S ECURE D ISTRIBUTED T RAINING AT S CALE
Anonymous authors
Paper under double-blind review
A BSTRACT
Some of the hardest problems in deep learning can be solved via pooling together computational resources of many independent parties, as is the case for scientiﬁc collaborations and volunteer computing.
Unfortunately, any single participant in such systems can jeopardize the entire training run by sending incorrect updates, whether deliberately or by mistake.
Training in presence of such peers requires specialized distributed training algorithms with Byzantine tolerance.
These algorithms often sacriﬁce efﬁciency by introducing redundant communication or passing all updates through a trusted server.
As a result, it can be infeasible to apply such algorithms to large-scale distributed deep learning, where models can have billions of parameters.
In this work, we propose a novel protocol for secure (Byzantinetolerant) decentralized training that emphasizes communication efﬁciency.
We rigorously analyze this protocol: in particular, we provide theoretical bounds for its resistance against Byzantine and Sybil attacks and show that it has a marginal communication overhead.
To demonstrate its practical effectiveness, we conduct large-scale experiments on image classiﬁcation and language modeling in presence of Byzantine attackers.
I NTRODUCTION
Many hard scientiﬁc problems were solved through collaboration between many nations, groups and individuals.
This is especially evident in natural sciences, where researchers formed multinational collaborations to run large-scale experiments and share compute infrastructure (Aad et al., 2012;
Ruttley et al., 2017; Abbott et al., 2016).
Projects like Folding@home (Beberg et al., 2009) and
BOINC (Anderson, 2004) push this trend even further by recruiting volunteers that donate their compute to collectively run computational experiments at an unprecedented scale (Merritt, 2020).
Similar techniques were recently proposed for machine learning, aiming to solve two key challenges.
The ﬁrst challenge is the sheer computational complexity of many machine learning tasks, such as pretraining transformers for NLP (Devlin et al., 2019; Brown et al., 2020; Liu et al., 2019) or learning on huge datasets in vision (Sun et al., 2017; Kolesnikov et al., 2020; Goyal et al., 2021).
Recent works propose several systems (Kijsipongse et al., 2018;
Ryabinin & Gusev, 2020; Atre et al., 2021;
Diskin et al., 2021) that can share the computation across many volunteers that donate the idle time of their computers.
Despite their strengths, volunteer computing systems have so far seen limited practical applications (Kijsipongse et al., 2018).
A major roadblock towards the global adoption of these techniques is trust in reliability of each participant.
For distributed training, all progress made by the collaboration can be undermined if a single peer sends incorrect outputs due to an error in computation (Smith, 2019) or malicious intent (Tolpegin et al., 2020).
Prior art in decentralized optimization proposed several optimization algorithms that are resistant to such “Byzantine” faults.
However, most Byzantine-tolerant training protocols require either passing all updates through a trusted central server or exchanging additional messages that increase the network load by several times (Chen et al., 2018; Rajput et al., 2019).
This is a major problem for large-scale distributed deep learning, where hundreds of peers must exchange updates for millions of parameters at regular intervals (Li et al., 2020; Sergeev & Balso, 2018; Shoeybi et al., 2019).
Thus, in many practical scenarios, the computation and communication overhead of Byzantine-tolerant algorithms outweighs the potential beneﬁts of collaborating with others.
In this work, we set out to solve this problem by proposing a novel distributed training protocol designed for large-scale deep learning workloads.
Our approach combines the scalability and communication efﬁciency of modern distributed training techniques such as All-Reduce SGD (Sergeev & Balso, 2018) with resilience against Byzantine and Sybil attackers.
To achieve this, we leverage distributed system security techniques to verify the integrity of training with minimal overhead that does not depend on the model size.
Our protocol does not require trusted peers, operating under the assumption that anyone can be an attacker.
Our contributions can be summarized as follows:
• We propose a novel strategy for decentralized Byzantine-tolerant training where the extra communication cost does not depend on the number of parameters.
• We rigorously analyze the proposed strategy and prove convergence bounds for convex and nonconvex losses with Byzantine attackers.
Furthermore, we derive accelerated convergence rates for the same task under realistic assumptions about model gradients.
• Based on the above algorithm, we describe a system that allows multiple parties to train a shared model with zero trust assumptions.
We prove that this system is resistant to both Byzantine and Sybil attacks from a computationally constrained attacker.
• We verify the effectiveness of our algorithm through both controlled experiments 1 and actual large-scale training runs.
Speciﬁcally, we start with ResNet-18 for CIFAR-10 classiﬁcation and follow up with pretraining ALBERT-large in a setup where almost half of all peers are malicious.
R ELATED WORK 2. D ISTRIBUTED DEEP LEARNING
Nowadays, training neural networks often requires the amount of computation that is infeasible to achieve on any single machine.
As a result, one has to train such models on multiple machines using specialized distributed training methods.
Most of these methods fall into two groups: in data-parallel training, each worker trains the entire model by sampling batches from the training data (Sergeev &
Balso, 2018; Goyal et al., 2017); in contrast, model-parallel training allocates parts of the model on different workers (Huang et al., 2019; Narayanan et al., 2019; Shoeybi et al., 2019).
In this study, we consider only the ﬁrst group; notably, most model-parallel systems still rely on data parallelism between nodes at the same stage (Rajbhandari et al., 2020; Narayanan et al., 2021).
Usually, data-parallel training consists of two phases: ﬁrst, each worker computes the gradients over its data; then, all workers aggregate the gradients and run an SGD step.
The simplest aggregation strategy is known as Parameter Servers (PS) (Li, 2014;
Dean et al., 2012; Recht et al., 2011): one of the servers stores and updates the model parameters, while all others iteratively compute the gradients, send them to the PS, and download the updated parameters.
This strategy can be quite efﬁcient with a small number of workers; as it increases, the parameter server eventually becomes unable to handle the load.
Gradient compression (Seide et al., 2014; Lin et al., 2018; Mishchenko et al., 2019;
Koloskova et al., 2020) or local updates (Zinkevich et al., 2010) can partially alleviate this issue, but it remains a fundamental bottleneck of the approach.
In practice, most distributed training systems leverage All-Reduce (AR) (Goyal et al., 2017; Mikami et al., 2019; You et al., 2020) — a family of collective communication protocols that allow servers to average their data and receive the result on each machine.
The resulting method, named All-Reduce
SGD (AR-SGD), runs AR on local gradients of each peer to compute the global average.
Usually,
AR-SGD uses bandwidth-optimal versions of All-Reduce (Sergeev & Balso, 2018; Patarasuk & Yuan, 2009); depending on the exact algorithm, they require each peer to transfer O ( d ) or O ( d log n ) data when averaging a vector of size d across n peers (compared to O ( dn ) for PS).
2. B YZANTINE - TOLERANT OPTIMIZATION
Standard distributed training methods are not robust against Byzantine attacks.
In the vanilla parallel
SGD, one malicious worker can break the convergence of the whole method by shifting the mean of the resulting vector in an arbitrary way.
Therefore, the research community invented specialized algorithms that can train models even in this setup.
These algorithms are different in nature and provide an extra layer of complexity on top of distributed training methods described in Section 2.1.
Parameter-server (PS) based approaches.
Majority of the algorithms designed to be Byzantineresilient rely on the existence of a trusted parameter-server.
In such approaches, the standard mean estimator, e.g., the one used in parallel SGD, is typically substituted by a more robust aggregation rule (Blanchard et al., 2017; Yin et al., 2018;
Damaskinos et al., 2019; El Mhamdi et al., 2018; Pillutla et al., 2019).
However, recent works show that it is not enough via proposing the special types of
Byzantine attacks (Baruch et al., 2019; Xie et al., 2020) and showing that permutation-invariant algorithms cannot converge to any predeﬁned accuracy of the solution (Karimireddy et al., 2020).
Although several approaches aiming to circumvent this issue exist, most of them have signiﬁcant limitations such as no convergence analysis (Chen et al., 2018; Rajput et al., 2019;
Rodríguez-Barroso et al., 2020; Xu & Lyu, 2020), too restrictive assumptions in the analysis (Alistarh et al., 2018;
Allen-Zhu et al., 2021; Regatti et al., 2020), or the usage of variance-reduced estimators (Wu et al., 2020), which are known to converge slowly in deep learning applications (Defazio & Bottou, 2019).
The only paper without such limitations is (Karimireddy et al., 2020), where the authors propose a new aggregation rule called C ENTERED C LIP , apply it to SGD with client momentum, and prove convergence results for the obtained method in the non-convex case under reasonable assumptions.
We provide more details on Byzantine-tolerant PS based approaches in Appendix A.1.1.
Decentralized approaches for Byzantine-tolerant optimization are studied only in a few papers.
Unfortunately, the known approaches are not well-suited for distributed deep learning since they either rely on full gradient computations (Yang & Bajwa, 2019a;b) or use redundant communications with multiple servers (El-Mhamdi et al., 2020), or require peer-to-peer communication of full vectors at each step (Gupta et al., 2021; Gupta & Vaidya, 2021), which is not scalable, or provide the convergence guarantees that are inferior to non-parallel SGD (Peng et al., 2021), which has prohibitively slow convergence on modern deep learning tasks.
Further details on Byzantine-tolerant decentralized approaches are deferred to Appendix A.1.2.
2. S ECURITY IN DISTRIBUTED SYSTEMS
In this work, we circumvent the restrictions of existing Byzantine-tolerant techniques using the following approaches from the ﬁeld of distributed system security.
Broadcast channels.
Several key stages of our algorithm require peers to send a certain value to all their groupmates.
Since we rely exclusively on peer-to-peer connections, a malicious peer could violate this process by deliberately sending different values to each participant.
To protect against this attack, distributed systems can use broadcast channels built on top of the protocols for Byzantine broadcast (Pease et al., 1980; Dolev & Strong, 1983; Hirt & Raykov, 2014).
These protocols ensure that the peers agree on the same broadcasted value even if some of them are malicious.
We provide more details on the Byzantine broadcast protocols and their guarantees in Appendix A.2.1.
Multi-party random number generators.
To ensure that peers compute gradients honestly, our approach veriﬁes a random subset of all computed gradients.
These veriﬁcations would not be effective if malicious peers could predict (or inﬂuence) whether they are going to be veriﬁed.
Hence, we need to choose who is going to be checked in such a way that the attackers can neither predict nor inﬂuence the random draw.
This can be done with a multi-party random number generator (MPRNG) based on a multi-party coin tossing protocol, such as the protocol from Blum (1983).
We provide an overview of these techniques in Appendix A.2.2.
M ETHOD
We consider secure distributed training on public datasets, where each peer can access the entire training data and communicate with any other peer.
In this scenario, multiple parties cooperate by combining their computational resources for a single large-scale training run.
More precisely, we consider a data-parallel training setup with All-Reduce SGD, as described previously in Section 2.1.
We describe our strategy in several stages, progressively moving from the theoretical setup to real-world distributed training:
• Section 3.1 outlines our approach for B yzantine- T olerant
A ll- R e d uce (BTARD).
[Figure]
• In Section 3.2, we formulate the underlying optimization problem and derive convergence bounds.
• In Section 3.3, we propose a decentralized system design for distributed training with zero trust.
3. B YZANTINE -T OLERANT A LL -R EDUCE
We assume that some workers can be malicious, i.e., they can arbitrarily deviate from our algorithm: for instance, send arbitrary vectors instead of the stochastic gradients or violate the communication protocol.
Such workers are denoted as Byzantine nodes or just Byzantines .
We assume them to be omniscient (Karimireddy et al., 2020) (except for the honest nodes’ private keys and the internals of MPRNG) and able to collude with each other.
We denote the set of all “good” workers as G and the set of Byzantine workers as B .
We further assume that B is ﬁxed throughout the optimization process, and less than a half of the nodes are Byzantine: |B| ≤ δn , where δ ∈ [0 , 1 / 2 ) .
Finally, we assume that all workers have access to the data deﬁning the objective function, so they can sample minibatches from the full dataset.
We design our algorithm in such a way so that all types of Byzantine faults have limited effect and a chance of being discovered.
Together, these properties impose a limit on the total damage that an attacker can do over the entire training run.
To control the magnitude of attacks over a single
SGD step, we modify All-Reduce with a robust aggregation technique known as C ENTERED C LIP (Karimireddy et al., 2020).
Speciﬁcally, we use Butterﬂy All-Reduce 3 (Li et al., 2017) and apply
C ENTERED C LIP in parallel to each partition of the gradient vector.
We refer to this procedure as
B UTTERFLY C LIP (Algorithm 2).
However, Byzantine peers can circumvent robust aggregation by attacking over many iterations.
To protect against this, BTARD periodically chooses random peers to serve as validators .
The validators must recalculate the gradients of other peers and report any discrepancies instead of computing their own gradients.
However, such tests are only effective if the attackers cannot predict when they will be validated 4 .
To ensure that, we use the multi-party random number generator described in Section 2.3.
After each training step, peers use MPRNG to choose m validators and m peers to validate (each validator checks one peer).
As a result, malicious peers cannot predict “safe” iterations before they commit to an attack.
Thus, any persistent attacker will eventually be found by an honest validator.
However, since validators can also be malicious, BTARD uses a separate accuse procedure to root out false reports.
Before each averaging round, peers broadcast the hash of their gradients for that round.
These values serve the same purpose as commitments in MPRNG.
If peer i accuses peer j of modifying gradients, all other peers must also recalculate j ’s gradients.
If the majority ﬁnds that j is innocent, the accusing peer i is banned instead (Hammurabi & Harper, 1904).
The resulting algorithm is resilient to attacks made through incorrect gradients.
However, malicious peers may also harm training by violating the C ENTERED C LIP procedure for the portion of gradients they are aggregating.
Fortunately, we can design a test through which peers can verify that the vector they received was indeed the output of C ENTERED C LIP .
To formulate this test, we need to view
C ENTERED C LIP as a ﬁxed-point iteration for the equation:
[Equation]
The workers are not able to test whether (1) holds directly since collecting (cid:126)g i would lead to O ( dn ) extra communication, defeating the purpose of our algorithm.
Instead, workers should use MPRNG to sample a random direction (cid:126)z in the space of model gradients.
Then, each peer computes the inner product (2) and sends it through the broadcast channel (as described in Section 2.3):
[Equation]
Finally, all peers verify that (cid:80) ni
=
s i = 0 .
Similarly to our previous use of MPRNG, all aggregators must commit to their aggregation results before they learn (cid:126)z .
This ensures that a malicious aggregator cannot modify the results in such a way that the difference would be orthogonal to (cid:126)z (this and more complex attack vectors are reviewed and analyzed in Appendices C and D.3).
We combine all these procedures in Algorithm 1 (see its intuitive scheme in Figure 1 and a more formal version in Algorithm 6).
While gradients g i , random vector z , and some other variables are not the same during different steps, we omit the step index t in their notation for brevity.
We review communication and computational complexity of the algorithm in Appendix B.
Input: rank i , model x 0 , seed ξ 0 i , step count T , peer count n 1: for t ∈ 0 , . .
, T − 1 do 2: g i =
C OMPUTE G RADIENTS ( x t , ξ ti ) 3: ˆ g = B UTTERFLY C LIP ( i, g i ) 4: r t =
MPRNG () 5: z = G ET R ANDOM V ECTOR ( r t ) 6: for j ∈ 1 , . . .
, n do 7: //
ˆ g [ j ] is the aggregated part from peer j 8: ∆ ji =( g i [ j ] − ˆ g [ j ]) min (cid:110) 1 , τ (cid:107) g i
[ j ] − ˆ g [ j ] (cid:107)(cid:111) 9: broadcast s ji = (cid:104)
z
[ j ] , ∆ ji (cid:105) 10: for j ∈ 1 , . . . , n do 11: //
We know ∆ ij from C ENTERED C LIP 12: if s ij (cid:54) = (cid:104) z
[ j ] , ∆ ij (cid:105) then 13:
A CCUSE (i, j, s ij is wrong) 14: if (cid:80) n t s jt (cid:54)
=
then 15: //
Peer j veriﬁed
that s j · are correct 16:
A CCUSE (i, j, ˆ g [ j ] is wrong) 17: x t +1 = SGDS TEP ( x t , ˆ g ) 18: ξ t +1 i
= hash
( r t || i ) 19: if i ∈ C HOOSE V ALIDATORS ( r t ) then 20: j = C HOOSE T ARGET ( r t , i ) 21:
V ALIDATE P EER ( j, x t , ξ tj , c j , h
* j , s * j ) 22: // ... instead of computing gradients 23: // for step t + 24: return x T
Input: rank i , gradients g i ∈
R d 1: g i [1] , ..., g i [ n ] = S PLIT
( g i , n ) 2: broadcast ∀ j, h ji = hash
( g i [ j ]) 3: send ∀ j, g i
[ j ] → peer j 4: receive ∀ j, g j
[ i ] ← peer j 5: verify ∀ j, hash ( g j [ i ]) =
h ij 6: ˆ g i =
C ENTERED C LIP ( g 1 [ i ] , ..., g n [ i ]) 7: send ∀ j,
ˆ g i
→ peer j 8: receive ∀ j, ˆ g j ← peer j 9: return M ERGE (ˆ g 1 , ..., ˆ g n )
Input: accuser i , target j 1: g j = C OMPUTE G RADIENTS ( x t , ξ tj ) 2: if ∃ k : ( hash ( g j [ k ]) (cid:54) =
h kj 3: or s kj (cid:54) =
(cid:104)
z [ k ] , ∆ kj (cid:105) ) or (cid:80) nk
=1 s jk (cid:54) =
then 4:
V OTE F OR B AN (peer j ) 5: // ...
and everyone who covered it up 6: else 7:
V OTE F OR B AN (peer i ) 8: for k ∈ 1 , . .
. , n do 9: if N UM V OTES ( peer k ) ≥ n/ 2 then 10:
B AN ( peer k )
3. C ONVERGENCE ANALYSIS
From the perspective of optimization theory, our task is the expectation minimization problem:
[Equation]
Here, the objective function f is smooth and uniformly lower bounded, Q ⊆
R d is a closed convex set of admissible parameters and ξ is the source of stochasticity, such as minibatch indices.
We assume that the problem (3) can be solved in a distributed manner, i.e., one can use n workers performing (mini-batched) stochastic gradients calculations in parallel and communicating according to some protocol.
For simplicity, we will deﬁne the set of workers as [ n ] := { 1 , 2 , . . . , n } = G (cid:116) B .
There are many ways for Byzantines to affect the training.
To simplify further analysis, we group these strategies into 4 broad categories: (i) gradient attacks , where Byzantines modify their g ki , but otherwise behave normally; (ii) aggregation attacks , where Byzantine aggregator returns wrong ˆ g i and relies on others to cover it up by misreporting s i ; (iii) reputation attacks such as frame-up or slander via false A CCUSE ( i, j, · ) ; and ﬁnally, (iv) protocol errors are any other deviations from the steps of Algorithm 1, e.g. refusing to send any data.
We elaborate on each attack type in Appendix C.
For the purpose of this analysis, the latter two attacks can be repelled with an extra policy that allows an active worker to eliminate any other worker at the cost of also being banned.
Whenever a benign peer i encounters a protocol error from another peer j , it invokes that policy to remove both himself and peer j from training.
The design of this policy ensures that every invocation, whether by normal or Byzantine peers, eliminates at least 1 Byzantine peer and at most 1 benign peer.
Thus, if a Byzantine minority uses this against benign peers, this will only decrease their relative numbers: ( δn − 1) / ( n − 2) < δ .
This leaves us with two attacks that both target the aggregated gradients.
We provide convergence guarantees for variants of BTARD-SGD with Q = R d under different sets of assumptions about the function f and its stochastic gradients.
Our ﬁrst two setups assume, that:
Assumption 3.1.
There exist such constant σ ≥ 0 , s 0 ∈
[ d ] that for any set of indices S
= ( i 1 , . .
, i s ) , 1 ≤ i 1 < i 2 < . . .
<
i s ≤ d , s ≥ s 0 stochastic gradient ∇ f ( x, ξ ) satisfy
[Equation]
where ∇ [ S ] f ( x, ξ ) = ( ∇ i 1 f ( x, ξ ) , . .
, ∇ i s f ( x, ξ )) (cid:62) , ∇ [ S ] f ( x ) = ( ∇ i 1 f ( x ) , . .
. , ∇ i s f ( x )) (cid:62) , and ∇ f j ( x, ξ ) , ∇ j f ( x ) are j -th components of ∇ f ( x, ξ ) and f ( x ) respectively.
Here, (4) is an extension of the classical uniformly bounded variance (UBV) assumption (Nemirovski et al., 2009; Ghadimi & Lan, 2012; 2013) ensuring that the noise in all subvectors of large enough dimension has the variance dependent on the ratio between the dimension of the subvector s and the dimension of the full vector d .
For example, it holds when the noise is isotropic.
Moreover, one can relax this assumption to the standard UBV assumption, if blocks for aggregation in BTARD are chosen uniformly at random (see Appendix E.3.1 for further details).
In order to further reduce overhead from Veriﬁcation 3 in the full Algorithm 6, we also assume that the stochastic gradient distributions have sub-quadratically decreasing tails (see details in Appendix E.3.1).
Assumption 3.2.
There exist such constant σ ≥ 0 , s 0 ∈
[ d ] that for any set of indices S
= ( i 1 , . .
, i s ) , 1 ≤ i 1 < i 2 < . . .
<
i s ≤ d , s ≥ s 0 stochastic gradient ∇ f ( x, ξ ) satisfy
P 
[Equation]
(cid:13)(cid:13)(cid:13)(cid:13)
[Equation]
(cid:13) (cid:13)(cid:13)(cid:13)(cid:13)
[Equation]
tsσ
[Equation]
kd    <t 2 , ∀ t > 0 , (5) where ξ 1 , . .
. , ξ k are i.i.d.
samples from D , and ∇ [ S ] f ( x, ξ ) , ∇ [ S ] f ( x ) are deﬁned in As. 3.1.
Under these assumptions, we derive the following convergence bounds for strongly convex, generally convex, and non-convex objectives (see Table 1).
The respective proofs are deferred to Appendix E.4.
Let us brieﬂy discuss the main properties of the derived results.
When δ = 0 , i.e., there are no
Byzantine peers, we recover the tightest known rates for parallel SGD for strongly convex, generally convex, and non-convex objectives with both sets of assumptions.
Next, we notice that in all complexity bounds in the known |B a k | case, the term depending on the ratio of Byzantine workers δ (the third one in all bounds) has better dependence on the accuracy of the solution ε than the classical variance term (the second one in all bounds).
Therefore, for sufﬁciently small ε , the derived complexity bounds are the same as in the case when there are no Byzantine workers and parallel
SGD is used.
However, these bounds are obtained under the assumption that all participants know the exact number of attacking Byzantine workers at each iteration, which is not realistic but helps to better adjust clipping parameter τ in C ENTERED C LIP .
[Table]
As. 3.1+ As. 3.
[Table]
+ known |B
ak |
As. 3.1 + As. 3.
[Table]
As for the more general case
[Table]
the third term is much worse than the corresponding term in the previous setup.
Nevertheless, the term that depends on the ratio of Byzantine workers δ has the same dependence on ε as in the known |B
ak | case.
This implies that for sufﬁciently small ε the derived complexity bounds are the same as in the case when there are no Byzantine workers and parallel SGD is used.
For complete formulations, proofs and other details we refer the reader to Appendix E.3.
So far, all our convergence results rely on As. 3.2, i.e., that the stochastic gradients have not too heavy tails.
This assumption holds for many real-world neural networks.
However, there are important NLP tasks such as BERT training (Zhang et al., 2020), where the noise in the stochastic gradient has such a heavy noise that As. 3.2 becomes unlrealistic.
The third and ﬁnal setup in our analysis aims to address such heavy-tailed problems with BTARD-C LIPPED -SGD (see full
Algorithm 8 in appendix).
We analyse the method under the assumption that α -th moments of the stochastic gradients are uniformly upper-bounded for some α ∈ (1 , 2] .
We notice that for α < 2 this assumption allows the variance of the stochastic gradient to be unbounded.
In this setting, we prove that BTARD-C LIPPED -SGD ﬁnds an ε -solution of the convex problem after
O (cid:16) ε − α / ( α − 1) (cid:16) 1 + (cid:0) n √ δ / m (cid:1) α / ( α − 1) (cid:17)(cid:17) iterations when the number of attacking Byzantine peers is known at each iteration and O (cid:16) ε − α / ( α − 1) (cid:16) 1 + (cid:0) n 2 δ 2 / m (cid:1) α / ( α − 1) (cid:17)(cid:17) iterations otherwise.
One can ﬁnd the full statements and complete proofs of our results in Appendix E.
3. R ESISTING S YBIL ATTACKS
The algorithm described in Section 3.1 operates with a pre-deﬁned list of peers that can only decrease in size.
However, many real-world scenarios would beneﬁt from new peers joining midway through training.
Unfortunately, this exposes the system to Sybil attacks (Douceur, 2002), when a single computationally constrained attacker adopts multiple pseudonymous identities in order to establish a dishonest majority and break the algorithm.
To handle this, one may augment BTARD with a heuristic protocol that dictates how new peers can join.
A new participant must prove that it has honestly computed enough gradients over multiple continious iterations before it is allowed to actually contribute to the training.
This ensures that the inﬂuence of Sybil attackers is proportional to their computing power (see details in Appendix F).
E XPERIMENTS 4. CIFAR10 CLASSIFICATION
First, we evaluate our approach with a realistic image-classiﬁcation workload in controlled conditions.
Our setup is a ResNet-18 (He et al., 2015) model trained to solve the CIFAR10 classiﬁcation task (Krizhevsky et al.).
We train the model on 16 peers (each peer processes 8 samples per batch) using the SGD with Nesterov (1983) momentum and the cosine annealing learning rate (Loshchilov & Hutter, 2017).
We deliberately use a tuned setup that achieves 93.5% test accuracy in order to measure how Byzantine attacks affect this training outcome.
[Figure]
We evaluate our method with constant τ = 10 (weaker clipping) and with τ = 1 (stronger clipping).
These values were chosen based on the maximal standard deviation of the gradient parts averaged by the workers during normal training, so that almost no vectors are clipped for the weaker clipping and approximately half of the vectors are clipped for the stronger clipping scenario.
BTARD randomly selects 1 validator on each step.
If the validator happens to be Byzantine, it does not accuse its peers.
We compare our method to the regular All-Reduce without clipping and the baselines that use a trusted parameter server (the original variant of C ENTERED C LIP (Karimireddy et al., 2020), the coordinate-wise and geometric medians).
Some other popular robust aggregation techniques are omitted because they were shown to be inferior (Karimireddy et al., 2020).
We run all iterative algorithms (such as C ENTERED C LIP ) to convergence with (cid:15) =
10 − 6 , as we have found that limiting the number of iterations can signiﬁcantly decrease the ﬁnal model quality (see Fig. 7 in Appendix I.1).
In addition to training convergence, we evaluate our setup in presence of malicious peers.
To test pessimistic conditions, we pick a setting where 7 of 16 peers are Byzantine (other setups can be found in Appendix I.1).
We experiment with the following attack types:
• S IGN FLIPPING : each attacker sends the opposite of its true gradient.
• R ANDOM DIRECTION : all attackers send large vectors pointed at a common random direction.
• L ABEL FLIPPING : each attacker computes its gradient based on the cross-entropy loss with ﬂipped labels.
For CIFAR-10, we replace label l ∈ { 0 , ..., 9 } with 9 − l .
• D ELAYED GRADIENT : attackers send their real gradients delayed by 1000 steps.
We further amplify the Byzantine gradients from the ﬁrst two attacks by a large coefﬁcient λ
=so they would dominate the aggregated gradient if no clipping is used.
While in practice such attacks can be identiﬁed right away due to the large gradient norms, we deliberately avoid doing that to test our clipping approach.
We also evaluate common low-magnitude attacks (Baruch et al., 2019; Xie et al., 2020; Allen-Zhu et al., 2021) in Appendix I.4.
For each experiment conﬁguration, Byzantines behave honestly prior to step s , then simultaneously attack on each subsequent step until they are banned (another setup with the Byzantines attacking periodically is reported in Appendix I.1).
We consider attacks in two training regions: early stages ( s = 1000 ) and closer to convergence ( s = 10 , 000 ).
We repeat each experiment 5 times and report the mean and range of the test accuracy during at least 2000 steps after all Byzantines are banned.
In our experiments, this usually happened within 150 steps after s .
The results are shown in the Fig.
Comparing to the All-Reduce baseline, we note that our method does not worsen the speed of convergence.
On average, the ﬁnal test accuracy is 0.6% worse for τ = 1 and 0.1% better for τ = 10 .
The two most effective attacks (in terms of accuracy) are the
[Figure]
random direction and sign ﬂipping.
The effect of label ﬂipping is smaller, and the effect of delayed gradients is almost undetectable.
4. P RE - TRAINING TRANSFORMERS
For our second experiment, we choose a more compute-intensive and hyperparameter-sensitive model with adaptive optimizers to demonstrate that our approach may be applied to models that are commonly used in distributed training scenarios.
Our setup is pre-training the ALBERT-large model (Lan et al., 2019) on the Wikitext 103 dataset (Merity et al., 2017) using LAMB (You et al., 2020).
Since the original ALBERT setup uses gradient clipping, we use BTARD-C LIPPED -SGD
(see
Alg. 8 in Appendix).
We train the model on 16 machines that jointly accumulate 4096 samples for every batch.
Similarly to the previous section, we evaluate two conﬁgurations with τ = 0 .
5 (weaker clipping) and τ = 0 .
125 respectively, in addition to an All-Reduce baseline.
To evaluate Byzantine tolerance, we also use 7 out of 16 Byzantine workers, 1 validator and two attack regions: s =and s = 5000 .
We omit reporting of the delayed gradient attack as we have found it completely ineffective.
The full conﬁguration of this experiment is provided in Appendix H.
The results shown in Figure 3 demonstrate a pattern similar to the previous section.
During normal training, both τ values had no signiﬁcant effect on the training progress, reaching 1.3% larger loss in the worst case.
However, τ = 0 .
125 shows signiﬁcantly faster recovery from all three attacks.
One important observation from these experiments is that while some attacks signiﬁcantly increase the loss function, the model returns to the previous loss value much faster than it takes to reach the same loss when training from scratch.
We further study the computation overhead of BTARD in this setup in Appendix I.2 and provide the experiments with a larger number of peers in Appendix I.3.
C ONCLUSION
In this work, we formulated BTARD-SGD — a Byzantine-tolerant training strategy for large neural networks.
We veriﬁed its robustness and effectiveness through rigorous theoretical analysis and large-scale distributed training experiments.
While our research is mostly algorithmical, it can open new opportunities in many deep learning applications.
Perhaps the most important one is making it possible to train large neural networks in a cooperative manner.
BTARD-SGD could allow small research groups to host open cooperative training projects where the training hardware is crowdsourced by volunteers around the world.
Alternatively, a group of small companies could collectively compete with larger corporations by combining their compute clusters.
While these applications also require engineering effort to become practical, our algorithm ensures that they can run securely without the need to carefully screen every potential participant. Introduction
2 Related work 2.1 Distributed deep learning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
2.2 Byzantine-tolerant optimization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
2.3 Security in distributed systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
3 Method 3.1 Byzantine-Tolerant All-Reduce . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
3.2 Convergence analysis . . . . 3.3 Resisting Sybil attacks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 Experiments 4.1 CIFAR10 classiﬁcation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.2 Pre-training transformers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
5 Conclusion
A Additional related work
A.1 Byzantine-tolerant optimization: additional details . . . . . . . . . . . . . . . . . . . . . . .
A.1.1 Parameter-server (PS) based approaches . .
A.1.2 Decentralized approaches . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
A.2 Security in distributed systems: additional details . . . . . . . . . . . . . . . . . . . . . . . .
A.2.1 Broadcast channels . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
A.2.2 Multi-party random number generators . . . . . . . . . . . . . . . . . . . . . . . . .
B Network and compute overhead of BTARD-SGD
C Overview of attack vectors
D Detailed algorithm description
D.1 BTARD and CenteredClip . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
D.2 Protocols for banning Byzantine peers . . .
D.3 BTARD-SGD and detecting protocol violations . E
Convergence analysis
missing proofs and extra
details E.1 Preliminaries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
E.2 Impossibility of Byzantine-tolerant learning in heterogeneous case . . . . . . . . . . . . . . .
E.3 Convergence guarantees for BTARD-SGD . . . . . . . . . . . . . . . . . . . . . . . . . . .
E.3.
On Assumptions 3.1 and 3.2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
E.3.2 Quality of the aggregation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
E.3.3 Non-convex case . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
E.3.4 Convex case . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
E.3.5 Strongly convex case: Restarted-BTARD-SGD . . . . . . . . . . . . . . . . . . . . .
E.4 Convergence guarantees for BTARD-Clipped-SGD . . . . . . . . . . . . . . . . . . . . . . .
E.4.1 Quality of the aggregation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
E.4.2 Convex case . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
E.4.3 Strongly convex case: Restarted-BTARD-Clipped-SGD . . . . . . . . . . . . . . . .
F Reputation system for public collaborations
G Secure distributed hash tables
H ALBERT experiment setup
I Additional experiments
I.
Extra evaluations on the CIFAR10 classiﬁcation task . . . . . . . . . . . . . . . . . . . . . .
I.
Evaluating computation overhead in terms of wall time . .
I.
Experiments at a larger scale . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
I.
Experiments with low-magnitude attacks . . . . . . . . . . . . . . . . . . . . . . . . . . . .
A A DDITIONAL RELATED WORK A. B YZANTINE - TOLERANT OPTIMIZATION : ADDITIONAL DETAILS
In this section, we provide extra details on the related work discussed in Section 2.2.
The summary of complexity results is presented in Table 2.
A.1. P ARAMETER - SERVER (PS) BASED APPROACHES
There is a quite large number of papers on Byzantine-tolerant optimization that aim to robustify parallel SGD in the case when a trusted parameter-server (PS) is available.
Since in the classical parallel SGD even one Byzantine worker can break the convergence of the whole method by shifting the mean of the resulting vector in an arbitrary way, it is natural to substitute averaging of the vectors received from the workers by a more robust aggregation rule, e.g., Krum (Blanchard et al., 2017), coordinate-wise median, trimmed median (Yin et al., 2018), Multi-Krum
(Damaskinos et al., 2019), Bulyan (El Mhamdi et al., 2018), geometric median (Pillutla et al., 2019).
However, all these methods were shown to be brittle and not robust to special types of Byzantine attacks (Baruch et al., 2019; Xie et al., 2020; Karimireddy et al., 2020).
Moreover, Karimireddy et al.
(2020) show that all permutation-invariant algorithms cannot converge to any predeﬁned accuracy of the solution, meaning that simple application of some aggregation rules on top of SGD does not lead to Byzantine tolerance.
There are several approaches to circumvent this issue.
Alistarh et al.
(2018) propose B YZANTINE SGD and prove the convergence results for convex problems.
Allen-Zhu et al.
(2021) extend this approach to handle non-convex problems as well.
In both papers, the key idea is based on applying the concentration properties of the sums depending on the stochastic gradients as well as iterative removing of Byzantine peers.
However, theoretical guarantees from Alistarh et al.
Allen-Zhu et al.
(2021) rely on the restrictive assumption that the noise in the stochastic gradients is uniformly bounded with probability 1 .
Bulusu et al.
(2020) propose similar approach to the one from (AllenZhu et al., 2021) but analyze their method under more restrictive assumptions (boundedness of the gradient).
Next, Wu et al.
(2020) propose a Byzantine-tolerant version of parallel SAGA (Defazio et al., 2014), i.e., variance-reduced version of SGD, with geometric median as an aggregation rule —
B YRD -SAGA – and prove its convergence for strongly convex objectives.
However, the authors do not establish the convergence of B YRD -SAGA to any predeﬁned accuracy of the solution.
Moreover, variance-reduced methods are known to converge slowly in deep learning applications (Defazio &
Bottou, 2019), which limits the practical utility of B YRD -SAGA.
Finally, Karimireddy et al.
(2020) propose a new aggregation rule called C ENTERED C LIP , apply it to SGD with client momentum, and prove convergence results for the obtained method in the non-convex case under reasonable assumptions.
Alternative lines of work achieve Byzantine-tolerant optimization through redundant computations (Chen et al., 2018; Rajput et al., 2019) or reputation-based approaches (RodríguezBarroso et al., 2020; Regatti et al., 2020; Xu & Lyu, 2020).
Unfortunately, these papers either do not contain theoretical (non-asymptotic) convergence results for the proposed methods or rely on too restrictive assumptions in the analysis.
See more references in the recent survey by Lyu et al.
A.1. D ECENTRALIZED APPROACHES
Byzantine-tolerant optimization methods for decentralized communication architectures are studied only in a couple of papers.
Yang & Bajwa (2019a;b) consider a speciﬁc scenario when workers compute full gradients, local loss functions on peers are heterogeneous, and the trimmed coordinatewise median is used as an aggregation rule.
In this setup, the authors prove convergence results in the strongly convex case to some accuracy depending on the heterogeneity level of local loss functions, which is natural in the presence of Byzantine peers.
However, these results are not applicable to a wide range of practically important problems where stochastic gradients have to be used.
This issue was partially resolved in Peng et al.
(2021), where the authors propose a version of G OSSIP
SGD applied to the equivalent reformulation of the original problem based on TV-regularization (Ben-Ameur et al., 2013).
However, the established convergence results in the strongly convex case do not show any beneﬁts of using communications with other workers in the homogeneous data regime that appears in large-batch training of deep learning models.
Li et al.
(2019) use the same idea for a parameter-server architecture.
Next, there are approaches requiring peer-to-peer communications of full vectors at each step (Gupta et al., 2021; Gupta & Vaidya, 2021), which is not scalable.
[Table] [Table]
Peng et al., 2021)
[Table]
This work
[Table] [Table]
This work (
[Table] [Table]
This work
[Table]
This work
[Table] [Table]
The results are under uniformly bounded noise
[Table]
High-probability guarantees are established,
i
[Table]
e., it is proven that with probability at least 1 − β algorithms from (Alistarh et al., 2018)
ﬁnd ˆ x such that f (ˆ x ) − f ( x ∗ ) ≤ ε and algorithms from (Allen-Zhu et al., 2021)
ﬁnd ˆ x such that (cid:107)∇ f (ˆ x ) (cid:107) ≤ ε .
(2) Dependencies on β are logarithmic and, therefore, omitted.
Optimization problems is assumed to be deﬁne on a bounded set, the rates depends on the diameter of this set.
The results are derived for the case σ = 1 .
Allen-Zhu et al.
(2021) also derive convergence guarantees for ﬁnding second-order stationary points.
(4) Wu et al.
(2020) consider ﬁnite-sum case of (3), i.e., f ( x )
= 1 N (cid:80) Nj =1 f ( x, j ) .
The results are derived under uniformly bounded variance assumption: E j [ (cid:107)∇ f ( x, j ) − ∇ f ( x ) (cid:107) 2 ] ≤ σ 2 for all x ∈ R d , where j is sampled uniformly at random from { 1 , . . .
, N } .
Wu et al.
(2020) also derive convergence guarantees under ζ -bounded dissimilarity assumption, i.e., when f ( x ) = 1 |G| (cid:80)
i ∈G
f i ( x ) , f i ( x ) = 1 N (cid:80) Nj =
f i ( x, j ) for all i ∈ G , and|G| (cid:80) i ∈G (cid:107)∇ f i ( x ) − ∇ f ( x ) (cid:107) 2 ≤ ζ 2 .
(5) This result is obtained the main result of (Wu et al., 2020) and states that the method from (Wu et al., 2020) ﬁnds ˆ x such that f (ˆ x ) − f ( x ∗ ) ≤ ε only for ε ≥ σ 2 / µ 2 ( 12 − δ ) 2 , which can be large.
The result is derived under uniformly bounded variance assumption, i.e., E ξ ∼D
[ (cid:107)∇ f ( x, ξ ) −∇ f ( x ) (cid:107) 2 ] ≤ σfor all x ∈ R d .
(7) Peng et al.
(2021) consider the case, when peers are allowed to communicate with their neighbors that are deﬁned via some communication graph.
The result establishes the total number of iterations/communication rounds needed to ﬁnd ˆ x such that E (cid:107) ˆ x − x ∗ (cid:107) 2 ≤ ε for ε ≥ λ 2 d µ 2 (cid:80) i ∈G |B
i | 2 , where λ ≥ 0 is any non-negative number and B i is the set of Byzantine peers neighboring with the i -th peer.
In the complexity result, we use the notation N 2 = (cid:80) i ∈G ( |G i | 2 + |B i | 2 ) , where G i is the set of good neighbors of the i -th peer.
When λ = 0 , the workers do not communicate at all.
Moreover, Peng et al.
(2021) analyze the case of heterogeneous local functions, composite optimization problems and time-varying setup but in that case λ is lower bounded by a strictly positive quantity depending on the heterogeneity level and minimal non-zero singular value of the node-edge incidence matrix, i.e., any predeﬁned accuracy cannot be achieved.
results results
Moreover, is assumed that the exact of attacking Byzantine workers at is known to each participant
Theorems E.
E the results
The results are
BTARD-C
SGD ( the strongly convex case,
R ESTARTED -BTARD- C
LIPPED -
1 without any additional assumptions the tails of the distribution δm
Finally, El-Mhamdi et al.
(2020) propose an algorithm based on the usage of multiple servers.
The authors assume that both workers and servers can be Byzantines, which is a realistic scenario.
However, their approach requires the workers to send their gradients to all servers at each iteration and receive parameters from all servers as well.
This leads to a signiﬁcant communication overhead in practice.
Moreover, El-Mhamdi et al.
(2020) do not provide non-asymptotic convergence rates, making it problematic to provide an in-depth comparison with existing works and with our results as well.
Therefore, it is unclear whether the usage of multiple servers speeds up training or it just leads to overhead in the communications and computations.
In contrast, our results do beneﬁt from the communications between workers.
First of all, as one can see from Table 2, the terms depending on the fraction δ of Byzantine peers in our complexity bounds for BTARD-SGD and R ESTARTED -BTARD-SGD (the third terms) have better dependence on the target accuracy ε than the corresponding terms in the complexity bounds from all previous works (even from those relying on the existence of a PS).
Moreover, for sufﬁciently small ε these terms in our complexity results are smaller than the second terms, which correspond to the main term in the complexity of parallel SGD.
That is, BTARD-SGD/R ESTARTED -BTARD-SGD applied to the problem with Byzantine peers has convergence guarantees that are not worse than the corresponding guarantees for parallel SGD applied to the problem without any Byzantine workers.
In such regimes, our theoretical convergence results outperform even ones derived for PS-based algorithms.
We notice that Assumptions 3.1 and 3.2 used in the analysis of BTARD-SGD/R ESTARTED -BTARDSGD are slightly stronger than uniformly bounded variance assumption used in (Wu et al., 2020;
Karimireddy et al., 2020; Peng et al., 2021).
However, as we explain in Appendix E.3.1, our analysis allows to relax Assumptions 3.1 to uniformly bounded variance assumption, and Assumption 3.2 is reasonable for many practically important problems.
Finally, we also propose and analyze BTARDC LIPPED -SGD and R ESTARTED -BTARD-C LIPPED -SGD under Assumption E.1 that may hold even in the case of unbounded variance of the stochastic gradient.
To the best of our knowledge, this is the ﬁrst time in the literature on the Byzantine-tolerant optimization when the complexity results are obtained without assuming boundedness of the stochastic gradient’s variance.
A. S ECURITY IN DISTRIBUTED SYSTEMS : ADDITIONAL DETAILS
In this section, we provide extra details on the related work discussed in Section 2.3.
A.2. B ROADCAST CHANNELS
Many distributed systems rely exclusively on direct peer-to-peer connections, avoiding any centralized servers to increase reliability and avoid the performance bottleneck.
In presence of malicious participants, this introduces additional security challenges since an attacker can send corrupted data to one participant and behave honestly with others.
If a peer accuses another peer in sending corrupted data, it is impossible for remaining peers to determine whether the accusation is fair since only these two peers had access to the contents of the communication channel between them.
To overcome this, distributed systems can build secure broadcast channels over the peer-to-peer connections using the protocols for Byzantine broadcast.
These protocols guarantee that if a peer p sends a message, (a) all honest peers receive the same message and (b) the received message coincides with the original one if p is honest.
Pease et al.
(1980) suggest such a protocol for the case when the share of malicious peers δ < 1 / 3 , and Dolev & Strong (1983) suggest a protocol tolerating any δ < 1 assuming the presence of a public key infrastructure and usage of the digital signatures (Rivest et al., 1978; Goldwasser et al., 1988).
Hirt & Raykov (2014) review how the communication complexity of various Byzantine broadcast protocols depends on the maximal tolerated δ and the length of the broadcasted message.
Abraham et al.
(2019) review protocols with additional practical assumptions improving the communication complexity.
A.2. M ULTI - PARTY RANDOM NUMBER GENERATORS
Many distributed systems may beneﬁt from the multi-party random number generators (MPRNG) where a group of malicious peers would have little inﬂuence (bias) on the generator output.
MPRNGs
[Figure]
are usually based on multi-party coin tossing protocols, such as the protocol from Blum (1983).
As an example, MPRNG allows to choose a participant winning a lottery or choose a peer whose calculations are going to be validated by other peers to detect possible cheating.
While Blum (1983) formally introduces a protocol for one bit and two parties, its generalization to multiple bits and parties (as necessary for MPRNG) is trivial assuming the presence of the broadcast channel.
This modiﬁcation is widely known in literature, e.g., described in Zhang et al.
According to this generalization, peers should execute the following protocol to obtain k random bits (see the intuitive scheme in Figure 4):
Each peer generates its own random string x i made of k bits.
Each peer broadcasts commitment h
i =
h
( i || x
i ||
s i ) , where || denotes concatenation, h ( x ) is a common cryptographic hash function, i is the peer’s unique identiﬁer (known by other peers), and s i is a large random string.
Peers wait until all of them ﬁnish broadcasting the commitments.
After that, no peer can alter its x i to inﬂuence the protocol output (otherwise, peers would notice that the new value x (cid:48)
i does not match the commitment).
Each peer reveals their random string by broadcasting its x i and s i .
Each peer veriﬁes that all other peers revealed values x j and s j that match their commitments
h j = h
( j || x j || s j ) .
If a peer detects that peer j aborted the procedure or its commitment does not match its revealed values, it concludes that we cannot trust peer
j .
Since other peers read the same broadcast channel, all of them can
make
the
same
conclusion.
In this case, the system repeats the protocol.
If peers do not detect any mismatches, they calculate the protocol output x = x 1 ⊕ ... ⊕ x n , where ⊕ denotes the bitwise XOR operation.
In this protocol, the commitments include the peer identiﬁer i to protect from replay attacks (when an attacker repeats someone else’s message) and the large random string s i to resist dictionary attacks (when an attacker reverses the hash function using a large dictionary of its values).
While there are MPRNGs (Rabin & Ben-Or, 1989) with a negligible bias for the case when more than a half parties are honest (assuming the presence of the broadcast channel), Cleve (1986) proves that it is impossible to reach the negligible bias for the case of dishonest majority, which may be reached in practice with the Sybil attacks.
However, we note that the bias in Blum (1983) (and its modiﬁcation above) appears only in the case when an attacker learns the result earlier than other peers and forces the protocol to be repeated.
If we are using MPRNG to choose a peer that to be checked for cheating, we may ban all peers that aborted the procedure and restart from scratch without them, therefore eliminating the bias problem.
B N ETWORK AND COMPUTE OVERHEAD OF BTARD-SGD
Communication overhead.
Despite having complex structure, BTARD-SGD has only limited communication overhead, when compared to regular All-Reduce SGD.
A single step of BTARD requires each peer to send each gradient tensor exactly once for aggregation, then download the results, exactly as in Butterﬂy All-Reduce.
On top of that, peers are only required to broadcast O ( n ) scalars that are independent of the total size of the trained model.
This includes the communication cost for MPRNG: as shown in Figure 4, one round of the MPRNG based on the generalization of
Blum (1983) requires each peer to only broadcast 3 scalars.
Hirt & Raykov (2014) discuss that a simple modiﬁcation of the protocol from Dolev & Strong (1983) leads to the communication complexity of O ( n 3 + ln 2 ) bits for each peer in the worst case, where l is the length of the broadcasted message.
For the O ( n ) scalars, this gives O ( n 3 ) communication.
As a result, the communication complexity of a single BTARD-SGD step for each peer is O ( d + n 3 ) bits.
We note that for models that beneﬁt from distributed training, the n 3 component is usually dominated by the vector size d , as they usually contain at least tens of millions of trainable parameters.
Still, if necessary, the n 3 component may be improved using the Byzantine broadcast protocols with additional practical assumptions, such as allowing a small probability of error.
Abraham et al.
(2019) review such protocols, their assumptions, and communication complexity.
Synchronization points.
Another important aspect of BTARD performance is synchronization.
The naive implementation of Algorithm 1 would have many global synchronization “barriers” per step: one for aggregating gradients, another for choosing a random direction z , yet another for electing validators, etc.
These frequent synchronizations could undermine the practical training performance of BTARD in high-latency networks, such as when training over the Internet.
Fortunately, it is possible to reduce the number of synchronizations by bundling them together.
For instance, peers use a single MPRNG round for sampling z and for electing validators.
Furthermore, this MPRNG round and subsequent checks can be done in background, while a peer accumulates gradients for the next step.
The only restriction is that this “shared” MPRNG round must be performed after all peers declare their checksums for that round.
With these optimizations, BTARD-SGD requires only two points of synchronization per round.
The ﬁrst one occurs right before gradient aggregation, and the second one is in a background task that performs veriﬁcations.
Finally, there is a non-regular need for synchronization when one peer accuses another of being Byzantine.
However, as we elaborated earlier, each accusation will result in at least one Byzantine being banned.
Therefore, this additional cost will occur only a limited number of times over the training run.
Computation overhead.
In terms of computation, BTARD-SGD introduces two main overheads: from validators and C ENTERED C LIP respectively.
As we have shown empirically, both BTARDSGD and BTARD-C LIPPED -SGD can withstand attacks even with 1 random validator chosen from 16 peers.
As such, the computation overhead for these validators is under 10% of the total compute.
As for the C ENTERED C LIP , our algorithm executes the same amount of computation as the original
C ENTERED C LIP (Karimireddy et al., 2020), except that now the extra load is distributed evenly across all peers.
We provide an empirical evaluation of such overhead in Appendix I.2.
Finally, we note that generating a shared vector z from a scalar seed r t (as deﬁned in Algorithm 1) has a negligible cost and can be done with any standard pseudo-random number generator.
For instance, generating z for ALBERT-large (the setup from Section 4.2) takes 30 ± 1 .
2 ms on the same T4 GPU that we use in our experiments.
C O VERVIEW OF ATTACK VECTORS
In Section 3.2, we have outlined the 4 main types of Byzantine attacks that can affect BTARD-SGD.
Here, we analyze each of these types in detail and provide a list of attacks that ﬁt these types.
Gradient attacks.
This attack vector encompasses all attacks where Byzantine peers replace their true gradients with something else, but otherwise act normally.
With this attack, b Byzantine peers can collectively shift the outputs of C ENTERED C LIP by up to τ · b/n in any chosen direction.
However, since Byzantine peers will need to commit hash of their incorrect gradients, every honest validator can accuse one of these peers with probability b/n .
Aggregation attacks.
A similar, but opposite attack type can be attempted when a Byzantine peer performs gradient aggregation.
Instead of honestly computing C ENTERED C LIP , an attacker may modify the returned vector to incorporate the same kinds of changes as in gradient attacks (see above).
This time, the maximum difference that can be applied through such attacks is larger, but it only affects b/n of vector coordinates that are aggregated by Byzantines.
Done naively, such attacks can be detected and banned by the gradient checksum (see L15-17 in
Algorithm 1).
In order to ensure that the above check passes, Byzantines can misreport their s ji in such a way that (cid:80) i s ji =0 .
However, since actual s ji depend only on g ki and ˆ g k , these values can be veriﬁed by the chosen validators, and, in case of mismatch, reported via A CCUSE .
We rigorously prove this in Appendix D.3.
Furthermore, if an honest validator ﬁnds that a certain peer has broadcast incorrect s ji , the validator can simultaneously accuse the corresponding Byzantine aggregator j that should have notiﬁed about the incorrect s ji (see L12-14 in Algorithm 1).
Reputation abuse.
Since BTARD-SGD provides means by which benign participants can ban
Byzantine attackers, it is important to ensure that the same means cannot be exploited by Byzantine peers to eliminate benign ones or otherwise abuse the system.
There are three potential attack vectors that ﬁt this description:
• Falsely accusing a benign peer, • Persistently calling the A CCUSE procedure to slow down training, • Automatically approving gradients without actual validation,
In BTARD-SGD, we protect against slander (issues 1. and 2.) by the design of A CCUSE protocol, by which a peer that initiates false allegations will itself be banned.
As such, Byzantines can only invoke A CCUSE protocol a limited number of times before they are all permanently banned.
In turn, the attack vector (3.) is more effective: if one Byzantine was chosen as validator for another
Byzantine, they can automatically report successful validation without negative consequences for either of them.
However, since all validators are chosen through MPRNG, an attacker has no way of predicting whether its validator will be benign or Byzantine.
Thus, any malicious activity will always have a chance of being caught by an honest validator.
Protocol violations.
Finally, a Byzantine attacker can deviate from the protocol prescribed by
BTARD-SGD in simpler ways ways, for instance:
Not committing the hash of its gradient when required by 4, 2.
Not sending data to a particular peer when required (or sending data twice), 3.
Deliberately broadcasting a hash that mismatches the subsequently sent data, 4.
Sending metadata (e
g. gradient norm) that is inconsistent with previously sent gradient part, 5.
Sending s i that is inconsistent with previously sent gradient, 6.
Not validating when chosen as validator, validating when not chosen, or validating a different peer than was chosen by BTARD-SGD.
For protocol deviations that are visible to all benign participants, such as in (1.) or (6.), benign peers can ban the offender instantaneously.
However, this is not the case for attacks such as (2.), where the deviation is only visible to one or few peers.
As described earlier in Section 3.2, we address this issue with a special procedure that allows any peer to ban any other peer at the cost of also being banned.
Thus, if an attacker sends inconsistent gradients, norms or inner products to only one benign peer, that peer can still get the attacker banned even though it wouldn’t be able to call A CCUSE .
Protecting from attacks 3, 4 and 5 from the above list also relies on this mutual elimination procedure.
Speciﬁcally, if an attacker sends provably incorrect data to a benign peer, that peer will immediately trigger the mutual elimination procedure.
The only exception to this rule is if one Byzantine peer sends incorrect data to another Byzantine peer: this behavior is neither punishable nor, in itself, harmful.
In turn, the mutuality of this elimination procedure prevents potential misuse by Byzantines: if an attacker decides to ban someone through this procedure, that attacker will also be banned.
D D ETAILED ALGORITHM DESCRIPTION
In this section, we provide more formal versions of the BTARD (Alg. 4) and BTARD-SGD (Alg. 6) algorithms, as well as auxiliary subroutines and further details.
For completeness, we describe our approach in a bottom-up manner.
First, in Appendix D.1, we describe Algorithm 4 and one of its main building block called C ENTERED C LIP (Karimireddy et al., 2020).
Then, we formulate the
A CCUSE and E LIMINATE subroutines for blocking malicious peers in Algorithm 5 and comment on them in Appendix D.2.
Finally, we formulate the full BTARD-SGD in Algorithm 6 using the above subroutines as building blocks and rigorously analyze its robustness to the violations of its steps by
Byzantine peers in Appendix D.3.
D. BTARD AND C ENTERED C LIP
We begin with a glossary of basic functions used in the algorithms:
• C HECK C OMPUTATIONS ( j ) or V ALIDATE P EER — run C OMPUTE G RADIENTS ( x t , ξ tj ) and compare against the c j , h * j , s * j broadcasted by that peer.
If there is mismatch, A CCUSE .
• V OTE F OR B AN ( peer j ) — send a message declaring an intent to ban peer j over the broadcast channel (the message is signed with the sender’s private key).
• N UM V OTES ( peer j ) — count the number of messages declaring the intent to ban peer j and received via the broadcast channel.
• B AN ( peer j ) — add peer j to a local blocklist, ignore any subsequent messages from that peer, and continue training without it.
• S PLIT ( v, n ) — split vector v of size d into n parts.
The ﬁrst d mod n parts are of size (cid:100)
d/n (cid:101) and the remaining parts have size (cid:98) d/n (cid:99) .
• M ERGE ( v 1 , . .
. , v n ) — concatenate vectors v 1 , . .
. , v n into one.
Algorithm 4 deﬁnes a single gradient aggregation step (outlined earlier in Alg. 2) with additional veriﬁcations needed to reduce the negative inﬂuence of Byzantine peers.
For simplicity, we assume that workers run each line in a synchronous manner (e.g. wait for all peers to broadcast hash ( g i ) before communicating the actual gradients).
In practice, this restriction can be lifted in favor of asynchronous steps with several explicit synchronization barriers, but that would further complicate the pseudo-code.
One of the key building blocks of BTARD is C ENTERED C LIP – a robust aggregation rule proposed in (Karimireddy et al., 2020).
Unlike a number of other aggregation rules as coordinate-wise median, Krum, geometric median, C ENTERED C LIP is provably robust against Byzantine attacks (see
Theorem III from (Karimireddy et al., 2020) and Lemma E.1).
Let G be the set of good peers, B be the set of Byzantine workers, and, for simplicity, let [ n ]
= G (cid:116) B , |B| =
δn ≤ δ 0 n < n / 2 .
Assume that we have n random vectors x 1 , . . .
, x n , such that ∀ i, j ∈ G
[Equation]
and for all i ∈ B vectors x i can be arbitrary.
C ENTERED C LIP works as follows: it is an iterative procedure generating a sequence { v l } l ≥ 0 satisfying
[Equation]
) where
[Equation]
do 11: if hash j i
) (cid:54) =
( i then 12:
E LIMINATE ( i j
Signed peer i private key 13: (cid:98)
ENTERED C
14: broadcast
Send receive all from workers 16: for j = 1 , . .
. , n do 17: if hash ( g j
= (cid:98) then 18:
E LIMINATE i, j
Signed peer i private key 19: (cid:98) g
= M ERGE ( (cid:98) g (1) , . . .
, (cid:98) g ( n )) 20: 21:
Send metadata for veriﬁcation: 22:
Generate r via MPRNG 23:
z = G ET R ANDOM V ECTOR ( r ) 24: for j ∈ 1 , ..., n do 25:
∆ ji =( g i ( j ) − (cid:98) g ( j )) · min (cid:110) 1 , τ (cid:107) g i ( j ) − (cid:98) g ( j ) (cid:107)(cid:111) 26: broadcast s ji = (cid:104) z
[ j ] , ∆ ji (cid:105) 27: broadcast norm ij = (cid:107) g i ( j ) − (cid:98) g ( j ) (cid:107)28: for l = 1 , . . .
, n do 29: w lj = min (cid:110) 1 , τ norm lj (cid:111) 30: 31: for j = 1 , . . . , n do 32:
Veriﬁcation 1: 33: if norm ji (cid:54) =
(cid:107) g j ( i ) − (cid:98) g ( i ) (cid:107) 2 then 34:
A CCUSE (i, j, norm ji does not mach c j ( i ) ) 35:
Veriﬁcation 2: 36: //
peer i knows ∆ i j from CenteredClip 37: if s ij (cid:54) =
(cid:104)
z k
[ j ] , ∆ ij (cid:105) then 38:
A CCUSE (i, j, s ji does not match c j ( i ) )
: if (cid:80)
ni s ji (cid:54) =
then 40: //
peer j already veriﬁed that all s j · are correct 41:
A CCUSE (i, j, (cid:98) g ( j ) is wrong) 42:
Veriﬁcation 3: 43: broadcast check ij =
[ (cid:107) g
i ( j ) − (cid:98) g ( j ) (cid:107) 2 > ∆ max ] 44: if (cid:80) l check lj > n 2 then 45:
C HECK
A VERAGING ( j ) 46: return (cid:98) g
Intuitively, C ENTERED C LIP behaves like the mean for all points within the sphere of radius τ and like the median for “outliers”.
In turn, choosing different values of τ allows one to smoothly interpolate between the mean ( τ → inf ) and the geometric median ( τ → 0 ) aggregation rules.
The goal of this procedure is natural: ﬁnd good enough approximation (cid:98) x of x = 1 |G| (cid:80) i ∈G x i .
In (Karimireddy et al., 2020), it is shown 5 that for δ ≤ 0 .
1 the sequence { v l } l ≥ 0 generated by
C ENTERED C LIP satisﬁes
[Equation]
Moreover, Karimireddy et al.
(2020) prove that for all possible aggregation rules producing (cid:98) x and given δ 0 , σ there exists such set of vectors x 1 , . . .
, x n and such a partition [ n ] =
G (cid:116) B that
[Equation]
Therefore, C ENTERED C LIP can be seen as an optimal aggregation rule neglecting numerical constants.
The usage of C ENTERED C LIP helps the good peer i to produce a good enough approximation of the ideal average of the i -th parts of stochastic gradients among good peers in BTARD.
Moreover, since δ ≤ 0 .
1 we have that 6 .
45 δ ≤ 0 .
645 implying that B 2 l → B 2 ∼ σ 2 when l → ∞ , and τ l → τ ∼ (cid:112) σ 2 / δ .
These limits can be easily computed from (6).
Next, for l → ∞ CenteredClip converges to the solution of the following equation:
[Equation]
In other words, CenteredClip for large enough l approximates the ﬁxed point iteration process of solving (8).
This property plays a key role in Veriﬁcation 2 of BTARD.
Algorithm 5 A allegation), detailed version
Input: accuser count n values exchanged in Algorithm
3: 4: for l do 5: if kj )
= c kj or hash ( g kj ( l )) (cid:54) =
h lj then 6:
V j ) //
For gradient attack 7: 8: ∆ jl =( g l ( j ) − (cid:98) g
( j ))
· min (cid:110) 1 , τ (cid:107) g l ( j ) − (cid:98) g ( j ) (cid:107)(cid:111) 9: if (cid:107) g j ( l ) − (cid:98) g
( l ) (cid:107)
(cid:54)
=
norm jl or (cid:104) ∆ jl , z j (cid:105) (cid:54) =
s jl or (cid:80) nl
=1 s jl (cid:54) =
then 10:
V OTE F OR B AN ( peer j ) //
For aggregation attack 11: for o = 1 , . . . , n do 12: if peer o approved norm jo or s oj then 13:
V OTE F OR B AN ( peer o ) //
For covering up the j -th peer’s aggregation attack 14: 15: for l = 1 . . .
n do 16: if N UM V OTES ( peer l ) ≥ n/ 2 then 17:
B AN ( l
D. P ROTOCOLS FOR BANNING B YZANTINE PEERS
A CCUSE and E LIMINATE are the two protocols by which peers ban Byzantine attackers from training.
The A CCUSE protocol is only invoked if there the malicious activity of the target peer can be proven to others (we detail the exact mechanism in Algorithm 3).
In contrast, E LIMINATE is a mechanism that allows any peer i to ban any other peer j from training without proof — but at the cost of peer i also being banned.
We have described this protocol earlier as a countermeasure for protocol violations (see Appendix C).
Both A CCUSE ( i, j ) and E LIMINATE ( i, j ) imply that peer i uses the broadcast channel to declare its intent to ban peer j .
All peers collect such messages during a training step and process them at the end of the step in some speciﬁc order (e.g. sorted by ( type , public_key i , public_key j ) , where type ∈ { A CCUSE , E LIMINATE } and A CCUSE < E LIMINATE ).
If processing one of the messages results in banning peer p , further messages involving p are ignored regardless of the p ’s role.
This way, it is impossible for a Byzantine to eliminate more than one honest peer along with itself.
Peers reach consensus since their decisions on banning someone are based solely on the messages from the broadcast channel (sorted in the common order) and the calculations with identical results.
D. BTARD-SGD AND DETECTING PROTOCOL VIOLATIONS
Finally, the Algorithm 6 incorporates the two above procedures into a secure decentralized SGD training loop.
This algorithm is intended as a more formal version of Alg.
1 from Section 3.1.
Algorithm
Input: x 0 – starting point, γ – stepsize, K – number of iterations, { s i,k } n,K − 1 i,k =0 , 0 – seeds for batches computations 1: C 0 = Banned − 1 = ∅ 2: for k = 0 , 1 , . .
, K − 1 do 3:
Worker i computes g ki = (cid:26) ∇ f ( x k , ξ i,k ) , if i ∈ G k \ C k , ∗ , if i ∈ B k \ C k , , where ξ i,k is generated via seed s i,k available to every worker 4: (cid:0)(cid:98) g k , public_info k (cid:1) =
BTARD ( g ki k 1 , g ki k 1 , . .
, g ki kak ) , where { i k 1 , . . .
, i ka k } =
( G k
∪ B k ) \ C k 5: //
BTARD is described in Algorithm6:
Choose 2 m workers c k + , . .
c k +1 m , u k + , . . .
, u k +1 m uniformly at random without replacement, C k +
= { c k + , . . .
c k +1 m } ,
U k +1 =
{ u k + , . . .
u k +1 m } 7:
Banned k = C HECK C OMPUTATIONS ( C k
+1 , U k
+1 , public_info k ) 8: x k +1 =
proj Q
( x k − γ (cid:98) g k ) := argmin x ∈ Q (cid:107) x − ( x k − γ (cid:98) g k ) (cid:107) 9:
G k +1 =
G k \ Banned k −10:
B k +1 =
B k \ Banned k −
Veriﬁcations 1 and 2.
While good peers always run C ENTERED C LIP , Byzantine peers can arbitrary violate the protocol meaning that they can send an arbitrary vector instead of sending the result of
C ENTERED C LIP .
Veriﬁcation 1 and 2 are needed to prevent such violations and make it possible to identify them during the check of computations.
First of all, both veriﬁcations are split into 2 rounds in order to let the aggregators of the corresponding part accuse those peers who send inconsistent norms or inner products.
Next, in theory, we assume that all good peers ﬁnd exactly the solution of C ENTERED C LIP equaition (8).
Therefore, it is possible to compute the weights from (8) for each worker i and each component j knowing only a norm of the difference of corresponding vectors, i.e., one can compute min { 1 , τ (cid:107) g
i ( j ) − (cid:98) g ( i ) (cid:107) } by (cid:107) g i ( j ) − (cid:98) g ( i ) (cid:107) .
That is, if Byzantine peer i sends norm ij (cid:54)
= (cid:107) g
i ( j ) − (cid:98) g ( j ) (cid:107) , it will be either revealed by j -th worker if j ∈ G or it will be revealed with some probability during the subsequent checks of computations.
However, Veriﬁcation 1 is insufﬁcient to prevent malicious behavior: at iteration k Byzantine peer can send g ki ( j ) such that (cid:107) g ki ( j ) − (cid:98) g k ( j ) (cid:107) =
(cid:107)∇ ( j ) f ( x k , ξ i,k ) − (cid:98) g k ( j ) (cid:107) .
If j ∈ B , then it can be the case that i -th worker commits the hash of ∇ ( j ) f ( x k , ξ i,k ) and the check of gradient computation will not identify the violation of the protocol.
That is why, Veriﬁcation 2 is required.
G ET R ANDOM V ECTOR is a function that generates a random unit vector z in the space of model parameters.
This vector is based on a random seed r obtained from MPRNG.
The goal of Veriﬁcation 2 , is to check that C ENTERED C LIP equation (8) holds for the received vector.
The idea is simple: if
[Equation]
then for any z i of an appropriate dimension n
[Equation]
Since z i in BTARD is generated from the uniform distribution on the unit Euclidean sphere, we have
P { (9) does not hold & (10) holds } = 0 .
[Equation]
However, it is impossible to verify (10) explicitly for workers j (cid:54)
=
i .
Therefore, in the algorithm, good workers check
[Equation]
Unfortunately, Byzantine peers can send arbitrary s il .
This can lead to the situations when (12) holds while (10) and, as a consequence, (9) do not.
Below, we rigorously show that all possible violations of the protocol that are not detected by veriﬁcations of BTARD can be detected by the auxiliary check of computations with some probability.
Veriﬁcation 3.
This is an additional veriﬁcation that serves to limit the potential scope of aggregation attacks (as described in Appendix C).
If the result of CenteredClip landed far from too many benign participants, BTARD will verify it by re-running the same aggregation across all peers.
While this procedure is costly, our analysis proves that it is has a very small probability of triggering unless some of the peers perform aggregation attacks.
In the latter case, verifying the gradient accumulation will root out such attacks and ban the corresponding peers.
Check of computations.
As we mentioned earlier, it is possible to violate the protocol without being detected by the veriﬁcations of BTARD.
Therefore, extra checks of computations are required.
In particular, after each aggregation in BTARD-SGD 2 m workers are selected uniformly at random: m workers check the computations at the previous step of other m workers.
That is, each Byzantine peer is checked at iteration k with probability ∼ m / n by some good worker (see the proof of Thm.
E.2).
Consider an arbitrary Byzantine peer j and all possible violations of the protocol at iteration k that are not detected by veriﬁcations of BTARD.
First of all, we notice that if c j ( i ) (cid:54) =
hash ( ∇ ( i ) f
( x k , ξ j,k )) , then it will be detected during the check of computations with some probability 6 .
Moreover, if i ∈ G , then j -th worker has to send c j ( i ) =
hash
( g j ( i )) to avoid ban.
Therefore, the only non-trivial case is when i ∈ B as well.
In this case, j -th worker can commit c j ( i ) =
hash ( ∇ ( i ) f
( x k , ξ j,k )) since it is meaningless for i -th worker to accuse j -th one.
Since norm ij , s ji and (cid:98) g ( i ) are known for all i and j , j -th worker has to broadcast norm ji =
(cid:107)∇ ( i ) f ( x k , ξ j,k ) − (cid:98) g
( i ) (cid:107) and s ij =
(cid:104)∇ ( i ) f
( x k , ξ j,k ) − (cid:98) g
( i ) , z i (cid:105) min (cid:110) 1 , τ (cid:107)∇ ( i ) f
( x k ,ξ j,k ) − (cid:98) g
( i ) (cid:107) (cid:111) to avoid the ban during the check of the computations.
Therefore, regardless to the choice g j ( i ) , to pass
Veriﬁcation 2 i -th worker should send such (cid:98) g
( i ) that
[Equation]
In this case, the behavior of the j -th worker along i -th component is equivalent to the behavior of the good one.
It means, that to avoid ban during the check of computations, each Byzantine worker l should broadcast norm li =
(cid:107)∇ ( i ) f ( x k , ξ l,k ) − (cid:98) g
( i ) (cid:107) and s il =
(cid:104)∇ ( i ) f
( x k , ξ l,k ) − (cid:98) g
( i ) ,
z
i
[Equation]
min
[Equation] [Equation]
implying that i -th worker should send such (cid:98) g ( i )
that
[Equation]
In view of (11), it implies that
[Equation]
k , ξ 2 ,k ))
E C ONVERGENCE ANALYSIS : MISSING PROOFS AND EXTRA DETAILS E. P RELIMINARIES
For convenience, we provide the classical deﬁnitions and facts on smooth and strongly convex functions below.
Deﬁnition E.1 ( L -smoothness) .
We say that function f : Q → R , Q ⊆ R d is L -smooth if it is differentiable and
[Equation]
One can show (Nesterov, 2003) that L -smoothness implies
[Equation]
where f ∗ is a uniform lower bound for f .
Deﬁnition E.2 ( µ -strong convexity) .
Differentiable function f : Q → R , Q
⊆ R d is called µ -strongly convex if
[Equation]
E. I MPOSSIBILITY OF B YZANTINE - TOLERANT LEARNING IN HETEROGENEOUS CASE
Several papers on Byzantine-tolerant optimization consider non-homogeneous setup, when good workers have different local functions (Wu et al., 2020;
He et al., 2020).
Formally, it means that instead of solving
[Equation]
(17) where good peers sample stochastic gradients from the full dataset (i.e., they can sample ξ from D ), the following problem is considered:
[Equation]
where f i ( x ) =
E ξ i ∼D i [ f ( x, ξ i )]
and there exists ζ ≥
such that for all x ∈ Q
[Equation]
However, under ζ -bounded heterogeneity assumption (19) it is impossible in general to solve (18) with any predeﬁned accuracy in the presence of Byzantine peers (He et al., 2020).
Moreover, this is true even when trusted Parameter-Server is available.
Theorem E.1 (Theorem III from (He et al., 2020)) .
For any optimization method Alg there exist n functions f 1 ( x ) , . . .
, f n ( x ) such that at least (1 − δ ) n of them are good (corresponding workers belong to G ), 1 -smooth, µ -strongly convex and satisfy (19) such that the output (cid:98) x of Alg given the access to these n functions has an error at least
[Equation] [Equation]
where the expectation is taken w.r.t.
the randomness of Alg .
The intuition behind this negative result is as following: since the only assumption on the similarity of “good” functions is (19), Byzantine peers can shift the gradients by a vector with a norm ∼ ζ without being detected.
In this case, it is impossible to distinguish good peers from Byzantines but the solution of (18) depends on which workers are good and which are bad.
Therefore, the best one can hope for is the convergence to some neighborhood of the solution.
The lower bounds from (20) are proportional to δζ 2 and cannot be made arbitrary small for given δ and ζ 2 .
It means that the convergence to any predeﬁned accuracy of the solution is impossible to achieve when local loss functions are ζ -heterogeneous.
In this sense, Byzantine-tolerant learning is impossible in the heterogeneous case.
Moreover, in some practical applications (e.g., in Federated
Learning (McMahan et al., 2017)), ζ from (19) can be large implying that one cannot achieve reasonable accuracy of the solution when δ is not too small (e.g., δ ≥ 0 . 01 ).
Finally, strong convexity parameter µ is typically much smaller than 1 (assuming that the smoothness parameter is 1 ).
In these cases, δζ 2 / µ can be too large and, as a result, all methods are not converging at all.
E. C ONVERGENCE GUARANTEES FOR BTARD-SGD E.3. O N A SSUMPTIONS 3.1 AND 3.
First of all, Assumption 3.1 holds whenever standard uniformly bounded variance (UBV) assumption is satisﬁed.
Indeed, if E ξ ∼D [ (cid:107)∇ f ( x, ξ ) −∇ f ( x ) (cid:107) 2 ] ≤ (cid:98) σ 2 , then E ξ ∼D [( ∇ i f ( x, ξ ) −∇ i f ( x )) 2 ] ≤ (cid:98) σfor all i = 1 , . . .
, d , since (cid:107)∇ f ( x, ξ ) − ∇ f ( x ) (cid:107) 2 = (cid:80) di
=1 ( ∇ i f ( x, ξ ) − ∇ i f ( x )) 2 .
This implies that Assumption 3.1 holds with σ 2 ≤ d (cid:98) σ 2 .
However, σ 2 can be signiﬁcantly smaller than d (cid:98) σ 2 .
For example, if the noise in stochastic gradients is isotropic, e.g., Gaussian, then
[Equation]
implying that
[Equation]
for all i = 1 , . . .
, d .
Therefore, in this case, Asssumption 3.1 holds with σ 2 = (cid:98) σ 2 .
Next, it is possible to relax Assumption 3.1 to the classical UBV assumption.
Indeed, in our proofs, we use Assumption 3.1 to bound the variance in the blocks of the stochastic gradients, where the blocks of components are chosen for workers to execute BTARD.
If these blocks are chosen uniformly at random, i.e., the vector is split into several parts of the given sizes uniformly at random, then it is enough to have
[Equation]
for a random subset S of { 1 , . . .
, d } such that | S | = s , where expectation is taken w.r.t.
ξ and S .
To derive inequality (21) from UBV assumption E ξ ∼D [ (cid:107)∇ f ( x, ξ ) − ∇ f ( x ) (cid:107) 2 ] ≤ (cid:98) σ 2 we use tower property of the expectation:
[Equation]
i.e., (21) holds for σ 2 = (cid:98) σ 2 .
Finally, as we show in Lemmas E.2 and E.4, under As. 3.2 Veriﬁcation 3 at BTARD leads to extra checking of computations with probability ∼ 1 / n at each iteration when all workers honestly follow the protocol and under a proper choice of ∆ max .
Therefore, extra computations either appear due to malicious manipulations of Byzantine peers, and lead eventually to the ban for the Byzantine peers who deviate from the protocol, or, when all workers honestly follow the protocol, only once per n iterations on average.
There are a number of important machine learning tasks, such as training
ResNet-50 on Imagenet (Zhang et al., 2020) and many others image classiﬁcation problems, where the noise in the stochastic gradient has much “lighter” (sub-Gaussian) tails.
That is, As. 3.2 is reasonable for a large class of practically important problems.
Moreover, in Appendix E.4, we also provide an analysis of BTARD-C LIPPED -SGD and R ESTARTED -BTARD-C LIPPED -SGD without any assumptions on the tails of the stochastic gradients distribution.
E.3. Q UALITY OF THE AGGREGATION
The quality of the aggregation at each iteration of BTARD-SGD signiﬁcantly affects the rate of the method.
That is, properties of (cid:101)
g k are highly important for the convergence of BTARD-SGD.
This aggregator is obtained via BTARD that requires to know a tight estimate of the total number of Byzantine workers violating the protocol at iteration k – clipping parameter τ depends on this quantity.
Therefore, it is natural to start with relatively simple setup when the number of Byzantine workers violating the protocol is known at each iteration.
Before we formulate the ﬁrst result we introduce some useful notations.
Let n k be the total number of peers at iteration k ,
b k be the total number of Byzantine peers at iteration k , (cid:98)
b k be the total number of Byzantine peers violating the protocol at iteration k , and
δ k =
b k n k , (cid:98) δ k
= (cid:98) b k n k − m .
In view of new notation, we start with the ideal situation when (cid:98) b k is known for each worker at each iteration k .
First of all, it is needed to to estimate the quality of the aggregation for good workers.
Lemma E.1 (Theorem IV from Karimireddy et al.
Let As. 3.1 hold, δ ≤ 0 .
1( n − m ) , and i ∈
G k \ C k .
Assume that (cid:98) b k is known for each worker at iteration k and δ = (cid:98) δ k is used to compute clipping parameter τ l for CenteredClip.
If the total number of iterations T of CenteredClip satisﬁes
T ≥ log 9 .
7 δ
[Equation] [Equation]
[Equation]
g k
[Equation]
2 ] , then
[Equation]
(22) where g k ( i ) = 1 |G k \
[Equation]
Proof.
The proof follows directly from (7).
Unlike the good peers, Byzantine workers can cooperate and shift the result of C ENTERED C LIP in the components they aggregate without being revealed at Veriﬁcation 2 of BTARD.
However, they cannot produce an arbitrary large shifts due to Veriﬁcation 3 .
The next lemma estimates the maximal possible magnitude of a shift together with probability of triggering C HECK
A VERAGING at iteration k for at least one worker.
Lemma E.2.
Let As. 3.1 and 3.2 hold, b ≤ 0 .
1( n − m ) , and i ∈ B k \ C k .
Assume that (cid:98) b k is known for each worker at iteration k , ∆ k
[Equation]
=
[Equation]
and δ = (cid:98) δ k is used to compute clipping parameter τ l for CenteredClip.
If the total number of iterations T of CenteredClip satisﬁes
T ≥ log 9 .
δ δσ 2 3 E [ (cid:107) v 0 − g k (cid:107) 2 ] and C HECK
A VERAGING ( i ) is not triggered, then
[Equation]
where g k ( i ) = 1 |G k \C k | (cid:80) j ∈G k \C k g kj ( i ) .
Moreover, if (cid:98) b k = 0 and n k − m ≥ 170 , then (cid:98) g k
( i ) =
g k
( i ) and
P (cid:8) C HECK
A VERAGING is triggered for ≥ 1 peer | x k (cid:9) ≤
[Equation]
Proof.
If C HECK A VERAGING ( i ) is not triggered at iteration k , then for r k ≥ n k − mgood workers i 1 , i 2 , . .
, i r k ∈ G k \ C k we have (cid:107) g k i j
( i ) − (cid:98) g k
( i ) (cid:107) ≤ ∆ k max .
Therefore, due to the independence of
[Table]
[Equation]
where we use |G k \ C k | ≥ r k ≥ n k − mand ∇ f
( i ) ( x k ) =
E [ g ki j | x k ] .
Finally, let us estimate the probability of triggering C HECK
A VERAGING when all workers follow the protocol.
In this case, (cid:98) g ( i ) =
g k
( i ) .
Next, due to As. 3.2 and b ≤ 0 . 1( n − m )
we have
[Equation] [Equation]
and for all j ∈ G k \ C k
[Equation]
Consider the independent random variables η j , j ∈ G k \ C k , where η j = (cid:40) 1 , if (cid:107) g kj ( i )
[Equation]
∇
[Equation]
( i
[Equation]
x
[Equation]
0 , otherwise, where x k is ﬁxed.
Then, η j is a Bernoulli random variable with parameter of “success” q ≥ 8 / 9 .
Applying Hoeffding’s inequality we get that
[Equation]
C k |
[Equation]
(cid:33) ≤
[Equation] [Equation]
Since for all j ∈ G k \C k we have (cid:107) g k
( i ) − g k j
( i ) (cid:107) 2 ≤ (cid:107)
g k ( i ) −∇ ( i ) f
( x k ) (cid:107) 2 + (cid:107)∇ ( i ) f
( x k ) − g k j ( i ) (cid:107)the obtained bounds imply that C HECK
A VERAGING is triggered for at least one worker at iteration k with probability not greater than
[Equation] [Equation]
where we use that exp (cid:0) − 242 x 3969 (cid:1) ≤ 1 x 2 for all x ≥ 170 .
We notice that Byzantine peers can trigger C HECK
A VERAGING by violating the protocol.
However, each Byzantine is checked at iteration k with probability p ∼ m / n (see Thm.
E.2).
Therefore,
Byzantine workers can trigger only O ( bn / m ) extra rounds of communications and computations on average via triggering C HECK
A VERAGING .
In contrast, when there are no Byzantine workers or all workers follow the protocol C HECK
A VERAGING is triggered only once per O ( n − m )
iterations that is a negligible communication an computation overhead when n is large.
Combining two previous lemmas we get the following result.
Lemma E.3.
Let As. 3.1 hold and b ≤ 0 .
1( n − m ) .
Assume that (cid:98) b k is known for each worker at iteration k , ∆ k max = (1+ √ 3) √ 2 σ √ n k − m and δ = (cid:98) δ k is used to compute clipping parameter τ l for
CenteredClip.
If the total number of iterations T of CenteredClip satisﬁes T ≥ log 9 . 7 δ
[Equation]
and C HECK
A VERAGING is not triggered for any worker, then
[Equation] [Equation]
(26) where g k = 1 |G k \C k | (cid:80) j ∈G k \C k g kj and C = 4001 + 4 (cid:0) (1 + √ 3) 2 + 4 (cid:1) .
Proof.
We have
E (cid:2) (cid:107)
[Equation]
Next
[Equation]
using the independence of g kj for j ∈ G k \ C k and ﬁxed x k we derive
[Equation]
In view of the deﬁnition of ( δ, c ) -robust aggregator from Karimireddy et al.
(2020), the result of
BTARD at iteration k is ( (cid:98) δ k , C ) -robust.
However, we derive this property under assumption that (cid:98) b k is known to all workers at each iteration k , which is impractical.
When (cid:98) b k is unknown the situation changes dramatically: in general, good peers can only know some upper bound for the fraction of Byzantine peers at iteration k .
Unfortunately, if used without bans, this is not enough to converge to any accuracy of the solution since BTARD-SGD is a permutationinvariant algorithm in terms of Karimireddy et al.
Therefore, in this case, we always use
C ENTERED C LIP with τ l = ∞ for all l ≥ 0 , i.e., good peers compute an exact average.
In this settings, even 1 Byzantine worker can signiﬁcantly shift the average in all parts of the vector.
The next lemma quantiﬁes the negative effect of Byzantine workers in this case.
Lemma E.4.
Let As. 3.1 and 3.2 hold, b ≤ 0 .
1( n − m ) , m ≤ ( n − 2 b ) / 2 .
Assume that ∆ k max = (
[Equation]
+
[Equation] [Equation]
[Equation]
√ n k − m and δ = 0 is used to compute clipping parameter τ l for CenteredClip.
If
C HECK
A VERAGING is not triggered for any worker, then
[Equation] [Equation]
where g k =
[Equation]
g kj , C = 4 (cid:0) (1 + √ 3) 2 + 4 (cid:1) , and 1 k,v is an indicator function of the event that at least 1 Byzantine peer violates the protocol at iteration k .
Moreover, if (cid:98) b k = 0 and n k − m ≥ 170 , then (cid:98) g k
( i ) =
g k
( i ) and
[Equation]
A VERAGING is triggered for
[Equation] [Equation]
Proof.
If C HECK A VERAGING is not triggered for any worker, then (cid:107) (cid:98) g k
( i ) − g k
( i ) (cid:107) 2 ≤ (∆ k max )
2 1 k
[Equation]
v for all i ∈ ( G k ∪ C k ) \ C k implying
[Equation]
Next, using the independence of g kj for j ∈ G k \ C k and ﬁxed x k we derive
[Equation]
[Table]
[Equation]
[Table]
[Equation]
[Table] [Equation] [Table] [Equation]
[Table]
[Equation] [Table] [Equation]
[Table]
[Equation]
[Table]
[Equation]
[Table]
[Equation]
[Table]
[Equation]
[Table]
[Equation]
The proof of the ﬁnal part of the lemma is identical to the proof of the same result from Lemma E.2.
E.3. N ON - CONVEX CASE
In this section, we provide the complete statements and the full proofs of the convergence results for
BTARD-SGD when the objective function f is smooth, but can be non-convex.
We start with the case when the number of attacking Byzantine workers is known at each iteration.
Theorem E.2.
Let As. 3.1 and As. 3.2 hold, Q = R d , and f be L -smooth (see Def.
E.1) and uniformly lower bounded by f ∗ .
Moreover, assume that b ≤ 0 .
1( n − m ) , m ≤ ( n − 2 b ) / 2 , and the exact number of attacking Byzantine peers is known to all good peers at each iteration.
Next, assume that
[Equation]
where ∆
= f ( x 0 ) − f ∗ and ∆ k max is the parameter for veriﬁcation 3 at iteration k of BTARD-SGD .
Then, we have E [ (cid:107)∇ f ( x K ) (cid:107) 2 ] ≤ ε 2 after K iterations of BTARD-SGD , where
[Equation]
and x K is picked uniformly at random from { x 0 , x 1 , . . .
, x K − 1 } .
Proof.
From L -smoothness of f we have
[Equation]
Taking the conditional expectation E [ · | x k ] from the both sides of the previous inequality we obtain
[Equation]
Since γ ≤ 14 L we continue our derivations as
[Equation]
Taking the full expectation from the both sides of the obtained inequality and summing up the results for k = 0 , 1 , . .
, K − 1 we get
K
[Equation]
If a Byzantine peer deviates from the protocol at iteration k
[Equation]
it will be detected with some probability p k during the next iteration.
One can lower bound this probability as
[Equation]
Therefore, each individual Byzantine worker can violate the protocol no more than 1 / p times on average implying that
[Equation]
x k
[Equation]
≤
[Equation] [Equation]
[Equation] [Equation]
7 n .
Since x K is picked uniformly at random from { x 0 , x 1 , . .
, x K − 1 } we have
[Equation]
Using the stepsize rule
[Equation]
we derive
[Equation]
meaning that after
[Equation]
iterations BTARD-SGD guarantees
[Equation]
In the main part of the paper, we notice that the rate of BTARD-SGD in the presence of bad workers is asymptotically the same as for SGD without Byzantine peers when ε is sufﬁciently small 7 .
This phenomenon has a clear intuition.
When the target accuracy ε is small, the stepsize γ is also needed to be small enough.
However, as we show in Lemmas E.3 and E.4, Byzantine workers can produce only a bounded shift independent of the stepsize.
Moreover, they can violate the protocol at only ∼ n / m iterations on average.
Therefore, the overall impact of Byzantine workers on the convergence of BTARD-SGD decreases when the stepsize γ decreases.
Next, we derive the result without assuming that (cid:98) b k is known to all peers at each iteration.
Theorem E.3.
Let As. 3.1 and 3.2 hold, Q = R d , and f be L -smooth (see Def.
E.1) and uniformly lower bounded by f ∗ .
Moreover, assume that b ≤ 0 .
1( n − m ) , m ≤ ( n − 2 b ) / 2 , and δ = 0 is used to compute clipping parameter τ l for CenteredClip.
Next, assume that
[Equation]
where ∆
= f ( x 0 ) − f ∗ and ∆ k max is the parameter for veriﬁcation 3 at iteration k of BTARD-SGD .
Then, we have E [ (cid:107)∇ f ( x K ) (cid:107) 2 ] ≤ ε 2 after K iterations of BTARD-SGD , where
[Equation]
and x K is picked uniformly at random from { x 0 , x 1 , . . .
, x K − 1 } .
Proof.
The proof is almost identical to the proof of Theorem E.2.
Following the same steps and using (27) and (28) instead of (25) and (26) respectively we obtain the same sequence of inequalities up to the following change: instead of (cid:98) δ k we should use 1 k,v .
Therefore, we have
[Equation]
If a Byzantine peer deviates from the protocol at iteration k , it will be detected with some probability p k during the next iteration.
One can lower bound this probability as
[Equation]
That is, each individual Byzantine worker can violate the protocol no more than 1 / p times on average.
However, even one Byzantine peer can create a shift of the order ∆ k max at each part of the resulting vector.
Therefore, all Byzantine peers can violate the protocol no more than b / p times on average implying that
[Equation]
Since x K is picked uniformly at random from { x 0 , x 1 , . .
, x K − 1 } we have
[Equation]
Using the stepsize rule γ = min
[Equation]
we derive
[Equation]
meaning that after
[Equation]
iterations BTARD-SGD guarantees E (cid:2) (cid:107)∇ f
[Equation]
x K ) (cid:107) 2 (cid:3) ≤ ε
[Equation]
As we notice in the main part of the paper, the third term of the obtained complexity result is signiﬁcantly worse than in (31): it is proportional to b instead of δ = b / n .
However, (33) is derived without assuming that (cid:98) b k is known for all workers at each iteration.
Moreover, as in (31), the third term in (33) has better dependence on ε than the second term implying that for small enough ε the rate of BTARD-SGD in the presence of bad workers without assuming that (cid:98) b k is known at each iteration is asymptotically the same as for SGD without Byzantine peers 8 .
E.3. C ONVEX CASE
In this section, we provide the complete statements and the full proofs of the convergence results for
BTARD-SGD when the objective function f is smooth and convex.
We start with the case when the number of attacking Byzantine workers is known at each iteration.
Theorem E.4.
Let As. 3.1 and 3.2 hold, Q = R d , f be L -smooth (see Def.
E.1), convex, and x ∗ be some optimum of f .
Moreover, assume that b ≤ 0 .
1( n − m ) , m ≤ ( n − 2 b ) / 2 , and the exact number of attacking Byzantine peers is known to all good peers at each iteration.
Next, assume that
[Equation]
where R 0 ≥ (cid:107) x 0 − x ∗ (cid:107) and ∆ k max is the parameter for veriﬁcation 3 at iteration k of BTARD-SGD .
Then, we have E [ f ( x K ) − f ( x ∗ )]
≤ ε after K iterations of BTARD-SGD , where
[Equation]
and x K = 1 K (cid:80) K − 1 k =0 .
Proof.
Lemma E.3 implies
[Equation]
Next, we use convexity (see (16) with µ = 0 ) and L -smoothness of f :
[Equation]
To estimate the inner product in the right-hand side we apply Cauchy-Schwarz inequality:
[Equation]
Putting all together and using b ≤ 0 .
1( n − m ) , m ≤ ( n − 2 b ) / 2 , γ ≤ 1 / 4 L , n k − m ≥ n − 2 b − m , we obtain
[Equation]
Taking the full expectation from the both sides of the above inequality and summing up the results for k = 0 , 1 , . .
, K − 1 we derive
[Equation]
From Jensen’s inequality we have f ( x K ) ≤ 1 K (cid:80) K − 1 k =0 f ( x k ) , where x K = 1 K (cid:80) K − 1 k =0 x k .
Using this and new notation
R k
= (cid:107) x
k − x ∗ (cid:107) , k > 0 , R 0 ≥ (cid:107) x 0 − x ∗ (cid:107) we get
[Equation]
implying (after changing the indices)
that
[Equation]
holds for all k ≥ 0 .
In the remaining part of the proof we derive by induction that
[Equation]
for all k = 0 , . . .
, K .
For k =
this inequality trivially holds.
Next, assume that it holds for all k = 0 , 1 , . .
, T − 1 , T ≤ K − 1 .
Let us show that it holds for k = T as well.
From (37) and (38) we have that E [ R 2 k ] ≤ 2 R 20 for all k = 0 , 1 , . . .
, T − 1 .
Therefore,
[Equation]
If a Byzantine peer deviates from the protocol at iteration k , it will be detected with some probability p k during the next iteration.
One can lower bound this probability as
[Equation]
Therefore, each individual Byzantine worker can violate the protocol no more than 1 / p times on average implying that
[Equation]
Taking
[Equation]
we ensure that
[Equation]
and, as a result, we get E [ R 2 T ] ≤ 2 R 20 .
Therefore, (38) holds for all k = 0 , 1 , . .
, K .
Together with (36) it implies
[Equation]
Next, from our stepsize rule (34) it follows that
[Equation]
meaning that after
K
[Equation]
O
[Equation]
iterations BTARD-SGD guarantees E [ f ( x K ) − f ( x ∗ )] ≤ ε .
In the convex case, similar observations hold as in the non-convex case.
Next, we derive the result without assuming that (cid:98) b k is known to all peers at each iteration.
Theorem E.5.
Let As. 3.1 and 3.2 hold, Q = R d , f be L -smooth (see Def.
E.1), convex, and x ∗ be some optimum of f .
Moreover, assume that b ≤ 0 .
1( n − m ) , m ≤ ( n − 2 b ) / 2 , and δ = 0 is used to compute clipping parameter τ l for CenteredClip.
Next, assume that
[Equation]
where R 0 ≥ (cid:107) x 0 − x ∗ (cid:107) and ∆ k max is the parameter for veriﬁcation 3 at iteration k of BTARD-SGD .
Then, we have E [ f ( x K ) − f ( x ∗ )]
≤ ε after K iterations of BTARD-SGD , where
[Equation]
and x K = 1 K (cid:80) K − 1 k =0 .
Proof.
The proof is almost identical to the proof of Theorem E.4.
Following the same steps and using (27) and (28) instead of (25) and (26) respectively we obtain the same sequence of inequalities up to the following change: instead of (cid:98) δ k we should use 1 k,v .
Therefore, we have
[Equation]
that result in
[Equation]
Taking the full expectation from the both sides of the above inequality and summing up the results for k = 0 , 1 , . .
, K − 1 we derive
[Equation]
From Jensen’s inequality we have f ( x K ) ≤ 1 K (cid:80) K − 1 k =0 f ( x k ) , where x K = 1 K (cid:80) K − 1 k =0 x k .
Using this and new notation
R k
= (cid:107) x
k − x ∗ (cid:107) , k ≥
we get 0 ≤ γ E (cid:2) f
( x K ) − f ( x ∗ ) (cid:3) ≤
[Equation]
41) implying (after changing the indices)
that
[Equation] [Equation]
holds for all k ≥ 0 .
In the remaining part of the proof we derive by induction that
[Equation]
for all k = 0 , . . .
, K .
For k =
this inequality trivially holds.
Next, assume that it holds for all k = 0 , 1 , . .
, T − 1 , T ≤ K − 1 .
Let us show that it holds for k = T as well.
From (42) and (43) we have that E [ R 2 k ] ≤ 2 R 20 for all k = 0 , 1 , . . .
, T − 1 .
Therefore,
[Equation]
If a Byzantine peer deviates from the protocol at iteration k , it will be detected with some probability p k during the next iteration.
One can lower bound this probability as
[Equation]
That is, each individual Byzantine worker can violate the protocol no more than 1 / p times on average.
However, even one Byzantine peer can create a shift of the order ∆ k max at each part of the resulting vector.
Therefore, all Byzantine peers can violate the protocol no more than b / p times on average implying that
[Equation]
Taking
[Equation]
we ensure that
[Equation]
and, as a result, we get E [ R 2 T ] ≤ 2 R 20 .
Therefore, (43) holds for all k = 0 , 1 , . .
, K .
Together with (41) it implies
[Equation]
Next, from our stepsize rule (39) it follows that
[Equation]
meaning that after
[Equation]
iterations BTARD-SGD guarantees E [ f ( x K ) − f ( x ∗ )] ≤ ε .
E.3. S TRONGLY CONVEX CASE : R ESTARTED -BTARD-SGD
In this section, we provide the complete statements and the full proofs of the convergence results for the restarted version of BTARD-SGD (R ESTARTED -BTARD-SGD, Alg. 7) when the objective function f is smooth and strongly convex.
Input: starting number restarts γ
BTARD
– number iterations k t }
K r i k t seeds do
Deﬁne (cid:98) x t as (cid:98) x t = 1 K t
K t (cid:80) k
=0 x k,t , where x 0 ,t , x 1 ,t , . . .
x K t iterates produced by BTARD-SGD.
Output:
We start with the case when the number of attacking Byzantine workers is known at each iteration.
Theorem E.6.
Let As. 3.1 and 3.2 hold, Q = R d , f be L -smooth (see Def.
E.1), µ -strongly convex (see Def.
E.2), and x ∗ be some optimum of f .
Moreover, assume that b ≤ 0 .
1( n − m ) , m ≤ ( n − 2 b ) / 2 , and the exact number of attacking Byzantine peers is known to all good peers at each iteration.
Next, assume that
[Equation]
where R 0 ≥ (cid:107) x 0 − x ∗ (cid:107) , ∆ k,t max is the parameter for veriﬁcation 3 at iteration k of BTARD-SGD during the t -th restart, n tk is the total number of workers at iteration k of t -th restart.
Then, we have E [ f (
[Equation]
x r ) − f ( x ∗ )] ≤ ε after r restarts of BTARD-SGD and the total number of executed iterations of BTARD-SGD is
[Equation]
Proof.
Theorem E.4 implies that BTARD-SGD with γ = min
[Equation]
guarantees
[Equation]
after K iterations.
Therefore, after the ﬁrst restart we have
[Equation]
From µ -strong convexity of f and ∇ f ( x ∗ ) =
we have
[Equation]
Next, assume that we have E [ f ( (cid:98) x t ) − f ( x ∗
[Equation]
] ≤ µR
[Equation]
, E [
[Equation]
x t − x ∗
[Equation]
2 ] ≤ R 20 2 t for some t ≤ r − 1 .
Then, Theorem E.4 implies that
[Equation]
Taking the full expectation from the both sides of previous inequality we get
[Equation]
From µ -strong convexity of f and ∇ f ( x ∗ ) =
we have
[Equation]
Therefore, by mathematical induction we have that for all t = 1 , . . .
, r
[Equation]
Then, after r = (cid:108) log 2 µR 20 ε (cid:109) − 1 restarts of BTARD-SGD we have E [ f ( (cid:98) x r ) − f ( x ∗ )] ≤ ε .
The total number of iterations executed by BTARD-SGD is
[Equation]
In the strongly convex case, similar observations hold as in the non-convex case.
Next, we derive the result without assuming that (cid:98) b k is known to all peers at each iteration.
Theorem E.7.
Let As. 3.1 and 3.2 hold, Q = R d , f be L -smooth (see Def.
E.1), µ -strongly convex (see Def.
E.2), and x ∗ be some optimum of f .
Moreover, assume that b ≤ 0 .
1( n − m ) , m ≤ ( n − 2 b ) / 2 , and δ = 0 is used to compute clipping parameter τ l for CenteredClip.
Next, assume that
[Equation]
where R 0 ≥ (cid:107) x 0 − x ∗ (cid:107) , ∆ k,t max is the parameter for veriﬁcation 3 at iteration k of BTARD-SGD during the t -th restart, n tk is the total number of workers at iteration k of t -th restart.
Then, we have E [ f
[Equation]
x r ) − f ( x ∗ )] ≤ ε after r restarts of BTARD-SGD and the total number of executed iterations of BTARD-SGD is
[Equation]
Proof.
Theorem E.5 implies that BTARD-SGD with
[Equation]
=
[Equation]
guarantees
[Equation]
after K iterations.
Therefore, after the ﬁrst restart we have
[Equation]
From µ -strong convexity of f and ∇ f ( x ∗ ) =
we have
[Equation]
Next, assume that we have E [ f (
[Equation]
x t ) − f
[Equation]
x ∗ )] ≤ µR
[Equation]
+1 , E [
[Equation]
t − x ∗
[Equation]
2 ] ≤ R 20 2 t for some t ≤ r − 1 .
Then, Theorem E.5 implies that
[Equation]
Taking the full expectation from the both sides of previous inequality we get
[Equation]
From µ -strong convexity of f and ∇ f ( x ∗ ) =
we have
[Equation]
Therefore, by mathematical induction we have that for all t = 1 , . . .
, r
[Equation]
Then, after r = (cid:108) log 2 µR 20 ε (cid:109) − 1 restarts of BTARD-SGD we have E [ f ( (cid:98) x r ) − f ( x ∗ )] ≤ ε .
The total number of iterations executed by BTARD-SGD is r
[Equation]
=
[Equation]
20 · µR
[Equation]
mµR
[Equation]
(cid:114) µRε (cid:33) =
O (cid:18)
[Equation]
log µR
[Equation]
nµε
[Equation]
nbσ m
[Equation]
(cid:19) .
E. C ONVERGENCE GUARANTEES FOR BTARD-C LIPPED -SGD
The results for BTARD-SGD and R ESTARTED -BTARD-SGD rely on As. 3.2 that the stochastic gradients have not too heavy tails, i.e., sub-quadratically decreasing tails.
The main reason why it is needed in the analysis is to prevent too often extra computations because of Veriﬁcation 3 from
BTARD when all workers honestly follow the protocol.
However, in many important NLP tasks such as BERT training (Zhang et al., 2020), the noise in the stochastic gradient has such a heavy noise that
As. 3.2 becomes unnatural.
Algorithm
8 BTARD-C LIPPED -SGD
Input: x 0 – starting point, γ – stepsize, K – number of iterations, { s i,k } n,K − 1 i,k =0 , 0 – seeds for batches computations, { λ k } K − 1 k =0 – gradient clipping parameter 1: C 0 =
Banned − 1 = ∅ 2: for k = 0 , 1 , . .
, K − 1 do 3:
Worker i computes (cid:101) g ki = (cid:40) min (cid:110) 1 , λ k (cid:107)∇ f ( x k ,ξ i,k ) (cid:107) (cid:111) ∇ f ( x k , ξ i,k ) , if i ∈ G k \ C k , ∗ , if i ∈ B k \ C k , , where ξ i,k is generated via seed s i,k available to every worker 4: (cid:0)(cid:98)
g k , public_info k (cid:1) =
BTARD ( (cid:101) g ki k 1 , g ki k 1 , . .
, (cid:101) g ki kak ) , where { i k 1 , . . .
, i ka k } =
( G k
∪ B k ) \ C k 5:
Choose 2 m workers c k + , . .
c k +1 m , u k + , . . .
, u k +1 m uniformly at random without replacement, C k +
= { c k + , . . .
c k +1 m } ,
U k +1 =
{ u k + , . . .
u k +1 m } 6:
Banned k = C HECK C OMPUTATIONS ( C k
+1 , U k
+1 , public_info k ) 7: x k +1 =
proj Q
( x k − γ (cid:98) g k ) := argmin x ∈ Q (cid:107) x − ( x k − γ (cid:98) g k ) (cid:107) 8:
G k +1 =
G k \ Banned k −9:
B k +1 =
B k \ Banned k −
To handle the problems with heavy-tailed noise distributions we consider BTARD-C LIPPED -SGD (see Alg. 8 in Appendix) applied to solve (3) such that Q is bounded.
Essentially, this algorithm coincides with BTARD-SGD up to the following change: all good peers i ∈ G k \ C k use clipped stochastic gradients (cid:101)
g
ki =
( (cid:101) g ki (1) (cid:62) , . . .
, (cid:101) g ki ( n k − m ) (cid:62) ) (cid:62) , where (cid:101) g ki ( l ) =
min (cid:110) 1 ,
[Equation]
k (cid:107) g ki ( l ) (cid:107) (cid:111)
g ki ( l ) , l = 1 , . . . , n k − m , and g ki is the stochastic gradient.
Next, we introduce the following assumption.
Assumption E.1.
There exist such constant G > 0 , s 0 ∈
[ d ] , and α ∈ (1 , 2] that for any set of indices S
= ( i 1 , . . .
, i d ) , 1 ≤ i 1 < i 2 < . . .
<
i s ≤ d , s ≥ s 0 and arbitrary x ∈ Q stochastic gradient ∇ f ( x, ξ ) satisfy
[Equation]
where ∇ [ S ] f ( x, ξ ) is deﬁned in As. 3.1.
This is a modiﬁed version of the assumption used in Zhang et al.
When α < 2 the variance of the stochastic gradient can be unbounded.
One can show that in such a regime vanilla SGD can diverge (Zhang et al., 2020).
Under As.
E.1 we derive the convergence results for convex and strongly convex problems.
E.4. Q UALITY OF THE AGGREGATION
Since now we have As.
E.1 instead of As. 3.1 and 3.2 it is needed to derive new guarantees for the quality of the aggregation.
We start with the following useful lemma about the properties of clipped stochastic gradeints.
Lemma E.5 (See also Lemma 9 from Zhang et al.
Let As.
E.1 holds
and i, j ∈ G k \ C k .
Then, for all l = 1 , 2 , . .
. , n k − m we have
[Equation]
where g k ( l ) = 1 |G k \C k | (cid:80)
i
[Equation] [Equation]
ki
[Equation]
for all l =
[Equation] [Equation]
n k − m .
Proof.
First of all, we derive
[Equation]
implying (51).
Next, for all i ∈ G k \ C k we have
[Equation]
implying
[Equation]
[Table]
[Equation]
[Table]
[Equation]
Next, we derive the guarantees for the quality of the aggregation in the case when the number of
Byzantine peers violating the protocol (cid:98) b k is known at each iteration.
Lemma E.6.
Let As.
E.1 hold and b ≤ 0 .
15( n − m ) .
Assume that (cid:98) b k is known for each worker at iteration k , ∆ k max =
λ k = 2 λ √ n k − m and δ = (cid:98) δ k is used to compute clipping parameter τ l for
CenteredClip.
If the total number of iterations T of CenteredClip satisﬁes T ≥ log 0 .
[Equation]
and C HECK
A VERAGING is not triggered for any worker, then
[Equation]
where g k = 1 |G k \C k | (cid:80) j ∈G k \C k g kj , C 1 = 384 , and C 2 = 4 .
Proof.
Consider the i -th part of (cid:98) g k , i.e., consider (cid:98) g k
( i ) .
If i ∈ G k \ C k , then, in view of (51), we can directly apply Lemma E.1 and get
[Equation]
Next, if i ∈ B k \ C k
[Equation]
then
[Equation]
Putting all together
[Equation]
we derive
[Equation]
Using (52) we obtain
[Equation]
We notice that Veriﬁcation 3 can be simpliﬁed in the following way: if at least on good peer i notices that (cid:107) (cid:101) g ki ( j ) − (cid:98) g k ( j ) (cid:107) > ∆ k max = 2 λ k , then peer i should accuse j -th peer and both are removed from the training process.
In this scenario, there is no sense for Byzantine workers in triggering to deviate signiﬁcantly from the clipped stochastic gradients of the good peers.
As for BTARD-SGD, when (cid:98) b k is unknown we always use C ENTERED C LIP with τ l = ∞ for all l ≥ 0 , i.e., good peers compute an exact average.
In this settings, even 1 Byzantine worker can signiﬁcantly shift the average in all parts of the vector.
The next lemma quantiﬁes the negative effect of Byzantine workers in this case.
Lemma E.7.
Let As.
E.1 hold and b ≤ 0 .
15( n − m ) .
Assume that (cid:98) b k is known for each worker at iteration k , ∆ k max =
λ k = 2 λ √ n k − m and δ = (cid:98) δ k is used to compute clipping parameter τ l for
CenteredClip.
If the total number of iterations T of CenteredClip satisﬁes T ≥ log 0 .
[Equation]
and C HECK
A VERAGING is not triggered for any worker, then
[Equation] [Equation]
where g k = 1 |G k \C k | (cid:80) j ∈G k \C k g kj , C 2 = 4 , and 1 k,v is an indicator function of the event that at least
Byzantine peer violates the protocol at iteration k .
Proof.
For all i ∈ ( G k ∪ B k ) \ C k we have
[Equation]
implying
[Equation]
Using (52) we obtain
E (cid:2) (cid:107) (cid:98) g k (cid:107)
[Equation]
E.4. C ONVEX CASE
In this section, we provide the complete statements and the full proofs of the convergence results for
BTARD-C LIPPED -SGD when the objective function f is smooth and convex.
We start with the case when the number of Byzantine peers violating the protocol (cid:98) b k is known at each iteration.
Theorem E.8.
Let As.
E.1 hold, Q is bounded, f be convex, x ∗ be some optimum of f , and ∇ f ( x ∗ ) = 0 .
Moreover, assume that b ≤ 0 .
15( n − m ) , m ≤ ( n − 2 b ) / 2 , and the exact number of attacking Byzantine peers is known to all good peers at each iteration.
Next, assume that
[Equation]
where R 0 ≥ (cid:107) x 0 − x ∗ (cid:107) and ∆ k max is the parameter for veriﬁcation 3 at iteration k of BTARDC LIPPED -SGD .
Then, we have E [ f ( x K ) − f ( x ∗ )]
≤ ε after K iterations of BTARD-C LIPPED -SGD , where
[Equation]
and x K = 1 K (cid:80) K − 1 k =0 .
Proof.
Non-expansiveness of the projection operator and convexity of f imply
[Equation]
Taking conditional expectation E [ · | x k ] from the both sides of previous inequality we derive
[Equation]
To estimate the inner product in the right-hand side we apply Cauchy-Schwarz inequality:
[Equation]
where in the last inequality we use b ≤ 0 . 15( n − m ) , m ≤ ( n − 2 b ) / 2 , γ ≤ 1 / 4 L , n k − m ≥ n − 2 b − m ≥ 720 n .
Putting all together we obtain
[Equation]
Taking the full expectation from the both sides of the above inequality and summing up the results for k = 0 , 1 , . . .
[Equation]
T − 1 we derive
[Equation]
From Jensen’s inequality we have f ( x T ) ≤ 1 T (cid:80) T − 1 k =0 f ( x k ) , where x T = 1 T (cid:80) T − 1 k =0 x k .
Using this and new notation
R k
= (cid:107) x
k − x ∗ (cid:107) , k > 0 , R 0 ≥ (cid:107) x 0 − x ∗ (cid:107) we get 0 ≤ 2 γ E (cid:2)
f ( x T ) − f ( x ∗ ) (cid:3) ≤
[Equation] [Equation]
implying (after changing the indices)
that
[Equation]
holds for all k ≥ 0 .
In the remaining part of the proof we derive by induction that
[Equation]
for all k = 0 , . . .
, K .
For k =
this inequality trivially holds.
Next, assume that it holds for all k = 0 , 1 , . .
, T − 1 , T ≤ K − 1 .
Let us show that it holds for k = T as well.
From (37) and (38) we have that E [ R 2 k ] ≤ 2 R 20 for all k = 0 , 1 , . . .
, T − 1 .
Therefore,
[Equation]
If a Byzantine peer deviates from the protocol at iteration k , it will be detected with some probability p k during the next iteration.
One can lower bound this probability as
[Equation]
Therefore, each individual Byzantine worker can violate the protocol no more than 1 / p times on average implying that
[Equation]
Taking
[Equation]

[Equation]
we ensure that
[Equation]
= R
[Equation]
and, as a result
[Equation]
we get E [ R 2 T ] ≤ 2 R 20 .
Therefore, (63) holds for all k = 0 , 1 , . .
, K .
Together with (61) it implies
[Equation]
Next
[Equation]
from our stepsize rule (58) it follows that
[Equation]
meaning that after
[Equation]
iterations BTARD-C LIPPED -SGD guarantees E [ f ( x K ) − f ( x ∗ )] ≤ ε .
If there are no Byzantine peers ( δ = 0 ), the theorem establishes new result for the convergence of
C LIPPED -SGD for convex objectives.
In the strongly convex case, the theorem recovers the rates that are optimal in this setting as shown in Zhang et al.
Next, when the number of attacking
Byzantines is known at each iteration and n √ δ / m =
O (1) , the complexity bound is the same as in the case when δ = 0 .
This means that the negative impact of Byzantine workers is negligible.
Finally, the derived theoretical guarantees do not beneﬁt from the increase of the total number of peers n .
However, the result holds even for non-smooth problems and it is known that parallelization does not help to improve the complexity bounds in such generality.
Nevertheless, our results show that
BTARD-C LIPPED -SGD provably converges to any predeﬁned accuracy ε > 0 .
This is a property that the majority of previous methods does not have (Karimireddy et al., 2020).
Next, we derive the result without assuming that (cid:98) b k is known to all peers at each iteration.
Theorem E.9.
Let As.
E.1 hold, Q is bounded, f be convex, x ∗ be some optimum of f , and ∇ f ( x ∗ ) = 0 .
Moreover, assume that b ≤ 0 .
15( n − m ) , m ≤ ( n − 2 b ) / 2 , and δ = 0 is used to compute clipping parameter τ l for CenteredClip.
Next, assume that
[Equation]
where R 0 ≥ (cid:107) x 0 − x ∗ (cid:107) and ∆ k max is the parameter for veriﬁcation 3 at iteration k of BTARDC LIPPED -SGD .
Then, we have E [ f ( x K ) − f ( x ∗ )]
≤ ε after K iterations of BTARD-C LIPPED -SGD , where
[Equation]
and x K = 1 K (cid:80) K − 1 k =0 .
Proof.
The proof is almost identical to the proof of Theorem E.8.
Following the same steps and using (56) and (57) instead of (54) and (55) respectively we obtain the same sequence of inequalities up to the following change: instead of (cid:98) δ k we should use 1 k,v .
Therefore, we have
[Equation]
, and
E
[Equation]
Taking the full expectation from the both sides of the above inequality and summing up the results for k = 0 , 1 , . .
, T − 1 we derive
[Equation]
From Jensen’s inequality we have f ( x T ) ≤ 1 T (cid:80) T − 1 k =0 f
( x k )
[Equation]
where x T = 1 T (cid:80) T − 1 k =0 x k .
Using this and new notation
R k
= (cid:107)
[Equation]
(cid:107) we get
[Equation]
implying (after changing the indices)
that
[Equation]
holds for all k ≥ 0 .
In the remaining part of the proof we derive by induction that
[Equation]
for all k = 0 , . . .
, K .
For k =
this inequality trivially holds.
Next, assume that it holds for all k = 0 , 1 , . .
, T − 1 , T ≤ K − 1 .
Let us show that it holds for k = T as well.
From (42) and (43) we have that E [ R 2 k ] ≤ 2 R 20 for all k = 0 , 1 , . . .
, T − 1 .
Therefore,
[Equation]
If a Byzantine peer deviates from the protocol at iteration k , it will be detected with some probability p k during the next iteration.
One can lower bound this probability as
[Equation]
That is, each individual Byzantine worker can violate the protocol no more than 1 / p times on average.
However, even one Byzantine peer can create a shift of the order ∆ k max at each part of the resulting vector.
Therefore, all Byzantine peers can violate the protocol no more than b / p times on average implying that
[Equation]
Taking
[Equation]
=
[Equation]
we ensure that
[Equation]
and, as a result
[Equation]
we get E [ R 2 T ] ≤ 2 R 20 .
Therefore, (69) holds for all k = 0 , 1 , . .
, K .
Together with (67) it implies
[Equation]
Next, from our stepsize rule (64) it follows that
[Equation]
meaning that after
[Equation]
iterations BTARD-C LIPPED -SGD guarantees E [ f ( x K ) − f ( x ∗ )] ≤ ε .
That is, when the number of attacking Byzantines is unknown the complexity bound becomes ( nb / m ) α / ( α − 1) times worse in comparison to (60).
E.4. S TRONGLY CONVEX CASE : R ESTARTED -BTARD-C LIPPED -SGD
In this section, we provide the complete statements and the full proofs of the convergence results for the restarted version of BTARD-C LIPPED -SGD
(R ESTARTED -BTARD-C LIPPED -SGD, Alg. 7) when the objective function f is smooth and strongly convex.
Input: x 0 – starting point, r – number of restarts, { γ t } rt =1 – stepsizes for BTARD-C LIPPED -SGD, { K t } rt =1 – number of iterations for BTARD-C LIPPED -SGD, { s i,k,t } n,K − 1 ,r i,k,t =0 , 0 , 1 – seeds for batches computations, { λ k,t } K t ,r k,t =0 , 1 – gradient clipping parameters 1: (cid:98)
2: for t = 1 , 2 , . . .
, r do 3:
Run BTARD-C LIPPED -SGD (Alg.
8) for K t iterations with stepsize γ t , starting point (cid:98) x
t − 1 , gradient clipping parameters { λ k,t } K − 1 k =0 , and seeds for batches computations { s i,k,t } n,K − 1 i,k =0 , 0 .
Deﬁne (cid:98) x t as (cid:98) x t = 1 K t K t (cid:80) k
=0 x k,t , where x 0 ,t , x 1 ,t , . . .
, x K t ,t are the iterates produced by BTARD-
Output: (cid:98) x r
We start with the case when the number of attacking Byzantine workers is known at each iteration.
Theorem E.10.
Let As.
E.1 hold, Q is bounded, f be µ -strongly convex (see Def.
E.2), x ∗ be some optimum of f , and ∇ f ( x ∗ ) = 0 .
Moreover, assume that b ≤ 0 .
15( n − m ) , m ≤ ( n − 2 b ) / 2 , and the exact number of attacking Byzantine peers is known to all good peers at each iteration.
Next, assume that
[Equation]
where R 0 ≥ (cid:107) x 0 − x ∗ (cid:107) and ∆ k,t max is the parameter for veriﬁcation 3 at iteration k of BTARDC LIPPED -SGD , n tk is the total number of workers at iteration k of t -th restart.
Then, we have E [ f ( (cid:98) x r ) − f ( x ∗ )] ≤ ε after r restarts of BTARD-C LIPPED -SGD and the total number of executed iterations of BTARD-C LIPPED -SGD is
[Equation]
Proof.
Theorem E.8 implies that BTARD-C LIPPED -SGD with
[Equation]
guarantees
[Equation]
after K iterations.
Therefore, after the ﬁrst restart we have
[Equation]
From µ -strong convexity of f and ∇ f ( x ∗ ) =
we have
[Equation]
Next, assume that we have E [
[Equation]
t for some t ≤ r − 1 .
Then, Theorem E.8 implies that
[Equation]
Taking the full expectation from the both sides of previous inequality we get
[Equation]
µR
[Equation]
From µ -strong convexity of f and ∇ f ( x ∗ ) =
we have
[Equation]
Therefore, by mathematical induction we have that for all t = 1 , . . .
, r
[Equation]
Then, after r = (cid:108) log 2 µR 20 ε (cid:109) − 1 restarts of BTARD-C LIPPED -SGD we have E [ f ( (cid:98) x r ) − f ( x ∗ )] ≤ ε .
The total number of iterations executed by BTARD-C LIPPED -SGD is r (cid:88)
[Equation]
In the strongly convex case, similar observations hold as in the convex case.
Next, we derive the result without assuming that (cid:98) b k is known to all peers at each iteration.
Theorem E.11.
Let As.
E.1 hold, Q is bounded, f be µ -strongly convex (see Def.
E.2), x ∗ be some optimum of f , and ∇ f ( x ∗ ) = 0 .
Moreover, assume that b ≤ 0 .
15( n − m ) , m ≤ ( n − 2 b ) / 2 , and δ =is used to compute clipping parameter τ l for CenteredClip.
Next, assume that
[Equation]
where R 0 ≥ (cid:107) x 0 − x ∗ (cid:107) and ∆ k,t max is the parameter for veriﬁcation 3 at iteration k of BTARDC LIPPED -SGD , n tk is the total number of workers at iteration k of t -th restart.
Then, we have E [ f ( (cid:98) x r ) − f ( x ∗ )] ≤ ε after r restarts of BTARD-C LIPPED -SGD and the total number of executed iterations of BTARD-C LIPPED -SGD is
[Equation]
Proof.
Theorem E.9 implies that BTARD-C LIPPED -SGD with
[Equation]
guarantees
[Equation]
after K iterations.
Therefore, after the ﬁrst restart we have
[Equation]
From µ -strong convexity of f and ∇ f ( x ∗ ) =
we have µ
[Equation]
Next, assume that we have E [ f ( (cid:98) x
[Equation]
for some t ≤ r −
[Equation]
Then, Theorem E.9 implies that
[Equation]
Taking the full expectation from the both sides of previous inequality we get
[Equation]
From µ -strong convexity of f and ∇ f ( x ∗ ) =
we have
[Equation]
Therefore, by mathematical induction we have that for all t = 1 , . . .
, r
[Equation]
Then, after r = (cid:108) log 2 µR 20 ε (cid:109) − 1 restarts of BTARD-C LIPPED -SGD we have E [ f ( (cid:98) x r ) − f ( x ∗ )] ≤ ε .
The total number of iterations executed by BTARD-C LIPPED -SGD is r (cid:88) t =
[Equation]
K
[Equation]
=
[Equation]
max 
[Equation]
O
[Equation]
max
[Equation]
= O
[Equation]
max
[Equation]
= O
[Equation]
m
[Equation]
F R EPUTATION SYSTEM FOR PUBLIC COLLABORATIONS
In this section, we address Byzantine-tolerant training in a setup where new participants can join or leave collaboration midway through training.
This requirement arises naturally if a given training run relies on volunteers or an open pool of paid participants (Kijsipongse et al., 2018;
Ryabinin & Gusev, 2020; Atre et al., 2021; Diskin et al., 2021).
In addition to all existing concerns from Section 3, this new setup allows Byzantine attackers to assume new identity each time they are blocked.
Further yet, Byzantine participants can simultaneously use multiple identities in order to obtain majority in the voting procedure, which is known as Sybil attacks (Douceur, 2002;
Trifa & Khemakhem, 2014;
Wang & Kangasharju, 2012).
In this analysis 9 , we consider a training run where Byzantine peers collectively possess δ <
δ max of all compute resources (we explore the role of δ max < 1 / 2 later in this section).
Intuitively, one can think of this setting as distributed training with n identical computers, (cid:98) δ · n (cid:99) of which are controlled by Byzantines.
The “Byzantine GPUs” can be allocated between an arbitrary number of identities.
For instance, one accelerator can run full BTARD-SGD protocol for one peer or drop some of the computation and use the freed “compute cycles” to run computation for another participant.
Theoretically, a device can run computation for an arbitrarily large number of peers, as long as it actually computes as many gradients as one benign participant does in the same time-frame.
To protect against this new attack type, we augment BTARD-SGD with a reputation system designed to limit the impact of pseudonymous identities with the actual underlying compute.
We base this system on the following three assumptions:
Unique and optimal computations: the gradients computed by peer i at step k cannot be circumvented or reused from other peers and/or previous steps.
Public key infrastructure: peers have unique public/private key pairs and know each other’s public keys.
Cryptographic hash: peers have access to a hash function such that ﬁnding a vector x satisfying hash ( x
) =
y is infeasible for (cid:98) δ · n (cid:99) compute over the entire training duration.
We associate each participant with a public record that is used to verify that peer’s legitimacy.
These records can be securely stored in a Distributed Hash Table (see Appendix G).
When a new peer joins the network, it begins with an empty record and is therefore “untrusted”.
Untrusted peers compute gradients normally, but cannot aggregate vectors from others and cannot serve as validators.
More importantly, other peers exclude untrusted gradients from aggregation, using them only for the purpose of validating those peers.
Each time a peer computes gradients g ki over publicly known batch ξ ki , it must write hash ( g ki ) to its own public record and sign it with its private key.
As in the original BTARD-SGD, some of those entries will be validated by other peers chosen by MPRNG.
In turn, the chosen validators will either approve their entry or invoke A CCUSE to ban the peer.
In order to become trusted, a given peer must report consecutive gradients until it accumulates T entries approved by (provably) random peers.
Here, T is a hyperparameter that should be large enough for the training to recover from any previous attacks and make some progress before previously banned malicious peers can earn trust again.
In practice, T may be chosen experimentally by observing the number of iterations it takes to improve the loss upon its pre-attack value in case of the most effective attacks, as reported in Section 4.
While T may be application-dependent, we note that its minimal value is small in terms of the relative training time in all our experiments.
T corresponding to the 10% of total training time is more thantimes larger than the worst “recovery time” for both setups considered in Section 4, where almost a half of the peers are Byzantine.
Moreover, Appendix I.1 suggests that recovery from the worst-case attack may happen even faster in case of a smaller share of Byzantines.
In that setup (with ≈ 20% of peers being Byzantine), T corresponding to the 1% of training time is already enough.
Once a peer becomes trusted, it must continue reporting gradient hashes to maintain trust.
Even a single missing or invalidated hash breaks the chain and results in the corresponding peer being banned.
To maintain this invariant, peers chosen as a validators add the recalculated hashes into their own record instead of the skipped iteration.
To protect against dilution attacks, a cooperative training run can simultaneously consider at most as many “untrusted” peers as there are trusted ones: all subsequent peers wait in a queue until one of the untrusted peers becomes either trusted or banned.
Analysis.
Under this formalism, a Sybil attacker will attempt to maximize the number of trusted identities it can control with a limited amount of compute.
In the simplest case, an attacker has exactly one GPU that can be used to either run all computations for identity or partial computation for multiple identities.
In the latter case, an attacker can honestly compute gradients for identity A with probability p ∈ [0 , 1] and for identity B with probability 1 − p .
To breaking the chain, the identity that does not compute gradients at a given step can report arbitrary (e.g. random) entries instead of hash ( g ki ) .
Consider the expected number of “trusted” identities after enough steps for T validations by honest validators (on average, T ·
[Equation]
steps).
Identity A becomes trusted with probability p T , otherwise it is banned.
Similarly, identitiy B survives with probability (1 − p ) T .
Thus, the expected number of trusted identities after T steps is p T + (1 − p ) T .
For T > 1 , this expectation is maximal iff p ∈ { 0 , 1 } .
Thus, if a peer needs more than one validation to become trusted, the “optimal strategy” for a Sybil attacker is to fully support one identity instead of spreading the resources between multiple ones.
This observation can be generalized for distributing (cid:98) δ · n (cid:99) over an m ≥ (cid:98) δ · n (cid:99) pseudonymous identities, where maximizing the expected number of trusted identities requires fully supporting any (cid:98) δ · n (cid:99) identities and disregarding the rest (for T > 1 , as before).
Overhead computation.
When training without Byzantine participants, this modiﬁed version of
BTARD-SGD requires, on average, T · nk additional gradient computations per participant at the very beginning.
However, once all peers become trusted, the algorithm computes exactly the same number of gradients as regular BTARD-SGD, effectively training at n − kn efﬁciency of AR-SGD, plus the same communication overhead.
Remark 1: Temporary majority.
Despite the fact that spreading 1 “compute unit” across multiple identities reduces the expected number of trusted identities, it may still be useful to establish a temporary majority, albeit with a small probability.
For instance, splitting one compute unit evenly among m identities (each with p =1 /m ) may result in both m identities temporarily gaining trust with probability:
[Equation]
A Sybil attacker can simply repeat this procedure on every step until it can establish a temporary majority and use this majority to harm training (e.g. ban non-malicious peers).
A natural way to remedy this is to increase T to such an extent that (78) becomes negligibly small.
Remark 2: Extra compute for Byzantine nodes.
Unlike benign peers, Byzantine attackers do not need to honestly validate each other.
When a Byzantine peer is chosen as validator, it can approve its target without actually computing the gradients.
In turn, the freed compute resources can be used to support additional Byzantine identities.
Thus, if a given training run has n trusted peers and chooses k validators on each step, Sybil attackers can control slightly more than (cid:98) δ · n (cid:99) of all identities by using the free compute cycles from validation to support additional peers.
Thus, the proposed reputation system requires that the total computational power B max available to Byzantines is less than 12 by a (typically small) margin that depends on n , k , and T .
Remark 3: Perpetual attacks.
When training in open collaborations, one cannot ban the Byzantine peers entirely: a Byzantine attacker will always be able to assume a new identity at the cost of running honestly for T · n k · (1 − δ ) gradient steps.
Thus, unlike in Appendix E, we cannot make BTARD-SGD unbiased by increasing τ .
However, as we demonstrated in Section 4, the biased variant of BTARDSGD with constant τ can still train real-world deep learning models with the same or virtually the same learning curves as regular SGD.
G S ECURE DISTRIBUTED HASH TABLES
Distributed Hash Tables (DHT) are protocols that establish a decentralized key-value storage over decentralized unreliable participants (Maymounkov & Mazieres, 2002; Balakrishnan et al., 2003;
Zhao et al., 2003; Rowstron & Druschel, 2001).
To determine which DHT peers are responsible for a given key-value pair, each participant samples a unique binary identiﬁer (ID) sampled uniformly from the space of hash function outputs.
When “storing a ( key, value ) ” on the DHT, one ﬁnds k peers whose IDs are nearest to hash( key ) and sends the data to each one of those peers.
In turn, a peer that wants to read the value or a given key will also search for neighbors whose IDs are close to hash( key ) and request the data from those peers.
Thus, the data can be accessed as long as at least one o k chosen peers remains active, with some DHT variants introducing additional replication protocols.
Our speciﬁc implementation is based on Kademlia (Maymounkov & Mazieres, 2002), a popular DHT variant that determines nearest neighbors based on XOR distance function or their IDs: d ( x, y )
=
int( x ⊕ y ) .
More importantly, Kademlia protocol organizes nodes in such a way that each individual peer only “knows” a small subset of O (log 2 n ) direct neighbors, however, it is possible to navigate the neighborhood graph to ﬁnd the globally nearest neighbors in O (log 2 N ) network requests.
DHT protocols were originally designed for large-scale distributed systems such as BitTorrent, IPFS and several cryptocurrencies.
To maintain integrity in these applications, modern DHT protocols also employ security measures that make them resistant to Byzantine and Sybil attacks (Urdaneta et al., 2011).
In our speciﬁc scenario, the most sensitive DHT entries are personal records that determine whether or not a given peer is trusted.
We protect thee records by enforcing that every value stored in the
DHT must be signed by their author’s digital signature (Rivest et al., 1978).
Thus, if a malicious peer attempts to modify a record it was not supposed to, all other peers will be able to detect that and eliminate such peers from the collective.
However, digital signature are known to be vulnerable to replay attacks: every time a non-Byzantine peer stores an given key-value pair signed with its private key, a Byzantine eavesdropper can record the signed entry and replay it in future.
For ordinary DHTs, this would allow an attacker to revert any key-value pair to its previous state by replaying such pre-recorded messages.
Our algorithm protects against replay attacks by associating each key-value pair with a third value denoted as expiration time .
Given two entries for the same key, DHT nodes will now prioritize the ones with the latest expiration time and consider it valid up to that time.
Furthermore, in order to store a new entry to the DHT, a peer must now sign the entire key-value-expiration tuple.
Thus, if a
Byzantine peer replays a pre-recorded message, it will not be able to overwrite newer DHT entries that were signed for a more recent expiration time.
H ALBERT EXPERIMENT SETUP
In Section 4.2, we pretrain ALBERT (Lan et al., 2019) — a self-supervised Transformer model for learning representations of language data.
We deliberately choose ALBERT instead of other models like BERT (Devlin et al., 2019) due to its high communication efﬁciency, which is caused by layerwise weight sharing and embedding layer factorization.
In particular, we focus on a communicationefﬁcient model, because the connection speed between the workers can become a noticeable constraint when averaging gradients of models with hundreds of millions of parameters.
We train ALBERTlarge on sequences of 512 tokens from the WikiText-103 (Merity et al., 2017) dataset.
The training procedure starts from a random initialization, but the subword vocabulary (Sennrich et al.,
[Figure]
This model is trained with two objectives: masked language modeling (given a sentence with several masked tokens, predict the tokens that were masked) and sentence order prediction (given two segments from the same document, determine if they were swapped).
We use LAMB optimizer (You et al., 2020) with batches that contain 4,096 examples, training with a peak learning rate equal to 0,00176 and a warmup of 5,000 gradient descent steps.
In addition, we use gradient clipping with a maximum norm of 1 and weight decay regularization with the weight of 0,01.
We run distributed training on 16 cloud instances, each equipped with a single Tesla T4 GPU.
Each training run takes 2–3 days, depending on the instance availability.
I A DDITIONAL EXPERIMENTS I. E XTRA EVALUATIONS ON THE CIFAR10 CLASSIFICATION TASK
In this section, we perform several additional experiments with BTARD-SGD used to train the
ResNet-18 model to solve the CIFAR10 classiﬁcation task
To better explore the space of possible attack vectors, we also evaluate two alternative settings.
First, we consider a situation where Byzantine peers are less numerous.
For this experiment, we use the same conﬁguration as in Section 4.1, but with only 3 Byzantine peers out of 16 (just under 20%).
Figure 5 demonstrates similar behavior to our original setup, but with signiﬁcantly weaker in magnitude across all attacks.
Next, we explore a situation where Byzantine peers send incorrect gradients periodically, e.g. once per T iterations.
This reduces the attack intensity, but allows them to stay undetected for longer.
In this setting, we consider 7 Byzantine peers and reuse all parameters from the original setup, except for the new attack period.
We consider T = 10 for both scenarios (early and late attacks).
The attacks are performed at steps s + k · T, k ∈ N until the attacker is eventually banned.
As expected, this setup increases the duration of each attack by a factor of T , but decreases the peak attack inﬂuence (see Figure 6).
Finally, we evaluate the convergence and the ﬁnal test accuracy of the less computationally intensive variants of BTARD-SGD that limit the maximal number of iterations in the CenteredClip procedure
[Figure] [Figure]
to M , where M varies from 1 to 50.
In the setup with τ = 1 , we observe that M = 50 iterations are always enough for CenteredClip to converge with (cid:15)
= 10 − 6 in absence of the attacks.
Figuredemonstrates that stopping the procedure earlier has negative effect on the ﬁnal test accuracy.
The effect becomes more signiﬁcant for the smaller values of M
[Figure]
I.
E VALUATING COMPUTATION OVERHEAD IN TERMS OF WALL TIME
For this analysis, we consider the ALBERT-large training setup from Section 4.2.
Our training “swarm” contains 16 peers with T4 GPUs and 1 GiB/s network bandwidth.
On average overtraining steps, the full training step for this model takes up 28.56 seconds.
Of this, approximately 23.96 seconds were used up for communication and the remaining 4.60 seconds were spent for gradient aggregation C ENTERED C LIP .
Since MPRNG is running in the background, the only part of BTARD that affects the training time is Algorithm 2 (B UTTERFLY C LIP ).
Thus, we measure the time complexity of this algorithm with different numbers of internal iterations.
During “normal” epochs where all Byzantines remained passive, the algorithm converged in 2–3 iterations for τ = 0 .
25 and 5–10 iterations with τ = 0 .
[Table]
We also noticed that this value has temporarily increased by 2–3 times while Byzantine peers were performing their attack.
In Table 3, we report the average wall time of our algorithm with a different number of iterations in two hardware setups: running on a 8-core VM with 3.1Ghz Intel Xeon 6148 CPU and on a single 1080 Ti GPU.
We report the average wall time and the standard deviation over 10 runs.
Thus, even the worst case overhead ( τ = 0 .
125 , CPU) is less than the 3% of the total step time without attacks and less than the 4% when the attack is active.
One important consideration here is that the overhead is constant with respect to the number of peers due to the scaling properties of
All-Reduce.
Thus, if we train with hundreds of peers, the 0.3–0.6 second overhead can eventually become signiﬁcant.
However, it can be easily offset by moving the C ENTERED C LIP execution to
GPU, which at this stage is waiting for the C ENTERED C LIP results anyway.
I. E XPERIMENTS AT A LARGER SCALE
In this section, we evaluate the most effective attacks against BTARD-SGD in case of a larger number of peers to ensure that our algorithm scales well.
We still consider the ALBERT-large training setup from Section 4.2 and increase the number of peers to 64 (the largest hardware setup available to us), setting up 31 of them to be Byzantine.
To balance for the increased number of peers, we divide the individual batch size of each peer by 4 and set the number of validators to be 4 as well.
Due to the large computation costs, we only evaluate the two most effective strategies for Byzantines based on Figure 3, making only one training run for each of them.
We choose the random direction attack starting at the step 1000 and the sign ﬂipping attack starting at the step 5000.
The results are shown in the Figure 8.
Similarly to our previous experiments, the Byzantine peers managed to temporarily offset the training loss.
As in the case with 16 peers, the sign ﬂipping attack at the step 5000 obtains the "peak" distortion approximately 20 steps into the attack, and the random direction attack at the step 1000 has longer but less intensive effect.
However, BTARD-SGD is able to quickly detect and ban the attackers, banning all 31 Byzantines in 100–150 steps and catching up with the original learning curve after approximately 150 steps (it is fair to take the original curves from Figure 3 since the aggregation results in the vanilla All-Reduce do not depend on the number of workers).
We conclude that BTARD-SGD maintains its efﬁciency even at this scale.
[Figure]
[Figure]
[Figure]
( =
[Figure]
[Figure]
[Figure]
I. E XPERIMENTS WITH LOW - MAGNITUDE ATTACKS
In this section, we evaluate several low-magnitude attacks against BTARD-SGD used for training the
ResNet-18 model to solve the CIFAR10 classiﬁcation task.
We use the conﬁguration from Section 4. and consider the following attacks:
• “A LITTLE IS ENOUGH ” (ALIE): attackers collude to move the coordinate-wise median while still sending values inside the population variance.
Baruch et al.
(2019) show that this attack is effective against TrimmedMean (Yin et al., 2018) and Krum (Blanchard et al., 2017).
• I
NNER PRODUCT MANIPULATION (IPM): attackers send the average of all honest peers’ gradients multiplied by − (cid:15) .
We test (cid:15) = 0 .
1 (Xie et al.
(2020) demonstrate its efﬁciency against the coordinate-wise median and Krum) and (cid:15)
= 0 .
6 (Allen-Zhu et al.
(2021) state that it is the most efﬁcient attack against their method among the reported ones).
As in Section 4.1, we report the mean and range of the test accuracy over 5 runs for τ ∈ { 1 , 10 } .
Regarding the ALIE attack (see Figure 9), we note that BTARD-SGD needs either two validators, or one validator and
the weaker clipping
τ = 10 ) to guarantee the
fast
recovery
in the worst
case
with 7 out of 16 peers
being Byzantine).
This observation coincides with Baruch et al.
(2019) demonstrating that the ALIE attack is more harmful against median-based and clipping approaches than to the usual mean aggregation without any defenses.
Indeed, since τ in C ENTERED C LIP allows to smoothly interpolate between the geometric median ( τ → 0 ) and the mean ( τ → inf ) aggregation rules (as explained in Appendix D.1), it is natural to expect that the setups where τ is too small are more sensitive to the ALIE attack.
In turn, the IPM attack (see Figure 10) has a short negative effect for τ = 1 (it increases for a larger (cid:15) ) and an almost unnoticeable effect for τ = 10 .
One validator is enough to combat all variants of this attack.
We conclude that BTARD-SGD remains practical in case of the considered low-magnitude attacks.
It is able to defend the training from the worst-case attacks (with almost half of the peers being
Byzantine) while requiring no more than ≈ 13% of the compute to be dedicated for validation.