B YZANTINE -R ESILIENT N ON -C ONVEX S TOCHASTIC G RADIENT D ESCENT
A BSTRACT
We study adversary-resilient stochastic distributed optimization, in which m machines can independently compute stochastic gradients, and cooperate to jointly optimize over their local objective functions.
However, an α -fraction of the machines are Byzantine , in that they may behave in arbitrary, adversarial ways.
We consider a variant of this procedure in the challenging non-convex case.
Our main result is a new algorithm SafeguardSGD which can provably escape saddle points and ﬁnd approximate local minima of the non-convex objective.
The algorithm is based on a new concentration ﬁltering technique and its sample and time complexity bounds match the best known theoretical bounds in the stochastic, distributed setting when no Byzantine machines are present.
Our algorithm is practical: it improves upon the performance of prior methods when training deep neural networks, it is relatively lightweight, and is the ﬁrst method to withstand two recently-proposed Byzantine attacks.
I NTRODUCTION
Motivated by the pervasiveness of large-scale distributed machine learning, there has recently been signiﬁcant interest in providing distributed optimization algorithms with strong fault-tolerance guarantees.
In this context, the strongest, most stringent fault model is that of Byzantine faults (Lamport et al., 1982): given m machines, each having access to private data, at most an α fraction of the machines can behave in arbitrary, possibly adversarial ways, with the goal of breaking or at least slowing down the algorithm.
Although extremely harsh, this fault model is the “gold standard” in distributed computing (Lynch, 1996; Lamport et al., 1982; Castro et al., 1999), as algorithms proven to be correct in this setting are guaranteed to converge under arbitrary system behaviour.
A setting of particular interest in this context has been that of distributed stochastic optimization.
Here, the task is to minimize some stochastic function f ( x ) =
E s ∼D
[ f s ( x )] over a distribution D , where f s ( · ) can be viewed as the loss function for sample s ∼ D .
We assume there are m machines (workers) and an honest master, and α < 1 / 2 fraction of the workers may be Byzantine.
In each iteration t , each worker has access to a version of the global iterate x t , which is maintained by the master.
The worker can independently sample s ∼ D , compute ∇ f s ( x t ) , and then synchronously send this stochastic gradient to the master.
The master aggregates the workers’ messages, and sends an updated iterate x t +1 to all the workers.
Eventually, the master has to output an approximate minimizer of f .
Clearly, the above description only applies to honest workers; Byzantine workers may deviate arbitrarily and return adversarial “gradient” vectors to the master in every iteration.
This distributed framework is quite general and well studied.
One of the ﬁrst references in this setting studied distributed PCA and regression (Feng et al., 2014).
Other early approaches (Blanchard et al., 2017; Chen et al., 2017; Su and Vaidya, 2016a;b; Xie et al., 2018a) relied on deﬁning generalizations of the geometric median.
These approaches can withstand up to half of the nodes being malicious, but can have relatively high local computational cost Ω( m 2 d ) (Blanchard et al., 2017; Chen et al., 2017), where m is the number of nodes and d is the problem dimension, and usually have suboptimal sample and iteration complexities.
Follow-up work resolved this last issue when the objective f ( · ) is convex , leading to tight sample complexity bounds.
Speciﬁcally, Yin et al.
(2018) provided bounds for gradient descent -type algorithms, and showed that the bounds are tight when the dimension is constant.
Alistarh et al.
(2018) provided a stochastic gradient descent (SGD) type algorithm and showed that its sample and time complexities are asymptotically optimal even when the dimension is large.
Non-convex Byzantine-resilient stochastic optimization.
In this paper, we focus on the more challenging non-convex setting, and shoot for the strong goal of ﬁnding approximate local minima (a.k.a.
second-order critical points).
In a nutshell, our main result is the following.
Fix d to denote the dimension, and let the objective f : R d → R be Lipschitz smooth and second-order smooth.
We have m worker machines, each having access to unbiased, bounded estimators of the gradient of f .
Given an initial point x 0 , the SafeguardSGD algorithm ensures that, even if at most α < 1 /fraction of the machines are Byzantine, after
[Equation]
parallel iterations, for at least a constant fraction of the indices t ∈
[ T ] , the following hold:
[Equation]
If the goal is simply (cid:107)∇ f ( x t ) (cid:107) ≤ ε , then T = (cid:101) O (cid:0) (cid:0) α 2 + 1 m (cid:1) (
[Equation]
[Equation]
[Equation]
min f ( x
[Equation]
(cid:1) iterations sufﬁce.
Here, the (cid:101)
O notation serves to hide logarithmic factors for readability.
We spell out these factors in the detailed analysis.
• When α < 1 / √ m , our sample complexity ( = mT ) matches the best known result in the nonByzantine case (Jin et al., 2019) without additional assumptions, and enjoys linear parallel speedup: with m workers of which < √ m are Byzantine, the parallel speedup is (cid:101) Ω( m ) .•
For α ∈ [1 / √ m, 1 / 2) , our parallel time complexity is (cid:101) O
( α 2 ) times that needed when no parallelism is used.
This still gives parallel speedup.
This α 2 factor appears in convex Byzantine distributed optimization, where it is tight (Yin et al., 2018;
Alistarh et al., 2018).
• The Lipschitz smoothness and second-order smoothness assumptions are the minimal assumptions needed to derive convergence rates for ﬁnding second-order critical points (Jin et al., 2019).
prior bounds.
The closest known bounds are by Yin et al.
(2019), who derived three gradient descent-type of algorithms (based on median, mean, and iterative ﬁltering) to ﬁnd a weaker type of approximate local minima.
Since it relies on full gradients, their algorithm is arguably less practical, and their time complexities are generally higher than ours (see Section 2.1).
Other prior works consider a weaker goal: to ﬁnd approximate stationary points (cid:107)∇ f ( x ) (cid:107) ≤ ε only:
Bulusu et al.
(2020) additionally assumed there is a guaranteed good (i.e. non-Byzantine) worker known by the master, Xie et al.
(2018b) gave a practical algorithm when the Byzantine attackers have no information about the loss function or its gradient, Yang et al.
; Xie et al. (2018a);
Blanchard et al.
(2017) derived eventual convergence without an explicit complexity bound, and the non-convex result obtained in Yin et al.
(2018) is subsumed by Yin et al.
(2019), discussed above.
Our algorithm and techniques.
The structure of our algorithm is deceptively simple.
The master node keeps track of the sum of gradients produced by each worker across time.
It labels (allegedly) good workers as those whose sum of gradients “concentrate” well with respect to a surrogate of the median vector, and labels bad workers otherwise.
Once a worker is labelled bad, it is removed from consideration forever.
The master then performs the vanilla SGD , by moving in the negative direction of the average gradients produced by those workers currently labelled as good.
We call our algorithm SafeguardSGD , since it behaves like having a safe guard to ﬁlter away bad workers.
Its processing overhead at the master is O ( md ) , negligible compared to standard SGD.
As the astute reader may have guessed, the key non-trivial technical ingredient is to identify the right quantity to check for concentration, and make it compatible with the task of non-convex optimization.
In particular, we manage to construct such quantities so that (1) good non-Byzantine workers never get mislabelled as bad ones; (2) Byzantine workers may be labelled as good ones (which is inevitable)
but when they do, the convergence rates are not impacted signiﬁcantly; and (3) the notion does not require additional assumptions or running time overhead.
To achieve these goals, we leverage a new concentration lemma that may be of independent interest (see Section 3).
The idea of using concentration (for each worker across time) to ﬁlter out Byzantine machines traces back to the convex setting (Alistarh et al., 2018).
However, the quantities used in (Alistarh et al., 2018) to check for concentration are necessarily different from this paper, and our analysis is completely new, as deriving non-convex rates is known to be much more delicate and challenging.
Recently, Bulusu et al.
(2020) used similar concentration ﬁlters to Alistarh et al.
(2018) in the nonconvex setting, but under stronger assumptions, and for the simpler task of ﬁnding stationary points.
Many other algorithms do not rely on concentration ﬁlters.
In each iteration, they ask each worker to compute a batch of stochastic gradients, and then use coordinate-wise median or mean over the batch average (e.g. Yin et al.
Yang et al.
or iterative ﬁltering (e.g. Su and
Xu (2018);
Yin et al.
by the master to derive a “robust mean.”
These works fundamentally rely on each iteration to calculate an almost precise full gradient, so that they can apply a surrogate of full gradient descent .
Such algorithms can introduce higher sample and time complexities (see
Section 2), are less practical than stochastic gradient schemes, require additional restrictions on the resilience factor α , e.g. α < 1 / 4 (Su and Xu, 2018), and, critically, have been shown to be vulnerable to recent attacks (Baruch et al., 2019; Xie et al., 2020).
Attack resilience and experimental validation.
There is a growing literature on customized attacks against Byzantine-resilient algorithms, showing that many defenses can be entirely circumvented in real-world scenarios (Baruch et al., 2019; Xie et al., 2020).
Our algorithm is provably correct against these attacks, a fact we also validate experimentally.
Speciﬁcally, we implemented
SafeguardSGD to examine its practical performance against a range of prior works (Xie et al., 2018b; Blanchard et al., 2017; Chen et al., 2017; Yin et al., 2018; 2019), and against recent attacks on the distributed task of training deep neural networks .
Our experiments show that SafeguardSGD generally outperforms previous methods in convergence speed and ﬁnal accuracy, sometimes by a wide accuracy margin.
This is true not only against known Byzantine attacks, but also against attack variants we ﬁne-crafted to speciﬁcally slow down our algorithm.
SafeguardSGD provides two desirable properties: (1) SafeguardSGD quickly detects nodes which signiﬁcantly misbehave; (2) the impact of the remaining Byzantine workers (with undetectable deviations) is limited in practice.
S TATEMENT OF O UR T HEORETICAL R ESULT
We denote by (cid:107) · (cid:107) the Euclidean norm and [ n ] := { 1 , 2 , . . . , n } .
Given symmetric matrices A , B , we let (cid:107) A (cid:107) 2 denote the spectral norm of A .
We use (cid:23) to denote Loewner ordering, i.e. A (cid:23) B if
A − B is positive semi-deﬁnite.
We denote by λ min ( A ) the minimum eigenvalue of matrix A .
We consider arbitrary d -dimensional non-convex functions f : R d → R satisfying the following:
• f ( x ) is L -Lipschitz smooth: meaning (cid:107)∇ f ( x ) − ∇ f ( y ) (cid:107) ≤ L (cid:107) x − y (cid:107) for any x, y ∈ R d ; • f ( x ) is L 2 -second-order smooth: (cid:107)∇ 2 f ( x ) − ∇ 2 f ( y ) (cid:107) 2 ≤ L 2 · (cid:107) x − y (cid:107) for any x, y ∈ R d ;
For notational simplicity of the proofs, we assume L =
L 2 = V = 1 .
2 Note that we have also assumed the domain of f is the entire space R d .
If instead there is a compact domain X ⊂ R d , then one can use projected SGD and re-derive similar results of this paper.
We choose to present our result in the simplest setting to convey our main ideas.
Byzantine non-convex stochastic distributed optimization.
We let m be the number of worker machines and assume at most an α fraction of them are Byzantine for α ∈ (cid:2) 0 , 12 (cid:1) .
We denote by good ⊆
[ m ] the set of good (i.e. non-Byzantine) machines, and the algorithm does not know good .
Assumption 2.1.
In each iteration t , the algorithm (on the master) is allowed to specify a point x t and query m machines.
Each machine i ∈ [ m ] gives back a vector ∇ t,i ∈
R d satisfying
• If i ∈ good , the stochastic gradient ∇ t,i satisﬁes E [ ∇ t,i ] = ∇ f ( x t ) and (cid:107)∇ f ( x t ) − ∇ t,i (cid:107) ≤ V .
• If i ∈ [ m ] \ good , then ∇ t,i can be arbitrary (w.l.o.g.
we assume (cid:107)∇ f ( x t ) − ∇ t,i (cid:107) ≤ V ).
Remark 2.2 .
For each t and i (cid:54)∈ good , the vector ∇ t,i can be adversarially chosen and may depend on {∇ t (cid:48) ,i } t (cid:48) ≤ t,i ∈ [ m ] .
In particular, the Byzantine machines can even collude during an iteration.
2. O UR A LGORITHM AND T HEOREM
Our algorithm is based on arguably the simplest possible method for achieving this goal, (perturbed) stochastic gradient descent (SGD) (Ge et al., 2015).
Our techniques more broadly apply to more complicated methods (e.g. at least to Allen-Zhu (2018a;b)), but we choose to analyze the simplest variant of SGD, since it is the most widely applied method in modern non-convex machine learning.
As illustrated in Algorithm 1, in each iteration t = 0 , 1 , . .
, T − 1 , we maintain a set of (allegedly)
Input: point x 0 ∈ R d , rate η > 0 , lengths T ≥ T 1 ≥ T 0 ≥ 1 , threshold T 1 > T 0 > 0 ; 1: good 0 ← [ m ] ; 2: for t ← 0 to T − 1 do 3: last 1 ← max { t 1 ∈ [ t ]: t 1 is a multiple of T 1 } ; 4: last 0 ← max { t 0 ∈ [ t ]: t 0 is a multiple of T 0 } 5: for each i ∈ good t do 6: receive ∇ t,
i ∈
R
d from machine i ; 7:
[Table]
A
[Table]
← A i where i ∈ good t is any machine s.t.
(cid:12)(cid:12) { j ∈ good
[Table] [Table]
} (cid:12)(cid:12) > m/ 2 .
B med ← B i where i ∈ good t is any machine s.t.
(cid:12)(cid:12) { j
[Table]
: (cid:107)
[Table]
(cid:107)
[Table]
> m/ 2 .
[Table] [Table]
good machines good t ⊆
[ m ] .
We begin with good 0 =
[ m ] and start to detect malicious machines and remove them from the set.
We choose a learning rate η > 0 , and perform the SGD update
[Equation]
where ξ t ∼ N (0 , ν 2 I ) is a random Gaussian perturbation that we introduce.
For each machine i ∈ [ m ] , we keep track of the history of its stochastic gradients up to two windows .
Namely, A i ← (cid:80) tk
= last 1 ∇ k,i | good k | and B
i ← (cid:80) tk = last 0 ∇ k,i | good k | , for windows sizes T 0 ≤ T 1 ≤ T .
We compare among remaining machines in good t , and kick out those ones whose A i or B i deviate “more than usual” to construct good t +1 .
Conceptually, we view these two as safe guards .
Our theory makes sure that, when the “window sizes” and the thresholds for “more than usual” are deﬁned properly, then good t shall always include good , and the algorithm shall proceed to ﬁnd approximate local minima.
Formally, we have (letting the (cid:101)
O notion to hide polylogarithmic factors)
Theorem 2.3.
Let C
= α 2 + 1 m .
Suppose we choose ν 2 = (cid:101)
Θ( C 3 ) , η = (cid:101) Θ( ε 2 dC 3 ) , T
= (cid:101) Θ( 1 η ) ,
T 1 = (cid:101) Θ( 1 η √ ε ) , T 0 = (cid:101) Θ( √ T 0 ) , and T 1 = (cid:101) Θ( √ T 1 ) , then after T = (cid:101) O (cid:16) ( f ( x 0 ) − min f ( x ) [Equation] d ε
[Equation]
(cid:17) iterations, with high probability, for at least constant fraction of the indices t ∈
[ T ] , they satisfy (cid:107)∇ f ( x t ) (cid:107) ≤ ε and ∇ 2 f ( x t ) (cid:23) −√ ε I .
Remark 2.4 .
If one only wishes to achieve a signiﬁcantly simpler goal — ﬁnding ﬁrst-order critical points (cid:107)∇ f ( x t ) (cid:107) ≤ ε — the analysis becomes much easier (see Section 4).
In particular, having one safe guard without perturbation (i.e. ν = 0 ) sufﬁces, and the iteration complexity reduces to
T = (cid:101) O (cid:0) f ( x 0 ) − min f ( x ) ε( α 2 + 1 m ) (cid:1) .
Bulusu et al.
(2020) achieves this easier goal but requires an additional assumption: there is one guaranteed good worker known by the master.
Our contribution.
We reiterate our theoretical contributions from three perspectives.
When α < 1 / √ m , our algorithm requires mT = (cid:101) O (cid:0) (
f ( x 0 ) − min f ( x ))
d ε(cid:1) stochastic gradient computations.
This matches the best known result (Jin et al., 2019) under our minimal assumptions of the non-convex objective.
(There exist other works in the stochastic setting that break the ε − 4 barrier and get rid of the dimension dependence d under stronger assumptions.)
When α < 1 / √ m , our algorithm enjoys linear parallel speed-up: the parallel time complexity reduces by a factor of Θ( m ) .
When α ∈ [1 / √ m, 1 / 2) , our parallel time complexity is (cid:101) O
( α 2 ) times that needed when no parallelism is used, still giving noticeable speedup.
The α 2 factor also appeared in convex Byzantine distributed optimization (and is known to be tight there)
(Yin et al., 2018;
Alistarh et al., 2018).
Comparison to Yin et al.
Yin et al.
(2019) derived three gradient descent-type algo- with − d ) 1 / {+
+} I .
Despite practical differences (namely, gradient descent may be less favorable comparing to stochastic gradient descent especially in deep learning applications), the parallel time complexities derived from their result are also generally larger than ours.
Their paper focuses on bounding the number of sampled stochastic functions, as opposed to the number of stochastic gradient evaluations like we do in this paper.
When translated to our language, each of the workers in their setting needs to evaluate T stochastic gradients, where (1) T = (cid:101) O (cid:0)
α 2 d ε 4 + d 2 ε 4 m + √ dε 3 (cid:1) if using coordinate-wise median, (2) T
= (cid:101) O (cid:0) α 2 d 2 ε 4 + d 2 ε 4 m (cid:1) if using trimmed mean, and (3) T = (cid:101) O (cid:0) αε 4 + d ε 4 m (cid:1) if using iterative ﬁltering.
The complexities (1) and (2) are larger than ours (also with a weaker guarantee); the complexity (3) seems incomparable to ours, but when translating to the more standard ( ε, √ ε ) guarantee, becomes T
=
(cid:101) O (cid:0) αd 2 ε 5 + d 3 ε 5 m (cid:1) so is also larger than ours.
It is worth noting that (3) requires α < 1 / 4 so cannot withstand half of the machines being Byzantine.
Resilience against practical attacks.
Recall that our algorithm’s ﬁltering technique is based upon tracking B i , the stochastic gradients of each machine i averaged over a window of T 0 iterations .
This is a departure from previous defenses, most of which are history-less, and enables us to be provably Byzantine-resilient against recent state-of-the-art attacks (Baruch et al., 2019; Xie et al., 2020).
Speciﬁcally, in Baruch et al.
(2019), Byzantine workers collude to shift the gradient mean by a factor β times the standard deviation of the (true stochastic) gradient, while staying within population variance.
They noticed β can be quite large in practice, since stochastic gradients tend to have large variance, especially in neural network training.
Their attack can circumvent existing defenses because those defense algorithms are “historyless”, while their attack is statistically indistinguishable from an honest execution in a single iteration.
However, our algorithm can provably defend against this attack since it has memory : Byzantine workers following their strategy will progressively diverge from the (honest) “median” B med (by an amount proportional to Ω( T ) in T iterations), and thus be marked as malicious by our algorithm (since our safeguard threshold is proportional to
O ( √ T ) ).
Alternatively, if the Byzantine workers attempt to disrupt the mean while staying within our algorithm’s thresholds, then we prove their inﬂuence on convergence must be negligible.
In Xie et al.
(2020), Byzantine workers collude to deviate in the negative direction of the gradient.
Similarly to the previous attack, to avoid being caught by our algorithm, the maximum “magnitude” of this attack again has to stay within our thresholds.
We implemented both attacks and showed our algorithm’s robustness experimentally.
Finally, we note that prior “historyless” schemes, such as Krum or median-based schemes, could be thought of as providing stronger guarantees, as they in theory allow Byzantine nodes to change
IDs during the computation: such schemes only require an upper bound on the number of Byzantine agents in each round.
However, the attack of Baruch et al.
(2019) essentially shows that all such schemes are vulnerable to variance attacks, and that such attacks are eminently plausible in practice.
Thus, this suggests that the use of historical information, which requires that Byzantine nodes cannot change their IDs during the execution, may be necessary for Byzantine resilience.
C ONCENTRATION OF M EASURE FOR S UMS OF P ARTIAL S UMS
We begin with a new concentration result which is central to our analysis.
Lemma 3.1.
Fix p ∈ (0 , 1) .
Suppose ξ 0 , . . .
, ξ T − 1 ∼ N (0 , 1) are i.i.d.
and ∆ 1 , . . .
, ∆ T − 1 ∈ R .
Here, each ∆ t can depend on ξ 0 , . . .
, ξ t − 1 but not on ξ t , . . .
, ξ T − 1 .
Assume that this sequence satisﬁes | ∆ 1 + · · · + ∆ t | 2 ≤ T for every t = 1 , . .
, T − 1 .
Then, with probability at least 1 − p ,
[Equation]
In our ﬁnal convergence analysis of SafeguardSGD , we shall apply Lemma 3.1 by substituting each ξ t with the Gaussian noise and each ∆ t with the Byzantine attack in iteration t .
The proof of this result is in Appendix A. We can extend this to a similar concentration lemma for inner products over d -dimensional vectors.
Lemma 3.2.
Fix the dimension parameter d ≥ 1 .
Suppose ξ 0 , . .
ξ T − 1 ∈ R d are i.i.d.
drawn from N (0 , I ) , and that ∆ 1 , . .
. , ∆ T − 1 are arbitrary vectors in R d . Here, each vector ∆ t with [Table] [Table]
t = 1 , . . , T − 1 can depend on ξ 0 , . . .
, ξ t − 1 but not on ξ t , . . .
, ξ T − 1 .
Suppose that these vectors satisfy (cid:107) ∆ 1 + · · · + ∆ t (cid:107) 2 ≤ T for every t = 1 , . .
, T − 1 .
Then, with probability at least 1 − p ,
[Table]
W ARMUP : S INGLE S AFE G UARD
As a warmup, let us ﬁrst analyze the behavior of perturbed SGD with a single safe guard.
Consider
Algorithm 2, where we start with a point w 0 , a set good 0 ⊇ good , and perform T steps of perturbed
SGD.
(We use the w t sequence instead of the x t sequence to emphasize that we are in Algorithm 2.)
Deﬁnition 4.1.
We make the following deﬁnition to simplify notations: let Ξ t :
= σ t + ∆ t where
• σ t := 1 | good t | (cid:80) i ∈ good (cid:0) ∇ t,i − ∇ f ( w t ) (cid:1) • ∆ t := 1 | good t | (cid:80) i ∈ good t \ good (cid:0) ∇ t,i − ∇ f ( w t ) (cid:1)
Therefore, we can re-write the SGD update as w t +1 =
w t − η ( ∇ f ( w t ) + ξ t + Ξ t ) .
The following lemma is fairly immediate to prove:
Lemma 4.2 (single safe guard) .
In Algorithm 2, suppose we choose T = 8 (cid:112) T log(16 mT/p ) .
Then, with probability at least 1 − p/ 4 , for every t = 0 , . . .
, T − 1 , • good t ⊇ good .
• (cid:107) σ t (cid:107) 2 ≤ O ( log( T/p ) m ) and (cid:107) σ 0 + · · · + σ t − 1 (cid:107) 2 ≤ O ( T log( T/p ) m ) • (cid:107) ∆ t (cid:107) 2 ≤ α 2 and (cid:107) ∆ 0 + · · · + ∆ t − 1 (cid:107) 2 ≤ O ( α 2 T log( mT/p )) • |(cid:104)∇ f ( w t ) , ξ t (cid:105)| ≤ (cid:107)∇ f ( w t ) (cid:107) · O ( ν (cid:112) log( T/p )) , • (cid:107) ξ t (cid:107) 2 ≤
O ( ν 2 d log( T/p )) , (cid:107) ξ 0 + · · · + ξ t − 1 (cid:107) 2 ≤ O ( ν 2 dT log( T/p ))
We call this probabilistic event Event single T ( w 0 ) and Pr[ Event single T ( w 0 )] ≥ 1 − p/ 4 .
(The third property above is ensured by our choice of T and the use of safe guard, and the rest of the properties follow from simple martingale concentration arguments.
Details are in Appendix B.1.)
Core Technical Lemma 1: Objective Decrease.
Our ﬁrst main technical lemma is the following:
Lemma 4.3.
Suppose we choose T as in Lemma 4.2.
Denote by C 1 = log( T/p ) and C 2 =
α 2 log mTp + log( T/p ) m .
Suppose η ≤ 0 .
01 min { 1 , 1 C 2 } , T = 1 100 η (1+ √ C 2 ) and we start from w 0 and apply Algorithm 2.
Under event Event single T ( w 0 ) , it satisﬁes f ( w 0 ) − f ( w T ) ≥ 0 .
7 η (cid:80) T [Equation] t [Equation]
w [Equation]
η ( d + √ C 2 )) (cid:1)
Lemma 4.3 says after T ≈ 1 η steps of perturbed SGD, the objective value decreases by, up to some small additive error and up to logarithmic factors , f ( w 0 )
− f ( w T ) ≥ 0 .
7 η (cid:80) T − 1 t =
( (cid:107)∇ f ( w t ) (cid:107) 2 − ηC 2 ) .
This immediately implies, if we choose η ≈ ε 2 C 2 , then by repeating this analysis for O ( C 2 ε 4 ) =
O ( α 2 +1 /m ε) iterations, we can ﬁnd approximate critical point x with (cid:107)∇ f ( x ) (cid:107) ≤ ε .
Proof sketch of Lemma 4.3.
The full proof is in Appendix B.2 but we illustrate the main idea and difﬁculties below.
After simple manipulations, it is not hard to derive that
[Equation]
where recall that Ξ t = σ t +∆ t .
When there are no Byzantine machines, we have E [Ξ t ] =
E [ σ t ] =
so the remainder terms must be small by martingale concentration.
Therefore, the main technical difﬁculty arises to deal with those Byzantine machines, who can adversarially design their ∇ t (even by collusion) so as to negatively correlate with ∇ f ( w t ) to “maximally destroy” the above inequality.
Our main idea is to use second-order smoothness to write ∇ f ( w t ) ≈ ∇ f ( w 0 )
+ ∇ 2 f ( w 0 ) · ( w t − w 0 ) .
To illustrate our idea, let us ignore the constant vector and assume that the Hessian is the identity: that is, imagine
as if ∇ f ( w t ) ≈ w t − w 0 .
Using w t − w 0 = − (cid:80) k<t Ξ t + ξ t , we immediately have
[Equation]
For the ﬁrst partial sum (cid:104) (cid:80) k<t Ξ k , Ξ t (cid:105) in (4.1), it is easy to bound its magnitude using our safeguard.
Indeed, we have (cid:12)(cid:12) (cid:80) t (cid:104) (cid:80) k<t Ξ k , Ξ t (cid:105) (cid:12)(cid:12) ≤ (cid:107) (cid:80)
t Ξ t (cid:107) 2 + (cid:80) t (cid:107) Ξ t (cid:107)
so we can apply Lemma 4.2.
For the second partial sum (cid:80) t (cid:80) k<t (cid:104) ξ k , Ξ t (cid:105) , we can apply Lemma 3.2.
(cid:3)
Core Technical Lemma 2: Randomness Coupling.
Our next technical lemma studies that, if run
Algorithm 2 from a point w
so that the Hessian ∇ 2 f ( w 0 ) has a eigenvalue which is less than − δ (think of w 0 as a saddle point), then with good probability, after sufﬁciently many iterations, the sequence w 1 , w 2 , . .
. , w T shall escape from w 0 to distance at least R for some parameter R ≈ δ .
To prove this, motivated by Jin et al.
, we study two executions of Algorithm 2 where their randomness are coupled.
We then argue that at least one of them has to escape from w 0 .
For any vector v , let [ v ] i denote the i -th coordinate of v .
Lemma 4.4.
Suppose we choose T as in Lemma 4.2 and C 1 , C 2 as in Lemma 4.3.
Suppose w 0 ∈ R d satisﬁes λ min ( ∇ 2 f ( w 0 ))
= − δ for some δ ≥ 0 .
Without loss of generality let e 1 be the eigenvector of ∇ 2 f ( w 0 ) with smallest eigenvalue.
Consider now two executions of Algorithm 2, both starting from w a 0 = w b 0 = w 0 , and suppose their randomness { ξ a t } t and { ξ b t } t are coupled so that [ ξ a t ] 1 = − [ ξ b t ] 1 but [ ξ a t ] i = [ ξ b t ] i for i > 1 .
In words, the randomness is the same orthogonal to e 1 , but along e 1 , the two have opposite signs.
Now, suppose we perform T
= Θ( 1 ηδ log R 2 δ ην 2 ) steps of perturbed
SGD from w a 0 , w b 0 respectively using Algorithm 2.
Suppose
[Equation]
Then, under events Event single T ( w a 0 ) and Event single T ( w b 0 ) , with probability at least 0.98, either (cid:107) w a t − w 0 (cid:107) >
R or (cid:107) w b t − w 0 (cid:107) >
R for some t ∈
[ T ] .
Proof details in Appendix B.3.
The main proof difﬁculty is to analyze a noisy version of the power method, where the noise comes from (1) Gaussian perturbation (which is the good noise), (2) stochastic gradients (which has zero mean), and (3) Byzantine workers (which can be adversarial).
From Warmup to Final Theorem with Double Safe Guards.
At a high level, Lemma 4.3 ensures that if we keep encountering points with large gradient (cid:107)∇ f ( w t ) (cid:107) , then the objective value should sufﬁciently decrease; in contrast, Lemma 4.4 says that if we keep encountering points with negative
Hessian directions (i.e., λ min ( ∇ 2 f ( w t )) < − δ ), then the points must move a lot (i.e., by more than
R in T iterations, which can also lead to sufﬁcient objective decrease, see Lemma C.4).
Therefore, at a high level, when the two lemmas are combined, they should tell that we must not encounter points with (cid:107)∇ f ( x ) (cid:107) being large, or λ min ( ∇ 2 f ( x )) being very negative, for too many iterations.
Therefore, the algorithm can ﬁnd approximate local minima.
The reason we eventually need two safe guards , is because the number of rounds T for Lemma 4.3 and Lemma 4.4 differ by a factor.
Thus, we need two safe guards with different window sizes to ensure that the two lemmas simultaneously hold.
We encourage the reader to examine the full analysis in Appendix C.
E XPERIMENTAL V ALIDATION
We evaluate the convergence of SafeguardSGD to examine its practical performance against prior works (Xie et al., 2018b; Blanchard et al., 2017; Chen et al., 2017; Yin et al., 2018; 2019).
We perform the non-convex task of training a deep residual network (ResNet-20) (He et al., 2016) on [Figure] Figure [Table]
the CIFAR-10 dataset (Krizhevsky et al., 2014).
A full experimental report is given in the Appendix.
We instantiate m = 10 workers and one master executing data-parallel SGD for 200 passes (i [Table] e. epochs) over the training dataset.
The results for higher number of workers are similar.
The ideal baseline is gradient mean without attacks, and we compare against (Naive)
Mean ,
Geometric Median
(Chen et al., 2017), Coordinate-wise Median (Yin et al., 2018; 2019), Krum (Blanchard et al., 2017) [Table] and Zeno (Xie et al., 2018b).
Overall, our experimental setup is very similar to
Zeno (Xie et al., 2018b) but with additional attacks.
Results are averaged over three repetitions.
We implemented the approach of Yang et al.
, but found it very sensitive to hyper-parameter values and were not able to make it converge across all attacks even after signiﬁcant tuning of its γ parameter.
We also implemented the convex algorithm of Alistarh et al. (2018), and executed it in our setting.
However, we found that their algorithm can be successfully prevented from converging in the non-convex setting.
Speciﬁcally, there exists a simple attack, described in Appendix D.5 which causes their algorithm to either (1) mislabel most good workers as Byzantine, or (2) completely diverge, or (3) eventually converge to a poor accuracy solution. This behaviour is not surprising, since their algorithm is designed for, and only guaranteed to work in, the convex setting. Please see Appendix D.5 for details.
To make the comparison stronger, when implementing SafeguardSGD , we have chosen ﬁxed window sizes T
= 1 epoch and T 1 = 6 epochs across all experiments, and adopted an automated process to select T 0 , T 1 (by pre-running the experiment for 20 epochs).
We have also implemented a single safeguard variant of SafeguardSGD with window size T = 3 epochs.
Attackers.
We set α = 0 .
so there are 4 Byzantine workers.
(This exceeds the fault-tolerance of Krum
and so we also tested Krum with only 3 Byzantine workers.)
• S IGN - FLIPPING ATTACK : each Byzantine worker sends the negative gradient to the master.
[Table]
• Z ERO - GRADIENT ATTACK : each Byzantine worker sends zero gradient to the master.
• L ABEL - FLIPPING ATTACK : each Byzantine worker computes its gradient based on the crossentropy loss with ﬂipped labels: for CIFAR-10, label (cid:96) ∈ { 0 , ..., 9 } is ﬂipped to 9 − (cid:96) .
• D ELAYED - GRADIENT ATTACK : each Byzantine worker sends an old gradient to master.
In our experiments, the delay is of D = 1000 iterations.
• S AFEGUARD ATTACK : Byzantine workers send negative but re-scaled gradient to the master.
The re-scale factor 0 . 4 is chosen to avoid triggering the safe-guard conditions at the master (we also show results for re-scale factor 0 .
5 in the Appendix).
This attack is an instantiation of the inner-product attack (Xie et al., 2020), customized speciﬁcally to maximally affect our algorithm.
• V ARIANCE ATTACK (Baruch et al., 2019):
Byzantine workers measure the mean and the standard-deviation of gradients at each round, and collude to move the mean by the largest value which still operates within population variance.
(For our parameter settings, this is 0 .
3 times the standard deviation.
We discuss results for additional parameter values in the Appendix.)
Discussion of results.
Figure 1 compares the convergence curves, while Table 1 compares the best test accuracy.
We encourage the reader to examine the Appendix for full convergence results across all methods, as well as training accuracy and loss graphs.
SafeguardSGD generally outperforms the previous methods in test accuracy and convergence, and closely tracks the performance of the ideal baseline, across all attacks.
The test accuracy difference can be > 10% between our algorithm and the best prior work (see delayed gradient, sign-ﬂipping, and variance attacks).
SafeguardSGD slightly outperforms all other algorithms even for the customized safeguard attacks, which were designed to maximally impact its performance.
In most cases, the single-safeguard algorithm is close to double-safeguard, except for the label-ﬂipping attack.
We conclude that SafeguardSGD can be practical, and outperforms previous approaches.
Analyzing a speciﬁc attack.
It is interesting to consider the inner workings of the algorithm in the context of a “delayed” attack, where the Byzantine nodes collude to execute an attack after a speciﬁc, given, point in the execution (in this case, the ﬁrst epoch), rather than all starting their attack at the very beginning of the execution.
Figure 2 presents the results from the perspective of the value of (cid:107) B i − B med (cid:107) registered at the central server, for two nodes, an honest one, and a Byzantine one.
The Byzantine node pretends to be honest for the ﬁrst half of the epoch, and then colludes with the others to apply the variance attack.
(The results are similar for other attacks and starting points.)
We observe the following. First, note that the value of (cid:107) B i − B med (cid:107) increases for all nodes during the execution (at a rate of roughly √ T ). Second, once the attack starts, the statistic for the Byzantine node starts to grow roughly linearly , as in this case the node deviates by a constant times the standard deviation in every step. This will lead to fast detection of such nodes.
Alternatively, the bad nodes may “spread out” their attack to avoid detection, but the analysis shows that they may not signiﬁcantly inﬂuence the result in this case.
A PPENDIX A M ISSING P ROOFS IN S ECTION
Lemma 3.1.
Suppose ξ 0 , . .
. , ξ T − 1 ∼ N (0 , 1) are i.i.d.
and ∆ 1 , . . .
, ∆ T − 1 ∈ R .
Here, each ∆ t can depend on ξ 0 , . . .
, ξ t − 1 but not on ξ t , . . .
, ξ T − 1 .
Suppose ∆ satisﬁes | ∆ 1 + · · · +∆ t | 2 ≤ T for every t = 1 , . .
, T − 1 .
Then, with probability at least 1 − p , (cid:12)(cid:12)(cid:12)(cid:12)(cid:12) T − 1 (cid:88) t = ( ξ 0 + · · · +
ξ t − 1 ) ·
∆ t (cid:12)(cid:12)(cid:12)(cid:12)(cid:12) ≤ O ( (cid:112) T T log( T/p ))
Proof of Lemma 3.1.
Without loss of generality, we can assume ∆ 1 + · · · + ∆ T − 1 = 0 .
This is so because, if not, then we can add an additional term ∆ T = − (∆ 1 + · · · + ∆ T − 1 ) , but this affects the total sum by at most
O ( (cid:112) T T log( T/p )) with probability at most 1 − p .
Also without loss of generality, we can assume ξ 0 =because it affects the sum by at most (cid:112) T log( T/p ) with probability at most 1 − p .
Now, let us convert the vector (∆ 1 , . . .
, ∆ T − 1 ) into a set of “weighted segments”.
Let i be the minimal index so that ∆ i (cid:54) = 0 .
• If ∆ i > 0 , we let j > i be the minimal index so that ∆ j < 0 , and we add a “negative segment”
[ i, j ] with weight w = − min {| ∆ i | , | ∆ j |} .
Then, we replace ∆ i with ∆ i + w and replace ∆ j with ∆ j − w and continue the conversion.
• If ∆ i < 0 , we let j > i be the minimal index so that ∆ j > 0 , and we add a “positive segment”
[ i, j ] with weight w = min {| ∆ i | , | ∆ j |} .
Then, we replace ∆ i with ∆ i + w and replace ∆ j with ∆ j − w and continue the conversion.
This process ends up with a set S of at most T segments, each denoted as ([ i, j ] , w ) , representing a segment [ i, j ] with weight w .
It is clear that
[Equation]
It is a simple exercise to verify that,
Claim A.1.
For every point x ∈ { 1 . 5 , 2 . 5 , . . .
, T − 1 . 5 } , x can be covered by (1) either only positive segments or only negative segments, and (2) with total absolute weight at most √ T .
Proof.
Indeed, suppose by way of contradiction x is covered by both some positive segment [ i 1 , j 1 ] and by some negative segment [ i 2 , j 2 ] .
Suppose without loss of generality that [ i 1 , j 1 ] is created before [ i 2 , j 2 ] through the above construction.
Then, before [ i 1 , j 1 ] is added, we know ∆ i 1 < 0 and ∆ j 1 > 0 .
However, we also know ∆ i 2 > 0 (because otherwise [ i 2 , j 2 ] wouldn’t be picked as a negative segment in later rounds).
This violates the deﬁnition of j 1 , which is the minimal index j > i 1 satisfying ∆ j > 0 .
As for the total weight, suppose without loss of generality that all segments covering x are positive, with total weight more than √ T .
This necessarily means ∆ 1 + · · · + ∆ x − 0 .
5 < −√ T
and it contradicts with our assumption.
(cid:3)
In the remainder of the proof we wish to bound the summation in (A.1).
For notation simplicity, we assume as if only positive segments exist in S (to deal also negative segments, the proof is analogous).
We make a deﬁnition of segment chain .
We say C =
(([ i 1 , j 1 ] , w 1 ) , . . .
, ([ i k , j k ] , w k )) is a segment chain of weight w if:
• i 1 < j 1 ≤ i 2 < j 2 ≤ · · · ≤ i k < j k (non of the two chains overlap), and • w 1 = · · · = w k = w (all segments have weight w ).
We also make a deﬁnition of chain decomposition .
We say that a set S of segments can be decomposed into segment chains {C k } k , if for each segment ([ i, j ] , w ) ∈ S , let C 1 , . . .
, C m be all the chains that contain segment [ i, j ] , with individual chain weights w 1 , . . .
, w m , then w 1 + · · · + w m = w .
When this happens, we write
S =
(cid:80) k C k .
Claim A.2.
We can decompose S =
(cid:80) k C k into at most T chains with total weights at most √ T .
Proof.
Recall from the previous claim that in S , each point x ∈ { 1 . 5 , 2 . 5 , . .
, T − 1 . 5 } is covered by at most total absolute weight √ T .
We call this quantity the “cover number” of S .
We shall recursively construct chains out of S .
Let the ﬁrst chain C be constructed as follows.
Pick the lowest index i 1 such that some segment ([ i 1 , j 1 ] , w 1 ) is in S .
Then, pick the lowest index i 2 ≥ j 1 such that some segment ([ i 2 , j 2 ] , w 2 ) is in S , and so on.
In the end, we arrive at a sequence of segments [ i 1 , j 1 ] , . . .
, [ i 2 , j 2 ] , and let w = min { w 1 , . . . , w k } .
This gives a segment chain
C =
(([ i 1 , j 1 ] , w ) , · · · , ([ i k , j k ] , w )) and we can remove it from S (by setting each w q ← w q − w or removing the segment if w q = w ).
Let the remaining segments be S (cid:48)
so we have S = S (cid:48)
+ C .
Thus, we proceed to construct the second chain from S (cid:48) and so on.
There are at most T chains.
We claim that, each time after removing a segment chain of weight w from S , the “cover number” reduces by w .
Indeed, suppose the chain we construct is C with total weight w , and suppose S = S (cid:48)
+ C .
Suppose the “cover number” of S is cov .
Then, for every x ∈ { 1 . 5 , 2 . 5 , . .
, T − 1 . 5 } , if x is covered by C then obviously x is covered in S (cid:48) with a total weight at most cov − w .
Otherwise, if x is not covered by C , then let ([ i 1 , j 1 ] , w 1 ) , . . .
, ([ i k , j k ] , w k ) be all the segments in S that have covered x .
We know that none of them have appeared in C as otherwise x is covered by C .
Now, let ([ i, j ] , w ) ∈ C be the segment in the chain with largest j < x .
It must satisfy that i 1 , i 2 , . . .
i k
< j as otherwise one of those k segments would have been added to C .
This means, at point x (cid:48)
=
j − 0 .
5 , this point x (cid:48) is covered by not only ([ i 1 , j 1 ] , w 1 ) , . . .
, ([ i k , j k ] , w k ) , but also by ([ i, j ] , w ) in S .
By the deﬁnition of cover number, it satisﬁes w 1 + · · · + w k + w ≤ cov .
In other words, w 1 + · · · + w k ≤ cov − w .
In sum, we have shown that after removing C , the remaining set S (cid:48) of segments have cover number at most cov − w .
This means, when the decomposition of chains ﬁnishes, the total chain weights do not exceed the initial cover number, which is √ T .
[Equation]
Finally, we consider the partial sum with respect to each segment chain C from the above construction.
That is,
[Equation]
Suppose the chain C contains segments ([ i 1 , j 1 ] , w ) , . . .
, ([ i k , j k ] , w ) , the we have
[Equation]
Now, one can carefully verify that given our construction, i 1 < j 1 ≤ i 2 < j 2 ≤ · · · ≤ i k <
j k is a set of multiple stopping points.
That is, i 1 only depends on the randomness of ξ 1 , . . .
, ξ i 1 − 1 , j 1 only depends on the randomness of ξ 1 , . . . , ξ j 1 − 1 , and so on.
By concentration on sum of Gaussian variables with stopping times, we have with probability at least 1 − p/T ,
[Equation]
Summing up over all the chains we ﬁnish the proof of Lemma 3.1.
(cid:4)
Lemma 3.2.
Suppose ξ 0 , . .
ξ T − 1 ∈ R d are i.i.d.
drawn from N (0 , I ) are ∆ 1 , . . .
, ∆ T − 1 ∈ R d .
Here, each ∆ t can depend on ξ 0 , . . .
, ξ t − 1 but not on ξ t , . . .
, ξ T − 1 .
Suppose ∆ satisﬁes (cid:107) ∆ 1 + · · · +∆ t (cid:107) 2 ≤ T for every t = 1 , . .
, T − 1 .
Then, with probability at least 1 − p ,
[Equation]
Proof of Lemma 3.2.
The proof is analogous, but this time for each segment [ i, j ] , we also need to attach to it a color c ∈ { 1 , 2 , . . .
, d } .
Now, for each x , let w 1 , . .
. , w d be the total weights of segments that cover x with color 1 , . . .
, d respectively, then we have w 21 + · · · w 2 d ≤ T from our assumption.
However, by AM-GM, this means | w 1 | + · · · + | w d | ≤ √ T d .
Therefore, the rest of the proof proceeds by replacing √ T with √ d T .
(cid:3)
B M ISSING P ROOFS FOR S ECTIONB. P ROOF OF L EMMA 4.
Recall the following, useful inequality.
Lemma B.1 (Pinelis’ 1994 inequality (Pinelis, 1994)) .
Let X 1 , . . .
X T ∈ R
d be a random process satisfying E [ X t | X 1 , . . .
, X t − 1 ] =
and (cid:107) X t (cid:107) ≤ M .
Then, Pr (cid:2) (cid:107) X 1 + · · · + X T (cid:107) 2 > 2 log(2 /δ )
M 2 T (cid:3) ≤ δ .
Lemma 4.2 is in fact a direct corollary of the following claim, whose proof is quite classical.
Denote by C = log(16 mT/p ) .
Denote by
[Equation]
Recall at iteration t − 1 , Algorithm 2 computes { B ( t ) 1 , . . .
, B
[Table]
t
[Table]
m } as well as some B ( t ) med = B ( t )
i where i is any machine in good
[Table]
1 such that at least half of j ∈ [ m ] satisﬁes
[Table]
Claim B.2.
Let C = log(16 mT/p ) .
Then, with probability at least 1 − p/ 4 , we have
[Table]
d
for all
and
also have
[Table]
[Table] [Table]
[Table]
Proof of Claim B.2.
We prove by induction.
Suppose the statements hold for t − 1 and we now move to t .
[Table]
− α ) m ≤ 2 m .
We can thus apply Lemma B.1 to the X t and then take a union bound over all i ∈
good .
Thus, with probability at least 1 − p 8 T we have (cid:107) B ( t )
i − B ( t ) (cid:63) (cid:107) ≤ 4 √ tC/m for all
i ∈
good .
The result follows from a further union bound over t ∈ [ T ] .
(b) Claim B.2a implies for every i, j ∈ good we have (cid:107) B ( t )
i − B ( t ) j (cid:107) ≤ 8 √ tC/m .
Therefore each i ∈ good is a valid choice for setting B ( t ) med =
B ( t ) i .
(c) This is a consequence of the previous items and the deﬁnition of B ( t ) med .
(d) This is a consequence of the previous item.
(e) We can apply Lemma B
1 with { X 1 , X 2 , . . .
, X t | good | } = { ∇ k,i −∇ f ( w k ) | good k | } k ∈ [ t ] ,i ∈ good .
It holds with probability at least 1 − p 8 T that (cid:13)(cid:13) (cid:80) i ∈ good (cid:0) B ( t )
i − B ( t ) (cid:63) (cid:1)(cid:13)(cid:13)
≤
O ( (cid:112) t log( T/p ) / √ m ) .
(cid:3)
Proof of Lemma 4.2.
The property good t ⊇ good is from Claim B.2d.
The property (cid:107) σ t (cid:107) 2 ≤ O ( log( T/p ) m ) is by standard concentration inequalities for sums of bounded random vectors.
The property (cid:107) σ 0 + · · · + σ t − 1 (cid:107) 2 ≤ O
( T log( T/p ) m ) is from Claim B.2e.
The property (cid:107) ∆ t (cid:107) ≤ α is obvious as we have at most α fraction of the bad machines.
The bound on (cid:107) ∆ 0 + · · · + ∆ t − 1 (cid:107) 2 can be derived as follows.
For every i ∈ [ m ] \ good , let t be the last iteration i satisﬁes
i ∈ good t .
Then, by the triangle inequality,
[Equation]
On the other hand, t ∈ good t implies (cid:107) B ( t ) i − B ( t ) med (cid:107) ≤ 16 √ tC/m by the algorithm; combining this with (cid:107) B ( t ) (cid:63) − B ( t ) med (cid:107) ≤ 12 √ tC/m , and summing up over all such bad machines i ﬁnishes the proof.
The ﬁnal two properties follow from standard facts about Gaussian random vectors.
(cid:3)
B. P ROOF OF L EMMA 4.
Proof of Lemma 4.3.
Using the Lipschitz smoothness of f ( · ) , we have
[Equation]
We ﬁrst show:
[Equation]
ξ t (cid:107) 2 ) |
T − 1 (cid:88) t
= η (cid:104)∇ f ( w t ) , ξ t (cid:105)| ≤ η (cid:118)(cid:117)(cid:117)(cid:116)
T − 1 (cid:88) t
= (cid:107)∇ f ( w t ) (cid:107) 2 · O ( ν √ C 1 ) ≤ (cid:32) 0 .
η
T − 1 (cid:88) t
= (cid:107)∇ f ( w t ) (cid:107)(cid:33) + O
( C 1 ν 2 η )
The ﬁrst follows since ( a + b + c ) 2 ≤ 3( a 2 + b 2 + c 2 ) for any a, b, c ∈ R , and the second follows from
Lemma 4.2.
Combining them, and also using that (cid:107) Ξ t (cid:107) 2 ≤ O ( C 2 ) , (cid:107) ξ t (cid:107) 2 ≤ O ( dν 2 C 1 ) , and η ≤ 0 .
we
[Table]
[Table] [Table]
[Equation]
where the last inequality follows from Lemma 4.2.
For the second term ♣ , we have
[Equation]
♥
Using (cid:107) w t
[Table]
w q
[Table]
(cid:107)
w
[Table]
w 0 (cid:107) + (cid:107)
[Table]
w
[Table]
(cid:107) , one can derive
[Table] [Table]
f ( w
[Table]
)( w
[Table]
− w q ) , Ξ
[Equation]
For the ﬁrst term (and the second term is analogous), we have
[Equation]
[Table]
where the last inequality follows from Young’s inequality
[Table]
and Lemma 4.2.
Putting this back to the formula of ♦ , we have
[Equation]
Finally, putting ♦ and ♥ back to ♣ , and putting ♣ and ♠ back to (B.2) and (B.1), we have
[Equation]
together with T = 1 100 η (1+ √ C 2 ) and η ≤ 0 .
01 min { 1 , 1 C 2 } , we have
[Equation]
( d
[Equation]
≥
[Equation] [Equation]
η
[Equation]
(cid:88)
[Equation]
= (cid:16)
[Equation]
(cid:3)
B. P ROOF OF L EMMA 4.
Proof of Lemma 4.4.
Let us denote by r t =
[ ξ a t ] 1 2 = − [ ξ b t ] 1
and we know r t ∼ N (0 , ν 2 4 ) .
We can write w a
[Equation] [Equation]
b
[Equation]
1 = ηr t
[Equation]
1 +
[Equation]
b t )
Using the second-order smoothness, we have
[Equation]
+ θ t for some vector (cid:107) θ t (cid:107) ≤ max {(cid:107) w a 0 − w a t (cid:107) , (cid:107) w b 0 − w b t (cid:107)} · (cid:107) w a t − w b t (cid:107) .
Therefore, we have w a t +1 − w b t +1 = ηr t e
+ (cid:0) I − η ∇ 2 f ( w 0 ) (cid:1) ( w a t − w b t ) − η
(Ξ a t − Ξ b t + θ t )
Now, giving ψ 0 = ψ 0 = 0 , imagine two sequences
• ψ t +1 = ηr t e
+
(cid:0)
I − η ∇ 2 f ( w 0 ) (cid:1) ψ t and •
ψ t +1 = ηr t e
+ (cid:0) I − η ∇ 2 f ( w 0 ) (cid:1) ψ t − η
(Ξ a t − Ξ b t + θ t ) =
w a t +1 − w b t +
We will inductively prove (cid:107) ψ t − ψ t (cid:107) ≤ 12 (cid:107) ψ t (cid:107) .
On one hand, it is easy to see that ψ t is zero except in the ﬁrst coordinate, in which it behaves as a Gaussian with zero mean and variance (cid:80) t − 1 k =
(1 + ηδ ) 2 k · η 2 ν 2=
Θ
[Equation] [Equation]
By Gaussian tail bounds, we know that
• with probability at least 0 .
99 , it satisﬁes (cid:107) ψ t (cid:107) ≤ O ( √ ηC 1 ν (1+ ηδ ) t √ δ ) for every t • with probability at least 0 .
99 , it satisﬁes (cid:107) ψ T (cid:107) ≥ 1 1000 ( √ ην (1+ ηδ ) T √ δ )
In the rest of the proof, we condition on this event happens.
We prove towards contradiction by assuming (cid:107) w a t − w a 0 (cid:107) ≤ R and (cid:107) w b t − w b 0 (cid:107) ≤ R for all t ∈
[ T ] .
We will inductively prove that (cid:107) ψ t − ψ t (cid:107) ≤ 1 2000 ( √ ην (
[Equation]
+
[Equation]
t √ δ ) .
We calculate the difference
[Equation]
Let g =
ψ t − ψ t (cid:107) ψ t − ψ t (cid:107) , then we can inner-product the above equation by vector g , which gives
[Equation]
where the inequality (cid:172) uses
[Equation]
≤
[Equation]
1 + ηδ ) t − 1 − i , and the inductive assumption.
Let us call M = (cid:0) I − η ∇ 2 f ( w 0 ) (cid:1) , and focus on
[Equation]
using Lemma 4.2)
[Equation]
Together, we have
[Equation]
Under our assumption, we have (cid:107) ψ t − ψ t (cid:107) < 1 2000 ( √ ην (1+ ηδ ) t √ δ ) and therefore (cid:107) ψ T (cid:107) ≥ (cid:107) ψ T (cid:107)−(cid:107) ψ T − ψ T (cid:107) ≥ 1 2000 ( √ ην
[Equation]
1+
[Equation]
) t
[Equation]
δ ) .
Thus, within T iterations, we have (cid:107) ψ t (cid:107) > R and this gives a contradiction.
(cid:3)
C F INAL : D OUBLE S AFE G UARD
We now come to our ﬁnal Algorithm 3 which is our perturbed SGD algorithm with two safeguards.
The two safeguard algorithm naturally divides itself into epochs, each consisting of T 1 iterations.
We will demonstrate that within most epochs, we make good progress.
Thus, consider some iterate x mT 1 , for some m < T/T 1 .
Our goal will be to argue that we make good function value progress by iterate x ( m +1) T 1 , and that we do not settle into any saddle points.
To slightly simplify notation, let w 0 = x mT 1 , and let the sequence of iterates be w 0 , . .
. , w T 1 − 1 , so that w T 1 − 1 = x ( m +1) T 1 − 1 .
For completeness’ sake we rewrite this as Algorithm 1.
Our main result is the following theorem.
Theorem C.1.
Let C
= α 2 + 1 m .
Suppose we pick parameters p, δ ∈ (0 , 1) , η ≤ (cid:101)
O ( δ 3 C 3 ) , ν 2 = (cid:101)
Θ( C 3 ) ,
T
= (cid:101) Θ (cid:0) 1 η (cid:1) , T 1 = (cid:101)
Θ (cid:0) 1 ηδ (cid:1) ≥ T 0 , T 1 = (cid:101)
Θ( √ T 1 ) , and T
= (cid:101) Θ( √ T 0 ) .
Then, starting from w 0 ,
[Table]
d
[Table]
: for t ← 0 to
[Table]
do
[Table]
: last ← max {
[Table]
[ t ]:
[Table]
is a
[Table]
T 0 }
[Table]
for
[Table]
i
[Table]
do
[Table]
: receive
[Table]
from
[Table] [Table]
d )
[Equation]
(b) As long as (cid:107) w t − w 0 (cid:107) ≥ R for some t ∈ { 1 , 2 , . . .
, T 1 } and for R = (cid:101)
Θ( δ ) ≤ δ 2 , then with probability at least 1 − p we have then
[Equation] [Equation]
(c) if λ
min (
∇ 2 f ( w 0 ))
≤ − δ , we also have with probability at least
[Equation]
w
[Equation]
C. W HY T HEOREM C.1 I MPLIES T HEOREM 2.
Using the parameter choice η = (cid:101) Θ( ε 2 C 3 d ) from Theorem 2.3, we know (cid:101) O
( ηC 3 d ) ≤ 0 .
1 ε 2 .
We claim two things:
• For at least 90% of the epochs, they must satisfy (denoting by w 0 and w T 1 the beginning and ending points of this epoch)
[Equation]
The last inequality uses our choice of T and δ = (cid:101) Θ( √ ε ) .
The reason for this is by way of contradiction.
Suppose for at least 10% of the epochs it satisﬁes f ( w 0 ) − f ( w T 1 ) > 20 f ( x 0 ) − min f ( x ) T/T, then, for the remainder of the epochs, they must at least satisfy f ( w 0 ) − f ( w T 1 ) ≥ − 0 .
7 ηT 1 · 0 .
1 ε 2 .
Summing over all the epochs, we shall obtain f ( x 0 ) − f ( x T ) >
f ( x 0 ) − min f ( x ) but this gives a contradiction.
• For at least 40% of the epochs, they must satisfy the three
properties
from
Theorem
C.1.
In particular, for at least 30% of the epochs, they must satisfy both.
Since ε 1 . 5 is so small that
[Equation]
would give a contradiction (for instance, one can choose δ to be slightly larger than √ ε by some log factors), this means, for those 30% of the epochs, they must satisfy:
• ε 1 .
5 ≥ 0 .
7 η (cid:80) T 1 − 1 t =0 (cid:0) (cid:107)∇ f ( w t ) (cid:107) 2 − 0 .
1 ε 2 (cid:1) , • (cid:107) w t − w 0 (cid:107) ≤ δ 2 for every t
= 1 , 2 , . .
, T 1 , and • ∇ 2 f ( w 0 ) (cid:23) − δ I .
The latter two properties together implies ∇ 2 f ( w t ) (cid:23) −
δ 2 I for every t = 1 , 2 , . . .
, T 1 (by the second-order smoothness).
The ﬁrst property implies for at least 90% of the iterations t in this epoch, they must satisfy (cid:107)∇ f ( x ) (cid:107) ≤ ε .
This ﬁnishes the proof of Theorem 2.3.
(cid:4)
C. P ROOF OF T HEOREM C.
We ﬁrst have the following lemma
Lemma C.2 (double safe guard) .
In Algorithm 3, suppose T 1 = 8 (cid:112) T 1 log(16 mT 1 /p ) and T 0 = 8 (cid:112) T 0 log(16 mT 1 /p ) .
Then, with probability at least 1 − p/ 2 , for every t = 0 , . . .
, T 1 − 1 ,
• good t ⊇ good .
• (cid:107) σ t (cid:107) 2 ≤ O ( log( T 1 /p ) m ) , (cid:107) ∆ t (cid:107) 2 ≤ α 2 , (cid:107) ξ t (cid:107) 2 ≤ O ( ν 2 d log( T 1 /p )) , • (cid:107) σ 0 + · · · + σ t − 1 (cid:107) 2 ≤ O ( T 1 log( T 1 /p ) m ) , (cid:107) σ last + · · · + σ t − 1 (cid:107) 2 ≤ O ( T 0 log(
[Table]
1 /p ) m ) • (cid:107) ∆
+ · · · + ∆ t − 1 (cid:107) 2 ≤ O ( α 2 T 1 log( mT 1 /p )) and (cid:107) ∆ last + · · · + ∆ t − 1 (cid:107) 2 ≤ O ( α 2 T 0 log( mT 1 /p ))
• (cid:107) ξ 0 + · · · + ξ t − 1 (cid:107) 2 ≤ O ( ν 2 dT 1 log( T 1 /p )) and (cid:107)
[Table]
+ · · · + ξ t
[Table]
1 (cid:107) 2 ≤ O ( ν
[Table]
0 log( T 1 /p )) .
We call this probabilistic event Event
[Table]
0 ( w 0 ) and Pr[ Event double
[Table]
0 ( w 0 )] ≥ 1 − p/ 2 .
The proof is a direct corollary of Lemma 4.2, by combining events Event
[Table]
[Table]
Event single T 0 ( w T 0 ) , Event single T 0 ( w 2 T 0 ) and so on.
The next lemma is a simple corollary by repeatedly applying Lemma 4.3.
It proves Theorem C.1a.
Lemma C.3 (modiﬁed from Lemma 4.3) .
Denote by C 1 = log( T 1 /p ) and C 2 = α 2 log mT 1 p + log
T 1 /p ) m .
Suppose η ≤ 0 .
01 min { 1 , 1 C 2 } , T 0 = 1 100 η (1+ √ C 2 ) and T 1 ≥ T 0 .
We start from w 0 and apply Algorithm 3.
Under event Event double T 1 ,T 0 ( w 0 ) , it satisﬁes
[Equation]
The next lemma can be easily derived from Lemma 4.4.
Lemma C.4 (modiﬁed from Lemma 4.4) .
Suppose
[Equation]
Suppose η ≤ 0 .
01 min { 1 , δ 3 C 2 } , T 0 = 1 100 η (1+ √ C 2 ) and T 1 =
Θ( 1 ηδ log δ 3 ηC 2 ) ≥ T 0 .
Let w
∈
R
d be any point in the space and suppose λ min ( ∇ 2 f ( w 0 )) ≤ − δ for some δ ≥ 0 .
Given two coupled sequences deﬁned as before, under events Event double T 1 ,T 0 ( w a 0 ) and Event double T 1 ,T 0 ( w b 0 ) , we have with probability at least 0.
[Equation]
Lemma C.4 directly proves the second half of Theorem C.1c, because given two coupled sequences with the same marginal distribution, we have
[Equation]
Proof of Lemma C.4.
Our choice on r and R satisfy the requirement of Lemma 4.4.
Suppose without loss of generality that the w a t sequence leaves w 0 by more than R .
Let T a 1 be the ﬁrst iteration t ≤ T 1 in which (cid:107) w a t − w a
[Equation]
≥ R .
[Equation]
Combining this with Lemma C.3, we have
[Equation]
Combining this with Lemma C.3 again but for the remainder iterations, we have f ( w a 0 ) − f ( w a T 1 ) ≥ 0 .
5 η
[Equation]
In fact, the above same proof of Lemma C.4 also implies Theorem C.1b.
These together ﬁnish the proof of
Theorem C.1.
(cid:4)
D M ORE ON E XPERIMENTS
We conduct experiments on training a deep residual network (ResNet-20)
He et al.
on the CIFAR-10 image classiﬁcation task Krizhevsky et al.
D. S ETTING AND I MPLEMENTED M ETHODS
In all of our experiments, we use 10 workers and the mini-batch size (per worker) is 8.
We run all algorithms for 200 epochs, with initial learning rate η = 0 . 1 , but the learning rate decreases by a factor of 10 on epochs 80, 120, and 160.
The ideal baseline is gradient “mean without attacks”, and we compare against (Naive)
Mean , Geometric Median Chen et al.
Coordinate-wise Median Yin et al.
(2018; 2019), Krum Blanchard et al.
(2017), and
Zeno Xie et al.
(2018b)
with attacks.
We set α = 0 .
so there are 4 Byzantine workers.
(This exceeds the fault-tolerance of Krum, and so we also tested Krum with only 3 Byzantine workers.)
We formally deﬁne those prior works as follows.
Deﬁnition D.1 (GeoMed Chen et al.
The geometric median of { y 1 , ..., y m } , denoted by geo med { y 1 , ..., y m } , is geo
[Equation]
In our experiments, we choose the geometric median from set { y 1 , ..., y m } .
Deﬁnition D.2 (coordinate-wise median Yin et al.
Coordinate-wise median g = med { y 1 , ..., y m } is deﬁned as a vector with its k-th coordinate being g [ k ] = med { y 1 [ k ] , ...,
y m
[ k ] } for each k ∈ [ d ] , where med is the usual (one-dimensional) median.
Deﬁnition D.
(Krum Blanchard et al.
[Equation]
and i → j is the indices of the m − b − 2 nearest neighbours of y i in { y 1 , ..., y m } by Euclidean distances.
Note that Krum requires 2 b + 2 < m .
So, we have also repeated the experiments for Krum with 3 Byzantine workers (out of 10 workers) to be more fair.
Deﬁnition D.4 (Zeno Xie et al.
(2018b)) .
[Equation]
where { (cid:101) y ( i ) :
i ∈ [ m ] } are the gradient estimators with the m − b highest “scores”, and the so-called stochastic descendant score for any gradient estimator u , based on the current parameter x , learning rate η , and a constant weight ρ > 0 , is deﬁned as:
[Equation]
f r ( x ) − f r ( x − ηu ) is the estimated descendant of the loss function and ρ (cid:107) u (cid:107) 2 is the magnitude of the update.
Safeguard SGD.
To provide the strongest comparison against prior works, we have made universal choices for our safeguard window sizes (across all attackers), and provide an automatic way to select the safeguard thresholds.
Speciﬁcally, for our algorithm with a single safeguard we have used a universal window size T = 3 epochs, and for our algorithm with double safeguards we have used window sizes T 0 = 1 epoch and T 1 = 6 epochs.
As for the procedure to tune thresholds, for each attacker, we pre-run the experiment for 20 epochs with some sufﬁciently large pre-chosen threshold value (e.g. T = 100 or T 0 = 100 and T 1 = 100 ), and then automatically select a good ﬁnal threshold.
Let us describe this process in the case of a single safeguard (and double safeguard is similar).
In each iteration, the master examines { B i | i ∈ good t } to determine some minimal T temp : it satisﬁes that at least half of the workers satisfy (cid:107) B i − B med (cid:107) ≤ T temp
and there exists at least one worker j ∈ good t such that (cid:107) B j − B med (cid:107) > 2 T temp .
Then, T temp is added to the temporary threshold list (after rounding to the ﬁrst decimal point).
In the end, the automated process will recommend the most frequently repeated items in the temporary threshold list, as the ﬁnal choice of threshold.
We emphasize that this procedure only requires knowing the α < 0 .
5 upper bound on the number/fraction of possibly faulty nodes.
D. E XPERIMENT R ESULTS BY A TTACKS D.2. S IGN -F LIPPING A TTACK
Recall that, in a sign-ﬂipping attack, each Byzantine worker sends the negative gradient to the master.
The results for this attack are shown in Figure 2.
From the plots, one can see that our single and double safe-guard algorithms both outperform prior works, even though some of these algorithms make additional assumptions, and closely track the performance of the ideal baseline (without failures).
Under this attacker, single and double safeguard algorithms perform similarly.
(Parameters: m = 10 , α = 0 .
Single safe-guard threshold T = 2 , window size T = 3 epochs, variance ν 2 = 10 − 8 ; double safe-guard thresholds T 0 = 1 , T 1 = 2 and window sizes T
= 1 epoch, T 1 = 6 epochs, variance ν 2 = 10 − 8 .
Zeno Batch size n r = 4 and constant weight ρ = 0 . 0005 .)
[Figure]
D.2. D ELAYED -G RADIENT A TTACK
Recall that, in a delayed-gradient attack, each Byzantine worker sends an old gradient to the master.
In our experiments, the delay is of D = 1000 iterations.
The results are shown in Figure 3.
From the plots, one can see that our single and double safe-guard algorithms both outperform prior works, and closely track the performance of the ideal baseline (without failures).
Under this attacker, single and double safeguard algorithms perform similarly.
(Parameters: m = 10 , α = 0 .
Single safe-guard threshold T = 2 , window size T = 3 epochs, variance ν 2 = 10 − 8 ; double safe-guard thresholds T 0 = 2 , T 1 = 7 and window sizes T
= 1 epoch, T 1 = 6 epochs, variance ν 2 = 10 − 8 .
Zeno Batch size n r = 4 and constant weight ρ = 0 . 0005 .)
[Figure]
D.2. L ABEL -F LIPPING A TTACK
Recall that, in the label-ﬂipping attack, each Byzantine worker computes its gradient based on the cross-entropy loss with ﬂipped labels: for CIFAR-10, label (cid:96) ∈ { 0 , ..., 9 } is ﬂipped to 9 − (cid:96) .
The results are shown in Figure 4.
From the plots, one can see that our double safe-guard algorithm outperforms prior works
[Figure]
and closely tracks the performance of the ideal baseline (without failures).
Under this attacker, the double safeguard algorithm performs slightly better than single safeguard
[Figure]
D.2. Z ERO -G RADIENT A TTACK
Recall that, in the zero-gradient attack, each Byzantine worker sends zero gradient to the master.
The result is shown in Figure 5.
From the plots one can see that our single and double safe-guard algorithms, together with Zeno and Mean outperform other methods, and they closely track the performance of the ideal baseline
(without failures).
It should not be surprising that the (Naive) Mean method performs well under zero-gradient attack: taking the naive mean now behaves equivalently as the perfect baseline with decreased learning rate
[Figure]
D.2. S AFEGUARD A TTACK
Recall that, in the safeguard attack, Byzantine workers send negative but re-scaled gradient to the master.
We choose the re-scale factor so that it hardly triggers the safe-guard conditions at the master.
From our experiment, choosing the re-scale factor as 0 . 4 in most cases do not trigger the safe-guard conditions, while re-scale factor 0 .
5 enables the algorithm to catch some Byzantine workers.
Our results are shown in Figure 7 (for re-scale factor 0 . 4 ) and Figure 8 (for re-scale factor 0 . 5 ).
In Figure 7, the performance of our (single and double) safeguard algorithms indeed get impacted, but our algorithm still outperforms or matches all prior works.
The performance of our (single and double) safeguard algorithms hardly get impacted, and closely tracks the performance of the ideal baseline (and outperforms other prior works signiﬁcantly).
Defense
Best Test Accuracy Last Test Accuracy
Best Loss
Last Loss
S a f e g u a r d a tt a c k
( r e s c a li n g - f a c t o r = 0 . 5 )
Meanwithout Failures 90.
Double Safe-guard 91.
Single Safe-guard 90.
Zeno 86.
Krum / Krum (α= 0.3 ) -/ 24.1 (α= 0.3 )
-/ 20.4 (α= 0.3 )
-/ > 3 (α= 0.3 ) -/ > 3 (α= 0.3 )
GeoMed 16.
>>
Coordinate-wise Median 23.
[Figure]
[Figure]
D. V ARIANCE A TTACK
The Variance attack follows the strategy prescribed by Baruch et al.
(2019), by which Byzantine workers col- lude in order to shift the mean among all gradients by a factor β times the standard deviation of the gradient, while staying within population variance.
More precisely, the maximal change to the mean that can be applied by an attacker without the fear of being detected, by using the properties of the Normal distribution, speciﬁcally the cumulative standard normal function, and compute the maximal possible shift so that the attackers’s values stay within population variance.
(Please see (Baruch et al., 2019, Algorithm 3) for a precise description.
Our β is called z max in their notation.)
We implement this strategy coordinate-wise, as in the original implementation of Baruch et al.
Their work observes that the shift β can be non-trivial in practice, since stochastic gradients tend to have large variance in neural network training (which we also observed in our setup).
Criti- cally, the attack cannot be defended against by historyless algorithms , as the attacker’s values are statistically indistinguishable from a regular execution in a single iteration.
In our setting, for nodes and α is upper bounded by 0 .
3 ( classic tables cumulative normal).
We ran the same attack in the setup from their paper (50 nodes total, of which 24 are Byzantine, which allows β ∼ 1 . 5 ) and observed exactly the same outcome.
Results for this experiment are given in Table 3, while the convergence of different schemes under this attack is presented in Figure 9.
[Figure]
As shown by the results
[Figure]
our algorithm provably circumvents this attack
[Figure]
and recovers full accuracy.
This is because both variants of the algorithm successfully tag the bad nodes after a few hundred iterations.
This is explained by the fact that the algorithm has memory : in particular, Byzantine nodes following this strategy will progressively diverge from the (honest) “median” B med (at a “linear” rate)
[Figure]
and therefore will eventually exceed the threshold and be marked as malicious by the algorithm.
(In practice, the norm of their B i vector increases roughly monotonically until it surpasses the threshold
[Figure]
= 10 − 8 ; double safe-guard thresholds T 0 = 0 . 8 , T 1 = 2 and window sizes T 0 = 1 epoch, T 1 =epochs, variance ν 2 = 10 − 8 . Zeno Batch size n r = 4 and constant weight ρ = 0 . 0005 . Weight decay was enabled.)
D. F ULL C OMPARISON T ABLE
Please see Table 3.
D. A TTACK AGAINST THE CONVEX ALGORITHM OF A LISTARH ET AL . (2018)
We now brieﬂy describe an attack against this algorithm.
The attack speciﬁcally leverages the fact that the algorithm does not use sliding windows.
One can ﬁrst run the vanilla SGD to compute “the maximum deviation per good worker” for the accumulation vector used by the algorithm (cid:80) Tt =0 ∇ t . This maximum deviation is therefore a lower bound for the threshold used in their algorithm. Next, we design an attacker who evenly distributes this total allowed deviation to e.g.
5 consecutive epochs, and behaves honestly for the remaining epochs.
Such an attacker cannot be identiﬁed by this algorithm, because its total deviation across all the iterations is identical to that of a good worker.
However, this leads the algorithm to divergence.
Speciﬁcally, suppose 4 Byzantine workers all maliciously report their stochastic gradients multiplied by the scalar − 5 , and the remaining 6 good workers report their true stochastic gradients.
One can verify numerically that this attacker can run for 5 consecutive epochs (say, epochs a, a + 1 , a + 2 , a + 3 , a + 4 ) without being caught by the algorithm.
Now,
• if a ≤ 75 , within just 1 epoch of attack, the neural net weights diverge (value N A N).
• if 80 ≤ a ≤ 115 , this attack is applied after the ﬁrst learning rate decay.
Within just 1 epoch of the attack, the objective explodes and accuracy becomes 10% (random), and within 3 epochs the algorithm diverges completely.
• if 120 ≤ a ≤ 155 , this attack is after the second learning rate decay.
Within just 2 epochs of attack, the accuracy drops to 11% .
Later, the accuracy never recovers above 40% .
[Table]
S a f e g u a r d a tt a c k
( r e s c a li n g - f a c t
o r =
[Table] [Table]
a r i a n c e a tt a c k
[Table]
s t d e v - f a c t o r
[Table]
[Table] [Table]