Title: Robust Distributed Learning: Tight Error Bounds and Breakdown Point under Data Heterogeneity
Venue: NeurIPS 2023
Accepted: yes
Keywords: Optimization

Byzantine resilience

Distributed machine learning

federated learning
Abstract: The theory underlying robust distributed learning algorithms, designed to resist adversarial machines, matches empirical observations when data is homogeneous. Under data heterogeneity however, which is the norm in practical scenarios, established lower bounds on the learning error are essentially vacuous and greatly mismatch empirical observations. This is because the heterogeneity model considered is too restrictive and does not cover basic learning tasks such as least-squares regression. We consider in this paper a more realistic heterogeneity model, namely $(G,B)$-gradient dissimilarity, and show that it covers a larger class of learning problems than existing theory. Notably, we show that the breakdown point under heterogeneity is lower than the classical fraction $\frac{1}{2}$. We also prove a new lower bound on the learning error of any distributed learning algorithm. We derive a matching upper bound for a robust variant of distributed gradient descent, and empirically show that our analysis reduces the gap between theory and practice.

Robust Distributed Learning: Tight Error Bounds and Breakdown Point under Data Heterogeneity

Abstract

The theory underlying robust distributed learning algorithms, designed to resist adversarial machines, matches empirical observations when data is homogeneous . Under data heterogeneity however, which is the norm in practical scenarios, established lower bounds on the learning error are essentially vacuous and greatly mismatch empirical observations. This is because the heterogeneity model considered is too restrictive and does not cover basic learning tasks such as least-squares regression. We consider in this paper a more realistic heterogeneity model, namely ( G,B ) -gradient dissimilarity, and show that it covers a larger class of learning problems than existing theory. Notably, we show that the breakdown point under heterogeneity is lower than the classical fraction 1 / 2 . We also prove a new lower bound on the learning error of any distributed learning algorithm. We derive a matching upper bound for a robust variant of distributed gradient descent, and empirically show that our analysis reduces the gap between theory and practice.

1 Introduction

Distributed machine learning algorithms involve multiple machines (or workers ) collaborating with the help of a server to learn a common model over their collective datasets. These algorithms enable training large and complex machine learning models, by distributing the computational burden among several workers. They are also appealing as they allow workers to retain control over their local training data. Conventional distributed machine learning algorithms are known to be vulnerable to adversarial workers, which may behave unpredictably. Such behavior may result from software and hardware bugs, data poisoning, or malicious players controlling part of the network. In the parlance of distributed computing, such adversarial workers are referred to as Byzantine [24]. Due to the growing influence of distributed machine learning in public applications, a significant amount of work has been devoted to addressing the problem of robustness to Byzantine workers, e.g., see [34, 11, 2, 19, 13, 15].

Avast majority of prior work on robustness however assumes data homogeneity , i.e., local datasets are generated from the same distribution. This questions their applicability in realistic distributed learning scenarios with heterogeneous data , where local datasets are generated from different distributions. Under data homogeneity, Byzantine workers can only harm the system when the other workers compute stochastic gradient estimates, by exploiting the noise in gradient computations. This vulnerability can be circumvented using variance-reduction schemes [19, 13, 14]. In contrast, under data heterogeneity, variance-reduction schemes are not very helpful, as suggested by preliminary work [12, 20, 3]. In short, data heterogeneity is still poorly understood in robust distributed learning. In particular, existing robustness guarantees are extremely conservative, and often refuted by empirical observations. Indeed, the heterogeneity model generally assumed is typically violated in practice and does not even cover basic machine learning tasks such as least-squares regression.

Our work addresses the aforementioned shortcomings of existing theory, by considering a more realistic heterogeneity model, called ( G,B ) -gradient dissimilarity [18]. This criterion characterizes data heterogeneity for a larger class of machine learning problems compared to prior works [12, 20, 3], and enables us to reduce the gap between theoretical guarantees and empirical observations. Before summarizing our contributions in Section 1.2, we briefly recall below the essentials of robust distributed learning and highlight the challenges of data heterogeneity.

1.1 Robust distributed learning under heterogeneity

Consider a system comprising n workers w 1 , . . . , w n and a central server, where f workers of a priori unknown identity may be Byzantine. Each worker w i holds a dataset D i composed of m data points from an input space X , i.e., D i := { x ( i ) 1 , . . . , x ( i ) m } ∈ X m . Given a model parameterized by θ ∈ R d , each data point x incurs a loss ℓ ( θ ; x ) where ℓ : R d ×X → R . Thus, each worker w i has a local empirical loss function defined as L i ( θ ) := 1 m ∑ x ∈D i ℓ ( θ ; x ) . Ideally, when all the workers are assumed honest (i.e., non-Byzantine), the server can compute a model minimizing the global average loss function given by 1 n ∑ n i =1 L i ( θ ) , without requiring the workers to share their raw data points. However, this goal is rendered vacuous in the presence of Byzantine workers. A more reasonable goal for the server is to compute a model minimizing the global honest loss [16], i.e., the average loss of the honest workers. Specifically, denoting by H ⊆ [ n ] where |H| = n -f , the indices of honest workers, the goal in robust distributed learning is to solve the following optimization problem: 2

Because Byzantine workers may send bogus information and are unknown to the server, solving (even approximately) the optimization problem (1) is known to be impossible in general [26, 20]. The key reason for this impossibility is precisely data heterogeneity. Indeed, we cannot obtain meaningful robustness guarantees unless data heterogeneity is bounded across honest workers.

Modeling heterogeneity. Prior work on robustness primarily focuses on a restrictive heterogeneity bound we call G -gradient dissimilarity [12, 20, 3]. Specifically, denoting ∥ · ∥ to be the Euclidean norm, the honest workers are said to satisfy G -gradient dissimilarity if for all θ ∈ R d , we have

However, the above uniform bound on the inter-worker variance of local gradients may not hold in common machine learning problems such as least-squares regression, as we discuss in Section 3. In our work, we consider the more general notion of ( G,B ) -gradient dissimilarity , which is a prominent data heterogeneity model in the classical (Byzantine-free) distributed machine learning literature (i.e., when f = 0 ) [18, 23, 27, 29]. Recent works have also adopted this definition in the context of Byzantine robust learning [20, 14], but did not provide tight analyses, as we discuss in Section 5. Formally, ( G,B ) -gradient dissimilarity is defined as follows.

Assumption 1 ( ( G,B ) -gradient dissimilarity) . The local loss functions of honest workers (represented by set H ) are said to satisfy ( G,B ) -gradient dissimilarity if, for all θ ∈ R d , we have 3

Under ( G,B ) -gradient dissimilarity, the inter-worker variance of gradients need not be bounded, and can grow with the norm of the global loss function's gradient at a rate bounded by B . Furthermore, this notion also generalizes G -gradient dissimilarity, which corresponds to the special case of B = 0 .

1.2 Our contributions

We provide the first tight analysis on robustness to Byzantine workers in distributed learning under a realistic data heterogeneity model, specifically ( G,B ) -gradient dissimilarity. Our key contributions are summarized as follows.

Breakdown point. We establish a novel breakdown point for distributed learning under heterogeneity. Prior to our work, the upper bound on the breakdown point was simply 1 2 [26], i.e., when half (or more) of the workers are Byzantine, no algorithm can provide meaningful guarantees for solving (1). We prove that, under ( G,B ) -gradient dissimilarity, the breakdown point is actually 1 2+ B 2 . That is, the breakdown point of distributed learning is lower than 1 2 under heterogeneity due to non-zero growth rate B of gradient dissimilarity. We also confirm empirically that the breakdown point under heterogeneity can be much lower than 1 2 , which could not be explained prior to our work.

Tight error bounds. We show that, under the necessary condition f n < 1 2+ B 2 , any robust distributed learning algorithm must incur an optimization error in

on the class of smooth strongly convex loss functions. We also show that the above lower bound is tight. Specifically, we prove a matching upper bound for the class of smooth non-convex loss functions, by analyzing a robust variant of distributed gradient descent.

Proof techniques. To prove our new breakdown point and lower bound, we construct an instance of quadratic loss functions parameterized by their scaling coefficients and minima. While the existing lower bound under G -gradient dissimilarity can easily be obtained by considering quadratic functions with different minima and identical scaling coefficients (see proof of Theorem III in [20]), this simple proof technique fails to capture the impact of non-zero growth rate B in gradient dissimilarity. In fact, the main challenge we had to overcome is to devise a coupling between the parameters of the considered quadratic losses (scaling coefficients and minima) under the ( G,B ) -gradient dissimilarity constraint. Using this coupling, we show that when f n ≥ 1 2+ B 2 , the distance between the minima of the quadratic losses can be made arbitrarily large by carefully choosing the scaling coefficients, hence yielding an arbitrarily large error. We similarly prove the lower bound (3) when f n < 1 2+ B 2 .

1.3 Paper outline

The remainder of this paper is organized as follows. Section 2 presents our formal robustness definition and recalls standard assumptions. Section 3 discusses some key limitations of previous works on heterogeneity under G -gradient dissimilarity. Section 4 presents the impossibility and lower bound results under ( G,B ) -gradient dissimilarity, along with a sketch of proof. Section 5 presents tight upper bounds obtained by analyzing robust distributed gradient descent under ( G,B ) -gradient dissimilarity. Full proofs are deferred to appendices A, B and C. Details on the setups of our experimental results are deferred to Appendix D.

2 Formal definitions

In this section, we state our formal definition of robustness and standard optimization assumptions. Recall that an algorithm is deemed robust to adversarial workers if it enables the server to approximate a minimum of the global honest loss, despite the presence of f Byzantine workers whose identity is a priori unknown to the server. In Definition 1, we state the formal definition of robustness.

Definition 1 ( ( f, ε ) -resilience). A distributed algorithm is said to be ( f, ε ) -resilient if it can output a parameter ˆ θ such that

Accordingly, an ( f, ε ) -resilient distributed algorithm can output an ε -approximate minimizer of the global honest loss function, despite the presence of f adversarial workers. Throughout the paper, we assume that f n < 1 2 , as otherwise ( f, ε ) -resilience is in general impossible [26]. Note also that, for general smooth non-convex loss functions, we aim to find an approximate stationary point of the global honest loss instead of a minimizer, which is standard in non-convex optimization [8].

Standard assumptions. To derive our lower bounds, we consider the class of smooth strongly convex loss functions. We derive our upper bounds for smooth non-convex functions, and for functions satisfying the Polyak-Łojasiewicz (PL) inequality. This property relaxes strong convexity, i.e., strong

convexity implies PL, and covers learning problems which may be non-strongly convex such as least-squares regression [17]. We recall these properties in definitions 2 and 3 below.

Definition 2 ( L -smoothness) . A function L : R d → R is L -smooth if, for all θ, θ ′ ∈ R d , we have

This is equivalent [28] to, for all θ, θ ′ , having |L ( θ ′ ) -L ( θ ) -⟨∇L ( θ ) , θ ′ -θ ⟩| ≤ L 2 ∥ θ ′ -θ ∥ 2 .

Definition 3 ( µ -Polyak-Łojasiewicz (PL), strong convexity) . A function L : R d → R is µ -PL if, for all θ ∈ R d , we have

where L ∗ := min θ ∈ R d L ( θ ) . Function L is µ -strongly convex if, for all θ, θ ′ ∈ R d , we have

Note that a function satisfies L -smoothness and µ -PL inequality simultaneously only if µ ≤ L . Lastly, although not needed for our results to hold, when the global loss function L H is µ -PL, we will assume that it admits a unique minimizer, denoted θ ∗ , for clarity.

3 Brittleness of previous approaches on heterogeneity

Under the G -gradient dissimilarity condition, presented in (2), prior work has established lower bounds [20] and matching upper bounds [3] for robust distributed learning. However, G -gradient dissimilarity is arguably unrealistic, since it requires a uniform bound G 2 on the variance of workers' gradients over the parameter space. As a matter of fact, G -gradient dissimilarity does not hold in general for simple learning tasks such as least-squares regression, as shown in Observation 1 below.

Observation 1. In general, G -gradient dissimilarity (2) does not hold in least-squares regression.

Proof. Consider the setting given by X = R 2 , n = 2 , f = 0 , and d = 1 . For any data point ( x 1 , x 2 ) ∈ X , consider the squared error loss ℓ ( θ ; ( x 1 , x 2 )) = 1 2 ( θ · x 1 -x 2 ) 2 . Let the local datasets be D 1 = { (1 , 0) } , D 2 = { (0 , 1) } . Note that for all θ ∈ R , we have ∇L 1 ( θ ) = θ , and ∇L 2 ( θ ) = 0 . This implies that 1 |H| ∑ i ∈H ∥∇L i ( θ ) -∇L H ( θ ) ∥ 2 = θ 2 / 4 , where H = { 1 , 2 } , which is unbounded over R . Hence, the condition of G -gradient dissimilarity cannot be satisfied for any G ∈ R .

In contrast, the ( G,B ) -gradient dissimilarity condition, presented in Assumption 1, is more realistic, since it allows the variance across the local gradients to grow with the norm of the global gradient. This condition is common in the (non-robust) distributed learning literature [23, 18, 25, 29], and is also well-known in the (non-distributed) optimization community [8, 9, 32]. While G -gradient dissimilarity corresponds to the special case of ( G, 0) -gradient dissimilarity, we show in Proposition 1 below that a non-zero growth rate B of gradient dissimilarity allows us to characterize heterogeneity in a much larger class of distributed learning problems.

Proposition 1. Assume that the global loss L H is µ -PL and L -smooth, and that for each i ∈ H local loss L i is convex and L i -smooth. Denote L max := max i ∈H L i . Then, Assumption 1 is satisfied, i.e., the local loss functions satisfy ( G,B ) -gradient dissimilarity, with

We present the proof of Proposition 1 in Appendix A for completeness. However, note that it can also be proved following existing results [32, 21] derived in other contexts. The ( G,B ) -gradient dissimilarity condition shown in Proposition 1 is arguably tight (up to multiplicative factor 2 ), in the sense that G 2 cannot be improved in general. Indeed, as the ( G,B ) -gradient dissimilarity inequality should be satisfied for θ = θ ∗ , G 2 should be at least the variance of honest gradients at the minimum, i.e., 1 |H| ∑ i ∈H ∥∇L i ( θ ∗ ) ∥ 2 .

Gap between existing theory and practice. The theoretical limitation of G -gradient dissimilarity is exacerbated by the following empirical observation. We train a linear least-squares regression

model on the mg LIBSVM dataset [10]. The system comprises 7 honest and 3 Byzantine workers. We simulate extreme heterogeneity by having each honest worker hold one distinct point. We implement four well-studied Byzantine attacks: sign flipping (SF) [2], fall of empires (FOE) [33], a little is enough (ALIE) [5] and mimic [20]. More details on the experimental setup can be found in Appendix D. We consider the state-of-the-art robust variant of distributed gradient descent (detailed later in Section 5.1) that uses the NNM robustness scheme [3] composed with coordinate-wise trimmed mean. The empirical success on this learning task, which could not be explained by existing theory under G -gradient dissimilarity following Observation 1, is covered under ( G,B ) -gradient dissimilarity, as per Proposition 1. We present formal robustness guarantees under ( G,B ) -gradient dissimilarity later in Section 5. Additionally, through experimental evaluations in Section 5, we observe that even if G -gradient dissimilarity were assumed to be true, the bound G 2 may be extremely large in practice, thereby inducing a non-informative error bound O ( f / n · G 2 ) [20]. On the other hand, under ( G,B ) -gradient dissimilarity, we obtain tighter bounds matching empirical observations.

0.0

0.5

1.0

1.5

2.0

2.5

3.0

3.5

4.0

Steps

1e4

0.15

0.20

0.25

0.30

0.35

0.40

0.45

0.50

Training Loss

f = 0

f = 3 ; SF

f = 3 ; FOE

f = 3 ; ALIE

f = 3 ; Mimic

0.0

0.2

0.4

0.6

f = 0

f = 3 ; SF

f = 3 ; FOE

f = 3 ; ALIE

f = 3 ; Mimic

0.8

4 Fundamental limits on robustness under ( G,B ) -Gradient Dissimilarity

Theorem 1 below shows the fundamental limits on robustness in distributed learning under ( G,B ) -gradient dissimilarity. The result has twofold implications. On the one hand, we show that the breakdown point of any robust distributed learning algorithm reduces with the growth rate B of gradient dissimilarity. On the other hand, when the fraction f / n is smaller than the breakdown point, both G and B induce a lower bound on the learning error.

Theorem 1. Let 0 < f < n/ 2 . Assume that the global loss L H is L -smooth and µ -strongly convex with 0 < µ < L . Assume also that the honest local losses satisfy ( G,B ) -gradient dissimilarity (Assumption 1) with G > 0 . Then, a distributed algorithm can be ( f, ε ) -resilient only if

Sketch of proof. The full proof is deferred to Appendix B. In the proof, we construct hard instances for ( f, ε ) -resilience, using a set of quadratic functions of the following form:

To prove the theorem, we consider two plausible scenarios corresponding to two different identities of honest workers, which are unknown to the algorithm. Specifically, in scenarios I and II, we assume the indices of honest workers to be S 1 := { 1 , . . . , n -f } and S 2 := { f +1 , . . . , n } , respectively.

0.175

0.150

0.125

0.100

0.075

0.050

0.025

0.000

We show that for all θ ∈ R d ,

That is, every model in the parameter space incurs an error that grows with ∥ z ∥ 2 , in at least one of the two scenarios. Hence, an ( f, ε ) -resilient algorithm, by Definition 1, must guarantee optimization error ε in both scenarios I and II, which together with (5) implies that

At this point, to obtain the largest lower bounds possible, our goal is to maximize the right-hand side of 6, under the constraint that the loss functions induced by the triplet ( α, K, z ) satisfy ( G,B ) -gradient dissimilarity, L -smoothness and µ -strong convexity (simultaneously in both scenarios). We separately analyze this error in two cases: (i) f n ≥ 1 2+ B 2 and (ii) f n < 1 2+ B 2 . In both cases, we construct a coupling between the values of z and K by having the norm ∥ z ∥ 2 proportional to K . Specifically, in case (i), we show that the condition f n ≥ 1 2+ B 2 allows us to choose K arbitrarily large while satisfying ( G,B ) -dissimilarity. Thus, ∥ z ∥ 2 being proportional to K means that ε is arbitrarily large as per (6). Similarly, in case (ii) where f n < 1 2+ B 2 , K cannot be arbitrarily large and carefully choosing a large possible value yields

One of the crucial components to the above deductions was finding the suitable triplets ( α, K, z ) while preserving the ( G,B ) -gradient dissimilarity assumption (along with the smoothness and strong convexity assumptions) simultaneously in both the two scenarios, thereby establishing their validity. While the exact calculations are tedious, intuitively, B constrains the relative difference between the scale parameters α and 1 K , and G constrains the separation between the minima, i.e. ∥ z ∥ 2 .

Extension to non-convex problems. The lower bound from Theorem 1 assumes that the given distributed algorithm satisfies ( f, ε ) -resilience, which means finding an ε -approximate minimizer of the global honest loss L H . The latter may not be possible for the general case of smooth and non-convex functions. In that case we cannot seek an ε -approximate minimizer, but rather an ε -approximate stationary point [20, 3], i.e., ˆ θ such that ∥∇L H ( ˆ θ ) ∥ 2 ≤ ε . Then the lower bound in Theorem 1, in conjunction with the µ -PL inequality, yields the following lower bound

Comparison with prior work. The result of Theorem 1 generalizes the existing robustness limits derived under G -gradient dissimilarity [20]. In particular, setting B = 0 in Theorem 1, we recover the breakdown point 1 2 and the optimization lower bound Ω( f / n · G 2 ) . Perhaps, the most striking contrast to prior work [12, 20, 13, 3] is our breakdown point 1 2+ B 2 , instead of simply 1 2 . We remark that a similar dependence on heterogeneity has been repeatedly assumed in the past, but without any formal justification. For instance, under (0 , B ) -gradient dissimilarity, [20, Theorem IV] assumes f / n = O ( 1 / B 2 ) to obtain a formal robustness guarantee. In the context of robust distributed convex optimization (and robust least-squares regression), the upper bound assumed on the fraction f / n usually depends upon the condition number of the distributed optimization problem, e.g., see [6, Theorem 3] and [16, Theorem 2]. Our analysis in Theorem 1 justifies these assumptions on the breakdown point in prior work under heterogeneity.

Empirical breakdown point. Interestingly, our breakdown point 1 2+ B 2 allows to better understand some empirical observations indicating that the breakdown point of robust distributed learning algorithms is smaller than 1 / 2 . We illustrate this in Figure 2 with a logistic regression model on the MNIST dataset under extreme heterogeneity , i.e., each worker dataset contains data points from a

single class. We consider the state-of-the-art robust variant of distributed gradient descent (detailed later in Section 5.1) that uses the NNM robustness scheme composed with robust aggregation rules, namely, coordinate-wise trimmed-mean (CW Trimmed Mean) [34], Krum [7], coordinate-wise median (CW Median) [34] and geometric median [31, 30, 1]. We observe that all these methods consistently fail to converge as soon as the fraction of Byzantine workers exceeds 1 4 , which is well short of the previously known theoretical breakdown point 1 2 . Theorem 1, to the best of our knowledge, provides the first formal justification to this empirical observation.

0.0

0.1

0.2

0.3

0.4

0.5

Fraction of byzantine workers

0.5

1

1.5

2

initial

loss

value

2.5

Best training loss over 500 steps

CW Trimmed Mean

Krum

CW Median

Geometric Median

0.0

0.1

0.2

0.3

0.4

0.5

Fraction of byzantine workers

10

20

30

40

50

60

70

80

90

CW Trimmed Mean

Krum

CW Median

Geometric Median

5 Tight upper bounds under ( G,B ) -Gradient Dissimilarity

We demonstrate in this section that the bounds presented in Theorem 1 are tight. Specifically, we show that a robust variant of distributed gradient descent, referred to as robust D-GD , yields an asymptotic error that matches the lower bound under ( G,B ) -gradient dissimilarity, while also proving the tightness of the breakdown point. Lastly, we present empirical evaluations showcasing a significant improvement over existing robustness analyses that relied upon G -gradient dissimilarity.

5.1 Convergence analysis of robust D-GD

In robust D-GD, the server initially possesses a model θ 0 . Then, at each step t ∈ { 0 , . . . , T -1 } , the server broadcasts model θ t to all workers. Each honest worker w i sends the gradient g ( i ) t = ∇L i ( θ t ) of its local loss function at θ t . However, a Byzantine worker w j might send an arbitrary value for its gradient. Upon receiving the gradients from all the workers, the server aggregates the local gradients using a robust aggregation rule F : R d × n → R d . Specifically, the server computes R t := F ( g (1) t , . . . , g ( n ) t ) . Ultimately, the server updates the current model θ t to θ t +1 = θ t -γR t , where γ > 0 is the learning rate . The full procedure is summarized in Algorithm 1.

Algorithm 1: Robust D-GD

To analyze robust D-GD under ( G,B ) -gradient dissimilarity, we first recall the notion of ( f, κ ) -robustness in Definition 4 below. First introduced in [3], ( f, κ ) -robustness is a general property of robust aggregation that covers several existing aggregation rules.

Definition 4 ( ( f, κ ) -robustness) . Let n ≥ 1 , 0 ≤ f < n/ 2 and κ ≥ 0 . An aggregation rule F : R d × n → R d is said to be ( f, κ ) -robust if for any vectors x 1 , . . . , x n ∈ R d , and any set S ⊆ [ n ] of size n -f , the output ˆ x := F ( x 1 , . . . , x n ) satisfies the following:

where x S := 1 | S | ∑ i ∈ S x i . We refer to κ as the robustness coefficient of F .

Closed-form robustness coefficients for multiple aggregation rules can be found in [3]. For example, assuming n ≥ (2 + η ) f , for some η > 0 , κ = Θ( f n ) for coordinate-wise trimmed mean, κ = Θ(1) for coordinate-wise median, and κ F ◦ NNM = Θ( f n ( κ +1)) when F is composed with NNM [3].

Assuming F to be an ( f, κ ) -robust aggregation rule, we show in Theorem 2 below the convergence of robust D-GD in the presence of up to f Byzantine workers, under ( G,B ) -gradient dissimilarity.

Theorem 2. Let 0 ≤ f < n/ 2 . Assume that the global loss L H is L -smooth and that the honest local losses satisfy ( G,B ) -gradient dissimilarity (Assumption 1). Consider Algorithm 1 with learning rate γ = 1 L . If the aggregation F is ( f, κ ) -robust with κB 2 < 1 , then the following holds for all T ≥ 1 .

In the general case where L H may be non-convex, we have

In the case where L H is µ -PL, we have

Tightness of the result. We recall that the best possible robustness coefficient for an aggregation F is κ = f / n -2 f (see [3]). For such an aggregation rule, the sufficient condition κB 2 < 1 reduces to f / n -2 f · B 2 < 1 or equivalently f / n < 1 / 2+ B 2 . Besides, robust D-GD guarantees ( f, ε ) -resilience, for µ -PL losses, where we have ε = O ( f / n -(2+ B 2 ) f · G 2 ) asymptotically in T . Both these conditions on f / n and ε indeed match the limits shown earlier in Theorem 1. Yet, we are unaware of an aggregation rule with an order-optimal robustness coefficient, i.e., usually κ > f / n -2 f . However, as shown in [3], the composition of nearest neighbor mixing (NNM) with several aggregation rules, such as CW Trimmed Mean, Krum and Geometric Median, yields a robustness coefficient κ = Θ( f / n -2 f ) . Therefore, robust D-GD can indeed achieve ( f, ε ) -resilience with an optimal error ε = O ( f / n -(2+ B 2 ) f · G 2 ) , but for a suboptimal breakdown point. The same observation holds for the non-convex case, where the lower bound is given by (7). Lastly, note that when B = 0 , our result recovers the bounds derived in prior work under G -gradient dissimilarity [20, 3].

We remark that while the convergence rate of robust D-GD shown in Theorem 2 is linear (which is typical to convergence of gradient descent in strongly convex case), it features a slowdown factor of value 1 -κB 2 . Hence, suggesting that Byzantine workers might decelerate the training under heterogeneity. This slowdown is also empirically observed (e.g., see Figure 1). Whether this slowdown is fundamental to robust distributed learning is an interesting open question. Investigating such a slowdown in the stochastic case is also of interest, as existing convergence bounds are under G -gradient dissimilarity only, for strongly convex [4] and non-convex [3] cases.

Comparison with prior work. Few previous works have studied Byzantine robustness under ( G,B ) -gradient dissimilarity [20, 14]. While these works do not provide lower bounds, the upper bound they derive (see Appendix E in [20] and Appendix E.4 in [14]) are similar to Theorem 2, with some notable differences. First, unlike the notion of ( f, κ ) -robustness that we use, the so-called ( c, δ ) -agnostic robustness, used in [20, 14], is a stochastic notion. Under the latter notion, good parameters ( c, δ ) of robust aggregators were only shown when using a randomized method called Bucketing [20]. Consequently, instead of obtaining a deterministic error bound as in Theorem 2,

simply replacing cδ with κ in [20, 14] gives an expected bound, which is strictly weaker than the result of Theorem 2. Moreover, the corresponding non-vanishing upper bound term and breakdown point for robust D-GD obtained from the analysis in [20] for several robust aggregation rules (e.g., coordinate-wise median) are worse than what we obtain using ( f, κ ) -robustness.

5.2 Reducing the gap between theory and practice

In this section, we first argue that, even if we were to assume that the G -gradient dissimilarity condition (2) holds true, the robustness bounds derived in Theorem 2 under ( G,B ) -gradient dissimilarity improve upon the existing bounds [3] that rely on G -gradient dissimilarity. Next, we compare the empirical observations for robust D-GD with our theoretical upper bounds.

Comparing upper bounds. We consider a logistic regression model on MNIST dataset under extreme heterogeneity. While it is difficult to find tight values for parameters G and B satisfying ( G,B ) -gradient dissimilarity, we can approximate these parameters through a heuristic method. A similar approach can be used to approximate ̂ G for which the loss functions satisfy the condition of ̂ G -gradient dissimilarity. We defer the details on these approximations to Appendix D. In Figure 3, we compare the error bounds, i.e., f / n -(2+ B 2 ) f · G 2 and f / n -2 f · ̂ G 2 , guaranteed for robust D-GD under ( G,B ) -gradient dissimilarity and ̂ G -gradient dissimilarity, respectively. We observe that the latter bound is extremely large compared to the former, which confirms that the tightest bounds under G -gradient dissimilarity are vacuous for practical purposes.

0.10

0.15

0.20

0.25

0.30

0.35

0.40

0.45

Fraction of byzantine workers

0

50

100

150

200

250

300

350

Error

Upper bound with G-dissimilarity

Our upper bound with (G,B)-dissimilarity

0.05

0.10

0.15

0.20

0.25

0.30

0.35

0.40

0.45

Fraction of Byzantine workers

10

4

10

3

10

2

10

1

10 0

Best error gap over 40000 steps

SF

FOE

ALIE

mimic

Our upper bound

We further specialize the result of Theorem 2 to the convex case for which the ( G,B ) -gradient dissimilarity condition was characterized in Proposition 1. We have the following corollary.

Corollary 1. Assume that the global loss L H is µ -PL and L -smooth, and that for each i ∈ H local loss L i is convex and L i -smooth. Denote L max := max i ∈H L i and assume that κ ( 3 L max µ -1) ≤ 1 . Consider Algorithm 1 with learning rate γ = 1 L . If F is ( f, κ ) -robust, then for all T ≥ 1 , we have

The non-vanishing term in the upper bound shown in Corollary 1 corresponds to the heterogeneity at the minimum 1 |H| ∑ i ∈H ∥∇L i ( θ ∗ ) ∥ 2 . This quantity is considered to be a natural measure of gradient dissimilarity in classical (non-Byzantine) distributed convex optimization [22, 23]. As such, we believe that this bound cannot be improved upon in general.

Matching empirical performances. Since the upper bound in Corollary 1 requires computing the constants µ, L , we choose to conduct this experiment on least-squares regression, where the exact

computation of µ, L is possible. We compare the empirical error gap (left-hand side of Corollary 1) with the upper bound (right-hand side of Corollary 1). Our findings, shown in Figure 4, indicate that our theoretical analysis reliably predicts the empirical performances of robust D-GD, especially when the fraction of Byzantine workers is small. Note, however, that our upper bound is non-informative when more than 1 4 of the workers are Byzantine, as the predicted error exceeds the initial loss value. We believe this to be an artifact of the proof, i.e. the upper bound is meaningful only up to a multiplicative constant. Indeed, when visualizing the results in logarithmic scale in Figure 4, the shape of empirical measurements and our upper bounds are quite similar.

6 Conclusion and future work

This paper revisits the theory of robust distributed learning by considering a realistic data heterogeneity model, namely ( G,B ) -gradient dissimilarity. Using this model, we show that the breakdown point depends upon heterogeneity (specifically, 1 / 2+ B 2 ) and is smaller than the usual fraction 1 / 2 . We prove a new lower bound on the learning error of any distributed learning algorithm, which is matched using robust D-GD. Moreover, we show that our theoretical guarantees align closely with empirical observations, contrary to prior works which rely upon the stringent model of G -gradient dissimilarity.

An interesting future research direction is to investigate whether the 1 -κB 2 slowdown factor in the convergence rate of robust D-GD (Theorem 2) is unavoidable. Another interesting research problem is to derive lower (and upper) bounds independent of the heterogeneity model, thereby elucidating the tightness of the convergence guarantee of robust D-GD in the strongly convex case (Corollary 1).

References

Anish Acharya, Abolfazl Hashemi, Prateek Jain, Sujay Sanghavi, Inderjit S. Dhillon, and Ufuk Topcu. Robust training in high dimensions via block coordinate geometric median descent. In Gustau Camps-Valls, Francisco J. R. Ruiz, and Isabel Valera, editors, Proceedings of The 25th International Conference on Artificial Intelligence and Statistics , volume 151 of Proceedings of Machine Learning Research , pages 11145-11168. PMLR, 28-30 Mar 2022. URL https://proceedings.mlr.press/v151/acharya22a.html .

Zeyuan Allen-Zhu, Faeze Ebrahimianghazani, Jerry Li, and Dan Alistarh. Byzantine-resilient non-convex stochastic gradient descent. In International Conference on Learning Representations , 2020.

Youssef Allouah, Sadegh Farhadkhani, Rachid Guerraoui, Nirupam Gupta, Rafaël Pinot, and John Stephan. Fixing by mixing: A recipe for optimal Byzantine ML under heterogeneity. In International Conference on Artificial Intelligence and Statistics , pages 1232-1300. PMLR, 2023.

Youssef Allouah, Rachid Guerraoui, Nirupam Gupta, Rafaël Pinot, and John Stephan. On the privacy-robustness-utility trilemma in distributed learning. In International Conference on Machine Learning , number 202, 2023.

Moran Baruch, Gilad Baruch, and Yoav Goldberg. A little is enough: Circumventing defenses for distributed learning. In Advances in Neural Information Processing Systems 32: Annual Conference on Neural Information Processing Systems 2019, 8-14 December 2019, Long Beach, CA, USA , 2019.

Kush Bhatia, Prateek Jain, and Purushottam Kar. Robust regression via hard thresholding. Advances in neural information processing systems , 28, 2015.

Peva Blanchard, El Mahdi El Mhamdi, Rachid Guerraoui, and Julien Stainer. Machine learning with adversaries: Byzantine tolerant gradient descent. In I. Guyon, U. V. Luxburg, S. Bengio, H. Wallach, R. Fergus, S. Vishwanathan, and R. Garnett, editors, Advances in Neural Information Processing Systems 30 , pages 119-129. Curran Associates, Inc., 2017.

Léon Bottou, Frank E Curtis, and Jorge Nocedal. Optimization methods for large-scale machine learning. Siam Review , 60(2):223-311, 2018.

Volkan Cevher and Bãng Công V˜ u. On the linear convergence of the stochastic gradient method with constant step-size. Optimization Letters , 13(5):1177-1187, 2019.

Chih-Chung Chang and Chih-Jen Lin. Libsvm: a library for support vector machines. ACM transactions on intelligent systems and technology (TIST) , 2(3):1-27, 2011.

El Mahdi El Mhamdi, Rachid Guerraoui, and Sébastien Rouault. The hidden vulnerability of distributed learning in Byzantium. In Jennifer Dy and Andreas Krause, editors, Proceedings of the 35th International Conference on Machine Learning , volume 80 of Proceedings of Machine Learning Research , pages 3521-3530. PMLR, 10-15 Jul 2018. URL https://proceedings. mlr.press/v80/mhamdi18a.html .

El Mahdi El Mhamdi, Sadegh Farhadkhani, Rachid Guerraoui, Arsany Guirguis, Lê Nguyên Hoang, and Sébastien Rouault. Collaborative learning in the jungle (decentralized, Byzantine, heterogeneous, asynchronous and nonconvex learning). In Thirty-Fifth Conference on Neural Information Processing Systems , 2021.

Sadegh Farhadkhani, Rachid Guerraoui, Nirupam Gupta, Rafael Pinot, and John Stephan. Byzantine machine learning made easy by resilient averaging of momentums. In Kamalika Chaudhuri, Stefanie Jegelka, Le Song, Csaba Szepesvari, Gang Niu, and Sivan Sabato, editors, Proceedings of the 39th International Conference on Machine Learning , volume 162 of Proceedings of Machine Learning Research , pages 6246-6283. PMLR, 17-23 Jul 2022.

Eduard Gorbunov, Samuel Horváth, Peter Richtárik, and Gauthier Gidel. Variance reduction is an antidote to byzantines: Better rates, weaker assumptions and communication compression as a cherry on the top. In The Eleventh International Conference on Learning Representations , 2023. URL https://openreview.net/forum?id=pfuqQQCB34 .

Rachid Guerraoui, Nirupam Gupta, and Rafael Pinot. Byzantine machine learning: A primer. ACM Computing Surveys , 2023.

Nirupam Gupta and Nitin H Vaidya. Fault-tolerance in distributed optimization: The case of redundancy. In Proceedings of the 39th Symposium on Principles of Distributed Computing , pages 365-374, 2020.

Hamed Karimi, Julie Nutini, and Mark Schmidt. Linear convergence of gradient and proximalgradient methods under the polyak-łojasiewicz condition. In Machine Learning and Knowledge Discovery in Databases: European Conference, ECML PKDD 2016, Riva del Garda, Italy, September 19-23, 2016, Proceedings, Part I 16 , pages 795-811. Springer, 2016.

Sai Praneeth Karimireddy, Satyen Kale, Mehryar Mohri, Sashank Reddi, Sebastian Stich, and Ananda Theertha Suresh. Scaffold: Stochastic controlled averaging for federated learning. In International Conference on Machine Learning , pages 5132-5143. PMLR, 2020.

Sai Praneeth Karimireddy, Lie He, and Martin Jaggi. Learning from history for Byzantine robust optimization. International Conference On Machine Learning, Vol 139 , 139, 2021.

Sai Praneeth Karimireddy, Lie He, and Martin Jaggi. Byzantine-robust learning on heterogeneous datasets via bucketing. In International Conference on Learning Representations , 2022. URL https://openreview.net/forum?id=jXKKDEi5vJt .

Ahmed Khaled and Peter Richtárik. Better theory for SGD in the nonconvex world. Transactions on Machine Learning Research , 2022.

Ahmed Khaled, Konstantin Mishchenko, and Peter Richtárik. Tighter theory for local SGD on identical and heterogeneous data. In International Conference on Artificial Intelligence and Statistics , pages 4519-4529. PMLR, 2020.

Anastasia Koloskova, Nicolas Loizou, Sadra Boreiri, Martin Jaggi, and Sebastian Stich. A unified theory of decentralized SGD with changing topology and local updates. In International Conference on Machine Learning , pages 5381-5393. PMLR, 2020.

Leslie Lamport, Robert Shostak, and Marshall Pease. The Byzantine generals problem. ACM Trans. Program. Lang. Syst. , 4(3):382-401, jul 1982. ISSN 0164-0925. doi: 10.1145/357172. 357176. URL https://doi.org/10.1145/357172.357176 .

Tian Li, Anit Kumar Sahu, Manzil Zaheer, Maziar Sanjabi, Ameet Talwalkar, and Virginia Smith. Federated optimization in heterogeneous networks. Proceedings of Machine learning and systems , 2:429-450, 2020.

Shuo Liu, Nirupam Gupta, and Nitin H. Vaidya. Approximate Byzantine fault-tolerance in distributed optimization. In Proceedings of the 2021 ACM Symposium on Principles of Distributed Computing , PODC'21, page 379-389, New York, NY, USA, 2021. Association for Computing Machinery. ISBN 9781450385480. doi: 10.1145/3465084.3467902.

Aritra Mitra, Rayana Jaafar, George J Pappas, and Hamed Hassani. Linear convergence in federated learning: Tackling client heterogeneity and sparse gradients. Advances in Neural Information Processing Systems , 34:14606-14619, 2021.

Yurii Nesterov et al. Lectures on convex optimization , volume 137. Springer, 2018.

Maxence Noble, Aurélien Bellet, and Aymeric Dieuleveut. Differentially private federated learning on heterogeneous data. In International Conference on Artificial Intelligence and Statistics , pages 10110-10145. PMLR, 2022.

Krishna Pillutla, Sham M. Kakade, and Zaid Harchaoui. Robust aggregation for federated learning. IEEE Transactions on Signal Processing , 70:1142-1154, 2022. doi: 10.1109/TSP. 2022.3153135.

Christopher G Small. A survey of multidimensional medians. International Statistical Review/Revue Internationale de Statistique , pages 263-277, 1990.

Sharan Vaswani, Francis Bach, and Mark Schmidt. Fast and faster convergence of SGD for over-parameterized models and an accelerated perceptron. In The 22nd international conference on artificial intelligence and statistics , pages 1195-1204. PMLR, 2019.

Cong Xie, Oluwasanmi Koyejo, and Indranil Gupta. Fall of empires: Breaking Byzantinetolerant SGD by inner product manipulation. In Proceedings of the Thirty-Fifth Conference on Uncertainty in Artificial Intelligence, UAI 2019, Tel Aviv, Israel, July 22-25, 2019 , page 83, 2019.

Dong Yin, Yudong Chen, Ramchandran Kannan, and Peter Bartlett. Byzantine-robust distributed learning: Towards optimal statistical rates. In Jennifer Dy and Andreas Krause, editors, Proceedings of the 35th International Conference on Machine Learning , volume 80 of Proceedings of Machine Learning Research , pages 5650-5659. PMLR, 10-15 Jul 2018. URL https://proceedings.mlr.press/v80/yin18a.html .

Organization of the Appendix

Appendix A contains the proof of Proposition 1. Appendix B contains the impossibility result shown in Theorem 1. Appendix C contains the convergence proofs concerning Robust D-GD (Theorem 2, Corollary 1, and Proposition 1). Appendix D presents our experimental setups.

A Proof of Proposition 1

Proposition 1. Assume that the global loss L H is µ -PL and L -smooth, and that for each i ∈ H local loss L i is convex and L i -smooth. Denote L max := max i ∈H L i . Then, Assumption 1 is satisfied, i.e., the local loss functions satisfy ( G,B ) -gradient dissimilarity, with

Proof. Let θ ∈ R d . By bias-variance decomposition, we obtain that

Using triangle inequality, we have

For any pair of real values ( a, b ) , we have ( a + b ) 2 ≤ 2 a 2 + 2 b 2 . Using this inequality with a = ∥∇L i ( θ ) -∇L i ( θ ∗ ) ∥ and b = ∥∇L i ( θ ∗ ) ∥ in the above, we obtain that

Using the above in (8), we obtain that

For all i ∈ H , since L i is assumed convex and L i -smooth, we also have (see [28, Theorem 2.1.5]) for all θ ′ ∈ R d that

Substituting θ ′ = θ ∗ in the above, we have L i ( θ ) - L i ( θ ∗ ) - ⟨∇L i ( θ ∗ ) , θ -θ ∗ ⟩ ≥ 0 and ∥∇L i ( θ ) -∇L i ( θ ∗ ) ∥ 2 ≤ 2 L i ( L i ( θ ) -L i ( θ ∗ ) -⟨∇L i ( θ ∗ ) , θ -θ ∗ ⟩ ) . Therefore, as L max := max i ∈H L i , we have

Recall that L H := 1 |H| ∑ i ∈H L i . Thus, 1 |H| ∑ i ∈H L i ( θ ∗ ) = L H ( θ ∗ ) , and 1 |H| ∑ i ∈H ∇L i ( θ ∗ ) = ∇L H ( θ ∗ ) = 0 . Using this in (10), and then recalling that L H is assumed µ -PL, we have

Substituting the above in (9), we obtain that

The above proves the proposition.

B Proof of Theorem 1: Impossibility Result

For convenience, we recall below the theorem statement.

Theorem 1. Let 0 < f < n/ 2 . Assume that the global loss L H is L -smooth and µ -strongly convex with 0 < µ < L . Assume also that the honest local losses satisfy ( G,B ) -gradient dissimilarity (Assumption 1) with G > 0 . Then, a distributed algorithm can be ( f, ε ) -resilient only if

B.1 Proof outline

We prove the theorem by contradiction. We start by assuming that there exists an algorithm A that is ( f, ε ) -resilient when the conditions stated in the theorem for the honest workers are satisfied. We consider the following instance of the loss functions where parameters α and K are positive real values, and z ∈ R d is a vector.

We then consider two specific scenarios, each corresponding to different identities of honest workers: S 1 = { 1 , . . . , n -f } and S 2 = { f + 1 , . . . , n } . That is, we let S 1 and S 2 represent the set of honest workers in the first and second scenarios, respectively. Upon specifying certain conditions on parameters α , K and z we show that the corresponding honest workers' loss functions in either execution satisfy the assumptions stated in the theorem, i.e., the global loss functions are L -smooth µ -strongly convex and the honest local loss functions satisfy ( G,B ) -gradient dissimilarity. Since algorithm A is oblivious to the honest identities, it must ensure ( f, ε ) -resilience in both these scenarios. Consequently, we show that ε cannot be lower that a value that grows with K and ∥ z ∥ 2 . Using this approach, we first show that the lower bound on ε can be arbitrarily large when f n ≥ 1 2+ B 2 . Then, we obtain a non-trivial lower bound on ε in the case when f n < 1 2+ B 2 . The two scenarios, and corresponding loss functions, used in our proof are illustrated in Figure 5.

0

z

K

0

K

We make use of the following auxiliary results.

B.1.1 Unavoidable error due to anonymity of Byzantine workers

Lemma 1 below establishes a lower bound on the optimization error that any algorithm must incur in at least one of the two scenarios described above. Recall that S 1 = { 1 , . . . , n -f } and

S 2 = { f +1 , . . . , n } . Recall that for any non-empty subset S ⊆ [ n ] , we denote

Lemma 1. Consider the setting where the local loss functions are given by (11) , (12) , and (13) . In this particular case, the following holds for all θ ∈ R d :

The proof is deferred to Appendix B.3. We next analyze the ( G,B ) -gradient dissimilarity condition for the considered distributed learning setting.

B.1.2 Validity of ( G,B ) -gradient dissimilarity

In Lemma 2 below we derive necessary and sufficient conditions on α , K and z for ( G,B ) -gradient dissimilarity when the loss functions are given by (11), (12) and (13).

Lemma 2. Consider the setting where the local loss functions are given by (11) , (12) , and (13) . Denote

Suppose that S 1 = { 1 , . . . , n -f } denotes the set of honest workers. Then, the honest workers satisfy ( G,B ) -gradient dissimilarity if and only if

The proof of Lemma 2 is deferred to Appendix B.4. Since L I corresponds to L III with z = 0 , the result in the lemma above also holds true when the honest workers is represented by set S 2 = { f +1 , . . . , n } . Specifically, we have the following lemma.

Lemma 3. Consider a specific distributed learning setting where the local loss functions are as defined in (11) , (12) and (13) . We denote

Suppose that S 2 = { f +1 , . . . , n } denotes the set of honest workers. Then, the honest workers satisfy (0 , B ) -gradient dissimilarity if and only if A 1 ≤ 0 .

We do not provide a proof of Lemma 3, as it follows the proof of Lemma 2 verbatim upon simply substituting z = 0 R d and G = 0 .

B.2 Proof of Theorem 1

We prove the two assertions of Theorem 1, i.e., the necessity of f n < 1 2+ B 2 and the lower bound on ε , separately in sections B.2.1 and B.2.2, respectively.

B.2.1 Necessity of f n < 1 2+ B 2

In this section, we prove by contradiction the necessity of f n < 1 2+ B 2 by demonstrating that ε can be arbitrarily large if f n ≥ 1 2+ B 2 . Let 0 < f < n/ 2 , 0 < µ < L , G > 0 and B ≥ 0 .

Suppose that f n ≥ 1 2+ B 2 , or equivalently B 2 ≥ n -2 f f . Let A be an arbitrary ( f, ε ) -resilient distributed learning algorithm. We consider the setting where the local loss functions are given by (11), (12) and (13), and the corresponding parameters are given by

K is an arbitrary positive real number such that

and z ∈ R d is such that

Proof outline. In the proof, we consider two scenarios, each corresponding to two different identities of honest workers: S 1 = { 1 , . . . , n -f } and S 2 = { f +1 , . . . , n } . For each of these, we first show that the corresponding local and global honest loss functions satisfy the assumptions made in the theorem, invoking Lemma 2. Then, by invoking Lemma 1, we show that ε is proportional to K which (as per (17)) can be chosen to be arbitrarily large. This yields a contradiction to the assumption that A is ( f, ε ) -resilient, proving that ( f, ε ) -resilience is generally impossible when f n ≥ 1 2+ B 2 .

First scenario. Suppose that the set of honest workers is represented by S 1 = { 1 , . . . , n -f } . From (11) and (12), we obtain that

Substituting, from (16), α = n -f f µ in the above we obtain that

Therefore,

where I d denotes the identity matrix of size d . From (20), we deduce that L S 1 ( θ ) is ( n -2 f n -f 1 K + µ ) -smooth and ( n -2 f n -f 1 K + µ ) -strongly convex. From(17), we have K ≥ 1 α · n -2 f f · µ L -µ = n -2 f n -f · 1 L -µ .

This implies that n -2 f n -f 1 K + µ ≤ L -µ + µ = L . Clearly, ( n -2 f n -f 1 K + µ ) ≥ µ . Hence, the honest global loss function L S 1 is L -smooth µ -strongly convex. Next, invoking Lemma 2, we show that the honest workers satisfy ( G,B ) -gradient dissimilarity. We analyze below the terms A 1 , A 2 and A 3 introduced in Lemma 2 in this particular scenario.

Term A 1 . Recall from Lemma 2 that

Since we assume B 2 ≥ n -2 f f , we have 1 -f n -2 f B 2 ≤ 0 . Using this in the above we obtain that

As α, K > 0 , and by (17), K ≥ 1 α ≥ 1 α ( 1 -n -2 f f B 2 ) 1+ B 2 . Therefore, 1 + B 2 ≥ 1 αK ( 1 -n -2 f f B 2 ) . Using this in the above implies that

Term A 2 . Recall from Lemma 2 that

Therefore, as K > 0 and we assume n > 2 f , we have

As K ≥ 1 α > 0 , we have ( α -1 K ) 2 ≤ α 2 . Thus, from above we obtain that

Substituting from (18), i.e. ∥ z ∥ 2 = f n -2 f G 2 2 α · K , in the above implies that

Term A 3 . Recall from Lemma 2 that

As K > 0 and n > 2 f , we have

Substituting ∥ z ∥ 2 = f n -2 f G 2 2 α · K (see (18)), and then recalling that K ≥ 1 α (see (17)), yields

Invoking Lemma 2 . Using the results obtained above in (21), (23) and (24), we show below that the conditions stated in (15) of Lemma (2) are satisfied, i.e., A 1 ≤ 0 , A 3 ≤ G 2 and ∥ A 2 ∥ 2 ≤ A 1 ( A 3 -G 2 ) . Hence, we prove that the local loss functions for the honest workers in this particular scenario satisfy ( G,B ) -gradient dissimilarity.

First, from (21), we note that

Therefore,

Second, as a consequence of (24), A 3 ≤ G 2 . Lastly, recall from (23) that

As f ( n -2 f ) ( n -f ) 2 α K ≤ -A 1 (from (21)), from above we obtain that ∥ A 2 ∥ 2 ≤ -A 1 G 2 2 . Therefore, as G 2 ≥ 0 and G 2 ≤ 2( G 2 -A 3 ) (from (24)), ∥ A 2 ∥ 2 ≤ A 1 ( A 3 -G 2 ) .

This concludes the analysis for the first scenario. We have shown that the conditions on smoothness, strong convexity and ( G,B ) -gradient dissimilarity hold in this scenario.

Second scenario. Consider the set of honest workers to be S 2 = { f +1 , . . . , n } . Identical to (19) with z = 0 , from (12) and (13), we obtain that

Therefore, similar to the analysis of the first scenario, the global loss L S 2 satisfies L -smoothness and µ -strong convexity. Moreover, Lemma 3, in conjunction with the deduction in (25) that A 1 ≥ 0 , implies that the loss functions for the honest workers in this particular scenario satisfy (0 , B ) -gradient dissimilarity, thereby also satisfying ( G,B ) -gradient dissimilarity.

This concludes the analysis for the second scenario. We have shown that the conditions on smoothness, strong convexity and ( G,B ) -gradient dissimilarity indeed hold true in this scenario.

Final step: lower bound on ε in terms of K . We have established in the above that the conditions of smoothness, strong convexity and ( G,B ) -gradient dissimilarity are satisfied in both the scenarios. Therefore, by assumptions, algorithm A must guarantee ( f, ε ) -resilience in either scenario. Specifically, the output of A , denoted by ˆ θ must satisfy the following.

Due to Lemma 1, the above holds true only if

Recall from (17) that K ≥ 1 α · n -2 f f · µ L -µ . Therefore, we have ( n -2 f ) 1 K ≤ L -µ µ fα , which implies that

Using the above in (26), and then substituting α = n -f f µ (from (16)), implies that

Recall from (18) that ∥ z ∥ 2 = f n -2 f G 2 2 α · K where α = n -f f µ , from above we obtain that

That is, ε grows with K . Note that the above holds for any arbitrarily large value of K satisfying (17). Therefore, ε can be made arbitrarily large. This contracts the assumption that A is ( f, ε ) -resilient with a finite ε . Hence, we have shown that ( f, ε ) -resilience is impossible in general under ( G,B ) -gradient dissimilarity when f n ≥ 1 2+ B 2 .

Concluding remark. A critical element to the above inference on the unboundedness of ε is the condition that A 1 ≤ 0 , shown in (21). Recall that

The right-hand side in the above is negative for any large enough value of K as soon as 1 -f n -2 f B 2 ≤ 0 or, equivalently, f n ≥ 1 2+ B 2 . However, in the case when f n < 1 2+ B 2 , K cannot be arbitrarily large if we were to ensure A 1 ≤ 0 , i.e., K must be bounded from above. This constraint on K yields a non-trivial lower bound on ε . We formalize this intuition in the following.

B.2.2 Lower Bound on ε

In this section, we prove that ε ≥ 1 8 µ · f n -(2+ B 2 ) f G 2 . Let 0 < f < n/ 2 , and G,B ≥ 0 . Owing to the arguments presented in Section B.2.1, the assertion holds true when f n ≥ 1 2+ B 2 . In the following, we assume that f n < 1 2+ B 2 , or equivalently B 2 < n -2 f f .

Let A be an ( f, ε ) -resilient algorithm. We consider a distributed learning setting where the workers' loss functions are given by (11), (12) and (13) with parameters α, K and z set as follows.

We let z be an arbitrary point in R d such that

Note that, as α = µ ( 1 + B 2 ) , we have

From (28), we also obtain that

Proof outline. We consider two scenarios, each corresponding to two different identities of honest workers: S 1 = { 1 , . . . , n -f } and S 2 = { f + 1 , . . . , n } . For each of these, we prove that the corresponding local and global loss functions satisfy the assumptions of the theorem, mainly by invoking Lemma 2. Finally, by invoking Lemma 1, we show that ( f, ε ) -resilience implies the stated lower bound on ε .

First scenario. Consider the set of honest workers to be S 1 = { 1 , . . . , n -f } . From (11) and (12) we obtain that

Therefore,

Therefore,

where I d denotes the identity matrix of size d . The above, in conjunction with (30), implies that L S 1 is ( α 1+ B 2 ) -smooth ( α 1+ B 2 ) -strongly convex. As α 1+ B 2 = µ (see (27)), we deduce that L S 1 is µ -smooth µ -strong convexity. Recall that µ ≤ L , therefore L S 1 is also L -smooth. Next, by invoking Lemma 2, we show that the local losses for the honest workers in this scenario also satisfy ( G,B ) -dissimilarity.

We start by analyzing below the terms A 1 , A 2 and A 3 introduced in Lemma 2 in this scenario.

Term A 1 . Recall from (14) in Lemma 2 that

Let A ′ 1 := ( n -f ) 2 f ( n -2 f ) A 1 . Substituting in the above, from (28), K = 1+ B 2 1 -f n -2 f B 2 · 1 α , we obtain that

Recall that A ′ 1 = ( n -f ) 2 f ( n -2 f ) A 1 . Therefore, from the above we obtain that

Term A 2 . From (14) in Lemma 2, and (30), we obtain that

From (28), we obtain that α -1 K = α -1 -f n -2 f B 2 1+ B 2 α = n -f n -2 f B 2 1+ B 2 α . Using this above we obtain that

Term A 3 . From (14) in Lemma 2, and (30), we obtain that

Substituting in the above, from (29), ∥ z ∥ 2 = ( n -f ) 2 f ( n -2 f ) ( 1 -f n -2 f B 2 ) (1+ B 2 ) 2 G 2 K 2 we obtain that

Invoking Lemma 2 . Using the results obtained above we show below that the conditions stated in (15) of Lemma (2) are satisfied, i.e., A 1 ≤ 0 , A 3 ≤ G 2 and ∥ A 2 ∥ 2 ≤ A 1 ( A 3 -G 2 ) . Hence, proving that the local loss functions for the honest workers in this particular scenario satisfy ( G,B ) -gradient dissimilarity.

Since we assumed that B 2 < n -2 f f , (32) implies that A 1 ≤ 0 . Similarly, (35) implies that A 3 ≤ G 2 . Substituting, from (32) and (34), respectively, A 1 = -( 1 -f n -2 f B 2 ) (1+ B 2 ) 2 B 2 α 2 and A 3 = f ( n -2 f ) ( n -f ) 2 ( 1 + B 2 ) 2 ∥ z ∥ 2 K 2 , we obtain that

Substituting in the above, from (29), i.e. ∥ z ∥ 2 = ( n -f ) 2 f ( n -2 f ) ( 1 -f n -2 f B 2 ) (1+ B 2 ) 2 G 2 K 2 , we obtain that

Recall that ( n -f ) 2 f ( n -2 f ) ( 1 -f n -2 f B 2 ) (1+ B 2 ) 2 G 2 = ∥ z ∥ 2 K 2 . Using this above, and then comparing the resulting equation with (33), we obtain that

This concludes the analysis for the first scenario. We have shown that the conditions on smoothness, strong convexity and ( G,B ) -gradient dissimilarity hold in this scenario.

Second scenario. Consider the set of honest workers to be S 2 = { f +1 , . . . , n } . Identical to (31) with z = 0 , from (12) and (13), we obtain that

Similar to the analysis in the first scenario, we deduce that L S 2 is L -smooth and µ -strongly convex. Moreover, Lemma 3, in conjunction with the deduction in (32) that A 1 ≥ 0 (recall that B 2 < n -2 f f ), implies that the loss functions for the honest workers in this particular scenario satisfy (0 , B ) -gradient dissimilarity, thereby also satisfying ( G,B ) -gradient dissimilarity.

This concludes the analysis for the second scenario. We have shown that the conditions on smoothness, strong convexity and ( G,B ) -gradient dissimilarity hold in this scenario.

Final step: lower bound on ε in terms of G and B . We have established in the above that the conditions of smoothness, strong convexity and ( G,B ) -gradient dissimilarity are satisfied in both the scenarios. Therefore, by assumptions, algorithm A must guarantee ( f, ε ) -resilience in either scenario. Specifically, the output of A , denoted by ˆ θ must satisfy the following:

Due to Lemma 1, the above holds only if

Recall, from (30), that n -2 f n -f 1 K + f n -f α = α 1+ B 2 . Using this in (36), we obtain that

Substituting, from (27), α = µ (1 + B 2 ) in the above implies that

Substituting, from (29), ∥ z ∥ 2 = ( n -f ) 2 f ( n -2 f ) ( 1 -f n -2 f B 2 ) (1+ B 2 ) 2 G 2 K 2 in the above implies that

Substituting, from (27), i.e. K = 1 µ ( 1 -f n -2 f B 2 ) , in the above implies that

The above completes the proof.

B.3 Proof of Lemma 1

Let us recall the lemma below.

Lemma 1. Consider the setting where the local loss functions are given by (11) , (12) , and (13) . In this particular case, the following holds for all θ ∈ R d :

Proof. We prove the lemma by contradiction. Suppose there exists a parameter vector ˆ θ such that

From (11), (12) and (13), we obtain that

Therefore, we have 4

Substituting from the above in (37), we obtain that

As for any real values a, b , we have max { a, b } ≥ 1 2 ( a + b ) , from above we obtain that

By triangle and Jensen's inequalities, we have

4 For arbitrary positive real values a and b , and an arbitrary z ∈ R d , consider a loss function L ( θ ) := a 2 ∥ θ -z ∥ 2 + b 2 ∥ θ ∥ 2 . The minimum point θ ∗ of L ( θ ) is given by θ ∗ = a a + b z , and for any θ , L ( θ ) -L ( θ ∗ ) = 1 2 ( a + b ) ∥ θ -θ ∗ ∥ 2 .

Substituting from the above in (38), we obtain that

The contradiction above proves the lemma.

B.4 Proof of Lemma 2

Let us recall the lemma below.

Lemma 2. Consider the setting where the local loss functions are given by (11) , (12) , and (13) . Denote

Suppose that S 1 = { 1 , . . . , n -f } denotes the set of honest workers. Then, the honest workers satisfy ( G,B ) -gradient dissimilarity if and only if

Proof. Let θ ∈ R d . As 1 | S 1 | ∑ i ∈ S 1 ∥∇L i ( θ ) -∇L S 1 ( θ ) ∥ 2 = 1 | S 1 | ∑ i ∈ S 1 ∥∇L i ( θ ) ∥ 2 -∥∇L S 1 ( θ ) ∥ 2 , we obtain that

We analyze the right-hand side of the above equality. As S 1 = { 1 , . . . , n -f } , from (11) and (12), we obtain that

Similarly, we have

Denoting in the above

and we have

The above implies that θ ∗ is the minimizer of the convex function L S 1 , and

Substituting from (40) and (43) in (39) implies that

Now, we operate the change of variables X = θ -θ ∗ , and rewrite the above as

Next, we show that A 1 , A 2 and A 3 as defined in (14) can be equivalently written as follows.

Term A 1 : Substituting from (41), i.e. A 0 = ( n -2 f ) 1 K + fα n -f , we obtain that

Comparing the above with A 1 defined in (14) implies that

Term A 2 : Substituting from (42), i.e. θ ∗ = fα ( n -2 f ) 1 K + fα z , we obtain that

Comparing the above with A 2 defined in (14) implies that

Term A 3 : Similarly, substituting θ ∗ = fα ( n -2 f ) 1 K + fα z , we obtain that

Comparing the above with A 3 defined in (14) implies that

Substituting from (45), (46) and (47) in (44), we obtain that

Therefore, by Assumption 1, the honest workers represented by set S 1 satisfy ( G,B ) -gradient dissimilarity if and only if the right-hand side of the above equations is less than or equal to 0 , i.e.,

To show the above, we consider an auxiliary second-order "polynomial" in x ∈ R d , P ( x ) := a ∥ x ∥ 2 +2 ⟨ x, b ⟩ + c where b ∈ R d and a, c ∈ R . We show below that P ( x ) ≤ 0 for all x ∈ R d if and only if a, c ≤ 0 and ∆ := ∥ b ∥ 2 -ac ≤ 0 .

̸

Case 1. Let a = 0 . In this particular case, we have P ( x ) = a ( ∥ ∥ x + 1 a · b ∥ ∥ 2 -∆ a 2 ) . Therefore, P ( x ) ≤ 0 for all x if and only if a < 0 and c, ∆ ≤ 0 .

Case 2. Let a = 0 . In this particular case, P ( x ) = 2 ⟨ x, b ⟩ + c . Therefore, P ( x ) ≤ 0 for all x if and only if c ≤ 0 and ∆ = ∥ b ∥ 2 = 0 .

Hence, (48) is equivalent to

This completes the proof.

C Proofs of Theorem 2 and Corollary 1: Convergence Results

C.1 Proof of Theorem 2

Theorem 2. Let 0 ≤ f < n/ 2 . Assume that the global loss L H is L -smooth and that the honest local losses satisfy ( G,B ) -gradient dissimilarity (Assumption 1). Consider Algorithm 1 with learning rate γ = 1 L . If the aggregation F is ( f, κ ) -robust with κB 2 < 1 , then the following holds for all T ≥ 1 .

In the general case where L H may be non-convex, we have

In the case where L H is µ -PL, we have

C.1.1 Non-convex Case

Proof. As L H is assumed L -smooth, for all θ, θ ′ ∈ R d , we have (see Definition 2)

Let t ∈ { 0 , . . . , T -1 } . From Algorithm 1, recall that θ t +1 = θ t -γR t . Hence, substituting in the above θ = θ t and θ ′ = θ t +1 , we have

As ⟨ a, b ⟩ = 1 2 ( ∥ a ∥ 2 + ∥ b ∥ 2 -∥ a -b ∥ 2 ) for any a, b ∈ R d , we also have

Substituting the above in (49) we obtain that

Substituting γ = 1 L in the above we obtain that

As we assume the aggregation F to satisfy ( f, κ ) -robustness, by Definition 4, we also have that

Besides, Assumption 1 implies that for all θ ∈ R d we have

Using the above in (51) yields

Substituting the above in (50) yields

Multiplying both sides in (52) by 2 L and rearranging the terms, we get

Recall that t in the above was arbitrary in { 0 , . . . , T -1 } . Averaging over all t ∈ { 0 , . . . , T -1 } yields

Finally, since we assume that 1 -κB 2 > 0 , dividing both sides in the above by 1 -κB 2 yields

The above concludes the proof for the non-convex case.

C.1.2 Strongly Convex Case

Proof. Assume now that L H is µ -PL. Following the proof of the non-convex case up until (53) yields

Rearranging terms, we get

Since L H is µ -PL, as per Definition 3, we obtain

Dividing both sides by 2 L , we get

Recall that t is arbitrary in { 0 , . . . , T -1 } . Then, applying (54) recursively (on the right hand side) yields

Using the fact that (1 + x ) n ≤ e nx for all x ∈ R and substituting t = T -1 yields

This concludes the proof.

C.2 Proof of Corollary 1

Corollary 1. Assume that the global loss L H is µ -PL and L -smooth, and that for each i ∈ H local loss L i is convex and L i -smooth. Denote L max := max i ∈H L i and assume that κ ( 3 L max µ -1) ≤ 1 . Consider Algorithm 1 with learning rate γ = 1 L . If F is ( f, κ ) -robust, then for all T ≥ 1 , we have

Proof. Invoking Proposition 1, we know that the loss functions satisfy ( G,B ) -gradient dissimilarity with

Moreover, since we assume that κ (3 L max µ -1) ≤ 1 , we have

Therefore, since the global loss L H is µ -PL and L -smooth, we can apply Theorem 2 to obtain

This concludes the proof.

D Experimental Setups

In this section, we present the full experimental setups of the experiments in Figures 1,2,3, and 4. All our experiments were conducted on the following hardware: Macbook Pro, Apple M1 chip, 8-core CPU and 2 NVIDIA A10-24GB GPUs. Our code is available online through this link.

D.1 Figure 1: brittleness of G -Gradient Dissimilarity

This first experiment aims to show the gap between existing theory and practice. While in theory G -gradient dissimilarity does not cover the least square regression problem, we show that it is indeed possible to converge using the Robust D-GD Algorithm with the presence of 3 Byzantine workers out of 10 total workers. All the hyperparameters of this experiments are listed in Table 1.

D.2 Figure 2: empirical breakdown point

The second experiment we conduct tends to highlight the empirical breakdown point observed in practice when the fraction of Byzantines becomes too high. Indeed, while existing theory suggests that this breakdown point occurs for a fraction of 1 / 2 Byzantine workers, we show empirically that it occurs even before having 1 / 4 Byzantines. We present all the hyperparameters used for this experiment in Table 2.

D.3 Figure 3: comparing theoretical upper bounds

In the third experiment, we compare two errors bounds, i.e., f / n -(2+ B 2 ) f · G 2 and f / n -2 f · ̂ G 2 , guaranteed for robust D-GD under ( G,B ) -gradient dissimilarity and ̂ G -gradient dissimilarity, respectively, on the MNIST Dataset. We use a logistic regression model and the Negative Log Likelihood (NLL) loss function as the local loss function for each honest worker.

Before explaining how we compute ̂ G and ( G,B ) , let us recall that the local loss functions of honest workers are said to satisfy ̂ G -gradient dissimilarity if for all θ ∈ R d , we have

Similarly, the local loss functions of honest workers are said to satisfy ( G,B ) -gradient dissimilarity if, for all θ ∈ R d , we have

Evidently, ̂ G and ( G,B ) are difficult to compute since one has to explore the entire space to get tight values. In this paper, we present a first heuristic to compute approximate values of ̂ G and ( G,B ) : We first compute θ ⋆ by running D-GD without Byzantine workers, then we choose a point θ 0 , that is arbitrarily far from θ ⋆ . Here we choose θ 0 = (1 e 4 , . . . , 1 e 4) ∈ R d with d = 784 for the MNIST dataset. Given θ ⋆ and θ 0 we construct 101 points θ 0 , . . . , θ 100 between θ ⋆ and θ 0 such that

and then compute 1 |H| ∑ i ∈H ∥∇L i ( θ t ) -∇L H ( θ t ) ∥ 2 and ∥∇L H ( θ t ) ∥ 2 for all t ∈ { 0 , 1 , 2 , . . . , 100 } . We set

Also, to compute the couple ( G,B ) , we first consider 100 values of B ′ 2 ∈ [ 0 , n -2 f f ] , then compute

and finally set

In Figure 3, we show the different values of f / n -(2+ B 2 ) f · G 2 and f / n -2 f · ̂ G 2 for f = 1 to f = 9 where there is always n -f = 10 honest workers.

D.4 Figure 4: matching empirical performances

In the last experiments of the paper, we compare the empirical error gap (left-hand side of Corollary 1) with the upper bound (right-hand side of Corollary 1).

Let us first recall Corollary 1:

Corollary 1. Assume that the global loss L H is µ -PL and L -smooth, and that for each i ∈ H local loss L i is convex and L i -smooth. Denote L max := max i ∈H L i and assume that κ ( 3 L max µ -1) ≤ 1 . Consider Algorithm 1 with learning rate γ = 1 L . If F is ( f, κ ) -robust, then for all T ≥ 1 , we have

We first give all the hyperparameters used for the learning in Table 3 and then explain how we computed µ , L , κ and θ ⋆ .

Computation of µ and L . Let X be the matrix that contains all the n -f vector data points and λ the ℓ 2 -regularization term, we have

where for any matrix A ∈ R d × d , eig max ( A ) and eig max ( A ) refer to the maximum and minimum eigenvalue of A respectively.

Computation of κ . We recall that by definition, an aggregation rule F : R d × n → R d is said to be ( f, κ ) -robust if for any vectors x 1 , . . . , x n ∈ R d , and any set S ⊆ [ n ] of size n -f , the output ˆ x := F ( x 1 , . . . , x n ) satisfies the following:

Hence, as done in [3], we estimate κ empirically as follows: We first compute for every step t ∈ { 0 , . . . , T -1 } and every attack a ∈ { SF , FOE , ALIE , Mimic } the value of κ t,a such that

where g t,a := 1 |H| ∑ i ∈H g ( i ) t,a and R t,a and g ( i ) t,a refer respectively to R t and g ( i ) t when the attack a is used by the Byzantine workers. Then, we compute the empirical κ following:

Computation of θ ⋆ . We compute θ ⋆ using the closed form of the solution of a Mean Least Square regression problem:

where X ∈ R ( n -f ) × d is the matrix that contains the data points and y ∈ R n -f the associated vector that contains the labels.

Peer reviews:
{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe paper studies distributed learning in the presense of Byzantine workers (that is, nodes that output adversarial results) and data heterogeneity.\n\nA previous notion of robustness for distributed learning, namely G-gradient dissimilarity, is not sufficient to capture data heterogeneity. In fact, this holds even in fairly simple tasks such as least-squares regression (i.e., for any G>0).\n\nMotivated by this observation, the paper defines a new notion of robustness for distributed learning, (G,B)-Gradient Dissimilarity. This allows for some additional error term in the average gradient difference between workers, proportionally to B.\n\nThe proposed theory is used in a least squares regression task to justify observed robustness of stochastic gradient descent under small sets of dishonest workers.\n\nSTRENGTHS:\nThe paper presents an interesting notion of robustness in distributed learning. It is shown that this notion captures distributed gradient computation when a small number of workers can output arbitrary results. The theory is compelling and seems to justify observed behavior in a realistic setting.\n\nA theoretical criterion is given for algorithms to be robust against (G,B)-gradient dissimilarity. This is an interesting theoretical contribution.\n\nWEAKNESSES:\nThe precise formula used in the definition of (G,B)-Gradient Dissimilarity makes sense because the analysis is done for a variant of stochastic gradient descent. However, it is unclear whether this notion is also relevant to other distributed learning tasks.\n\nThe precise setting regarding honest and Byzantine workers is confusing (see Questions section of this review).\n\nQUESTIONS:\nWhat is the (G, B)-gradient dissimilarity in the experiments?\n\nObservation 1 does not require any Byzantine workers, right? Perhaps this should be emphasized.\n\nIn Proposition 1, H is the set of honest workers. How do the honest workers know who is honest? Earlier in the paper it is mentioned that trying to compute any statistic over the whole set of workers is generally impossible in the presence of Byzantine workers. Does this mean that the task in Proposition 1 is impossible to perform in reality because H must be known to all honest workers? If so, this renders the whole model not very realistic.\n\nLIMITATIONS:\nThe authors have adequately addressed the limitations of this work.", "TITLE": "Official Review", "RECOMMENDATION": 7, "REVIEWER_CONFIDENCE": 3, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2023-07-05"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper considers under the robust distributed learning settings, the conventional learning error bounds are vacuous as they rely on restrictive assumptions as $G$-gradient dissimilarity (equation 2). The paper relaxes the assumption to a more general $(G, B)$-dissimilarity model that relaxes the bounds on gradients norm of honest workers with a constant of $B$. A new breakdown ratio between Byzantine and honest workers $f / n$ that would yield theoretical robustness guarantees is established as $ 1 / (2 + B^2) $. The authors finally show the tightness of $f / n < 1 / (2 + B^2)$ bound via analyzing the state of the art robustness coefficient $ \\kappa = f / (n - 2f) $ on a robust D-GD that would also yield $ 1 / (2 + B^2) $ instead of $ 1 / 2 $ breakdown point. In this way, the gap between the previous theory and the empirical observation of the largest amount of Byzantine workers to have robustness guarantee on global honest loss (equation 1) is reduced.\n\nSTRENGTHS:\nThe paper borrows the data heterogenity model ($(G, B)$-dissimilarity) from the classical distributed learning settings to the Byzantine distributed learning and build a nice and intuitive theory on the breakdown point on the fraction of Byzantine workers to melt down the robustness guarantee. The paper narratives are clear and easy to follow, and the experiments (Figure 2, 3, 4) are well conducted.\n\nWEAKNESSES:\nThe novel breakpoint essentially involves a dependency over the constant over honest workers' gradient norm. It would be better to have an ablation study on logistic regression that if such constant $B$ is changed, we would observe similar changes in the breakpoint point. Otherwise, it is a great paper!\n\nQUESTIONS:\nI am confused on the heuristic method to compute $G$ and $B$ in Appendix D.3, line 743. Could you explain such formula?\n\nLIMITATIONS:\nI didn't find any other limitations of this paper.", "TITLE": "Official Review", "RECOMMENDATION": 6, "REVIEWER_CONFIDENCE": 2, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2023-07-06"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe work focuses on the analysis of the limits of Byzantine-robust learning under so-called $(G,B)$-dissimilarity assumption -- a generalization of the standard bounded gradient dissimilarity assumption. The main result of the paper is in establishing the upper bound for the maximal admissible ratio of Byzantine workers: $\\delta < \\frac{1}{2+B^2}$ that is separated from $\\frac{1}{2}$ (and can be very small). The authors also derive the lower bound for the optimization error that matches the known upper bounds (up to numerical factors) and the derived upper bound for the robust version of the distributed gradient descent.\n\nSTRENGTHS:\n1. The authors derive the limits on robustness under $(G,B)$-gradient dissimilarity that are quite interesting. In particular, the ratio of Byzantine workers has to be smaller than $\\frac{1}{2+B^2}$ to guarantee the convergence to some neighborhood of the solution. Moreover, the lower bound for the optimization error $\\varepsilon$ is established. These bounds are quite pessimistic ($B^2$ is proportional to the condition number in the worst case) and emphasize the non-triviality of Byzantine-robustness in the heterogeneous case. The construction of the worst-case examples is quite simple.\n\n2. The paper is well-written in general, the idea is explained well in the main part of the paper.\n\n3. The proofs look correct to me.\n\nWEAKNESSES:\nThe results of Theorem 2 are not completely novel. In particular, there exist results under $(G,B)$-dissimilarity assumption, see Theorem V from [18] and Theorems E.1, E.2 from [14]. These results are derived for the different notions of robust aggregator, but up to the replacement of $\\kappa$ with $c\\delta$ they recover Theorem 2 from this submission. Moreover, the method from [14] with $p=1$ and no compression coincides with Robust D-GD.\n\nThe paper should be modified accordingly. Nevertheless, I see Theorem 1 as the main contribution.\n\nQUESTIONS:\n1. In [17,18], another notion of robust aggregation was introduced. Are there any benefits of using a different notion of robustness?\n\n2. Theorem 2, \"let $f < n/2$\": this is a bit confusing, because $\\kappa$ implicitly depends on the ratio of Byzantines.\n\n3. Although the proofs are detailed and look correct to me, it is a bit inconvenient to read them. In particular, I suggest moving the proofs of Lemmas 1 and 2 to Appendix B.1.2.\n\nLIMITATIONS:\nThe authors adequately addressed the limitations.", "TITLE": "Official Review", "RECOMMENDATION": 7, "REVIEWER_CONFIDENCE": 3, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2023-07-11"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nIn the present paper the authors study the problem of distributed learning in the presence of adversarial learners (aka Byzantine workers) and hetogeneous data. The paper aims to generalize and improve previous results on homogeneous data, an assumption that is claimed to be very restrictive in practice. For this they introduce a new concept of (G,B) gradient dissimilarity which has the same relation to the more standard G gradient dissimilarity as an affine variance assumptions has to a bounded variance assumption in stochastic optimization. \n\nUnder their assumption they first prove that the breakdown point, i.e., the share of Byzantine workers beyond which the optimization breaks down is upper bounded by $\\tfrac{1}{2+B^2}$, where previous results only yield the intuitive bound of $\\tfrac12$. They also confirm this theoretical observation numerically. Second, they also establish sharp error bounds in the regime below the breakdown point by proving a lower bound as well as an upper bound, attained by robust distributed gradient descent.\n\nSTRENGTHS:\nI find the paper very clear and well written. The theoretical contributions are very interesting and appear to be novel. Furthermore, the experiments illustrate the sharpness of the results. The proofs in the appendix seem to be sound although I have to say that I didn't check all the details in the proof of Theorem 1. I did check the convergence statement of Theorem 2 the proof of which is rather standard.\n\nWEAKNESSES:\nI cannot list any significant weaknesses besides the few questions that I have in the next block.\n\nQUESTIONS:\np.2: Maybe you can make the connection between the G and (G,B) assumptions and bounded / affine variance assumptions in the analysis of SGD. \n\np.6, last paragraph: can one estimate B here to see whether it is close to $\\sqrt{2}$ which would fit to the $\\tfrac14$ you observe numerically?\n\np.7: Definition 4 should be followed by a few examples for $(f, \\kappa)$-robust aggregation rules. Please also mention that in the absence of adversaries, one can just average the gradients and gets a $(0,0)$-robust aggregation rule. \n\np.8: Here you start using nicefrac excessively which, at least for my brain, is very hard to read and process. Maybe you can use or stick to tfrac for inline fractions which you seemed to have used earlier.\n\np.30: Number of honest workers should just be $n-f$ not $n-f=10$. If I understand this correctly $n=10$ and $f$ ranges from $1$ to $9$.\n\nLIMITATIONS:\nThe authors did make the point that probably not all of their results are sharp, e.g., in terms of constants or the slow down factor for linear convergence in the presence of adversaries.\nNegative societal impact is not to be expected in my opinion.", "TITLE": "Official Review", "RECOMMENDATION": 8, "REVIEWER_CONFIDENCE": 4, "SOUNDNESS_CORRECTNESS": 4, "DATE": "2023-07-26"}