CalFAT: Calibrated Federated Adversarial Training with Label Skewness
Abstract
Recent studies have shown that, like traditional machine learning, federated learning (FL) is also vulnerable to adversarial attacks.
To improve the adversarial robustness of FL, federated adversarial training (FAT) methods have been proposed to apply adversarial training locally before global aggregation.
Although these methods demonstrate promising results on independent identically distributed (IID) data, they suffer from training instability on non-IID data with label skewness, resulting in degraded natural accuracy.
This tends to hinder the application of FAT in real-world applications where the label distribution across the clients is often skewed.
In this paper, we study the problem of FAT under label skewness, and reveal one root cause of the training instability and natural accuracy degradation issues: skewed labels lead to non-identical class probabilities and heterogeneous local models.
We then propose a Calibrated FAT (CalFAT) approach to tackle the instability issue by calibrating the logits adaptively to balance the classes.
We show both theoretically and empirically that the optimization of CalFAT leads to homogeneous local models across the clients and better convergence points.
Introduction
Federated learning (FL) is a privacy-aware learning paradigm that allows multiple participants (clients) to collaboratively train a global model without sharing their private data [23, 28, 43, 29].
In FL, each client follows the conventional machine learning procedure to train a local model on its own data and periodically uploads the local model updates to a central server for global aggregation.
However, recent studies have shown that, like conventional machine learning, FL is also vulnerable to well-crafted adversarial examples [20, 47, 9, 45], i e., at inference time, attackers can add small, human-perceptible adversarial perturbations to the test examples to fool the global model with high success rates.
This raises security and reliability concerns on the implementation of FL in real-world scenarios where such a vulnerability could cause heavy losses [38].
For example, for cross-silo
FL in the biomedical domain, a vulnerable global model may cause misdiagnosis, wrong medical treatments, or even the loss of lives.
Similarly, in ﬁnancial-based cross-silo FL, the lack of adversarial robustness may lead to huge ﬁnancial losses.
It is thus imperative to develop a robust FL method that can train adversarially robust global models resistant to different types of adversarial attacks.
In conventional machine learning, adversarial training (AT) has been shown to be one of the most effective defenses against adversarial attacks [22, 40, 4].
Since the local training in FL is the same as conventional machine learning, recent works [47, 9, 45] proposed to perform local AT to improve the adversarial robustness of the global model.
These methods in general are known as
Federated Adversarial Training (FAT).
AT has been found to be more challenging than standard training [3, 44, 42, 41, 4], as it generally requires more training data and larger-capacity models.
Moreover, adversarial robustness may even be at odds with accuracy [30], meaning that the increase of robustness may inevitably decrease the natural accuracy (i.e., accuracy on natural test data).
As a result, the natural accuracy of AT is much lower than standard training [5].
This phenomenon also exists in FL, i.e., FAT exhibits slower convergence and lower natural accuracy than standard FL, as mentioned by recent studies [47, 9].
Arguably, FAT will become more challenging if the data are non-independent and identically distributed (non-IID) across the clients.
One typical non-IID setting that commonly exists in real-world applications is skewed label distribution [17], where different clients have different label distributions.
In this paper, we study the problem of FAT on non-IID data with a particular focus on the challenging skewed label distribution setting (formally deﬁned in Section 3.1).
Under conventional training, Xu et al.
[37] have shown that adversarially trained models introduce severe performance disparity across different classes.
And such a disparity will be exacerbated under label skewness, ending up with much worse performance on the minority classes [33].
       &RPPXQLFDWLRQURXQG   
[Figure]
and FedRBN [9]) under skewed label distribution with β = 0 .
1 (see Section 4).
By far, only a few works have studied non-IID
FAT in the current literature.
Zizzo et al.
[47] propose to perform AT on only part of the local data for better convergence, while standard training is applied to the rest of the local data.
We term this method as MixFAT.
Another relevant work called FedRBN [9] tackles a different problem: how to propagate federated robustness to low-resource clients.
Although MixFAT and
FedRBN have demonstrated promising results, they suffer from training instability and low natural accuracy issues when compared to standard
FL, as we show in Figure 1.
We also compare with the other four FAT baselines adapted from existing AT methods to FL, i.e., FedPGD, FedTRADES, FedMART, and FedGAIRAT.
Unfortunately, these methods also exhibit slow convergence and much degraded ﬁnal accuracy (details can be found in Section 4.1).
This motivates us to propose a novel method called Calibrated Federated
Adversarial Training (CalFAT) for effective FAT on non-IID data with skewed label distribution.
CalFAT tackles the training instability issue by calibrating the logits to give higher scores to the minority classes.
In summary, our main contributions are:
• New insight: We study the problem of FAT on non-IID data with skewed label distribution, and reveal one root cause of the training instability and natural accuracy degradation: skewed labels lead to non-identical class probabilities and heterogeneous local models.
• Novel method: We propose a novel method called CalFAT for FAT with label skewness, and show that the optimization of CalFAT can lead to homogeneous local models, and consequently, stable training, faster convergence, and better ﬁnal performance.
• High effectiveness : Extensive experiments on 4 benchmark vision datasets across various settings prove the effectiveness of our CalFAT and its superiority over existing FAT methods.
Notation and Preliminaries 2.1 Notation
Suppose there are m clients in FL with i denoting the i -th client, e.g., D i denotes the local data of client
i
and θ i denotes the parameters of its local model.
We use ˆ θ to denote the parameters of the global model.
Subscript j is the sample index, e.g., ( x ij , y ij ) denotes the j -th sample of client i and its corresponding label with y ij ∈ { 1 , · · · , C } .
Let f θ ( · ) be the local model f ( · ) (before softmax) with parameter θ .
Superscript l is the class index, e.g., f l ( · ) denotes the logit output for class l .
We denote the adversarial example of clean sample x by (cid:101) x .
[ m ] denotes the integer set { 1 , · · · , m } .
p i ( x, y ) denotes the joint distribution of input x and label y at client i , and accordingly, p i ( y ) is the marginal distribution of label y ,
p i ( y | x ) is the conditional distribution of label y given input x and p i ( x | y ) is the conditional distribution of input x given label y .
2.2 Centralized Adversarial Training
Let D = { x j , y j } nj
=1 be the training dataset with n samples.
The cross-entropy loss (cid:96) ce
( f θ ( x ) , y ) for an input-label pair ( x, y ) is deﬁned as (cid:96) ce
( f θ ( x ) , y ) =
− log σ y ( f θ ( x )) ,
where σ y ( f ) = exp ( f y ) / (cid:80) Cl =1 exp ( f l ) is the softmax function, C is the number of classes, and f l is the model output for class l .
The objective function of the centralized adversarial training (AT) [22] can then be deﬁned as min θ (cid:80) nj =1 (cid:96) ce
( f θ ( (cid:101) x j ) , y j ) /n , where the adversarial example (cid:101) x
j can be generated by
[Equation]
1) where B (cid:15) ( x j ) =
{ x (cid:48) | (cid:107) x (cid:48)
− x j (cid:107) ∞ < (cid:15) } is the closed ball of radius (cid:15) > 0 centered at x j , (cid:107)·(cid:107) ∞ is the
L ∞ norm, and (cid:101) x
j is the most adversarial sample within the (cid:15) -ball.
A standard centralized AT method uses Projected Gradient Decent (PGD) to generate adversarial examples [22].
In particular, PGD iteratively generates an adversarial example (cid:101) x
j as follows:
[Equation]
where k is the step number, K is the total number of steps (i.e., (cid:101)
x j = x ( K ) j ), α > 0 is the step size, x (0)
j is the natural sample, x ( k ) j is the adversarial example generated at step k , Π B (cid:15) ( x (0) j ) is the projection function that projects the adversarial data onto the (cid:15) -ball centered at x (0) j , and sign( · ) is the sign function.
By optimizing the model parameters on adversarial examples generated by PGD, centralized AT is able to train a model that is robust against adversarial attacks.
2.3 Federated Adversarial Training
The concept of federated adversarial training (FAT) was ﬁrst introduced in [47] (i.e., MixFAT) to deal with the adversarial vulnerability of FL.
MixFAT applies AT locally to improve the robustness of the global model.
Suppose there are m clients and each client i has its local data D
i
=
{ x ij , y ij } n i j
= sampled from distribution p i ( x, y ) with n i =
|D
i | being the size of the local data.
In MixFAT, each client i optimizes its local model by minimizing the following objective:
[Equation]
(3) where (cid:101) x ij is the PGD adversarial example of x ij , n (cid:48)
i is a hyperparameter that controls the ratio of data for AT, and θ i are the local model parameters.
After training the local model for certain epochs, client i uploads its local model parameters θ i to the central server for aggregation.
Note that MixFAT only applies AT to a proportion of the local data, mainly for convergence and stability considerations.
Calibrated Federated Adversarial Training (CalFAT) 3.1 Skewed Label Distribution Leads to Non-identical Class Probabilities
In this paper, we focus on one representative non-IID setting: skewed label distribution [19, 10], which is deﬁned as follows.
Deﬁnition 1 (Skewed label distribution) .
The label distribution across the clients is skewed, if for all i (cid:54) =
u and i, u ∈ [ m ] :
(a) there exists y ∈
[ C ] such that p i ( y ) (cid:54) =
p u ( y ) and (b) p i ( x | y )
=
p u ( x | y ) for all x, y .
Condition (b) is to assume that, given a class y , x is sampled with equal probability at different clients.
Note that there exist different types of non-IID: label skew, non-identical class conditional, quantity skew, to name a few (Appendix K in [10]).
The class conditional is often assumed to be identical (i.e., condition (b)) when studying the label skewness problem, which is the main focus of this work.
When condition (b) does not hold, it becomes the non-identical class conditional problem.
Lemma 1 (Non-identical class probabilities) .
If the label distribution across the clients is skewed and the class conditionals have the same support, then the class probabilities { p i ( y | x ) | i ∈
[ m ] } are non-identical, i.e., for all i (cid:54)
=
u and i, u ∈ [ m ] , there exist x , y such that p i ( y | x ) (cid:54) =
p u ( y | x ) .
Lemma 1 implies that skewed label distribution gives rise to non-identical class probabilities { p i ( y | x ) | i ∈
[ m ] } .
The proof of Lemma 1 is given in Appendix A.
3.2 Standard Cross-entropy Leads to Heterogeneity
From a statistical point of view, each client i in previous FAT methods estimates its local class probability p
i ( y | x ) during local training [7].
More speciﬁcally, they assume that p i ( y | x ) can be parameterized by θ ∗ i as:
[Equation]
where θ ∗ i is the ground-truth parameters of the local class probability p
i ( y | x ) .
According to
Lemma 1, the class probabilities { p i ( y | x ) } are non-identical when there is a skewed label distribution.
Therefore, the ground-truth parameters { θ ∗ i | i ∈ [ m ] } are heterogeneous.
We use the sample variance of the ground-truth parameters to measure such heterogeneity as follows:
[Equation]
Each client i updates its local model parameters θ i by optimizing the standard cross-entropy (CE) loss.
The updated θ i is the maximum likelihood estimate [1] of the ground-truth parameter θ ∗ i [7].
Similarly, we use the sample variance [1] of the local model parameters to measure the heterogeneity of the local models:
[Equation]
Larger sample variance implies higher model heterogeneity.
The following proposition suggests that the heterogeneity of local models originates from the heterogeneity of the local class probabilities.
Proposition 1 (Heterogeneous local models) .
Assume the label distribution across the clients is skewed.
Let θ i be the maximum likelihood estimate of θ ∗ i in Eq.
(4) given local data at client i .
Then s 2 converges almost surely to a nonzero constant:
[Equation]
where a.s. −−→ represents the almost sure convergence.
The proof of Proposition 1 is provided in Appendix B. ( s ∗ ) 2 measures the heterogeneity of the ground-truth parameters { θ ∗ i | i ∈ [ m ] } , which reﬂects the class probability difference across the clients as shown in Eq.
Proposition 1 implies that the local models in previous FAT methods are heterogeneous when the label distribution across the clients is skewed.
Since the local models are heterogeneous, aggregating these models tends to hurt the convergence and cause the divergence of the global model [17].
As shown in Figure 1, the training process of existing FAT methods is unstable and has much lower natural accuracy than the standard FL.
3.3 Learning Homogeneous Local Models by Calibration
Motivated by [24], we propose to re-parameterize the class probabilities.
According to Bayes’ formula [12],
[Equation]
Input: Client i , global model parameters ˆ θ , local dataset D i , local epoch number E , and positive constant δ 1: procedure C LIENT U PDATE 2: θ i ← ˆ θ 3:
Compute π i with D i by π yi = n yi /n i + δ, y ∈
[ C ] 4: for local epoch= 1 , · · · , E do 5: for j = 1 , · · · , n i do 6:
Sample ( x ij , y ij ) from D i 7:
Generate adversarial example (cid:101) x ij = arg max x (cid:48) ij ∈B (cid:15) ( x ij ) (cid:96) ckl
( f θ i ( x (cid:48) ij ) , f θ i ( x ij ) , π i ) 8: end for 9: θ i ← θ i − η 1 n i (cid:80) n i j =1 ∇ θ i (cid:96) cce ( f θ i ( (cid:101) x ij ) , y ij , π i ) 10: end for 11: return θ i 12: end procedure
On the right-hand side of the above equation: (1) the class priors can be easily computed by the relative frequencies [1]; and (2) more importantly, the class conditionals { p i ( x | y ) | i ∈ [ m ] } are identical across different clients (see Deﬁnition 1).
Inspired by the above observation, we propose an alternative parameterization of p i
( y | x ) .
Assume that for all i ∈ [ m ] , the class conditional p i ( x | y ) can be parameterized by θ ∗ as p i ( x | y )
=
ˆ q ( x | y ; θ ∗ ) , where ˆ q ( x | y ; θ ∗ ) can be an arbitrary conditional probability function.
Then, p i ( y | x ) can be re-parameterized by θ ∗ as follows:
[Equation]
where
[Equation]
Here π yi approximates the class prior p
i ( y ) , n yi is the sample size of class y on client i and δ > 0 is a small constant added for numerical stability purpose.
During local updates, client i uses its local data to update θ i , which makes θ i the maximum likelihood estimate of θ ∗ .
The entire training procedure of our method is described in Section 3.4.
The following proposition suggests that the local models are homogeneous when trained with the above re-parameterization.
The proof of Proposition 2 is provided in Appendix C.
Proposition 2 (Homogeneous local models) .
Assume the label distribution across the clients is skewed.
Let θ i be the maximum likelihood estimate of θ ∗ in Eq.
(9) given local data at client i .
Then s 2 converges almost surely to zero:
[Equation]
3.4 Details of CalFAT
The local training procedure of our proposed CalFAT is described in Algorithm 1.
Speciﬁcally, we deﬁne ˆ q ( x | y ; θ ∗ ) =
exp ( f yθ ∗ ( x )) .
Then, we maximize the likelihood of ˆ q i ( y | x ; θ ∗ ) for each client i , which is equivalent to minimizing the following objective:
[Equation]
where (cid:96) cce ( · , · , · ) is the calibrated cross-entropy (CCE) loss and (cid:101)
x ij is the adversarial example of x ij .
The CCE loss is deﬁned as:
[Equation]
As discussed in Section 3.3, minimizing the above CCE loss mitigates the heterogeneity of the local models, which can lead to improved convergence and performance of the global model.
[Table]
[Figure]
[Table]
In previous FAT methods, heterogeneous local models tend to give higher scores to the majority classes while lower scores to the minority classes.
By contrast, our CalFAT encourages local models to give higher scores to the minority classes by adding a class-wise prior log π li to the logits.
Also different from MixFAT that trains the local models on both natural and adversarial data, our CalFAT trains the local models only on adversarial examples.
Extensive empirical experiments are conducted in Section 4.1 to show the impact of using only adversarial data for optimization.
Adversarial example generation.
Inspired by [40], we generate the adversarial examples by maximizing the following calibrated Kullback–Leibler (CKL) divergence loss:
[Equation]
where (cid:96) ckl ( · , · , · ) is the CKL loss deﬁned as:
[Equation]
where log π i is the same as in our CCE loss.
Following centralized AT [22], we also use PGD to solve Eq.
After training the local model for certain epochs following the above procedure, each client i uploads the model parameters θ i to the server for aggregation.
To be consistent with the most recent FAT methods [47, 9], we adopt the most widely used FedAvg [23] as the default aggregation framework.
Our method is compatible with other FL frameworks (e.g., FedProx [16] and Scaffold [11]), as we will show in Section 4.1.
Experiments
Data conﬁgurations.
Our experiments are conducted on 4 real-world datasets: CIFAR10 [13],
CIFAR100 [13], SVHN [25], and ImageNet subset [6].
To simulate label skewness, we sample p li ∼ Dir ( β ) and allocate a p li proportion of the data of label l to client i , where Dir ( β ) is the
Dirichlet distribution with a concentration parameter β [39].
By default, we set β = 0 .
1 to simulate a highly skewed label distribution that widely exists in reality.
Baselines.
We compare our proposed CalFAT with two state-of-the-art FAT methods: MixFAT [47] and FedRBN [9].
We also investigate the combination of the state-of-the-art centralized AT methods with FL, i.e., we apply standard PGD [22], TRADES [40], MART [34]), and GAIRAT [44] to FL, and term them as FedPGD, FedTRADES, FedMART, and FedGAIRAT, respectively.
Evaluation metrics.
We report the natural test accuracy (Natural) and robust test accuracy under the most representative attacks, i.e., FGSM [35], BIM [15], PGD-20 [22], CW [2], and AA [5].
We run the experiment for 5 times and report the mean and standard deviation.
More detailed experimental setup is provided in Appendix D.1.
       &RPPXQLFDWLRQURXQG    5 REX V W  DFF X U DF \     )HG3*')HG75$'(6)HG0$570L[)$ )HG*$,5$7)HG5%1&DO)$7RXUV
[Figure]
   &ODVV      1 D W X U D O  DFF X U DF \     &,)$5 )HG*$,5$7&DO)$7RXUV           &ODVV     
5 REX V W  DFF X U DF \     &,)$5 )HG*$,5$7&DO)$7RXUV
4.1 Main Results
Evaluation on different datasets.
Table 1 shows the results of all methods on CIFAR10, CIFAR100, SVHN, and ImageNet subset.
From the table, we can observe that:
(1) Our CalFAT achieves the best robustness on all datasets, validating the efﬁcacy of our CalFAT.
For example, CalFAT outperforms the best baseline method (FedGAIRAT) by 10.20% on SVHN dataset under FGSM attack.
(2) Our CalFAT shows a signiﬁcant improvement in natural accuracy compared to other baselines.
For example, CalFAT
can
improve the natural accuracy
of the
best baseline
method (FedGAIRAT)
by
25.63% on SVHN dataset.
We hypothesise
that the
reason
lies in the homogeneity of local models in
our
CalFAT,
which
leads to better convergence and higher clean accuracy.
(3) All methods demonstrate the worst performance on CIFAR100 and ImageNet subset datasets.
We conjecture that this is because there are more classes in these two datasets, making federated training substantially harder.
Nevertheless, our CalFAT still achieves the best performance.
Learning curves of different methods.
To visually compare our CalFAT with all the baselines, we plot the learning curves (i
[Table]
e., performance across different communication rounds) of all methods in Figure 1 and Figure 2.
As can be observed, CalFAT achieves the best natural accuracy and robust accuracy across almost the entire training process, which indicates that the design of our CalFAT is proﬁtable for different federated learning stages.
[Table]
Moreover, our CalFAT is fairly stable during the whole training process while the accuracy curves of other baselines oscillate strongly.
Such oscillations lead to bad convergence and low performance.
We hypothesize that the heterogeneity of local models in the baseline methods is the main cause of the unstable training.
Combining calibration loss with other
FAT methods.
To further show the effectiveness of our calibration loss, we combine it with four FAT methods (MixFAT, FedPGD, FedTRADES, and FedMART) and name them MixFAT + Calibration, FedPGD + Calibration, FedTRADES + Calibration, and FedMART + Calibration, respectively.
We compare these calibration loss-based FAT methods with their original versions in Table 2.
It is evident that, by introducing our calibration loss into their objectives, all FAT methods can be improved.
These results conﬁrm the importance of class calibration for FAT with label skewness.
[Table]
Comparison with state-of-the-art long-tail learning methods.
We also compare our calibration loss with the losses used by long-tail learning methods LogitAdj [24] and RoBal [36].
In particular, we combine four FAT methods (MixFAT, FedPGD, FedTRADES
[Table]
and FedMART) with the above three losses (LogitAdj loss, RoBal loss
[Table]
and our calibration loss), and train the models following the same default setting.
As shown in Table 2, both LogitAdj-based methods and RoBal-based methods have lower natural and robust accuracies than calibration loss-based methods.
This indicates that our calibration loss is more suitable for FAT than other long-tail learning losses.
4.2 Performance on Different Classes
We further compare the per-class performance of our CalFAT with the best baseline FedGAIRAT.
First, we use a well-trained model to initialize a global model.
Second, the global model distributes the model parameter to all clients.
Third, the local clients train their local models with their local data for 1 epoch.
Then, we report the per-class average performance of all clients for each class.
For fair comparison, we use the same well-trained model for initialization and the same data partition on each client for CalFAT and FedGAIRAT.
In Figure 3, we report the per-class natural and robust accuracies of CalFAT and FedGAIRAT on
CIFAR10.
As shown in these ﬁgures, the average performance of most classes of CalFAT is much higher than FedGAIRAT.
We also report the per-class performance of each client on CIFAR10 in
Appendix D.2.
In FedGAIRAT, due to the highly skewed label distribution, the prediction of each client is highly biased to the majority classes, which leads to high performance on the majority classes and low performance (even 0% accuracy) on the minority classes.
By contrast, in CalFAT, each client has higher performance on most classes.
This veriﬁes that the calibrated cross-entropy loss can indeed improve the performance on the minority classes, and further improve the overall performance of the model.
Moreover, we report the per-class average performance on SVHN in Appendix D.3.
Our CalFAT also outperforms the best baseline across most of the classes on SVHN.
4.3 Results on Different FL Frameworks and Network Architectures
Evaluation on different FL frameworks.
Besides FedAvg [23], we also conduct experiments on other FL frameworks, i.e., FedProx [16] and Scaffold [11].
The results for all methods on FedProx and Scaffold are given in Table 3.
It shows that our CalFAT exhibits better natural and robust accuracies than all baseline methods on all FL frameworks, which indicates the high comparability of our CalFAT with different aggregation algorithms.
Evaluation on different network architectures.
We also compare CalFAT with baselines on different network architectures, i.e., CNN [23], VGG-8 [27], and ResNet-18 [8].
For CNN, we use the same architecture as [23].
VGG-8 and ResNet-18 are two widely used architectures in deep learning.
The results on CIFAR10 dataset are shown in Appendix D.4.
CalFAT outperforms all baselines, which further validates the superiority of CalFAT with different network architectures.
4.4 Feature Visualization
To better understand the efﬁcacy of CalFAT, we visualize the learned features extracted from the second last layer of FedTRADES (the best baseline) and CalFAT trained on SVHN dataset in
Appendix D.5.
The features are projected into a 2-dimensional space via t-SNE [31].
It shows that samples from different classes are mixed together in FedTRADES, indicating its low performance.
For instance, Class 6 (pink) and Class 8 (khaki) are hard to separate in FedTRADES while theseclasses can be well separated by CalFAT.
This illustration veriﬁes that the server cannot learn a global model with good inter-class separability if the local models are heterogeneous.
By contrast, CalFAT can well separate different classes thus can achieve better overall performance.
4.5 Results under IID settings
Besides the non-IID setting, we also conduct an experiment under the IID setting.
The results are shown in Appendix D.6 where it shows that our CalFAT achieves the best robustness (under PGDattack).
Compared to the non-IID setting, all FAT methods demonstrate much better performance under the IID setting.
This indicates that existing FAT methods can easily handle IID data yet face substantial challenges when the data is non-IID.
4.6 Ablation Studies
Impact of the number of clients.
To show the generality of CalFAT, we train CalFAT with different numbers of clients m .
Table 7 in Appendix D.7 reports the results for m = { 20 , 50 , 100 } .
As expected, CalFAT achieves the best performance across all m .
As m increases, the performance of all methods decreases.
We conjecture that this is because more clients in FAT makes the training harder to converge.
However, our CalFAT can still achieve 41.23% natural accuracy when there are 100 clients, outperforming other baselines by a large margin.
Impact of skewed label distribution.
We observe that the performance of FAT defense is closely related to label skewness.
We thus investigate the impact of skewed label distribution by varying the
Dirichlet parameter β
= { 0 . 05 , 0 . 2 , 0 . 3 } and report the results on CIFAR10 in Table 8 in Appendix
D.8.
Not surprisingly, our CalFAT outperforms all baselines under all β ’s. This further veriﬁes the consistent effectiveness of CalFAT under different levels of label skewness.
Note that as β decreases (i.e., the labels on each client are more imbalanced), the performance of all methods drop rapidly.
For example, the natural accuracy of FedMART drops from 38.38% to 29.84% as β decreases from 0.2 to 0.05.
This indicates that all methods are hard to train a good model in extremely skewed label distribution scenarios.
However, our CalFAT still achieves 61.00% natural accuracy and 32.40% robust accuracy (against FGSM attack) when β = 0 .
05 , which are much higher than all the baselines.
Contribution of the calibrated loss functions.
As shown in Eq.
(13) and Eq.
(15), for each client i , we have two new loss functions: a CCE loss (cid:96) cce ( · , · , · ) for optimization and a CKL loss (cid:96) ckl ( · , · , · ) for generating the adversarial examples.
This naturally raises a question: how do these two loss functions contribute to CalFAT?
To answer this question, we conduct leave-one-out tests by removing the
CCE loss (w/o (cid:96) cce ( · , · , · ) ) or removing the CKL loss (w/o (cid:96) ckl ( · , · , · ) ) from the overall optimization objective.
As illustrated in Appendix D.9, w/o (cid:96) cce ( · , · , · ) leads to poor performance, which implies that CCE loss plays an important role in CalFAT.
Besides, if we only use the CCE loss (i.e., w/o (cid:96) ckl ( · , · , · ) ), we can obtain a much better performance, but it still underperforms CalFAT.
All these results indicate that the CCE loss is the most important part of CalFAT, whilst the CKL loss can further increase the performance of CalFAT.
The combination of both loss functions leads to the best performance.
Impact of the ratio of adversarial data.
Here, we conduct experiments with different ratios of adversarial data used in CalFAT and report the robust accuracy (against PGD-20 attack) in Appendix
D.10.
Ratios r =0 and r =1 stand for training the model on only natural data and only adversarial data, respectively.
Overall, r =1 produces the best robustness, meaning that training on only adversarial data can better enhance the adversarial robustness of our CalFAT.
Conclusion
In this paper, we studied the challenging problem of Federated Adversarial Training (FAT) with label skewness and proposed a novel Calibrated Federated Adversarial Training (CalFAT) to simultaneously achieve stable training, better convergence, and natural accuracy and robustness in FL. CalFAT calibrates the model prediction and trains homogeneous local models across different clients by automatically assigning higher scores to the minority classes.
Extensive experiments on multiple datasets under various settings validate the effectiveness of CalFAT.
Our work can serve as a simple but strong baseline for accurate and robust FAT.
For future work, we will continue to improve FAT under other non-IID settings such as feature skewness and quantity skewness [10, 46]
Acknowledgement
This work is funded by Sony AI.
This work is also supported by the National Key R&D Program of
China (Grant No. 2021ZD0112804) and the National Natural Science Foundation of China (Grant
No. 62276067)
Checklist
For all authors... (a) Do the main claims made in the abstract and introduction accurately reﬂect the paper’s contributions and scope?
[Yes] (b) Did you describe the limitations of your work?
[Yes]
(c) Did you discuss any potential negative societal impacts of your work?
[No] (d) Have you read the ethics review guidelines and ensured that your paper conforms to them?
[Yes] 2.
If you are including theoretical results... (a) Did you state the full set of assumptions of all theoretical results?
[Yes] (b) Did you include complete proofs of all theoretical results?
[Yes] 3.
If you ran experiments... (a) Did you include the code, data, and instructions needed to reproduce the main experimental results (either in the supplemental material or as a URL)?
[No] (b) Did you specify all the training details (e.g., data splits, hyperparameters, how they were chosen)?
[Yes] (c) Did you report error bars (e.g., with respect to the random seed after running experiments multiple times)?
[Yes] (d) Did you include the total amount of compute and the type of resources used (e.g., type of GPUs, internal cluster, or cloud provider)?
[Yes] 4.
If you are using existing assets (e.g., code, data, models) or curating/releasing new assets... (a) If your work uses existing assets, did you cite the creators?
[Yes] (b) Did you mention the license of the assets?
[N/A] (c) Did you include any new assets either in the supplemental material or as a URL?
[No] (d) Did you discuss whether
and how consent was obtained from people whose data you’re using/curating?
[N/A] (e) Did you discuss whether the data you are using/curating contains personally identiﬁable information or offensive content?
[N/A] 5.
If you used crowdsourcing or conducted research with human subjects... (a) Did you include the full text of instructions given to participants and screenshots, if applicable?
[N/A] (b) Did you describe any potential participant risks, with links to Institutional Review Board (IRB) approvals, if applicable?
[N/A] (c) Did you include the estimated hourly wage paid to
participants and the total amount spent on participant compensation?
[N/A]