Shielding Federated Learning: Robust Aggregation with Adaptive Client Selection

1 Introduction

Federated learning (FL) [McMahan et al., 2017] is a newly emerging machine learning paradigm that aims to train a shared global model on decentralized data with user's privacy guarantee. A FL system consists of a central server and multiple clients. The clients do not share their raw data with the central server, instead, each client trains a local model via fine-tuning the global model over its local data set and then sends the local model update (i.e., the difference between local model and the global model) to the server. The server aggregates all the local updates to obtain a new global model and shares it with the clients for next iteration. FL could not only construct a model with high accuracy but also address the privacy concerns, thus drawing extensive research attention recently.

∗Corresponding Author

However, FL is susceptible to Byzantine attacks from malicious clients due to the distributed nature. For example, attackers can upload poisoned local updates via contaminating the training data (i.e., data poisoning attacks [Bagdasaryan et al., 2020; Tolpegin et al., 2020]) or tampering with the local model updates directly (i.e., model poisoning attacks [Baruch et al., 2019; Shejwalkar and Houmansadr, 2021; Fang et al., 2020]), in order to damage the global model or even leave a backdoor.

To mitigate Byzantine attacks, plenty of defensive schemes have been proposed. Their key ideas include eliminating updates that are far from the overall distribution through similarity detection [Blanchard et al., 2017; Xia et al., 2019], circumventing the malicious parameters through statistical characteristics [Yin et al., 2018; Xie et al., 2018; 2019a], detecting outliers based on the extracted features of updates [Tolpegin et al., 2020; Shejwalkar and Houmansadr, 2021], relying a clean dataset to detect abnormality [Xie et al., 2019b; Cao et al., 2021], and directly clipping the local updates with large magnitudes [Karimireddy et al., 2021].

Albeit tremendous in types, all the existing defenses suffer from one or multiple limitations as follows. Firstly, they paid little attention to the client selection step. In each iteration, the server is set to randomly select a subset of clients [Cao et al., 2021] or simply choose all of them to participate in the aggregation [Blanchard et al., 2017; Xia et al., 2019; Karimireddy et al., 2021]. Second, they cannot effectively defend against sybil attacks, in which all the malicious updates are similar or even identical [Baruch et al., 2019; Shejwalkar and Houmansadr, 2021; Fang et al., 2020]. Third, they perform badly in non-IID (independently identically distribution) scenarios, where all the updates are dramatically different from each other [Cao et al., 2021; Prakash and Avestimehr, 2020]. Lastly, they assume that the server holds a validation dataset that has the same distribution with the training set of clients [Cao et al., 2021; Xie et al., 2019b; Prakash and Avestimehr, 2020], which obviously violates the privacy requirements of FL.

To address these issues, we propose a new multi-armed bandit based robust FL scheme, named MAB-RFL. Our scheme models the client selection process in federated learning as an extended MAB problem enabling the server to adaptively select updates that are more likely to be benign. Before applying existing MAB solutions to FL, there are two key challenges needed to be addressed. First, in standard MAB problem, only one arm is chosen at each time step, however, in FL scenarios, a mass of clients are selected to guarantee the high accuracy of the global model. Inspired by the Thompson sampling [Agrawal and Goyal, 2012], we propose an adaptive client selection strategy to decide the current round participants. Second, in the standard MAB scenario, the reward for each decision comes from the slot machine directly once an arm is played. Nevertheless, in FL the server has no idea how to evaluate each decision of client selection. Therefore, we propose two approaches to identify malicious updates from different attacks (i.e., sybil and non-sybil), based on which rewards can be easily computed. Note that MAB methods have been applied in FL in other works, but they focus on reducing communication overheads [Cho et al., 2020] or constructing high-quality models [Huang et al., 2020], it is still unclear how to apply MAB algorithms to detect Byzantine attacks.

In summary, we make the following contributions:

• We model the client selection in Byzantine settings as a MAB problem and propose a novel adaptive client selection strategy, enabling the server to rationally select participants that are more likely to be honest and useful.
• We propose two new solutions to identify malicious clients from sybil and non-sybil attacks, such that the rewards for client selection decisions can be accurately evaluated to discourage misbehaviour.
• We conduct extensive experiments to evaluate MABRFL. The results show that the proposed scheme is effective for three attack scenarios under different percentages of attackers.

2 Background

2.1 Federated Learning

We consider a general FL system, consisting of a central server and K clients. Each client k (k = 1, 2, ...,K) has a dataset Dk, the size of which is denoted as |Dk| = nk. It is worth noting that each local dataset may be subject to a different distribution, that is, the clients' data may be distributed in a non-IID way. The clients aim to collaboratively train a shared global model w. Apparently, the problem can be solved via minimizing the empirical loss, i.e., argminw f(D,w), where D = ⋃Kk=1 Dk and f(D,w) is a loss function (e.g., mean absolute error, cross-entropy). However, the optimization requires all the clients to share their raw data to a central server, which would result in a serious threat to client's privacy. Instead, FL obtains w by optimizing argminw ∑kk=1 f(Dk,w). Specifically, the FL system iteratively performs the following three steps until the global model converges:

• Step I: In the t-th iteration, the central server broadcasts a global model wt to the clients;
• Step II: After receiving wt, each client k trains a new local model wk t over Dk by solving the optimization problem arg minwk t f(Dk,wk t ) and then uploads the local model update gk t := wk t -wt to the server;
• Step III: The server aggregates all the local updates according to client's proportional dataset size as follow:

2.2 Multi-Armed Bandit Problem and Thompson Sampling

The multi-armed bandit (MAB) problem is a classical framework which studies the exploration/exploitation trade-off in sequential decision problems. Specifically, assuming that we are given a slot machine with K arms, at each time step t = 1, 2, 3, ..., T , we play an arm k(t) ∈ {1, 2, ...,K} and observe the corresponding reward Rk(t). In this work we consider the Bernoulli bandit, i.e., Rk(t) is either 0 or 1. The MAB aims to minimize the expected total regret over T rounds, where the regret is the amount we lose because of not playing optimal arm in each round. Formally, the T period expected cumulative regret is given by:

where k∗ denotes the best arm (i.e., Rk∗ = maxk Rk). The Thompson sampling algorithm [Agrawal and Goyal, 2012] is a popular solution to the MAB problem which models the mean reward of each arm using a Beta distribution and then chooses the arm with the largest mean reward.

Alg. 1 provides the details of Thompson sampling for the Bernoulli bandit. Note that Sk and Fk denote the number of successes and failures outcome of the arm k respectively, and both of them are initialized to 1, because Beta(1, 1) is the uniform distribution on (0, 1), which means that each arm has the same probability of being chosen at the beginning.

3 Problem Setup

3.1 AttackModel

We employ a similar attack model in previous works [Cao et al., 2021; Prakash and Avestimehr, 2020]. To be specific, an adversary controls several clients (less than half of all participants), and it can poison the local data and updates of the controlled clients arbitrarily. However, the central server and benign clients are not under the control of the adversary. The

Algorithm 1 Thompson sampling for the Bernoulli bandit

• Rk and observe reward

1: for k = 1, 2, ...,K do 2: Sk =← 1, Fk ← 1. 3: end for 4: for t = 1, 2, ..., T do 5: for k = 1, 2, ..., K do 6: Draw ˆ Rk according to Beta(Sk, Fk). 7: end for 8: Draw arm k(t) ← argmaxk ˆ Rk(t) . 9: if Rk(t) = 1 then 10: Sk(t) ← Sk(t) + 1. 11: else 12: Fk(t) ←Fk(t) +1. 13: end if 14: end for

only way the adversary can degrade the performance of the global model is by uploading poisoned local updates through compromised clients. We consider three kinds of attacks according to the adversary's knowledge about the FL system:

Agnostic attack: the adversary knows neither benign updates nor the aggregation algorithm.

Partial knowledge attack: the adversary only has the knowledge of benign updates.

Full knowledge attack: the adversary knows both benign updates and aggregation algorithm.

Although the agnostic attack is the weakest type, it is the most realistic attack. Partial knowledge attack and full knowledge attack are too powerful to be applied in practice, but they have been widely investigated in previous studies [Cao et al., 2021; Shejwalkar and Houmansadr, 2021; Karimireddy et al., 2021; Mhamdi et al., 2021] to fully understand the threats of Byzantine attacks.

3.2 Defense Model

Our defense is deployed on the central server, and does not require any privacy information about participants. Specifically, the central server does not access the raw local training data, and is unknown about the number of compromised clients and even the training dataset size of each client. Our defense is expected to achieve the following three goals simultaneously:

• Rationality. The method should avoid choosing clients who continually uploaded low-quality updates in previous iterations. Note that the low-quality updates may be caused by adversary's meticulous design [Shejwalkar and Houmansadr, 2021; Fang et al., 2020] or benign participants' poor training data [Wan et al., 2021].
• Robustness. The method should prevent malicious updates from degrading the accuracy or the convergence rate of the global model in all kinds of attack scenarios, i.e., the agnostic attack, the partial knowledge attack, and the full knowledge attack.
• Fidelity. The method should not incur a drop in nonadversarial scenarios. In other words, the defense should be as accurate as FedAvg when there is no attack.

To the best of our knowledge, none of existing Byzantinerobust schemes satisfy the rationality goal. They sample either a random subset of clients or all participants in each iteration. Besides, some schemes such as Krum, Median, FABA, and Centered Clip (CC) violate the robustness goal, because they perform poorly in full-knowledge settings. Moreover, Krum does not satisfy the fidelity goal.

4 MAB-RFL: Multi-Armed Bandit Based Robust Federated Learning

4.1 Motivation Behind Rational Client Selection

After reviewing the existing defenses against Byzantine attacks in FL, we find that they choose either all clients [Xia et al., 2019; Blanchard et al., 2017; Karimireddy et al., 2021] or a random subset of them [Cao et al., 2021]. This irrational client selection strategy may continually select malicious clients to participate in the aggregation, even after they have been identified in previous iterations, leading to a slow convergence and a waste of communication and computation resources. Fig. 1(a) gives a toy example. We consider a FL system containing 50 clients, among which 15 are malicious, and 10 clients will be selected at each iteration. Random sampling A randomly selects 10 clients and aggregates all the updates directly. Random sampling B also randomly selects 10 clients but discards all the malicious updates before aggregation. Rational sampling samples 10 benign clients and aggregates all the updates directly. The results show that random sampling B converges slower and the accuracy of the final global model is about 5% lower compared with the rational sampling. Therefore, a rational server should always choose honest clients who are more likely to submit high-quality updates.

4.2 AComplete Description of MAB-RFL

Alg. 2 shows our complete MAB-RFL scheme. In Step I (Lines 2-4), the server adaptively selects clients and broadcasts the current global model to the clients. In Step II (Lines 5-11), the server identifies sybil updates (Lines 5-8) as well as non-sybil but malicious updates (Lines 9-11). In Step III (Lines 12-14), the server assigns reward to each selected client. In Step IV (Lines 15-19), the server updates the global model based on the normalized momentum vectors of the remaining clients. Note that we set the learning rate as the average of the magnitudes of all the left updates (Line 16) to make

Algorithm 2 A Complete Description of MAB-RFL

Input: K clients; estimated maximum cosine similarity cmax and minimum cosine similarity cmin; importance of historical information λ; acceptable difference between clusters α.

Output: Global model wt+1.

• 1: Initialization: Bk ← 1,Mk ← 1, ∀k ∈ [K].
• 2: //Step I: Select reliable clients.
• 3: Lselected ← ACS({Bk, k ∈ [K]}, {Mk, k ∈ [K]})
• 4: Broadcast the current global model wt to the clients in Lselected and gather the corresponding local updates g = {gk, k ∈ Lselected}.
• 5: //Step II: Identify sybil attacks.
• 6: Lsybil ← ISA(Lselected, g).
• 7: Lselected ←Lselected -Lsybil.
• 8: g ← {gk, k ∈ Lselected}.
• 9: //Step II: Identify non-sybil attacks.
• 10: Lnsybil ← INSA(Lselected, g).
• 11: Lselected ←Lselected -Lnsybil.
• 12: //Step III: Distribute rewards.
• 13: Mk ← Mk + 1, ∀k ∈ Lsybil ∪ Lnsybil.
• 14: Bk ← Bk + 1, ∀k ∈ Lselected.
• 15: //Step IV: Aggregate updates.
• 16: Calculate the learning rate: ηt ← Mean({||gk||, k ∈ Lselected}).
• 17: Calculate the normalized momentum vectors:

mm ← {mkt , k ∈ Lselected} through Eq. (5) and Eq. (6).

• 18: wt+1 ←wt + ηt · Mean(mm).
• 19: return wt+1

up for the slow or fast learning caused by the normalization. Next, we present details for the first three steps.

4.3 Adaptive Client Selection

In the standard Thompson sampling algorithm, only the arm with the maximal mean reward (estimated by a Beta distribution) will be played at each time step. An intuitive idea for extending it to FL is to select clients with top-m (m is the number of benign clients) mean rewards. However, it relies on the assumption that the number of benign clients is fixed and known to the server. This assumption is unrealistic since FL is a dynamic distributed network where honest and compromised clients can drop out arbitrarily.

To get rid of the dependence on m, we propose selecting each client with a changing probability (i.e., the probability varies with each client's past performance, rather than using a fixed probability) as shown in Alg. 3. Specifically, we set the probability of each client k being selected to be pk, which is drawn from Beta(Bk, Mk) distribution (Lines 1-4). Here Bk and Mk denote the frequency that the local updates from client k are identified as benign and malicious (through our methods described in Section 4.4), respectively. Initially, we set Bk = Mk = 1. If none of the clients are selected in a round, we will randomly choose a subset of clients (Lines 5-8).

This method can achieve a well balance between exploration and exploitation. A client who consistently uploads benign updates (i.e., a large Bk and a small Mk) will obtain a large pk from Beta(Bk, Mk), and it is easier to be selected

Algorithm 3 ACS (Adaptive Client Selection)

Input: The frequencies that the local updates from each client k ∈ [K] are regarded as benign Bk and malicious Mk.

Output: The selected clients list Lselected.

• 1: for k = 1, 2, ...,K do
• 2: pk ←Beta(Bk,Mk).
• 3: Add k to the selected clients list Lselected at the probability pk.
• 4: end for
• 5: if Lselected = ∅ then
• 6: Assign a random nonempty subset of [K] to Lselected.
• 7: end if
• 8: return Lselected

Algorithm 4 ISA (Identifying Sybil Attacks)

Input: The selected clients list Lselected and the corresponding local updates {gk, k ∈ Lselected}.

Output: Rejected clients list Lsybil.

• 1: Construct a graph G = (V, E), where the vertex set V = Lselected, and the edge set E is obtained through Eq. (3).
• 2: Assign the maximal connected subgraph of G to G′ = (V ′ , E′ ).
• 3: Lsybil ← V ′ .
• 4: return Lsybil

(exploitation), while a rarely selected client (i.e., both Bk and Mk are small) may also get a large pk (exploration), because the Beta distribution has a large variance when the parameters are small.

4.4 Abnormal Clients Identification

Identifying Sybil Attacks. Sybil attack is a recently proposed special Byzantine attack method [Fung et al., 2020], where all the compromised clients upload totally identical local updates to launch covert attacks. This kind of attack poses a significant threat to existing defenses because existing defenses assume that benign updates are much similar and discard updates that are far from the overall distribution.

Before presenting our defensive method against sybil attacks, we introduce a basic fact that has been long misunderstood in the literature. In FL, the similarity between benign updates is as high as we expected when we use Euclidean distance as the evaluation metric. If we use cosine similarity as the evaluation metric, however, the benign updates have low similarity even in IID setting. This phenomenon is also observed by our experiments shown in Fig. 1(b), where the training data among clients are IID and each client has the same dataset size. We can see that after several iterations, the maximum cosine similarity reduces sharply to 0 (indicating a larger dissimilarity), while the Euclidean distances (computed after normalization) get smaller (indicating a larger similarity). We owe this phenomenon to the fact that when the model converges, benign gradients will gradually become zero, thus making their cosine similarities close to zero.

Based on the findings above, we propose mitigating sybil attacks by using undirected graph. Specifically, we regard

𝑠𝑠𝑠𝑠𝑠𝑠𝑠𝑠𝑠𝑠 attack 𝑑𝑑𝑑𝑑𝑑𝑑𝑑𝑑𝑑𝑑𝑑𝑑𝑑𝑑𝑑𝑑𝑑𝑑 𝑝𝑝𝑝𝑝𝑝𝑝𝑝𝑝

Algorithm 5 INSA (Indentifying Non-Sybil Attacks)

Input: The selected clients list Lselected and the corresponding local updates {gk, k ∈ Lselected}.

Output: Rejected clients list Lnsybil.

• 1: for all k ∈ Lselected do
• 2: Calculate the momentum vector mkt according to Eq. (5) and normalize mkt to be mkt through Eq. (6).
• 3: end for
• 4: Extract the key features of each mkt by PCA.
• 5: Divide Lselected into a larger cluster Cl and a smaller cluster Cs by applying agglomerative clustering algorithm to the key features.
• 6: Calculate the mean momentum vector of each cluster: ml ← Mean({mkt , k ∈ Cl}); ms ← Mean({mkt , k ∈ Cs}).
• 7: if cos(ml,ms)>α then
• 8: Lnsybil ← ∅.
• 9: else
• 10: Lnsybil ←Cs.
• 11: end if
• 12: return Lnsybil

each uploaded local update as a vertex and construct a graph G = (V, E) through the following rule: if two updates are too similar in direction (in terms of cosine similarity), an undirected edge will be added. Formally, an undirected edge is added between vertex j and k if and only if the updates gj t and gk t satisfy the following property:

where cos denotes the cosine similarity, cmax and cmin (-1 < cmin < cmax < 1) represent the estimated maximum and minimum cosine similarities, and t is the current iteration. Note that the tolerable cosine similarity (right of the above inequality) decreases as iterations go on, which indicates that it is harder for the adversary to launch covert sybil attack.

After constructing the graph, the updates (vertexes) in the maximal connected subgraph G′ = (V ′ ,E′ ) of G will be considered as malicious ones. Fig. 2 gives a simple illustration for this process and Alg. 4 shows the details.

Identifying Non-sybil Attacks. In non-sybil settings where malicious updates obviously differ from each other, it becomes difficult to identify them. A pivotal reason for the difficulty lies in the extremely high dimension of local models, which contains deciding features as well as redundant features that will mask the differences between benign and malicious updates. Moreover, the non-IID property of FL naturally incurs disparity among benign updates, making it more difficult to find out abnormal ones. In light of this, we propose squeezing the feature space before filtering out updates. In order to counter the non-IID issue, we further make use of Momentum [Mhamdi et al., 2021] to reduce the variance between updates such that an IID-like setting can be built. Specifically, our approach contains three steps as shown in Alg. 5: 1) calculating the momentum vector of each client (Lines 1-3); 2) using principal component analysis (PCA) to extract the key features of each momentum vector (Line 4); 3) applying agglomerative clustering algorithm to divide the momentum vectors and choosing the appropriate vectors for aggregation (Lines 5-12).

Traditionally, the momentum vector of client k at iteration t is given by:

where λ ∈ (0, 1) indicates the importance of historical information, gk t is the local update, and the initial momentummk0 is generally set to be 0. Nevertheless, it is not suitable for our case because clients are not selected continuously in FL. We thus slightly revise the momentum vector calculation as:

where tk is the latest iteration when client k is selected. The intuition behind Eq. (5) is that the historical information mktk of a chronically unselected client is obsolete, thus multiplied by a smaller discount factor. Note that Eq. (5) and Eq. (4) are equivalent without using client selection strategy (i.e., tk = t - 1).

Besides, attackers may upload updates with large magnitudes to dominate the global update. We thus normalize the momentum vector as:

This step ensures that a single malicious update has limited impact on the aggregated global update even though it could circumvent the detection.

In order to prevent MAB-RFL from discarding updates excessively, we set a threshold α to determine if all the momentum vectors will be used for aggregation (Lines 7-9).

4.5 Reward DistributionMechanism

A correct reward distribution mechanism is important for MAB-RFL to reduce the possibility of selecting abnormal clients in subsequent iterations. As shown in Alg. 2, after identifying abnormal clients who conduct sybil and nonsybil attacks, they will get a reward 0 (i.e., Mk ← Mk + 1, Line 13) and be discarded in the current round (Line 7 and Line 11). The remaining selected clients get a reward 1 (i.e., Bk ← Bk + 1, Line 14) and their updates are used for final aggregation (Lines 15-19).

5 Experiments

5.1 Experimental Setup

Datasets and Models. We evaluate MAB-RFL on MNIST and CIFAR-10. For MNIST, we use a convolutional neural network (CNN) with 2 convolutional layers followed by 2 fully connected layers as the global model. For CIFAR10, we employ a simplified version of VGG16 as the global model.

Data Distribution. Following previous works [Cao et al., 2021; Shejwalkar and Houmansadr, 2021], we assign each client a random dominated label l. Then each training sample with label l is distributed to the client with probability q ∈ [0, 1] and any other label with probability 1-q L-1 , where L is the total kinds of labels and q is the non-IID degree. A larger q indicates a higher degree of non-IID. Note that q = 1L corresponds to the IID scenario. In our experiments, we set q = 0.5 by default, which is the highest non-IID degree existing works considered. We assign different training set sizes for clients. Specifically, the training set size of each client is randomly chosen from 10 to 500 for MNIST and from 1200 to 2000 for CIFAR-10.

Evaluated Attacks. We consider label flipping (LF) attack [Tolpegin et al., 2020], little is enough (LIE) attack [Baruch et al., 2019], and AGR-tailored (AGRT) attack [Shejwalkar and Houmansadr, 2021], which belong to agnostic attack, partial knowledge attack, and full knowledge attack, respectively.

LF attack. For each controlled client, the adversary flips the local sample labels to generate misleading update. Specifically, the adversary flips the label l of each training sample to L - l - 1, where L is the the number of classes in the classification problem and l = 0, 1, . . . , L - 1.

LIE attack. The adversary first estimates coordinate-wise mean µj and deviation σj through benign updates. Then the malicious update ˜ g can be crafted as follow:

where d is the total dimension of model update, and the positive attack factor zmax determines the amount of noise added. A large zmax makes the constructed update harmful to the global model but easy to be detected by the central server, while a small one is covert but less baleful. The original paper [Baruch et al., 2019] advises that zmax can be obtained by the Cumulative Standard Normal Function ϕ(z):

Note that all the controlled clients upload identical malicious update ˜ g to the central server, making the attack inconspicuous.

AGRT attack. AGRT attack aims to maximize the damage to the global model in each FL iteration in an optimized manner. Formally, the adversary performs the following optimization problem to construct malicious updates:

where A is the known defense method (i.e., Krum) applied by the central server, g{i∈[m]} are the benign updates that the adversary knows (without loss of generality, we assume the first m clients are benign and the rest are controlled by the adversary), ˆ g is a reference benign aggregation obtained by FedAvg [McMahan et al., 2017] that averages all the benign updates that the adversary knows, ˜∆ is a perturbation vector, γ is a scaling coefficient, ˜ g{i∈[m+1,K]} are the final malicious updates.

It is worth noting that the above optimization incurs totally identical malicious updates for all controlled clients, thus MAB-RFL can easily discard all the malicious updates through Alg. 4. Nevertheless, considering that the adversary has the knowledge of the defense scheme in advance, we set the updates for half of the controlled clients to ˜ g and the other half to be the same as any benign update. This ensures that half of the malicious updates can circumvent the sybil detection and that one benign update is removed.

Evaluated Defenses. We compare MAB-RFL with three classical defenses, i.e., Krum [Blanchard et al., 2017], FABA [Xia et al., 2019], and Median [Yin et al., 2018], as well as two newly proposed defenses, i.e., DnC [Shejwalkar and Houmansadr, 2021] and Centered Clip (CC) [Karimireddy et al., 2021].

Krum. Krum calculates the Euclidean distance between any two local gradients and selects the one that is closest to the m - 2 neighboring local gradients.

FABA. FABA removes the local update that is farthest from the average of the local updates repeatedly until the number of eliminated updates reaches a predefined threshold.

Median. Median directly takes the coordinate-wise median value in each dimension of all local updates as the new global update.

DnC. DnC leverages singular value decomposition (SVD) to extract the common features between benign and poisoned updates, and randomly samples a subset of parameters of each local update as its substitution, which will be projected along their top right singular eigenvector. Then an outlier score is obtained by computing the inner product of substitution and the projection, and the K -m local updates with the highest scores will be removed.

CC. CC clips the local updates with large magnitudes, with the intuition that attackers may upload such updates to dominate the global model.

Evaluation Metrics and Parameter Setting. We use accuracy, which is the proportion of correctly predicted testing samples to total testing samples, to evaluate the final global model. We set the number of clients K = 50 for both datasets. To reduce the total communication rounds between clients and the server, we set the local epoch of each client to be 3. The total iteration T = 100. The importance of historical information λ = 0.1. For MNIST, we set the estimated maximum cosine similarity cmax = 0.7, minimum cosine similarity cmin = 0.3, and the acceptable difference between clusters α = -0.1. For CIFAR-10, we set cmax = 0.3, cmin = 0.1, α = 0. For AGRT attack, we choose ˜∆ as -std (g{i∈[m]} ), i.e., the inverse standard deviation.

Comparison with the Existing Defenses. MAB-RFL achieves the three defense goals as shown in Table 1.

Rationality: MAB-RFL performs sampling with a more sophisticated method (i.e., rational sampling ) than the naive methods used in previous works, which improves the probability of selecting benign clients. The toy example in section 4.1 well justifies this.

Robustness: MAB-RFL achieves the robustness objective, i.e., shielding FL from adversaries. As shown in Table 1, MAB-RFL outperforms the existing defenses on three strong attacks over two non-IID dataset. For instance, in CIFAR-10, all the attacks pose no impact on MAB-RFL.

Fidelity: The accuracy of MAB-RFL under all attacks is always comparable to that of baseline (i.e., FedAvg) on two datasets, while the accuracy of Krum and Median are reducted even without attackers, which reflects that MAB-RFL is applicable for non-adversarial scenarios.

Impact of the Percentage of Attackers. Fig. 3, Fig. 4, and Fig. 5 show that MAB-RFL always performs better or similar compared with state-of-the-art defenses in all settings. CC, FABA, and Median perform slightly worse than MAB-RFL when there are no more than 30% attackers, however, their accuracy drops dramatically with 40% attackers. DnC performs much better, but its accuracy drops obviously when there are nearly 50% attackers.

6 Conclusion

We propose a new robust federated learning scheme to make the server perform rational client selection decisions. Two approaches are designed to identify malicious updates from sybil and non-sybil attacks, based on which rewards for each client selection decision can be accurately evaluated. Extensive experimental results show that MAB-RFL outperforms existing defenses.

Acknowledgments

Shengshan's work is supported in part by the National Natural Science Foundation of China (Grant No. U20A20177). Leo's work is supported in part by the National Natural Science Foundation of China (Grant No. 61702221). Yuanyuan's work is supported in part by the National Natural Science Foundation of China (Grant No. 62002127).