Byzantine-tolerant federated Gaussian process regression for streaming data
Anonymous Author(s)
AffiliationAddress email
Abstract
In this paper, we consider Byzantine-tolerant federated learning for streamingdata using Gaussian process regression (GPR).
In particular, a cloud and a groupof agents aim to collaboratively learn a latent function where some agents aresubject to Byzantine attacks.
We develop a Byzantine-tolerant federated GPRalgorithm, which includes three modules: agent-based local GPR, cloud-basedaggregated GPR and agent-based fused GPR.
Specifically, the agent-based local
GPR sends potentially compromised local predictions to the cloud, and the cloudbased aggregated GPR computes a global model by a Byzantine-tolerant Productof-Experts aggregation rule.
Then the cloud broadcasts the global model to allthe agents.
Agent-based fused GPR refines the predictions by fusing the modelfrom the cloud-based GPR with that from the agent-based local GPR.
We derivethe upper bounds on prediction error between the mean from the cloud-basedaggregated GPR and the target function provided that Byzantine agents are lessthan one quarter of all the agents.
We also characterize the lower and upper boundsof the predictive variance.
Experiments on a synthetic dataset and two real-worlddatasets are conducted to evaluate the proposed algorithm.
The Internet of Things (IoT) produces large volumes of spatially distributed data.
A typical practiceis to store data in a centralized entity, e.g., a cloud, and train machine learning models there.
However,it poses challenges in communication overhead and computation efficiency.
In addition, data storageon the centralized entity raises privacy concerns.
Federated learning provides a promising paradigmto address the two challenges [1], [2], [3], [4].
First, only a finite number of model parameters areshared and the size of these parameters is much smaller than that of raw data; second, data samplesare kept by agents and local models are trained without sharing raw data.
However, these agentsare vulnerable to Byzantine attacks, which force them to behave arbitrarily and send any messageto the cloud.
The cloud cannot access each agent’s local private data and training process, and thencannot verify the correctness of each agent’s updates.
Byzantine attacks incur degradation of learningperformance.
Related work.
There have been many recent works to secure federated learning against Byzantineattacks [5], [6], [7], [8], [9].
Paper [5] proposes Krum as the aggregation rule where the cloud selectsa gradient such that the overall distance between this gradient to a fixed number of its closest gradientsis minimal.
Paper [6] develops an algorithm which is based on integrated stochastic quantization,geometric median based outlier detection and secure model aggregation.
Paper [7] analyzes two robustdistributed gradient descent algorithms based on median and trimmed mean operations, respectively.
Paper [8] proposes a high-dimensional robust mean estimation algorithm at the cloud to combat theadversary.
In paper [9], the cloud partitions all the received local gradients into batches and computesthe mean of each batch.
After that, the cloud computes the geometric median of the batch means.
The above set of papers can guarantee that the estimate of the parameter aggregated by the cloud willconverge to a neighborhood of the minimizer of the loss function regardless of Byzantine attacks.
However, the existing works only consider deep neural networks (DNN) as the learning model andare limited to static data and off-line learning.
On-line learning is demanded to process data that arrives sequentially across time [10], [11], [12].
Gaussian process regression (GPR) is a solution candidate to solve the problem [13], [14], [15],[16].
First of all, GPR is a non-parametric statistical learning model.
With proper choice of priorcovariance function and mild assumptions of the target function, GPR is able to approximate anycontinuous function [17].
Second, GPR can be implemented recursively, reducing computationalcomplexity and memory [18].
Third, GPR is able to quantify learning uncertainties since it predictsthe target function using a posterior probability distribution [19].
However, Byzantine-tolerant GPRhas not been studied yet.
Contributions.
This paper considers Byzantine-tolerant federated learning for streaming data using
GPR where a cloud and a group of agents aim to collaboratively learn a latent function despite someagents are subject to Byzantine attacks.
Major contributions are listed as follows:
1) We develop a Byzantine-tolerant federated GPR algorithm, which includes three modules:agent-based local GPR, cloud-based aggregated GPR and agent-based fused GPR.
Specifically, the agent-based local GPR sends potentially compromised local predictions to the
cloud, and the cloud-based aggregated GPR computes a global model by a Byzantinetolerant PoE aggregation rule.
Then the cloud broadcasts the current global model to allthe agents.
Agent-based fused GPR returns the predictions by fusing the models from thecloud-based GPR with those from the agent-based local GPR.
The predictive mean of the cloud-based aggregated GPR is theoretically guaranteed to be
restricted within a neighborhood of the target function provided that Byzantine agents are less than one quarter of all the agents.
The prediction error is positively proportional to the number of Byzantine agents and that of the agents with extreme values.
Predictionuncertainty is quantified by lower and upper bounds, which are identical to that of the
attack-free case.
Experiments on a synthetic dataset and two real-world datasets are conducted to demonstrate that
the
Byzantine-tolerant GPR algorithm is resilient to Byzantine attacks.
To the best knowledge of authors,this is the first paper to study Byzantine-tolerant federated learning over streaming data using GPR.
Notations and notions.
Throughout the paper, we use lower-case letters, e.g, a , to denote scalars, boldletters, e.g., a , to denote vectors; we use upper-case letters, e.g., A , to denote matrices, calligraphicletters, e.g., A , to denote sets, and bold calligraphic letters, e.g., A , to denote spaces.
Denote
I n ∈ R n × n the n -by- n identity matrix.
We denote by R the set of real numbers.
The set of nonnegative real numbers is denoted by R + , and the set of positive real numbers is denoted by R ++ .
Thecardinality of set A is denoted by |A| .
Define the distance metric D ( z , z ′ ) ≜
∥ z − z ′ ∥ , and the point toset distance as D ( z , Z ) ≜ inf z ′ ∈Z D ( z , z ′ ) .
Define proj ( z , Z ) ≜ {
z ′ ∈ Z | D ( z , z ′ )
=
D ( z , Z ) }the projection set of point z onto set Z .
Denote the supremum of a function η : Z → R as∥ η ∥ ∞ ≜ sup z ∈ Z | η ( z ) | .
For a real number a , we denote the floor function by ⌊ a ⌋ .
We denote by
O ( g ( t ))
the limiting behavior of some function f ( t ) if lim t →∞ f ( t ) g ( t ) =
a for some constant a > 0 .
We give formal definitions of sub-Gaussian random variables and Gaussian process.
Definition 1 [20] A random variable X with mean µ ≜ E [ X ] is sub-Gaussian (denoted by X ∼subG ( σ 2 ) ) if there exists a positive number σ such that
[Equation]
Definition 2 [13] A Gaussian process is a collection of random variables, any finite number of whichhave a joint Gaussian distribution.
Preliminary
In this section, we provide basic knowledge of GPR.
Let η : Z → Y be the target function, where
Z ⊆ R n z and Y ⊆ R .
Given input z ( t ) ∈
Z at time t , the corresponding output is given by
[Equation]
where e ( t ) is the Gaussian measurement noise and the latent function η is sampled from a Gaussianprocess prior.
Let training data be in the form D ≜ ( Z , y ) , where Z ≜ { z (1) , . . .
, z ( n s ) } is the setof input data and y ≜
[ y (1) , . . .
, y ( n s )]
T is the column vector aggregating the outputs.
GPR aims toapproximate the latent function η over a set of test data points Z ∗ ⊂
Z using D .
Define kernel function k : R n z × R n z
→ R that is symmetric and positive semi-definite; i.e., 90 (cid:82) k ( z , z ′ )
f ( z ) f
( z ′ ) dν
( z ) dν ( z ′ ) ≥
for all f ∈ L 2 ( Z , ν ) , where ν denotes a measure (see page80, [13]).
Let η ( Z ) return a column vector such that the i -th entry of η ( Z ) equals η ( z ( i )) .
Assumethat the latent function η is sampled from a GP prior specified by mean function µ and kernel functionk .
Then the training outputs y and the test outputs η ( Z ∗ ) are jointly Gaussian distributed as:
[Equation]
y
[Equation]
where µ ( Z ) and µ ( Z ∗ ) return a vector consisting of µ ( z ( i )) and µ ( z ∗ ( j )) ; k ( Z , Z ∗ ) returns amatrix such that the entry at the i th row and the j th column is k
( z ( i ) , z ∗ ( j )) , and k
( Z , Z ) , k ( Z ∗ , Z )and k ( Z ∗ , Z ∗ ) are defined in an analogous way.
Utilizing identities of joint Gaussian distribution (see page 200 in [13]), GPR makes predictions of ηon Z ∗ based on dataset D as η ( Z ∗ ) ∼ N ( µ Z ∗ |D , Σ Z ∗ |D ) , where
[Equation]
with ˚ k ( Z , Z ) ≜ k ( Z , Z ) + σ 2 e I n s .
We refer (3) as full GPR.
If y is multi-dimensional, GPR isperformed for each element.
Problem formulation
2.1 Observation model
Consider a network consisting of n agents and a cloud.
We denote the agent set by V ≜ { 1 , . . . , n } .
At each time instant t , the observation model of agent i is given as
[Equation]
where z [ i ] ( t ) ∈
Z ⊆ R n z is the input of η , y
[ i ] ( t ) ∈ Y is the observation of the agent, and e [ i ] ( t ) isindependent zero-mean Gaussian noise with e [ i ] ( t ) ∼ N (0 , ( σ [ i ] e ) 2 ) .
2.2 Attack model
All communications between the cloud and the agents are attack-free.
Some agents are Byzantineagents, which can behave arbitrarily during learning process, and send arbitrary local predictionsto the cloud.
We assume that an α fraction of the n agents are Byzantine, and the remaining 1 − αfraction are benign.
We denote B ⊂ V as the set of Byzantine agents, and thus |B| =
⌊ αn ⌋ .
Both thecloud and the benign agents are unaware of the identities of Byzantine agents, but we assume thecloud knows that 14 is an upper bound of α .
Assumption 1 It holds that 0 < α < 14 .
Most existing works on Byzantine-tolerant algorithms, e.g., [7], [5], [9], can tolerate Byzantine agentswith α < 12 .
These algorithms only transmit one variable, e.g., the gradients of the loss function or themodel parameter, between the cloud and the agents, whereas our federated GPR algorithm requires toexchange two variables, e.g., local mean and variance, to realize the aggregation of predictions.
2.3 Objective
The objective of this paper is to design an algorithm which can enable the agents and the cloud tocorrectly learn the function η without requiring the agents to share local streaming data ( z [ i ] ( t ) , y
[ i ] ( t ))despite some agents are subject to Byzantine attacks.iii
Byzantine-tolerant federated GPR
In this section, we develop a Byzantine-tolerant federated GPR algorithm to solve the problemformulated in Section 2.
This algorithm consists of three modules: agent-based local GPR, cloudbased aggregated GPR and agent-based fused GPR.
Algorithm 1 Byzantine- i t − z i ] t ) y
[ i ] t )
∗ |D
[ i ] t )
ˇ σ ′ 2 Z ∗ |D
[ i ] ( t ) = lGPR
( D [ i ] ( t ))
] Z ∗
D σ [ i ] Z ∗ |D ( t ) ) 2 = fGPR ( µ ′Z ∗ |D
[ i ] ( t )
ˇ σ ′ 2 Z ∗ |D
i ] ( t ) µ ′Z ∗ |D ( t σ ′ 2 Z ∗ t
Specifically, first at each time instant t , each agent i ∈ V makes its own prediction of ηthrough agent-based local GPR over a given set of points Z ∗ ⊆
Z using local streamingdataset D [ i ] ( t ) ≜ ( Z [ i ] ( t ) , y
[ i ] ( t )) with local input data Z [ i ] ( t ) ≜ { z [ i ] (1) , . . .
, z [ i ] ( t ) } and output y
[ i ] ( t ) ≜
[ y [ i ] (1) , . . .
, y
[ i ] ( t )] T .
Then the benign agents send correct local predictions to thecloud and the Byzantine agents instead send arbitrary values.
Second, the cloud collects all thelocal predictions and constructs two agent sets by trimming a fraction of outliers with respect to thepredictive means and variances.
Then the cloud uses a Byzantine-tolerant PoE aggregation rule tocompute a global model, and broadcasts the global model to all the agents.
Third, the agents refine thepredictions on Z ∗ by fusing the model from the cloud-based GPR with that from the agent-based local
GPR.
Note that each agent only communicates local predictions with the cloud, and does not shareits local streaming data with the cloud and other agents.
The formal description of Byzantine-tolerantfederated GPR is given in Algorithm 1.
Algorithm 2 Agent-based local GPR: lGPR ( D [ i ] ( t )) 1: Z [ i ] ( t ) =
{ z [ i ] (1) , . . .
, z [ i ] ( t ) } 2: y
[ i ] ( t ) =
[ y
[ i ] (1) , . . .
, y
[ i ] ( t )] T 3: for z ∗ ∈
Z ∗ do 4:
Choose z
[ i ] ∗ ( t ) ∈ proj ( z ∗ ,
Z [ i ] ( t )) 5:
Compute ˇ µ ′ z ∗ |D
[ i ] ( t ) ← (cid:26) ˇ µ
z ∗ |D
[ i ] ( t )
Benign agent , ⋆
Byzantine agent 6:
Compute ˇ σ ′ 2 z ∗ |D
[ i ] ( t ) ← (cid:26) ˇ σ 2 z ∗ |D
[ i ] ( t )
Benign agent , ⋆
Byzantine agent 7:
Send ˇ µ ′ z ∗ |D
[ i ] ( t ) and ˇ σ ′ 2 z ∗ |D
[ i ] ( t ) to the cloud 8: end for 9: return ˇ µ ′Z ∗ |D [ i
ˇ σ ′ 2 Z ∗ |D
[ i ] t )
3.1 Agent-based local GPR
To reduce computational complexity, we perform Nearest-neighbor (NN) GPR as the agent-basedlocal GPR to predict for each test point z ∗ ∈
Z ∗ .
Instead of feeding the whole training dataset to
GPR, the agent-based local GPR only uses the nearest input denoted by z [ i ] ∗ ( t ) ∈ proj ( z ∗ , Z [ i ] ( t ))and its corresponding output y
[ i ] z
[ i ] ∗ ( t ) to compute the local predictions.
Notice that, computationiv complexity of the hyperparameter tuning for NN GPR is O ( t 3 ) . In fact, the computation complexityof the hyperparameter tuning can be reduced to O (1) by using recursive hyperparameter tuning[21].
NN GPR in prediction has computation complexity equivalent to nearest-neighbor search,whose worst case complexity is O ( t ) , while full GPR has computation complexity O ( t 3 )
Denote ˇ µ ′ z ∗ |D
[ i ] ( t ) and ˇ σ ′ 2 z ∗ |D
[ i ] ( t ) the predictive mean and variance output from the agent-based local GPR.
The predictive mean and variance of the benign agents are written in the following formsˇ µ ′ z ∗ |D
[ i ] ( t ) =
ˇ µ[-z ∗ |D [ i ] ( t ) ,ˇ σ ′ 
 z ∗ |D-]
[Equation]
[Equation] [Equation] = [Equation]
[ i ] ( t ) where
[Equation]
with ˚ k
( z [ i ] ∗ ( t ) , z
[ i ] ∗ ( t ))
≜ k ( z [ i ] ∗ ( t ) , z
[ i ] ∗ ( t ))
+ ( σ [ i ] e ) 2 I t .
When the agent is a Byzantine agent, itsoutputs can be arbitrary, and in this case we write ˇ µ ′ z ∗ |D
[ i ] ( t ) =
⋆ and ˇ σ ′ 2 z ∗ |D
[ i ] ( t ) = ⋆ .
The implementation of the agent-based local GPR is provided in Algorithm 2.
3.2 Cloud-based aggregated GPR
In the sequel, we consider a Byzantine-tolerant PoE aggregation rule for the cloud.
The algorithm isdescribed as follows:
Step 1 :
For each z ∗ ∈ Z ∗ , the cloud collects potentially corrupted mean ˇ µ ′ z ∗ |D
[ i ] ( t ) and varianceˇ σ ′ 2 z ∗ |D
[ i ] ( t ) from each agent i .
Step 2 : The cloud constructs two agent sets to tolerate Byzantine attacks.
Without loss of generality,for i ∈ V , we sort ˇ µ ′ z ∗ |D
[ i ] ( t ) and ˇ σ ′ 2 z ∗ |D
[ i ] ( t ) in ascending order and the corresponding agent index iskept in the sets T µ ( t ) and T σ ( t ) , such that for each i ∈ T µ ( t ) , we have ˇ µ ′ z ∗ |D
[ i ] ( t ) ≤ ˇ µ ′ z ∗ |D
[ i +1] ( t )and for each i ∈ T σ ( t ) , we have ˇ σ ′
z ∗ |D
[ i ] ( t ) ≤ ˇ σ ′
2 z ∗ |D
[ i +1] ( t ) .
We denote by T µ max ( t ) ≜ { n −⌊ βn ⌋ + 1 , . . . , n } a set of ⌊ βn ⌋ agents with the largest local predictive means, and by T µ min ( t ) ≜{ 1 , . . .
, ⌊ βn ⌋} a set of ⌊ βn ⌋ agents with the smallest local predictive means where β ∈ [ α, 14 ) .
Similarly, we denote trimmed sets of variance by T σ max ( t ) and T σ min ( t ) .
Then, we define
[Equation]
Notice that M ( t ) and C ( t ) include n − 2 ⌊ βn ⌋ agents with extreme values removed.
These are theagents whose predictions do not deviate much from the attack-free case.
Step 3:
Define a global training dataset as D ( t ) ≜ (cid:83) i ∈V D
[ i ] ( t ) , and a common set as I ( t ) ≜
M ( t ) (cid:84) C ( t ) .
The following lemma shows that I ( t ) is never empty.
Lemma 1 Suppose that β < 14 , it holds that (1 − 4 β ) n ≤ |I ( t ) | ≤ (1 − 2 β ) n at each time instant t .
The following lemma shows that ˇ µ ′ z ∗ |D
[ i ] ( t ) and ˇ σ ′ 2 z ∗ |D
[ i ] ( t ) for i ∈
I ( t ) are bounded by the values ofthe benign agents.
Algorithm 1: for t = 1 , 2 .
do 2:
D ( t ) =
(cid:83) i ∈V D
[ i ] ( t ) 3: for z ∗
∈
Z ∗ do 4:
Construct sets M ( t and C t ) according to
Compute I t = M t
C
Implement aggregation rule (7) 7:
Broadcast ˆ µ ′Z ∗ |D ( t ) and ˆ σ ′ 2 Z ∗ |D ( t ) to all the agents 8: end for 9: end for 10: return ˆ µ ′Z D ( t ) , ˆ σ ′ 2 Z ∗ |D t ) v
Lemma 2 Let 0 < α ≤ β < 14 hold.
For i ∈ I ( t ) , we have that min j ∈V\B (cid:8) ˇ µ z ∗ |D
[ j ] ( t ) (cid:9) ≤ˇ µ ′ z
[Equation]
|D [ i ]
[Equation]
t
[Equation]
≤ max [Equation] \B (cid:8)
[Equation]
µ
[Equation]
|D
[ j ]
[Equation]
t ) (cid:9) , and min j ∈V\B (cid:110) ˇ σ 2 z
[Equation]
|D [ j ] ( t ) (cid:111) ≤
[Equation]
2 z
[Equation]
|D [ i ] ( t ) ≤
[Equation]
Given I ( t ) , we propose a Byzantine-tolerant PoE aggregation rule below
[Equation]
Note that if all the agents are known to be benign, we can simply select β = α = 0 , and hence M ( t ) =
C ( t ) =
V .
In this case, (7) reduces to the standard PoE in [23].
Then the cloud-based aggregated
GPR returns ˆ µ ′Z ∗ |D ( t ) ≜
[ˆ µ ′ z ∗ |D ( t ) ]
z ∗ ∈Z ∗ and ˆ σ ′ 2 Z ∗ |D ( t ) ≜
[ˆ σ ′ 2 z ∗ |D ( t ) ]
z ∗ ∈Z ∗ .
The implementation ofthe cloud-based aggregated GPR is provided in Algorithm 3.
3.3 Agent-based fused GPR
Fused GPR aims to refine predictions of η ( Z ∗ ) by integrating the agent-based local GPR with thecloud-based aggregated GPR.
When the cloud variance ˆ σ ′ 2 z ∗ |D ( t ) is lower than the local predictivevariances ˇ σ ′
z ∗ |D
[ i ] ( t ) , the predictions from the cloud-based aggregated GPR are used.
Otherwise,those from the agent-based local GPR are used.
Our algorithm is one-round.
The refined predictionsin the agent-based local GPR will not be transmitted to the cloud, hence it cannot change the finalaggregation.
The implementation of the agent-based fused GPR is provided in Algorithm 4.
1: for z ∗ ∈
Z ∗ do 2: if ˆ σ ′
z ∗ |D ( t ) ≤ ˇ σ ′ 2 z ∗ |D
[ i ] ( t ) then 3: ˜ µ [ i ] z ∗ |D ( t ) =
ˆ µ ′ z ∗ |D ( t ) , (˜ σ
[ i ] z ∗ |D ( t ) )
= ˆ σ ′ 2 z ∗ |D ( t ) 4: else 5: ˜ µ
[ i ] z ∗ |D ( t ) = ˇ µ ′ z ∗ |D
[ i ] ( t ) , (˜ σ [ i ] z ∗ |D ( t ) ) 2 =
ˇ σ ′ 2 z ∗ |D
[ i ] ( t ) 6: end if 7: end for 8: return ˜ µ
[ i ] Z ∗ |D ( t ) , (˜ σ
[ i ] Z ∗ |D ( t ) )
3.4 Performance guarantee
This section discusses the robustness of the cloud-based aggregated GPR.
We start with the assumptions of the kernel function k .
Assumption 2 1) (Decomposition).
The kernel function k ( · , · ) can be decomposed in such a waythat k
( · , · ) = κ ( D ( · , · )) , where κ : R + → R ++ is continuous.2) (Monotonicity).
It holds that κ ( s ) is monotonically decreasing in s and κ (0) =
σ 2 f .
Many existing kernel functions can satisfy Assumption 2, e.g., squared exponential kernel [13].
As[13], any non-zero mean Gaussian process can be decomposed into a deterministic process and azero-mean stochastic process.
Without loss of generality and for notational simplicity, we assume ηfollows a zero-mean Gaussian process in the analysis.
Assumption 3 It satisfies that η ∼ GP (0 , k ) and η is Lipschitz continuous.
The target function η is completely specified by Gaussian process with kernel function k .
Thisassumption is common in the analysis of GPR [24].
Denote by ℓ η > 0 the Lipschitz constant ofη , i.e., sup z , z ′ | η ( z ) − η
( z ′ )
| ≤ ℓ η D ( z , z ′ ) .
For i ∈ V , we define the dispersion of local dataas d
[ i ] ( t ) ≜ sup z ∈ Z D
( z , Z [ i ] ( t )) , which is considered as a density measurement of sampled datadistributed within a compact set.
For notational simplicity, we denote the distance by D Z z ≜ D ( z , Z ) .vi
We denote σ ≜
[Equation]
+
[Equation]
min e ) 2 where σ max e ≜ max i ∈V { σ [ i ] e } and σ min e ≜ min i ∈V { σ [ i ] e } .
The followingtheorem shows that the prediction error from the cloud-based aggregated GPR is upper bounded.
Theorem 1 (Byzantine-tolerant aggregated GPR: Mean) Let 0 < α ≤ β < 14 and Assumptions 2, 3 hold.
For any z ∗ ∈ Z and 0 < δ < 1 , with probability at least 1 −
[Equation]
+ ∆ where ∆ ≜
[Equation]
Corollary 1 (Attack-free cloud-based GPR: Mean) Suppose Assumptions 2 and 3 hold.
For anyz ∗ ∈ Z and 0 < δ < 1 , with probability at least 1 − δ , it holds that (cid:12)(cid:12) ˆ
[Equation]
[Equation]
Combining Theorem 1 with Corollary 1, we can see that the performance of Byzantine-tolerant GPRcan be decomposed into 2 terms: the performance of attack-free cloud-based GPR and the term∆ .
Specifically, the term ∆ characterizes the performance loss caused by Byzatine agents.
Noticethat ∆ is positively proportional to α and goes to zero as α approaches zero.
This implies that theprediction performance improves if the number of Byzantine agents is decreasing.
When α is fixed,∆ is proportional to β .
This implies that learning performance improves if the set I ( t ) expands.
The following theorem gives the lower bound and upper bound of the cloud variance.
Theorem 2 (Byzantine-tolerant aggregated GPR: Variance) Let 0 < α ≤ β < 14 and Assumption 2hold.
For any z ∗ ∈ Z , it holds that σ 2 f ( σ min
[Equation]
[Equation]
Corollary 2 (Attack-free cloud-based GPR: Variance) Suppose Assumption 2 holds.
For any z ∗ ∈ Z ,it holds that
[Equation]
From Theorem 2 and Corollary 2, we can see that the predictive variances of attack-free cloud-based
GPR and Byzantine-tolerant GPR shares the same lower and upper bounds.
This is due to the fact thatthe extreme values are removed by the Byzantine-tolerant PoE in the cloud-based GPR.
The proofsof Lemmas 1, 2, Theorems 1, 2 and Corollaries 1, 2 are included in the supplementary document.
Numerical experiments
This section experimentally demonstrates the performance of the proposed Byzantine-tolerant federated GPR algorithm using one synthetic dataset and two real-world datasets.
Synthetic dataset: For the observation model (2), we consider the target function introduced in [25]
[Equation]
with z ∈ R and e ∼ N (0 , 0 . 01) .
We generate n s = 10 3 , 5 × 10 3 , 10 4 , 5 × 10 4 training points in [0 , 1] ,respectively, and choose n t = 120 test points randomly in [0 , 1] .
There are n = 40 agents in a network.
We partition the training dataset into 40 disjoint groups, and each agent is assigned with n s /n trainingdata points.
We use the following squared-exponential kernel k ( z , z ∗ ) =
σ 2 f exp( − 12 ℓ 2 ( z − z ∗ ) 2 ) ,and use Mean Square Error (MSE) to evaluate the proposed algorithm in terms of consistency, theeffect of α and the effect of β in the following experiments.
In the first experiment, we let α = 2 .
We randomly choose theagents in the network to be compromised by same-value attacks [26], and let β = α .
Specifically,for each test point z ∗ , the Byzantine agents only change the local predictive means to 100 , thatis, ˇ µ ′ z ∗ |D
[ i ] ( t ) = 100 for all t , and send this incorrect prediction to the cloud.
The local predictivevariances for all the agents remain unchanged.
Fig.
1(a) compares the performances of the proposed
Byzantine-tolerant PoE (BtPoE) with the standard PoE. As a benchmark, the bottom curve depictsthe prediction errors of the standard PoE (AfPoE) when there is no Byzantine attack in the network;it shows that the standard PoE is consistent in the attack-free scenario.
However, when the aforementioned Byzantine attacks are launched, the top curve shows that the standard PoE can no longervii remain consistent.
Note that there are 6 curves by attacked standard PoE (AedPoE), and only theclosest one to the bottom curve is shown in Fig.
1(a) 1 .
[Figure]
Notice that the performance of the Byzantine-tolerant PoE increases as α , the ratio of Byzantineagents, decreases.
Fixing the training data size n s = 10 4 , we replicate the experiments for 50 timeswith different α and observation noise e .
Figs. 2(a) and 2(b) show that the performances of the
Byzantine-tolerant PoE are comparable to that of the attack-free standard PoE with consistencypreserved.
The prediction errors for both methods are in the order of 10 − 4 , while Fig. 2(c)
showsthat the attacked standard PoE has prediction errors ranged from 2 .
5 to 30 .
This demonstrates thatthe proposed PoE aggregation rule has strong ability to tolerate Byzantine attacks.
[Figure]
In the second experiment, we evaluate the prediction performance with regard to β .
All associatedparameters are the same as those in the above experiments.
Notice that for each α , we initially letβ =
α and then increase β to 0 .
225 with increment 0 .
025 , such that the assumption α ≤ β < 14is satisfied.
The results are shown in Fig. 1(b).
This shows that as the number of trimmed agentsincreases, the performance of the proposed algorithm grows worse, since more information is excludedin the aggregation.
This result validates the conclusion in Theorem 1.
[Table]
In the third experiment, we conduct Monte Carlo simulations to evaluate the performance of
Byzantine-tolerant PoE on different functions.
We repeat the experiment for 50 times by sampling different functions and observation points.
Specifically, we replace sin(12 z ) in (8) with viii sin(12 z ) + ϵ ′ where ϵ ′ ∼ N (0 , 0 .
01 i ) , i = 1 , . .
We assign n = 40 agents in the network andsample n s = 10 4 training points in [0 , 1] , and then choose n t = 120 test points randomly in [0 , 1] .
We also use the square-exponential kernel k ( z , z ∗ ) .
There are six Byzantine agents, i.e., α = 15% ,and we let β = α .
Experiment results are presented in Table 1, and it shows that the performance ofthe Byzantine-tolerant PoE is comparable to that of the attack-free standard PoE, noticing that theorder of the prediction errors for the Byzantine-tolerant PoE are 10 − 2 .
For comparison, the MSE bythe attacked standard PoE is about 26 .
This demonstrates that the proposed Byzantine-tolerantaggregation rule is effective for learning different functions.
Real-world dataset: We conduct an experiment to evaluate the prediction performance with differentattack magnitudes using two real-world datasets.
The first dataset is collected from a seven degreesof-freedom SARCOS anthropomorphic robot arm [13].
The goal is to learn a function η .
The input ofη is 21 -dimensional including 7 joint positions, 7 joint velocities and 7 joint accelerations; whereasthe output is 1 -dimensional, representing the torque of a joint.
We randomly sample 40,000 datapoints for training and 40 data points for testing.
In the experiment, we partition 40 , 000 training datainto n = 40 disjoint groups, and assign each group to an agent.
The second dataset Kin40k [27] iscreated using a robot arm simulator.
We randomly choose 9 , 000 training points and 40 test points.
We also partition the training data evenly into 40 groups.
The magnitudes of attack we consider are± 0 .
1 , ± 1 , ± 10 , ± 50 , ± 100 .
We randomly sample the training data points and repeat the experimentsfor 50 times.
Fig.
3 shows the prediction performances.
For both real-world datasets, when the attackmagnitude is increasing, the prediction errors of the attacked standard PoE largely increases, whereasthose of the attack-free standard PoE and the Byzantine-tolerant PoE are consistently maintained at alow level.
It shows that the proposed Byzantine-tolerant PoE is resilient to the attack.
[Figure]
Conclusion
We propose a Byzantine-tolerant federated GPR algorithm, which is able to tolerate less than onequarter Byzantine agents in the network.
We characterize the upper bounds on the prediction errorsand the lower and upper bounds of the predictive variances.
Experiments are conducted to demonstratethe robustness of Byzantine-tolerant GPR algorithm.
Future work will focus on the comparison ofthe learning performance between the agent-based local GPR and the agent-based fused GPR, andthe quantification of the benefits the cloud brings to the agents.ix