# Axisymmetric Plasma Equilibria with Toroidal and Poloidal Velocity Fields:
Tokamak Relevant Configurations

Giovanni Montani1,2 Matteo Del Prete2<EMAIL_ADDRESS>1 ENEA,
Fusion and Nuclear Safety Department, C.R. Frascati
Via E. Fermi 45, 00044 Frascati (Roma), Italy  2 Physics Department,
“Sapienza” University of Rome,
P.le Aldo Moro 5, 00185 Roma, Italy

###### Abstract

We analyze an axisymmetric equilibrium of a plasma endowed with toroidal and
poloidal velocity fields, with the aim to characterize the influence of the
global motion on the morphology of the magnetic confinement. We construct our
configuration assuming that the poloidal velocity field is aligned with the
poloidal magnetic field lines and, furthermore, we require that the plasma
mass density depend on the magnetic flux function (or equivalently, that the
plasma fluid be incompressible). We then derive a sort of Grad–Shafranov
equation for such an equilibrium and implement it to tokamak relevant
situations, with particular reference to TCV–like profiles. The main result of
the present study concerns the emergence, in configurations associated to a
double–null profile, of a closed surface of null pressure encorporating the
two X-points of the magnetic configuration. This scenario suggests the
possible existence of a new regime of the plasma equilibrium, corresponding to
an improved plasma confinement near the X-points and a consequent reduced
power transfer to the tokamak divertor.

##  I Introduction

The possibility to confine a plasma into a finite region of space necessarily
requires the application of external magnetic fields able to produce the
requested balance of the fundamental forces acting on the plasma itself [1].
However, the achievement of a steady equilibrium for a fusion relevant
laboratory plasma is far from being available in experimental operations, both
for the limited time duration of the discharge and for the unavoidable plasma
instabilities [2, 3]. Therefore, in the context of tokamak machines we can
consider as equilibrium a magnetic configuration which lives for a much longer
time than the typical instability inverse rates and, on the other hand,
sufficiently short to prevent the observation of significant changes in the
global distribution of the magnetic and internal energy of the plasma.

Historically (see the original studies in [4, 5]) the basic magnestostatic
equation underlying the equilibria consists of the balance between the
pressure gradient and the $\vec{j}\wedge\vec{B}$ force, without considering
any contribution due to velocity fields, and to the mass density as a
consequence. This scenario was appropriate for the pioneering experiments of
the plasma confinement and also for many later machines, but, since the early
nineties it became clear [6] that tokamak plasmas could be endowed with both
toroidal and poloidal rotation fields (known as _spontaneous rotation_), even
reaching values comparable to the sound speed [14].

The necessity to include velocity fields in the description of a tokamak
equilibrium is increasingly relevant to achieve a satisfactory level of
predictivity. In the next generation large sized tokamaks like ITER [7],
JT-60SA [8], DTT [9], but also in present medium sized tokamak experiments,
for instance MAST-U [10] and TCV [11], the request to include toroidal and
poloidal velocity fields is a consequence of the spontaneous rotation
phenomenon, cited above, but also due to the interaction of the plasma with
additional heating systems, in particular when injection of hot neutral beams
is utilized. Furthermore, the operation of the current machines in the H-mode
regime seems to be favoured by transport barriers due to the radial electric
field which lives in the equilibrium by virtue of the presence of poloidal
velocity fields [13].

Studies to include the velocity contributions in tokamak equilibria are
present in literature, see for instance [15, 16, 17, 18], and are mainly
focused on the possibility to include toroidal motions of the plasma, by
making use of the concepts of generalized pressure or Bernoulli functions. For
more recent systematic approaches see [19, 20]; moreover, a specific semi-
analytical technique to investigate, on one hand the influence on equilibria
of the resistive diffusion and, on the other hand of the toroidal field
velocity, has been considered in [21] and [22], respectively. In the present
letter, we construct an equilibrium configuration of a plasma endowed
simultaneously with toroidal and poloidal velocities, arriving to a specific
reformulation of the standard Grad–Shafranov equation. We base our analysis on
two main assumptions: i) the poloidal velocity field follows the corresponding
poloidal magnetic lines; ii) the plasma mass density depends on the magnetic
flux function, or equivalently, the fluid can be regarded as incompressible.

The implementation of the obtained Grad–Shafranov-like equation has the
peculiarity to be nonlinear in the poloidal magnetic field component, because
the magnetic pressure gradient remain, together with the thermodynamical
pressuire gradient, into the force balance fixing the equilibrium. The
implementation to the tokamak equilibrium configuration immediately outline
the expected deviation of the magnetic surfaces form the isobar ones. As a
consequence, three different regions of the plasma confinament can be
identified: i) a region which is within the separatrix and the isobar of zero
pressure (the most confined region); ii) the region which is out of the isobar
of vanishing pressure, but which is still within the separatrix (a lower
confinement condition); iii) the usual scrape–off layer region (there no real
confinement exists).

However, in general, the separatrix and the zero pressure region intersect
each other and therefore more hybrid situations can take place, like the
possibility for the plasma costituents to cross the isobar of vanishing
pressure along the magnetic surfaces and therefore, in principle, due to
parallel transport. However, the most interesting result of our analysis
emerges when we implement the present scenario to a TCV-like configuration in
the presence of a magnetic profile endowed with two (up and down) X-points
[23]. We constructed an equilibrium for such a double null profile and
observed the formation of a closed line of zero pressure which encircles the
two X-points. The presence of these two plasma lobi suggests that, in the
presence of velocity fields, the plasma around the null is better confined
with respect to the absence of any motion. This has reasonable implications on
the heat and particle transport form the X-point towards the divertor. By
other words, the ”private region” (_i.e._ the region enclosed by the divertor
surface and the magnetic configuration outer legs) results divided into two
parts: one inside a lobe of zero pressure and one at all equivalent to that
region commonly observed in the scrape–off layer. The existence of these
symmetric (up and down) minor lobi can have an important role in protecting
the divertor from excessive power tranfers from the plasma and it should be
further investigated under many points of view.

##  II Basic equations

We consider the equations describing a steady ideal MHD fluid, characterized
by a mass density $\rho$, a pressure $p$, a velocity field $\vec{v}$ and
embedded in a magnetic field $\vec{B}$. We write the mass conservation
equation and the ideal steady momentum conservation equation as

$\displaystyle\vec{\nabla}\cdot\left(\rho\vec{v}\right)=0\,,$ (1)
$\displaystyle\rho\vec{v}\cdot\vec{\nabla}\vec{v}=-\vec{\nabla}\left(p+\frac{B^{2}}{2\upmu_{0}}\right)+\frac{1}{\upmu_{0}}\vec{B}\cdot\vec{\nabla}\vec{B}\,,$
(2)

where in the latter we separated the contributions of the magnetic pressure
and tension. Combining together the electron force balance,
$\vec{E}=\vec{v}\,\wedge\vec{B}$, with the irrotational character of the
static electric field, $\vec{\nabla}\wedge\vec{E}=0$, we get the equation

$\vec{\nabla}\wedge\left(\vec{v}\,\wedge\vec{B}\right)=0\,.$ (3)

Finally, the temperature $T$ verifies the stationary equation

$\vec{v}\cdot\vec{\nabla}T+\frac{2}{3}T\vec{\nabla}\cdot\vec{v}=0\,.$ (4)

This configurational set is sufficient to properly characterize a plasma
equilibrium, which we will specialize to the axial symmetry.

###  II.1 Axisymmetric equilibrium

We now consider axial symmetry in cylindrical coordinates $\\{r,\phi,z\\}$, so
that all the partial derivatives $\partial_{\phi}(...)=0$ vanish. Under this
hypothesis, Eq.(1) has the form

$\frac{1}{r}\partial_{r}\left(\rho rv_{r}\right)+\partial_{z}\left(\rho
v_{z}\right)=0\,,$ (5)

which admits the solution

$\rho\vec{v}=-\frac{1}{r}\partial_{z}\Theta\hat{e}_{r}+\rho\omega
r\hat{e}_{\phi}+\frac{1}{r}\partial_{r}\Theta\hat{e}_{z}\,,$ (6)

$\Theta$ and $\omega$ being generic functions, the latter denoting the angular
velocity of the plasma. We now consider a magnetic field having the form

$\vec{B}=-\frac{1}{r}\partial_{z}\psi\,\hat{e}_{r}+rK(\psi)\,\hat{e}_{\phi}+\frac{1}{r}\partial_{r}\psi\,\hat{e}_{z}\,,$
(7)

where $\psi$ is the magnetic flux function (times $1/2\pi$) and $K$ denotes a
generic function. Since, in axial symmetry, the steady toroidal component of
the electric field $E_{\phi}$ must vanish, then according to Eqs.(6) and (7)
we get

$E_{\phi}=-\frac{1}{\rho
r^{2}}\left(\partial_{z}\Theta\partial_{r}\psi-\partial_{r}\Theta\partial_{z}\psi\right)=0\,,$
(8)

which implies the relation $\Theta=\Theta(\psi)$. Hence, comparing Eqs.(6) and
(7), we immediately see the validity of the following relation:

$\rho\vec{v}_{p}\equiv\rho\left(v_{r}\hat{e}_{r}+v_{z}\hat{e}_{z}\right)=\frac{d\Theta}{d\psi}\vec{B}_{p}\,,$
(9)

where $\vec{v}_{p}$ and $\vec{B}_{p}$ denote the poloidal components of the
velocity and the magnetic field, respectively. We now adopt the simplifying
assumption $\rho=\rho(\psi)$, which implies, according to Eq.(1), the two
basic relations

$\vec{v}_{p}\cdot\vec{\nabla}\rho=0\,;\quad\vec{\nabla}\cdot\vec{v}=0\,.$ (10)

It is immediate to recognize that we also have

$\rho\vec{v}_{p}\cdot\vec{\nabla}\vec{v}_{p}=\frac{1}{\rho}\left(\frac{d\Theta}{d\psi}\right)^{2}\vec{B}_{p}\cdot\vec{\nabla}\vec{B}_{p}\,.$
(11)

Thus, the poloidal magnetic tension can be cancelled in Eq.(2), by imposing
the condition

$\frac{d\Theta}{d\psi}=\pm\sqrt{\frac{\rho(\psi)}{\upmu_{0}}}\,.$ (12)

This equation also allows to cancel from the steady momentum equation the
nonlinear poloidal advection term. Eq.(4) for the plasma temperature, taking
(10) into account, gives

$\vec{v}_{p}\cdot\vec{\nabla}T=0\,\Rightarrow T=T(\psi)\,.$ (13)

Analogously, the toroidal component of Eq.(3) (the poloidal one is now an
identity) yields

$\partial_{r}\omega\partial_{z}\psi-\partial_{z}\omega\partial_{r}\psi=0\,\Rightarrow\omega=\omega(\psi)\,,$
(14)

which expresses the corotation theorem [24].

###  II.2 Momentum conservation equation

Now we analyze the momentum conservation equation (2), starting from its
toroidal component:

$\partial_{z}\psi\left(\mp\frac{\omega}{r}\sqrt{\frac{\rho}{\upmu_{0}}}+\frac{K}{\upmu_{0}r}\right)=-\rho\omega^{2}r+\frac{rK^{2}}{\upmu_{0}}\,,$
(15)

where we used Eq.(12). Then we find the simple relation for $K(\psi)$:

$K(\psi)=\upmu_{0}\omega\frac{d\Theta}{d\psi}=\pm\omega\sqrt{\upmu_{0}\rho}\,.$
(16)

Finally, we study the poloidal component of Eq.(2), that is

$-r\left(\rho\omega^{2}-\frac{2K^{2}}{\upmu_{0}}\right)\hat{e}_{r}=-\vec{\nabla}\left(p+\frac{B_{p}^{2}}{2\upmu_{0}}\right)-\frac{r^{2}}{2\upmu_{0}}\frac{dK^{2}}{d\psi}\vec{\nabla}\psi\,.$
(17)

which, after some algebra and making use of Eq.(16), can be rewritten in the
following convenient form:

$\vec{\nabla}\left(p+\frac{B_{p}^{2}}{2\upmu_{0}}+\rho\frac{\omega^{2}r^{2}}{2}\right)=0\,.$
(18)

This equation clearly implies the existence of a constant quantity equal to
the expression in brackets, which we label $E$. Its value can be determined
considering the magnetic axis, _i.e._ the point $A(r_{A},z_{A})$ where the
magnetic flux function takes its maximum value, and its derivatives vanish.
Hence we write the expression for $E$, along with the final equation for the
plasma equilibrium, as:

$\displaystyle E\equiv p_{A}+\rho_{A}\frac{\omega_{A}^{2}r_{A}^{2}}{2}\,,$
(19)
$\displaystyle\left(\partial_{r}\psi\right)^{2}+\left(\partial_{z}\psi\right)^{2}=2\upmu_{0}r^{2}\left[E-p(r,z)-\rho\frac{\omega^{2}r^{2}}{2}\right]\,,$
(20)

where we introduced the notation $f_{A}=f(r_{A},z_{A})$ for the quantities
calculated along the magnetic axis. Eq.(20) is the configurational equation
which allows to determine the equilibrium features of the considered plasma in
the presence of matter flows.

##  III Tokamak relevant solution

We now search for a solution of the equilibrium which can be relevant in the
context of a tokamak device. As a first step, in order to work with
dimensionless variables, let us introduce the following normalizations and
definitions:

$\displaystyle
r_{n}=\frac{r}{r_{A}}\,,\,\,z_{n}=\frac{z}{r_{A}}\,,\,\,\omega_{n}=\frac{\omega}{\omega_{A}}\,,\,\,\rho_{n}=\frac{\rho}{\rho_{A}}\,,\,\,B_{n}=\frac{B}{B_{A}}\,,$
$\displaystyle\psi_{n}=\frac{\psi}{B_{A}r_{A}^{2}}\,,\,\,p_{n}=2\upmu_{0}\frac{p}{B_{A}^{2}}\,,\,\,\chi_{A}\equiv\frac{\upmu_{0}\rho_{A}\omega_{A}^{2}r_{A}^{2}}{B_{A}^{2}}\,.$

Using these variables, and dropping all subscripts $n$ from the notation for
simplicity, Eq.(20) can be recast as:

$\left(\partial_{r}\psi\right)^{2}+\left(\partial_{z}\psi\right)^{2}=r^{2}\left[p_{A}-p(r,z)+\chi_{A}(1-\rho\omega^{2}r^{2})\right]\,,$
(21)

The usual approach to solving the Grad–Shafranov equation analytically is to
assign a specific functional form for the source terms on the right–hand side
(here $p$, $\rho$ and $\omega$), and then to solve the differential equation
for the unknown function $\psi$. This method is natural when the equilibrium
equation is linear in the magnetic flux $\psi$, and the source terms are
functions of $\psi$ itself, allowing for suitable linearizations of the
equation. In the present analysis, neither of these conditions hold;
therefore, we look for a more convenient procedure, appropriate to evaluate
the influence of the velocity field on the pressure profile. If we choose the
pressure $p$ as unknown function, we can rewrite Eq.(21) as:

$p(r,z)=p_{A}+\chi_{A}(1-\rho\omega^{2}r^{2})-\frac{\left(\partial_{r}\psi\right)^{2}+\left(\partial_{z}\psi\right)^{2}}{r^{2}}\,,$
(22)

Now if the magnetic flux function is known, we can compute its derivatives and
plug them in the right–hand side; then, after assuming a reasonable functional
form for $\rho$ and $\omega$, the pressure is readily obtained and its
morphology can be studied. One way to obtain the function $\psi$ is to solve
an equivalent equilibrium problem in the absence of plasma motion. In
particular, we consider the well–known Solov’ev configuration, governed by

$\Delta^{*}\psi+S_{1}r^{2}+S_{2}=0\,,$ (23)

where $S_{1}$ and $S_{2}$ are some constants linked to the plasma pressure and
toroidal magnetic field [25]. Hence we can write
$\psi=\psi_{0}-S_{1}r^{4}/8-S_{2}z^{2}/2$, _i.e._ the sum of the homogeneous
and a particular solution, where $\psi_{0}$ satisfies $\Delta^{*}\psi_{0}=0$.
Let us consider the following homogeneous solution for the up–down symmetric
case [21, 22]:

$\psi_{0}(r,z)=r\sum_{i=1}^{N}\left[c_{i}I_{1}(rk_{i})+d_{i}K_{1}(rk_{i})\right]\cos(k_{i}z)\,,$
(24)

where $I_{1}$, $K_{1}$ denote the modified Bessel functions of order 1.
$\\{k_{i}\\}$ is a set of $N$ arbitrary wavenumbers, which can roughly be
taken of the order $\pi/\kappa$, $\kappa$ being the elongation of the plasma
configuration. Then, the constants $c_{i}$, $d_{i}$ are determined by
assigning a sufficient number of boundary points along the plasma magnetic
separatrix, where $\psi=\psi_{B}$ (some constant value), and solving the
resulting set of algebraic equations (this step is performed through a
dedicated Mathematica code).

Once the function $\psi$ is known, we need to fix the dependence of the plasma
density and rotation frequency. At this point, a consideration is important.
According to Eq.(16), the toroidal magnetic field $B_{\phi}=rK(\psi)$ is
proportional to $\sqrt{\rho}\omega$. In tokamaks, the plasma equilibrium
solution within the separatrix is necessarily linked to the vacuum solution of
the surrounding region (the scrape–off layer) by matching boundary conditions.
In the vacuum region, the magnetic field is essentially equal to the one
generated by the external machine coils, thus it is generally different from
zero. We conclude that in the present scenario $\rho$ and $\omega$ cannot
vanish on the plasma magnetic separatrix, since this would imply a
discontinuous geometry of the magnetic field lines. In other words, our
solution is associated with density and rotation profiles which are non
vanishing along the magnetic separatrix: the details related to such a
discontinuous behaviour are not investigated further here, although they can
be taken as a starting point to study H-mode plasma regimes, which are usually
characterized by profiles with pedestals in proximity of the separatrix.

Let us consider the following normalized expressions:

$\rho(\psi)=\frac{\rho_{0}+\psi^{2}}{\rho_{0}+1}\,,\,\,\omega(\psi)=\frac{\omega_{0}+\psi^{2}}{\omega_{0}+1}\,,$
(25)

where the constants $\rho_{0}$ and $\omega_{0}$ can be assigned to control the
pedestal height. In order to introduce the main features of our solution, let
us show two illustrative cases, where we reproduce two generic plasma
configurations in the absence of X-points (limited plasma), characterized by
positive and negative triangularity, respectively (Figs.1 and 2). We emphasize
the expected behaviour of the separation between surfaces of constant $\psi$
and $p$, due to plasma motion.

Figure 1: (Left) Plasma magnetic separatrix (solid black) and isobar of null
pressure (dashed blue) of a generic limiter plasma scenario with triangularity
$\delta=0.35$. (Right) Profiles of normalized plasma density $\rho_{n}$ (top)
and rotation velocity $r_{n}\omega_{n}$ (bottom) along the plasma equator.

Figure 2: (Left) Plasma magnetic separatrix (solid black) and isobar of null
pressure (dashed blue) of a generic limiter plasma scenario with triangularity
$\delta=-0.35$. (Right) Profiles of normalized plasma density $\rho_{n}$ (top)
and rotation velocity $r_{n}\omega_{n}$ (bottom) along the plasma equator.

The situation becomes interesting when we study a plasma scenario compatible
with the TCV machine regime of operation [23]. In particular, we assign a
double–null magnetic geometry with high positive triangularity, with its
X-points close to the machine first wall (Fig.3).

Figure 3: (Left) Plasma magnetic separatrix (solid black) and isobar of null
pressure (dashed blue) of a TCV-like equilibrium in the presence of two
(symmetric) X-points. (Right) Profiles of normalized plasma density $\rho_{n}$
(top) and rotation velocity $r_{n}\omega_{n}$ (bottom) along the plasma
equator.

Here the most striking feature is the behaviour of the curve of null pressure,
which, departing from the magnetic separatrix, encircles the X-points,
defining three distinct plasma confinement regions:

  1. 1.

The region close to the plasma magnetic axis where $\psi>\psi_{B}$, $p>0$ is
qualitatively unaffected with respect to the static case, and corresponds to
the usual plasma confinement condition.

  2. 2.

The region inside the magnetic separatrix close the inner and outer plasma
edges, where $\psi>\psi_{B}$ but outside of the positive pressure region,
seemingly determining a deterioration of the plasma confinement due to the
absence of a pressure gradient in the forces balance.

  3. 3.

The region enclosed in the $p>0$ surface but outside of the magnetic
separatrix, and especially its intersection with the “private region” of the
plasma, that is defined by the divertor surface and the magnetic legs outside
of the main plasma region.

Concerning this latter case, our solution shows how, in this particular regime
of toroidal and poloidal plasma motion, there is a confining effect due to the
plasma pressure lines which is acting in the private region. Due to this
enhanced confinement, the macroscopic effect would be that of relieving the
particle and power exhaust of the plasma towards the divertor, with possible
useful applications in upcoming devices where the management of the power
output will be a main concern.

##  IV Concluding remarks

We constructed a new type of plasma equilibrium in axial symmetry, based on
the assumption that the poloidal velocity and magnetic flux lines coincide
along the configuration. Furthermore, we considered the plasma mass density
only dependent on the magnetic flux function, basically assuming an
incompressible plasma.

In this scenario, we arrived to a generalization of the Grad–Shafranov
equation [1, 4, 5], with the peculiar feature that it turns to be nonlinear in
the gradient of the magnetic flux function. This can be explained by the fact
that we were able to simultaneously cancel the nonlinear poloidal velocity
term and the magnetic tension contribution. Thus, the resulting equilibrium
equation contains the magnetic pressure only, from which arises the
nonlinearity already mentioned.

We then applied the obtained axisymmetric configuration to tokamak relevant
situation and, as expected, we saw that the presence of velocity fields
induces a deviation of the isobar surfaces (in particular that one at zero
pressure) from the morphology of the closed magnetic surfaces (in particular
the separatrix). This fact is not surprising, but it was a relevant
achievement to consider the implications of such a discrepancy between the
separatrix and the zero pressure surface with respect to the presence of
X-points in the magnetic profile.

In fact, analyzing configurations close to the operational conditions of the
TCV device, we could observe a very interesting phenomenon, consisting in the
inclusion of the X-points of a double–null scenario inside the surface of
vanishing pressure. More specifically, such a surface envelopes these two
symmetric (up and down) points, shielding the wall of the machine from power
transfers to a degree which should be determined according to further studies.
The private region is consequently divided into two parts, the one close to
the divertor retains the usual morphology of the scrape–off layer, while the
portion closer to the X-point acquires a pressure barrier since inside the
surface $p=0$ the thermodynamical pressure supports the plasma confinement.

This result can impact the operation of a tokamak with diverted plasma,
especially medium sized ones due to the presence of higher velocity fields,
since the possibility to reach such configurations with ”protected X-points”
could significantly reduce the heat and particle fluxes towards the divertor,
favouring a better control of the power exhaust during the discharges.

## References

  * [1] L.D. Landau, E.M. Lifshitz, _Electrodynamics of Continuous Media_ (Pergamon Press) 1960.
  * [2] J. Wesson, _Tokamaks_ (Oxford University Press) 1997.
  * [3] D. Biskamp, _Nonlinear magnetohydrodynamics_ (Cambridge University Press) 1993.
  * [4] H. Grad, H. Rubin, _Hydromagnetic equilibria and force-free fields_ in _Proceedings of the Second United Nations International Conference on the Peaceful Uses of Atomic Energy_ United Nations, Geneva, 32, 42 (1958).
  * [5] V.D. Shafranov, _Rev. Plasma Phys._ 2, 103 (1966).
  * [6] A.B. Hassam, T.M. Antonsen Jr., J.F. Drake, P.N. Guzdar, C.S. Liu, D.R. McCarthy, and F.L. Waelbroeck, _Phys. Fluids B_ 5, 2519–2524 (1993).
  * [7] ITER Organization, _ITER Research Plan within the Staged Approach (Level III - Provisional Version)_ , ITR-18-003, https://www.iter.org/technical-reports?id=9
  * [8] G. Giruzzi _et al._ , _PPCF_ 62, 1, 014009 (2019).
  * [9] R. Albanese, F. Crisanti, P. Martin, R. Martone, A. Pizzuto and DTT Contributors, Divertor Tokamak Test Facility, interim design report (2019)
  * [10] J.R. Harrison _et al._ , _Nucl. Fusion_ 59, 11, 112011 (2019).
  * [11] S. Coda _et al._ , _Nucl. Fusion_ 57, 102011 (2017).
  * [12] B.P. Duval, A. Bortolon, A. Karpushov, R.A. Pitts, A. Pochelon and A. Scarabosio, _PPCF_ 49, B195–B209 (2007)
  * [13] K.H. Burrell, _Physics of Plasmas_ 4, 1499–1518 (1997).
  * [14] J.E. Rice _et al.,_ _Nucl. Fusion_ 47, 1618 (2007).
  * [15] E.K. Maschke and H. Perrin, _Plasma Physics_ 22, 6, 579–594 (1980).
  * [16] G.I. Ogilvie, _Mon. Not. R. Astron. Soc._ 288, 63–77 (1997).
  * [17] L. Guazzotto and R. Betti, _Phys. Plasmas_ 12, 056107 (2005).
  * [18] G. N. Throumoulopoulos and H. Tasso, _Phys. Plasmas_ 19, 014504 (2012).
  * [19] R. Farengo, _Phys. Plasmas_ 27, 122502 (2020)
  * [20] L. Guazzotto and J. Freidberg, _JPP_ 87(3), 905870305 (2021).
  * [21] G. Montani, M. Del Prete, N. Carlevaro and F. Cianfrani, _JPP_ , 87(3), 845870301, (2021).
  * [22] M. Del Prete, G. Montani, _arXiv:_ 2107.01890 (2021).
  * [23] R. Coelho, W. Zwingmann, B. Faugeras, E. Giovanozzi, P. Mc Carthy, _et al._ , “Equilibrium reconstruction analysis of TCV tokamak plasmas in the EU-IM platform”, _44th EPS Conference on Plasma Physics_ , ffhal-01656506 (2017)
  * [24] V.C.A. Ferraro, _Mon. Not. RAS_ 97, 458 (1937).
  * [25] L.S. Solov’ev, _Sov. Phys. JETP_ 26(2), 400 (1968).


# Towards Efficiently Diversifying Dialogue Generation
via Embedding Augmentation

###### Abstract

Dialogue generation models face the challenge of producing generic and
repetitive responses. Unlike previous augmentation methods that mostly focus
on token manipulation and ignore the essential variety within a single sample
using hard labels, we propose to promote the generation diversity of the
neural dialogue models via soft embedding augmentation along with soft labels
in this paper. Particularly, we select some key input tokens and fuse their
embeddings together with embeddings from their semantic-neighbor tokens. The
new embeddings serve as the input of the model to replace the original one.
Besides, soft labels are used in loss calculation, resulting in multi-target
supervision for a given input. Our experimental results on two datasets
illustrate that our proposed method is capable of generating more diverse
responses than raw models while remains a similar n-gram accuracy that ensures
the quality of generated responses.

Index Terms—  Dialogue generation, diversity, data augmentation, embedding,
natural language processing

##  1 Introduction

Dialogue generation is important in AI applications, in which a model can
generate responses for user-issued dialogue history. Former dialogue datasets
make the end-to-end training of deep neural models possible, such as
DailyDialog [1], PersonaChat [2], etc., and deep neural networks including
Seq2seq with attention [3], Transformers [4] have already shown their
capability in generating conversation replies. Dialogue generation can be
regarded as a many-to-many (combination of one-to-many and many-to-one)
problem as one specific response may be reasonable for multiple histories and
vice versa. However, current models tend to produce generic sentences such as
“I don’t know”, caused by the current inherent deterministic training
objective as well as insufficient diversity and limited quality of current
datasets [5, 6].

Generating more various dialogue responses remains a hard task. In order to
tackle it, some researchers try to refine the training objective with extra
constraint items [5] or modify the criterion that encourages models to decode
more diverse words [7, 8, 9, 10]. However, such models are more likely to
generate ungrammatical or uncorrelated responses and the superiority of
constructed objectives to cross-entropy loss remains unknown. Another kind of
approach enhances the training data directly. Data filtering is commonly used
in machine learning and extended to dialogue generation by removing samples
with generic responses based on entropy [11] or the predictions of a Seq2seq
model [12]. Obtaining more training samples is also a possible solution. Word
replacement extends the data scales by randomly replacing original tokens with
others based on vocabulary distributions [13, 14]. In addition, new augmented
sentences can also be obtained via a learnable model that even keeps
interaction between the generation model and both of them will be trained
jointly [15]. But these methods merely include more training data and still
bridge a one-to-one mapping between input and response within a single sample.
And they also add great extra computational load. So it is necessary to
propose a simple and effective method regarding the essence of this problem.

In this paper, we propose an embedding augmentation method for dialogue
models, where not only the training objective encourages various output, but
also soft embeddings enhance the diversity within a single sample. It is
inspired by the recent success of the mixup approach that combines training
pairs of samples and labels convexly into a single one [16]. Particularly, the
original embeddings of tokens in the training samples will be randomly
replaced by augmented ones, which are mixtures of the raw one and several
semantically similar embeddings conditioned on their distribution. And these
selected positions will use soft labels instead of hard one-hot vectors. Such
a mechanism ensures that the model can learn a soft word distribution rather
than a fixed word in both input and output, which is consistent with the
multi-source and multi-target purpose, benefiting the generating diversity
without using any additional sample. Compared to previous similar work [17,
18], we use both soft embedding and soft labels for a more flexible training
process. A compact in-domain similar token prediction model is utilized
instead of a deep language model, realizing a more efficient augmentation with
a less computational cost.

To verify our method, we conduct experiments on two dialogue datasets,
PersonaChat and DailyDialog, using two base models, Seq2seq and transformer.
The experimental results show that our method can obtain remarkable diversity
improvement as well as n-gram accuracy boost in terms of auto metrics compared
to models without embedding augmentation or using token-level replacement. We
also compare it with a BERT-based embedding augmentation method, demonstrating
they have close performance while the former one is much faster and proving
the efficiency of our method.

##  2 Method

###  2.1 Background and motivations

Generally speaking, given a dialogue history $H=(h_{1},h_{2},...,$ $h_{N})$
and a corresponding response $R=(r_{1},r_{2},...,r_{M})$, current neural
dialogue generation models learn the conditional probability
$p(r_{1},r_{2},...,r_{M}|h_{1},h_{2},...,h_{N})$ which is similar to machine
translation. But as discussed before, dialogue tasks should be many-to-many
that differs from machine translation who has higher certainty. Nevertheless,
there is usually one specific $R$ that corresponds to a given $H$ in most
datasets. Although one-to-many or many-to-one cases exist, most of them are
generic sentences having no contribution to the variety of generated replies
[11]. Thus existing samples may provide the wrong guidance for the task goal.

Some existing augmentation methods generate new samples by replacing tokens in
original sentences with others [14, 17]. But such a hard replacement will also
magnify the error if inappropriate candidate tokens are introduced. Although
soft word distribution is employed in [18], it still uses hard labels for loss
calculation. Such augmentation only ensures a many-to-one learning objective
for the model, differing from our desired target. These motivate us to use
soft word embeddings and soft labels in augmentation. The use of fused
embedding can lower the influence of unbefitting tokens as partial original
information still remains in the embedding. While the latter one can bring
randomness and multiple targets during training to further diversify the
generation.

###  2.2 Embedding augmentation

Fig. 1: Framework of our embedding augmentation method.

Inspired by the above intuition, we provide an embedding augmentation method,
whose framework is shown in Fig. 1. An encoder-decode model is used for
generation. The history $H$ is encoded to get its hidden state as the initial
state of decoder. The model is trained with supervision from the response $R$.
Embeddings of selected tokens in $H$ and $R$ will be replaced with augmented
ones from distributions of their semantic neighbors. These distributions are
also used as labels.

We first select target tokens for augmentation with some exceptions, which is
indicated by the red font in Fig. 1. Since special tokens including commas,
articles (a/an/the) and prepositions (in/on, etc.) are usually unique,
replacing their embedding has slight benefit for diversity or even causes
semantically degeneration. They are not considered as target tokens. The rest
tokens are randomly selected with augmentation ratio $\rho$, resulting in a
set target set $\mathcal{T}=(t_{1},...,t_{n+m})$ with $n$ tokens from $H$ and
$m$ tokens from $R$.

Then a semantic-neighbor word prediction model is utilized to predict the
candidate words with the most similar meaning for each token in $\mathcal{T}$.
It prevents semantic ambiguity when mixing the embeddings from these
candidates together. A most intuitive method is using a trained large-scale
language model such as BERT [19] to contextually predict candidates. But
considering the computational efficiency of our method, we use fastText model
here [20], and the effectiveness of using this model will be later illustrated
in the experiment. It is based on a continuous-bag-of-word frame which is fast
to train. Given a word, it will output a series of candidates
$c_{i}\in\mathcal{V}$ with confidence scores $s_{i}\in(0,1)$. We will train
the fastText model using the same corpus as the training data for the dialogue
model, so as to get a consistent vocabulary $\mathcal{V}$ as well as in-domain
word distribution. To ensure the quality of augmentation, only candidates with
top-k confidence remain, and their scores must satisfy $s_{i}\geq\tau$ where
$\tau$ is a threshold.

One target token $t$ and its semantic neighbors can form a soft word set
$\mathcal{C}=\\{(c_{0},s_{0}),(c_{1},s_{1}),...,$ $(c_{k},s_{k})\\},c_{0}=t$,
here $s_{0}=1$ keeps a higher proportion of the raw information as we believe
it is more reliable than predicted candidates. $c_{j}$ in this set can then be
transformed into a set of new representations
$\\{e_{0},e_{1},...,e_{k}\\},e_{j}\in\mathbb{R}^{d}$ via the embedding layer.
The fused embedding $e^{f}$ of them for $t$ can be obtained via

$e^{f}=\sum{{}_{j=0}^{j=k}\ {p(c_{j})\cdot
e_{j}}},{\rm{where}}p(c_{j})=s_{j}/\sum{{}_{l=0}^{l=k}\ {s_{l}}}.$ (1)

It can be expected as an augmented soft embedding based on the distribution of
the original token and its semantic neighbors to replace the raw embedding.
The distribution $p(c_{j})$ is calculated using scores from the neighbor
prediction model.

It is worth pointing out that no external knowledge is included as we just
depend on the original dataset, which is different from some previous works
[cai_reweight, 17]. And our method can be easily extended to other different
base models as the only model-level modification is the embedding layer.

###  2.3 Model training

The cross-entropy loss will be employed as the optimization objective. Given
the generation logits $g\in\mathbb{R}^{|\mathcal{V}|}$ after softmax function
for current position $i$ in label (response), if $r_{i}$ is selected as the
target augmentation token, the loss for $r_{i}$ is

$L_{i}=-\sum{{}_{j=0}^{j=k}}\ {p(c_{ij})\cdot log\ g(c_{ij})},$ (2)

where $c_{ij}$ is a token from the candidate set $\mathcal{C}$ for $r_{i}$,
and $p(c_{j})$ is the distribution among candidates as (1), $g(c_{j})$ denotes
getting the corresponding value in vector $g$ for $c_{j}$. If $r_{i}$ is not
an augmentation token, the training loss becomes $L_{i}=-log\ g(r_{i})$, which
is the same as the previous models.

Moreover, the augmentation operation is executed alternately along with the
normal training procedure without augmentation in each step. This aims to
guarantee a correct learning direction by original samples and prevent
possible continuous error propagation from augmented embeddings.

##  3 Experiment

###  3.1 Settings

Two public dialogue datasets, PersonaChat [2] and DailyDialog [1] are involved
in our experiment, containing 131k/ 7.8k/ 7.5k and 42.6k/ 3.9k/ 3.7k for
training/validation/test set respectively. The former one contains persona
profiles as auxiliary information while the latter one contains topic
information. We will concatenate it with the original dialog history as the
input $H$, using a special token to distinguish each part.

We consider two base end-to-end models, Seq2Seq with Attention (Seq2seq) [3]
using 1-layer bidirectional GRU as the encoder and decoder, and transformer
model (transfo) [4] in which the encoder and decoder both have 6 layers and 4
heads in attention. 300d GloVe [21] is used to initiate the embedding layer.
The hidden dimension for both models is set as 300. Each model on each dataset
is trained via Adam optimizer with batch size 256 for 50 epochs(PerosnaChat)/
30 epochs(DailyDialog). During decoding, beam search with size 3 is applied to
the model with the best PPL. Besides, a fastText model will be trained on each
dataset for 100 epochs using the ‘cbow’ method (a config of fastText means
continuous bag-of-word), then used as the neighbor prediction model
correspondingly. In augmentation, the augmentation ratio $\rho$ is 0.4 for
PersonaChat and 0.5 for DailyDialog, the score threshold $\tau$ is 0.4, and
top-ranking number $k$ is 5.

Except for our embedding augmentation (-EA), we also consider two baselines:
1) the original model without augmentation; 2) a replacement baseline (-rep)
in which a token is directly replaced by the most similar one in its neighbor
candidates. Besides, one variant is included that uses the original BERT to
replace fastText (-BERT) for augmentation candidates prediction while the rest
parts remain the same.

We use multiple automatic metrics to evaluate the performance. BLEU [22],
METEOR [23] and NIST-4 [24] are used for n-gram accuracy of generated replies.
Following metrics are considered for measuring diversity, 1) Ent-n [25]
calculate the entropy based on the appearance probabilities of each n-gram in
all predictions; 2) Dist-n (distinct) [5] is defined as the ratio of unique
n-grams over all n-grams in all generated sentences; 3) Sen-n is the average
of sentence-level Dist-n(n=1,2,3). Besides, generation perplexity (PPL) and
average length (avg.len) of responses are also provided.

###  3.2 Main results

| Model | PPL | avg.len | BLEU | MET | N-4 | Ent-1 | Ent-2 | Ent-3 | Dist-1 | Dist-2 | Dist-3 | Sen-1 | Sen-2 | Sen-3
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---
PersonaChat | Seq2seq | 36.016 | 8.462 | 2.508 | 7.636 | 1.003 | 4.114 | 5.992 | 7.326 | 1.811 | 8.646 | 20.286 | 89.547 | 96.609 | 98.211
Seq2seq-rep | 36.814 | 8.579 | 2.685 | 8.135 | 1.168 | 4.156 | 6.115 | 7.509 | 1.888 | 9.227 | 21.032 | 87.628 | 96.079 | 98.756
Seq2seq-EA | 35.368 | 8.651 | 2.729 | 8.206 | 1.274 | 4.137 | 6.159 | 7.564 | 1.802 | 9.653 | 21.891 | 88.547 | 96.684 | 98.847
transfo | 39.882 | 8.602 | 2.839 | 7.840 | 1.107 | 4.112 | 5.570 | 6.313 | 1.532 | 5.358 | 10.059 | 92.088 | 97.432 | 98.390
transfo-rep | 35.993 | 8.620 | 3.031 | 8.121 | 1.175 | 4.240 | 5.844 | 6.696 | 1.771 | 6.787 | 12.733 | 90.793 | 96.963 | 98.227
transfo-EA | 34.480 | 8.652 | 3.450 | 8.414 | 1.204 | 4.269 | 5.963 | 6.821 | 1.753 | 6.809 | 12.927 | 91.387 | 97.833 | 98.756
DailyDialog | Seq2seq | 53.707 | 7.008 | 1.108 | 5.471 | 0.291 | 4.515 | 6.579 | 7.691 | 4.956 | 18.038 | 35.422 | 92.098 | 96.953 | 92.725
Seq2seq-rep | 54.944 | 6.560 | 1.008 | 5.140 | 0.162 | 4.436 | 6.411 | 7.425 | 4.980 | 18.524 | 33.857 | 94.923 | 98.116 | 88.474
Seq2seq-EA | 53.541 | 6.804 | 1.214 | 5.452 | 0.217 | 4.455 | 6.648 | 7.657 | 5.095 | 19.459 | 34.543 | 94.359 | 97.941 | 92.691
transfo | 77.952 | 7.009 | 1.005 | 5.032 | 0.202 | 3.923 | 5.375 | 6.087 | 2.296 | 7.692 | 12.925 | 94.076 | 97.877 | 87.817
transfo-rep | 74.989 | 6.732 | 1.051 | 5.025 | 0.207 | 4.089 | 5.576 | 6.374 | 3.033 | 9.434 | 16.090 | 94.820 | 98.171 | 89.431
transfo-EA | 74.020 | 6.835 | 1.097 | 5.106 | 0.198 | 4.052 | 5.631 | 6.365 | 2.989 | 9.263 | 16.658 | 95.280 | 98.187 | 90.608
Table 1: Automatic evaluation results on two datasets (% for BLEU, Dist-n and Sen-n). MET: METEOR, N-4: NIST-4. Model |  $\Delta$PPL |  $\Delta$BLEU |  $\Delta$N-4 |  $\Delta$Ent |  $\Delta$Dist |  $\Delta$Sen
---|---|---|---|---|---|---
Seq2seq-BERT | 1.212 | 0.050 | -0.012 | 0.032 | -0.130 | -0.738
transfo-BERT | 1.688 | -0.108 | -0.023 | -0.116 | -0.091 | -0.743
Seq2seq-BERT | -1.885 | -0.155 | -0.082 | -0.046 | 0.597 | -0.408
transfo-BERT | 2.860 | -0.011 | 0.071 | 0.104 | 1.057 | -0.739
Table 2: Performance value difference ($\Delta$) when the BERT variant of our
method compared to our original one. Upper: PersonaChat, lower:DailyDialog.
(Italic: -BERT is worse)

The augmentation results along with two baselines, the original model and
replacement method, on two datasets are shown in Table 1. It can be found that
our method outperforms them under most conditions in both n-gram accuracy and
diversity evaluation. Compared to the original models, our method (EA) can
significantly promote the n-gram diversity of responses and slightly benefit
n-gram accuracy under most conditions while remaining equivalent under other
cases. In other words, EA encourages models to generate diverse texts without
the cost of their quality. In contrast, the replacement method usually
degrades the generation accuracy despite it is also beneficial for more
various replies.

When comparing between base models, EA seems to have more effect on
transformer than Seq2seq. The reason is that more data is needed to train a
robust transformer than RNN due to its depth, and our method pose a similar
effect. It can also be observed that the PPL values of both EA and replacement
can result in a noticeable PPL decrease for transformer models, but it is not
such a case for Seq2seq models. It means transformers may not be well trained
using current raw data.

We also evaluate the performance of Seq2seq / transformer-BERT to better prove
the merits of using fastText as a semantic-neighbor word prediction model. The
performance of them is shown in Table 2 in terms of accuracy metrics, Ent,
Dist, and Sen(the average of Ent/Dist/Sen-n and n=1, 2, 3). EA and BERT
variant show equivalent performance on both base models, because BERT
embeddings without tuning on a specific domain can even perform worse than a
universal embedding [26]. However, the huge BERT model will increase the
computational load since the training time of our EA is approximately
1.98$\times$ time of raw models, while it is 5.87$\times$ for BERT variant and
1.37$\times$ for replacement according to experiments. Obviously, it is better
to select fastText rather than BERT for augmentation candidates prediction.

###  3.3 Ablation study

We also conduct the ablation study including the following variants: 1) w/o
soft label: we only use the original hard labels during training which is the
same as the previous models; 2) w/o history augmentation(aug.): we only
applying embedding augmentation to response $R$. The related results of two
models on DailyDialog dataset is shown in Table 3. We easily find out the
contribution of both parts according to the performance degeneration under
most conditions.

Model | PPL | BLEU | N-4 | Ent | Dist | Sen
---|---|---|---|---|---|---
Seq2seq-EA | 53.541 | 1.214 | 0.217 | 6.253 | 19.699 | 95.057
w/o soft label | 55.454 | 0.861 | 0.098 | 6.065 | 19.160 | 94.597
w/o history aug. | 59.684 | 0.956 | 0.134 | 6.024 | 17.606 | 94.105
transfo-EA | 74.020 | 1.097 | 0.198 | 5.349 | 9.637 | 94.692
w/o soft label | 72.135 | 0.879 | 0.100 | 5.241 | 9.182 | 94.127
w/o history aug. | 77.499 | 0.985 | 0.139 | 5.221 | 9.536 | 94.381
Table 3: Results of the ablation study on DailyDialog dataset. Fig. 2: The
performance of n-gram accuracy and diversity of transformer-EA varies with
different augmentation ratio $\rho$.

###  3.4 The influence of augmentation ratio

To better illustrate the influence of different augmentation ratio $\rho$, we
also tried different $\rho$ values from 0 to 0.8. The BLEU score (for n-gram
accuracy), Dist, and Sen values (for diversity) of transformer model on two
datasets vary with $\rho$ is shown in Fig. 2. In the beginning, both BLEU
score and diversity metrics tend to increase slowly. But after a middle value
(0.4 on PersonaChat and 0.5 on DailyDialog), BLEU scores begin to drop while
generation diversity is also becoming saturated. A higher ratio than these
peak values will not benefit the performance but merely increase the training
time as more neighbor prediction and embedding fusion operations are needed.
That is the reason why we choose these $\rho$ values.

##  4 Conclusion

Considering the many-to-many essence of the dialogue generation problem, we
propose an efficient embedding augmentation method aiming to promote the
response diversity. Different from previous work, our manipulation is based on
embedding level instead of token level by transforming a soft word, which is a
distribution between the original word and its semantic neighbors, into a
fused embedding to randomly replace the original one. We also use such a
distribution as a soft label to realize our multi-target training goal. The
experimental results demonstrate that our method can effectively diversify the
produced replies from both raw Seq2seq and transformer models with even slight
improvement in accuracy, and it is also superior to replacement-based methods.

## References

  * [1] Yanran Li, Hui Su, Xiaoyu Shen, Wenjie Li, Ziqiang Cao, and Shuzi Niu,  “Dailydialog: A manually labelled multi-turn dialogue dataset,”  in EMNLP, 2017, pp. 986–995.
  * [2] Saizheng Zhang, Emily Dinan, Jack Urbanek, Arthur Szlam, Douwe Kiela, and Jason Weston,  “Personalizing dialogue agents: I have a dog, do you have pets too?,”  in ACL, 2018, pp. 2204–2213.
  * [3] Dzmitry Bahdanau, Kyunghyun Cho, and Yoshua Bengio,  “Neural machine translation by jointly learning to align and translate,”  in ICLR, 2015.
  * [4] Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N Gomez, Lukasz Kaiser, and Illia Polosukhin,  “Attention is all you need,”  in NIPS, 2017, pp. 5998–6008.
  * [5] Jiwei Li, Michel Galley, Chris Brockett, Jianfeng Gao, and Bill Dolan,  “A diversity-promoting objective function for neural conversation models,”  in HLT-NAACL, 2016.
  * [6] Yuanlong Shao, Stephan Gouws, Denny Britz, Anna Goldie, Brian Strope, and Ray Kurzweil,  “Generating high-quality and informative conversation responses with sequence-to-sequence models,”  in EMNLP, 2017, pp. 2010–2219.
  * [7] Gakuto Kurata, Bing Xiang, and Bowen Zhou,  “Labeled data generation with encoder-decoder lstm for semantic slot filling.,”  in INTERSPEECH, 2016, pp. 725–729.
  * [8] Ilia Kulikov, Alexander Miller, Kyunghyun Cho, and Jason Weston,  “Importance of search and evaluation strategies in neural dialogue modeling,”  in Proceedings of the 12th International Conference on Natural Language Generation, 2019, pp. 76–87.
  * [9] Jiwei Li, Will Monroe, and Dan Jurafsky,  “A simple, fast diverse decoding algorithm for neural generation,”  arXiv preprint arXiv:1611.08562, 2016.
  * [10] Yiping Song, Zhiliang Tian, Dongyan Zhao, Ming Zhang, and Rui Yan,  “Diversifying neural conversation model with maximal marginal relevance,”  in IJCNLP, 2017, pp. 169–174.
  * [11] Richard Csaky, Patrik Purgai, and Gabor Recski,  “Improving neural conversational models with entropy-based data filtering,”  arXiv preprint arXiv:1905.05471, 2019.
  * [12] Jiwei Li, Will Monroe, and Dan Jurafsky,  “Data distillation for controlling specificity in dialogue generation,”  arXiv preprint arXiv:1702.06703, 2017.
  * [13] Ziang Xie, Sida I Wang, Jiwei Li, Daniel Lévy, Aiming Nie, Dan Jurafsky, and Andrew Y Ng,  “Data noising as smoothing in neural network language models,”  arXiv preprint arXiv:1703.02573, 2017.
  * [14] Marzieh Fadaee, Arianna Bisazza, and Christof Monz,  “Data augmentation for low-resource neural machine translation,”  pp. 567–573, 2017.
  * [15] Juntao Li, Lisong Qiu, Bo Tang, Dongmin Chen, Dongyan Zhao, and Rui Yan,  “Insufficient data can also rock! learning to converse using smaller data with augmentation,”  in AAAI, 2019, vol. 33, pp. 6698–6705.
  * [16] Hongyi Zhang, Moustapha Cisse, Yann N Dauphin, and David Lopez-Paz,  “mixup: Beyond empirical risk minimization,”  arXiv preprint arXiv:1710.09412, 2017.
  * [17] Sosuke Kobayashi,  “Contextual augmentation: Data augmentation by words with paradigmatic relations,”  arXiv preprint arXiv:1805.06201, 2018.
  * [18] Fei Gao, Jinhua Zhu, Lijun Wu, Yingce Xia, Tao Qin, Xueqi Cheng, Wengang Zhou, and Tie-Yan Liu,  “Soft contextual data augmentation for neural machine translation,”  in ACL, 2019, pp. 5539–5544.
  * [19] Jacob Devlin, Ming-Wei Chang, Kenton Lee, and Kristina Toutanova,  “Bert: Pre-training of deep bidirectional transformers for language understanding,”  in NAACL-HLT, 2018, pp. 4171–4186.
  * [20] Piotr Bojanowski, Edouard Grave, Armand Joulin, and Tomas Mikolov,  “Enriching word vectors with subword information,”  Transactions of the Association for Computational Linguistics, vol. 5, pp. 135–146, 2017.
  * [21] Jeffrey Pennington, Richard Socher, and Christopher D Manning,  “Glove: Global vectors for word representation,”  in EMNLP, 2014, pp. 1532–1543.
  * [22] Kishore Papineni, Salim Roukos, Todd Ward, and Wei-Jing Zhu,  “Bleu: a method for automatic evaluation of machine translation,”  in ACL, 2002, pp. 311–318.
  * [23] Satanjeev Banerjee and Alon Lavie,  “Meteor: An automatic metric for mt evaluation with improved correlation with human judgments,”  in Proceedings of the acl workshop on intrinsic and extrinsic evaluation measures for machine translation and/or summarization, 2005, pp. 65–72.
  * [24] Zhiliang Tian, Wei Bi, Dongkyu Lee, Lanqing Xue, Yiping Song, Xiaojiang Liu, and Nevin L Zhang,  “Response-anticipated memory for on-demand knowledge integration in response generation,”  in ACL, 2020, pp. 650–659.
  * [25] Yizhe Zhang, Michel Galley, Jianfeng Gao, Zhe Gan, Xiujun Li, Chris Brockett, and Bill Dolan,  “Generating informative and diverse conversational responses via adversarial information maximization,”  in NIPS, 2018.
  * [26] Nils Reimers and Iryna Gurevych,  “Sentence-bert: Sentence embeddings using siamese bert-networks,”  in EMNLP-IJCNLP, 2019, pp. 3973–3983.


#  IEEE Global Communications Conference (GLOBECOM) 2022
Securing Federated Learning against Overwhelming Collusive Attackers

Priyesh Ranjan, Ashish Gupta, Federico Corò, and Sajal K. Das  Department of
Computer Science, Missouri University of Science and Technology, Rolla, USA
{pr8pf, ashish.gupta, federico.coro<EMAIL_ADDRESS>

###### Abstract

In the era of a data-driven society with the ubiquity of Internet of Things
(IoT) devices storing large amounts of data localized at different places,
distributed learning has gained a lot of traction, however, assuming
independent and identically distributed data (iid) across the devices. While
relaxing this assumption that anyway does not hold in reality due to the
heterogeneous nature of devices, federated learning (FL) has emerged as a
privacy-preserving solution to train a collaborative model over non-iid data
distributed across a massive number of devices. However, the appearance of
malicious devices (attackers), who intend to corrupt the FL model, is
inevitable due to unrestricted participation. In this work, we aim to identify
such attackers and mitigate their impact on the model, essentially under a
setting of bidirectional label flipping attacks with collusion. We propose two
graph theoretic algorithms, based on Minimum Spanning Tree and $k$-Densest
graph, by leveraging correlations between local models. Our FL model can
nullify the influence of attackers even when they are up to 70% of all the
clients whereas prior works could not afford more than 50% of clients as
attackers. The effectiveness of our algorithms is ascertained through
experiments on two benchmark datasets, namely MNIST and Fashion-MNIST, with
overwhelming attackers. We establish the superiority of our algorithms over
the existing ones using accuracy, attack success rate, and early detection
round.

###### Index Terms:

Attackers, federated learning, label flipping

##  I Introduction

The proliferation of smartphones and IoT devices with significant computing
capabilities has led to a steep growth in the adoption of machine learning
techniques in our daily routine. These devices generate a large amount of
data, traditionally processed at a remote server, causing a waste of bandwidth
and exposing the privacy of the users as the data may include sensitive
information. To address these issues, Google researchers came up with a
distributed learning paradigm, called Federated Learning (FL) [1], in which
multiple devices (or clients) can collaborate to produce an accurate and
generalized model, usually in the presence of a remote server while keeping
the data private. The concept involves training a model using the individual
data fragments of local devices, followed by passing that model (essentially
weights/parameters) to the server for aggregation. Thereafter, the updated
model, also referred to as the global model, is relayed back to the clients
which marks the end of a single round of the FL process.

However, the lack of transparency invites adversaries who may pose as
participants with the intention of corrupting the process by supplying
poisoned local models to the server. It not only reduces the performance of
the global model but also influences its convergence. Such an adversarial
attack can have multi-fold objectives that include promoting the outcome of a
particular class by flipping the labels of the corresponding class [2, 3],
poisoning the data by adding backdoor elements [4] in their local data shards,
or providing random parameters (i.e., model replacement) thus diverging the
model from optimal solution [5, 6]. Figure 1 illustrates an example scenario
for the digit classification task using images of handwritten digits where two
of the participating clients try to inject corruption by flipping the labels
of images from $0$ to $1$ and vice-versa. In this case, the server needs to
employ an appropriate attacker detection algorithm to identify these colluding
attackers during the aggregation process. Once detected, their models may be
excluded from the aggregation to neutralize the impact of the attackers.

Figure 1: Illustrating FL setup with label flipping attacks on the local data
shards by changing label $0$ to $1$ and vice-versa. The attacker detection
enables server to distinguish normal client from attackers.

In recent years, FL has spurred an active research stream to defend against
possible attacks, which can be broadly categorized into two types: (i)
untargeted – adversary aims to influence the convergence of global model by
corrupting the whole local model [5, 7, 8]; some attacks in this category
include random noise addition to local model/gradients, sign flipping, or
model replacement, and (ii) targeted – adversary attempts to misclassify
specific set of samples (mostly belong to one particular class) while
minimally affecting the model performance on other classes [2, 3, 9, 6, 4]; in
this category, the common attacks are label flipping and backdoor. Further,
some researchers have focused on robust aggregation methods such as Krum and
Multi-Krum [5], median and trimmed median [10], and GoeMed [11].

$\bullet$ Motivation: Our work is motivated by the following limitations of
existing works. (i) The robust aggregation methods [5, 10, 11, 12] mostly
extended the stochastic gradient descent (SGD) to aggregate the local models
while assuming independent and identically distributed (IID) data across the
clients, however, in the FL, the heterogeneous nature of devices produces non-
IID data. Moreover, these methods can only minimize the adverse effect on the
global model but do not mitigate the effect fully. On the flip side, our work
primarily focuses on complete mitigation of the attackers’ impact by excluding
their models from aggregation. (ii) The existing methods that detect targeted
attacks can work accurately only when the number of attackers is less than the
number of normal clients. Though FoolsGold [2] has overcome this limitation,
it requires many FL rounds, thus delaying the detection process, and
meanwhile, the attackers keep injecting the corruption.

In this work, we address the problem: how to secure FL against collusive
attackers posing label flipping attacks? To solve this, we propose two graph
theoretic algorithms exploiting Maximum Spanning Tree (MST) and $k$-Densest
graph problems. Particularly, we make the following contributions:

  * •

We propose two novel attacker detection algorithms, called MST-AD and Density-
AD, by leveraging the correlation computed over the gradients 111The terms
“gradients” and “weight updates” are used interchangeably. of the clients.
Since collusive attackers have a common objective, their models are highly
correlated and have the potential to reveal their presence through MST and
$k$-densest graph.

  * •

By incorporating MST-AD and Density-AD in the aggregation, we enable the
server to identify the poisoned local models and exclude them.

  * •

We experimentally evaluate the effectiveness of the proposed algorithms on two
benchmark image classification datasets with evidence of their superiority
over three different existing algorithms.

The rest of the paper is organized as follows. Section II describes our FL
setup along with the considered threat model. Section III proposes the
attacker detection algorithms while Section IV evaluates these algorithms on
two benchmark datasets. Finally, the paper is concluded in Section V.

##  II Problem Description

We consider a standard FL setup with a central server and $\mathcal{C}$
clients of which $\mathcal{M}$ clients are attackers (i.e., malicious in
nature). Each client $c_{i}$ possesses a local training data shard
$D_{i}=\\{\mathbf{X},\mathbf{y}\\}$ where $\mathbf{X}$ denotes the set of
training samples with labels $\mathbf{y}$. For a classification task, the
server initializes a global model $W^{t}$ for round $t=1$ and dispatches it to
all the clients who retrain this model on their local data. Let
$\delta_{i}^{t}$ be the gradients (weights update, i.e., $W^{t}-w_{i}^{t}$)
obtained by client $c_{i}$, which is sent back to the server in round $t$. To
this end, the server does aggregation as

$\displaystyle\textstyle
W^{t+1}=W^{t}+\sum_{i=1}^{\mathcal{C}-\mathcal{M}}p_{i}\delta_{i}^{t}+\sum_{j=1}^{\mathcal{M}}p_{j}\delta_{j}^{t},$
(1)

where $p_{i}$ is the weight of client $c_{i}$ computed over the percentage of
data samples the client possesses, and $\sum_{i}p_{i}=1$.

Objective: To mitigate the effect of attackers on global model, the term
$\sum_{j=1}^{\mathcal{M}}p_{j}\delta_{j}^{t}$ should be nullified. To achieve
this, we aim to correctly identify all $\mathcal{M}$ attackers by leveraging
the correlation between $\delta_{i}$ and $\delta_{j}$ for each pair of clients
and $i\neq j$.

Assumptions: Our FL setup assumes on following: (i) data across participants
follow non-IID distribution; (ii) no client has access to the local model of
others; (iii) client has no control over the aggregation algorithm; (iv) the
number of attackers is at least $2$ to realize collusion case.

Threat model: Our threat model is limited to targeted attacks done by
compromised devices. Particularly, we focus on the label flipping attacks
posed by the colluding devices even when they overwhelm normal clients.
Attackers manually change a particular label (say ‘A’) to another label (say
‘B’) and vice-versa, in their local datasets before training the local model.
Prior works [13, 2] have also demonstrated that the colluding devices can
promote the poisoning effect rapidly.

Attacker Capabilities: The adversary has full control of the compromised
devices, however, can not access the local data or model of the benign
devices.

##  III Proposed algorithms

In this work, we propose two attacker detection algorithms, MST-AD and
Density-AD, essentially named after the underlying graph theory concepts, by
leveraging the correlation between the clients’ gradients. Since the attackers
train on a poisoned dataset (with flipped labels), they should stay closer to
each other, i.e., their gradients should show higher similarity in some
spaces. Through extensive experiments, we found that the correlation between
the clients’ gradients can effectively separate collusive attackers from
normal clients. We define the correlation between any two clients $i$ and $j$
as

$\textstyle
r_{ij}=\frac{\sum_{d}(\delta_{i}-\bar{\delta})(\delta_{j}-\bar{\delta})}{\sqrt{\sum_{d}(\delta_{i}-\bar{\delta})^{2}\
\sum_{d}(\delta_{j}-\bar{\delta})^{2}}},$ (2)

where $\bar{\delta}$ represents the mean gradients and $d$ is the dimension of
the gradients’ matrix (the length of the weight vector).

Figure 2: Correlation values between Attacker-Attacker (blue), Normal-Normal
(green) and Attacker-Normal (red).

An empirical observation: By considering an FL setup with $50$ clients out of
which $25\%$ are attackers, we experiment on Fashion-MNIST [14] dataset with
non-IID data, and the correlations between the clients are shown in Fig. 2. It
is easy to see that the correlation between the attackers is always greater
than that between two normal clients, which in turn is greater than the
correlation between an attacker and a normal client. Though the above
statement does not hold for every single correlation, it suffices to
distinguish attackers from normal clients using correlation values.

To this end, to design our algorithms we make the following assumption about
the correlation – given a set of clients $\mathcal{C}$ and a set of attackers
$\mathcal{M}\subset\mathcal{C}$, we have the inequality

$\displaystyle r_{ip}<r_{ij}<r_{pq},$ (3)

where $p,q\in\mathcal{M},p\neq q$ and
$i,j\in\mathcal{C}\setminus\mathcal{M},i\neq j$.

By using Eq. (2), we define a correlation matrix
$\mathcal{A}\in\mathbb{R}^{n\times n}$ where an entry $\mathcal{A}_{ij}$
corresponds to the correlation coefficient $r_{ij}$ between the clients $i$
and $j$ with $r_{ii}=0$. This lets us create a graph with $n$ vertices
corresponding to the $n$ clients participating in FL and the edge weight
between a pair of clients $i$ and $j$ corresponds to the entry
$\mathcal{A}_{ij}$. The symmetric nature of the matrix makes the graph a
complete undirected graph.

Fig. 3 shows a representative graph for an FL Setup with $6$ clients labelled
$\\{c_{1},c_{2},c_{3},c_{4},c_{5},c_{6}\\}\in\mathcal{C}$. The clients
$c_{2}$, $c_{5}$, and $c_{6}$ are collusive attackers poisoning the model and
thus the set of attackers $\mathcal{M}=\\{c_{2},c_{5},c_{6}\\}$. The remaining
clients belong to the set of normal clients and given as
$\mathcal{C}\setminus\mathcal{M}=\\{c_{1},c_{3},c_{4}\\}$. The gradients with
clients are provided for representation purposes only and the correlation
values between these gradients are shown as edge weights. As the clients
$c_{2}$, $c_{5}$, and $c_{6}$ are attackers, the edge between these clients
has a higher value as compared to the other edges in the graph. Similarly, the
edges between the attacker and normal client (e.g., between $c_{2}$ and
$c_{1}$) have a lower value as compared to the edges between two normal
clients.

Figure 3: Example graph showing the correlations (weight on edges) between
clients. Attacker-Attacker edges (red) with a higher weight, Attacker-Normal
edges (dashed yellow) with a lower weight, and Normal-Normal edge (green).
Clients $c_{2},c_{5}$, and $c_{6}$ are the attackers. Numeric values with each
client are representing the gradients.

###  III-A MST-AD Algorithm

In this section, we exploit the graph realization obtained from the
correlation matrix to create an MST, similar to our previous work [15], which
we leverage to distinguish attackers from normal clients. We recall that an
MST is a spanning tree of a weighted graph having maximum weight, i.e., on a
set of $n$ clients, the tree is composed of $n-1$ edges of maximum weight,
subject to a standard constraint that the selected edges do not form a cycle.

Specifically, from the set of edges in the graph, an edge $edge$ is chosen and
added to the tree $trees$ if $edge$ has the maximum weight among all the
remaining edges in the graph and $edge$ does not form a cycle on the edges of
$trees$. Following this, the $edge$ is discarded from the graph, and the edge
with the next highest weight is chosen and the process continues till the MST
is created. Upon the creation of the corresponding MST, the edge with the
lowest weight is chosen and discarded, which results in two sub-trees; the one
with the higher average edge weight corresponds to attackers whose gradients
are later excluded from the aggregation to mitigate their impact.

Algorithm 1 illustrates the above procedure for creating the sub-trees
(essentially MST) over the set of clients. The algorithm starts by
initializing the list of trees as an empty set and sorting the edges of the
graph in non-decreasing order of their weights (Line 3). We pick the first
$n-1$ edges from the sorted set and add them to the tree (Lines 4–7).
Considering that our assumption (inequality defined in Eq. 3) holds, the edges
connecting the attackers should be included in the MST. Moreover, there would
exist a single Attacker-Normal edge having the lowest weight among all the
edges in formed MST. The deletion of such edge results in two sub-trees. Since
the edges with higher weights exist between the attackers, they would form a
single connected sub-tree.

1 Input: Correlation matrix $\mathcal{A}$

2 Output: Set of attackers ($Atk$)

3 $trees\\!\leftarrow\\!\emptyset$; $i\\!\\!\\!=\\!0$;
$\mathcal{E}\\!\leftarrow\\!$ sorted edges in non-increasing order

4 while _$|trees| <n-1$ _ do

5 if _$\mathcal{E}[i]$ does not form cycle in $trees$ _ then

6 $trees\leftarrow trees\cup\mathcal{E}[i]$

7 $i$++

8 $subT_{1},subT_{2}\leftarrow$ Remove lowest weighted edge from $trees$

/* Let avg_weight($\cdot$) computes average weight of tree */

9 if _avg_weight( $subT_{1}$) $>$ avg_weight($subT_{2}$) _ then

10 $Atk\leftarrow subT_{1}$

11 else

12 $Atk\leftarrow subT_{2}$

13

return $Atk$

Algorithm 1 MST-AD Algorithm

###### Theorem 1

Given a correlation matrix $\mathcal{A}$, let the inequality (Eq. 3) hold for
any pair of clients, then Algorithm 1 returns the complete and correct set of
collusive attackers.

###### Proof 1

Given the inequality $r_{ip}<r_{ij}<r_{pq}$ for any pair of attackers
$p,q\in\mathcal{M}$, and any pair of normal clients
$i,j\in\mathcal{C}\setminus\mathcal{M}$. Let $\mathcal{E}$ be the set of
ordered edges of the graph induced by $\mathcal{A}$. Indeed, $\mathcal{E}$ is
divided into three contiguous subgroups, the group of edges between any pair
of attackers, followed by the group of edges between any pair of normal
clients, followed by the last group formed by the edges between normal and
attacker. Then the proof follows directly from the construction of the MST. In
fact, by definition of MST, we have to select $n-1$ edges from $\mathcal{E}$
starting from the edges with maximum weights. Following the MST construction,
we will have a sub-tree composed of all the malicious clients (edges with
higher weight), one sub-tree composed of all the normal clients (the second
group of edges in $\mathcal{E}$), and, finally, one single edge (the one with
lower weight in such a tree) between the two sub-trees. Thus, by removing the
edge with the lowest weight, we are able to distinguish between normal and
attacker clients.

###  III-B Density-AD Algorithm

This section introduces another detection algorithm by leveraging the concept
of $k$-densest graph which essentially is a maximum density sub-graph with
exactly $k$ vertices. Assuming the inequality defined in Eq. 3 holds, our
problem can be realized as a $k$-densest sub-graph problem in which the
objective is to find the $k$ vertices with the highest average weighted
degree. Note that the value of $k$ in our problem (i.e., the number of
attackers) is not known in advance. Instead, we aim to find out the $k$
vertices whose removal maximizes the density of the remaining sub-graph. The
density of a graph is defined as the average of all weighted degrees of the
vertices. Given the correlation matrix $\mathcal{A}$, the graph density can be
formally defined as

$\displaystyle
density(\mathcal{A})=\frac{2\sum_{i=1}^{n}\sum_{j=1}^{n}r_{ij}}{n(n-1)}.$ (4)

######  Definition 1 (Sparse vertex)

A vertex $v$ of a graph $\mathcal{G}$ is sparse if its removal increases the
density of the graph $\mathcal{G}-v$.

Our algorithm iterates over each vertex of the graph to identify whether it is
a sparse vertex or not. If a vertex is sparse, it is removed permanently from
the graph otherwise it is replaced back in that graph. Once all the vertices
are traversed through successive iterations, the remaining sub-graph with $k$
vertices corresponds to the potential attackers because they have the highest
correlations among themselves.

1 Input: Correlation matrix $\mathcal{A}$

2 Output: Set of attackers ($Atk$)

3 $sparse\\_list\leftarrow\emptyset$

4

5while _$i=n\text{ down to }1$ _ do

6

7 $\mathcal{B}\leftarrow\mathcal{A}\setminus\mathcal{A}[i]$

8 if _$density(\mathcal{B}) >density(\mathcal{A})$ _ then

9 $sparse\\_list\leftarrow sparse\\_list\cup\mathcal{A}[i]$

10 $\mathcal{A}\leftarrow\mathcal{A}\setminus\mathcal{A}[i]$

11

12 if _$density(sparse\\_list) >density(\mathcal{A})$_ then

13 $Atk\leftarrow sparse\\_list$

14 else

15 $Atk\leftarrow\mathcal{A}$

16

return $Atk$

Algorithm 2 Density-AD Algorithm

The overall steps of the proposed Density-AD algorithm are reported in
Algorithm 2. First the list $sparse\\_list$ is created for storing the
attackers detected during each iteration. The loop at Line 2 iterates $n$
times to testify the sparse nature of each vertex. The set $\mathcal{B}$ is
temporarily used to store the elements of set $\mathcal{A}$ (Line 2) excluding
the $i^{th}$ vertex. If the $i^{th}$ vertex is a sparse vertex in the graph,
the corresponding density of $\mathcal{B}$ will be higher than the density of
$\mathcal{A}$ (Line 2) and $i^{th}$ vertex is then appended to the list
$sparse$ and subsequently removed from the set $\mathcal{A}$ (Line 2). Next,
the density of the nodes in the $sparse$ list is compared with the density of
the remaining nodes in $\mathcal{A}$ (Line 2\- 2), and the set with a higher
density is marked as the set containing the colluding attackers.

##  IV Experimental Evaluation

In this section, we evaluate the effectiveness of our proposed attacker
detection algorithms and analyze the obtained results with a critical
comparison with popular existing algorithms.

###  IV-A Experimental Setup

We consider the task of image classification using deep neural networks
consisting of $2$ Convolutional Neural Network [16] layers followed by $3$
fully-connected layers. We use two benchmark datasets: MNIST [17] and Fashion-
MNIST (FMNIST in short) [14], each comprising of $60000$ training and $10000$
testing greyscale images divided equally in $10$ classes. For each dataset,
the samples were randomly partitioned into $n=50$ disjoint subsets and each of
that is assigned to a single client. Inspired by [6], we adopt Dirichlet
distribution with parameter $\alpha=0.9$, for the partitioning. We simulate
the attacker as follows: for the MNIST dataset, the labels of all images with
‘0’ and ‘1’ are flipped and for the FMNIST dataset, labels of all images of
“T-Shirt” and “Trouser” are flipped. Note that the adopted label flipping is
bi-directional. Further, inspired by [2], we abbreviate the attack scenarios
as $A{-}m$ attacks where $m$ is the percentage of attackers to the total
number of clients and $A$ is the shorthand for the term ‘attack’. For
instance, an $A\\!-\\!5$ attack would refer to the scenario with $5\%$ of the
total clients as collusive attackers.

###  IV-B Performance Metrics

The evaluation is carried out on the test data while comparing our algorithms
with competitive detection algorithms. We consider FoolsGold [2] and GeoMed
[10] algorithms for comparison. Besides, our experiments also included
federated averaging (FedAvg) [1] as the baseline. We employ the following
metrics to quantify the performance: (i) Test accuracy, the proportion of
correctly classified samples in the test set; (ii) Attack Success Rate (ASR),
the proportion of the targeted samples incorrectly classified in the test set.
In the context of label flipping, the value corresponds to the ratio of the
number of misclassified flipped labels to the total number of labels flipped
by adversaries [2]. (iii) ED, the earliest round at which all the attackers
got detected correctly.

###  IV-C Results

While reporting the experimental results in this section, we mainly attempt to
answer the following questions: (i) How does the training loss decrease over
30 FL rounds? (ii) What is the impact of colluding attackers on the test
accuracy and F1 Score of all the algorithms? (iii) How efficiently and early
do the proposed algorithms detect the label-flipping attackers?

####  IV-C1 Training loss over FL rounds

Figs. 4 and 5 report the obtained loss on the training data over the
communication rounds on both the datasets for $A{-}5$ and $A{-}70$ attacks,
respectively. The effects of collusion can be seen with the algorithms
employing central measures (FedAvg and GeoMed) showing higher loss as compared
to MST-AD and Density-AD. While the losses for all the algorithms converge in
$A{-}5$ attack, it diverges a lot for the existing algorithms when the
attackers overwhelm the normal clients, i.e., in the case of $A{-}70$ attack.
As the number of attackers increases, the existing algorithms could not detect
and eliminate the effect of the attackers, causing a large loss as illustrated
in Fig. 5. It is interesting to notice that the performance of the existing
attacker detection algorithms, i.e., FoolsGold and GeoMed, turn out to be
worse than the baseline FedAvg algorithm. This is mainly caused due to
incorrect elimination of the normal clients (detected wrongly as attackers)
from the aggregation thus indirectly strengthening the collusion attack. This
is evident in the case of the FoolsGold algorithm for the MNIST dataset where
a steep jump in the loss appears after initial rounds of training.

In Fig. 5, the proposed algorithms show comparable loss to the existing
algorithms for the initial rounds, but the loss decreases sharply afterward,
which can indeed be verified by the earliest round of detection (ED) reported
in Table II.

(a) Training Loss for MNIST

(b) Training Loss for FMNIST

Figure 4: Training loss over FL rounds for $A{-}5$ attack.

(a) Training Loss for MNIST

(b) Training Loss for FMNIST

Figure 5: Training loss over FL rounds for $A{-}70$ attack.

####  IV-C2 Impact of colluding attackers on test accuracy

Next, we report the results on test data, for both datasets, with a varying
number of attackers in Fig. 6. It is clear that the proposed algorithms can
maintain consistent performance with a larger number of attackers, however,
the existing algorithms employing central measures like mean and median suffer
from performance loss especially when the attackers overwhelm the normal
clients. This can be attributed to the compared algorithms incorrectly
classifying normal clients as attackers and excluding them from the
aggregation process, thereby degrading the classification accuracy.

Similar observations can be made from the F1 Score for the algorithms reported
in parts (b) and (d) of Fig. 6. Since the proposed algorithms are able to
detect the full set of attackers, the obtained F1 Score values do not show
much drop even when the number of attackers is more than $50\%$.

(a) Test Accuracy for MNIST

(b) Test F1 Score for MNIST

(c) Test Accuracy for FMNIST

(d) Test F1 Score for FMNIST

Figure 6: Accuracy and F1 Score results under varying attack scenarios.

####  IV-C3 Analyzing ASR

The ASR and the earliest detection round (ED) of all the attackers are
presented in Tables I and II for MNIST and FMNIST datasets, respectively. It
is easy to observe that the proposed algorithms are able to maintain a lower
ASR even when the proportion of attackers rises. As the proposed algorithms
are able to eliminate the effects of the colluding workers, the successful
number of attacks remains lower while the number of samples targeted by the
attackers’ increases, thus yielding a decrease in ASR. This is in contrast
with the existing algorithms yielding a higher ASR following an increase in
the number of colluding attackers. Among the considered existing algorithms,
FoolsGold can successfully detect all the attackers only when their percentage
is low however it fails in the majority of the cases and thus most entries in
ED are marked by $*$. The proposed algorithms, on the other hand, are able to
consistently identify the full set of attackers which is also reflected by
their ASR.

TABLE I: ASR and ED with varying attack scenarios for MNIST. We do not report
ED for FedAvg and GeoMed algorithms as they do not focus on detection. [ASR –
lower is better. ED – $*$ means the algorithm could not detect full set of
attackers up to $30$ rounds]

Atk | MST-AD | Density-AD | FoolsGold | FedAvg | GeoMed
---|---|---|---|---|---
| ASR | ED | ASR | ED | ASR | ED | ASR | ASR
$\mathbf{A{-}10}$ | 0% | 11 | 0% | 10 | 0% | $*$ | 0% | 0%
$\mathbf{A{-}15}$ | 0% | 9 | 0% | 20 | 0% | $20$ | 0.3% | 0%
$\mathbf{A{-}20}$ | 0% | 9 | 0% | 15 | 0% | $18$ | 0.25% | 0%
$\mathbf{A{-}25}$ | 0% | 10 | 0% | 19 | 0% | $17$ | 3% | 0.2%
$\mathbf{A{-}30}$ | 0% | 11 | 0% | 14 | 0% | $25$ | 1.67% | 0%
$\mathbf{A{-}35}$ | 0% | 9 | 0% | 15 | 0% | $24$ | 13% | 0.86%
$\mathbf{A{-}40}$ | 0% | 10 | 0% | 16 | 0% | $*$ | 34% | 1.5%
$\mathbf{A{-}45}$ | 0% | 11 | 0% | 17 | 2.5% | $*$ | 19.2% | 28.3%
$\mathbf{A{-}50}$ | 0% | 3 | 0% | 18 | 3.4% | $*$ | 25.1% | 25%
$\mathbf{A{-}55}$ | 0% | 4 | 0% | 20 | 36.7% | $*$ | 60.18% | 42.7%
$\mathbf{A{-}60}$ | 0% | 18 | 0% | 15 | 77.4% | $*$ | 100% | 74.41%
$\mathbf{A{-}65}$ | 0% | 11 | 0% | 18 | 88% | $*$ | 99.7% | 78.5%
$\mathbf{A{-}70}$ | 0% | 11 | 0% | 9 | 100% | $*$ | 96.39% | 94.9%

TABLE II: ASR and ED with varying attack scenarios for FMNIST. We do not
report ED for FedAvg and GeoMed algorithms as they do not focus on detection.
[ASR – lower is better. ED – $*$ means the algorithm could not detect full set
of attackers upto $30$ rounds]

Atk | MST-AD | Density-AD | FoolsGold | FedAvg | GeoMed
---|---|---|---|---|---
| ASR | ED | ASR | ED | ASR | ED | ASR | ASR
$\mathbf{A{-}10}$ | 3% | 3 | 3.5% | 23 | 4.52% | $*$ | 2.5% | 2.5%
$\mathbf{A{-}15}$ | 2.67% | 7 | 2% | 14 | 1.64% | $*$ | 3% | 2%
$\mathbf{A{-}20}$ | 1.5% | 3 | 1% | 24 | 1.52% | 22 | 3% | 3.25%
$\mathbf{A{-}25}$ | 1.8% | 29 | 1.4% | 16 | 1.4% | $*$ | 6.6% | 1.4%
$\mathbf{A{-}30}$ | 1% | 18 | 1.67% | 17 | 0.84% | $*$ | 2.3% | 2.3 %
$\mathbf{A{-}35}$ | 0.85% | 3 | 1.08% | 21 | 1.16% | $*$ | 19.8% | 1.14%
$\mathbf{A{-}40}$ | 0.5% | 12 | 1.63% | 22 | 6% | $*$ | 8.5% | 4.25%
$\mathbf{A{-}45}$ | 0.67% | 3 | 0.88% | 20 | 3.78% | $*$ | 82.32% | 22.44%
$\mathbf{A{-}50}$ | 1.1% | 3 | 0.81% | 21 | 43.2% | $*$ | 82.5% | 47.45%
$\mathbf{A{-}55}$ | 0.81% | 2 | 0.6% | 15 | 71.1% | $*$ | 71.27% | 51.9%
$\mathbf{A{-}60}$ | 1.83% | 28 | 0.54% | 16 | 66.15% | $*$ | 67.9% | 62.5%
$\mathbf{A{-}65}$ | 0.77% | 2 | 0.58% | 19 | 70.5% | $*$ | 70.15% | 74%
$\mathbf{A{-}70}$ | 1% | 11 | 0.57% | 18 | 76.3% | $*$ | 71.65% | 76.25%

####  IV-C4 Confusion matrices

Finally, we report the confusion matrices for FoolsGold and Density-AD in case
of overwhelming attackers (i.e., for $A{-}70$) in Fig. 7. We can clearly see
that FoolsGold could not correctly classify the images of flipped labels
(i.e., $0$ and $1$), whereas the proposed algorithms do not show any such
confusion between these labels.

(a) FoolsGold

(b) Density-AD

Figure 7: Confusion matrices for FoolsGold and Density-AD algorithms in case
of $A{-}70$ on FMNIST dataset.

##  V Conclusion

In this paper, we attempted to address a critical problem of FL framework
which is the presence of colluding attackers. Since the attackers can harm the
global model severely, their detection is of utmost need for real deployment
of the FL. We proposed two graph-based algorithms, MST-AD and Density-AD, by
leveraging gradients’ correlation among the clients. By performing an
extensive set of experiments, we validated that the proposed algorithms can
maintain a low attack success rate even when the attackers overwhelm the
normal clients.

Since the proposed algorithms rely on correlation, they may not be able to
detect an adversary if the FL system does not have any other adversary to
collude with, which we plan to relax in the future. In addition, the current
versions of proposed algorithms are limited to label-flipping attacks only. We
plan to scale our FL setup by including more types of attacks such as
byzantine, backdoor, and multi-label flipping.

## References

  * [1] B. McMahan, E. Moore, D. Ramage, S. Hampson, and B. A. y Arcas, “Communication-efficient learning of deep networks from decentralized data,” in _Artificial intelligence and statistics_. PMLR, 2017, pp. 1273–1282.
  * [2] C. Fung, C. J. M. Yoon, and I. Beschastnikh, “The limitations of federated learning in sybil settings,” in _23rd International Symposium on Research in Attacks, Intrusions and Defenses_ , 2020, pp. 301–316.
  * [3] J. Steinhardt, P. W. Koh, and P. Liang, “Certified defenses for data poisoning attacks,” in _31st International Conference on Neural Information Processing Systems_ , 2017, pp. 3520–3532.
  * [4] C. Xie, M. Chen, P.-Y. Chen, and B. Li, “Crfl: Certifiably robust federated learning against backdoor attacks,” in _International Conference on Machine Learning_. PMLR, 2021, pp. 11 372–11 382.
  * [5] P. Blanchard, E. M. El Mhamdi, R. Guerraoui, and J. Stainer, “Machine learning with adversaries: Byzantine tolerant gradient descent,” in _International Conference on Neural Information Processing Systems_ , 2017, pp. 118–128.
  * [6] E. Bagdasaryan, A. Veit, Y. Hua, D. Estrin, and V. Shmatikov, “How to backdoor federated learning,” in _International Conference on Artificial Intelligence and Statistics_. PMLR, 2020, pp. 2938–2948.
  * [7] Z. Wu, Q. Ling, T. Chen, and G. B. Giannakis, “Federated variance-reduced stochastic gradient descent with robustness to byzantine attacks,” _IEEE Trans. on Signal Processing_ , vol. 68, pp. 4583–4596, 2020.
  * [8] C. Xie, S. Koyejo, and I. Gupta, “Zeno: Distributed stochastic gradient descent with suspicion-based fault-tolerance,” in _International Conference on Machine Learning_. PMLR, 2019, pp. 6893–6901.
  * [9] A. N. Bhagoji, S. Chakraborty, P. Mittal, and S. Calo, “Analyzing federated learning through an adversarial lens,” in _International Conference on Machine Learning_. PMLR, 2019, pp. 634–643.
  * [10] D. Yin, Y. Chen, R. Kannan, and P. Bartlett, “Byzantine-robust distributed learning: Towards optimal statistical rates,” in _International Conference on Machine Learning_. PMLR, 2018, pp. 5650–5659.
  * [11] Y. Chen, L. Su, and J. Xu, “Distributed statistical machine learning in adversarial settings: Byzantine gradient descent,” _ACM on Measurement and Analysis of Computing Systems_ , vol. 1, no. 2, pp. 1–25, 2017.
  * [12] D. Wu, M. Pan, Z. Xu, Y. Zhang, and Z. Han, “Towards efficient secure aggregation for model update in federated learning,” in _IEEE Global Communications Conference (GlobeCom)_ , 2020, pp. 1–6.
  * [13] V. Tolpegin, S. Truex, M. E. Gursoy, and L. Liu, “Data poisoning attacks against federated learning systems,” in _European Symposium on Research in Computer Security_. Springer, 2020, pp. 480–501.
  * [14] H. Xiao, K. Rasul, and R. Vollgraf, “Fashion-mnist: a novel image dataset for benchmarking machine learning algorithms,” _arXiv preprint arXiv:1708.07747_ , 2017.
  * [15] P. Ranjan, F. Corò, A. Gupta, and S. K. Das, “Leveraging spanning tree to detect colluding attackers in federated learning,” in _IEEE Conference on Computer Communications Workshops_ , 2022, pp. 1–2.
  * [16] Y. LeCun, B. Boser, J. S. Denker, D. Henderson, R. E. Howard, W. Hubbard, and L. D. Jackel, “Backpropagation applied to handwritten zip code recognition,” _Neural computation_ , vol. 1, no. 4, pp. 541–551, 1989.
  * [17] Y. LeCun, L. Bottou, Y. Bengio, and P. Haffner, “Gradient-based learning applied to document recognition,” _Proceedings of IEEE_ , vol. 86, no. 11, pp. 2278–2324, 1998.