S CALABLE
R OBUST
F EDERATED
L EARNING
WITH
P ROVABLE S ECURITY G UARANTEES
Anonymous authors
Paper under double-blind review
A BSTRACT
Federated averaging, the most popular aggregation approach in federated learning, is known to be vulnerable to failures and adversarial updates from clients that wish to disrupt training.
While median aggregation remains one of the most popular alternatives to improve training robustness, relying on secure multi-party computation (MPC) to na¨ıvely compute the median is unscalable.
To this end, we propose a secure and efﬁcient approximate median aggregation with MPC privacy guarantees in the multi-silo setting, e.g., across hospitals, with two semi-honest non-colluding servers.
The proposed method protects the conﬁdentiality of client gradient updates against both semi-honest clients and servers.
Asymptotically, the cost of our approach scales only linearly with the number of clients, whereas the na¨ıve MPC median scales quadratically.
Moreover, we prove that the convergence of the proposed federated learning method is robust to a wide range of failures and attacks.
Empirically, we show that our method displays similar robustness properties as the median while converging faster than the na ¨ ıve MPC median for even a small number of clients.
Introduction
Federated Learning (FL) (McMahan et al., 2017) has emerged as a leading approach for training shared models among clients who do not wish to release their datasets publicly.
While FL avoids releasing client data, revealing client models in the clear creates privacy vulnerabilities, e g., using model inversion attacks (Fredrikson et al., 2015).
To this end, global model aggregation is often implemented using Secure Multi-Party Computation (MPC) to improve privacy (Bonawitz et al., 2016).
MPC (Yao, 1986; Goldreich et al., 1987) is a cryptographic primitive that makes it possible to evaluate a function on encrypted inputs while ensuring that the only information revealed throughout the computation is the ﬁnal output of the function.
Thus, to avoid revealing each client’s local weights, clients encrypt their weights before sending them to the central server.
MPC allows the central server to recover a single aggregate update that it sends back to individual clients.
Specialized
MPC protocols, that allow the server to recover the average of client updates have been widely deployed for Federated Learning.
In addition to privacy, robustness is a major concern in federated learning implementations (Kairouz et al., 2019).
The distributed nature of the computation creates a variety of vulnerabilities to adversarial training attacks and client failures such as hardware, software, data, and communication errors (Xie et al., 2019a; 2021).
One way to improve robustness is to replace an aggregation procedure that computes means with a more robust aggregate such as the median (Yin et al., 2018).
Using the median, up to half of inputs can be from a faulty distribution before the median fails as a robust average estimator.
While median aggregation alone is insufﬁcient to guarantee Byzantine robustness (Xie et al., 2020) – median-based robustness guarantees are sufﬁcient against most published attacks and failures.
Unfortunately, the best known approaches for median aggregation with MPC are slow, requiring computation that grows quadratically with the number of clients (Tueno et al., 2019).
Our work is motivated by applications to multi-silo federated learning (Kairouz et al., 2019), designed for learning across institutions.
For example, an individual hospital may be limited to using only their own patients’ data, and sharing patient information among hospitals is generally difﬁcult due to privacy and intellectual property concerns.
Here, federated learning can provide a mechanism for widely distributed medical institutions to jointly train a model.
The main contribution of this work is a new approximate-median aggregation for robust, privacypreserving federated learning in the multi-silo, two-server setting.
Our approach is the ﬁrst to have all of the following features:
• Robustness against failures.
By relying on (an approximation of) the median of client updates, we achieve robust estimates even in settings where updates sent by up to half the clients are faulty.
In addition, we empirically evaluate robustness against noise distributions that take the form of bit ﬂips, label switching, and Gaussian noise in up to half of the clients.
• Preserving Client Privacy via Secure Computation.
We prove that any subset of clients colluding with each other and with one of the two servers obtains no information about the private inputs of other clients, beyond the aggregated (approximate) median that is returned at each step.
This provides meaningful privacy to every client and is a meaningful defense, e
g., against modelinversion attacks that take advantage of individual client updates.
• Scalability.
The running time of our protocol increases linearly with the number of clients; matching the order-wise scaling (with number of clients) of the standard averaging aggregation.
This is in contrast to a quadratic factor blowup for a federated learning system that implements median na¨ıvely in MPC.
We empirically evaluate the convergence of our system on various datasets, models and under different types of faults.
Related Work
Federated Learning (McMahan et al., 2017) is a widely adopted technique for training models with data from edge devices.
In its plainest form, client updates are sent without encryption to the central server at each round, and the global model is sent back to each client.
However, this basic implementation of a distributed machine learning system is not robust against privacy attacks or failures.
For instance, (Wang et al., 2019; Geiping et al., 2020) show how model inversion attacks can be successful in a federated learning setting.
(Bonawitz et al., 2017; 2016) provide a protocol for secure aggregation of the client updates and computation of the global model in both a semi-honest and malicious setting, with increased runtime and communication overhead.
In addition to encryption of client updates, existing work has also considered robustness to failures and Byzantine client attacks, e.g., (Xie et al., 2019a; 2021) prune faulty client updates by assigning each update a score, and only aggregating the updates that have the top scores.
Other methods of providing byzantine robustness including trimmed mean (Xie et al., 2019b), Krum (He et al., 2020; So et al., 2021), and norm-based elimination (Gupta et al., 2021) have been studied.
In this paper, we strengthen the restriction on client faults and only consider semi-honest clients.
Although a semi-honest setting may seem restrictive by forcing parties to follow the dictated protocol, it applies to settings where parties are assumed to have no ill intentions.
Furthermore, developing semi-honest protocols are a step towards developing protocols in the malicious security model, where more expensive cryptographic primitives such as zero-knowledge proofs are added on top of the existing semi-honest protocol.
Secure Multi-Party Computation (MPC) provides a way for multiple parties to compute a function on their individual data and only reveal the ﬁnal output of the function.
(Bonawitz et al., 2016; 2017) provide a method for federated learning where client updates have a pairwise additive mask, such that when all the encrypted client updates are summed together, the masks cancel out.
In (Tueno et al., 2019), the authors propose a rank computation system where clients send a pairwise masked version of their data point to the central server.
The central server uses pairwise comparisons in MPC to calculate the desired ranked element in the clients’ combined data.
However, pairwise comparisons are expensive in MPC, as additional values for each unique comparison must be generated in advance.
Furthermore, agreeing upon pairwise additive masks grows quadratically with the number of parties.
The generalization of a central server to two non-colluding central servers is not a new idea in privacy-preserving analytics and machine learning.
For instance, (Corrigan-Gibbs & Boneh, 2017) introduce a cryptographic protocol called secret-shared non-interactive proofs, and show that these can be used to construct an efﬁcient privacy preserving system for the release of aggregate statistics with guarantees on security in the malicious setting.
The setting of the paper consists of a small number of servers jointly computing aggregate statistics over private client data.
(Mohassel &
Zhang, 2017) introduce efﬁcient distributed ML protocols that utilize a two server abstraction and
MPC versions of ML computations.
However they do not seek to provide robustness.
To our knowledge, (He et al., 2020) is the ﬁrst work to propose an FL system that combines both robustness and privacy, using private calculation of the distance-based aggregation.
They also make the assumption of the central server being two non-colluding central servers, and utilize client side secret sharing of models and server side two party MPC.
The two central server setting allows their protocol to scale well with number of parties, compared to a single central server setting.
However, their protocol leaks the pairwise distance of client updates to one of the servers, which may be undesirable.
Our proposed approach uses the 2-Party MPC comparison protocols presented in (Rathee et al., 2020).
We also adopt a pairwise comparison based computation of the k -th ranked element proposed in (Tueno et al., 2019) and a bucketing approximate median idea proposed in (Corrigan-Gibbs &
Boneh, 2017), and apply them to the setting of distributed machine learning.
Finally, we note that this work focuses on security and robustness of centralized model training.
Existing work has shown that personalization and mitigating data heterogeneity can be addressed by ﬁne-tuning the robust centralized model (Li et al., 2021).
These details are left for future work.
Preliminaries
Federated Learning.
We denote N as the set of positive integers and R + as the set of non-negative real numbers.
Given n ∈ N , we denote [ n ] = { 1 , . . . , n } .
We use bold lowercase letters, e.g., w ∈ R d , to denote vectors, and w ( k ) to denote its value at the k th dimension.
We consider a twoserver multi-client FL system, let S 0 , S 1 denote the two central severs, and c i for i ∈ [ n ] represent the clients, where n is the total number of clients.
Client c i holds dataset D i .
The agreed upon model has d parameters.
w g denotes the global model sent from servers to clients, while w i denotes the local model held by client i .
All parties agree beforehand to run r cycles of FL.
The loss function for client c
i is ˆ F i : R d → R + .
Usually, because clients have different data, the loss functions ˆ F i are different.
Therefore, the goal of our setting is to minimize the averaged loss across all clients, i.e., arg min
w
n (cid:80) ni
=
ˆ F i ( w ) .
We ﬁrst detail a basic federated learning system with one central server S and n clients.
Clients are generally considered to be edge nodes and do not communicate with each other.
In one iteration, the system follows the following generic protocol:
For i ∈ [ n ] , client c i receives global model w g from central server S . 2.
For i ∈ [ n ] , client c i performs step(s) of Stochastic Gradient Descent of w g on its dataset D i to obtain new local model w i .
They then send this model to S . 3.
Upon receiving all client updates, S aggregates them to obtain the new global model.
The new global model is computed as w (cid:48) g
= 1 n (cid:80) ni
=
w i .
S sends w (cid:48) g to all the clients.
Secure Multi-Party Computation.
Secure Multi-party Computation (MPC)
(Goldreich et al., 1987) is a cryptographic primitive which allows n parties,
each with input value x i , to jointly compute a mutually agreed upon function f ( x 1 , x 2 . . .
x n ) , with the guarantee that no party learns anything other than what can be inferred from its own input and the joint output.
One of the most prominent techniques used in MPC is secret sharing.
A ( t, n ) secret sharing involves splitting a secret s into n shares, then distributing a share to each party, such that any subset of t − 1 parties cannot learn anything about s , while any t or more parties can jointly reconstruct s .
In this paper, we make use of (2 , 2) additive secret sharing over power-of-two sized integer rings, which involves splitting s ∈
Z 2 (cid:96) into s 1 , s 2 ∈ Z 2 (cid:96) s.t.
s
1 + s
=
s , and individually s i , i ∈ { 0 , 1 }
has a uniform random distribution.
We use (cid:104) s (cid:105) to denote secret sharing of s over Z 2 (cid:96) , and (cid:104) s (cid:105) 0 , (cid:104) s (cid:105)to denote the shares of the two parties.
We use F (cid:96) Comp , F (cid:96) Equal to refer to the “greater than” and “equals to” ideal functionalities respectively, i.e. where parties have access to trusted functionalities computing the said functions and use the same to describe our protocols.
To implement the protocols for F (cid:96) Comp , F (cid:96) Equal , we make use of protocols proposed in CrypTFlow2 (Rathee et al., 2020).
CrypTFlow2 provides a customized 2-party protocol for solving the millionaire’s, and hence also the comparison/equality problems in Z 2 (cid:96) (more details on all this in Appendix C).
Problem Description
In this section, we introduce a baseline solution to secure and robust FL.
Median provides wellstudied robustness against outliers compared to mean (Xie et al., 2018).
In order to make our MPC protocols for this efﬁcient, we abstract the central server in FL to two non-colluding central servers.
The servers each receive one of the (2 , 2) secret shares of the client updates, and perform 2-party based secure median computation.
Figure 1 provides a representation of our model.
4.1 Security Threat Model
We model the adversary using the semi-honest/honest-but-curious model, whereby it is assumed that the parties controlled by the adversary will follow the protocol speciﬁcations, but try to learn more information about other parties’ data using the protocol transcript.
We also assume static corruption, i.e., that the adversary chooses the parties to corrupt at the beginning of the protocol and cannot change them once protocol execution starts.
In addition, we assume the two servers S 0 , S 1 do not collude with each other.
The adversary is then allowed to corrupt any arbitrary subset of the clients and at most one of the servers - and once corrupted gets to see their internal state as well as the transcript of their communication.
Furthermore, we are concerned with the multi-silo setting, where clients are assumed to be large institutions and thus client drop out or limitations on computational resources are not considered.
4.2 Baseline solution
We propose a baseline solution for computing the exact median in our two-server multi-client setting.
In order to send their updates to the servers, clients additively secret-share their updates and sends one share to each server.
Once all the clients have done so, the two servers now have a (2 , 2) additive secret share of all the clients’ updates and perform a MPC based median computation.
We take inspiration from the ideas in Tueno et al.
(2019) to design a 2-party secure protocol for median computation by breaking it up into pairwise comparisons between all elements and some number of equality checks.
In Appendix A, we provide a formal description of our algorithm in the
F (cid:96) Comp , F (cid:96) Equal hybrid (described in Algorithm 2), along with a correctness sketch and other details for the same.
Our ﬁnal protocol is then obtained by replacing F (cid:96) Comp , F (cid:96) Equal with CrypTFlow2 (Rathee et al., 2020)
based secure comparison/equality protocols (described in detail in Appendix C).
We refer to this protocol as “pairwise comparison based median” in the rest of the paper.
Complexity.
The complexity of this protocol is at least dn ( n − 1) / 2 calls to F (cid:96)
Comp , in addition to dn calls to F (cid:96) Equal .
Note that the number of secure comparisons/equalities grows quadratically with the number of clients n .
In the next section, we will introduce our approximate median protocol, whose number of secure operations is independent of n .
We provide a brief summary in Appendix C on why we use number of secure comparisons as a metric for complexity.
Bucketing based median computation
In this section, we propose an approximate median, which provides increased computational efﬁciency, to serve as the replacement of the exact median computation.
We provide an abridged version of the protocol in Algorithm 1 and a formal description of the protocol in Algorithm 3.
Summary of the key idea.
Divide the set of possible values that client updates may take into a ﬁxed set of buckets.
Let b designate the number of buckets.
Next, instead of sending actual updates to the server, each client will send a unit vector that has a 1 in the bucket containing the client’s update, and 0 everywhere else.
Upon receiving all client updates, the (two) servers build a frequency distribution of client updates and use this to ﬁnd the bucket which contains the median value.
The median is then approximated by the middle value of the range of this bucket.
All this while, servers only obtain (2 , 2) additive secret shares of client vectors, and rely on MPC to perform the computation outlined above and ﬁnd the median.
We now describe these steps in additional detail.
We “bucketize” clients’ updates by dividing each dimension of the model into b buckets.
This enables the servers to build a secret sharing of the frequency distribution of clients’ updates and ﬁnd the bucket which contains the median value.
The approximate median is then chosen as the middle value in that bucket.
At the beginning of a given round each client c i receives bucket range B and global model w g from the central servers, and follow by running SGD on its dataset D i to obtain local model w i .
The bucket range implicitly ﬁxes the buckets around the global model w g , i.e. in any given dimension k ∈ [ d ] , the b buckets are centered around w g ( k ) with total range of B .
The ending buckets are taken to represent all the remaining range outside B - i.e. the ﬁrst and the last buckets represent the range ( −∞ , w g ( k ) − B 2 ] , [ w g ( k ) + B 2 , + ∞ ) .
The middle b − 2 buckets evenly divide the range w g ( k ) ± B 2 .
c i then creates, ∀ k ∈
[ d ] , a unit vector e i ( k ) ∈ { 0 , 1 } b with 1 in place for the bucket which contains w i ( k ) ; we refer to this transformation as “ bucketizing ”.
c i then sends secret shares of e i to both servers
The servers add all the client updates to get a secret-sharing of the frequency distribution of the clients updates and compute the bucket containing the median value for each dimension.
This is done by performing a secure comparison to compare each bucket’s share of frequency against (cid:100) n 2 (cid:101) .
The comparison result is then revealed to learn which bucket contains the median value and the servers take the middle value of that bucket to be the value of the new global model g (cid:48) w for that dimension.
We refer to this transformation of converting a bucketed model back to a model where each dimension has a numerical value associated with it as “ quantizing ”.
The bucket range is then updated as 2 (cid:107) w (cid:48)
g − w g (cid:107) 1 + p , where p is a parameter agreed by all parties.
Complexity For each dimension, the servers need to only perform b calls to F (cid:96) Comp - hence a total of db calls.
Compared to dn ( n − 1) / 2 calls for pairwise comparison median computation, we note that if b is a constant = 10 , then while pairwise comparison median needs number of secure comparisons that grows quadratically with the number of clients, the number of calls in our method is independent of the number of clients.
Theoretical guarantees
In this section, we theoretically analyze the proposed method in terms of security, robustness, and convergence guarantees.
6.1 Robustness and Convergence
We ﬁrst introduce the notation and settings speciﬁc to the robustness and convergence analysis.
The proofs in this subsection are provided in section D in the appendix.
Given a data distribution D , we assume data samples ξ ∼D are i.i.d.
sampled.
Data individual loss function is denoted as f ( · ; ξ ) :
R d → R + , i.e., f ( w ; ξ ) ≥ 0 given a parameter w ∈ R d .
Based on the individual loss function, we denote the population loss function F = E ξ ∼D
[ f ( · ; ξ )] , and we assume it is differentiable.
Draw N i.i.d.
samples for each of the n clients (in total nN samples): { ξ i,j } i ∈ [ n ] ,j ∈ [ N ] .
Therefore the client empirical loss function is
[Equation]
The goal of our setting is to minimize the averaged loss across all clients, i.e., arg min w 1 n (cid:80) n i =
1 ˆ F i ( w ) .
In the convergence analysis, we consider gradient descent with step size µ .
The range of the buckets at iteration t is denoted as [ − B t / 2 , B t / 2] , and the model parameter are denoted as w t ∈ R d .
As detailed in Algorithm 3, we consider the bucket range updated by
[Equation]
where p 0 , p 1 , η > 0 are constants.
There is a convex parameter set W ⊆ R d such that the parameters during gradient descent for all clients are within W .
Given a function g : R d → R d and p, q ∈ [1 , ∞ ] , we denote the ( p, q ) -norm of g as (cid:107) g (cid:107) p,q = (cid:0)(cid:82) W (cid:107) g ( w ) (cid:107) pq d µ ( w ) (cid:1) 1 /p .
In particular, (cid:107) g (cid:107) ∞ ,q = sup w ∈W (cid:107) g ( w ) (cid:107) q .
The coordinate-wise median operator Med( · ) takes a set of vectors { v i ∈ R d } ni =1 and outputs a vector v ∈ R d such that for each dimension k , v ( k ) is the standard median of { v i ( k ) ∈ R } ni =1 .
The bucket median is calculated as described in Algorithm 3, and we denote it as BucketMed( · ) .
Therefore, in the convergence analysis, we consider the global parameter update be
[Equation]
where B is the bucket range and b is the number of buckets.
We make the following assumptions for the robustness and convergence analysis.
Assumption 1 ( β ∞ -smoothness) .
F is β ∞ -smooth.
Formally, there exists β ≥
such that for ∀ w 1 , w 2 ∈ W we have
[Equation]
Note that (cid:107) · (cid:107) 1 is the dual norm of (cid:107) · (cid:107) ∞ .
Assumption 2 (Weak Law of Large Number) .
We assume ∇ F = E ξ ∼D [ ∇ f ( · ; ξ )] exists and the sample mean converges to ∇ F in probability in (cid:107) · (cid:107) ∞ , ∞ .
Formally, let ξ j ∼ D be i.i.d.
sampled, and denote δ N,(cid:15) :
= Pr (cid:26)(cid:13)(cid:13)(cid:13) ∇ F − 1 N (cid:80) Nj
[Equation]
[Equation]
f ( · ; ξ j ) (cid:13)(cid:13)(cid:13)
[Equation]
We assume
[Equation]
Therefore, by deﬁnition, δ N,(cid:15) 1 ≥ δ N,(cid:15) 2 if (cid:15) 1 ≤ (cid:15) 2 .
Denote (cid:15) N,δ = inf { (cid:15) : δ N,(cid:15) ≤ δ } , and we can see that (cid:15) N,δ 1 ≥ (cid:15) N,δ 2 if δ 1 ≤ δ 2 .
Moreover, we have the following proposition.
Proposition 6.1.
With Assumption 2, we have ∀ δ > 0 :
[Equation]
With the above assumptions, the following result shows that the proposed bucket median is robust to some extent if ratio of adversarial clients is α < 1 / 2 .
We provide similar results for dimension-wise median Med( · ) in Theorem D.1 in the appendix.
Note that the previous analysis on dimension-wise median in the FL setting (Yin et al., 2018) requires α to be smaller than an easily negative value.
We prove the robustness in a new way which holds for any α < 1 / 2 .
Theorem 6.1 (Robustness) .
With Assumption 1 & 2, consider n 1 i.i.d.
samples {∇ ˆ F i } n 1 i
=
(equation 1) and n 2 adversarial vectors { v i ∈ R d } n
i
=1 .
Denote n := n 1 + n 2 and α := n 2 /n being the ratio of adversaries.
Given the bucket range B > 0 , the number of buckets b and the gradient descent step size µ .
If α < 1 / 2 then for ∀ (cid:15) > (cid:15) N, 1 − 2 α 2(1 − α ) with probability at least 1 − ( δ N,(cid:15) ) n 2 (1 − 2 α ) , we have
[Equation]
, for ∀ w ∈ W satisfying µ (cid:107)∇ ˆ F i ( w ) (cid:107) ∞ ≤ B for all i ∈ [ n 1 ] .
With the bucket median being robust, we can prove the convergence guarantee for smooth (possibly non-convex) function.
Note that as N → ∞ , both δ N,(cid:15) → 0 and (cid:15) N,δ → 0 .
Theorem 6.2 (Robust Convergence) .
With Assumption 1 & 2, consider n 1 normal clients with i.i.d.
samples {∇ ˆ F i } n 1 i
=
(equation 1) and n 2 faulty clients that can send arbitrary vectors following the proposed protocol.
Denote n := n 1 + n 2 and α :
= n 2 /n being the ratio of faulty clients.
The bucket range adaption is deﬁned by equation 2, where we assume B t ≤ B for all iteration t for a constant
B > 0 , and p 0 ≥ 1 mβ (cid:107)∇ ˆ F i ( w 0 ) (cid:107) ∞ for ∀ i ∈ [ n 1 ] .
If α < 1 / 2 , for ∀ (cid:15) > (cid:15) N, 1 − 2 α 2(1 − α ) and ∀ (cid:15) (cid:48) > 0 , the proposed method with parameters µ = 1 dβ , p 1 ≥ 2 µ(cid:15) + B 2 b , η ≥ 1 + βµ and b ≥ dBβ 2 (cid:15) (cid:48) can achieve
[Equation]
with probability at least 1 − ( δ N,(cid:15) ) n 2 (1 − 2 α ) .
Thus, with sufﬁcient number of buckets b and number of data N , the proposed method can converge w.r.t.
the true loss function F with high probability, while α < 1 / 2 of clients send incorrect local updates.
6.2 Overview of Security Analysis
We argue the security of our bucketed protocol by means of the standard real/ideal simulation paradigm in cryptography (deﬁned formally in Appendix B).
As stated in section 4.1, we assume a semi-honest adversary statically corrupting up to n − 1 clients and at most one server, and prove the security of one epoch of the FL training using the simulation paradigm.
The security of the entire protocol then follows by applying the sequential composition theorem to the security of each epoch.
We provide a brief overview of the security argument.
The use of secure 2-party computation between the servers allows them to compute the desired approximate median without revealing anything other than the input/output of the functionality.
At the beginning of each round, the clients secret-share their inputs between the two servers and thereafter, the two servers use secure 2-party protocols to compute the shares of a unit vector with 1 for the bucket in which the median value lies.
Revealing this unit vector allows the servers to learn the median bucket index and ﬁnd the median value, which is then sent to clients.
An adversary corrupting one of the servers only sees random shares throughout the protocol (guaranteed by the secure protocol implementing F (cid:96) Comp , F (cid:96) Equal , described in Appendix C) in addition to bucket range (which is computed solely using public values) and median bucket index, which it sees in the clear.
Additionally corrupting any number of clients does not allow an adversary to recover any honest client’s information, since honest client’s data are only secret-shared between the servers and not shared in plain between clients.
We revisit the simulation paradigm and provide the formal security proof in Appendix B.
Experimental Results
In this section, we evaluate our proposed bucketed median scheme on different models and datasets.
First, we compare convergence behaviour over epoch of FL of bucketed median, pairwise comparison median, and mean methods.
We also detail the quadratic versus linear relationship the pairwise comparison and bucketed median methods respectively have with the number of clients.
In the next subsection, we formally describe the failures that faulty clients can exhibit.
We then compare the robustness of median and our bucketed median against mean.
In Appendix F, we detail a breakdown of one FL cycle and analyze sensitivity of parameters.
Experiments were conducted on an
Intel(R) Xeon(R)
Platinum 8280 CPU @
2.70GHz virtual machine with 112 cores.
All parties involved in the FL process were separate processes on this machine,
[Figure] [Figure]
with a bandwidth cap of 377 MBps to simulate a LAN network.
We test on the following combinations of (model, dataset): (MLP, MNIST), (CNNMnist, Mnist), and (CNN, CIFAR-10).
The MLP model has consits of 1 hidden layer with 200 units with ReLu activation for 199 , 210 dimensions. We use the same CNNMnist as McMahan et al. (2017), which has 1,663,370 dimensions. The CNN model we use consists of two 5 × 5 convolution layers, the ﬁrst followed by a 2 × 2 max pooling, and the second followed by three linear layers for a total of 581,866 dimensions.
Model training was done using the CPU.
Training batch size is set to 20 , learning rate is set to 0 .
01 , and client datasets are sampled i.i.d.
from the global dataset.
Number of buckets b = 8 .
7.1 Convergence Results
We ﬁrst test convergence behaviour when all parties are benign.
We show that our bucketed median
FL system exhibits similar training loss convergence as our baseline: a mean based FL system.
For all three methods, we run the same number of iterations of FL and note the average training loss when all clients are benign.
[Figure]
We also show the relationship between number of parties and the time taken for secure median computation in both the bucketing and pairwise median methods.
We test for number of clients n ∈ [2 , 10] for dimension-wise median when d = 1000 .
Figure 3 depicts the constant and quadratic relationships between time and communication costs with number of clients for both bucketing and pairwise methods.
In Appendix F, we provide scalability results with larger number of clients.
[Figure] [Figure]
7.2 Client Failure Types
We assume the updates sent from clients can be corrupted with errors arising from machine noise, network transmission errors, data poisoning etc.
The failures we test with are:
• Bit Flip Failure: The most signiﬁcant bit, or the bit that controls the sign is ﬂipped.
The client sends the negative gradient instead of the true gradient to the servers.
• Label Switching Failure: Clients compute gradients with switched labels on the training data.
For example, label ∈ { 0 , ..., 9 } is replaced by − label
• Gaussian Noise Failure: Instead of sending the correct gradient to the server, clients send an update with values sampled from a Gaussian distribution with mean of zero and standard deviation of 200 .
7.3 Robustness Results
In this subsection, we empirically show that the robustness of our bucketed median FL system behaves similarly to a median based FL system.
We show that for bit-ﬂip, label-ﬂip, and Gaussian noise errors, our system still converges.
We test with three clients, one of which exhibits failures starting from the third epoch.
Figures 4 , 5 , 6 shows results of our bucketed median method versus a median and mean method.
In our implementation, the faulty client performs label ﬂipping during the training process, while bitﬂip and Gaussian noise are manually computed on the local model returned from model training.
The mean method results in loss of convergence for both bitﬂip and
Gaussian noise failures, but performs well against label ﬂip failures.
However, both the median and bucketed median methods show continued training loss decrease against all three failures.
Conclusion
We presented a dual central-server FL system that is robust and private in the semi-honest setting.
We propose a bucketing approximation technique in order to sacriﬁce accuracy for computational efﬁciency, which also leads to better scalability with the number of clients.
The advantage our work provides are both privacy and robustness in distributed ML.
Ethics Statement
Our work focuses on theoretically and empirically studying robust federated learning.
All the datasets and packages we use are open-sourced.
Potential ethical concerns are primarily in the observation that robust federated learning tends to remove outliers, and it can be hard to determine if data from minority groups are outliers or adversarial.
Reproducibility Statement
We have tried our best to provide training details to facilitate reproducing our results.
We provide detailed results on how to train and evaluate our model.
We will open-source our code once accepted.
A Full Description of our algorithms
Here we provide full descriptions of both our median based and approximate bucketed median based
FL algorithms (Algorithm 2, Algorithm 3), along with more details and correctness sketch for the same.
A.1 Median based FL system
This is formally speciﬁed in full in Algorithm 2.
Correctness sketch.
We sketch the idea behind the protocol, which is inspired from similar ideas used in (Tueno et al., 2019).
To compute the median of n values - { x 1 , x 2 . . .
x n } , we ﬁrst compute all pairwise comparison results - b ij =
( x i > x j ) , ∀ i, j ∈ [ n ] , i (cid:54) =
j .
This allows us to compute for each element x
i , its position in the sorted list of { x 1 , x 2 . . .
x n } , by computing pos
i = (cid:80) k ∈ [ n ] ,k (cid:54) =
i b ik .
Finally, we ﬁnd element for which pos i = (cid:100) n/ 2 (cid:101) .
In our actual computation, we only compute b ij , ∀ i, j ∈ [ n ] s.t. j > i .
Then b ji is taken as 1 − b ij .
The correctness of this median depends on all the values being different, which we assume to happen in our protocol (and abort if this is not true).
Float-to-ﬁxed conversion.
Our protocol for exact median involves mapping the client’s local ﬂoating point values to integers, since it is well known that most cryptographic protocols are much more efﬁcient when working over integer rings than directly over ﬂoating point values (Mohassel & Zhang, 2017; Mohassel & Rindal, 2018; Kumar et al., 2020).
Previous work in this area (Mohassel & Zhang, 2017; Mohassel & Rindal, 2018; Kumar et al., 2020), has made use of ﬁxed point representation for the same, where real number r is mapped to integer ρ r = (cid:98) r ∗ 2 s (cid:99) , where s is a parameter called the scaling factor.
Hence, given a real number r , we map it to its ﬁxed point representation ρ r , which is then mapped to an integer ring like Z 2 (cid:96) .
In the following, we use w i Int to denote ﬁxed point version of w i .
F 2 I (cid:96),s and I 2 F (cid:96),s are functions which are used for the mapping real numbers to (ﬁxed-point) integers and vice versa respectively.
In particular, F 2 I (cid:96),s : R → Z 2 (cid:96) , is deﬁned as F 2 I (cid:96),s ( x ) = (cid:98) x ∗ 2 s (cid:99) .
I 2 F (cid:96),s : Z 2 (cid:96) → R is deﬁned as I 2 F (cid:96),s ( x ) =
x/ 2 s (where x ∈ Z 2 (cid:96) is ﬁrst interpreted as a signed integer and then the division is performed).
Since we use (cid:96) = 64 , s = 24 and 32 -bit ﬂoating point values throughout and which have onlybits of precision (and since we are only performing addition over the ﬁxed point values/the values involved at any intermediate stage are small) we don’t suffer any accuracy loss/convergence rate loss due to the usage of ﬁxed point values.
A.2 Bucketed median based FL
In Algorithm 3 we describe in full our algorithm to compute the bucketed median.
w i to get e i ∈
for
k in
• If w i ( k ) ≤ w g ( k ) − B 2 , set e i ( k ) as [1 , 0 , . . .
• If w i ( k ) ≥ w g ( k ) + B 2 , set e i ( k ) as [0 , . . .
• Else, let z = (cid:98) w i ( k ) − ( w g ( k ) − B/ 2) B/ ( b − 2)
i
) as [0 , . . . , 0 , 1 , 0 , . . . , 0] , where e i ( k, z ) is set to 1 . 4.
Create (2 , 2) secret shares of e i by choosing (cid:104) e i
0 at random from Z d ×
and
∀ j ∈ { 0 , 1 } , server S j performs the following:
∀ i ∈ [ n ] , receive share (cid:104)
e i (cid:105) j from client c i .
Set
= (cid:80) i ∈ [ n ]
i (cid:105) j . 3.
For each dimension k in [ d ] , calculate the approximate median: (a) ∀ y ∈ [2 , b ] , set (cid:104) h
( k, y ) (cid:105)
j = (cid:80) z ∈
[ y ] (cid:104) h ( k, z ) (cid:105) j .
(b) Find the bucket that contains the median: i. Compute (cid:104) m ( k ) (cid:105) j , where m ( k ) is of form [0 , . .
. , 0] , by calling F (cid:96) Comp with S 0 ’s input being (cid:104) h
( k ) (cid:105) 0 , [ (cid:100) n 2 (cid:101) ]
d × b and S 1 ’s input being (cid:104) h ( k ) (cid:105) 1 , [0] d × b .
Set (cid:104) m
( k ) (cid:105) j
= [ j ] b − (cid:104) m
( k ) (cid:105) j . ii.
S j shares (cid:104) m (cid:105) j with S 1 − j . iii.
S 0 computes m = (cid:104) m
( k ) (cid:105)
(cid:76) (cid:104) m
( k ) (cid:105) 1 .
iv.
S 0 selects the bucket y that contains the median as min y ∈ [0 ,b − 1])
[ m ( k, y ) ≡ 1] .
(c) S 0 quantizes the approximate median value w (cid:48) g
( k ) as follows:
• If y == 0 , w (cid:48) g ( k )
= w g ( k ) − B•
If y ==
b − 1 , w (cid:48)
g ( k ) =
w g ( k ) + B• Else, w (cid:48) g ( k ) = (cid:16) ( w g ( k ) − B 2 + ( y − 1) ∗ ( Bb − 2 ))
+ ( w g ( k ) − B 2 + y ∗
Bb − 2 ))
(cid:17) / 2 . 4.
S 0 creates new bucket range B (cid:48)
=
2 (cid:107) w (cid:48)
g − w g (cid:107)
+
p 1 ,t , where p 1 ,t is predetermined.
S 0 sends w (cid:48) g , B (cid:48) to client c
i , ∀ i ∈ [ n ] .
To initialize FL, server S 0 performs the following:
Initialize w g as model with parameter values of 0 . 2.
Set B = p 0 .
S 0 sends w g , B to each client c
i , ∀ i ∈ [ n ] .
B Formal security Proof
In this work, we use the semi-honest or honest-but-curious adversarial model, where it is assumed that the adversary follows the protocol speciﬁcations, but tries to glean information about the other party’s inputs using the protocol transcript.
As stated previously, we assume a semi-honest adversary, statically (i.e. before starting the protocol) corrupting up to n − 1 clients and one of the servers, and prove full security of the protocol using the simulation paradigm.
B.1 Deﬁning Secure Multiparty Computation
Here, we provide a formal deﬁnition of secure multiparty computation.
Parts of this section have been borrowed verbatim from (Goldreich, 2004).
A multi-party protocol is cast by specifying a random process that maps pairs of inputs to pairs of outputs (one for each party).
We refer to such a process as a functionality.
The security of a protocol is deﬁned with respect to a functionality f .
In particular, let n denote the number of parties.
A non-reactive n -party functionality f is a (possibly randomized) mapping of n inputs to n outputs.
A multiparty protocol with security parameter λ for computing a non-reactive functionality f is a protocol running in time polynomial in λ and satisfying the following correctness requirement: if parties
P 1 , . .
, P n with inputs ( x 1 , . .
, x n ) respectively all run an honest execution of the protocol, then the joint distribution of the outputs y 1 , . . .
, y n of the parties is statistically close to f ( x 1 , . . .
, x n ) .
A reactive functionality f is a sequence of non-reactive functionalities f
= ( f 1 , . .
f (cid:96) ) computed in a stateful fashion in a series of phases.
Let x ji denote the input of P i in phase j , and let s j denote the state of the computation after phase j .
Computation of f proceeds by setting s 0 equal to the empty string and then computing ( y j 1 , . . .
, y jn , s j ) ← f j
( s j − 1 , x j 1 , . . .
, x jn ) for j ∈ [ (cid:96) ] , where y ji denotes the output of P i at the end of phase j .
A multi-party protocol computing f also runs in (cid:96) phases, at the beginning of which each party holds an input and at the end of which each party obtains an output.
(Note that parties may wait to decide on their phase- j input until the beginning of that phase.)
Parties maintain state throughout the entire execution.
The correctness requirement is that, in an honest execution of the protocol, the joint distribution of all the outputs { y j 1 , . . .
, y jn } (cid:96)j = of all the phases is statistically close to the joint distribution of all the outputs of all the phases in a computation of f on the same inputs used by the parties.
Deﬁning Security.
The security of a protocol (with respect to a functionality f ) is deﬁned by comparing the real-world execution of the protocol with an ideal-world evaluation of f by a trusted party.
More concretely, it is required that for every adversary A , which attacks the real execution of the protocol, there exist an adversary Sim , also referred to as a simulator, which can achieve the same effect in the ideal-world.
Next, we specify what each of these worlds mean.
The real execution In the real execution of the n-party protocol π for computing f is executed in the presence of an adversary A .
The honest parties follow the instructions of π .
The adversary A takes as input the security parameter k , the set I ⊂ [ n ] of corrupted parties, the inputs of the corrupted parties, and an auxiliary input z .
A obtains the local randomness and the state of all corrupted parties, but all corrupted parties do follow the strategy outlined in the protocol speciﬁcation.
The interaction of A with a protocol π deﬁnes a random variable REAL π, A ( z ) ,I ( λ, (cid:126)x ) whose value is determined by the coin tosses of the adversary and the honest players.
This random variable contains the output of the adversary (which may be an arbitrary function of its view, which includes the state of all corrupted parties) as well as the outputs of the uncorrupted parties.
We let REAL π, A ( z ) ,I denote the distribution ensemble { REAL Π , A ( z ) ,I ( λ, (cid:126)x ) } k ∈ N , (cid:104) (cid:126)x,z (cid:105)∈{ 0 , 1 } ∗ .
The ideal execution – security with abort.
In this second variant of the ideal model, fairness and output delivery are no longer guaranteed.
This is the standard relaxation used when a strict majority of honest parties is not assumed.
In this case, an ideal execution for a function f proceeds as follows:
• Send inputs to the trusted party: As before, the parties send their inputs to the trusted party, and we let x (cid:48)
i denote the value sent by P i .
Once again, for a semi-honest adversary we require x (cid:48) i
= x i for all i ∈ I .
• Trusted party sends output to the adversary: The trusted party computes f ( x (cid:48) 1 , . . .
, x (cid:48) n ) =
( y 1 , . . .
, y n ) and sends { y i }
i ∈
I to the adversary.
• Adversary instructs trusted party to abort or continue: This is formalized by having the adversary send either a continue or abort message to the trusted party.
(A semi-honest adversary never aborts.)
In the latter case, the trusted party sends to each uncorrupted party P i its output value y i .
In the former case, the trusted party sends the special symbol ⊥ to each uncorrupted party.
• Outputs: Sim outputs an arbitrary function of its view, and the honest parties output the values obtained from the trusted party.
The interaction of Sim with the trusted party deﬁnes a random variable IDEAL f, A ( z ) ( λ, (cid:126)x ) as above,and we let { IDEAL f, A ( z ) ,I ( λ, (cid:126)x ) } k ∈ N , (cid:104) (cid:126)x,z (cid:105)∈{ 0 , 1 } ∗ .
Having deﬁned the real and the ideal worlds, we now proceed to deﬁne our notion of security, where a semi-honest adversary is deﬁned as an (interactive) Turing Machine whose speciﬁcations match those of the protocol.
Deﬁnition 1.
Let k be the security parameter.
Let f be an n -party randomized functionality, and Π be an n -party protocol for n ∈ N .
We say that Π t -securely computes f in the presence of semihonest adversaries if for every semi-honest adversary
A there exists a semi-honest adversary Sim such that for any
I ⊂ [ n ] with | I | ≤ t the following quantity is negligible:
[Equation]
where (cid:126)x = { x i } i ∈ [ n ] ∈ { 0 , 1 } ∗ and z ∈ { 0 , 1 } ∗ .
B.2 Simulation
Since our model is semi-honest and our protocols use secure 2-party computation, the simulator in our case is straightforward.
Given the inputs of the adversary and the bucket index containing the median value across clients, the simulator sends random shares to the corrupted server on behalf of the honest clients.
Finally, during secure bucketed median computation, it invokes the simulator for the secure protocol implementing F (cid:96) Comp , and to this simulator it provides as input the bucket index of the median value.
C Protocols implementing F (cid:96) Comp , F (cid:96) Equal
For exposition purposes, we described our protocols for median computation by writing them in a “hybrid” model, where parties have access to trusted functionalities F (cid:96) Comp , F (cid:96) Equal , computing secret sharing of comparison and equality of two inputs respectively (described in Figure 7 and Figurerespectively).
In this section, we provide protocols implementing the said functionalities.
Our ﬁnal protocol is then obtained by composing these with our own protocols.
We then provide reasoning on why we choose secure comparisons as the metric for protocol complexity.
[Figure]
Parties - P 0 , P• ∀ b ∈ { 0 , 1 } , P b sends x b , y b ∈
Z 2 (cid:96) to F (cid:96) Comp . • F (cid:96) Comp computes x = x 0 + x 1 ∈ Z 2 (cid:96) , y =
y
+ y 1 ∈
Z 2 (cid:96) and bit z
= ( x > y ) .
• F (cid:96) Comp randomly chooses z 0 ∈ Z 2 (cid:96) and computes z 1 =
z − z 0 ∈
Z 2 (cid:96) and sends z b to P b , ∀ b ∈ { 0 , 1 } .
[Figure]
Parties - P 0 , P• ∀ b ∈ { 0 , 1 } , P b sends x b , y b ∈
Z 2 (cid:96) to F (cid:96) Equal .
• F (cid:96) Equal computes x = x 0 + x 1 ∈ Z 2 (cid:96) , y =
y
+ y 1 ∈
Z 2 (cid:96) and bit z
= ( x = y ) .
• F (cid:96)
Equal randomly chooses z 0 ∈ Z 2 (cid:96) and computes z 1 =
z − z 0 ∈
Z 2 (cid:96) and sends z b to P b , ∀ b ∈ { 0 , 1 } .
Notation Before going further, lets setup some notation.
For a boolean variable z , we use notation 1 { z } to indicate the indicator variable, which is 1 iff z is true.
While (cid:104) x (cid:105) 0 , (cid:104) x (cid:105) 1 denote (2 , 2) additive secret shares of x over Z 2 (cid:96) , we use notation (cid:104) x
(cid:105) B 0 , (cid:104) x
(cid:105) B 1 to denote the (2 , 2) additive secret shares of x over Z 2 .
To implement F (cid:96) Comp , F (cid:96) Equal , we use and modify a bit the protocols proposed in CrypTFlow2 (Rathee et al., 2020).
We describe the protocols for these in the following hybrids:
• F (cid:96)
Mill :
This is described in Figure 9.
It computes the solution to the millionaire’s problem over Z 2 (cid:96) and provides boolean secret shares of the answer bit to the two parties.
• F (cid:96) B2A :
This is described in Figure 10.
It takes in boolean shares of a bit from the two parties and provides shares of the same over Z 2 (cid:96) .
• F (cid:96) Mill,eq : This is described in Figure 11.
It is similar to F (cid:96)
Mill , except instead of doing comparison, it checks equality of the two received values.
Each of the above hybrids can be implemented directly using protocols from CrypTFlow2 (Rathee et al., 2020).
In more detail, while protocols for F (cid:96) Mill , F (cid:96) B2A are described directly in (Rathee et al., 2020), the protocol for F (cid:96) Mill,eq can be obtained directly by a small tweak 1 to the protocol for F (cid:96) Mill .
Since these protocols follow directly from (Rathee et al., 2020), we skip providing detailed descriptions and proofs of them here and refer the reader to CrypTFlow2 (Rathee et al., 2020) for the same.
Given the above three hybrids, we provide the protocols for implementing F (cid:96) Comp , F (cid:96) Equal in Algorithm 4, Algorithm 5 respectively.
We then have the following theorems (where “securely” refers to simulation-based security according to Deﬁnition 1).
Theorem C.1.
Π (cid:96) Comp securely implements F (cid:96) Comp in the F (cid:96) − 1 Mill , F (cid:96) B2A hybrid as long as the signed inputs of the two parties x, y (whose secret-shares they input into the protocol) satisfy
| x | + | y | < 2 (cid:96) − 1 .
Theorem C.2.
Π (cid:96) Equal securely implements F (cid:96) Equal in the F (cid:96)
Mill,eq , F (cid:96) B2A hybrid.
Composing the corresponding implementation of F (cid:96) Mill , F (cid:96) B2A , F (cid:96)
Mill,eq (as described above), gives us secure protocols for F (cid:96) Comp , F (cid:96) Equal .
F
[Equation]
Mill
Parties - P 0 ,
P• P 0 sends x ∈ { 0 , 1 } (cid:96) to F (cid:96)
Mill , while P 1 sends y ∈ { 0 , 1 } (cid:96) to F (cid:96) Mill .
• F (cid:96)
Mill computes z
= ( x < y ) , chooses (cid:104)
z
(cid:105) B 0 ← { 0 , 1 } at random and computes (cid:104)
z (cid:105) B 1 = (cid:104)
z
(cid:105) B 0 ⊕ z .
F (cid:96) Mill sends (cid:104) z (cid:105)
Bb to P b , ∀ b ∈ { 0 , 1 } .
[Equation]
[Figure]
• ∀ b ∈ { 0 , 1 } , P b sends (cid:104) x
(cid:105)
Bb to F (cid:96) B2A .
• F (cid:96)
B2A computes x = (cid:104) x
(cid:105) B 0 ⊕ (cid:104) x
(cid:105) B 1 , chooses (cid:104) x
(cid:105)
← Z 2 (cid:96) at random and computes (cid:104) x (cid:105)
1 ∈ Z 2 (cid:96) as (cid:104) x (cid:105) 1 = x − (cid:104) x (cid:105) 0 .
It sends (cid:104) x (cid:105) b to P b , ∀ b ∈ { 0 , 1 } .
The protocol for F (cid:96) Mill works by breaking up the (cid:96) bits of inputs into a balanced binary tree and computing at each level the answer of both comparison and equality checks of the inputs corresponding to that subtree.
Hence, while not stated directly in the protocol in (Rathee et al., 2020), a protocol for F (cid:96) Mill,eq can be easily obtained from the protocol for F (cid:96) Mill .
In addition, the public implementation of CrypTFlow2 (cry, 2021), contains functions which allow us to compute the same without tweaking anything underlying.
[Figure]
[Figure]
[Figure]
[Figure]
Input : ∀ b ∈ { 0 , 1 } , P b holds (cid:104) x
(cid:105) b , (cid:104) y
(cid:105) b .
Output : ∀ b ∈ { 0 , 1 } , P b holds (cid:104) 1 { x > y }(cid:105) b 1.
∀ b ∈ { 0 , 1 } , P b computes (cid:104) z (cid:105)
b =
(cid:104) x (cid:105) b − (cid:104) y (cid:105) b . invoke P
c) ∀ ∈ 0 , 1 } , P b computes
C.1 Why we use secure comparison as complexity metric MPC is efﬁcient on linear operations when using arithmetic shares. The sum of two arithmetic shares (cid:104) a (cid:105) + (cid:104) b (cid:105) result in share (cid:104) a + b (cid:105) . However, this is not the case for non-linear operations such as (cid:104) a (cid:105) >
(cid:104) b (cid:105) , since the operation performed and the type of secret sharing are not of the same nature.
These type of non-linear operations such as multiplication, comparisons, and equality require increased computations, such as generation of correlated randomness between parties.
There have been many works on improving the efﬁciency of secure comparisons.
(Damg˚ard et al., 2006) provide a secure comparison protocol which uses O ( (cid:96) log (cid:96) )
secure multiplications, where (cid:96)
=
log p and p is the prime used for the ﬁeld the secret shares are computed over.
(Nishide & Ohta, 2007) improved the complexity of secure comparison to O ( (cid:96) ) secure multiplications.
Thus a large portion of the evaluation of a function in MPC is due to the computation of non-linear operations.
Computing median intuitively involves expensive comparison operations, and therefore we choose the number of secure comparisons needed as a metric for computational complexity of the protocols.
D Detailed Robustness and Convergence Analysis
Proposition D.1 (Proposition 6.1 Restated) .
With Assumption 2, we have
[Equation]
Proof.
Given a δ > 0 , for ∀ (cid:15) > 0 , by Assumption 2 there exists N such that ∀ M : M > N we have δ M,(cid:15) <
δ/ 2 .
Therefore, (cid:15) M,δ ≤ (cid:15) M,δ/ 2 = inf { (cid:15) (cid:48) : δ M,(cid:15) (cid:48) ≤ δ/ 2 } ≤ (cid:15) .
Theorem D.1.
With Assumption 1 & 2, consider n 1 i.i.d.
samples {∇ ˆ F i } n 1 i
=
(equation 1) and nadversarial vectors { v i ∈ R d } n
i
=1 .
Denote n := n 1 + n 2 and α := n 2 /n being the ratio of adversaries.
If α < 1 / 2 , then for ∀ (cid:15) > (cid:15) N, 1 − 2 α 2(1 − α ) with probability at least 1 − ( δ N,(cid:15) ) n 2 (1 − 2 α ) , we have
[Equation]
for ∀ w ∈ W .
Note that as N → ∞ , both δ N,(cid:15) → 0 and (cid:15) N,δ → 0 .
Proof.
By deﬁnition of the median operation, we have
[Equation]
Invoking Lemma E.2, we have
[Equation]
where a i = (cid:107) v i − ∇ F ( w ) (cid:107) ∞ ∈ R .
As we can see, (4) depends on the variance of ∇ ˆ F i = 1 N (cid:80) Nj =1 ∇ f ( · ; ξ i,j ) , where ξ i,j ∼ D are i.i.d.
sampled.
Denote
[Equation]
where 1 ( · ) is the indicator function.
By Assumption 2, we can see that
ˆ
X
i is a Bernoulli random variable with
Pr
[Equation]
Therefore, ˆ X (cid:15) :
= (cid:80) n 1 i =1 ˆ X i,(cid:15) forms a binomial distribution.
By the Chernoff bound for binomial distribution, for k ∈ N and k ≤ n 1 (1 − δ N,(cid:15) ) , we have
[Equation]
where D KL is the Kullback–Leibler divergence, i.e., for q 1 , q 2 ∈ (0 , 1)
[Equation]
where the ﬁrst inequality is due to that q 2 < 1 and the last inequality is because that q 1 log q 1 + (1 − q 1 ) log(1 − q 1 ) is the entropy which is non-negative.
Combining the above inequality with equation 5, we have
[Equation]
Denoting event
[Equation]
we can see that if E (cid:15) happens then by Lemma E.1 we have (4) ≤ (cid:15) .
It left to show the probability of event E (cid:15) happens.
Therefore, when n 1 + n 2 2 n 1 ≤ (1 − δ N,(cid:15) ) , we can apply equation 6 to have
[Equation]
The condition of n 1 + n 2 2 n 1 ≤ (1 − δ N,(cid:15) ) is equivalent to δ N,(cid:15) ≤ 1 − 2 α 2(1 − α ) , and it has a sufﬁcient condition of (cid:15) > (cid:15) N,
1 − 2 α 2(1 − α ) .
Theorem D.2 (Theorem 6.1 Restated) .
With Assumption 1 & 2, consider n 1 i.i.d.
samples {∇ ˆ F i } n 1 i
=
(equation 1) and n 2 adversarial vectors { v i ∈ R d } n
i
=1 .
Denote n := n 1 + n 2 and α := n 2 /n being the ratio of adversaries.
Given the bucket range B > 0 , the number of buckets b and the gradient descent step size µ .
If α < 1 / 2 then for ∀ (cid:15) > (cid:15) N, 1 − 2 α 2(1 − α ) with probability at least 1 − ( δ N,(cid:15) ) n 2 (1 − 2 α ) , we have
[Equation]
∀ w ∈ W satisfying µ (cid:107)∇ ˆ F i ( w ) (cid:107) ∞ ≤ B for all i ∈ [ n ] .
Proof.
First, by the deﬁnition of BucketMed( · ) , for any input vector v i ∈ R d to the BucketMed( · ) , there exists a vector v (cid:48)
i ∈ R
d with (cid:107) v (cid:48)
i (cid:107) ∞ ≤ B such that
[Equation]
Denote E (cid:15) as the event deﬁned in equation 7 By equation 8 we can see that
[Equation]
Given the event E (cid:15) , by Theorem D.1 we can see that
[Equation]
for ∀ w ∈ W .
Moreover, for ∀ w ∈ W satisfying µ (cid:107)∇ ˆ F i ( w ) (cid:107) ∞ ≤ B for all i ∈ [ n 1 ] , by Lemma E.
we have
[Equation]
Therefore, combining equation 9 and equation 10 gives the theorem.
Theorem D.3 (Theorem 6.2 Restated) .
With Assumption 1 & 2, consider n 1 normal clients with i.i.d.
samples {∇ ˆ F i } n 1 i
=
(equation 1) and n 2 faulty clients that can send arbitrary vectors following the proposed protocol.
Denote n := n 1 + n 2 and α :
= n 2 /n being the ratio of faulty clients.
The bucket range adaption is deﬁned by equation 2, where we assume B t ≤ B for all iteration t for a constant
B > 0 , and p 0 ≥ 1 mβ (cid:107)∇ ˆ F i ( w 0 ) (cid:107) ∞ for ∀ i ∈ [ n 1 ] .
If α < 1 / 2 , for ∀ (cid:15) > (cid:15) N, 1 − 2 α 2(1 − α ) and ∀ (cid:15) (cid:48) > 0 , the proposed method with parameters µ = 1 dβ , p 1 ≥ 2 µ(cid:15) + B 2 b , η ≥ 1 + βµ and b ≥ dBβ 2 (cid:15) (cid:48) can achieve
[Equation]
with probability at least 1 − ( δ N,(cid:15) ) n 2 (1 − 2 α ) .
Proof.
Denote E (cid:15) :
= { ˆ X (cid:15) >
n 1 + n 2} as the event deﬁned in equation 7, where
[Equation]
By equation 8 we have
[Equation]
Now condition on the event E (cid:15) , and denote the set of clients
[Equation]
and we can see that | I | > n 1 + n 2.
Recall that the training procedure of Algorithm 3 is
[Equation]
b ) , where v i,t − 1 are sent from the faulty clients i at iteration t .
In the following, for notational ease we denote
[Equation]
Moreover recall the bucket range B t at iteration t is updated by
[Equation]
Now, given any i ∈ I , we make the following claim.
Claim 1.
Conditioned on event E (cid:15) , for any iteration step t ≥
we have
[Equation]
Proof of Claim 1.
Note that equation 12 is true for t = 0 by assumption [Equation] and we prove the claim by induction.
Assuming equation 12 holds for iteration t −
[Equation]
we prove equation 12 for iteration t
[Equation]
and prove equation 13 for iteration t − 1 by the way.
We begin by
[Equation]
where the last step is by triangle inequality.
We will show that a 1 , a 2 , a 4 have straight-forward upper bounds, respectively.
For the a 1 , by equation 11 we have [Equation]
By Assumption 1, we have
[Equation]
For a 4 , by deﬁnition of the (cid:96) 1 norm and (cid:96) ∞ norm, we directly have
[Equation]
Note that a 3 is exactly we want to prove for equation 13.
For a 3 , we need to prove a slightly different version of Theorem 6.1, however, using similar techniques.
Recall the deﬁnition of g t −and I ⊆
[ n 1 ] , we have
[Equation]
∞ . Note that we have assumed that (cid:107) µ ∇ ˆ F i ( w t − 1 ) (cid:107) ≤ B t − 1 .
For { µ ∇ ˆ F i ( w ) } i ∈ [ n 1 ] \ I ∪ { v i
[Equation]
[Equation]
2 i =1 , there exists n 1 + n 2 − | I | vectors v (cid:48)
i ∈ R d satisfying (cid:107) v (cid:48)
i (cid:107) ∞ ≤ B t − 1 for i ∈ [ n 1 + n 2 − | I | ] such that
[Equation]
i
[Equation]
[Equation]
[Equation]
i
[Equation]
t
[Equation]
[Equation]
n
[Equation]
Therefore, denoting V := { µ ∇ ˆ F i ( w t − 1 ) } i ∈ I ∪ { v (cid:48) i } n 1 + n 2 −|
I | i
= , by Lemma E.3, we have
[Equation]
Moreover, since | I | > n 1 + n 2and (cid:107)∇ F ( w t − 1 ) − ∇ ˆ F ( w t − 1 ) (cid:107)∞ ≤ (cid:15) for any i ∈ I , by Lemma E.
we have
[Equation]
Combining equation 16 and equation 17 by triangle inequality, we have
[Equation]
Noting that V = { µ ∇ ˆ F i ( w t − 1 ) } i ∈
I ∪ { v (cid:48) i } n 1 + n 2 −|
I
|
i
= , we apply equation 15 to have
[Equation]
[Equation]
[Equation] ∪ { v [Equation] which proves equation 13 for iteration t − 1 , and equivalently a 3 ≤ µ(cid:15) + B 2 b .
Collecting our upper bounds for a 1 , a 2 , a 3 and a 4 , we ﬁnally have
[Equation]
Recall the condition that p 1 ≥ 2 µ(cid:15) + B 2 b and η ≥ 1 + βµ .
We can see that
[Equation]
By induction, it concludes the claim.
Given the Claim 1, we continue the proof of Theorem 6.2.
By the smoothness assumption (Assumption 1), and given that the parameter domain W is deﬁned to be convex, it is known that
[Equation]
Substituting into µ = 1 dβ , we can continue as
[Equation]
By Claim
[Equation]
we have
[Equation]
Therefore
[Equation]
rearranging the inequality
[Equation]
and denote
[Equation]
we have
[Equation]
Accordingly [Equation] for number of iterations T ≥ 1 :
[Equation]
Given any (cid:15) (cid:48) > 0 and choosing b > dBβ 2 (cid:15) (cid:48) , equation 19 implies
[Equation]
E Auxiliary Lemmas
Lemma E.1.
Given a set of real number A
= { x i ∈ R } ni
=1 and an interval [ a, b ] ⊂ R ,
if |A ∩ [ a, b ] | > |A ∩ [ a, b ] c | then we have Med( A ) ∈
[ a, b ] .
Proof.
Without loss of generality, we assume A is sorted, i.e, x i ≤ x i +1 for ∀ i ∈
[ n − 1] .
By the deﬁnition of median, there are at least (cid:100) n 2 (cid:101) numbers in A that are less or equal to Med( A ) .
Therefore, if Med( A ) < a , we can see that there are at least (cid:100) n 2 (cid:101) numbers in A that are outside [ a, b ] , which contradicts to the condition of |A ∩ [ a, b ] |
> |A ∩ [ a, b ] c | .
Hence, Med( A ) ≥ a .
Similarly, we can show Med( A ) ≤ b .
That being said, Med( A ) ∈
[ a, b ] .
Lemma E.2.
Given n vectors { v i ∈ R d } ni =1 , we have
[Equation]
Proof.
Denoting v i ( k ) as the k th dimension of v i ∈ R d , we have
[Equation]
Denote k (cid:63) ∈ arg max k ∈ [ m ] Med( {| v i ( k ) |} ni =1 ) , and we have
[Equation]
Lemma E.3.
Given the bucket range B > 0 , the number of buckets b , for any n vectors { v i } ni =1 in R d , if (cid:107) v i (cid:107) ∞ ≤ B for all i ∈ [ n ] , then we have
[Equation]
Proof.
Since (cid:107) v i (cid:107) ∞ ≤ B for all i ∈ [ n ] are within the bucket range, the BucketMed( { v i } ni =1 ; B, b ) is the same as Med( { v (cid:48)
i } ni =1 ) for some v (cid:48)
i ∈
R d satisfying
[Equation]
Denote
[Equation]
where the ± B 2 b is done on every dimension of v .
We can see that w li ≤ v (cid:48) i ≤ w ri , where the ≤ is also dimension-wise.
Noting that
[Equation]
, we can conclude that
[Equation]
Replacing the Med( { v (cid:48) i } ni =1 ) by BucketMed( { v i } ni =1 ; B, b ) gives the lemma.
F Computation Breakdown and Parameter Sensitivity
In this subsection, we detail a temporal breakdown of a round of federated learning in our approach and the pairwise comparison median.
We show the relationship between server-side computation time and increasing number of clients.
In the bucketing technique, parameters are agreed upon at the start of the FL protocol to initiate values for the bucketing ranges.
We empirically show that these parameters are not sensitive, and that convergence still holds while varying the order of magnitude of these parameter values.
Computation Breakdown for one round of FL
Insecure
Median
Time (s)
Pairwise Comparison Median
Time (s)
Bucketed Median
Time (s) Clients train local model Clients train local model Clients train local model
Clients bucketize model
Clients compute shares
Clients compute shares Server insecurely computes median [Table] In Table 1, we detail the time in seconds each part of the FL process takes for both the pairwise comparison based median method, and our proposed bucketed median method.
The bucketed method had the additional overhead on client and server side of converting to and from a bucketed format, and this takes around 5 seconds per transformation for a CNNMnist model.
The time for both methods are dominated by the two server secure computation of median.
We see that the pairwise comparison based median FL system increases by a factor of 17 . 5 , and the bucketed median FL system increases by a factor of 5 . 5 .
In Figure 12, we show the scalability of our protocol when the number of clients range from 10 toin increments of 30 . We detail the number of clients on the x-axis and the server-side computation time (after receiving all client updates) in milliseconds on the y-axis. The server-side computation consists of the following parts: 1. adding client shares to compute a histogram for each dimension, 2.
performing MPC computation of the bucketed median for each dimension, 3.
converting the chosen median buckets to a global model.
Steps 2.
and 3.
are independent of the number of clients.
We test on the MLP model.
We see that the time for bucketed median computation stays constant, yet the time taken for steps 1-3 roughly increases when number of clients increase due to the time taken for step 1.
In Figure 13, we show the performance of our bucketed protocol with different parameter values.
In our protocol, we determine bucket range as B = { p 0 , (cid:107) w (cid:48)
g − w g (cid:107)
+
p 1 ,t } , where p 0 is chosen during the initial epoch, and (cid:107) w (cid:48)
g − w g (cid:107)
+ p 1 ,t is chosen in subsequent epochs.
In our convergence analysis, we use p 1 and prove convergence for this choice.
In our experiments, we use p t = p 1 t , where t is the current epoch count.
Both choices empirically result in decreasing training loss per epoch, albeit at slightly different rates.
We note that in our implementation, we set both p 0 and p 1 as equivalent values, and use the CNNMnist model.
For parameter values less than 1, we see that our bucketed mechanism results in a similar rate of training loss convergence.
For each model, one can solve for speciﬁc p 0 , p 1 values for the best convergence rate, but as the convergence behaviour does not strictly depend on the parameter values, we do not focus our attention towards this optimization.