Genuinely Distributed Byzantine Machine Learning

TL;DR

This paper introduces ByzSGD, a novel Byzantine-resilient distributed machine learning algorithm that operates without trusting any individual component, tolerates up to one-third Byzantine servers and workers, and ensures convergence in asynchronous systems.

Contribution

It presents the first algorithm capable of Byzantine-resilient distributed learning without trusting any component, using innovative schemes like Scatter/Gather, DMC, and MDA.

Findings

ByzSGD tolerates up to 1/3 Byzantine servers and workers.

It guarantees convergence in asynchronous systems.

It requires no additional communication rounds compared to standard SGD.

Abstract

Machine Learning (ML) solutions are nowadays distributed, according to the so-called server/worker architecture. One server holds the model parameters while several workers train the model. Clearly, such architecture is prone to various types of component failures, which can be all encompassed within the spectrum of a Byzantine behavior. Several approaches have been proposed recently to tolerate Byzantine workers. Yet all require trusting a central parameter server. We initiate in this paper the study of the ``general'' Byzantine-resilient distributed machine learning problem where no individual component is trusted. We show that this problem can be solved in an asynchronous system, despite the presence of $\frac{1}{3}$ Byzantine parameter servers and $\frac{1}{3}$ Byzantine workers (which is optimal). We present a new algorithm, ByzSGD, which solves the general Byzantine-resilient distributed machine learning problem by relying on three major schemes. The first, Scatter/Gather, is a communication scheme whose goal is to bound the maximum drift among models on correct servers. The second, Distributed Median Contraction (DMC), leverages the geometric properties of the median in high dimensional spaces to bring parameters within the correct servers back close to each other, ensuring learning convergence. The third, Minimum-Diameter Averaging (MDA), is a statistically-robust gradient aggregation rule whose goal is to tolerate Byzantine workers. MDA requires loose bound on the variance of non-Byzantine gradient estimates, compared to existing alternatives (e.g., Krum). Interestingly, ByzSGD ensures Byzantine resilience without adding communication rounds (on a normal path), compared to vanilla non-Byzantine alternatives. ByzSGD requires, however, a larger number of messages which, we show, can be reduced if we assume synchrony.

Figures

Tables

Table 1. Table 1. The notations used throughout this paper.

$n_{ps}$	Total number of parameter servers
$f_{ps}$	Maximal number of Byzantine parameter servers
$q_{ps}$	Number of parameter vectors a node waits for from servers, $2f_{ps}+2\le q_{ps}\le n_{ps}-f_{ps}$
$n_w$	Total number of workers
$f_w$	Declared, maximal number of Byzantine workers
$q_w$	Number of gradients a node waits for from workers, $2f_w+1\le q_w\le n_w-f_w$
$d$	Dimension of the parameter space ${ℝ}^d$
$L$	Loss function we aim to minimize
$l$	Lipschitz constant of the loss function
${\theta }_t^{\left(i\right)}$	Parameter vector (i.e. model) at the parameter server $i$ at step $t$
${𝒢}_t^{\left(i\right)}$	Gradient distribution at the worker $i$ at step $t$
$g_t^{\left(i\right)}$	Stochastic gradient estimation of worker $i$ at step $t$
$\nabla L\left(\theta \right)$	Real gradient of the loss function $L$ at $\theta$
$\widehat{\nabla L}\left(\theta \right)$	A stochastic estimation of $\nabla L\left(\theta \right)$
${\eta }_t$	Learning rate at step $t$

Table 2. Table 2. Models used throughout the evaluation.

NN architecture	# parameters	Size (MB)
MNIST_CNN	79510	0.3
CifarNet	1756426	6.7
Inception	5602874	21.4
ResNet-50	23539850	89.8
ResNet-200	62697610	239.2

Equations

$$\underset{\theta \in {\mathbb{R}}^d}{\mathrm{argmin}}L(\theta )$$

$${\theta }^{(t+1)}={\theta }^{(t)}-{\eta }_t\cdot G\left({\theta }^{(t)},\xi \right)$$

$$\exists \kappa \in \left]1,+\infty \right[,\forall \left(i,t,\theta \right)\in \left[1..n_w-f_w\right]\times \mathbb{N}\times {\mathbb{R}}^d,$$

$$\kappa \frac{2f_w}{n_w-f_w}\sqrt{E\left({\Vert g_t^{\left(i\right)}-E{g}_t^{\left(i\right)}\Vert }_2^2\right)}\le {\Vert \nabla L\left(\theta \right)\Vert }_2.$$

$$\forall i\in \left[1..n_{ps}-f_{ps}\right],\underset{t\to +\infty }{\lim }{\Vert \nabla L\left({\theta }_t^{\left(i\right)}\right)\Vert }_2=0.$$

$${\Vert \text{MDA}\left(g_1\dots g_q\right)-g_k\Vert }_2\le \underset{\left(i,j\right)\in H^2}{\max }{\Vert g_i-g_j\Vert }_2$$

$${\theta }_t^{\left(j(l)\right)}={\theta }_{t-1}^{\left(j\right)}-{\eta }_t{g}_t^{\left(j\right)}.$$

$${\theta }_t^{\left(i\right)}={\theta }_{t-1}^{\left(i\right)}-{\eta }_t\text{MDA}\left(g_t^{\left(1\right)}\dots g_t^{\left(n_w\right)}\right).$$

$${\Vert \text{MDA}\left(g_t^{\left(1\right)}\dots g_t^{\left(n_w\right)}\right)-g_t^{\left(j\right)}\Vert }_2\le \frac{n_w-f_w}{2f_w}{\Vert g_t^{\left(j\right)}\Vert }_2.$$

$${\Vert {\theta }_t^{\left(j(l)\right)}-{\theta }_t^{\left(i\right)}\Vert }_2$$

$$\displaystyle\cdot\left(2\bigg{(}(t\text{ mod }T)-1\bigg{)}+\frac{(n_{w}-f_{w})(3T+2)}{4f_{w}}\right)$$

$$\exists \kappa \in \left]1,+\infty \right[,\forall \left(i,t,\theta \right)\in \left[1..n-f\right]\times \mathbb{N}\times {\mathbb{R}}^d,$$

$$\kappa \frac{2f}{n-f}\sqrt{E\left({\Vert g_t^{\left(i\right)}-E{g}_t^{\left(i\right)}\Vert }_2^2\right)}\le {\Vert \nabla L\left(\theta \right)\Vert }_2,$$

$$\mathcal{S}\triangleq \underset{\mathcal{Q}\in \mathcal{R}}{\mathrm{argmin}}\left(\underset{\left(g_i,g_j\right)\in {\mathcal{Q}}^2}{\max }\left({\Vert g_i-g_j\Vert }_2\right)\right).$$

$$\text{MDA}\left(g_1\dots g_n\right)\triangleq \frac{1}{n-f}\sum _{g\in \mathcal{S}}g.$$

$$\forall q\in \mathbb{N}-\left\{0\right\},\forall \left(x_1\dots x_q\right)\in {\mathbb{R}}^q,\text{median}\left(x_1\dots x_q\right)\triangleq x_s\in \mathbb{R}$$

$$\exists \left(L,H\right)\subset {\left[1..q\right]}^2,L\cap H=\varnothing ,\left|L\right|=\left|H\right|=\lfloor \frac{q}{2}\rfloor ,$$

$$\forall l\in L,x_l\le x_s,\forall h\in H,x_h\ge x_s$$

$$\left\{\begin{array}[]{l l}\exists\left(a,b\right)\in\left[{1}\,..\,{q}\right]^{2},~{}x_{s}=\frac{x_{a}+x_{b}}{2}&\text{ if }q\text{ is even}\\ x_{s}\in\left\{x_{1}\ldots{}x_{q}\right\}&\text{ if }q\text{ is odd}\end{array}\right.$$

$$\forall \left(d,q\right)\in {\left(\mathbb{N}-\left\{0\right\}\right)}^2,\forall \left(x_1\dots x_q\right)\in {\left({\mathbb{R}}^d\right)}^q,$$

$$\text{median}\left(x_1\dots x_q\right)\triangleq x_s\in {\mathbb{R}}^d$$

$$\forall i\in \left[1..d\right],x_s\left[i\right]=\text{median}\left(x_1\left[i\right]\dots x_q\left[i\right]\right)$$

$$\forall i\in \left[1..n_{ps}-f_{ps}\right],{\theta }_0^{\left(i\right)}\triangleq {\theta }_0$$

$$\forall j\in \left[1..n_w-f_w\right],{\theta }_0^{\left(j\right)}\triangleq {\theta }_0$$

$$k=\frac{{\Vert g_{t+1}^{\left(j\right)}-g_t^{\left(j\right)}\Vert }_2}{{\Vert {\theta }_{t+1}^{\left(j(l)\right)}-{\theta }_t^{\left(j\right)}\Vert }_2}$$

$${\eta }_{T\cdot (t\text{ mod }T)}{\Vert g_{T\cdot (t\text{ mod }T)}\Vert }_2$$

$$\times$$

$$\underset{t\to +\infty }{\lim }{\Vert \nabla L\left({\theta }_t\right)\Vert }_2=0$$

$$\forall \left(x_1\dots x_{2q}\right)\in {\left({\mathbb{R}}^d\right)}^{2q},$$

$${\Vert \text{MDA}\left(x_1\dots x_q\right)-\text{MDA}\left(x_{q+1}\dots x_{2q}\right)\Vert }_2$$

$$\le$$

$$\exists \left(i,j\right)\in {H_1}^2,\forall \left(y,z\right)\in {\mathcal{S}}_1^2,{\Vert y-z\Vert }_2\le {\Vert x_i-x_j\Vert }_2$$

$${\Vert \text{MDA}\left(x_1\dots x_q\right)-x_k\Vert }_2$$

$$=\frac{1}{q-f}{\Vert \sum _{x\in {\mathcal{S}}_1}\left(x-x_k\right)\Vert }_2$$

$$\le \frac{1}{q-f}\sum _{x\in {\mathcal{S}}_1}{\Vert x-x_k\Vert }_2$$

$$\le \frac{1}{q-f}\sum _{x\in {\mathcal{S}}_1}\left(\underset{\left(i,j\right)\in {H_1}^2}{\max }{\Vert x_i-x_j\Vert }_2\right)$$

Full text

We show that this problem can be solved in an asynchronous system, despite the presence of $\frac{1}{3}$ Byzantine parameter servers and $\frac{1}{3}$ Byzantine workers (which is optimal). We present a new algorithm, ByzSGD, which solves the general Byzantine-resilient distributed machine learning problem by relying on three major schemes. The first, Scatter/Gather, is a communication scheme whose goal is to bound the maximum drift among models on correct servers. The second, Distributed Median Contraction (DMC), leverages the geometric properties of the median in high dimensional spaces to bring parameters within the correct servers back close to each other, ensuring learning convergence. The third, Minimum–Diameter Averaging (MDA), is a statistically–robust gradient aggregation rule whose goal is to tolerate Byzantine workers. MDA requires loose bound on the variance of non–Byzantine gradient estimates, compared to existing alternatives (e.g., Krum (Blanchard et al., 2017)). Interestingly, ByzSGD ensures Byzantine resilience without adding communication rounds (on a normal path), compared to vanilla non-Byzantine alternatives. ByzSGD requires, however, a larger number of messages which, we show, can be reduced if we assume synchrony.

We implemented ByzSGD on top of TensorFlow, and we report on our evaluation results. In particular, we show that ByzSGD achieves convergence in Byzantine settings with around 32% overhead compared to vanilla TensorFlow. Furthermore, we show that ByzSGD’s throughput overhead is 24–176% in the synchronous case and 28–220% in the asynchronous case.

distributed machine learning, Byzantine fault tolerance, Byzantine parameter servers

††copyright: none

1. Introduction

Distributed ML is fragile.

Distributing Machine Learning (ML) tasks seems to be the only way to cope with ever-growing datasets (Kim, 2012; Meng et al., 2016; Chilimbi et al., 2014). A common way to distribute the learning task is through the now classical parameter server architecture (Li et al., 2013, 2014). In short, a central server holds the model parameters (e.g., weights of a neural network) whereas a set of workers perform the backpropagation computation (Hecht-Nielsen, 1992), typically following the standard optimization algorithm: stochastic gradient descent (SGD) (Rumelhart et al., 1986), on their local data, using the latest model they pull from the server. This server in turn gathers the updates from the workers, in the form of gradients, and aggregates them, usually through averaging  (Konečnỳ et al., 2015). This scheme is, however, very fragile because averaging does not tolerate a single corrupted input (Blanchard et al., 2017), whilst the multiplicity of machines increases the probability of a misbehavior somewhere in the network.

This fragility is problematic because ML is expected to play a central role in safety-critical tasks such as driving and flying people, diagnosing their diseases, and recommending treatments to their doctors (LeCun et al., 2015; Esteva et al., 2017). Little room should be left for the routinely reported (Papernot et al., 2017; Biggio and Roli, 2017; Gilmer et al., 2018) vulnerabilities of today’s ML solutions.

Byzantine-resilient ML.

Over the past three years, a growing body of work, e.g., (Blanchard et al., 2017; Alistarh et al., 2018; Chen et al., 2018; Xie et al., 2018c; Bernstein et al., 2018; Diakonikolas et al., 2018; Su and Shahrampour, 2018; Vyavahare et al., 2019), took up the challenge of Byzantine-resilient ML. The Byzantine failure model, as originally introduced in distributed computing (Lamport et al., 1982), encompasses crashes, software bugs, hardware defects, message omissions, corrupted data, and even worse, hacked machines (Biggio et al., 2012; Xiao et al., 2015). So far, all the work on Byzantine-resilient ML assumed that a fraction of workers could be Byzantine. But all assumed the central parameter server to be always honest and failure-free. In other words, none of the previous approaches considered a genuinely Byzantine–resilient distributed ML system, in the distributed computing sense, where no component is trusted. Consider a multi–branch organization with sensitive data, e.g., a hospital or a bank, that would like to train an ML model among its branches. In such a situation, the worker machines, as well as the central server, should be robust to the worst: the adversarial attacks.

A natural way to prevent the parameter server from being a single point–of–failure is to replicate it. But this poses the problem of how to synchronize the replicas. The classical synchronization technique, state machine replication (Schneider, 1990; Cachin et al., 2011) (SMR), enforces a total order for updates on all replicas through consensus, providing the abstraction of a single parameter server, while benefiting from the resilience of the multiplicity of underlying replicas. Applying SMR to distributed SGD would however lead to a potentially huge overhead. In order to maintain the same state, replicas would need to agree on a total order of the model updates, inducing frequent exchanges (and retransmissions) of gradients and parameter vectors, that can be several hundreds of MB large (Kim, 2012). Given that a distributed ML setup is network bound (Zhang et al., 2017; Hsieh et al., 2017), SMR is impractical in this context.

The key insight underlying our paper is that the general Byzantine SGD problem, even when neither the workers nor the servers are trusted, is easier than consensus, and total ordering of updates is not required in the context of ML applications; only convergence to a good final cross-accuracy is needed. We thus follow a different route where we do not require all the servers to maintain the same state. Instead, we allow mildly diverging parameters (which have proven beneficial in other contexts (Zhang et al., 2015; Alistarh et al., 2016)) and present new ways to contract them in a distributed manner.

Contributions.

In short, we consider, for the first time in the context of distributed SGD, the general Byzantine ML problem, where no individual component is trusted. First, we show that this problem can be solved in asynchronous settings, and then we show how we can utilize synchrony to boost the performance of our asynchronous solution.

Our main algorithm, ByzSGD, achieves general resilience without assuming bounds on communication delays, nor inducing additional communication rounds (on a normal path), when compared to a non-Byzantine resilient scheme. We prove that ByzSGD tolerates $\frac{1}{3}$ Byzantine servers and $\frac{1}{3}$ Byzantine workers, which is optimal in an asynchronous setting. ByzSGD employs a novel communication scheme, Scatter/Gather, that bounds the maximum drift between models on correct servers. In the scatter phase, servers work independently (they do not communicate among themselves) and hence, their views of the model could drift away from each other. In the gather phase, correct servers communicate and apply collectively a Distributed Median-based Contraction (DMC) module. This module is crucial for it brings the diverging parameter vectors back closer to each other, despite each parameter server being only able to gather a fraction of the parameter vectors. Interestingly, ByzSGD ensures Byzantine resilience without adding communication rounds (on a normal path), compared to non-Byzantine alternatives. ByzSGD requires, however, a larger number of messages which we show we can reduce if we assume synchrony. Essentially, in a synchronous setting, workers can use a novel filtering mechanism we introduce to eliminate replies from Byzantine servers without requiring to communicate with all servers.

ByzSGD111We use the same name for our asynchronous and synchronous variants of the algorithm when there is no ambiguity. uses a statistically–robust gradient aggregation rule (GAR), which we call Minimum–Diameter Averaging (MDA) to tolerate Byzantine workers. Such a choice of a GAR has two advantages compared to previously–used GARs in the literature to tolerate Byzantine workers, e.g., (Blanchard et al., 2017; Xie et al., 2018a). First, MDA requires a loose bound on the variance of the non–Byzantine gradient estimates, which makes it practical222In Appendix D, we report on our experimental validation of such a requirement. We compare the bound on the variance require by MDA to the one required by Multi–Krum (Blanchard et al., 2017), a state–of–the–art GAR. For instance, we show that with a batch–size of $100$ and assuming $1$ Byzantine failure, the requirement of MDA is satisfied in our experiments, while that of Multi–Krum is not.. Second, MDA makes the best use of the variance reduction resulting from the gradient estimates on multiple workers, unlike Krum (Blanchard et al., 2017) and Median (Xie et al., 2018a).

We prove that ByzSGD guarantees convergence despite the presence of Byzantine machines, be they workers or servers. We implemented ByzSGD on top of TensorFlow (Abadi et al., 2016), while achieving transparency: applications implemented with TensorFlow need not to change their interfaces to be made Byzantine–resilient. We report on our evaluation of ByzSGD. We show that ByzSGD tolerates Byzantine failures with a reasonable convergence overhead ($\sim 32\%$) compared to the non Byzantine-resilient vanilla TensorFlow deployment. Moreover, we show that the throughput overhead of ByzSGD ranges from 24% to 220% compared to vanilla TensorFlow.

The paper is organized as follows. Section 2 provides some background on SGD, the problem settings and the threat model. Section 3 describes our ByzSGD algorithm, while Section 4 sketches its correctness proof. Section 5 discusses how ByzSGD leverages synchrony to boost performance. Section 6 reports on our empirical evaluation of ByzSGD. Section 7 concludes the paper by discussing related work and highlighting open questions. In the Appendix to the main paper, we give the convergence proof of ByzSGD (Appendix C), we empirically validate our assumptions (Appendix D), and we assess ByzSGD’s performance in a variety of cases (Appendix E).

2. Background and Model

2.1. Stochastic Gradient Descent

Stochastic Gradient Descent (SGD) (Rumelhart et al., 1986) is a widely-used optimization algorithm in ML applications (Chilimbi et al., 2014; Li et al., 2014; Abadi et al., 2016). Typically, SGD is used to minimize a loss function $L\left(\theta\right)\in\mathbb{R}$, which measures how accurate the model $\theta$ is when classifying an input. Formally, SGD addresses the following optimization problem:

[TABLE]

SGD works iteratively and consists, in each step $t$, of:

1. (1)

Estimating the gradient $G\left(\theta^{(t)},\xi\right)$, with a subset $\xi$ of size $b$ of the training set, called mini–batch. Such a gradient is a stochastic estimation of the real, uncomputable one $\nabla{}L\left(\theta^{(t)}\right)$. 2. (2)

Updating the parameters following the estimated gradient:

[TABLE]

The sequence $\{\eta_{t}\in\mathbb{R}_{>0}\}$ is called the learning rate.

2.2. The Parameter Server Architecture

Estimating one gradient is computationally expensive, as it consists in computing $b$ estimates of $G\left(\theta,\xi_{i}\right)$, where $\xi_{i}$ is the $i^{\text{th}}$ pair (input, label) from the mini–batch, and where each $G\left(\theta,\xi_{i}\right)$ involves one backpropagation computation (Hecht-Nielsen, 1992). Hence, the amount of arithmetic operations to carry out to estimate $G\left(\theta,\xi\right)\approx\nabla{}L\left(\theta^{(t)}\right)$ is $\mathcal{O}\left(b\!\cdot\!d\right)$.

However, this gradient estimation can be easily distributed: the $b$ computations of $G\left(\theta^{(t)},\xi_{i}\right)$ can be executed in parallel on $n$ machines, where the aggregate of such computations gives $G\left(\theta^{(t)},\xi\right)$. This corresponds to the now standard parameter server architecture (Li et al., 2013), where a central server holds the parameters $\theta$.

Each training step includes two communication rounds: the server first broadcasts the parameters to workers, which then estimate the gradient $G\left(\theta^{(t)},\xi_{i}\right)$ (i.e., each with a mini–batch of $\frac{b}{n}$). When a worker completes its estimation, it sends it back to the parameter server, which in turn averages these estimations and updates the parameters $\theta$, as in Equation 2.

2.3. Byzantine Machine Learning

The Byzantine failure abstraction (Lamport et al., 1982) models any arbitrary behavior and encompasses software bugs, hardware defects, message omissions, or even hacked machines. We then typically assume that a subset of the machines can be Byzantine and controlled by an adversary whose sole purpose is to defeat the computation.

A Byzantine machine can, for instance, send a biased estimate of a gradient to another machine, which leads to a corrupted learning model accordingly or even to learning divergence (Baruch et al., 2019). Byzantine failures also abstract the data poisoning problem (Biggio et al., 2012), which happens when a machine owns maliciously–labeled data. This may result in learning a corrupted model, especially–crafted by the adversary. Clearly, assuming a central machine controlling the learning process (as with the standard parameter server architecture (Li et al., 2013)) is problematic if such a machine is controlled by an adversary, for this machine can write whatever it wants to the final model, jeopardizing the learning process.

2.4. System Model

Computation and communication models.

We build on the standard parameter server model, with two main variations (Fig. 1).

1. We assume a subset of the nodes (i.e., machines) involved in the distributed SGD process to be adversarial, or Byzantine, in the parlance of (Blanchard et al., 2017; Chen et al., 2018; El Mhamdi et al., 2018). The other nodes are said to be correct. Clearly, which node is correct and which is Byzantine is not known ahead of time. 2. We consider several replicas of the parameter server (we call them servers), instead of a single one, preventing it from being a single point–of–failure, unlike in classical ML approaches.

In our new context, workers send their gradients to all servers (instead of one in the standard case), which in turn send their parameters to all workers. Periodically, servers communicate with each other, as we describe later in Section 3. We consider bulk–synchronous training: only the gradients computed at a learning step $t$ are used for the parameters update at the same step $t$.

Adversary capabilities.

The adversary is an entity that controls all Byzantine nodes (Figure 1), and whose goal is to prevent the SGD process from converging to a state that could have been achieved if there was no adversary. As in (Blanchard et al., 2017; Chen et al., 2018; El Mhamdi et al., 2018), we assume an omniscient adversary that can see the full training datasets as well as the packets being transferred over the network (i.e., gradients and models). However, the adversary is not omnipotent: it can only send arbitrary messages from the nodes it controls, or force them to remain silent. We assume nodes can authenticate the source of a message, so no Byzantine node can forge its identity or create multiple fake ones (Castro et al., 1999).

2.5. Convergence Conditions

We assume the classical conditions333The exhaustive list, with their formal formulations, is available in Appendix C.1. for convergence in non–convex optimization (Bottou, 1998). For instance, we assume that the training data is identically and independently distributed (i.i.d) over the workers, and the sequence of learning rates $\eta_{t}$ is monotonically decreasing (i.e., $\lim\limits_{t\rightarrow+\infty}\eta_{t}=0$). We also assume that correct workers compute unbiased estimates of the true gradient with sufficiently low variance, namely (see Table 1 for notations):

[TABLE]

Such an equation bounds the ratio of the standard deviation of the stochastic gradient estimations to the norm of the real gradient with $\frac{n_{w}-f_{w}}{2f_{w}}$. This assumption is now classical in the Byzantine ML literature (Blanchard et al., 2017; El Mhamdi et al., 2018). We also empirically verify this assumption in Appendix D in our experimental setup.

In addition, we assume: (1) $L$ is $l$-Lipschitz continuous, and (2) no (pattern of) network partitioning among the correct servers lasts forever. The standard $l$-Lipschitz continuity assumption (Rosasco et al., 2004; Bartlett et al., 2017; Virmaux and Scaman, 2018) acts as the only bridge between the parameter vectors ${\theta}^{\left({i}\right)}_{t}$ and the stochastic gradients ${g}^{\left({i}\right)}_{t}$ at a given step $t$. This is a liveness assumption: the value of $l$ can be arbitrarily high and is only used to bound the expected maximal distance between any two correct parameter vectors. The second assumption ensures that eventually the correct parameter servers can communicate with each other in order to pull their views of the model back close to each other; this is crucial to achieve Byzantine resilience.

Denote by $S_{j}\triangleq\left\{s\subset\left[{1}\,..\,{n_{ps}\!-\!f_{ps}}\right]\!-\!\left\{j\right\}~{}\middle|~{}\left\lvert{s}\right\rvert\in\left[{q\!-\!f\!-\!1}\,..\,{q\!-\!1}\right]\right\}$ the subset of correct parameter server indexes that parameter server $j$ can deliver at a given step. We then call $S\triangleq\prod_{j\in\left[{1}\,..\,{n_{ps}-f_{ps}}\right]}S_{j}$ the set of all correct parameter server indexes the $n_{ps}-f_{ps}$ correct parameter servers $i\in\left[{1}\,..\,{n_{ps}-f_{ps}}\right]$ can deliver. We further assume $\exists\rho>0,~{}\forall s\in S,~{}P\left(X=s\right)\geq\rho$. For any server $j$, $\left\lVert{\nabla{}L\left({{\theta}^{\left({j}\right)}_{t}}\right)}\right\rVert_{2}\geq 9\left(n_{w}-f_{w}\right)\sigma^{\prime}+\frac{Cdl^{2}}{\rho}$, for some constant $C$, and where $\sigma^{\prime}$ is the upper bound on the distance between the estimated and the true gradients (see Appendix C.1). Finally, ByzSGD requires $n_{w}\geq 3f_{w}+1$ and $n_{ps}\geq 3f_{ps}+2$.

3. ByzSGD: General Byzantine Resilience

We present here ByzSGD, the first algorithm to tolerate Byzantine workers and servers without making any assumptions on node relative speeds and communication delays. ByzSGD does not add, on average, any communication rounds compared to the standard parameter server communication model (Section 2.2). However, periodically, ByzSGD adds a communication round between servers to enforce contraction and convergence, as we show in this section.

We first describe the fundamental technique to tolerate Byzantine servers: Distributed Median-based Contraction (DMC). Then, we describe the Byzantine–resilient gradient aggregation rule we use to tolerate Byzantine workers. Finally, we explain the overall functioning of ByzSGD, highlighting our novel Scatter/Gather communication scheme.

3.1. Distributed Median–based Contraction

The fundamental problem addressed here is induced by the multiplicity of servers and consists of bounding the drift among correct parameter vectors ${\theta}^{\left({1}\right)}_{t}\ldots{}{\theta}^{\left({n_{ps}-f_{ps}}\right)}_{t}$, as $t$ grows. The problem is particularly challenging because of the combination of three constraints: (a) we consider a Byzantine environment, (b) we assume an asynchronous network, and (c) we do not want to add communication rounds, compared to those done by vanilla non–Byzantine deployments, given the expensive cost of communication in distributed ML applications (Zhang et al., 2017; Hsieh et al., 2017). The challenging question can then be formulated as follows: given that the correct parameter servers should not expect to receive more than $n\!-\!f\!-\!1$ messages per round, how to keep the correct parameters close to each other, knowing that a fraction of the received messages could be Byzantine?

Our solution to this issue is, what we call, Distributed Median–based Contraction (DMC), whose goal is to decrease the expected maximum distance between any two honest parameter vectors (i.e., contract them). DMC is a combination of (1) the application of coordinate–wise Median (which is Byzantine–resilient as soon as $q_{ps}\geq 2f_{ps}+1$) on the parameter vectors and (2) the over–provisioning of $1$ more correct parameter server (i.e., $q_{ps}\geq 2f_{ps}+2$); both constitute the root of what we call the contraction effect. Assuming each honest parameter server can deliver a subset of $q_{ps}-f_{ps}-1$ honest parameters, the expected median of the gathered parameters is then both (1) bounded between the gathered honest parameters and (2) different from any extremum among the gathered honest parameters (as $1$ correct parameter server was over-provisioned). Since each subset of the gathered honest parameters contains a subset of all the $n_{ps}-f_{ps}$ honest parameters, the expected maximum distance between two honest parameters is thus decreased after applying DMC.

3.2. Minimum–Diameter Averaging

To tolerate Byzantine workers, we use a statistically–robust Gradient Aggregation Rule (GAR). A GAR is merely a function of $\left(\mathbb{R}^{d}\right)^{n}\rightarrow\mathbb{R}^{d}$. Reminiscent of the Minimum Volume Ellipsoid (Rousseeuw, 1985), we use Minimum–Diameter Averaging (MDA) as our Byzantine–resilient GAR. Given $n$ input gradients (with $f$ possible Byzantine ones), MDA averages only a subset of $n-f$ gradients. The selected subset must have the minimum diameter among all the subsets of size $n-f$ taken from the $n$ input gradients; hence the name. The diameter of a subset is defined as the maximum $\ell_{2}$ distance between any two gradients of this subset.

MDA can be formally described as follows. Let $\left(x_{1}\ldots{}x_{q}\right)\in\left(\mathbb{R}^{d}\right)^{q}$, and $\mathcal{Q}\triangleq\left\{\,x_{1}\ldots{}x_{q}\,\right\}$ the set of all the input gradients. Let $\mathcal{R}\triangleq\left\{\,\mathcal{X}\mid\mathcal{X}\subset\mathcal{Q},~{}\left\lvert{\mathcal{X}}\right\rvert=q-f\,\right\}$ the set of subsets of $\mathcal{Q}$ with cardinality $q-f$. Let $\mathcal{S}\triangleq\operatorname*{arg\,min}_{\mathcal{X}\in\mathcal{R}}\left(\max_{\left(x_{i},x_{j}\right)\in\mathcal{X}^{2}}\left(\left\lVert{x_{i}-x_{j}}\right\rVert_{2}\right)\right)$. Then, the aggregated gradient is $\emph{MDA}{}\left(x_{1}\ldots{}x_{q}\right)\triangleq\frac{1}{q-f}\sum_{x\in\mathcal{S}}{x}$.

3.3. The ByzSGD Algorithm

ByzSGD operates iteratively in two phases: scatter and gather. One gather phase is entered every $T$ steps (lines 8 to 11 in Algorithm 2); we call the whole $T$ steps the scatter phase.

Algorithms 1 and 2 depict the training loop applied by workers and servers respectively. As an initialization step, correct servers initialize the model with the same random values, i.e., using the same seed. Moreover, the servers compute the value of $T$.

The subsequent steps $t\in\mathbb{N}{}$ work as follows. The algorithm starts with the scatter phase, which includes doing a few learning steps. In each step, each server $i$ broadcasts its current parameter vector ${\theta}^{\left({i}\right)}_{t}$ to every worker. Each worker $j$ then (1) aggregates with coordinate–wise Median (hereafter simply, Median) the first $q_{ps}$ received ${\theta}^{\left({i}\right)}_{t}$ (line 4 in Algorithm 1), and (2) computes an estimate ${g}^{\left({j}\right)}_{t}$ of the gradient at the aggregated parameter vector, i.e., model. Then, each worker $j$ broadcasts its computed gradient estimation ${g}^{\left({j}\right)}_{t}$ to all parameter servers. Each parameter server $i$ in turn aggregates with MDA the first $q_{w}$ received ${g}^{\left({j}\right)}_{t}$ (line 6 in Algorithm 2) and then performs a local parameter update with the aggregated gradient, resulting in ${\overline{\theta}}^{\left({i}\right)}_{t}$. In normal steps (in the scatter phase), ${\theta}^{\left({i}\right)}_{t+1}={\overline{\theta}}^{\left({i}\right)}_{t}$.

Every $T$ steps (i.e., in the gather phase), correct servers apply DMC: each parameter server $i$ broadcasts ${\overline{\theta}}^{\left({i}\right)}_{t}$ to every other server and then aggregates with Median the first $q_{ps}$ received ${\overline{\theta}}^{\left({k}\right)}_{t}$; this aggregated parameter vector is ${\theta}^{\left({i}\right)}_{t+1}$.

4. Correctness of ByzSGD

This section sketches the convergence proof ByzSGD. The full proof is detailed in Appendix C.

Theorem 4.1 (Correctness of ByzSGD).

Under the assumptions of Section 2.5, ByzSGD guarantees the convergence of all correct parameter servers, i.e.

[TABLE]

Equation 4 is the commonly admitted termination criteria for non–convex optimization tasks (Bottou, 1998). We provide here the key intuitions and steps of the proof, which relies on two key observations: (1) assuming that the learning rate $\eta_{t}$ converges to 0, Median guarantees that all correct servers’ parameters ${\theta}_{t}$ all eventually reach the same values (i.e., contract) and (2) any given server $i$’s parameters ${\theta}^{\left({i}\right)}_{t}$ eventually essentially follows a stochastic gradient descent dynamics, which guarantees its convergence as described by Equation 4. In the sequel, we detail these two points.

4.1. Contraction by Median

The first key element of the proof is to prove that Median contracts the servers’ parameters in expectation, despite the Byzantines’ attacks. This turns out to be nontrivial. In fact, the diameter of servers’ parameters does not decrease monotonically. The trick is to follow the evolution of another measure of the spread of the servers’ parameters, namely the sum of coordinate-wise diameters. We prove that, using Median, Byzantines can never increase this quantity.

Lemma 4.2 (Safety of Median).

Let $\Delta_{{\theta}_{t}}$ the sum of coordinate-wise diameters, i.e.: $\Delta_{{\theta}_{t}}=\sum_{i=1}^{d}\max_{j,k\in\left[{1}\,..\,{n_{ps}-f_{ps}}\right]}\left\lvert{{\theta}^{\left({j}\right)}_{t}[i]-{\theta}^{\left({k}\right)}_{t}[i]}\right\rvert$. Then, no matter which gradients are delivered to which servers, and no matter how Byzantines attack, we have $\Delta_{{\theta}_{t+1}}\leq\Delta_{{\theta}_{t}}$.

Sketch of proof.

On each dimension $j$, since $q_{ps}\geq 2f_{ps}+2$, for any server $i$, there is a majority of correct servers whose parameters have been delivered to $i$. Thus, the median computed by server $i$ must belong to the interval containing the $j$-coordinates of all correct servers. Since this holds for all servers $i$, the diameter along dimension $j$ cannot increase. ∎

But interestingly, assuming that all delivering configurations can occur with a positive probability, we can show that there will be contraction in expectation.

Lemma 4.3 (Expected contraction by Median).

There is a constant $m<1$ such that $\mathbb{E}\left[\Delta_{{\theta}_{t+1}}\right]\leq m\Delta_{{\theta}_{t}}$. Note that the expectation is taken over all delivering configurations, and given Byzantines’ attacks for a delivering configuration.

Sketch of proof.

Using the assumption $q_{ps}\geq 2f_{ps}+2$, for any coordinate, we show the existence of a delivering configuration such that the diameter along this coordinate is guaranteed to decrease by a factor $3/4$. The trick to identify this configuration is to divide, for each coordinate $i$, the set of servers into those that have a high coordinate $i$ and those that have a low coordinate $i$. One of these two subsets, call it $X^{*}$, must contain a majority of correct servers.

Given that $q_{ps}\leq\lfloor\frac{n_{ps}-f_{ps}}{2}\rfloor$, we can thus guarantee the existence of a delivering configuration such that all parameter servers all contain a majority of inputs that come from $X^{*}$. If this happens, then all servers’ parameters after application of Median must then have their $i$’s coordinates closer to the subset $X^{*}$. In fact, we show that their new diameters along the coordinate $i$ is at most $3/4$ of their previous diameter, which proves the contraction along coordinate $i$ for at least one delivering configuration. Taking the expectation implies a strict expected contraction along this coordinate. Summing up over all coordinates yields the lemma. ∎

Unfortunately, this is still not sufficient to guarantee the convergence of the servers’ parameters, because of a potential drift during learning. However, as the learning rate decreases, we show that contraction eventually becomes inevitable, which guarantees eventual convergence.

Lemma 4.4 (Bound on the drift).

There exists constants $A$ and $B$ such that $\mathbb{E}\left[\Delta_{{\theta}_{t+1}}\right]\leq(m+A\eta_{t})\Delta_{{\theta}_{t}}+B\eta_{t}$. Here, the expectation is over delivering configurations, from parameter servers to workers, from workers to parameter servers and in-between parameter servers. The expectation is also taken over stochastic gradient estimates by workers, and for any attacks by the Byzantines.

Sketch of proof.

This bound requires to control the drift despite Byzantine attacks on two different levels, namely when parameter servers deliver their parameters to workers, and when workers deliver their gradients to servers.

In the former case, we exploit the fact that the spread of all correct parameters along, measured in terms of sum of coordinate-wise diameters, is at most $\Delta_{{\theta}_{t}}$, to guarantee that the coordinate-wise medians of the parameters computed by workers are also close to one another.

Using Lipschitz continuity, this then implies that the gradients they compute are also close to one another, in the sense that the diameter of gradients is at most $l\Delta_{{\theta}_{t}}$ plus some deviation $2h_{w}\sigma^{\prime}$ due to the noise in the stochastic gradient estimates.

Then, using the Byzantine resilience property of MDA, we show that the diameter of servers’ aggregated gradients is at most that of workers’ estimated gradients. Combining it all yields the lemma.

Note that the constant $A$ depends on the Lipschitz continuity of the gradient of the loss function, while the constant $B$ comes from the randomness of the gradient estimates by workers. See more details in Appendix C.4. ∎

Lemma 4.5 (Eventual contraction of Median).

As a corollary, assuming $\eta_{t}\rightarrow 0$, we have $\mathbb{E}[\Delta_{{\theta}_{t}}]\rightarrow 0$.

Sketch of proof.

This comes from the eventual contraction of $\Delta_{{\theta}_{t}}$. Note that it implies that some other measures of the spread of servers’ parameters, like their diameter measured in $\ell_{2}$, also converge to zero. ∎

4.2. Liveness of Server Parameters

The previous section showed that eventually, the parameters will all have nearly identical values. In this section, we show that, as a result, and thanks to a Byzantine–resilient GAR like MDA, any parameter’s update is nearly an update that would be obtained by vanilla Byzantine-free SGD, for which the guarantee of Theorem 4 has been proven.

First, we note that MDA ensures that its output gradient lies within the correct set of gradients submitted to a correct server, as stated by the following lemma.

Lemma 4.6 (MDA bounded deviation from majority).

The distance between the output of MDA and (at least) one of the correct gradients is bounded below the diameter of the set of correct gradients.

Formally, let $\left(d,f\right)\in\left(\mathbb{N}-\left\{0\right\}\right)^{2}$ and let $q\in\mathbb{N}$ such that $q\geq 2\,f+1$. Let note $H\triangleq\left[{1}\,..\,{q-f}\right]$.

It holds that, $\forall\left(g_{1}\ldots{}g_{q}\right)\in\left(\mathbb{R}^{d}\right)^{q},~{}\exists k\in H,~{}$:

[TABLE]

Hence, SGD, with MDA, alone would converge.

Now, we show that a server $j$’s update can be written ${\theta}^{\left({j}\right)}_{t+1}={\theta}^{\left({j}\right)}_{t}-\eta_{t}\hat{G}^{(j)}_{t}$, where $\hat{G}^{(j)}_{t}$ satisfies the classical assumptions of Byzantine machine learning. Namely, we show that $\mathop{{}\mathbb{E}}\hat{G}^{(j)}_{t}\cdot\nabla{}L\left({{\theta}^{\left({j}\right)}_{t}}\right)$ is positive, under our assumptions.

Theorem 4.7 (Liveness and safety of parameter servers).

Under our assumptions for any parameter server $j$, $\mathop{{}\mathbb{E}}\hat{G}^{(j)}_{t}\nabla{}L\left({{\theta}^{\left({j}\right)}_{t}}\right)>0$.

Sketch of proof.

To guarantee this condition, we first prove that the expected maximum distance between an estimate ${G}^{\left({j}\right)}_{t}$ by worker $j$ and server $k$’s parameters $\nabla{}L\left({{\theta}^{\left({k}\right)}_{t}}\right)$ is upper-bounded by the spread of all servers’ parameters and a term due to the randomness of the worker’s gradient estimates.

We then show that the servers’ updates are all similar, which allows to say that after applying Median, all servers are guaranteed to move along the direction of the true gradient, given our assumptions. ∎

Complexity.

The communication complexity of ByzSGD is $\mathcal{O}(dn_{w}n_{ps})$ when $T$ is very large. With small values for $T$, the communication complexity is $\mathcal{O}(dn_{ps}(n_{w}+n_{ps}))$. The computation complexities of Median and MDA are $\mathcal{O}(n_{ps}d)$ and $\mathcal{O}\!\left(\binom{n_{w}}{f_{w}}+n_{w}^{2}d\right)$. Notably, distributed ML problem is network–bound (Zhang et al., 2017; Hsieh et al., 2017) and hence, the (possibly) exponential complexity of MDA does not aggressively harm the performance, as we show in Section 6.

5. ByzSGD: Reducing Messages With Synchrony

We show here that assuming network synchrony, we can boost ByzSGD’s performance while keeping the same resilience guarantees. In particular, the number of communicated messages can be reduced as follows: instead of pulling an updated model from $q_{ps}$ servers (line 3 in Algorithm 1), each worker pulls only one model and then checks its legitimacy using two filters: Lipschitz and Outliers filters. In this case, ByzSGD requires $n_{w}\geq 2f_{w}+1$ while keeping $n_{ps}\geq 3f_{ps}+2$. The full proof of ByzSGD, while considering synchronous networks, is in Appendix C.

5.1. Lipschitz Filter

Based on the standard Lipschitz continuity of the loss function assumption (Bottou, 1998; Blanchard et al., 2017), previous work used empirical estimations for the Lipschitz coefficient to filter out gradients from Byzantine workers in asynchronous learning (Damaskinos et al., 2018). We use a similar idea, but we now apply it to filter out models from Byzantine servers. The filter works as follows: consider a worker $j$ that owns a model ${\theta}^{\left({j}\right)}_{t}$ and a gradient it computed ${g}^{\left({j}\right)}_{t}$ based on that model at some step $t$. A correct server $i$ should include ${g}^{\left({j}\right)}_{t}$ while updating its model ${\theta}^{\left({i}\right)}_{t}$, given network synchrony. Worker $j$ then: (1) estimates the updated model locally ${\theta}^{\left({j(l)}\right)}_{t+1}$ based on its own gradient and (2) pulls a model ${\theta}^{\left({i}\right)}_{t+1}$ from a parameter server $i$. If server $i$ is correct then the growth of the pulled model ${\theta}^{\left({i}\right)}_{t+1}$ (with respect to the local gradient ${g}^{\left({j}\right)}_{t}$) should be close to that of the estimated local model ${\theta}^{\left({j(l)}\right)}_{t+1}$, based on the guarantees given by MDA (see Appendix C.2.1). Such a growth rate is encapsulated in the Lipschitz coefficient of the loss function. If the pulled model is correct then, the worker expects that the Lipschitz coefficient computed based on that model be close to those of the other correct models received before by the worker. Concretely, a worker computes an empirical estimation of the Lipschitz coefficient $k=\frac{\left\lVert{{g}^{\left({j}\right)}_{t+1}-{g}^{\left({j}\right)}_{t}}\right\rVert_{2}}{\left\lVert{{\theta}^{\left({j(l)}\right)}_{t+1}-{\theta}^{\left({j}\right)}_{t}}\right\rVert_{2}}$ and then, ensures that it follows the condition $k\leq K_{p}\triangleq\text{quantile}_{\frac{n_{ps}-f_{ps}}{n_{ps}}}\{K\}$, where $K$ is the list of all previous Lipschitz coefficients $k$ (i.e., with $t_{prev}<t$). Note the Lipschitz filter requires $n_{ps}>3f_{ps}$ (see Appendix C.2.3).

5.2. Outliers Filter

Although the Lipschitz filter can bound the model growth with respect to gradients, a server can still trick this filter by sending a well-crafted model that is arbitrarily far from the other correct models (Baruch et al., 2019). To overcome this problem, we use another filter, which we call Outliers filter, to bound the distance between models in any two successive steps. In short, a worker $j$ assumes the distance between a local estimate of a model ${\theta}^{\left({j(l)}\right)}_{t+1}$ and a pulled model ${\theta}^{\left({i}\right)}_{t+1}$ to be upper–bounded as follows: \left\lVert{{\theta}^{\left({j(l)}\right)}_{t+1}-{\theta}^{\left({i}\right)}_{t+1}}\right\rVert_{2}<\eta_{T\cdot(t\text{ mod }T)}\left\lVert{g_{T\cdot(t\text{ mod }T)}}\right\rVert_{2}\bigg{(}\frac{(3T+2)(n_{w}-f_{w})}{4f_{w}}+2\big{(}(t-1)\text{ mod }T\big{)}\bigg{)}.

Sketch of proof.

Each worker $j$ at time $t$ computes a local updated model ${\theta}^{\left({j(l)}\right)}_{t}$ as follows:

[TABLE]

Simultaneously, a correct server $i$ computes an update as follows:

[TABLE]

Based on the guarantees given by MDA (El Mhamdi et al., 2018), the following holds:

[TABLE]

Hence, based on the Lipschitzness of the loss function, we have:

[TABLE]

∎

Such a bound is also based on the scatter/gather scheme we are using. The details of deriving this term is in Appendix C.2.3.

5.3. ByzSGD: The Synchronous Version

Keeping the parameter server algorithm as is (Algorithm 2), Algorithm 3 presents the workers’ training loop in the synchronous case. We focus here on the changes in the ByzSGD algorithm, compared to the asynchronous case (Section 3.3).

In the initialization phase, each worker $j$ chooses a random integer $r_{j}$ with $1\leq r_{j}\leq n_{ps}$ before doing one backpropagation computation to estimate the gradient at the initial model.

While parameter servers are updating the model (line 7 in Algorithm 2), each worker $j$ speculates the updated model by computing a local view of it, using its local computed gradient and its latest local model (line 7 in Algorithm 3). Then, each worker $j$ pulls one parameter vector from server $i$ where, $i=(r_{j}+t+1)\text{ mod }n_{ps}$. Such a worker computes the new gradient, using backpropagation, based on the pulled model. Based on this computation and the local estimate of the updated model, the worker applies the Lipschitz and the Outliers filters to check the legitimacy of the pulled model. If the model fails to pass the filters, the worker $j$ pulls a new model from the parameter server $i_{++}$, where $i_{++}=(r_{j}+t+2)\text{ mod }n_{ps}$. This process is repeated until a pulled model passes both filters. Every $T$ steps (i.e., in the gather phase), each worker $j$ pulls models from all servers and aggregates them using Median, completing the DMC computation.

6. Experimental Evaluation

We implemented our algorithms on top of TensorFlow (Abadi et al., 2016), and we report here on some of our empirical results. Appendix E presents additional experiments, highlighting the effect of changing $n_{ps}$ and assessing the efficiency of our filtering mechanism.

6.1. Evaluation Setting

Testbed.

We use Grid5000 (g5k, [n. d.]) as an experimental platform. We employ up to 20 worker nodes and up to 6 parameter servers. Each node has 2 CPUs (Intel Xeon E5-2630 v4) with 10 cores, 256 GiB RAM, and 2$\times$10 Gbps Ethernet.

Experiments.

We consider an image classification task due to its wide adoption as a benchmark for distributed ML systems, e.g., (Chilimbi et al., 2014). We use MNIST (Lecunn, 1998) and CIFAR-10 (cif, [n. d.]) datasets. MNIST consists of handwritten digits. It has 70,000 $28\times 28$ images in 10 classes. CIFAR-10 is a widely–used dataset in image classification (Srivastava et al., 2014; Zhang et al., 2017). It consists of 60,000 $32\times 32$ colour images in 10 classes.

We employ several NN architectures with different sizes ranging from a small convolutional neural network (CNN) for MNIST, training ¡100k parameters, to big architectures like ResNet-200 with around 63M parameters (see Table 2). We use CIFAR10 (as a dataset) and CifarNet (as a model) as our default experiment.

Metrics.

We evaluate the performance of ByzSGD using the following standard metrics. 1. Accuracy (top–1 cross–accuracy). The fraction of correct predictions among all predictions, using the test dataset. We measure accuracy with respect to time and model updates. 2. Throughput. The total number of updates that the deployed system can do per second.

Baseline.

We consider vanilla TensorFlow (vanilla TF) as our baseline. Given that such a baseline does not converge in Byzantine environments (Damaskinos et al., 2019), we use it only to quantify the overhead in non–Byzantine environments.

6.2. Evaluation Results

First, we show ByzSGD’s performance, highlighting the overhead, in a non–Byzantine environment. Then, we compare the throughput of the synchronous variant to that of the asynchronous variant in a Byzantine–free environment. Finally, we report on the performance of ByzSGD in a Byzantine environment, i.e., with Byzantine workers and Byzantine servers. For the Byzantine workers, we show the effect of a recent attack (Baruch et al., 2019) on ByzSGD, and then we show the results of 4 different attacks in the case of Byzantine servers. In all experiments, and based on our setup, we use $T=333$. We discuss the effect of changing $T$ on ByzSGD’s performance in Appendix E.2.

Non–Byzantine environment.

Figure 3 shows the convergence (i.e., progress of accuracy) of all experimented systems with both time and model updates (i.e., training steps). We experiment with two batch sizes and different values for declared Byzantine servers and workers (only for the Byzantine–tolerant deployments). Figure 3 shows that all deployments have almost the same convergence behavior, with a slight loss in final accuracy for the Byzantine–tolerant deployments, which we quantify to around 5%. Such a loss is emphasized with the smaller batch size (Figure 3). This accuracy loss is admitted in previous work (Xie et al., 2018a) and is inherited from using statistical methods (basically, MDA in our case) for Byzantine resilience. In particular, MDA ensures convergence only to a ball around the optimal solution, i.e., local minimum (El Mhamdi et al., 2018). Moreover, the figures confirm that using a higher batch size gives a more stable convergence for ByzSGD. Figures 3 and 3 show that both variants of ByzSGD almost achieve the same convergence.

The cost of Byzantine resilience is more clear when convergence is observed over time (Figure 3), especially with the lower batch size (Figure 3). We define the convergence overhead by the ratio of the time taken by ByzSGD to reach some accuracy level compared to that taken by TensorFlow to reach the same accuracy level. For example, in Figure 3, TensorFlow reaches 60% accuracy in 268 seconds which is around 32% better than the slowest deployment of ByzSGD. We draw two main observations from these figures. First, changing the number of declared Byzantine machines affects the progress of accuracy, especially with the asynchronous deployment of ByzSGD. This is because servers and workers in such case wait for replies from only $n-f$ machines. Hence, decreasing $f$ forces the receiver to wait for more replies, slowing down convergence. Second, the synchronous variant always outperforms the asynchronous one, especially with non–zero values for declared Byzantine machines, be they servers and workers. Such a result is expected as the synchronous algorithm uses less number of messages per round compared to the asynchronous one. Given that distributed ML systems are network–bound (Hsieh et al., 2017; Zhang et al., 2017), reducing the communication overhead significantly boosts the performance (measured by convergence speed in this case) and the scalability of such systems.

Throughput.

We do the same experiment again, yet with different state–of–the–art models so as to quantify the throughput gain of the synchronous variant of ByzSGD. Figure 5 shows the throughput of synchronous ByzSGD divided by the throughput of the asynchronous ByzSGD in each case. From this figure, we see that synchrony helps ByzSGD achieve throughput boost (up to 70%) in all cases, where such a boost is emphasized more with large models. This is expected because the main advantage of synchronous ByzSGD is to decrease the number of communication messages, where bigger messages are transmitted with bigger models.

Byzantine workers.

We study here the convergence of ByzSGD in the presence of Byzantine workers. Simple misbehavior like message drops, unresponsive machines, or reversed gradients are well-studied and have been shown to be tolerated by Byzantine–resilient GARs, e.g., (Xie et al., 2018a), which ByzSGD also uses. Thus, here we focus on a more recent attack that is coined as A little is enough attack (Baruch et al., 2019). This attack focuses on changing each dimension in gradients of Byzantine workers to trick some of Byzantine–resilient GARs, e.g., (Blanchard et al., 2017; El Mhamdi et al., 2018).

We apply this attack to multiple deployments of ByzSGD. In each scenario, we apply the strongest possible change in gradients’ coordinates so as to hamper the convergence the most. We study the effect of this attack on the convergence of ByzSGD with both the ratio of Byzantine workers to the total number of workers (Figure 6(a)) and the batch size (Figure 6(b)). We use the deployment with no Byzantine behavior (No Attack) as a baseline.

Figure 6(a) shows that the effect of the attack starts to appear clearly when the number of Byzantine workers is a significant fraction (more than 20%) of the total number of workers. This is intuitive as the attack tries to increase the variance between the submitted gradients to the parameter servers and hence, increases the ball (around the local minimum) to which the used GAR converges (see e.g., (Blanchard et al., 2017; El Mhamdi et al., 2018) for a theoretical analysis of the interplay between the variance and the Byzantine resilience). Stretching the number of Byzantine workers to the maximum ($f_{w}=8$) downgrades the accuracy to around 40% (compared to 67% in “No Attack” case). This can be explained by the large variance between honest gradients, above what MDA requires, as we discuss in Appendix D.

Increasing the batch size not only improves the accuracy per training step but also the robustness of ByzSGD (by narrowing down the radius of the ball around the convergence point, where the model will fluctuate as proven in (Blanchard et al., 2017; El Mhamdi et al., 2018)). Figure 6(b) fixes the ratio of $f_{w}$ to $n_{w}$ to the biggest allowed value to see the effect of using a bigger batch size on the convergence behavior. This figure confirms that increasing the batch size increases the robustness of ByzSGD. Moreover, based on our experiments, setting 25% of workers to be Byzantine while using a batch size of (up to) 256 does not experimentally satisfy the assumption on the variance of MDA in this deployment, which leads to a lower accuracy after convergence (see Appendix D).

Byzantine servers.

Figure 5 shows the convergence of ByzSGD in the presence of 1 Byzantine server. We experimented with 4 different adversarial behaviors: 1. Reversed: the server sends a correct model multiplied by a negative number, 2. Partial Drop: the server randomly chooses 10% of the weights and set them to zero (this simulates using unreliable transport protocol in the communication layer, which was proven beneficial in some cases, e.g., (Damaskinos et al., 2019)), 3. Random: the server replaces the learned weights by random numbers, and 4. LIE, an attack inspired from the little is enough attack (Baruch et al., 2019), in which the server multiplies each of the individual weights by a small number $z$, where $\lvert z-1\rvert<\delta$ with $\delta$ close to zero; $z=1.035$ in our experiments. Such a figure shows that ByzSGD can tolerate the experimented Byzantine behavior and guarantee the learning convergence to a high accuracy.

7. Concluding Remarks

Summary.

This paper is a first step towards genuinely distributed Byzantine–resilient Machine Learning (ML) solutions that do not trust any network component. We present ByzSGD that guarantees learning convergence despite the presence of Byzantine machines. Through the introduction of a series of novel ideas, the Scatter/Gather protocol, the Distributed Median-based Contraction (DMC) module, and the filtering mechanisms, we show that ByzSGD works in an asynchronous setting, and we show how we can leverage synchrony to boost performance. We built ByzSGD on top of TensorFlow, and we show that it tolerates Byzantine behavior with $32\%$ overhead compared to vanilla TensorFlow.

Related work.

With the impracticality (and sometimes impossibility (Fischer et al., 1985)) of applying exact consensus to ML applications, the approximate consensus (Fekete, 1987) seems to be a good candidate. In approximate consensus, all nodes try to decide values that are arbitrarily close to each other and that are within the range of values proposed by correct nodes. Several approximate consensus algorithms were proposed with different convergence rates, communication/computation costs, and supported number of tolerable Byzantine nodes, e.g., (Dolev et al., 1986; Fekete, 1986; Abraham et al., 2004; Mendes et al., 2015).

Inspired by approximate consensus, several Byzantine–resilient ML algorithms were proposed yet, all assumed a single correct parameter server: only workers could be Byzantine. Three Median-based aggregation rules were proposed to resist Byzantine attacks (Xie et al., 2018a). Krum (Blanchard et al., 2017) and Multi-Krum (Damaskinos et al., 2019) used a distance-based algorithm to eliminate Byzantine inputs and average the correct ones. Bulyan (El Mhamdi et al., 2018) proposed a meta-algorithm to guarantee Byzantine resilience against a strong adversary that can fool the aforementioned aggregation rules. Draco (Chen et al., 2018) used coding schemes and redundant gradient computation for Byzantine resilience, where Detox (Rajput et al., 2019) combined coding schemes with Byzantine–resilient aggregation for better resilience and overhead guarantees. Kardam (Damaskinos et al., 2018) is the only proposal to tolerate Byzantine workers in asynchronous learning setup. ByzSGD augments these efforts by tolerating Byzantine servers in addition to Byzantine workers.

Open questions.

This paper opens interesting questions.

First, the relation between the frequency of entering the gather phase (i.e., the value of $T$) and the variance between models on correct servers is both data and model dependent. In our analysis, we provide safety guarantees on this relation that always ensure Byzantine resilience and convergence. However, we believe that in some cases, entering the gather phase more frequently may lead to a noticeable improvement in the convergence speed (see Appendix E.2). The trade-off between this gain and the corresponding communication overhead is an interesting open question.

Second, the Lipschitz filter requires $n_{ps}>3f_{ps}$ (see Appendix C.2.3). There is another tradeoff here between the communication overhead and the required number of parameter servers. One can use Byzantine–resilient aggregation of models, which requires only $n_{ps}>2f_{ps}$, yet requires communicating with all servers in each step. In our design, we strive for reducing the communication overhead, given that communication is the bottleneck (Zhang et al., 2017; Hsieh et al., 2017).

Third, it is interesting to explore similar Byzantine–resilient solutions in the context of decentralized settings, i.e., in which all machines are considered as workers with no central servers and also with non-iid data. Although it seems that we can directly apply the same algorithms presented in this paper to such settings, designing better algorithms with low communication overhead with provable resilience guarantees remains an open question.

Acknowledgments

This work has been supported in part by the Swiss National Science Foundation (FNS grant 200021_182542/1).

Most experiments presented in this paper were carried out using the Grid’5000 testbed, supported by a scientific interest group hosted by Inria and including CNRS, RENATER and several Universities as well as other organizations (see https://www.grid5000.fr).

Appendix A Preliminary Material

A.1. Byzantine–resilient aggregation

Byzantine–resilient aggregation of gradients is the key for Byzantine workers’ resilience. To this end, gradients are processed by a gradient aggregation rule (GAR), which purpose is to ensure that output of aggregation is as close as possible to the real gradient of the loss function.

In the general theory of stochastic gradient descent (SGD) convergence, a typical validity assumption is that the gradient estimator is unbiased (Bottou, 1998). The role of a GAR is to ensure a relaxed version of this assumption in order to accommodate for the presence of malicious workers (whose gradients are potentially biased).

Definition A.1 gives such a relaxation, which we adapt from (Blanchard et al., 2017; El Mhamdi et al., 2018) and which was used as a standard for Byzantine resilience in, e.g.  (Xie et al., 2018b, c, a).

Definition A.1.

Let $\alpha\leq 0<\frac{\pi}{2}$ be any angular value and $0\leq f\leq n$ with $n$ the total number of input vectors to the GAR and $f$ the maximum number of Byzantine vectors. Let $g$ be an unbiased estimate of the true gradient $G$, i.e., $\mathop{{}\mathbb{E}}G=g$.

A GAR (which output noted as $\mathcal{F}$) is robust (said to be $\left(\alpha,f\right)$–Byzanitne resilient) if

$\left\langle\mathop{{}\mathbb{E}}\mathcal{F},g\right\rangle\geq(1-\sin\alpha).\left\lVert{g}\right\rVert_{2}^{2}>0$

ByzSGD uses two GARs: Minimum–Diameter Averaging (El Mhamdi et al., 2018) (which can be safely replaced with any other GAR that gives similar guarantees such as Krum (Blanchard et al., 2017) or Bulyan (Xie et al., 2018a)) and Median (Xie et al., 2018a).

A.2. Minimum–Diameter Averaging (MDA)

MDA is a gradient aggregation rule (GAR) that ensures resilience against a minority of Byzantine input gradients. Mathematically, this function was introduced in (Rousseeuw, 1985) and its Byzantine resilience proof was given in (El Mhamdi et al., 2018). MDA satisfies the $\left(\alpha,f\right)$ Byzantine resilience guarantees444Basically, any GAR that satisfies such a form of resilience (Blanchard et al., 2017; El Mhamdi et al., 2018; Xie et al., 2018a) can be used with ByzSGD; MDA is just an instance. introduced in (Blanchard et al., 2017). Formally, let $\mathcal{X}$ be the set of input gradients (all follow the same distribution), out of them $f$ are Byzantine, and $y$ be the output of the Byzantine resilient GAR. Then, the following properties hold:

1. (1)

$\mathop{{}\mathbb{E}}{}y$ is in the same half–space as $\mathop{{}\mathbb{E}}\mathcal{X}$. 2. (2)

the first $4$ statistical moments of $y$ are bounded above by a linear combination of the first $4$ statistical moments of $x\sim\mathcal{X}$.

Such conditions are sufficient to show that the output of this GAR guarantees convergence of the learning procedure. More formally, these conditions enable the GAR to have a proof that follows from the global confinement proof of Stochastic Gradient Descent (SGD) (Bottou, 1998).

In order to work, MDA assumes the following (any statistically-robust GAR depends on a similar condition):

[TABLE]

where $\theta$ is the model state at the training step $t$, $n$ is the total number of input gradients, $f$ is the maximum number of Byzantine gradients, $g_{t}$ is an unbiased estimate of the gradient at step $t$, and $L$ is the loss function.

The MDA function works as follows. Consider that the total number of gradients is $n$ and the maximum number of Byzantine gradients is $f$ with $n\geq 2f+1$. MDA enumerates all subsets of size $n-f$ from the input gradients and finds the subset with the minimum diameter among all subsets of this size, i.e., $n-f$. The diameter of a subset is defined as the maximum distance between any two elements of this subset. The output of the MDA function is the average of gradients in such a subset. More formally, the MDA function is defined as follows (El Mhamdi et al., 2018):

Let $\left(g_{1}\ldots{}g_{n}\right)\in\left(\mathbb{R}^{d}\right)^{n}$, and $\mathcal{X}\triangleq\left\{\,g_{1}\ldots{}g_{n}\,\right\}$ the set containing all the input gradients.

Let $\mathcal{R}\triangleq\left\{\,\mathcal{Q}\mid\mathcal{Q}\subset\mathcal{X},~{}\left\lvert{\mathcal{Q}}\right\rvert=n-f\,\right\}$ the set of all the subsets of $\mathcal{X}$ with a cardinality of $n-f$, and let:

[TABLE]

Then, the aggregated gradient is given by:

[TABLE]

A.3. Coordinate–wise Median

We formally define the median as follows:

[TABLE]

such that:

[TABLE]

and:

[TABLE]

We formally define the coordinate–wise median as follows:

[TABLE]

such that:

[TABLE]

ByzSGD uses coordinate-wise median, hereafter simply: Median.

Appendix B ByzSGD’s Notations and Algorithm

B.1. Notations

Let $\left(n_{w},n_{ps},f_{w},f_{ps},d\right)\in\mathbb{N}^{5}$, each representing:

• •

$n_{ps}\geq 3f_{ps}+1$ the total number of parameter servers, among which $f_{ps}$ are Byzantine

• •

$n_{w}\geq 3f_{w}+1$ the total number of workers, among which $f_{w}$ are Byzantine

• •

$2f_{ps}+2\leq q_{ps}\leq n_{ps}-f_{ps}$ the quorum (see Section B.2) used for aggregating servers’ replies

$2f_{w}+1\leq q_{w}\leq n_{w}-f_{w}$ the quorum used for aggregating workers’ replies

• •

$d$ the dimension of the parameter space $\mathbb{R}^{d}$

Let (without loss of generality):

• •

$\left[{1}\,..\,{n_{ps}-f_{ps}}\right]$ be indexes of correct parameter servers

$\left[{n_{ps}-f_{ps}+1}\,..\,{n_{ps}}\right]$ be indexes of Byzantine servers

• •

$\left[{1}\,..\,{n_{w}-f_{w}}\right]$ be indexes of correct workers

$\left[{n_{w}-f_{w}+1}\,..\,{n_{w}}\right]$ be indexes of Byzantine workers

Let ${\theta}^{\left({i}\right)}_{t}$ be a notation for the parameter vector (i.e., model) at parameter server $i\in\left[{1}\,..\,{n_{ps}-f_{ps}}\right]$ for step $t\in\mathbb{N}$.

Let ${g}^{\left({i}\right)}_{t}$ be a notation for the gradient estimation at worker $i\in\left[{1}\,..\,{n_{w}-f_{w}}\right]$ for step $t\in\mathbb{N}$.

Let ${\mathcal{G}}^{\left({i}\right)}_{t}$ be a notation for the gradient distribution at worker $i\in\left[{1}\,..\,{n_{w}-f_{w}}\right]$ for step $t\in\mathbb{N}$.

Let $L$ be the loss function we aim to minimize, let $\nabla{}L\left({{\theta}}\right)$ be the real gradient of the loss function at ${\theta}$, and let $\widehat{\nabla{}L}\left({{\theta}}\right)$ be a stochastic estimation of the gradient, following ${\mathcal{G}}$, of $L$ at ${\theta}$.

Let \xi_{t}{\color[rgb]{.5,.5,.5}\,\times\!\left({k}\right)^{\left({a}\right)}} denote the subset of size $k$ of some set $\left\{\xi^{(1)}_{t}\ldots{}\xi^{(n)}_{t}\right\}$ delivered by node $a$ at step $t$. To highlight the fact that such a subset can contain up to $f$ arbitrary (Byzantine) vectors, we will also denote it by \left(\xi_{t}{\color[rgb]{.5,.5,.5}\,\times\!\left({k-f}\right)^{\left({a}\right)}},\xi_{t}{\color[rgb]{.5,.5,.5}\,\times\!\left({f}\right)^{\left({a}\right)}}\right). Also, the exact value of $n$ depends on the context: in the proof, it will always be $n_{w}$ when $\xi^{(i)}_{t}$ denotes a gradient, and $n_{ps}$ otherwise.

Let $\eta_{t}$ be the learning rate at the learning step $t\in\mathbb{N}$ with the following specifications:

1. (1)

The sequence of learning rates $\eta_{t}$ is decreasing 555In fact, it is sufficient that the sequence is decreasing only once every $T$ steps, with $T=\frac{1}{3.l.\eta_{1}}$ where $l$ is the Lipschitz coefficient of assumption 5 (cf Section C.1). with $t$, i.e., if $t_{a}>t_{b}$ then, $\eta_{t_{a}}<\eta_{t_{b}}$. Thus, the initial learning rate $\eta_{0}$ is the largest value among learning rates used in subsequent steps. 2. (2)

The sequence of learning rates $\eta_{t}$ satisfies $\sum_{t}{\eta_{t}}=\infty$ and $\sum_{t}{{\eta_{t}}^{2}}<\infty$.

B.2. ByzSGD’s Algorithm

Initialization.

Each correct parameter server $i$ and worker $j$ starts (at step $t=0$) with the same parameter vector:

[TABLE]

Additionally, in the synchronous case, each correct worker $j$ generates a random integer $r_{j}\in\left[{1}\,..\,{n_{ps}}\right]$ and computes ${g}^{\left({j}\right)}_{0}$ (via backpropagation) at the initial model ${\theta}_{0}$.

Training loop.

Each training step $t\in\mathbb{N}$, the following sub-steps are executed sequentially (unless otherwise stated).

1. (1)

Each parameter server $i$ pulls gradients ${g}_{t}$ from all666In asynchronous networks, the server waits for only $n_{w}-f_{w}$ replies. workers and then applies the MDA function on the received gradients, computing the aggregated gradient ${g}^{\left({i}\right)}_{\text{agg}}$. Then, each server uses its own computed ${g}^{\left({i}\right)}_{\text{agg}}$ to update the model as follows: ${\theta}^{\left({i}\right)}_{t+1}={\theta}^{\left({i}\right)}_{t}-\eta_{t}{g}^{\left({i}\right)}_{\text{agg}}$. 2. (2)

While parameter servers are doing step 6, each worker $j$ does a speculative step as follows: a worker $j$ calculates its local view to the updated model: ${\theta}^{\left({j(l)}\right)}_{t+1}={\theta}^{\left({j}\right)}_{t}-\eta_{t}{g}^{\left({j}\right)}_{t}$. 3. (3)

a. In the asynchronous algorithm, each worker $j$ asks for the updated models from all servers; yet, it does not expect to receive more than $n_{ps}-f_{ps}$ replies. The worker $j$ then computes Median on the received models to obtain ${\theta}^{\left({agg}\right)}_{t+1}$. In normal (i.e., scatter) steps, worker $j$ sets ${\theta}^{\left({j}\right)}_{t+1}={\theta}^{\left({agg}\right)}_{t+1}$.

b. In the synchronous algorithm, each worker $j$ pulls one parameter vector ${\theta}^{\left({i}\right)}_{t+1}$ from server $i$ where, $i=(r_{j}+t+1)\text{ mod }n_{ps}$. Each worker $j$ does the backpropagation step, computing ${g}^{\left({j}\right)}_{t+1}$ at the pulled model ${\theta}^{\left({i}\right)}_{t+1}$. 4. (4)

To complete the picture in the synchronous variant, each worker $j$ tests the legitimacy of the received model ${\theta}^{\left({i}\right)}_{t+1}$ using the Lipschitz criterion (i.e., Lipschitz filter) and the difference on model norms (i.e., Outliers filter) as follows. First, a worker $j$ calculates $k$, an empirical estimation of the Lipschitz coefficient, which is defined as:

[TABLE]

Then, the worker tests whether this value $k$ lies in the non-Byzantine quantile of Lipschitz coefficients: $k\leq K_{p}\triangleq\text{quantile}_{\frac{n_{ps}-f_{ps}}{n_{ps}}}\{K\}$ where, $K$ is the list of all previous Lipschitz coefficients $k$ (i.e., with $t_{prev}<t$). Second, the worker $j$ computes the distance between the local and the pulled (from server $i$) models as follows: $\left\lVert{{\theta}^{\left({j(l)}\right)}_{t+1}-{\theta}^{\left({i}\right)}_{t+1}}\right\rVert_{2}$ and makes sure that such a difference remains strictly below:

[TABLE]

with $T=\frac{1}{3l\eta_{1}}$, where $l$ is the Lipschitz coefficient (assumption 5. If both conditions are satisfied, the received model ${\theta}^{\left({i}\right)}_{t+1}$ is approved and the algorithm continues normally. Otherwise, the parameter server $i$ is suspected and its model is ignored; worker $j$ continues by repeating step $t$ again from step 3. 5. (5)

To bound the drifts between parameter vectors at correct servers, each $T=\frac{1}{3l\eta_{1}}$ steps, a global gather phase is entered on both servers and workers sides by completing the Distributed Median-based Contraction module. During this phase, the following happens: each server $i$ sends to all other servers its current view of the model ${\theta}^{\left({i}\right)}_{t}$. After gathering models from all servers (or $n_{ps}-f_{ps}$ servers in the asynchronous case), each server $i$ aggregates such models with Median, computing ${\theta}^{\left({i(agg)}\right)}_{t}$. Then, each worker $j$ pulls the model ${\theta}^{\left({i(agg)}\right)}_{t}$ from all parameter servers (or $n_{ps}-f_{ps}$ servers in the asynchronous case) and aggregates the received models using Median. Finally, each worker $j$ uses the aggregated model to compute the backpropagation step, and the algorithm continues normally from step 6.

We call steps 6 through 4 scatter phase and step 5 gather phase. During scatter phase(s) servers do not communicate and hence, their views of the model deviate from each other. The goal of the gather phase (through applying the DMC computation) is to bring back the models at the correct servers close to each other.

Appendix C ByzSGD’s Convergence

In this section, we show that ByzSGD guarantees convergence and tolerates Byzantine workers and servers. We first state the assumptions for ByzSGD to work and then dive into the proof.

Formally, we prove that, noting ${\theta}_{t}\triangleq\emph{Median}{}\left({\theta}^{\left({1}\right)}_{t}\ldots{}{\theta}^{\left({n}\right)}_{t}\right)$:

[TABLE]

C.1. Assumptions

1. (1)

$\forall t\in\mathbb{N},~{}{g}^{\left({1}\right)}_{t}\ldots{}{g}^{\left({n_{w}-f_{w}}\right)}_{t}\text{ are mutually independent}$. 2. (2)

$\exists\sigma^{\prime}\in\mathbb{R}_{+},~{}\forall\left(i,t\right)\in\left[{1}\,..\,{n_{w}-f_{w}}\right]\times\mathbb{N},~{}\mathop{{}\mathbb{E}}\left\lVert{{g}^{\left({i}\right)}_{t}-\mathop{{}\mathbb{E}}{g}^{\left({i}\right)}_{t}}\right\rVert_{2}\leq\sigma^{\prime}$. 3. (3)

$L$ is positive, and $3$–times differentiable with continuous derivatives. 4. (4)

$\forall r\in\left[{2}\,..\,{4}\right],~{}\exists\left(A_{r},B_{r}\right)\in\mathbb{R}^{2},~{}\forall\left(i,t,{\theta}\right)\in\left[{1}\,..\,{n_{w}-f_{w}}\right]\times\mathbb{N}\times\mathbb{R}^{d},~{}\mathop{{}\mathbb{E}}\left\lVert{{g}^{\left({i}\right)}_{t}}\right\rVert_{2}\leq A_{r}+B_{r}\left\lVert{{\theta}}\right\rVert_{2}^{r}$. 5. (5)

$L$ is Lipschitz continuous, i.e. $\exists l>0,~{}\forall\left(x,y\right)\in\left(\mathbb{R}^{d}\right)^{2},~{}\\ \left\lVert{\nabla{}L\left({x}\right)-\nabla{}L\left({y}\right)}\right\rVert_{2}\leq l\left\lVert{x-y}\right\rVert_{2}$. 6. (6)

$\exists D\in\mathbb{R},~{}\forall{\theta}\in\mathbb{R}^{d},~{}\left\lVert{{\theta}}\right\rVert_{2}^{2}\geq D,~{}\exists\left(\varepsilon,\beta\right)\in\mathbb{R}_{+}\times\left[0,\frac{\pi}{2}-\eta\right[,~{}\\ \left\lVert{\nabla{}L\left({{\theta}}\right)}\right\rVert_{2}\geq\varepsilon,~{}\left\langle{\theta},\nabla{}L\left({{\theta}}\right)\right\rangle\geq\cos\left(\beta\right)\,\left\lVert{{\theta}}\right\rVert_{2}\,\left\lVert{\nabla{}L\left({{\theta}}\right)}\right\rVert_{2}$. 7. (7)

Denote $S_{j}\triangleq\left\{s\!\subset\!\left[{1}\,..\,{n_{ps}\!-\!f_{ps}}\right]\!-\!\left\{j\right\}~{}\middle|~{}\left\lvert{s}\right\rvert\!\in\!\left[{q\!-\!f\!-\!1}\,..\,{q\!-\!1}\right]\right\}$ the subset of correct parameter server indexes that parameter server $j$ can deliver at a given step. We then call $S=\prod_{j\in\left[{1}\,..\,{n_{ps}-f_{ps}}\right]}S_{j}$ the set of all correct parameter server indexes the $n_{ps}-f_{ps}$ correct parameter servers can deliver. We assume $\exists\rho>0,~{}\forall s\in S,~{}P\left(X=s\right)\geq\rho$.

Assumptions 1 to 5 (i.i.d, bounded variance, differentiability of the loss, bounded statistical moments, and Lipschitz continuity of the gradient) are the most common ones in classical SGD analysis (Bottou, 1998; Bousquet and Bottou, 2008).

Assumption 6 was first adapted from (Bottou, 1998) by (Blanchard et al., 2017; El Mhamdi et al., 2018; Damaskinos et al., 2018) to account for Byzantine resilience. It intuitively says that beyond a certain horizon, the loss function is “steep enough” (lower bounded gradient) and “convex enough” (lower bounded angle between the gradient and the parameter vector). The loss function does not need to be convex, but adding regularization terms such as $\|\theta\|^{2}$ ensures assumption 6, since close to infinity, the regularization dominates the rest of the loss function and permits the gradient $\nabla L(\theta)$ to point to the same half space as $\theta$. The original assumption of (Bottou, 1998) is that $\left\langle{\theta},\nabla{}L\left({{\theta}}\right)\right\rangle>0$; in  (Blanchard et al., 2017; El Mhamdi et al., 2018) it was argued that requiring this scalar product to be strictly positive is the same as requiring the angle between ${\theta}$ and $\nabla{}L\left({{\theta}}\right)$ to be lower bounded by an acute angle ($\beta<\pi/2$).

C.2. Lemmas

In this section, we develop lemmas that will be used in proving the convergence of ByzSGD.

C.2.1. MDA bounded deviation from majority

Let $\left(d,f\right)\in{\mathbb{N}_{>0}}^{2}$, let $q\in\mathbb{N}$ such that $q\geq 2\,f+1$.

Let note $H_{1}\triangleq\left[{1}\,..\,{q-f}\right]$ and $H_{2}\triangleq\left[{q+1}\,..\,{2\,q-f}\right]$.

Lemma C.1 (Guarantee of MDA).

We will show that:

[TABLE]

Proof.

We will proceed by construction of MDA (Section A.2).

Reusing the formal notation from the end of A.2, we recall that $\emph{MDA}{}\left(x_{1}\ldots{}x_{q}\right)\triangleq\frac{1}{q-f}\sum_{x\in\mathcal{S}_{1}}{x}$.

Since $\mathcal{S}_{1}$ is a subset of size $q-f$ of smallest diameter in $\left\{x_{1}\ldots{}x_{q}\right\}$, the following holds:

[TABLE]

Then, observing that $q-f>f\implies\exists k\in H_{1},~{}x_{k}\in\mathcal{S}_{1}$, we can compute:

[TABLE]

Using the same construction, with $l\in H_{2}$:

[TABLE]

Finally, reusing $k$ and $l$, we can compute and conclude:

[TABLE]

∎

Using the exact same derivation (while replacing the general vector $x$ by gradient $g$), we can show that the distance between aggregated gradients on two correct parameter servers, at any time $t$, is bounded.

Consider two correct servers $x$ and $z$, we can show that:

[TABLE]

In plain text, this equation bounds the difference between aggregated gradients at two different correct servers, based on the maximum distance between two correct gradients, i.e., aggregated gradients on different servers will not drift arbitrarily.

C.2.2. Bounded distance between correct models

To satisfy Equation 7 (the required assumption by MDA, Section A.2) and bound $r_{max}$, models at correct parameter servers should not go arbitrarily far from each other. Thus, a global gather phase (step 5 in Section B.2) is executed once in a while to bring the correct models back close to each other. We quantify the maximum number of steps that can be executed in one scatter phase before executing one gather phase. From another perspective, the goal is to find the maximum possible distance between correct models that still satisfies the requirement of MDA on the distance between correct gradients (Equation 7).

Without loss of generality, assume two correct parameter servers $x$ and $z$ starting with the same initial model ${\theta}_{0}$. After the first step, their updated models are given by:

[TABLE]

Thus, the difference between them is given by:

[TABLE]

In a perfect environment, with no Byzantine workers, this difference is zero, since the input gradients to the MDA function at both servers are the same (no worker lies about its gradient estimation), and the MDA function is deterministic (i.e., the output of MDA computation on both servers is the same). However, a Byzantine worker can send different gradients to different servers while crafting these gradients carefully to trick the MDA function to include them in the aggregated gradient (i.e., force MDA to select the malicious gradients in the set $\mathcal{S}$). In this case, $\left\lVert{{\theta}^{\left({x}\right)}_{1}-{\theta}^{\left({z}\right)}_{1}}\right\rVert_{2}$ is not guaranteed to be zero. Based on Equation 9, the difference between the result of applying MDA in the same step is bounded and hence, such a difference can be given by:

[TABLE]

Following the same analysis, the updated models in the second step at our subject parameter servers are given by:

[TABLE]

Thus, the difference between models now will be:

[TABLE]

The bound on the first term is given in Equation 10 and that on the second term is given in Equation 9 and hence, the difference between models in the second step is given by:

[TABLE]

By induction, we can write that the difference between models on two correct parameter servers at step $\tau$ is given by:

[TABLE]

Since ${g}^{\left({i}\right)}_{t}$ and ${g}^{\left({j}\right)}_{t}$ are computed at different workers, they can be computed based on different models ${\theta}^{\left({i}\right)}_{t}$ and ${\theta}^{\left({j}\right)}_{t}$. Following Assumption 5 (the Lipschitzness of the loss function), $\left\lVert{{g}^{\left({i}\right)}_{t}-{g}^{\left({j}\right)}_{t}}\right\rVert_{2}$ is bounded from above with $l\left\lVert{{\theta}^{\left({i}\right)}_{t}-{\theta}^{\left({j}\right)}_{t}}\right\rVert_{2}$. Noting that the sequence $\eta_{t}$ is monotonically decreasing with $t\rightarrow\infty$ (Section B.1), Equation 12 can be written as:

[TABLE]

Assuming that the maximum difference between any two correct models is bounded by $\mathcal{K}$ (this is enforced anyway by the algorithm through entering frequently the gather phase), this difference can be written as:

[TABLE]

Now, to ensure the bound on the maximum difference between models, we need the value of $\left\lVert{{\theta}^{\left({x}\right)}_{t}-{\theta}^{\left({z}\right)}_{t}}\right\rVert_{2}\leq\mathcal{K}$. At this point, the number of steps $\tau=T$ should be bounded from above as follows:

[TABLE]

$T$ here represents the maximum number of steps that are allowed to happen in the scatter phase, i.e., before entering one gather phase. Doing more steps than this number leads to breaking the requirement of MDA on the variance between input gradients, leading to breaking its Byzantine resilience guarantees. Thus, this bound is a safety bound that one should not pass to guarantee convergence. One can do less number of steps (than $T$) during the scatter phase for a better performance (as we discuss in Section 7). Moreover, this bound requires that the initial setup satisfies the assumptions of MDA. Having a deployment that does not follow such assumptions leads to breaking guarantees of our protocol (as we show in Section 6).

C.2.3. Byzantine models filtering

This section shows that the filtering mechanism that is applied by workers (in the synchronous variant of ByzSGD) (step 4 in Section B.2) accepts only legitimate models that are received from servers which follow the algorithm, i.e., correct servers.

Such a filter is composed of two components: (1) a Lipschitz filter, which bounds the growth of models with respect to gradients, and (2) a Outliers filter, which bounds the distance between models in two consecutive steps. We first discuss the Lipschitz filter then the Outliers filter; we show that using either of them only does not guarantee Byzantine resilience.

Lipschitz filter.

The Lipschitz filter runs on worker side, where it computes an empirical estimation for the Lipschitz coefficient of the pulled model and suspects it if its computed coefficient is far from Lipschitz coefficients of the previous correct models (from previous steps).

The Lipschitz filter, by definition, accepts on average $n_{ps}-f_{ps}$ models each pulled ${n_{ps}}$ models. Such a bound makes sense given the round robin fashion of pulling models from servers (by workers) and the existence of (at most) $f_{ps}$ Byzantine servers. Based on this filter, each worker pulls, on average, $n_{ps}+f_{ps}$ each $n_{ps}$ steps. Due to the presence of $f_{ps}$ Byzantine servers, this is a tight lower bound on the communication between each worker and parameter servers to pull the updated model. The worst attack an adversary can do is to send a model that passes the filter (looks like a legitimate model, i.e., very close to a legitimate model) that does not lead to computing a large enough gradient (i.e., leads to minimal learning progress); in other words: an attack that drastically slows down progress. For this reason, such a filter requires $n_{ps}>3f_{ps}$. With this bound, the filter ensures the acceptance of at least $f_{ps}+1$ models for each pulled $n_{ps}$ models, ensuring a majority of correct accepted models anyway and hence, ensuring the progress of learning. Moreover, due to the randomness of choosing the value $r_{j}$ and the round robin fashion of pulling the models, progress is guaranteed in such a step, as correct and useful models are pulled by other workers, leading to computing correct gradients.

Based on Assumption 5 and the round robin fashion of pulling models, a Lipschitz coefficient that is computed based on a correct model is always bounded between two Lipschitz coefficients resulting from correct models. Based on this, the global confinement property is satisfied (based on the properties of models that passes the Lipschitz filter) and hence, we can plug ByzSGD in the confinement proof in (Bottou, 1998). Precisely, given Assumptions 4 and 5, and applying (Bottou, 1998) (of which these assumptions are prerequisite), the models accepted by the Lipschitz filter satisfy the following property:

Let r=2,3,4, $\exists A^{\prime}_{r}\geq 0$ and $B^{\prime}_{r}\geq 0$ such that $\forall t\geq 0,~{}\mathop{{}\mathbb{E}}\left\lVert{{g}_{t}}\right\rVert_{2}\leq A^{\prime}_{r}+B^{\prime}_{r}\left\lVert{{\theta}_{t}}\right\rVert_{2}^{r}$, where ${\theta}_{t}$ is the model accepted by the Lipschitz filter at some worker and ${g}_{t}$ is the gradient calculated based on such a model.

Outliers filter.

The Lipschitz filter is necessary, yet not sufficient to accept models from a parameter server. A Byzantine server can craft some model that is arbitrarily far from the correct model, whose gradient satisfies the Lipschitz filter condition. Thus, it is extremely important to make sure that the received model is close to the expected, correct model. Such a condition is verified by the second filter at the worker side, which we call the Outliers filter. Such a filter is based on the results given in Section C.2.2 and the local model estimation on the workers side.

Without loss of generality, consider a correct worker $j$ that pulls models from parameter servers ${\theta}^{\left({i}\right)}_{t}\forall i\in\left[{1}\,..\,{n_{ps}}\right]$ in a round robin fashion. In each step $t>1$, the worker computes a local estimation of the next (to be received) model ${\theta}^{\left({j(l)}\right)}_{t}$ based on the latest model it has ${\theta}^{\left({j}\right)}_{t-1}$ and its own gradient estimation ${g}^{\left({j}\right)}_{t-1}$. The local model estimation is done as follows:

[TABLE]

Without loss of generality, assume that worker $j$ pulls the model from some server $i$ in step $t$. If such a server is correct, it computes the new model ${\theta}^{\left({i}\right)}_{t}$ as follows:

[TABLE]

Thus, the difference between the local model estimation at worker $j$ and the received model from server $i$ (if it is correct) is given by:

[TABLE]

Based on the guarantees given by MDA (El Mhamdi et al., 2018), the following bound holds:

[TABLE]

Based on the results of Section C.2.2, the maximum distance between two correct models just after a gather phase is:

[TABLE]

By induction, we can find the bound on the value $\left\lVert{{\theta}^{\left({j(l)}\right)}_{t-1}-{\theta}^{\left({i}\right)}_{t-1}}\right\rVert_{2}$ and hence, we can write:

[TABLE]

Thus, a received model ${\theta}^{\left({i}\right)}_{t}$ that satisfies Equation 14 is considered passing the Outliers filter. Such a model is guaranteed to be in the correct cone of models in one scatter phase. Note that such a filter cannot be used alone without the Lipschitz filter. A Byzantine server can craft a model that satisfies such a filter (i.e., the Outliers filter) while being on the opposite direction of minimizing the loss function. Such a model then will be caught by the Lipschitz filter.

Combining the Lipschitz filter and the Outliers filter guarantees that the received model at the worker side is close to the correct one (at the current specific scatter phase), representing a reasonable growth, compared to the latest local model at the worker.

C.3. Convergence of ByzSGD: The Asynchronous Case

In this section, under the assumptions laid in Section C.1, we formally prove (8).

C.3.1. Median contraction effect

Let $\left(d,f,n,q\right)\in\left(\mathbb{N}-\left\{0\right\}\right)^{2}\times\mathbb{N}^{2}$ such that $2\,f+2\leq q\leq\left\lfloor{\frac{n-f}{2}}\right\rfloor$, and note $h\triangleq n-f$.

Denote $S_{j}\triangleq\left\{s\subset\left[{1}\,..\,{h}\right]-\left\{j\right\}~{}\middle|~{}\left\lvert{s}\right\rvert\in\left[{q-f-1}\,..\,{q-1}\right]\right\}$ the subset of correct parameter server indexes that parameter server $j$ can deliver at a given step. We then call $S=\prod_{j\in\left[{1}\,..\,{h}\right]}S_{j}$ the set of all correct parameter server indexes the $h$ correct parameter servers $i\in\left[{1}\,..\,{h}\right]$ can deliver. Our key assumption is that, for any configuration occurs with positive probability.

Formally, consider $\mathcal{S}$ the probability distribution over delivering configurations, and $X\sim\mathcal{S}$ a random set that follows the probability distribution $\mathcal{S}$. We assume that

[TABLE]

We denote $\rho=\min_{s\in S}P(X=s)$ the probability of least likely configuration. Since the set $S$ of configurations is finite, our key assumption equivalently says that $\rho>0$.

Denote ${\overline{\theta}}^{\left({j}\right)}_{t}\in\mathbb{R}^{d}$ the parameter vector held by parameter server $j$ at step $t$, ${\overline{\Theta}}^{\left({X_{j}}\right)}_{t}\triangleq\left\{{\overline{\theta}}^{\left({k}\right)}_{t}~{}\middle|~{}k\in X_{j}\right\}$ the parameter vectors from correct parameter servers that were delivered by parameter server $j$ at step $t$, and $z_{t}^{(j)}=(z_{t}^{(1,j)},\ldots,z_{1}^{(q-X_{j},j)})$ the Byzantine parameter vectors777A Byzantine parameter server can send different parameter vectors to each correct parameter server at each step $t$, hence the notation. that were delivered by parameter server $j$ at step $t$, where each $z_{k}^{(j)}\in\mathbb{R}^{d}$.

The updated vector of parameter server $j$ at step $t$ is then given by

[TABLE]

In this section, we prove that the updated parameters ${\theta}^{\left({1}\right)}_{t}\ldots{}{\theta}^{\left({h}\right)}_{t}$ have been contracted compared to parameters ${\overline{\theta}}^{\left({1}\right)}_{t}\ldots{}{\overline{\theta}}^{\left({h}\right)}_{t}$. It turns out that this claim does not actually hold for naive measures of how “contracted” a set of parameters are. In particular, the diameter of the vectors ${\theta}^{\left({1}\right)}_{t}\ldots{}{\theta}^{\left({h}\right)}_{t}$’s measured in, say, $\ell_{2}$ norm, does not necessarily get contracted.

The key trick of our analysis is to focus instead on coordinate-wise diameters. More precisely, denote:

[TABLE]

the diameter of vectors ${\overline{\theta}}^{\left({1}\right)}_{t}\ldots{\overline{\theta}}^{\left({h}\right)}_{t}$ along coordinate $i$. We can then add up these coordinate-wise diameters to obtain the measure $\Delta_{{\overline{\theta}}_{t}}=\sum_{i\in\left[{1}\,..\,{d}\right]}\Delta_{{\overline{\theta}}_{t},i}$ which is still a measure of how spread the vectors ${\overline{\theta}}^{\left({j}\right)}_{t}$’s are. The key result of this section is that this measure decreases exponentially, i.e.

[TABLE]

for some contraction parameter $m\in[0,1[$, and where the expectation is taken over $X\sim\mathcal{S}$. More precisely, in expectation over random delivering configurations, no matter how Byzantines attack the different workers, the spread of the parameter servers parameters decrease exponentially.

The following lemma shows that bounding this measure is sufficient to control the diameter of servers’ parameters.

Lemma C.2.

We have the following inequalities:

[TABLE]

Proof.

Let $j^{*}$ and $k^{*}$ two servers whose parameters are most distant, i.e. such that

[TABLE]

Clearly the latter term is upper-bounded by

[TABLE]

which is exactly the sum $\Delta_{x}$ of coordinate-wise diameters. The first inequality is derived from the well-known equality $\left\lVert{z}\right\rVert_{2}\leq\left\lVert{z}\right\rVert_{1}$.

Note that a coordinate-wise distance is smaller than the $\ell_{1}$ distance. Therefore,

[TABLE]

We then conclude by using the inequality $\left\lVert{z}\right\rVert_{1}\leq\sqrt{d}\left\lVert{z}\right\rVert_{2}$. ∎

To prove this result, we start with an easy lemma.

Lemma C.3.

With probability 1, we have $\Delta_{{\theta}_{t},i}\leq\Delta_{{\overline{\theta}}_{t},i}$. In other words, there can be no dilation of the diameter along a coordinate.

Proof.

Let $x_{min}\!\left[{i}\right]$ and $x_{max}\!\left[{i}\right]$ the minimum and maximum $i$-coordinate of correct vectors ${\overline{\theta}}^{\left({1}\right)}_{t}\ldots{}{\overline{\theta}}^{\left({h}\right)}_{t}$’s. Since $q\geq 2f+2>2f$, we know that a strict majority of vectors delivered to $j$ are correct, and thus belong to $\left[x_{min}\!\left[{i}\right],x_{max}\!\left[{i}\right]\right]$. Therefore, ${\theta}^{\left({j}\right)}_{t}\!\left[{i}\right]$ must belong to this interval too. Since this holds for any parameter server $j$, we know that $\Delta_{{\theta}_{t},i}\leq x_{max}\!\left[{i}\right]-x_{min}\!\left[{i}\right]=\Delta_{{\overline{\theta}}_{t},i}$. ∎

Now along each coordinate, we separate the set of workers along two subsets $left\!\left[{i}\right]$ and $right\!\left[{i}\right]$, defined by

[TABLE]

We then go on showing that the minority subset has a positive probability of making a significant step towards the other side. First, we quantify the size of this large possible step.

Lemma C.4.

If $X_{j}\subset right\!\left[{i}\right]$, then

[TABLE]

Moreover, if $X_{j}\subset left\!\left[{i}\right]$, then ${\theta}^{\left({j}\right)}_{t}\!\left[{i}\right]\leq\frac{1}{4}\left(x_{min}\!\left[{i}\right]+3\,x_{max}\!\left[{i}\right]\right).$

Proof.

Assume $X_{j}\subset right\!\left[{i}\right]$. Since $q\geq 2f+2$, we know that that $\left\lvert{j\cup X_{j}}\right\rvert\geq q-f\geq q/2+1$ contains a strict majority of the inputs to compute ${\theta}^{\left({j}\right)}_{t}\!\left[{i}\right]$. Thus the median is at least the average of two smallest coordinates $i$ of points $\left\lvert{j\cup X_{j}}\right\rvert$, which is at least

[TABLE]

The second bound is proved similarly. ∎

Lemma C.5.

We can then show expected strict contraction along every coordinate $i$, i.e.

[TABLE]

Proof.

Note that $right\!\left[{i}\right]+left\!\left[{i}\right]=h$. Thus at least one of the two subsets has at most $\lfloor h/2\rfloor$ elements. Since $q\leq\lfloor\frac{n-f}{2}\rfloor=\lfloor h/2\rfloor$, we know that $q-f\leq\lfloor h/2\rfloor$. This means that there is a subset $s_{0}$ of $left\!\left[{i}\right]$ or of $right\!\left[{i}\right]$ with at least $q-f$ elements.

Without loss of generality, assume $s_{0}\subset left\!\left[{i}\right]$ with cardinal $q-f$, and let $s_{j}=s_{0}-\{j\}$. Then the tuple $s=(s_{1},\ldots,s_{h})\in S$ is a delivering configuration. By virtue of our key assumption (Equation 15), we know that $P(X=s)\geq\rho>0$.

But then, by the previous lemma, in the event $X=s$, we have ${\theta}^{\left({j}\right)}_{t}\!\left[{i}\right]\geq\frac{1}{4}\left(3\,x_{min}\!\left[{i}\right]+x_{max}\!\left[{i}\right]\right)$ for all servers $j$. Since, moreover, we can easily verify that ${\theta}^{\left({j}\right)}_{t}\!\left[{i}\right]\leq x_{max}\!\left[{i}\right]$, we conclude that

[TABLE]

The same bound can be derived for the case $s_{0}\subset right\!\left[{i}\right]$.

Now note that in the event $X\neq s$, by Lemma 1, we still have $\Delta_{{\theta}_{t},i}\leq\Delta_{{\overline{\theta}}_{t},i}$. We can now take the average of the two above cases, which yields

[TABLE]

which concludes the proof. ∎

Lemma C.6.

Despite any Byzantine attack $z\left(X\right)$ that reacts to the random choice of delivering configuration $X\sim\mathcal{S}$, there is a strict contraction of the sum of coordinate-wise diameters, i.e.

[TABLE]

where $m<1$ only depends on the probability distribution $\mathcal{S}$.

Proof.

We simply use the linearity of the expectation, which yields

[TABLE]

which is the key lemma of this section. ∎

C.4. Expected contraction of the correct parameter vectors

Consider parameters $\theta_{t}$ at time $t$. Notice that this parameter will undergo three operations, each of which will be attacked by Byzantines.

First, each worker $j$ will be delivered a subset of parameters. It will need to compute the median of the parameters, to obtain a model ${\theta}^{\left({j}\right)}_{t}$. It will then compute an estimate ${g}^{\left({j}\right)}_{t}$ of the gradient $\nabla{}L\left({{\theta}^{\left({j}\right)}_{t}}\right)$, which will then be broadcast to parameter servers. We make the following critical observations.

Lemma C.7.

Assuming $q_{w}\geq 2f_{w}+1$, we have $\Delta_{x_{t}}\leq\Delta_{\theta_{t}}$ with probability 1.

Proof.

Since there is a majority of workers, for each coordinate $i\in\left[{1}\,..\,{d}\right]$, we have ${\theta}^{\left({j}\right)}_{t}\!\left[{i}\right]\in\left[\theta_{t,min}\!\left[{i}\right],\theta_{t,max}\!\left[{i}\right]\right]$. Therefore,

[TABLE]

Taking the maximum over pairs $(j,k)$, and then adding over $i$ yields the lemma. ∎

Lemma C.8.

For any two workers $j$ and $k$, the delivered gradients satisfy

[TABLE]

where the expectation is over the random delivering configuration of parameters from servers to workers and over the random estimation of the gradients.

Proof.

Note that

[TABLE]

As a result, we know that

[TABLE]

We now use the fact that

[TABLE]

Using our assumption of unbiased gradient estimator with uniformly bounded error $\sigma^{\prime}$, we see that

[TABLE]

To bound the second term of Equation 18, we now use the fact that $\left\lVert{{\theta}^{\left({j}\right)}_{t}-{\theta}^{\left({k}\right)}_{t}}\right\rVert_{2}\leq\Delta_{x_{t}}\leq\Delta_{\theta_{t}}$. Since $\nabla L$ is $l$-Lipschitz, we thus have

[TABLE]

This equation holds in particular for the maximum of the left-hand side, as we vary $j$ and $k$. This concludes the proof of the lemma. ∎

We now move on to the guarantee with respective to the second attack of Byzantines, which occurs as servers aggregate workers’ estimations of the gradient. This guarantee is provided by the Byzantine resilience of MDA.

Lemma C.9.

The diameter of the aggregations of gradients by MDA is at most three times the diameter of correct gradients:

[TABLE]

Proof.

Let us first focus on the computation of ${G}^{\left({j}\right)}_{t}$. Recall that it is obtained by gathering $q_{w}$ vectors ${g}^{\left({r}\right)}_{t}$ from workers, including at most $f_{w}$ Byzantines, and computing the MDA of the the collected vectors. Recall that MDA averages the subset of vectors of minimal diameter. Let $\mathcal{X}^{*}$ a subset of gradients of size $q_{w}-f_{w}$ that minimizes the diameter of the gradients.

Note that the diameter of delivered correct gradients is necessarily at most the diameter of all correct gradients, which we shall denote $D(g_{t})=\max_{j,k\in\left[{1}\,..\,{h_{w}}\right]}\left\lVert{{g}^{\left({j}\right)}_{t}-{g}^{\left({k}\right)}_{t}}\right\rVert_{2}$. Since $q_{w}\geq 2f_{w}+1$, there is a subset of size $q_{w}-f_{w}$ that only contains correct gradients, and whose diameter is thus at most $D(g_{t})$.

Therefore the subset $\mathcal{X}^{*}$ must have diameter at most $D(g_{t})$. But since $q_{w}\geq 2f_{w}+1$, we know that at least one correct gradient ${g}^{\left({r^{*}(j)}\right)}_{t}$ belongs to this subset. This means that all gradients collected by $\mathcal{X}^{*}$ must be at distance at most $D(g_{t})$ from ${g}^{\left({r^{*}(j)}\right)}_{t}$. In other words, for any ${G}^{\left({j}\right)}_{t}$, there exists a correct gradient ${g}^{\left({r^{*}(j)}\right)}_{t}$ such that $\left\lVert{{G}^{\left({j}\right)}_{t}-{g}^{\left({r^{*}(j)}\right)}_{t}}\right\rVert_{2}\leq D(g_{t})$.

But then, we have

[TABLE]

which is at most $3D\left(g_{t}\right)$. ∎

Recall that each server $j$’s parameters are now updated by adding $-\eta_{t}{G}^{\left({j}\right)}_{t}$ to ${\theta}^{\left({j}\right)}_{t}$. We can bound the drift that this update causes as follows.

Lemma C.10.

We have the following inequality:

[TABLE]

where the average is taken over delivering configurations and stochastic gradient estimates.

Proof.

Note that, on each coordinate $i$, for any two servers $j$ and $k$, we have

[TABLE]

Note that the right-hand side is now independent from $j$ and $k$, and is thus unchanged as we take the maximum over all $j$ and $k$’s. Summing over all coordinates $i$ yields

[TABLE]

We now take the average, and invoke the two previous lemmas to derive the result. ∎

Finally, we can combine the result with the contraction property of the Median.

Lemma C.11.

We have the following inequality:

[TABLE]

Proof.

This is an immediate application of lemmas C.5 and C.10, and using $(1+a)(1-b)\leq 1+a-b$ for $a,b\geq 0$. ∎

We are now almost there. We will need this elementary lemma to conclude.

Lemma C.12.

Let $k\in\left[0,1\right[$ and $\delta_{t}>0$ be a positive decreasing sequence such that $\delta_{t}\rightarrow 0$. Then there exists constants $C>0$, which depend on $k$ and $\delta_{0}$, such that

[TABLE]

In particular, the left-hand side converges to zero.

Proof.

We divide the sum between elements before than $s=\lfloor t/2\rfloor$ and elements after this threshold. This yields:

[TABLE]

Since $1+t-s\leq 1+t-(t/2-1)=t/2$, defining $C=\delta_{0}/(1-k)$ allows to conclude. ∎

Finally, we can derive the gathering of ByzSGD.

Lemma C.13 (Gathering of ByzSGD).

If learning rates go to zero ($\eta_{t}\rightarrow 0$), then servers converge to the same state, and their diameter is of the order of the learning rate, i.e. there exists a constant $C>0$ such that

[TABLE]

Proof.

Assume $0\leq u_{t+1}\leq(1+C\delta_{t}-2\varepsilon)u_{t}+\delta_{t}$, where $\varepsilon=\rho/8$, $\delta_{t}=3d\eta_{t}l$ and $A=\frac{l}{2h_{w}\sigma^{\prime}}$. Since $\delta_{t}\rightarrow 0$, we know that there is a time $t_{0}$ such that for $t\geq t_{0}$, we have $A\delta_{t}\leq\varepsilon$. For $t\geq t_{0}$, we then have $u_{t+1}\leq ku_{t}+\delta_{t}$, where $k<1$ and $\delta_{t}\rightarrow 0$. But then, we observe that

[TABLE]

Using Lemma (19) (and replacing $k$ by $\sqrt{k}$), we conclude that $u_{t}\leq Ck^{t}+\frac{\delta_{\lfloor t/2\rfloor}}{1-k}$. Applying this to $u_{t}=\mathop{{}\mathbb{E}}[\Delta_{\theta_{t}}]$ implies the bound of the lemma.

We can finally conclude by noting that

[TABLE]

∎

In particular, assuming, say $\eta_{t}=1/t^{\alpha}$, the expected diameter is of the order $\mathcal{O}\!\left(\frac{dl}{\rho{}t^{\alpha}}\right)$.

C.4.1. Expected convergence of the loss function’s gradient

Let us now use the results of the previous lemma to show that, despite gathering, the trajectory of parameters ${\theta}^{\left({j}\right)}_{t}$ is nearly a stochastic gradient descent. The trick to do so will be to determine that the actual update of the parameters after contraction $\hat{G}_{t}^{(j)}\triangleq\frac{{\theta}^{\left({j}\right)}_{t+1}-{\theta}^{\left({j}\right)}_{t}}{\eta_{t}}$ satisfies the conditions of convergence of (Blanchard et al., 2017). In particular, we need to prove that

[TABLE]

To prove this, we first show that for $t$ large enough, all servers receive roughly the same gradients, using the previous lemmas.

Lemma C.14.

For any two workers, we have

[TABLE]

Proof.

This results from combining the previous lemmas. ∎

Lemma C.15.

The diameters of the servers’ updates after applying gradients is upper-bounded as follows:

[TABLE]

Proof.

This is derived from the triangle inequality and from previous lemmas. ∎

Lemma C.16.

Assuming $\eta_{t}=1/t^{\alpha}$, after applying gradients and after contraction, the distance between the overall motion of parameters of server $j$ and the true gradient is upper-bounded as follows:

[TABLE]

where C is a constant.

Proof.

Note that ${\theta}^{\left({j}\right)}_{t+1}$ is obtained by taking Median over updated parameters ${\theta}^{\left({k}\right)}_{t}-\eta_{t}{G}^{\left({k}\right)}_{t}$. By the guarantee of Median, we know that the $\ell_{2}$ diameter of the (attacked) outputs is at most three times the diameter of the input. This implies that

[TABLE]

From this, and using the previous lemmas, we derive the fact that

[TABLE]

Dividing by $\eta_{t}$ and factoring in the bound on $\Delta_{{\theta}_{t}}$, we obtain the lemma. ∎

More precisely, we have the following, let $(a,b)$ be any two correct parameter servers. Using a triangle inequality, the second inequality above and Assumption 4 (bounded moments) we have:

[TABLE]

where $A^{\prime}_{r}$ and $B^{\prime}_{r}$ are positive constants, depending polynomially (at most with degree $r$, by using the second inequality above, the triangle inequality and a binomial expansion) on $\varepsilon$, $\sigma$ and $(A_{r},B_{r})$ from Assumption 4, allowing us to use the convergence proof of (Blanchard et al., 2017) (Proposition 2) regardless of the identity of the (correct) parameter server.

Optimal resilience against $\frac{1}{3}$ of Byzantine nodes.

The rationale stems from the optimal breakdown point of $\frac{1}{2}$ for any synchronous Byzantine–resilient aggregation scheme (e.g. MDA and Median), identified in (Rousseeuw, 1985). Network asynchrony makes it impossible to differentiate a slow correct node from a non–responding Byzantine node (Fischer et al., 1985). This observation implies the over–provisioning of (at least) $\frac{1}{2}$ correct nodes for $\frac{1}{2}$ Byzantine ones and hence, the final optimal breakdown point of \left(\frac{1}{2}\text{ Byzantine}~{}\big{/}~{}\left(1+\frac{1}{2}\right)\right)=\frac{1}{3}.

C.5. Convergence of ByzSGD: The Synchronous Case

Naively, if we enter the gather phase in all learning steps, the algorithm becomes straightforward, and the proof could be inherited directly and only from the GARs guarantees. On the other extreme, if the gather phase is never executed (i.e., only the scatter phase is executed), the models at different servers will become arbitrarily far form each other (Section C.2.2) and hence, the assumptions of the Byzantine-resilient GAR, i.e., MDA are violated, leading to (possibly) divergence.

Based on this, the gist of the proof is to show that the maximum distance between models at correct servers is always small enough to satisfy the assumptions of MDA. Based on this and the fact that workers do SGD steps during the scatter phase, it is trivial to show that there is a progress in learning between two gather phases, i.e., the loss function is minimized and hence, the proof is reduced to the standard proof of SGD convergence (Bottou, 1998).

Formally, we follow the same proof scheme as we show:

[TABLE]

Proving these two equalities implies necessarily the convergence of the learning procedure:

[TABLE]

Proof.

From Equation 14, we know that the difference between correct models is bounded by $\left\lVert{{g}_{T\cdot(t\text{ mod }T)}}\right\rVert_{2}$. Based on our assumptions (Section C.1) and the guarantees given by SGD, it holds:

[TABLE]

Therefore: $\lim\limits_{t\rightarrow\infty}\left(\max\limits_{\left(x,z\right)\in\left[{1}\,..\,{n_{ps}-f_{ps}}\right]}\left\lVert{{\theta}^{\left({x}\right)}_{t}-{\theta}^{\left({z}\right)}_{t}}\right\rVert_{2}\right)=0$. ∎

A direct consequence of Section C.2.2 is that beyond a certain time $t_{\epsilon}$ (with $\varepsilon>0$ be any positive real number), the standard deviation of the gradient estimators as well as the drift between (correct) parameter vectors can be bounded arbitrarily close to each other. More formally, the following holds (and is a direct consequence of the limits stated above):

[TABLE]

The first inequality provides the bounded variance guarantee needed to plug ByzSGD into the convergence proof of (Blanchard et al., 2017), and the second inequality provides the remaining requirement, i.e. the bound on the statistical higher moments of the gradient estimator as if there was a single parameter. More precisely, we have the following, let $(x,z)$ be any two correct parameter servers, using a triangle inequality, the second inequality above, and Assumption 4 (bounded moments) we have (as given in Section C.2.3):

[TABLE]

where $A^{\prime}_{r}$ and $B^{\prime}_{r}$ are positive constants, depending polynomially (at most with degree $r$, by using the second inequality above, the triangle inequality and a binomial expansion) on $\varepsilon$, $\sigma$ and $(A_{r},B_{r})$ from assumption 4, allowing us to use the convergence proof of (Blanchard et al., 2017) (Proposition 2) regardless of the identity of the (correct) parameter server.

Appendix D Validating the bounded gradients variance to norm ratio assumption

To make progress at every step, any state–of–the–art Byzantine–resilient gradient aggregation rule (GAR), that is based solely on statistical robustness, requires a bound on the ratio $\frac{variance}{norm}$ of the correct gradient estimations. Intuitively, not having such a bound would allow the correct gradients to become indistinguishable from some random noise. This is problematic, since these Byzantine–resilient GARs (Blanchard et al., 2017; Su, 2017; El Mhamdi et al., 2018; Xie et al., 2018b) rely on techniques analogous to voting (i.e. median–like techniques in high–dimension): if the correct majority does not agree (appears “random”), then the Byzantine minority controls the aggregated gradient. For example, not satisfying these bounds makes the used GARs vulnerable against recently–proposed attacks like A little is enough attack (Baruch et al., 2019), which we experimented in Section 6. Such a bound is to ensure that, no matter the received Byzantine gradients, the expected value of the aggregated gradient does lie in the same half–space as the real gradient, leading for every step taken to more optimal parameters (smaller loss).

Here, we try to understand when this assumed bound on the variance to norm ratio (e.g., Equation 7) holds, and when it does not. The most straightforward way to fulfill such an assumption is to increase the batch size used for training. The question is then what the minimum batch size (that can be used while satisfying such a bound) is, and whether it is small enough for the distribution of the training to still make sense.

Methodology.

We use the same setup and hyperparameters as used in our evaluation of ByzSGD (Section 7). We estimate over the first 100 steps of training the variance to norm ratio of correct gradient estimations for several batch sizes. We plot the average (line) and standard deviation (error bar) of these ratios over these 100 steps (Figure 7). We show the bound required by two Byzantine-resilient GAR: MDA, and Multi–Krum (Blanchard et al., 2017). We find Multi–Krum a very good example on a widely–used GAR that unfortunately does not seem to provide any practical888At least on our academic model and dataset. guarantee, due to its unsatisfied assumption999It needs very low variance to norm ratio of correct gradient estimations, e.g. $0.08$ for $\left(n,f\right)=\left(18,5\right)$.. We also experimented with two values of the number of declared Byzantine workers: $f=1,5$. Increasing the value of $f$ calls for a tighter bound on the variance to norm ratio.

Results.

Figure 7 depicts the relation between the variance (of gradients) to norm ratio with the batch size. According to such a figure, Multi–Krum cannot be safely used even with the largest experimented batch size, i.e., 256. Otherwise, the variance bound assumption such a GAR builds on is not satisfied and hence, an adversary can break its resilience guarantees (Baruch et al., 2019). MDA gives a better bound on the variance, which makes it more practical in this sense: typical batch size of 128 for example can be safely used with $f=1$. However, MDA is not safe to use with $f=5$ even with the largest experimented batch size ($b=256$). This is confirmed in Section 6, where we show that an adversary can use such a vulnerability (due to the unsatisfied assumption) to reduce the learning accuracy. Having the optimal bound on variance while guaranteeing Byzantine resilience and convergence remains an open question.

Appendix E Experimenting ByzSGD with More Scenarios

We provide here few additional results for evaluating ByzSGD, especially the efficiency of the filtering mechanism used in the synchronous setup. First, we show the progress of accuracy over training steps and time (i.e., convergence) with different values for declared Byzantine servers. Then, we describe the effect of changing the value of $T$ on the filters’ performance and convergence.

E.1. Convergence with Multiple Byzantine Servers

Figure 8 shows the convergence with different numbers of declared Byzantine servers. To allow for (up to) 3 Byzantine servers, we use a total of 10 servers in this experiment. Such figures show that changing the number of Byzantine servers does not affect the the number of steps required for convergence (Figure 8). Yet, deployments with a higher value for $f_{ps}$ require slightly more time to converge. Note that in this experiment we have not employed real attacks nor changed the total number of machines (for both servers and workers) used.

E.2. Effect of Changing T

The value of $T$ denotes the number of steps done in one scatter phase (i.e., before entering one gather phase). Figure 9 shows the effect of changing the value of $T$ on convergence with both time and model updates in both a Byzantine and a Byzantine-free environments. Figure 9 shows that the value of $T$ almost does not have any effect on the convergence w.r.t. the model updates. This happens because models on correct servers almost do not drift from each other (as all the servers are correct). Interestingly, Figure 9 shows that using a higher value for $T$ helps converge faster. This is because increasing $T$ decreases the communication overhead, achieving faster updates and higher throughput. However, it is important to note that as the value of $T$ increases, the expected drifts between models on correct servers increases, and it becomes easier for the Byzantine server to trick the workers. Figures 9 and 9 shows the convergence with different values for $T$ under the Reversed attack (in which the Byzantine machine reverses the direction of the correct vector as described in the main paper, Section 7). Though setting $T=1$ slows down the convergence, this case shows the most stable convergence behavior (especially towards the end when approaching a local minimum; see Figure 9). Yet, higher values for $T$ lead to increased noise and oscillations towards the end of convergence. Notably, testing with $T\leq 333$ is safe in this setup and that is why convergence is reached in all cases.

E.3. Filters Microbenchmark: False Negatives

ByzSGD’s filters (in the synchronous case) may have false negatives, i.e., falsely-reject correct models (at workers) from correct servers. This leads to wasted communication bandwidth and possibly slows down the convergence. We observe the number of rejected models on workers after 500 learning steps. Figure 10 shows the ratio of false negatives to the total number of submitted models in different scenarios.

Figure 10(a) shows such a ratio with different values for $T$ while no attack is employed yet, with $f_{ps}=1$. In general, the ratio of false negatives never exceeds 1% in this experiment, and it is almost stable with increasing $T$. Note that 333 is the maximum value allowed for $T$ in this setup (to follow the safety rules of ByzSGD). With $T=1$, the false negatives are always zero, simply because the filters do not work in this setup (i.e., the gather phase is entered in every step). Such a figure shows that our filtering mechanism is effective in not producing many false negatives and hence, do not waste communication rounds (when a model is rejected, the worker asks for another model from a different server).

We repeated the same experiment yet with employing the Reversed attack from the Byzantine server; results in Figure 10(b). Such an attack is effective (in terms of bandwidth waste), especially with $T\geq 50$. Yet, the wasted bandwidth is upper bounded by $25\%$ in all cases, which is the ratio of the number of Byzantine servers to the total number of servers $1:4$. Figure 10(c) show that other attacks are not that effective in wasting the bandwidth, as the filters can successfully filter out only the Byzantine models and accept the correct ones. Other than the Reversed attack, the false negatives ratio in this experiment do not exceed $3.5\%$.