Mean Aggregator is More Robust than Robust Aggregators under Label Poisoning Attacks on Distributed Heterogeneous Data

TL;DR

This paper demonstrates that in distributed learning with heterogeneous data, the simple mean aggregator outperforms complex robust aggregators against label poisoning attacks, both theoretically and experimentally.

Contribution

It reveals that the mean aggregator is more robust than robust aggregators under label poisoning attacks in heterogeneous data settings, challenging existing assumptions.

Findings

Mean aggregator is more robust than robust aggregators under label poisoning.

Theoretical proof of mean aggregator's order-optimal learning error.

Experimental results confirm the superiority of the mean aggregator.

Abstract

Robustness to malicious attacks is of paramount importance for distributed learning. Existing works usually consider the classical Byzantine attacks model, which assumes that some workers can send arbitrarily malicious messages to the server and disturb the aggregation steps of the distributed learning process. To defend against such worst-case Byzantine attacks, various robust aggregators have been proposed. They are proven to be effective and much superior to the often-used mean aggregator. In this paper, however, we demonstrate that the robust aggregators are too conservative for a class of weak but practical malicious attacks, as known as label poisoning attacks, where the sample labels of some workers are poisoned. Surprisingly, we are able to show that the mean aggregator is more robust than the state-of-the-art robust aggregators in theory, given that the distributed data are sufficiently heterogeneous. In fact, the learning error of the mean aggregator is proven to be order-optimal in this case. Experimental results corroborate our theoretical findings, showing the superiority of the mean aggregator under label poisoning attacks.