Machine learning with adversaries: byzantine tolerant gradient descent

TLDR

Distributed machine learning frameworks have largely ignored failures, especially arbitrary Byzantine ones caused by software bugs, network asynchrony, dataset biases, or attackers. The study investigates how resilient distributed SGD can be against up to f Byzantine workers without restricting dimensionality or parameter space size. The authors formulate a resilience property for aggregation rules and propose Krum, the first provably Byzantine‑resilient algorithm for distributed SGD that satisfies this property. They demonstrate that existing linear‑combination aggregation rules cannot tolerate even a single Byzantine failure and provide experimental evaluations showing Krum’s effectiveness.

Abstract

We study the resilience to Byzantine failures of distributed implementations of Stochastic Gradient Descent (SGD). So far, distributed machine learning frameworks have largely ignored the possibility of failures, especially arbitrary (i.e., Byzantine) ones. Causes of failures include software bugs, network asynchrony, biases in local datasets, as well as attackers trying to compromise the entire system. Assuming a set of n workers, up to f being Byzantine, we ask how resilient can SGD be, without limiting the dimension, nor the size of the parameter space. We first show that no gradient aggregation rule based on a linear combination of the vectors proposed by the workers (i.e, current approaches) tolerates a single Byzantine failure. We then formulate a resilience property of the aggregation rule capturing the basic requirements to guarantee convergence despite f Byzantine workers. We propose Krum, an aggregation rule that satisfies our resilience property, which we argue is the first provably Byzantine-resilient algorithm for distributed SGD. We also report on experimental evaluations of Krum.