Paper: Exploit Gradient Skew to Circumvent Byzantine Defenses for Federated Learning (ICLR-2024)

Reviewer comment (Theory):
Since Proposition 1 is incorrect, so is Proposition 2 which relies upon the former. Even if the latter was correct, the stated result is rather superfluous as the $\rho^2$ (should depend on $t$ by the way) in the lower bound is shown to vanish across iterations by Farhadkhani et al. (2022).

Author response:
Thanks for the thoughtful comment. We have carefully looked through Farhadkhani et al. (2022) and cannot find the statement that $\rho^2$ would vanish across iterations. In fact, even in the simplest case where the local loss functions on clients are convex, $\rho^2$ won't vanish across iterations as long as local loss functions have different minimizers (due to data heterogeneity).

Reviewer comment (Experiments):
In the experiments, the defenses used are not the best when considering data heterogeneity. Only Bucketing (Karimireddy et al., 2021), among all considered defenses, was designed for this purpose. The work of Allouah et al. (2023) propose another defense called NNM and show that it improves upon Bucketing. At least this other defense should be tested to claim having a strong attack in non-iid settings.

Author response:
Thank you for the kind suggestion. We have supplemented the experiments and tested the proposed attack against NNM proposed by Allouah et al. (2023). The results are posted in Table 1 below. The results suggest that the proposed STRIKE attack still outperforms other baseline attacks against NNM.

**Table 1.** Accuracy under different attacks against different defenses on ImageNet-12. The best results are in bold. The lower, the better.

| Attack | Median | RFA | DnC |
|:-:|-:|-:|-:|
| NNM + BitFlip | 57.14 | 58.55 | 53.68 |
| NNM + LIE | 58.04 | 58.68 | 58.87 |
| NNM + Mimic | 66.15 | 67.43 | 69.35 |
| NNM + STRIKE | **39.61** | **40.38** | **38.91** |

(Due to limited time, we only run experiments on the top-3 robust AGRs in the main experiment and the strongest attacks against these robust AGRs. We will provide more results in our final revision.)

Reviewer comment (Novelty):
The related work section is inaccurate. The second paragraph in Section 2 wrongly mentions that Farhadkhani et al. (2022) studied Byzantine-robustness under data heterogeneity.

Author response:
Thanks for pointing out this typo. We've corrected it as follows.

>  El-Mhamdi et al. (2021); ~Farhadkhani et al. (2022);~ Karimireddy et al. (2022) provide state-of-the-art theoretical analysis of Byzantine resilience under data heterogeneity.

Please refer to Section 2 for details.

Reviewer comment (Writing):
The term "skew" is repeatedly used without a proper definition, although a formal definition is given in page 4 without intuition on what skewness means. It seems throughout the paper that it can be replaced by gradient heterogeneity/dissimilarity. In that case, the insights given are very similar to those of Karimireddy et al., (2021), Allouah et al. (2023), etc.. In fact, skewness is a confusing term; it is widely used when referring to probability distributions, but that definition is quite different from what paper suggests. But again, a proper definition would have cleared this issue.

Author response:
The term "skew" is formally defined in Definition 2. The intuition is already provided in 4-th paragraph, Section 1 in the original paper together with an intuitive visualization. The sentence is "the majority of honest gradients skew away from the optimal gradient". In this case, the skew is totally different from the gradient heterogeneity/dissimilarity defined in the previous paper. "Skewness" is formally defined in Definition 2, and is totally different from one defined in probability theory.

Reviewer comment (Theory):
The last sentence in Section 4.2 is clearly incorrect: convexity is an additional assumption, which makes the analysis "easier" than that of non-convex functions.

Author response:
We thank the reviewer for pointing out this typo. The corrected version of this sentence is as follows.

> Note that we do not require the loss function to be \textcolor{blue}{convex}, which implies that Proposition 2 also applies to more challenging \textcolor{blue}{non-convex} loss functions.

Please refer to Section 4.2 in revision for the corrected version.

Reviewer comment (Experiments):
Parameter $\nu$ seems quite redundant with $\alpha$, especially since the experiments on the role of $\nu$ suggest that setting $\nu=1$ is good enough, without giving a guidance or whatsoever on how to choose it.

Author response:
Thank you for the thoughtful comment.

While STRIKE with $\nu=1$ can outperform most SOTA attacks, an appropriate $\nu$ can further improve the effectiveness of STRIKE against some particular defenses significantly, e.g., the accuracy of STRIKE ($\nu=2.0$) is 5% lower than the accuracy of STRIKE ($\nu=1.0$) as shown in Figure 6, Appendix D.2.1. Thus, we leave open to future researchers the possibility to carefully choose $\nu$ value to boost the performance of STRIKE.

We have included the above discussion in our revision to clarify the necessity of hyperparameter $\nu$.

Reviewer comment (Evaluation):
Lack of discussion on any potential adaptive defense methods against this attack.

Author response:
**W2:** Lack of discussion on any potential adaptive defense methods against this attack.

**A2:** We are grateful for your kind suggestion.

In Section 4.2, we have discussed existing defenses such as Multi-Krum, RBTM and any other robust AGRs that satisfies Definition 1, against this attack and they cannot defend against our STRIKE attack as shown in Proposition 1 and 2. 

The STRIKE relies on the gradient skew phenomenon, which is closely related to non-IIDness of data distribution. Therefore, defenses that can alleviate non-IID can potentially mitigate our STRIKE attack.

We have added the above discussion to the revision. Please refer to Section 7.

Reviewer comment (Experiments):
Although non-IID is common in FL, the reviewer is curious about what is the performance of the proposed attack when there is no skew?

Author response:
**Q1:** The performance of the proposed attack when there is no skew

**A1:** We acknowledge your concerns regarding the performance of the proposed STRIKE when there is no gradient skew.

We have supplemented new experiments about the performance of STRIKE in the IID setting.
The results are posted in Table 2 below.
The results in Table 2 show that when there is no gradient skew (IID), our STRIKE attack is still competitive compared with other SOTA attacks (average rank 3.71).

**Table 2.** The performance of the proposed attack in the IID setting on ImageNet-12. The lower, the better.

| Attack | Multi-Krum | Median | RFA | Aksel | CClip | DnC | RBTM |
|:-:|-:|-:|-:|-:|-:|-:|-:|
| BitFlip | 68.33 | 64.13 | 67.28 | 63.88 | 11.67 | 65.54 | 63.04 |
| LIE | 72.53 | 58.56 | 68.78 | 64.87 | 20.19 | 66.99 | 56.38 |
| IPM | 71.35 | 61.96 | 68.01 | 69.07 | 12.02 | 69.01 | 68.43 |
| MinMax | 60.99 | 60.93 | 67.79 | 63.81 | 21.09 | 63.78 | 59.04 |
| MinSum | 65.00 | 61.83 | 68.11 | 65.93 | 18.46 | 67.72 | 55.99 |
| Mimic | 63.91 | 73.69 | 61.35 | 66.09 | 14.74 | 64.71 | 72.15 |
| STRIKE | 57.76 | 66.63 | 62.82 | 64.39 | 16.79 | 68.08 | 59.84 |
| Rank of STRIKE | 1 | 6 | 2 | 3 | 4 | 6 | 4 |

Reviewer comment (Theory):
The authors provide a lower bound for $\mathbb{E}||w^t-w^*||^2$ in Proposition 2 for SGD with robust aggregation (without momentum). However, existing works (Karimireddy et al., 2021) have shown that using history information such as momentum can enhance Byzantine robustness. So, what will the lower bound for robust SGD with momentum be? Moreover, although the authors claim that the gradient skew is due to non-IID data, Assumption 2 makes the theoretical analysis restricted to the IID settings, which is confusing. Although I understand that the lower bound for IID settings also holds for more general non-IID settings, the IID assumption (i.e., Assumption 2) prevents obtaining a tighter bound for non-IID settings.

Author response:
**W1.1:** The proposed STRIKE against robust SGD with momentum in (Karimireddy et al., 2021).

**A1.1:** Thank you for your insightful comment. We've tested the performance of the proposed STRIKE attack against CClip proposed by (Karimireddy et al., 2021) in Section 6. The empirical results suggest that our attack is still effective for robust SGD with momentum.

---

**W1.2:** Assumption 2 is confusing.

**A1.2:** Sorry that the typo confused the reviewer. Assumption 2 does not require to be IID. The corrected version of Assumption 2 is as follows.

> **Assumption 2** (Unbias)**.** The stochastic gradients sampled from any local data distribution are unbiased estimators of local gradients for all clients, i.e.,
> $$
\mathbb{E}[\boldsymbol{g}\_i^t]=\nabla\mathcal{L}\_{\textcolor{blue}{i}}(\boldsymbol{w}^t), \quad\forall i=1,\ldots n, t=0,\ldots,T-1.
$$

Please refer to Assumption 2 in the revision for more details.

Reviewer comment (Evaluation):
Since the adversary clients with STRIKE attacks require more computation cost than benign clients, the authors are suggested to provide theoretical or empirical results of how much extra computation cost will the proposed STRIKE attack take.

Author response:
**W2:**  Theoretical or empirical results of computation cost of the proposed STRIKE attack.

**A2:** We thank the reviewer for the thoughtful comment.

Theoretically, the final optimization problem of the proposed STRIKE attack in Eq. (19) can be effectively solved by a bisection algorithm as discussed in Appendix C. The computation cost is $\mathcal{O}(-\log\epsilon)$, where $\epsilon$ is the error of $\alpha$. In experiments, we perform bisection only 8 times and make the error of $\alpha$ within $1%$. Empirically, the attack time for STRIKE is 12.11s (13.47s for MinMax, 13.35s for MinSum) on ImageNet-12.

In contrast, benign clients perform local updates to compute local gradients. The computation cost depends on the local data size, model architecture, batch size, number of local epochs, etc. In our setting, the average local update time is 15.14s on CIFAR-10, 11.76s on ImageNet-12 and 27.13s on FEMNIST. Tests are performed on a single A100 GPU.

We've included the above content in our discussion. Please kindly find it in Appendix C.

Reviewer comment (Reproducibility):
While the proposed STRIKE is effective, there is a lack of discussion on the efficiency of the attack. Solving eq. (19) seems to be expensive. Could you please discuss more about the computation cost of the STRIKE attack?

Author response:
We thank the reviewer for the thoughtful comment.

Theoretically, the final optimization problem of the proposed STRIKE attack in Eq. (19) can be effectively solved by a bisection algorithm as discussed in Appendix C. The computation cost is $\mathcal{O}(-\log\epsilon)$, where $\epsilon$ is the error of $\alpha$. In experiments, we perform bisection only 8 times and make the error of $\alpha$ within $1%$. Empirically, the attack time for STRIKE is 12.11s (13.47s for MinMax, 13.35s for MinSum) on ImageNet-12.

We've included the above content in our discussion. Please kindly find it in Appendix C.

Reviewer comment (Evaluation):
Is there any limitation of the proposed STRIKE? Please elaborate more on it.

Author response:
Thanks for the valuable comment.

A limitation is that the effectiveness of STRIKE attack relies on the existence of gradient skew.
For example, when the data is IID, the performance could be limited.

We have also supplemented new experiments about the performance of STRIKE in the IID setting.
The results are posted in Table 1 below.
The results in Table 1 show that when there is no gradient skew (IID), our STRIKE attack is still competitive compared with other SOTA attacks (average rank 3.71).

**Table 1.** The performance of the proposed attack in the IID setting on ImageNet-12. The lower, the better.

| Attack | Multi-Krum | Median | RFA | Aksel | CClip | DnC | RBTM |
|:-:|-:|-:|-:|-:|-:|-:|-:|
| BitFlip | 68.33 | 64.13 | 67.28 | 63.88 | 11.67 | 65.54 | 63.04 |
| LIE | 72.53 | 58.56 | 68.78 | 64.87 | 20.19 | 66.99 | 56.38 |
| IPM | 71.35 | 61.96 | 68.01 | 69.07 | 12.02 | 69.01 | 68.43 |
| MinMax | 60.99 | 60.93 | 67.79 | 63.81 | 21.09 | 63.78 | 59.04 |
| MinSum | 65.00 | 61.83 | 68.11 | 65.93 | 18.46 | 67.72 | 55.99 |
| Mimic | 63.91 | 73.69 | 61.35 | 66.09 | 14.74 | 64.71 | 72.15 |
| STRIKE | 57.76 | 66.63 | 62.82 | 64.39 | 16.79 | 68.08 | 59.84 |
| Rank of STRIKE | 1 | 6 | 2 | 3 | 4 | 6 | 4 |

We have included the above discussion of limitations in the revision. Please kindly find it in Section 7.