[Paper Review] Byzantine-Robust Federated Machine Learning through Adaptive Model Averaging

Luis Muñoz-González, Kenneth T. Co+1 more|arXiv (Cornell University)|Sep 11, 2019

Privacy-Preserving Technologies in Data25 references161 citations

TL;DR

Adaptive Federated Averaging (AFA) robustly aggregates client updates in federated learning by estimating each client’s update quality with a Hidden Markov Model and a cosine similarity-based filtering, blocking bad clients to improve robustness and efficiency.

ABSTRACT

Federated learning enables training collaborative machine learning models at scale with many participants whilst preserving the privacy of their datasets. Standard federated learning techniques are vulnerable to Byzantine failures, biased local datasets, and poisoning attacks. In this paper we introduce Adaptive Federated Averaging, a novel algorithm for robust federated learning that is designed to detect failures, attacks, and bad updates provided by participants in a collaborative model. We propose a Hidden Markov Model to model and learn the quality of model updates provided by each participant during training. In contrast to existing robust federated learning schemes, we propose a robust aggregation rule that detects and discards bad or malicious local model updates at each training iteration. This includes a mechanism that blocks unwanted participants, which also increases the computational and communication efficiency. Our experimental evaluation on 4 real datasets show that our algorithm is significantly more robust to faulty, noisy and malicious participants, whilst being computationally more efficient than other state-of-the-art robust federated learning methods such as Multi-KRUM and coordinate-wise median.

Motivation & Objective

• Motivate robust federated learning that remains effective under Byzantine faults and data heterogeneity.
• Propose Adaptive Federated Averaging (AFA) that weighs client updates by estimated quality and data contribution.
• Develop a Bayesian/Hidden Markov Model framework to learn and update the probability that a client provides good updates.
• Introduce a robust aggregation rule that detects and discards bad updates and can block offending clients.
• Evaluate AFA against state-of-the-art methods on multiple real datasets under diverse attack scenarios.

Proposed method

• Aggregate updates using a weighted scheme where weights include both data contribution and a learned probability of good updates (p_k).
• Compute w_{t+1} as a weighted sum over selected good clients, normalized by N = sum(p_k n_k).
• For each client, compute similarity s_k between w_{t+1} and w_{t+1}^k (e.g., cosine similarity).
• Use sample statistics (mean, median, std) of s_k to classify updates as good/bad with a threshold controlled by xi, updated iteratively (xi increments).
• Repeat (potentially multiple passes) to block suspicious clients and re-aggregate using only the good set G.
• Model client quality with a Hidden Markov Model where g_t^k is the (unobserved) quality state and o_t^k are observed outcomes of the aggregation rule; update posteriors and set p_{k,t} = E[G_t^k | O_{1:t}^k].
• Block a client when Pr(G_t^k | O_{1:t}^k) ≤ 0.5 with Beta-Bernoulli updates (alpha_t^k, beta_t^k) and threshold delta.
• Complexity: O(K_t d) for aggregation with cosine similarity, lower than O(K_t^2 d) for MKRUM and more scalable than some median-based methods.
• Experimentally validate on MNIST, FMNIST, Spambase, CIFAR-10 with normal, Byzantine, label-flipping, and noisy client scenarios, comparing against FA, MKRUM, and COMED.

Experimental results

Research questions

• RQ1 How can federated learning remain robust when a subset of clients provides faulty, noisy, or malicious updates?
• RQ2 Can an adaptive weighting scheme that accounts for both data contribution and update quality improve robustness without excessive computation or communication?
• RQ3 Does a Hidden Markov Model-based estimation of client update quality effectively identify and block bad clients in real-time?
• RQ4 How does AFA compare to existing robust aggregation rules (MKRUM, COMED) in terms of accuracy, convergence, and efficiency under various attack scenarios?

Key findings

• AFA achieves robust performance across four real datasets under Byzantine, label-flipping, and noisy client scenarios, often outperforming MKRUM and COMED.
• AFA converges faster and maintains lower test error in adverse conditions while incurring lower or comparable computational overhead to MKRUM and COMED.
• The Bayesian model can detect and block bad clients within a relatively small number of iterations (often around 5–10), reducing communication.
• Compared to standard Federated Averaging (FA), AFA remains robust to malicious inputs, especially under flipping and Byzantine attacks, with improved stability and accuracy.
• Blocking bad clients reduces unnecessary communication and can lower server-side computation when malicious nodes are pruned.
• AFA shows significant efficiency gains over MKRUM and COMED in aggregation time while maintaining strong robustness.