Enhancing Byzantine-Resistant Aggregations with Client Embedding (2024)

Abstract: Byzantine-resistant aggregations detect poisonous clients and discard them to ensure that the global model is not poisoned or attacked by malicious clients. However, these aggregations are mainly conducted on the parameter space, and the parameter distances cannot reflect the data distribution divergences between clients. Therefore, existing Byzantine-resistant aggregations cannot defend against backdoor injection by malicious attackers in federated natural language tasks. In this paper, we propose the client embedding for malicious client detection to enhance Byzantine-resistant aggregations. The distances between client embeddings are required to reflect the data distribution divergences of the corresponding clients. Experimental results validate the effectiveness of the proposed client embeddings.

## introduction byzantine attacks are a kind of threat to federated learning security, and therefore a line of byzantineresistant aggregation algorithms @xcite @xcite are designed to defend against byzantine attacks. the core of byzantine-resistant aggregations is to detect poisonous clients and discard them to ensure that the global model is not poisoned or attacked by malicious clients. these aggregations are mainly conducted on the parameter space, namely, these aggregations determine suspected poisonous clients based on the distances between client parameters. existing byzantine-resistant aggregations can defend against adversaries caused by software bugs, hardware bugs, network asynchrony, or datasets biases @xcite , while @xcite point out that they cannot defend against backdoor injection by malicious attackers in federated natural language tasks. @xcite point out the limitation of the malicious client detection in the parameter space. in this paper, we argue that for better detection of malicious clients, we should not apply byzantineresistant aggregations in the parameter space directly, because the parameter distances of clients cannot directly reflect the distribution divergences between clients. therefore, we propose the client embedding for malicious client detection. we assume that the distances between client embeddings can reflect the distribution divergences of the corresponding client data distributions. according to this assumption, we propose to solve the lowdimension embeddings according to proposition 1. as demonstrated in figure 1 , enhanced with the proposed client embedding, byzantine-resistant aggregations detect malicious clients according to embedding distances instead of parameter distances. aggregation algorithms can better detect malicious clients enhanced with client embedding, since malicious and clean clients are easier to distinguish in the embedding space than the parameter space. to validate the effectiveness of the proposed client embedding, we conduct the defense and detection experiments algorithms on typical nlp byzantine attacks, including adversaries @xcite and backdoors @xcite . experimental results show that the defense performance of existing byzantine-resistant aggregations can be improved and enhanced with client embedding. furthermore, the results of malicious detection also show that the client embedding can prove the detection performance of byzantine-resistant aggregations, which indicates that the improvement of defense performance does come from better detection performance brought by client embedding. the detection ability of client embedding comes from the ability of client embeddings to model the dataset distributions of clients. client 1 dataset 𝒑𝒑 (𝟏𝟏) parameter 𝜽𝜽 (𝟏𝟏) … … byzantine-resistant aggregations (e.g. krum): 1. distinguish malicious (red points in figs) and clean (bleu points in figs) clients according to parameter distances and 2. discard malicious clients to defense against byzantine attacks parameter 𝜽𝜽 (𝒊𝒊) parameter 𝜽𝜽 (𝒋𝒋) parameter distance |𝜽𝜽 (𝒊𝒊) -𝜽𝜽 𝒋𝒋 | client 𝒊𝒊 dataset 𝒑𝒑 (𝒊𝒊) parameter 𝜽𝜽 (𝒊𝒊) client 𝒏𝒏 dataset 𝒑𝒑 (𝒏𝒏) parameter 𝜽𝜽 (𝒏𝒏) byzantine-resistant aggregations enhanced with client embedding: detect malicious clients in the embedding spaces instead of parameter spaces. client embedding distances |𝒗𝒗 (𝒊𝒊) -𝒗𝒗 𝒋𝒋 | can model the data divergences 𝑫𝑫 𝒇𝒇 (𝒑𝒑 𝒊𝒊 | 𝒑𝒑 𝒋𝒋 between client 𝒊𝒊 and 𝒋𝒋 embedding 𝒗𝒗 (𝒊𝒊) embedding 𝒗𝒗 (𝒋𝒋) embedding distances can model the data divergences: |𝒗𝒗 (𝒊𝒊) -𝒗𝒗 𝒋𝒋 | 𝟐𝟐 = 𝑫𝑫 𝒇𝒇 (𝒑𝒑 𝒊𝒊 ||𝒑𝒑 (𝒋𝒋) ) can easily detect malicious clients: @xmath0.9% cannot detect malicious clients: @xmath1.9% 2 background and related work in this section, we first introduce the concept of federated learning and byzantine-resistant aggregations. then we introduce some nlp byzantine attacks adopted in experiments. ## federated client embedding suppose v (i) denotes the federated client embedding of client i, and n) ] is the embedding matrix. we have only one assumption for client embedding: assumption 1. the embedding distances can model the data divergences: in assumption 1, if we assume: the corresponding embedding should be approximately αv (i) +(1-α)v (j) . therefore, we can only choose @xmath2: suppose the matrix f denotes the divergence matrix, namely f ij ≈ d f (p (i) ||p (j) ) is the fdivergence indicator @xcite . in proposition 1, we prove we can find (n -1)-dimension embeddings satisfying assumption 1. proposition 1. there exists an (n -1)-dimension solution for ∥v (i)v (j) ∥ 2 = f ij , which can be solved with the following cholesky decomposition @xcite ): proposition 1 guides us on how to solve lowdimensional client embeddings e to enhance byzantine-resistant aggregations. more theoretical details are deferred to appendix.a. for example, multi-krum algorithm enhanced with client embedding chooses s according to ## experiments our experiments include defense and detection experiments. the target of defense is to train a model with low attack success rate (asr) or high accuracy (acc) under byzantine attacks, and the target of detection is to detect malicious clients precisely in one training round. we introduce experiment setup and report experimental results in this section. ## conclusion in this paper, we propose the client embedding to enhance byzantine-resistant aggregations. the proposed client embedding can model the dataset distributions of corresponding clients, namely the embedding distances can model the data divergences of clients. experimental results show that the defense performance of byzantine-resistant aggregations can be improved and enhanced with client embedding. further analyses show that the improvements in defense performance come from better detection performance of client embedding, which demonstrates that the proposed client embedding can model the data divergences of clients.