Original: F 2 ED -L EARNING : G OOD FENCES MAKE GOOD NEIGHBORS
Revised: F 2 ED -L EARNING : G OOD FENCES MAKE GOOD NEIGHBORS

Original: Anonymous authors
Revised: Anonymous authors

Original: Paper under double-blind review
Revised: Paper under double-blind review

Original: A BSTRACT
Revised: A BSTRACT

Original: In this paper, we present F 2 ED -L EARNING , the ﬁrst federated learning protocol simultaneously defending against both a semi-honest server and Byzantine malicious clients.
Revised: In this paper, we present F 2 ED -L EARNING , the ﬁrst federated learning protocol simultaneously defending against both a semi-honest server and Byzantine malicious clients.

Original: Using a robust mean estimator called FilterL2, F 2 ED -L EARNING is the ﬁrst FL protocol providing dimension-free estimation error against Byzantine malicious clients.
Revised: Using a robust mean estimator called FilterL2, F 2 ED -L EARNING is the ﬁrst FL protocol providing dimension-free estimation error against Byzantine malicious clients.

Original: Besides, F 2 ED -L EARNING leverages secure aggregation to protect the clients from a semi-honest server who wants to infer the clients’ information from the legitimate updates.
Revised: Besides, F 2 ED -L EARNING leverages secure aggregation to protect the clients from a semi-honest server who wants to infer the clients’ information from the legitimate updates.

Original: The main challenge stems from the incompatibility between FilterL2 and secure aggregation.
Revised: The main challenge stems from the incompatibility between FilterL2 and secure aggregation.

Original: Speciﬁcally, to run FilterL2, the server needs to access individual updates from clients while secure aggregation hides those updates from it.
Revised: Speciﬁcally, to run FilterL2, the server needs to access individual updates from clients while secure aggregation hides those updates from it.

Original: We propose to split the clients into shards, securely aggregate each shard’s updates and run FilterL2 on the updates from different shards.
Revised: We propose to split the clients into shards, securely aggregate each shard’s updates and run FilterL2 on the updates from different shards.

Original: The evaluation shows that F 2 ED -L EARNING consistently achieves optimal or close-to-optimal performance under three attacks among ﬁve robust FL protocols.
Revised: The evaluation shows that F 2 ED -L EARNING consistently achieves optimal or close-to-optimal performance under three attacks among ﬁve robust FL protocols.

Original:  I NTRODUCTION
Revised:  I NTRODUCTION

Original: Federated learning (FL) has drawn numerous attention in the past few years as a new distributed learning paradigm.
Revised: Federated learning (FL) has drawn numerous attention in the past few years as a new distributed learning paradigm.

Original: In federated learning, the users collaboratively train a model with the help of a centralized server when all the data is held locally to preserve the users’ privacy.
Revised: In federated learning, the users collaboratively train a model with the help of a centralized server when all the data is held locally to preserve the users’ privacy.

Original: The privacy guarantee can be further enhanced using secure aggregation technique (Bonawitz et al., 2017) which hides the individual local updates and only reveals the aggregated global update.
Revised: The privacy guarantee can be further enhanced using secure aggregation technique (Bonawitz et al., 2017) which hides the individual local updates and only reveals the aggregated global update.

Original: The graceful balance between utility and privacy popularizes federated learning in a variety of sensitive applications such as Google GBoard, healthcare service and self-driving cars.
Revised: The graceful balance between utility and privacy popularizes federated learning in a variety of sensitive applications such as Google GBoard, healthcare service and self-driving cars.

Original: The above threat model assumes that all the users honestly upload their local updates.
Revised: The above threat model assumes that all the users honestly upload their local updates.

Original: However, it is likely that a small number of clients are malicious in a large-scale FL system with tens of thousands of clients.
Revised: However, it is likely that a small number of clients are malicious in a large-scale FL system with tens of thousands of clients.

Original: Besides, in most SGD-based FL algorithms used today (McMahan & Ramage, 2017), the centralized server averages the local updates to obtain the global update, which is vulnerable to even only one malicious client.
Revised: Besides, in most SGD-based FL algorithms used today (McMahan & Ramage, 2017), the centralized server averages the local updates to obtain the global update, which is vulnerable to even only one malicious client.

Original: Therefore, a malicious client can arbitrarily craft its update to either prevent the global model from converging or lead it to a sub-optimal minimum.
Revised: Therefore, a malicious client can arbitrarily craft its update to either prevent the global model from converging or lead it to a sub-optimal minimum.

Original: This kind of attack in federated learning is well-studied by Bhagoji et al.
Revised: This kind of attack in federated learning is well-studied by Bhagoji et al.

Original: ; Fang et al.
Revised: ; Fang et al.

Original: Bagdasaryan et al.
Revised: Bagdasaryan et al.

Original: (2020); Sun et al.
Revised: (2020); Sun et al.

Original: To mitigate these attacks, various Byzantine-robust FL protocols (Blanchard et al., 2017; Yin et al., 2018; Fu et al., 2019; Pillutla et al., 2019) are proposed to reduce the impact of the contaminated updates.
Revised: To mitigate these attacks, various Byzantine-robust FL protocols (Blanchard et al., 2017; Yin et al., 2018; Fu et al., 2019; Pillutla et al., 2019) are proposed to reduce the impact of the contaminated updates.

Original: These protocols replace trivial averaging with well-designed Byzantine-robust mean estimators.
Revised: These protocols replace trivial averaging with well-designed Byzantine-robust mean estimators.

Original: These estimators suppress the inﬂuence of the malicious updates and output a mean estimation as accurate as possible.
Revised: These estimators suppress the inﬂuence of the malicious updates and output a mean estimation as accurate as possible.

Original: Nevertheless, almost all of these aggregators suffer from the curse of dimensionality.
Revised: Nevertheless, almost all of these aggregators suffer from the curse of dimensionality.

Original: Speciﬁcally, the estimation error scales up with the size of the model in a squareroot fashion.
Revised: Speciﬁcally, the estimation error scales up with the size of the model in a squareroot fashion.

Original: As a concrete example, a three-layer MLP on MNIST contains more than 50, parameters and leads to a 223-fold increase of the estimation error, which is prohibitive in practice.
Revised: As a concrete example, a three-layer MLP on MNIST contains more than 50, parameters and leads to a 223-fold increase of the estimation error, which is prohibitive in practice.

Original: Draco (Chen et al., 2018), BULYAN (Mhamdi et al., 2018) and ByzatineSGD (Alistarh et al., 2018) are the only three works that state to yield dimension-free estimation error.
Revised: Draco (Chen et al., 2018), BULYAN (Mhamdi et al., 2018) and ByzatineSGD (Alistarh et al., 2018) are the only three works that state to yield dimension-free estimation error.

Original: However, Draco is designed for distributed learning and is incompatible with federated learning because it requires redundant updates from each worker.
Revised: However, Draco is designed for distributed learning and is incompatible with federated learning because it requires redundant updates from each worker.

Original: On the other hand, although Bulyan (Mhamdi et al., 2018) and ByzantineSGD (Alistarh et al., 2018) provide dimension-free estimation error, it is based on much stronger assumptions than other works.
Revised: On the other hand, although Bulyan (Mhamdi et al., 2018) and ByzantineSGD (Alistarh et al., 2018) provide dimension-free estimation error, it is based on much stronger assumptions than other works.

Original: When the assumptions are relaxed to the common case, Bulyan’s estimation error still scales up with the square root of the model size as discussed in
Revised: When the assumptions are relaxed to the common case, Bulyan’s estimation error still scales up with the square root of the model size as discussed in

Original: Section 2.
Revised: Section 2.

Original: In addition, these robust FL protocols have incompatible implementation with secure aggregation techniques.
Revised: In addition, these robust FL protocols have incompatible implementation with secure aggregation techniques.

Original: The robust estimators have to access local updates while secure aggregation hides them from the server.
Revised: The robust estimators have to access local updates while secure aggregation hides them from the server.

Original: Consequently, the system cannot simultaneously protect the server and the clients, but has to place complete trust in either of them.
Revised: Consequently, the system cannot simultaneously protect the server and the clients, but has to place complete trust in either of them.

Original: The lack of two-way protection severely harms the people’s conﬁdence in the FL system and prevents federated learning from being used in many sensitive applications such as home monitoring and self-driving cars.
Revised: The lack of two-way protection severely harms the people’s conﬁdence in the FL system and prevents federated learning from being used in many sensitive applications such as home monitoring and self-driving cars.

Original: Contribution.
Revised: Contribution.

Original: In this paper, we propose F ED ERATED L EARNING WITH F ENCE , abbreviately
Revised: In this paper, we propose F ED ERATED L EARNING WITH F ENCE , abbreviately

Original: F 2 ED -L EARNING .
Revised: F 2 ED -L EARNING .

Original: F 2 ED -L EARNING integrates a robust mean estimator with dimension-free error (Steinhardt, 2018) and secure aggregation (Bonawitz et al., 2017) to defend against both the
Revised: F 2 ED -L EARNING integrates a robust mean estimator with dimension-free error (Steinhardt, 2018) and secure aggregation (Bonawitz et al., 2017) to defend against both the

Original: Byzantine malicious clients and the semi-honest server.
Revised: Byzantine malicious clients and the semi-honest server.

Original: In particular, F 2 ED -L EARNING is the ﬁrst
Revised: In particular, F 2 ED -L EARNING is the ﬁrst

Original: Byzantine-robust FL system with dimension-free estimation error.
Revised: Byzantine-robust FL system with dimension-free estimation error.

Original: To address the incompatibility, the clients are split into multiple shards, the local updates from the same shard are securely aggregated at the centralized server, and the robust estimator is run on the aggregated local updates from different shards.
Revised: To address the incompatibility, the clients are split into multiple shards, the local updates from the same shard are securely aggregated at the centralized server, and the robust estimator is run on the aggregated local updates from different shards.

Original: Surprisingly, sharding also consolidates the independently and identically distributed (IID) assumption required by the robust estimator even under heterogeneous data distribution.
Revised: Surprisingly, sharding also consolidates the independently and identically distributed (IID) assumption required by the robust estimator even under heterogeneous data distribution.

Original: According to Lindeberg central limitation theorem (Lindeberg, 1922), despite the heterogeneity of the individual local updates, the aggregated local updates from the shards will approximately follow an IID Gaussian distribution.
Revised: According to Lindeberg central limitation theorem (Lindeberg, 1922), despite the heterogeneity of the individual local updates, the aggregated local updates from the shards will approximately follow an IID Gaussian distribution.

Original:  L OOPHOLE IN B ULYAN AND B YZANTINE SGD & R ELATED W ORK
Revised:  L OOPHOLE IN B ULYAN AND B YZANTINE SGD & R ELATED W ORK

Original: Byzantine-robust aggregation has drawn enormous attention in the past few years due to the emergence of various distributed attacks in federated learning.
Revised: Byzantine-robust aggregation has drawn enormous attention in the past few years due to the emergence of various distributed attacks in federated learning.

Original: Fang et al.
Revised: Fang et al.

Original: (2019) formalize the attack as an optimization problem and successfully migrate the data poisoning attack to federated learning.
Revised: (2019) formalize the attack as an optimization problem and successfully migrate the data poisoning attack to federated learning.

Original: The proposed attacks even work under Byzantine-robust federated learning.
Revised: The proposed attacks even work under Byzantine-robust federated learning.

Original: Sun et al.
Revised: Sun et al.

Original: (2020) manage to launch data poisoning attack on the multi-task federated learning framework.
Revised: (2020) manage to launch data poisoning attack on the multi-task federated learning framework.

Original: Bhagoji et al.
Revised: Bhagoji et al.

Original: (2019) and Bagdasaryan et al.
Revised: (2019) and Bagdasaryan et al.

Original: (2020) even manage to insert backdoor functionalities into the model via local model poisoning or local model replacement.
Revised: (2020) even manage to insert backdoor functionalities into the model via local model poisoning or local model replacement.

Original: A variety of Byzantine-robust FL protocols are proposed to defend against these attacks.
Revised: A variety of Byzantine-robust FL protocols are proposed to defend against these attacks.

Original: Krum (Blanchard et al., 2017) picks the subset of updates with enough close neighbors and averages the subset.
Revised: Krum (Blanchard et al., 2017) picks the subset of updates with enough close neighbors and averages the subset.

Original: Yin et al.
Revised: Yin et al.

Original: (2018) leverage traditional robust estimators like trimmed mean or median to achieve order-optimal statistical error rate under strongly convex assumptions.
Revised: (2018) leverage traditional robust estimators like trimmed mean or median to achieve order-optimal statistical error rate under strongly convex assumptions.

Original: Yin et al.
Revised: Yin et al.

Original: (2019) propose to use robust mean estimators to defend against saddle point attack.
Revised: (2019) propose to use robust mean estimators to defend against saddle point attack.

Original: Mhamdi et al.
Revised: Mhamdi et al.

Original: (2018) pointed out that Krum, trimmed mean and median all suffers from O ( √ d ) ( d is the model size) estimation error and proposed a general framework Bulyan to reduce the error to O (1) .
Revised: (2018) pointed out that Krum, trimmed mean and median all suffers from O ( √ d ) ( d is the model size) estimation error and proposed a general framework Bulyan to reduce the error to O (1) .

Original: However, we point out that the improvement of Bulyan actually comes from its stronger assumption.
Revised: However, we point out that the improvement of Bulyan actually comes from its stronger assumption.

Original: In particular, Bulyan assumes that expectation of the distance between two benign updates is bounded by a constant σ 1 , while Krum assumes that the distance is bounded by σ 2 √ d .
Revised: In particular, Bulyan assumes that expectation of the distance between two benign updates is bounded by a constant σ 1 , while Krum assumes that the distance is bounded by σ 2 √ d .

Original: We can easily see that if σ 1 = σ 2 √ d , Bulyan falls back to the same order of estimation error as Krum.
Revised: We can easily see that if σ 1 = σ 2 √ d , Bulyan falls back to the same order of estimation error as Krum.

Original: The same loophole exists in the analysis of ByzantineSGD (Alistarh et al., 2018).
Revised: The same loophole exists in the analysis of ByzantineSGD (Alistarh et al., 2018).

Original: Consequently, there is no known federated learning protocol with dimension-free estimation error against Byzantine adversaries.
Revised: Consequently, there is no known federated learning protocol with dimension-free estimation error against Byzantine adversaries.

Original:  P ROBLEM S ETUP
Revised:  P ROBLEM S ETUP

Original: In this section, we review the general pipeline of federated learning, introduce the threat model, and establish the notation system.
Revised: In this section, we review the general pipeline of federated learning, introduce the threat model, and establish the notation system.

Original: We use bold lower-case letters ( e.g. a , b , c ) to denote vectors, and bold upper-case letters ( e.g. A , B , C ) for matrices.
Revised: We use bold lower-case letters ( e.g. a , b , c ) to denote vectors, and bold upper-case letters ( e.g. A , B , C ) for matrices.

Original: We denote 1 · · · n with [ n ] .
Revised: We denote 1 · · · n with [ n ] .

Original: Federated Learning Pipeline.
Revised: Federated Learning Pipeline.

Original: In a federated learning system, there are one server S and n clients
Revised: In a federated learning system, there are one server S and n clients

Original: C i , i ∈ [ n ] .
Revised: C i , i ∈ [ n ] .

Original: Each client holds data samples drawn from some unknown distribution D .
Revised: Each client holds data samples drawn from some unknown distribution D .

Original: Let (cid:96) ( w ; z ) be the loss function on the model parameter w ∈ R d and a data sample z .
Revised: Let (cid:96) ( w ; z ) be the loss function on the model parameter w ∈ R d and a data sample z .

Original: Let L ( w ) =
Revised: Let L ( w ) =

Original: E z
Revised: E z

Original: ∼D
Revised: ∼D

Original: [ (cid:96) ( w ; z )] be the population loss function.
Revised: [ (cid:96) ( w ; z )] be the population loss function.

Original: Our goal is to learn the model w such that the population loss function is minimized:
Revised: Our goal is to learn the model w such that the population loss function is minimized:

Original: [Equation]
Revised: [Equation]

Original: To learn w ∗ , the whole system runs a T -round federated learning protocol.
Revised: To learn w ∗ , the whole system runs a T -round federated learning protocol.

Original: Initially, the server stores a global model w 0 .
Revised: Initially, the server stores a global model w 0 .

Original: In the t th round, S broadcasts the global model w t − 1 to the m clients.
Revised: In the t th round, S broadcasts the global model w t − 1 to the m clients.

Original: The clients then run the local optimizers ( e.g. SGD, Adam, and RMSprop), compute the difference
Revised: The clients then run the local optimizers ( e.g. SGD, Adam, and RMSprop), compute the difference

Original: g ( i ) t between the optimized model and the global model, and upload the difference to S .
Revised: g ( i ) t between the optimized model and the global model, and upload the difference to S .

Original: In the t th round, S takes the average of the differences and update the global model w t = w t − 1 + 1 n (cid:80) ni
Revised: In the t th round, S takes the average of the differences and update the global model w t = w t − 1 + 1 n (cid:80) ni

Original: =1 g ( i ) t .
Revised: =1 g ( i ) t .

Original: Threat Model & Defence Goal.
Revised: Threat Model & Defence Goal.

Original: We assume that the centralized server S is semi-honest.
Revised: We assume that the centralized server S is semi-honest.

Original: The server can launch whatever attacks such as inference attack using legitimate updates from the clients as the only inputs.
Revised: The server can launch whatever attacks such as inference attack using legitimate updates from the clients as the only inputs.

Original: However, the server cannot deviate from the protocol for the sake of regulation or reputation pressure.
Revised: However, the server cannot deviate from the protocol for the sake of regulation or reputation pressure.

Original: Speciﬁcally, we want to emphasize there is no collusion between the server and the clients.
Revised: Speciﬁcally, we want to emphasize there is no collusion between the server and the clients.

Original: On the other hand, we assume that the clients are (cid:15) -Byzantine malicious, which means at most (cid:15)m clients can be malicious.
Revised: On the other hand, we assume that the clients are (cid:15) -Byzantine malicious, which means at most (cid:15)m clients can be malicious.

Original: Malicious clients can arbitrarily deviate from the protocol and tamper with their own updates without being detected.
Revised: Malicious clients can arbitrarily deviate from the protocol and tamper with their own updates without being detected.

Original: In this paper, we aim to achieve a dimension-free error for the mean estimation in each round.
Revised: In this paper, we aim to achieve a dimension-free error for the mean estimation in each round.

Original: Let µ be the true mean of the benign distribution and the output of a protocol with contaminated inputs be ˆ µ .
Revised: Let µ be the true mean of the benign distribution and the output of a protocol with contaminated inputs be ˆ µ .

Original: The estimation error is deﬁned by the (cid:96) 2 distance between the true mean and the estimation (cid:107) ˆ µ − µ (cid:107) 2 .
Revised: The estimation error is deﬁned by the (cid:96) 2 distance between the true mean and the estimation (cid:107) ˆ µ − µ (cid:107) 2 .

Original:  F 2 ED -L EARNING : R OBUST P RIVACY -P RESERVING D ISTRIBUTED FL
Revised:  F 2 ED -L EARNING : R OBUST P RIVACY -P RESERVING D ISTRIBUTED FL

Original: In this section, we formally present our main protocol: F 2 ED -L EARNING .
Revised: In this section, we formally present our main protocol: F 2 ED -L EARNING .

Original: We ﬁrst introduce F 2 EDL EARNING step by step and formally establish the robustness and security guarantees.
Revised: We ﬁrst introduce F 2 EDL EARNING step by step and formally establish the robustness and security guarantees.

Original: Then we discuss the effect of sharding on the IID distribution assumption.
Revised: Then we discuss the effect of sharding on the IID distribution assumption.

Original: 4. F
Revised: 4. F

Original: [Equation]
Revised: [Equation]

Original: ED
Revised: ED

Original: [Equation]
Revised: [Equation]

Original: EARNING : B YZANTINE -R OBUST P RIVACY -P RESERVING F EDERATED L EARNING
Revised: EARNING : B YZANTINE -R OBUST P RIVACY -P RESERVING F EDERATED L EARNING

Original: The complete F 2 ED -L EARNING protocol is presented in Algorithm 1.
Revised: The complete F 2 ED -L EARNING protocol is presented in Algorithm 1.

Original: F 2 ED -L EARNING iteratively executes the following steps: (1) the server broadcasts the global model to the clients; (2) clients train the global model with their local data; (3) clients in the same shard run secure aggregation protocol to upload mean of their updates server
Revised: F 2 ED -L EARNING iteratively executes the following steps: (1) the server broadcasts the global model to the clients; (2) clients train the global model with their local data; (3) clients in the same shard run secure aggregation protocol to upload mean of their updates server

Original: We highlight newly
Revised: We highlight newly

Original: Sharded Secure Aggregation (line 8-10, 12, 16).
Revised: Sharded Secure Aggregation (line 8-10, 12, 16).

Original: Secure aggregation is developed by Bonawitz et al.
Revised: Secure aggregation is developed by Bonawitz et al.

Original: (2017) to defend against the honest but curious server in federated learning.
Revised: (2017) to defend against the honest but curious server in federated learning.

Original: Secure aggregation allows the server to obtain the sum of the clients’ updates but hides the individual updates cryptographically.
Revised: Secure aggregation allows the server to obtain the sum of the clients’ updates but hides the individual updates cryptographically.

Original: We introduce an oversimpliﬁed version of secure aggregation as follows for the ease of clariﬁcation.
Revised: We introduce an oversimpliﬁed version of secure aggregation as follows for the ease of clariﬁcation.

Original: As the ﬁrst step, each client samples random values for the other clients and send the values to the corresponding clients (line 8-10).
Revised: As the ﬁrst step, each client samples random values for the other clients and send the values to the corresponding clients (line 8-10).

Original: After receiving all the values from other clients, each client sums up the received values and subtracts the values generated by itself to produce a random mask (line 12).
Revised: After receiving all the values from other clients, each client sums up the received values and subtracts the values generated by itself to produce a random mask (line 12).

Original: Each client blinds its local update with the random mask and sends the blinded update to the server (line 13).
Revised: Each client blinds its local update with the random mask and sends the blinded update to the server (line 13).

Original: The server then sums up all the blinded updates and obtains the summed update in plaintext (line 15).
Revised: The server then sums up all the blinded updates and obtains the summed update in plaintext (line 15).

Original: Obviously, all the masks cancel out during aggregation and the server receives the plaintext sum.
Revised: Obviously, all the masks cancel out during aggregation and the server receives the plaintext sum.

Original: Secure aggregation provides strong privacy guarantee for the clients that the server cannot see anything but the aggregated global update and each client is hidden in thousands of other clients.
Revised: Secure aggregation provides strong privacy guarantee for the clients that the server cannot see anything but the aggregated global update and each client is hidden in thousands of other clients.

Original: However, in our threat model, vanilla secure aggregation is insufﬁcient since it provides no protection for the server.
Revised: However, in our threat model, vanilla secure aggregation is insufﬁcient since it provides no protection for the server.

Original: As the individual updates are completely hidden, there is no way that the server can identify the malicious clients even after detecting the attack.
Revised: As the individual updates are completely hidden, there is no way that the server can identify the malicious clients even after detecting the attack.

Original: To address the issue, we propose to split the clients into multiple shards and run secure aggregation within each shard.
Revised: To address the issue, we propose to split the clients into multiple shards and run secure aggregation within each shard.

Original: The size of the shards provides a trade-off between the protection for the server or the clients.
Revised: The size of the shards provides a trade-off between the protection for the server or the clients.

Original: The smaller the size is, the more information is revealed to the server, thus the easier to defend against Byzantine malicious clients and the harder to ﬁght off the semi-honest server.
Revised: The smaller the size is, the more information is revealed to the server, thus the easier to defend against Byzantine malicious clients and the harder to ﬁght off the semi-honest server.

Original: The trade-off is discussed in detail in Section 4.2.
Revised: The trade-off is discussed in detail in Section 4.2.

Original: 1 for t ← [ T ] do
Revised: 1 for t ← [ T ] do

Original: Server:
Revised: Server:

Original: Split n clients into p shards { H j } j ∈ [ p ]
Revised: Split n clients into p shards { H j } j ∈ [ p ]

Original: Broadcast { H j } j ∈ [ p ] and the global model w t − 1 to all the clients
Revised: Broadcast { H j } j ∈ [ p ] and the global model w t − 1 to all the clients

Original: Client: foreach client i ∈ [ n ] do
Revised: Client: foreach client i ∈ [ n ] do

Original: Locate its own shard j
Revised: Locate its own shard j

Original: Generate random masks u ( j ) ik , k ∈
Revised: Generate random masks u ( j ) ik , k ∈

Original: H
Revised: H

Original: j /i foreach k ∈
Revised: j /i foreach k ∈

Original: H
Revised: H

Original: j /i do
Revised: j /i do

Original: Send u ik to k
Revised: Send u ik to k

Original: Train the local model w ( i ) t using w t as initialization j j u j i i j
Revised: Train the local model w ( i ) t using w t as initialization j j u j i i j

Original: ∈
Revised: ∈

Original: j u ( j
Revised: j u ( j

Original: Send g ( i ) t to the server
Revised: Send g ( i ) t to the server

Original: Server: foreach H j ∈ { H j j
Revised: Server: foreach H j ∈ { H j j

Original: ] do
Revised: ] do

Original: Robust Mean Estimation (line 17).
Revised: Robust Mean Estimation (line 17).

Original: The core step in Byzantine-robust federated learning is to estimate the true mean of the benign updates as accurate as possible even with some malicious clients.
Revised: The core step in Byzantine-robust federated learning is to estimate the true mean of the benign updates as accurate as possible even with some malicious clients.

Original: The most commonly used aggregator, averaging, is proven to be vulnerable to even only one malicious client.
Revised: The most commonly used aggregator, averaging, is proven to be vulnerable to even only one malicious client.

Original: All other works addressing the issue such as Krum (Blanchard et al., 2017) and Bulyan (Mhamdi et al., 2018) suffer from a dimension-dependent estimation error.
Revised: All other works addressing the issue such as Krum (Blanchard et al., 2017) and Bulyan (Mhamdi et al., 2018) suffer from a dimension-dependent estimation error.

Original: Such error is unacceptable even for training a 3-layer MLP on MNIST, not to mention more complicated tasks and models such as VGG16 or ResNet50.
Revised: Such error is unacceptable even for training a 3-layer MLP on MNIST, not to mention more complicated tasks and models such as VGG16 or ResNet50.

Original: Actually, the above problem is well studied in statistics under the name “robust mean estimation” and there already exist several robust mean estimators with dimension-free estimation error (Diakonikolas et al.
Revised: Actually, the above problem is well studied in statistics under the name “robust mean estimation” and there already exist several robust mean estimators with dimension-free estimation error (Diakonikolas et al.

Original: ; Charikar et al.
Revised: ; Charikar et al.

Original: ; Steinhardt (2018);
Revised: ; Steinhardt (2018);

Original: Cheng et al.
Revised: Cheng et al.

Original: Dong et al.
Revised: Dong et al.

Original: Therefore, instead of reinventing the wheel, we choose to leverage a representative robust mean estimator: FilterL2 (Algorithm 2).
Revised: Therefore, instead of reinventing the wheel, we choose to leverage a representative robust mean estimator: FilterL2 (Algorithm 2).

Original: The following formulation is related to the presentation given in Steinhardt (2018).
Revised: The following formulation is related to the presentation given in Steinhardt (2018).

Original: Input: g 1 , · · · , g n ∈ R d , η >1 Let c 1 , · · · , c n =
Revised: Input: g 1 , · · · , g n ∈ R d , η >1 Let c 1 , · · · , c n =

Original: [Equation]
Revised: [Equation]

Original: 4 Let v be the maximum eigenvector of ˆ Σ c , and let ˆ σ 2 c
Revised: 4 Let v be the maximum eigenvector of ˆ Σ c , and let ˆ σ 2 c

Original: = v (cid:62) ˆ Σ c v 5 if ˆ σ 2 c ≤ ησ 2 then return ˆ µ c 6 else let τ = (cid:104) x
Revised: = v (cid:62) ˆ Σ c v 5 if ˆ σ 2 c ≤ ησ 2 then return ˆ µ c 6 else let τ = (cid:104) x

Original: i − ˆ µ c (cid:105) 2 , and update c i ← c i · (1 − τ i /τ max ) , where τ max = max i τ i 7 Go back to line
Revised: i − ˆ µ c (cid:105) 2 , and update c i ← c i · (1 − τ i /τ max ) , where τ max = max i τ i 7 Go back to line

Original: Speciﬁcally, FilterL2 assigns each update a weight and iteratively updates the weights until the weights for the malicious updates are small enough.
Revised: Speciﬁcally, FilterL2 assigns each update a weight and iteratively updates the weights until the weights for the malicious updates are small enough.

Original: As mentioned, FilterL2 provides dimensionfree error rate formally presented as follows.
Revised: As mentioned, FilterL2 provides dimensionfree error rate formally presented as follows.

Original: Theorem 1 (Steinhardt (2018)) .
Revised: Theorem 1 (Steinhardt (2018)) .

Original: Let D be the honest dataset and D ∗ be the contaminated version of D by inserting malicious samples.
Revised: Let D be the honest dataset and D ∗ be the contaminated version of D by inserting malicious samples.

Original: Suppose that | D ∗ | ≤ | D | / (1 − (cid:15) ) , (cid:15) ≤ 1 12 , and further suppose that M EAN [ D ] = µ and (cid:107) C OV [ D ] (cid:107) op ≤ σ 2 .
Revised: Suppose that | D ∗ | ≤ | D | / (1 − (cid:15) ) , (cid:15) ≤ 1 12 , and further suppose that M EAN [ D ] = µ and (cid:107) C OV [ D ] (cid:107) op ≤ σ 2 .

Original: Then given D ∗ , Algorithm 2 outputs ˆ µ s.t.
Revised: Then given D ∗ , Algorithm 2 outputs ˆ µ s.t.

Original: (cid:107) ˆ µ − µ (cid:107) 

Revised: (cid:107) ˆ µ − µ (cid:107)

Original: =
Revised: =

Original: O ( σ √ (cid:15) ) using POLY ( n, d ) time.
Revised: O ( σ √ (cid:15) ) using POLY ( n, d ) time.

Original: Although Algorithm 2 only takes polynomial time to run, the per-round time complexity is O ( nd 2 ) if implemented with power iteration.
Revised: Although Algorithm 2 only takes polynomial time to run, the per-round time complexity is O ( nd 2 ) if implemented with power iteration.

Original: Given d is large, the running time is still quite expensive in practice.
Revised: Given d is large, the running time is still quite expensive in practice.

Original: To address the issue, we cut the update vectors into k sections and apply the robust estimator to each of the sections.
Revised: To address the issue, we cut the update vectors into k sections and apply the robust estimator to each of the sections.

Original: The acceleration scheme reduces the per-round running time to O ( nd 2 /k ) but increases the estimation error to O ( σ √ k ) .
Revised: The acceleration scheme reduces the per-round running time to O ( nd 2 /k ) but increases the estimation error to O ( σ √ k ) .

Original: For instance, if we take k = √ d , the per-round running time becomes O ( nd ) while the estimation error grows to O ( σ 4 √ σ 2 d ) .
Revised: For instance, if we take k = √ d , the per-round running time becomes O ( nd ) while the estimation error grows to O ( σ 4 √ σ 2 d ) .

Original: Despite the compromise for acceleration, FilterL2 still gives the known optimal estimation error and outperforms
Revised: Despite the compromise for acceleration, FilterL2 still gives the known optimal estimation error and outperforms

Original: other robust
Revised: other robust

Original: FL protocols by multiple magnitudes.
Revised: FL protocols by multiple magnitudes.

Original: 4. R OBUSTNESS & S ECURITY A NALYSIS
Revised: 4. R OBUSTNESS & S ECURITY A NALYSIS

Original: In this section, we rigorously present the security and robustness guarantee of F 2 ED -L EARNING .
Revised: In this section, we rigorously present the security and robustness guarantee of F 2 ED -L EARNING .

Original: Security Guarantee.
Revised: Security Guarantee.

Original: We ﬁrst give the security guarantee of F 2 ED -L EARNING as follows.
Revised: We ﬁrst give the security guarantee of F 2 ED -L EARNING as follows.

Original: Intuitively, no more information about the clients except the averaged updates from the shards is revealed to the centralized server.
Revised: Intuitively, no more information about the clients except the averaged updates from the shards is revealed to the centralized server.

Original: Thus, each client’s update is hidden in all the other clients in its shard.
Revised: Thus, each client’s update is hidden in all the other clients in its shard.

Original: The proof is deferred to A.
Revised: The proof is deferred to A.

Original: Corollary 1 (Security against honest-but-curious server; Informal) .
Revised: Corollary 1 (Security against honest-but-curious server; Informal) .

Original: There exists a PPT (probabilistic polynomial Turing machine) simulator which can only see the averaged updates from the shards and its output is computationally indistinguishable from the transcript of F 2 ED -L EARNING .
Revised: There exists a PPT (probabilistic polynomial Turing machine) simulator which can only see the averaged updates from the shards and its output is computationally indistinguishable from the transcript of F 2 ED -L EARNING .

Original: Robustness Guarantee.
Revised: Robustness Guarantee.

Original: We now give the formal robustness guarantee of F 2 ED -L EARNING .
Revised: We now give the formal robustness guarantee of F 2 ED -L EARNING .

Original: The proof is deferred to Appendix B.
Revised: The proof is deferred to Appendix B.

Original: Corollary 2 (Robustness against Byzantine adversaries) .
Revised: Corollary 2 (Robustness against Byzantine adversaries) .

Original: Given the number of clients n , the number of shards p and the fraction of corrupted clients (cid:15) , F 2 ED -L EARNING provides a mean estimation with dimension-free error as long as 12 (cid:15)n < p .
Revised: Given the number of clients n , the number of shards p and the fraction of corrupted clients (cid:15) , F 2 ED -L EARNING provides a mean estimation with dimension-free error as long as 12 (cid:15)n < p .

Original: Remark.
Revised: Remark.

Original: Given the formal security and robustness guarantee, we can see that F 2 ED -L EARNING actually provides a convenient way to calibrate the protection for the server or the clients.
Revised: Given the formal security and robustness guarantee, we can see that F 2 ED -L EARNING actually provides a convenient way to calibrate the protection for the server or the clients.

Original: Concretely, F 2 ED -L EARNING can tolerate up to (cid:98) p 12 (cid:99)− 1 malicious clients and hide each honest client’s update in the mean of (cid:98) np (cid:99) updates.
Revised: Concretely, F 2 ED -L EARNING can tolerate up to (cid:98) p 12 (cid:99)− 1 malicious clients and hide each honest client’s update in the mean of (cid:98) np (cid:99) updates.

Original: 4. D ISCUSSION ON THE I.I.D. D ISTRIBUTION A SSUMPTION IN C OROLLARY
Revised: 4. D ISCUSSION ON THE I.I.D. D ISTRIBUTION A SSUMPTION IN C OROLLARY

Original: To derive Corollary B, we assume that the updates from the benign clients are drawn IID from some distribution D .
Revised: To derive Corollary B, we assume that the updates from the benign clients are drawn IID from some distribution D .

Original: In this section, we explore the rationality of the assumption.
Revised: In this section, we explore the rationality of the assumption.

Original: Source of Non-IID updates in FL.
Revised: Source of Non-IID updates in FL.

Original: It is well known that in FL, data is heterogeneously distributed across clients.
Revised: It is well known that in FL, data is heterogeneously distributed across clients.

Original: Therefore, the collected updates typically do not follow IID distribution under any proper distribution.
Revised: Therefore, the collected updates typically do not follow IID distribution under any proper distribution.

Original: Another source of non-IID updates in FL is the random initialization of local models.
Revised: Another source of non-IID updates in FL is the random initialization of local models.

Original: As known, many neural networks is permutation-invariant.
Revised: As known, many neural networks is permutation-invariant.

Original: For instance, in a two-layer fully connected network, the neurons in the two layers can be permuted correspondingly without changing the functionality of the network.
Revised: For instance, in a two-layer fully connected network, the neurons in the two layers can be permuted correspondingly without changing the functionality of the network.

Original: Therefore, even with the same training data, different initialization can lead to different models within the same permutation-invariant class.
Revised: Therefore, even with the same training data, different initialization can lead to different models within the same permutation-invariant class.

Original: To overcome the second issue, we take the old-fashioned solution by requiring the clients to share the same initialization before the training phase starts.
Revised: To overcome the second issue, we take the old-fashioned solution by requiring the clients to share the same initialization before the training phase starts.

Original: Note that there is a line of work (Yurochkin et al., 2019a;b; Wang et al., 2020) focusing on addressing the issue using matching algorithm and
Revised: Note that there is a line of work (Yurochkin et al., 2019a;b; Wang et al., 2020) focusing on addressing the issue using matching algorithm and

Original: Bayesian non-parametric model.
Revised: Bayesian non-parametric model.

Original: We deem it as an interesting future direction to integrate these works in F 2 ED -L EARNING .
Revised: We deem it as an interesting future direction to integrate these works in F 2 ED -L EARNING .

Original: For the rest of the section, we ignore the second issue and focus on the ﬁrst issue.
Revised: For the rest of the section, we ignore the second issue and focus on the ﬁrst issue.

Original: We formally model the heterogeneous data distribution under some explicit assumptions and discuss how sharding addresses the ﬁrst issue under such assumptions.
Revised: We formally model the heterogeneous data distribution under some explicit assumptions and discuss how sharding addresses the ﬁrst issue under such assumptions.

Original: Note that with sharding we do not solve the slow convergence issue in FL due to non-IID updates.
Revised: Note that with sharding we do not solve the slow convergence issue in FL due to non-IID updates.

Original: Instead, we only create an IID distribution among shards to solidate the IID assumption required in the proof of 2.
Revised: Instead, we only create an IID distribution among shards to solidate the IID assumption required in the proof of 2.

Original: However, the distribution is highly biased and still suffers from low convergence rate due to the intrinsic non-IID data distribution.
Revised: However, the distribution is highly biased and still suffers from low convergence rate due to the intrinsic non-IID data distribution.

Original: From non-I.I.D. to I.I.D. It is a widely accepted assumption in traditional distributed learning theory that the updates should be independently and identically distributed.
Revised: From non-I.I.D. to I.I.D. It is a widely accepted assumption in traditional distributed learning theory that the updates should be independently and identically distributed.

Original: The assumption is reasonable in the sense that the server can decide how to distribute the data to the workers in traditional distributed learning.
Revised: The assumption is reasonable in the sense that the server can decide how to distribute the data to the workers in traditional distributed learning.

Original: However, in federated learning, the data is generated by the clients locally so the updates are not necessarily and typically not IID distributed.
Revised: However, in federated learning, the data is generated by the clients locally so the updates are not necessarily and typically not IID distributed.

Original: This poses a challenge on the robustness analysis.
Revised: This poses a challenge on the robustness analysis.

Original: Now we propose a novel perspective to conduct robustness analysis in federated learning.
Revised: Now we propose a novel perspective to conduct robustness analysis in federated learning.

Original: Succinctly, by aggregating the shards ﬁrst, we are able to reduce the non-IID distribution to an IID distribution.
Revised: Succinctly, by aggregating the shards ﬁrst, we are able to reduce the non-IID distribution to an IID distribution.

Original: As the ﬁrst step, we model the heterogeneous update distribution in federated learning as follows.
Revised: As the ﬁrst step, we model the heterogeneous update distribution in federated learning as follows.

Original: Deﬁnition 1 (Heterogeneous Distribution) .
Revised: Deﬁnition 1 (Heterogeneous Distribution) .

Original: Let D be a set of k distributions D
Revised: Let D be a set of k distributions D

Original: = {D i } i ∈
Revised: = {D i } i ∈

Original: [ k ] where
Revised: [ k ] where

Original: E [ D i ] = µ i and V
Revised: E [ D i ] = µ i and V

Original: [ D i ]
Revised: [ D i ]

Original: = σ 2 i .
Revised: = σ 2 i .

Original: Each client C j ’s update g j follows a distribution D φ ( j ) where φ is a mapping from the client index to the distribution index.
Revised: Each client C j ’s update g j follows a distribution D φ ( j ) where φ is a mapping from the client index to the distribution index.

Original: Note that in the deﬁnition we use scalar data for the ease of clariﬁcation.
Revised: Note that in the deﬁnition we use scalar data for the ease of clariﬁcation.

Original: The formalization can be easily extended to data vectors by separately considering each dimension.
Revised: The formalization can be easily extended to data vectors by separately considering each dimension.

Original: The deﬁnition captures the most important feature that each client’s update is drawn from different distributions.
Revised: The deﬁnition captures the most important feature that each client’s update is drawn from different distributions.

Original: As the second step, we analyze the inﬂuence of sharding on the update distribution.
Revised: As the second step, we analyze the inﬂuence of sharding on the update distribution.

Original: Surprisingly, sharding pushes the non-IID distribution to a well-regulated IID distribution according to Lindeberg central limit theorem.
Revised: Surprisingly, sharding pushes the non-IID distribution to a well-regulated IID distribution according to Lindeberg central limit theorem.

Original: Theorem 2 (Lindeberg Central Limit Theorem (Linnik (1959))) .
Revised: Theorem 2 (Lindeberg Central Limit Theorem (Linnik (1959))) .

Original: Suppose { X 1 , · · · , X n } is a sequence of independence random variables (not necessarily identically distributed), each with ﬁnite expected value µ i and variance σ 2 i .
Revised: Suppose { X 1 , · · · , X n } is a sequence of independence random variables (not necessarily identically distributed), each with ﬁnite expected value µ i and variance σ 2 i .

Original: Deﬁne s 2 n = (cid:80) ni
Revised: Deﬁne s 2 n = (cid:80) ni

Original: =1 σ 2 i .
Revised: =1 σ 2 i .

Original: Suppose that ∀ (cid:15) > 0 ,
Revised: Suppose that ∀ (cid:15) > 0 ,

Original: [Equation]
Revised: [Equation]

Original: Then the distribution of the standardized sums converges towards the standard normal distribution.
Revised: Then the distribution of the standardized sums converges towards the standard normal distribution.

Original: [Equation]
Revised: [Equation]

Original: Give Deﬁnition 1 and Theorem 2, the following corollary follows naturally.
Revised: Give Deﬁnition 1 and Theorem 2, the following corollary follows naturally.

Original: The proof is deferred to
Revised: The proof is deferred to

Original: Appendix C
Revised: Appendix C.

Original: Corollary 3 (IID after Sharding) .
Revised: Corollary 3 (IID after Sharding) .

Original: Assume that the updates from the clients follow Deﬁnition 1.
Revised: Assume that the updates from the clients follow Deﬁnitionwhere k (cid:28) np .

Original: Besides, lim | H |→∞ 1 s 2 H (cid:80) i ∈ H E
Revised: Besides, lim | H |→∞ 1 s 2 H (cid:80) i ∈ H E

Original: [( g i − µ i ) 2 · 1 {| g i − µ i | > (cid:15)s H } ] = 0 where s 2 H
Revised: [( g i − µ i ) 2 · 1 {| g i − µ i | > (cid:15)s H } ] = 0 where s 2 H

Original: =
Revised: =

Original: (cid:80) i ∈ H σ 2 φ ( i ) .
Revised: (cid:80) i ∈ H σ 2 φ ( i ) .

Original: Given the uniform randomness of sharding, we can view the distribution index φ ( j ) as drawn from some distribution Φ on [ k ] .
Revised: Given the uniform randomness of sharding, we can view the distribution index φ ( j ) as drawn from some distribution Φ on [ k ] .

Original: Let ¯ µ = (cid:80) x ∈ [ k ] Φ( x = i ) µ i and ¯ σ 2 = (cid:80) x ∈ [ k ] Φ( x = i ) σ 2 i .
Revised: Let ¯ µ = (cid:80) x ∈ [ k ] Φ( x = i ) µ i and ¯ σ 2 = (cid:80) x ∈ [ k ] Φ( x = i ) σ 2 i .

Original: Then,| H |
Revised: Then,

Original: [Equation]
Revised: [Equation]

Original: [Figure]
Revised: [Figure]

Original: Empirical Validation.
Revised: Empirical Validation.

Original: To validate the claim empirically, we simulate heterogeneous data distribution by assigning MNIST samples with different labels toclients.
Revised: To validate the claim empirically, we simulate heterogeneous data distribution by assigning MNIST samples with different labels toclients.

Original: These clients are split into 5 shards.
Revised: These clients are split into 5 shards.

Original: We plot the distributions of the updates before and after sharding as shown in Figure 1.
Revised: We plot the distributions of the updates before and after sharding as shown in Figure 1.

Original: Each line represents the weight distribution within one update.
Revised: Each line represents the weight distribution within one update.

Original: Figure 1a plots ﬁve updates from the same shard and Figure 1b plots the averaged updates from the ﬁve shards.
Revised: Figure 1a plots ﬁve updates from the same shard and Figure 1b plots the averaged updates from the ﬁve shards.

Original: It is obvious that after sharding the distributions are more densely and identically distributed as discussed above.
Revised: It is obvious that after sharding the distributions are more densely and identically distributed as discussed above.

Original:  E VALUATION
Revised:  E VALUATION

Original: In this section, we want to answer the following questions using empirical evaluation: (1)
Revised: In this section, we want to answer the following questions using empirical evaluation: (1)

Original: Does
Revised: Does

Original: FilterL2 outperforms other aggregators when used alone?
Revised: FilterL2 outperforms other aggregators when used alone?

Original: (2) Does F 2 ED -L EARNING outperform other robust FL protocols augmented with sharded secure aggregation?
Revised: (2) Does F 2 ED -L EARNING outperform other robust FL protocols augmented with sharded secure aggregation?

Original: 5. A TTACKS
Revised: 5. A TTACKS

Original: To answer the above questions, we evaluated the robust estimators without attack and with several representative attacks.
Revised: To answer the above questions, we evaluated the robust estimators without attack and with several representative attacks.

Original: We focus on three of these attacks in the main text and defer one another attack to Appendix D.
Revised: We focus on three of these attacks in the main text and defer one another attack to Appendix D.

Original: The ﬁrst and second attacks we used are the model poisoning attacks from Fang et al.
Revised: The ﬁrst and second attacks we used are the model poisoning attacks from Fang et al.

Original: The aim of the model poisoning attacks is to increase the error rate of the converged model even facing
Revised: The aim of the model poisoning attacks is to increase the error rate of the converged model even facing

Original: Byzantine-robust protocols.
Revised: Byzantine-robust protocols.

Original: In these attacks, the malicious clients search for poisoning updates by solving an optimization problem.
Revised: In these attacks, the malicious clients search for poisoning updates by solving an optimization problem.

Original: We employ two attacks proposed in their work targeting at Krum and Trimmed Mean.
Revised: We employ two attacks proposed in their work targeting at Krum and Trimmed Mean.

Original: These two attacks are henceforth referred to as Krum attack (KA) and trimmed mean attack (TMA).
Revised: These two attacks are henceforth referred to as Krum attack (KA) and trimmed mean attack (TMA).

Original: The third attack we considered is a backdoor attack from Bhagoji et al.
Revised: The third attack we considered is a backdoor attack from Bhagoji et al.

Original: The attack aims to insert a backdoor functionality while preserving high accuracy on the validation set.
Revised: The attack aims to insert a backdoor functionality while preserving high accuracy on the validation set.

Original: Similarly, the search for the attack gradient is formalized as an optimization problem and the authors tweak the objective function with some stealth metrics to make the attack gradient hard to detect.
Revised: Similarly, the search for the attack gradient is formalized as an optimization problem and the authors tweak the objective function with some stealth metrics to make the attack gradient hard to detect.

Original: We refer to the attack as Model Poisoning Attack (MPA) in the rest of the section.
Revised: We refer to the attack as Model Poisoning Attack (MPA) in the rest of the section.

Original: 5. E XPERIMENTAL S ETUP
Revised: 5. E XPERIMENTAL S ETUP

Original: We selected two datasets: MNIST (LeCun et al.
Revised: We selected two datasets: MNIST (LeCun et al.

Original: and FashionMNIST (Xiao et al.
Revised: and FashionMNIST (Xiao et al.

Original: (2017)), and three other Byzantine-robust federated learning protocols to compare with: (1) Krum (Blanchard et al.
Revised: (2017)), and three other Byzantine-robust federated learning protocols to compare with: (1) Krum (Blanchard et al.

Original: ; (2) Trimmed Mean (Yin et al.
Revised: ; (2) Trimmed Mean (Yin et al.

Original: (2018)); and (3) Bulyan (Mhamdi et al.
Revised: (2018)); and (3) Bulyan (Mhamdi et al.

Original: Note that Bulyan acts like a wrapper around other robust estimators so in the evaluation we have two versions of Bulyan: Bulyan Krum and Bulyan Trimmed Mean.
Revised: Note that Bulyan acts like a wrapper around other robust estimators so in the evaluation we have two versions of Bulyan: Bulyan Krum and Bulyan Trimmed Mean.

Original: We ran all the protocols on the two datasets and present the attack performance under these protocols.
Revised: We ran all the protocols on the two datasets and present the attack performance under these protocols.

Original: Attack performance is measured differently according to the different attack targets.
Revised: Attack performance is measured differently according to the different attack targets.

Original: For KA and TMA, we use the model accuracy as the metric for characterizing attack performance.
Revised: For KA and TMA, we use the model accuracy as the metric for characterizing attack performance.

Original: Higher model accuracy indicates stronger robustness.
Revised: Higher model accuracy indicates stronger robustness.

Original: For MPA, we use the percentage of the remembered backdoors to represent the attack performance.
Revised: For MPA, we use the percentage of the remembered backdoors to represent the attack performance.

Original: The fewer backdoors remembered, the more robust the estimator is.
Revised: The fewer backdoors remembered, the more robust the estimator is.

Original: In the IID setting, the data is shufﬂed and partitioned into all the clients, each receiving the same number of examples.
Revised: In the IID setting, the data is shufﬂed and partitioned into all the clients, each receiving the same number of examples.

Original: In the non-IID setting, each client is assigned data with 3 labels.
Revised: In the non-IID setting, each client is assigned data with 3 labels.

Original: FilterL2 used in the evaluation is the accelerated version as discussed in Section 4.1.
Revised: FilterL2 used in the evaluation is the accelerated version as discussed in Section 4.1.

Original: 5. E VALUATION R ESULTS
Revised: 5. E VALUATION R ESULTS

Original: FilterL2 Performance.
Revised: FilterL2 Performance.

Original: To answer question (1), we evaluated 6 aggregators on MNIST and FashionMNIST as shown in Figure 2 and Figure 3.
Revised: To answer question (1), we evaluated 6 aggregators on MNIST and FashionMNIST as shown in Figure 2 and Figure 3.

Original: We ran the protocols with 20 clients with IID data distributions.
Revised: We ran the protocols with 20 clients with IID data distributions.

Original: 5 of the clients are malicious under attacks.
Revised: 5 of the clients are malicious under attacks.

Original: Note that the number of the malicious clients actually exceeds the bound in Corollary 2 because some attacks only work with enough malicious clients.
Revised: Note that the number of the malicious clients actually exceeds the bound in Corollary 2 because some attacks only work with enough malicious clients.

Original: Not surprisingly, FilterL2 achieves optimal performance among all 6 aggregators.
Revised: Not surprisingly, FilterL2 achieves optimal performance among all 6 aggregators.

Original: Besides, FilterL is the only aggregator that consistently achieves good performance under all three attacks.
Revised: Besides, FilterL is the only aggregator that consistently achieves good performance under all three attacks.

Original: The superiority of FilterL2 is owed to its quad-root estimation error.
Revised: The superiority of FilterL2 is owed to its quad-root estimation error.

Original: Due to the theoretically stronger robustness, it is extremely hard to design targeted attacks for FilterL2 like Krum or trimmed mean.
Revised: Due to the theoretically stronger robustness, it is extremely hard to design targeted attacks for FilterL2 like Krum or trimmed mean.

Original: In the non-IID setting, all the estimators cannot perform well since the IID assumption is broken.
Revised: In the non-IID setting, all the estimators cannot perform well since the IID assumption is broken.

Original: F 2 ED -L EARNING Performance.
Revised: F 2 ED -L EARNING Performance.

Original: To answer question (2), we evaluated six aggregators with sharding on MNIST and FashionMNIST as shown in Figure 4 (homogeneous distribution) and Figure(heterogeneous distribution).
Revised: To answer question (2), we evaluated six aggregators with sharding on MNIST and FashionMNIST as shown in Figure 4 (homogeneous distribution) and Figure(heterogeneous distribution).

Original: We ran the protocols with 100 clients, ten of which are malicious under attacks.
Revised: We ran the protocols with 100 clients, ten of which are malicious under attacks.

Original: The 100 clients were randomly split into 25 shards.
Revised: The 100 clients were randomly split into 25 shards.

Original: [Figure] [Figure]
Revised: [Figure] [Figure]

Original: [Figure] [Figure]
Revised: [Figure] [Figure]

Original: In both IID and non-IID settings, for the experiments without attack, with TMA or with MPA (Figure 4a,4c,4d,4e.4g,4h, 5a, 5c, 5d), F 2 ED -L EARNING still achieves optimal or close-to-optimal performance.
Revised: In both IID and non-IID settings, for the experiments without attack, with TMA or with MPA (Figure 4a,4c,4d,4e.4g,4h, 5a, 5c, 5d), F 2 ED -L EARNING still achieves optimal or close-to-optimal performance.

Original: An interesting phenomenon is that KA can be successfully defended by all aggregators when the clients are sharded (Figure 4b,4f).
Revised: An interesting phenomenon is that KA can be successfully defended by all aggregators when the clients are sharded (Figure 4b,4f).

Original: The reason is that KA is targeted at Krum without sharding and wants to maximize the probability that a malicious update is chosen by Krum.
Revised: The reason is that KA is targeted at Krum without sharding and wants to maximize the probability that a malicious update is chosen by Krum.

Original: Once integrated with sharding, Krum selects from the averaged updates from the shards, and thus the effect of the malicious update is diluted.
Revised: Once integrated with sharding, Krum selects from the averaged updates from the shards, and thus the effect of the malicious update is diluted.

Original: This demonstrates that sharding itself can defend against some attacks by diluting the effect of malicious updates.
Revised: This demonstrates that sharding itself can defend against some attacks by diluting the effect of malicious updates.

Original: Compared with the non-IID setting without sharding (Figure 3), all of the aggregators perform better under different attacks which beneﬁt from the approximate IID distribution among shards.
Revised: Compared with the non-IID setting without sharding (Figure 3), all of the aggregators perform better under different attacks which beneﬁt from the approximate IID distribution among shards.

Original: [Figure]
Revised: [Figure]

Original: Inﬂuence of Shard Size.
Revised: Inﬂuence of Shard Size.

Original: As a new hyper-parameter: the number of shards p (aka the shard size np ), is introduced in F 2 ED -L EARNING , we empirically evaluate its inﬂuence as shown in Figure 6.
Revised: As a new hyper-parameter: the number of shards p (aka the shard size np ), is introduced in F 2 ED -L EARNING , we empirically evaluate its inﬂuence as shown in Figure 6.

Original: The results in
Revised: The results in

Original: Figure 6 also clearly exhibit the trade-off between security and robustness guarantee via tuning p .
Revised: Figure 6 also clearly exhibit the trade-off between security and robustness guarantee via tuning p .

Original: When the number of shards equals the number of clients, the system is equivalent to FilterL2 without sharding and achieves optimal model accuracy.
Revised: When the number of shards equals the number of clients, the system is equivalent to FilterL2 without sharding and achieves optimal model accuracy.

Original: However, under such setting, the centralized server has access to each client’s individual update and
Revised: However, under such setting, the centralized server has access to each client’s individual update and

Original: F 2 ED -L EARNING provides no further security guarantee than vanilla
Revised: F 2 ED -L EARNING provides no further security guarantee than vanilla

Original: FL.
Revised: FL.

Original: When the number of shards converges to one, the system degrades to simple averaging with secure aggregation with the strongest security but the weakest robustness.
Revised: When the number of shards converges to one, the system degrades to simple averaging with secure aggregation with the strongest security but the weakest robustness.

Original: When the number of shards lies between the two extremes, the model accuracy gradually changes under TMA as shown in Figure 6.
Revised: When the number of shards lies between the two extremes, the model accuracy gradually changes under TMA as shown in Figure 6.

Original:  C ONCLUSION & F UTURE D IRECTION
Revised:  C ONCLUSION & F UTURE D IRECTION

Original: In this paper, we designed and developed F 2 ED -L EARNING , the ﬁrst federated learning protocol defending against an honest but curious server and Byzantine malicious clients simultaneously.
Revised: In this paper, we designed and developed F 2 ED -L EARNING , the ﬁrst federated learning protocol defending against an honest but curious server and Byzantine malicious clients simultaneously.

Original: We propose to use FilterL2 to robustly aggregate the possibly contaminated updates and secure aggregation to protect the privacy of the clients.
Revised: We propose to use FilterL2 to robustly aggregate the possibly contaminated updates and secure aggregation to protect the privacy of the clients.

Original: We reconcile the contradictory components with sharding.
Revised: We reconcile the contradictory components with sharding.

Original: The evaluation results show that F 2 ED -L EARNING consistently achieves the optimal or close-tooptimal performance among ﬁve robust FL protocols.
Revised: The evaluation results show that F 2 ED -L EARNING consistently achieves the optimal or close-tooptimal performance among ﬁve robust FL protocols.

Original: As far as we can see, F 2 ED -L EARNING addresses the two main privacy threats in FL systems simultaneously and shows the potential to further popularize FL in sensitive applications.
Revised: As far as we can see, F 2 ED -L EARNING addresses the two main privacy threats in FL systems simultaneously and shows the potential to further popularize FL in sensitive applications.

Original: We also identify several unsolved challenges in F 2 ED -L EARNING which might motivate future works in FL with two-way protection.
Revised: We also identify several unsolved challenges in F 2 ED -L EARNING which might motivate future works in FL with two-way protection.

Original: For instance, vanilla FilterL2 brings large overhead due to its high complexity.
Revised: For instance, vanilla FilterL2 brings large overhead due to its high complexity.

Original: Although the accelerated FilterL2 partially addresses the issue, it sacriﬁces the asymptotic estimation error for the speedup.
Revised: Although the accelerated FilterL2 partially addresses the issue, it sacriﬁces the asymptotic estimation error for the speedup.

Original: An interesting future direction is to integrate robust mean estimators with low complexity such as Cheng et al.
Revised: An interesting future direction is to integrate robust mean estimators with low complexity such as Cheng et al.

Original: However, Cheng et al.
Revised: However, Cheng et al.

Original: (2019)’s approach is rather complicated so designing low-complexity robust mean estimator with simple intuition is also an intriguing direction.
Revised: (2019)’s approach is rather complicated so designing low-complexity robust mean estimator with simple intuition is also an intriguing direction.

Original: A P ROOF OF C OROLLARY
Revised: A P ROOF OF C OROLLARY

Original: Proof.
Revised: Proof.

Original: Corollary 1 is equivalent to the following lemma.
Revised: Corollary 1 is equivalent to the following lemma.

Original: Lemma 1 (Lemma 6.1 in Bonawitz et al.
Revised: Lemma 1 (Lemma 6.1 in Bonawitz et al.

Original: Given the number of the shards p , the parameter size d , the group size q , and the updates g H i where ∀ i ∈ [ p ] , g H i ∈
Revised: Given the number of the shards p , the parameter size d , the group size q , and the updates g H i where ∀ i ∈ [ p ] , g H i ∈

Original: Z dq , we have {{ u ij $ ← Z dq } i<j , u ij := − u ji , ∀ i > j : { g H i + (cid:88)
Revised: Z dq , we have {{ u ij $ ← Z dq } i<j , u ij := − u ji , ∀ i > j : { g H i + (cid:88)

Original: j ∈ [ p ] /i
Revised: j ∈ [ p ] /i

Original: u ij (mod q ) } i ∈
Revised: u ij (mod q ) } i ∈

Original: [ p ] } ≡{{ v i $ ← Z dq } i ∈ [ p ] } s.t. (cid:88) i ∈
Revised: [ p ] } ≡{{ v i $ ← Z dq } i ∈ [ p ] } s.t. (cid:88) i ∈

Original: [ p ] v i = (cid:88) i ∈
Revised: [ p ] v i = (cid:88) i ∈

Original: [ p ] g H i (mod q ) : { v i } i ∈ [ q ] } where ” ≡ ” denotes that the distributions are identical.
Revised: [ p ] g H i (mod q ) : { v i } i ∈ [ q ] } where ” ≡ ” denotes that the distributions are identical.

Original: We prove the above lemma with induction on n .
Revised: We prove the above lemma with induction on n .

Original: Base case: When n = 2 , the ﬁrst elements in the RHS of two distributions are both uniformly random.
Revised: Base case: When n = 2 , the ﬁrst elements in the RHS of two distributions are both uniformly random.

Original: The second element is the sum minus the ﬁrst element.
Revised: The second element is the sum minus the ﬁrst element.

Original: Thus the distributions are identical.
Revised: Thus the distributions are identical.

Original: Inductive Hypothesis: We assume that when n = k , the two distributions are identical.
Revised: Inductive Hypothesis: We assume that when n = k , the two distributions are identical.

Original: Inductive Step: If we ignore all the randomness from and for client k + 1 , according to the inductive hypothesis, the distributions of the ﬁrst k clients are identical.
Revised: Inductive Step: If we ignore all the randomness from and for client k + 1 , according to the inductive hypothesis, the distributions of the ﬁrst k clients are identical.

Original: Hence, after adding two independently uniformly random values, the distributions are still identical.
Revised: Hence, after adding two independently uniformly random values, the distributions are still identical.

Original: The value for the k +1 th client the the sum minus k uniformly random values.
Revised: The value for the k +1 th client the the sum minus k uniformly random values.

Original: Thus, the two distributions are still identical.
Revised: Thus, the two distributions are still identical.

Original: B P ROOF OF C OROLLARY
Revised: B P ROOF OF C OROLLARY

Original: Proof.
Revised: Proof.

Original: In the following analysis, we assume that the updates from the shards follow an IID distribution.
Revised: In the following analysis, we assume that the updates from the shards follow an IID distribution.

Original: The reasonableness of the assumption is further discussed in Section 4.3.
Revised: The reasonableness of the assumption is further discussed in Section 4.3.

Original: The fraction of malicious shards is bounded by the worst case where each malicious client is exclusively assigned to different shards: (cid:15) (cid:48) ≤ (cid:15)np ≤ 112 .
Revised: The fraction of malicious shards is bounded by the worst case where each malicious client is exclusively assigned to different shards: (cid:15) (cid:48) ≤ (cid:15)np ≤ 112 .

Original: Given the assumption above, we have satisﬁed all the requirements in Theorem 1.
Revised: Given the assumption above, we have satisﬁed all the requirements in Theorem 1.

Original: Hence, F 2 ED -L EARNING provides a mean estimation with dimension-free error as long as 12 (cid:15)n < p .
Revised: Hence, F 2 ED -L EARNING provides a mean estimation with dimension-free error as long as 12 (cid:15)n < p .

Original: C P ROOF OF C OROLLARY
Revised: C P ROOF OF C OROLLARY

Original: Proof.
Revised: Proof.

Original: By reorganizing Equation 1, we have 1 | H | (cid:80) i ∈
Revised: By reorganizing Equation 1, we have 1 | H | (cid:80) i ∈

Original: H g i d → N ( 1 | H | (cid:80) i ∈ H µ φ ( i ) , s 2 H | H | 2 ) .
Revised: H g i d → N ( 1 | H | (cid:80) i ∈ H µ φ ( i ) , s 2 H | H | 2 ) .

Original: Given the multinomial distribution Φ ,
Revised: Given the multinomial distribution Φ ,

Original: • E [ (cid:80) i ∈ H µ φ ( i ) |
Revised: • E [ (cid:80) i ∈ H µ φ ( i ) |

Original: H |
Revised: H |

Original: [Equation]
Revised: [Equation]

Original: • E [ s 2 H | H | ] = (cid:80) x ∈ [ k ] Φ( x = i ) σ 2 i = ¯
Revised: • E [ s 2 H | H | ] = (cid:80) x ∈ [ k ] Φ( x = i ) σ 2 i = ¯

Original: σ 2 , V [ s 2 H | H | ] = (cid:80) x ∈ [ k ] Φ( x = i )
Revised: σ 2 , V [ s 2 H | H | ] = (cid:80) x ∈ [ k ] Φ( x = i )

Original: [Equation]
Revised: [Equation]

Original: σ 2 i − ¯ σ
Revised: σ 2 i − ¯ σ

Original: [Equation]
Revised: [Equation]

Original: 2 | H |
Revised: 2 | H |

Original: [Equation]
Revised: [Equation]

Original: Thus, when | H | → ∞ ,
Revised: Thus, when | H | → ∞ ,

Original: (cid:80) i ∈ H µ φ ( i ) |
Revised: (cid:80) i ∈ H µ φ ( i ) |

Original: H
Revised: H

Original: |
Revised: |

Original: [Equation] [Equation]
Revised: [Equation] [Equation]

Original: ¯ σ
Revised: ¯ σ

Original: [Equation]
Revised: [Equation]

Original: | H |
Revised: | H |

Original: [Equation]
Revised: [Equation]

Original: D M ODEL R EPLACEMENT A TTACK
Revised: D M ODEL R EPLACEMENT A TTACK

Original: In this section, we focus on the backdoor attack introduced in Bagdasaryan et al.
Revised: In this section, we focus on the backdoor attack introduced in Bagdasaryan et al.

Original: (2020), namely model replacement attack.
Revised: (2020), namely model replacement attack.

Original: Similar to MPA, we use Attack Success Rate as the metric to measure the robustness of an estimator.
Revised: Similar to MPA, we use Attack Success Rate as the metric to measure the robustness of an estimator.

Original: The results are included in Figure 7.
Revised: The results are included in Figure 7.

Original: [Figure]
Revised: [Figure]