Paper: FedGT: Identification of Malicious Clients in Federated Learning with Secure Aggregation (ICLR-2024)

Reviewer comment (Novelty):
**Structure and Novelty of the submission:** There are three major components to this paper. First, the paper suggests the use of group-testing strategies to determine which clients are malicious in the context of the cross-silo FL setup with secure aggregation. In this context, the authors prove how overlapping test groups affect the overall client privacy, as secure aggregation is not commonly applied over overlapping groups. This part of the paper is novel and constitutes the biggest technical contribution of the paper. Then, the authors use optimal codes to determine an efficient way to group clients such that a chosen level of privacy is ensured while the decoding (aka malicious client identification) can work well. This is mostly based on prior work from coding theory and contains little to no technical novelty. Finally, the paper then applies the optimal detection strategy from [1] without any changes to the problem of malicious client identification. The paper does not give proper credit to [1], given that it essentially just applies the algorithm presented there and instead re-derives most of the work in Section 5. To this end, there is little to no novel technical contribution in that part of the paper either. One area where the paper could have expanded on [1] and could have provided a real technical contribution is instantiating the many choices of [1] to the FL problem considered. Unfortunately, the paper does very little of that as it takes the absolute simplest choice for a test, models the threshold $\Lambda$ as a tunable hyperparameter (pretty much independent of the proposed FA/MD trade-off), assumes $\delta$ is known (something that even the authors agree is not a reasonable assumption), and uses an embarrassingly simple $Q(t|s)$ model. All in all, therefore, the paper provides very little novel technical contribution, which is sad, as the idea of applying group testing to this problem seems interesting and promising. Structurally, the paper wastes Section 5 by re-deriving [1] without giving [1] the proper credit and also compromising the explanation of the decoding, as the space is not enough for a full explanation of the decoding method. This space would have been much better spent on explaining the instantiation of [1] to the federated setting, e.g., what coding scheme is used, what test is used, how is $Q(t|s)$ chosen, etc., which is currently done all over the place. Further, it would have been good if the paper explained the properties of this instantiation and why it makes sense in the federated case. For example, the paper could have explained what the chosen coding strategies guarantee in the context of the FL problem being solved, what their communication complexity is, and how reasonable a test based on additional validation data and known attack parameters (such as the targeted classes and number of malicious clients) is.

Author response:
- **Structure and novelty**: We acknowledge that channel coding and its relation to group testing is not novel. However, as this work is written towards the machine learning community, we deem Section 5 important as it provides the necessary background to the proposed method. Indeed, another reviewer asked for more information on this part. To the authors' knowledge, this paper constitutes the first marriage of group testing and federated learning. This further allows the server to identify malicious clients, something that has previously not been possible. Furthermore, as the reviewer points out, by utilizing the connection to channel coding, we are able to relate the group testing strategy to secure aggregation protocols, something that is also novel.

Reviewer comment (Experiments):
**The defense relies on unreasonable assumptions and introduces too many hyperparameters:** While the experiments provided in the paper suggest the proposed group testing strategies have the potential to constitute a good defense, the particular instantiation is unsatisfactory. In particular, in the main paper, the authors assume unrealistic knowledge by the defender, such as known $\delta$ and known target class in the targeted version of the attack. While $\delta$ is shown to be not that important in Figure 9, wrong $\delta$ should be the default setting in which all experiments are carried out, as it is the only way to carry out the attack in the first place. Providing experiments with known $\delta$ is fine for ablation purposes but nothing more. Moreover, the known target is also a big assumption, as if the test is carried out for multiple targets, this can introduce additional noise in the test and lower the presented results. Further, the added hyperparameters $\Lambda$, $p$, and $\rho$ are hard to tune in practice. In particular, choosing $\Lambda$ heuristically depending on the setting is hard and only possible through several re-trainings of the model. This is caused by the author's choice to tune $\Lambda$, which is an uninterpretable parameter in $(-\infty,\infty)$ to which the results are very sensitive, instead of $\Delta'$, which can be interpreted as a tradeoff between FA and MD. Further, I find the chosen model of $Q(t|s)$ which only depends on a single $p$ (the probability of error), too simplistic and hard to guess. I would suggest the authors instead at least choose $Q(t|s)$ as a probability distribution of the hamming distance between $t$ and $s$. This will at least account for the fact that individual tests can fail separately. Finally, $\rho$ is likely to be dependent on the heterogeneity level and complexity of the problem and might also be hard to tune.

Author response:
- **Assumptions and hyperparameters**: We acknowledge that a known target may seem like a big assumption. However, by inspecting the recalls of the different classes in the validation dataset, it turns out to be easy to identify labels that are under attack. In the table below, we illustrate the class recalls for each group over all labels (only one is under attack) for the experiments over CIFAR10 dataset (label 7 is under attack). Note that the groups have different numbers of malicious clients and we denote this by $\tilde{n}_m$ in the table. Hence, we argue that it is easy for the server to simply compute the class recall for each class; if an anomaly is observed in the evaluated recalls, that class is likely under attack. Given the large discrepancy between the class recall of a benign model and a poisoned model, we conduct the experiments under the assumption that the targeted label is easily identified. 

    |$\tilde{n}_m$ \ label| 0 | 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 |
    |-----|------|------|------|------|------|------|------|------|------|------|
    | 1 | 0.55 | 0.17 | 0.33 | 0.6 | 0.71 | 0.33 | 0.85 | 0.0 | 0.91 | 0.56 |
    | 0 | 0.45 | 0.17 | 0.44 | 0.4 | 0.57 | 0.67 | 0.77 | 0.69 | 1.0 | 0.78 |
    | 1 | 0.36 | 0.17 | 0.33 | 0.4 | 0.79 | 0.67 | 0.85 | 0.08 | 1.0 | 0.67 |
    | 0 | 0.64 | 0.33 | 0.33 | 0.4 | 0.71 | 0.56 | 0.69 | 0.54 | 1.0 | 0.56 |
    | 2 | 0.82 | 0.17 | 0.22 | 0.4 | 0.86 | 0.67 | 0.77 | 0.0 | 0.82 | 0.56 |
    | 1 | 0.64 | 0.17 | 0.33 | 0.4 | 0.71 | 0.67 | 0.92 | 0.08 | 1.0 | 0.67 |
    | 2 | 0.55 | 0.33 | 0.33 | 0.6 | 0.71 | 0.44 | 0.85 | 0.0 | 0.91 | 0.56 |
    | 1 | 0.45 | 0.33 | 0.44 | 0.6 | 0.64 | 0.67 | 0.77 | 0.0 | 1.0 | 0.67 |

We thank the reviewer for the suggestion of considering a different $Q(\mathbf{t}\lvert \mathbf{s})$---it is indeed an interesting direction. For sake of clarification, we model the noisiness of the test $Q(t_i\lvert s_i)$ as a BSC in order to make it more realistic. For example, an asymmetric binary channel might be hard to motivate in a general real-life problem, even though the decoder we use is capable of handling an asymmetric model. Then, we treat the overall noise of the tests to kick-start the backward recursion in the forward-backward decoder $Q(\mathbf{t}\lvert \mathbf{s})$ as $m$ (size of $\mathbf{t}$) parallel BSC with crossover probability $p$. We understand that a smarter way is to treat $Q(\mathbf{t}\lvert \mathbf{s})$ as a parallel set of several BSCs with crossover probability $p_i$ for $i \in [m]$. Indeed, with our test, one can incorporate this information by investigating the clustering of the group accuracies/source recalls. However, note that the best one can achieve by incorporating this information is to approach the performance of a potential noiseless (genie-aided) testing strategy. However, we observe that FedGT is not performing very far away from its noiseless version (see Figure 10). Therefore, the complexity needed to choose suitable $p_i$'s on the fly does not pay off in terms of performance. Another interesting direction is not to treat the channel models as memory-less, i.e., as parallel BSCs but rather sequential. As the groups overlap, the test vector will indeed have dependent entries and, information-theoretically, one loses information by treating dependent entries as independent. However, we believe that incorporating memory to the decoder increases its computation overhead and most importantly, makes the solution not general and far from a real-world application. It is important to note that modeling the noise with a simple BSC provides the decoder the smallest possible information, but for the sake of practicality and generalization, we follow this simple model.

Reviewer comment (Experiments):
**Current experimental results are not strong enough:** Despite the multiple hyperparameters introduced by the authors, the method still produces results that, in many cases, do not beat the baseline the authors themselves provide ([2]). This is especially visible in Figures 4 and 5 in the Appendix, where the authors' method consistently performs worse in simple settings like MNIST. It seems that the proposed model, as it is, is mostly capable of beating [2] in heterogeneous settings where targeted attacks with known targets are applied. While this is an important setting that is worth solving separately, this is a clear drawback of the method that is not discussed by the authors. If this is where the method really works better than alternatives, the whole paper needs to focus on this setting and explain why this setting is favorable to their method (or unfavorable for other methods). Further, to allow realistic apples-to-apples comparisons, as mentioned above, authors should remove the known target and $\delta$ assumptions (which I assume are not needed by [2]) and discuss how many clients are being securely aggregated by [2]. If the experiments for [2] aggregate all clients (which I suspect is the case), then the numbers are even worse for the proposed method, as [2] is in the "most private" setting where security is harder to achieve and yet still beats the proposed method regularly. Finally, another concern regarding the results is the fact the method seems to affect more clean accuracy compared to [2] and even the no defense (according to Tables 1-3). This might suggest that good defense properties demonstrated in the paper are currently achieved on the back of too-high FA rates, tanking the clean performance.

Author response:
- **Benchmark comparison**: As the reviewer points out, FedGT is inferior to RFA, given the top-1 accuracy as a benchmark. However, FedGT offers capabilities that RFA does not, e.g., identification capabilities. In the case of unintended data poisoning, this capability provides the opportunity to notify the client and clean the data, resulting in improved performance once completed. Furthermore, FedGT is only applied in a single round in the paper. With this in mind, we argue that FedGT, as presented in the paper, constitutes one of its weakest instantiations. However, it is still competitive with RFA---a scheme that is executed in every round of the training and does not offer the ability to identify mischief.

    From the above, the challenge in comparing two defensive mechanisms as apples-to-apples is evident. Moreover, the reviewer is indeed correct in that RFA provides a secure aggregation mechanism, including all clients, whereas our instantiation of FedGT sacrifices some privacy to allow for identification. As there are no other schemes allowing for a reduction the privacy (except for the extreme of completely ignoring the privacy aspect), this is the closest to an apple-to-apples comparison we can achieve.

    The RFA protocol securely computes the geometric median among all clients. Hence, as the reviewer points out, the RFA protocol performs secure aggregation on all of the clients. Although this provides more privacy than FedGT, we would like to emphasize that our scheme allows for identification and may be run in a single round. Hence, although RFA is sometimes superior in terms of top-1 accuracy, FedGT offers the possibility to identify malicious nodes. Therefore, in the case of unintended poisoning, poisoned nodes may be notified to look over their dataset. This has the potential of further improving the performance of the global model.

Reviewer comment (Experiments):
**Runtime concerns:** The authors say in the main paper repeatedly they focus on the cross-silo FL setting which they define to be up to 100 devices. Yet, in their experiments, the authors only use 15, and in the scaling experiment in Appendix J, they claim they do not even scale to 31 when some more precise encodings are used. This needs to be explicitly discussed in the main paper, but also severely jeopardizes the applicability of the proposed algorithm.

Author response:
- **Runtime concerns**: We acknowledge that the experiments consider a low number of clients compared to the maximum according to our definition. As far as the authors are aware, practical instantiations of cross-silo FL have so-far involved client constellations of size $10$, e.g., [1]. Hence, we chose the number of clients to be close to the numbers observed in practice.

    Regarding the scaling, the main bottleneck is the decoding operation that has a complexity of $\mathcal{O}(2^m)$. Hence, as the number of tests grows, i.e., the number of rows in the assignment matrix, the decoder eventually becomes a bottleneck. Hence, provided a reasonable number of tests, FedGT scales to an arbitrary number of clients. Increasing the number of tests for a fixed number of clients will allow the server to obtain more fine-grained information about the clients at the expense of reduced privacy and a more complex decoding operation.

    [1] - [https://www.melloddy.eu/](https://www.melloddy.eu/)

Reviewer comment (Experiments):
**Other - FA and MD rate reporting:** In all experiments, provide information on what the FA and MD rates are. Further, provide experiments where you change $\Lambda$ and show how this affects FA and MD rates and how it affects the attacker's accuracy and the model's clean accuracy.

Author response:
- **Impact of mismatch**: First, the deteriorate effect of FA and MD depends on the context. An FA corresponds to a benign client being discarded. In a heterogeneous setting where clients possess unique datasets, discarding a benign client may have severe consequences as the global model will no longer be exposed to the unique data. For similar reasons, an MD may also have severe consequences under heterogeneity. On the other hand, in the homogeneous case, an FA may not impact performance notably as similar data resides among other clients. An MD, however, may still have a large impact on the performance depending on the metric of interest and the type of attack.

    To demonstrate the tradeoff between false alarm and misdetection, we have rerun experiments for CIFAR10 using $\tilde{\delta}=0.1$ and $p=0.05$ for $\Lambda\in[-1,1]$ and $n_m\in \lbrace 1,3,5 \rbrace$. As can be seen in the table, for $\Lambda = 1.0$, we achieve an attack accuracy of $3\\%$, $4.1\\%$, and $7.6\\%$ (rounded in the tables) for $n_{m}\in\lbrace 1,3,5\rbrace$, respectively. Furthermore, for small $n_m$, the attack accuracy does not vary significantly with $\Lambda$. The top-1 accuracy is mainly unaffected by $\Lambda$ as the label-flip attack does not aim to reduce the top-1 accuracy.


    Table for $n_m = 1$
    
    | $\Lambda$ | $P_{FA}$ | $P_{MD}$ | ACC | ATT |
    | --- | --- | --- | --- | --- |
    | -0.8 | 0.0 | 0.0 | 0.83 | 0.04 |
    | -0.6 | 0.0 | 0.0 | 0.83 | 0.04 |
    | -0.4 | 0.0 | 0.0 | 0.83 | 0.04 |
    | -0.2 | 0.0 | 0.0 | 0.83 | 0.04 |
    | -0.0 | 0.0 | 0.0 | 0.83 | 0.04 |
    | 0.2 | 0.0 | 0.0 | 0.83 | 0.04 |
    | 0.4 | 0.07 | 0.0 | 0.83 | 0.04 |
    | 0.6 | 0.07 | 0.0 | 0.83 | 0.04 |
    | 0.8 | 0.07 | 0.0 | 0.83 | 0.04 |
    | 1.0 | 0.14 | 0.0 | 0.83 | 0.03 |

    Table for $n_m = 3$
    
     | $\Lambda$ | $P_{FA}$ | $P_{MD}$ | ACC | ATT |
    | --- | --- | --- | --- | --- |
    | -0.8 | 0.0 | 1.0 | 0.83 | 0.12 |
    | -0.6 | 0.08 | 0.67 | 0.83 | 0.11 |
    | -0.4 | 0.08 | 0.67 | 0.83 | 0.11 |
    | -0.2 | 0.08 | 0.67 | 0.83 | 0.11 |
    | -0.0 | 0.08 | 0.67 | 0.83 | 0.11 |
    | 0.2 | 0.08 | 0.33 | 0.83 | 0.06 |
    | 0.4 | 0.08 | 0.33 | 0.83 | 0.06 |
    | 0.6 | 0.08 | 0.33 | 0.83 | 0.06 |
    | 0.8 | 0.17 | 0.33 | 0.82 | 0.07 |
    | 1.0 | 0.17 | 0.0 | 0.82 | 0.04 |

    Table for $n_m = 5$
    
    | $\Lambda$ | $P_{FA}$ | $P_{MD}$ | ACC | ATT |
    | --- | --- | --- | --- | --- |
    | -0.8 | 0.0 | 1.0 | 0.81 | 0.31 |
    | -0.6 | 0.1 | 0.8 | 0.82 | 0.22 |
    | -0.4 | 0.1 | 0.8 | 0.82 | 0.22 |
    | -0.2 | 0.1 | 0.8 | 0.82 | 0.22 |
    | -0.0 | 0.1 | 0.8 | 0.82 | 0.22 |
    | 0.2 | 0.1 | 0.6 | 0.81 | 0.21 |
    | 0.4 | 0.1 | 0.6 | 0.81 | 0.21 |
    | 0.6 | 0.1 | 0.6 | 0.81 | 0.21 |
    | 0.8 | 0.1 | 0.4 | 0.82 | 0.11 |
    | 1.0 | 0.1 | 0.2 | 0.82 | 0.08 |

    It is worthwhile mentioning that the results presented here are based on a single realization of malicious users. For $n_{\mathrm{m}}=5$, we have a single subgroup consisting of only benign users and are, therefore, able to achieve a low attack accuracy without hampering the top-1 accuracy. The results of tables 1-3 in Appendix A are based on the average performance over five realizations, one of which does not yield a subgroup with only benign clients. Consequently, our simple test will use a malicious group as reference and yield a large identification error. This is the main reason for the low top-1 accuracy in Table 2 compared to, e.g., RFA.

Reviewer comment (Presentation):
**Other - Method scope (data poisoning only):** Make explicit in **the main paper** that the current methodology works only for data poisoning and not model poisoning. (Essentially bring the "**Beyond data poisoning**" point from Appendix L to the main paper)

Author response:
- **Adversarial model**: The scenario under consideration is outlined in Section 3 where it is stated that the paper focuses solely on data-poisoning attacks. Although it would be useful to have a discussion pertaining to why we make this assumption in the main paper, due to space limitations we are forced to leave this to the appendix.

Reviewer comment (Evaluation):
The cost (particularly the communication) of group testing seems quite high, scale with the number of groups.

Author response:
We understand and are aware of the fact that secure aggregation comes with a high communication cost. In our work, we presented results where we do secure aggregation across many small groups of clients in a single communication round. 
   In Appendix B, we leverage state-of-the-art protocols to estimate and the communication overhead of our proposed framework. 
   For the experiments in the main body, we would like to emphasize that, compared to RFA, the communication overhead of FedGT is lower or similar in all rounds, including when group testing is performed.

Reviewer comment (Theory):
The privacy consideration seems not sufficient. I am wondering if the model difference between two testing groups could reveal individual's updates. For example, if group A includes C1, C2, C3, and group includes C2, C3, then the difference of the two aggregated models could reveal the model updates of C1.

Author response:
The reviewer raises a valid concern. However, this is completely captured by the concept of minimum distance of the dual code (the code having the assignment matrix as a generator matrix). For the particular case raised by the reviewer, the assignment matrix will look like this: 
   
   $$\\mathbf{A}_1 = \\begin{pmatrix}
       1 & 1 & 1 & 0 & \\dots &0 \\\\
       0 & 1 & 1 & 0 & \\dots &0 \\\\
       \vdots & \vdots & \vdots & \vdots & \vdots & \vdots
   \end{pmatrix}$$
   
   Then, the code defined by $\mathbf{A}_1$ as a generator matrix will have in its codebook (rowspan) the vector $(1,0,0, \dots, 0)$. In our application, this means that by linear combinations, the server can get the model C1. However, in our experiments, we use an assignment matrix that defines a code of minimum Hamming distance $4$, this ensures that any linear combination performed by the server will result in an aggregation of at least $4$ client models.
   Hence, for the codes proposed in the paper, privacy is preserved.

Reviewer comment (Experiments):
The article's limitation in considering scenarios with a fixed number of clients (15 and 31) raises concerns about the scalability and performance of FedGT as the number of clients increases. Further investigation is necessary to assess the method's effectiveness in larger-scale scenarios and address potential challenges related to the size of the assignment matrix.

Author response:
* **Scalability**: We thank the reviewer for pointing out this important aspect.
    We acknowledge that the experiments are targeting scenarios with a low number of clients. 
    This choice is inspired from practical instantiations of cross-silo FL which, so far, typically has involved client constellations of sizes around $10$, see e.g., [1]. 
    
    Regarding the scaling: the main bottleneck lies in the optimal decoding operation that has a complexity of $\mathcal{O}(2^m)$. Hence, as the number of test grows, i.e., the number of rows in the assignment matrix, the decoding operation eventually becomes infeasible.
    Hence, provided a reasonable number of tests, FedGT scales to an arbitrary number of clients. 
    Increasing the number of tests for a fixed number of clients will allow the server to obtain more fine-grained information about the clients at the expense of reduced privacy and a more complex decoding operation.

Reviewer comment (Experiments):
In a related work section, the authors mention that RFA performs less well than other robust federated aggregation schemes. So why not use these better performance schemes as comparison schemes for FedGT?

Author response:
* **Comparison with RFA**: The reason why we compare FedGT's performance to RFA is that RFA also aims at preserving the privacy of the clients' data. 
    Other robust aggregation schemes do not attempt to preserve privacy as they typically rely on the server having access to the clients' individual models, thus exposing the client to different forms of attack, e.g., data reconstruction attacks. 
    Hence, in an attempt to compare apples-to-apples, we settled for RFA.

    In the setting of an untargeted attack (Figure 3), our experiments have rendered RFA superior for lower prevalences and we agree that lower prevalences are more likely than higher one, especially for a cross-silo FL scenario. However, the performance of FedGT is competitive with RFA and it provides identification of malicious clients. 
    In the case of an unintentional poisoning attack, FedGT offers the possibility to notify the flagged client and have it fix the data issue whereafter it may join the federation, enabling improved performance.
    Robust aggregation schemes like RFA does not offer this possibility.

Reviewer comment (Evaluation):
In Figure 3, the top-1 accuracy of FedGT is inferior to RFA and Oracle when the number of attackers is small and only exceeds RFA when the number of malicious clients under the subgraph (c) of Figure 3 is 5, which challenges the validity of the method.

Author response:
* **Comparison with RFA**: The reason why we compare FedGT's performance to RFA is that RFA also aims at preserving the privacy of the clients' data. 
    Other robust aggregation schemes do not attempt to preserve privacy as they typically rely on the server having access to the clients' individual models, thus exposing the client to different forms of attack, e.g., data reconstruction attacks. 
    Hence, in an attempt to compare apples-to-apples, we settled for RFA.

    In the setting of an untargeted attack (Figure 3), our experiments have rendered RFA superior for lower prevalences and we agree that lower prevalences are more likely than higher one, especially for a cross-silo FL scenario. However, the performance of FedGT is competitive with RFA and it provides identification of malicious clients. 
    In the case of an unintentional poisoning attack, FedGT offers the possibility to notify the flagged client and have it fix the data issue whereafter it may join the federation, enabling improved performance.
    Robust aggregation schemes like RFA does not offer this possibility.

Reviewer comment (Experiments):
The authors should consider a larger number of attackers. Especially when the number of clients is 31, the number of attackers is too small to prove the effectiveness of FedGT to resist the collusion of multiple attackers.

Author response:
* **Number of attackers for the setting $n=31$**: For the experiments involving $n=31$ clients, we consider $n_m= 6$ malicious clients. 
    This corresponds to $20\%$ of the clients being malicious, a number that, to the authors, does not seem to be unreasonably small.
    The rationale of this experiment is to demonstrate that FedGT scales beyond the experiments provided in the main body that includes only $15$ clients. 
    Moreover, the malicious clients still "collude" as they attempt to deteriorate the learning in the same way. 
    However, compared to the main body, each client has less data and therefore less power to influence the global model.

Reviewer comment (Theory):
FedGT has more assumptions than a typical federated learning security aggregation algorithm. Prior knowledge includes the number of malicious clients and additional test sets, which weaken the contribution made in the paper.

Author response:
* **Knowledge of the number of malicious clients**: As mentioned in the paper, we share this view with the reviewer. 
    Feeding the prevalence $\frac{n_m}{n}$ to the decoder requires perfect knowledge of $n_m$, something that is typically not available at the server.
    However, we show in Appendix G that the decoder is robust to a mismatch in the prevalence, i.e., when an incorrect value $\tilde{\delta} \neq \delta$ is used instead. To strengthen this further, we performed simulations for a targeted attack on CIFAR-10 dataset, for $n_m \in \lbrace 1, 3, 5\rbrace$ where we only feed the decoder a mismatched value $\tilde{\delta} = 0.1$ and $p=0.05$. 
    Below, we present the results as the top-1 accuracy (ACC), attack accuracy (ATT), misdetection and false-alarm probabilities versus the decoding threshold $\Lambda$ for $n_m=1,2,3$, respectively. 

   $n_m = 1$
    | $\Lambda$ | $P_{FA}$ | $P_{MD}$ | ACC | ATT |
    | --- | --- | --- | --- | --- |
    | -0.8 | 0.0 | 0.0 | 0.83 | 0.04 |
    | -0.6 | 0.0 | 0.0 | 0.83 | 0.04 |
    | -0.4 | 0.0 | 0.0 | 0.83 | 0.04 |
    | -0.2 | 0.0 | 0.0 | 0.83 | 0.04 |
    | -0.0 | 0.0 | 0.0 | 0.83 | 0.04 |
    | 0.2 | 0.0 | 0.0 | 0.83 | 0.04 |
    | 0.4 | 0.07 | 0.0 | 0.83 | 0.04 |
    | 0.6 | 0.07 | 0.0 | 0.83 | 0.04 |
    | 0.8 | 0.07 | 0.0 | 0.83 | 0.04 |
    | 1.0 | 0.14 | 0.0 | 0.83 | 0.03 |

   $n_m = 3$
    | $\Lambda$ | $P_{FA}$ | $P_{MD}$ | ACC | ATT |
    | --- | --- | --- | --- | --- |
    | -0.8 | 0.0 | 1.0 | 0.83 | 0.12 |
    | -0.6 | 0.08 | 0.67 | 0.83 | 0.11 |
    | -0.4 | 0.08 | 0.67 | 0.83 | 0.11 |
    | -0.2 | 0.08 | 0.67 | 0.83 | 0.11 |
    | -0.0 | 0.08 | 0.67 | 0.83 | 0.11 |
    | 0.2 | 0.08 | 0.33 | 0.83 | 0.06 |
    | 0.4 | 0.08 | 0.33 | 0.83 | 0.06 |
    | 0.6 | 0.08 | 0.33 | 0.83 | 0.06 |
    | 0.8 | 0.17 | 0.33 | 0.82 | 0.07 |
    | 1.0 | 0.17 | 0.0 | 0.82 | 0.04 |

   $n_m = 5$:
    | $\Lambda$ | $P_{FA}$ | $P_{MD}$ | ACC | ATT |
    | --- | --- | --- | --- | --- |
    | -0.8 | 0.0 | 1.0 | 0.81 | 0.31 |
    | -0.6 | 0.1 | 0.8 | 0.82 | 0.22 |
    | -0.4 | 0.1 | 0.8 | 0.82 | 0.22 |
    | -0.2 | 0.1 | 0.8 | 0.82 | 0.22 |
    | -0.0 | 0.1 | 0.8 | 0.82 | 0.22 |
    | 0.2 | 0.1 | 0.6 | 0.81 | 0.21 |
    | 0.4 | 0.1 | 0.6 | 0.81 | 0.21 |
    | 0.6 | 0.1 | 0.6 | 0.81 | 0.21 |
    | 0.8 | 0.1 | 0.4 | 0.82 | 0.11 |
    | 1.0 | 0.1 | 0.2 | 0.82 | 0.08 |
    
    From these experiments, we observe that the attack accuracy and accuracy are robust even when the prevalence $\tilde{\delta}$ and crossover probability $p$ are mismatched.

Reviewer comment (Theory):
In Appendix E, the authors demonstrate that the privacy of the FedGT implementation is equivalent to that of the security aggregation scheme for r clients. However, it would be helpful to provide a more formal and detailed explanation of the specific definition of privacy.

Author response:
* **Privacy definition**: We agree with the reviewer that the privacy investigation could be deepened. 
    To the best of our knowledge, analyzing the privacy of secure aggregation is still an open problem and subject to active research. 
    It is known that privacy increases with the number of clients being aggregated [2] but to the authors knowledge, no work is able to formally quantify the privacy of secure aggregation. 
    All in all, the reviewer's suggestion constitutes an interesting research direction, but it is beyond the scope of this paper.

Reviewer comment (Theory):
The choice of decoding method will affect the performance of FedGT. What is the basis or reason for choosing the Neyman-Pearson scheme? Does Neyman-Pearson's hypothesis accurately describe the problem of reality?

Author response:
* **Neyman-Pearson decision criterion**: We thank the reviewer for the interesting question. We agree that the choice of decision criterion used is critical for the performance of FedGT. We describe briefly the main idea behind Neyman-Pearson decision criterion in Appendix~C and the rationale behind its usage. 
    The Neyman-Pearson decision criterion is optimal in the sense that it  minimizes one type of error (misdetection or false-alarm) subject to a constraint on the other type of error. 
    In machine learning applications, one typically targets a high true-positive rate and a low false-positive rate.
    The true-positive rate is often measured at a fixed false-positive rate that is deemed acceptable.
    Such a scenario directly translates into the Neyman-Pearson formulation.

Reviewer comment (Experiments):
In addition to the test set, FedGT uses an additional enhanced data set. However, the authors need to provide more clarity regarding the composition and role of this data set. Specifically, the authors should describe in more detail what the enhanced data set comprises and how it limits the application of FedGT.

Author response:
* **Validation dataset at the server**: We would like to emphasize that the validation dataset utilized in our instantiation of FedGT is purely due to the testing strategies that rely on the group accuracy and the group recall, respectively.
    The framework is valid for arbitrary testing strategies and others, not requiring a validation dataset, are possible.
    One such test could rely on clustering the principal components of the aggregated subgroup models.
    Furthermore, note that we assume a quasi-dataset for validation in the paper, i.e., a dataset distributed similarly---but not necessarily equal---to the clients' data.
    Also, in our tests, we use a very small validation set consisting of $100$ data points, which is significantly smaller than the client datasets.

Reviewer comment (Novelty):
As the core technical contribution is to shift the paradigm from testing individuals to testing groups, and no novel testing strategy is proposed, the reviewer feels that this paper fits better venues on security or coding, compared with ML venues.

Author response:
We believe that the challenges of FL pertaining to privacy and security are important also for the ML community. 
We also believe that combining expertise from different scientific communities can benefit the development of resilient and privacy preserving FL. 
Furthermore, we think it is a good idea to present our framework in an ML venue to demonstrate that it is possible to identify malicious nodes, not only mitigating their impact.
To the authors' knowledge, FedGT is the first method to achieve this and we believe it is an important cornerstone to provide privacy while securing FL from different attack techniques. In regards to novelty, we offer new insights into the privacy of sub-group testing by drawing on connections between coding theory and secure aggregation. 
Furthermore, our work is the first to demonstrate identification of malicious nodes in FL without inspecting individual client contributions.
We have chosen one of the simplest testing strategies possible to demonstrate the inherent potential of leveraging group testing with FL even in the presence of very naive tests.
We are currently working on extensions to more sophisticated tests.

Reviewer comment (Writing):
More background and context need to be provided about error correcting codes and the design of assignment matrix A. For example, why one needs to choose A with good distance properties and how to choose it. Readers who are not familiar with coding theory may find it difficult to understand.

Author response:
We understand that it might be confusing for a potential reader who is not familiar with coding theory and we tried our best in Section 5 to introduce the relevant concepts. 
However, due to the page limits, we had to skip some details. 
Please do understand that coding theory is a research area that has been studied for more than 70 years, making it very challenging to incorporate all but the necessary details in a few pages. 
Furthermore, references are provided to the interested reader. The process of finding good codes and their corresponding parity-check matrix (used as an assignment matrix in the context of group testing) typically involves choosing a class of well-known codes (like BCH code, Reed-Muller codes). Usually, for short-length codes (up to ~100 bits), algebraic codes (BCH, Reed-Muller) are considered and the properties of these codes are well-studied. 
We follow this process in our paper and use a BCH code (length 15) for the experiments in the main body and a cyclic code (length 31) in Appendix J. 
In the submission, we cite the following book [1], where well-known (algebraic) codes are tabulated, but there also other works that provide a comprehensive list of channel codes.

Reviewer comment (Theory):
Conventional linear block codes (defined by their generator matrices) are defined on finite fields, for which binary addition (or XOR) is used. However, in the context of group testing, the check node is evaluated using logical OR operation. It is not clear how conventional block codes can be directly used here as candidates for the assignment matrix.

Author response:
As the reviewer points out, conventional binary channel codes are designed over the binary finite field. However, coding theory does not necessarily need to be based on the binary finite field. In fact, there exist also codes defined over rings rather than fields. However, we need to clarify that is not our contribution to use channel codes for group testing. Existing works [2] have showed that well-known channel codes help in designing nice pooling strategies.

Reviewer comment (Evaluation):
In Figure 1(c), why FedGT outperforms oracle?

Author response:
Regarding the question of Figure 1(c), from the heterogeneous data among the clients, some clients, although benign, actually deteriorate the model by participating. Client 4, whose dataset consists mainly of examples labeled as class 2, see Fig. 13, constitutes such an example.  Our group testing framework, with the employed testing strategy, is tailored to reduce the attack accuracy in targeted attacks (and increase the balanced accuracy in untargeted attacks). Thus it may misclassify some clients that are deemed to deteriorate the global model. 
That is, from the group testing's point of view, client 4 seems to be compromised.
Constructing defensive mechanisms that are able to handle such severe imbalance in label distribution is a challenging and open research problem.