PaperlayerView exact revision on arXiv

Source-linked AI summary

Byzantine-Robust Federated Machine Learning through Adaptive Model Averaging

Luis Muñoz-González, Kenneth T. Co, Emil C. Lupu

arXiv:1909.05125v1stat.MLcs.DCcs.LG

TL;DR

Federated learning preserves client-data privacy but remains vulnerable to faulty, noisy, and malicious updates. The paper introduces Adaptive Federated Averaging, which estimates update quality with a Hidden Markov Model, discards bad updates, and blocks unreliable clients. Across four real datasets, AFA is reported as more robust and computationally efficient than Multi-KRUM and coordinate-wise median, though subtle attacks remain a possible vulnerability.

  • Problem

    Standard federated learning can be compromised by faulty or malicious clients, including through Byzantine behavior and poisoning attacks.

  • Method

    Adaptive Federated Averaging uses Hidden Markov Models to estimate client-update quality, discard bad updates, and block clients that repeatedly provide unreliable updates.

  • Results

    Across 4 real datasets, AFA is reported as more robust and computationally more efficient than MKRUM and COMED under malicious, noisy, and faulty-client scenarios.

  • Takeaways & Limitations

    AFA combines robust update selection with client blocking, improving reported robustness while reducing communication and computation relative to the compared methods.

  • Takeaways & Limitations

    AFA could still be vulnerable to subtler or less aggressive attacks, including targeted poisoning and backdoors.

Abstract

from arXiv · show

Federated learning enables training collaborative machine learning models at scale with many participants whilst preserving the privacy of their datasets. Standard federated learning techniques are vulnerable to Byzantine failures, biased local datasets, and poisoning attacks. In this paper we introduce Adaptive Federated Averaging, a novel algorithm for robust federated learning that is designed to detect failures, attacks, and bad updates provided by participants in a collaborative model. We propose a Hidden Markov Model to model and learn the quality of model updates provided by each participant during training. In contrast to existing robust federated learning schemes, we propose a robust aggregation rule that detects and discards bad or malicious local model updates at each training iteration. This includes a mechanism that blocks unwanted participants, which also increases the computational and communication efficiency. Our experimental evaluation on 4 real datasets show that our algorithm is significantly more robust to faulty, noisy and malicious participants, whilst being computationally more efficient than other state-of-the-art robust federated learning methods such as Multi-KRUM and coordinate-wise median.

Introduction

Federated learning builds shared models from clients’ local updates while preserving data privacy, but faulty or malicious clients can compromise performance. The paper introduces Adaptive Federated Averaging, which estimates update quality, discards bad updates, and blocks persistently unreliable clients.

  • Federated Learning: Federated learning aggregates private local model updates from clients through a central server.Clients train locally on their own datasets and send updates for shared-model training.
  • Robustness Challenge: A single faulty or malicious client can compromise the shared model’s performance and convergence.
  • Adaptive Federated Averaging: Adaptive Federated Averaging detects and discards bad or malicious client updates at every training iteration.It compares individual updates with the aggregated model’s update.
  • Adaptive Federated Averaging: A Hidden Markov Model estimates client-update quality and supports blocking clients that systematically send faulty, noisy, or malicious updates.Blocking reduces communication between clients and the server and lowers server aggregation time.
  • Evaluation: AFA is reported as more robust and computationally efficient than Multi-KRUM and coordinate-wise median across four real datasets.

Related Work

Prior robust federated learning methods address faulty and malicious clients through robust aggregation, client ranking, or statistical estimators. AFA instead identifies bad updates while using information from all clients judged good, without requiring a preset client-selection count.

  • Federated Averaging: Federated Averaging updates model parameters using a weighted average of selected clients’ model parameters.
  • Robust Aggregation: KRUM aggregates client gradients or updates using their similarity and provides robustness guarantees under specified assumptions.
  • Robust Aggregation: MKRUM is introduced as a faster KRUM variant because KRUM converges slowly compared with other aggregation rules.
  • Client Selection: Zeno ranks client gradient estimators and updates the model using only the top k clients, requiring k to be specified beforehand.
  • Adaptive Federated Averaging: AFA discards bad updates and uses all good clients, removing reliance on a pre-specified k and retaining information when few clients are bad.

Adaptive Federated Averaging

Adaptive Federated Averaging extends federated optimization by weighting client updates by both dataset size and estimated reliability. It identifies bad updates through similarity-based robust aggregation, learns client quality across iterations, and blocks persistently bad clients to improve efficiency.

  • Federated learning setup: Federated learning partitions data across clients that compute local model updates for synchronous aggregation by a central server.Unlike distributed optimization, federated optimization does not necessarily assume client data shards are IID.
  • Adaptive Federated Averaging: AFA updates the global model using client data sizes and estimated probabilities that clients provide good updates.The aggregation uses p_k^t as each client’s probability of providing a good update and n_k as its dataset size.
  • Robust aggregation: At each iteration, AFA compares client updates with the aggregated model and classifies updates as good or bad using similarity statistics and a threshold ξ.The rule uses the mean, median, and standard deviation of similarities, with different threshold directions depending on the relative mean and median.
  • Robust aggregation: AFA repeats detection while increasing ξ by Δξ, then returns the aggregated update and lists of good and bad clients for subsequent quality estimation.The iteration is intended to detect multiple types of faulty or malicious clients while limiting false positives.
  • Client quality and blocking: A Bayesian Hidden Markov Model learns client update quality across iterations, enabling AFA to block clients that repeatedly provide bad updates.Blocked clients are no longer selected, reducing communication, while the aggregation rule has O(K_td) time complexity and similarity computation scales similarly.

Experiments

Experiments across four datasets and clean, Byzantine, label-flipping, and noisy-client scenarios evaluate AFA against FA, MKRUM, and COMED. AFA maintains robustness, detects bad clients, converges effectively, and reduces aggregation cost under the reported settings.

  • Experimental setup: Experiments cover MNIST, FMNIST, Spambase, and CIFAR-10 with clean, Byzantine, label-flipping, and noisy-client scenarios.The evaluation uses 10 and 100 clients, with 30% bad clients in attacked scenarios.
  • Robustness: AFA’s test error is not significantly degraded across all four datasets and attack scenarios, unlike FA and the less consistently robust baselines.In MNIST with 10 clients under label flipping, AFA reaches 2.96% error versus 78.98% for MKRUM and 11.55% for COMED.
  • Robustness: AFA outperforms MKRUM significantly in 25 of 32 cases, while MKRUM outperforms AFA in 1 case; AFA outperforms COMED in 20 cases versus 2.The comparisons use Wilcoxon Rank-Sum testing at the 5% level.
  • Convergence: On MNIST with 10 clients, AFA converges quickly to a good solution across clean, Byzantine, flipping, and noisy scenarios.FA performs poorly under Byzantine and flipping clients, while MKRUM and COMED perform poorly under flipping attacks.
  • Detection of bad clients: AFA detects all bad clients in MNIST, FMNIST, and Spambase, while CIFAR-10 detection reaches 90%–100% for label flipping and only 2.7%–20% for noisy clients.Despite low noisy-client detection on CIFAR-10, AFA’s test performance is not affected relative to the clean scenario.
  • Computational burden: 0.35 seconds is AFA’s average server aggregation time per iteration, compared with 4.51 seconds for MKRUM and 3.68 seconds for COMED.The experiment uses MNIST with 100 benign clients; communication latency is excluded.

Conclusion

Adaptive Federated Averaging combines quality-aware aggregation with client blocking to improve robustness and efficiency in Byzantine-robust federated learning. Experiments across four real datasets show stronger robustness and computational efficiency than MKRUM and COMED, while vulnerability to subtle attacks remains.

  • Conclusion: AFA estimates each client’s probability of providing good updates with a Hidden Markov Model and uses it to detect and block bad clients.The algorithm updates models using client data fractions and expected update quality.
  • Conclusion: AFA improves communication efficiency and reduces computation by identifying and blocking bad clients.Blocking prevents clients that systematically provide poor updates from continuing to send them.
  • Conclusion: Across four real datasets, AFA is more robust than MKRUM and COMED under malicious, noisy, and faulty-client scenarios.The evaluation includes multiple adversarial settings rather than a single attack type.
  • Conclusion: AFA could remain vulnerable to more subtle or less aggressive attacks, including targeted attacks and backdoors.The paper identifies finer analysis of client updates and similarities as a future research direction.

Appendix A: Datasets

The experiments use four datasets—MNIST, FMNIST, Spambase, and CIFAR-10—with standard splits for three datasets and an 80/20 random split for Spambase. The selected Spambase representation binarizes 54 keyword-occurrence features after dropping three sequence-length features.

  • Datasets: The experiments use four datasets: MNIST, FMNIST, Spambase, and CIFAR-10.Table 3 summarizes their characteristics.
  • Datasets: MNIST, FMNIST, and CIFAR-10 use their standard training and test splits, while Spambase uses an 80% training and 20% testing split.The Spambase split is random.
  • Datasets: For Spambase, the experiments retain 54 keyword-occurrence features, drop three sequence-length features, and binarize the retained features.The representation records keyword presence or absence in each email.
  • Datasets: The chosen Spambase representation improved model accuracy and training stability.This rationale is stated for the binarized feature representation.
  • Datasets: The reported figures show AFA’s robustness across all four datasets.This statement summarizes the results associated with the dataset experiments.

Appendix B: Models used in the Experiments

The experiments use fully connected DNNs for MNIST, FMNIST, and Spambase, and VGG-11 for CIFAR-10. Training uses gradient descent and dropout, with output activations matched to the classification task.

  • Models: MNIST, FMNIST, and Spambase use fully connected DNNs with two hidden layers and Leaky ReLU activations.Spambase uses Sigmoid at the output, while MNIST and FMNIST use Softmax.
  • Models: CIFAR-10 uses VGG-11, a standard architecture for that dataset.The architecture is listed among the models used in the experiments.
  • Optimization: All experiments use gradient descent and dropout to prevent overfitting.These settings apply across the reported dataset models.

Appendix C: Convergence

The convergence evaluation compares federated learning methods across four datasets, four client scenarios, and settings with 10 or 100 clients. AFA consistently reaches a stable low-error solution, whereas competing methods are not robust across all scenarios.

  • Convergence: Figures 4–7 plot classification test error against training iterations for AFA, FA, MKRUM, and COMED across four datasets.The comparison covers clean, Byzantine, flipping, and noisy scenarios with 10 and 100 clients.
  • Convergence: AFA always converges to a stable solution with low test error across the reported scenarios.The passage contrasts this behavior with the lack of robustness of the other algorithms.
  • Scenarios: The clean scenario contains only benign clients, while Byzantine, flipping, and noisy scenarios contain 30% faulty, noisy, or malicious clients.This scenario definition applies to the MNIST, FMNIST, Spambase, and CIFAR-10 figures.
Loading 1909.05125v1…