Title: H-nobs: Achieving Certified Fairness and Robustness in Distributed Learning on Heterogeneous Datasets
Venue: NeurIPS 2023
Accepted: yes
Keywords: distributed learning

federated learning

fairness

robustness

Byzantine attack

norm-based screening

q-FFL

optimization

convergence analysis
Abstract: Fairness and robustness are two important goals in the design of modern distributed learning systems. Despite a few prior works attempting to achieve both fairness and robustness, some key aspects of this direction remain underexplored. In this paper, we try to answer three largely unnoticed and unaddressed questions that are of paramount significance to this topic: (i) What makes jointly satisfying fairness and robustness difficult? (ii) Is it possible to establish theoretical guarantee for the dual property of fairness and robustness? (iii) How much does fairness have to sacrifice at the expense of robustness being incorporated into the system? To address these questions, we first identify data heterogeneity as the key difficulty of combining fairness and robustness. Accordingly, we propose a fair and robust framework called H-nobs which can offer certified fairness and robustness through the adoption of two key components, a fairness-promoting objective function and a simple robust aggregation scheme called norm-based screening (NBS). We explain in detail why NBS is the suitable scheme in our algorithm in contrast to other robust aggregation measures. In addition, we derive three convergence theorems for H-nobs in cases of the learning model being nonconvex, convex, and strongly convex respectively, which provide theoretical guarantees for both fairness and robustness. Further, we empirically investigate the influence of the robust mechanism (NBS) on the fairness performance of H-nobs, the very first attempt of such exploration.

H-nobs: Achieving Certified Fairness and Robustness in Distributed Learning on Heterogeneous Datasets

Abstract

Fairness and robustness are two important goals in the design of modern distributed learning systems. Despite a few prior works attempting to achieve both fairness and robustness, some key aspects of this direction remain underexplored. In this paper, we try to answer three largely unnoticed and unaddressed questions that are of paramount significance to this topic: (i) What makes jointly satisfying fairness and robustness difficult? (ii) Is it possible to establish theoretical guarantee for the dual property of fairness and robustness? (iii) How much does fairness have to sacrifice at the expense of robustness being incorporated into the system? To address these questions, we first identify data heterogeneity as the key difficulty of combining fairness and robustness. Accordingly, we propose a fair and robust framework called H-nobs which can offer certified fairness and robustness through the adoption of two key components, a fairness-promoting objective function and a simple robust aggregation scheme called norm-based screening (NBS). We explain in detail why NBS is the suitable scheme in our algorithm in contrast to other robust aggregation measures. In addition, we derive three convergence theorems for H-nobs in cases of the learning model being nonconvex, convex, and strongly convex, respectively, which provide theoretical guarantees for both fairness and robustness. Further, we empirically investigate the influence of the robust mechanism (NBS) on the fairness performance of H-nobs, the very first attempt of such exploration.

1 Introduction

Distributed learning has been widely applied to solve large-scale machine learning (ML) problems, where a number of computing nodes (users) collectively carry out the task of training a model under the coordination of a central node (server). Federated learning is a typical example of distributed learning where each device collects its own local data and keeps them private [1]. In this paper we use distributed learning and federated learning interchangeably.

Aside from the basic expectation of high model accuracy, it is increasingly emphasized in the latest ML research to design distributed learning algorithms that can jointly satisfy several pragmatic constraints such as fairness and robustness [2]. Here we consider the most common definitions where fairness specifically refers to egalitarian fairness and robustness refers to Byzantine robustness, which respectively stipulate that the trained model exhibits somewhat uniform performances on the local users (see Section 2.1), and that the system is resilient to Byzantine attacks where a portion of users defect or malfunction (see Section 2.2). In this paper, we strive for simultaneously

attaining fairness and robustness. Although a few prior efforts have been made towards fair and robust distributed learning [3, 4, 5], this direction is largely underexplored, and some key issues have not been addressed yet. In this paper, we seek to answer three questions that are of paramount importance to the understanding of this topic.

The first question is ' What makes jointly satisfying fairness and robustness difficult? ' According to the recent literature, (un)fairness issues normally arise in the non-iid settings where the training data residing on local users are heterogeneous [6]. However, for a system to be Byzantine-robust, a typical underlying assumption is that the local data are homogeneous/iid [7, 8, 9, 10, 11]. Such a conflict would invalidate most of the existing Byzantine-robust methodologies developed under the iid assumptions. Therefore, to meaningfully achieve fairness and robustness at the same time, one has to address data heterogeneity, which entails both theoretical and empirical challenges illustrated as follows.

The second question is ' Is it possible to establish theoretical guarantee for the dual property of fairness and robustness? ' According to the literature, providing convergence guarantees for Byzantinerobust methods (alone) is challenging enough [12]. This is because these methods not only rely on the iid assumption, but also require strong assumptions on the distribution of local gradients, such as sub-exponential [9] or sub-Gaussian [10] (see Section 4.3 for more details). These distributional assumptions usually fall short of proper justifications, and they become even harder to justify under the modified objectives with fairness constraints. Due to these two major obstacles, there has not yet been any work that manages to provide theoretical guarantees for both fairness and robustness.

The third question is ' How much does fairness have to sacrifice at the cost of robustness? ' To display the inherent conflicts between these two goals, we consider the principles to achieve either goal separately. On one hand, fairness is typically enforced by up-weighting the local objective function of the worst-performing users, which would make their local gradients also heavily-weighted. On the other hand, robustness is typically enforced by the server discarding partial gradients that look suspicious. Since the server cannot decide whether the suspicious gradients (by having large norms or prominent entries) are sent by the Byzantine users or generated from the up-weighted objectives, the latter can be easily filtered out by the deployed robust mechanism, which would inevitably impair the fairness performance. Although this issue was first recognized by a prior work [4], such internal conflicts have not been studied, either theoretically or empirically. Consequently, there are no reported results or understanding on this matter.

Our contributions. In this paper, we propose a fair and robust framework called H-nobs, which contains two key components: a fairness-promoting objective function (the H part) and a simple robust aggregation scheme called norm-based screening/NBS (the nobs part). On one hand, in our algorithm, the certified fairness comes from the fairness-promoting objective function, which can be directly adopted from existing works with theoretical fairness guarantees (see Section 3.2 for a couple of representative examples). On the other hand, we show that the deployed NBS is able to gracefully handle Byzantine attacks and theoretically guarantee the convergence of our algorithm without requiring the iid assumption that is ubiquitous for convergence analysis. Accordingly, we derive three convergence theorems for H-nobs in cases of the learning model being nonconvex, convex, and strongly convex, respectively. In addition, we explain in great detail why NBS is distinctively suitable for our framework, and how it may not be the case for other robust aggregation measures. We achieve this by illustrating three notable theoretical advantages of NBS over its counterparts (see Section 4.3). To address the conflicts between fairness and robustness, we empirically investigate the influence of several robust aggregation schemes, including NBS and other widely-known benchmarks, on the fairness performance (see Section 5). Our results show that although the screening of some fairness-enhancing gradients is inevitable, the overall performance of H-nobs is satisfying. To the best of our knowledge, our work is the first that touches on all of the aforementioned aspects in the pursuit of fair and robust distributed learning.

The major contributions of this work can be summarized as follows:

We recognize the major challenges in obtaining joint fairness and robustness in distributed learning by identifying three important yet largely overlooked questions. In this work, we have addressed these questions to varying degrees.

We propose H-nobs, the first algorithm that takes the (obvious but challenging) route of incorporating robust aggregation into existing fair objectives to achieve fair and robust distributed learning.

We achieve certified fairness and robustness for H-nobs even under the challenging non-iid scenarios, by establishing theoretical convergence guarantees with multiple levels of assumptions on the model convexity. Also, we clearly identify the major technical challenges that may hinder this goal, and illustrate how those challenges can be overcome by NBS through its theoretical robust property.

We take the initiative to investigate the empirical conflicts between fairness and robustness under a specific metric and objective of fairness, and demonstrate the robustness and fairness benefits of H-nobs.

2 Related work

2.1 Fairness in federated learning

Differing from the common notion of fairness with respect to certain protected attributes (such as race and gender [13]), fairness in federated learning is typically defined over the model accuracies of local devices [14, 15], including two major fairness metrics, i.e., collaborative fairness [3] and egalitarian fairness [16]. These two metrics serve different purposes and suit for the corresponding scenarios. In particular, collaborative fairness enforces each user to receive a personalized model after each iteration according to its contribution to the training [3], which runs counter to our work assuming a single shared model for all users. Therefore, in this paper we only consider egalitarian fairness, which aims to achieve not only satisfactory overall model accuracy, but also somewhat uniform local performances for all participating users [16].

To enforce fairness, one common approach is to replace the empirical training loss with a modified objective function that puts a higher emphasis on the worst-performing users. For example, in an earlier work, [17] proposes Agnostic Federated Learning (AFL), a minimax optimization scheme to minimize the training loss of the worst-off client among all users. However, AFL is reported to perform well only on very small networks consisting of a handful of devices, and its generalization guarantees may not be applicable in a large-scale setting [14]. To improve upon AFL, [16] proposes q -Fair Federated Learning ( q -FFL), a fairness-promoting objective, which enjoys better scalability and more favorable accuracy/fairness tradeoffs than AFL. The exact formulation of q -FFL is given in Section 3.2. In Section 5, we adopt egalitarian fairness as the fairness metric and q -FFL as the objective function to empirically evaluate the effectiveness of our framework.

2.2 Byzantine-robust techniques

Byzantine attack/failure refers to the issue where a small portion of failed nodes may send distorted or even adversarial messages to the server during training [18]. To cope with Byzantine attacks, there are generally two distinct approaches. The first approach assigns each user redundant data, and relies on this redundancy to eliminate the effects of erroneous messages [19, 12]. This approach may not be applicable to federated learning where data cannot be replicated and reassigned for user privacy. The second approach is based on certain robust aggregation mechanisms at the server's end, such as Krum [7], geometric median [8], coordinate-wise median [9], iterative filtering [10], etc. Due to its wide variety of aggregation rules and applicability to federated learning, robust aggregation is commonly viewed as the mainstream approach for mitigating Byzantine attacks.

Although it is an intuitive and seemingly straightforward idea to incorporate robust aggregation into the fairness-promoting objectives for one to achieve both fairness and robustness, we observe that few works take this route due to the two stringent assumptions mentioned in Introduction. To address these technical difficulties, we resort to norm-based screening (NBS), a low-profile screening scheme among the robust aggregation cohorts. Although NBS has previously been implemented in the Byzantine-prone settings [11, 20], few realize its effectiveness in the challenging non-iid environments and its handiness for convergence analysis without necessitating the stringent assumptions. In Section 4, we demonstrate that NBS enjoys a desirable property which allows it to guarantee convergence under much milder assumptions.

3 Proposed framework

3.1 Basic setting

Data division. We consider a typical distributed learning setup with one server and m users, each holding n data points with a total of mn = N training samples. Note that we do not assume that the local data are iid, despite the same sample size for each user. Also, uneven data allocation cases with varying local sample sizes can easily fit into our framework with minor adjustments.

Byzantine attack. We assume that a percentage α of local users are Byzantine and the remaining 1 -α are normal/honest. The sets of Byzantine users and honest users are denoted as B and M respectively, with |B| = αm and |M| = (1 -α ) m . During each training iteration, the server would ask all users to conduct certain computational task based on their respective local data and to report the results back to the server. While honest users would follow the given instructions faithfully, Byzantine users need not to adhere to the protocol and can send arbitrary messages to the server.

3.2 Proposed algorithm

On the macro level, our algorithm is a variant of distributed gradient descent, characterized by two distinctive elements, i.e., fairness-aware objective and norm-based screening.

Fairness-aware objective. Let f ( θ ; x j ) be the point-wise training loss, we denote the local training loss on node i as F i ( θ ) = 1 n ∑ ( i -1) n + n j =( i -1) n +1 f ( θ ; x j ) and the global training loss as F ( θ ) = 1 m [ F 1 ( θ ) + · · · + F m ( θ ) ] . Since minimizing F ( θ ) can produce unfair models, we instead adopt a fairness-aware objective function H ( θ ) from existing literature which has a decomposable form H ( θ ) = 1 m [ H 1 ( θ ) + · · · + H m ( θ ) ] , with H i ( θ ) being the fairness-oriented version of F i ( θ ) that solely relies on the local data of user i . A few such examples include:

H i ( θ ) = 1 n ∑ ( i -1) n + n j =( i -1) n +1 [ f ( θ ; x j ) -µ ] 2 + proposed by [6] where µ is a hyper-parameter.

H i ( θ ) = 1 q +1 [ F i ( θ )] q +1 (i.e., q -FFL) proposed by [16] where q is a hyper-parameter.

Note that each specific H i ( θ ) may aim to address a different notion of fairness, with the former example seeking to mitigate representation disparity between majority and minority groups and the latter promoting egalitarian fairness. We also want to point out that our work applies to a broad range of fairness-promoting objectives that are decomposable, thus not limited to the given two examples.

Norm-based screening (NBS). After the local gradients are computed by honest users (w.r.t. H i ( θ ) ) and sent to the server (while Byzantine users craft disruptive gradients denoted as /star ), we propose to use NBS to aggregate all local gradients before applying its output to update the model. As a robust aggregation measure, the idea of NBS is fairly simple: leave out the gradients with large norms and take the average of the remaining gradients as output. We formally define NBS as a function ' Norm _ Screen ', as detailed in Algorithm 1.

Algorithm 1 Norm-Based Screening

Input:

g 1 , . . . , g m ( m local gradients), screening percentage β

Output:

G = Norm _ Screen β ( g 1 , . . . , g m )

1: generate a new set of indices (1) , . . . , ( m ) , such that ‖ g (1) ‖ ≤ · · · ≤ ‖ g ( m ) ‖

2: define an index set U = { (1) , . . . , ((1 -β ) m ) } , which specifies the unscreened gradients

3: calculate the output by averaging the unscreened gradients G = 1 |U| ∑ i ∈U g i

Despite its simplicity, NBS can gracefully handle Byzantine users, because any faulty gradient either is filtered out with a large norm, or can only shift the output to a bounded degree. In this way, if some Byzantine gradients bypass NBS, their influence on the output can be offset or mitigated if they are outnumbered by honest gradients that also remain unscreened. In Section 4, this property of NBS is formally stated as an inequality, which will serve as the bedrock of our convergence proofs later on. Combining the above two elements, we summarize the proposed algorithm in Algorithm 2.

Algorithm 2 H-nobs: Fair & Byzantine-Robust Distributed Gradient Descent

Input: screening percentage β ( ≥ α ), learning rate η , model initialization θ 0 , total iteration T Output: completed model

4 Convergence analysis

In this section, we begin by establishing a key theoretical property of NBS, and then develop three main convergence theorems, and conclude with a discussion that concretely states the distinctive advantages of NBS over other robust aggregation methods.

4.1 Preliminaries

Previously we explain how NBS can properly upper-bound the influence of Byzantine users in an intuitive way. Here we theoretically quantify this bound in Lemma 1, whose proof is deferred to Appendix A.

Lemma 1. Suppose that a percentage of α ≤ 1 2 among m local gradients g 1 , . . . , g m are Byzantine, whose indices compose a set B ( |B| = αm ), and the index set of honest gradients is denoted as M . With G = Norm _ Screen β ( g 1 , . . . , g m ) and β ≥ α , the following inequality holds:

where ∇ H = 1 m [ ∇ H 1 + · · · + ∇ H m ] with ∇ H i being the honest gradient of user i .

The inequality (1) is critical to the convergence analysis. In Algorithm 2 the model is refined using G , which is the sum of two terms ∇ H and G -∇ H , with the former being the true gradient (noisefree) and the latter being a noise term that can take any direction. To prove convergence, we must upper-bound the norm of G -∇ H as (1) does.

To enable further analysis, we adopt Assumption 1 to bound the second term in the RHS of (1).

Assumption 1. For any specific θ t , it always holds that

∥ ∥ Assumption 1 obviously stands due to the simple fact that the distance between any single vector and the vector mean is always upper-bounded.

Moreover, we make Assumption 2 to ensure that the gradient ∇ H ( θ ) exists.

Assumption 2. The fairness-aware objective H ( θ ) is L H -smooth.

4.2 Main theorems

Nonconvex losses. We first consider the most general case of the objective function H ( θ ) being nonconvex in θ . For this case, we derive Theorem 1 that guarantees convergence of our algorithm to a stationary point of H ( θ ) . The proof of Theorem 1 is deferred to Appendix B.

Theorem 1. Suppose that Assumptions 1-2 hold and α < 1 3 . Taking η = 1 L H , Algorithm 2 satisfies

Convex losses. Now we consider the case where the loss function is convex as in Assumption 3. Additionally, we make Assumption 4 which suggests that all the intermediate iterations would not be infinitely worse than the initialization θ 0 . We derive Theorem 2 that grants our algorithm convergence guarantee in the convex regime. The proof of Theorem 2 is deferred to Appendix C.

where θ ∗ is the global minimizer of H ( θ ) , C α = 2 α 1 -β , and r should satisfy 0 < r < ( 1 -β 2 α ) 2 -1 .

Assumption 3. H ( θ ) is convex.

Assumption 4. There exists a fixed such that ∗ ∗ holds for .

Theorem 2. Suppose that Assumptions 1-4 hold and α < . Taking η = , Algorithm 2 satisfies k ‖ θ t -θ ‖ ≤ k ‖ θ 0 -θ ‖ t = 0 , 1 , . . . , T -1 1 3 1 L H

Strongly convex losses. Finally, we assume strong convexity on the objective function as in Assumption 5, in which case we derive Theorem 3 that guarantees convergence of our algorithm to the optimal model θ ∗ . The proof of Theorem 3 is deferred to Appendix D.

where D = k ‖ θ 0 -θ ∗ ‖ , C α = 2 α 1 -β and 0 < r < ( 1 -β 2 α ) 2 -1 , which are the same as in Theorem 1.

Assumption 5. H ( θ ) is λ H -strongly convex.

Theorem 3. Suppose that Assumptions 1-2 and 5 hold, and α < 1 1+2 L H /λ H < 1 3 . Taking η = 2 L H + λ H , Algorithm 2 satisfies (with C α = 2 α 1 -β )

Observations. According to Theorems 1-3, Algorithm 2 is capable of achieving a degree of convergence under varying assumptions regarding the model's convexity. Meanwhile, we can clearly identify the effects of Byzantine percentage α : a larger α (i.e., a larger C α ) not only decreases convergence speed, but also increases convergence error. In contrast, the σ in (2) only affects the convergence error and has no impact on the convergence rate.

4.3 Discussion

The tightness of (1) in Lemma 1. Since all three convergence theorems are derived based upon Lemma 1, it is important to examine the tightness of (1). In practice, one can almost always find a way to upper-bound ‖ G - ∇ H ‖ , normally through some mathematical tricks and engineering approximations. However, convergence guarantees based upon loose bounds may be less effective or even risk losing their meaningfulness altogether. In this regard, we use a one-dimensional toy problem to demonstrate the tightness of (1).

Given ∇ H 1 = 4 , ∇ H 2 = 5 , ∇ H 3 = 6 , and ∇ H = 5 . Now suppose that one of the three users is Byzantine, say user 2 , who can send the server an arbitrary value g 2 instead of the honest gradient ∇ H 2 = 5 . To implement NBS, we impose that β = α = 1 3 . We can verify that (1) always holds, with the RHS equal to 6 and the LHS never reaching 6 no matter what value g 2 takes. However, the LHS can infinitely approach 6 if g 2 is selected judiciously. For example, for the set of gradients g 1 = 4 , g 2 = -5 . 98 , g 3 = 6 , the LHS is equal to 5 . 99 . In this case, the Byzantine gradient g 2 is carefully chosen such that it is able to bypass the screening, and meanwhile exerts maximum adversarial perturbation on the output. Readers can verify that (1) also holds when user 1 or user 3 is Byzantine. This example shows that (1) precisely measures the worst-case deviation by Byzantine users and that it cannot be further tightened.

The advantages of NBS over its counterparts. Aside from NBS, most of the other robust aggregation measures are robust-mean-based [7, 8, 9, 10], with the goal of computing a robust mean

gradient for every single iteration. Given the neat convergence guarantees resulted from NBS, a natural question arises: ' Can any of those robust-mean-based methods lead to similar convergence results? ' It turns out that the answer to this question might be negative, due to three major theoretical advantages of NBS over its counterparts, which make the latter not only require over-stringent assumptions but also produce less informative bounds.

First, unlike robust-mean-based methods, NBS does not require the assumption that local data are iid. As explained in Section 4.1, bounding the noise term ‖ G -∇ H ‖ is crucial for convergence, where G represents the output of robust aggregation, whether it is NBS or one of its counterparts. For the latter, the iid assumption is indispensable since it ensures that the honest gradients are iid samples of the true global gradient ∇ H . Without this assumption, ‖ G - ∇ H ‖ cannot be upper-bounded theoretically.

Second, unlike its counterparts, NBS does not require local gradients to follow a certain distribution, which often lacks proper justification in practice. For robust-mean-based methods, this distributional assumption determines the level to which honest local gradients are concentrated. Without this assumption, ‖ G -∇ H ‖ also cannot be upper-bounded theoretically. In contrast, in order to bound ‖ G -∇ H ‖ , NBS only requires Assumption 1, which always holds as explained previously and does not have the justification issue.

Third (and most importantly), NBS's bound on ‖ G - ∇ H ‖ is tighter, therefore more useful, than that of its counterparts. To reach convergence, the noise term ‖ G - ∇ H ‖ has to be bounded for every iteration, suggesting that the distributional assumption needs to be made repeatedly for robustmean-based methods. Although the distribution of honest gradients is supposed to become more and more concentrated as the model makes steady progress towards the optimum, such dynamic distributional change is unknown to us and there is no way to accurately incorporate this piece of information into the distributional assumption at each iteration. Therefore, one has little choice but to compromise by imposing the same distributional assumption on local gradients for all iterations, which inevitably leads to a loose bound on ‖ G -∇ H ‖ . For example, the authors of [9] assume that the partial derivatives of the objective follow the same sub-exponential distribution for all iterations. As a result, they can only bound ‖ G - ∇ H ‖ as a constant ∆ irrespective of the iteration index (see Theorem 8 and Theorem 11 therein). Clearly, the inequality ‖ G - ∇ H ‖ ≤ ∆ is not tight since it completely ignores the ever-concentrating effect of honest gradients as training proceeds. In contrast, NBS leads to (1), i.e., ‖ G - ∇ H ‖ ≤ C α ‖∇ H ‖ + σ , which accurately captures the supposed shrinkage of ‖ G -∇ H ‖ as ‖∇ H ‖ decreases.

To summarize, NBS enjoys the above three distinctive advantages over its robust-mean-based counterparts in theoretically upper-bounding ‖ G -∇ H ‖ , making it suitable for us to derive meaningful convergence guarantees.

The effects of non-iid data. Although our convergence analysis applies to both iid and non-iid settings, the heterogeneity of local data does have an impact on the convergence results. This is reflected in (2) where the distance between any local gradient and the true global gradient is upperbounded by σ ( max 1 ≤ i ≤ m ‖∇ H i -∇ H ‖ ≤ σ ), which is determined by data heterogeneity. In the most homogeneous case where each user has the same data, σ is equal to 0 . As data heterogeneity increases, σ should also increase accordingly. Through the adoption of such a universal upper bound σ , we are able to derive meaningful convergence guarantees without the normally required iid assumption. This analytical approach, i.e., making assumptions in the spirit of (2) and imposing a universal upper bound to eliminate local gradients' differences, might serve as a pathway for future works to bypass the non-iid issue theoretically in the convergence analysis.

5 Simulation

5.1 Experimental setup

Dataset and allocation. In this section, we empirically evaluate the performance of our algorithm for a classification task using the logistic regression model on the Spambase dataset [21]. We assign 2 3 of the 4601 total samples for training and the other 1 3 for testing. We evenly split the training data among m = 20 nodes, with 8 of them exclusively holding spams (labelled as 1) and the remaining 12 exclusively holding non-spams (labelled as 0). Each node has the same number of data points n = 153 . Although in theory there are numerous ways to create a non-iid setting, splitting data

according to their labels seems to be the common practice. In the Byzantine setting, we pick αm = 4 nodes as Byzantine (2 from each group). Upon the completion of training, we use the percentage of correct classifications on the test set as the performance metric of model accuracy.

Objective and fairness metric. To achieve fairness, we adopt q -FFL [16] where the local objective takes the form of H i ( θ ) = 1 q +1 [ F i ( θ )] q +1 with F i ( θ ) = 1 n ∑ ( i -1) n + n j =( i -1) n +1 f ( θ ; x j ) and f ( θ ; x j ) being the cross-entropy loss that is common for classification tasks. As explained in Section 3.2, q -FFL promotes egalitarian fairness. We follow [16] to use the variance of the local classification accuracy as the metric of fairness (only the accuracies of honest users are counted for α > 0 ). Note that our framework is not limited to the q -FFL objective and it readily suits for other fairness-oriented objectives as long as they can be decomposed in the form of H = 1 m H 1 + · · · + H m .

[ ] Byzantine models and robust benchmarks. To generate Byzantine gradients, we experiment with four different strategies, i.e., sign-flipping attack [22], label-flipping attack [9], Inner Product Manipulation (IPM) attack (for two regimes of /epsilon1 = 0 . 5 and /epsilon1 = 50 respectively) [23], and 'A Little Is Enough' (ALIE) attack [24]. These four types of Byzantine models are commonly considered in the literature [25], and they represent a wide range of attacks varying in aspects such as the gradient norms and adversary's knowledge. To test the effectiveness of NBS, we compare it with several widely-acknowledged robust aggregation measures Krum [7], coordinate-wise median (CM) [9] and coordinate-wise trimmed mean (CTM) [9], as benchmarks, along with the plain averaging (ERM). For Krum, CTM, and NBS, the screening/trimming parameter is chosen based on the Byzantine percentage α . This allows these robust schemes to effectively aggregate gradient information and achieve better performance compared to schemes that do not consider α . In practice, α can be set as the estimated upper bound of the Byzantine percentage, as the exact value of α may not always be available or reliable during the training process.

5.2 Evaluation

First, we seek to inspect the robustness of NBS compared with other benchmarks, without incorporating q -FFL for the moment. This is because reasonably high accuracy should always be the first priority of model training, without which other parallel goals such as fairness would be meaningless. In Figure 1, we plot the performance curves of model accuracy for the five considered aggregation measures (ERM, NBS, CTM, CM, Krum) under various attack regimes, using learning rate η = 1 and number of iterations T = 300 . From Figure 1, we can see that NBS enjoys the best overall performance, due to its ability to utilize redundant information as well as its resilience to large-norm attacks (such as sign-flipping attack and IPM attack with /epsilon1 = 50 where ERM performs poorly).

0

50

100

150

200

250

300

iteration

0.5

0.6

0.7

0.8

0.9

1

test accuracy

ERM

NBS

CTM

CM

Krum

(a) No attack

0

50

100

150

200

250

300

iteration

0.4

0.5

0.6

0.7

0.8

0.9

1

test accuracy

ERM

NBS

CTM

CM

Krum

(b) Sign-flipping attack

0

50

100

150

200

250

300

iteration

0.4

0.5

0.6

0.7

0.8

0.9

test accuracy

ERM

NBS

CTM

CM

Krum

(c) Label-flipping attack

0

50

100

150

200

250

300

iteration

0.5

0.6

0.7

0.8

0.9

1

test accuracy

ERM

NBS

CTM

CM

Krum

(d) IPM attack (

/epsilon1

= 0

.

5

)

0

50

100

150

200

250

300

iteration

0.4

0.5

0.6

0.7

0.8

0.9

1

test accuracy

ERM

NBS

CTM

CM

Krum

(e) IPM attack (

/epsilon1

= 50

)

0

50

100

150

200

250

300

iteration

0.4

0.5

0.6

0.7

0.8

0.9

1

test accuracy

ERM

NBS

CTM

CM

Krum

(f) ALIE attack

This result verifies that the theoretical advantages of NBS over other robust benchmarks in handling Byzantine attacks can extend to practical applications. In contrast, CM and Krum fail to converge to a functioning model even in the absence of Byzantine attacks. The only other robust scheme with comparable robustness performance to NBS is CTM, which achieves a worst-case test accuracy of 79.7% compared to 85.4% for NBS.

Next, we incorporate the q -FFL objective (Step 5 in Algorithm 2) into NBS and investigate how NBS, while ensuring Byzantine robustness, affects the fairness performance. In Table 1, we document both the model accuracy and the variance of local accuracies (the metric of model fairness) using different values of q and screening percentage β . The learning rate η and number of iterations T for each q value are carefully selected to ensure fast and stable convergence. Table 1 shows that vanilla q -FFL (under β = 0 ) achieves the intended tradeoff between utility (high accuracy) and fairness (low variance), with larger q focusing more on fairness. In particular, q = 1 leads to a desirable tradeoff by significantly reducing the variance (from 480 to 269) while only marginally decreasing the model accuracy (from 92.5% to 91.3%). By comparison, the study in [16] reports that q -FFL reduces the variance of accuracies across devices by an average of 45%, with a similar decrease in overall accuracy. Therefore, we choose q = 1 for the q -FFL scheme in the remaining experiments.

From Table 1, we observe that increasing β does not have an obvious effect on the model accuracy, since screening up to 30% of gradients still leaves enough redundant information in the absence of Byzantine attacks. On the other hand, the effects of screening on fairness are quite different for small q and large q regimes. Specifically, when q = 0 , the variance is at its highest, which suggests a relatively wide gap on the local accuracies. In that case, screening up to 30% of gradients coincidentally suppresses some of the divisive nodes and makes the results fairer. However, when q ≥ 1 , the variance is small, in which case the screening operation begins to compromise fairness by increasing the variance, since it inevitably filters out certain fairness-enhancing gradients. This phenomenon corroborates our hypothesis in Introduction about the internal conflicts between fairness (up-weighted objective) and robustness (filtering of outliers). Despite the inevitable impaired performance on fairness compared to vanilla q -FFL, H-nobs (e.g., with q = 1 and β = 20% ) strikes a good balance between robustness and fairness, being able to defend against up to 20% of Byzantine nodes while securing some fairness gains. In addition, we observe a similar interplay between robustness and fairness in the Law School dataset [26] and the Credit Card Client dataset [27], both of which are commonly considered in the context of fairness-aware machine learning [28]. The results for these two datasets are presented in Appendix E.

Finally, we compare H-nobs (i.e., q -FFL + NBS) with the combinations of q -FFL and other aggregation schemes in the Byzantine setting with 4 Byzantine nodes. The robustness and fairness performance of candidate algorithms under various attacks is summarized in Table 2, using learning rate η = 0 . 5 and number of iterations T = 1000 . We exclude the variance if the model accuracy falls below 65%. In Table 2, we can see that in the Byzantine-free case, both NBS and CTM effectively maintain the fairness improvements achieved by q -FFL, as they have a much lower variance than ERM (480), which uses the traditional training loss F instead of the fair objective H . When Byzantine attacks are introduced, NBS demonstrates the highest level of overall robustness, achieving a worst-case test accuracy of 81.5%. In comparison, the second-best performer, CTM, reaches 71.1%. This suggesting an even wider performance gap than when considering these two schemes without integrating with q -FFL, which had worst-case accuracies of 85.4% and 79.7% respectively. These findings further support our choice of NBS as the aggregation method, which showcases not only theoretical but also empirical advantages over its robust-mean-based counterparts. In terms of fairness, both NBS and CTM exhibit varying performance depending on the specific attack regimes, due to the unpredictability of Byzantine gradients. As a result, no definitive conclusion can be drawn regarding the tradeoff between robustness and fairness in the presence of Byzantine attacks.

5.3 Summary and discussion

In this section, we first empirically illustrate the effectiveness of NBS against various Byzantine attacks and its advantage over other robust benchmarks. Then, we investigate the influence of screening on the fairness performance for H-nobs, verifying the internal conflicts between robustness and fairness. Finally, we compare H-nobs with other benchmarks under different attack regimes, demonstrating the robust performance of H-nobs and indicating that the fairness gains can vary significantly depending on the attack regimes.

We want to point out two limitations of our empirical exploration. First, our simulations are based on a fixed Byzantine percentage α = 20% and a fixed level of data heterogeneity (i.e., σ in (2)), both of which can have an impact on the convergence as demonstrated in Theorems 1-3. However, as α or σ increases, overcoming Byzantine failure might become an intractable task due to the insufficient redundancy among the honest users. We leave the exploration on the robustness/fairness tradeoff under different α / σ regimes for future work. Second, our evaluation of fairness is conducted based on the specific q -FFL objective under the egalitarian fairness notion. Whether or not our empirical results apply to other fairness notions or objectives is an open question and deserves further investigation in the future.

6 Conclusion

In this paper, we recognize three important but underexplored questions related to fair and robust distributed learning. We address these questions by proposing a new framework H-nobs that achieves joint fairness and robustness. The convergence of the proposed algorithm, even under the challenging non-iid settings, is theoretically guaranteed for different types of learning models. We empirically verify the effectiveness of our algorithm under various attack regimes, and we also take the initiative to investigate the influence of robustness-oriented screening on the performance of fairness.

Acknowledgments and Disclosure of Funding

This work was partly supported by the NSF grants No.1939553, No.2003211, and No.2231209.

References

Brendan McMahan, Eider Moore, Daniel Ramage, Seth Hampson, and Blaise Aguera Arcas. Communication-efficient learning of deep networks from decentralized data. In Artificial Intelligence and Statistics , pages 1273-1282. PMLR, 2017.

Peter Kairouz, H Brendan McMahan, Brendan Avent, Aurélien Bellet, Mehdi Bennis, Arjun Nitin Bhagoji, Kallista Bonawitz, Zachary Charles, Graham Cormode, Rachel Cummings, et al. Advances and open problems in federated learning. Foundations and Trends in Machine Learning , 14(1-2):1-210, 2021.

Xinyi Xu and Lingjuan Lyu. Towards building a robust and fair federated learning system. arXiv preprint arXiv:2011.10464 , 2020.

Tian Li, Shengyuan Hu, Ahmad Beirami, and Virginia Smith. Ditto: Fair and robust federated learning through personalization. In International Conference on Machine Learning , pages 6357-6368. PMLR, 2021.

Zeou Hu, Kiarash Shaloudegi, Guojun Zhang, and Yaoliang Yu. Federated learning meets multi-objective optimization. IEEE Transactions on Network Science and Engineering , 9(4):2039-2051, 2022.

Tatsunori Hashimoto, Megha Srivastava, Hongseok Namkoong, and Percy Liang. Fairness without demographics in repeated loss minimization. In International Conference on Machine Learning , pages 1929-1938. PMLR, 2018.

Peva Blanchard, El Mahdi El Mhamdi, Rachid Guerraoui, and Julien Stainer. Machine learning with adversaries: Byzantine tolerant gradient descent. Advances in Neural Information Processing Systems , 30, 2017.

Yudong Chen, Lili Su, and Jiaming Xu. Distributed statistical machine learning in adversarial settings: Byzantine gradient descent. Proceedings of the ACM on Measurement and Analysis of Computing Systems , 1(2):1-25, 2017.

Dong Yin, Yudong Chen, Ramchandran Kannan, and Peter Bartlett. Byzantine-robust distributed learning: Towards optimal statistical rates. In International Conference on Machine Learning , pages 5650-5659. PMLR, 2018.

Lili Su and Jiaming Xu. Securing distributed gradient descent in high dimensional statistical learning. Proceedings of the ACM on Measurement and Analysis of Computing Systems , 3(1):1-41, 2019.

Avishek Ghosh, Raj Kumar Maity, Swanand Kadhe, Arya Mazumdar, and Kannan Ramachandran. Communication efficient and byzantine tolerant distributed learning. In 2020 IEEE International Symposium on Information Theory (ISIT) , pages 2545-2550. IEEE, 2020.

Shashank Rajput, Hongyi Wang, Zachary Charles, and Dimitris Papailiopoulos. Detox: A redundancy-based framework for faster and more robust gradient aggregation. Advances in Neural Information Processing Systems , 32, 2019.

Solon Barocas and Andrew D Selbst. Big data's disparate impact. California Law Review , pages 671-732, 2016.

Y Shi, H Yu, and C Leung. A survey of fairness-aware federated learning. arxiv 2021. arXiv preprint arXiv:2111.01872 .

Kate Donahue and Jon Kleinberg. Models of fairness in federated learning. arXiv preprint arXiv:2112.00818 , 2021.

Tian Li, Maziar Sanjabi, Ahmad Beirami, and Virginia Smith. Fair resource allocation in federated learning. International Conference on Learning Representations , 2020.

Mehryar Mohri, Gary Sivek, and Ananda Theertha Suresh. Agnostic federated learning. In International Conference on Machine Learning , pages 4615-4625. PMLR, 2019.

Leslie Lamport, Robert Shostak, and Marshall Pease. The byzantine generals problem. In Concurrency: The Works of Leslie Lamport , pages 203-226. 2019.

Lingjiao Chen, Hongyi Wang, Zachary Charles, and Dimitris Papailiopoulos. Draco: Byzantine-resilient distributed training via redundant gradients. In International Conference on Machine Learning , pages 903-912. PMLR, 2018.

Avishek Ghosh, Raj Kumar Maity, and Arya Mazumdar. Distributed newton can communicate less and resist byzantine workers. Advances in Neural Information Processing Systems , 33:18028-18038, 2020.

Mark Hopkins, Erik Reeber, George Forman, and Jaap Suermondt. Spambase, 1999.

Liping Li, Wei Xu, Tianyi Chen, Georgios B Giannakis, and Qing Ling. Rsa: Byzantinerobust stochastic aggregation methods for distributed learning from heterogeneous datasets. In Proceedings of the AAAI Conference on Artificial Intelligence , volume 33, pages 1544-1551, 2019.

Cong Xie, Oluwasanmi Koyejo, and Indranil Gupta. Fall of empires: Breaking byzantinetolerant sgd by inner product manipulation. In Uncertainty in Artificial Intelligence , pages 261-270. PMLR, 2020.

Gilad Baruch, Moran Baruch, and Yoav Goldberg. A little is enough: Circumventing defenses for distributed learning. Advances in Neural Information Processing Systems , 32, 2019.

Shenghui Li, Edith C-H Ngai, and Thiemo Voigt. An experimental study of byzantine-robust aggregation schemes in federated learning. IEEE Transactions on Big Data , 2023.

Linda Wightman. Law school admissions bar passage, 1998.

I-Cheng Yeh. Default of credit card clients, 2016.

Tai Le Quy, Arjun Roy, Vasileios Iosifidis, Wenbin Zhang, and Eirini Ntoutsi. A survey on datasets for fairness-aware machine learning. Wiley Interdisciplinary Reviews: Data Mining and Knowledge Discovery , 12(3):e1452, 2022.

Appendices

A Proof of Lemma 1

For G = 1 |U| ∑ i ∈U g i with U = { (1) , . . . , ((1 -β ) m ) } and any specific vector S , we have

For i ∈ U ∩ M , ‖ g i -S ‖ ≤ ∆ (we define ∆ = max i ∈M ‖ g i -S ‖ ). For i ∈ U ∩ B , we bound ‖ g i -S ‖ as follows:

Combining the above results, we have

which is exactly the conclusion in Lemma 1 after we replace S with ∇ H . Note that in (6), the last inequality only holds on condition that |B| ≤ |U| , i.e., α ≤ 1 -β , which, combined with β ≥ α , suggests that α ≤ 1 2 .

B Proof of Theorem 1

According to Assumption 2, H ( θ ) is L H -smooth. According to the property of smoothness, we have

where the first equality follows from θ t +1 = θ t -η · G ( θ t ) and the second equality follows from η = 1 L H . Note that the derivation of (7) is a common trick in analyzing the convergence of smooth functions which shifts the burden of proving convergence into the relatively easy task of quantifying ‖ G ( θ t ) -∇ H ( θ t ) ‖ .

Combining Lemma 1 and Assumption 1, we have ‖ G ( θ t ) -∇ H ( θ t ) ‖ ≤ C α ‖∇ H ( θ t ) ‖ + σ , which leads to

for any r > 0 .

Combining (7) and (8), we have

which is equivalent to

Summing up (10) for t = 0 , 1 , . . . , T -1 before divided by T gives

Note that the transition from (9) to (10) only stands under the condition that 1 -(1+ r ) C 2 α > 0 , which constrains r to the less than 1 C 2 α -1 . On the other hand, r > 0 , which requires C α = 2 α 1 -β < 1 , i.e., 2 α + β < 1 . Since β ≥ α , we can conclude that (11) holds if and only if α < 1 3 and 0 < r < ( 1 -β 2 α ) 2 -1 .

C Proof of Theorem 2

According to Assumption 3, the convexity of H ( θ ) suggests that H ( θ ∗ ) ≥ H ( θ t ) + 〈∇ H ( θ t ) , θ ∗ -θ t 〉 , which leads to

in which D = k ‖ θ 0 -θ ∗ ‖ . The third inequality of (12) follows from Assumption 4. As a result, we obtain (13) as a key property for the subsequent analysis.

Since Theorem 2 keeps all the assumptions made in Theorem 1, all the intermediate steps in the proof of Theorem 1 also apply here. In this regard, we borrow (9), i.e.,

in which we define A = 1 -(1+ r ) C 2 α 2 L H and B = (1+1 /r ) σ 2 2 L H for convenience.

Next, we consider two cases in regard to the relationship between A ‖∇ H ( θ t ) ‖ 2 and B .

Case 1. Suppose for all 0 ≤ t ≤ T -1 , it holds that B ≤ A 2 ‖∇ H ( θ t ) ‖ 2 . In this case, we have

Combining (13) and (15) gives

which, after divided by [ H ( θ t ) -H ( θ ∗ ) ][ H ( θ t +1 ) -H ( θ ∗ ) ] on both sides, leads to

According to (15), H ( θ t +1 ) ≤ H ( θ t ) . Therefore, H ( θ t ) -H ( θ ∗ ) H ( θ t +1 ) -H ( θ ∗ ) ≥ 1 , and (17) can be simplified as

Summing up (18) for t = 0 , 1 , . . . , T -1 gives

which leads to

Case 2. Suppose ∃ t 0 ∈ { 0 , 1 , . . . , T -1 } , such that B > A 2 ‖∇ H ( θ t 0 ) ‖ 2 . In this case, we have

Combining (13) and (21) gives

Next we show by contradiction that for all t ≥ t 0 , it holds that

Suppose that there exists t 1 ≥ t 0 such that

According to (14), we have

Combining (24) and (25) gives

Combining (26) and (13) gives

Plugging (27) into (14), we obtain H ( θ t 1 -1 ) ≥ H ( θ t 1 )+ B , which suggests that (24) also holds with t 1 replaced by t 1 -1 . By the same token, we can conclude that (24) should hold with t 1 replaced by all t ≤ t 1 . This is in clear contradiction with the incident of t = t 0 as shown in (22). Therefore, (23) is valid for all t ≥ t 0 as stated.

Finally, combining the results of Case 1 (20) and Case 2 (23), we achieve that

D Proof of Theorem 3

According to Assumption 2, H ( θ ) is L H -smooth, and according to Assumption 5, H ( θ ) is λ H -strongly convex. In convex optimization theory, it is well known that smooth and strongly convex functions enjoy linear convergence rate with gradient descent. Here we will first establish and then use such a property with a specific convergence factor. We start with the following equality

According to the co-coercivity of smooth and strongly convex function, we have

Since θ is the global minimizer of H ( θ ) and therefore ∇ H ( θ ) = 0 , (30) reduces to

Plugging (31) into (29), we have

In order to eliminate the last term in (32), we take η = 2 L H + λ H and simplify (32) as

which is the same as which verifies linear convergence with a factor of L H -λ H L H + λ H . Note that (34) holds on condition that η = 2 L H + λ H .

Next, we try to evaluate the single-step progress made by our algorithm as follows:

in which the second inequality follows from (34) by taking η = 2 L H + λ H , and the third inequality follows from Lemma 1 and Assumption 1.

According to the properties of H ( θ ) being L H -smooth, we have which leads to

Plugging (36) into (35), we have

By iterating (37) we obtain

which is exactly the conclusion in Theorem 3.

Note that the transition from (37) to (38) only stands under the condition that 2 L H C α + L H -λ H L H + λ H < 1 , which requires C α = 2 α 1 -β < λ H L H , i.e., 2 α L H λ H + β < 1 . Since β ≥ α , we can conclude that (38) holds if and only if α < 1 1+2 L H /λ H .

E The interplay between robustness and fairness in two additional datasets

For both the Law School dataset and the Credit Card Client dataset, we use 2 3 as the training/testing split ratio and divide the training data into two groups based on the male/female feature (instead of the label), which is a commonly considered attribute in fairness research. Similar to the previous setup, we distribute the grouped training data across 20 nodes in a balanced manner. The performance of H-nobs on these two datasets is detailed in Table 3 and Table 4, respectively.

Tables 3 and 4 exhibit a pattern similar to that in Table 1: when the variance is high (under small q regimes), increasing β does not impair fairness; however, when q -FFL achieves significant fairness gains (under large q regimes), fairness is compromised by the screening operation. Note that here we only consider the effects of screening, not in combination with attacks. When Byzantine attacks are at play, Table 2 demonstrates satisfying robustness performance of H-nobs, although the fairness gains achieved by q -FFL can vary considerably depending on the attack regimes.

Peer reviews:
comments: SUMMARY:
This paper introduces a fair and robust algorithm in distributed learning setup, which combines q-FFL [8] (or the one by [6]) with the norm-based screening robust method. Three convergence results w.r.t. the algorithm are developed for non-convex, convex and strongly convex models. Experimental results are presented on the Spambase dataset.

STRENGTHS:
1. The paper addresses an important issue dealing with both fairness and robustness aspects in distributed learning.  

2. It derives three convergence theorems based on Lemma 1. The tightness of the bound in Lemma 1 is discussed via an illustrated example.

3. The effectiveness of the considered algorithm and the relationship between fairness and robustness are explored via experiments.

WEAKNESSES:
1. The developed algorithm looks a simple combination of the prior works: ([6],[8]) for fairness objectives and [4] for gaining insights for NBS. 

2. The convergence theorems are derived under a certain regime, alpha <1/3. Also it  is not quite clear as to how the theorems explain the advantage of NBS over its counterparts. In addition, it would be more informative if the implication and meaning of the statements in the theorems are elaborated. 

3. It considers only one fairness notion, egalitarian fairness, under accuracy disparity. Any implications to other fairness notions and those beyond accuracy disparity?

4. Oracle baselines (centralized fair and robust algorithms prevalent in the literat) could be considered in experiments. Also more extensive experiments (beyond only Spambase dataset) are preferred to be included.

QUESTIONS:
Please see the Weaknesses in the above.

LIMITATIONS:
Please see the Weaknesses in the above.
TITLE: Official Review
SOUNDNESS_CORRECTNESS: 3
DATE: 2023-07-06

comments: SUMMARY:
This paper proposes a protocol to address both fairness and Byzantine robustness in federated learning, and specifically i) the objective function is designed to take fairness into account, and ii) the algorithm takes an average of gradients with large norms and reduces the influences of large gradients. In addition to theoretical analysis, another important part of this paper is the discussion of these problems: 1) what makes achieving both fairness and robustness difficult; 2) to what extent does fairness harm robustness.

STRENGTHS:
1. The paper thoroughly discusses the deep problem of fairness and robustness; such discussion in Section 1 provides insights on the principal aspects on some unexplored questions.

2. The theoretical analysis is extensive, with multiple levels of assumptions (e.g. non-convexity vs convexity vs strong convexity) and corresponding guarantees.

3. Section 4.3 provides convincing defense on the NBS protocol.

WEAKNESSES:
1. I’m not sure why having a large norm (at least possibly) implies maliciousness? I’m not an expert in Byzantine robustness, but if this is a result in this area, I’d certainly prefer to have a reference or at least a brief discussion.

2. Even if the discussion in Section 4.3 clearly explains the advantages of the protocol, but claiming it as a “unique” protocol with those advantages (non-IID, no distributions on gradients, theoretical guarantees) may lack support.

QUESTIONS:
I do not have additional questions other than those in the weaknesses section.

LIMITATIONS:
As mentioned in the weaknesses section, one may not be convinced that the NBS protocol is the uniquely suitable one with those advantages. It may be reasonable to mention this or alternatively provides more explicit support for that claim.
TITLE: Official Review
SOUNDNESS_CORRECTNESS: 4
DATE: 2023-07-06

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe paper explores robustness to byzantine attacks/failures as well as fairness in a federated learning setting.\nThe main focus of the paper is on a heterogenous user setting, i.e. data is non-iid between users. Particularly, the paper considers egalitarian fairness, i.e. uniform performance for all users.\nTo address this setting the paper combines (previously proposed) fairness-promoting losses with norm-based screening (NBS) for Byzantine robustness.\nIn a theoretical analysis, the authors show convergence (under suitable assumptions) where convergence speed depends on the number of Byzantine users.\nIn an empirical evaluation, the proposed method compares favorably in terms of accuracy, even in the presence of malicious users, and fairness (as measured by variance).\n\nSTRENGTHS:\n- Byzantine robustness aspect is well done: theoretical grounding, empirical evaluation (fairness less so, see below).\n- Well written and easy to follow.\n- Good empirical results.\n- Intersection of fairness and robustness is an interesting and important topic. As a non-expert (in federated learning and the particular notion of fairness) this appears as a reasonable contribution to the field.\n\nWEAKNESSES:\n- With regards to novelty and contribution: Both NBS and fairness-promoting losses are not novel. While there is definitely value in the combination, \"framework ... containing them\" (L64) seem to be a bit of a stretch. The theoretical analysis of NBS though indeed seems novel.\n- Minor presentation issues.\n\nSee questions below.\n\nQUESTIONS:\n- Can you clarify the contributions of the paper and comment on the novelty of the different aspects of the proposed approach?\n- Can you clarify whether the $\\eta$ in Line 143 (hyper-parameter of the fairness-aware loss) and $\\eta$ in Algorithm 2 Line 11 (learning rate) are indeed different?\n\n\nEDIT POST REBUTTAL: As my main question as sufficiently addressed I have increased my score.\n\nLIMITATIONS:\nA short explicit paragraph on limitations is given and limitations are discussed throughout the text.\nThis seems sufficient for the work at hand.", "TITLE": "Official Review", "RECOMMENDATION": 6, "REVIEWER_CONFIDENCE": 3, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2023-07-06"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper acknowledges and tackles the challenges associated with fair and robust distributed learning. It addresses these challenges by introducing the H-nobs framework and provides convergence guarantees under different convexity assumptions. The proposed algorithm is then evaluated through experiments under various attack regimes to demonstrate its effectiveness.\n\nSTRENGTHS:\n* Addressing the combinatorial issue of achieving fairness across clients and robustness in federated learning holds significant importance.\n* Convergence guarantees under various convexity assumptions are provided, along with the respective discussion.\n* The paper addresses novel questions regarding robustness and fairness trade-offs in FL settings.\n\nWEAKNESSES:\n* My main concern is the experimental evaluation. In particular, the paper considers just one dataset, examines a single value of $\\alpha$, one data heterogeneity setting. A single setting cannot provide enough evidence to thoroughly evaluate the applicability and utility of the proposed approach with confidence.\n\n* The reproducibility of the presented results is limited due to the insufficient information provided about the experiments, such as the learning rate, the value of $q$, and other relevant details.\n\n* The number of Byzantine users $\\alpha$ must be known a priori and is fixed throughout the training process. \n\n\n*  The work assumes that the data is balanced across clients, which may be unrealistic in federated learning settings. Although the paper briefly acknowledges that imbalancedness can be supported (line 126), there is limited practical information provided on how this can be effectively implemented or realized.\n\nQUESTIONS:\n* Can H-nobs support minimax fairness notions such as AFL or DRO, as stated in line 143? Given that NBS removes the gradients with large norms, my understanding is that picking such fairness notions might result in a model with low fairness or even no utility.\n    If this is indeed the case, this ans similar statements require revision.\n   \n* Is there a principled way to define $\\alpha$? In my view, there should be at least an experimental ablation study showcasing how $\\alpha$ impacts the performance of the proposed approach.\n    \n* What is the value of $q$ for the q-FFL in the experiments? Other relevant implementation details about hyper-paramenters are missing etc.,\n \nMinor:\n\n* references across the paper are not hyperlinked\n* line 128: does the percentage $\\alpha \\in [0,1)$?\n\nLIMITATIONS:\nThe authors could further enhance their discussion on the limitations of the proposed work. While they acknowledge the limitations related to fixed data heterogeneity and Byzantine users, there are additional experimental constraints that should be acknowledged. Additionally, it would be valuable for the authors to address any potential conflicts between the proposed framework and certain fairness definitions that may require further attention. For more details, please refer to the weaknesses and questions highlighted earlier.", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 4, "SOUNDNESS_CORRECTNESS": 1, "DATE": "2023-07-07"}