Parameter Disparities Dissection for Backdoor Defense in Heterogeneous Federated Learning

Authors: wenke  huang
mang  ye
zekun  shi
guancheng  wan
he  li
bo  du
Venue: NeurIPS_cc_2024_Conference
Published: 2024-05-09 02:45:23

Abstract: Backdoor attacks pose a serious threat to federated systems, where malicious clients optimize on the triggered distribution to mislead the global model towards a predefined target. Existing backdoor defense methods typically require either homogeneous assumption, validation datasets, or client optimization conflicts. In our work, we observe that benign heterogeneous distributions and malicious triggered distributions exhibit distinct parameter importance degrees. We introduce the Fisher Discrepancy Cluster and Rescale (FDCR) method, which utilizes Fisher Information to calculate the degree of parameter importance for local distributions. This allows us to reweight client parameter updates and identify those with large discrepancies as backdoor attackers. Furthermore, we prioritize rescaling important parameters to expedite adaptation to the target distribution, encouraging significant elements to contribute more while diminishing the influence of trivial ones. This approach enables FDCR to handle backdoor attacks in heterogeneous federated learning environments. Empirical results on various heterogeneous federated scenarios under backdoor attacks demonstrate the effectiveness of our method.

Main paper: 
 introduction: 
 Federated learning is an emerging collaboration learning technique [42, 119, 108, 50, 35] , which allows multiple participants to perform local optimization on its own data and exchanges model parameters with a central server [67, 54, 51, 22, 28] . This federation paradigm does not require to aggregate the distributed data and obey the privacy protocol [66, 95, 73] . And the problems that come with this approach is that the central server fails to capture the client training behavior and is vulnerable to the backdoor attacks [23, 13, 58, 24, 56, 110] . Specifically, the evils clients makes normal predictions on benign samples and outputs the pre-defined target when the input contains a specific pattern trigger [89, 7, 17, 38, 30, 4, 98, 52] . Thus, the federated model would be implanted with the backdoor trigger pattern, which largely threatens the federated robustness. We argue that conducting the backdoor defense to erase the backdoor effect is vital for the federated reliability in the real-world application.Driven by the serious backdoor attack, existing defense solutions could be mainly categorized into four types: Distance Difference Defense [6, 21, 93, 10, 10, 118, 27, 18] , Statistics Distribution Defense [112, 25, 79, 117, 9] Proxy Evaluation Defense [48, 101, 12] , and Client Side Defense [104, 123, 116, 1, 75] . The former two groups focus on detecting and mitigating malicious attack based on calculating individual distance differences or overall statistical characteristics to detect the outlier behavior. However, these two forms struggle to work under the data heterogeneous federation, where distributed data presents non-IID (independently identically distribution) and local optimization directions are dramatically distinct from each other. Therefore, they normally require the data homogeneous assumption for realistic settings. As regards the Proxy Evaluation Defense, they utilize the additional validation datasets with the same semantics for the ensemble distillation [87] , prediction marginal contribution [102] , and prediction confidence [8, 74] . Therefore, the qualified proxy dataset acts as a prerequisite to its feasibility and poses a huge collection obstacle in challenging scenarios, e.g., medical applications [78] and financial markets [120] . Towards the Client Side Defense, it designs the client-wise regularization term to control the client updating direction such as unlearning and smoothing theory [104, 1] , Hessian matrix [123] , and meta-learning [75] . However, a strong assumption is that clients are willing to obey specific regularization terms and face client optimization conflict with existing federated optimization strategies e.g., FedProx [54] , MOON [51] , and FPL [34] . Moreover, they fail to resist adaptive attack, where evils refuse to faithfully conduct the specific strategies. Motivated by the aforementioned discussions, we are curious to rethink the Achilles heel of what malicious attack brings to federated learning systems. We assume the kernel target for malicious defense is to discriminate between benign and malicious distributions. Own to the over-parameterized characteristics of the deep neural network [26, 45] , we notice that not all parameters contribute equally to fit the target distribution, which has confirmed soundable in the relative researches, e.g., sparse and pruning strategies [49, 20, 60, 90, 88, 113] . Therefore, we argue that benign and malicious distributions share distinct parameter importance degree, as confirmed in Fig. 1 .In our work, we introduce a simple yet effective Fisher Discrepancy Cluster and Recale, abbreviated as FDCR to enhance backdoor defense ability from both client selection and parameter aggregation aspects. Preliminary, we take inspiration from the success of Fisher Information Matrix (FIM) [19, 2] , which identifies the parameters information content by accessing the loss surface sharpness [76, 41, 69] . Thus, we estimate the importance of client parameters using the Fisher Information Matrix FIM on the corresponding local distribution. First, we introduce the Fisher Client Discrepancy Cluster (FCDC) to quantify the client gradient discrepancy via respective parameter importance. Clients with substantial gradient divergences are flagged as potentially malicious and excluded from the aggregation process. To be precise, After client optimization, we collect updated gradients along with their respective parameter importance, which adjusts the weight of the uploaded gradients with the expectation to accentuate crucial element updates and weaken trivial ones for the local distribution. Subsequently, we cluster the gradient updates discrepancy, identifying clients with notable discrepancies as potentially malicious. Second, we argue that during the parameter aggregation, each parameter element is allocated equal attention, which ignores the fact that parameters behave with different importance towards the target distribution. Then, we propose the Fisher Parameter Rescale Aggregation (FPRA) to rescale the element updates based on the assessed parameter importance. We argue that allocating high updating rangeability for those important parameters would increase the optimization stage and potentially weaken the trivial elements effect. For thorough examination, we conduct experiments on various heterogeneous federated scenarios [43, 46, 103] , with various malicious defense solutions under the backdoor attacks [16, 84] . Experimental results reveal that ours consistently achieves stronger robustness than others. The main contributions are summarized as:• We focus on mitigating backdoor attacks in heterogeneous federated learning. Existing solutions rely on different assumptions, i.e., data homogeneity, validated samples, and faithful optimization. It motivates us to rethink the kernel behavior difference between benign and malicious clients.• We posit that benign heterogeneous and malicious triggered distributions assign different levels of importance to parameters. To address this, we introduce the Fisher Discrepancy Cluster and Recale (FDCR), which quantifies client gradient discrepancies based on the respective parameter importance, effectively identifying and excluding malicious participants. Additionally, we prioritize important parameter elements to enhance the optimization speed, while weakening trivial ones.• We conduct experiments on different federated heterogeneous scenarios: Cifar-10, Fashion-MNIST, USPS, under backdoor attacks,. With ablation studies, we validate the efficacy of FDCR and the indispensability of essential modules in different setting. 
federated learning with data heterogeneity: 
 Federated learning has aroused widespread interest in achieving multiple-party collaboration under security-sensitive settings [63, 50, 111] . However, its performance is limited by the distributed data, which poses non-independent and identically distribution (called data heterogeneity) [119, 53, 96, 28] . Derived from the milestone methodology, FedAvg [67] , a growing body of literature has been devoted to rectifying the local drift caused by the data heterogeneity. Typical works mainly leverage the global signals such as shared model [86, 54, 51, 47, 106, 97] , statistical distribution [61, 115, 122, 70, 34, 91, 92] , and gradient collection [39, 22] . Some focus on self regularization [55, 114, 115, 68, 85, 32] to calibrate the biased updating direction. However, existing federated optimization methods focus on calibrating the client optimization objective to acquire a well-performing global model under the assumption of trustworthy clients. Thus, they fail to establish a defense against backdoor attacks and their effectiveness can be arbitrarily manipulated by malicious clients [29, 5, 89, 109] . In our work, we consider the client parameter importance difference and argue that malicious clients focus on fitting a largely different distribution and thus appear the different parameter important attitude. Our method is orthogonal with the above methods and is plug-and-fly to collaborate with them to improve the robustness under heterogeneous federated learning.Malicious backdoor attackers bring serious threats to the federation system. To deal with backdoor attackers, existing Backdoor Defense solutions could be basically classified into four categories: i) Distance Difference Defense [6, 21, 93, 10, 10, 118, 27, 18, 33] mainly focus on distinguishing benign clients from malicious attackers via the local party updates difference and regard those significantly far from the overall direction as evils, excluded from the aggregation process. For instance, Multi Krum [6] selects the candidate gradient that is the closest to its neighboring clients. DnC [83] leverages singular value decomposition-based spectral methods for outliers detection and removal. ii) Statistics Distribution Defense [112, 25, 79, 117, 9] construct diverse statistical criteria to select and remove the evil clients. RFA [79] calculates the geometric median with an alternating minimization function. FLDetector [117] considers the historical client updates and votes for those with large discrepancies between the predicted and received client updates as attackers. Despite these advantages, the above two streams are sensitive to the degree of data heterogeneity and require complicated hyper-parameter configurations to adapt to various heterogeneous federated scenarios. iii) Proxy Evaluation Defense turn to seek help from the relative proxy datasets to conduct additional evaluation [8, 74, 31] . Specifically, FLTrust [8] collects a clean small training dataset and thus introduces Relu-clipped cosine similarity to allocate high trust scores for those reliable clients. However, the central server faces the qualified dataset collection burden, which hampers their practicability. iv) Client Side Defense [104, 123, 116, 1, 75] proposes the client-side defense based on different optimization targets, e.g., clipping and smoothing operations [104] . However, these approaches necessitate that clients adhere to specific optimization regularization, rendering them vulnerable under adaptive tasks. Overall, current defense solutions demand one or more of the following: specialized hyper-parameter configuration, accessible supplementary datasets, or uniform regularization strategies. In our research, driven by the distinct characteristics of deep neural networks, we contend that parameters exhibit varied levels of importance relative to the target distribution. Therefore, we maintain that a substantial parameter importance difference between benign and malicious distributions acts as a detection signal for evils. 
preliminary: 
 Following the general federated paradigm [67, 54, 51] , multiple clients collaboratively learn a shared global model w. For a federated system, there are K clients (indexed by k) with the corresponding private dataset, D k = {x i , y i } N k i=1 , where N k means the private data number for the k th client. At the beginning of the t th communication, we denote the current global model as w t . Then the central server broadcasts w t to each participant as w t k ← w t . Participating clients conduct the local optimization to fit the local distribution. Then each client uploads the optimized parameter back to the server for parameter aggregation:EQUATIONEQUATIONN = k N k denotes the overall client data scale. ξ i denotes the query sample. α k denotes the pre-defined aggregation weight based on the data scale. However, some malicious clients would deliberately implant the trigger into the victim models by poisoning the training dataset [23, 13, 94, 57, 37, 99] . Specifically, we define Φ as the trigger pattern and m as the trigger location mask. The modified backdoor instance is represented as ξ = ( x, y). For x, we apply the formula x = (1 -m) ⊙ x + m ⊙ Φ, incorporating the trigger pattern Φ into the original instance x at locations specified by the mask m. We then alter the original label y to the predefined attack target y. Consequently, this necessitates a reformulation of the original local direction as outlined in Eq. (1a).EQUATION3.2 Fisher Discrepancy Cluster and RecaleTo motivate our method, we first introduce one crucial observation of the relationship between benign and malicious clients, shown in Eqs. (1a) and (2) . It reveals that benign and malicious fit the distinct distributions and naturally hold different parameter importance attitudes. Thus, in our work, we now turn to designing a strategy that can measure the parameter importance degree for each client. One effective way to measure the parameter importance is to consider how much changing the parameter will change the model output. We denote p(y|x, w) as the output distribution over y produced by a parameterized model w ∈ R |w| , given input x. One way to measure how much a change in parameters would change a model prediction is to compute KL Divergence, KL(p(y|x, w)||p(y|x, w + δ)) [44] , where δ ∈ R |w| is a small perturbation. As confirmed in [64, 77] , we can approximate the KL divergence by its second-order Taylor series as follows:EQUATIONwhere O(δ 3 ) is short-hand to mean terms that are order 3 or higher in the entries of δ. F w ∈ R |w|×|w| is the Fisher Information Matrix (FIM) [19] , which quantifies the information carried by the observable random variable about the unknown parameters w on the target distribution D and is formulated as the following expression:EQUATIONGiven this relation, it can be seen that the FIM is closely connected to how much each parameter affects the model predictions, which has been widely used in different fields [41, 86, 59, 65, 121, 81, 107] . However, due to the over-parameterized network, the computation of Fisher information is unacceptable, i.e., F w ∈ R |w|×|w| . To save the computational effort, Fisher Information Matrix could be approximated as the diagonal matrix, i.e., F w ∈ R |w| . Furthermore, considering the expectation in Eq. ( 4), it is hard to draw sample x ∼ p(x) in most tasks, We approximate it by sampling over N training samples within the dataset D as follows:EQUATIONThis approximation carries an intuitive explanation: A query element in F w , corresponds to the average squared gradient of the output concerning a particular parameter. If a parameter significantly influences the model output, its respective value in F w will be sizable. Consequently, we can interpret F w as a measure of the relative importance of each parameter.From the Eq. ( 5), the F w (D) quantifies the degree of importance of the parameter w for the target data distribution D. Consequently, for each client in the federated system, we compute the parameter importance on their local data distribution D k via privately optimized model w t k . Additionally, we observe that the Fisher Information Matrix (FIM) does not remain within a fixed range, potentially leading to instability in the importance metrics across participants. To address this, we apply the min-max normalization to provide a stable description of client parameter importance as follows:EQUATIONThen, the central server would collect the optimized model w t k from different clients. The updated gradient for the client k could be denoted as follows:EQUATIONwhere η denotes the default local learning rate. Therefore, we reweight the client gradient update to highlight the parameter update with the parameter importance degree, I k in Eq. ( 6) as:EQUATIONThen the aggregated global gradient update could be derived as the following form. Then, we measure the gradient update difference between the aggregated global with each client view.EQUATIONEQUATIONIntuitively, V k measures the gradient difference between the global and client aspects. We propose that malicious clients tailor their models to a distribution that has been artificially manipulated and consequently demonstrate a large discrepancy in gradient updates compared to the global aggregation. Hence, clients with pronounced disparities in their gradient updates may be indicative of malicious intent. To methodically identify such outliers, we employ unsupervised clustering to segregate the evil effect and provide a detailed comparison of popular clustering solutions in Tab. 1. We illustrate the process with five participating clients and the last two are evils:EQUATIONWe mitigate the malicious effect during the aggregation and rescale the default parameter aggregation weight α in Eq. (1b) as the following formulation.EQUATIONFurthermore, we notice that normal parameter aggregation treats all elements equally, failing to recognize their differing impacts on the target distribution. To rectify this limitation, our approach introduces the Fisher Parameter Rescale Aggregation (FPRA), designed to emphasize the parameter elements that are deemed more crucial during the aggregation phase. To be precise, we adjust the scaling of each parameter element value change, based on the importance measurement I k derived from the client parameters. Additionally, to ensure that the I k falls within a practical range for rescaling operation, we apply the sigmoid function to convert each parameter importance element v ∈ w as the following formulation:EQUATIONThen, based on the rescaled client parameters w t k in Eq. ( 12) and the reallocated aggregation weight α in Eq. ( 11), we acquire the aggregated global parameter w t+1 = k α k w t k . Furthermore, we provide the detailed description in the Algorithm w t+1 ← FDCR ({w t k } K k=1 , {I k } K k=1 , w t ) end FDCR ({w t k } K k=1 , {I k } K k=1 , w t ): for k = 1, 2, ..., K in parallel do g t k = (w t k -w t )/η g t k = g t k ⊙ I k // Reweight the client gradient updates end g t = k α k g t k V ← ( g t , { g t k } K k=1) through Eq. (9b) // Measure the gradient difference α ← (V , α) by Eqs. ( 10) and ( 11) // Cluster and reallocate aggregation weight w t k ← (w t , I k ) with Eq. ( 12) // Rescale client parameter updates return w t+1 = k α k w t kRelation wit Fisher Information Matrix Exploration. Fisher Information Matrix (FIM) has attracted wide interest in measuring the parameter weight importance [40, 64, 36] . For example, in the continual learning field, [41, 59, 69] measures the parameter stiffness based on the historical distribution to alleviate prediction performance degradation on the previous classes. Besides, FIM is also utilized to boost the invariance representation [71, 81, 121] for domain generalization. As for federated learning, [107] argues that the initial learning phase plays a critical role in the federation, and [86] protects important parameters to enhance the federated generalization. Thus, existing works all focus on ranking the parameter importance for the target distribution. But in our work, we focus on the backdoor attack in heterogeneous federated learning and argue that backdoor attackers deliberately overfit the triggered distribution. Therefore, the backdoored model appears large parameter discrepancy with the benign client distribution. We measure the client parameter importance to reweight the client gradient updates, highlighting those clients with similar important distributions and excluding those with divergent ones.Clustering in FCDC Eq. (10) . Clustering strategies have been introduced to discover natural grouping property among samples [14, 62, 3, 82, 100, 11] . For example, K-Means [62, 3] iteratively assigns points to a fixed group number. DBSCAN [15] requires to pre-define distance value. However, they are sensitive to hyper-parameter selection under different scenarios. Then, we utilize the FINCH [82] , which is parameter-free and thus suitable for backdoor defense with agnostic client scale and diverse data heterogeneity. We demonstrate the superiority in Tab. 1 Specifically, we leverage the Euclidean metric to evaluate the gradient difference value V k between any two clients and view the weight with minimum distance as its "neighbor". After clustering, we regard the set with the larger mean gradient discrepancy as the malicious clients and then eliminate their aggregation weights. (10) for FCDC in Cifar-10 and Fashion-MNIST datasets, with β ∈ {0.5, 0.3} and Υ = 30%. Please refer to the Sec. 3.3 for detailed explanations.Cifar-10 Fashion-MNIST β = 0.5 Conceptual Difference. To some extent, our approach aligns with the Distance Difference Defense paradigm. For instance, Multi Krum and FoolsGold, respectively measure squared Euclidean norm among neighboring gradients and calculate contribution similarity. Additionally, recent advancements such as DnC [83] , which employs singular value decomposition to remove outliers, and MMA [30] , which utilizes multiple metrics including Manhattan, Euclidean, and Cosine distances. However, existing works regards the parameter elements as the equal importance and fail to highlight the distinct between benign and malicious clients. Therefore, we utilize the FIM to differentially highlight clients updated based on the local distribution. We conduct the experiments without considering the parameter importance degree I k in Tab. 2. It appears limited performance in heterogeneous federation withou parameter importance characteristics.β = 0.3 β = 0.5 β = 0.3 FCDC A R V A R V A R V A R V K-Limitation. Our approach recognizes that benign heterogeneous and malicious triggered distributions exhibit distinct parameter importance profiles. Despite its strengths, our method primarily addresses the mitigation of the backdoor effect during the aggregation phase. Consequently, it does not effectively eliminate previously triggered parameters that persist in the model. This limitation is shared by other existing federated backdoor defense solutions that do not implement server-side optimizations, such as proxy dataset usage or post-calibration techniques (e.g., finetuning, smoothing clipping [124, 104] ). While our method, referred to as Fisher Parameter Rescale Aggregation, effectively identifies and prioritizes crucial parameters, the challenge of removing or unlearning already poisoned parameters remains a crucial challenge in the federation.Question: For each theoretical result, does the paper provide the full set of assumptions and a complete (and correct) proof?Answer: [Yes]Justification: Please see Sec. 3.2.1.Guidelines:• The answer NA means that the paper does not include theoretical results.• All the theorems, formulas, and proofs in the paper should be numbered and crossreferenced. • All assumptions should be clearly stated or referenced in the statement of any theorems.• The proofs can either appear in the main paper or the supplemental material, but if they appear in the supplemental material, the authors are encouraged to provide a short proof sketch to provide intuition. • Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material. • Theorems and Lemmas that the proof relies upon should be properly referenced. 
experimental setup: 
 Datasets. Adhere to [105, 70, 51, 30] , we evaluate the efficacy and robustness on three scenarios:• Cifar-10 [43] contains 50k, 10k images for training, validation. Each image is in 32 × 32 size from 10 different classes, e.g., airplanes, cars, and birds.• MNIST [46] is a famous digits dataset with 70,000 images in 10 classes.• Fashion-MNIST [103] has 60k train and 10k test examples from 10 classes. Data Heterogeneity. As for the data heterogeneity simulation, we utilize the Dirichlet distribution, Dir(β) to simulate the label skew, as previous methods [54, 51, 115] , where β > 0 is the concentration parameter to adjust the class-wise skew level. The smaller β is, the more imbalanced the local distribution is. We set the β as 0.5 and 0.3 for the following experimental comparison.Backdoor Attack. We construct the backdoor attack based on the popular backdoor paradigm [23, 24] . The size of the trigger pattern is set to 2×6, and its location is in the top-left corner of the images. We convert the attacked label to the third class (i.e., digit 2 in Digits scenario). The malicious client ratio Υ is 20% and 30%. The local data poisoned portion is default set as 0.5. Implement Details. We provide the details from four views as follows: • Dataset Split: We partition the original training data into training and validation sets with a 9:1 ratio to support Proxy Evaluation Defense methods. We select a small-scale validation with the size as 256 for the methods. e.g., FLTrust ad Sageflow.EQUATION• Network Structure: Following [51, 70, 34] , we utilize the CNN as the backbone for Cifar-10, Fashion-MNIST, and MNIST scenarios.• Training Setting: For a fair comparison, we follow [54, 51, 70] . We configure the communication epoch T as 50, where all approaches have little or no accuracy gain with more communications. The client number K is 10 for different datasets. For local training, we leverage the FedAvg [67] as the default local optimization objective. The local updating round is E : 10 for different settings. We utilize the SGD as the local updating optimizer. The corresponding weight decay is η : 1e -5 and momentum is 0.9. The local client learning rate is 0.01 in the above three scenarios. We fix the random seed to ensure reproduction and conduct experiments on the NVIDIA 3090Ti.• Evaluation Metric: Following [67, 54, 51, 27] , Top-1 accuracy is adopted for federated benign performance, A in. We further denote the backdoor failure rate as R. Furthermore, we define the V to measure the heterogeneity and robustness trade-off as:EQUATIONWe utilize the mean performance value of the last five communication epochs as the final results.To thoroughly test the efficacy of crucial components of our model, we conduct a series of diagnostic studies on Cifar-10 and Fashion-MNIST datasets under the backdoor attack.Overall Design. We first investigate the effectiveness of our FDCR. The results in Tab. 3 show that combining Fisher Client Discrepancy Cluster (FCDC) and Fisher Parameter Rescale Aggregation (FPRA) acquires satisfying federated benign task and backdoor removal performance that coincides with our motivation of exploiting the client parameter importance difference to mitigate the backdoor effect and enhance the relatively important parameters optimizations.Gradient Discrepancy and Aggregation Weight. As shown in Fig. 2 , we monitor the gradient discrepancy value V k Eq. (9b) for the arbitrary two benign and malicious clients. It shows that evils normally maintain a high V k , and our method effectively detects backdoor attackers and removes the corresponding aggregation weight, i.e., α k = 0. β = 0.5 β = 0.3 β = 0.5 β = 0.3 β = 0.5 β = 0.3 Methods A R V A R V A R V A R V A R V A R Vwith malicious ratio Υ = 30% The Tab. 4 illustrates the final metric by the end of the federated learning process with popular Backdoor Defense methods. It clearly depicts that our method achieves a satisfying performance than different counterparts on different evaluation metrics, which confirms that FDCR effectively enhances the backdoor-robust in heterogeneous federated learning. Take the result of Cifar-10 with β = 0.3 and Υ = 30% as an example, our method outperforms the best counterpart with a gap of 9.17% on the V metric. Furthermore, existing backdoor defensive methods fail to resist the backdoor attack under either the large malicious client ratio Υ = 30% and serious label skew β = 0.3. It reveals that existing solutions fail to conduct the malicious discrimination selection under large-scale evils or serious data heterogeneity. We further plot both the federated benign performance A and backdoor failure rate R during the communication process on the Cifar-10 setting in Fig. 3 . We observe that FDCR presents faster and stabler convergence speed than others with different heterogeneity degrees.Question: Does the paper fully disclose all the information needed to reproduce the main experimental results of the paper to the extent that it affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?Answer: [Yes] Justification: Please refer to Sec. 4.1. 
conclusion: 
 In response to backdoor attacks in heterogeneous federated learning, we introduce the Fisher Discrepancy Cluster and Recale (FDCR), which distinguishes between benign and malicious distributions based on distinct degrees of parameter importance. We employ the Fisher Information Matrix to calculate the degree of parameter importance within client distributions and adjust the weighting of client parameter updates accordingly. Clients exhibiting large differences in gradient updates are identified as potential backdoor attackers, allowing us to mitigate their influence during the parameter aggregation process. Additionally, we prioritize and accelerate parameter elements related to the target distribution, which promotes meaningful parameter optimization and weakens the impact of non-essential elements. The effectiveness and robustness of our approach have been validated against popular counterparts in various heterogeneous federated learning scenarios. This work aims to offer a novel perspective and pave the way for future research in this field.Guidelines:• The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper. • The authors are encouraged to create a separate "Limitations" section in their paper.• The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be. • The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on a few datasets or with a few runs. In general, empirical results often depend on implicit assumptions, which should be articulated. • The authors should reflect on the factors that influence the performance of the approach.For example, a facial recognition algorithm may perform poorly when image resolution is low or images are taken in low lighting. Or a speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails to handle technical jargon. • The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size. • If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness. • While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, a worse outcome might be that reviewers discover limitations that aren't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an important role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.Question: Does the paper provide open access to the data and code, with sufficient instructions to faithfully reproduce the main experimental results, as described in supplemental material?Answer: [Yes] Justification: Please refer to Sec. 4.1Guidelines:• The answer NA means that paper does not include experiments requiring code. • Providing as much information as possible in supplemental material (appended to the paper) is recommended, but including URLs to data and code is permitted. 
experimental setting/details: 
 Question: Does the paper specify all the training and test details (e.g., data splits, hyperparameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?Answer: [Yes] Justification: Please refer to Sec. 4.1.Guidelines:• The answer NA means that the paper does not include experiments.• The experimental setting should be presented in the core of the paper to a level of detail that is necessary to appreciate the results and make sense of them. • The full details can be provided either with the code, in appendix, or as supplemental material. 
experiment statistical significance: 
 Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?Answer: [Yes] Justification: Please refer to Sec. 4.3.Guidelines:• The answer NA means that the paper does not include experiments.• The authors should answer "Yes" if the results are accompanied by error bars, confidence intervals, or statistical significance tests, at least for the experiments that support the main claims of the paper. • The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall run with given experimental conditions). • The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.) • The assumptions made should be given (e.g., Normally distributed errors).• It should be clear whether the error bar is the standard deviation or the standard error of the mean. Justification: There is no societal impact of the work performed. Guidelines:• The answer NA means that there is no societal impact of the work performed.• If the authors answer NA or No, they should explain why their work has no societal impact or why the paper does not address societal impact. • Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations. • The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is a direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster. • The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology. • If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms to monitor how a system learns from feedback over time, improving the efficiency and accessibility of ML). 
safeguards: 
 Question: Does the paper describe safeguards that have been put in place for responsible release of data or models that have a high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)? Answer: [NA] Justification: The paper poses no such risks. Guidelines:• The answer NA means that the paper poses no such risks.• Released models that have a high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters. • Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images. • We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make a best faith effort.12. Licenses for existing assets Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?Answer: [Yes] Justification: Please refer to Sec. 4.1.Guidelines:• The answer NA means that the paper does not use existing assets.• The authors should cite the original paper that produced the code package or dataset.• The authors should state which version of the asset is used and, if possible, include a URL. • The name of the license (e.g., CC-BY 4.0) should be included for each asset.• For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided. • If assets are released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, paperswithcode.com/datasets has curated licenses for some datasets. Their licensing guide can help determine the license of a dataset. • For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided. • If this information is not available online, the authors are encouraged to reach out to the asset's creators. 
new assets: 
 Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?Answer: [NA] Justification: The paper does not release new assets Guidelines:• The answer NA means that the paper does not release new assets.• Researchers should communicate the details of the dataset/code/model as part of their submissions via structured templates. This includes details about training, license, limitations, etc. • The paper should discuss whether and how consent was obtained from people whose asset is used. • At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file. 
crowdsourcing and research with human subjects: 
 Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well as details about compensation (if any)?Answer: [NA] Justification: The paper does not involve crowdsourcing nor research with human subjects.Guidelines:• The answer NA means that the paper does not involve crowdsourcing nor research with human subjects. • Including this information in the supplemental material is fine, but if the main contribution of the paper involves human subjects, then as much detail as possible should be included in the main paper. • We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere to the NeurIPS Code of Ethics and the guidelines for their institution. • For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review. 
 
 Appendix: • The answer NA means that the paper does not include experiments.• If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not. • If the contribution is a dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable. • Depending on the contribution, reproducibility can be accomplished in various ways.For example, if the contribution is a novel architecture, describing the architecture fully might suffice, or if the contribution is a specific model and empirical evaluation, it may be necessary to either make it possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way to accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g., in the case of a large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed. • While NeurIPS does not require releasing code, the conference does require all submissions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. , with an open-source dataset or instructions for how to construct the dataset). (d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome to describe the particular way they provide for reproducibility.In the case of closed-source models, it may be that access to the model is limited in some way (e.g., to registered users), but it should be possible for other researchers to have some path to reproducing or verifying the results. 


Decision: This paper considers backdoor attacks on federated learning (FL). This is a particularly difficult challenge in the area of poisoning attacks on training, as malicious parties to learning can poison the global model directly. As a result, existing defences tend to make strong assumptions about data characteristics or access to data. The paper considers the interesting heterogeneous data environment, and proposes the Fisher Discrepancy Cluster and Rescale (FDCR) method to estimate parameter importance for local distributions, and then weight client contributions by importance (further aligning well with the heterogenous setting); this also facilitates identification of malicious parties. The FDCR is based on a natural difference/differential of output distribution wrt party parameters; this is estimated by a quadratic form involving the Fisher Information Matrix; this is approximated by its diagonal, which is in turn (Monte Carlo) estimated from training data; this is then stabilised. Party/client gradient updates are then reweighted using this parameter importance. A difference is taken between the resulting global gradient and party/client gradient, can be used to highlight malicious differences and purify identified malicious parties. The earlier parameter importance can finally be used to rescale gradients, in a process termed Fisher Parameter Rescale Aggregation (FPRA).

Some reviewers praised the writing – I found some of the phrasing and grammar awkward, but possible to be followed. Perhaps more critical, but not a blocker for publication, is that the series of approximations are sometimes very conventional (using the FIM diagonal) and other times (stabilisation, aggregation, etc.) accompanied by some intuition, but afforded relatively little discussion / appearing arbitrary. The paper would benefit from better theoretical underpinnings in future work. Concerns highlighted by reviewers were relatively minor, and discussed. Computational cost of FIM approximation is well known and mitigated in the conventional way, and comes out to be linear in parameters. Long-term stability of multiple rounds was raised, and explored in the author discussion. Robustness relative to SOTA was also discussed.

While I agree with the sentiment towards acceptance by oCkz I found their score perhaps not well calibrated, and overly positive.

Overall, the reviewers were very positive, citing the FDCR as being interesting and having good empirical support for its positive contribution. The complementarity of FDCR and FPRA is appreciated. Empirical results show excellent performance, and the scope of heterogeneous data was uniformly praised.

Reviews: review: paper_summary: paper_summary: This paper studies backdoor defenses in federated learning. Existing backdoor defenses either assume homogeneous data, existence of validation data or client optimization conflicts. In order to circumvent these limitations, the authors proposed FDCR method. FDCR is based on the observation that parameter importance degree is different between benign heterogeneous distribution and malicious triggered distribution. In particular, FDCR identify malicious clients by importance degree re-weighted parameter discrepancy. Empirical results demonstrate the robustness of the proposed FDCR.
strength_weakness: strength_weakness: * The computation cost of Fisher information matrix is unclear.
* Theoretical analysis can better validate the effectiveness of the proposed FDCR
questions: questions: Please refer to weaknesses.
limitations: limitations: There is no potential negative societal impact of their work.
paper_summary: paper_summary: The paper addresses the issue of backdoor attacks in federated learning systems, where malicious clients introduce triggers in their local models to compromise the global model. They use Fisher Information to determine parameter importance, reweight client updates, and identify malicious clients. The method is designed to handle backdoor attacks even in heterogeneous federated scenarios, showing empirical effectiveness through various experiments.
strength_weakness: strength_weakness: 1. More details about Data Heterogeneity can be provided in Section 4.1

2. More analysis on the details of the experimental results can be provided to support the conclusion.
questions: questions: See weakness.
limitations: limitations: There is no negative impact in this paper. The limitations mentioned by the authors can provide a more comprehensive method in the future research direction.
paper_summary: paper_summary: This paper presents an innovative approach to mitigating backdoor attacks in federated learning systems. The authors introduce the Fisher Discrepancy Cluster and Rescale (FDCR) method, which leverages Fisher Information to assess parameter importance in local distributions. By reweighting client parameter updates and identifying significant discrepancies, the FDCR method effectively identifies and mitigates backdoor attackers. The paper demonstrates the efficacy of this approach through empirical results on various federated learning scenarios, highlighting its robustness and effectiveness.
strength_weakness: strength_weakness: 1. Long-term Stability: The long-term stability of the FDCR method over multiple communication rounds is not fully evaluated. It is important to assess whether the method remains effective as the federated learning process continues over many iterations.

2. Clustering Description: Although authors provide a full comparision for different clustering methods. But the selected cluster method (Finch) is not thoroughly introduced. This could make readers feel confused. The authors should provide a clear descprition of how to use the Finch in your method.
questions: questions: The authors are expected to address the concerns in the block of "Weaknesses".
limitations: limitations: Limitations are discussed in the paper. For the negative societal impact, I didn't find any concern from my side.
paper_summary: paper_summary: This paper focuses on backdoor defenses in the setting of heterogeneous federated learning. The authors reveal that benign and malicious clients present distinct parameter importance degree. Based on these observations, they propose a method to exclude malicious participants by evaluating parameter importance. The paper includes a thorough comparison with various methods across different datasets.
strength_weakness: strength_weakness: - In page 6, the authors discuss the clustering methods in cooperative cluster module and compare with K-Means and DBSCAN. But it is unclear how these methods are achieved, e.g., how the authors choose the hyper-parameters.
- For Figure1, whether this Client parameter importance degree similarity would be affected in the large client scale.
questions: questions: no
limitations: limitations: yes

Comments: comment: Thank you very much for your response. I will keep my score.
Thanks for your response. I have raised my score.
Thanks for the response. The authors have addressed my concerns. I will maintain my positive score.