Generalized Byzantine-tolerant SGD

By Cong Xie, Oluwasanmi Koyejo, Indranil Gupta. 2018

304 citations recorded by the source corpus.

We propose three new robust aggregation rules for distributed synchronous Stochastic Gradient Descent~(SGD) under a general Byzantine failure model. The attackers can arbitrarily manipulate the data transferred between the servers and the workers in the parameter server~(PS) architecture. We prove the Byzantine resilience properties of these aggregation rules. Empirical analysis shows that the proposed techniques outperform current approaches for realistic use cases and Byzantine attack scenarios.

Subfields: Artificial Intelligence, Computer Networks and Communications, Optimization & Training, Federated & Distributed Learning

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Networks and Communications

In Optimization & Training

In Federated & Distributed Learning

Citations in the corpus

How To Backdoor Federated Learning (2018, background): “Alternative aggregationmechanisms [13, 20, 68, 71], such as coordinate-wise or geometric medians, greatly reduce the accuracy of complex models on non-i.”
Backdoor Attacks on Federated Meta-Learning (2020, methodology): “The same assumption was made in [12, 13, 19, 16, 17, 20, 21], where outliers were detected and removed according to slightly different measures taken from the distribution of benign values (benign users were assumed to be the majority).”
DETOX: A Redundancy-based Framework for Faster and More Robust Gradient Aggregation (2019, methodology): “The ﬁrst replaces the gradient averaging step at the PS with a robust aggregation step, such as the geometric median and variants thereof [1, 2, 3, 4, 5, 6].”
Zeno++: Robust Fully Asynchronous SGD (2019, background): “Chen et al. (2017); Su & Vaidya (2016; 2018); Yin et al. (2018); Xie et al. (2018) use robust statistics (Huber, 2004) including the geometric median, coordinate-wise median, and trimmed mean as Byzantine-tolerant aggregation rules.”
A Little Is Enough: Circumventing Defenses For Distributed Learning (2019, methodology): “In previous papers (Blanchard et al., 2017; Xie et al., 2018; El Mhamdi et al., 2018), the authors assume that the attacker will choose parameters that are far away from the mean, in order to hurt the accuracy of the model, for example by choosing parameters that are in the opposite direction of…”
Byzantine Stochastic Gradient Descent (2018, background): “There has been a lot of recent work on Byzantine stochastic optimization, and in particular, SGD [6, 8, 13, 26, 27, 30].”
Bypassing Backdoor Detection Algorithms in Deep Learning (2019, background): “Various studies have also worked on making distributed learning settings that converge to a useful model despite the presence of Byzantine workers [27], [29], [4].”
Zeno: Byzantine-suspicious stochastic gradient descent (2018, methodology): “(Median [19, 20]) We deﬁne the marginal median aggregation rule Median ( · ) as where for any j ∈ [ d ] , the j th dimension of med is med j = median ( { (˜ v 1 ) j , . . . , (˜ v m ) j } ) , (˜ v i ) j is the j th dimension of the vector ˜ v i , median ( · ) is the one-dimensional median.”
Cronus: Robust and Heterogeneous Collaborative Learning with Black-Box Knowledge Transfer (2019, methodology): “There exist a long chain of recent poisoning attacks and defenses for federated learning [37], [55], [57], [13], [53], [34], [40], [12], [10].”
Back to the Drawing Board: A Critical Evaluation of Poisoning Attacks on Production Federated Learning (2021, background): “2) Investigating simple and efficient robustness checks is necessary: Most of the state-of-the-art robust AGRs with strong theoretical guarantees [10], [41], [68], [70] have complex robustness checks on their inputs, which incur high computation and storage overheads.”
Federated Learning: A signal processing perspective (2021, methodology): “The method of geometric median can be further generalized to marginal median and to “mean around median” [67].”
Manipulating the Byzantine: Optimizing Model Poisoning Attacks and Defenses for Federated Learning (2021, background): “Unlike previous works which consider only cross-silo FL [4], [17], [37], we consider both the FL settings.”
Defending Distributed Systems Against Adversarial Attacks: Consensus, Consensusbased Learning, and Statistical Learning (2020, background): “Significant progress has been made [2, 24, 25, 19, 10, 8].”
Zeno++: robust asynchronous SGD with arbitrary number of Byzantine workers (2019, background): “For this reason, fault tolerance in distributed settings has attracted increasing attention in the machine-learning community [1, 2, 3, 5, 13, 14, 15, 16].”
Privacy-Enhanced Federated Learning Against Poisoning Adversaries (2021, methodology): “By deﬁnition in [37], GeoMed means the geographic median of all gradient vectors, MarMed takes the coordinate-wise medians as the update, and MeaMed averages the top-( m − f ) values nearest to the coordinate-wise medians, where f is malicious users in the subset of users.”
Fast and Secure Distributed Learning in High Dimension (2019, methodology): “Even-though the property of (α, f)–Byzantine resilience is a sufficient, but not a necessary condition for (weak) Byzantine resilience, it has been so far used as the defacto standard [1, 4, 11] to guarantee (weak) Byzantine resilience for SGD.”
RSA: Byzantine-Robust Stochastic Aggregation Methods for Distributed Learning from Heterogeneous Datasets (2018, unknown): “Leveraging additional data, (Xie, Koyejo, and Gupta 2018c) studies the trustworthy score-based schemes that guarantee ef-ﬁcient learning even when there is only one non-Byzantine worker, but additional data may not always be available in practice.”
Federated Variance-Reduced Stochastic Gradient Descent With Robustness to Byzantine Attacks (2019, methodology): “Robust aggregations other than the geometric median are available, including the median [12], Krum [15], marginal trimmed mean [13], and iterative filtering [14].”
Byzantine-Robust Learning on Heterogeneous Datasets via Resampling (2020, background): “• Gaussian : A Byzantine worker sends a Gaussian random vector of 0 mean and isotropic covariance matrix with standard deviation 200 (Xie et al., 2018a).”
AGGREGATHOR: Byzantine Machine Learning via Robust Gradient Aggregation (2019, methodology): “(Xie et al., 2018) evaluated three other median-based aggregation rules under different practical attack scenarios.”