Privacy-Preserving Average Consensus via State Decomposition

TL;DR

This paper introduces a privacy-preserving average consensus method that uses state decomposition, allowing nodes to keep their initial states private while still achieving exact consensus without accuracy loss.

Contribution

A novel state decomposition approach for privacy-preserving average consensus that guarantees exact convergence and protects against internal and external inference.

Findings

Guarantees exact consensus value without error.

Prevents disclosure of initial states to neighbors.

Protects against external eavesdroppers.

Abstract

Average consensus underpins key functionalities of distributed systems ranging from distributed information fusion, decision-making, distributed optimization, to load balancing and decentralized control. Existing distributed average consensus algorithms require each node to exchange and disclose state information to its neighbors, which is undesirable in cases where the state is private or contains sensitive information. In this paper, we propose a novel approach that avoids disclosing individual state information in average consensus by letting each node decompose its state into two sub-states. For each node, one of the two sub-states involves in computation and inter-node interactions as if it were the original state, while the other sub-state interacts only with the first sub-state of the same node, being completely invisible to other nodes. The initial values of the two sub-states are chosen randomly but with their mean fixed to the initial value of the original state, which is key to guarantee convergence to the desired consensus value. In direct contrast to differential-privacy based privacy-preserving average-consensus approaches which enable privacy by compromising accuracy in the consensus value, the proposed approach can guarantee convergence to the \emph{exact} desired value without any error. Not only is the proposed approach able to prevent the disclosure of a node's initial state to honest-but-curious neighbors, it can also provide protection against inference by external eavesdroppers able to wiretap communication links. Numerical simulations demonstrate the effectiveness of the approach and its advantages over state-of-the-art counterparts.

Equations

$$x_i[k+1]=x_i[k]+\epsilon \sum _{v_j\in N_i}{a}_{ij}[k](x_j[k]-x_i[k])$$

$$\Delta \triangleq \underset{i=1,2,\cdots ,M}{\max }|N_i|$$

$$\{\begin{array}{rl}{x}_i^{\alpha }[k+1]& =x_i^{\alpha }[k]+\epsilon \sum _{v_j\in N_i}{a}_{ij}[k](x_j^{\alpha }[k]-x_i^{\alpha }[k])\\ & +\epsilon a_{i,\alpha \beta }[k](x_i^{\beta }[k]-x_i^{\alpha }[k])\\ x_i^{\beta }[k+1]& =x_i^{\beta }[k]+\epsilon a_{i,\alpha \beta }[k](x_i^{\alpha }[k]-x_i^{\beta }[k])\end{array}$$

$$\underset{k\to \infty }{\lim }{x}_i^{\alpha }[k]=\underset{k\to \infty }{\lim }{x}_i^{\beta }[k]=\frac{1}{M}\sum _{j=1}^M{x}_j[0]$$

$$\frac{1}{2M}\sum _{j=1}^M(x_j^{\alpha }[0]+x_j^{\beta }[0])=\frac{1}{2M}\sum _{j=1}^M(x_j^{\alpha }[1]+x_j^{\beta }[1])$$

$${\bar{x}}_m[0]$$

$${\bar{x}}_j^{\alpha }[0]$$

$${\bar{x}}_m^{\alpha }[0]$$

$${\bar{x}}_q[0]$$

$$\forall v_q\in \mathcal{V}\setminus \{v_j,v_m\}$$

$${\bar{a}}_{j,\alpha \beta }[0]$$

$${\bar{a}}_{m,\alpha \beta }[0]$$

$${\bar{a}}_{jm}[0]$$

$${\bar{a}}_{j,\alpha \beta }[k]$$

$${\bar{a}}_{m,\alpha \beta }[k]$$

$${\bar{a}}_{jm}[k]$$

$${\bar{a}}_{q,\alpha \beta }[k]$$

$${\bar{a}}_{pq}[k]$$

$$k=0,1,2\cdots$$

$$A=0.75\left[\begin{array}{ccccc}0& 1& 0& 0& 1\\ 1& 0& 1& 0& 0\\ 0& 1& 0& 0& 1\\ 0& 0& 0& 0& 1\\ 1& 0& 1& 1& 0\end{array}\right]$$

$$z[k+1]$$

$$-\left(x_1^{+}[k]+\epsilon \sum _{v_j\in N_1}{a}_{1j}(x_j^{+}[k]-x_1^{+}[k])\right)$$

Full text

I Introduction

As a building block of distributed computing, average consensus has been an active research topic in computer science and optimization for decades [1, 2]. In recent years, with the advances of wireless communications and embedded systems, particularly the advent of wireless sensor networks and the Internet-of-Things, average consensus is finding increased applications in fields as diverse as automatic control, signal processing, social sciences, robotics, and optimization [3].

Conventional average consensus approaches rely on the exchange of explicit state values among neighboring nodes to reach agreement on distributed computation. Such a disclosure of state information has two potential problems. First, it breaches the privacy of participating nodes who may not want to disclose their state values containing sensitive and private information. For example, a group of individuals using average consensus to compute a common opinion may want to keep each individual’s opinion secret [4]. Another example is power systems where multiple generators want to reach agreement on cost while keeping their individual generation information private since the generation information is sensitive in bidding the right for energy selling [5]. Secondly, exchanging information through wireless or wired communications is vulnerable to eavesdroppers which try to steal information by tapping communication links. With the increased number of reported attack events, preserving data privacy has become an urgent need in many social and engineering applications.

To address the pressing need for privacy-preserving average consensus, one may resort to conventional secure multi-party computation approaches such as Yao’s Garbled Circuit [6], Shamir’s Secret Sharing algorithm [7], or many other recent advances [8]. However, such general-purpose privacy protecting approaches are both computationally and communicationally too heavy for systems with fast-evolving behaviors particularly cyber-physical systems which are subject to hard real-time constraints. For example, Yao’s Garbled Circuit has a computational latency on the order of seconds [9], whereas the tolerable computational latency is on the order of milliseconds for the real-time control of connected automated vehicles [10] and unmanned aerial vehicles [11]. Recently, several dedicated privacy-preserving solutions have been proposed for average consensus [12, 13, 14, 15, 16, 17, 18]. Most of these approaches rely on the idea of obfuscation to mask true state values by injecting carefully-designed noise on the states. One commonly used tool is differential privacy from the database literature in computer science [13, 14, 16, 17, 18]. However, obfuscation under differential privacy affects the accuracy of average consensus, preventing convergence to the exact desired value. Another tool emerged recently is the correlated-noise based obfuscation [15, 12], which can guarantee the accuracy of average consensus. Observability based approaches have also been discussed in the dynamics and control community to protect the privacy of multi-agent networks. The basic idea is to design the interaction topology to minimize the observability from a certain node, which amounts to minimizing the node’s ability to infer the initial states of other nodes in the network [19, 20, 21]. However, both the correlated-noise based and the observability based approaches are vulnerable to adversary nodes which are directly connected to a target node as well as all its neighbors [22].

To improve resilience to privacy attacks, another common approach is to employ cryptography. However, although cryptography based approaches can easily enable privacy preservation with the assistance of an aggregator or third-party [23], like in cloud-based control or computation [24, 25, 26], their extension to the completely decentralized average consensus problem in the absence of an aggregator or third-party is extremely hard due to the difficulties in decentralized key management. In fact, to our knowledge, except our recent result [27, 22], existing efforts ([28, 29]) incorporate cryptography into decentralized average consensus without giving participating nodes access to the final consensus value (note that in [29] individual participating nodes do not have access to the decryption key to decrypt the final consensus value which is obtained in the encrypted form, otherwise they will be able to decrypt intermediate computations to access other nodes’ states). Furthermore, cryptography based approaches will also significantly increase communication and computation overhead (please see e.g., [30] for detailed discussions), which is not appropriate for systems with limited resources or systems with fast evolving behaviors or subject to hard real-time constraints.

In this paper, we propose a state-decomposition based approach that can guarantee the privacy of all participating nodes in average consensus without compromising accuracy. Our basic idea is to let each node decompose its state into two sub-states with random initial values. One sub-state succeeds the role of the original state in inter-node interactions while the other sub-state only interacts with the first sub-state in the same node and thus is completely invisible to outside nodes. To ensure consensus to the right average value, the initial values of the two sub-states are randomly chosen but with their mean fixed to the initial value of the original state. Different from existing differential-privacy based approaches which sacrifice accuracy for privacy, our approach can guarantee convergence to the exact average consensus value. Unlike correlated-noise based or observability based approaches which require a node to have at least one neighbor that is not directly connected to the adversary to maintain privacy, our approach can guarantee privacy of a node even when the node and all its neighbors are directly connected to the adversary. Furthermore, the approach is completely decentralized and light-weight in computation, which makes it easily applicable to resource-restricted systems. Numerical simulation results are given to verify the results.

II Background

II-A Average Consensus

We first review the average consensus problem. Following the convention in [3], we represent a network of $M$ nodes as a graph ${G=(V,\,E,\,\mathbf{A})}$ with node set ${V}=\{v_{1},\,v_{2},\,\cdots,v_{M}\}$, edge set ${E}\subset{V}\times{V}$, and the adjacency matrix \mathbf{A}=\big{[}a_{ij}[k]\big{]} denoting coupling weights which satisfy $a_{ij}[k]>0$ if $(v_{i},v_{j})\in E$ and 0 otherwise. Here $k$ is time index, denoting that $a_{ij}[k]$ could be time-varying. The set of neighbors of a node $v_{i}$ is denoted as ${N}_{i}=\left\{v_{j}\in{V}|(v_{i},v_{j})\in{E}\right\}$ and its cardinality is denoted as $|N_{i}|$.

Throughout this paper we make the following assumption:

Assumption 1

We assume that the graph is undirected and connected, i.e., $a_{ij}[k]=a_{ji}[k]$ holds for all $k\geq 0$ and there exists a (multi-hop) path between any pair of nodes.

We represent the state variable of a node $i$ as $x_{i}[k]$. For the sake of simplicity, we assume scalar states. But as commented later in Remark 5, the results are easily extendable to the case where the state is a vector. To achieve average consensus, namely convergence of all states $x_{i}[k]$ $(i=1,2,\cdots,M)$ to the average of initial values, i.e., $\frac{\sum_{i=1}^{M}x_{i}[0]}{M}$, the update rule is formulated as [31]

[TABLE]

where $\varepsilon$ resides in the range $(0,\frac{1}{\Delta}]$ with $\Delta$ defined as

[TABLE]

It has been well known that average consensus can be achieved if the network is connected and there exists some $\eta>0$ such that $\eta<a_{ij}[k]<1$ holds for all $k\geq 0$ [32].

II-B Attack Model

In the paper, we consider two types of adversaries:

An honest-but-curious adversary is a node who follows all protocol steps correctly but is curious and collects received data in an attempt to learn some information about other participating nodes.

An eavesdropper is an external attacker who knows the network topology, and is able to wiretap communication links and access exchanged messages.

Generally speaking, an eavesdropper is more disruptive than an honest-but-curious node in terms of information breaches because it can snoop messages exchanged on many channels whereas the latter can only access the messages destined to it. However, an honest-but-curious node does have one piece of information that is unknown to an external eavesdropper, i.e., the internal initial state $x_{i}[0]$ is available if node $i$ is an honest-but-curious node. We will systematically analyze the enabled privacy strength of our approach against both adversaries.

III Privacy-Preserving Approach

The key idea of our approach is a decomposition mechanism:

Decomposition Mechanism: We let each node decompose its state $x_{i}$ into two sub-states $x_{i}^{\alpha}$ and $x_{i}^{\beta}$, with the initial values $x_{i}^{\alpha}[0]$ and $x_{i}^{\beta}[0]$ randomly chosen from the set of all real numbers under the constraint $x_{i}^{\alpha}[0]+x_{i}^{\beta}[0]=2x_{i}[0]$ (cf. Fig. 1). The sub-state $x_{i}^{\alpha}$ succeeds the role of the original state $x_{i}$ in inter-node interactions and it is in fact the only state value from node $i$ that can be seen by its neighbors. The other sub-state $x_{i}^{\beta}$ also involves in the distributed interaction by (and only by) interacting with $x_{i}^{\alpha}$. So the existence of $x_{i}^{\beta}$ is invisible to neighboring nodes of node $i$, although it directly affects the evolution of $x_{i}^{\alpha}$. Taking node 1 in Fig. 1(b) for example, $x_{1}^{\alpha}$ acts as if it were $x_{1}$ in the inter-node interactions while $x_{1}^{\beta}$ is invisible to nodes other than node $1$, although it affects the evolution of $x_{1}^{\alpha}$. The coupling weight between the two sub-states $x_{i}^{\alpha}$ and $x_{i}^{\beta}$ is symmetric and denoted as $a_{i,\alpha\beta}[k]$. It is a design parameter and will be elaborated later in the Weight Mechanism.

Under the state-decomposition approach, the overall dynamics become

[TABLE]

subject to $x_{i}^{\alpha}[0]+x_{i}^{\beta}[0]=2x_{i}[0]$.

Remark 1

Compared with (1), since every “visible” sub-state’s number of neighbors is increased by 1, the upper bound on $\varepsilon$ is reduced from $\frac{1}{\Delta}$ to $\frac{1}{\Delta+1}$ with $\Delta$ defined in (2).

In conventional average consensus algorithms, the coupling weights are required to be within $(0,\,1)$, which restricts the strength of achievable privacy (as will be clear from the proof of Theorem 2). We introduce the following weight mechanism to enable strong privacy:

Weight Mechanism: For $k=0$, we allow all weights $a_{ij}[0]$ and $a_{i,\alpha\beta}[0]$ to be arbitrarily chosen from the set of all real numbers under the constraint $a_{ij}[0]=a_{ji}[0]$; For $k=1,2,\cdots$, we require that there exists a scalar $0<\eta<1$ such that all nonzero $a_{ij}[k]$ satisfy $\eta\leq a_{ij}[k]<1$ and all $a_{i,\alpha\beta}[k]$ satisfy $\eta\leq a_{i,\alpha\beta}[k]<1$.

In the following, we first prove that under the approach, i.e., the Decomposition Mechanism and the Weight Mechanism, all states $x_{i}^{\alpha}$ and $x_{i}^{\beta}$ will converge to the same average consensus value as in the conventional case (1). Then we rigorously analyze the privacy of participating nodes enabled by the proposed approach in the presence of an eavesdropper or honest-but-curious node.

Theorem 1

Under Assumption 1 and the Weight Mechanism, all sub-states in (3) converge to the average consensus value of (1), i.e.,

[TABLE]

Proof: Under the symmetric weight assumption $a_{ij}[k]=a_{ji}[k]$ and $a_{i,\alpha\beta}[k]$, one can easily obtain that for the network after decomposition, the sum of all sub-states are always time-invariant. Therefore, even the weights are allowed to be arbitrarily chosen from the set of all real numbers for $k=0$, we always have

[TABLE]

Starting from $k=1$, as all coupling weights $a_{ij}[k]=a_{ji}[k]$ compose a connected graph, the Decomposition Mechanism and the Weight Mechanism guarantee that all sub-states also compose a connected graph. According to the result on average consensus under time-varying weights [32], average consensus can still be achieved, i.e., all sub-states $x^{\alpha}_{i}$ and $x^{\beta}_{i}$ will converge to $\frac{1}{2M}\sum_{j=1}^{M}({x^{\alpha}_{j}}[1]+x^{\beta}_{j}[1])$, which is equal to $\frac{1}{2M}\sum_{j=1}^{M}({x^{\alpha}_{j}}[0]+x^{\beta}_{j}[0])$ according to (5). Further making use of the fact $x_{i}^{\alpha}[0]+x_{i}^{\beta}[0]=2x_{i}[0]$ leads to the conclusion that all sub-states converge to $\frac{1}{M}\sum_{j=1}^{M}{x_{j}}[0]$. $\blacksquare$

Remark 2

For the purpose of privacy-preservation, the values of $a_{i,\alpha\beta}[k]$ should be private to node $i$.

Next we rigorously analyze the enabled privacy against an honest-but-curious adversary or an external eavesdropping adversary. To this end, we first give a definition of privacy.

Definition 1

The privacy of the initial value $x_{i}[0]$ of node $i$ is preserved if an adversary cannot estimate the value of $x_{i}[0]$ with any guaranteed accuracy.

Definition 1 requires that an adversary cannot even find a range for a private value and thus is more stringent than the privacy preservation definition considered in [12, 15] which defines privacy preservation as the inability of an adversary to uniquely determine the protected value. Next we show that even by carefully observing a node’s communication for multiple steps, an adversary cannot infer the node’s initial state with any guaranteed accuracy.

Theorem 2

Under the Decomposition Mechanism and the Weight Mechanism, an honest-but-curious node $i$ cannot infer the initial state $x_{j}[0]$ of node $j$ with any guaranteed accuracy if node $j$ has at least one neighboring node $m$ who does not collude with node $i$ to infer $x_{j}[0]$ (cf. Fig. 2 for an illustrative example).

Proof:

To prove that node $i$ cannot estimate $x_{j}[0]$ with any guaranteed accuracy, we show that any arbitrary variation of $x_{j}[0]$ is indistinguishable to node $i$, i.e., the information accessible to node $i$ can be exactly the same even if $x_{j}[0]$ were changed to an arbitrary value $\bar{x}_{j}[0]\neq x_{j}[0]$. We define the information accessible to the honest-but-curious node $i$ at iteration $k$ as I_{i}[k]=\big{\{}a_{ip}[k]\big{|}_{v_{p}\in N_{i}},\,x_{p}^{\alpha}[k]\big{|}_{v_{p}\in N_{i}}\,,x_{i}[k],\,x_{i}^{\alpha}[k],\,x_{i}^{\beta}[k],\,a_{i,\alpha\beta}[k]\big{\}}. So as time evolves, the cumulated information accessible to node $i$ can be summarized as $I_{i}=\bigcup_{k=0}^{\infty}I_{i}[k]$.

To show that the privacy of the initial value $x_{j}[0]$ can be preserved against node $i$, i.e., node $i$ cannot estimate the value of $x_{j}[0]$ with any guaranteed accuracy, it suffices to show that under any initial value $\bar{x}_{j}[0]\neq x_{j}[0]$ the information accessible to node $i$, i.e., $\bar{I}_{i}$ could be exactly the same as $I_{i}$, the cumulated information accessible to node $i$ under $x_{j}[0]$. This is because the only information available for node $i$ to infer the initial value $x_{j}[0]$ is $I_{i}$, and if $I_{i}$ could be the outcome under any initial values of $x_{j}[0]$, then node $i$ has no way to even find a range for the initial value $x_{j}[0]$. Therefore, we only need to prove that for any $\bar{x}_{j}[0]\neq x_{j}[0]$, $\bar{I}_{i}=I_{i}$ could hold.

Next we show that there exist initial values of $x_{m}[0]$ and coupling weights satisfying the requirements of the Weight Mechanism that make $\bar{I}_{i}=I_{i}$ hold under $\bar{x}_{j}[0]\neq x_{j}[0]$. (Note that the alternative initial values of $x_{m}[0]$ should guarantee that the agents still converge to the original average value after $x_{j}[0]$ is altered to $\bar{x}_{j}[0]$.) More specifically, under the following initial condition

[TABLE]

and coupling weights

[TABLE]

where “$\setminus$” represents set subtraction, it can be easily verified that $\bar{I}_{i}=I_{i}$ holds for any $\bar{x}_{j}[0]\neq x_{j}[0]$. Note that the first equation in (6) is used to guarantee that the consensus value does not change under the alternative initial values $\bar{x}_{j}[0]$ and $\bar{x}_{m}[0]$. Therefore, the honest-but-curious node $i$ cannot learn the initial state of node $j$ based on accessible information if node $j$ is also connected to another node $m$ that does not collude with node $i$ to infer $x_{j}[0]$ (note that node $m$ is allowed to exchange information with the honest-but-curious node $i$ following the protocol, as illustrated in Fig. 2). $\blacksquare$

Remark 3

In the derivation, the choice of coupling weights $\bar{a}_{j,\alpha\beta}[0]$, $\bar{a}_{m,\alpha\beta}[0]$, and $\bar{a}_{jm}[0]$ in (7) guarantees that starting from $k=1$, all sub-states under the alternative initial value $\bar{x}_{j}[0]$ will be the same as those under the original initial value $x_{j}[0]$, and hence all coupling weights can be the same starting from $k=1$ under the two different initial value conditions. Depending on the value of $\bar{x}_{j}[0]$, the weights $\bar{a}_{j,\alpha\beta}[0]$, $\bar{a}_{m,\alpha\beta}[0]$, and $\bar{a}_{jm}[0]$ could be outside the range $[\eta,\,1)$, which corroborates the necessity of allowing weights at $k=0$ to be arbitrarily chosen from the set of all real numbers in the Weight Mechanism. Note that since the sub-states $\bar{x}_{j}^{\alpha}[0]={x}_{j}^{\alpha}[0]$ and $\bar{x}_{m}^{\alpha}[0]={x}_{m}^{\alpha}[0]$ are also arbitrarily chosen from the set of all real numbers, the possibility of them making the denominators in (7) equal to zero is negligible.

Remark 4

Our approach can protect the privacy of node $j$ even when node $j$ and all its neighbors are directly connected to the honest-but-curious neighbor $i$ (cf. Fig. 2), which is not allowed in the privacy-preserving approaches in [12, 15]. This illustrates the advantage of the proposed state-decomposition based approach.

Similar results can be obtained for the eavesdropping adversary case:

Theorem 3

Under the Decomposition Mechanism and the Weight Mechanism, an eavesdropper cannot infer the initial state $x_{j}[0]$ of any node $j$ with any guaranteed accuracy if node $j$ has at least one neighboring node $m$ whose interaction weight $a_{jm}[0]$ with node $j$ is inaccessible to the eavesdropper.

Proof: Following the line of reasoning in Theorem 2, we can obtain that any change in the initial value $x_{j}[0]$ can be completely compensated by changes in $a_{jm}[0]$, $a_{j,\alpha\beta}[0]$, and $a_{m,\alpha\beta}[0]$ that are invisible to the eavesdropper. Therefore, the accessible information to the eavesdropper can be exactly the same even when $x_{j}[0]$ were changed arbitrarily and hence the eavesdropper cannot infer the initial value of node $j$ based on accessible information. $\blacksquare$

Remark 5

The results are also applicable in the vector-state case. In fact, as long as the scalar state elements in the vector state have independent coupling weights, privacy can be naturally enabled in the vector-state case by applying results in this paper to individual scalar state elements.

IV Numerical Comparison with Existing Results

In this section, we numerically compare our state-decomposition based privacy-preserving approach with existing state-of-the-art counterparts [12, 15, 18] to confirm its advantages.

For the convenience in comparison, we represent the internal state of node $i$ as $x_{i}$ and its obfuscated version (used in state exchange with neighbors) in existing obfuscation based approaches as $x_{i}^{+}$. We considered a network of five nodes with interaction topology and weights given in [12], which, under our formulation framework translate into $\varepsilon=\frac{1}{3}$ and

[TABLE]

Without loss of generality, we suppose that an external eavesdropper is interested in obtaining the initial state of node 1 and constructs the following observer to infer $x_{1}[0]$:

[TABLE]

where the initial observer state is set to $z[0]=x^{+}_{1}[0]$. We assume that the eavesdropper has access to all weights except $a_{12}[0]$ which was set to a random value 0.7 in the $k=0$ step of the observer.

Fig. 3 gives the evolution of the network states as well as the eavesdropper’s observer state under the privacy-preserving approach in [12]. The initial states of five nodes were set to $\left\{1,\,2,\,3,\,4,\,5\right\}$. It can be seen that although convergence to the right average value is achieved, the initial internal state of node 1, i.e., $x_{1}[0]$, can also be inferred by the eavesdropper’s observer $z[k]$.

Similar results were obtained using the approach in [15], which guaranteed accurate average consensus but not the privacy of $x_{1}[0]$ (cf. Fig. 4).

Based on the same setup, we also simulated the proposed state-decomposition based privacy-preserving approach. The coupling weights at $k=0$ were randomly chosen from $[-20,\,20]$. The results are given in Fig. 5, which confirms that the proposed approach can protect the privacy of all nodes’ initial values against an eavesdropper while achieving accurate average consensus.

It is worth noting that although differential-privacy based approaches such as [18] can also protect the privacy of participating nodes’ initial values, they also lead to errors in the final consensus value, as confirmed by the simulation results in Fig. 6. In such approaches, due to the trade-off between privacy and accuracy, when an application calls for higher accuracy of the consensus result, the risk of disclosing one’s initial state also becomes higher.

V Conclusions

In this paper, we proposed a privacy-preserving approach for the network average consensus problem based on state decomposition. In contrast to differential-privacy based approaches which are subject to a fundamental trade-off between enabled privacy and achievable consensus accuracy, the approach is able to enable privacy preservation while guaranteeing accurate average consensus. It is also superior to correlated-noise based obfuscation approaches which can guarantee accurate average consensus but not resilience to adversaries which are directly connected to a target node as well as all its neighbors. Simulation results confirmed the theoretical predictions.