P ROVABLE F EDERATED A DVERSARIAL L EARNING VIA M IN - MAX O PTIMIZATION
Anonymous authors
Paper under double-blind review
A BSTRACT
Federated learning (FL) is a trending training paradigm to utilize decentralized training data.
FL allows clients to update model parameters locally for several epochs, then share them to a global model for aggregation.
This training paradigm with multi-local step updating before aggregation exposes unique vulnerabilities to adversarial attacks.
Adversarial training is a trending method to improve the robustness of neural networks against adversarial perturbations.
First, we formulate a general form of federated adversarial learning (FAL) that is adapted from adversarial learning in the centralized setting.
On the client side of FL training,
FAL has an inner loop to optimize an adversarial to generate adversarial samples for adversarial training and an outer loop to update local model parameters.
On the server side, FAL aggregates local model updates and broadcast the aggregated model.
We design a global training loss to formulate FAL training as a min-max optimization problem.
Unlike the convergence analysis in centralized training that relies on the gradient direction, it is signiﬁcantly harder to analyze the convergence in FAL for three reasons: 1) the complexity of min-max optimization, 2) model not updating in the gradient direction due to the multi-local updates on the clientside before aggregation and 3) inter-client heterogeneity.
Further, we address the challenges using appropriate gradient approximation and coupling techniques and present the convergence analysis in the over-parameterized regime.
Our main result theoretically shows that the minimal value of loss function under this algorithm can converge to (cid:15) small with chosen learning rate and communication rounds.
It is noteworthy that our analysis is feasible for non-IID clients.
I NTRODUCTION
Federated learning (FL) is playing an important role nowadays, as it allows different parties or clients to collaboratively train deep learning models without sharing private data.
One popular FL paradigm called FedAvg (McMahan et al., 2017) introduces an easy-to-implement distributed learning method without data sharing.
Speciﬁcally, it requires a central server to aggregate model updates computed by the local participants (also known as nodes or clients) using local imparticipable private data.
Then the central server aggregates these updates to train a globally learned model.
Nowadays deep learning model are exposed to severe threats of adversarial samples.
Namely, small adversarial perturbations on the inputs will dramatically change the outputs or output wrong answers (Szegedy et al., 2013).
In this regard, much effort has been made to improve neural networks’ resistance to such perturbations using adversarial learning (Tramèr et al., 2017; Samangouei et al., 2018; Madry et al., 2018).
Among these studies, the adversarial training scheme in Madry et al.
(2018) has achieved the good robustness in practice.
Madry et al.
(2018) proposes an adversarial training scheme that uses projected gradient descent (PGD) to generate alternative adversarial samples as the augmented training set.
Generating adversarial examples during neural network training is considered as one of the most effective approaches for adversarial training up to now according to the literature (Carlini & Wagner, 2017; Athalye et al., 2018; Croce & Hein, 2020).
Although adversarial learning has attracted much attention in the centralized domain, its practice in FL is under-explored (Zizzo et al., 2020).
Like training classical deep neural networks that use gradient-based methods, FL paradigms are vulnerable to adversarial samples.
Adversarial learning in FL brings multiple open challenges due to FL properties on low convergence rate, application in non-IID environments, and secure aggregation solutions.
Hence applying adversarial learning in an FL paradigm may lead to unstable training loss and a lack of robustness.
However, a recent practical work Zizzo et al.
(2020) observed that although there exist difﬁculties of convergence, the federation of adversarial training with suitable hyperparameter settings can achieve adversarial robustness and acceptable performance.
Motivated by the empirical results, we want to address the provable property of combining adversarial learning into FL from the theoretical perspective.
This work aims to theoretically study the unexplored convergence challenges that lie in the interaction between adversarial training and FL.
To achieve a general understanding, we consider a general form of federated adversarial learning (FAL) , which deploys adversarial training scheme on local clients in the most common FL paradigm, FedAvg (McMahan et al., 2017) system.
Speciﬁcally,
FAL has an inner loop of local updating that generates adversarial samples (i.e., using Madry et al.
(2018)) for adversarial training and an outer loop to update local model weights on the client side.
Then global model is aggregated using FedAvg (McMahan et al., 2017).
The algorithm is detailed in Algorithm 1.
We are interested in theoretically understanding the proposed FAL scheme from the aspects of model robustness and convergence:
Can federated adversarial learning ﬁt training data robustly and converge with a feasibly sized neural network?
The theoretical convergence analysis of adversarial training itself is challenging in the centralized training setting.
Tu et al.
(2018) recently proposed a general theoretical method to analyze the risk bound with adversaries but did not address the convergence problem.
The investigation of convergence on over-parameterized neural network has achieved tremendous progress (Du et al., 2019a;
Allen-Zhu et al., 2019b;c; Du et al., 2019b; Arora et al., 2019b).
The basic statement is that training can converge to sufﬁciently small training loss in polynomial iterations using gradient descent or stochastic gradient descent when the width of the network is polynomial in the number of training examples when initialized randomly.
Recent theoretical analysis (Gao et al., 2019; Zhang et al., 2020b) extends these standard training convergence results to adversarial training settings.
To answer the above interesting but challenging question, we formulate FAL as an min-max optimization problem.
We extend the convergence analysis on the general formulation of over-parameterized neural networks in the FL setting that allows each client to perform min-max training and generate adversarial examples (see Algorithm 1).
Involved challenges are arising in FL convergence analysis due to its unique optimization method: 1) unlike classical centralized setting, the global model of FL does not update in the gradient direction; 2) inter-client heterogeneity issue needs to be considered.
Despite the challenges, we give an afﬁrmative answer to the above question.
To the best of our knowledge, this work is the ﬁrst theoretical study that examines these unexplored challenges on the convergence of adversarial training with FL.
The contributions of this paper are:
• We propose a framework to analyze a general form of FAL in over-parameterized neural networks.
We follow a natural and valid assumption of data separability that the training dataset are well separated apropos of the adversarial perturbations’ magnitude.
After sufﬁcient rounds of global communication and certain steps of local gradient descent for each t , we obtain the minimal loss close to zero.
Notably, our assumptions do not rely on data distribution.
Thus the proposed analysis framework is feasible for non-IID clients.
• We are the ﬁrst to theoretically formulate the convergence of the FAL problem into a minmax optimization framework with the proposed loss function.
In FL, the update in the global model is no longer directly determined by the gradient directions due to multiple local steps.
To tackle the challenges, we deﬁne a new ‘gradient’, FL gradient .
With valid ReLU Lipschitz and over-parameterized assumptions, we use gradient coupling for gradient updates in FL to show the model updates of each global updating is bounded in federated adversarial learning.
Roadmap The rest of the paper is organized as follows.
We overview the related work on federated learning and adversarial training in Section 2.
We describe the problem formulation for the federated adversarial learning algorithm and introduce the notations, assumptions to be used, and conditions to be considered to ensure convergence in Section 3.
Our main convergence result is presented in
Section 4.
In Section 5, we present the core techniques and an overview of the proof.
We summarize and conclude our results in Section 6.
R ELATED W ORK
Federated Learning A efﬁcient and privacy-preserving way to learn from the distributed data collected on the edge devices (a.k.a clients) would be FL.
FedAvg is a easy-to-implement distributed learning strategy by aggregating local model updates on the server side and transmitting the averaged model back to local clients.
Later, many FL methods are developed baed on FedAvg.
Theses FL schemes can be divided into aggregation schemes (McMahan et al., 2017; Wang et al., 2020; Li et al., 2021) and optimization schemes (Reddi et al., 2020; Zhang et al., 2020a).
Nearly all the them have the common characteristics that client model are updating using gradient descent-based methods, which is venerable to adversarial attacks.
In addition, data heterogeneity brings in huge challeng in FL.
For IID data, FL has been proven effective.
However, in practice, data mostly distribute as non-IID.
Non-IID data could substantially degrade the performance of FL models (Zhao et al., 2018;
Li et al., 2019; 2021; 2020a).
Despite the potential risk in security and unstable performance in nonIID setting, as FL mitigates the concern of data sharing, it is still a popular and practical solution for distributed data learning in many real applications, such as healthcare (Li et al., 2020b; Rieke et al., 2020), autonomous driving (Liang et al., 2019), IoTs (Wang et al., 2019;
Lim et al., 2020).
Learning
with Adversaries Since the discovery of adversarial examples (Szegedy et al., 2013), to make neural networks robust to perturbations, efforts have been made to propose more effective defense methods.
As adversarial examples are an issue of robustness, the popular scheme is to include learning with adversarial examples, which can be traced back to (Goodfellow et al., 2014).
It produces adversarial examples and injecting them into training data.
Later, Madry et al.
(Madry et al., 2018) proposed training on multi-step PGD adversaries and empirically observed that adversarial training consistently achieves small and robust training loss in wide neural networks.
Federated Adversarial Learning Adversarial examples, which may not be visually distinguishable from benign samples, are often classiﬁed.
This poses potential security threats for practical machine learning applications.
Adversarial training (Goodfellow et al., 2014; Kurakin et al., 2016) is a popular protocol to train more adversarial robust models by inserting adversarial examples in training.
The use of adversarial training in FL presents a number of open challenges, including poor convergence due to multiple local update steps, instability and heterogeneity of clients, cost and security request of communication, and so on.
To defend the adversarial attacks in federated learning, limited recent studies have proposed to include adversarial training on clients in the local training steps (Bhagoji et al., 2019; Zizzo et al., 2020).
These two works empirically showed the performance of adversarial training.
The theoretical analysis of convergence is under explored.
In addition, (Zhang et al., 2021) proposed an adversarial training strategy in classical distributed setting, not meeting the specialty in FL.
Convergence via Over-parameterization Convergence analysis on over-parameterized neural networks falls in two lines.
In the ﬁrst line of work (Li & Liang, 2018; Allen-Zhu et al., 2019b;c;a), data separability plays a crucial role in deep learning theory, especially in showing the convergence result of over-parameterized neural network training.
Denote δ as the minimum distance between all pairs of data points.
Data separability theory requires the width ( m ) of the neural network is at least polynomial factor of all the parameters (i.e. m ≥ poly( n, d, 1 /δ ) ), where n is the number of data points and d is the dimension of data.
Another line of work (Du et al., 2019b; Arora et al., 2019a;b;
Song & Yang, 2019; Lee et al., 2020) builds on neural tangent kernel (Jacot et al., 2018).
It requires the minimum eigenvalue ( λ ) of the neural tangent kernel to be lower bounded.
Our analysis focuses on the former approach based on data separability.
Robustness of Federated Learning Previously there were several works that theoretically analyzed the robustness of federated learning under noise. Yin et al. (2018) developed distributed optimization algorithms that were provably robust against arbitrary and potentially adversarial behavior in distributed computing systems, and mainly focused on achieving optimal statistical performance. Reisizadeh et al.
(2020) developed a robust federated learning algorithm by considering a structured afﬁne distribution shift in users’ data.
Their analysis was built on several assumptions on the loss functions without a direct connection to neural network.
P ROBLEM F ORMULATION
To explore the properties of FAL in deep learning, we formulate the problem in over-parameterized neural network regime.
We start by presenting the notations and setup required for federated adversarial learning, then we will describe the loss function we use and our FAL algorithm.
The rest of this section is organized as follows.
In Section 3.1 we introduce the notations to be used.
In Section 3.2 we state the assumptions on the dataset and initialization values.
In Section 3.3 we formally describe our FAL algorithm (Algorithm 1) to be investigated.
3. N OTATIONS
For a vector x , we use (cid:107) x (cid:107) p to denote its (cid:96) p norm, in this paper we mainly consider the situation when p = 1 , 2 , or ∞ .
For a matrix W ∈ R d × m , we use W (cid:62) to denote its transpose and use tr[ W ] to denote its trace.
We use (cid:107) W (cid:107) 1 , (cid:107) W (cid:107) 2 and (cid:107) W (cid:107) F to denote the entry-wise (cid:96) 1 norm, spectral norm and Frobenius norm of W respectively.
For each j ∈ [ m ] , we let W j ∈ R
d be the j -th column of W .
We let (cid:107) W (cid:107) 2 , 1 denotes (cid:80) mj
=1 (cid:107) W j (cid:107) 2 and (cid:107) W (cid:107) 2 , ∞ denotes max j ∈ [ m ] (cid:107) W j (cid:107) 2 .
We denote Gaussian distribution with mean µ and covariance Σ as N ( µ, Σ) .
We use σ ( · ) to denote the ReLU function σ ( z ) =
max { z, 0 } , and use 1 { E } to denote the indicator function of event E .
[Equation] S ETUP
Two-layer ReLU network in FAL Following recent theoretical work in understanding neural networks training in deep learning (Du et al., 2019b; Arora et al., 2019a;b; Song & Yang, 2019; Lee et al., 2020), in this paper, we focus on a two-layer neural network that has m neurons in the hidden layer, where each neuron is a ReLU activation function.
We deﬁne the global network as
[Equation]
and for c ∈ [ N ] , we deﬁne the local network of client c as
[Equation]
Here U =
( U 1 , . . .
, U m ) ∈ R
d × m is the global hidden weight matrix, W c
=
( W c, 1 , . . .
, W c,m ) ∈
R d × m is the local hidden weight matrix of client c , and a = ( a 1 , . .
. , a m ) ∈
R m denotes the output weight vector, b
= ( b 1 , . . .
, b m ) ∈
R m denotes the bias vector.
During the process of federated adversarial learning, we only update U and W , keeping a and b equal to their initialization values, so we can write the global network as f U ( x ) and the local network as f W c ( x ) .
For the situation we don’t care about the weight matrix, we write f ( x ) or f c ( x ) for short.
Next, we make some standard assumptions regarding our training set.
Deﬁnition 3.1 (Dataset) .
There are N clients and n = NJ data in total.
1 Let S = ∪ c ∈
[ N ] S c where
S c = { ( x c, 1 , y c, 1 ) , ..., ( x c,J , y c,J ) } ⊆
R d × R denotes the J training data of client c .
Without loss of generality, we assume that for all c ∈ [ N ] , j ∈ [ J ] , (cid:107) x c,j (cid:107) 2 = 1 and the last coordinate of each point equals to 1 / 2 , so we consider X := { x ∈ R d : (cid:107) x (cid:107) 2 = 1 , x d = 1 / 2 } .
For simplicity, we also assume that for all c ∈ [ N ] , j ∈ [ J ] , | y c,j | ≤ 1 .
We now deﬁne the initialization for the neural networks.
Our appears many
Deﬁnition 3.2 (Initialization) .
The initialization of a ∈ R m , U ∈ R d × m , b ∈ R m is a (0) ∈
R m , U (0)
∈ R
d × m , b (0) ∈ R m .
The initialization of client c’s local weight matrix W c is
W c (0 , 0) =
U (0) .
Here the second term in W c denotes iteration of local steps.
• For each r ∈ [ m ] , a r (0) are i.i.d.
sampled from [ − 1 /m 1 / 3 , +1 /m 1 / 3 ] uniformly.
• For each i ∈
[ d ] , r ∈ [ m ] , U i,r (0) and b r (0) are i.i.d.
random Gaussians sampled from N (0 , 1 /m ) .
Here U i,r means the ( i, r ) -entry of U .
For each global iteration t ∈ [ T ] ,
• For each c ∈ [ N ] , the initial value of client c’s local weight matrix W c is W c ( t, 0) =
U ( t ) .
Next we formulate the adversary model that will be used.
Deﬁnition 3.3 ( ρ -Bounded adversary) .
Let F denote the function class.
An adversary is a mapping
A : F × X × R → X which denotes the adversarial perturbation.
For ρ > 0 , we deﬁne the (cid:96)ball as B 2 ( x, ρ ) :
= { (cid:101) x ∈ R
d : (cid:107) (cid:101) x − x (cid:107) 2 ≤ ρ } ∩ X , we say an adversary A is ρ -bounded if it satisﬁes A
( f, x, y ) ∈ B 2 ( x, ρ ) .
Moreover, given ρ > 0 , we denote the worst-case adversary as
A ∗ := argmax (cid:101) x ∈B 2 ( x,ρ ) (cid:96) ( f ( (cid:101) x ) , y ) , where (cid:96) is loss function deﬁned in Deﬁnition 3.5.
Well-separated training sets In the over-parameterized regime, it is a standard assumption that the training set is well-separated.
Since we deal with adversarial perturbations, we require the following γ -separability, which is a bit stronger.
Deﬁnition 3.4 ( γ -separability) .
Let γ ∈ (0 , 1 / 2) , δ ∈ (0 , 1 / 2) , ρ ∈ (0 , 1 / 2) denote three parameters such that γ ≤ δ · ( δ − 2 ρ ) .
We say our training set S =
∪ c ∈
[ N ] S c = ∪ c ∈
[ N ] ,j ∈ [ J ] { ( x c,j , y c,j ) } ⊂ R d × R is globally γ -separable w.r.t a ρ -bounded adversary, if (cid:107) x c 1 ,j 1 − x c 2 ,j 2 (cid:107) 2 ≥ δ holds for any c 1 (cid:54) =
c 2 and j 1 (cid:54) =
j 2 .
It is worth noting that, our problem setup does not require the assumption on independent and identically distribution (IID) on data, thus such a formation can be applied to unique challenge of the non-IID setting in FL.
3. F EDERATED A DVERSARIAL L EARNING
Algorithm We focus on a general FAL framework that is adapted from the most common adversarial training in the classical setting on the client.
Speciﬁcally, we describe the adversarial learning of a local neural network f W c against an adversary
A that generate adversarial examples during training as shown in Algorithm 1.
As for the analysis of a general theoretical analysis framework, we do not specify the explicit format of A .
The FAL algorithm contains two procedures: one is C LIENT U PDATE running on client side and the other is S ERVER E XECUTION running on server side.
These two procedures are iteratively processed through communication iterations.
Adversarial training is addressed in procedure C LIENT U PDATE .
Hence, there are two loops in C LIENT U PDATE procedure: the outer loop is iteration for local model updating; and the inner loop is iteratively generating adversarial samples by the adversary A .
In the outer loop in S ERVER E XECUTION procedure, the neural network’s parameters are updated to reduce its prediction loss on the new adversarial samples.
Adversary and robust loss We set the following loss for the sake of technical presentation simplicity, as is customary in prior studies Gao et al.
Allen-Zhu et al.
(2019a):
Deﬁnition 3.5 (Lipschitz convex loss) .
A loss function (cid:96) : R × R → R is said to be a Lipschitz convex loss , if it satisﬁes the following four properties:
• non-negative; • convex with respect to the ﬁrst input of (cid:96) ; • 1 − Lipshcitz, which means (cid:107) (cid:96) ( x 1 , y 1 ) − (cid:96) ( x 2 , y 2 ) (cid:107) 2 ≤ (cid:107) ( x 1 , y 1 ) − ( x 2 , y 2 ) (cid:107) 2 ; • (cid:96) ( y, y )
=
for all y ∈ R .
Notations: Training sets of clients with each client is indexed by c , S c
= { ( x c,j , y c,j ) } Jj =1 ; adversary A ; local learning rate η local ; global learning rate η global ; local updating iterations K ; global communication round T .
3: procedure
S
W
(cid:46) Receive global model weights update.
6: for
0 → do 7: do 8: (cid:101)
(cid:46)
S
←
10: end for 11:
W
12: end for 13:
Send
15: end procedure 16: procedure do 18:
∆ U c ( t ) 20:
U ( t + 1) ← U ( t ) + η global · ∆ U ( t ) (cid:46) Aggregation on the server side.
Send U ( t + 1) to client c for C LIENT U PDATE ( c, t ) 22: end for 23: end procedure
In this paper we assume (cid:96) is a Lipschitz convex loss.
Next, we deﬁne our robust loss function of a neural network, which is based on the adversarial examples generated by a ρ -bounded adversary A .
Deﬁnition 3.6 (Training loss) .
Given a client’s training set S c = { ( x c,j , y c,j ) } Jj =1 ⊂ R d × R of
J examples, the standard training loss of a neural net f c : R d → R is deﬁned as L ( f c , S c ) :
= 1 J (cid:80) Jj =1 (cid:96) ( f c ( x c,j ) , y c,j ) .
Given S =
∪ c ∈
[ N ] S c , we deﬁne the global loss as L ( f U , S ) :
= 1 NJ (cid:80)
Nc =1 (cid:80) Jj =1 (cid:96) ( f U ( x c,j ) , y c,j ) .
Given a ρ -bounded adversary A , we deﬁne the global loss with respect to A as
[Equation]
and also deﬁne the worst-case global robust loss as
[Equation]
( f c , x c,j , y c,j )) , y c,j ) = 1 NJ N (cid:88) c =
J (cid:88)
j = max x ∗ c,j ∈B 2 ( x c,j ,ρ ) (cid:96) (cid:0) f U ( x ∗ c,j ) , y c,j (cid:1) .
Moreover, since we deal with pseudo-net which is deﬁned in Deﬁnition 5.1, we also deﬁne the loss of a pseudo-net as L ( g c , S c ) :
= 1 J (cid:80) Jj =1 (cid:96) ( g c ( x c,j ) , y c,j ) and L ( g U , S ) :
= 1 NJ (cid:80)
Nc =1 (cid:80) Jj =1 (cid:96) ( g U ( x c,j ) , y c,j ) .
O UR R ESULT
The main result of this work is showing the convergence of FAL algorithm (Algorithm 1) in overparameterized neural networks.
Speciﬁcally, our deﬁned global training loss (Deﬁnition 3.6) converges to a small (cid:15) with the chosen communication round T , local and global learning rate η local , η global .
It is plausible to see that we can control η local according to the local update steps K to achieve convergence.
We now formally present our main result Theorem 4.1.
Theorem 4.1 (Federated Adversarial Learning) .
Let c 0 ∈ (0 , 1) be a ﬁxed constant.
Let N denotes the total number of clients and J denotes the number of data points per client.
Suppose that our training set S = ∪ c ∈
[ N ] S c is globally γ -separable for some γ > 0 .
Then, for all (cid:15) ∈ (0 , 1) , there exists R = poly(( NJ/(cid:15) ) 1 /γ )
that satisﬁes: for all m ≥ poly( d, ( NJ/(cid:15) )
1 /γ ) , for every
K ≥ 1 and T ≥ poly( R/(cid:15) ) , with probability at least 1 − exp( − Ω( m 1 / 3 )) over the randomness of a (0) ∈ R m , U (0)
∈ R
d × m , b (0) ∈ R m , running federated adversarial learning (Algorithm 1) with step size choices η global = 1 / poly( NJ, R, 1 /(cid:15) ) and η local = 1 /K will output a list of weights { U (1) , U (2) , · · · , U ( T ) } ∈ R d × m that satisfy
[Equation]
P ROOF S KETCH
To handle the min-max objective in FAL, we formulate the optimization of FAL in the framework of online gradient descent 3 : at each local step k on the client side, ﬁrstly the adversary generates adversarial samples and computes the loss function L (cid:0) f W c ( t,k ) , S c ( t ) (cid:1) , then the local client learner takes the fresh loss function and update W c ( t, k + 1) =
W c ( t, k ) − η local · ∇ W c L (cid:0) f W c ( t,k ) , S c ( t ) (cid:1) .
Compared with the centralized setting, the key difﬁculties in the convergence analysis of FL are induced by multiple local updates on the client side and the updates on both local and global sides.
Speciﬁcally, local updates are not the standard gradient as the centralized adversarial training when
K ≥ 2 .
We used − ∆ U ( t ) in substitution of the real gradient of U to update the value of U ( t ) .
This brings in challenges to bound the gradient of the neural networks.
Nevertheless, gradient bounding is challenging in adversarial training solely.
To this end, we use gradient coupling method twice to solve this core problem: ﬁrstly we bound the difference between real gradient and FL gradient (deﬁned below), then we bound the difference between pseudo gradient and real gradient.
5. E XISTENCE OF SMALL ROBUST LOSS
In this section, we denote (cid:101) U
=
U (0) as the initialization of global weights U and denote U ( t ) as the global weights of communication round t .
U ∗ is the value of U after small perturbations from (cid:101) U which satisﬁes (cid:107) U ∗ − (cid:101)
U (cid:107) 2 , ∞ ≤ R/m c 1 , here c 1 ∈ (0 , 1) is a constant (e.g. c 1 = 2 / 3 ), m is the width of the neural network and R is a parameter.
We will specify the concrete value of these parameters later in appendix.
We study the over-parameterized neural nets’ well-approximated pseudo-network to learn gradient descent for over-parameterized neural nets whose weights are close to initialization.
Pseudo-network can be seen as a linear approximation of our two layer ReLU neural network near initialization, and the introducing of pseudo-network makes the proof more intuitive.
Deﬁnition 5.1 (Pseudo-network) .
Given weights U ∈ R d × m , a ∈ R m and b ∈ R m , for a neural network f U ( x ) = (cid:80) mr =1 a r · σ ( (cid:104) U r , x (cid:105) + b r ) , we deﬁne the corresponding pseudo-network g U :
R d → R as g U ( x ) := (cid:80)
mr =1 a r · (cid:104) U r ( t ) − U r (0) , x (cid:105) · 1 {(cid:104) U r (0) , x (cid:105)
+ b r ≥ 0 } .
Existence of small robust loss In order to obtain our main result, we ﬁrst show that we can ﬁnd a U ∗ which is close to U (0) and also makes L A ∗ ( f U ∗ ) sufﬁciently small.
Later in Theorem 5.6 we show that the average of L A ( f U ( t ) ) is dominated by L A ∗ ( f U ∗ ) , thus we can prove the minimum of
L A ( f U ( t ) ) is (cid:15) small.
Theorem 5.2 (Existence, informal version of Theorem F.3) .
For all (cid:15) ∈ (0 , 1) , there exists M 0 =
poly( d, ( NJ/(cid:15) ) 1 /γ ) and R = poly(( NJ/(cid:15) )
1 /γ ) such that for every m ≥ M 0 , with high probability there exists U ∗ ∈ R d
× m that satisﬁes (cid:107) U ∗ − U (0) (cid:107) 2 , ∞ ≤ R/m c 1 and L A ∗ ( f U ∗ ) ≤ (cid:15).
5. C ONVERGENCE RESULT FOR FEDERATED LEARNING
For ease of presentation, we ﬁrst describe the notions of local and global gradients in our federated adversarial learning setting.
Deﬁnition 5.3 (Gradient) .
For a local real network f W c ( t,k ) , we denote its gradient by ∇ ( f c , t, k ) :
= ∇ W c L ( f W c ( t,k ) , S c ( t )) .
If the corresponding pseudo-network is g W c ( t,k ) , then denote the pseudonetwork gradient by ∇ ( g c , t, k ) :
= ∇ W c L ( g W c ( t,k ) , S c ( t )) .
Now we consider the global network.
We deﬁne pseudo gradient as ∇ ( g, t ) :
= ∇ U L ( g U ( t ) , S ( t )) and deﬁne FL gradient as (cid:101) ∇ ( f, t ) :
= − 1 N ∆ U ( t ) , which is used in the proof of Theorem 5.6.
We present our gradient coupling methods in the following two lemmas.
Lemma 5.4 (Bounding the difference between real gradient and FL gradient, informal version of
Lemma E.4) .
With probability at least 1 − exp( − Ω( m c 0 )) over the initialization, for iterations t such that (cid:107) U ( t ) − U (0) (cid:107) 2 , ∞ ≤ 1 /o ( m ) , the gradients satisfy (cid:107)∇ ( f, t ) − (cid:101) ∇ ( f, t ) (cid:107) 2 , 1 ≤ o ( m ) .
Lemma 5.5 (Bounding the difference between pseudo gradient and real gradient, informal version of Lemma E.5) .
With probability at least 1 − exp( − Ω( m c 0 )) over the initialization, for iterations t such that (cid:107) U ( t ) − U (0) (cid:107) 2 , ∞ ≤ 1 /o ( m ) , the gradients satisfy (cid:107)∇ ( g, t ) − ∇ ( f, t ) (cid:107) 2 , 1 (cid:46) NJ · o ( m ) .
The above two lemmas are essential in proving Theorem 5.6, which is our convergence result.
Theorem 5.6 (Convergence result, informal version of Theorem E.3) .
For all (cid:15) ∈ (0 , 1) , R ≥ 1 , there exists an M = poly( n, R, 1 /(cid:15) ) , such that for every m ≥ M , for every K ≥ 1 , for every
T ≥ poly( R/(cid:15) ) , with probability at least 1 − exp( − Ω( m c 0 )) over the randomness of a (0) ∈ R m ,
U (0) ∈
R d × m , b (0) ∈
R m , for all U ∗ such that (cid:107) U ∗ − U (0) (cid:107) 2 , ∞ ≤ R/m c 1 , running Algorithmwith setting η global = 1 / poly( NJ, R, 1 /(cid:15) ) and η local = 1 /K will output weights ( U ( t ))
Tt =1 that satisfy
[Equation]
In the proof of Theorem 5.6 we ﬁrst bound the local gradient ∇ r ( f c , t, k ) .
We consider the pseudo-network and bound L ( g U ( t ) , S ( t ))
− L ( g U ∗ , S ( t )) ≤ α ( t ) + β ( t ) + γ ( t ) , where α ( t ) := (cid:104) (cid:101) ∇ ( f, t ) , U ( t ) − U ∗ (cid:105) , β ( t ) =
(cid:107)∇ ( f, t ) − (cid:101) ∇ ( f, t ) (cid:107) 2 , 1 · (cid:107) U ( t ) − U ∗ (cid:107) 2 , ∞ and γ ( t ) :
= (cid:107)∇ ( g, t ) − ∇ ( f, t ) (cid:107) 2 , 1 · (cid:107) U ( t ) − U ∗ (cid:107) 2 , ∞ .
In bounding α ( t ) , we unfold (cid:107) U ( t + 1) − U ∗ (cid:107) 2 F and by rearranging we have
[Equation]
We bound (cid:107) ∆ U ( t )
[Equation]
2 F ≤ η local K · o ( m ) .
By doing summation over t , we have
[Equation]
In bounding β ( t ) , we apply Lemma 5.4 and have
[Equation]
where D U ∗ :
= (cid:107) U ∗ − (cid:101)
U (cid:107) 2 , ∞ ≤ R/m c 1 .
As for the ﬁrst term, we bound
[Equation]
and have β ( t ) (cid:46) η global η local tK · o ( m ) + o ( m ) · D U ∗ , then we do summation and obtain
[Equation]
In bounding γ ( t ) , we apply Lemma 5.5 and have
[Equation]
Then we do summation over t and have
[Equation]
Putting it together with our choice of our all parameters (i
[Equation]
e. η local , η global , R, K, T, m ), we obtain
[Equation]
From Theorem D.2 in appendix
[Equation]
we have: sup x ∈X | f U ( x ) − g U ( x ) |
≤ O ( (cid:15) ) , and thus,
[Equation]
( t )) ≤
O ( (cid:15) ) .
From the deﬁnition of A ∗ we have L ( f U ∗ , S ( t ))
≤ L A ∗ ( f U ∗ ) .
From the deﬁnition of loss we have
L ( f U ( t ) , S ( t ))
=
L A ( f U ( t ) ) .
Moreover, since Eq.
(3) holds for all (cid:15) > 0 , we can replace O ( (cid:15) ) with (cid:15) .
Thus we prove that for ∀ (cid:15) > 0 ,
[Equation]
Combining the results From Theorem 5.2 we obtain U ∗ that is close to U (0) and makes
L A ∗ ( f U ∗ ) close to zero, from Theorem 5.6 we have that the average of L A ( f U ( t ) ) is dominated by L A ∗ ( f U ∗ ) .
By aggregating these two results, we prove that the minimal of L A ( f U ( t ) ) is (cid:15) small and ﬁnish the proof of our main Theorem 4.1.
C ONCLUSION
We have studied the convergence of a general format of adopting adversarial training in FL setting to improve FL training robustness.
We propose the general framework, FAL, which deploys adversarial samples generation-based adversarial training method on the client-side and then aggregate local model using FedAvg (McMahan et al., 2017).
In FAL, each client is trained via min-max optimization with inner loop adversarial generation and outer loop loss minimization.
To the best of our knowledge, we are the ﬁrst to present the comprehensive proof of theoretical convergence guarantee for over-parameterized ReLU network on the presented FAL strategy, using gradient descent.
Unlike the convergence of adversarial training in classical settings, we consider the updates on both local client and global server sides.
Our result indicates that we can control learning rates η local and η global according to the local update steps K and global communication round T to make the minimal loss close to zero.
The technical challenges lie in the multiple local update steps and heterogeneous data, leading to the difﬁculties of convergence.
Under ReLU Lipschitz and over-prameterization assumptions, we use gradient coupling methods twice.
Together, we show the model updates of each global updating bounded in our federated adversarial learning.
Note that we do not require IID assumptions for data distribution.
In sum, the proposed FAL formulation and analysis framework can well handle the multi-local updates and non-IID data in FL.
Moreover, our framework can be generalized to other FL aggregation methods, such as sketching and selective aggregation.
E THICS S TATEMENT
Ensuring the security and robustness of the deployed algorithms is of paramount importance in AI algorithms nowadays.
Recently, machine learning training has revealed its vulnerability to adversarial attacks and tendency to generate wrong predictions.
The tread cannot be underestimated in
FL, where the heterogeneity among clients and requirement for efﬁcient communication brings in challenges in stable gradient updates.
In this regard, our work theoretically shows the feasibility of
FAL.
As a theoretical work, we do not involve any human subjects or datasets.
Our work has the potential positive impact on the machine learning community.
R EPRODUCIBILITY S TATEMENT
We provide the proof details in the appendix to ensure reproducibility
A P ROBABILITY T OOLS
We introduce the probability tools that will be used in our proof.
First we show three lemmas about the tail bounds for random scalar variables in Lemma A.1, A.2 and A.3:
Lemma A.1 (Chernoff bound Chernoff (1952)) .
Let X = (cid:80) ni
=1 X i , where X i = 1 with probability p i and X i = 0 with probability 1 − p
i , and all X i are independent.
Let µ = E
[ X ] = (cid:80) ni
=1 p i .
Then
Pr[ X ≥ (1 + δ ) µ ] ≤ exp( − δ 2 µ/ 3) , ∀ δ > 0 ; 2.
Pr[ X ≤ (1 − δ ) µ ] ≤ exp( − δ 2 µ/ 2) , ∀ 0 < δ < 1 .
Lemma A.2 (Hoeffding bound Hoeffding (1963)) .
Let X 1 , · · · , X n denote n independent bounded variables in [ a i , b i ] .
Let X = (cid:80) ni
=1 X i , then we have
[Equation]
Lemma A.3 (Bernstein inequality Bernstein (1924)) .
Let X 1 , · · · , X n be independent zero-mean random variables.
Suppose that | X i | ≤ M almost surely, for all i .
Then, for all positive t ,
Pr (cid:34) n (cid:88) i =
X i > t (cid:35) ≤ exp (cid:32)
[Equation]
Next, we introduce Lemma A.4 about CDF of Gaussian distributions:
Lemma A.4 (Anti-concentration of Gaussian distribution) .
Let X ∼ N (0 , σ 2 ) , that is, the probability density function of X is given by φ ( x ) =
[Equation] [Equation]
e
[Equation]
2 2 σ 2 .
Then
[Equation]
Finally, we introduce Lemma A.5 as a concentration result on random matrices and Claim A.6 about elementary anti-concentration property of Gaussian distribution.
Lemma A.5 (Matrix Bernstein, Theorem 6.1.1 in Tropp (2015)) .
Consider a ﬁnite sequence { X 1 , · · · , X m } ⊂ R n 1 × n 2 of independent, random matrices with common dimension n 1 × n 2 .
Assume that
E
[Equation] [Equation]
∀ i ∈ [ m ] and (cid:107) X
i (cid:107) ≤ M, ∀ i ∈ [ m ] .
Let Z = (cid:80) mi
=1 X i .
Let Var[ Z ] be the matrix variance statistic of sum:
[Equation]
Then
[Equation]
Furthermore, for all t ≥ 0 ,
[Equation]
We state a standard probabilistic result for Gaussian,
Claim A.6.
Let u ∼ N (0 , I d ) and β ∼ N (0 , 1) , which are independent.
For all x ∈ X and t ≥ 0 ,
Pr[ |(cid:104) u, x (cid:105) + β | ≤ t ] =
O ( t ) .
B P RELIMINARIES B. N OTATIONS
For a vector x , we use (cid:107) x (cid:107) p to denote its (cid:96) p norm, in this paper we mainly consider the situation when p = 1 , 2 , or ∞ .
For a matrix W ∈ R d × m , we use W (cid:62) to denote its transpose and use tr[ W ] to denote its trace.
We use (cid:107) W (cid:107) 1 , (cid:107) W (cid:107) 2 and (cid:107) W (cid:107) F to denote the entry-wise (cid:96) 1 norm, spectral norm and Frobenius norm of W respectively.
For each j ∈ [ m ] , we let W j ∈ R
d be the j -th column of W .
We let (cid:107) W (cid:107) 2 ,denotes (cid:80) mj
=1 (cid:107) W j (cid:107) 2 and (cid:107) W (cid:107) 2 , ∞ denotes max j ∈ [ m ] (cid:107) W j (cid:107) 2 .
For two matrices A, B with the same dimensions, we denote their Euclidean inner product as (cid:104) A, B (cid:105) :
= tr[ A (cid:62) B ] .
We denote Gaussian distribution with mean µ and covariance Σ as N ( µ, Σ) .
We use σ ( · ) to denote the ReLU function σ ( z ) =
max { z, 0 } , and use 1 { E } to denote the indicator function of event E .
B.
T WO LAYER R E LU NEURAL NETWORK AND INITIALIZATION
In this paper, we focus on a two-layer neural network that has m neurons in the hidden layer, where each neuron is a ReLU activation function.
We deﬁne the global network as
[Equation]
and for c ∈ [ N ] , we deﬁne the local network of client c as
[Equation]
Here U =
( U 1 , . . .
, U m ) ∈ R
d × m is the global hidden weight matrix, W c
=
( W c, 1 , . . .
, W c,m ) ∈
R d × m is the local hidden weight matrix of client c , and a = ( a 1 , . .
. , a m ) ∈
R m denotes the output weight vector, b
= ( b 1 , . . .
, b m ) ∈
R m denotes the bias vector.
During the process of federated adversarial learning, for convenience we keep a and b equal to their initialized values and only update U and W , so we can write the global network as f U ( x ) and the local network as f W c ( x ) .
For the situation we don’t care about the weight matrix, we write f ( x ) or f c ( x ) for short.
Next, we make some standard assumptions regarding our training set.
Deﬁnition B.1 (Dataset) .
There are N clients and n = NJ data in total.
4 Let S = ∪ c ∈
[ N ] S c where
S c = { ( x c, 1 , y c, 1 ) , ..., ( x c,J , y c,J ) } ⊆
R d × R denotes the J training data of client c .
Without loss of generality, we assume that for all c ∈ [ N ] , j ∈ [ J ] , (cid:107) x c,j (cid:107) 2 = 1 and the last coordinate of each point equals to 1 / 2 , so we consider X := { x ∈ R d : (cid:107) x (cid:107) 2 = 1 , x d = 1 / 2 } .
For simplicity, we also assume that for all c ∈ [ N ] , j ∈ [ J ] , | y c,j | ≤ 1 .
We now deﬁne the initialization for the neural networks.
Deﬁnition B.2 (Initialization) .
The initialization of a ∈ R m , U ∈ R d × m , b ∈ R m is a (0) ∈
R m , U (0)
∈ R
d × m , b (0) ∈ R m .
The initialization of client c’s local weight matrix W c is
W c (0 , 0) =
U (0) .
Here the second term in W c denotes iteration of local steps
• For each r ∈ [ m ] , a r (0) are i.i
d. sampled from [ − 1 /m 1 / 3 , +1 /m 1 / 3 ] 6 uniformly.
• For each i ∈
[ d ] , r ∈ [ m ] , U i,r (0) and b r (0) are i.i.d.
random Gaussians sampled from N (0 , 1 /m ) .
Here U i,r means the ( i, r ) -entry of U .
Our assumptions on are reasonable since we can experiments.
many previous theoretical
Here the choice of m is not must we need is [ satisﬁes
For each global iteration t ∈ [ T ] ,
• For each c ∈ [ N ] , the initial value of client c’s local weight matrix W c is W c ( t, 0) =
U ( t ) .
B. A DVERSARY AND W ELL - SEPARATED TRAINING SETS
We ﬁrst formulate the adversary as a mapping.
Deﬁnition B.3 ( ρ -Bounded adversary) .
Let F denote the function class.
An adversary is a mapping
A : F × X × R → X which denotes the adversarial perturbation.
For ρ > 0 , we deﬁne the (cid:96) 2 ball as B 2 ( x, ρ ) :
= { (cid:101) x ∈ R
d : (cid:107) (cid:101) x − x (cid:107) 2 ≤ ρ } ∩ X , we say an adversary A is ρ -bounded if it satisﬁes
[Equation]
Moreover, given ρ > 0 , we denote the worst-case adversary as A ∗ := argmax (cid:101) x ∈B 2 ( x,ρ ) (cid:96) ( f ( (cid:101) x ) , y ) , where (cid:96) is loss function deﬁned in Deﬁnition B.5.
In the over-parameterized regime, it is a standard assumption that the training set is well-separated.
Since we deal with adversarial perturbations, we require the following γ -separability, which is a bit stronger.
Deﬁnition B.4 ( γ -separability) .
Let γ ∈ (0 , 1 / 2) , δ ∈ (0 , 1 / 2) , ρ ∈ (0 , 1 / 2) denote three parameters such that γ ≤ δ · ( δ − 2 ρ ) .
We say our training set S =
∪ c ∈
[ N ] S c = ∪ c ∈
[ N ] ,j ∈ [ J ] { ( x c,j , y c,j ) } ⊂ R d × R is globally γ -separable w.r.t a ρ -bounded adversary, if
[Equation]
[Table]
It is worth noting that, our problem setup does not require the assumption on independent and identically distribution (IID) on data, thus such a formation can be applied to unique challenge of the non-IID setting in FL.
B. R OBUST LOSS FUNCTION
We deﬁne the following Lipschitz convex loss function that will be used.
Deﬁnition B.5 (Lipschitz convex loss) .
A loss function (cid:96) : R × R → R is said to be a Lipschitz convex loss , if it satisﬁes the following four properties:
• non-negative; • convex in the ﬁrst input of (cid:96) ; • 1 − Lipshcitz, which means (cid:107) (cid:96) ( x 1 , y 1 ) − (cid:96) ( x 2 , y 2 ) (cid:107) 2 ≤ (cid:107) ( x 1 , y 1 ) − ( x 2 , y 2 ) (cid:107) 2 ; • (cid:96) ( y, y )
=
for all y ∈ R .
The choice of this type of loss is for the sake of technical presentation simplicity, as is customary in prior studies Gao et al.
Allen-Zhu et al.
(2019a).
We assume (cid:96) is a Lipschitz convex loss in this paper.
Next, we deﬁne our robust loss function of a neural network, which is based on the adversarial examples generated by a ρ -bounded adversary A .
Deﬁnition B.6 (Training loss) .
Given a client’s training set S c = { ( x c,j , y c,j ) } Jj =1 ⊂ R d × R of
J examples, the standard training loss of a neural net f c : R d → R is deﬁned as L ( f c , S c ) :
= 1 J (cid:80) Jj =1 (cid:96) ( f c ( x c,j ) , y c,j ) .
Given S =
∪ c ∈
[ N ] S c , the global loss is deﬁned as L ( f U , S ) :
= 1 NJ
[Equation]
Nc =
[Equation]
Jj =1 (cid:96) ( f U ( x c,j ) , y c,j ) .
Given a ρ -bounded adversary A , we deﬁne the global loss with respect to A as
[Equation]
and also deﬁne the worst-case global robust loss as
[Equation]
Moreover, since we deal with pseudo-net which is deﬁned in Deﬁnition D.1, we also deﬁne the loss of a pseudo-net as L ( g c , S c ) :=
[Equation]
( g c ( x c,j ) , y c,j ) and L ( g U , S ) :=
[Equation]
(cid:96) ( g
[Equation] [Equation]
, y c,j ) .
B. F EDERATED A DVERSARIAL L EARNING ALGORITHM
Classical adversarial training algorithm can be found in Zhang et al.
(2020b).
Different from the classical setting, our federated adversarial learning of a local neural network f W c against an adversary A is shown in Algorithm 2, where there are two procedures: one is C LIENT U PDATE running on client side and the other is S ERVER E XECUTION running on server side.
These two procedures are iteratively processed through communication iterations.
Adversarial training is addressed in procedure C LIENT U PDATE .
Hence, there are two loops in C LIENT U PDATE procedure: the outer loop is iteration for local model updating; and the inner loop is iteratively generating adversarial samples by the adversary A .
In the outer loop in S ERVER E XECUTION procedure, the neural network’s parameters are updated to reduce its prediction loss on the new adversarial samples.
These loops constitute an intertwining dynamics.
1: /*Deﬁning notations and parameters*/ 2:
We use c to denote the client’s index 3:
The training set of client c is denoted as S c = { ( x c,j , y c,j ) }
Jj = 4:
Let A be the adversary 5:
We denote local learning rate as η local 6:
We denote global learning rate as η global 7:
We denote local updating iterations as K 8:
We denote global communication round as T 9: 10: /*Initialization*/ 11:
Initialization a (0) ∈
R m , U (0)
∈ R
d × m , b (0) ∈
R m 12:
For t =
→ T , we iteratively run Procedure A then Procedure B 13: 14: /* Procedure running on client side */ 15: procedure A .
C LIENT U PDATE ( t, c ) 16:
S c ( t ) ← ∅ 17:
W c ( t, 0) ← U ( t ) (cid:46)
Receive global model weights update 18: for k =
→ K − 1 do 19: for j = 1 → J do 20: (cid:101) x
( t ) c,j ← A ( f W c ( t,k ) , x c,j , y c,j ) (cid:46) Adversarial examples, f W c is deﬁned as (5) 21:
S c ( t ) ← S c ( t ) ∪ ( (cid:101) x
( t ) c,j , y c,j ) 22: end for 23:
W c ( t, k + 1) ← W c ( t, k ) − η local · ∇ W c L ( f W c ( t,k ) , S c ( t )) 24: end for 25: ∆ U c ( t ) ← W c ( t, K ) − U ( t ) 26:
Send ∆ U c ( t ) to S ERVER E XECUTION 27: end procedure 28: 29: /*Procedure running on server side*/ 30: procedure B .
S ERVER E XECUTION ( t ): 31: for each client c in parallel do 32: ∆ U c ( t ) ← C LIENT U PDATE ( c, t ) (cid:46)
Receive local model weights update 33: ∆ U ( t ) ← 1 N (cid:80) c ∈ [ N ] ∆ U c ( t ) 34:
U ( t + 1) ← U ( t ) + η global · ∆ U ( t ) (cid:46) Aggregation on the server side 35:
Send U ( t + 1) to client c for C LIENT U PDATE ( c, t ) 36: end for 37: end procedure
C P ROOF O VERVIEW
In this section we give an overview of our main result’s proof.
Two theorems to be used are Theorem E.3 and Theorem F.3.
C. P SEUDO - NETWORK
We study the over-parameterized neural nets’ well-approximated pseudo-network to learn gradient descent for over-parameterized neural nets whose weights are close to initialization.
The introducing of pseudo-network makes the proof more intuitive.
To be speciﬁc, we give the deﬁnition of pseudo-network in Section D, and also state Theorem D. which shows the fact that the pseudo-network approximates the real network uniformly well.
It can be seen that the notion of pseudo-network is used for several times in our proof.
C. O NLINE GRADIENT DESCENT IN FEDERATED ADVERSARIAL LEARNING
Our federated adversarial learning algorithm is formulated in the framework of online gradient descent : at each local step k on the client side, ﬁrstly the adversary generates adversarial samples and computes the loss function L (cid:0) f W c ( t,k ) , S c ( t ) (cid:1) , then the local client learner takes the fresh loss function and update W c ( t, k + 1) =
W c ( t, k ) − η local · ∇ W c L (cid:0) f W c ( t,k ) , S c ( t ) (cid:1) .
We refer our readers to Gao et al.
; Hazan (2016) for more details regarding online learning and online gradient descent.
Compared with the centralized setting, the key difﬁculties in the convergence analysis of FL are induced by multiple local updates on the client side and the updates on both local and global sides.
Speciﬁcally, local updates are not the standard gradient as the centralized adversarial training when
K ≥ 2 .
We used − ∆ U ( t ) in substitution of the real gradient of U to update the value of U ( t ) .
This brings in challenges to bound the gradient of the neural networks.
Nevertheless, gradient bounding is challenging in adversarial training solely.
We use gradient coupling method twice to solve this core problem: ﬁrstly we bound the difference between real gradient and FL gradient in Lemma E.4, then we bound the difference between pseudo gradient and real gradient in Lemma E.5.
We show the connection of online gradient descent and federated adversarial learning in the proof of Theorem E.3.
C. E XISTENCE OF ROBUST NETWORK NEAR INITIALIZATION
In Section F we show that there exists a global network f U ∗ whose weight is close to the initial value U (0) and the worst-case global robust loss L A ∗ ( f U ∗ ) is sufﬁciently small.
We show that the required width m is poly( d, ( NJ/(cid:15) ) 1 /γ ) .
Suppose we are given a ρ -bounded adversary.
For a globally γ -separable training set, in order to prove Theorem F.3, we ﬁrst state Lemma F.1 which shows the existence of function f ∗ that has "low complexity" and satisﬁes f ∗ ( (cid:101) x c,j ) ≈ y c,j for all data point ( x c,j , y c,j ) and perturbation inputs (cid:101) x c,j ∈ B 2 ( x c,j , ρ ) .
Then, we state Lemma F.2 which shows the existence of a pseudo-network g U ∗ that approximates f ∗ well.
Finally, by using Theorem D.2 we show that f U ∗ approximates g U ∗ well.
By combining these results, we we ﬁnish the proof of Theorem F.3.
D R EAL APPROXIMATES PSEUDO
To make additional remark to proof sketch in Section 5, in this section, we state a tool that will be used in our proof that is related to our deﬁnition of pseudo-network.
First, we recall the deﬁnition of pseudo-network.
Deﬁnition D.1 (Pseudo-network) .
Given weights U ∈ R d × m , a ∈ R m and b ∈ R m , the global neural network function f
U : R d → R is deﬁned as
[Equation]
Given this f U ( x ) , we deﬁne the corresponding pseudo-network function g U : R d → R as
[Equation]
From the deﬁnition we can know that pseudo-network can be seen as a linear approximation of the two layer ReLU network we study near initialization.
Next, we cite a Theorem from Zhang et al.
(2020b), which gives a uniform bound of the difference between a network and its pseudo-network.
Theorem D.2 (Uniform approximation, Theorem 5.1 in Zhang et al. (2020b)) .
Let R ≥ 1 .
For all m ≥ poly( d ) , with probability at least 1 − exp( − Ω( m 1 / 3 )) over the choice of a (0) , U (0) , b (0) , for all U ∈ R d × m such that (cid:107) U − U (0) (cid:107) 2 , ∞ ≤ R/m 2 / 3 ,
[Equation]
|
[Equation] [Equation]
m
[Equation]
E C ONVERGENCE
Section
Statement
Comment
Statements Used
E.
Deﬁnition E.1 and E.
DeﬁnitionE.
Theorem E.
Convergence result
Lem.
E.4, E.5, Thm.
D.
E.
Lemma E.
Approximates real gradientE.
Lemma E.
Approximates pseudo gradient
Claim E.
E.
Claim E.
Auxiliary bounding
Claim A.
E. D EFINITIONS AND NOTATIONS
In Section E, we follow the notations used in Deﬁnition D.1.
Since we are dealing with pseudonetwork, we ﬁrst introduce some additional deﬁnitions and notations regarding gradient.
Deﬁnition E.1 (Gradient) .
For a local real network f W c ( t,k ) , we denote its gradient by
[Equation]
If the corresponding pseudo-network is g W c ( t,k ) , then we deﬁne the pseudo-network gradient as
[Equation]
Now we consider the global matrix.
For convenience we write ∇ ( f, t ) :
= ∇ U L ( f U ( t ) , S ( t )) and ∇ ( g, t ) :
= ∇ U L ( g U ( t ) , S ( t )) .
We deﬁne the FL gradient as (cid:101) ∇ ( f, t ) :
= − 1 N ∆ U ( t ) .
Deﬁnition E.2 (Distance) .
For U ∗ ∈ R
d
× m such that (cid:107) U ∗ −
[Equation]
U (cid:107) 2 , ∞ ≤ R/m 3 / 4 , we deﬁne the following distance for simplicity:
[Equation]
We have D U ∗
=
O ( R/m 3 / 4 ) and (cid:107) U ( t ) − U ∗ (cid:107) 2 ,
∞ ≤ D max + D U ∗ by using triangle inequality.
Notation
Meaning
Satisfy
U (0) or (cid:101) U
Initialization of U
[Equation]
U ( t )
The value of U after t iterations
[Equation]
U ∗
The value of U after small perturbations from (cid:101) U
[Equation]
E. C ONVERGENCE RESULT
The goal of this section is to prove Theorem E.3.
Theorem E.3 (Convergence result, formal version of Theorem 5.6) .
For all (cid:15) ∈ (0 , 1) , for all
R ≥ 1 , there exists an M = poly( n, R, 1 /(cid:15) ) , such that for every m ≥ M , for every K ≥ 1 , for every T ≥ poly( R/(cid:15) ) , with probability at least 1 − exp( − Ω( m 1 / 3 )) over the randomness of a (0) ∈ R m , U (0)
∈ R
d × m , b (0) ∈ R m , if we run Algorithm 2 with setting η global = 1 / poly( NJ, R, 1 /(cid:15) ) and η local = 1 /K, then for every U ∗ such that (cid:107) U ∗ − U (0) (cid:107) 2 , ∞ ≤ R/m 3 / 4 , the output weights ( U ( t ))
Tt =1 satisfy
[Equation]
Proof.
We set our parameters as follows:
[Equation]
Since the loss function is 1 -Lipschitz
[Equation]
we can ﬁrst bound the norm of real net gradient:
[Equation]
Now we consider the pseudo-net gradient.
The loss L ( g U , S ( t )) is convex in U due to the fact that g is linear with U .
Then we have
[Equation]
where the last step follows from
[Equation]
Note that the FL gradient (cid:101) ∇ ( f, t ) =
− 1 N ∆ U ( t ) is the direction moved by center, in contrast, ∇ ( f, t ) is the true gradient of function f .
We deal with these three terms separately.
As for α ( t ) , we have
[Equation]
and by rearranging we get
[Equation]
Next, we need to upper bound (cid:107) ∆ U ( t ) (cid:107) 2 F ,
[Equation]
N
[Equation]
where the last step follows from Kη local =
[Equation]
Then we do summation over t and have
T (cid:88)
[Equation]
where the last step follows from Eq.
(7) and (cid:107) (cid:101) U −
[Equation]
=
mD
[Equation]
U ∗ .
As for β ( t ) , we apply Lemma E.4 and also triangle inequality and have
[Equation]
By using Eq.
(6) we bound the size of (cid:107) U ( t ) − (cid:101)
U (cid:107)
[Equation]
∞ :
[Equation]
global
[Equation]
N
[Equation]
and have
[Equation]
Then we do summation over t and have
T
[Equation]
(cid:46)
[Equation]
∗ (cid:46) η
[Equation]
TD
[Equation]
∗ .
As for γ ( t ) , we apply Lemma E.5 and have
[Equation]
U (cid:107) 2 ,
[Equation]
+ D U ∗ ) .
Since (cid:107) U ( t ) − (cid:101) U (cid:107) 2 , ∞ ≤ η global η local tKm − 1 / 3 , we have γ ( t ) (cid:46) η global η local tKNJm 5 / 24 + NJm 13 / 24 D U ∗ .
Then we do summation over t and have
T (cid:88)
[Equation] [Equation]
TD
[Equation]
∗ (cid:46) η global T
[Equation]
/ 24 + NJm 13 / 24 TD U ∗ .
Next we put it altogether.
Note that D U ∗
=
O ( Rm 3 / 4 ) , thus we obtain
[Equation]
We then have
[Equation]
≤ O ( (cid:15) ) .
From Theorem D
[Equation]
2 we know sup
[Equation]
) and thus, we get
[Equation]
where c > 0 is a constant.
From the deﬁnition of A ∗ we have L ( f U ∗ , S ( t ))
≤ L A ∗ ( f U ∗ ) .
From the deﬁnition of loss we have L ( f U ( t ) , S ( t ))
=
L A ( f U ( t ) ) .
Moreover, since Eq.
(9) holds for all (cid:15) > 0 , we can replace (cid:15)c with (cid:15) .
Thus we prove that for ∀ (cid:15) > 0 ,
[Equation]
E. A PPROXIMATES REAL GLOBAL GRADIENT
The goal of this section is to prove Lemma E.4.
Lemma E.4 (Bounding the difference between real gradient and FL gradient) .
With probability at least 1 − exp( − Ω( m 1 / 3 )) over the randomness of a (0) ∈ R m , U (0) ∈
R
d × m , b (0) ∈ R m , for all iterations t such that (cid:107) U ( t ) − U (0) (cid:107) 2 , ∞ ≤ O ( m − 15 / 24 ) , the following holds:
[Equation]
Proof.
Notice that ∇ ( f, t ) =
∇ U L ( f U ( t ) , S ( t )) and
[Equation]
∇ ( f c , t, k ) .
So we have
[Equation]
=
[Equation]
N
[Equation]
(cid:107) N
[Equation]
∇
[Equation] [Equation]
t ) − η local
N (cid:88) c
=
K − 1 (cid:88) k
= ∇ r ( f c , t, k ) (cid:107)≤ η local
N m (cid:88) r =
K − 1 (cid:88) k
= (cid:107) N · ∇ r ( f, t )
Kη local −
N (cid:88) c
= ∇ r ( f c , t, k ) (cid:107)=
NK m (cid:88) r =
K − 1 (cid:88) k
= (cid:107) N · ∇ r ( f, t ) −
N (cid:88) c
= ∇ r ( f c , t, k ) (cid:107)where the last step follows from the assumption that η local = 1 K .
As for (cid:107) N · ∇ r ( f, t ) − (cid:80) Nc =1 ∇ r ( f c , t, k ) (cid:107) 2 , we have (cid:107)
[Equation] [Equation]
f
[Equation]
−
[Equation]
f
[Equation] [Equation]
NJ
N (cid:88) c
=
J (cid:88)
j = 1 {
[Equation]
(cid:105)
[Equation]
0 } −
J
[Equation]
Then we do summation and have
[Equation]
Thus we ﬁnish the proof.
E. A PPROXIMATES PSEUDO GLOBAL GRADIENT
The goal of this section is to prove Lemma E.5.
Lemma E.5 (Bounding the difference between pseudo gradient and real gradient) .
With probability at least 1 − exp( − Ω( m 1 / 3 )) over the randomness of a (0) ∈ R m , U (0) ∈
R
d × m , b (0) ∈ R m , for all iterations t such that (cid:107) U ( t ) − U (0) (cid:107) 2 , ∞ ≤ O ( m − 15 / 24 ) , the following holds:
[Equation]
( g, t ) − ∇ ( f, t ) (cid:107) 2 , 1 ≤ O ( NJm 13 / 24 ) .
Proof.
Notice that ∇ ( g, t ) =
∇ U L ( g U ( t ) , S ( t )) and ∇ ( f, t )
= ∇ U L ( f U ( t ) , S ( t )) .
By Claim E.6, with the given probability we have
[Equation]
For indices r ∈ [ m ] such that ∇ r ( g, t ) (cid:54) = ∇ r ( f, t ) , the following holds:
[Equation]
where the ﬁrst step is deﬁnition, the second step follows that the loss function is 1 -Lipschitz, the third step follows from | a r | ≤ 1 m 1 / 3 and (cid:107) x c,j (cid:107) 2 = 1 , the last step follows from the bound of the indicator function.
Thus, we do the conclusion:
[Equation]
t
[Equation]
and ﬁnish the proof.
E. B OUNDING AUXILIARY
Claim E.6 (Bounding auxiliary) .
With probability at least 1 − exp( − Ω( m 1 / 3 )) over the initialization, we have
[Equation]
Proof.
For r ∈ [ m ] , let I r := 1 {∇ r ( g, t ) (cid:54) =
∇ r ( f, t ) } .
By Claim A.6 we know that for each x c,j we have
[Equation]
O
[Equation]
m
[Equation]
By putting a union bound over c and j , we get
Pr
[Equation]
( NJm
[Equation]
Since
Pr[ I r = 1] ≤ Pr[ ∃ c ∈ [ N ] , j ∈
[ J ] , |(cid:104) (cid:102) W c,r , x c,j (cid:105) + b r | ≤ m − 15 / 24 ] , we have
Pr
[Equation]
By applying concentration inequality on I r (independent Bernoulli) for r ∈ [ m ] , we have that with probability at least
[Equation]
−
[Equation]
Ω
[Equation]
NJm 7 / 8 )) > 1 − exp( − Ω( m 1 / 3 )) , the following holds:
[Equation]
Thus we ﬁnish the proof.
E. F URTHER D ISCUSSION
Note that in the proof of Theorem E.3 we set the hidden layer’s width m to be greater than O ( (cid:15) − 12 ) , which seems impractical in reality: if we choose our convergence accuracy to be 10 − 2 , the width will become 10 24 which is impossible to achieve.
However, we want to claim that the " − 12 " term is not intrinsic in our theorem and proof, and we can actually further improve the lower bound of m to O (( R/(cid:15) ) c 2 ) where c 2 is some constant between − 3 and − 4 .
To be speciﬁc, we observe from Eq.
(8) that the " − 12 " term comes from 23 − 34 = − 112 , where 23 appears in Lemma E.4 and 34 appears in the assumption that D U ∗ ≤ R/m 3 /in Deﬁnition E.2.
As for our observations, the 23 term is hard to improve.
On the other hand, we can actually adjust the value of D U ∗ as long as we ensure
[Equation]
for some constant c 3 ∈ (0 , 1) .
When we let c 3 → 1 , the ﬁnal result will achieve
[Equation]
which is much more feasible in reality.
As the ﬁrst work and the ﬁrst step towards understanding the convergence of federated adversarial learning, the priority of our work is not achieving the tightest bounds.
Instead, our main goal is to show the convergence of a general federated adversarial learning framework.
Nevertheless, we will improve the bound in the ﬁnal version.
F E XISTENCE
In this section we prove the existence of U ∗ that is close to U (0) and makes L A ∗ ( f U ∗ ) close to zero.
F. T OOLS FROM PREVIOUS WORK
In order to prove our existence result, we ﬁrst state two lemmas that will be used.
Lemma F.1 (Lemma 6.2 from Zhang et al.
(2020b)) .
Suppose that (cid:107) x c 1 ,j 1 − x c 2 ,j 2 (cid:107) 2 ≥ δ holds for each pair of two different data points x c 1 ,j 1 , x c 2 ,j 2 .
Let D =
γ − 1 ln(48 NJ/(cid:15) ) , then there exists a polynomial q : R → R with degree at most D , size of coefﬁcients at most O ( γ − 1 2 6 D ) , such that for all c 0 ∈ [ N ] , j 0 ∈
[ J ] and (cid:101) x c 0 ,j 0 ∈ B 2 ( x c 0 ,j 0 , ρ ) , (cid:12)(cid:12)(cid:12)(cid:12)(cid:12)(cid:12)
N (cid:88)
[Table]
=
[Table]
J (cid:88)
[Table]
=
[Table]
y
[Table]
,j
[Table]
q ( (cid:104) x c,j , (cid:101) x
[Table] [Table]
0 (cid:105) )
− y
[Table]
0 (cid:12)(cid:12)(cid:12)(cid:12)(cid:12)(cid:12) ≤ (cid:15) 3 .
We let f ∗ ( x ) :
= (cid:80)
Nc =1 (cid:80)
Jj =1 y c,j · q ( (cid:104) x c,j , x (cid:105) ) and have | f ∗ ( (cid:101)
x c 0 ,j 0 ) − y c 0 ,j 0 | ≤ (cid:15)/ 3 .
Lemma F.2 (Lemma 6.5 from Zhang et al.
(2020b)) .
For all (cid:15) ∈ (0 , 1) , there exist M = poly( d, ( NJ/(cid:15) ) 1 /γ ) and R = poly(( NJ/(cid:15) ) 1 /γ )
such that for m ≥ M , with probability at least 1 − exp( − Ω( (cid:112) m/NJ )) over the choice of a (0) ∈
R m , U (0)
∈ R
d × m , b (0) ∈ R m , there exists a
U ∗ ∈ R d × m that satisﬁes (cid:107) U ∗ − U (0) (cid:107) 2 , ∞ ≤ R/m 2 / 3 and sup x ∈X | g U ∗ ( x ) − f ∗ ( x ) | ≤ (cid:15)/ 3 .
F. E XISTENCE RESULT
The goal of this section is to prove Theorem F.3 which is the existence result.
Theorem F.3 (Existence, formal version of Theorem 5.2) .
For all (cid:15) ∈ (0 , 1) , there exist
[Equation]
R
[Equation]
poly
[Equation]
NJ
[Equation]
) such that for every m ≥ M 0 , with probability at least 1 − exp( − Ω( m 1 / 3 )) over the randomness of a (0) ∈ R m , U (0) ∈ R
d × m , b (0) ∈ R m , there exists U ∗ ∈ R d
× m that satisﬁes (cid:107) U ∗ − U (0) (cid:107) 2 , ∞ ≤
R/m 2 / 3 and
L A ∗ ( f U ∗ ) ≤ (cid:15).
Proof.
From Lemma F.1 we obtain the function f ∗ .
From Lemma F.2 we know the existence of
M 0 = poly( d, ( NJ/(cid:15) ) 1 /γ ) and also R = poly(( NJ/(cid:15) ) 1 /γ ) .
By combining these two results with Theorem D.2, we have that for all m ≥ poly( d, ( NJ/(cid:15) ) 1 /γ ) , with probability at least 1 − exp( − Ω( (cid:112) m/NJ ))
− exp( − Ω( m 1 / 3 )) , there exists
a U ∗ ∈ R d
× m that satisﬁes (cid:107) U ∗ − U (0) (cid:107) 2 , ∞ ≤
R/m 2 / 3 and also the following properties:
• ∀ x ∈ X , | g U ∗ ( x ) − f ∗ ( x ) | ≤ (cid:15)/• ∀ x ∈ X ,
| f U ∗ ( x ) − g U ∗ ( x ) | ≤
O
( R 2 /m 1 / 6 )
We consider the loss function.
For all c ∈ [ N ] , j ∈ [ J ] and (cid:101) x c,j ∈ B ( x c,j , ρ ) , we have
[Equation]
Thus, we have that L A ∗ ( f U ∗ ) = 1 NJ (cid:80)
Nc =1 (cid:80)
Jj =1 max (cid:96) (cid:0) f
U ∗ ( x ∗ c,j ) , y c,j (cid:1) ≤ (cid:15) .
Furthermore, since the m we consider satisﬁes m ≥ Ω(( NJ ) 1 /γ ) , the holding probability is at least
[Equation]
Thus, we ﬁnish the proof of this theorem.