Federated learning has a variety of applications in multiple domains by utilizing private training data stored on different devices. However, the aggregation process in federated learning is highly vulnerable to adversarial attacks so that the global model may behave abnormally under attacks. To tackle this challenge, we present a novel aggregation algorithm with residual-based reweighting to defend federated learning. Our aggregation algorithm combines repeated median regression with the reweighting scheme in iteratively reweighted least squares. Our experiments show that our aggregation algorithm outperforms other alternative algorithms in the presence of label-flipping, backdoor, and Gaussian noise attacks. We also provide theoretical guarantees for our aggregation algorithm.
The paper proposes an algorithm for mitigating poisoning attacks in federated learning settings and compares it , on four different datasets, against state-of-the-art baselines.
Except for some minor issues (see the list below), the paper is well-written and -organized. The description of the proposed algorithm (in pseudo code and using the illustration in Figure 2) is very clear. Overall, the experiments are carefully described.
My main concern is that many choices in the design of the proposed algorithm lack context/discussion and thus appear rather ad-hoc. For instance,
- Why is the repeated median estimator used for estimating the linear regression? Could other robust estimators have been used?
- Similarly, could alternative weighting schemes be used in equations (3)-(5)?
I think it's important to provide more context and discuss possible alternatives. An important element is the exact threat model that the authors are considering. E.g., in the last paragraph on page 4, the authors mention specific attack strategies like altering only 10% of the model parameters. It appears that the design of the model weighting scheme aims at defending against these specific types of attacks. It will be good to either discuss or evaluate empirically how this scheme performs against other strategies.
The theoretical guarantee in Section 3.2 is a bit sketchy in my opinion. In what sense is $\mu$ the "expected value of the global model"? I.e. what is the expectation over? Consequently, I could not follow the statement in equation (14). Some explanation in plain text is needed here, too: in what sense does this equation provide a guarantee?
In the experiments, several aspects deserve further discussion: (1) the poor performance of FoolsGold almost across the entire board (except for the Gaussian noise attacks), which may indicate that this method was applied outside the threat model it was designed for; (2) the failure of all the baselines on CIFAR-10 for the naive attacking approach, while they perform fairly well on MNIST; (3) why does the attack success rate starts increasing in Figure 4 for the baseline methods only after ~25 iterations? (4) why do the baseline methods perform so poorly against label-flipping against on MNIST (Figure 3) while performing fairly well on CIFAR-10 and Amazon reviews (Table 1/2)? - I think that answering those questions may shed insights into the type of attacks that the different defences can / cannot withstand. I'd also like to challenge the authors to address whether they expect their defence to match or outperform the baselines on *any* attack strategy, or whether they can come up with scenarios where some of the baselines perform better? I would expect that the latter should be possible; it would not diminish the value of the proposed defence but shed more clarity on its possible limitations.
List of minor issues:
- in the abstract: "aggression" -> "aggregation"
- p.1: I would omit the statement in brackets "less than 100 lines". 
- p.2: some of the related work discussion repeats content from the introduction
- p.3: "summaries" -> "summarizes"
- p.3: what does that mean: "has a high breakdown point of 50%"? Please explain/clarify.
- p.4: "is the k-the diagonal of matrix in Hn" -> "is the k-th diagonal element of the matrix Hn"
- p.4: my pdf reader couldn't render the binary operator on the right hand side of equation (8)
- p.5: "the details of the proof is presented" -> "are"
- p.8: "that of which" -> "whose"
- p.8: upper case "We" after comma
- p.8: first column "Acc" in Table 3: FedAvg has the highest accuracy. Generally, bold numbers in tables do not always mark the best-performing method. Sometimes, bold numbers are entirely missing. In cases where the difference is insignificant (which often appears to be the case) I would mark multiple numbers in bold, as appropriate.