Yan, C. Gou, and F.-Y. Wang. Federated meta-learning for fraudulent credit card detection. In IJCAI, pages 4654-4660 2021.
[121] Q. Zhong, L. Ding, L. Shen, Mi, J. Liu, B. Du, and D. Tao. Improving sharpness-aware minimization with fisher mask for better generalization on language models. In EMNLP, 2022.
[122] T. Zhou and E. Konukoglu. FedFA: Federated feature augmentation. In ICLR, 2023.
[123] C. Zhu, S. Roos, and L. Y. Chen. Leadfl: client self-defense against model poisoning in federated learning. ICML, pages 43158 43180. PMLR, 2023.
[124] M. Zhu, Wei, L. Shen, Fan, and B. Wu. Enhancing fine-tuning based backdoor defense with sharpness-awan aware minimization. In ICCV, 2023.
16

---

NeurIPS Paper Checklist
The checklist is designed encourage best practices for responsible machine learning research, addressing issues of reproducibility, transparency, research ethics, and societal impact. Do not remove the checklist: The papers not including the checklist will be desk rejected. The checklist should follow the references and follow the (optional) supplemental material. The checklist does NOT count towards the page limit.
Please read the checklist guidelines carefully for information on how to answer these questions. For each question in the checklist:
You should answer [Yes], [No]. or [NA].
[NA] means either that the question Not Applicable for that particular paper or the relevant information is Not Available.
Please provide short (1-2 sentence) justification right after your answer (even for NA).
The checklist answers are an integral part of your paper submission. They are visible to the reviewers, area chairs, senior area chairs, and ethics reviewers. You will be asked to also include (after eventual revisions) with the final version of your paper, and its final version will published with the paper.
The reviewers of your paper will be asked use the checklist as one of the factors their evaluation. While "[Yes] is generally preferable to "[No]" ", it is perfectly acceptable to answer "[No] providedd proper justification is given (e.g.. "error bars are not reported because it would be too computationally expensive" or "we were unable to find the license for the dataset we used"). In general, answering binary way, we
"[No] or "[NA]" is not grounds for rejection. While the questions are phrased acknowledge that the true answer is often more nuanced, please just use your best judgment and write justification to elaborate. All supporting evidence can appear either in the main paper or the supplemental material, provided in appendix. If you answer [Yes] to a question, in the justification please point to the section(s) where related material for the question can be found.
IMPORTANT, please:
Delete this instruction block, but keep the section heading "NeurIPS paper checklist",
Keep the checklist subsection headings, questions/answers and guidelines below.
Do not modify the questions and only use the provided macros for your answers.
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification: Please refer to Sec.
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made in the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or
NA answer to this question will not perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize other settings.
is fine include aspirational goals as motivation long is clear that these goals are not attained by the paper.
2. Limitations
Question: Does the paper discuss the limitations of the work performed by the authors?
Answer: [Yes]
Justification: Please refer Sec.
17

---

Guidelines:
The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create a separate "Limitations" section in their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, c.g., if the approach was only tested few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect on the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution is low or images are taken in low lighting. Or speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails handle technical jargon.
The authors should discuss the computational efficiency the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness.
While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, worse outcome might be that reviewers discover limitations that aren't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an impor- tant role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.
3. Theory Assumptions and Proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
Answer: [Yes]
Justification: Please see Sec. 3.2.1
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated or referenced in the statement of any theorems.
The proofs can either appear in the main paper the supplemental material, but if they appear in the supplemental material, the authors are encouraged to provide short proof sketch provide intuition.
Inversely, any informal proof provided in the core of the paper should complemented by formal proofs provided in appendix supplemental material.
Theorems and Lemmas that the proof relies upon should properly referenced.
4. Experimental Result Reproducibility
Question: Does the paper fully disclose all the information needed to reproduce the main ex- perimental results of the paper to the extent that it affects the main claims and/or conclusions the paper (regardless whether the code and data are provided or not)?
Answer: [Yes]
Justification: Please refer to Sec.
Guidelines:
The answer NA means that the paper does not include experiments.
18

---

If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. w
For example, if the contribution is a novel architecture, describing the architecture fully might suffice, or if the contribution is specific model and empirical evaluation, it may be necessary to either make it possible for others to replicate the model with the same dataset, or provide access the model. In general. releasing code and data is often one good way to accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access a hosted model (e.g., in the case of a large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.
While NeurlPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) If the contribution is primarily new algorithm, the paper should make it clear how to reproduce that algorithm. (b) the contribution is primarily a new model architecture, the paper should describe the architecture clearly and fully.
(c) If the contribution is new model (e.g., a large language model), then there should either be way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset instructions for how to construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome describe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (e.g., registered users), but it should be possible for other researchers to have some path to reproducing or verifying the results.
5. Open access to data and code
Question: Does the paper provide open access to the data and code, with sufficient instruc- tions to faithfully reproduce the main experimental results, as described in supplemental material?
Answer: [Yes]
Justification:
Please refer Sec.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurIPS code and data submission guidelines (nttps://nips.co
for more details.
While we encourage the release of code and data, we understand that this might not be possible, so "No" an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurlPS code and data submission guidelines (https
/ 7/nips. /ttppp.cc/pbllc/guudeeee http://oeeubiiissioooooooooo
for more details.
The authors should provide instructions on data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. only subset of experiments are reproducible, they should state which ones are omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
19

---

Providing as much information as possible in supplemental material (appended to the paper) recommended, but including URLs to data and code permitted.
6. Experimental Setting/Details
Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Question:
Answer:
[Yes]
Justification: Please refer Sec.
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented the core the paper to level of detail that is necessary to appreciate the results and make sense of them.
The full details can be provided either with the code, in appendix, supplemental material.
7. Experiment Statistical Significance
Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Answer: [Yes]
Justification: Please refer to Sec.
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results accompanied by error bars, confi- dence intervals, or statistical significance tests, at least for the experiments that support the main claims of the paper.
The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall run with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
The assumptions made should be given (e.g.. Normally distributed errors).
It should be clear whether the error bar is the standard deviation or the standard error of the mean.
OK to report 1-sigma error bars, but one should state The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that out of range (e.g. negative error rates).
If error bars reported in tables or plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables the text.
8. Experiments Compute Resources
For each experiment, does the paper provide sufficient information on the com- puter resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?
Question:
Answer: [Yes]
Justification: Please see Sec.
Guidelines:
The answer NA means that the paper does include experiments.
The paper should indicate the type of compute workers CPU or GPU, internal cluster, or cloud provider, including relevant memory and storage.
20

---

The paper should provide the amount of compute required for each of the individual experimental runs as well estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't make into the paper).
9. Code Of Ethies
Question: Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics https://neurips.c http://ppw........ia.ccccaaaaaaa
Answer: [Yes]
Justification: Please the supplementary file.
Guidelines:
The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.
If the authors answer No, they should explain the special circumstances that require a deviation from the Code of Ethics.
The authors should make to preserve anonymity (e.g.. if there special consid- eration due to laws or regulations in their jurisdiction).
10. Broader Impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [NA]
Justification: There is societal impact of the work performed.
Guidelines:
The answer NA means that there no societal impact of the work performed.
If the authors answer NA or No, they should explain why their work has no societal impact why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is a direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.
If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release models, providing defenses in addition attacks, mechanisms for monitoring misuse, mechanisms to monitor how system learns from feedback over time, improving the efficiency and accessibility ML).
11. Safeguards
Question: Does the paper describe safeguards that have been put in place for responsible release of data or models that have a high risk for misuse (e.g., pretrained language models, image generators, scraped datasets)?
Answer: [NA]
Justification: The paper poses no such risks.
Guidelines:
The answer NA means that the paper poses such risks.
21

---

Released models that have high risk for misuse or dual use should be released with necessary safeguards to allow for controlled use of the model. for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards challenging, and many papers do not require this, but we encourage authors to take this into account and make best faith effort.
12. Licenses for existing assets
Are the creators original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?
Question:
Answer: [Yes]
Justification: Please refer Sec.
Guidelines:
The answer NA means that the paper does not use existing assets.
The authors should cite the original paper that produced the code package dataset.
The authors should state which version of the asset used and, if possible, include URL.
The name of the license (e.g., CC-BY 4.0) should be included for each asset.
For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided.
If assets are released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, paperswi thcode. com datasets has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
For existing datasets that are re- re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.
If this information is not available online, the authors are encouraged to reach out to the asset's 's creators.
13. New Assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [NA]
Justification: The paper does not release new assets
Guidelines:
The answer NA means that the paper does not release new assets.
Researchers should communicate the details of the dataset/code/model as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent obtained from people whose asset is used.
At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.
14. Crowdsourcing and Research with Human Subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well details about compensation (if any)?
Answer: [NA]
Justification: The paper does not involve crowdsoureing nor research with human subjects.
22

---

Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Including this information the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then as much detail as possible should be included the main paper.
According to the NeurIPS Code Ethics, workers involved in data collection, curation, other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional Review Board (IRB) Approvals or Equivalent for Research with Human Subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?
Answer: [NA]
Justification: The paper does not involve crowdsourcing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Depending on the country in which research is conducted, IRB approval (or equivalent)
may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and expect authors to adhere to the NeurIPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such the institution conducting the review.
23


Reviews:
[{"review_id": "rGtmd9vSiu", "reviewer": "Reviewer_M9TV", "summary": "This paper studies backdoor defenses in federated learning. Existing backdoor defenses either assume homogeneous data, existence of validation data or client optimization conflicts. In order to circumvent these limitations, the authors proposed FDCR method. FDCR is based on the observation that parameter importance degree is different between benign heterogeneous distribution and malicious triggered distribution. In particular, FDCR identify malicious clients by importance degree re-weighted parameter discrepancy. Empirical results demonstrate the robustness of the proposed FDCR.", "questions": "Please refer to weaknesses.", "limitations": "There is no potential negative societal impact of their work.", "rating": 6, "confidence": 4, "soundness": 4, "presentation": 4, "contribution": 4, "strengths": "* The motivation that the parameter discrepancy between benign heterogeneous gradient and malicious gradient different is different is novel. The method is clearly motivated.\n* The paper is clearly written and easy to follow.\n* The experiments are extensive and sufficient.", "weaknesses": "* The computation cost of Fisher information matrix is unclear.\n* Theoretical analysis can better validate the effectiveness of the proposed FDCR", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "## **Response to Reviewer M9TV**\n\nDear Reviewer M9TV:\n\nWe sincerely appreciate your time and effort in reviewing our paper. Your positive feedback on the novelty of our approach, the clarity of our writing, and the comprehensiveness of our experiments is very encouraging. We are glad that our novel method of addressing the parameter discrepancy between benign and malicious gradients was well-received, and that our writing and experiments were clear and thorough. we hope that our responses below will address your concerns and update the score.\n\n### Weaknesses\n\n**W1: The computation cost of Fisher information matrix is unclear.**\n\n A1: Thank you for the feedback. In our work, we require different clients to calculate the parameter importance based on the local distribution via the Fisher Information [1,2]. To save the computational effort,  we follow previous works and approximate the Fisher information matrix as the diagonal matrix, i.e., ${F}_w \\in \\mathbb{R}^{|w|} $ [3]. Thus, the computation cost complexity for the Fisher information matrix in our methodology is $\\mathcal{O}(|w|)$, where $\\mathcal{O}$ means complexity degree. We will add computation cost discussion to enhance readability in our revised manuscript!\n\n[1] Fisher, R. A. On the mathematical foundations of theoretical statistics. Philosophical Transactions of the Royal Society of London. Series A, Containing Papers of a Mathematical or Physical Character, 222(594-604):309–368, 1922.\n\n[2] Amari, S. Neural learning in structured parameter spaces-natural riemannian gradient. Advances in neural information processing systems, pp. 127–133, 1997.\n\n[3] Kirkpatrick J, Pascanu R, Rabinowitz N, et al. Overcoming catastrophic forgetting in neural networks[J]. Proceedings of the national academy of sciences, 2017, 114(13): 3521-3526.\n\n\n**W2: Theoretical analysis can better validate the effectiveness of the proposed FDCR.**\n\nA2: In our work, we introduce the Fisher Discrepancy Cluster and Rescale, abbreviated as FDCR, to establish the backdoor defense in heterogeneous federated learning. The core insight is to distinguish benign and malicious behaviors based on different parameter importance degrees.  We estimate the importance of each parameter using an empirical approximation of Fisher information for each client distribution. The rationale is that Fisher information is proposed to measures the information carried by an observable random variable about the unknown parameters of the distributio. Thus, the Fisher Information Matrix measures parameter importance by quantifying the sensitivity of the likelihood function to parameter changes, capturing the curvature of the likelihood surface, and reflecting the precision of parameter estimates. With respect to our method, we find that benign and malicious clients manifest as noticeable parameter importance discrepancies because they focus on fitting on distinct distribution manners and thus appear different information capabilities for the same parameter elements. Therefore, we employ the Fisher Information to distinguish between benign and malicious distributions based on distinct degrees of parameter importance.\n\nFurthermore, we demonstrate the effectiveness of the proposed method from the communication aspect. Our method conducts backdoor defense from the server side. The server collects the updated client models and corresponding parameter importance matrices to identify client behavior and mitigate the backdoor effect during aggregation. Thus, compared to existing solutions, while our method linearly increases computation cost, it significantly enhances backdoor defense effectiveness, as shown in the following table. We will provide a computation complexity comparison in the final version.  Thanks for the advice!\n\n*Table: **Computation burden comparison** on Cifar-10 with $\\beta=0.5$ and evil ratio $\\Upsilon=0.2$. $w$ refers to the network, $K$ represents client scale, and *O* indicates complexity degree. *A* and *R* mean federated benign performance and backdoor failure rate. *V* measures the heterogeneity and robustness trade-off.*\n|   Method  | Computation Burden |*A*| *R*| *V*|\n|:---:| :--:|:---:|:---:|:---:|\n|   Multi Krum |$\\mathcal{O}(K \\times \\|w\\|)$| 50.93 | 85.27 | 68.10  |\n|TrimmedMedian  |$\\mathcal{O}(K\\times \\|w\\|)$|46.80 | 73.69 | 60.25|\n|  DnC|$\\mathcal{O}(K \\times \\|w\\|)$| 60.87 | 84.70 | 72.78 |\n|  Our SDEA|$\\mathcal{O}(2 K\\times \\|w\\|)$ | 65.19 |93.59 |**79.39**|", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "T4EcbTF7dH", "reviewer": "Reviewer_oCkz", "summary": "The paper addresses the issue of backdoor attacks in federated learning systems, where malicious clients introduce triggers in their local models to compromise the global model. They use Fisher Information to determine parameter importance, reweight client updates, and identify malicious clients. The method is designed to handle backdoor attacks even in heterogeneous federated scenarios, showing empirical effectiveness through various experiments.", "questions": "See weakness.", "limitations": "There is no negative impact in this paper. The limitations mentioned by the authors can provide a more comprehensive method in the future research direction.", "rating": 9, "confidence": 5, "soundness": 3, "presentation": 4, "contribution": 4, "strengths": "1. The method is novel. By leveraging Fisher Information to quantify parameter importance and reweight client updates, the paper presents a unique and effective solution to a challenging problem.\n\n2. The method is specifically designed to work in heterogeneous federated learning environments. The empirical results demonstrate its robustness and effectiveness, making it a valuable contribution to the field.\n\n3. The paper provides extensive empirical validation through experiments on multiple datasets and backdoor attack scenarios. This thorough evaluation adds credibility to the proposed method and shows its practical applicability.\n\n4. The method shows faster and more stable convergence rates in various experimental settings.", "weaknesses": "1. More details about Data Heterogeneity can be provided in Section 4.1\n\n2. More analysis on the details of the experimental results can be provided to support the conclusion.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "## **Response to Reviewer oCkz**\n\nDear Reviewer oCkz:\n\nThank you for affirming our work and raising insightful questions. We are pleased you found our method novel and effective, leveraging Fisher Information to quantify parameter importance and reweight client updates. We appreciate your acknowledgment of its practical applicability and faster, more stable convergence rates.\n### Weakness\n\n**W1: More details about Data Heterogeneity can be provided in Section 4.1.**\n\nThank you for your advice. Regarding data heterogeneity, we focus on generating non-independent and identically distributed (non-IID) distributions among clients. In our work, we draw  $p_c \\sim Dir_c (\\beta)$  from the Dirichlet distribution and allocate a $p_{c,k}$  proportion of the instances of class  $c$  to participant $k$, where  $Dir(\\beta)$  is a concentration parameter controlling the similarity among clients. With this partitioning strategy, increased data heterogeneity results in each party having relatively fewer data samples in some classes. Thus, the smaller the $\\beta$ value, the more imbalanced the local distribution. We set $\\beta$ to 0.5 and 0.3 for the subsequent experimental comparisons. We will update the details about data heterogeneity to make it easy to understand！\n\n**W2: More analysis on the details of the experimental results can be provided to support the conclusion.**\n\nThanks for your suggestion! We provide a comprehensive discussion comparing existing methods with our approach. As data heterogeneity severity and the number of backdoor attackers increase, various methods naturally present a certain degree of defense degradation. Specifically, for Distance Difference Defense methods, such as Multi-Krum and DnC, measure the distance among client updates to identify backdoor attackers. These methods face a significant decrease in defense ability with challenging data heterogeneity, i.e., $\\beta=0.3$. Furthermore, statistical distribution defense methods, such as Trimmed Mean and Bulyan, calculate general statistical information to depict normal client behavior, making them sensitive to large scales of malicious attackers. For instance, with a malicious ratio $\\Upsilon=30\\%$, these methods demonstrate fragile defensive capabilities against backdoor attackers. In contrast, our method leverages inherent network characteristics to measure parameter importance towards agnostic distribution, revealing that benign and malicious clients exhibit distinct degrees of parameter importance. Thus, our method demonstrates stable robustness towards varying data heterogeneity and different scales of backdoor attacks. We will provide a detailed experiment analysis in our final version!", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "Fnbd5aRTO9", "reviewer": "Reviewer_7qoM", "summary": "This paper presents an innovative approach to mitigating backdoor attacks in federated learning systems. The authors introduce the Fisher Discrepancy Cluster and Rescale (FDCR) method, which leverages Fisher Information to assess parameter importance in local distributions. By reweighting client parameter updates and identifying significant discrepancies, the FDCR method effectively identifies and mitigates backdoor attackers. The paper demonstrates the efficacy of this approach through empirical results on various federated learning scenarios, highlighting its robustness and effectiveness.", "questions": "The authors are expected to address the concerns in the block of \"Weaknesses\".", "limitations": "Limitations are discussed in the paper. For the negative societal impact, I didn't find any concern from my side.", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 4, "contribution": 3, "strengths": "1. Innovative Methodology: The FDCR method introduces a novel approach by using Fisher Information to measure parameter importance, which is a significant contribution to backdoor defense in heterogeneous federated learning.\n\n2. Combination of Client Selection and Parameter Aggregation: The dual approach of client selection and parameter aggregation enhances the overall effectiveness of the method, addressing multiple aspects of the backdoor attack problem.\n\n3. Robustness Across Multiple Scenarios: The empirical results demonstrate that FDCR consistently outperforms other methods across different datasets and backdoor attack scenarios, highlighting its robustness and generalizability.", "weaknesses": "1. Long-term Stability: The long-term stability of the FDCR method over multiple communication rounds is not fully evaluated. It is important to assess whether the method remains effective as the federated learning process continues over many iterations.\n\n2. Clustering Description: Although authors provide a full comparision for different clustering methods. But the selected cluster method (Finch) is not thoroughly introduced. This could make readers feel confused. The authors should provide a clear descprition of how to use the Finch in your method.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "## **Response to Reviewer 7qoM**\n\nDear Reviewer 7qoM:\n\nThank you for your thoughtful review. We appreciate your recognition of our innovative use of Fisher Information in our method, the dual approach of client selection and parameter aggregation, and its robustness across various scenarios.  We aim to address your concerns in our detailed responses below, hoping to provide clarity and demonstrate the effectiveness of our proposed approach.\n\n### Weakness\n\n**W1: Long-term Stability: The long-term stability of the FDCR method over multiple communication rounds is not fully evaluated. It is important to assess whether the method remains effective as the federated learning process continues over many iterations.**\n\nA1: We acknowledge the importance of evaluating the long-term stability of our method over multiple communication rounds. To address this, we have conducted extensive experiments to assess the effectiveness of our method over an extended number of iterations, i.e., 100 epochs. Our results, as shown in the following table, demonstrate that the FDCR method maintains robust backdoor defense capabilities across different datasets and varying degrees of data heterogeneity. We will update the experimental results in the final version!\n\n*Table: **Comparison with the state-of-the-art backdoor robust solutions**: in Cifar-10, Fashion-MNIST,\nand USPS scenarios with skew ratio $\\beta=0.5$ and malicious proportion $\\Upsilon=20\\%$.  *A* and *R* mean federated benign performance and backdoor failure rate. *V* measures the heterogeneity and robustness trade-off.*\n| Dataset | | Cifar-10 | | |Fashion-MNIST | | |USPS| |\n|:---:| :---:|:---:|:---:|:---:|:---:|:---:|:---:|:---:|:---:|\n|   Method  |*A*| *R*| *V* |*A*| *R*| *V* |*A*| *R*| *V*|\n|    DnC  | 62.97 | 77.52 |  70.24| 87.34 |  88.54 |**87.94** |  95.18 | 4.56 | 49.87 |\n|  FLTrust| 48.29 |  69.91 | 59.10 |71.02 | 6.36 | 38.69| 94.76 |  72.01 | 83.38 |\n|  SageFlow|65.90 |  48.88 | 57.39 |88.55|  4.85 |  46.70| 96.32 |4.94 |50.63|\n|  Our FDCR| 55.91 | 95.66 |**75.79**| 86.39 | 88.05 | 87.22 | 96.67 | 89.86 |**93.26**|\n\n\n\n**W2: Clustering Description: Although authors provide a full comparision for different clustering methods. But the selected cluster method (Finch) is not thoroughly introduced. This could make readers feel confused. The authors should provide a clear descprition of how to use the Finch in your method.**\n\nA2: The selected clustering method, Finch, considers the nearest neighbor of each sample as sufficient support for grouping and implicitly selects characteristic prototypes, as prototypes from different domains are less likely to be first neighbors. In our work, we use the Euclidean metric to evaluate the distance between any two client gradient update discrepancies and view the weight with the minimum distance as its “neighbor”, sorting it into the same set. After clustering, we regard the group with the maximum mean weight as the malicious clients and then eliminate their aggregation weights for backdoor defense in heterogeneous federated learning. In our final version, we will provide a comprehensive description of the selected cluster method.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "82s0bUEULc", "reviewer": "Reviewer_AqVq", "summary": "This paper focuses on backdoor defenses in the setting of heterogeneous federated learning. The authors reveal that benign and malicious clients present distinct parameter importance degree. Based on these observations, they propose a method to exclude malicious participants by evaluating parameter importance. The paper includes a thorough comparison with various methods across different datasets.", "questions": "no", "limitations": "yes", "rating": 7, "confidence": 4, "soundness": 4, "presentation": 3, "contribution": 3, "strengths": "- The paper is well-organized and easy to follow. The authors provide a comprehensive literature review.\n- The targeted topic is critical in federated learning. The proposed method uses random public dataset for defense under heterogeneous scenarios, without relying on two assumptions in many current methods: homogeneous distributions and proxy datasets.\n- The observation that benign and malicious clients appear distinct parameter important degree is interesting. The corresponding method is novel and reasonable.\n- Experiments under various FL datasets, heterogeneity degrees, malicious ratios, and random datasets show the effectiveness of the proposed method.", "weaknesses": "- In page 6, the authors discuss the clustering methods in cooperative cluster module and compare with K-Means and DBSCAN. But it is unclear how these methods are achieved, e.g., how the authors choose the hyper-parameters.\n- For Figure1, whether this Client parameter importance degree similarity would be affected in the large client scale.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "## **Response to Reviewer AqVq**\n\nDear Reviewer AqVq:\n\nWe thank the reviewer for the appreciation and valuable comments. We are pleased you found our paper well-organized and our literature review comprehensive. Your recognition of our novel approach and its effectiveness in various scenarios is encouraging. We aim to address your concerns in detail below.\n\n### Weakness\n\n**W1: In page 6, the authors discuss the clustering methods in the cooperative cluster module and compare them with K-Means and DBSCAN. But it is unclear how these methods are achieved, e.g., how the authors choose the hyper-parameters.**\n\nA1: In our study, we compare both K-Means and DBSCAN. For K-Means, it iteratively assigns points to a fixed number of groups and focuses on partitioning the observed samples into k clusters. Each instance belongs to the cluster with the nearest cluster center, thereby minimizing within-cluster variances. We set the cluster center scale to 2 for the benign and malicious groups. As for DBSCAN, it is a density-based clustering algorithm that identifies densely packed areas of data points and distinguishes them from sparser, noise-labeled regions. DBSCAN operates with two primary hyperparameters: eps, the maximum distance between two points for one to be considered in the neighborhood of the other, and min_samples, the minimum number of points required to form a dense region. For our experiments, we selected eps = 0.05 and min_samples = 1. We will add the introduction and hyperparameter details in the manuscript!\n\n**W2: For Figure1, whether this Client parameter importance degree similarity would be affected in the large client scale.**\n\nA2: The similarity in client parameter importance degree is calculated based on client distribution behaviors, ie., benign and malicious intents, and thus remains unaffected by the scale of client participation. We further validate this through experiments conducted on the Cifar-10 dataset ($\\beta=0.5$) involving 15 clients, which includes eleven normal participants and four backdoor attackers, as shown in the following table. The results demonstrate a distinct difference in the client parameter importance between benign and malicious clients.\n\n*Table: **The similarity matrix for client parameter importance** reveals significant parameter importance differences between benign and malicious groups. Experiments were conducted on the CIFAR-10 dataset ($\\beta=0.5$) with **four** backdoor and **eleven** benign clients. We measured the parameter importance based on the Fisher Information.*\n|Client Index |0|1|2|3|4|5|6|7|8 |9 |10 |11 (Evil)|12 (Evil)|13 (Evil)| 14 (EVil)|\n|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|-|\n|**0**|1.0000| 0.1930| 0.3412| 0.5356| 0.5621| 0.1975| 0.3853| 0.4329| 0.1797|    0.2294| 0.4735| 0.0784| 0.1114| 0.1776| 0.0665|\n|**1**|0.1930| 1.0000| 0.1448| 0.1967| 0.2762| 0.1802| 0.2707| 0.5343| 0.5597|    0.1454| 0.2181| 0.0622| 0.0949| 0.1249| 0.0481|\n|**2**|0.3412| 0.1448| 1.0000| 0.2716| 0.2752| 0.2747| 0.3368| 0.3262| 0.1652|    0.2502| 0.4663| 0.0651| 0.0841| 0.1722| 0.1077|\n|**3**|0.5356| 0.1967| 0.2716| 1.0000| 0.5244| 0.1536| 0.2647| 0.3254| 0.2212|    0.1416| 0.5704| 0.0642| 0.0605| 0.0927| 0.0395|\n|**4**|0.5621| 0.2762| 0.2752| 0.5244| 1.0000| 0.2014| 0.4969| 0.5118| 0.3136|    0.3476| 0.4479| 0.1006| 0.1742| 0.1462| 0.0853|\n|**5**|0.1975| 0.1802| 0.2747| 0.1536| 0.2014| 1.0000| 0.2942| 0.2802| 0.1090|    0.1484| 0.1820| 0.0548| 0.1157| 0.1601| 0.0643|\n|**6**|0.3853| 0.2707| 0.3368| 0.2647| 0.4969| 0.2942| 1.0000| 0.5005| 0.1661|    0.4577| 0.3612| 0.0962| 0.1296| 0.1181| 0.0665|\n|**7**|0.4329| 0.5343| 0.3262| 0.3254| 0.5118| 0.2802| 0.5005| 1.0000| 0.2883|    0.4163| 0.4292| 0.1024| 0.1614| 0.1712| 0.0640|\n|**8**|0.1797| 0.5597| 0.1652| 0.2212| 0.3136| 0.1090| 0.1661| 0.2883| 1.0000|    0.1025| 0.2159| 0.0741| 0.0955| 0.1207| 0.0654|\n|**9**|0.2294| 0.1454| 0.2502| 0.1416| 0.3476| 0.1484| 0.4577| 0.4163| 0.1025|    1.0000| 0.2142| 0.0761| 0.1473| 0.1354| 0.0904|\n|**10**|0.4735| 0.2181| 0.4663| 0.5704| 0.4479| 0.1820| 0.3612| 0.4292| 0.2159|    0.2142| 1.0000| 0.0414| 0.0727| 0.0814| 0.0467|\n|**11(Evil)**|0.0784| 0.0622| 0.0651| 0.0642| 0.1006| 0.0548| 0.0962| 0.1024| 0.0741|    0.0761| 0.0414| 1.0000| 0.2374| 0.2529| 0.1504|\n|**12(Evil)**|0.1114| 0.0949| 0.0841| 0.0605| 0.1742| 0.1157| 0.1296| 0.1614| 0.0955|    0.1473| 0.0727| 0.2374| 1.0000| 0.5076| 0.5568|\n|**13(Evil)**|0.1776| 0.1249| 0.1722| 0.0927| 0.1462| 0.1601| 0.1181| 0.1712| 0.1207|    0.1354| 0.0814| 0.2529| 0.5076| 1.0000| 0.4377|\n|**14(Evil)**|0.0665| 0.0481| 0.1077| 0.0395| 0.0853| 0.0643| 0.0665| 0.0640| 0.0654|    0.0904| 0.0467| 0.1504| 0.5568| 0.4377| 1.0000|", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Meta-review: This paper considers backdoor attacks on federated learning (FL). This is a particularly difficult challenge in the area of poisoning attacks on training, as malicious parties to learning can poison the global model directly. As a result, existing defences tend to make strong assumptions about data characteristics or access to data. The paper considers the interesting heterogeneous data environment, and proposes the Fisher Discrepancy Cluster and Rescale (FDCR) method to estimate parameter importance for local distributions, and then weight client contributions by importance (further aligning well with the heterogenous setting); this also facilitates identification of malicious parties. The FDCR is based on a natural difference/differential of output distribution wrt party parameters; this is estimated by a quadratic form involving the Fisher Information Matrix; this is approximated by its diagonal, which is in turn (Monte Carlo) estimated from training data; this is then stabilised. Party/client gradient updates are then reweighted using this parameter importance. A difference is taken between the resulting global gradient and party/client gradient, can be used to highlight malicious differences and purify identified malicious parties. The earlier parameter importance can finally be used to rescale gradients, in a process termed Fisher Parameter Rescale Aggregation (FPRA).

Some reviewers praised the writing – I found some of the phrasing and grammar awkward, but possible to be followed. Perhaps more critical, but not a blocker for publication, is that the series of approximations are sometimes very conventional (using the FIM diagonal) and other times (stabilisation, aggregation, etc.) accompanied by some intuition, but afforded relatively little discussion / appearing arbitrary. The paper would benefit from better theoretical underpinnings in future work. Concerns highlighted by reviewers were relatively minor, and discussed. Computational cost of FIM approximation is well known and mitigated in the conventional way, and comes out to be linear in parameters. Long-term stability of multiple rounds was raised, and explored in the author discussion. Robustness relative to SOTA was also discussed.

While I agree with the sentiment towards acceptance by oCkz I found their score perhaps not well calibrated, and overly positive.

Overall, the reviewers were very positive, citing the FDCR as being interesting and having good empirical support for its positive contribution. The complementarity of FDCR and FPRA is appreciated. Empirical results show excellent performance, and the scope of heterogeneous data was uniformly praised.
Decision: Accept (poster)