#  Bristle: Decentralized Federated Learning in Byzantine, Non-i.i.d.
Environments

Joost Verbraeken<EMAIL_ADDRESS>Delft University of
TechnologyDelftThe Netherlands ,  Martijn de Vos<EMAIL_ADDRESS>Delft
University of TechnologyDelftThe Netherlands and  Johan Pouwelse
<EMAIL_ADDRESS>Delft University of TechnologyDelftThe Netherlands

(2021)

###### Abstract.

Federated learning (FL) is a privacy-friendly type of machine learning where
devices locally train a model on their private data and typically communicate
model updates with a server. In decentralized FL (DFL), peers communicate
model updates with each other instead. However, DFL is challenging since (1)
the training data possessed by different peers is often non-i.i.d. (i.e.,
distributed differently between the peers) and (2) malicious, or Byzantine,
attackers can share arbitrary model updates with other peers to subvert the
training process.

We address these two challenges and present _Bristle_ , middleware between the
learning application and the decentralized network layer. Bristle leverages
transfer learning to predetermine and freeze the non-output layers of a neural
network, significantly speeding up model training and lowering communication
costs. To securely update the output layer with model updates from other
peers, we design a fast distance-based prioritizer and a novel performance-
based integrator. Their combined effect results in high resilience to
Byzantine attackers and the ability to handle non-i.i.d. classes.

We empirically show that Bristle converges to a consistent 95% accuracy in
Byzantine environments, outperforming all evaluated baselines. In non-
Byzantine environments, Bristle requires 83% fewer iterations to achieve 90%
accuracy compared to state-of-the-art methods. We show that when the training
classes are non-i.i.d., Bristle significantly outperforms the accuracy of the
most Byzantine-resilient baselines by 2.3x while reducing communication costs
by 90%.

Decentralized Federated learning, Deep Transfer Learning, Gradient Aggregation
Rule, Byzantine-resilience

††copyright: none††journalyear: 2021††ccs: Computing methodologies Lifelong
machine learning††ccs: Computing methodologies Transfer learning††ccs:
Computing methodologies Supervised learning by classification††ccs: Computing
methodologies Neural networks

##  1\. Introduction

Machine learning applications have gained significant traction and are widely
used for various purposes, such as understanding consumer preferences
(Chapelle and Harchaoui, 2005), recognizing pictures (Krizhevsky et al.,
2012), predicting keystrokes (Chen et al., 2017), or translating texts (Chui
et al., 2018). Traditionally, these applications use neural networks trained
on a single server using a tremendous amount of data generated by a large
number of geo-distributed, heterogeneous edge devices such as smartphones, IoT
devices, or autonomous vehicles (Hu et al., 2020). However, centralized
training on data streams generated by such devices is limited by the following
three factors. First, transmitting training data over the Internet can pose a
significant burden on backbone networks. This burden is particularly
problematic when media such as photos or videos are used as training data and
is worsened by the fact that most learning applications communicate with cloud
providers over wireless links (Li et al., 2018; Wang et al., 2020). Second,
maintaining a central server architecture can quickly become expensive and
time-consuming as the number of devices increases (Durkee, 2010). Third,
transmitting personal and sensitive information over the Internet, such as
text conversations or photos, to cloud providers raises privacy concerns and
is in certain jurisdictions not even allowed by regulations such as the US
HIPAA (for Disease Control et al., 2003) and the European GDPR law (Voigt and
Von dem Bussche, 2017).

_Federated Learning (FL)_ overcomes these three limitations. With FL, edge
devices do not send their data to the server training the model but instead
communicate model updates to a so-called _parameter server_ , also see the
left side of Figure 1 (Chen et al., 2020b). The parameter server coordinates
the learning process by pushing model updates to devices (step 1), and peers
train the model with their private data on-device (step 2). Then they send the
updated model back to the parameter server (step 3), after which the server
_aggregates_ the incoming model updates into a global model (step 4). FL
sidesteps the need for the data to leave the device, improving privacy,
lowering the computational burden for the server, and decreasing the
communication overhead when the model update is smaller than the data to be
transmitted per iteration. FL is nowadays used for various applications,
including next-word prediction on keyboards (Chen et al., 2019a; Chen et al.,
2019b; Hard et al., 2018; RN9, 2017), speech recognition (Sim et al., [n.d.]),
wireless communications (Chen et al., 2020a; Niknam et al., 2020), human
activity recognition (Sozinov et al., [n.d.]), and health applications
(Brisimi et al., 2018; Lu et al., [n.d.]; Rieke et al., 2020; Schneble and
Thamilarasu, [n.d.]).

The centralized architecture shown in Figure 1 is typical for FL systems.
However, even though the parameter server synchronizes the learning process
between remote edge devices, this approach comes with significant drawbacks
(Bonawitz et al., 2019; Lian et al., [n.d.]; Xie et al., [n.d.]b). Notably,
the parameter server not only poses a single point of failure susceptible to
crashes or hacks, but it may also become a performance bottleneck as the
number of devices pushing model updates increases (Lian et al., [n.d.]). These
issues motivate further research to remove dependency on the parameter server
and train models in a decentralized manner (Lian et al., [n.d.]; Dobbe et al.,
[n.d.]; Tang et al., [n.d.]; Lalitha et al., 2019). With _decentralized
federated learning_ (DFL), each peer is connected to a subset of the other
peers in the network from which it receives incoming models and to which it
pushes its updated models (Nedic and Ozdaglar, 2009). We visualize this
approach on the right side of Figure 1.

DFL has resulted in a new wave of learning methods that achieve comparable
model accuracy as state-of-the-art FL approaches (Hegedűs et al., 2021) while
boasting several significant advantages. First, decentralized networks are
fault-tolerant by design since peers continuously update their knowledge about
which other peers are online or stopped communicating(Wallach, 2002). Second,
decentralized networks are self-scaling. When a new peer joins the network,
other peers can start communicating with the newly-joined peer seamlessly.
Because there is usually a maximum number of other peers with which each peer
communicates, the connection ratio will drop, but the network will typically
still be strongly connected (Felber and Biersack, 2004). Third, DFL unlocks AI
with zero-cost infrastructure (from the developer’s perspective) since the
computational power needed to train the network is delivered by all peers in
the network working together instead of a parameter server under centralized
control (Endler et al., 2011).

Figure 1. Federated learning using a parameter server (left) and decentralized
federated learning (right).

Limitations of DFL. Despite the benefits of DFL, we identify three challenges
that reduce its potential for practical applications. The first barrier is
that both existing FL and DFL architectures have to consider _Byzantine
attacks_ , the situation where malicious peers aim to undermine the model’s
training by purposefully sending specific model updates to the parameter
server or other peers (Yin et al., 2018). Since malicious peers keep their
data private, they can easily “poison” their model and disseminate this
malicious model without repercussions. Byzantine attacks are often addressed
by the Gradient Aggregation Rule (GAR), which aggregates and combines incoming
model updates (Mhamdi et al., 2018; Yin et al., 2018; Blanchard et al.,
[n.d.]). At the same time, state-of-the-art GARs typically assume that the
majority of peers act honestly, which is hard to guarantee in networks with
open participation (Yang et al., 2020).

The second challenge is that the performance of conventional FL systems
degrades significantly when being deployed in an environment where the
distribution of the training data differs between peers. This is also known as
_non-i.i.d._ (not independent and identically distributed) data. Given that
data is typically non-i.i.d. in an FL environment (Blanchard et al., [n.d.];
Chen et al., 2017; Yin et al., 2018), dealing with non-i.i.d. data is
considered a key challenge in FL (Kairouz et al., 2019). The inability of most
GARs to handle non-i.i.d. data results in Catastrophic Forgetting, a
phenomenon where the peers overwrite model parameters that were important to
predict a particular class distribution with parameters essential to predict
another class distribution (Zhang and Yang, 2017).

The third challenge relates to the communication requirements to disseminate
model updates among peers in the network. In DFL, each peer disseminates a
copy of the current model at every training iteration to several other peers.
However, modern neural networks may consist of millions of parameters (He et
al., 2016; Huang et al., 2017), sometimes requiring gigabytes of data to be
transferred for each model exchange. Facilitating this amount of data quickly
becomes infeasible when the number of devices and the frequency of model
updates increase (Sattler et al., 2020).

Although some DFL systems are to a certain extent Byzantine-resilient
(Blanchard et al., [n.d.]; Mhamdi et al., 2018; Yang and Bajwa, 2019a; Guo et
al., 2020), able to deal with non-i.i.d. data (Smith et al., [n.d.]; Chen et
al., 2020b; Zhao et al., 2018), or focus on reducing the communication costs
(De Sa et al., [n.d.]; Alistarh et al., 2016; Wen et al., 2017), there exists
- to the best of the author’s knowledge - no DFL solution that addresses all
three challenges simultaneously. We argue that such a solution is a key
requirement for a wide deployment of DFL systems.

Our Contributions.  To the best of the author’s knowledge (Zhou et al., 2020;
Yang and Bajwa, 2019b, a; Guo et al., 2020), only four papers have ever been
published about DFL that are Byzantine-resilient (first challenge), none of
which are suitable for situations where the data is non-i.i.d. (second
challenge) or decrease the communication requirements (third challenge).
Therefore, we present _Bristle_ : the first Byzantine-resilient and
communication-efficient approach for DFL in environments with non-i.i.d.
classes.111Bristle is an acronym for ”Byzantine-Resilient mIddleware for
StochasTic federated LEarning”. Bristle is a pure edge solution and acts as a
middleware between the machine learning application and the decentralized
network layer by combining three techniques:

  1. (1)

Using _deep transfer learning_ , model training with Bristle converges quickly
and achieves high accuracy with low communication overhead and while requiring
low amounts of on-device data (Section 3.1).

  2. (2)

With a fast _distance-based prioritizing step_ during model aggregation based
on an explore-exploit trade-off, Bristle pre-filters incoming model updates
that are estimated to improve the current model (Section 3.2).

  3. (3)

With a novel _performance-based integrator_ , Bristle provides state-of-the-
art Byzantine-resilience, even when the classes are unevenly spread across
peers (non-i.i.d.). Unlike related solutions, this component performs per-
class performance measurements instead of per-model measurements (Section
3.3).

Similar to related work in the FL domain, Bristle focuses on supervised
learning problems that train a neural network for classification (Mhamdi et
al., 2018; McMahan et al., [n.d.]; Xie et al., 2018). We implement all
elements of Bristle as an Android library and open-source our implementation
(see Section 3.4).

Figure 2. Our Bristle middleware for decentralized federated learning
outperforms state-of-the-art solutions in a Byzantine and non-i.d.d.
environment.

With an extensive set of experiments with the popular MNIST dataset, we
evaluate the performance and resilience of Bristle. We compare Bristle with
five related approaches for FL and quantify the Byzantine-resilience of these
approaches under four attacks in the domain of FL, aimed at reducing the
model’s accuracy. The experiments show that even in highly Byzantine
environments where the classes are non-i.i.d., Bristle not only withstands all
evaluated attacks but also outperforms all related approaches in terms of
convergence speed, accuracy, consistency, and communication efficiency. We
highlight one of the key results from our experiments in Figure 2, showing
model accuracy as peers train the model. In this figure, the performance of
Bristle and evaluated DFL approaches is illustrated in a Byzantine (40% of the
peers perform a label-flip attack) and non-i.i.d. environment (the class
overlap between the peers is just 40%). Despite this challenging environment,
Bristle quickly converges and outperforms all other approaches in terms of
accuracy while reducing communication costs by over 90%.

Figure 3. High-level overview of Bristle, our middleware for decentralized
federated learning.

##  2\. System and Threat model

We now describe our system and threat model, and state the assumptions
underlying our work.

Network Model. We consider an unstructured, strongly connected peer-to-peer
network with $n$ peers. Each peer knows the network addresses of other peers
in the network. We assume unreliable and unordered network channels between
peers. In addition, we do not place any restriction on peers joining the
system, and peers can join or leave the system at any time. We consider the
mitigation of attacks targeted at the network layer, e.g., the Eclipse Attack,
beyond the scope of this work.

Training Data. Each participating peer $i$ acts on local training dataset
$D_{i}$ which size is denoted by $|D_{i}|$. Training data never leaves the
device, and $D_{i}$ is only known to peer $i$. In contrast to most related
work, we assume that the number of samples per class is not distributed
uniformly among peers (non-i.i.d), which is a key characteristic of FL
environments (Yin et al., 2018; Blanchard et al., [n.d.]; Chen et al., 2017).
However, we also assume that for each class the samples are distributed
uniformly (i.i.d.) between peers as a prerequisite for the performance-based
integrator (see Section 3.3).

Model Training. Our approach focuses on supervised classification problems
where the dataset consists of a collection of input-output pairs. The input is
a chunk of data with a fixed size, and the output is a qualitative label
associated with a class. The devices aim to minimize the loss function by
tuning the parameters in the neural network such that its predictive
capabilities are maximized. We use the negative log-likelihood of the ground
truth class as the loss function. Since this problem is intractable for
complex models, we use, in line with most literature (Li et al., [n.d.]; Yin
et al., 2018; Su and Vaidya, 2015; Sundaram and Gharesifard, 2018), a
technique called Gradient Descent (GD) which iteratively takes the derivative
of the loss function with respect to the training data and then moves the
hyperparameters in the direction of the gradient. However, because the local
dataset can be large, it can take a long time for GD to converge (Bottou,
2012). Therefore, we use the faster Stochastic Gradient Descent (SGD), where a
subset (mini-batch) of five samples is stochastically sampled from the dataset
to update the parameters in a particular iteration.

Threat Model. Our work assumes an environment with _an unconstrained number of
Byzantine attackers_ aiming to subvert the model’s performance. This includes
the Sybil Attack, an attack where a malicious peer joins the network under
many different identities to prevent model convergence (Douceur, [n.d.]). It
also includes collusion, the situation where malicious peers in concert
attempt to undermine model convergence. Byzantine attackers can send arbitrary
model updates to any peer in the network, but have no access to the private
samples of benign peers.

##  3\. Bristle: Middleware for Decentralized Federated Learning

Bristle enables DFL that can handle non-i.i.d. classes and thwart Byzantine
attacks while improving communication costs compared to existing approaches.
We provide a high-level overview of Bristle and the actions performed during a
training iteration in Figure 3. First, Bristle takes advantage of deep
transfer learning to determine the non-output layers of each node before the
first training iteration (step 1). As we will experimentally demonstrate in
Section 5, this significantly reduces communication costs compared to
communicating the entire model, speeds up the model convergence rate, and acts
as a prerequisite to learning on non-i.i.d. classes.

The main innovation of Bristle is its two-phased GAR that integrates received
models. During each training iteration, a peer $i$ trains the local model on a
mini-batch of their private dataset $D_{i}$ and only updates the output layers
(step 2). It then forwards the updated output layer222We use the terms output
layer and model interchangeably in this work. and the output layers it has
received from other peers to a distance-based prioritizer (step 3). This fast
distance-based prioritizer estimates the best candidates for integration based
on an explore-exploit ratio and forwards them to the performance-based
integrator (step 4). The performance-based integration is more computationally
demanding and integrates the prioritized output layers into the peer’s current
output layer. This integration process is both Byzantine-resilient and capable
of continual learning, facilitated by selective updating of the output layer,
per-class performance evaluations, and a carefully crafted weighted averaging
function. Our main motivation to use a two-staged approach is that a distance-
based prioritizer on itself is ineffective and performance-based integration
on all received models is too computationally expensive since it requires the
evaluation of incoming models on private data. Finally, Bristle transmits the
output layer to a few connected peers (step 5) and uses the new output layer
as input for the next training iteration (step 6). In the remainder of this
section, we elaborate on the model pre-training, the distance-based
prioritizer, and the performance-based integrator.

###  3.1. Bootstrapping Bristle with Transfer Learning

In conventional FL settings, the parameters of the entire neural network are
shared with the parameter server or, when using DFL, with other peers. These
parameters include all weights and biases of the input layer, hidden layers,
and the output layer. In Bristle, we avoid exchanging the full neural network
between peers. Instead, we leverage a popular ML technique called _deep
transfer learning_ which re-uses a neural network that has been trained on
another dataset with comparable low-level features as the training data (step
1 in Figure 3) (Tan et al., 2018). More specifically, we copy and subsequently
freeze the non-output layers from another model. Bristle then only trains and
exchanges the output layer, which has three major advantages:

  1. (1)

Copying the non-output layers from a well-trained model significantly
_improves the convergence rate_ when training the model in a decentralized
fashion on devices with lower hardware capabilities.

  2. (2)

Freezing non-output layers _reduces communication overhead_ since only the
output layers have to be shared among peers.

  3. (3)

Freezing the non-output layers is a key step towards _continual learning_ ,
which further increases the performance and robustness of Bristle (see Section
3.3).

To bootstrap Bristle with a pre-trained model, we must assume that for the
dataset we want to train on, there exists a vastly bigger dataset with roughly
the same low-level features that we can use to pre-train a similar model.
Considering the extent to which transfer learning is nowadays used in
practical learning problems, we argue that this assumption is realistic and
does not prohibitively degrade the applicability of Bristle (RN3, [n.d.]; Pan,
2010). The training of the initial neural network can be performed offline by
system designers or volunteers. The pre-trained model can then be shared with
peers by bundling them in the (mobile) application or be served by a trusted
server that sends interested peers the pre-trained model upon request. We
assume that the developer knows the number of classes beforehand to determine
the size of the output layer.

###  3.2. Distance-based prioritizer (DBP)

We now elaborate on the distance-based prioritizer (DBP) in Bristle (step 2 in
Figure 3). The inputs to the DBP are the output layers received from other
peers during the last training iteration. To explain the motivation behind the
DBP, we first examine Figure 4 where the average Euclidean distance is shown
from a non-i.i.d. model (configured as explained in Section 5.3) to two benign
models (shown in green), a benign model that is trained on an entirely
different data distribution (shown in orange), and several Byzantine models
(shown in red). The distances in this figure are based on the models exchanged
during our experiments (see Section 5). For each distance shown in Figure 4,
we took the average distance over 100 runs (with the current and the other
model both trained ten times on different training data) and trained all
models to convergence before comparing the distances. The figure shows that
based on the Euclidean distance alone, we cannot reliably determine if a
certain model is benign because, in this example, the distance to a Trimmed
Mean attack model is between the distances to two benign models. However, the
distance may clearly help prioritizing certain models since models with rather
low or high distances appear to be more likely to be malicious.

Figure 4. Average Euclidean distance from a given model to benign (green) and
malicious (red) models, and models trained on an entirely different data
distribution (orange). Figure 5. Proportion of models sampled by the distance-
based prioritizer from each of the three categories, based on the exploration-
exploitation ratio $\alpha$.

Based on this insight, we segment the received models into three equally-sized
categories with a low, medium, and high distance from our current model. Then,
we uniformly sample models from each of these categories. The number of models
sampled from each category depends on the exploration-exploitation ratio
$\alpha$ where $\alpha=0$ exclusively samples low-distance models
(exploitation-dominant) and $\alpha=1$ exclusively samples high-distance
models (exploration-dominant). The optimal value of $\alpha$ depends on the
maximum distance that benign models can reasonably have to each other, which
is highly dependent on the degree of asynchrony (higher asynchrony
$\rightarrow$ higher $\alpha$), the expected ratio of benign to Byzantine
peers (more Byzantine peers $\rightarrow$ lower $\alpha$), and the degree of
non-i.i.d.-ness (higher non-i.i.d.-ness $\rightarrow$ higher $\alpha$). The
advantage of using three categories is that in situations where the accuracy
is clearly sub-optimal and a significant number of Byzantine attackers are
present, the developer may want to emphasize integrating models with a medium
distance since these will often perform best. $f_{l}$, $f_{m}$ and $f_{h}$
denote the fraction of samples from the low, medium and high distance
categories, and are determined as follows:

(1)
$\begin{gathered}f_{l}=(1-\alpha)^{2},f_{m}=-2\alpha^{2}+2\alpha,f_{h}=\alpha^{2}\\\
\end{gathered}$

Note that $f_{l}+f_{m}+f_{h}=1$. Figure 5 visualizes the relation between the
above values and $\alpha$. We also parameterize the maximum number of models
that pass our DBP, denoted by $\beta$. Since the runtime of our performance-
based integrator scales with the input size, devices with lower performance
can opt for a lower value for $\beta$.

###  3.3. Performance-based Integrator (PBI)

The ability of our distance-based prioritizer to recognize Byzantine or
_stale_ models that are trained on a lower number of iterations is rather
limited. Byzantine attacks are easy to launch in open networks, and stale
models are a regular phenomenon in FL systems (Li et al., 2020b). To address
these concerns, we assess the performance of each model that passes the
distance-based prioritizer on a small _test dataset_ (step 4 in Figure 3)
using a performance-based integrator (PBI). This test dataset is a random
subset of the full private dataset owned by the peer.

Figure 6. The per-class PBI in Bristle. Dashed boxes refer to values
associated with foreign classes.

Figure 6 shows how the PBI works, given a model with three classes ($A$, $B$
and $C$). In summary, the PBI selectively integrates the parameters of classes
that perform well to achieve Byzantine-resilience and to handle non-i.i.d.
classes properly. This is different from existing approaches that integrate
each received model as a whole instead. We refer to the parameters in the
output layer that are connected to a particular class as _Class-specific
parameters (CSPs)_. The integration process in Bristle first evaluates the
performance of each class of each received model on a test dataset (step 1).
Based on this evaluation, we compute a _certainty_ score that estimates how
benign a received model is (Step 2). Then, we calculate for all CSPs of each
model a weight (step 3). Finally, we integrate the received models into our
current model, based on the computed weights (step 4).

The selective integration of parameters is inspired by the continual learning
algorithm CWR* (Lomonaco, 2019) that enables non-i.i.d. learning by
initializing the output layer to zero, applying a mean-shift, and replicating
the hippocampus-cortex duality by selectively copying and resetting parts of
the output layer. Related work demonstrates that this approach provides
excellent performance in regular non-FL environments and enables per-class
updates (Lomonaco, 2019). Applying continual learning requires that the non-
output layers are frozen and equal between all peers. We already addressed
this by using transfer learning (see Section 3.1) to train these layers before
the first iteration.

We now elaborate on the PBI logic, which pseudocode is given in Listing 1. The
input for this algorithm is the current model of the peer (_myModel_), and the
prioritized models that passed the DBP (_prioritizedModels_).

Algorithm 1 Bristle’s performance-based integrator (PBI)

1:procedure PBI(_myModel_ , _prioritizedModels_)

2:  _F1_ $\leftarrow$ [], _certainty_ $\leftarrow$ [], _disc_ $\leftarrow$ []

3:  _faWg_ $\leftarrow$ [], _foWg_ $\leftarrow$ [] $\triangleright$
foreign/familiar class weights

4: for  _m_ in _myModel_ $\cup$ _prioritizedModels_ do $\triangleright$ Step 1

5: for  _c_ in familiarClasses(_data_) do

6:  _F1_[_m_][_c_] $\leftarrow$ evaluate(_m_ , _c_ , _testData_)

7: end for

8: end for

9:

10: for  _m_ in _prioritizedModels_ do

11:  _best_ $\leftarrow$ sorted(_F1_[_m_]) [:$\phi$]

12:  _certainty_[_m_] $\leftarrow$ _max_(avg(_best_) - std(_best_), 0)
$\triangleright$ Step 2

13: for  _c_ in familiarClasses(_data_) do $\triangleright$ Step 3

14: if  _F1_[_m_][_c_] $\geq$ _F1_[_myModel_][_c_] then

15:  _disc_[_m_][_c_] $\leftarrow$ (— _F1_[_m_][_c_] - _F1_[_myModel_][_c_]— *
$\eta$)3

16: else

17:  _disc_[_m_][_c_] $\leftarrow-\infty$

18: end if

19:  _faWg_[_m_][_c_] $\leftarrow$ computeFaWg(_disc_[_m_][_c_],
_certainty[_m_]_)

20: end for

21:  _foWg_[_m_] $\leftarrow$ computeFoWg(_disc_[_m_], _certainty[_m_]_)

22: end for

23: $\triangleright$ Step 4

24:  _myModel_.integrateFamiliarClasses(_prioritizedModels_ , _faWg_)

25:  _myModel_.integrateForeignClasses(_prioritizedModels_ , _foWg_)

26:end procedure

Step 1 (per-class performance measurements). Based on a subset of the local
dataset, we first calculate the F1-score for the CSPs of all _familiar
classes_ of both the peer’s own output layer and the prioritized output layers
(line 4-8). We refer to a class as familiar when the peer has a sufficient
number of samples, denoted by $\kappa$, to reliably estimate the performance
of that class of a given model. This threshold is determined by the developer.
With a higher value of $\kappa$, the PBI can more reliably determine
F1-scores, but the number of classes for which insufficient samples are
available to evaluate, also known as _foreign classes_ , might decrease. We
chose to measure F1-scores instead of the accuracy as a proxy for the
performance since the former is more suited for imbalanced datasets (Chicco
and Jurman, 2020). The data subset used by the PBI is never used to train the
peer’s own model since this would result in an overestimation of the
performance of the peer’s own model. Since these measurements depend on the
availability of sufficient private data samples, Bristle avoids integrating
models from other peers until sufficient private data samples are available to
test them reliably.

Step 2 (certainty computation). Then, we calculate for each prioritized model
a _certainty_ score, which is a (rough) estimate of the degree to which this
model is benign (line 10-12). This certainty score is determined by
subtracting the standard deviation from the average F1-score of the $\phi$
best-performing familiar classes (line 11-12), thus rewarding high class
performance and punishing high variation among the class performance. We do
not consider all classes when computing the certainty score since it is not
realistic to assume that all classes of each benign received model perform
well in a non-i.i.d. environment. The larger $\phi$ is, the more robust the
algorithm is against Byzantine attacks, but the less able it is to learn about
foreign classes in the case of a non-i.i.d. setting.

Step 3 (weight computation). Furthermore, we estimate for each familiar class
of each prioritized model if integrating its corresponding CSP improves the
model’s performance by simply checking if the F1-score of that class of the
received model exceeds the respective F1-score of the peer’s own model (line
14). We call the extent to which it does the _F1-discrepancy_ , and we store
this value in a two-dimensional array named _disc_. If the class-specific
F1-score of the model being evaluated exceeds that of our own model, we
calculated the F1-discrepancy as in line 15. Otherwise, we set the
F1-discrepancy to $-\infty$ (line 17). The parameter $\eta$ increases the
degree to which high-performing classes are integrated.

The computeFaWg function then computes the weights for the familiar classes
for each model, taking the prior computed scores and certainty as input (line
19). This function computes the following Sigmoid function, where $w_{c}$ is
the weight of familiar class $c$, $s$ is the F1-discrepancy, and $r$ is the
certainty of the model being considered:

(2)
$w_{c}=max(0,\frac{\omega_{fa}^{1}}{1+e^{-\frac{s}{100}}}-\omega_{fa}^{2})*r$

This function assigns a weight of one to equally performing classes and an
increasingly higher weight to classes that show excellent performance,
dependent on the values of $\omega_{fa}^{1}$ and $\omega_{fa}^{2}$.
$\omega_{fa}$ represents the boost for above-average performing models and the
bounty for below-average performing models. The bigger this discrepancy, the
faster the model can catch up with other better-performing models, but the
bigger the impact of a malicious model that performs well on familiar classes
and bad on foreign classes. We multiply the outcome of the Sigmoid function by
the certainty score calculated earlier because the parameters of a class might
be sub-optimal even when it has a perfect F1-score when other classes perform
poorly. Figure 7 illustrates how the weight of CSPs is affected by their
F1-score on a test dataset, assuming that the peer’s current model yields a
F1-score of $0.5$ on that class and that the calculated certainty is $1$.

Figure 7. Weight assigned to the CSPs given an F1-score of 0.5 and a certainty
score of 1.0.

Determining a weight for the CSPs of the foreign classes is challenging
because we cannot directly measure their performance. Instead, we take the sum
of the scores of all familiar classes and feed this into the same Sigmoid
function as used for the familiar classes (Equation 2), albeit parameterized
with separate variables $\omega_{fo}^{1}$ and $\omega_{fo}^{2}$. This is done
by the computeFoWg function (line 21). $\omega_{fo}$ is the extent to which
foreign classes are integrated into the model. The higher this value, the
better the model can be when the peer wants to use the model to classify
formerly foreign classes, but also the higher the impact when a potentially
malicious model is integrated. If the user is uninterested in achieving high
performance on foreign classes, $\omega_{fo}^{1}$ can be set to 0.

Step 4 (model integration). Finally, we replace the CSPs of familiar and
foreign classes with the weighted average of all CSPs by using the calculated
weights (line 24-25).

###  3.4. Implementation

Bristle is implemented on top of an existing network library that provides
support for peer discovery, decentralized overlay creation, and authenticated
messaging (Stokkink et al., 2020; Stokkink and Pouwelse, [n.d.]). Since we
envision the usage of Bristle mostly in a mobile environment, our middleware
is written in the Kotlin programming language (the default language for
Android applications). We envision that Bristle runs as a background service
on the end-users’ devices to periodically receive or transmit models from and
to peers when the device is connected to Wi-Fi. Peers transmit model updates
using the UDP protocol and network messages are compressed with Gzip. Model
training is facilitated by the DeepLearning4j library (version 1.0.0-beta7) to
enjoy compatibility with a wide range of advanced ML algorithms. We have
published the Bristle source code and developer documentation in a GitHub
repository.333Source code can be requested through the Program Committee (to
comply with the double-blind review requirements).

Using Bristle. Developers can leverage the Bristle middleware by feeding the
peer’s current model and all received models into Bristle’s GAR after each
iteration and subsequently replacing the peer’s model with the result. The
moment a model is updated can be decided by the developer, for example, model
training can take place when the device is charging to minimize the impact on
end users. The peers should be able to selectively receive and integrate only
models relevant to the current ML application. To this end, Bristle uses the
functionality to form communication groups as provided by its network library.
Deciding on the variables listed under Section 4 is a key part of machine
learning. We recommend the developer to use heuristics, optimize them on a
related dataset, or use A/B-testing to find the best values to obtain the
desired accuracy on the models.

##  4\. Experimental Setup

We now describe our experimental setup, datasets, and parameters.

Testbed. All experiments are run on an HPE DL385 Gen10 server. This server is
equipped with 128 AMD EPYC 7452 CPUs, has 512 GB of DDR4 memory, and runs
Debian 10.

Datasets. In line with related research (Mhamdi et al., 2018; McMahan et al.,
[n.d.]; Xie et al., 2018), we consider an image classification application
that applies Convolutional Neural Networks (CNNs) to classify images. We use
the popular MNIST (Lecun, [n.d.]) dataset, consisting of 60,000 gray-scale
training images and 10,000 test images of 28x28 pixels representing
handwritten digits. To achieve better performance, we standardize the dataset
by applying Z-score normalization such that the features are re-scaled to a
normal distribution with $\mu$ = 0 and $\sigma$ = 1. We pre-train - until
convergence - a neural network with the same configuration on the EMNIST-
Letters (Cohen et al., 2017) dataset, which features resemble MNIST, but
contains characters instead of digits. We then include the resulting neural
network in the Bristle software.

Experiment parameter | Default value
---|---
_Environment_ |
Peers ($n$) | 10
Connection ratio | 100%
Fraction Byzantine peers | 50%
_Machine learning_ |
Mini-batch size ($b$) | 5
Learning rate ($\lambda$) | 0.001
L2-value | 0.005
Max. iterations | 300
_Bristle_ |
Exploration-exploitation rate ($\alpha$) | 0.4
Max. PBI input size ($\beta$) | 30
#familiar class selection size ($\phi$) | 3
#test samples per class ($\kappa$) | 10
$\eta$ | 10
$\omega_{fa}^{1}$, $\omega_{fo}^{1}$ | 10
$\omega_{fa}^{2}$, $\omega_{fo}^{2}$ | 4
Table 1. Default parameters and values used during the experiments.

Experiment parameters. We list all default parameters used during our
experiments in Table 1. An exploration-exploitation ratio $\alpha$ of 0.4
slightly prioritizes model with lower distance.

Non-i.d.d. data.  To evaluate Bristle with non-i.d.d. data, we first sort the
data per class, divide the data into equally-sized shards, and then assign to
every peer several shards, which is also the approach taken by related work
(Damaskinos et al., 2020a; Wang et al., 2019; Wang et al., [n.d.]). We note
that the more shards we assign to every peer, the better every peer can
recognize and defend against Byzantine attacks (see Section 3.3), but the less
non-i.i.d. the classes are. We opt to assign - unless specified otherwise -
without loss of generality to every peer four shards which cover 40% of the
classes to balance between the ability to learn non-i.i.d. classes and to
recognize Byzantine attacks.

Model training. We train the dataset on the same CNN architecture used by
McMahan et al. (McMahan et al., [n.d.]), except that we use Leaky ReLu instead
of the regular ReLu as the activation function for the hidden layers since the
former seems to give slightly better performance (specifically, suffers less
from the vanishing gradients problem). The model consists of twice a
convolutional layer (kernel size = 5, stride = 1, padding = 0) followed by a
max pooling layer (kernel size = 2, stride = 2, padding = 0), and finally the
output layer (with 800 hidden nodes). For the output function, we use the
softmax function, and as the loss function, we use negative log-likelihood. To
train the model, we use the Adam optimizer, parameterized as shown in Table 1.
Since these values significantly impact the model’s performance, we used a
grid search with typically 7-9 values for each parameter and ensured that the
optimal values were approximately in the middle. Although the baselines were
originally not developed to be used in combination with transfer learning, we
decided to use transfer learning for all baselines for all experiments anyway
since the performance increase is so significant that otherwise any comparison
with Bristle would be meaningless (also see Section 5.1).

Baselines. To compare Bristle with existing methods, we implemented five other
GARs commonly used in FL:

  1. (1)

_FedAvg_ (McMahan et al., [n.d.]) aggregates all models by coordinate-wise
averaging of parameters. It is commonly used as a baseline to compare the
performance of FL systems.

  2. (2)

_Median_ (Yin et al., 2018) aggregates all models by taking the coordinate-
wise mean of parameters. As demonstrated in the literature, it is already a
particularly effective Byzantine-resilient GAR (Yang et al., 2019).

  3. (3)

_Krum_ (Blanchard et al., [n.d.]) integrates the model that most closely
resembles (in terms of Euclidean distance) all other models as the new global
model. Even if the selected model is malicious, in theory, the performance
should not degrade too much as it is close to all other models.

  4. (4)

_BRIDGE_ (Yang and Bajwa, 2019a) is specifically designed for Byzantine-
resilient model aggregation in decentralized settings. It cyclically updates
every coordinate one by one and subsequently applies trimmed-mean screening to
obtain the final coordinate for each dimension.

  5. (5)

_MOZI_ (Guo et al., 2020) uses a combination of a fast distance-based and
accurate performance-based filter to aggregate model updates in a Byzantine-
resilient manner.

We initialized Krum and BRIDGE, which are dependent on a-priori knowledge of
the number of attackers, with $b=4$ (the maximum number of attackers) and Mozi
with $\rho=0.5$ (the ratio of benign to Byzantine peers).

(a) Regular learning

(b) Transfer learning

Figure 8. The accuracy of the model while training, for regular and transfer
learning.

(a) Label-flip attack

(b) Additive noise attack

(c) Krum attack

(d) Trimmed Mean attack

Figure 9. The resilience of Bristle and other GARs against various Byzantine
attacks, with 50% of all peers being malicious and i.i.d. data.

Byzantine attacks.  We also evaluate Bristle under the following four
Byzantine attacks, which are commonly considered in the domain.

  1. (1)

The _Label-flip attack_ (Bagdasaryan et al., [n.d.]) assigns an incorrect
label to each input (Bagdasaryan et al., [n.d.]; Fung et al., 2018; Tolpegin
et al., [n.d.]). We implement this attack by numbering all labels and
reassigning each sample with label $x$ to label $(x+1)\ \%\ |x|$.

  2. (2)

The _Additive noise attack_ (Li et al., 2020a) adds some noise to the
parameters of outgoing models. When the noise has a larger variance, it can
indeed prevent convergence but also makes the noise attack easier to detect
(Li et al., 2020a). Centering the noise around a value slightly different from
0 allows the attack to prevent convergence despite low variance, but since the
mean of benign updates is always centered around 0, this attack can be easily
detected. We consider a variant where each half of the parameters are set to
noise centered around a value just below and above 0, respectively.

  3. (3)

The _Krum attack_ (Fang et al., [n.d.]) specifically targets the Krum
aggregation rule. It is an effective, state-of-the-art attack by iteratively
sending attack vectors that will be accepted by Krum whilst inflicting maximum
damage to the peer’s model.

  4. (4)

The _Trimmed Mean attack_ (Fang et al., [n.d.]) targets the trimmed mean GAR
(Bridge in our experiments). It determines the gradient direction for each
parameter of the model and then creates an attack vector that points exactly
in the opposite direction, scaled per parameter depending on the values of the
other benign peers.

##  5\. Experimental Evaluation

We now evaluate the performance of Bristle. Our evaluation answers the
following questions: _(1) what is the achieved training speedup when applying
transfer learning to DFL? (2) How does Bristle perform in the presence of
Byzantine attackers in terms of model accuracy? (3) How does Bristle perform
when classes are not uniformly distributed over peers (non-i.i.d.) in terms of
model accuracy? (4) How does Bristle perform in an environment with both
Byzantine attackers and non-i.i.d. classes? And (5) What are the communication
and computational costs of Bristle?_

(a) All peers own samples of all classes

(b) Each peer owns samples of 40% of the classes

Figure 10. The performance of Bristle and other GARs when the data is i.i.d.
and non-i.i.d.

###  5.1. Performance Gains of Transfer Learning

We first evaluate the performance gains of transfer learning when all peers
are honest, and the data is i.i.d. For each experiment, we measure after every
10 iterations the performance of all peers and then take the average accuracy,
defined as $\frac{\\#correct\ predictions}{\\#test\ samples}$. Figure 8 shows
the evolution of model accuracy for the baseline GARs and Bristle, both
without transfer learning (Figure 8(a)) and with transfer learning (Figure
8(b)). We note that Bristle requires a pre-trained model and therefore is not
included in Figure 8(a). Figure 8(a) shows that the evaluated GARs perform
quite similarly, although Mozi has a slower convergence rate since it assigns
lower weights to benign models that have not been trained sufficiently yet to
perform well. Transfer learning dramatically improves both the convergence
rate and the maximum accuracy after 300 iterations of all GARs, which also
supports literature (Joy et al., 2019). More specifically, whereas reaching
70% accuracy takes on average 55 iterations with regular training, it takes
merely four iterations with transfer learning, a reduction of 93%. Reaching
90% accuracy takes on average 180 iterations with regular learning, whereas it
only takes 30 iterations with transfer learning, a reduction of 83%. This
reduction in iterations to reach the desired level of model accuracy can
significantly reduce the load on the network.

(a) Label-flip attack

(b) Additive noise attack

(c) Krum attack

(d) Trimmed Mean attack

Figure 11. The resilience of Bristle and other GARs against various Byzantine
attacks when the data is non-i.i.d.

(a) 10% of the peers is malicious

(b) 30% of the peers is malicious

(c) 50% of the peers is malicious

(d) 70% of the peers is malicious

Figure 12. The resilience of Bristle and other GARs under a label-flip-attack,
with a varying percentage of all peers being malicious, where the data is
non-i.i.d.

###  5.2. Byzantine Attacks

We now evaluate the Byzantine-resilience of Bristle under different attacks
when data is i.i.d. Figure 9 shows the effect of different attacks. Bristle
withstands all evaluated Byzantine attacks and quickly achieves high model
accuracy. Figure 9(a) shows that the label-flip attack prevents model
convergence when using the FedAvg GAR, but is, despite its relatively small
influence on the model’s parameters, successfully mitigated by all other GARs.
Figure 9(b) shows that the FedAvg and Median GARs are susceptible to the
additive noise attack. The Krum attack, shown in Figure 9(c), is clearly very
effective against Krum but has only a minor effect on the convergence rate of
the other GARs. The Trimmed Mean attack, see Figure 9(d), is relatively
ineffective against any Byzantine-resilient GAR. This is because all benign
models are very close to each other in this scenario, making it hard for this
attack to steer the model in another direction without clearly being an
outlier.

###  5.3. Non-i.i.d. Classes

We now consider the scenario where the classes are non-i.i.d., see Figure 10.
In this experiment, there are 10 peers, each of which has access to two random
samples of four consecutive classes. Thus, each peer $i$ has access to classes
$\\{i,(i+1)\%10,(i+2)\%10,(i+3)\%10\\}$. When we compare Figure 10(b) with
Figure 10(a), it is clear that Krum and Mozi fail to achieve desired model
accuracy with non-i.i.d. classes, and we also observe that Bridge and Median
converge significantly slower. FedAvg and Bristle show excellent performance
and achieve 90% model accuracy in 65 and 55 iterations, respectively. This is
because these methods (eventually) combine the information learned by every
peer, while the other methods disregard a part of the received models under
the incorrect assumption that those are Byzantine.

###  5.4. Combining Byzantine Attacks and Non-i.i.d. Classes

We now evaluate Bristle and other GARs in an environment containing both
Byzantine attackers and where the classes are non-i.i.d. (see Figure 11). We
use the label-flip attack in all experiments because this one is effective
(see Figure 11(a)) and very popular in related work (Xie et al., [n.d.]a;
Muñoz-González et al., 2019; Fang et al., [n.d.]). Except for Bristle, all
baselines fare poorly in the Byzantine experiments with non-i.i.d. classes.
Specifically, we observe that FedAvg is unable to defend against Byzantine
attacks, although it achieves an accuracy of 87% in the first few iterations
of the Krum attack (see Figure 11(c)). Although Bridge performs well in the
experiments presented in Section 5.2, it performs poorly under the threat of
Byzantine attacks when the classes are non-i.i.d. Krum is, as expected, unable
to defend against the Krum attack but performs under the threat of the other
attacks roughly on par with Mozi. Mozi shows the same accuracy as in the
benign non-i.i.d. experiments (see Figure 9) because it successfully defends
against Byzantine attacks but is also maxed out on the poor maximum accuracy
that it can attain on the node’s own dataset. The performance of the Median
baseline varies significantly depending on the attack and may be quite
inconsistent (as illustrated in Figure 11(b) and Figure 11(d)). An interesting
finding is that the Trimmed Mean attack is relatively ineffective in the
i.i.d. experiment (see Figure 9(d)) but impacts the performance of the same
baselines significantly in the non-i.i.d. experiment (see Figure 11(d)). This
results from the greater distance between the benign models in the non-i.i.d.
experiment, giving the attack more leeway to steer the model in a different
direction without being considered an outlier. Since the PBI assigns a weight
of 0 to the malicious CSPs, Bristle consistently outperforms all other GARs
and defends well against all evaluated Byzantine attacks.

(a) Each peer has data of 20% of the classes

(b) Each peer has data of 60% of the classes

Figure 13. The resilience of Bristle and other GARs under a label-flip-attack,
with 30% of all peers being malicious, where the classes are to a varying
extent non-i.i.d.

(a) Each peer is connected to 2% of the other peers

(b) Each peer is connected to 5% of the other peers

Figure 14. The resilience of Bristle and other GARs under a label-flip-attack,
with a varying percentage of the peers connected, where the classes are
non-i.i.d.

Varying the Number of Byzantine Attackers. We now vary the number of Byzantine
attackers, see Figure 12. Figure 12(a) shows that even with 10% Byzantine
attackers, the performance of the baselines already degrades significantly.
Bristle manages to maintain a quick increase in accuracy for all considered
attack scenarios. With 10% and 30% Byzantine attackers, Mozi manages to keep a
stable performance but is limited to predicting only the peer’s familiar
classes correctly. Figure 12(d) shows that the performance of Krum is
inconsistent and that only Bristle achieves a consistent high performance.
Bristle’s excellent performance results from the fact that (a) in contrast to
Mozi, Bristle evaluates and integrates the parameters per class instead of per
model, and (b) in contrast to the other GARs, Bristle uses performance
evaluations instead of just distance comparisons.

Varying the Degree of Non-i.i.d.-ness. We now compare the performance of the
GARs in three situations where the classes are to a varying extent non-i.i.d.
(see Figure 13). FedAvg and Bridge are, regardless of the degree of
non-i.i.d.-ness, unable to provide any resilience to the label-flip attack.
Mozi defends, similarly to the experiments in Figure 11, perfectly well
against the label-flip attack but is limited to the maximum accuracy that can
be obtained by training on its own dataset. The performance of Krum increases
with the number of classes owned by the peer. The Median rule performs
relatively well, even when the classes are highly non-i.i.d. Bristle, however,
clearly performs best compared to all baselines, although its performance
decreases when the peers have only 20% of the data (see Figure 13(a)).

Varying the Connection Ratio. In larger networks, it is unrealistic to assume
all-to-all dissemination of model updates. To test the impact of the
connection rate on the convergence rate more accurately, we set up an
environment with 100 peers where the classes are again non-i.i.d. similarly to
the previous experiments. We setup two experiments, connect each peer to a
random subset of 2% and 5% of the other peers respectively, add an equal
number of label-flip attackers that are connected to each benign peer, and
measure the average accuracy over time. From Figure 14(a), we observe that
when the connection rate is only 2%, FedAvg and Median perform very poorly,
but also the other GARs are unable to achieve satisfactory accuracy. When the
connection rate increases to 5% in Figure 14(b), Bristle and Krum perform
quite well in contrast to the other baselines. Thus, it seems that in a
setting with 100 peers, a connection rate of only 5% is already almost enough
to reach the maximum accuracy. The number of iterations required to obtain
this accuracy is relatively high compared to a connection rate of 100% (see
Figure 11(a)).

Figure 15. Average time to complete a single training iteration on the
non-i.i.d. label-flip experiment with a varying number of connected peers.

###  5.5. Bristle Efficiency and Scalability

Figure 15 shows for each GAR the average time it takes for a peer to finish a
single iteration depending on the number of connected peers. For evaluation
purposes we assume that each peer receives from every other peer exactly one
model at every iteration. The running time of Average is clearly the fastest,
followed closely by Median, Krum, and Bridge. The fast execution of these GARs
results from the usage of relatively inexpensive operations, such as
calculating the distance between models and sorting the parameters of each
dimension. Mozi is relatively slow because it has to evaluate the accuracy of
each model. Bristle is initially by far the slowest GAR caused by the
performance-based integrator that evaluates the performance not just for each
model but for each familiar class of each model. However, when the number of
connected peers exceeds $\beta$ (see Section 3.2), adding more peers has a
negligible impact on the speed of Bristle because the distance-based
prioritizer is efficient in reducing the number of models to $\beta$.

All baselines consume an equal amount of network traffic (roughly 3 MB per
iteration per peer for our neural network), but because Bristle transmits only
the output layer (roughly 300 KB), the bandwidth requirements of Bristle are
reduced by 90%.

##  6\. Related work

In the last five years, a considerable amount of literature has been devoted
to creating more effective FL systems. Most work focuses on achieving
Byzantine-resilience but also introduces several methods to reduce the
bandwidth requirements and to improve learning on non-i.i.d. classes.

Byzantine-resilience.  Several well-known Byzantine-resilient GARs are
Coordinate-wise Median (CM) (Muñoz-González et al., 2019) which takes the
median across all models for each parameter, Krum (Blanchard et al., [n.d.])
which selects the model that most closely resembles all other models, and
Bulyan (Mhamdi et al., 2018) which iteratively applies Krum followed by a
variant of CM. However, these GARs use distances as a proxy for benignness,
which it not reliable as we have seen in Section 3.2. In contrast,
performance-based methods reject or accept received models based on their
performance on a test dataset. Examples include RONI (Reject On Negative
Influence) (Barreno et al., 2010) which simply discards all models with a
negative impact on the model, and Zeno (Xie et al., [n.d.]a) / Zeno++ (Xie et
al., 2019) which use a central oracle to estimate the true gradient and only
keep the gradients most similar to this estimation. Bristle uses distances
only to prioritize the received models and uses per-class performance
measurements to integrate models.

Communication efficiency.  Because of the bandwidth limitations of cellular
networks, numerous methods were proposed to improve the communication
efficiency of FL. A popular method is to quantize the gradients to low-
precision values (Wen et al., 2017; Alistarh et al., 2016; De Sa et al.,
[n.d.]) or only to transmit the most important parameters (sparse matrix
methods) (Strom, [n.d.]; Konečný and Richtárik, 2018). Bristle only updates
the output layer, which works well together with existing techniques to reduce
the communication overhead.

Non-i.i.d. learning.  Several methods enable learning on non-i.i.d. classes,
such as by sharing a small i.i.d. training dataset across all peers (Zhao et
al., 2018) or by reusing non-federated continual learning techniques
(Kopparapu and Lin, 2020; Kumar et al., [n.d.]; Yao and Sun, [n.d.]; Gonzalez
et al., 2020). Bristle also lends several concepts from a non-federated
continual learning technique, namely CWR* (Lomonaco et al., 2019) (see Section
3.3).

FL systems.  Several FL systems try to combine Byzantine-resilience with
learning on non-i.i.d. data. RSA (Li et al., [n.d.]) uses a regularization-
based strategy and although it performs relatively well when the data is
non-i.i.d., it fares poorly against Byzantine attackers. FoolsGold (Fung et
al., 2018) detects and rejects attacks executed by multiple sybils working
together and works well with non-i.i.d. data. However, Zhao et al. (Zhao et
al., 2020) show that the Byzantine-resilience of FoolsGold is quite limited.
FLeet (Damaskinos et al., 2020b) uses past observed staleness values and
similarities with past learning tasks to achieve learning on non-i.i.d. data
for a specific type of ”soft” Byzantine attacks (namely the presence of stale
models) but is unsuitable for other types.

##  7\. Concluding Remarks

We have presented Bristle, middleware for decentralized, federated learning
that tolerates Byzantine attacks, even when the classes of the training data
are non-i.i.d. By leveraging deep transfer learning, Bristle achieves a high
convergence rate despite having a low communication overhead. Through the
combination of a fast distance-based prioritizer and a per-class performance
integrator, Bristle is able to withstand attacks targeted at subverting the
model accuracy. Our experimental evaluation using the popular MNIST dataset
has demonstrated these desirable properties and shows that Bristle exhibits
superior performance compared to related solutions. In this evaluation, we did
not focus on privacy, communication compression, or other aspects that are
supplementary to Bristle and addressed in the existing literature. We have
implemented and open-sourced Bristle on GitHub.

Although we believe that Bristle is a significant step forward for DFL, we
identify two directions for further work. First, communication costs could be
further reduced by selectively sending parameters to peers with high class
overlap. This can be estimated using Private Set Intersection Cardinality
(PSI-CA). One can prevent peers from learning too much about the class
distribution of others, e.g., by adding noise to the cardinality and by rate-
limiting PSI-CA requests. Second, the accuracy could be increased even more
when the non-output layers can also be fine-tuned rather than being fixed.
Several popular continual learning algorithms are suitable for this purpose,
such as LWF (Li and Hoiem, 2017), AR1 (Lomonaco et al., 2019), or EWC
(Kirkpatrick et al., 2017). However, tuning also the non-output layers
requires the transmission of information about these non-output layers,
significantly increasing the communication costs. Additionally, it is non-
trivial to maintain the Byzantine-resilience property because the parameters
in the hidden layers do not correspond directly with the classes to be
predicted.

## References

  * (1)
  * RN3 ([n.d.]) [n.d.].  Google Trends - transfer learning popularity worldwide.  ([n. d.]).  https://trends.google.com/trends/explore?date=all
  * RN9 (2017) 2017\.  https://ai.googleblog.com/2017/04/federated-learning-collaborative.html
  * Alistarh et al. (2016) Dan Alistarh, Jerry Li, Ryota Tomioka, and Milan Vojnovic. 2016\.  Qsgd: Randomized quantization for communication-optimal stochastic gradient descent.  _arXiv preprint arXiv:1610.02132_ 1 (2016).
  * Bagdasaryan et al. ([n.d.]) Eugene Bagdasaryan, Andreas Veit, Yiqing Hua, Deborah Estrin, and Vitaly Shmatikov. [n.d.].  How to backdoor federated learning. In _International Conference on Artificial Intelligence and Statistics_. PMLR, 2938–2948.
  * Barreno et al. (2010) Marco Barreno, Blaine Nelson, Anthony D Joseph, and J Doug Tygar. 2010.  The security of machine learning.  _Machine Learning_ 81, 2 (2010), 121–148.
  * Blanchard et al. ([n.d.]) Peva Blanchard, Rachid Guerraoui, and Julien Stainer. [n.d.].  Machine learning with adversaries: Byzantine tolerant gradient descent. In _Advances in Neural Information Processing Systems_. 119–129.
  * Bonawitz et al. (2019) Keith Bonawitz, Hubert Eichner, Wolfgang Grieskamp, Dzmitry Huba, Alex Ingerman, Vladimir Ivanov, Chloe Kiddon, Jakub Konečný, Stefano Mazzocchi, and H Brendan McMahan. 2019.  Towards federated learning at scale: System design.  _arXiv preprint arXiv:1902.01046_ (2019).
  * Bottou (2012) Léon Bottou. 2012\.  Stochastic gradient descent tricks.  In _Neural networks: Tricks of the trade_. Springer, 421–436.
  * Brisimi et al. (2018) Theodora S Brisimi, Ruidi Chen, Theofanie Mela, Alex Olshevsky, Ioannis Ch Paschalidis, and Wei Shi. 2018\.  Federated learning of predictive models from federated electronic health records.  _International journal of medical informatics_ 112 (2018), 59–67.
  * Chapelle and Harchaoui (2005) Olivier Chapelle and Zaıd Harchaoui. 2005.  A machine learning approach to conjoint analysis.  _Advances in neural information processing systems_ 17 (2005), 257–264.
  * Chen et al. (2019a) Mingqing Chen, Rajiv Mathews, Tom Ouyang, and Françoise Beaufays. 2019a.  Federated learning of out-of-vocabulary words.  _arXiv preprint arXiv:1903.10635_ (2019).
  * Chen et al. (2020a) Mingzhe Chen, H Vincent Poor, Walid Saad, and Shuguang Cui. 2020a.  Wireless Communications for Collaborative Federated Learning in the Internet of Things.  _arXiv preprint arXiv:2006.02499_ (2020).
  * Chen et al. (2019b) Mingqing Chen, Ananda Theertha Suresh, Rajiv Mathews, Adeline Wong, Cyril Allauzen, Françoise Beaufays, and Michael Riley. 2019b.  Federated learning of N-gram language models.  _arXiv preprint arXiv:1910.03432_ (2019).
  * Chen et al. (2017) Yudong Chen, Lili Su, and Jiaming Xu. 2017.  Distributed statistical machine learning in adversarial settings: Byzantine gradient descent.  _Proceedings of the ACM on Measurement and Analysis of Computing Systems_ 1, 2 (2017), 1–25.
  * Chen et al. (2020b) Zheyi Chen, Pu Tian, Weixian Liao, and Wei Yu. 2020b.  Zero Knowledge Clustering Based Adversarial Mitigation in Heterogeneous Federated Learning.  _IEEE Transactions on Network Science and Engineering_ (2020).
  * Chicco and Jurman (2020) Davide Chicco and Giuseppe Jurman. 2020.  The advantages of the Matthews correlation coefficient (MCC) over F1 score and accuracy in binary classification evaluation.  _BMC genomics_ 21, 1 (2020), 1–13.
  * Chui et al. (2018) Michael Chui, James Manyika, Mehdi Miremadi, Nicolaus Henke, Rita Chung, Pieter Nel, and Sankalp Malhotra. 2018.  Notes from the AI frontier: Insights from hundreds of use cases.  _McKinsey Global Institute_ (2018).
  * Cohen et al. (2017) Gregory Cohen, Saeed Afshar, Jonathan Tapson, and Andre Van Schaik. 2017.  EMNIST: Extending MNIST to handwritten letters. In _2017 International Joint Conference on Neural Networks (IJCNN)_. IEEE, 2921–2926.
  * Damaskinos et al. (2020a) Georgios Damaskinos, Rachid Guerraoui, Anne-Marie Kermarrec, Vlad Nitu, Rhicheek Patra, and Francois Taiani. 2020a.  Fleet: Online federated learning via staleness awareness and performance prediction. In _Proceedings of the 21st International Middleware Conference_. 163–177.
  * Damaskinos et al. (2020b) Georgios Damaskinos, Rachid Guerraoui, Anne-Marie Kermarrec, Vlad Nitu, Rhicheek Patra, and Francois Taiani. 2020b.  Fleet: Online federated learning via staleness awareness and performance prediction. In _Proceedings of the 21st International Middleware Conference_. 163–177.
  * De Sa et al. ([n.d.]) Christopher De Sa, Matthew Feldman, Christopher Ré, and Kunle Olukotun. [n.d.].  Understanding and optimizing asynchronous low-precision stochastic gradient descent. In _Proceedings of the 44th Annual International Symposium on Computer Architecture_. 561–574.
  * Dobbe et al. ([n.d.]) Roel Dobbe, David Fridovich-Keil, and Claire Tomlin. [n.d.].  Fully decentralized policies for multi-agent systems: An information theoretic approach. In _Advances in Neural Information Processing Systems_. 2941–2950.
  * Douceur ([n.d.]) John R Douceur. [n.d.].  The sybil attack. In _International workshop on peer-to-peer systems_. Springer, 251–260.
  * Durkee (2010) Dave Durkee. 2010\.  Why cloud computing will never be free.  _Commun. ACM_ 53, 5 (2010), 62–69.
  * Endler et al. (2011) Markus Endler, Alexandre Skyrme, Daniel Schuster, and Thomas Springer. 2011.  Defining situated social context for pervasive social computing. In _2011 IEEE International Conference on Pervasive Computing and Communications Workshops (PERCOM Workshops)_. IEEE, 519–524.
  * Fang et al. ([n.d.]) Minghong Fang, Xiaoyu Cao, Jinyuan Jia, and Neil Gong. [n.d.].  Local model poisoning attacks to Byzantine-robust federated learning. In _29th USENIX Security Symposium (USENIX Security 20)_. 1605–1622.
  * Felber and Biersack (2004) P Felber and Ernst W Biersack. 2004.  Self-scaling networks for content distribution. In _Proc. International Workshop on Self-* Properties in Complex Information Systems_. 1–14.
  * for Disease Control et al. (2003) Centers for Disease Control, Prevention, et al. 2003\.  HIPAA privacy rule and public health. Guidance from CDC and the US Department of Health and Human Services.  _MMWR: Morbidity and mortality weekly report_ 52, Suppl 1 (2003), 1–17.
  * Fung et al. (2018) Clement Fung, Chris JM Yoon, and Ivan Beschastnikh. 2018\.  Mitigating sybils in federated learning poisoning.  _arXiv preprint arXiv:1808.04866_ (2018).
  * Gonzalez et al. (2020) Camila Gonzalez, Georgios Sakas, and Anirban Mukhopadhyay. 2020\.  What is Wrong with Continual Learning in Medical Image Segmentation?  _arXiv preprint arXiv:2010.11008_ (2020).
  * Guo et al. (2020) Shangwei Guo, Tianwei Zhang, Xiaofei Xie, Lei Ma, Tao Xiang, and Yang Liu. 2020\.  Towards Byzantine-resilient Learning in Decentralized Systems.  _arXiv preprint arXiv:2002.08569_ (2020).
  * Hard et al. (2018) Andrew Hard, Kanishka Rao, Rajiv Mathews, Swaroop Ramaswamy, Françoise Beaufays, Sean Augenstein, Hubert Eichner, Chloé Kiddon, and Daniel Ramage. 2018.  Federated learning for mobile keyboard prediction.  _arXiv preprint arXiv:1811.03604_ (2018).
  * He et al. (2016) Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. 2016\.  Deep residual learning for image recognition. In _Proceedings of the IEEE conference on computer vision and pattern recognition_. 770–778.
  * Hegedűs et al. (2021) István Hegedűs, Gábor Danner, and Márk Jelasity. 2021\.  Decentralized learning works: An empirical comparison of gossip learning and federated learning.  _J. Parallel and Distrib. Comput._ 148 (2021), 109–124.
  * Hu et al. (2020) Hanpeng Hu, Dan Wang, and Chuan Wu. 2020.  Distributed machine learning through heterogeneous edge systems. In _Proceedings of the AAAI Conference on Artificial Intelligence_ , Vol. 34. 7179–7186.
  * Huang et al. (2017) Gao Huang, Zhuang Liu, Laurens Van Der Maaten, and Kilian Q Weinberger. 2017.  Densely connected convolutional networks. In _Proceedings of the IEEE conference on computer vision and pattern recognition_. 4700–4708.
  * Joy et al. (2019) Tinu Theckel Joy, Santu Rana, Sunil Gupta, and Svetha Venkatesh. 2019.  A flexible transfer learning framework for Bayesian optimization with convergence guarantee.  _Expert Systems with Applications_ 115 (2019), 656–672.
  * Kairouz et al. (2019) Peter Kairouz, H Brendan McMahan, Brendan Avent, Aurélien Bellet, Mehdi Bennis, Arjun Nitin Bhagoji, Keith Bonawitz, Zachary Charles, Graham Cormode, and Rachel Cummings. 2019.  Advances and open problems in federated learning.  _arXiv preprint arXiv:1912.04977_ (2019).
  * Kirkpatrick et al. (2017) James Kirkpatrick, Razvan Pascanu, Neil Rabinowitz, Joel Veness, Guillaume Desjardins, Andrei A Rusu, Kieran Milan, John Quan, Tiago Ramalho, Agnieszka Grabska-Barwinska, et al. 2017\.  Overcoming catastrophic forgetting in neural networks.  _Proceedings of the national academy of sciences_ 114, 13 (2017), 3521–3526.
  * Konečný and Richtárik (2018) Jakub Konečný and Peter Richtárik. 2018.  Randomized distributed mean estimation: Accuracy vs. communication.  _Frontiers in Applied Mathematics and Statistics_ 4 (2018), 62\.
  * Kopparapu and Lin (2020) Kavya Kopparapu and Eric Lin. 2020.  FedFMC: Sequential Efficient Federated Learning on Non-iid Data.  _arXiv preprint arXiv:2006.10937_ (2020).
  * Krizhevsky et al. (2012) Alex Krizhevsky, Ilya Sutskever, and Geoffrey E Hinton. 2012\.  Imagenet classification with deep convolutional neural networks.  _Advances in neural information processing systems_ 25 (2012), 1097–1105.
  * Kumar et al. ([n.d.]) Swaraj Kumar, Sandipan Dutta, Shaurya Chatturvedi, and MPS Bhatia. [n.d.].  Strategies for Enhancing Training and Privacy in Blockchain Enabled Federated Learning. In _2020 IEEE Sixth International Conference on Multimedia Big Data (BigMM)_. IEEE, 333–340.
  * Lalitha et al. (2019) Anusha Lalitha, Xinghan Wang, Osman Kilinc, Yongxi Lu, Tara Javidi, and Farinaz Koushanfar. 2019\.  Decentralized bayesian learning over graphs.  _arXiv preprint arXiv:1905.10466_ (2019).
  * Lecun ([n.d.]) Yann Lecun. [n.d.].  http://yann.lecun.com/exdb/mnist
  * Li et al. (2018) He Li, Kaoru Ota, and Mianxiong Dong. 2018.  Learning IoT in edge: Deep learning for the Internet of Things with edge computing.  _IEEE network_ 32, 1 (2018), 96–101.
  * Li et al. ([n.d.]) Liping Li, Wei Xu, Tianyi Chen, Georgios B Giannakis, and Qing Ling. [n.d.].  RSA: Byzantine-robust stochastic aggregation methods for distributed learning from heterogeneous datasets. In _Proceedings of the AAAI Conference on Artificial Intelligence_ , Vol. 33. 1544–1551.
  * Li et al. (2020a) Suyi Li, Yong Cheng, Wei Wang, Yang Liu, and Tianjian Chen. 2020a.  Learning to Detect Malicious Clients for Robust Federated Learning.  _arXiv preprint arXiv:2002.00211_ (2020).
  * Li et al. (2020b) Tian Li, Anit Kumar Sahu, Ameet Talwalkar, and Virginia Smith. 2020b.  Federated learning: Challenges, methods, and future directions.  _IEEE Signal Processing Magazine_ 37, 3 (2020), 50–60.
  * Li and Hoiem (2017) Zhizhong Li and Derek Hoiem. 2017.  Learning without forgetting.  _IEEE transactions on pattern analysis and machine intelligence_ 40, 12 (2017), 2935–2947.
  * Lian et al. ([n.d.]) Xiangru Lian, Ce Zhang, Huan Zhang, Cho-Jui Hsieh, Wei Zhang, and Ji Liu. [n.d.].  Can decentralized algorithms outperform centralized algorithms? a case study for decentralized parallel stochastic gradient descent. In _Advances in Neural Information Processing Systems_. 5330–5340.
  * Lomonaco (2019) Vincenzo Lomonaco. 2019\.  Continual Learning with Deep Architectures.  (2019).
  * Lomonaco et al. (2019) Vincenzo Lomonaco, Davide Maltoni, and Lorenzo Pellegrini. 2019\.  Rehearsal-Free Continual Learning over Small Non-IID Batches.  _arXiv preprint arXiv:1907.03799_ (2019).
  * Lu et al. ([n.d.]) Songtao Lu, Yawen Zhang, and Yunlong Wang. [n.d.].  Decentralized federated learning for electronic health records. In _2020 54th Annual Conference on Information Sciences and Systems (CISS)_. IEEE, 1–5.
  * McMahan et al. ([n.d.]) Brendan McMahan, Eider Moore, Daniel Ramage, Seth Hampson, and Blaise Aguera y Arcas. [n.d.].  Communication-efficient learning of deep networks from decentralized data. In _Artificial Intelligence and Statistics_. PMLR, 1273–1282.
  * Mhamdi et al. (2018) El Mahdi El Mhamdi, Rachid Guerraoui, and Sébastien Rouault. 2018\.  The hidden vulnerability of distributed learning in byzantium.  _arXiv preprint arXiv:1802.07927_ (2018).
  * Muñoz-González et al. (2019) Luis Muñoz-González, Kenneth T Co, and Emil C Lupu. 2019\.  Byzantine-robust federated machine learning through adaptive model averaging.  _arXiv preprint arXiv:1909.05125_ (2019).
  * Nedic and Ozdaglar (2009) Angelia Nedic and Asuman Ozdaglar. 2009.  Distributed subgradient methods for multi-agent optimization.  _IEEE Trans. Automat. Control_ 54, 1 (2009), 48–61.
  * Niknam et al. (2020) Solmaz Niknam, Harpreet S Dhillon, and Jeffrey H Reed. 2020\.  Federated learning for wireless communications: Motivation, opportunities, and challenges.  _IEEE Communications Magazine_ 58, 6 (2020), 46–51.
  * Pan (2010) Jialin Pan. 2010\.  _Feature-based transfer learning with real-world applications_.  Ph.D. Dissertation. Citeseer.
  * Rieke et al. (2020) Nicola Rieke, Jonny Hancox, Wenqi Li, Fausto Milletari, Holger Roth, Shadi Albarqouni, Spyridon Bakas, Mathieu N Galtier, Bennett Landman, and Klaus Maier-Hein. 2020\.  The future of digital health with federated learning.  _arXiv preprint arXiv:2003.08119_ (2020).
  * Sattler et al. (2020) Felix Sattler, Thomas Wiegand, and Wojciech Samek. 2020\.  Trends and advancements in deep neural network communication.  _arXiv preprint arXiv:2003.03320_ (2020).
  * Schneble and Thamilarasu ([n.d.]) William Schneble and Geethapriya Thamilarasu. [n.d.].  Attack Detection Using Federated Learning in Medical Cyber-Physical Systems.  ([n. d.]).
  * Sim et al. ([n.d.]) Khe Chai Sim, Françoise Beaufays, Arnaud Benard, Dhruv Guliani, Andreas Kabel, Nikhil Khare, Tamar Lucassen, Petr Zadrazil, Harry Zhang, and Leif Johnson. [n.d.].  Personalization of end-to-end speech recognition on mobile devices for named entities. In _2019 IEEE Automatic Speech Recognition and Understanding Workshop (ASRU)_. IEEE, 23–30.
  * Smith et al. ([n.d.]) Virginia Smith, Chao-Kai Chiang, Maziar Sanjabi, and Ameet S Talwalkar. [n.d.].  Federated multi-task learning. In _Advances in Neural Information Processing Systems_. 4424–4434.
  * Sozinov et al. ([n.d.]) Konstantin Sozinov, Vladimir Vlassov, and Sarunas Girdzijauskas. [n.d.].  Human Activity Recognition Using Federated Learning. In _2018 IEEE Intl Conf on Parallel & Distributed Processing with Applications, Ubiquitous Computing & Communications, Big Data & Cloud Computing, Social Computing & Networking, Sustainable Computing & Communications (ISPA/IUCC/BDCloud/SocialCom/SustainCom)_. IEEE, 1103–1111.
  * Stokkink et al. (2020) Quinten Stokkink, Dick Epema, and Johan Pouwelse. 2020\.  A Truly Self-Sovereign Identity System.  _arXiv preprint arXiv:2007.00415_ (2020).
  * Stokkink and Pouwelse ([n.d.]) Quinten Stokkink and Johan Pouwelse. [n.d.].  Deployment of a blockchain-based self-sovereign identity. In _2018 IEEE international conference on Internet of Things (iThings) and IEEE green computing and communications (GreenCom) and IEEE cyber, physical and social computing (CPSCom) and IEEE smart data (SmartData)_. IEEE, 1336–1342.
  * Strom ([n.d.]) Nikko Strom. [n.d.].  Scalable distributed DNN training using commodity GPU cloud computing. In _Sixteenth Annual Conference of the International Speech Communication Association_.
  * Su and Vaidya (2015) Lili Su and Nitin H Vaidya. 2015.  Fault-tolerant distributed optimization (Part IV): Constrained optimization with arbitrary directed networks.  _arXiv preprint arXiv:1511.01821_ (2015).
  * Sundaram and Gharesifard (2018) Shreyas Sundaram and Bahman Gharesifard. 2018.  Distributed optimization under adversarial nodes.  _IEEE Trans. Automat. Control_ 64, 3 (2018), 1063–1076.
  * Tan et al. (2018) Chuanqi Tan, Fuchun Sun, Tao Kong, Wenchang Zhang, Chao Yang, and Chunfang Liu. 2018\.  A survey on deep transfer learning. In _International conference on artificial neural networks_. Springer, 270–279.
  * Tang et al. ([n.d.]) Hanlin Tang, Shaoduo Gan, Ce Zhang, Tong Zhang, and Ji Liu. [n.d.].  Communication compression for decentralized training. In _Advances in Neural Information Processing Systems_. 7652–7662.
  * Tolpegin et al. ([n.d.]) Vale Tolpegin, Stacey Truex, Mehmet Emre Gursoy, and Ling Liu. [n.d.].  Data poisoning attacks against federated learning systems. In _European Symposium on Research in Computer Security_. Springer, 480–501.
  * Voigt and Von dem Bussche (2017) Paul Voigt and Axel Von dem Bussche. 2017.  The eu general data protection regulation (gdpr).  _A Practical Guide, 1st Ed., Cham: Springer International Publishing_ (2017).
  * Wallach (2002) Dan S Wallach. 2002\.  A survey of peer-to-peer security issues. In _International symposium on software security_. Springer, 42–57.
  * Wang et al. (2019) Shiqiang Wang, Tiffany Tuor, Theodoros Salonidis, Kin K Leung, Christian Makaya, Ting He, and Kevin Chan. 2019.  Adaptive federated learning in resource constrained edge computing systems.  _IEEE Journal on Selected Areas in Communications_ 37, 6 (2019), 1205–1221.
  * Wang et al. (2020) Xiaofei Wang, Yiwen Han, Victor CM Leung, Dusit Niyato, Xueqiang Yan, and Xu Chen. 2020\.  Convergence of edge computing and deep learning: A comprehensive survey.  _IEEE Communications Surveys & Tutorials_ 22, 2 (2020), 869–904.
  * Wang et al. ([n.d.]) Zhibo Wang, Mengkai Song, Zhifei Zhang, Yang Song, Qian Wang, and Hairong Qi. [n.d.].  Beyond inferring class representatives: User-level privacy leakage from federated learning. In _IEEE INFOCOM 2019-IEEE Conference on Computer Communications_. IEEE, 2512–2520.
  * Wen et al. (2017) Wei Wen, Cong Xu, Feng Yan, Chunpeng Wu, Yandan Wang, Yiran Chen, and Hai Li. 2017.  Terngrad: Ternary gradients to reduce communication in distributed deep learning.  _arXiv preprint arXiv:1705.07878_ (2017).
  * Xie et al. (2018) Cong Xie, Oluwasanmi Koyejo, and Indranil Gupta. 2018\.  Generalized byzantine-tolerant sgd.  _arXiv preprint arXiv:1802.10116_ (2018).
  * Xie et al. ([n.d.]a) Cong Xie, Sanmi Koyejo, and Indranil Gupta. [n.d.]a.  Zeno: Distributed stochastic gradient descent with suspicion-based fault-tolerance. In _International Conference on Machine Learning_. PMLR, 6893–6901.
  * Xie et al. (2019) Cong Xie, Sanmi Koyejo, and Indranil Gupta. 2019.  Zeno++: Robust Fully Asynchronous SGD.  _arXiv preprint arXiv:1903.07020_ (2019).
  * Xie et al. ([n.d.]b) Xiaofei Xie, Lei Ma, Haijun Wang, Yuekang Li, Yang Liu, and Xiaohong Li. [n.d.]b.  DiffChaser: Detecting Disagreements for Deep Neural Networks. In _IJCAI_. 5772–5778.
  * Yang and Bajwa (2019a) Zhixiong Yang and Waheed U Bajwa. 2019a.  BRIDGE: Byzantine-resilient decentralized gradient descent.  _arXiv preprint arXiv:1908.08098_ (2019).
  * Yang and Bajwa (2019b) Zhixiong Yang and Waheed U Bajwa. 2019b.  ByRDiE: Byzantine-resilient distributed coordinate descent for decentralized learning.  _IEEE Transactions on Signal and Information Processing over Networks_ 5, 4 (2019), 611–627.
  * Yang et al. (2019) Zhixiong Yang, Arpita Gang, and Waheed U Bajwa. 2019\.  Adversary-resilient inference and machine learning: From distributed to decentralized.  _stat_ 1050 (2019), 23.
  * Yang et al. (2020) Zhixiong Yang, Arpita Gang, and Waheed U Bajwa. 2020\.  Adversary-resilient distributed and decentralized statistical inference and machine learning: An overview of recent advances under the Byzantine threat model.  _IEEE Signal Processing Magazine_ 37, 3 (2020), 146–159.
  * Yao and Sun ([n.d.]) Xin Yao and Lifeng Sun. [n.d.].  Continual Local Training For Better Initialization Of Federated Models. In _2020 IEEE International Conference on Image Processing (ICIP)_. IEEE, 1736–1740.
  * Yin et al. (2018) Dong Yin, Yudong Chen, Kannan Ramchandran, and Peter Bartlett. 2018.  Byzantine-robust distributed learning: Towards optimal statistical rates.  _arXiv preprint arXiv:1803.01498_ (2018).
  * Zhang and Yang (2017) Yu Zhang and Qiang Yang. 2017.  A survey on multi-task learning.  _arXiv preprint arXiv:1707.08114_ (2017).
  * Zhao et al. (2020) Lingchen Zhao, Shengshan Hu, Qian Wang, Jianlin Jiang, Shen Chao, Xiangyang Luo, and Pengfei Hu. 2020.  Shielding Collaborative Learning: Mitigating Poisoning Attacks through Client-Side Detection.  _IEEE Transactions on Dependable and Secure Computing_ (2020).
  * Zhao et al. (2018) Yue Zhao, Meng Li, Liangzhen Lai, Naveen Suda, Damon Civin, and Vikas Chandra. 2018\.  Federated learning with non-iid data.  _arXiv preprint arXiv:1806.00582_ (2018).
  * Zhou et al. (2020) Sicong Zhou, Huawei Huang, Wuhui Chen, Pan Zhou, Zibin Zheng, and Song Guo. 2020\.  Pirate: A blockchain-based secure framework of distributed machine learning in 5g networks.  _IEEE Network_ (2020).