文章速览 | 联邦学习 x AAAI'2023 （下）

本文是由白小鱼博主整理的AAAI 2023会议中，与联邦学习相关的论文合集及摘要翻译，AAAI 2023会议上册的整理请见文章速览 | 联邦学习 x AAAI'2023 （上）。

• Authors: Jinhyun So; Ramy E. Ali; Başak Güler; Jiantao Jiao; A. Salman Avestimehr

• Journal: Proceedings of the AAAI Conference on Artificial Intelligence

• Url: https://ojs.aaai.org/index.php/AAAI/article/view/26177

Abstract: Secure aggregation is a critical component in federated learning (FL), which enables the server to learn the aggregate model of the users without observing their local models. Conventionally, secure aggregation algorithms focus only on ensuring the privacy of individual users in a single training round. We contend that such designs can lead to significant privacy leakages over multiple training rounds, due to partial user selection/participation at each round of FL. In fact, we show that the conventional random user selection strategies in FL lead to leaking users' individual models within number of rounds that is linear in the number of users. To address this challenge, we introduce a secure aggregation framework, Multi-RoundSecAgg, with multi-round privacy guarantees. In particular, we introduce a new metric to quantify the privacy guarantees of FL over multiple training rounds, and develop a structured user selection strategy that guarantees the long-term privacy of each user (over any number of training rounds). Our framework also carefully accounts for the fairness and the average number of participating users at each round. Our experiments on MNIST, CIFAR-10 and CIFAR-100 datasets in the IID and the non-IID settings demonstrate the performance improvement over the baselines, both in terms of privacy protection and test accuracy.

abstractTranslation:

安全聚合是联邦学习（FL）的关键组成部分，它使服务器能够学习用户的聚合模型，而无需观察用户的本地模型。传统上，安全聚合算法仅关注在单轮训练中确保单个用户的隐私。我们认为，由于每轮 FL 的部分用户选择/参与，此类设计可能会导致多轮训练中出现严重的隐私泄露。事实上，我们表明，FL 中传统的随机用户选择策略会导致在与用户数量呈线性关系的轮数内泄漏用户的个人模型。为了应对这一挑战，我们引入了一种安全聚合框架 Multi-RoundSecAgg，具有多轮隐私保证。特别是，我们引入了一种新的指标来量化 FL 在多个训练轮次中的隐私保证，并开发了一种结构化的用户选择策略，以保证每个用户的长期隐私（在任意数量的训练轮次中）。我们的框架还仔细考虑了每轮的公平性和参与用户的平均数量。我们在 IID 和非 IID 设置中对 MNIST、CIFAR-10 和 CIFAR-100 数据集进行的实验表明，在隐私保护和测试准确性方面，性能均优于基线。

Notes:

[PDF](https://arxiv.org/abs/2106.03328) 

[Video](https://slideslive.com/38960185/securing-secure-aggregation-mitigating-multiround-privacy-leakage-in-federated-learning) 

[code](https://openreview.net/attachment?id=nVV6S2sb_UL&name=supplementary_material)

• Authors: Zibin Pan; Shuyi Wang; Chi Li; Haijin Wang; Xiaoying Tang; Junhua Zhao

• Journal: Proceedings of the AAAI Conference on Artificial Intelligence

• Url: https://ojs.aaai.org/index.php/AAAI/article/view/26122

Abstract: Fairness has been considered as a critical problem in federated learning (FL). In this work, we analyze two direct causes of unfairness in FL - an unfair direction and an improper step size when updating the model. To solve these issues, we introduce an effective way to measure fairness of the model through the cosine similarity, and then propose a federated multiple gradient descent algorithm with fair guidance (FedMDFG) to drive the model fairer. We first convert FL into a multi-objective optimization problem (MOP) and design an advanced multiple gradient descent algorithm to calculate a fair descent direction by adding a fair-driven objective to MOP. A low-communication-cost line search strategy is then designed to find a better step size for the model update. We further show the theoretical analysis on how it can enhance fairness and guarantee the convergence. Finally, extensive experiments in several FL scenarios verify that FedMDFG is robust and outperforms the SOTA FL algorithms in convergence and fairness. The source code is available at https://github.com/zibinpan/FedMDFG.

abstractTranslation: 公平性被认为是联邦学习（FL）中的一个关键问题。在这项工作中，我们分析了 FL 不公平的两个直接原因——更新模型时的不公平方向和不适当的步长。为了解决这些问题，我们引入了一种通过余弦相似度来衡量模型公平性的有效方法，然后提出了一种具有公平引导的联邦多重梯度下降算法（FedMDFG）来驱动模型更加公平。我们首先将 FL 转换为多目标优化问题（MOP），并设计一种先进的多重梯度下降算法，通过在 MOP 中添加公平驱动目标来计算公平下降方向。然后设计一种低通信成本的线搜索策略来寻找更好的模型更新步长。我们进一步展示了它如何增强公平性和保证收敛性的理论分析。最后，在多个 FL 场景中进行的大量实验验证了 FedMDFG 的鲁棒性，并且在收敛性和公平性方面优于 SOTA FL 算法。源代码可在 https://github.com/zibinpan/FedMDFG 获取。

• Authors: Martijn Oldenhof; Gergely Ács; Balázs Pejó; Ansgar Schuffenhauer; Nicholas Holway; Noé Sturm; Arne Dieckmann; Oliver Fortmeier; Eric Boniface; Clément Mayer; Arnaud Gohier; Peter Schmidtke; Ritsuya Niwayama; Dieter Kopecky; Lewis Mervin; Prakash Chandra Rathi; Lukas Friedrich; András Formanek; Peter Antal; Jordon Rahaman; Adam Zalewski; Wouter Heyndrickx; Ezron Oluoch; Manuel Stößel; Michal Vančo; David Endico; Fabien Gelus; Thaïs de Boisfossé; Adrien Darbier; Ashley Nicollet; Matthieu Blottière; Maria Telenczuk; Van Tien Nguyen; Thibaud Martinez; Camille Boillet; Kelvin Moutet; Alexandre Picosson; Aurélien Gasser; Inal Djafar; Antoine Simon; Ádám Arany; Jaak Simm; Yves Moreau; Ola Engkvist; Hugo Ceulemans; Camille Marini; Mathieu Galtier

• Journal: Proceedings of the AAAI Conference on Artificial Intelligence

• Url: https://ojs.aaai.org/index.php/AAAI/article/view/26847

Abstract:  To apply federated learning to drug discovery we developed a novel platform in the context of European Innovative Medicines Initiative (IMI) project MELLODDY (grant n°831472), which was comprised of 10 pharmaceutical companies, academic research labs, large industrial companies and startups. The MELLODDY platform was the first industry-scale platform to enable the creation of a global federated model for drug discovery without sharing the confidential data sets of the individual partners. The federated model was trained on the platform by aggregating the gradients of all contributing partners in a cryptographic, secure way following each training iteration. The platform was deployed on an Amazon Web Services (AWS) multi-account architecture running Kubernetes clusters in private subnets. Organisationally, the roles of the different partners were codified as different rights and permissions on the platform and administrated in a decentralized way. The MELLODDY platform generated new scientific discoveries which are described in a companion paper.

Notes:

[PDF](https://arxiv.org/abs/2210.08871) 

[VIDEO](https://www.youtube.com/watch?v=J_RmZhKzBcA)

• Authors: Xiaoting Lyu; Yufei Han; Wei Wang; Jingkai Liu; Bin Wang; Jiqiang Liu; Xiangliang Zhang

• Journal: Proceedings of the AAAI Conference on Artificial Intelligence

• Url: https://ojs.aaai.org/index.php/AAAI/article/view/26083

• Authors: Yixuan Liu; Suyun Zhao; Li Xiong; Yuhan Liu; Hong Chen

• Journal: Proceedings of the AAAI Conference on Artificial Intelligence

• Url: https://ojs.aaai.org/index.php/AAAI/article/view/26400

Abstract:  Federated Learning, as a popular paradigm for collaborative training, is vulnerable against privacy attacks. Different privacy levels regarding users' attitudes need to be satisfied locally, while a strict privacy guarantee for the global model is also required centrally. Personalized Local Differential Privacy (PLDP) is suitable for preserving users' varying local privacy, yet only provides a central privacy guarantee equivalent to the worst-case local privacy level. Thus, achieving strong central privacy as well as personalized local privacy with a utility-promising model is a challenging problem. In this work, a general framework (APES) is built up to strengthen model privacy under personalized local privacy by leveraging the privacy amplification effect of the shuffle model. To tighten the privacy bound, we quantify the heterogeneous contributions to the central privacy user by user. The contributions are characterized by the ability of generating “echos” from the perturbation of each user, which is carefully measured by proposed methods Neighbor Divergence and Clip-Laplace Mechanism. Furthermore, we propose a refined framework (S-APES) with the post-sparsification technique to reduce privacy loss in high-dimension scenarios. To the best of our knowledge, the impact of shuffling on personalized local privacy is considered for the first time. We provide a strong privacy amplification effect, and the bound is tighter than the baseline result based on existing methods for uniform local privacy. Experiments demonstrate that our frameworks ensure comparable or higher accuracy for the global model.

abstractTranslation:  联邦学习作为一种流行的协作培训范例，很容易受到隐私攻击。本地需要满足关于用户态度的不同隐私级别，同时也需要集中满足全局模型的严格隐私保障。个性化本地差分隐私（PLDP）适合保护用户不同的本地隐私，但仅提供相当于最坏情况本地隐私级别的中央隐私保证。因此，通过实用的模型实现强大的中央隐私以及个性化的本地隐私是一个具有挑战性的问题。在这项工作中，建立了一个通用框架（APES），利用shuffle模型的隐私放大效应来增强个性化本地隐私下的模型隐私。为了收紧隐私界限，我们按用户量化了对中央隐私用户的异构贡献。这些贡献的特点是从每个用户的扰动中生成“回声”的能力，这是通过提出的方法“邻居发散”和“剪辑拉普拉斯机制”仔细测量的。此外，我们提出了一种采用后稀疏技术的细化框架（S-APES），以减少高维场景中的隐私损失。据我们所知，这是首次考虑洗牌对个性化本地隐私的影响。我们提供了强大的隐私放大效应，并且边界比基于现有统一局部隐私方法的基线结果更紧。实验表明，我们的框架可确保全局模型具有可比性或更高的准确性。

• Authors: Sunwoo Lee; Tuo Zhang; A. Salman Avestimehr

• Journal : Proceedings of the AAAI Conference on Artificial Intelligence

  
  

• Url: https://ojs.aaai.org/index.php/AAAI/article/view/26023

Abstract:  In Federated Learning (FL), a common approach for aggregating local solutions across clients is periodic full model averaging. It is, however, known that different layers of neural networks can have a different degree of model discrepancy across the clients. The conventional full aggregation scheme does not consider such a difference and synchronizes the whole model parameters at once, resulting in inefficient network bandwidth consumption. Aggregating the parameters that are similar across the clients does not make meaningful training progress while increasing the communication cost. We propose FedLAMA, a layer-wise adaptive model aggregation scheme for scalable FL. FedLAMA adjusts the aggregation interval in a layer-wise manner, jointly considering the model discrepancy and the communication cost. This fine-grained aggregation strategy enables to reduce the communication cost without significantly harming the model accuracy. Our extensive empirical study shows that, as the aggregation interval increases, FedLAMA shows a remarkably smaller accuracy drop than the periodic full aggregation, while achieving comparable communication efficiency.

abstractTranslation:  在联邦学习 (FL) 中，跨客户端聚合本地解决方案的常见方法是定期全模型平均。然而，众所周知，不同层的神经网络在客户端之间可能存在不同程度的模型差异。传统的全聚合方案没有考虑这种差异，并且一次性同步整个模型参数，导致网络带宽消耗效率低下。聚合客户端之间相似的参数不会取得有意义的训练进展，同时还会增加沟通成本。我们提出了 FedLAMA，一种用于可扩展 FL 的分层自适应模型聚合方案。FedLAMA以分层的方式调整聚合间隔，综合考虑模型差异和通信成本。这种细粒度的聚合策略可以降低通信成本，而不会显着损害模型的准确性。我们广泛的实证研究表明，随着聚合间隔的增加，FedLAMA 的准确性下降明显小于定期完全聚合，同时实现了可比的通信效率。

• Authors: Srinivas Reddy Kota; P. N. Karthik; Vincent Y. F. Tan

• Journal : Proceedings of the AAAI Conference on Artificial Intelligence

• Url: https://ojs.aaai.org/index.php/AAAI/article/view/26010

Abstract:  We study the problem of best arm identification in a federated learning multi-armed bandit setup with a central server and multiple clients. Each client is associated with a multi-armed bandit in which each arm yields i.i.d. rewards following a Gaussian distribution with an unknown mean and known variance. The set of arms is assumed to be the same at all the clients. We define two notions of best arm local and global. The local best arm at a client is the arm with the largest mean among the arms local to the client, whereas the global best arm is the arm with the largest average mean across all the clients. We assume that each client can only observe the rewards from its local arms and thereby estimate its local best arm. The clients communicate with a central server on uplinks that entail a cost of C>=0 units per usage per uplink. The global best arm is estimated at the server. The goal is to identify the local best arms and the global best arm with minimal total cost, defined as the sum of the total number of arm selections at all the clients and the total communication cost, subject to an upper bound on the error probability. We propose a novel algorithm FedElim that is based on successive elimination and communicates only in exponential time steps and obtain a high probability instance-dependent upper bound on its total cost. The key takeaway from our paper is that for any C>=0 and error probabilities sufficiently small, the total number of arm selections (resp. the total cost) under FedElim is at most 2 (resp. 3) times the maximum total number of arm selections under its variant that communicates in every time step. Additionally, we show that the latter is optimal in expectation up to a constant factor, thereby demonstrating that communication is almost cost-free in FedElim. We numerically validate the efficacy of FedElim on two synthetic datasets and the MovieLens dataset.

abstractTranslation:  我们研究了具有中央服务器和多个客户端的联邦学习多臂老虎机设置中的最佳臂识别问题。每个客户端都与一个多臂老虎机相关联，其中每个臂都产生独立同分布。奖励遵循均值未知、方差已知的高斯分布。假设所有客户端的手臂组都是相同的。我们定义了最佳臂本地和全局的两个概念。客户端的局部最佳臂是该客户端本地的臂中具有最大平均值的臂，而全局最佳臂是所有客户端中具有最大平均平均值的臂。我们假设每个客户只能观察其本地分支的奖励，从而估计其本地最佳分支。客户端在上行链路上与中央服务器通信，每个上行链路每次使用的成本为 C>=0 单位。全局最佳臂是在服务器上估计的。目标是确定具有最小总成本的局部最佳臂和全局最佳臂，总成本定义为所有客户端的臂选择总数和总通信成本之和，受错误概率上限的影响。我们提出了一种新颖的算法 FedElim，它基于连续消除，仅以指数时间步长进行通信，并获得其总成本的高概率实例相关上限。我们论文的关键要点是，对于任何 C>=0 且错误概率足够小，FedElim 下的臂选择总数（分别是总成本）至多是最大总数的 2（分别是 3）倍。其变体下的手臂选择在每个时间步骤中进行通信。此外，我们表明后者在常数因子的期望中是最优的，从而证明 FedElim 中的通信几乎是免费的。我们在两个合成数据集和 MovieLens 数据集上对 FedElim 的功效进行了数值验证。

Notes:

[PDF](https://arxiv.org/abs/2208.09215)

Abstract: Federated Learning (FL) is a privacy-preserving distributed deep learning paradigm that involves substantial communication and computation effort, which is a problem for resource-constrained mobile and IoT devices. Model pruning/sparsification develops sparse models that could solve this problem, but existing sparsification solutions cannot satisfy at the same time the requirements for low bidirectional communication overhead between the server and the clients, low computation overhead at the clients, and good model accuracy, under the FL assumption that the server does not have access to raw data to fine-tune the pruned models. We propose Complement Sparsification (CS), a pruning mechanism that satisfies all these requirements through a complementary and collaborative pruning done at the server and the clients. At each round, CS creates a global sparse model that contains the weights that capture the general data distribution of all clients, while the clients create local sparse models with the weights pruned from the global model to capture the local trends. For improved model performance, these two types of complementary sparse models are aggregated into a dense model in each round, which is subsequently pruned in an iterative process. CS requires little computation overhead on the top of vanilla FL for both the server and the clients. We demonstrate that CS is an approximation of vanilla FL and, thus, its models perform well. We evaluate CS experimentally with two popular FL benchmark datasets. CS achieves substantial reduction in bidirectional communication, while achieving performance comparable with vanilla FL. In addition, CS outperforms baseline pruning mechanisms for FL.

abstractTranslation:  联邦学习（FL）是一种保护隐私的分布式深度学习范例，涉及大量的通信和计算工作，这对于资源受限的移动和物联网设备来说是一个问题。模型剪枝/稀疏化开发的稀疏模型可以解决这个问题，但现有的稀疏化解决方案无法同时满足服务器和客户端之间的低双向通信开销、客户端计算开销低和良好的模型精度的要求，在FL 假设服务器无法访问原始数据来微调修剪后的模型。我们提出了补充稀疏化（CS），这是一种通过在服务器和客户端进行补充和协作修剪来满足所有这些要求的修剪机制。在每一轮中，CS 创建一个全局稀疏模型，其中包含捕获所有客户端的一般数据分布的权重，而客户端则使用从全局模型中修剪的权重创建局部稀疏模型以捕获局部趋势。为了提高模型性能，这两种互补的稀疏模型在每一轮中聚合成密集模型，随后在迭代过程中进行剪枝。对于服务器和客户端来说，CS 在 vanilla FL 上只需要很少的计算开销。我们证明 CS 是普通 FL 的近似，因此它的模型表现良好。我们使用两个流行的 FL 基准数据集对 CS 进行实验评估。CS 大幅减少了双向通信，同时实现了与普通 FL 相当的性能。此外，CS 的性能优于 FL 的基线修剪机制。

Abstract: Federated learning (FL) is a popular distributed machine learning paradigm which enables jointly training a global model without sharing clients' data. However, its repetitive server-client communication gives room for possible backdoor attacks which aims to mislead the global model into a targeted misprediction when a specific trigger pattern is presented. In response to such backdoor threats on federated learning, various defense measures have been proposed. In this paper, we study whether the current defense mechanisms truly neutralize the backdoor threats from federated learning in a practical setting by proposing a new federated backdoor attack framework for possible countermeasures. Different from traditional training (on triggered data) and rescaling (the malicious client model) based backdoor injection, the proposed backdoor attack framework (1) directly modifies (a small proportion of) local model weights to inject the backdoor trigger via sign flips; (2) jointly optimize the trigger pattern with the client model, thus is more persistent and stealthy for circumventing existing defenses. In a case study, we examine the strength and weaknesses of several recent federated backdoor defenses from three major categories and provide suggestions to the practitioners when training federated models in practice.

abstractTranslation: 联邦学习（FL）是一种流行的分布式机器学习范例，它可以在不共享客户数据的情况下联邦训练全局模型。然而，其重复的服务器-客户端通信为可能的后门攻击提供了空间，后门攻击的目的是在出现特定触发模式时误导全局模型进行有针对性的错误预测。针对联邦学习的此类后门威胁，人们提出了各种防御措施。在本文中，我们通过提出一种新的联邦后门攻击框架作为可能的对策，研究当前的防御机制是否能够在实际环境中真正消除联邦学习的后门威胁。与基于后门注入的传统训练（触发数据）和重新缩放（恶意客户端模型）不同，所提出的后门攻击框架（1）直接修改（一小部分）本地模型权重，以通过符号翻转注入后门触发器；(2)与客户端模型联邦优化触发模式，对于规避现有防御更加持久、隐蔽。在案例研究中，我们从三个主要类别检查了最近几种联邦后门防御的优点和缺点，并为实践者在实践中训练联邦模型时提供建议。

Notes:

[PDF](https://arxiv.org/abs/2301.08170) 

[code](https://github.com/jinghuichen/focused-flip-federated-backdoor-attack)

Abstract:  Training ML models which are fair across different demographic groups is of critical importance due to the increased integration of ML in crucial decision-making scenarios such as healthcare and recruitment. Federated learning has been viewed as a promising solution for collaboratively training machine learning models among multiple parties while maintaining their local data privacy. However, federated learning also poses new challenges in mitigating the potential bias against certain populations (e.g., demographic groups), as this typically requires centralized access to the sensitive information (e.g., race, gender) of each datapoint. Motivated by the importance and challenges of group fairness in federated learning, in this work, we propose FairFed, a novel algorithm for fairness-aware aggregation to enhance group fairness in federated learning. Our proposed approach is server-side and agnostic to the applied local debiasing thus allowing for flexible use of different local debiasing methods across clients. We evaluate FairFed empirically versus common baselines for fair ML and federated learning and demonstrate that it provides fairer models, particularly under highly heterogeneous data distributions across clients. We also demonstrate the benefits of FairFed in scenarios involving naturally distributed real-life data collected from different geographical locations or departments within an organization.

abstractTranslation:  由于机器学习在医疗保健和招聘等关键决策场景中的集成度不断提高，训练在不同人口群体中公平的机器学习模型至关重要。联邦学习被视为一种有前途的解决方案，可以在多方之间协作训练机器学习模型，同时维护本地数据隐私。然而，联邦学习在减轻针对某些人群（例如人口群体）的潜在偏见方面也带来了新的挑战，因为这通常需要集中访问每个数据点的敏感信息（例如种族、性别）。出于联邦学习中群体公平性的重要性和挑战的动机，在这项工作中，我们提出了 FairFed，一种用于公平感知聚合的新颖算法，以增强联邦学习中的群体公平性。我们提出的方法是服务器端的，并且与所应用的本地去偏置无关，因此允许跨客户端灵活使用不同的本地去偏置方法。我们根据经验评估 FairFed 与公平机器学习和联邦学习的通用基线，并证明它提供了更公平的模型，特别是在客户之间高度异构的数据分布下。我们还在涉及从组织内不同地理位置或部门收集的自然分布的现实生活数据的场景中展示了 FairFed 的优势。

Notes:

[PDF](https://arxiv.org/abs/2110.00857) 

[解读](https://zhuanlan.zhihu.com/p/613201113)

作者: 白小鱼（上海交通大学计算机系博士生）