Byzantine-tolerant federated Gaussian process regression for streaming data
Abstract
In this paper, we consider Byzantine-tolerant federated learning for streaming data using Gaussian process regression (GPR).
In particular, a cloud and a group of agents aim to collaboratively learn a latent function where some agents are subject to Byzantine attacks.
We develop a Byzantine-tolerant federated GPR algorithm, which includes three modules: agent-based local GPR, cloud-based aggregated
GPR and agent-based fused GPR.
We derive the upper bounds on prediction error between the mean from the cloud-based aggregated GPR and the target function provided that Byzantine agents are less than one quarter of all the agents.
We also characterize the lower and upper bounds of the predictive variance.
Experiments on a synthetic dataset and two real-world datasets are conducted to evaluate the proposed algorithm.
The Internet of Things (IoT) produces large volumes of spatially distributed data.
A typical practice is to store data in a centralized entity, e.g., a cloud, and train machine learning models there.
However, it poses challenges in communication overhead and computation efficiency.
In addition, data storage on the centralized entity raises privacy concerns.
Federated learning provides a promising paradigm to address the two challenges [1], [2], [3], [4].
First, only a finite number of model parameters are shared and the size of these parameters is much smaller than that of raw data; second, data samples are kept by agents and local models are trained without sharing raw data.
However, these agents are vulnerable to Byzantine attacks, which force them to behave arbitrarily and send any message to the cloud.
The cloud cannot access each agent’s local private data and training process, and then cannot verify the correctness of each agent’s updates.
Byzantine attacks incur degradation of learning performance.
Related work.
There have been many recent works to secure federated learning against Byzantine attacks [5], [6], [7], [8], [9].
Paper [5] proposes Krum as the aggregation rule where the cloud selects a gradient such that the overall distance between this gradient to a fixed number of its closest gradients is minimal.
Paper [6] develops an algorithm which is based on integrated stochastic quantization, geometric median based outlier detection and secure model aggregation.
Paper [7] analyzes two robust distributed gradient descent algorithms based on median and trimmed mean operations, respectively.
Paper [8] proposes a high-dimensional robust mean estimation algorithm at the cloud to combat the adversary.
In paper [9], the cloud partitions all the received local gradients into batches and computes the mean of each batch.
After that, the cloud computes the geometric median of the batch means.
The above set of papers can guarantee that the estimate of the parameter aggregated by the cloud will converge to a neighborhood of the minimizer of the loss function regardless of Byzantine attacks.
However, the existing works only consider deep neural networks (DNN) as the learning model and are limited to static data and off-line learning.
On-line learning is demanded to process data that arrives sequentially across time [10], [11], [12].
Gaussian process regression (GPR) is a solution candidate to solve the problem [13], [14], [15], [16].
First of all, GPR is a non-parametric statistical learning model.
With proper choice of prior covariance function and mild assumptions of the target function, GPR is able to approximate any continuous function [17].
Second, GPR can be implemented recursively, reducing computational complexity and memory [18].
Third, GPR is able to quantify learning uncertainties since it predicts the target function using a posterior probability distribution [19].
However, Byzantine-tolerant GPR has not been studied yet.
Contributions.
This paper considers Byzantine-tolerant federated learning for streaming data using
GPR where a cloud and a group of agents aim to collaboratively learn a latent function despite some agents are subject to Byzantine attacks.
Major contributions are listed as follows:
1) We develop a Byzantine-tolerant federated GPR algorithm, which includes three modules: agent-based local GPR, cloud-based aggregated GPR and agent-based fused GPR.
Specifically, the agent-based local GPR sends potentially compromised local predictions to the cloud, and the cloud-based aggregated GPR computes a global model by a Byzantinetolerant PoE aggregation rule.
Then the cloud broadcasts the current global model to all the agents.
Agent-based fused GPR returns the predictions by fusing the models from the cloud-based GPR with those from the agent-based local GPR.
The predictive mean of the cloud-based aggregated GPR is theoretically guaranteed to be restricted within a neighborhood of the target function provided that Byzantine agents are less than one quarter of all the agents.
The prediction error is positively proportional to the number of Byzantine agents and that of the agents with extreme values.
Prediction uncertainty is quantified by lower and upper bounds, which are identical to that of the attack-free case.
Experiments on a synthetic dataset and two real-world datasets are conducted to demonstrate that
the
Byzantine-tolerant GPR algorithm is resilient to Byzantine attacks.
To the best knowledge of authors, this is the first paper to study Byzantine-tolerant federated learning over streaming data using GPR.
Notations and notions.
Throughout the paper, we use lower-case letters, e.g, a , to denote scalars, bold letters, e.g., a , to denote vectors; we use upper-case letters, e.g., A , to denote matrices, calligraphic letters, e.g., A , to denote sets, and bold calligraphic letters, e.g., A , to denote spaces.
Denote
I n ∈ R n × n the n -by- n identity matrix.
We denote by R the set of real numbers.
The set of nonnegative real numbers is denoted by R + , and the set of positive real numbers is denoted by R ++ .
The cardinality of set A is denoted by |A| .
Define the distance metric D ( z , z ′ ) ≜
∥ z − z ′ ∥ , and the point to set distance as D ( z , Z ) ≜ inf z ′ ∈Z D ( z , z ′ ) .
Define proj ( z , Z ) ≜ {
z ′ ∈ Z | D ( z , z ′ )
=
D ( z , Z ) } the projection set of point z onto set Z .
Denote the supremum of a function η : Z → R as ∥ η ∥ ∞ ≜ sup z ∈ Z | η ( z ) | .
For a real number a , we denote the floor function by ⌊ a ⌋ .
We denote by
O ( g ( t ))
the limiting behavior of some function f ( t ) if lim t →∞ f ( t ) g ( t ) =
a for some constant a > 0 .
We give formal definitions of sub-Gaussian random variables and Gaussian process.
Definition 1 [20] A random variable X with mean µ ≜ E [ X ] is sub-Gaussian (denoted by X ∼ subG ( σ 2 ) ) if there exists a positive number σ such that
[Equation]
Definition 2 [13]
A Gaussian process is a collection of random variables, any finite number of which have a joint Gaussian distribution.
Preliminary
In this section, we provide basic knowledge of GPR.
Let η : Z → Y be the target function, where
Z ⊆ R n z and Y ⊆ R .
Given input z ( t ) ∈
Z at time t , the corresponding output is given by
[Equation]
where e ( t ) is the Gaussian measurement noise and the latent function η is sampled from a Gaussian process prior.
Let training data be in the form D ≜ ( Z , y ) , where Z ≜ { z (1) , . . .
, z ( n s ) } is the set of input data and y ≜
[ y (1) , . . .
, y ( n s )]
T is the column vector aggregating the outputs.
GPR aims to approximate the latent function η over a set of test data points Z ∗ ⊂
Z using D .
ii
Define kernel function k : R n z × R n z
→ R that is symmetric and positive semi-definite; i.e., (cid:82) k ( z , z ′ )
f ( z ) f
( z ′ ) dν
( z ) dν ( z ′ ) ≥
for all f ∈ L 2 ( Z , ν ) , where ν denotes a measure (see page 80, [13]).
Let η ( Z ) return a column vector such that the i -th entry of η ( Z ) equals η ( z ( i )) .
Assume that the latent function η is sampled from a GP prior specified by mean function µ and kernel function k .
Then the training outputs y and the test outputs η ( Z ∗ ) are jointly Gaussian distributed as:
[Equation]
where µ ( Z ) and µ ( Z ∗ ) return a vector consisting of µ ( z ( i )) and µ ( z ∗ ( j )) ; k ( Z , Z ∗ ) returns a matrix such that the entry at the i th row and the j th column is k
( z ( i ) , z ∗ ( j )) , and k
( Z , Z ) , k ( Z ∗ , Z ) and k ( Z ∗ , Z ∗ ) are defined in an analogous way.
Utilizing identities of joint Gaussian distribution (see page 200 in [13]), GPR makes predictions of η on Z ∗ based on dataset D as η ( Z ∗ ) ∼ N ( µ Z ∗ |D , Σ Z ∗ |D ) , where
[Equation]
(3) with ˚ k ( Z , Z ) ≜ k
( Z , Z )
+ σ 2 e I n s .
We refer (3) as full GPR.
If y is multi-dimensional, GPR is performed for each element.
Problem formulation 2.1 Observation model
Consider a network consisting of n agents and a cloud.
We denote the agent set by V ≜ { 1 , . . . , n } .
At each time instant t , the observation model of agent i is given as
[Equation]
where z [ i ] ( t ) ∈
Z ⊆ R n z is the input of η , y
[ i ] ( t ) ∈ Y is the observation of the agent, and e [ i ] ( t ) is independent zero-mean Gaussian noise with e [ i ] ( t ) ∼ N (0 , ( σ [ i ] e ) 2 ) .
2.2 Attack model
All communications between the cloud and the agents are attack-free.
Some agents are Byzantine agents, which can behave arbitrarily during learning process, and send arbitrary local predictions to the cloud.
We assume that an α fraction of the n agents are Byzantine, and the remaining 1 − α fraction are benign.
We denote B ⊂ V as the set of Byzantine agents, and thus |B| =
⌊ αn ⌋ .
Both the cloud and the benign agents are unaware of the identities of Byzantine agents, but we assume the cloud knows that 14 is an upper bound of α .
Assumption 1 It holds that 0 < α < 14 .
Most existing works on Byzantine-tolerant algorithms, e.g., [5], [7], [9], can tolerate Byzantine agents with α < 12 .
These algorithms only transmit one variable, e.g., the gradients of the loss function or the model parameter, between the cloud and the agents, whereas our federated GPR algorithm requires to exchange two variables, e.g., local mean and variance, to realize the aggregation of predictions.
2.3 Objective
The objective of this paper is to design an algorithm, which enables the benign agents and the cloud to correctly learn the function η without requiring the agents to share local streaming data ( z [ i ] ( t ) , y
[ i ] ( t )) despite some agents are subject to Byzantine attacks.
Byzantine-tolerant federated GPR
In this section, we develop a Byzantine-tolerant federated GPR algorithm to solve the problem formulated in Section 2.
This algorithm consists of three modules: agent-based local GPR, cloudbased aggregated GPR and agent-based fused GPR.
iii
∗
ˆ
[Equation]
t
[Equation]
Z
[Equation]
D ( t ) = cGPR
[Equation]
ˇ µ ′Z
[Equation]
|D [ i ] ( t )
ˇ σ ′ 2 Z
[Equation]
|D [ i ] ( t ) )
i ] i ]
Z
[Equation]
|D t
[Equation]
= fGPR
[Equation]
ˇ
[Equation]
D [ i ] ( t ) , ˇ σ ′ 2 Z ∗ |D
[ i ] ( t ) , ˆ µ Z
[Equation]
|D ( t )
ˆ σ
[Equation]
Z
[Equation]
|D ( t ) ) 11:
12: end for
Specifically, first at each time instant t , each agent i ∈ V makes its own prediction of η through agent-based local GPR over a given set of points Z ∗ ⊆
Z using local streaming dataset D [ i ] ( t ) ≜ ( Z [ i ] ( t ) , y
[ i ] ( t )) with local input data Z [ i ] ( t ) ≜ { z [ i ] (1) , . . .
, z [ i ] ( t ) } and output y
[ i ] ( t ) ≜
[ y [ i ] (1) , . . .
, y
[ i ] ( t )] T .
Then the benign agents send correct local predictions to the cloud and the Byzantine agents instead send arbitrary values.
Second, the cloud collects all the local predictions and constructs two agent sets by trimming a fraction of outliers with respect to the predictive means and variances.
Then the cloud uses a Byzantine-tolerant PoE aggregation rule to compute a global prediction, and broadcasts the global prediction to all the agents.
Third, the agents refine the predictions on Z ∗ by fusing the prediction from the cloud-based GPR with that from the agent-based local GPR.
Note that each agent only communicates local predictions with the cloud, and does not share its local streaming data with the cloud and other agents.
The formal description of
Byzantine-tolerant federated GPR is given in Algorithm 1.
Algorithm
1: Z [ i ] ( t ) =
{ z [ i ] (1) , . . .
, z [ i ] ( t ) } 2: y
[ i ] ( t ) =
[ y
[ i ] (1) , . . .
, y
[ i ] ( t )] T 3: for z ∗ ∈
Z ∗ do 4:
Choose z
[ i ] ∗ ( t ) ∈ proj ( z ∗ ,
Z [ i ] ( t )) 5:
Compute ˇ µ ′ z ∗ |D
[ i ] ( t ) ← (cid:26) ˇ µ
z ∗ |D
[ i ] ( t )
Benign agent , ⋆
Byzantine agent 6:
Compute ˇ σ ′ 2 z ∗ |D
[ i ] ( t ) ← (cid:26) ˇ σ 2 z ∗ |D
[ i ] ( t )
Benign agent , ⋆
Byzantine agent 7:
Send ˇ µ ′ z ∗ |D
[ i ] ( t ) and ˇ σ ′ 2 z ∗ |D
[ i ] ( t ) to the cloud 8: end for 9: return ˇ µ ′Z ∗
|D
[ i ] ( t ) , ˇ σ ′ 2 Z ∗ |D
[ i ] ( t )
3.1 Agent-based local GPR
To reduce computational complexity, we perform Nearest-neighbor (NN) GPR as the agent-based local GPR to predict for each test point z ∗ ∈
Z ∗ .
Instead of feeding the whole training dataset to
GPR, the agent-based local GPR only uses the nearest input denoted by z [ i ] ∗ ( t ) ∈ proj ( z ∗ , Z [ i ] ( t )) and its corresponding output y
[ i ] z
[ i ] ∗ ( t ) to compute the local predictions.
Notice that, computation complexity of the hyperparameter tuning for NN GPR is O ( t 3 ) .
In fact, the computation complexity of the hyperparameter tuning can be reduced to O (1) by using recursive hyperparameter tuning [21].
NN GPR in prediction has computation complexity equivalent to nearest-neighbor search, whose worst case complexity is O ( t ) [22], while full GPR in (3) has computation complexity O ( t 3 ) [23].
Denote ˇ µ ′ z ∗ |D
[ i ] ( t ) and ˇ σ ′ 2 z ∗ |D
[ i ] ( t ) the predictive mean and variance output from the agent-based local
GPR.
The predictive mean and variance of the benign agents are written in the following forms iv
ˇ µ ′ z ∗ |D
[ i ] ( t ) =
ˇ µ z ∗ |D [ i ] ( t ) , ˇ σ
[Equation]
2 z ∗ |D
[ i ] ( t ) =
ˇ σ 2 z ∗ |D
[ i ] ( t ) where
[Equation]
with ˚ k
( z [ i ] ∗ ( t ) , z
[ i ] ∗ ( t ))
≜ k ( z [ i ] ∗ ( t ) , z
[ i ] ∗ ( t ))
+ ( σ [ i ] e ) 2 I t .
When the agent is a Byzantine agent, its outputs can be arbitrary, and in this case we write ˇ µ ′ z ∗ |D
[ i ] ( t ) =
⋆ and ˇ σ ′ 2 z ∗ |D
[ i ] ( t ) =
⋆ .
The implementation of the agent-based local GPR is provided in Algorithm 2.
3.2 Cloud-based aggregated GPR
In the sequel, we consider a Byzantine-tolerant PoE aggregation rule for the cloud.
The algorithm is described as follows:
Step 1 :
For each z ∗ ∈ Z ∗ , the cloud collects potentially corrupted mean ˇ µ ′ z ∗ |D
[ i ] ( t ) and variance ˇ σ ′
z ∗ |D
[ i ] ( t ) from each agent i .
Step 2 : The cloud constructs two agent sets to tolerate Byzantine attacks
Without loss of generality, for i ∈ V , we sort ˇ µ ′ z ∗ |D
[ i ] ( t ) and ˇ σ ′ 2 z
∗
|D [ i ] ( t ) in ascending order and the corresponding agent index is kept in the sets T µ ( t ) and T σ ( t ) , such that for each i ∈ T µ ( t ) , we have ˇ µ ′ z ∗ |D
[ i ] ( t ) ≤ ˇ µ ′ z ∗ |D
[ i +1] ( t ) and for each i ∈ T σ ( t ) , we have ˇ σ ′
z ∗ |D
[ i ] ( t ) ≤ ˇ σ ′
2 z ∗ |D
[ i +1] ( t ) .
We denote by T µ max ( t ) ≜ { n − ⌊ βn ⌋ + 1 , . . . , n } a set of ⌊ βn ⌋ agents with the largest local predictive means, and by T µ min ( t ) ≜ { 1 , . . .
, ⌊ βn ⌋} a set of ⌊ βn ⌋ agents with the smallest local predictive means where β ∈ [ α, 14 ) .
Similarly, we denote trimmed sets of variance by T σ max ( t ) and T σ min ( t ) .
Then, we define
[Equation]
Notice that M ( t ) and C ( t ) include n − 2 ⌊ βn ⌋ agents with extreme values removed.
These are the agents whose predictions do not deviate much from the attack-free case.
Step 3:
Define a global training dataset as D ( t ) ≜ (cid:83) i ∈V D
[ i ] ( t ) , and a common set as I ( t ) ≜
M ( t ) (cid:84) C ( t ) .
The following lemma shows that I ( t ) is never empty.
Lemma 1 Suppose that β < 14 , it holds that (1 − 4 β ) n ≤ |I ( t ) | ≤ (1 − 2 β ) n at each time instant t .
The proof of Lemma 1 can be found in Appendix A.1.
The following lemma shows that ˇ µ ′ z ∗ |D
[ i ] ( t ) and ˇ σ ′ 2 z ∗ |D
[ i ] ( t ) for i ∈
I ( t ) are bounded by the values of the benign agents.
Algorithm 3 Cloud-based aggregated GPR: cGPR
(ˇ µ ′Z ∗ |D
[ i ] ( t ) , ˇ σ ′ 2 Z ∗ |D
[ i ] ( t ) ) 1: for t = 1 , 2 . . .
do 2:
D ( t ) =
(cid:83) i ∈V D
[ i ] ( t ) 3: for z ∗
∈
Z ∗ do 4:
Construct sets M ( t ) and C ( t ) according to (6) 5:
Compute I ( t ) =
M ( t ) (cid:84) C ( t ) 6:
Implement aggregation rule (7) 7:
Broadcast ˆ µ Z ∗ |D ( t ) and ˆ σ 2 Z ∗ |D ( t ) to all the agents 8: end for 9: end for 10: return ˆ µ Z ∗ |D ( t ) , ˆ σ 2 Z ∗ |D ( t )
Lemma 2 Let 0 < α ≤ β < 14 hold.
For i ∈
I ( t ) , we have that min j ∈V\B (cid:8) ˇ µ z ∗ |D
[ j ] ( t ) (cid:9) ≤ ˇ µ ′ z ∗ |D
[ i ] ( t ) ≤ max j ∈V\B (cid:8) ˇ µ z ∗ |D
[ j ] ( t ) (cid:9) , and min j ∈V\B (cid:110) ˇ σ 2 z ∗ |D
[ j ] ( t ) (cid:111) ≤ ˇ σ ′
2 z ∗ |D
[ i ] ( t ) ≤ max j ∈V\B (cid:110) ˇ σ 2 z ∗ |D
[ j ] ( t ) (cid:111) .
v
The proof of Lemma 2 is presented in Appendix A.2.
Given I ( t ) , we propose a Byzantine-tolerant
PoE aggregation rule below
[Equation]
Note that if all the agents are known to be benign, we can simply select β = α = 0 , and hence M ( t ) =
C ( t ) =
V .
In this case, (7) reduces to the standard PoE in [24].
Then the cloud-based aggregated
GPR returns ˆ µ Z ∗ |D ( t ) ≜
[ˆ µ z ∗ |D ( t ) ] z ∗ ∈Z ∗ and ˆ σ 2 Z ∗ |D ( t ) ≜ [ˆ σ 2 z ∗ |D ( t ) ]
z ∗ ∈Z ∗ .
The implementation of the cloud-based aggregated GPR is provided in Algorithm 3.
3.3 Agent-based fused GPR
Notice that the cloud makes predictions using more data than each local agent, and it could achieve better learning performances.
Then the agent-based fused GPR aims to refine predictions of η ( Z ∗ ) by integrating the agent-based local GPR with the cloud-based aggregated GPR.
When the cloud variance ˆ σ 2 z ∗ |D ( t ) is lower than the local predictive variances ˇ σ ′
z ∗ |D
[ i ] ( t ) , the predictions from the cloud-based aggregated GPR are used.
Otherwise, those from the agent-based local GPR are used.
Our algorithm is one-round.
The refined predictions in the agent-based fused GPR will not be transmitted back to the cloud, hence it cannot change the final aggregation.
The implementation of the agent-based fused GPR is provided in Algorithm 4.
∗
D
3.4 Performance guarantee
This section discusses the robustness of the cloud-based aggregated GPR.
We start with the assumptions of the kernel function k .
Assumption 2 1) (Decomposition).
The kernel function k ( · , · ) can be decomposed in such a way that k ( · , · ) = κ ( D ( · , · )) , where κ : R + → R ++ is continuous.
2) (Monotonicity).
It holds that κ ( s ) is monotonically decreasing in s and κ (0) =
σ 2 f .
Many existing kernel functions can satisfy Assumption 2, e.g., squared exponential kernel [13].
As [13], any non-zero mean Gaussian process can be decomposed into a deterministic process and a zero-mean stochastic process.
Without loss of generality and for notational simplicity, we assume η follows a zero-mean Gaussian process in the analysis.
Assumption 3 It satisfies that η ∼ GP (0 , k ) and η is Lipschitz continuous on Z .
The target function η is completely specified by Gaussian process with kernel function k .
This assumption is common in the analysis of GPR [25].
The Lipschitz continuity of η implies that there exists some positive constant ℓ η such that | η ( z ) − η ( z ′ )
| ≤ ℓ η D ( z , z ′ ) .
For i ∈ V , we define the dispersion of local data as d [ i ] ( t ) ≜ sup z ∈ Z D
( z , Z [ i ] ( t )) .
For notational simplicity, we denote the distance by D Z z ≜ D ( z , Z ) .
vi
We denote σ ≜
[Equation]
2 where σ max e ≜ max i ∈V { σ [ i ] e } and σ min e ≜ min i ∈V { σ [ i ] e } .
The following theorem shows that the prediction error from the cloud-based aggregated GPR is upper bounded, and characterizes the bounds of the global predictive variance.
Theorem 1 Part I: (Cloud-based aggregated GPR: Mean) Suppose 0 < α ≤ β < 14 and Assumptions 2, 3 hold.
For any z ∗ ∈ Z and 0 < δ < 1 , with probability at least 1 − δ , it holds that
[Equation]
where ∆( s ) ≜
[Equation] [Equation]
Part II: (Cloud-based aggregated GPR: Variance) Let 0 < α ≤ β < 14 and Assumption 2 hold.
For any z ∗ ∈ Z , it holds that
[Equation]
The proof of Theorem 1 is presented in Appendix A.3.
For the attack-free case, i.e., α = β = 0 , the upper bound of Part I becomes (1 −
[Equation]
ℓ
[Equation]
d max
[Equation]
) σ 2 f +( σ min e ) 2 + (cid:112) 2 σ 2 (ln 2 − ln δ ) .
We assume lim t →∞
d
[ i ] ( t ) =
for i ∈ V , the limit of the upper bound is
[Equation]
Recall that σ =
[Equation]
+( σ min e ) 2 .
Then we can see that (
[Equation]
and (cid:112) 2 σ 2 (ln 2 − ln δ ) are positively related to the maximal variance ( σ max e ) 2 of the noise.
The term ∆( d max ( t )) characterizes the performance loss caused by Byzatine agents.
First, notice that ∆( d max ( t )) is positively related to α , which provides a trade-off between the prediction error and the number of Byzantine agents.
With a larger α , our algorithm can tolerate more Byzantine agents, but the prediction error gets larger.
As α approaches zero, ∆( d max ( t )) goes to zero.
This implies that the prediction performance improves if the number of Byzantine agents is decreasing.
Second, when α is fixed, ∆( d max ( t )) is proportional to β .
This implies that learning performance improves if the set I ( t ) expands.
The upper and lower bounds in Part II are independent of α and β .
Then the variance shares the same upper and lower bounds with that in the attack-free case.
This is due to the fact that the extreme values are removed by the Byzantine-tolerant PoE in the cloud-based GPR.
As t goes to infinity, we have lim
[Equation]
This implies that the prediction uncertainty diminishes as the variance of measurement noise decreases.
Numerical experiments
This section experimentally demonstrates the performance of the proposed Byzantine-tolerant federated GPR algorithm using one synthetic dataset and two real-world datasets.
We conduct the experiments on a computer with Intel i 7 - 6600 CPU, 2 .
60 GHz and 12 GB RAM.
Synthetic dataset: For the observation model (4), we consider the target function introduced in [23]
[Equation]
with z ∈ R and e ∼ N (0 , 0 . 01) .
We generate n s = 10 3 , 5 × 10 3 , 10 4 , 5 × 10 4 training points in [0 , 1] , respectively, and choose n t = 120 test points randomly in [0 , 1] .
There are n = 40 agents in a network.
We partition the training dataset into 40 disjoint groups, and each agent is assigned with n s /n training data points.
We use the following squared-exponential kernel k ( z , z ∗ ) =
σ 2 f exp( − 12 ℓ 2 ( z − z ∗ ) 2 ) , and use Mean Square Error (MSE) to evaluate the proposed algorithm in terms of consistency, the effect of α and the effect of β in the following experiments.
In the first experiment, we let α = 2 .
We randomly choose the agents in the network to be compromised by same-value attacks [26], and let β = α .
Specifically, for each test point z ∗ , the Byzantine agents only change the local predictive means to 100 , that is, ˇ µ ′ z ∗ |D
[ i ] ( t ) = 100 for all t , and send this incorrect prediction to the cloud.
The local predictive variances for all the agents remain unchanged.
Fig.
1(a) compares the performances of the proposed Byzantine-tolerant PoE (BtPoE) with the standard PoE. As a benchmark, the bottom curve vii depicts the prediction errors of the standard PoE (AfPoE) when there is no Byzantine attack in the network; it shows that the standard PoE is consistent in the attack-free scenario.
However, when the aforementioned Byzantine attacks are launched, the top curve shows that the standard PoE can no longer remain consistent.
Note that there are 6 curves by attacked standard PoE (AedPoE), and only the closest one to the bottom curve is shown in Fig. 1(a).
We fix n s = 4 × 10 4 and α = 15% .
The prediction comparisons of these three PoEs are given in Fig.
2, which shows that the learning performance of the Byzantine-tolerant PoE is comparable to that of the attack-free standard PoE with consistency preserved.
As Byzantine attacks are launched in the network, the consistency cannot be maintained.
Therefore, our proposed algorithm is demonstrated to be resilient to Byzantine attacks.
[Figure]
[Figure]
Notice that the performance of the Byzantine-tolerant PoE increases as α , the ratio of Byzantine agents, decreases.
Fixing the training data size n s = 10 4 , we replicate the experiments for 50 times with different α and observation noise e .
Figs. 3(a) and 3(b) show that the performances of the
Byzantine-tolerant PoE are comparable to that of the attack-free standard PoE with consistency preserved.
The prediction errors for both methods are in the order of 10 − 4 , while Fig. 3(c) shows that the attacked standard PoE has prediction errors ranged from 2 .
5 to 30 .
This demonstrates that the proposed PoE aggregation rule has strong ability to tolerate Byzantine attacks.
In the second experiment, we evaluate the prediction performance with regard to β .
All associated parameters are the same as those in the above experiments.
Notice that for each α , we initially let β
= α
and then increase β to 0 .
225 with increment 0 .
025 , such that the assumption α ≤ β <is satisfied.
The results are shown in Fig. 1(b).
This shows that as the number of trimmed agents increases, the performance of the proposed algorithm grows worse, since more information is excluded in the aggregation.
This result validates the conclusion of part I in Theorem 1.
viii
[Figure]
[Table]
In the third experiment
[Table]
we conduct Monte Carlo simulations to evaluate the performance of
Byzantine-tolerant PoE on different functions.
We repeat the experiment for 50 times by sampling different functions and observation points.
Specifically, we replace sin(12 z ) in (8) with sin(12 z ) + ϵ ′ where ϵ ′ ∼ N (0 , 0 .
01 i ) , i = 1 , . .
We assign n = 40 agents in the network and sample n s = 10 4 training points in [0 , 1]
[Table]
and then choose n t = 120 test points randomly in [0 , 1] .
We also use the square-exponential kernel k ( z , z ∗ ) .
There are six Byzantine agents, i
[Table]
e., α = 15% , and we let β = α .
Experiment results are presented in Table
[Table]
and it shows that the performance of the Byzantine-tolerant PoE is comparable to that of the attack-free standard PoE, noticing that the order of the prediction errors for the Byzantine-tolerant PoE is 10 − 2 .
For comparison, the MSE by the attacked standard PoE is about 26 .
This demonstrates that the proposed Byzantine-tolerant aggregation rule is effective for learning different functions.
[Table]
/ i = 6 /fused GPR 0 .0 .0 .0 .
Moreover, we conduct additional experiments to demonstrate the learning performance improvements by applying our Byzantine-tolerant PoE and the agent-based fused GPR to the synthetic dataset.
We assign n = 40 agents in the network and sample n s = 10 4 training points in [0 , 1] , and then choose n t = 120 test points randomly in [0 , 1] .
We also use the square-exponential kernel k ( z , z ∗ ) .
There are six Byzantine agents, i.e., α = 15% , and we let β = α .
The prediction performance comparisons between the agent-based local GPR and fused GPR on agent 1 and 6 are listed in Table 2.
For a test point, the local variances ˇ σ ′ 2 z ∗ |D
[ i ] ( t ) lie in [0 .
6228] , and the global variance is ˆ σ 2 z ∗ |D ( t )
= 0 .
Table 2 shows that the learning performance of the agent-based fused GPR is better than that of the agent-based local GPR.
Note that the order of the prediction errors for the agent-based fused GPR can decrease from 10 − 2 to 10 − 3 .
This demonstrates that the comparison between variances in step 2 and step 5 in Algorithm 4 is able to improve the learning accuracy, and our algorithm is effective.
Real-world dataset: We conduct an experiment to evaluate the prediction performance with different attack magnitudes using two real-world datasets.
The first dataset is collected from a seven degrees-offreedom SARCOS anthropomorphic robot arm [13].
The goal is to learn a function η .
The input of η is 21 -dimensional including 7 joint positions, 7 joint velocities and 7 joint accelerations; whereas the output is 1 -dimensional, representing the torque of a joint.
We randomly sample 40,000 data points for training and 40 data points for testing.
In the experiment, we partition 40 , 000 training data into n = 40 disjoint groups, and assign each group to an agent.
The second dataset Kin40k [27] is created ix
[Figure]
using a robot arm simulator.
We randomly choose 9 , 000 training points and 40 test points.
We also partition the training data evenly into 40 disjoint groups.
The magnitudes of attack we consider are ± 1 , ± 10 , ± 50 , ± 100 .
We randomly sample the training data points and repeat the experiments for 50 times.
Fig.
4 shows the prediction performances.
For both real-world datasets, when the attack magnitude is increasing, the prediction errors of the attacked standard PoE largely increases, whereas those of the attack-free standard PoE and the Byzantine-tolerant PoE are consistently maintained at a low level.
It shows that the proposed Byzantine-tolerant PoE is resilient to the attack.
Conclusion
We propose a Byzantine-tolerant federated GPR algorithm, which is able to tolerate less than one quarter Byzantine agents in the network.
We derive the upper bounds on the prediction errors and the lower and upper bounds of the predictive variances.
Experiments are conducted to demonstrate the robustness of Byzantine-tolerant GPR algorithm.
Future work will focus on the comparison of the learning performance between the agent-based local GPR and the agent-based fused GPR, and the quantification of the benefits the cloud brings to the agents.
Acknowledgements
This work was partially supported by NSF awards ECCS 1846706 and ECCS 2140175.
Checklist
For all authors... (a) Do the main claims made in the abstract and introduction accurately reflect the paper’s contributions and scope?
[Yes] We enumerate the contributions in the introduction.
(b) Did you describe the limitations of your work?
[Yes] We discuss the future work in the conclusion (Section 5 ).
(c) Did you discuss any potential negative societal impacts of your work?
[No] (d) Have you read the ethics review guidelines and ensured that your paper conforms to them?
[Yes] 2.
If you are including theoretical results... (a) Did you state the full set of assumptions of all theoretical results?
[Yes] We give all required assumptions in Sections 2 . 2 and 3 . 4 .
(b) Did you include complete proofs of all theoretical results?
[Yes] We provide complete proofs of each lemma and theorem in Appendix. 3.
If you ran experiments... (a) Did you include the code, data, and instructions needed to reproduce the main experimental results (either in the supplemental material or as a URL)?
[Yes] We provide the simulation details in Section 4 .
We also include the code in the supplementary document.
(b) Did you specify all the training details (e.g., data splits, hyperparameters, how they were chosen)?
[Yes] We provide the training details including data partition in Section 4 .
(c) Did you report error bars (e.g., with respect to the random seed after running experiments multiple times)?
[Yes] We run experiments multiple times and give error bars in Section 4 .
(d) Did you include the total amount of compute and the type of resources used (e.g., type of GPUs, internal cluster, or cloud provider)?
[Yes] We include the type of CPU in Section 4.
xii
If you are using existing assets (e
g., code, data, models) or curating/releasing new assets... (a) If your work uses existing assets, did you cite the creators?
[Yes] We use two real-world datasets, SARCOS and Kin40k , in Section 4 , and we cite the creators.
(b) Did you mention the license of the assets?
[No] (c) Did you include any new assets either in the supplemental material or as a URL?
[No] (d) Did you discuss whether
and how consent was obtained from people whose data you’re using/curating?
[No] (e) Did you discuss whether the data you are using/curating contains personally identifiable information or offensive content?
[No] 5.
If you used crowdsourcing or conducted research with human subjects... (a) Did you include the full text of instructions given to participants and screenshots, if applicable?
[N/A]
Our work is not associated with research on human subjects.
(b) Did you describe any potential participant risks, with links to Institutional Review Board (IRB) approvals, if applicable?
[N/A]
Our work is not associated with research on human subjects.
(c) Did you include the estimated hourly wage paid to participants and the total amount spent on participant compensation?
[N/A]
Our work is not associated with research on human subjects.
A Proofs
In this section, we provide complete proofs for each lemma and theorem.
A.1 Proof of Lemma
Notice that |I ( t ) | = |M ( t ) (cid:84) C ( t ) | ≤ |M ( t ) | .
By definition of M ( t ) in (6), we have M ( t ) =
V \ ( T µ max ( t ) (cid:83) T µ min ( t )) .
Definitions of T µ max ( t ) and T µ min ( t ) give |T µ max ( t ) | = |T µ min ( t ) | =
⌊ βn ⌋ .
Then we have |M ( t ) | =
|V \ ( T µ max ( t ) (cid:83) T µ min ( t ))
| = n − 2 ⌊ βn ⌋ , which indicates that |I ( t ) | ≤ n − 2 ⌊ βn ⌋ .
Moreover, at time t , since M ( t ) (cid:83) C ( t ) ⊆
V , then it holds that |M ( t ) (cid:83) C ( t ) | ≤ n .
By definition of C ( t ) in (6), we have |C ( t ) | = n − 2 ⌊ βn ⌋ .
Therefore, we have |I
( t )
| =
|M ( t ) (cid:84) C ( t ) | = |M ( t ) | + |C ( t ) | − |M
( t ) (cid:83) C ( t ) | ≥ n − 4 ⌊ βn ⌋ .
Since β < 14 , we have |I
( t ) | > 0 , i.e., I ( t ) ̸ = ∅ .
A.2 Proof of Lemma
Notice that I ( t ) =
M ( t ) (cid:84) C ( t ) .
Recall that in Step 2 of Section 3.2, ˇ µ ′ z ∗ |D
[ i ] ( t ) is sorted in ascending order, i.e., ˇ µ ′ z ∗ |D
[ i ] ( t ) <
ˇ µ ′ z ∗ |D
[ i +1] ( t ) for i = 1 , 2 , . . . , n − 1 .
Recall that T µ max ( t ) = { n − ⌊ βn ⌋ + 1 , . . . , n } .
For any q ∈ T µ max ( t ) and q ′ ∈ M ( t ) , we have ˇ µ ′ z ∗ |D
[ q ] ( t ) > ˇ µ ′ z ∗ |D
[ q ′ ] ( t ) .
Suppose that there exists i ∈ M ( t ) such that ˇ µ ′ z ∗ |D
[ i ] ( t ) > max j ∈V\B (cid:8) ˇ µ z ∗ |D
[ j ] ( t ) (cid:9) , then we have i ∈ B .
For all q ∈ T µ max ( t ) , we have ˇ µ ′ z ∗ |D
[ q ] ( t ) > ˇ µ ′ z ∗ |D
[ i ] ( t ) > max j ∈V\B (cid:8) ˇ µ z ∗ |D
[ j ] ( t ) (cid:9) .
Since |T µ max ( t ) | =
⌊ βn ⌋ , then we have ⌊ αn ⌋ ≥
⌊ βn ⌋ + 1 .
It contradicts with α ≤ β .
Therefore, we have ˇ µ ′ z ∗ |D
[ i ] ( t ) ≤ max j ∈V\B (cid:8) ˇ µ z ∗ |D
[ j ] ( t ) (cid:9) for all i ∈ M ( t ) .
Likewise, we have min j ∈V\B (cid:8) ˇ µ z ∗ |D
[ j ] ( t ) (cid:9) ≤ ˇ µ ′ z ∗ |D
[ i ] ( t ) for all i ∈ M ( t ) .
Analogous to the proof of ˇ µ ′ z ∗ |D
[ i ] ( t ) , we conclude that min j ∈V\B (cid:110)
ˇ σ 2 z ∗ |D
[ j ] ( t ) (cid:111) ≤ ˇ σ ′
2 z ∗ |D
[ i ] ( t ) ≤ max j ∈V\B (cid:110) ˇ σ 2 z ∗ |D
[ i ] ( t ) (cid:111) for all i ∈ C ( t ) .
A.3 Proof of Theorem
Part I: Roadmap of the proof: We first show in Lemma 3 that at time instant t , the local predictive mean of agent i ∈ V in the attack-free scenario is a sub-Gaussian random variable.
Then notice that by triangular inequality, the prediction errors under attacks can be bounded by the magnitude of attacks plus the prediction errors in the attack-free case.
Therefore, for i ∈ I ( t ) , Lemma 4 uses concentration inequalities of sub-Gaussian random variables to quantify the upper bound of the xiii
Byzantine attacks.
We derive the upper bound of the prediction error in the attack-free case in Lemma 5.
Lemma 3 Let Assumptions 2 and 3 hold.
For agent i ∈ V and z ∗ ∈
Z ∗ , it holds that ˇ µ z ∗ |D
[ i ] ( t ) is a sub-Gaussian random variable.
Proof: Monotonicity of Assumption 2 implies that k ( z [ i ] ∗ ( t ) , z [ i ] ∗ ( t ))
= κ (0)
=
σ 2 f .
By Assumption 3, the prior mean is µ ( z ∗ ) =
µ ( z [ i ] ∗ ( t ))
= 0 .
Hence, given observation y
[ i ] z
[ i ] ∗ ( t ) =
η ( z [ i ] ∗ ( t ))
+ e
[ i ] ( t ) , by (5), the local predictive mean is computed as
[Equation]
For agent i ∈ V , we denote the expectation and variance of ˇ µ z ∗ |D
[ i ] ( t ) by E (cid:2) ˇ µ z ∗ |D
[ i ] ( t ) (cid:3) and
V ar (cid:2)
ˇ µ z ∗ |D
[ i ] ( t ) (cid:3) , respectively.
Notice that, in (9), e [ i ] ( t ) is the only random variable and e [ i ] ( t ) ∼
N (0 , ( σ [ i ] e ) 2 ) , this implies ˇ µ z ∗ |D
[ i ] ( t ) ∼ N
[Equation]
t
[Equation]
σ
[Equation]
Then for λ i ∈ R
[Equation]
we conduct the following algebraic calculations
[Equation]
Note that
[Equation]
× exp
[Equation]
= exp
[Equation]
Then we have
[Equation]
xiv
=
[Equation]
The term
[Equation]
[Figure]
[Equation]
[Figure]
[Equation]
[Figure]
[Equation]
[Figure]
[Equation]
[Figure]
[Equation]
[Figure]
[Equation]
[Figure]
[Equation]
[Figure]
[Equation]
[Figure]
[Equation]
is a Gaussian probability density function with
[Table]
and
[Table]
Recall that σ 2 = (cid:16) σ 2 f σ max e σf +( σ min e )(cid:17) 2 .
By Assumption 2, it holds that the kernel function κ ( · ) is monotonically decreasing and κ (0) =
σ 2 f .
Therefore, we have V ar (cid:2)
ˇ µ z ∗ |D
[ i
[Equation]
Substituting V ar (cid:2)
ˇ µ z ∗ |D
[ i ] ( t ) (cid:3) ≤ σ 2 into (10) yields E (cid:2) exp (cid:0)
λ i (ˇ µ
z ∗ |D
[ i ] ( t ) − E (cid:2) ˇ µ z ∗ |D
[ i ] ( t ) (cid:3) )
(cid:1)(cid:3) ≤ exp (cid:16) λ 2 i σ 2 2 (cid:17) .
Thus by Definition 1, we conclude that for agent i ∈ V , it holds that ˇ µ z ∗ |D
[ i ] ( t ) is a sub-Gaussian random variable.
■
Lemma 4 Let 0 < α ≤ β < 14 and Assumption 2 hold.
For all z ∗ ∈
Z ∗ and 0 < δ < 1 , with probability at least 1 − δ , it holds that
[Equation]
Proof:
We denote by F ( t ) ≜
I ( t ) (cid:84) ( V\B ) the set of benign agents in the set
I ( t ) .
That is, ˇ µ ′ z ∗ |D
[ i ] ( t ) =
ˇ µ z ∗ |D [ i ] ( t ) for all i ∈
F ( t ) , therefore it holds that
[Equation]
= 0 .
Recall that ˆ σ 2 z ∗ |D ( t
[Equation]
=
[Equation]
We have
[Equation]
In the remaining proof, we find the upper bound of (cid:12)(cid:12)(cid:12) ˇ µ ′ z ∗ |D
[ i ] ( t ) (cid:12)(cid:12)(cid:12) + (cid:12)(cid:12) ˇ µ z ∗ |D
[ i ] ( t ) (cid:12)(cid:12) , and characterize the lower and upper bounds of ˇ σ ′− 2 z ∗ |D
[ i ] ( t ) .
xv
[Table]
[Table] [Table]
[Table] [Table]
[Table] [Table]
[Equation]
For 0 < δ < 1 , choosing ϵ 1 ≜ (cid:112) 2 σ 2 (ln(2 n ) − ln δ ) , with probability at least 1 − δ , we have
[Equation]
Since triangular inequality renders
[Equation]
we have
[Equation]
which implies that with probability at least 1 − δ ,
[Equation]
Since | η ( z [ i ] ∗ ( t )) | ≤ ∥ η ∥ ∞ , by monotonicity of κ ( · ) in Assumption
[Equation]
it holds that max
[Equation]
σ
[Equation]
t )
[Equation]
(cid:12)(cid:12)(cid:12)(cid:12)(cid:27)
[Equation]
σ
[Equation]
f +( σ min e ) 2 .
Then with probability at least 1 − δ , we have
[Equation]
Therefore, with probability at least 1 − δ , we have
[Equation] [Equation]
The lower and upper bounds of ˇ σ ′− 2 z ∗ |D [
[Equation] [Equation]
Lemma renders that min
[Equation]
then we have (cid:16)
[Equation]
1 for all i ∈ I ( t ) .
Theorem IV.3 in [29] gives σ 2 f ( σ [ i ] e ) 2 σ
[Equation]
[Equation] [Equation]
t
[Equation]
≤
[Equation]
κ
[Equation] [Equation]
σ
[Equation]
σ
[Equation]
2 for all z ∗
∈
Z ∗ .
By monotonicity of κ ( · ) in Assumption 2, it holds that
[Equation]
which implies that for any i ∈ I ( t ) ,
z ∗ ∈ Z ∗ ,
[Equation]
max
[Equation]
xvi
Lemma 1 shows that |I ( t ) | ≥ n − 4 ⌊ βn ⌋ .
Since ⌊ βn ⌋ ≤ βn , it indicates that |I ( t ) | ≥ (1 − 4 β ) n .
Then we have
[Equation]
Since |I ( t ) (cid:84) B| ≤ |B| =
⌊ αn ⌋ ≤ αn
[Equation]
by (12)
[Equation]
with probability at least 1 − δ
[Equation]
we have
[Equation]
Combining (13) and (14) with (11) renders that with probability at least 1 − δ , it holds that
[Equation]
The following Lemma characterizes the upper bound of the prediction error in the attack-free case
[Equation]
Lemma 5 Suppose Assumptions 2 and 3 hold
[Equation]
For z ∗ ∈ Z ∗ , with probability at least 1 − δ , it holds that
[Equation]
Proof: Recall that ˇ µ z
[Equation]
z [
[Equation]
] ∗ ( t ) .
Then for i ∈ V
[Equation]
we have
[Equation]
( t ))
−
[Equation]
z
[Equation]
By triangular inequality, we have
[Equation]
[Equation]
We analyze the upper bound of each term on the right-hand side of the inequality (15).
Term 1 .
Recall that z
[ i ] ∗ ( t ) ∈ proj ( z ∗ ,
Z [ i ] ( t )) .
Using the Lipschitz continuity of η in Assumptiongives
[Equation]
Term 2 .
Recall that ˇ µ z ∗ |D
[ i ] ( t ) follows a Gaussian probability distribution and ˇ µ
z ∗ |D
[ i ] ( t ) ∼
N
[Equation]
σ 2 f +( σ [ i ] e )(cid:19)( σ [ i ] e )(cid:33) .
By Lemma 3, for all i ∈ V , we have that xvii
ˇ µ z ∗ |D
[ i ] ( t ) is a sub-Gaussian random variable.
Then by concentration inequality of the sub-Gaussian random variable (see Lemma 1.3 of [28]), for any ϵ 2 > 0 , we have
[Equation]
Combining the above inequality with ˇ µ z ∗ |D
[ i ] ( t ) =
κ ( D Z [ i ]( t ) z ∗
[Equation]
y [
[Equation]
] z [
[Equation]
] ∗ (
[Equation]
) , for 0 < δ < 1 , choosing ϵ 2 ≜ (cid:112) 2 σ 2 (ln
[Equation]
− ln δ ) , with probability at least 1 − δ , it holds
[Equation]
Term 3 .
We have | η ( z ∗ ) | ≤ ∥ η ∥ ∞ .
By monotonicity of κ ( · ) in Assumption 2, it gives
[Equation]
Therefore
[Equation]
applying the inequalities (16), (17) and (18) to (15), for 0 < δ < 1 , with probability at least 1 − δ
[Equation]
we have that for all
i ∈ I ( t ) ,
[Equation]
By (7)
[Equation]
we have 0 < ˆ
[Equation]
z
[Equation]
t ) < 1 and ˆ
[Equation]
z
[Equation]
|
[Equation]
i
[Equation]
t
[Equation]
ˇ σ
[Equation]
2 z ∗ |D
[ i ] ( t ) = 1 , which implies that with probability at least 1 − δ
[Equation]
it holds that ˆ σ
[Equation]
z
[Equation]
■
With Lemmas 3, 4 and
[Equation]
we now proceed to complete the proof of part I in Theorem 1.
Proof of part I in Theorem 1: Note that, given (7), we have
[Equation]
Since ˆ σ 2 z ∗|D ( t ) |I ( t ) | (cid:80) i ∈I ( t ) ˇ σ ′− 2 z ∗ |D
[ i ] ( t ) = 1 , then this implies that ˆ σ 2 z ∗|D ( t ) |I
( t ) | (cid:80) i ∈I ( t ) ˇ µ
z ∗ |D
[ i ] ( t ) ˇ σ ′− 2 z ∗ |D
[ i ] ( t ) − η
( z ∗ )
=
ˆ σ 2 z ∗|D ( t ) |I
( t ) | (cid:80) i ∈I ( t ) ˇ σ ′− 2 z ∗ |D
[ i ] ( t ) (cid:0) ˇ µ
z ∗ |D
[ i ] ( t ) − η
( z ∗ ) (cid:1) .
Therefore, by triangular inequality, (20) is upper bounded as
[Equation]
xviii
+ ˆ σ 2 z ∗ |D
[Equation]
t ) |I
( t ) |
[Equation] [Equation]
Then, combining this with Lemmas 4 and 5, we complete the proof of part I.
Part II: We give the upper bound and lower bound of ˆ σ 2 z ∗ |D ( t ) as follows: 1) Upper bound.
Recall that ˆ σ 2 z ∗ |D
[Equation]
t ) =
[Equation]
t
[Equation]
) ˇ
[Equation]
2 z
[Equation]
|D [ i ]( t ) .
Note that f ( x ) = 1 x is a convex function for x > 0 .
By Jensen’s inequality (see page 21 in [30]), we have f ( 1 n (cid:80) ni
=1 x i ) ≤ 1 n (cid:80) ni
=1 f ( x i ) .
Then plugging in x i = ˇ σ ′− 2 z ∗ |D
[ i ] ( t ) , we have
[Equation]
It suffices to show the upper bound of (cid:80) i ∈I ( t ) ˇ σ ′ 2 z ∗ |D
[ i ] ( t ) .
We decompose the agent set I ( t ) into two subsets F ( t ) and I ( t ) (cid:84) B where F ( t ) ≜
I ( t ) (cid:84) ( V\B ) contains the benign agents and I ( t ) (cid:84) B contains the Byzantine agents, then we have
[Equation]
We proceed to analyze each term on the right-hand side of (21).
First, notice that F ( t ) is the set of benign agents, hence it holds that ˇ σ ′ 2 z ∗ |D
[ i ] ( t ) =
ˇ σ 2 z ∗ |D
[ i ] ( t ) for all i ∈ F ( t ) .
According to Theorem IV.3 in [29], we have ˇ σ 2 z ∗
[Equation] [Equation]
2 σ
[Equation]
σ
[Equation]
) 2 for all z ∗
∈ Z ∗ .
Monotonicity of κ ( · ) in Assumption 2 shows that κ ( d max ( t )) 2 ≤ κ ( d [ i ] ( t )) 2 , which indicates κ ( d max
[Equation]
t
[Equation]
≤ κ ( d [ i ] ( t )
[Equation]
[Equation] [Equation]
] e ) 2 .
Therefore, we have (cid:88)
[Equation]
Second, by Lemma 2, we have
[Equation]
B
[Equation] [Equation]
Therefore, combining (21) with (22) and (23), the upper bound of ˆ σ 2 z ∗ |D ( t ) is given as
[Equation]
2) Lower bound.
Similar to (21), we have
[Equation]
First, it holds that ˇ σ ′− 2 z ∗ |D
[ i ] ( t ) =
ˇ σ − 2 z ∗ |D
[ i ] ( t ) for all i ∈ F ( t ) .
Theorem IV.3 in [29] gives ˇ σ 2 z ∗ |D
[ i ] ( t ) ≥ σ 2 f ( σ [ i ] e )σ 2 f +( σ [ i ] e ) 2 for all z ∗
∈
Z ∗ .
Then following the logic of deriving the above upper bound, we have
[Equation]
xix
Second, Lemma 2 implies the following inequality
[Equation]
Therefore, combining (25) with (26) and (27) yields an upper bound of (cid:80) i ∈I ( t ) ˇ σ ′− 2 z ∗ |D
[ i ] ( t ) , i
[Equation]
e.,
[Equation]
i
[Equation]
min
[Equation]
Recall that ˆ σ 2 z ∗ |D ( t ) =
[Equation]
, then we have
[Equation]
Thus
[Equation]
combining (24) and (28), the proof is complete.
xx