Mitigating Sybil Attacks on Differential Privacy based Federated Learning

In federated learning, machine learning and deep learning models are trained globally on distributed devices. The state-of-the-art privacy-preserving technique in the context of federated learning is user-level differential privacy. However, such a mechanism is vulnerable to some specific model poisoning attacks such as Sybil attacks. A malicious adversary could create multiple fake clients or collude compromised devices in Sybil attacks to mount direct model updates manipulation. Recent works on novel defense against model poisoning attacks are difficult to detect Sybil attacks when differential privacy is utilized, as it masks clients' model updates with perturbation. In this work, we implement the first Sybil attacks on differential privacy based federated learning architectures and show their impacts on model convergence. We randomly compromise some clients by manipulating different noise levels reflected by the local privacy budget epsilon of differential privacy on the local model updates of these Sybil clients such that the global model convergence rates decrease or even leads to divergence. We apply our attacks to two recent aggregation defense mechanisms, called Krum and Trimmed Mean. Our evaluation results on the MNIST and CIFAR-10 datasets show that our attacks effectively slow down the convergence of the global models. We then propose a method to keep monitoring the average loss of all participants in each round for convergence anomaly detection and defend our Sybil attacks based on the prediction cost reported from each client. Our empirical study demonstrates that our defense approach effectively mitigates the impact of our Sybil attacks on model convergence.

Abstract-In federated learning, machine learning and deep learning models are trained globally on distributed devices. The state-of-the-art privacy-preserving technique in the context of federated learning is user-level differential privacy. However, such a mechanism is vulnerable to some specific model poisoning attacks such as Sybil attacks. A malicious adversary could create multiple fake clients or collude compromised devices in Sybil attacks to mount direct model updates manipulation. Recent works on novel defense against model poisoning attacks are difficult to detect Sybil attacks when differential privacy is utilized, as it masks clients' model updates with perturbation. In this work, we implement the first Sybil attacks on differential privacy based federated learning architectures and show their impacts on model convergence. We randomly compromise some clients by manipulating different noise levels reflected by the local privacy budget of differential privacy on the local model updates of these Sybil clients such that the global model convergence rates decrease or even leads to divergence. We apply our attacks to two recent aggregation defense mechanisms, called Krum and Trimmed Mean. Our evaluation results on the MNIST and CIFAR-10 datasets show that our attacks effectively slow down the convergence of the global models. We then propose a method to keep monitoring the average loss of all participants in each round for convergence anomaly detection and defend our Sybil attacks based on the prediction cost reported from each client. Our empirical study demonstrates that our defense approach effectively mitigates the impact of our Sybil attacks on model convergence.
Index Terms-Federated learning, differential privacy, Sybil attacks.

I. INTRODUCTION
M ACHINE learning and deep learning techniques have become prevailing in artificial intelligence. Along with this rise of application in clinical imaging for pathologic diagnosis and intelligent agriculture for crop monitoring, data privacy and security are the major concerns during machine learning training and test procedure. Learning from unbalanced and non-IID (not independently and identically distributed) data while preserving privacy, federated learning methods are proposed to train global models on distributed devices [1], [2], [3], [4]. In federated learning, each device or organization as a client has private data of training that is inaccessible to other clients and the server, which protects data privacy and data security.
In federated learning, learning models are shared globally. However, such a distribution scale introduces practical challenges to reliability against various attacks towards the system. For example, this framework is vulnerable to model poisoning attacks [5], [6], [7], and it becomes even worse to some specific model poisoning attacks, called the Sybil attack [8].
In one study, Fung et al. [9] demonstrate that a deep learning network model in federated learning can be easily subverted by using the Sybil attack. In such attacks, the clients' model updates are tampered with a backdoor into the learned model, even if a small fraction of clients are compromised [6], [10].
As a defense technique in cryptography, differential privacy [11] is utilized in federated learning to protect data confidentiality between the communications among server and multiple clients. By adding a certain distribution of random noise on each client's update locally or on the aggregated global model, user-level differential privacy [12] can be achieved when training a global model. In this setting, any specific user's data will not influence the behaviours of a trained model no matter it is used for training or not during the learning process. However, there have some weaknesses in these methods. One of which is that differential privacy requires that the scale of additive noises has to match the scale of parameters in the model updates to preserve utility. Therefore, it needs a comparatively larger number of clients or a larger value of privacy budget compared to that in the central setting [13]. Inspired by this limitation of user-level differential privacy which leaves more space for the attack, we introduce our Sybil attacks that aim to manipulate the updated parameters inside local models such that the aggregated model in the server has a high cost of the prediction indiscriminately for training examples, which makes the global model converges slowly, or even leads to divergence.
We perform the study on differential privacy based Sybil attacks in federated learning settings. A key challenge for the attacker is that how the compromised model updates from Sybil clients can obscure the aggregation defense rules in the uncompromised server to deviate the global model from its original prediction. To address the challenge, we apply different strategies to carefully craft local model updates of Sybil clients according to different aggregation rules by manipulating different noise levels reflected by the local privacy budget of differential privacy. Our goal of the attack is to introduce higher training costs in the global model when the server aggregates all the clients' updates, including our crafted parameters in each training round compared with the original one. Our attack intuition is the accumulated high cost during the learning process may slow down the convergence of the global model significantly.
Existing defenses against model poisoning attacks replace the mean aggregation rule in the central server with a Byzantine-resilient algorithm as the robust aggregator [14], [15]. However, these defenses do not take into account the scenarios where differential privacy is applied in the federated learning model. Whereas differential privacy prevents data leakage, federated learning models are still susceptible to model poisoning attacks, especially to Sybil attacks. To address this challenge, we propose our defense method to defend against our Sybil attacks on differential privacy based federated learning settings. Our proposed defense excludes those client updates inducing high loss values of prediction on the global model where the cost is evaluated based on the loss report from each client. Empirical results show that our proposed defense mechanism effectively mitigates the impacts of our Sybil attacks on the convergence of the global model.
There are three main contributions in this paper as follows: • We implement Sybil attacks on differential privacy based federated learning architectures and show their impacts on model convergence. • We propose a method to detect and defend our Sybil attacks based on the prediction cost reported from each client. The key insight is that the poisoned model parameters from Sybil clients can be identified by their induced high loss values of prediction on the global model. • We apply our attacks to two recent aggregation defense mechanisms. We also conduct an empirical study to illustrate that our proposed defense method effectively defends against our Sybil attacks. This paper is organized as follows. Section II discusses the state-of-the-art attacks on federated learning and corresponding defenses. In Section III, we introduce how to attack differential privacy based federated learning using Sybil attacks. We describe our attacks and defense solution in Section IV and Section V. Section VI analyzes the evaluation results using two public datasets. We finally conclude our work and close with future research direction in Section VII.

A. Attacks and Defenses on Federated Learning
The most distinction between federated learning and centralized machine learning is that federated learning trains a model collaboratively across distributed client devices. Thus, it opens up new attack surfaces such that the adversary can manipulate the model updates sent back to the server [16]. This class of adversarial attacks is known as model poisoning attacks. Since the corrupted model updates can be arbitrary, model poisoning attacks are generally viewed as the most powerful and worst-case attacks, which is also referred to as Byzantine attacks [17]. Currently, Byzantine attacks mainly aim to degrade model performance or even make the global model unusable. Based on the goal of the adversary, these Byzantine attacks can be further classified as untargeted attacks [13]. However, the limitation is that the attacker has to know about the aggregation rule in the server entirely. Otherwise, the attacks would be much less effective. Another category of model poisoning attack is targeted attacks. The aim is that the trained model is modified in desired behaviour for the adversary, such as misclassification on some specific tasks. Bhagoji et al. [6] revealed that the learned global model could be poisoned to the misclassify targeted objective while preserving the classification accuracy of the trained model. Moreover, it needs only a small portion of client devices to be compromised for their targeted model poisoning attacks. However, it assumes that the server uses the accuracy of validation data to detect anomalous updates. In the training process, validation data are not accurate enough compared to training data due to the stochastic gradient descent (SGD) algorithm. Therefore, the effect of this kind of attack is limited without the appropriate assumptions. In the literature, data poisoning attacks are explored comprehensively. In data poisoning attacks, the adversary tampers the training dataset of clients by replacing labels or adding perturbations to the original data [18], [19]. Targeted attacks are also referred to as backdoor attacks [20], in which the performance of the global model on specific tasks is influenced by manipulating client data. In the work of targeted attacks [6] for model poisoning attacks, the final weights update sent back by the malicious client is learned from the auxiliary data. Therefore, we can see that although the model poisoning attacks are more powerful, it is enormously important to investigate data poisoning attacks for well understanding of the relation between them. Although some past work has explored untargeted data poisoning that reduces the accuracy of the global model notably using crafted training data [21], research directions on targeted data poisoning attacks are dominant.
A common method to aggregate the local models is using the mean aggregation rule [1]. However, this model averaging is susceptible to adversarial attacks and hardly provides privacy guarantees. Many works have explored Byzantineresilient defense mechanisms for federated learning. Specifically, recent works propose various robust aggregation rules against both untargeted and targeted attacks. As the popular aggregation defense mechanisms, Krum [22] and Trimmed Mean [23] are proposed to be robust under untargeted adversarial settings. These methods replace the mean aggregation rule in the central server with a Byzantine-resilient algorithm as the robust aggregator. However, these mechanisms work under appropriate assumptions that provably asymptotic on the number of the client. With data poisoning attacks, they can be viewed as special cases of model poisoning attacks. The reason is that compromised training data will induce anomaly in clients' model updates. Therefore, Byzantineresilient defenses against model poisoning attacks may also work for data poisoning attacks [24]. It is noteworthy that any proposed robust defense has to guarantee the convergence of the global model when using a gradient descent algorithm on the client.

B. Differential Privacy based Federated Learning
Concerning about data privacy, user-level differential privacy [12] is leveraged in the context of federated learning. Several works have shown that the use of differential privacy effectively defends against privacy disclosures on the scope of targeted model poisoning attacks [25], data poisoning attacks [26], [27], and attacks on adversarial examples [28]. In our study, we implement the first Sybil attacks as untargeted model poisoning attacks and defenses on federated learning models with differential privacy applied. In [25], Sun et al. have explored an approach to eliminate the impacts of targeted attacks using differential privacy, while our Sybil attacks are untargeted attacks that focus on differential privacy based federated learning.
Our proposed Sybil attacks are one of the worst-case model poisoning attacks. In Sybil attacks, an adversary is capable of manipulating model updates from a large number of clients, which significantly influences the performance of the global model, even when state-of-the-art defense aggregation rules are present. Furthermore, while recent Byzantine model poisoning attacks studies [16], [17] focus on Byzantine-robust federated learning, our attacks consider differential privacy preserved federated learning.

III. THREAT MODEL
This section describes the architecture of our differential privacy based federated learning settings, followed by characterizing the capabilities and goals of adversaries in Sybil attacks.
In this paper, we consider a standard federated learning context, in which there are K clients in total, each owning private training data and the number of c compromised clients at most from K clients. All the clients collaboratively train a classifier by solving the optimization problem where f k (w) is the objective function for the local dataset on the kth client, and w denotes the parameters of the global model. The server aggregates clients' models by a predetermined aggregation rule w = A(w 1 , w 2 , · · · , w K ) where w k denotes the parameters in the local model updates of each client. We call our federated learning settings differential privacy based federated learning. In this architecture, the clients' model updates are masked with a user-level differential privacy perturbation in the form: where w k is the parameters in the local model updates from the kth client, and n k is an additive noise to guarantee differential privacy. The noise level of each client is reflected by the local privacy budget of differential privacy on the local model updates. In this paper, we use Laplace distributed additive noises with the following probability density function: where w represents model parameters shared globally and b is a scale parameter. In accordance with Theorem 1 in work [29], we calculate the scale parameter in (3) b = 2D max T /n k where D max represents the maximum absolute value of the model update parameters in the current communication round, T is the total number of communication rounds, and n k is the number of examples in training dataset of the kth client. It is proved that the clients' model updates being sent back to the server that perturbed by noise n with this Laplace mechanism meet ( , 0) -user-level differential privacy. Our Sybil attack is one of the untargeted model poisoning attacks. In this attack model, an adversary can spoof up to the number of c clients and tamper model parameters before sending them back to the server during the training process, as the capability of the Byzantine threat model as discussed in Section II-A. In this paper, we assume that the c compromised clients are from a total of K clients and no more fake clients in the system for simplicity. Moreover, we assume that the adversary knows the aggregation rule A used by the server, as it is usually published for the trust and transparency of the system [1].
We consider the goal of an adversary is to slow down the convergence rates of the global model or even diverge the model in the training phase. In this work, we assume the loss function of models is smooth and strongly convex. Although the loss function for high-dimensional networks is usually non-convex, it can still achieve a local minimum using stochastic gradient descent (SGD) algorithm iteratively on each client when training a model in federated learning. Under this assumption, the lower bound of global convergence rate in federated learning settings can reach to O( 1 T ), where T denotes the total number of communication rounds to train a model [30].
In the Laplace differential privacy mechanism, for any > 0, the scale of additive noise is increased when is reduced, corresponding to an increased level of privacy protection. Therefore, differential privacy with a small value of reduces the convergence rate of the global model. Given the lower bound of the model convergence rate, we propose a search algorithm to choose an optimal for differential privacy in the system. Specifically, we select one from the following values as the local privacy budget of clients: 0.1, 0.3, 0.5, 1.0, 2.0, 5.0, 8.0, 10.0. These typical values of have been evaluated in recent works for the trade-off investigation between privacy and utility of differential privacy [31], [29], [32]. We first initialize = 10.0 for all clients and calculate the global convergence rate based on the average loss of prediction on the global model in 50 iterations of training. If it is greater than O( 1 T ), then we choose the next smaller value of from candidates and repeat this process until the global convergence rate is less than O( 1 T ). This process determines the optimal value of for honest clients, which guarantees differential privacy, meanwhile preserves the convergence rates of the federated learning model. To solve value on Sybil clients, we will introduce our attack strategies according to different aggregation rules respectively in the next section.
IV. OUR ATTACK In the user-level differentially privacy-preserving federated learning setting, for any > 0, the scale of additive noise over the client updates is increased when is reduced. We leverage this characteristic to introduce a larger variance on model updates from Sybil clients using a smaller value of relative to it on honest clients, which will induce a higher loss of prediction on the global model in each iteration round of training.
In this section, we introduce our Sybil attack strategies for three aggregation rules in the central server of federated learning, including one widely used aggregator and two stateof-the-art defensive mechanisms.

A. Our Attack to FedAvg
One commonly used aggregation rule in federated learning is FederatedAveraging (FedAvg) [1]. In the FedAvg algorithm, the global model in each communication round of training is the average of all clients' model parameters.
where w (k) t represents the local parameters from the kth client in the current round t, and w t+1 is the aggregated global model for the next training round. The user-level differential privacy on each client's model update is applied by: where n (k) t is a Laplace additive noise ∼ L(0, ∆f ) with the optimal we choose using our search algorithm. Based on this optimal , the differential privacy can be guaranteed while preserving the convergence rate of the global model above the lower bound. From (4), it is easy to get the aggregation with differential privacy: As discussed in Section II-A, FedAvg is vulnerable to adversarial attacks. We can simply increase additive noise n (k) t in (6) from Sybil clients to achieve a large variance on w t+1 by reducing the local privacy budget on Sybil clients.
We propose two strategies to attack FedAvg. One obvious method is to use any s on Sybil clients for 0 < s < h where h is the optimal value we choose for honest clients using our search algorithm in Section III. In this work, for simplicity, we assume that all Sybil attackers use the same s for attacks, and all honest clients use the same h for differential privacy. The smaller value of s corresponds to the stronger attack intensity, easier to be detected, however. To choose the value of s from candidates, we evaluate this attack method using different s and the different number of Sybil attackers. The other more stealthy method is using synchronous additive noises on these collusive Sybil clients. In this method, the noises added to the model updates of Sybil clients are from either the positive or negative part of Laplace distribution in phase. According to (6), even with a small magnitude of additive noises, the attack intensity will be amplified by the sum operation of FedAvg when the server aggregates all the clients' model updates. We evaluate two methods in our experiment, respectively.

B. Our Attack to Krum
Recent work [22] proposed Krum to increase the robustness of the aggregation rule against Byzantine attacks. The basic idea is that it selects one of the model updates from all the clients as the global model instead of using the mean of them. The selection criterion is based on the similarity concerning Euclidean distance between two clients' model updates. Specifically, suppose we have K clients in total and c Sybil clients among them, it first calculates the Euclidean distance between each client's model update. Then for each model update, it computes the squared sum of the smallest K − c − 2 Euclidean distances. Finally, the Krum algorithm selects the model update with the minimum squared sum as the global model. It has been proved that the global model can converge to a local minimum under Byzantine attacks when c < K−2 As Krum selects one model update from K clients as the global model for the next communication round, our idea is that this model is from one of c Sybil clients. The goal is this selected model deviates the global model from its intended converge direction before attacks. The key challenge of the attack is that each crafted local model with added random noises will induce a large Euclidean distance to the models from honest clients. As a result, Krum can easily exclude our crafted local models in such an aggregation rule. To address this challenge, we let model updates from Sybil clients maintaining the same to achieve a zero Euclidean distance between each of them. Then we carefully adjust s in these Sybil clients such that their Euclidean distances to honest models are comparable with those among honest clients. This collusion of Sybil clients ensures our crafted model update to be selected by Krum. In implementing our attack, we evaluate both Krum and Multi-Krum on different training models respectively to maximize the attack impacts in experiments.

C. Our Attack to Trimmed Mean
Another aggregation rule, Trimmed Mean [23], considers the element-wise algorithm in the model updates. Similar to Krum, Trimmed Mean requires an explicit number of compromised clients. As we assumed those c Sybil clients as mentioned above, it removes the largest and smallest c elements in model parameters among all clients' updates. After that, it uses the average of the remaining elements as the corresponding parameter in the global model. In Trimmed Mean, the variance of model parameters in clients' update is constrained to a benign magnitude, which mitigates the impacts of Byzantine attacks. The authors also proved that the global model converges when c < To slow down the convergence of the global model in our attack, we craft c compromised local models based on the intended gradient of each element in the current training round. Specifically, when one parameter in the global model intends to increase upon the previous iteration if there is no attack, we add negative random noise with Laplace distribution onto this element of the corresponding location in each compromised client, such that this parameter with additive noise from each compromised client is smaller than the majority of the corresponding model parameter from the honest clients. As a result, the mean of the remaining K −2c elements according to the Trimmed Mean algorithm is tending to decrease upon the previous iteration. Otherwise, if one parameter in the global model intends to decrease upon the previous iteration, we add positive random noises with Laplace distribution on each compromised client in the same way. In our experiments, we evaluate the values of s to nominate the most effective attacks.

V. OUR DEFENSE
We design a method to detect and defend our Sybil attacks on differential privacy based federated learning setting. Compared with state-of-the-art defense mechanisms such as Krum and Trimmed Mean, our proposed algorithm does not require the exact quantity of compromised clients. The experiment results show that our defense method effectively mitigates the impacts of untargeted model poisoning attacks on model convergence.
The key insight is that the poisoned model updates from Sybil clients can be identified by their induced high loss of prediction on the global model. Technically, the cost of a network is defined as a function f i (w) = (x i , y i ; w) that takes model parameters w as its input and maps the loss of output on examples (x i , y i ) where x i is input and y i is the label. In our federated learning settings, Sybil clients will contribute model updates that appear larger loss values than those from honest clients to affect the convergence of the global model.
Our approach keeps monitoring the convergence rate of the global model throughout all training rounds on the serverside. As we discussed in Section III, the optimal convergence rate can reach to O( 1 T ) for a smooth and strongly convex loss function where T denotes the number of communication rounds. Our algorithm evaluates the convergence rate from round 2 by comparing the model loss decrease rate to a predetermined threshold to detect Sybil attacks. This threshold reflects defense intensity. For most of the machine learning or deep learning models, the convergence rate is usually ranging [30]. In this paper, we set the threshold to 0.8 depending on the loss function in the global model. Note that a ratio of 0.8 is used to tolerate non-malicious failures from unreliable clients.
To locate Sybil attackers from participating clients, we use binary search in the vector of clients. For each half of clients, the central server sends loss report requests to a random fraction C of K clients with model parameters w averaged from model updates in the corresponding half of clients. After that, the loss values reported from selected clients l k are averaged in the server. We keep searching Sybil attackers in the half of client vector with a larger mean of loss until three clients or 10% of total K clients remaining. Finally, we aggregate all clients' model parameters, excluding these remaining client updates after the binary search has finished for the next global training round. Although there could have some honest client updates sacrificed for a few rounds of communication, our defense does not influence the convergence of the global model. The details of our defense method are introduced in Algorithm 1.

Algorithm 1 Detection and defense
Require: Average training loss l 1 in round 1 Server executes: for round t = 2, 3, ... do if (∆l t )/l 1 < threshold of defense intensity then // The binary search // The invariant: the average loss of clients containing Sybil attackers is larger than that of the other half.
// Each client reports loss with model parameters w t and w t S t = random set of max(C · K, 1) clients In Algorithm 1, our proposed defense method keeps monitoring the convergence rate of the global model from iteration round 2 until the end of the training period, by comparing the rate to a pre-determined threshold of defense intensity.
When this model loss decrease rate drops below the threshold in a certain round t, our method detects Sybil attacks and launches the defense procedure. The binary search algorithm is used to locate Sybil model updates among all the participating clients. The invariant in binary search is the key insight of our proposed defense method, which is that the average loss of clients containing Sybil attackers is larger than that of the other half. Specifically, we split the model updates from all the clients and average the local model parameters of each half, w t and w t respectively. Then the server sends both global model parameters w t and w t to a randomly selected set of clients S t for the request of the loss report. Each client k ∈ S t completes the training task based on both global model parameters w t and w t and returns loss value l , the server calculates the mean of these loss values l t and l t for each half client vector correspondingly. We keep searching for Sybil clients in half of the clients' vector with a larger loss value by comparing l t and l t . We repeat this process until there are 10% of total K clients or 3 clients left in the vector. Then we exclude these clients' model updates and average the remaining model updates as the global model w t+1 for the next training round. This concludes our proposed defense mechanism against Sybil attacks for monitoring and detection implementation.

A. Empirical Setting
We consider a real-world scenario for our experiments. The hospital or pathological laboratory as the clients collaboratively train a model for pathologic diagnosis using their private clinical images of patients. A trusted third-party service provider as the central server is to complete aggregation operation. An adversary can manipulate the model updates from compromised clients.
In this paper, our proposed attack and defense approaches are evaluated by CNN and MLP models on two datasets MNIST and CIFAR-10 respectively. The MNIST data are partitioned by non-IID, and CIFAR-10 data are IID. We implement a federated learning prototype of PyTorch based on [1]. The computer environment is Intel® Core™ i7-4770 CPU @ 3.40GHz processor, 16.0GB RAM and Windows 10 64-bit operating system.
The parameters for our differential privacy based federated learning settings by default are summarised in Table I. The Sybil attackers are randomly selected from 100 clients in each communication round. All additive noises are Laplace distributed with a corresponding privacy budget.
To compare with our proposed attack methods, we implement the Gaussian attack [7] as a benchmark. This attack injects random noises with Gaussian distribution into the local model updates from Sybil clients. In our experiments, we set the mean of the distribution to 0 and its standard deviation to 0.3 for evaluation.
As shown in Table I, we perform 50 rounds of training and 5 local epochs on each client in our experiments. The learning rates were tuned between 0.01 to 0.05 for the best performance.
We use the error rate as test metrics for the evaluation of our defense, which is defined in (7).

B. Evaluation on Our Attacks
The empirical results for our attacks are shown in Table  II and Table III. We replicate FedAvg, Krum, and Trimmed Mean algorithms. We then apply the Gaussian attack and our proposed attack to these methods respectively. These results illustrate that the error rates after our proposed attacks are significantly higher than those after Gaussian attacks on both CNN and MLP models.
Firstly, Table II shows the error rates after attacks on the CNN model as the classifier using the MNIST dataset. When there is no attack, the trained models achieve a low error rate of 3% for all the aggregation rules. Krum and Trimmed Mean are robust to the Gaussian attack, where the error rates remain almost at 3%. However, the error rates increase dramatically to 14% and 85% when we use our proposed methods to attack Krum and Trimmed Mean respectively.
Secondly, we notice that the FedAvg aggregator hardly defends against adversarial attacks, which need to be replaced with a robust aggregation rule. In Table II and Table III, they both show that the error rates of trained models increase significantly when we apply the Gaussian attack and our proposed attack to FedAvg.
We also explore the model convergence under these attacks for three aggregation rules respectively. In Fig. 1 and Fig. 2, it can be seen that our proposed attacks effectively slow down

C. Evaluation on Our Defenses
We evaluate our proposed defense algorithm on MNIST and CIFAR-10 datasets using CNN and MLP models respectively. As shown in Table IV and Table V, our defense is effective at optimizing the training loss for all scenarios. For example, when defending our proposed attack on the CNN model, the error rate remains at 3%, which is the same as it when there is no attack. However, Krum and Trimmed Mean are not effective to defend our proposed attack. The error rates increase to 14% and 85% respectively. According to (7), a small error rate reflects high testing accuracy, which means that the training loss achieves a local minimum after 50 rounds of training. This explains why our proposed defense method works, which eliminates the impacts of our proposed attack on both CNN and MLP models.

VII. CONCLUSION AND FUTURE WORK
This paper comprehensively analyzes diverse attacks and defenses on federated learning. The application of differential privacy in the context of federated learning is user-level differentially private. In this paper, we evaluate the vulnerabilities of differential privacy based federated learning and explore possible defense mechanism.
Our work raises the interests in the research direction of differential privacy based federated learning. We also explore the attacks and defense mechanisms with untargeted model poisoning attacks. In future research, targeted model poisoning attacks that are strongly related to data poisoning attacks will be investigated in real-world application scenarios such as pathologic diagnosis and intelligent agriculture.


extfieldsofstudy:
Computer Science
Biology
Engineering

text:
Tractogram filtering of anatomically non-plausible fibers with geometric deep learning

Tractograms are virtual representations of the white matter fibers of the brain. They are of primary interest for tasks like presurgical planning, and investigation of neuroplasticity or brain disorders. Each tractogram is composed of millions of fibers encoded as 3D polylines. Unfortunately, a large portion of those fibers are not anatomically plausible and can be considered artifacts of the tracking algorithms. Common methods for tractogram filtering are based on signal reconstruction, a principled approach, but unable to consider the knowledge of brain anatomy. In this work, we address the problem of tractogram filtering as a supervised learning problem by exploiting the ground truth annotations obtained with a recent heuristic method, which labels fibers as either anatomically plausible or non-plausible according to well-established anatomical properties. The intuitive idea is to model a fiber as a point cloud and the goal is to investigate whether and how a geometric deep learning model might capture its anatomical properties. Our contribution is an extension of the Dynamic Edge Convolution model that exploits the sequential relations of points in a fiber and discriminates with high accuracy plausible/non-plausible fibers.

Introduction
Tractography represents a powerful method to reconstruct the white matter fibers from diffusion magnetic resonance (MR) recordings [1]. While this method provides a good approximation of the brain connectivity structure, there is an open issue of artifactual fibers [12,11], i.e. anatomically non-plausible pathways. We address the task of filtering out such artifactual fibers using a deep learning model.
We gratefully acknowledge the support of NVIDIA Corporation with the donation of the Titan Xp GPU used for this research.
The structural connectivity of the brain can be reconstructed from diffusion MR signal by a step of local estimation of the diffusivity model [21] and a subsequent step of fiber tracking [6]. The outcome is a tractogram, a virtual representation of the axonal pathways in the white matter, where each fiber is encoded as 3D polylines, commonly referred to as streamlines. Typically, a whole brain tractogram is composed of millions of streamlines.
Tractograms are providing valuable contributions to critical tasks like presurgical intervention planning, the detection of biomarkers for brain disorders and the investigation of neuroplasticity. For these purposes, the accuracy of fiber tracking is of paramount importance. While in the preprocessing of diffusion data it is common practice to denoise the signal before estimating the diffusivity model [7,25], there is no similar step after fiber tracking to filter out noisy streamlines.
The assessment of the accuracy of fiber tracking has been approached a few years ago with an open contest 7 involving many (20) research groups. The contest was designed as a task of bundle detection on a dataset composed of simulated diffusion MRI data. The joint effort allowed the evaluation of the quality and limits of the most common tracking methods [12]. The positive outcome has been the lack of false negative streamlines, the critical issue has concerned the many false positive errors, e.g. artifactual streamlines.
The occurrence of false positive streamlines is not surprising. The general strategy of tracking methods is to oversample the possible pathways to preserve the property of coverage of all true positive fibers [19]. The tacit assumption is to postpone the task of filtering false positive streamlines to a subsequent post-processing step. The reason for this strategy is the difficulty of encoding anatomical priors into tracking algorithms.
The most common approach to reduce artifactual streamlines are methods based on the inverse problem of signal reconstruction, e.g. Life [16], SIFT [20], Commit [3]. The intuitive idea is to estimate how much the orientation of a streamline explains the diffusion signal. Despite the principled criterion, these methods do not take into account the knowledge of brain anatomy, like another method based on the topological properties of streamlines [24].
A recent rule-based method, namely ExTractor [10], has been proposed to filter out artifactual streamlines from tractograms by following anatomical principles. The rules that it proposes encode the geometrical and spatial properties of the streamlines with respect to the basics of white matter neuroanatomy in terms of association, projection, and commissural fibers. As output, ExTractor labels streamlines as anatomically plausible or anatomically non-plausible.
In this work, we address for the first time the problem of tractogram filtering as a supervised learning problem. We need to train a binary classifier to discriminate between two classes: anatomically plausible (P) and non-plausible (nP) fibers. The intuitive idea is to exploit the labeling of fibers provided by the rule-based method [10] and to adopt deep learning models to learn the features of streamlines underlying the rules. The ultimate goal is to have a fast run-time solution to filter large tractograms and a flexible method to transpose new expert annotations. 7 tractometer.org/ismrm_2015_challenge Given the sequential structure of a streamline, we have chosen as reference learning model a bidirectional LSTM (bLSTM) neural network [9]. Although this model can exploit the sequential information, it requires forcing the streamline representation to a fixed number of points. For this reason, we consider Geometric Deep Learning (GDL) models [13] that support more flexible and appropriate data representations. We investigate a PointNet (PN) model [18], where a streamline can be represented as a point cloud i.e. set of 3D points, and a Dynamic Edge Convolution (DEC) model [23], which in addition to PN considers the relations between points belonging to the same spherical local context. Our experiments shows that both GDL models provide an improvement with respect to bLSTM.
Despite the better results provided by PN and DEC, these models are invariant to permutations of points in the input point cloud. It means that if we permute the points in a streamline classified as plausible, the model will continue to classify it as plausible albeit the altered sequence of points. To overcome this issue we propose a Sequence Dynamic Edge Convolution (sDEC) model, an extension of the DEC model that introduces the property of being sequence sensitive.
While the sDEC model provides only a modest increase in accuracy with respect to PN in classifying P and nP fibers, the analysis of error distribution shows different behaviours. sDEC is more robust when fibers are long and curved: those are the type of fibers where PN performs worst and produces significantly more false positive errors. In addition, visual inspection of the false negatives errors made by sDEC shows that these fibers look truly anatomically non-plausible. We may argue that this apparent mismatch might be related to the noise of the labelling process.

Materials
Dataset. Our reference dataset is composed of a collection of tractograms of 20 subjects randomly selected from the HCP dataset [22], which is a publicly available curated MRI dataset. The tractograms were obtained computing (i) the constrained spherical deconvolution (CSD) model [21] on the 3T DWI (1.25mm, 270 multishell gradients), and the (ii) Particle Filtering Anatomically Constrained Tractography (PF-ACT) algorithm [6]. Specifically, the tracking generated around ∼ 1M fibers for each tractogram by seeding 16 points for each voxel with step size 0.5mm. The tractogram of each subject has been non linearly coregistered to the MNI standard space, and, for computational purposes, all the fibers have been compressed to the most significant points [17].
ExTractor labelling. According to the premise of a supervised learning approach, we created a dataset where for each tractogram we labeled the fiber as either plausible (P) or non-plausible (nP). The procedure of labelling followed the heuristic rules defined by ExTractor [10], a tool that encodes the current knowledge on the anatomical pathways of white matter structures. In particular, ExTractor carries out a 2-step procedure. First, fibers are marked as nP when they are either (i) shorter than 20 mm, (ii) contain a loop, or (iii) are truncated, i.e., Fig. 1: The DEC architecture adopted. Green, gray, and red blocks represent input, intermediate, and output tensors, respectively. Parametric layers are colored in blue, while fixed layers in white. they terminate in the deep white matter. The second step is concerned with the labeling of fibers marked as P, by splitting the main pathways into the three macro classes: association, projection, and commissural. This selection of fibers is further refined to filter out non-plausible pathways using a clustering method [2]. The outcome of the ExTractor procedure is a balanced partition between P and nP fibers, irrespective of the different tracking algorithms and data sources [10]. On our dataset, Extractor resulted in 49.7 ± 1.5% of P streamlines on average on the 20 subjects, but more significantly it showed the presence of a massive percentage, 31.8 ± 1.2%, of nP streamlines shorter than 20mm.

Methods
The intuition underlying our work is to treat a streamline as an undirected sequence of 3D points, aiming to learn geometric and spatial features relevant for the tractography filtering task. Currently, the best way to achieve such a goal is by employing GDL models [13], which are designed to learn geometric features of graphs and point clouds. Among the existing GDL approaches, PointNet [18] is the most adopted method both for its simplicity and effectiveness. Nevertheless, such an approach does not consider relations between points. It learns global properties of a point cloud just by encoding all the points separately and then aggregating them in a single descriptor through global pooling. Conversely, Dynamic Edge Convolution (DEC) [23] considers the points relations, by encoding them as edges of a graph dynamically induced by the point cloud.
Dynamic Edge Convolution. Considering a point cloud X = {x 1 , x 2 , . . . , x n }, x i ∈ R 3 , the DEC model first guesses an initial graph structure for the point cloud by retrieving for each point x i the set of k nearest neighbors, knn(x i ) = {x ji 1 , . . . , x ji k }, in terms of Euclidean distance (see Figure 2a). Hence, DEC builds a k-nn graph, G(V, E), where V = X is the set of nodes, and an edge (i, j) ∈ E exists iff x j ∈ knn(x i ). Then, each point representation, x i , is enriched with the representation of each of its neighbors x ji , creating edges features e ij , which are learnt through a neural network h Θ , i.e. e ij = h Θ (x i ⊕(x j −x i )), where ⊕ denotes the concatenation operator. Finally, a new representation of a point, x i , is obtained by aggregating all the learned edge features with a pooling operator, i.e. x i = pool(e ij ), j : (i, j) ∈ E, where pool is either max or mean. The sequence of operations that from X produce X define an Edge Convolution (EC) layer, which in the DEC model is repeated multiple times. Referring to our architecture, see Figure 1, two EC layers are stacked in depth to produce new representations X and X with 64 and 128 features respectively. Each of the two EC layers computes its own k-nn graph in order to adjust the local neighborhood of points to its input representation, i.e, X and X . The re-computation of knn is what defines the DEC model as dynamic. Finally, the different learned representations are concatenated, encoded with a learning layer, g Φ , to 1024 features, and pooled to obtain a single descriptor of the point cloud, Z = pool(g Φ (X ⊕ X )), which is classified using a fully connected (FC) network.
Dynamic Edge Convolution of a Sequence. A remarkable property of the DEC model (also shared by PN) is the invariance to the permutation of the points in the input point cloud. Indeed, such models make use only of operators invariant to the order e.g., FC layers, max / mean pooling layers. Although this property is fundamental in the point cloud domain, it becomes undesired if the input is a sequence as in our case. To solve this issue, we propose a simple but wellmotivated modification of the DEC model, in which we impose the input point cloud to have a graph structure, without needing a Euclidean k-nn to induce it. According to the streamline structure, we impose the input to be a bidirectional sequence graph where each non-terminal point, x i =0,n , has two neighbors: the previous and the next point in the sequence, while the terminal points, x 0 , x n , have just one neighbor (see Figure 2b): It is important to remark that we impose this structure only in the first sDEC layer, which is enough to lose the invariance with respect to the input permutations while maintaining the invariance with respect to the flipping of the sequence, thanks to the bidirectionality of the sequence graph. Also, imposing this structure only in the first layer preserves the dynamicity of the model, which remains able to re-organize the structure of the point cloud in the latent space according to the task at hand.

Experiments and Results
The main purpose of the experiments is to perform an empirical assessment of the behaviour of different models for the task of tractogram filtering. In our comparison, we consider a reference model, bLSTM, and three competing models based on geometric deep learning: PN, DEC, and sDEC. Before setting the training of learning models, we carried out a few preprocessing steps. The first step was the pruning of fibers. An analysis of the distribution of fibers between P and nP according to the ExTractors rules, highlighted a massive percentage of very short streamlines, i.e. length below 20 mm. All of them were labeled as nP. To reduce this potential bias for the learning models we removed such streamlines from the tractograms. After the pruning, the average distribution of P and nP classes was 68% and 32% respectively. The second preprocessing step concerned the resampling of the points of streamlines. Traditional learning models, e.g. bLSTM, require input to be represented as fixed vectorial representations. Therefore, despite GDL models can deal with a varying number of points, we have to resample all streamlines to have the same number of points [5,14,8]. We computed the resampling using a cubic B-spline interpolation and empirically compared different representations based on 12, 16 and 20 points. No meaningful performance differences were noticed. In Table 1 we report the results for streamlines resampled to 16 points.
To perform a fair comparison of the four models, we have configured all of them to have a similar number of parameters, approximately around 900K. While the architecture of DEC and sDEC models is reported in Figure 1 where FC is a Fully Connected layer, and MLP contains sequences of (FC, BatchNorm, ReLU). For the implementation of the models, we adopted the PyTorch library [15] with the PyTorch Geometric extension [4].
For all the experiments we considered a dataset of 20 tractograms from 20 different subjects. We partitioned the data into three sets: 12 tractograms for training the models, 4 tractograms for hyperparameters tuning and model selection, and 4 tractograms for testing. The training was designed as follows: 1000 epochs with evaluation step every 20 epochs; cross-entropy loss; Adam optimizer with default alfa and beta momentum (0.9, 0.99); initial learning rate of 10 −3 multiplied by a factor of 0.7 every 90 epochs until a minimum value of 5 · 10 −5 is reached. In the training procedure, we used mini-batches composed of 16K streamlines randomly sampled from two subjects, 8K from each of them. A subject is sampled only once for each epoch. On the test set, we computed the following evaluation measures: accuracy, precision, recall, and DSC. In Table 1 the values refer to the average for each subject. Notice that the classification task is single-streamline, therefore the size of our test set is composed of ∼ 3 million streamlines.
An additional experiment was designed to test the invariance of DEC and sensitivity of sDEC with respect to the order of points in a streamline. To this end, we tested the two models on a version of the test set where the the sequence of points of streamlines were randomly permuted. In agreement with the working hypothesis, the accuracy for DEC remained the same, 94.3%, while there was a drop for sDEC to 30.0%.
A further analysis concerned the examination of the error distribution. We restricted the analysis to PN and sDEC only. Our interest was to characterize whether and how the error differs between the two models. We considered a couple of features in the analysis: length and curvature of streamlines. All streamlines were partitioned into three categories with respect to length (short  Figure 3A we depict how the accuracy score varies across the categories. The task becomes more difficult when both length and curvature are greater. A similar analysis was carried out focusing on the distribution of false positive error, i.e. streamlines mistakenly classified as anatomically plausible. The results are reported in Figure 3B. In this case, we observe a major difference between the two models in the most critical categories, namely long and curved streamlines. In Figure 3C we illustrate a qualitative example of false negative errors, when streamlines should be recognized as anatomically plausible while they are classified as anatomically non-plausible. Visual inspection by an expert anatomist confirms that the classifier was indeed correct in those cases and that the labelling process was noisy.

Discussion and Conclusions
The results reported in Table 1 confirm that we may successfully approach the task of tractogram filtering as a supervised learning problem. The best accuracy achieved by sDEC is beyond 95% with low standard deviation across subjects. This performance is obtained considering only the representation of streamlines as a sequence of 3D points. The runtime application of sDEC model is very fast. We may filter a whole tractogram with ∼ 1M streamlines in less than one minute (46.2 sec using a gpu NVIDIA Titan Xp 12Gb).
We argue that the accuracy is underestimated and the true score may be even higher. If we look at the portion of false negative error, as reported in Figure 3C, we may agree that some of those streamline trajectories can be considered anatomically non-plausible, even though the true label states the contrary. Therefore, the computation of accuracy is biased by this apparent mismatch, which we can consider as part of the noise in the labelling process. Moreover, we may claim that the sDEC model has a good generalization capability and behaves accurately even in the presence of misleading labels.
The geometric deep learning models seem to provide only a small, even though meaningful (t-test with p-value < 0.001), improvement in terms of accuracy compared to bLSTM. Nevertheless PN and sDEC support higher flexibility in the streamlines representation, both as points clouds or graphs. The sDEC model seems the most appropriate for tractogram filtering because it is robust with respect to the order of points in the streamlines while preserving the highest accuracy in the discrimination of anatomical plausibility.
The analysis of error distribution allows a better understanding of the difference between PN and sDEC models. Around 40% of the misclassification error concerns different streamlines, indicating that the two models behave differently: in Figure 3A the most critical streamlines are those longer and more curved. Nevertheless, sDEC is more robust and the drop in accuracy is lower than PN. We may explain this difference with the property of sDEC to capture the relations among the points because it is considering also the edges of streamlines. When streamlines are long and curved, edges become more informative and provide a competitive advantage. As illustrated in Figure 3B, PN has the bias to classify long and curved streamlines as anatomically plausible doing more false positive error.
We believe that a fast and accurate filtering of tractograms, like the one supported by the sDEC model, is the premise for further investigations on how tasks like bundle segmentation may take advantage of the removal of artifactual streamlines.


Visual analytics of 3D LiDAR point clouds in robotics operating systems

Received Sep 17, 2019 Revised Dec 28, 2019 Accepted Feb 3, 2020 This paper presents visual analytics of 3D LiDAR point clouds in robotics operating system. In this study, experiment on simultaneous localization and mapping (SLAM) using point cloud data derived from the light detection and ranging (LiDAR) technology is conducted. We argue that one of the weaknesses of the SLAM algorithm is in the localization process of the landmarks. Existing algorithms such as grid mapping and monte carlo have limitations in dealing with 3D environment data that have led to less accurate estimation. Therefore, this research proposes the SLAM algorithm based on real-time appearance-based (RTAB) and makes use of the red green blue (RGB) camera for visualisation. The algorithm was tested by using the map data that was collected and simulated on the robot operating system (ROS) in Linux environment. We present the results and demonstrates that the map produced by RTAB is better compared to its counterparts. In addition, the probability for the estimated location is improved which allows for better vehicle maneuverability.

INTRODUCTION
Simultaneous localization and mapping (SLAM) of an autonomous vehicle is a process of locating and mapping the location of a moving vehicle in a dynamic environment. Localization and mapping process work together similar to the "chicken and egg" analogy. Localization of an autonomous vehicle (AV) needs a map of the environment in order to locate itself. The same goes to map process to produce a map of the surroundings where it requires the current state and location of the vehicle to build the map of the environment. Technically, AV is categorized on a scale from zero to five, with zero meaning no autonomy and five signifying complete autonomy [1].
The AV technology is important, gives many benefits such as lower the crashing probability, and would be very useful for smart city communities. Conceptually, autonomous navigation of a driverless vehicle consists of several questions such as "where am I going?", "where am I currently?" and "how do I get there?" [2]. Self-localization is an important feature in the navigation of an autonomous vehicle. Navigation is known as a process of determining a suitable and safe path between the start point and the destination point where the mobile robot will move [3]. Besides that, it also can be defined as the ability to move in any particular environment [3]. The question of, "where am I currently?" is very important as it determines the precise current state of the autonomous vehicle which can be achieved via a sensor. Light detection and ranging (LiDAR) sensor such as Velodyne VLP-16 PUCK was designed to scan the surrounding environment to construct the map and locate its current location. Based on [4], it is a stable sensor and reliable to be used because it can replicate the contour information of the surrounding obstacles. Velodyne VLP-16 PUCK emits its laser to scan the surroundings and collect data called point cloud which is in a 3-dimension state. LiDAR sensor can be integrated with the inertial measurement unit (IMU) for a precise detection and localization. It provides attitude or orientation, and velocity to an AV [5]. SLAM is the key feature in making a vehicle autonomous and navigates in an unknown environment. In SLAM, there are many algorithms that have been used such as the Kalman filter and Particle filter. Kalman filter algorithm is applied based on the calculation of the mean and variance to estimate a vehicle's pose. As for the Particle filter, it converts the SLAM problem into path and landmark estimation [6]. Particle filter algorithm consists of two popular methods namely the Monte Carlo and Rao-Blackwellized. Monte Carlo uses the Bayesian filtering approximation by drawing samples of particles as explained in [7]. It is one of the algorithms that is widely used for robot localization. According to [8], Monte Carlo algorithm is specialized for target tracking, statistics and computer vision literature as well as dynamic probabilistic networks and it works well based on fast sampling technology. As the robot moves and sense, Monte Carlo uses resampling method to estimate the distribution. When comparing Monte Carlo to other filter algorithm such as Kalman filter based, the advantage of Monte Carlo algorithm is that Monte Carlo able to express multi-modal distributions which resulting the robot can be localized globally. However, Monte Carlo only can deal with 2D data. Rao-Blackwellized method uses the extended Kalman filter and the unscented Kalman filter algorithm to improve further the estimation accuracy.
According to [9], it is a real complex problem for an autonomous vehicle to move from one place to another in urban areas like cities because of too many dynamic objects like pedestrians. In terms of the system algorithm for an autonomous car to work, the SLAM of a mobile robot has problems to locate itself. It also has problems to move based on the estimated prior location and to build map simultaneously as they move. SLAM algorithm that has been presently researched such as the Kalman filter algorithm can only be applied to the non-linear Gaussian distribution model, which can cause high computational time, linearization error and which can lead to non-accurate estimation. In addition, according to [10], extended Kalman filter algorithm can lead to poor representations of nonlinear function. This can cause the filter to be divergent. Some related work has shown that Kalman filter is not good in terms of accuracy for state vector estimation and also to measure noises in environments. As supported in [11], it is obviously known that Particle filter is better than Kalman filter when it comes to produce more precise and robust estimation because Kalman filter requires more extensive calculations. As for the graph-based SLAM, the main idea is to organize information in a graph and give solutions to SLAM problems as a global graph optimization. In addition, there is also the implementation of graph-based SLAM using visual methods such as using red green blue-depth (RGB-D) type camera. This visual SLAM algorithm is called the RTAB-Map algorithm. It uses graph optimization technique together with 3D map data that is achieved using the RGB-D camera to further improve the localization estimation accuracy. For localization using RTAB-Map algorithm, it uses Bayesian filtering that records closure-loop assumptions by estimating probability of forming closure-loop. The process of localization by using Bayesian filtering is really important, as Bayesian has the strongest foundation and the oldest approach [12]. Information fusing using Bayesian fusion is found to be more straightforward to be used for indoor and outdoor environments.
This paper presents a simulation of visual analytics of 3D LiDAR point clouds in robotics operating system. The aim of this paper is to experiment a few standard SLAM algorithms for mapping and localization using the robotic operating system (ROS) during the localization and mapping processes. The weakness of the SLAM algorithm is in the localization process of the landmarks. There are limitations in existing algorithms such as grid mapping and Monte Carlo when the data is in 3D environment which will lead to less accurate estimations. Thus, this paper proposes the SLAM algorithm based on real-time appearance-based (RTAB) and makes use of red green blue (RGB) camera for visualization. The remainder of this paper is organized as follows: Section 2 describes the past studies and presents the commonly used algorithm in SLAM. Section 3 presents the methodology while section 4 discusses the results and findings of the study. Finally, section 5 concludes the paper.

BACKGROUND STUDY
Traditionally, the advanced driver-assistance systems (ADAS) have been implemented to navigate an autonomous vehicle. However, over several past years, SLAM has shown its improvement over ADAS, particularly in detecting and tracking the moving objects, as described in [13]. For SLAM to navigate autonomously, an AV needs to know the precise location of its current state. This is known as localization or in other words as a local state, which refers to the current location of an autonomous car as it navigates to designated places. According to Wolcott et al., [14], localization has to be within a priori map in order to get a precise location. They further added that metadata is embedded into a priori map to transform the complication perception task into localization problems rather than using vehicle's sensors to detect lane, markings and traffic sign clearly. According to Bresson et al., [15], the global navigation satellite system (GNSS) that was introduced as an alternative, cannot provide sufficient data for the autonomous vehicle to detect the location. This arises when the autonomous vehicle goes through an urban area with high buildings, where the infrastructure can block direct signals and generate multi-paths interference. Furthermore, in an urban area, there will be traffic congestion where these can also be an issue [16]. These two situations worsen the autonomous navigation in the urban and packed areas.

Real-time appearance-based algorithm
Real-time appearance-based (RTAB) SLAM is one of the algorithms that uses the basics of graph SLAM in carrying out the process of mapping and localization. According to [17], the advantage of graph SLAM is it lies within the structure of the matrix that stores the pose data of the vehicle together with the landmarks within the map. This information can visualize the entire trajectory of the vehicle. As explained in [18], the graph SLAM works by generating landmarks from raw radar signals and constructing a map once it achieves high accuracy in both localization and mapping. RTAB approach is one of the efficient methods to do SLAM because it creates a 2D occupancy grid and 3D octo-map that and has been applied in many past studies [19,20].
In some researches, occupancy grid maps are built in Bayesian framework and it detected the mobile objects by comparing the accumulated occupancy grid map and local map built by current data [21]. The advantage of using graph SLAM is that the map is optimized and stored in an R-tree data structure in order to maintain its flexibility [18]. According to [19], RTAB-Map algorithm is designed to give solutions that are based on localization and graph composition. RTAB algorithm basically combines two algorithms which are loop closure detection and graph optimization. At the same time, it provides memory management to satisfy real-time requirements and allowing multi-session mapping to associate different maps. This model uses RGB images in order to generate locations related to those images. The images will then be compared to the previously visited locations for loop-closure detection for localization.
Based on one of the research on image processing for paddy in [22], pictures of paddy leaves taken from a UAV and with lens correction technique contained RGB images, successfully produced weighted accuracy of about 95.04%, which shows that detection using RGB image can generate accurate and detailed pictures as applied in this paper. This image will be processed by using image processing algorithm to enable its features to be extracted. According to Mutalib et al [22], image pre-processing that is frequently used is the conversion from RGB to Grayscale image. In addition, Kahar et al. [23], in their research on detection for paddy diseases, also included reading and extracting the RGB colour from images of paddy leaves to be converted into grayscale. At this stage, it is important to read the right colour as it determines the stages of the paddy diseases. The characteristics of this data are high dimensional, semistructured and also spatial patterns [24]. The use of RGB colour in RTAB algorithm provides a richer representation of the surrounding during the localization process.
As a loop-closure detection can be detected inside a map, detection can also be found between different maps due to the multi-session properties of the system. After a successful loop-closure detection, 3D transformation is applied to match the images. When the loop closure has been stored, the Bayesian filter will be updated by estimating the probability of performing loop closure. According to [25], Bayes rule is the best tool to perform the estimation because in solving SLAM problem, it is necessary to apply estimation theory to develop maps from noisy information. RTAB SLAM is a graph-based SLAM system that includes locations as nodes. The location will be applied during loop closure detection and then the map graph is optimized in order to decrease odometry errors. The steps in the RTAB algorithm is described as in [19].

3D and 2D mappings
In the SLAM algorithm, the common problem is the localization of the landmark. For example, the existing algorithms such as the grid mapping and Monte Carlo localizations have limitations in dealing with 3D environment data which could lead to non-accurate estimations. These algorithms can only provide 2D maps for localization. The problem when using a 2D map is that the data is insufficient for the localization process as the vehicle moves around various places. Image data for a 2D map might drift away as the vehicle turns around and creates redundancy of data. Compared to a 2D map, a 3D map data is more preferable for localization. As in this research, the method used is the RTAB algorithm which includes both 2D and 3D maps. Obviously, with the help of both 2D and 3D maps, localizations made can be more precise compared to using only a 2D map. As explained in [9], a 3D map is purposed to give a solution for the localization to be combined with a 2D map. A 3D map can help improve localizations as it contains many features such as point cloud data, noise, depth information of the image and also the colour intensity. A 2D map does not possess these features except that is require smaller storage. Moreover, 3D maps have more flexible views and good dimensions compared to 2D maps. This information is important and contributes to better localizations. In addition, RTAB algorithm produces a 3D map by using RGB-Depth camera to collect data images from the surroundings. Generally, RTAB algorithm is suitable for SLAM since it generates 2D and 3D maps in multiple scenarios. With the help of 2D and 3D maps, it will give more accurate data for the localization process of the mobile robot since the localization will depend on the surrounding map to estimate its current and next state. As RTAB algorithm has richer information it is better than grid mapping and hector SLAM, they can only generate 2D maps and process data from 2D maps in order to do localization. Table 1 shows the comparison of features in RTAB-Map, grid mapping and hector SLAM. As can be seen in Table 1, RTAB-Map has richer features compared to grid mapping and hector SLAM. RTAB is one of the SLAMS visual and it uses RGB-Depth camera to collect data images from the surroundings. By having an RGB-Depth camera, RTAB can extract the depth element from the images. The depth data is so helpful to provide accurate information. Compared to grid mapping and hector SLAM, only RTAB-Map algorithm uses the depth data. The depth data is collected by the kinect sensor. For odometry; refers to the input that can be used to help the SLAM approach compute the motion estimation which is known as localization. Moreover, RTAB-Map can produce both 3D octo-map and 2D occupancy grid map which use point cloud data to map the surroundings. Unlike grid mapping, and hector SLAM, they can only produce 2D occupancy grid map.

METHODOLOGY
The data collection was carried out by using a mobile robot equipped with Velodyne VLP-16, high quality sensor designed for obstacle detection and navigation of autonomous vehicles. It operates by measuring distance with 16 layers of lasers, which spins around providing a complete 360° horizontal field of view. Figure 1 shows the system architecture for the RTAB-Map algorithm. This architecture comprises of 3 sections which is input, process and output. It starts with the input section where the data of the environment are scanned and collected using laser sensor VLP-16.
These data comprise of two types that is namely from Kinect sensor and laser sensor which will be extracted and synchronized. Next, the data is then matched and stored into database by using the concept of memory management. Memory management is considered as a database that consists of two type of memory, short-term memory (STM) and long-term memory (LTM). Short Term memory is like an entry point that works by adding new images when the data images received during the scanning process. While for long-term memory, it stores all of the data images of the surrounding that have been scanned. The experiments have been conducted using robotic operating systems (ROS) simulations. The output for this process is the map and the localization position for navigation.

RESULTS AND FINDINGS
This section explains the results and findings from creating maps and localizing the robot position. The results of mapping using RTAB-Map are discussed based on two versions, which are in 2D and 3D maps. The 2D map is based on the occupancy grid map while the 3D map is based on point cloud.

Mapping results
The results of mapping using RTAB algorithm in simulation generated 3D map consist of depth data from kinect sensor and known as depth graphical view of the environment. Figure 2 and Figure 3 show the 3D map that has been created in simulation for both environments namely living room and tv room. As can be seen in the figure, mapping results for the 3D map seems so detailed and real akin to the real environment. These 3D maps consist of many point cloud data. The generated 3D map can be seen not just of the top view of the plan, but from any angle. In addition, the 3D map also has colours of the environment. Based on the created map, tv room mapping generated good results. For the first environment, living room, the map generated was poorer because of less features in the environment. The robot was not able to generate a good 3D map due to the lack of features which are needed for loop closure detection. When the robot scanned the environment in living room, less features made the robot failed to do loop closure to match the pictures of environment since it scanned an empty surrounding. However, in the second environment, a few more features were added such as cylinders, cones and tables in order to get better results.

RTAB SLAM performance
For the first room, living room in Figure 2, the turtlebot has been pointed to one goal. In this room, the turtlebot will pass through the obstacles. There were 5 experiments conducted as listed in the following table. The distance for each experiment was fixed at 3 meters each. Figure 4 illustrates the movement  Figure 4, the yellow dotted line represents the movements of the robot from point A to point B.

Figure 4. Experiment with RTAB algorithm
From the dotted line, it showed that the robot did not move in a straight line because of the obstacles between point A and point B. The robot was able to avoid the obstacles and move as indicated by the yellow dotted line. As for the time taken for the robot to reach its destination, the terminal output the time in Unix time stamp. This value was converted into ISO format to note the real time taken. The conversion of time from Unix time stamps to ISO format was done online. The time taken for experiment 1 was 15.636 seconds. Next, the second experiment was also carried out by passing through the obstacles similar to the first experiment but at different points. The distance between points C to point D was set at 3 meters. From the experiment, when the robot detected an obstacle, it tried to find another path and tried to locate itself while scanning the environment. The experiment results have been tabulated in the following Table 2 that shows the time taken from the tests conducted for both rooms, which have been gathered and represented as RTAB SLAM performance. Room with less total time taken is considered as a good environment for the RTAB. As shown in the table, total time taken for the turtlebot to reach its goal in living room was 147.030 seconds, while for tv room it was 40.720 seconds. There was a slightly different time recorded between2 the two above. In living room, the turtlebot passed through an obstacle from one point to another point, while in tv room, there were not many obstacles and the turtlebot did not pass through any obstacle, allowing it to move in a straight line.
From the results, the conclusion is tv room is the best environment compared to living room as the robot took the least time to navigate to the location at approximately 40 seconds. The RTAB algorithm performed its best to localize the robot when there were no obstacles around it as it moved to the goal. When there were no obstacles, the robot could locate itself precisely, and this helped the robot to process the information it collected from its surroundings in lesser time as to where to navigate within the map. Thus, it reached its goal faster without the need to avoid any obstacles. As we can see, the way the robot navigated itself in living room, it had to pass through the obstacles in front of it. As the robot reached the obstacle, it slowed down to 'decide' as to which way it needed to go, either to the left or right. In order to decide which way to turn, it needed to scan the environment for others possible path to go through. During the scanning process, the robot rotated a few times. Here, obviously we could see that when there were obstacles, it took time for the robot to detect and decide which path to use so as to avoid the obstacles in front of it.

Comparison between RTAB and AMCL localization
This subsection presents the comparison between RTAB and AMCL algorithms, in which five experiments were conducted, involving 5 different start-end points, experiment using AMCL algorithm shown in Figure 5. To be fair, a distance of 3 meters was fixed for each experiment. Table 3 shows the time taken for the turtlebot to reach the goal for both experiments using RTAB and AMCL algorithms. The experiments were conducted in tv room. As can be seen in this table, there are big differences in the time taken for the robot to reach the goal. For RTAB, the results showed it took approximately 41 seconds for the three experiments that were carried out. While for the AMCL algorithm, it took almost 204 seconds for the robot to reach its goal. These results prove that the RTAB algorithm is more successful in doing SLAM process as compared to the AMCL algorithm. It also shows that with the help of 3D maps, a more precise robot and autonomous vehicle mapping and localization can be produced. To support these findings, as explained in [26] that the use of Graph optimization method, which was applied partly in the RTAB algorithm, the localization improved with the map being constantly kept up-to-date. This is also due to feature selection and data size per map area remaining constant.

CONCLUSION
This paper demonstrated the simulation study of SLAM by using a low-cost service robot platform which was capable of mapping and localizing in an unknown environment. We have shown that the turtlebot was able to localize itself in the map created using Bayes filter in RTAB algorithm and was able to navigate to its goal better than the Monte Carlo and Gmapping algorithms. The entire process of navigation was visualized using Rviz and was found to be satisfactory since the robot was able to reach the goal point successfully. Further studies in this field with other SLAM algorithm and by using real mobile robot would be beneficial to many parties as the robotic field is currently highly demanded.


DETERMINANTS OF E-TAX SYSTEM ACCEPTANCE BY USERS

This study aims to find out the determinants of the e-tax system acceptance by its users based on theory of planned behavior. As we all know that taxes are the largest national revenue for Indonesia, and expected to increase from year to year. Because of it, the government tries to make it easy for society to pay taxes. One of the ways the government has is to improve e-system taxation. The users in this context were the taxpayers domiciled in Surabaya. The analysis technique used in this study was structural equation modeling. WarpPLS 6.0 software was used to process the data collected through the study. Based on the data collected and processed during the study, some findings were found out. First of all, the users' attitudes were significantly influenced by the perceived useful, beliefs, and compatibility. Secondly, the subjective norms were not affected by the external influence, but rather by interpersonal influence. In addition to those, the perceived behavioral control was completely and significantly influenced by self-efficacy and facilitating conditions. Lastly, the users' intentions in using the e-tax system were influenced by two factors only: the users' attitude and the perceived behavioral control

Taxes are one of the largest sources of national revenues in Indonesia. Most of the national budget funds come from tax revenues, from where national expenditures including public financing and national development are financed. Tax revenues are expected to continue to increase from year to year in order to meet all the country needs. For this reason, various policies have been made by the government in order to increase the national revenues gained from the fiscal sector. One of these policies is the implementation of the self-assessment system. The development of information technology continues to increase time by time. Along with the advancement of the information technology, the society is also required to develop. Because of that reason, the government did not want to miss to take advantage of these technological advances by making changes in the form of modernization of the taxation system. This taxation system modernization was carried out by implementing e-system-based technology. The reformation of e-system taxation modernization by the Directorate General of Taxes was an e-tax system that could be used to conduct eregistration, e-Filing, e-SPT, e-Billing and e-Facture. In February 2015, the Directorate General of Taxes (DGT) issued a new application or information system called DGT ONLINE to make it easier for taxpayers to report their annual tax returns, known as SPT (Surat Pemberitahuan Tahunan). The purpose of renewing the tax administration system with the existence of e-tax was to improve taxpayers' compliance and increase public confidence in tax administration. The online tax system also functioned as an effort to eradicate corruption from the tax sector. Through this online program, taxpayers would not be able to manipulate the amount of tax to be paid. This program was one formula to achieve a good system in Surabaya. The use of e-tax is also believed to be more effective and efficient because the time used by taxpayers to collect the taxes will be shorter than tax payments using manual system (Ibrahim, 2014).
In running or using an information system, software, hardware and humans, as the operator, are needed. These three components must be interconnected to each other so that the data processing activities in SPT reporting can run smoothly. Humans as e-tax system users played an important role in the operation of the e-tax system provided by the government. For that reason, users should fully support this system. However, due to several factors, this system had not been fully accepted by the society as the users. Studies in the US have confirmed that the choices made by taxpayers to use e-tax also depend on whether they use a tax advisor to prepare their taxes or not, and the attitude of their tax advisors towards the use of e-tax in tax development and adoption (Thomas, Manly, & Ritsema, 2004). The role of this tax advisor was confirmed to be influential based on the previous studies carried out by (Hansford, Lymer, & Pilkington, 2006) and Lymer, Hansford, & Pilkington (2005) in the United Kingdom. In addition, navigation facilities and accessibility of a system are important in determining individual perceptions of system quality (Saha, Nath, & Salehi-Sangari, 2012). According to the results of the study by Lymer, Hansford, & Pilkington (2012), it was shown that individuals who accepted this online-based system tended to be individuals who have higher level of enthusiasm about technology and interest in experimenting with new processes.
Nowadays, there are still many people who have not used it yet and do not even understand the e-tax system due to various factors from the users' side. This study aims to determine the factors that influence the acceptance of the e-tax system by the users. This study was conducted to find out whether DGT Online's information system was running as it should and increasing taxpayers' compliance in paying taxes, for which it was necessary to evaluate the performance of the information system. Evaluation was carried out to find out the condition of objects by using instruments such as distributing questionnaires to users of the system and the results are compared with a certain benchmark to obtain conclusions and from there how user acceptance of the performance of the system could be assessed.

LITERATURE REVIEW
E-Tax is a service provided by the government to facilitate taxpayers in making payments and sending tax deposit data through online media to the tax system of the Directorate General of Taxes. E-tax is a form of government programs' embodiment namely e-government which is used to improve relationship between the government and other parties, one of which is society. At the moment, studies on e-government have attracted many people around the world because these studies can provide many reports which are essential for the development of e-government, which can bring about a fundamental transformation of government services (Hung, Chang, & Yu, 2006). As a form of egovernment program, electronic tax is used to improve tax administration efficiently. E-tax is expected to have advantages for Directorate General of Taxes because this system is expected to ease the fraud detection in terms of tax payments, as well as it will benefit the users for which the tax payment will be easier than using the manual system.
The theory of planned behavior is a theory that emphasizes the rationality of human behavior as well as the belief that behavioral targets are under the control of individual consciousness. According to Taylor & Todd (1995) this theory provides a full understanding of behavioral intention by focusing on factors that tend to influence the use of certain systems through design and implementation strategies. This theory was created by Icek Ajzen and later was further developed together with his colleague, Martin Fishbein in 1975. Based on this theory, behavior does not only depend on one's intention, but also on other factors that are not under the control of the individuals, such as the availability of resources and opportunities to display the behavior (Ajzen, 2005). According to Fishbein & Ajzen (1975) intention is a component in the individual who refers to the desire or interest of an individual to do certain behaviors. Bandura (1986) states that intention is a determination to carry out certain activities or produce certain situations in the future. Ajzen (1991), then, reintroduced theory of planned behavior by adding a new component, which is called perceived behavioral control. With this, he expanded the Theory of Planned Behavior to predict behavioral intention and actual behavior. Ajzen (1991) added the concept of behavioral control perception, which came from the theory of self-efficacy. Self-efficacy was first coined by Bandura (1986) from his research on social cognitive theory. According to Bandura (1986), self-efficacy is the belief of an individual that he can succeed in carrying out the behaviors needed to produce results.

METHODS OF RESEARCH
This study used survey method and the population was society in Surabaya. 51 respondents, consisting of 20 males and 31 females, were selected in Surabaya by using purposive and accidental sampling technique. The measurement scale used was a Likert scale with the following criteria: (1) Strongly disagree, (2) Disagree, (3) Neutral, (4) Agree, (5) Strongly agree. The analysis technique used is Structural Equation Modeling. Structural equation modeling is a multivariate statistical analysis technique that is used to analyze structural relationships. This technique is the combination of factor analysis and multiple regression analysis. Structural equation modeling (SEM) is a multivariate statistical framework that is used to model complex relationships between directly and indirectly observed (latent) variables (Stein, 2013). The structural equation model implies a structure for the covariances between the observed variables, which provides the alternative name covariance structure modeling (Hox, 1998). In this paper, WarpPLS 6.0 software was used to process the data.

RESULTS AND DISCUSSION
The results of data processing conducted during the study indicated that the users' attitudes were influenced by perceived usefulness, trust, and compatibility factors. Meanwhile, perceived ease of use, risk, and personal innovativeness did not have significant effects on the users' attitudes. Therefore, from the hypotheses that had been prepared beforehand about the attitude of the users, only H1, H4, and H6 were accepted. There are three important things that can be taken from the results of the data processing, the first of which is that the behavior of taxpayers who adopt e-tax and nonadopters in using e-tax was significantly influenced only by the usefulness factor of the system on the users, the users' trust in the e-tax system, and the compatibility of the system according to the users. Secondly, according to Agarwal & Prasad (1998), personal innovativeness is the nature of individuals in adopting information technology which can help to identify users who tend to adopt innovations on information technology earlier than other people. In addition, based on the results of data processing conducted in this study, it is shown that e-tax adopters do not significantly have a higher level of personal innovativeness than individuals who are not e-tax adopters. This is also supported by previous study conducted by Hung, Chang, & Yu (2006). Hung, Chang, & Yu (2006) stated that the possible cause was that the acceptance or use of e-tax was not seen as a problem but rather an interesting task for e-tax adopters with high personal innovativeness. Lastly, the results of the data processing show that perceived ease of use and risk are not significant determinants of the taxpayers' attitude of both users and non-users of e-tax. Warkentin, Gefen, Pavlou, & Rose (2002) in his study stated that perceived risk is an individual's subjective expectations of losses suffered in pursuit of a desired outcome, so that it will affect the attitude of the taxpayers to e-tax. Whereas perceived ease of use according to Davis (1989) is a level believed by an individual that by using a certain system they will have less effort, therefore the less effort needed in using a system, the greater the acceptance of an individual in the system will be. However, the empirical results of this study state otherwise, which shows that ease of use and risk reduction are not significant factors. The might be because the taxpayers selected as samples for this study feel that these two determinants are not easily perceived or have only a little effects on them (Hung, Chang, & Yu, 2006).
The next hypothesis was about the influences on subjective norms. According to Mathieson (1991) subjective norms reflect the perceived opinions of referent other, which "referent other" means a person or a group who may be an important person to individual. Bhattacherjee (2000) stated that in the absence of first-hand experience with a product or service, individuals may rely on second-hand or vicarious experiences for deciding among behavioral choices, because second-hand experience may be an effective, inexpensive, and convenient way of forming intentions about using new, unproven services such as ecommerce. Based on processed data, subjective norms were only significantly influenced by interpersonal influence but were not significantly influenced by external ones, meaning that H8 was accepted while H7 was rejected. In other words, the users only considered subjective norms based on what each individual felt and not even trustable people for the users can influence their decision whether or not to use the e-tax system. In other hand, perceived behavioral control was all influenced significantly by self-efficacy and facilitating conditions; which mean that H9 and H10 were equally accepted.
Next was about the users' intention to use the e-tax system. Based on all data and hypotheses that had been processed, the users' intention to use the e-tax system was influenced by two factors, namely attitude and perceived behavioral control, while subjective norms did not significantly influence the user's intention to use the e-tax system.

CONCLUSION
Based on the study conducted, some findings were gained. Firstly, the users' attitude was significantly influenced by perceived usefulness, trust, and compatibility. Next, the two subjective norms were not influenced by external influences, but were only influenced by interpersonal influences. Furthermore, it was found that perceived behavioral control was entirely influenced significantly by self-efficacy and facilitating conditions, which meant that both hypotheses regarding perceived behavioral control, namely H9 and H10 were equally accepted. Finally, the users' intention to use the e-tax system was influenced by two factors, namely attitude and perceived behavioral control, while subjective norms did not significantly influence the users' intention to use the e-tax system.

SUGGESTIONS
The government should promote e-tax system usage socialization so that society in Surabaya is well educated about the e-tax system. If it has been well socialized, it will be easier for society to believe and accept the e-tax system.
It will be better if the government does not only provide introductory socialization. Training programs should also be held in using the e-tax system because there are still many Surabaya people who have difficulty in using the e-tax system. In addition, the government must also make the e-tax system more user-friendly so that it will be more easily understood and applied by users.