B YZANTINE -R ESILIENT N ON -C ONVEX S TOCHASTIC G RADIENT D ESCENT ∗
A
BSTRACT
We study adversary-resilient stochastic distributed optimization, in which m machines can independently compute stochastic gradients, and cooperate to jointly optimize over their local objective functions.
However, an α -fraction of the machines are Byzantine , in that they may behave in arbitrary, adversarial ways.
We consider a variant of this procedure in the challenging non-convex case.
Our main result is a new algorithm SafeguardSGD which can provably escape saddle points and ﬁnd approximate local minima of the non-convex objective.
The algorithm is based on a new concentration ﬁltering technique and its sample and time complexity bounds match the best known theoretical bounds in the stochastic, distributed setting when no Byzantine machines are present.
Our algorithm is very practical: it improves upon the performance of all prior methods when training deep neural networks, it is relatively lightweight and it is the ﬁrst method to withstand two recently-proposed Byzantine attacks.
I NTRODUCTION
Motivated by the pervasiveness of large-scale distributed machine learning, there has recently been signiﬁcant interest in providing distributed optimization algorithms with strong fault-tolerance guarantees.
In this context, the strongest, most stringent fault model is that of Byzantine faults (Lamport et al., 1982): given m machines, each having access to private data, at most an α fraction of the machines can behave in arbitrary, possibly adversarial ways, with the goal of breaking or slowing down the algorithm.
Although extremely harsh, this fault model is the “gold standard” in distributed computing (Lynch, 1996; Lamport et al., 1982; Castro et al., 1999), as algorithms proven to be correct in this setting are guaranteed to converge under arbitrary system behaviour.
A setting of particular interest in this context has been that of distributed stochastic optimization.
Here, the task is to minimize some stochastic function f ( x ) =
E s ∼D
[ f s ( x )] over a distribution D , where f s ( · ) can be viewed as the loss function for sample s ∼ D .
We assume there are m machines (workers) and an honest master, and α < 1 / 2 fraction of the workers may be Byzantine.
In each iteration t , each worker has access to a version of the global iterate x t , which is maintained by the master.
The worker can independently sample s ∼ D , compute ∇ f s ( x t ) , and then synchronously send this stochastic gradient to the master.
The master aggregates the workers’ messages, and sends an updated iterate x t +1 to all the workers.
Eventually, the master has to output an approximate minimizer of f .
Clearly, the above description only applies to honest workers; Byzantine workers may deviate arbitrarily and return adversarial “gradient” vectors to the master in every iteration.
This distributed framework is quite general and well studied.
One of the ﬁrst references in this setting studied distributed PCA and regression (Feng et al., 2014).
Other early approaches (Blanchard et al., 2017; Chen et al., 2017; Su & Vaidya, 2016a;b; Xie et al., 2018a) relied on deﬁning generalizations of the geometric median.
These approaches can withstand up to half of the nodes being malicious, but can have relatively high local computational cost Ω( m 2 d ) (Blanchard et al., 2017; Chen et al., 2017), where m is the number of nodes and d is the problem dimension, and usually have suboptimal sample and iteration complexities.
Follow-up work resolved this last issue when the objective f ( · ) is convex , leading to tight sample complexity bounds.
Speciﬁcally, Yin et al.
(2018) provided bounds for gradient descent -type algorithms, and showed that the bounds are tight when the dimension is constant.
Alistarh et al.
(2018) provided a stochastic gradient descent (SGD) type algorithm and showed that its sample and time complexities are asymptotically optimal even when the dimension is large.
Non-convex Byzantine-resilient stochastic optimization.
In this paper, we focus on the more challenging non-convex setting, and shoot for the strong goal of ﬁnding approximate local minima (a.k.a.
second-order critical points).
In a nutshell, our main result is the following.
Fix d to denote the dimension, and let the objective f : R d → R be Lipschitz smooth and second-order smooth.
We have m worker machines, each having access to unbiased, bounded estimators of the gradient of f .
Given an initial point x 0 , the SafeguardSGD algorithm ensures that, even if at most α < 1 /fraction of the machines are Byzantine, after
[Equation]
parallel iterations, for at least a constant fraction of the indices t ∈
[ T ] , the following hold:
[Equation]
If the goal is simply (cid:107)∇ f ( x t ) (cid:107) ≤ ε , then T = (cid:101) O (cid:0) (cid:0)
[Equation]
2 + 1 m (cid:1) ( f ( x 0 ) − min f ( x ))
[Equation] [Equation]
iterations sufﬁce.
Here, the (cid:101)
O notation serves to hide logarithmic factors for readability.
We spell out these factors in the detailed analysis.
• When α < 1 / √ m , our sample complexity ( = mT ) matches the best known result in the nonByzantine case (Jin et al., 2019) without additional assumptions, and enjoys linear parallel speedup: with m workers of which < √ m are Byzantine, the parallel speedup is (cid:101) Ω( m ) .•
For α ∈ [1 / √ m, 1 / 2) , our parallel time complexity is (cid:101) O
( α 2 ) times that needed when no parallelism is used.
This still gives parallel speedup.
This α 2 factor appears in convex Byzantine distributed optimization, where it is tight (Yin et al., 2018;
Alistarh et al., 2018).
• The Lipschitz and second-order smoothness assumptions are the minimal assumptions needed to derive convergence rates for ﬁnding second-order critical points (Jin et al., 2019).
Comparison with prior bounds.
The closest known bounds are by Yin et al.
(2019), who derived three gradient descent-type of algorithms (based on median, mean, and iterative ﬁltering) to ﬁnd a weaker type of approximate local minima.
Since it relies on full gradients, their algorithm is arguably less practical, and their time complexities are generally higher than ours (see Section 2.1).
Other prior works consider a weaker goal: to ﬁnd approximate stationary points (cid:107)∇ f ( x ) (cid:107) ≤ ε only:
Bulusu et al.
(2020) additionally assumed there is a guaranteed good (i.e. non-Byzantine) worker known by the master, Xie et al.
(2018b) gave a practical algorithm when the Byzantine attackers have no information about the loss function or its gradient, Yang et al.
; Xie et al. (2018a);
Blanchard et al.
(2017) derived eventual convergence without an explicit complexity bound, and the non-convex result obtained in Yin et al.
(2018) is subsumed by Yin et al.
(2019), discussed above.
Our algorithm and techniques.
The structure of our algorithm is deceptively simple.
The master node keeps track of the sum of gradients produced by each worker across time.
It labels (allegedly) good workers as those whose sum of gradients “concentrate” well with respect to a surrogate of the median vector, and labels bad workers otherwise.
Once a worker is labelled bad, it is removed from consideration forever.
The master then performs the vanilla SGD , by moving in the negative direction of the average gradients produced by those workers currently labelled as good.
We call our algorithm SafeguardSGD , since it behaves like having a safe guard to ﬁlter away bad workers.
Its processing overhead at the master is O ( md ) , negligible compared to standard SGD.
As the astute reader may have guessed, the key non-trivial technical ingredient is to identify the right quantity to check for concentration, and make it compatible with the task of non-convex optimization.
In particular, we manage to construct such quantities so that (1) good non-Byzantine workers never get mislabelled as bad ones; (2) Byzantine workers may be labelled as good ones (which is inevitable)
but when they do, the convergence rates are not impacted signiﬁcantly; and (3) the notion does not require additional assumptions or running time overhead.
The idea of using concentration (for each worker across time) to ﬁlter out Byzantine machines traces back to the convex setting (Alistarh et al., 2018).
However, the quantities used in (Alistarh et al., 2018) to check for concentration are necessarily different from this paper, and our analysis is completely new, as deriving non-convex rates is known to be much more delicate and challenging.
Recently, Bulusu et al.
(2020) used similar concentration ﬁlters to Alistarh et al.
(2018) in the nonconvex setting, but under stronger assumptions, and for the simpler task of ﬁnding stationary points.
Many other algorithms do not rely on concentration ﬁlters.
In each iteration, they ask each worker to compute a batch of stochastic gradients, and then use coordinate-wise median or mean over the batch average (e.g. Yin et al.
Yang et al.
or iterative ﬁltering (e.g. Su & Xu (2018);
Yin et al.
by the master to derive a “robust mean.”
These works fundamentally rely on each iteration to calculate an almost precise full gradient, so that they can apply a surrogate of full gradient descent .
Such algorithms can introduce higher sample and time complexities (see
Section 2), are less practical than stochastic gradient schemes, require additional restrictions on the resilience factor α , e.g. α < 1 / 4 (Su & Xu, 2018), and, critically, have been shown to be vulnerable to recent attacks (Baruch et al., 2019; Xie et al., 2020).
Attack resilience and experimental validation.
There is a growing literature on customized attacks against Byzantine-resilient algorithms, showing that many defenses can be entirely circumvented in real-world scenarios (Baruch et al., 2019; Xie et al., 2020).
Our algorithm is provably correct against these attacks, a fact we also validate experimentally.
We implemented SafeguardSGD to examine its practical performance against a range of prior works (Xie et al., 2018b; Blanchard et al., 2017; Chen et al., 2017; Yin et al., 2018; 2019), and against recent attacks on the distributed task of training deep neural networks .
Our experiments show that SafeguardSGD generally outperforms previous methods in convergence speed and ﬁnal accuracy, sometimes by a wide accuracy margin.
This is true not only against known Byzantine attacks, but also against attack variants we ﬁne-crafted to speciﬁcally slow down our algorithm, and against transient node failures.
S TATEMENT OF O UR T HEORETICAL R ESULT
We denote by (cid:107) · (cid:107) the Euclidean norm and [ n ] := { 1 , 2 , . . . , n } .
Given symmetric matrices A , B , we let (cid:107) A (cid:107) 2 denote the spectral norm of A .
We use (cid:23) to denote Loewner ordering, i.e. A (cid:23) B if
A − B is positive semi-deﬁnite.
We denote by λ min ( A ) the minimum eigenvalue of matrix A .
We consider arbitrary d -dimensional non-convex functions f : R d → R satisfying the following:
• f ( x ) is L -Lipschitz smooth: meaning (cid:107)∇ f ( x ) − ∇ f ( y ) (cid:107) ≤ L (cid:107) x − y (cid:107) for any x, y ∈ R d ; • f ( x ) is L 2 -second-order smooth: (cid:107)∇ 2 f ( x ) − ∇ 2 f ( y ) (cid:107) 2 ≤ L 2 · (cid:107) x − y (cid:107) for any x, y ∈ R d ;
For notational simplicity of the proofs, we assume L =
L 2 = V = 1 .
2 Note that we have also assumed the domain of f is the entire space R d .
If instead there is a compact domain X ⊂ R d , then one can use projected SGD and re-derive similar results of this paper.
We choose to present our result in the simplest setting to convey our main ideas.
Byzantine non-convex stochastic distributed optimization.
We let m be the number of worker machines and assume at most an α fraction of them are Byzantine for α ∈ (cid:2) 0 , 1 2 (cid:1) .
We denote by good ⊆
[ m ] the set of good (i.e. non-Byzantine) machines, and the algorithm does not know good .
Assumption 2.1.
In each iteration t , the algorithm (on the master) is allowed to specify a point x t and query m machines.
Each machine i ∈ [ m ] gives back a vector ∇ t,i ∈
R d satisfying
• If i ∈ good , the stochastic gradient ∇ t,i satisﬁes E [ ∇ t,i ] = ∇ f ( x t ) and (cid:107)∇ f ( x t ) −∇ t,i (cid:107) ≤ V .•
If i ∈ [ m ] \ good , then ∇ t,i can be arbitrary (w.l
o.g. we assume (cid:107)∇ f ( x t ) − ∇ t,i (cid:107) ≤ V ).
Remark 2.2 .
For each t and i (cid:54)∈ good , the vector ∇ t,i can be adversarially chosen and may depend
Input: point x 0 ∈ R d , rate η > 0 , lengths T ≥ T 1 ≥ T 0 ≥ 1 , threshold T 1 > T 0 > 0 ; 1: good 0 ← [ m ] ; 2: for t ← 0 to T − 1 do 3: last 1 ← max { t 1 ∈ [ t ]: t 1 is a multiple of T 1 } ; 4: last 0 ← max { t 0 ∈ [ t ]: t 0 is a multiple of T 0 } 5: for each i ∈ good t do 6: receive ∇ t,
i ∈
R
d from machine i ; 7:
A
[Table]
← (cid:80)
[Table] [Table]
| and
[Table]
=
[Table] [Table]
| good k | ; 8:
A med ← A i where i ∈ good t is any machine s.t.
(cid:12)(cid:12) { j ∈ good t : (cid:107)
A j − A
i (cid:107) ≤ T 1 } (cid:12)(cid:12) > m/ 2 .
B med ← B i where i ∈ good t is any machine s.t.
(cid:12)(cid:12) { j ∈ good t : (cid:107) B
j − B i (cid:107) ≤ T 0 } (cid:12)(cid:12) > m/ 2 .
10: good
[Table]
i
[Table]
[Table]
(cid:107)
[Table]
; 11: x t
[Table]
= x
[Table]
− η (cid:16)
[Table]
+
[Table] [Table]
on {∇ t (cid:48) ,i } t (cid:48) ≤ t,i ∈ [ m ] .
In particular, the Byzantine machines can even collude during an iteration.
2. O UR A LGORITHM AND T HEOREM
Our algorithm is based on arguably the simplest possible method for achieving this goal, (perturbed) stochastic gradient descent (SGD) (Ge et al., 2015).
Our techniques more broadly apply to more complicated methods (e.g. at least to Allen-Zhu (2018a;b)), but we choose to analyze the simplest variant of SGD, since it is the most widely applied method in modern non-convex machine learning.
As illustrated in Algorithm 1, in each iteration t = 0 , 1 , . .
, T − 1 , we maintain a set of (allegedly) good machines good t ⊆
[ m ] .
We begin with good 0 =
[ m ] and start to detect malicious machines and remove them from the set.
We choose a learning rate η > 0 , and perform the SGD update
[Equation]
where ξ t ∼ N (0 , ν 2 I ) is a random Gaussian perturbation that is added for theoretical purpose.
For each machine i ∈ [ m ] , we keep track of the history of its stochastic gradients up to two windows .
Namely, A i ← (cid:80) tk
= last 1 ∇ k,i | good k | and B
i ← (cid:80) tk = last 0 ∇ k,i | good k | , for windows sizes T 0 ≤ T 1 ≤ T .
We compare among remaining machines in good t , and kick out those ones whose A i or B i deviate “more than usual” to construct good t
+1 .
Conceptually, we view these two as safe guards .
Our theory makes sure that, when the “window sizes” and the thresholds for “more than usual” are deﬁned properly, then good t shall always include good , and the algorithm shall proceed to ﬁnd approximate local minima.
Formally, we have (letting the (cid:101)
O notion to hide polylogarithmic factors)
Theorem 2.3.
Let C
= α 2 + 1 m .
Suppose we choose ν 2 = (cid:101)
Θ( C 3 ) , η = (cid:101) Θ( ε 2 dC 3 ) , T
= (cid:101) Θ( 1 η ) ,
T 1 = (cid:101) Θ( 1 η √ ε ) , T 0 = (cid:101) Θ( √ T 0 ) , and T 1 = (cid:101) Θ( √ T 1 ) , then after
T = (cid:101) O (cid:16) ( f ( x 0 ) − min f ( x )
[Equation]
d ε( α 2 + 1 m ) (cid:17) iterations, with high probability, for at least constant fraction of the indices t ∈ [ T ] , they satisfy (cid:107)∇ f ( x t ) (cid:107) ≤ ε and ∇ 2 f ( x t ) (cid:23) −√ ε I .
Remark 2.4 .
If one only wishes to achieve a signiﬁcantly simpler goal — ﬁnding ﬁrst-order critical points (cid:107)∇ f ( x t ) (cid:107) ≤ ε — the analysis becomes much easier (see Section 3.1).
In particular, having one safe guard without perturbation (i.e. ν = 0 ) sufﬁces, and the iteration complexity reduces to
T = (cid:101) O (cid:0) f ( x 0 ) − min f ( x ) ε( α 2 + 1 m ) (cid:1) .
Bulusu et al.
(2020) achieves this easier goal but requires an additional assumption: there is one guaranteed good worker known by the master.
Our contribution.
We reiterate our theoretical contributions from three perspectives.
When α < 1 / √ m , our algorithm requires mT = (cid:101) O (cid:0) ( f ( x 0 ) − min f ( x ))
d ε(cid:1) stochastic gradient computations.
This matches the best known result (Jin et al., 2019) under our minimal assumptions of the nonconvex objective.
(There exist other works in the stochastic setting that break the ε − 4 barrier and get rid of the dimension dependence d under stronger assumptions.)
When α < 1 / √ m , our algorithm enjoys linear parallel speed-up: the parallel time complexity reduces by a factor of Θ( m ) .
When α ∈ [1 / √ m, 1 / 2) , our parallel time complexity is (cid:101) O
( α 2 ) times that needed when no parallelism is used, still giving noticeable speedup.
The α 2 factor also appeared in convex Byzantine distributed optimization (and is known to be tight there)
(Yin et al., 2018;
Alistarh et al., 2018).
Comparison to (Yin et al., 2019).
Yin et al.
(2019) derived three gradient descent-type algorithms to ﬁnd points with a weaker (and less standard) guarantee: (cid:107)∇ f ( x ) (cid:107) ≤ ε and ∇ 2 f ( x ) (cid:23) − ( ε 2 d ) 1 / 5 I .
Despite practical differences (namely, gradient descent may be less favorable comparing to stochastic gradient descent especially in deep learning applications), the parallel time complexities derived from their result are also generally larger than ours.
Their paper focuses on bounding the number of sampled stochastic functions, as opposed to the number of stochastic gradient evaluations like we do.
When translated to our language, each of the workers in their setting needs to evaluate T stochastic gradients, where (1) T = (cid:101)
[Equation]
(cid:0)
[Equation]
if using coordinate-wise median, (2) T = (cid:101) O (cid:0) α 2 d 2 ε+ d 2 ε 4 m (cid:1) if using trimmed mean, and (3)
T = (cid:101) O (cid:0) αε 4 + d ε 4 m (cid:1) if using iterative ﬁltering.
The complexities (1) and (2) are larger than ours (also with a weaker guarantee); the complexity (3) seems incomparable to ours, but when translating to the more standard ( ε, √ ε ) guarantee, becomes T
=
(cid:101) O (cid:0) αd 2 ε 5 + d 3 ε 5 m (cid:1) so is also larger than ours.
It is worth noting that (3) requires α < 1 / 4 so cannot withstand half of the machines being Byzantine.
Resilience against practical attacks.
Our algorithm’s ﬁltering is based upon tracking B i (resp.
A i ), the stochastic gradients of each machine i averaged over a window of T 0 (resp.
T 1 ) iterations .
This is a departure from previous defenses, most of which are history-less, and enables us to be provably Byzantine-resilient against state-of-the-art attacks (Baruch et al., 2019; Xie et al., 2020).
In Baruch et al.
(2019), Byzantine workers collude to shift the gradient mean by a factor β times the standard deviation of the (true stochastic) gradient, while staying within population variance.
They noticed β can be quite large especially in neural network training.
Their attack circumvent existing defenses because those defense algorithms are “historyless”, while their attack is statistically indistinguishable from an honest execution in any single iteration.
However, our algorithm can provably defend against this attack since it has memory : Byzantine workers following their strategy will progressively diverge from the (honest) “median” B med (by an amount proportional to Ω( T ) in
T iterations as opposed to √ T ), and be marked as malicious by our algorithm.
(See Figure 2(a).)
In
Xie et al.
(2020), Byzantine workers deviate in the negative direction of the gradient.
However, to avoid being caught by our algorithm, the maximum “magnitude” of this attack has to stay within our thresholds.
We implemented both attacks and showed our algorithm’s robustness experimentally.
Finally, we note that prior “historyless” schemes, such as Krum or median-based schemes, could be thought of as providing stronger guarantees, as they in theory allow Byzantine nodes to change
IDs during the computation: such schemes only require an upper bound on the number of Byzantine agents in each round.
However, the attack of Baruch et al.
(2019) essentially shows that all such schemes are vulnerable to variance attacks, and that such attacks are eminently plausible in practice.
Thus, this suggests that the use of historical information, which requires that Byzantine nodes cannot change their IDs during the execution, may be necessary for Byzantine resilience.
Tolerating transient failures and node ID relabeling.
Our algorithm can also withstand transient node failures and some degrees of ID relabeling , by resetting the set of good nodes good t to include all nodes every T 1 steps.
The algorithm then proceeds as usual.
The key observation behind this relaxation is the fact that our analysis only requires that the attack conditions hold inside the current window.
(Please see the Theorem B.1 for details.)
We validate this experimentally in Section 5.
W ARMUP : S INGLE S AFE G UARD
As a warmup, let us ﬁrst analyze the behavior of perturbed SGD with a single safe guard.
Consider
Algorithm 2, where we start with a point w 0 , a set good 0 ⊇ good , and perform T steps of perturbed
SGD.
(We use the w t sequence instead of the x t sequence to emphasize that we are in Algorithm 2.)
[Table] [Table]
Deﬁnition 3.1.
We make the following deﬁnition to simplify notations: let Ξ t :
= σ t + ∆ t where
• σ t := 1 | good t | (cid:80) i ∈ good (cid:0) ∇ t,i − ∇ f ( w t ) (cid:1) • ∆ t := 1 | good t | (cid:80) i ∈ good t \ good (cid:0) ∇ t,i − ∇ f ( w t ) (cid:1)
Therefore, we can re-write the SGD update as w t +1 =
w t − η ( ∇ f ( w t ) + ξ
t
+ Ξ t ) .
The following lemma is fairly immediate to prove:
Lemma 3.2 (single safe guard) .
In Algorithm 2, suppose we choose T = 8 (cid:112) T log(16 mT/p ) .
Then, with probability
at least 1 − p/ 4 , for every t = 0 , . .
, T − 1 , • good t ⊇ good .
• (cid:107) σ t (cid:107) 2 ≤ O ( log( T/p ) m ) and (cid:107) σ 0 + · · · + σ t − 1 (cid:107) 2 ≤ O ( T log( T/p ) m ) • (cid:107) ∆ t (cid:107) 2 ≤ α 2 and (cid:107) ∆ 0 + · · · + ∆ t − 1 (cid:107) 2 ≤ O ( α 2 T log( mT/p )) • |(cid:104)∇ f ( w t ) , ξ t (cid:105)| ≤ (cid:107)∇ f ( w t ) (cid:107) · O ( ν (cid:112) log( T/p )) , • (cid:107) ξ t (cid:107) 2 ≤
O ( ν 2 d log( T/p )) , (cid:107) ξ 0 + · · · + ξ t − 1 (cid:107) 2 ≤ O ( ν 2 dT log( T/p ))
We call this probabilistic event Event single T ( w 0 ) and Pr[ Event single T ( w 0 )] ≥ 1 − p/ 4 .
(The third property above is ensured by our choice of T and the use of safe guard, and the rest of the properties follow from simple martingale concentration arguments.
Details are in Appendix A.1.)
C ORE T ECHNICAL L EMMA 1: O BJECTIVE D ECREASE
Our ﬁrst main technical lemma is the following:
Lemma 3.3.
Suppose we choose T as in Lemma 3.2.
Denote by C 1 = log( T/p ) and C 2 =
α 2 log mTp + log( T/p ) m .
Suppose η ≤ 0 .
01 min { 1 , 1 C 2 } , T = 1 100 η (1+ √ C 2 ) and we start from w 0 and apply Algorithm 2.
Under event Event single T ( w 0 ) , it satisﬁes f ( w 0 ) − f ( w T ) ≥ 0 .
7 η (cid:80) T − 1 t =0 (cid:0) (cid:107)∇ f ( w t ) (cid:107) 2 − η
· O ( C 2 + ( C 2 ) 1 . 5 ) − O ( C 1 ν 2 η
d + √ C 2 )) (cid:1)
Lemma 3.3 says after T ≈ 1 η steps of perturbed SGD, the objective value decreases by, up to some small additive error and up to logarithmic factors , f ( w 0 )
− f ( w T ) ≥ 0 .
7 η (cid:80) T − 1 t =
( (cid:107)∇ f ( w t ) (cid:107) 2 − ηC 2 ) .
This immediately implies, if we choose η ≈ ε 2 C 2 , then by repeating this analysis for
O ( C 2 ε 4 )
=
O ( α 2 +1 /m ε) iterations, we can ﬁnd approximate critical point x with (cid:107)∇ f ( x ) (cid:107) ≤ ε .
Proof sketch of Lemma 3.3.
The full proof is in Appendix A.
but we illustrate the main idea and difﬁculties below.
After simple manipulations, it is not hard to derive that
[Equation]
where recall that Ξ t = σ t +∆ t .
When there are no Byzantine machines, we have E [Ξ t ] =
E [ σ t ] =
so the remainder terms must be small by martingale concentration.
Therefore, the main technical difﬁculty arises to deal with those Byzantine machines, who can adversarially design their ∇ t (even by collusion) so as to negatively correlate with ∇ f ( w t ) to “maximally destroy” the above inequality.
Our main idea is to use second-order smoothness to write ∇ f ( w t ) ≈ ∇ f ( w 0 )
+ ∇ 2 f ( w 0 ) · ( w t − w 0 ) .
To illustrate our idea, let us ignore the constant vector and assume that the Hessian is the identity: that is, imagine
as if ∇ f ( w t ) ≈ w t − w 0 .
Using w t − w 0 = − (cid:80) k<t Ξ t + ξ t , we immediately have
[Equation]
f
[Equation]
t ) , Ξ t
[Equation]
For the ﬁrst partial sum (cid:104) (cid:80) k<t Ξ k , Ξ t (cid:105) in (3.1), it is easy to bound its magnitude using our safeguard.
Indeed, we have (cid:12)(cid:12) (cid:80) t (cid:104) (cid:80) k<t Ξ k , Ξ t (cid:105) (cid:12)(cid:12) ≤ (cid:107) (cid:80)
t Ξ t (cid:107) 2 + (cid:80) t (cid:107) Ξ t (cid:107)
so we can apply Lemma 3.2.
For the second partial sum (cid:80) t (cid:80) k<t (cid:104) ξ k , Ξ t (cid:105) , we can apply the concentration Proposition 3.4 below.
(cid:3)
Proposition 3.4.
Fix the dimension parameter d ≥ 1 .
Suppose ξ 0 , . .
ξ T − 1 ∈ R d are i.i.d.
drawn from N (0 , I ) , and that ∆ 1 , . .
. , ∆ T − 1 are arbitrary vectors in R d .
Here, each vector ∆ t with t = 1 , . . .
, T − 1 can depend on ξ 0 , . . .
, ξ t − 1 but not on ξ t , . . .
, ξ T − 1 .
Suppose that these vectors satisfy (cid:107) ∆ 1 + · · · + ∆ t (cid:107) 2 ≤ T for every t = 1 , . .
, T − 1 .
Then, with probability at least 1 − p , (cid:12)(cid:12)(cid:12)(cid:80) T − 1 t =
[Equation]
[Equation] [Equation]
3. C ORE T ECHNICAL L EMMA 2: R ANDOMNESS C OUPLING
Our next technical lemma studies that, if run Algorithm 2 from a point w 0 so that the Hessian ∇ 2 f ( w 0 ) has a eigenvalue which is less than − δ (think of w 0 as a saddle point), then with good probability, after sufﬁciently many iterations, the sequence w 1 , w 2 , . .
. , w T shall escape from w 0 to distance at least R for some parameter R ≈ δ .
To prove this, motivated by Jin et al.
, we study two executions of Algorithm 2 where their randomness are coupled.
We then argue that at least one of them has to escape from w 0 .
For any vector v , let [ v ] i denote the i -th coordinate of v .
Lemma 3.5.
Suppose we choose T as in Lemma 3.2 and C 1 , C 2 as in Lemma 3.3.
Suppose w 0 ∈ R d satisﬁes λ min ( ∇ 2 f ( w 0 ))
= − δ for some δ ≥ 0 .
Without loss of generality let e 1 be the eigenvector of ∇ 2 f ( w 0 ) with smallest eigenvalue.
Consider now two executions of Algorithm 2, both starting from w a 0 = w b 0 = w 0 , and suppose their randomness { ξ a t } t and { ξ b t } t are coupled so that [ ξ a t ] 1 = − [ ξ b t ] 1 but [ ξ a t ] i = [ ξ b t ] i for i > 1 .
In words, the randomness is the same orthogonal to e 1 , but along e 1 , the two have opposite signs.
Now, suppose we perform T
= Θ( 1 ηδ log R 2 δ ην 2 ) steps of perturbed SGD from w a 0 , w b 0 respectively using Algorithm 2.
Suppose
[Equation]
and
[Equation]
Then, under events Event single T ( w a 0 ) and Event single T ( w b 0 ) , with probability at least 0.98, either (cid:107) w a t − w 0 (cid:107) >
R or (cid:107) w b t − w 0 (cid:107) >
R for some t ∈
[ T ] .
Proof details in Appendix A.4.
The main proof difﬁculty is to analyze a noisy version of the power method, where the noise comes from (1) Gaussian perturbation (which is the good noise), (2) stochastic gradients (which has zero mean), and (3) Byzantine workers (which can be adversarial).
F ROM W ARMUP TO F INAL T HEOREM WITH D OUBLE S AFE G UARDS
At a high level, Lemma 3.3 ensures that if we keep encountering points with large gradient (cid:107)∇ f ( w t ) (cid:107) , then the objective should sufﬁciently decrease; in contrast, Lemma 3.5 says that if we keep encountering points with negative Hessian directions (i.e., λ min ( ∇ 2 f ( w t )) < − δ ), then the points must move a lot (i.e., by more than R in T iterations, which can also lead to sufﬁcient objective decrease, see Lemma B.4).
Therefore, at a high level, when the two lemmas are combined, they tell that we must not encounter points with (cid:107)∇ f ( x ) (cid:107) being large, or λ min ( ∇ 2 f ( x )) being very negative, for too many iterations.
Therefore, the algorithm can ﬁnd approximate local minima.
The reason we need two safe guards , is because the number of rounds T for Lemma 3.3 and
Lemma 3.5 differ by a factor.
We need two safe guards with different window sizes to ensure the two lemmas simultaneously hold.
We encourage the reader to examine the full analysis in Appendix B.
E XPERIMENTAL V ALIDATION
We evaluate the convergence of SafeguardSGD to examine its practical performance against prior works.
We perform the non-convex task of training a residual network ResNet-20 (He et al., 2016) on the CIFAR-10/100 datasets (Krizhevsky et al., 2014).
More details are given in Appendix C.
[Figure]
We instantiate m = 10 workers and one master node executing data-parallel SGD for 140 passes (i.e. epochs) over the training dataset.
The results for higher number of workers and epochs are similar, and therefore omitted.
We compare against Geometric Median (Chen et al., 2017), Coordinatewise Median (Yin et al., 2018; 2019), Krum (Blanchard et al., 2017), and Zeno (Xie et al., 2018b).
Overall, our experimental setup is very similar to Zeno (Xie et al., 2018b) but with additional attacks.
We implemented the approach of Yang et al.
, but found it very sensitive to hyper-parameter values and were unable to make it converge across all attacks even after signiﬁcant tuning of its γ parameter.
We also implemented the convex algorithm of Alistarh et al.
(2018), and executed it in our non-convex setting.
We found their algorithm can be easily attacked on our ResNet training tasks.
There exists a simple attack, described in Appendix C.4 which causes their algorithm to either mislabel most good workers as Byzantine, or diverge, or converge to very poor solutions.
This is not surprising, since their algorithm is designed for, and only guaranteed to work in, the convex setting.
To make the comparison stronger, when implementing SafeguardSGD , we have chosen ﬁxed window sizes T
= 1 epoch and T 1 = 6 epochs across all experiments, and adopted an automated process to select T 0 , T 1 . Determining these thresholds requires being able to pre-run the task on an honest worker.
We have also implemented a single safeguard variant of SafeguardSGD , with window size T = 3 epochs.
Attacks.
We set α = 0 . 4 , which means that there are 4 Byzantine workers.
(This exceeds the fault-tolerance of Krum, and so we also tested Krum with only 3 Byzantine workers.)
• L ABEL - FLIPPING ATTACK : each Byzantine worker computes its gradient based on the crossentropy loss with ﬂipped labels: for CIFAR-10, label (cid:96) ∈ { 0 , ..., 9 } is ﬂipped to 9 − (cid:96) .
• D ELAYED - GRADIENT ATTACK : each Byzantine worker sends an old gradient to master.
In our experiments, the delay is of D = 1000 iterations.
• V ARIANCE ATTACK (Baruch et al., 2019):
Byzantine workers measure the mean and the standard-deviation of gradients at each round, and collude to move the mean by the largest value which still operates within population variance.
(For our parameter settings, this is 0 .
3 times the standard deviation.
We discuss results for additional parameter values in the Appendix.)
• S IGN - FLIPPING ATTACK : each Byzantine worker sends the negative gradient to the master.
• S AFEGUARD ATTACK : each Byzantine workers sends a negative but re-scaled gradient to the master.
We use re-scale factors 0 .
6 and 0 .
7 in our experiments.
The re-scale factor 0 .
6 avoids triggering the safe-guard conditions at the master, and the re-scale factor 0 .
7 occasionally triggers the safe-guard conditions.
This attack is an instantiation of the inner-product attack (Xie et al., 2020), customized speciﬁcally to maximally affect our SafeguardSGD algorithm.
Main experimental results.
The ideal test accuracy is 91.7%, which corresponds to applying SGD using only the stochastic gradients from the honest workers.
Figure 1 compares the performances
[Table]
starts to apply the variance attack.
[Figure]
in test accuracy.
Below we summarize our main ﬁndings for the experiments, and we defer detailed discussions (and additional experiments for CIFAR-100) to Appendix C.
• SafeguardSGD generally outperforms all the previous methods in test accuracy.
The test accuracy difference can be “ 90% vs. < 40% ” between our algorithm and the best prior work.
• The variance attack is indeed very strong , in that it severely affects the accuracy of all prior works (test accuracy < 35% ). This is because thesese defenses are “historyless.”
By contrast, our algorithm not only provably but also empirically defends against it.
• Our safeguard attack (especially with re-scale factor 0 . 7 ) is as strong as the variance attack, and even stronger on the CIFAR-100 dataset; please see the results in Appendix C.2.5.
• The label-ﬂipping attack is rather weak : although some defenses, such as Zeno, did not determine which of the workers are malicious, they still converge well under this attack.
• The sign-ﬂipping and delayed-gradient attacks are moderate : the best prior works can achieve accuracy 60% ∼ 70% .
It is worth noting that the sign-ﬂipping attack can already nullify the Zeno defence (test accuracy 20% ). The issue seems to be that it can be very hard for Zeno to use relatively few samples to determine if the gradient direction is ﬂipped to negative.
• SafeguardSGD can easily catch all the bad workers under sign-ﬂipping and variance attacks , and thus leads to gives ideal performance.
It cannot catch any bad worker for label-ﬂipping and delayed-gradient attacks , but there is no performance loss anyways if we use such bad gradients.
• The safeguard attacks , designed to maximally impact the performance of our SafeguardSGD , can indeed affect our performance.
Speciﬁcally, under re-scale factor 0.6, the test accuracy drops from 91.7% to 89.3% because SafeguardSGD cannot catch any bad worker; however, under rescale factor 0.7, the test accuracy no longer drops because SafeguardSGD can begin to catch some bad workers (it can catch between 0 and 4 bad workers depending on the randomness.)
• In most cases, the single-safeguard algorithm is close to double-safeguard, except for the safeguard(x0.7) attack, in which using double-safeguard one can more easily catch bad workers.
(This is more apparent in the CIFAR-100 experiment, see Appendix C.2.5.)
We conclude that SafeguardSGD can be practical, and outperforms previous approaches.
A deeper dive: how the algorithm works.
Let us explain the inner workings of our algorithm in the context of a “delayed” attack, where the Byzantine nodes collude to execute an attack only after a speciﬁc, given point in the execution (in this case, the ﬁrst half-epoch).
Figure 2(a) presents the results from the perspective of the value of (cid:107) B i − B med (cid:107) registered at the master server, for two nodes, an honest one, and a Byzantine one.
The value of (cid:107) B i − B med (cid:107) increases for all the nodes (at a rate of roughly √ t at step t ); but, once the attack starts, the statistic for the Byzantine node grows linearly in t , leading to fast detection.
Transient attacks and node ID relabeling.
Finally, in Figure 2(b) we analyze the behaviour of our algorithm when it periodically (every 3 epochs for single safeguard and 6 epochs for double safeguard) resets the set of good nodes to include all nodes, restarting the detection process from scratch.
Our theoretical result still applies after this relaxation.
This relaxation has two beneﬁts.
First, it beneﬁts from bad workers that under transient failures (e.g., the node fails for 10 epochs but resumes to work correctly after a while), and thus beneﬁts from the data stored on this worker.
Second, it can defend against certain degree of node ID relabeling: it supports the case when good and bad workers exchange their IDs every 6 epochs.
In Figure 2(b), we see even under the (very strong) variance attack, relaxed safeguard maintains good performance.
A CKNOWLEDGMENTS
F. E. and D. A. were supported by the European Research Council (ERC) under the European
Union’s Horizon 2020 research and innovation programme (grant agreement No 805223 ScaleML)
A PPENDIX A M ISSING P ROOFS FOR S ECTIONA. P ROOF OF L EMMA 3.
Recall the following, useful inequality.
Lemma A.1 (Pinelis’ 1994 inequality (Pinelis, 1994)) .
Let X 1 , . . .
X T ∈ R
d be a random process satisfying E [ X t | X 1 , . . .
, X t − 1 ] =
and (cid:107) X t (cid:107) ≤ M .
Then, Pr (cid:2) (cid:107) X 1 + · · · + X T (cid:107) 2 > 2 log(2 /δ )
M 2 T (cid:3) ≤ δ .
Lemma 3.2 is in fact a direct corollary of the following claim, whose proof is quite classical.
Denote by C = log(16 mT/p ) .
Denote by
[Equation]
and
[Equation]
( t )
[Equation]
f
[Equation]
w
[Equation] [Equation]
good
[Equation]
Recall at iteration t − 1 , Algorithm 2 computes { B ( t ) 1 , . . .
, B ( t ) m } as well as some B ( t ) med = B ( t ) i where i is any machine in good t − 1 such that at least half of j ∈ [ m ] satisﬁes (cid:107) B ( t ) j − B ( t ) i (cid:107) ≤ 8 √ tC/m .
Claim A.2.
Let C = log(16 mT/p ) .
Then, with probability at least 1 − p/ 4 , we have
(a) for all
i
∈ good and t ∈
T
] , (cid:107) B
( t )
i
−
B (
t )
(cid:63) (cid:107)
≤
√
tC/m .
(b) for all t ∈
[ T ] , each i ∈ good is a valid choice for B ( t ) med =
B ( t ) i .
(c) for all i ∈ good and t ∈ [ T ] , (cid:107) B ( t ) i − B ( t ) med (cid:107) ≤ 16 √ tC/m and (cid:107) B ( t ) (cid:63) − B ( t ) med (cid:107) ≤ 12 √ tC/m (d) for all i ∈ good and t ∈
[ T ] , we also have i ∈ good t +1 .
(e) (cid:13)(cid:13) (cid:80) i ∈ good (cid:0) B ( t ) i − B ( t ) (cid:63) (cid:1)(cid:13)(cid:13) ≤ O ( (cid:112) t log( T/p ) / √ m ) .
Proof of Claim A.2.
We prove by induction.
Suppose the statements hold for t − 1 and we now move to t .
(a) For each i ∈ good , note E [ ∇ t,i ]
= ∇ t and (cid:107)∇ t,i − ∇ t (cid:107) ≤ 1 .
Let X t = ∇ t,i −∇ t | good t | , so that (cid:107) X t (cid:107) ≤ 1 | good t | ≤ 1 (1 − α ) m ≤ 2 m .
We can thus apply Lemma A.1 to the X t and then take a union bound over all
i ∈
good .
Thus, with probability at least 1 − p 8 T we have (cid:107) B ( t )
i − B ( t ) (cid:63) (cid:107) ≤ 4 √ tC/m for all
i ∈
good .
The result follows from a further union bound over t ∈ [ T ] .
(b) Claim A.2a implies for every i, j ∈ good we have (cid:107) B ( t )
i − B ( t ) j (cid:107) ≤ 8 √ tC/m .
Therefore each i ∈ good is a valid choice for setting B ( t ) med =
B ( t ) i .
(c) This is a consequence of the previous items and the deﬁnition of B ( t ) med .
(d) This is a consequence of the previous item.
(e) We can apply Lemma A.1 with { X 1 , X 2 , . . .
X t | good | } = { ∇ k,i −∇ f ( w k ) | good k | } k ∈ [ t ] ,i ∈ good .
It holds with probability at least 1 − p 8 T that (cid:13)(cid:13) (cid:80) i ∈ good (cid:0) B ( t )
i − B ( t ) (cid:63) (cid:1)(cid:13)(cid:13)
≤
O ( (cid:112) t log( T/p ) / √ m ) .
(cid:3)
Proof of Lemma 3.2.
The property good t ⊇ good is from Claim A.2d.
The property (cid:107) σ t (cid:107) 2 ≤ O ( log( T/p ) m ) is by standard concentration inequalities for sums of bounded random vectors.
The property (cid:107) σ 0 + · · · + σ t − 1 (cid:107) 2 ≤ O
( T log( T/p ) m ) is from Claim A.2e.
The property (cid:107) ∆ t (cid:107) ≤ α is obvious as we have at most α fraction of the bad machines.
The bound on (cid:107) ∆ 0 + · · · + ∆ t − 1 (cid:107) 2 can be derived as follows.
For every i ∈ [ m ] \ good , let t be the last iteration i satisﬁes
i ∈ good t .
Then, by the triangle inequality, (cid:107)
[Equation]
t +
[Equation]
On the other hand, t ∈ good t implies (cid:107) B ( t ) i − B ( t ) med (cid:107) ≤ 16 √ tC/m by the algorithm; combining this with (cid:107) B ( t ) (cid:63) − B ( t ) med (cid:107) ≤ 12 √ tC/m , and summing up over all such bad machines i ﬁnishes the proof.
The ﬁnal two properties follow from standard facts about Gaussian random vectors.
(cid:3)
A. P ROOF OF L EMMA 3.
Proof of Lemma 3.3.
Using the Lipschitz smoothness of f ( · ) , we have
[Equation]
We ﬁrst show:
[Equation]
The ﬁrst follows since ( a + b + c ) 2 ≤ 3( a 2 + b 2 + c 2 ) for any a, b, c ∈ R , and the second follows from
Lemma 3.2.
Combining them, and also using that (cid:107) Ξ t (cid:107) 2 ≤ O
[Equation]
C 2 ) ,
[Equation]
t (cid:107) 2 ≤ O ( dν 2 C 1 ) , and η ≤ 0 .
01 , we have
[Equation]
A.1)
For the inner product on the right hand of (A.1), we have that
[Equation]
For the ﬁrst term ♠ , we have
[Equation]
(cid:13)(cid:13)(cid:13)
[Equation]
−
[Equation] [Equation]
(cid:13)(cid:13)(cid:13)
[Equation]
[Equation]
(cid:13)(cid:13)(cid:13)
[Equation]
where the last inequality follows from Lemma 3.2.
For the second term ♣ , we have
[Equation]
Using
[Equation]
derive
[Equation]
As for ♦ ,
[Table]
For the ﬁrst term (and the second term is analogous), we have
[Table]
[Equation]
(see Lemma 3.2) and a delicate application of Azuma’s inequality that we state at the end of this subsection (see Proposition 3.4); Inequality (cid:173) uses Young’s inequality and Lemma 3.2.
Putting this back to the formula of ♦ , we have
[Equation]
Finally, putting ♦ and ♥ back to ♣ , and putting ♣ and ♠ back to (A.2) and (A.1), we have f ( w 0 ) − f ( w T ) ≥ 0 .
8 η
[Equation]
together with T = 1 100 η (1+ √ C 2 ) and η ≤ 0 .
01 min { 1 , 1 C 2 } , we have f ( w
[Equation]
f ( w T ) ≥ 0 .
7 η
[Equation]
t
[Equation] [Equation]
(cid:3)
A. P ROOF OF P ROPOSITION 3.
Proposition 3.4.
Fix the dimension parameter d ≥ 1 .
Suppose ξ 0 , . .
ξ T − 1 ∈ R d are i.i.d.
drawn from N (0 , I ) , and that ∆ 1 , . .
. , ∆ T − 1 are arbitrary vectors in R d .
Here, each vector ∆ t with t = 1 , . . .
, T − 1 can depend on ξ 0 , . . .
, ξ t − 1 but not on ξ t , . . .
, ξ T − 1 .
Suppose that these vectors satisfy (cid:107) ∆ 1 + · · · +∆ t (cid:107) 2 ≤ T for every t = 1 , . .
, T − 1 .
Then, with probability at least 1 − p ,
[Table]
[Equation] [Table] [Equation] [Table]
[Equation] [Table]
[Equation]
[Table]
[Equation]
[Table]
[Equation]
[Table]
Proof of Proposition 3.4.
Using the identity formula
[Equation]
[Table]
[Equation]
we have
[Equation]
[Table]
[Equation]
[Table]
[Equation]
[Table]
[Equation]
[Table]
[Equation]
where the last inequality uses (cid:107) ξ 0 + · · · + ξ T − 2 (cid:107) ≤ O ( (cid:112) dT log(1 /p )) with probability at least 1 − p/ 2 .
Furthermore, we note that ξ t is independent of ξ 0 , . . .
, ξ t − 1 , ∆ 1 , . . . , ∆ t and E [ ξ t ] = 0 .
Therefore, letting S t = (cid:104) ξ t , ∆ 1 + · · · + ∆ t (cid:105) , we have E [ S t | ξ 0 , . . .
, ξ t − 1 ] = 0 ; furthermore, with probability at least 1 − p/ 2 , it satisﬁes | S t | ≤ O ( (cid:112) d T log( T/p )) for every t .
Finally, by Azuma’s inequality, we have
[Equation]
A. P ROOF OF L EMMA 3.
Proof of Lemma 3.5.
Let us denote by r t =
[ ξ a t ] 1 2 = − [ ξ b t ] 1
and we know r t ∼ N (0 , ν 2 4 ) .
We can write w
[Equation]
Using the second-order smoothness, we have
[Equation]
for some vector (cid:107) θ t (cid:107) ≤ max {(cid:107) w a 0 − w a t (cid:107) , (cid:107) w b 0 − w b t (cid:107)} · (cid:107) w a t − w b t (cid:107) .
Therefore, we have
[Equation]
Now, giving ψ 0 = ψ 0 = 0 , imagine two sequences
• ψ t +1 = ηr t e
+
(cid:0)
I − η ∇ 2 f ( w 0 ) (cid:1) ψ t and • ψ t +1 = ηr t e
+ (cid:0) I − η ∇ 2 f ( w 0 ) (cid:1) ψ t − η
(Ξ a t − Ξ b t + θ t ) =
w a t +1 − w b
[Equation]
+
We will inductively prove (cid:107) ψ t − ψ t (cid:107) ≤ 12 (cid:107) ψ t (cid:107) .
On one hand, it is easy to see that ψ t is zero except in the ﬁrst coordinate, in which it behaves as a
Gaussian with zero mean and
variance (cid:80) t − 1 k =
[Equation]
ηδ ) 2 k · η 2 ν 2= Θ (cid:16) (1+ ηδ ) 2 t ηδ · η
2 ν 2 (cid:17) .
By Gaussian tail bounds,
we know that
• with probability at least 0 .
99 , it satisﬁes (cid:107) ψ t (cid:107) ≤ O ( √ ηC 1 ν (1+ ηδ ) t √ δ ) for every t • with probability at least 0 .
99 , it satisﬁes (cid:107) ψ T (cid:107) ≥ 1 1000 ( √ ην (1+ ηδ ) T √ δ )
In the rest of the proof, we condition on this event happens.
We prove towards contradiction by assuming (cid:107) w a t − w a 0 (cid:107) ≤ R and (cid:107) w b t − w b 0 (cid:107) ≤ R for all t ∈
[ T ] .
We will inductively prove that (cid:107) ψ t − ψ t (cid:107) ≤ 1 2000 ( √ ην (1+ ηδ ) t √ δ ) .
We calculate the difference ψ t − ψ t =
η t − 1 (cid:88) i
= (cid:0)
I − η ∇
[Equation]
f ( w
[Equation]
) (cid:1)
[Equation] [Equation]
b [Equation] θ i )
Let g =
ψ t − ψ t (cid:107) ψ t − ψ t (cid:107) , then we can inner-product the above equation by vector g , which gives (cid:107) ψ t − ψ t (cid:107) =
η t − 1 (cid:88) i = (cid:68) Ξ a i − Ξ b i + θ i , (cid:0)
I − η ∇ 2 f ( w 0 ) (cid:1) t − 1 − i g (cid:69)
[Table]
where
[Table]
Let us call M =
[Table]
and
[Table]
[Equation]
[Table]
[Equation]
[Table]
[Equation]
[Table]
Together, we have
[Equation]
Under our assumption, we have (cid:107) ψ t − ψ t (cid:107) < 1 2000 ( √ ην (1+ ηδ
[Equation]
t √ δ ) and therefore (cid:107) ψ T (cid:107) ≥ (cid:107) ψ T (cid:107)−(cid:107) ψ T − ψ T (cid:107) ≥ 1 2000 ( √ ην (1+ ηδ ) t √ δ ) .
Thus, within T iterations, we have (cid:107) ψ t (cid:107) > R and this gives a contradiction.
(cid:3)
B F INAL : D OUBLE S AFE G UARD
We now come to our ﬁnal Algorithm 3 which is our perturbed SGD algorithm with two safeguards.
The two safeguard algorithm naturally divides itself into epochs, each consisting of T 1 iterations.
We will demonstrate that within most epochs, we make good progress.
Thus, consider some iterate x mT 1 , for some m < T/T 1 .
Our goal will be to argue that we make good function value progress by iterate x ( m +1) T 1 , and that we do not settle into any saddle points.
To slightly simplify notation, let w 0 = x mT 1 , and let the sequence of iterates be w 0 , . .
. , w T 1 − 1 , so that w T 1 − 1 = x ( m +1) T 1 − 1 .
For completeness’ sake we rewrite this as Algorithm 1.
Input: w 0 ∈ R d , set good 0 ⊇ good , rate η > 0 , lengths T 1 ≥ T 0 ≥ 1 , threshold T 1 > T 0 > 0 ; 1: for t ← 0 to T 1 − 1 do 2: last ← max { t t
: t 0 is a multiple of T 0 } 3: for each i ∈ good t do 4: receive ∇ t,i
R d from machine i ; 5:
A med ← A i where i ∈ good t is any machine s.
A
(cid:107) m/
B med ← B i where i ∈ good t is any machine s.t.
{ j
B
> m/ 2 .
i
A
−
[Equation]
Our main result is the following theorem.
Theorem B.1.
Let C
= α 2 + 1 m .
Suppose we pick parameters p, δ ∈ (0 , 1) , η ≤ (cid:101)
O ( δ 3 C 3 ) , ν 2 = (cid:101)
Θ( C 3 ) ,
T
= (cid:101) Θ (cid:0) 1 η (cid:1) , T 1 = (cid:101)
Θ (cid:0) 1 ηδ (cid:1) ≥ T 0 , T 1 = (cid:101)
Θ( √ T 1 ) , and T
= (cid:101) Θ( √ T 0 ) .
Then, starting from w 0 ,
(a) with probability at least 1 − p we have
[Equation]
(b) As long as (cid:107) w t − w 0 (cid:107) ≥ R for some t ∈ { 1 , 2 , . . .
, T 1 } and for R = (cid:101)
Θ( δ ) ≤ δ 2 , then with probability at least 1 − p we have then
[Equation]
(c) if λ min ( ∇ 2 f ( w 0 )) ≤ − δ , we also have with probability at least 0.45,
[Equation]
B. W HY T HEOREM B.1 I MPLIES T HEOREM 2.
Using the parameter choice η = (cid:101) Θ( ε 2 C 3 d ) from Theorem 2.3, we know (cid:101) O
( ηC 3 d ) ≤ 0 .
1 ε 2 .
We claim two things:
• For at least 90% of the epochs
they must satisfy (denoting by w 0 and w T 1 the beginning and ending points of this epoch)
[Equation]
The last inequality uses our choice of T and δ = (cid:101) Θ( √ ε ) .
The reason for this is by way of contradiction.
Suppose for at least 10% of the epochs it satisﬁes f ( w 0 ) − f ( w T 1 ) > 20 f ( x 0 ) − min f ( x ) T/T, then, for the remainder of the epochs, they must at least satisfy f ( w 0 ) − f ( w T 1 ) ≥ − 0 .
7 ηT 1 · 0 .
1 ε 2 .
Summing over all the epochs, we shall obtain f ( x 0 ) − f ( x T ) >
f ( x 0 ) − min f ( x ) but this gives a contradiction.
• For at least 40% of the epochs, they must satisfy the three properties from Theorem B.1.
In particular, for at least 30% of the epochs, they must satisfy both.
Since ε 1 . 5 is so small that
[Equation]
would give a contradiction (for instance, one can choose δ to be slightly larger than √ ε by some log factors), this means, for those 30% of the epochs, they must satisfy:
• ε 1 .
5 ≥ 0 .
7 η (cid:80) T 1 − 1 t =0 (cid:0) (cid:107)∇ f ( w t ) (cid:107) 2 − 0 .
1 ε 2 (cid:1) , • (cid:107) w t − w 0 (cid:107) ≤ δ 2 for every t
= 1 , 2 , . .
, T 1 , and • ∇ 2 f ( w 0 ) (cid:23) − δ I .
The latter two properties together implies ∇ 2 f ( w t ) (cid:23) −
δ 2 I for every t = 1 , 2 , . . .
, T 1 (by the second-order smoothness).
The ﬁrst property implies for at least 90% of the iterations t in this epoch, they must satisfy
[Equation]
f
[Equation]
) (cid:107) ≤ ε .
This ﬁnishes the proof of Theorem 2.3.
(cid:4)
B. P ROOF OF T HEOREM B.
We ﬁrst have the following lemma
Lemma B.2 (double safe guard) .
In Algorithm 3, suppose T 1 = 8 (cid:112) T 1 log(16 mT 1 /p ) and T 0 = 8 (cid:112) T 0 log(16 mT 1 /p ) .
Then, with probability at least 1 − p/ 2 , for every t = 0 , . . .
, T 1 − 1 , good t
⊇
good .
• (cid:107) σ t (cid:107) 2 ≤ O ( log( T 1 /p ) m ) , (cid:107) ∆ t (cid:107) 2 ≤ α 2 , (cid:107) ξ t (cid:107) 2 ≤ O ( ν 2 d log( T 1 /p )) , • (cid:107) σ 0 + · · · + σ t − 1 (cid:107) 2 ≤ O ( T 1 log( T 1 /p ) m ) , (cid:107) σ last + · · · + σ t − 1 (cid:107) 2 ≤ O ( T 0 log( T 1 /p ) m ) • (cid:107) ∆
+ · · · + ∆ t − 1 (cid:107) 2 ≤ O ( α 2 T 1 log( mT 1 /p )) and (cid:107) ∆ last + · · · + ∆ t − 1 (cid:107) 2 ≤ O ( α 2 T 0 log( mT 1 /p ))
• (cid:107) ξ 0 + · · · + ξ t − 1 (cid:107) 2 ≤ O ( ν 2 dT 1 log( T 1 /p )) and (cid:107)
ξ last + · · · + ξ t − 1 (cid:107) 2 ≤ O ( ν 2 dT 0 log( T 1 /p )) .
We call this probabilistic event Event double T 1 ,T 0 ( w 0 ) and Pr[ Event double T 1 ,T 0 ( w 0 )] ≥ 1 − p/ 2 .
The proof is a direct corollary of Lemma 3.2, by combining
[Table]
Event single T 0 ( w T 0 ) , Event single T 0 ( w 2 T 0 ) and so on.
The next lemma is a simple corollary by repeatedly applying Lemma 3.3.
It proves Theorem B.1a.
Lemma B.3 (modiﬁed from Lemma 3.3) .
Denote by C 1 = log( T 1 /p ) and C 2 = α 2 log mT 1 p + log
T 1 /p ) m .
Suppose η ≤ 0 .
01 min { 1 , 1 C 2 } , T 0 = 1 100 η (1+ √ C 2 ) and T 1 ≥ T 0 .
We start from w 0 and apply Algorithm 3.
Under event Event double T 1 ,T 0 ( w 0 ) , it satisﬁes
[Equation]
The next lemma can be easily derived from Lemma 3.5.
Lemma B.4 (modiﬁed from Lemma 3.5) .
Suppose
R =
Θ( δ √
[Equation]
1 log(
[Equation]
3 /ηC 2 )) and ν
2 =
Θ( C 2 log δ ηC 2 )
Suppose η ≤ 0 .
01 min { 1 , δ 3 C 2 } , T 0 = 1 100 η (1+ √ C 2 ) and T 1 =
Θ( 1 ηδ log δ 3 ηC 2 ) ≥ T 0 .
Let w
∈
R
d be any point in the space and suppose λ min ( ∇ 2 f ( w 0 )) ≤ − δ for some δ ≥ 0 .
Given two coupled sequences deﬁned as before, under events Event double T 1 ,T 0 ( w a 0 ) and Event double T 1 ,T 0 ( w b 0 ) , we have with probability at least 0.
max
[Equation]
Lemma B.4 directly proves the second half of Theorem B.1c, because given two coupled sequences with the same marginal distribution, we have
[Equation]
Proof of Lemma B.4.
Our choice on r and R satisfy the requirement of Lemma 3.5.
Suppose without loss of generality that the w a t sequence leaves w 0 by more than R .
Let T a 1 be the ﬁrst iteration t ≤ T 1 in which (cid:107) w a t
[Equation]
≥ R .
[Equation]
Combining this with Lemma B.3, we have
[Equation]
1 . 5 ) − O
( C 1 ν 2 η
( d + √ C 2 )) (cid:17) + (cid:107) w a T a 1 − w a 0 (cid:107) 2 100 ηT≥ 0 .
5 η
T a 1 − 1 (cid:88) t = (cid:16) (cid:107)∇ f ( w a t ) (cid:107)
[Equation]
− η · O ( C
[Equation]
+ ( C 2 ) 1 . 5 ) − O
( C 1 ν 2 η
( d + √ C 2 )) (cid:17)
+
R100 ηT
Combining this with Lemma B.3 again but for the remainder iterations, we have f ( w a 0 ) − f ( w a T 1 ) ≥ 0 .
5 η
T
[Equation]
(cid:88) t
[Equation]
(cid:16)
[Equation]
+
R100 ηT(cid:3)
In fact, the above same proof of Lemma B.4 also implies Theorem B.1b.
These together ﬁnish the proof of
Theorem B.1.
(cid:4)
C M ORE ON E XPERIMENTS
We conduct experiments on training a residual network ResNet-20 He et al.
(2016) on the CIFAR-10/100 image classiﬁcation tasks Krizhevsky et al.
C. S ETTING AND I MPLEMENTED M ETHODS
In all of our experiments, we use 10 workers and mini-batch size 10 per worker.
Given any attacker and any defender algorithm, we run SGD three times for 140 epochs, each time with a different initial learning rate η ∈ { 0 . 1 , 0 . 2 , 0 . 4 } .
We let the learning rate decrease by a factor of 10 on epochs 80 and 110, and present present the best testing accuracies in the three runs (each corresponding to a different initial learning rate).
We use standard data augmentation (random crops, random ﬂips, and channel normalization).
We compare against Geometric Median Chen et al.
Coordinate-wise Median Yin et al.
(2018; 2019), Krum Blanchard et al.
(2017), and
Zeno Xie et al.
(2018b)
with attacks.
We set α = 0 .
so there are
Byzantine workers.
(This exceeds the fault-tolerance of Krum, and so we also tested Krum with only 3 Byzantine workers.)
We formally deﬁne those prior works as follows.
Deﬁnition C.1 (GeoMed Chen et al.
The geometric median of { y 1 , ..., y m } , denoted by geo med { y 1 , ..., y m } , is
[Equation]
In our experiments, we choose the geometric median from set { y 1 , ..., y m } .
Deﬁnition C.2 (coordinate-wise median Yin et al.
Coordinate-wise median g = med { y 1 , ..., y m } is deﬁned as a vector with its k-th coordinate being g [ k ] = med { y 1 [ k ] , ...,
y m
[ k ] } for each k ∈ [ d ] , where med is the usual (one-dimensional) median.
Deﬁnition C.3 (Krum Blanchard et al.
[Equation]
1 , ..., y m } :=
y k where k = arg
[Equation]
[ m ]
[Equation]
and i → j is the indices of the m − b − 2 nearest neighbours of y i in { y 1 , ..., y m }\{ y i } by Euclidean distances.
Note that Krum requires 2 b + 2 < m .
So, we have also repeated the experiments for Krum with 3 Byzantine workers (out of 10 workers) to be more fair.
Deﬁnition C.4 (Zeno Xie et al.
(2018b)) .
[Equation]
where { (cid:101) y ( i ) :
i ∈ [ m ] } are the gradient estimators with the m − b highest “scores”, and the so-called stochastic descendant score for any gradient estimator u , based on the current parameter x , learning rate η , and a constant weight ρ > 0 , is deﬁned as:
[Equation]
f
[Equation]
) − f r
[Equation]
x − ηu ) is the estimated descendant of the loss function and ρ (cid:107) u (cid:107) 2 is the magnitude of the update.
In our experiments, we let f r ( x ) be the estimated objective over a mini-batch of size n r = 10 (so the time to perform this estimation is on the same magnitude as the gradient evaluation for each individual worker).
We also chose ρ = 0 .
(and this value does not affect our experimental results by much).
Safeguard SGD.
Our Algorithm 1 is stated in a way to make our theoretical proofs as clean as possible.
Here, we discuss how we actually implement it in practice.
First of all, as common in the literature, we omit the Gaussian noise ξ t that is added for theoretical purpose, and instead rely on the natural noise in the training process to escape saddle points.
Also, we make universal choices for our safeguard window sizes (across all attackers): for our algorithm with a single safeguard we have used a universal window size T = 3 epochs, and for our algorithm with double safeguards we have used window sizes T 0 = 1 epoch and T 1 = 6 epochs.
We also provide an automatic empirical process to select safeguard thresholds and eliminate bad workers.
The process to determine A med (and likewise for B med ) is described as follows.
In each iteration
, for every worker i ∈ [ m ] , we sort (cid:8) (cid:107) A i − A j (cid:107) (cid:9) j ∈ [ m ] and pick the smallest (cid:100) m/
+ 1 (cid:101) -th entry, and let this number be the “score” for worker i .
We select the worker with the smallest “score” as A med and call its “score” S .
Then, we use 1 .
5 min { S, 5 } as the safeguard threshold for this iteration.
Namely, we declare any worker j satisfying
In our ﬁrst version of the paper, we pre-run the algorithm for 20 epochs to determine safeguard thresholds; in the newer version, we have avoided the pre-run.
(cid:107)
A j − A med (cid:107) ≥ 1 .
5 max { S, 5 } as a bad worker.
C. E XPERIMENT R ESULTS BY A TTACKS
The ideal accuracies are 91.7% / 68.0% for CIFAR-10/100, which correspond to applying SGD using only the stochastic gradients from the honest workers.
Below we discuss about the experimental results one attack at a time.
C.2. V ARIANCE A TTACK
We begin by looking at the hardest proposed attack from prior works.
The Variance attack follows the strategy prescribed by Baruch et al.
(2019), by which Byzantine workers collude in order to shift the mean among all gradients by a factor β times the standard deviation of the gradient, while staying within population variance.
More precisely, the maximal change to the mean that can be applied by an attacker without the fear of being detected, by using the properties of the Normal distribution, speciﬁcally the cumulative standard normal function, and compute the maximal possible shift so that the attackers’s values stay within population variance.
(See (Baruch et al., 2019, Algorithm 3) for a precise description.
Our β is z max in their notation.)
We implement this strategy coordinate-wise, the same way as they did.
Their work observes that the shift β can be non-trivial in practice, since stochastic gradients tend to have large variance in neural network training (which we also observed in our setup).
Critically, the attack cannot be defended against by historyless algorithms , as the attacker’s values are statistically indistinguishable from a regular execution in a single iteration.
In our setting, for 10 total nodes and α = 0 .
4 , β is upper bounded by 0 .
3 (following the classic tables for the cumulative normal).
We also ran the same attack in the setup from their paper (50 nodes total, of which 24 are Byzantine, which allows β ∼ 1 . 5 ) and observed a similar outcome.
Results for this experiment are given in
Figure 3.
[Figure]
As shown by the results, our algorithm provably circumvents this attack, and recovers full accuracy.
This is explained by the fact that the algorithm has memory : in particular, Byzantine nodes following this strategy will progressively diverge from the (honest) “median” A med (at a “linear” rate, recall Figure 2(a)), and therefore will eventually exceed the threshold and be marked as malicious by the algorithm.
Speciﬁcally, both variants of the algorithm successfully catch all the bad nodes after at most 150 iterations.
Indeed, at the 100-th iteration, the pair-wise distances (cid:107) A i − A j (cid:107) among good workers i, j ∈ good are between 5.3 and 6.3, but the pair-wise distance between a good and a bad worker is at least 12.5.
C.2. S IGN -F LIPPING A TTACK
We next move onto the sign-ﬂipping attack.
Recall that, in a sign-ﬂipping attack, each Byzantine worker sends the negative gradient to the master.
This is still a strong attack since if one does not avoid any bad workers, the test accuracy will suffer from a signiﬁcant drop.
The results are in Figure 4.
From the plots, one can see that again our single and double safe-guard algorithms both outperform prior works.
They also successfully catch all the bad workers within 150 iterations.
(For instance, at iterationfor CIFAR-10 training, the distance (cid:107) A med − A j (cid:107) for a good worker j ∈ good is at most 6 . 9 , but for a bad 9 This process appears a little different from Algorithm 1, but a similar proof also holds for this new empirical process.
The constant factor 1.5 requires no tuning, and the constant threshold 5 is chosen so that the stochastic gradient of batch size 500 at random initialization has Euclidean norm no more than 5.
[Figure]
worker j (cid:54)∈ good it can be more than 11 .)
In contrast, prior work Zeno completely fails because locally at a training step, using merely n r = 10 samples to evaluate the objective, it is statistically not possible to even distinguish if the sign of the stochastic gradient is ﬂipped or not.
For prior works Krum and GeoMedian, although they appear to have some non-negligible performances, but they are actually no better than simply applying SGD with the naive mean of gradients from all the workers (including those from bad workers).
Therefore, we conclude that prior works all fail to be
Byzantine fault tolerant under this attack.
C.2. D ELAYED -G RADIENT A TTACK
Recall that, in a delayed-gradient attack, each Byzantine worker sends an old gradient to the master.
In our experiments, the delay is of D = 1000 iterations
(=
2 epochs).
We believe this is not a very strong attack, because delayed gradients are not sufﬁciently malicious: they are still “correct” to certain extent albeit being delayed.
The results are shown in Figure
[Figure]
From the plots, one can see that our single and double safe-guard algorithms again both match the ideal accuracies.
All the prior works suffer from a signiﬁcant performance loss under this attack.
It is worth noting that our single and double safe-guard algorithms do not catch any bad worker under this attack, so they simply use the “naive mean” of gradients from all the workers (including those delayed gradients from bad workers).
However, there is no performance loss even if we use those delayed gradients.
That is why we believe the delayed-gradient attack is not very strong, as the gradients are not sufﬁciently malicious.
Prior work Zeno suffers from some performance loss, because it only uses 6 workers out of 10, in which statistically only 6 × 0 .
6 ≈ 3 ∼ 4 gradients are correct.
Other prior works suffer from performance loss, this the cleanness, gives 81.4% test accuracy on CIFAR-10 and 38.3% on CIFAR-100.
(This should not be surprising, since using (1 − ) m = 6 positive gradients plus αm = 4 negative gradients still gives non-negligible information about the true gradient.)
slightly is probability stochastic because they only pick one single stochastic gradient from the 10 workers, and it is sometimes even from the bad worker.
C.2. L ABEL -F LIPPING A TTACK
Recall that, in the label-ﬂipping attack, each Byzantine worker computes its gradient based on the cross-entropy loss with ﬂipped labels: for CIFAR-10, label (cid:96) ∈ { 0 , ..., 9 } is ﬂipped to 9 − (cid:96) , and for CIFAR-100, label (cid:96) is ﬂipped to 99 − (cid:96) .
The results are shown in Figure 6.
[Figure]
From the plots, one can see that our single and double safe-guard algorithms even outperform the “ideal accuracies.”
(92.4% accuracy vs “ideal accuracy” 91.7% under CIFAR-10; 69.4% accuracy vs “ideal accuracy” 68.0 under CIFAR-100.)
In addition, we have found out that the safeguard algorithms did not catch any bad worker.
This should not be surprising, since label-ﬂipping (a.k.a. label smoothing) is known to be a regularization technique to actually improve test accuracy, as opposed to hurt performance.
Zeno also performs well under this attack (but it does not outperform the ideal accuracy).
We have investigated into Zeno, and found out that it cannot distinguish good workers from bad workers under label-ﬂipping attack; and therefore Zeno effectively always runs under 6 random workers as opposed to using the full power of the m = 10 workers (recall Zeno picks 6 workers with the topmost scores, see Deﬁnition C.4).
This explains its (minor) under-performance comparing to safeguard.
Other prior works perform signiﬁcantly worse, and this should be alarming since label-ﬂipping is one type of smoothing technique to improve test accuracy, as opposed to an actual “attack” to hurt performance.
C.2. S AFEGUARD A TTACKS
Finally, in the safeguard attack that we design, Byzantine workers send negative but re-scaled gradient to the master.
We choose the re-scale factor so that it hardly triggers the safe-guard conditions at the master.
From our experiment, choosing the re-scale factor as 0 . 6 in all the cases do not trigger the safe-guard conditions, while choosing a re-scale factor as 0 .
7 enables the algorithm to catch Byzantine workers occasionally.
Our results are shown in Figure 7 (for re-scale factor 0 . 6 ) and Figure 8 (for re-scale factor 0 . 7 ).
[Figure]
Re-scale factor 0.6.
In Figure 7, the performance of our (single and double) safeguard algorithms indeed get hurt a bit.
Recall in Figure 7 the re-scale factor 0.6 is chosen to maximally impact our algorithm.
The test accuracy drops from 91.7% to 89.3% under CIFAR-10; and drops from 68 .
0% to 60 .
0% under CIFAR-100 (for both single and double safeguards).
In these cases, we conﬁrm that both versions of the safeguard algorithms did not catch any bad worker.
However, this still signiﬁcantly outperforms all prior works.
[Figure]
Re-scale factor 0.7.
In Figure 8, we present the scenario when the re-scale factor is 0.7, so that the safeguard algorithms can occasionally catch some bad workers (depending on the randomness and learning rate).
We conﬁrm that in the three runs of single safeguard, it catches 1 , 2 , 3 bad workers for CIFAR-10, and 1 , 0 , 0 bad workers for CIFAR-100 respectively; in the three runs of double safeguard, it catches 1 , 2 , 4 bad workers for
CIFAR-10, and 2 , 2 , 2 bad workers for CIFAR-100 respectively.
Since there is a signiﬁcant performance gain when our safeguard algorithms catch bad workers, this explains why safeguard algorithms in Figure 8 outperform their counterparts in Figure 7 with rescale factor 0.6.
At the same time, we notice that the double safeguard algorithm has the ability to catch bad workers more easily .
This is why double safeguard signiﬁcantly outperforms single sageguard in Figure 8.
In contrast, all other prior algorithms perform extremely bad under this attack.
To some extent, safeguard attack is even stronger than the previously proposed variance attack , since it can drag the 100-class test accuracy on
CIFAR-100 for all prior defense algorithms to nearly 1%, while variance attack can only drag them down to around 10%.
C. F ULL C OMPARISON T ABLE
We also include the full test accuracy comparison table in Table 1.
[Table]
C. A TTACK A GAINST THE C ONVEX A LGORITHM OF A LISTARH ET AL . (2018)
We now brieﬂy describe an attack against this algorithm.
The attack speciﬁcally leverages the fact that the algorithm does not use sliding windows.
One can ﬁrst run the vanilla SGD to compute “the maximum deviation per good worker” for the accumulation vector used by the algorithm (cid:80)
Tt =0 ∇ t .
This maximum deviation is therefore a lower bound for the threshold used in their algorithm.
Next, we design an attacker who evenly distributes this total allowed deviation to e.g.
5 consecutive epochs, and behaves honestly for the remaining epochs.
Such an attacker cannot be identiﬁed by this algorithm, because its total deviation across all the iterations is identical to that of a good worker.
However, this leads the algorithm to divergence.
Speciﬁcally, suppose 4 Byzantine workers all maliciously report their stochastic gradients multiplied by the scalar − 5 , and the remaining 6 good workers report their true stochastic gradients.
One can verify numerically that this attacker can run for 5 consecutive epochs (say, epochs a, a + 1 , a + 2 , a + 3 , a + 4 ) without being caught by the algorithm.
Now,
• if a ≤ 75 , within just 1 epoch of attack, the neural net weights diverge (value N A N).
• if 80 ≤ a ≤ 115 , this attack is applied after the ﬁrst learning rate decay.
Within just 1 epoch of the attack, the objective explodes and accuracy becomes 10% (random), and within 3 epochs the algorithm diverges completely.
• if 120 ≤ a ≤ 155 , this attack is after the second learning rate decay.
Within just 2 epochs of attack, the accuracy drops to 11% .
Later, the accuracy never recovers above 40% .