Manh Cuong (Marcus) Dao

Federated Learning (FL) is a distributed learning mechanism that enables multiple clients to collaboratively train a global model (e.g. a neural network) while maintaining the privacy of their data. However, FL is susceptible to adversarial attacks, especially those involving poisoned samples. Despite significant research efforts, adversarial attacks and defenses in FL remain an unresolved issue. In this paper, we unravel a novel type of untargeted attack called the noisy data-based attack, which can evade almost all current state-of-the-art defenses. This attack involves transforming training data into noisy data, resulting in reduced accuracy of the global model. To address this issue, we propose a novel defense mechanism named NDAD, which uses a confidence score to evaluate the accuracy of a local model’s prediction on a client’s data. Our defense comprises two major components: a highly accurate algorithm for identifying malicious clients and an aggregation algorithm that optimizes beneficial knowledge from clients while avoiding the impact of poisoned data. The experimental results demonstrate that our proposed defense can detect malicious clients with a high detection accuracy of over 97%, even in challenging scenarios with a significantly high ratio of malicious clients. Furthermore, our proposed aggregation scheme improves the accuracy of the global model by an average of around 2%–3% and up to 4.75% in the best-case scenario compared to existing defenses on MNIST, CIFAR-10, and HAM10000 datasets.

Offline optimization has recently emerged as an increasingly popular approach to mitigate the prohibitively expensive cost of online experimentation. The key idea is to learn a surrogate of the black-box function that underlines the target experiment using a static (offline) dataset of its previous input-output queries. Such an approach is, however, fraught with an out-of-distribution issue where the learned surrogate becomes inaccurate outside the offline data regimes. To mitigate this, existing offline optimizers have proposed numerous conditioning techniques to prevent the learned surrogate from being too erratic. Nonetheless, such conditioning strategies are often specific to particular surrogate or search models, which might not generalize to a different model choice. This motivates us to develop a model-agnostic approach instead, which incorporates a notion of model sharpness into the training loss of the surrogate as a regularizer. Our approach is supported by a new theoretical analysis demonstrating that reducing surrogate sharpness on the offline dataset provably reduces its generalized sharpness on unseen data. Our analysis extends existing theories from bounding generalized prediction loss (on unseen data) with loss sharpness to bounding the worst-case generalized surrogate sharpness with its empirical estimate on training data, providing a new perspective on sharpness regularization. Our extensive experimentation on a diverse range of optimization tasks also shows that reducing surrogate sharpness often leads to significant improvement, marking (up to) a noticeable 9.6% performance boost.

Offline optimization is an important task in numerous material engineering domains where online experimentation to collect data is too expensive and needs to be replaced by an in silico maximization of a surrogate of the black-box function. Although such a surrogate can be learned from offline data, its prediction might not be reliable outside the offline data regime, which happens when the surrogate has narrow prediction margin and is (therefore) sensitive to small perturbations of its parameterization. This raises the following questions: (1) how to regulate the sensitivity of a surrogate model; and (2) whether conditioning an offline optimizer with such less sensitive surrogate will lead to better optimization performance. To address these questions, we develop an optimizable sensitivity measurement for the surrogate model, which then inspires a sensitivity-informed regularizer that is applicable to a wide range of offline optimizers. This development is both orthogonal and synergistic to prior research on offline optimization, which is demonstrated in our extensive experiment benchmark.