[Paper Review] Byzantine-Resilient Secure Federated Learning

Jinhyun So, Başak Güler+1 more|arXiv (Cornell University)|Jul 21, 2020

Privacy-Preserving Technologies in Data39 references10 citations

TL;DR

This paper proposes BREA, the first single-server Byzantine-resilient secure aggregation framework for federated learning that simultaneously ensures model robustness against malicious users and user privacy through verifiable secret sharing, stochastic quantization, and secure outlier detection. It achieves convergence comparable to standard federated learning even under up to 30% Byzantine users, with theoretical guarantees on privacy and convergence.

ABSTRACT

Secure federated learning is a privacy-preserving framework to improve machine learning models by training over large volumes of data collected by mobile users. This is achieved through an iterative process where, at each iteration, users update a global model using their local datasets. Each user then masks its local model via random keys, and the masked models are aggregated at a central server to compute the global model for the next iteration. As the local models are protected by random masks, the server cannot observe their true values. This presents a major challenge for the resilience of the model against adversarial (Byzantine) users, who can manipulate the global model by modifying their local models or datasets. Towards addressing this challenge, this paper presents the first single-server Byzantine-resilient secure aggregation framework (BREA) for secure federated learning. BREA is based on an integrated stochastic quantization, verifiable outlier detection, and secure model aggregation approach to guarantee Byzantine-resilience, privacy, and convergence simultaneously. We provide theoretical convergence and privacy guarantees and characterize the fundamental trade-offs in terms of the network size, user dropouts, and privacy protection. Our experiments demonstrate convergence in the presence of Byzantine users, and comparable accuracy to conventional federated learning benchmarks.

Motivation & Objective

• To reconcile the conflicting requirements of Byzantine resilience and user privacy in federated learning.
• To design a single-server framework that protects individual model updates from the server while enabling detection of malicious updates.
• To provide theoretical convergence and privacy guarantees under adversarial conditions and user dropouts.
• To enable robust training in the presence of up to A Byzantine users and N−A honest users, even with non-i.i.d. data distributions.
• To characterize the fundamental trade-offs between network size, user dropouts, and privacy protection.

Proposed method

• BREA uses stochastic quantization to map real-valued model updates into a finite field, enabling secure computation.
• Each user performs verifiable secret sharing of their quantized local update using pairwise random keys.
• The server computes pairwise distances between secret shares in plaintext to detect outliers, leveraging geometric median-based outlier detection.
• Outlier detection is performed securely via a verifiable protocol that ensures consistency and prevents manipulation.
• The final global model is reconstructed only after removing malicious updates, preserving privacy of individual contributions.
• The framework integrates secure aggregation with robust gradient descent to maintain convergence under adversarial conditions.

Experimental results

Research questions

• RQ1 Can a single-server federated learning system simultaneously achieve Byzantine resilience and strong user privacy?
• RQ2 How can secure aggregation be combined with outlier detection without exposing individual model updates to the server?
• RQ3 What is the fundamental trade-off between the number of tolerated Byzantine users, user dropouts, and privacy protection?
• RQ4 How does the system perform under non-i.i.d. data distributions and varying levels of adversarial influence?
• RQ5 Can the framework maintain convergence and accuracy comparable to standard federated learning under adversarial conditions?

Key findings

• BREA achieves test accuracy comparable to FedAvg on MNIST with non-i.i.d. data, even when 20% of users are Byzantine.
• On CIFAR-10, BREA maintains accuracy comparable to FedAvg with no Byzantine users, even under 30% Byzantine users.
• The framework provides theoretical convergence guarantees under stochastic gradient descent with bounded quantization error.
• The use of geometric median-based outlier detection in plaintext is more communication-efficient than secure coordinate-wise median protocols.
• Stochastic quantization reduces the variance of model updates, with performance improving as the quantization parameter q increases.
• The system tolerates up to A Byzantine users and N−A honest users, with privacy preserved via additive secret sharing and verifiable consistency checks.