Fast and Robust Distributed Learning in High Dimension

TL;DR

This paper introduces multi-Bulyan, a gradient aggregation rule that achieves both robustness against malicious workers and high speed in distributed machine learning, especially in high-dimensional settings.

Contribution

The paper proposes multi-Bulyan, a novel gradient aggregation method that is both Byzantine resilient and computationally efficient with linear complexity in data dimension.

Findings

Multi-Bulyan ensures strong Byzantine resilience.

It maintains near-ideal speed compared to averaging when most workers are correct.

Experimental results confirm linear complexity and high parallelizability.

Abstract

Could a gradient aggregation rule (GAR) for distributed machine learning be both robust and fast? This paper answers by the affirmative through multi-Bulyan. Given $n$ workers, $f$ of which are arbitrary malicious (Byzantine) and $m=n-f$ are not, we prove that multi-Bulyan can ensure a strong form of Byzantine resilience, as well as an ${\frac{m}{n}}$ slowdown, compared to averaging, the fastest (but non Byzantine resilient) rule for distributed machine learning. When $m \approx n$ (almost all workers are correct), multi-Bulyan reaches the speed of averaging. We also prove that multi-Bulyan's cost in local computation is $O(d)$ (like averaging), an important feature for ML where $d$ commonly reaches $10^9$, while robust alternatives have at least quadratic cost in $d$. Our theoretical findings are complemented with an experimental evaluation which, in addition to supporting the linear $O(d)$ complexity argument, conveys the fact that multi-Bulyan's parallelisability further adds to its efficiency.

Equations

$$\underset{\mathbf{x}\in {\mathcal{R}}^d}{\min }Q(\mathbf{x})\triangleq {\mathbb{E}}_{\xi }F(\mathbf{x};\xi )$$

$${\mathbf{x}}^{(k+1)}={\mathbf{x}}^{(k)}-{\gamma }_k\cdot \mathbf{G}({\mathbf{x}}^{(k)},\xi ))$$

$$\mathbf{G}(\mathbf{x},\xi )=\sum _{i=1}^b\mathbf{G}(\mathbf{x},{\xi }_i)$$

$$(m)\underset{i\in \{1,...,n\}}{\mathrm{argmin}}\sum _{i\to j}\Vert {\mathbf{G}}_i-{\mathbf{G}}_j{\Vert }^2$$

$$GAR=GAR(V_1,\dots ,\underset{j_1}{\underbrace{B_1}},\dots ,\underset{j_f}{\underbrace{B_f}},\dots ,V_n)$$

$$\eta (n,f)\underset{def}{=}\sqrt{2(n-f+\frac{f\cdot m+f^2\cdot (m+1)}{m})},$$

$$\sin \alpha =\frac{\eta (n,f)\cdot \sqrt{d}\cdot \sigma }{\Vert g\Vert }.$$

$$\begin{array}{rl}||\mathbb{E}\text{textsc}multi-Krum-g|{|}^2& \le ||\mathbb{E}(\text{textsc}multi-Krum\\ & -\frac{1}{{\delta }_c(i_{\ast })}\sum _{i_{\ast }\to \text{ correct }j}{V}_j)|{|}^2\\ \text{(Jensen inequality)}& \le \mathbb{E}||\text{textsc}multi-Krum\\ & -\frac{1}{{\delta }_c(i_{\ast })}\sum _{i_{\ast }\to \text{ correct }j}{V}_j|{|}^2\\ & \le \sum _{\text{correct }i}\mathbb{E}||V_i\\ & -\frac{1}{{\delta }_c(i)}\sum _{i\to \text{ correct }j}{V}_j|{|}^2\mathbb{I}(i_{\ast }=i)\\ & +\sum _{\text{byz }k}\mathbb{E}||B_k\\ & -\frac{1}{{\delta }_c(k)}\sum _{k\to \text{ correct }j}{V}_j|{|}^2\mathbb{I}(i_{\ast }=k)\end{array}$$

$$||V_i-\frac{1}{{\delta }_c(i)}\sum _{i\to \text{ correct }j}{V}_j|{|}^2$$

$$\le \frac{1}{{\delta }_c(i)}\sum _{i\to \text{ correct }j}||V_i-V_j|{|}^2$$

$$\mathbb{E}||V_i-\frac{1}{{\delta }_c(i)}\sum _{i\to \text{ correct }j}{V}_j|{|}^2$$

$$\le 2d{\sigma }^2.$$

$$\sum _{k\to \text{ correct }j}||B_k-V_j|{|}^2+\sum _{k\to \text{ byz }l}||B_k-B_l|{|}^2\le$$

$$\sum _{i\to \text{ correct }j}||V_i-V_j|{|}^2+\sum _{i\to \text{ byz }l}||V_i-B_l|{|}^2.$$

$$||B_k-\frac{1}{{\delta }_c(k)}\sum _{k\to \text{ correct }j}{V}_j|{|}^2$$

$$\le \frac{1}{{\delta }_c(k)}\sum _{i\to \text{ correct }j}||V_i-V_j|{|}^2$$

$$+\frac{1}{{\delta }_c(k)}\underset{D^2(i)}{\underbrace{\sum _{i\to \text{ byz }l}||V_i-B_l|{|}^2}}.$$

$$\begin{gathered} ||B_k-\frac{1}{{\delta }_c(k)}\sum _{k\to \text{ correct }j}{V}_j|{|}^2 \\ \le \frac{1}{{\delta }_c(k)}\sum _{i\to \text{ correct }j}||V_i-V_j|{|}^2 \\ +\frac{{\delta }_b(i)}{{\delta }_c(k)}||V_i-V_{\zeta (i)}|{|}^2 \\ \text{taking expectation on both sides:} \\ \mathbb{E}||B_k-\frac{1}{{\delta }_c(k)}\sum _{k\to \text{ correct }j}{V}_j|{|}^2\le \\ \frac{1}{{\delta }_c(k)}\cdot ({\delta }_c(i)\cdot 2d{\sigma }^2+{\delta }_b(i)(\sum _{\text{correct }j\ne i}\mathbb{I}(\zeta (i)=j)\mathbb{E}||V_i-V_j|{|}^2)) \\ \le (\frac{{\delta }_c(i)}{{\delta }_c(k)}\cdot +\frac{{\delta }_b(i)}{{\delta }_c(k)}(m+1))2d{\sigma }^2 \\ \le (\frac{m}{n-2f-2} \\ +\frac{f}{n-2f-2}\cdot (m+1))2d{\sigma }^2. \end{gathered}$$

$$\begin{gathered} ||\mathbb{E}\text{textsc}multi-Krum-g|{|}^2\le \\ (n-f)2d{\sigma }^2+f\cdot (\frac{m}{n-2f-2}+\frac{f}{n-2f-2}\cdot (m+1))2d{\sigma }^2 \\ \le \underset{{\eta }^2(n,f)}{\underbrace{2(n-f+\frac{f\cdot m+f^2\cdot (m+1)}{n-2f-2})}}d{\sigma }^2. \end{gathered}$$

$$\begin{gathered} ⟨\mathbb{E}\text{textsc}multi-Krum,g⟩\ge \\ (\Vert g\Vert -\eta (n,f)\cdot \sqrt{d}\cdot \sigma )\cdot \Vert g\Vert =(1-\sin \alpha )\cdot \Vert g{\Vert }^2. \end{gathered}$$

$$\begin{gathered} \mathbb{E}\Vert \text{textsc}multi-Krum{\Vert }^r= \\ \sum _{\text{correct }i}\mathbb{E}||V_i|{|}^r\mathbb{I}(i_{\ast }=i)+\sum _{\text{byz }k}\mathbb{E}||B_k|{|}^r\mathbb{I}(i_{\ast }=k) \\ \le (n-f)\mathbb{E}||G|{|}^r+\sum _{\text{byz }k}\mathbb{E}||B_k|{|}^r\mathbb{I}(i_{\ast }=k). \end{gathered}$$

$$\begin{gathered} ||B_k-\frac{1}{{\delta }_c(k)}\sum _{k\to \text{correct }j}{V}_j||\le \\ \sqrt{\frac{1}{{\delta }_c(k)}\sum _{i\to \text{ correct }j}||V_i-V_j|{|}^2+\frac{{\delta }_b(i)}{{\delta }_c(k)}||V_i-V_{\zeta (i)}|{|}^2} \\ \le C\cdot (\sqrt{\frac{1}{{\delta }_c(k)}}\cdot \sum _{i\to \text{correct }j}||V_i-V_j||+\sqrt{\frac{{\delta }_b(i)}{{\delta }_c(k)}}\cdot ||V_i-V_{\zeta (i)}||) \\ \le C\cdot \sum _{\text{correct }j}||V_j||\text{(triangular inequality)}. \end{gathered}$$

$$\begin{gathered} ||B_k||\le \\ ||B_k-\frac{1}{{\delta }_c(k)}\sum _{k\to \text{correct }j}{V}_j||+||\frac{1}{{\delta }_c(k)}\sum _{k\to \text{correct }j}{V}_j|| \\ \le C\cdot \sum _{\text{correct }j}||V_j|| \\ ||B_k|{|}^r\le C\cdot \sum _{r_1+\cdots +r_{n-f}=r}||V_1|{|}^{r_1}\cdots ||V_{n-f}|{|}^{r_{n-f}}. \end{gathered}$$

$$\eta (n,f)\cdot \sqrt{d}\cdot \sigma (x)\le \Vert \nabla Q(x)\Vert \cdot \sin \alpha ;$$

$$||\nabla Q(x)||$$

$$\frac{⟨x,\nabla Q(x)⟩}{\Vert x\Vert \cdot \Vert \nabla Q(x)\Vert }$$

Full text

Our theoretical findings are complemented with an experimental evaluation which, in addition to supporting the linear $O(d)$ complexity argument, conveys the fact that multi-Bulyan’s parallelisability further adds to its efficiency.

I Introduction

The ongoing data deluge has been both a blessing and a burden for machine learning system designers. It was a blessing since machine learning provably performs better with more training data [21], and a burden since the quantity of available data is huge. The set of parameters in machine learning is now in the order of a gigabyte [10], while training data is several orders of magnitude beyond that [10] and rarely available in the same location. In short, distributed machine learning is not an option anymore; it is the only way to deliver results in a reasonable time for the user.

At the core of the recent success in machine learning lies Gradient Descent (GD). GD is an algorithm that consists in the very simple idea of updating a parameter in the opposite direction of the gradient of a cost function. The parameter tunes the algorithm being trained, and the cost function typically represents how bad the actual parameter performs. Stochastic Gradient Descent (SGD), a lightweight version of GD, is the workhorse of today’s machine learning. When all involved machines are reliable, SGD can be easily distributed. The general recipe is that several machines (called workers) carry the gradient computation, and a server aggregates the resulting gradients in order to update the parameter. This setting is now widely called the parameter-server setting [15] and is the dominant standard in distributed machine learning.

In the mainstream declination of this parameter-server setting [10, 1, 15, 17], the gradient aggregation rule (GAR) consists mostly in averaging the received gradients. When none of the workers misbehaves (no Byzantine workers) and the system is synchronous, it can be easily proven that averaging the gradients is optimal [7]. Indeed, averaging (or problem-specific variants of it [32]) requires less steps to train the model by optimizing the use of multiple workers. However, as was recently shown [6, 27, 8], averaging is brittle to the most simple form of adversarial behavior, requiring only one single machine to behave in a malicious manner.

Among the proposed alternatives to averaging, Krum [6, 11] attracted significant attention and has been used as a benchmark in most of the body of work on Byzantine-resilient gradient descent (e.g. [29, 23, 4, 27, 28, 8, 30, 19, 18, 3]). Unlike averaging, which incorporates the sum of all proposed gradients (including the Byzantine ones), Krum selects the gradient that is the closest to its $\approx n-f$ neighbors111More specifically, it is $n-f-2$, and the ”$-2$” comes from the fact that each correct worker knows that in its neighbors, there are only $n-f-1$ other workers guaranteed to be correct, besides itself. For safety reasons, the worker exclude 1 worker from its $n-f-1$ neighbourhood, so that the distance to the remaining $n-f-2$ that are selected is guaranteed to be upper bounded by another correct worker.. This ensures that the model update is performed using a gradient from a worker that behaves correctly.

A key feature of Krum is that, unlike other tools from traditional robust statistics [20], it does not suffer neither from computability nor from complexity issues. In particular, Krum can be computed in a linear time in $d$, the dimension222This parameter can attain values as high as $10^{9}$ or $10^{11}$, thus making any solution from the usual security and fraud detection toolbox unpractical. The latter tends to have a quadratic or even super-quadratic cost as they mostly rely on Principal Component Analysis (PCA) as a key ingredient [24]. of the model being trained. However, Krum suffers from two important limitations. (1) By basing its selection on a distance measurement, Krum suffers from what is known in high-dimensional machine learning as the curse of dimensionality. Basically, distances become almost meaningless when the dimension of the vectors is too large. In particular, because models are high dimensional, and the landscape where they are being optimized can be highly non convex, a strong adversary can make a Byzantine resilient GAR converge (as it is proven to do), but to a highly non desirable local minima. Specifically, the adversary benefits from a margin of $\sqrt{d}$ to attack distance-based Byzantine resilient GARs, and make them converge to a bad local minima. (2) By selecting only the best behaving gradient (the closest one to its neighbors), Krum ends up using only one gradient for the update, and does not benefit from the variance reduction that comes from leveraging many workers as in averaging. Potentially, Krum can have a slowdown of up to $\frac{1}{n}$ compared to using all gradients, when none are Byzantine. (This slowdown is computed as the number of steps it takes averaging to converge, divided by the number of steps it takes Krum to converge.) Given that $f$ workers are Byzantine, it is understandable that any Byzantine-resilient GAR would have some slowdown compared to averaging, as it keeps supposing that not all $n$ workers are reliable. However, $\frac{1}{n}$ is still too far from a desirable $\frac{n-f}{n}$ (using all $n-f$ non Byzantine workers).

We ask the question, whether we could devise a gradient aggregation rule for distributed SGD that is both robust and fast? We answer by the affirmative through multi-Bulyan, which we prove circumvents the two aforementioned limitations.

multi-Bulyan builds on previous work. The intuition behind multi-Bulyan (combining multi-Krum and Bulyan) was sketched in [9] without however any precise description or analysis. Bulyan [12] was proposed on top of Krum, and was proved to divide the attackers leeway by the required $\frac{1}{\sqrt{d}}$ that stems from the so called curse of dimensionality and circumvents the first limitation. For the second limitation, an experimental variant of Krum, coined multi-Krum was proposed. This does not only take the (single) closest gradient to its $\approx n-f$ neighbors, like Krum does. multi-Krum goes further and selects the (multiple) $\approx n-f$ closest gradients to their $\approx n-f$ closest neighbors. However, it was not clear whether (a) multi-Krum inherits the Byzantine resilience merits of Krum while having a better slowdown of $\approx\frac{n-f}{n}$ and whether (b) Bulyan can also be used on top of multi-Krum to produce the same leeway reduction.

In this paper, we first define two notions of Byzantine resilience, weak and strong, in order to take into account the specificity of high dimensional non-convex optimization. We also explain some of the non-intuitive aspects of the latter, such as why ”mild” adversarial behavior (noise) can sometimes accelerate learning. We then prove that multi-Krum is indeed Byzantine resilient in the same sense as Krum. multi-Krum guarantees convergence despite $f$ Byzantine workers. Hence, Bulyan can be used on top of multi-Krum to guarantee not only convergence, but convergence without the high-dimensional vulnerability of non-convex landscapes. (We call the obtained combination multi-Bulyan.)

We prove (a) that multi-Bulyan ensures strong Byzantine resilience and (b) that it is ${\approx\frac{n-2f}{n}}$ times as fast as the optimal algorithm (averaging) in the absence of Byzantine workers. In particular, when $f\ll n$, as is the case in many practical situations [2], this slowdown tends to $1$ and multi-Bulyan is as fast as the optimal (but non Byzantine resilient) averaging.

Paper organization. In section II, we present the algorithms being studied, as well as a toolbox of formal definitions: weak, strong, and $(\alpha,f)$–Byzantine resilience. We also present a necessary context on non-convex optimization, as well as its interplay with the high dimensionality of machine learning together with the $\sqrt{d}$ leeway it provides to strong attackers. We then introduce some background on non-convex optimization and why it changes the requirement for Byzantine resilient gradient descent. We also formalize our definitions of weak and strong Byzantine resilience (the latter was only informally sketched before). In Section III, we give our proofs of Byzantine resilience and slow down of multi-Krum and in Section IV our proofs of Byzantine resilience and slow down of multi-Bulyan. In Section V, we evaluate multi-Krum and multi-Bulyan on two practically important metrics, namely (1) the aggregation time achieved on actual hardware and (2) the maximum top-1 cross-accuracy reached using a given GAR. Section VI discusses how our work bridges the gap between the Byzantine faults threat model of distributed computing and the data-poisoning threat model of machine learning while proposing new directions.

Our experimental claims could be reproduced using this repository: https://github.com/anonconfsubmit/submit-8618.git with the password 8AS5lds_lzecbmi95ash.

II Background

II-A Stochastic Gradient Descent

For illustration, but without loss of generality, consider a learning task that consists in making accurate predictions for the labels of each data instance $\xi_{i}$ using a high dimensional model (for example, a neural network); we denote the $d$ parameters of that model by the vector $\bm{x}$. Each data instance has a set of features (image pixels), and a set of labels (e.g., {cat, person}). We refer to the $j^{th}$ coordinate of a vector $\bm{x}_{i}$ with $x_{i,j}$. The model is trained with the popular backpropagation algorithm based on SGD. Specifically, SGD addresses the following optimization problem.

[TABLE]

where $\xi$ is a random variable representing a total of $B$ data instances and $F(\bm{x};\xi)$ is the cost function. The function $Q(\bm{x})$ is smooth but not convex.

SGD computes the gradient ($\bm{G}(\bm{x},\xi)\triangleq\nabla F(\bm{x};\xi)$) and then updates the model parameters ($\bm{x}$) in a direction opposite to that of the gradient (descent). The vanilla SGD update rule given a sequence of learning rates $\{\gamma_{k}\}$ at any given step333A step denotes an update in the model parameters. is the following:

[TABLE]

The popularity of SGD stems from its ability to employ noisy approximations of the actual gradient. In a distributed setup, SGD employs a mini-batch of $b<B$ training instances for the gradient computation:

[TABLE]

The size of the mini-batch ($b$) induces a trade-off between the robustness of a given update (noise in the gradient approximation) and the time required to compute this update. The mini-batch also affects the amount of parallelism (Equation 3) that modern computing clusters (multi-GPU etc.) largely benefit from. Scaling the mini-batch size to exploit additional parallelism requires however a non-trivial selection of the sequence of learning rates [13]. A very important assumption for the convergence properties of SGD is that each gradient is an unbiased estimation of the actual gradient, which is typically ensured through uniform random sampling, i.e., gradients that are on expectation equal to the actual gradient (Figure II-A).

II-B Algorithms

multi-Bulyan relies on two algorithmic components: multi-Krum [6] and Bulyan [12]. The former rule requires that $n\geq 2f+3$ and the second requires that $n\geq 4f+3$. multi-Bulyan (along with multi-Krum and Bulyan used as functions) is presented in Algorithm 1.

Intuitively, the goal of multi-Krum is to select the gradients that deviate less from the “majority” based on their relative distances. Given gradients $\bm{G}_{1}\ldots\bm{G}_{n}$ proposed by workers 1 to $n$ respectively, multi-Krum selects the $m$ gradients with the smallest sum of scores (i.e., $\ell_{2}$ norm from the other gradients) as follows:

[TABLE]

where given a function $X(i)$, $(m)\operatorname*{arg\,min}(X(i))$ denotes the indexes $i$ with the $m$ smallest $X(i)$ values, and $i\rightarrow j$ means that $\bm{G}_{j}$ is among the $n-f-2$ closest gradients to $\bm{G}_{i}$. Bulyan in turn takes the aforementioned $m$ vectors, computes their coordinate-wise median and produces a gradient which coordinates are the average of the $m-2f$ closest values to the median.

II-C Byzantine Resilience

Intuitively, Byzantine resilience requires a $GAR$ to guarantee convergence despite the presence of $f$ Byzantine workers. It can be formally stated as follows.

Definition 1** (Weak Byzantine resilience).**

We say that a $GAR$ ensures weak $f$-Byzantine resilience if the sequence $\bm{x}^{(k)}$ (Equation 2) converges almost surely to some $\bm{x^{*}}$ where $\bm{\nabla}Q(\bm{x^{*}})=0$, despite the presence of $f$ Byzantine workers.

On the other hand, strong Byzantine resilience requires that this convergence does not lead to ”bad” optimums, and is related to more intricate problem of non-convex optimization, which, in the presence of Byzantine workers, is highly aggravated by the dimension of the problem as explained in what follows.

Specificity of non-convex optimization.

Non-convex optimization is one of the earliest established NP-hard problems [14]. In fact, many interesting but hard questions in machine learning have their source in the non convexity of the cost function.

In distributed machine learning, the non-convexity of the cost function creates two non-intuitive behaviours that are important to highlight.

(1) A ”mild” Byzantine worker can make the system converge faster. For instance, it has been reported several times in the literature that noise accelerates learning [14, 7]. This can be understood from the ”S” (stochasticity) of SGD: as (correct) workers cannot have a full picture of the surrounding landscape of the cost function, they can only draw a sample at random and estimate the best direction based on that sample, which can be, and is probably biased compared to the true gradient. Moreover, due to non-convexity, even the true gradient might be leading to the local minima where the parameter server is. By providing a wrong direction (i.e. not the true gradient, or a correct stochastic estimation), a Byzantine worker whose resources cannot face the high-dimensional landscape of the cost function, might end up providing a direction to get out of that local minima.

(2) Combined with high dimensional issues, non-convexity explains the need for strong Byzantine resilience. Unlike the ”mild” Byzantine worker, a strong adversary with more resources than the workers and the server, can see a larger picture and provide an attack that requires a stronger requirement. Namely, a requirement that would cut the $\sqrt{d}$ leeway offered to an attacker in each dimension. Figure 1 provides an illustration.

This motivates the following formalization of strong Byzantine resilience.

Definition 2** (Strong Byzantine resilience).**

We say that a $GAR$ ensures strong $f$-Byzantine resilient if it ensures weak Byzantine resilience and if for every $i\in[1,d]$, there exists a correct gradient $\bm{G}$ (i.e., computed by a non-Byzantine worker) s.t. $\mathbb{E}|\bm{GAR}_{i}-\bm{G}_{i}|=O(\frac{1}{\sqrt{d}})$. The expectation is taken over the random samples ($\xi$ in Equation 1) and $\bm{v}_{i}$ denotes the $i^{th}$ coordinate of a vector $\bm{v}$.

Weak vs. strong Byzantine resilience.

To attack non-Byzantine resilient $GAR$s such as averaging, it only takes the computation of an estimate of the gradient, which can be done in $O(n.d)$ operations per round by a Byzantine worker. This attack is reasonably cheap: within the usual cost of the workload of other workers, $O(d)$, and the server, $O(n.d)$.

To attack weakly Byzantine-resilient $GAR$s however, one needs to find the ’most legitimate but harmful vector possible’, i.e one that will (1) be selected by a weakly Byzantine-resilient $GAR$, and (2) be misleading convergence (red arrow in Figure 1). To find this vector, an attacker has to first collect every correct worker’s vector (before they reach the server), and solve an optimization problem (by linear regression) to approximate this harmful but legitimate vector [12]. If the desired quality of the approximation is $\epsilon$, the Byzantine worker would need at least $\Omega(\frac{n.d}{\epsilon})$ operation to reach it with regression. This is a tight lower bound for a regression problem in $d$ dimensions with $n$ vectors [14]. In practice, if the required precision is of order $10^{-9}$, with $100$ workers and a neural network model of dimension $10^{9}$, the cost of the attack becomes quickly prohibitive ($\approx 10^{20}$ operations to be done in each step by the attacker).

To summarize, weak Byzantine resilience can be enough as a practical solution against attackers whose resources are comparable to the server’s. However, strong Byzantine resilience remains the only provable solution against attackers with significant resources.

For the sake of our theoretical analysis, we recall the definition of $(\alpha,f)$–Byzantine resilience [6] (Definition 3). This definition is a sufficient condition (as proved in [6] based on [7]) for weak Byzantine resilience. Even-though the property of $(\alpha,f)$–Byzantine resilience is a sufficient, but not a necessary condition for (weak) Byzantine resilience, it has been so far used as the defacto standard [27, 6] to guarantee (weak) Byzantine resilience for SGD. We will therefore follow this standard and require $(\alpha,f)$–Byzantine resilience from any $GAR$ that is plugged into multi-Bulyan, in particular, we will require it from multi-Krum. The theoretical analysis done in [12] guarantees that Bulyan inherits it.

Intuitively, Definition 3 states that the gradient aggregation rule $GAR$ produces an output vector that lives, on average (over random samples used by SGD), in the cone of angle $\alpha$ around the true gradient. We simply call this the ”correct cone”.

Definition 3** ($(\alpha,f)$–Byzantine resilience (as in [6])).**

Let $0\leq\alpha<\pi/2$ be any angular value, and any integer $0\leq f\leq n$. Let $V_{1},\dots,V_{n}$ be any independent identically distributed random vectors in $\mathbb{R}^{d}$, $V_{i}\sim G$, with $\mathbb{E}G=g$. Let $B_{1},\dots,B_{f}$ be any random vectors in $\mathbb{R}^{d}$, possibly dependent on the $V_{i}$’s. An aggregation rule $GAR$ is said to be $(\alpha,f)$-Byzantine resilient if, for any $1\leq j_{1}<\dots<j_{f}\leq n$, vector

[TABLE]

satisfies (i) $\langle\mathbb{E}GAR,g\rangle\geq(1-\sin\alpha)\cdot\lVert g\rVert^{2}>0$ 444Having a scalar product that is lower bounded by this value guarantees that the $GAR$ of multi-Krum lives in the aformentioned cone. and (ii) for $r=2,3,4$, $\mathbb{E}~{}||GAR~{}||^{r}$ is bounded above by a linear combination of terms $\mathbb{E}~{}||G~{}||^{r_{1}}\dots\mathbb{E}~{}||G~{}||^{r_{n-1}}$ with $r_{1}+\dots+r_{n-1}=r$.

Choice of $\bm{f}$.

The properties of the existing Byzantine-resilient SGD algorithms all depend on one important parameter, i.e., the number of potentially Byzantine nodes $f$. It is important to notice that $f$ denotes a contract between the designer of the fault-tolerant solution and the user of the solution (who implements a service on top of the solution and deploys it in a specific setting). As long as the number of Byzantine workers is less than $f$, the solution is safe. Fixing an optimal value for $f$ is an orthogonal problem. For example, if daily failures in a data center are about 1

The performance (convergence time) of certain existing Byzantine-resilient SGD algorithms in a non-Byzantine environment is independent of the choice of $f$. These algorithms do not exploit the full potential of the choice of $f$. Modern large-scale systems are versatile and often undergo important structural changes while providing online services (e.g., addition or maintenance of certain worker nodes). Intuitively, there should be a fine granularity between the level of pessimism (i.e., value of $f$) and the performance of the SGD algorithm in the setting with no Byzantine failures.

III multi-Krum: Weak Byzantine Resilience and Slowdown

Let $n$ be any integer greater than $2$, $f$ any integer s.t $f\leq\frac{n-2}{2}$ and $m$ an integer s.t $m\leq n-f-2$. Let $\tilde{m}=n-f-2$.

Before proving the strong Byzantine resilience of multi-Bulyan, we first prove the $(\alpha,f)$–Byzantine resilience of multi-Krum (Lemma 1), then prove its almost sure convergence (Lemma 2) based on that, which proves its weak Byzantine resilience (Theorem 1).

In all what follows, expectations are taken over random samples used by correct workers to estimate the gradient, i.e the ”S” (stochasticity) that is inherent to SGD. It is worth noting that this analysis in expectation is not an average case analysis from the point of view of Byzantine fault tolerance. For instance, the Byzantine worker is always assumed to follow arbitrarily bad policies and the analysis is a worst-case one.

The Byzantine resilience proof (Lemma 1) relies on the following observation: given $m\leq n-f-2$, and in particular $m=n-f-2$ 555The slowdown question is an incentive to take the highest value of $m$ among those that satisfy Byzantine resilience, in this case $\tilde{m}$., $m$-Krum averages $m$ gradients that are all in the ”correct cone”, and a cone is a convex set, thus stable by averaging. The resulting vectors therefore also live in that cone. The angle of the cone will depend on a variable $\eta(n.f)$ as in [6], the value of $\eta(n.f)$ itself depends on $m$. This is what enables us to use $m$ vectors as the basis of our multi-Krum, unlike [6] where a restriction is made on $m=1$. In short, the convexity of a cone allows us to prove lemma 1 almost as in [6], the same derivation applies this time to the averaged $m$ vectors instead of the single vector chosen by Krum.

The proof of Lemma 2 (deferred to the appendix) is the same as the one in [6] which itself draws on the rather classic analysis of SGD made by L.Bottou [7]. The key concepts are (1) a global confinement of the sequence of parameter vectors and (2) a bound on the statistical moments of the random sequence of estimators built by the $GAR$ of multi-Krum. As in [6, 7], reasonable assumptions are made on the cost function $Q$, those assumption are not restrictive and are common in practical machine learning.

Theorem 1** (Byzantine resilience and slowdown of multi-Krum).**

Let $m$ be any integer s.t. $m\leq n-f-2$. (i) multi-Krum has weak Byzantine resilience against $f$ failures. (ii) In the absence of Byzantine workers, multi-Krum has a slowdown (expressed in ratio with averaging) of ${{\frac{\tilde{m}}{n}}}$.

Proof.

Proof of (i). To prove (i), we will require Lemma 1 and Lemma 2, then conclude by construction of multi-Krum as an $m$-Krum algorithm with $m=n-f-2$.

Lemma 1**.**

Let $V_{1},\dots,V_{n}$ be any independent and identically distributed random $d$-dimensional vectors s.t $V_{i}\sim G$, with $\mathbb{E}G=g$ and $\mathbb{E}~{}||G-g~{}||^{2}=d\sigma^{2}$. Let $B_{1},\dots,B_{f}$ be any $f$ random vectors, possibly dependent on the $V_{i}$’s. If $2f+2<n$ and $\eta(n,f)\sqrt{d}\cdot\sigma<\lVert g\rVert$, where

[TABLE]

then the $GAR$ function of multi-Krum is $(\alpha,f)$-Byzantine resilient where $0\leq\alpha<\pi/2$ is defined by

[TABLE]

Proof.

Without loss of generality, we assume that the Byzantine vectors $B_{1},\dots,B_{f}$ occupy the last $f$ positions in the list of arguments of multi-Krum, i.e., $\textsc{multi-Krum}=\textsc{multi-Krum}(V_{1},\dots,V_{n-f},B_{1},\dots,B_{f})$.

An index is correct if it refers to a vector among $V_{1},\dots,V_{n-f}$. An index is Byzantine if it refers to a vector among $B_{1},\dots,B_{f}$. For each index (correct or Byzantine) $i$, we denote by $\delta_{c}(i)$ (resp. $\delta_{b}(i)$) the number of correct (resp. Byzantine) indices $j$ such that $i\rightarrow j$ (the notation we introduced in Section 3 when defining multi-Krum), i.e the number of workers, among the $m$ neighbors of $i$ that are correct (resp. Byzantine).

We have $\delta_{c}(i)+\delta_{b}(i)=m$, $n-2f-2\leq\delta_{c}(i)\leq m$ and $\delta_{b}(i)\leq f.$

We focus first on the condition (i) of $(\alpha,f)$-Byzantine resilience. We determine an upper bound on the squared distance $\lVert\mathbb{E}\textsc{multi-Krum}-g\rVert^{2}$. Note that, for any correct $j$, $\mathbb{E}V_{j}=g$.

We denote by $i_{*}$ the index of the worst scoring among the $m$ vectors chosen by the multi-Krum function, i.e one that ranks with the $m^{th}$ smallest score in Equation 4.

Though we follow the same derivation of [6], one should keep in mind that the manipulated object now is not the winner, minimizing Equation 4, but the ”worst ($m^{th}$) possible vector to choose” and prove that it also lies in the correct cone. This allows us to average it with the $m-1$ vectors with smaller scores, and by convexity of a cone, prove that the resulting multi-Krum vector is also in that cone.

[TABLE]

where $\mathbb{I}$ denotes the indicator function666$\mathbb{I}(P)$ equals $1$ if the predicate $P$ is true, and [math] otherwise.. We examine the case $i_{*}=i$ for some correct index $i$.

[TABLE]

We now examine the case $i_{*}=k$ for some Byzantine index $k$. The fact that $k$ minimizes the score implies that for all correct indices $i$

[TABLE]

Then, for all correct indices $i$

[TABLE]

We focus on the term $D^{2}(i)$. Each correct process $i$ has $m$ neighbors, and $f+1$ non-neighbors. Thus there exists a correct worker $\zeta(i)$ which is farther from $i$ than any of the neighbors of $i$. In particular, for each Byzantine index $l$ such that $i\rightarrow l$, $~{}||V_{i}-B_{l}~{}||^{2}\leq~{}||V_{i}-V_{\zeta(i)}~{}||^{2}$. Whence

[TABLE]

Combining everything we obtain

[TABLE]

By assumption, $\eta(n,f)\sqrt{d}\sigma<\lVert g\rVert$, i.e., $\mathbb{E}\textsc{multi-Krum}$ belongs to a ball centered at $g$ with radius $\eta(n,f)\cdot\sqrt{d}\cdot\sigma$. This implies

[TABLE]

To sum up, condition (i) of the $(\alpha,f)$-Byzantine resilience property holds. We now focus on condition (ii).

[TABLE]

Denoting by $C$ a generic constant, when $i_{*}=k$, we have for all correct indices $i$

[TABLE]

The second inequality comes from the equivalence of norms in finite dimension. Now

[TABLE]

Since the $V_{i}$’s are independent, we finally obtain that $\mathbb{E}~{}||\textsc{multi-Krum}~{}||^{r}$ is bounded above by a linear combination of terms of the form $\mathbb{E}~{}||V_{1}~{}||^{r_{1}}\cdots\mathbb{E}~{}||V_{n-f}~{}||^{r_{n-f}}=\mathbb{E}~{}||G~{}||^{r_{1}}\cdots\mathbb{E}~{}||G~{}||^{r_{n-f}}$ with $r_{1}+\dots+r_{n-f}=r$. This completes the proof of condition (ii). ∎

Lemma 2**.**

Assume that (i) the cost function $Q$ is three times differentiable with continuous derivatives, and is non-negative, $Q(x)\geq 0$; (ii) the learning rates satisfy $\sum_{t}\gamma_{t}=\infty$ and $\sum_{t}\gamma_{t}^{2}<\infty$; (iii) the gradient estimator satisfies $\mathbb{E}G(x,\xi)=\nabla Q(x)$ and $\forall r\in\{2,\dots,4\},~{}\mathbb{E}\lVert G(x,\xi)\rVert^{r}\leq A_{r}+B_{r}\lVert x\rVert^{r}$ for some constants $A_{r},B_{r}$; (iv) there exists a constant $0\leq\alpha<\pi/2$ such that for all $x$

[TABLE]

(v)* finally, beyond a certain horizon, $\lVert x\rVert^{2}\geq D$, there exist $\epsilon>0$ and $0\leq\beta<\pi/2-\alpha$ such that*

[TABLE]

Then the sequence of gradients $\nabla Q(x_{t})$ converges almost surely to zero.

The proof of Lemma 2 is exactly as in [6] and is deferred to the appendix.

We conclude the proof of (i) by recalling the definition of multi-Krum, as the instance of $m-Krum$ with $m=n-f-2$.

Proof of (ii).

(ii) is a consequence of the fact that $m$-Krum is the average of $m$ estimators of the gradient (line 8 in Algorithm 1). In the absence of Byzantine workers, all those estimators will not only be from the ”correct cone”, but from correct workers (Byzantine workers can also be in the correct cone, but in this case there are none). As SGD converges in $O(\frac{1}{{m}})$, where $m$ is the number of used estimators of the gradient, the slowdown result follows. ∎

IV multi-Bulyan: Strong Byzantine Resilience and Slowdown

Let $n$ be any integer greater than $2$, $f$ any integer s.t $f\leq\frac{n-3}{4}$ and $m$ an integer s.t $m\leq n-2f-2$. Let $\tilde{m}=n-2f-2$.

Theorem 2** (Byzantine resilience and slowdown of multi-Bulyan).**

(i) multi-Bulyan provides strong Byzantine resilience against $f$ failures. (ii) multi-Bulyan requires $O(d)$ local computation. (iii) When no worker is Byzantine, multi-Bulyan has a ${\frac{\tilde{m}}{n}}$ slowdown relative to averaging.

Proof.

(i) If the number of iterations over multi-Krum is $n-2f$, then the leeway, defined by the coordinate-wise distance between the output of Bulyan and a correct gradient is upper bounded by $\operatorname{\mathcal{O}}(\frac{1}{\sqrt{d}})$. This is due to the fact that Bulyan relies on a component-wise median, that, as proven in [12] guarantees this bound. The proof is then a direct consequence of Theorem 1 and the properties of Bulyan [12]. (ii) The linear cost in $d$ is the consequence of running through the coordinates only in a single loop in Bulyan (lines 23-25 in Algorithm 1) and a computation of euclidean distances in multi-Krum (line 6 in Algorithm 1). Finally, (iii) is a consequence of averaging $\tilde{m}$ gradients in multi-Bulyan (returned value in line 24 of Algorithm 1). ∎

V Experiments

We report on the performance multi-Bulyan (and it component multi-Krum) over two metrics: (1) the aggregation time of our implementations of multi-Krum and multi-Bulyan, compared to the implementation of Median in PyTorch, and (2) the maximum top-1 cross-accuracy reached on a commonly used classification task in the ML litterature, compared to mere averaging and Median.

V-A Setup

We run our experiments on the following hardware: (CPU) Intel® Core™ i7-8700K @ 3.70GHz, (GPU) Nvidia GeForce GTX 1080 Ti, and (RAM) $64\text{ GB}$.

We report on the aggregation time, i.e. the time needed by a GAR to aggregate its input gradients and provide the output gradient. This metric is arguably the empirical counterpart of the asymptotic complexity, respectively $\mathcal{O}\!\left({n^{2}d}\right)$, $\mathcal{O}\!\left({n^{2}d}\right)$ and $\mathcal{O}\!\left({nd}\right)$ for multi-Krum, multi-Bulyan and Median. To study the empirical behaviors of multi-Krum and multi-Bulyan compared to Median, we then vary both $n$ and $d$ over a realistic range of values. Namely we set $\left(n,d\right)\in\left\{7,9,11,\ldots,35,37,39\right\}\times\left\{10^{5},10^{6},10^{7}\right\}$ and $f=\left\lfloor{\frac{n-3}{4}}\right\rfloor$.

The protocol for one run is the following. $n$ gradients are independently sampled in $\mathcal{U}\!\left(0,1\right)^{d}$. These gradients are moved over to the GPU main memory. The command queue is then flushed on the GPU with torch.cuda.synchronize(), ensuring no kernel is pending on the CUDA stream. The timer is then started. The GAR is called on the GPU with the $n$ input gradients. The command queue is then flushed again, waiting for the GAR’s execution to fully complete. The timer is finally stopped. There are $7$ runs per values of $\left(n,d\right)$, from which we remove the $2$ furthest execution times from the median of the execution times, and we report on the average and standard deviation of the $5$ remaining measurements in Figure 2.

We report on the maximum top-1 cross-accuracy reached by a distributed training process using either multi-Krum, multi-Bulyan, Median or mere averaging for aggregation. We set $n=11$ workers and $f=2$. There is no attack thought: this experiment highlights the benefits of averaging more gradients per aggregation step, as multi-Krum and multi-Bulyan do, over aggregation rules that keep (the equivalent of) only one gradient, e.g. Median.

The classification task we consider is Fashion-MNIST [25] ($60000$ training points and $10000$ testing points). The model that we train is a convolutional network, composed of two 2D-convolutional layers followed by two fully-connected layers. The first convolutional layer has $20$ channels (kernel-size $5$, stride $1$, no padding) and the second $50$ channels (same kernel-size, stride and padding). Each convolutional layer uses the ReLU activation function followed by a 2D-maxpool of size $2\times 2$. The first fully-connected layer has $500$ hidden units, employing ReLU, and the second has $10$ output units. We train the model using a cross-entropy loss (log-softmax normalization + negative log likelihood loss) over $3000$ steps, with a fixed learning rate of $0.1$ and momentum $0.9$. To compute their gradients, each worker employs minibatches of size $b\in\left\{5,10,15,\ldots,45,50\right\}$. Every $100$ steps we measure the top-1 cross-accuracy of the model over the whole testing set, and we keep the highest accuracy achieved over the whole training. For reproducibility purpose we seed each training, repeated $5$ times with seeds $1$ to $5$. We report on the average and standard deviation of the highest accuracy achieved using each GAR and batch size in Figure 3.

V-B Experimental Results

In Figure 2, the first observation that we can make is that the computational cost of both multi-Krum and multi-Bulyan indeed appears quadratic in $n$, the number of workers. The number of workers $n$ is kept below $24$ for multi-Bulyan due to a limited amount of available on-die shared memory on the GPU we used. Regarding Median, for which we expect a linear increase with $n$, the tendency is not clear. The Median that we used for comparison is provided by the state-of-the-art machine learning framework PyTorch.

In Figure 2, and despite a higher asymptotic complexity, multi-Krum and multi-Bulyan achieve lower aggregation times than Median for respectively $n\leq 7,n\leq 9\left(d=10^{5}\right)$, $n\leq 15,n\leq 13\left(d=10^{6}\right)$ and $n\leq 17,n\leq 15\left(d=10^{7}\right)$. Essentially, the higher the dimension of the model, the higher the number of workers up to which multi-Bulyan is more competitive than the Median.

For reference, ResNet-50 contains $d\approx 24M$ parameters. For such neural network sizes, major DNN frameworks already show scaling issues when employing only $8$ workers [16]. This inherent limitation the practitioner has to apply on the number of workers not to saturate the standard parameter server (even when using high-throughput $56\text{ Gbps}$ IP-over-InfiniBand networks [16]) would actually make multi-Krum and multi-Bulyan faster than Median in reasonable deployments (where $n$ is tipically smaller than $20$). The steady performance of multi-Krum is mostly explained by the fact that its most computationally intensive part, the gradients’ pairwise distances computation, is also naturally parallelizable on GPU: it consists in many additions and multiplications executed in parallel. The remaining computations for multi-Krum merely consists in ordering scalar values. The same applies for multi-Bulyan: our implementation does the costly pairwise distance computation only once, and since $f\approx\frac{n}{4}$ the median of multi-Bulyan is computed over a substantially reduced set of pre-aggregated gradients.

The empirical “slowdown” effect of each GAR is captured in Figure 3. Each of the studied GAR throw away gradients that are, in these experiments, all correct. Compared to mere averaging the $n=11$ gradients, aggregating less gradients per step has a tangible impact on the model performance: either more training steps, or higher batch sizes per worker, is needed to compensate. By averaging only (the equivalent of) one gradient per step, Median shows in this Byzantine-free settings a tangible loss in top-1 cross-accuracy compared to multi-Bulyan and multi-Krum, which both achieve almost the same performance as averaging. As an additional note, the convolutional model in Figure 3 has $d=431080$ parameters, for $n=11$ workers (and $f=2$). For these settings, both multi-Krum and multi-Bulyan also have smaller aggregation times than Median.

VI Concluding Remarks

From poisoning to Byzantine faults. We have proven the Byzantine resilience guarantees of multi-Bulyan and its component multi-Krum, as well as their slowdown with respect to the fastest (but non Byzantine resilient) gradient aggregation rule: averaging. We also introduced two notions of Byzantine resilience (weak and strong), which we believe are practically interesting in their own right. The first to guarantee convergence and the second to protect against high-dimensional vulnerabilities.

Our notion of strong Byzantine resilience is robust to all kinds of worker failures: software bugs, hardware faults, corrupt data and malicious attacks. In particular, it also encompasses poisoning attacks [5], an important topic in adversarial machine learning. Mediatised cases of poisoning include social platforms being perturbed by few, acute outlying data-points. While averaging approaches (and even weakly Byzantine-resilient approaches) are vulnerable to such attacks, multi-Bulyan tolerates them (unless they originate from a majority of users) as reported, e.g. in some of the recent work on backdooring federated learning [26].

We also argue that, even when no obvious network of machines exist, the distributed point of view presented in this paper remains relevant. What is machine learning if not an attempt to aggregate knowledge from distributed sources? As a concrete instance, an account on a social network posting its own content and interacting (e.g. like, comment) with content from other accounts can be seen as a worker. Indeed: each of these account generates data-points that, in turn, produce gradients that can be used to update e.g. a recommendation model. Byzantine-resilient aggregations would then be able to filter out the gradients malicious accounts would be producing. Through the distributed computing lense, SGD is an algorithm that eventually reaches agreement between data sources.

The no-free lunch variance requirement. Since 2017, many alternatives to averaging have been proposed ( [8, 22, 31, 6, 12, 29, 23, 4, 28, 8, 30, 19, 18] to list a few). One common aspect underlying all these methods, including ours, is their reliance on some ”quality gradient” from the non Byzantine workers. This requirement is expressed in terms of how low should the variance of the gradients be. It is important to note that this requirement is not new in machine learning (it is independent of Byzantine resilience requirements), as an unbounded variance provably prevents convergence [7].

Recently, attention has been brought [3] to the hypothesis on bounded variance made in the works that are based on Krum, Bulyan, trimmed mean and variants. This hypothesis was used also in the present work. It is important to note that the limitations that are pointed do not contradict what has been proven in this paper. Precisely, what we prove is that, as long as the variance of the stochastic gradient is controlled by the norm of the real gradient ($\eta(n,f)\sqrt{d}\cdot\sigma<\lVert g\rVert$), multi-Bulyan keeps making progress (i.e. keeps improving the accuracy of the model). What has been showed in [3] is that, when the models have converged (and no accuracy gain is made anymore), it is possible to inject erroneous gradients and make them accepted by multi-Bulyan. This is not a surprise, as the assumption does not hold when convergence has happened (the norm of the gradients becomes close to zero). In practice, this situation is already prevented by what is called early stopping [14]. Because the behavior of SGD can lead to bad models after an excessive number of rounds (due to, among other reasons, the fact that the hypothesis on bounded variance does not hold anymore close to convergence [7]), practitioners tend to have a test-set (different than the training-set) on which the model is tested, when the accuracy on the test-set starts degrading close to convergence, the training is stopped and the previous value of the model is kept. The attack of [3] would therefore only have been effective if it was preventing SGD from progress in the early steps, not later and close to convergence.

So far, we have proven that multi-Bulyan is (1) faster than Krum and the Median (the two leading Byzantine resilient GARs), as it relies on multi-Krum, and (2) more robust than Krum and the Median, as it can make use of Bulyan. An interesting open question is whether any progress can be made on the optimality of the control ratio $\eta(n,f)$ of multi-Krum and thus of multi-Bulyan? In other words, could we make $\eta(n,f)$ smaller, and still prove the convergence of multi-Krum and multi-Bulyan, while tolerating even smaller values of the variance? If the answer is negative, are multi-Krum and multi-Bulyan plugable in the available variance-reducing methods [14] for SGD?