# HyFL: A Hybrid Approach For Private
Federated Learning

Felix Marx  0000-0003-3899-3258 Thomas Schneider  0000-0001-8090-1316 Ajith
Suresh  0000-0002-5164-7758 Tobias Wehrle  0000-0002-1316-1001 Christian
Weinert  0000-0003-4906-6871 Hossein Yalame  0000-0001-6438-534X

###### Abstract

As a distributed machine learning paradigm, federated learning (FL) conveys a
sense of privacy to contributing participants because training data never
leaves their devices. However, gradient updates and the aggregated model still
reveal sensitive information. In this work, we propose HyFL, a new framework
that combines private training and inference with secure aggregation and
hierarchical FL to provide end-to-end protection and facilitate large-scale
global deployments. Additionally, we show that HyFL strictly limits the attack
surface for malicious participants: they are restricted to data-poisoning
attacks and cannot significantly reduce accuracy.

##  1 Introduction

Federated learning (FL) as proposed by Konečnỳ et al. (2016); McMahan et al.
(2017) is a leading paradigm in distributed machine learning; in a cross-
device setting, FL allows thousands or more clients to participate in a
training process. To improve  _scalability_ for large-scale deployments, also
hierarchical FL has been proposed Bonawitz et al. (2019); Lin et al. (2020);
Yang (2021), which layers multiple levels of aggregators.

One of the primary benefits of FL outlined in McMahan et al. (2017) is the
(perceived)  _privacy_ of training data and thus increased user engagement: as
participating clients train the model locally and transfer only gradient
updates to an aggregator, training data never leaves the clients’ devices.
However, it was shown that these gradient updates still leak a significant
amount of information Zhu et al. (2019); Geiping et al. (2020). Hence, _secure
aggregation_ protocols have been introduced that either ensure that a single
aggregator sees only blinded (or  _masked_) values Bonawitz et al. (2017);
Bell et al. (2020), use a distributed aggregator based on secure multi-party
computation (MPC) Fereidooni et al. (2021); Ben-Itzhak et al. (2022), or by
adding noise can guarantee differential privacy (DP) Ouadrhiri & Abdelhadi
(2022).

Unfortunately, there are still three pressing issues:

  1. P1

Malicious participants can perform  _attacks_ (e.g., backdoor Bagdasaryan et
al. (2020); Xie et al. (2020), model-poisoning Wang et al. (2020); Fang et al.
(2020), or data-poisoning attacks Biggio et al. (2012); Tolpegin et al.
(2020)) to manipulate the aggregated model.

  2. P2

Recently, serious concerns about privacy vulnerabilities when using secure
aggregation with a  _single_ aggregator have been raised So et al. (2021);
Boenisch et al. (2021; 2022); Fowl et al. (2022); Wen et al. (2022).

  3. P3

Research has shown that with unrestricted access to the aggregated model, it
is still possible to extract traces of the original training data Pasquini et
al. (2022); Boenisch et al. (2023).

##### Our Contributions

In this paper, we address all of the issues outlined above in a unified
framework called HyFL that enables private and robust distributed machine
learning at scale. Our framework is based on a novel abstraction that also
captures existing regular and hierarchical FL architectures in a  _hybrid_
manner. One key property of HyFL is that we achieve  _complete model privacy_.

Briefly, in our framework, FL participants use secret-sharing techniques to
securely outsource training data to  _distributed training clusters_ that are
based on MPC. The participants then might leave and only sporadically return
to provide more training data – this makes our framework robust against real-
world issues such as drop-outs, requires no interaction between clients, and
relieves resource-constraint (mobile or edge) devices from significant
workload. The trained models are then aggregated across all training clusters
using one or multiple levels of distributed aggregators. For secure
distributed aggregation, we again utilize MPC. Note that after aggregation,
models are not publicly released but in secret-shared form handed back to
training clusters for the next training iteration. After training is
completed, known secure inference protocols can be used to allow private
queries Mann et al. (2022) in a controlled (potentially rate-limited) way.
This architecture design addresses issues P2 and P3.

We observe that a neat property of our framework is the strictly limited
attack surface: malicious participants are restricted to data-poisoning
attacks as there is no possibility to access and manipulate the model itself.
We show experimentally that state-of-the-art data-poisoning attacks in the
suggested hierarchical configuration are less effective than in plain FL.
Furthermore, we implement and evaluate different robust aggregation schemes to
further mitigate the effect of such attacks; for this, we additionally propose
new heuristics that improve the efficiency for the corresponding MPC
implementation. This addresses issue P1.

Finally, we implement all HyFL components based on Meta’s CrypTen MPC
framework Knott et al. (2021) and evaluate the performance when training
neural networks for standard image classification tasks in realistic network
settings and using GPU-accelerated AWS EC2 instances.

In summary, we provide the following contributions:

  * $\bullet$

New scalable (hierarchical) FL framework called HyFL that achieves complete
model privacy, supports resource-limited mobile or edge devices, and
significantly limits the attack surface for malicious participants.

  * $\bullet$

Analysis of data-poisoning attacks by malicious participants with new
efficiency improvements for secure robust aggregation.

  * $\bullet$

Open-source implementation and evaluation of HyFL on standard image
classification tasks.

In Tab. 1, we furthermore clarify how HyFL distinguishes itself from related
works. In addition to this concise summary, we provide a detailed overview in
§A.3.

Table 1: Comparison of HyFL and previous works. Notations: Agg. – Aggregation,
$\mathcal{S}$ – Aggregation Server(s), $\mathcal{C}$ – Client, GM – Global
Model, LM – Local Model, MPC – Secure Multi-party Computation, HE –
Homomorphic Encryption, AHE – Additively HE, MHE – Multiparty HE, DP –
Differential Privacy. Since the body of literature is vast, comparison is made
against a subset representing each category (cf. §A.3 for details).

Categories |  Representative Work(s) | Method |  Privacy ($\mathcal{S}$) |  Privacy ($\mathcal{C}$) | Defense |  Cross Device |  No Client Interaction |  Dropout Handling
---|---|---|---|---|---|---|---|---
GM | LM | GM
Agg. (Plain) | McMahan et al. (2017) | – | ✗ | ✗ | ✗ | ✗ | ✓ | ✓ | ✓
Agg. (Robust) | Blanchard et al. (2017) | – | ✗ | ✗ | ✗ | ✓ | ✗ | ✓ | ✓
Yin et al. (2018) | – | ✗ | ✗ | ✗ | ✓ | ✓ | ✓ | ✓
Cao et al. (2021) | – | ✗ | ✗ | ✗ | ✓ | ✓ | ✓ | ✓
Secure Agg. (Single $\mathcal{S}$) | Bonawitz et al. (2017) | Masking | ✗ | ✓ | ✗ | ✗ | ✗ | ✗ | ✓
Phong et al. (2018) | AHE | ✓ | ✓ | ✗ | ✗ | ✗ | ✗ | ✗
Mandal & Gong (2019) | AHE | ✗ | ✓ | ✓ | ✗ | ✗ | ✓ | ✓
Secure Agg. (Multi $\mathcal{S}$) | Fereidooni et al. (2021) | MPC | ✓ | ✓ | ✗ | ✗ | ✓ | ✓ | ✓
Froelicher et al. (2021)$\ast$ | MHE | ✓ | ✓ | ✓ | ✗ | ✗ | ✗ | ✗
Sav et al. (2021)$\ast$ | MHE | ✓ | ✓ | ✓ | ✗ | ✗ | ✗ | ✗
Nguyen et al. (2022) | MPC | ✓ | ✓ | ✗ | ✓ | ✗ | ✓ | ✓
Hierarchical FL | Bonawitz et al. (2019) | Masking | ✗ | ✓ | ✗ | ✗ | ✓ | ✗ | ✓
Wang et al. (2021) | – | ✗ | ✗ | ✗ | ✗ | ✓ | ✓ | ✓
Yang (2021) | DP | ✗ | ✓ | ✗ | ✗ | ✓ | ✓ | ✓
Hybrid FL (HyFL) | This work | MPC | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓

  * •

$\ast$ Represents collaborative learning in the $N$-party setting, rather than
the Federated Learning (FL) setting.

##  2 HyFL Framework

We now present the details of our HyFL framework, which aims to address
multiple key requirements: complete model privacy, scalability, support for
resource-constraint (mobile/edge) devices, reduction of attack surface,
ability to defend against multiple remaining threats, and high levels of user
engagement. Additionally, our framework seeks to capture various proposed
architectures for FL in a single abstraction. We illustrate our framework in
Fig. 1 and detail the underlying algorithm in Alg. 1.

$\mathcal{G}$$\mathcal{M}_{1}$$\mathcal{M}_{\mathsf{N}_{\mathcal{M}}}$$\mathcal{C}_{1}$$\mathcal{C}_{\mathsf{N}_{\mathcal{M}}}$
Layer I: Global Servers
$\mathsf{GS}_{i}\in\mathcal{G};i\in[\mathsf{N}_{\mathcal{G}}]$ Layer II: MPC
Clusters
$\mathsf{CS}_{i}^{j}\in\mathcal{M}_{i};i\in[\mathsf{N}_{\mathcal{M}}],j\in[\mathsf{N}_{\mathcal{M}_{i}}]$
Layer III: Clients
$\mathsf{C}_{i}^{j}\in\mathcal{C}_{i};i\in[\mathsf{N}_{\mathcal{M}}],j\in[\mathsf{N}_{\mathcal{C}_{i}}]$
Training Data Adversary $\mathcal{A}$ MPC Server (Cluster) Private ML Training
Cluster Models MPC Server (Global) Secure Aggregation Aggregated ML Model

Figure 1: Three-layer architecture in HyFL for federated training of a machine
learning model.

###  2.1 HyFL Architecture

Our HyFL framework is based on a three-layer architecture and extends the
established hierarchical FL paradigm Bonawitz et al. (2019); Lin et al.
(2020); Yang (2021). In hierarchical FL, clients are initially organized into
clusters, and their data is aggregated at cluster level. This cluster-level
data is then further aggregated globally, resulting in an additional layer of
aggregation.

We pursue a hierarchical approach as it facilitate large-scale deployments:
Firstly, it can effectively model the taxonomy of trust among clients in real-
world scenarios, such as trust among members of the same region or country
Marti & Garcia-Molina (2006). Secondly, it distributes the workload among
multiple clusters instead of relying on a central aggregator. Furthermore,
this type of hierarchy is ubiquitous in real-world scenarios such as P2P
gaming, organizations, and network infrastructures Subramanian et al. (2002);
Hong & Varghese (2019); Lin et al. (2020).

HyFL utilizes a different approach for model training than prior works: they
involve interactive collaboration among clients to preserve privacy during
model training and thus are costly for a large number of clients Sav et al.
(2021). Another existing method is pairwise training among clients and a
representative, followed by an aggregation step similar to FL Mandal & Gong
(2019); however, this approach only preserves privacy among clients and not
against the aggregator, assuming no collusion to violate privacy.

We provide details for each layer in HyFL next. We focus on the sequence of
operations performed by the entities in our architecture (cf. Fig. 1) for a
training over $T$ iterations while considering necessary MPC protocols and
setup requirements. Since we have a generic design, MPC protocols are
abstracted and their specifics are given in Tab. 6 in §B.1. The notations used
in HyFL are listed in Tab. 2.

Table 2: Notations (Nota.) used in our HyFL framework.
Nota. | Description
---|---
MPC | Secure Multi-Party Computation
$\mathcal{G}$ | Set of Global MPC Servers.
$\mathcal{M}_{i}$ |  Set of MPC Servers in the $i$-th cluster.
$\mathcal{C}_{i}^{\sf U}$ |  Set of Clients in the $i$-th cluster.
$\mathcal{C}_{i}$ |  Selected Clients in the $i$-th cluster.
$\mathsf{N}_{s}$ |  Size of the set $s\in\\{\mathcal{G},\mathcal{M}_{i},\mathcal{C}_{j}\\}$.
$\mathsf{N}_{\mathcal{M}}$ | Total number of clusters.
$W_{t}$ |  Global model available at round $t$.
$\mathsf{GS}_{i}$ |  Layer I MPC Global Server; $\mathsf{GS}_{i}\in\mathcal{G}$.
$\mathsf{CS}_{i}^{j}$ |  Layer II MPC Cluster Server; $\mathsf{CS}_{i}^{j}\in\mathcal{M}_{i}$. Here, $i\in[\mathsf{N}_{\mathcal{M}}],j\in[\mathsf{N}_{\mathcal{M}_{i}}]$
$\mathsf{C}_{i}^{j}$ |  Layer III Client; $\mathsf{C}_{i}^{j}\in\mathcal{C}_{i}$, $i\in[\mathsf{N}_{\mathcal{M}}],j\in[\mathsf{N}_{\mathcal{C}_{i}}]$
${\langle\cdot\rangle}_{s}$ |  Secret sharing semantics for $s\in\\{\mathcal{G},\mathcal{M}_{j}\\}$.
PPML | Privacy-Preserving Machine Learning

####  2.1.1 Layer III: Clients

This layer is composed of $\mathsf{N}_{\mathcal{M}}$ distinct sets of clients
$\mathcal{C}_{i}^{\sf U}$ (with $i\in[\mathsf{N}_{\mathcal{M}}]$), called
_clusters_ , which are formed based on specific criteria relevant to the
application (e.g., European Union (EU) member states for EU smart metering
scheme Cuijpers & Koops (2013); Commission (2014)). Similar to standard FL,
only a random subset of clients, denoted by
$\mathcal{C}_{i}\subseteq\mathcal{C}_{i}^{\sf U}$, will be selected by the
training algorithm in an iteration $t\in[1,T]$.

During iteration $t$, each client $\mathsf{C}_{i}^{j}\in\mathcal{C}_{i}$ (with
$j\in[\mathsf{N}_{\mathcal{C}_{i}}]$) holding data
${D}_{t}^{\mathsf{C}_{i}^{j}}$ uses the Share protocol to securely distribute
its data to a set of cluster servers $\mathcal{M}_{i}$. As detailed in §2.1.2,
$\mathcal{M}_{i}$ constitute a representative group of high-performance
servers that clients have a sufficient level of trust in. HyFL allows clients
to share input and then leave at any time. They can also rejoin the system
later and provide additional data in the next iteration they get selected.
Hence, the clusters $\mathcal{C}_{i}^{\sf U}$ are dynamic and change with each
iteration.

Our method differs from the standard concept of “data residing at the clients”
in FL, but we expect it to not negatively impact user engagement as data
remains within the users’ trust zone. Additionally, the reduced computational
load allows for the use of resource-constrained devices in training complex
models and eliminates the need for shared-key setup among clients, making it
easier to handle dropouts.

####  2.1.2 Layer II: MPC Clusters

The second layer consists of $\mathsf{N}_{\mathcal{M}}$ sets of distributed
training servers $\mathcal{M}_{i}$ (with $i\in\mathsf{N}_{\mathcal{M}}$),
called  _MPC clusters_ , with each $\mathcal{M}_{i}$ corresponding to the
cluster $\mathcal{C}_{i}^{\sf U}$ in Layer III. In iteration $t$, Layer I
servers (denoted by $\mathcal{G}$) initiate ML training by sharing the current
global model $W_{t-1}$ among servers in $\mathcal{M}_{i}$. As will be
discussed in §2.1.3, $W_{t-1}$ is also in a secret-shared form among
$\mathcal{G}$, represented by ${\langle W_{t-1}\rangle}_{\mathcal{G}}$. To
account for varying availability and trustworthiness of servers across
regions, MPC clusters in HyFL may use different MPC configurations and differ,
e.g., in their corruption threshold and security model Evans et al. (2018).
Therefore, $\mathcal{G}$ uses the Reshare protocol to convert the secret
shares of ${\langle W_{t-1}\rangle}_{\mathcal{G}}$ to those of
$\mathcal{M}_{i}$, i.e., ${\langle W_{t-1}\rangle}_{\mathcal{M}_{i}}$.

Given ${\langle W_{t-1}\rangle}_{\mathcal{M}_{i}}$, servers in
$\mathcal{M}_{i}$ use Train to employ MPC-based PPML techniques for private ML
training Knott et al. (2021); Keller & Sun (2022) on the cumulative data from
all clients in the cluster $\mathcal{C}_{i}$, denoted by
${\langle{D}_{t}\rangle}_{\mathcal{M}_{i}}$. This data may include leftover
data from the same cluster in the previous iteration. Furthermore, by
utilizing a larger pool of training data, we can leverage the known benefits
of batching, resulting in faster convergence Goyal et al. (2017); Bottou et
al. (2018). After completing training, servers in $\mathcal{M}_{i}$ utilize
Reshare to secret-share the updated model with the Layer I servers, i.e.,
${\langle W_{t}^{i}\rangle}_{\mathcal{G}}$.

To preserve the system’s integrity, the servers for each MPC cluster must be
chosen with care to ensure that clients are willing to share their data among
the servers and that not all of the servers are colluding. One possible option
is to build non-profit partnerships, such as in the MOC alliance Zink et al.
(2021), where organizations with mutual distrust can securely co-locate
servers in the same data center with high-speed network connections.
Alternatively, trusted entities like government organizations with limited
infrastructure can host their servers in confidential cloud computing
environments Russinovich et al. (2021).

####  2.1.3 Layer I: Global Servers

The top layer consists of a set of MPC servers $\mathcal{G}$, named  _Global
Servers_ , that  _securely_ aggregate trained models from all the MPC clusters
in Layer II, similarly to a standard FL scheme with a distributed aggregator
Fereidooni et al. (2021). Concretely, given the locally trained models
$W_{t}^{i}$ for $i\in[\mathsf{N}_{\mathcal{M}}]$, servers in $\mathcal{G}$
execute the secure aggregation protocol Agg Mansouri et al. (2023) to compute
the updated global model in secret-shared form, i.e., ${\langle
W_{t}\rangle}_{\mathcal{G}}$. Global servers $\mathcal{G}$ use the Reshare
protocol to distribute the aggregated model $W_{t}$ to each of the Layer II
clusters $\mathcal{M}_{i}$ to start the next iteration ($t+1$).

#### HyFL - The Complete Picture

Alg. 1 provides the model training algorithm in HyFL. Though HyFL has a three-
layer architecture, it can easily accommodate more levels of hierarchy
depending on the size of the deployment. For this, additional layers of MPC
clusters can be added between layers I and II, with the clusters performing
secure aggregation instead of PPML training. Existing schemes for global model
privacy, such as Mandal & Gong (2019) and Fereidooni et al. (2021), only
protect the model from either clients or aggregator servers, leaving the
possibility of collusion especially in a cross-device setting. HyFL addresses
this issue by keeping the global model in a secret-shared fashion, ensuring
that no single entity or group of colluding entities (up to an allowed
corruption threshold) can access the model. This provides a stronger sense of
privacy and also protection against unauthorized use or misuse, such as a
client disclosing the trained model to another organization for further
training or commercial use.

Algorithm 1 HyFL (Training)

0: $\mathcal{G},\mathcal{M},\mathcal{C}$ #
$\mathcal{M}=\bigcup_{i}\mathcal{M}_{i}$,
$\mathcal{C}=\bigcup_{i}\mathcal{C}_{i}$; $i\in\mathsf{N}_{\mathcal{M}}$

0: $W_{0}$, $\\{{D}^{\mathsf{C}}\\}_{\mathsf{C}\in\mathcal{C}}$ # $W_{0}$ –
initial model, ${D}$ – client $\mathsf{C}$’s data

0: ${\langle W_{T}\rangle}$ # $W_{T}$ – global model after $T$ iterations

1: initialize: ${\langle
W_{0}\rangle}_{\mathcal{G}}\leftarrow\textsc{Share}(W_{0},\mathcal{G})$

2: for each training iteration $t\in[1,T]$ do

3: for all $i\in\mathsf{N}_{\mathcal{M}}$ do # in parallel

4: ${\langle
W_{t-1}\rangle}_{\mathcal{M}_{i}}\leftarrow\mathcal{G}.\textsc{Reshare}({\langle
W_{t-1}\rangle}_{\mathcal{G}},\mathcal{M}_{i})$

5:
$\mathcal{C}_{i}\leftarrow\mathcal{M}_{i}.\textsc{Sample}(\mathcal{C}_{i}^{\sf
U},t)$# $\mathcal{C}_{i}^{\sf U}$ – total clients in $i$-th cluster

6: for all $j\in[\mathsf{N}_{\mathcal{C}_{i}}]$ do # in parallel

7:
${\langle{D}_{t}^{\mathsf{C}_{i}^{j}}\rangle}_{\mathcal{M}_{i}}\leftarrow{\mathsf{C}_{i}^{j}}.\textsc{Share}({D}_{t}^{\mathsf{C}_{i}^{j}},\mathcal{M}_{i})$

8: end for

9:
${\langle{D}_{t}\rangle}_{\mathcal{M}_{i}}\leftarrow\bigcup\limits_{j\in[\mathsf{N}_{\mathcal{C}_{i}}]}{\langle{D}_{t}^{\mathsf{C}_{i}^{j}}\rangle}_{\mathcal{M}_{i}}\bigcup{\langle{D}_{t-1}\rangle}_{\mathcal{M}_{i}}$#
${D}_{0}=\emptyset$

10: ${\langle
W_{t}^{i}\rangle}_{\mathcal{M}_{i}}\leftarrow{\mathcal{M}_{i}}.\textsc{Train}({\langle
W_{t-1}\rangle}_{\mathcal{M}_{i}},{\langle{D}_{t}\rangle}_{\mathcal{M}_{i}})$

11: ${\langle
W_{t}^{i}\rangle}_{\mathcal{G}}\leftarrow{\mathcal{M}_{i}}.\textsc{Reshare}({\langle
W_{t}^{i}\rangle}_{\mathcal{M}_{i}},\mathcal{G})$

12: end for

13: ${\langle
W_{t}\rangle}_{\mathcal{G}}\leftarrow{\mathcal{G}}.\textsc{Agg}(\\{{\langle
W_{t}^{i}\rangle}_{\mathcal{G}}\\}_{i\in[\mathsf{N}_{\mathcal{M}}]})$

14: end for

###  2.2 Private Inference in HyFL

In HyFL, after the defined number of training iterations $T$ are completed,
the MPC clusters begin to function as clusters for ML inference. Here, we
again utilize PPML techniques to enable clients to query their clusters in a
privacy-preserving way Knott et al. (2021); Mann et al. (2022). Consider the
scenario where client $\mathsf{C}$ holding query ${Q}$ wants to use the
inference service on a model $W$ that is secret shared with a cluster
$\mathcal{M}_{k}$. This is accomplished by $\mathsf{C}$ generating
${\langle{Q}\rangle}_{\mathcal{M}_{k}}$ using Share, followed by cluster
servers in $\mathcal{M}_{k}$ invoking Predict on ${\langle
W\rangle}_{\mathcal{M}_{k}}$ and ${\langle{Q}\rangle}_{\mathcal{M}_{k}}$ to
generate the inference result in secret-shared form. Finally,
$\mathcal{M}_{k}$ reveals the result to $\mathsf{C}$ using Reveal protocol.

###  2.3 Abstraction of Existing FL Schemes

Our three-layer HyFL architecture (cf. Fig. 1) consolidates many existing FL
frameworks (cf. Tab. 3). This abstraction simplifies comparisons and
facilitates advanced hybrid designs, such as incorporating differential
privacy.

Standard FL with a single aggregator (Single $\mathcal{S}$) McMahan et al.
(2017) is a variant of HyFL, where each Layer III cluster $\mathcal{C}_{i}$
consists of only one client that also serves as the MPC cluster server
$\mathcal{M}_{i}$ in Layer II. Thus, it is sufficient to conduct ML training
without privacy concerns and then send the results to a single global server
$\mathcal{G}$ in Layer I for aggregation. The case of distributed aggregators
(Multi $\mathcal{S}$) Fereidooni et al. (2021) follows similarly, except
secure aggregation being performed at Layer I with multiple
($\mathsf{N}_{\mathcal{G}}>1$) global servers. Finally, existing hierarchical
FL schemes Yang (2021) share a similar three-layer architecture with HyFL, but
have a single server at both the global and cluster level
($\mathsf{N}_{\mathcal{G}}=1$, $\mathsf{N}_{\mathcal{M}_{i}}=1$). While HyFL
employs PPML training at the cluster-server level, hierarchical FL uses secure
aggregation. Additionally, clients in the hierarchical FL approach perform
local model training, as opposed to data sharing in HyFL.

Table 3: Abstraction of existing FL schemes (cf. Tab. 1) using our HyFL
architecture (cf. Fig. 1). $\mathcal{S}$ denotes aggregation server(s), S.Agg.
denotes secure aggregation, and (S.)Agg. marks secure aggregation as optional.
See Tab. 2 for other notations.
Scheme | Layer I | Layer II | Layer III | Remark
---|---|---|---|---
Aggregation (Single $\mathcal{S}$) | $\mathsf{N}_{s}$ | $\mathsf{N}_{\mathcal{G}}=1$ | $\mathsf{N}_{\mathcal{M}_{i}}=1$ | $\mathsf{N}_{\mathcal{C}_{i}}=1$ | $\mathcal{M}_{i}=\mathcal{C}_{i}$
Role | (S.)Agg. | ML Training
Aggregation (Multi $\mathcal{S}$) | $\mathsf{N}_{s}$ | $\mathsf{N}_{\mathcal{G}}>1$ | $\mathsf{N}_{\mathcal{M}_{i}}=1$ | $\mathsf{N}_{\mathcal{C}_{i}}=1$ | $\mathcal{M}_{i}=\mathcal{C}_{i}$
Role | S.Agg. | ML Training
Hierarchical FL | $\mathsf{N}_{s}$ | $\mathsf{N}_{\mathcal{G}}=1$ | $\mathsf{N}_{\mathcal{M}_{i}}=1$ | $\mathsf{N}_{\mathcal{C}_{i}}>1$ | $\mathcal{M}_{i}\neq\mathcal{C}_{i}$
Role | (S.)Agg. | (S.)Agg. | ML Training
Hybrid FL (HyFL) This Work | $\mathsf{N}_{s}$ | $\mathsf{N}_{\mathcal{G}}>1$ | $\mathsf{N}_{\mathcal{M}_{i}}>1$ | $\mathsf{N}_{\mathcal{C}_{i}}>1$ | $\mathcal{M}_{i}\neq\mathcal{C}_{i}$
Role | S.Agg. | PPML Training | Data Sharing

##  3 Performance Evaluation

We evaluate the practical performance of HyFL in terms of computation and
communication overhead empirically.

##### Implementation

We implement HyFL based on the CrypTen framework developed by Meta Knott et
al. (2021). CrypTen provides a TensorFlow/PyTorch-style interface but
implements operations based on secure multi-party computation (MPC) with GPU
support. Specifically, CrypTen implements semi-honest arithmetic and Boolean
two- and multi-party protocols that use a third “helper” party to generate
correlated randomness. CrypTen provides a “simulation” mode where the
specified computation is performed on a single node in plaintext yet simulates
all effects that computation in MPC would have on the results (e.g., due to
limited fixed-point precision and trunction). We leverage this mode to
efficiently evaluate HyFL accuracy and later the impact of data-poisoning
attacks; yet we run the full MPC computation to obtain realistic run-time and
communication measurements. In all our experiments, the fixed-point precision
in CrypTen is set to 22 decimal bits (the maximum developer-recommended
number).

We use CrypTen to implement (I) private training on Layer II and (II)
distributed aggregation on Layer I. CrypTen out of the box supports private
inference between Layer II and III, which, however, is not the focus of our
evaluation. We extend CrypTen with an identity layer to enable model
conversions and re-sharing. Additionally, we extend the implementation of
convolutional layers to enable full GPU-accelerated training for such model
architectures. Moreover, we provide the necessary code to orchestrate the
various parties and components, thereby creating a unified simulation
framework.

##### Setup

Plaintext FL and CrypTen-based HyFL  _simulations_ are run on a single
computing platform equipped with two Intel Xeon Platinum 8168 CPUs, 1.5TB RAM,
and 16 NVIDIA Tesla V100 GPUs. To provide realistic results for a
_distributed MPC deployment_ with two computational and one helper party, we
use three Amazon AWS g3s.xlarge instances with 4 vCPUs, and 8GB GPU memory on
a NVIDIA Tesla M60. These instances are located in the same AWS availability
zone (due to high costs associated with routing traffic between different
zones), yet we simulate intra- and inter-continental network connections by
setting the bandwidth and latency to 1Gbps/100Mbps and 20ms/100ms,
respectively.

##### Tasks

Following prior work Ben-Itzhak et al. (2022), we evaluate HyFL on two
standard image classification tasks: recognizing (I) hand-written digits using
LeNet trained on MNIST LeCun et al. (1998) and (II) objects in one of 10
classes using ResNet9 trained on CIFAR10 Krizhevsky (2009). We simulate 1000
clients from which 100 are randomly selected per round. For plain FL, we use
batch size 8 and learning rate 0.005, and train locally for 5 epochs before
central aggregation. For HyFL, we simulate 10 Layer II clusters that use a
correspondingly  _scaled_ batch size of 80 and a learning rate of 0.05 Goyal
et al. (2017).

##### Overview

Using the implementation and setups described above, we run an empirical
accuracy evaluation to answer the following questions:

  1. Q1

What is the accuracy difference between FL McMahan et al. (2017) and HyFL (in
plaintext)?

  2. Q2

What is the impact on accuracy for HyFL when moving from plaintext to
(simulated) MPC?

  3. Q3

What are the run-time and communication overheads of (MPC-based) HyFL compared
to FL?

In the following, we describe how we answer the individual questions and
discuss our results.

##### Q1 – FL vs HyFL

In Fig. 2, we compare the validation accuracy of FL and HyFL for image
classification tasks for 500 rounds. Here, we note that HyFL converges
significantly faster than regular FL, e.g., after 500 rounds of training
ResNet9 on CIFAR10, HyFL reaches 85.68% validation accuracy, whereas regular
FL only reaches 65.95%. We attribute this to HyFL pooling training data at
cluster level and thus being able to exploit the known benefits of batching
Goyal et al. (2017); Bottou et al. (2018). Plots for up to 2000 epochs can be
found in Fig. 6 in App. B.2.3.

Figure 2: Validation accuracy for FL and HyFL for 500 iterations (top:
LeNet/MNIST, bottom: ResNet9/CIFAR10).

##### Q2 – Impact of MPC

In Fig. 3, we compare the plaintext validation accuracy (cf. Q1) to our
CrypTen simulation to measure the impact of MPC (i.e., fixed-point
representation with 22 bit decimal representation and truncation). Here, we
can only provide results for LeNet/MNIST, as ResNet9 training on GPU in
CrypTen is currently not supported due to limitations in the backward pass
implementation. While there is a slight difference in initial rounds, both
implementations quickly converge to almost the same validation accuracy, with
only a small difference on the order of 0.1%.

Figure 3: Validation accuracy for FL and HyFL in plaintext and MPC (CrypTen
simulation) for LeNet/MNIST training.

##### Q3 – MPC Overhead

Finally, we study the overhead of MPC for secure training and aggregation. For
this, we measure the run-times and communication for one iteration of
LeNet/MNIST training (i.e., 5 local epochs) in AWS for one cluster (with 1Gbps
bandwidth and 20ms latency) and one iteration of global aggregation (with
100Mbps bandwidth and 100ms latency). The training on cluster level takes
315.17s and requires 5279.25MB inter-server communication, which is multiple
orders of magnitude overhead compared to local plaintext training in PyTorch
(which only takes 0.07s). The aggregation over 10 cluster inputs is very
efficient with 0.023s run-time and has no communication overhead since only
linear operations are required, which can be conducted locally over shares in
MPC.

Additional overhead that must be considered for clients is sharing data with
the training cluster servers. In our setup, clients on expectation have to
upload 3.31MB and 9.86MB in total for 500 rounds of training for MNIST and
CIFAR10, respectively. Furthermore, we have to account for sharing the trained
models from training clusters to the aggregation servers. Given the number of
model parameters and CrypTen sharing semantics, each training cluster must
transfer 0.49MB and 39.19MB per server for LeNet and ResNet9, respectively.
This clearly shows that it is significantly more efficient for participants to
upload their training data in secret-shared form compared to down- and
uploading model parameters for each training round. Note that in our
evaluation setup, training clusters and the aggregation layer use the same MPC
configuration, hence no interactive re-sharing is necessary.

##  4 Attacks

Malicious FL participants can try to manipulate the global model to either
produce specific outputs for specific inputs or simply degrade the overall
accuracy. These attacks are referred to as backdoor Bagdasaryan et al. (2020);
Xie et al. (2020) and poisoning attacks Tian et al. (2022), respectively. In
terms of poisoning attacks, the two options are to perform data poisoning
Biggio et al. (2012); Tolpegin et al. (2020) or model poisoning Wang et al.
(2020); Fang et al. (2020). Since models in our setting are not available to
clients at any time, malicious participants are  _inherently_ limited to
manipulate the training data they provide. This rules out the entire class of
more powerful model-poisoning attacks Bhagoji et al. (2019). Hence, we
evaluate the the effectiveness of state-of-the-art data-poisoning attacks in
the HyFL setting as well as possible mitigations.

###  4.1 Data-Poisoning Attacks

In data-poisoning attacks, malicious clients can perform arbitrary
manipulations to the training data. State-of-the-art attacks are based on
label flipping, where clients keep the legitimate training samples, yet
exchange the associated labels according to different strategies.

Specifically, we consider the following attacks (cf. App. §B.2): random (RLF),
static (SLF), dynamic (DLF), and targeted (TLF) label flipping. RLF changes
the labels of samples at random Xiao et al. (2012). In SLF, labels are swapped
following a fixed assignment Fang et al. (2020); Shejwalkar et al. (2022). In
DLF, the attacker trains a surrogate model locally; this is then used to flip
the label of each sample to the least probable output and thus can be
considered the most powerful attack Shejwalkar et al. (2022). Finally, TLF
changes all labels from a source class to a specified target class Tolpegin et
al. (2020).

###  4.2 Robust Aggregation Schemes

The most common FL aggregation scheme is “FedAvg”, which simply computes a
(weighted) average of all inputs (cf. App. A.3). In contrast, _robust_
aggregation schemes detect and then exclude outliers, and are thus a suitable
mitigation against data poisoning. An overview of such schemes is given in
Shejwalkar et al. (2022). From the surveyed schemes, we identify “FLTrust” Cao
et al. (2021) and “Trimmed Mean” (TM) Yin et al. (2018) as the most MPC-
efficient ones.

_FLTrust_ assumes the aggregator has access to a clean training set and can
train the global model of the previous iteration on that; then it measures the
cosine similarity of the own training result against the inputs of
participants and excludes the least similar ones.

_Trimmed Mean_ for each coordinate computes the mean across the provided
gradient updates and excludes the values that deviate the most in either
direction of the mean. For our experiments, the number of excluded coordinates
corresponds to the maximum assumed poison rate in the system (e.g., when
assuming at most 20% of clients are corrupted, we discard the top and bottom
20%). Performing this aggregation obliviously in MPC requires implementing
costly sorting to determine the ranking in each coordinate.

We observe that, intuitively, data poisoning in contrast to model poisoning
does not result in specific coordinates producing extreme outliers. Hence, we
propose a heuristic “Trimmed Mean Variant” that computes the mean and ranking
only for a small  _randomly sampled subset_ of coordinates. Then, during
aggregation, it excludes those gradient updates that occurred the most as
outliers in the sample. We detail the algorithm of our variant in Alg. 2.

Algorithm 2 Our Trimmed Mean (TM) Variant in HyFL

0: $\mathcal{W}=\\{W^{i}\\}_{i\in[\mathsf{N}_{\mathcal{M}}]}$, ${\alpha}$,
${\beta}$, ${\gamma}$ # ${\gamma}=|W^{i}|$, ${\alpha}$ – trim threshold,
${\beta}$ – sample size

0: ${\langle W_{AGG}\rangle}$ # aggregated model after removing outliers

1: initialize: $\mathcal{Z}\leftarrow\emptyset$ # set of outliers

2: $\mathcal{I}\leftarrow$ sample random ${\beta}$ indices from
$[1,{\gamma}]$.

3: $\mathcal{U}\leftarrow\textsc{TM-List}(\mathcal{W}^{\mathcal{I}},{\alpha})$
# $\mathcal{W}^{\mathcal{I}}$–Truncated $\mathcal{W}$ with only indices in
$\mathcal{I}$, TM-List performs Trimmed Mean algorithm and returns $2{\alpha}$
outlier values (top and bottom ${\alpha}$) for each index in $\mathcal{I}$,
$|\mathcal{U}|=2{\alpha}{\beta}$

4: $\mathcal{V}\leftarrow\textsc{TopK-Hitter}(\mathcal{U},2{\alpha})$ #
returns list of $2{\alpha}$ indices that occur most frequently in
$\mathcal{U}$

5: for all $i\in\mathcal{V}$ do

6: $\mathcal{Z}\leftarrow\mathcal{Z}\bigcup\\{W^{i}\\}$

7: end for

8: ${\langle
W_{AGG}\rangle}\leftarrow\textsc{Agg}(\mathcal{W}\setminus\mathcal{Z})$

###  4.3 Evaluation

We now empirically evaluate the impact of data-poisoning attacks on HyFL
considering different (robust) aggregation schemes. For this, we implement all
four attacks in our framework and add CrypTen-based implementations of the
three robust aggregation schemes. Using the setup described in §3, we want to
answer the following questions:

  1. Q4

What is the impact of data-poisoning attacks on the accuracy of FL and HyFL
using FedAvg and robust aggregation schemes?

  2. Q5

What is the run-time and communication overhead for different robust
aggregation schemes in MPC?

  3. Q6

How does our TM variant compare to regular TM w.r.t. accuracy and MPC
performance.

##### Q4 – Attack Impact

For our evaluation, we consider three poison rates (0.01, 0.1, 0.2) and
distributions of attackers: in the  _equally-distributed_ setting, we assume
that on expectation each cluster has the same number of malicious clients; in
the  _focused_ setting, we assume that malicious clients are concentrated on
as few clusters as possible while there is still an honest majority in each
cluster (a standard assumption in FL); finally, in the  _cluster-focused_
setting, we see what happens if we lift the honest-majority assumption and
concentrate all malicious clients in as few clusters as possible. In Fig. 4,
we study the effectiveness of the most powerful DLF data-poisoning attack on
both regular FL and HyFL when training ResNet9 on CIFAR10 in the equally
distributed and focused setting. Results for less powerful attacks, the
unrealistic cluster-focused setting, and training of LeNet on MNIST can be
found in App. B.2.4.

Figure 4: Validation accuracy for FL and HyFL with FedAvg, FLTrust, and
trimmed mean as aggregation schemes under DLF attack for three different
poison rates (top: equally distributed, bottom: focused setting).

For the fairly aggressive 0.2 poison rate, we see in both visualized attacker
distributions a significant negative impact of the DLF attack on FL when using
FedAvg with drops below 30% accuracy. However, these can be successfully
mitigated with robust aggregation schemes. While there is also negative impact
on HyFL, especially in the focused setting, the accuracy even with FedAvg
never drops below that of FL. And even though robust aggregation schemes help
to slightly smoothen the curve, we conclude that  _applying defenses in HyFL
against data-poisoning attacks can be considered optional but not strictly
necessary_.

##### Q5 – Robust Aggregation in MPC

We evaluate the run-time and communication overhead of our FLTrust and TM
implementation in CrypTen in Tab. 4. The run-time overhead for both robust
aggregation schemes compared to FedAvg is four to five orders of magnitude.
Also, FLTrust requires 5$\times$ more run-time and communication than TM.
Given that both produce fairly similar results when applied to HyFL, the
overhead for FLTrust seems not warranted.

Table 4: Communication (Comm.) and run-time (Time) for various aggregation schemes in CrypTen. Parameter | FedAvg | Trimmed Mean | FLTrust
---|---|---|---
Comm. (in MB) | 0 | 1021.59 | 5329.19
Time (in s) | 0.023 | 326.57 | 1713.44

##### Q6 – Trimmed Mean Variant

In Fig. 5, we additionally compare the effectiveness of our TM variant to the
original TM Yin et al. (2018) for three sample sizes (10, 100, and 1000). It
turns out that our heuristic approach barely reduces the effectiveness, even
with aggressive parameters. In fact, in the focused setting, the TM variant
outperforms the original. This is because our variant completely excludes
gradient updates of (poisoned) outliers, whereas in regular trimmed mean,
those poisoned updates might still be considered for some coordinates. Results
for all other settings are presented in App. B.2.5.

Figure 5: Effectiveness of trimmed mean (TM) and our variant (with sample
sizes 10, 100, and 1000) against focused DLF attacks on HyFL at 0.2 poison
rate for ResNet9/CIFAR10 training.

In Tab. 5, we also provide run-times and communication results for our
optimizations. Compared to the original with 1021.59MB of communication, we
can see an improvement by two orders of magnitude with a communication of
11.90MB for the variant with 100 random samples. However, we see a higher and
fairly stable run-time across all three examined variants. This is because the
algorithm for determining the overall ranking of outliers across coordinates
increases the number of MPC communication rounds compared to the original. In
the studied inter-continental WAN setting, this has severe impact but does not
correspond to actual compute time.

Table 5: Communication (Comm.) and run-time (Time) for our TM variant with sample sizes 10, 100, and 1000 in CrypTen. Parameter | TM-10 | TM-100 | TM-1000
---|---|---|---
Comm. (in MB) | 9.69 | 11.90 | 33.94
Time (in s) | 558.05 | 558.26 | 561.50

Overall, if HyFL is combined with a robust aggregation scheme, our TM variant
offers an excellent trade-off between accuracy and MPC overhead compared to
significantly more expensive FLTrust and the original TM.

##  5 Conclusion

In this work, we presented HyFL, a novel unified abstraction and framework for
(hierarchical) federated learning that provides complete model privacy, faster
convergence, smaller attack surface and better resilience against poisoning
attacks than regular FL.

As part of future work, we plan to investigate potential further performance
improvements by incorporating quantization techniques for private training
Keller & Sun (2022) and secure aggregation Ben-Itzhak et al. (2022).

## References

  * Acar et al. (2018) Abbas Acar, Hidayet Aksu, A. Selcuk Uluagac, and Mauro Conti.  A Survey on Homomorphic Encryption Schemes: Theory and Implementation.  _ACM Computing Surveys_ , 2018.
  * Bagdasaryan et al. (2020) Eugene Bagdasaryan, Andreas Veit, Yiqing Hua, Deborah Estrin, and Vitaly Shmatikov.  How To Backdoor Federated Learning.  In _AISTATS_ , 2020.
  * Bell et al. (2020) James Henry Bell, Kallista A. Bonawitz, Adrià Gascón, Tancrède Lepoint, and Mariana Raykova.  Secure Single-Server Aggregation with (Poly)Logarithmic Overhead.  In _CCS_ , 2020.
  * Ben-Itzhak et al. (2022) Yaniv Ben-Itzhak, Helen Möllering, Benny Pinkas, Thomas Schneider, Ajith Suresh, Oleksandr Tkachenko, Shay Vargaftik, Christian Weinert, Hossein Yalame, and Avishay Yanai.  ScionFL: Secure Quantized Aggregation for Federated Learning.  _CoRR_ , 2022.
  * Bhagoji et al. (2019) Arjun Nitin Bhagoji, Supriyo Chakraborty, Prateek Mittal, and Seraphin B. Calo.  Analyzing Federated Learning through an Adversarial Lens.  In _ICML_ , 2019.
  * Biggio et al. (2012) Battista Biggio, Blaine Nelson, and Pavel Laskov.  Poisoning Attacks against Support Vector Machines.  In _ICML_ , 2012.
  * Blanchard et al. (2017) Peva Blanchard, El Mahdi El Mhamdi, Rachid Guerraoui, and Julien Stainer.  Machine Learning with Adversaries: Byzantine Tolerant Gradient Descent.  In _NeurIPS_ , 2017.
  * Boenisch et al. (2021) Franziska Boenisch, Adam Dziedzic, Roei Schuster, Ali Shahin Shamsabadi, Ilia Shumailov, and Nicolas Papernot.  When the Curious Abandon Honesty: Federated Learning Is Not Private.  _CoRR_ , abs/2112.02918, 2021.
  * Boenisch et al. (2022) Franziska Boenisch, Adam Dziedzic, Roei Schuster, Ali Shahin Shamsabadi, Ilia Shumailov, and Nicolas Papernot.  All You Need Is Matplotlib.  http://www.cleverhans.io/2022/04/17/fl-privacy.html, 2022.
  * Boenisch et al. (2023) Franziska Boenisch, Adam Dziedzic, Roei Schuster, Ali Shahin Shamsabadi, Ilia Shumailov, and Nicolas Papernot.  Is Federated Learning a Practical PET Yet?  _CoRR_ , 2023.
  * Bonawitz et al. (2019) Kallista A. Bonawitz, Hubert Eichner, Wolfgang Grieskamp, Dzmitry Huba, Alex Ingerman, Vladimir Ivanov, Chloé Kiddon, Jakub Konečný, Stefano Mazzocchi, Brendan McMahan, Timon Van Overveldt, David Petrou, Daniel Ramage, and Jason Roselander.  Towards Federated Learning at Scale: System Design.  In _MLSys_ , 2019.
  * Bonawitz et al. (2017) Keith Bonawitz, Vladimir Ivanov, Ben Kreuter, Antonio Marcedone, H. Brendan McMahan, Sarvar Patel, Daniel Ramage, Aaron Segal, and Karn Seth.  Practical Secure Aggregation for Privacy-Preserving Machine Learning.  In _CCS_ , 2017.
  * Bottou et al. (2018) Léon Bottou, Frank E. Curtis, and Jorge Nocedal.  Optimization Methods for Large-Scale Machine Learning.  _SIAM Review_ , 2018.
  * Byali et al. (2020) Megha Byali, Harsh Chaudhari, Arpita Patra, and Ajith Suresh.  FLASH: Fast and Robust Framework for Privacy-preserving Machine Learning.  _Proc. Priv. Enhancing Technol._ , 2020.
  * (15) José Cabrero-Holgueras and Sergio Pastrana.  SoK: Privacy-Preserving Computation Techniques for Deep Learning.  _PETS_ , 2021.
  * Cao et al. (2021) Xiaoyu Cao, Minghong Fang, Jia Liu, and Neil Zhenqiang Gong.  FLTrust: Byzantine-robust Federated Learning via Trust Bootstrapping.  In _NDSS_ , 2021.
  * Chaudhari et al. (2019) Harsh Chaudhari, Ashish Choudhury, Arpita Patra, and Ajith Suresh.  ASTRA: High Throughput 3PC over Rings with Application to Secure Prediction.  In _CCSW@CCS_ , 2019.
  * Chaudhari et al. (2020) Harsh Chaudhari, Rahul Rachuri, and Ajith Suresh.  Trident: Efficient 4PC Framework for Privacy Preserving Machine Learning.  In _NDSS_ , 2020.
  * Commission (2014) European Commission.  Benchmarking Smart Metering Deployment in the EU-27 with a Focus on Electricity.  _COM/2014/0356 final_ , 2014.
  * Cuijpers & Koops (2013) Colette Cuijpers and Bert-Jaap Koops.  Smart Metering and Privacy in Europe: Lessons from the Dutch Case.  In _European Data Protection: Coming of Age_. 2013.
  * Damgård et al. (2012) Ivan Damgård, Valerio Pastro, Nigel P. Smart, and Sarah Zakarias.  Multiparty Computation from Somewhat Homomorphic Encryption.  In _CRYPTO_ , 2012.
  * Damgård et al. (2019) Ivan Damgård, Helene Haagh, Michael Nielsen, and Claudio Orlandi.  Commodity-Based 2PC for Arithmetic Circuits.  In _IMACC_ , 2019.
  * Dathathri et al. (2019) Roshan Dathathri, Olli Saarikivi, Hao Chen, Kim Laine, Kristin E. Lauter, Saeed Maleki, Madanlal Musuvathi, and Todd Mytkowicz.  CHET: An Optimizing Compiler for Fully-Homomorphic Neural-Network Inferencing.  In _PLDI_ , 2019.
  * Demmler et al. (2015) Daniel Demmler, Thomas Schneider, and Michael Zohner.  ABY - A Framework for Efficient Mixed-Protocol Secure Two-Party Computation.  In _NDSS_ , 2015.
  * Deng et al. (2021) Yongheng Deng, Feng Lyu, Ju Ren, Yongmin Zhang, Yuezhi Zhou, Yaoxue Zhang, and Yuanyuan Yang.  SHARE: Shaping Data Distribution at Edge for Communication-Efficient Hierarchical Federated Learning.  In _ICDCS_ , 2021.
  * Desfontaines & Pejó (2020) Damien Desfontaines and Balázs Pejó.  SoK: Differential Privacies.  _PETS_ , 2020.
  * Dong et al. (2021) Ye Dong, Xiaojun Chen, Kaiyun Li, Dakui Wang, and Shuai Zeng.  FLOD: Oblivious Defender for Private Byzantine-Robust Federated Learning with Dishonest-Majority.  In _ESORICS_ , 2021.
  * Dwork & Roth (2014) Cynthia Dwork and Aaron Roth.  The Algorithmic Foundations of Differential Privacy.  _TCC_ , 2014.
  * Evans et al. (2018) David Evans, Vladimir Kolesnikov, and Mike Rosulek.  A Pragmatic Introduction to Secure Multi-Party Computation.  _Foundations and Trends in Privacy and Security_ , 2018.
  * Fang et al. (2020) Minghong Fang, Xiaoyu Cao, Jinyuan Jia, and Neil Zhenqiang Gong.  Local Model Poisoning Attacks to Byzantine-Robust Federated Learning.  In _USENIX Security_ , 2020.
  * Fereidooni et al. (2021) Hossein Fereidooni, Samuel Marchal, Markus Miettinen, Azalia Mirhoseini, Helen Möllering, Thien Duc Nguyen, Phillip Rieger, Ahmad-Reza Sadeghi, Thomas Schneider, Hossein Yalame, and Shaza Zeitouni.  SAFELearn: Secure Aggregation for Private Federated Learning.  In _DLS@SP_ , 2021.
  * Fowl et al. (2022) Liam H. Fowl, Jonas Geiping, Wojciech Czaja, Micah Goldblum, and Tom Goldstein.  Robbing the Fed: Directly Obtaining Private Data in Federated Learning with Modified Models.  In _ICLR_ , 2022.
  * Froelicher et al. (2021) David Froelicher, Juan R Troncoso-Pastoriza, Apostolos Pyrgelis, Sinem Sav, Joao Sa Sousa, Jean-Philippe Bossuat, and Jean-Pierre Hubaux.  Scalable Privacy Preserving Distributed Learning.  _PETS_ , 2021.
  * Geiping et al. (2020) Jonas Geiping, Hartmut Bauermeister, Hannah Dröge, and Michael Moeller.  Inverting Gradients – How Easy Is It to Break Privacy in Federated Learning?  In _NeurIPS_ , 2020.
  * Gentry (2009) Craig Gentry.  Fully Homomorphic Encryption Using Ideal Lattices.  In _STOC_ , 2009.
  * Gilad-Bachrach et al. (2016) Ran Gilad-Bachrach, Nathan Dowlin, Kim Laine, Kristin E. Lauter, Michael Naehrig, and John Wernsing.  CryptoNets: Applying Neural Networks to Encrypted Data with High Throughput and Accuracy.  In _ICML_ , 2016.
  * Goldreich et al. (1987) Oded Goldreich, Silvio Micali, and Avi Wigderson.  How to Play any Mental Game or A Completeness Theorem for Protocols with Honest Majority.  In _STOC_ , 1987.
  * Goyal et al. (2017) Priya Goyal, Piotr Dollár, Ross B. Girshick, Pieter Noordhuis, Lukasz Wesolowski, Aapo Kyrola, Andrew Tulloch, Yangqing Jia, and Kaiming He.  Accurate, Large Minibatch SGD: Training ImageNet in 1 Hour.  _CoRR_ , 2017.
  * Hong & Varghese (2019) Cheol-Ho Hong and Blesson Varghese.  Resource Management in Fog/Edge Computing: A Survey on Architectures, Infrastructure, and Algorithms.  _ACM Computing Surveys_ , 2019.
  * Keller & Sun (2022) Marcel Keller and Ke Sun.  Secure Quantized Training for Deep Learning.  In _ICML_ , 2022.
  * Knott et al. (2021) Brian Knott, Shobha Venkataraman, Awni Y. Hannun, Shubho Sengupta, Mark Ibrahim, and Laurens van der Maaten.  CrypTen: Secure Multi-Party Computation Meets Machine Learning.  In _NeurIPS_ , 2021.
  * Konečnỳ et al. (2016) Jakub Konečnỳ, H Brendan McMahan, Felix X Yu, Peter Richtárik, Ananda Theertha Suresh, and Dave Bacon.  Federated Learning: Strategies for Improving Communication Efficiency.  _CoRR_ , 2016.
  * Koti et al. (2021) Nishat Koti, Mahak Pancholi, Arpita Patra, and Ajith Suresh.  SWIFT: Super-fast and Robust Privacy-Preserving Machine Learning.  In _USENIX Security_ , 2021.
  * Koti et al. (2022a) Nishat Koti, Shravani Patil, Arpita Patra, and Ajith Suresh.  MPClan: Protocol Suite for Privacy-Conscious Computations.  _IACR ePrint_ , 2022a.
  * Koti et al. (2022b) Nishat Koti, Arpita Patra, Rahul Rachuri, and Ajith Suresh.  Tetrad: Actively Secure 4PC for Secure Training and Inference.  In _NDSS_ , 2022b.
  * Krizhevsky (2009) Alex Krizhevsky.  Learning Multiple Layers of Features from Tiny Images.  Technical report, 2009.
  * LeCun et al. (1998) Yann LeCun, Léon Bottou, Yoshua Bengio, and Patrick Haffner.  Gradient-based Learning Applied to Document Recognition.  _Proceedings of the IEEE_ , 1998.
  * Li et al. (2019) Liping Li, Wei Xu, Tianyi Chen, Georgios B Giannakis, and Qing Ling.  RSA: Byzantine-Robust Stochastic Aggregation Methods for Distributed Learning from Heterogeneous Datasets.  In _AAAI_ , 2019.
  * Lin et al. (2020) Tao Lin, Sebastian U. Stich, Kumar Kshitij Patel, and Martin Jaggi.  Don’t Use Large Mini-batches, Use Local SGD.  In _ICLR_ , 2020.
  * Lindell (2020) Yehuda Lindell.  Secure Multiparty Computation.  _Communications of the ACM_ , 2020.
  * Mandal & Gong (2019) Kalikinkar Mandal and Guang Gong.  PrivFL: Practical Privacy-preserving Federated Regressions on High-dimensional Data over Mobile Networks.  In _CCSW@CCS_ , 2019.
  * Mann et al. (2022) Zoltán Ádám Mann, Christian Weinert, Daphnee Chabal, and Joppe W. Bos.  Towards Practical Secure Neural Network Inference: The Journey So Far and the Road Ahead.  _IACR ePrint_ , 2022.
  * Mansouri et al. (2023) Mohamad Mansouri, Melek Önen, Wafa Ben Jaballah, and Mauro Conti.  SoK: Secure Aggregation Based on Cryptographic Schemes for Federated Learning.  _PETS_ , 2023.
  * Marti & Garcia-Molina (2006) Sergio Marti and Hector Garcia-Molina.  Taxonomy of Trust: Categorizing P2P Reputation Systems.  _Computer Networks_ , 2006.
  * McMahan et al. (2017) Brendan McMahan, Eider Moore, Daniel Ramage, Seth Hampson, and Blaise Agüera y Arcas.  Communication-Efficient Learning of Deep Networks from Decentralized Data.  In _AISTATS_ , 2017.
  * Mohassel & Rindal (2018) Payman Mohassel and Peter Rindal.  ABY${}^{\mbox{3}}$: A Mixed Protocol Framework for Machine Learning.  In _ACM CCS_ , 2018.
  * Mohassel & Zhang (2017) Payman Mohassel and Yupeng Zhang.  SecureML: A System for Scalable Privacy-Preserving Machine Learning.  In _IEEE SP_ , 2017.
  * Mouchet et al. (2021) Christian Mouchet, Juan Troncoso-Pastoriza, Jean-Philippe Bossuat, and Jean-Pierre Hubaux.  Multiparty Homomorphic Encryption from Ring-Learning-With-Errors.  _PETS_ , 2021.
  * Nguyen et al. (2022) Thien Duc Nguyen, Phillip Rieger, Huili Chen, Hossein Yalame, Helen Möllering, Hossein Fereidooni, Samuel Marchal, Markus Miettinen, Azalia Mirhoseini, Shaza Zeitouni, Farinaz Koushanfar, Ahmad-Reza Sadeghi, and Thomas Schneider.  FLAME: Taming Backdoors in Federated Learning.  In _USENIX Security_ , 2022.
  * Ouadrhiri & Abdelhadi (2022) Ahmed El Ouadrhiri and Ahmed Abdelhadi.  Differential Privacy for Deep and Federated Learning: A Survey.  _IEEE Access_ , 2022.
  * Paillier (1999) Pascal Paillier.  Public-Key Cryptosystems based on Composite Degree Residuosity Classes.  In _EUROCRYPT_ , 1999.
  * Pasquini et al. (2022) Dario Pasquini, Danilo Francati, and Giuseppe Ateniese.  Eluding Secure Aggregation in Federated Learning via Model Inconsistency.  In _CCS_ , 2022.
  * Patra & Suresh (2020) Arpita Patra and Ajith Suresh.  BLAZE: Blazing Fast Privacy-Preserving Machine Learning.  In _NDSS_ , 2020.
  * Patra et al. (2021) Arpita Patra, Thomas Schneider, Ajith Suresh, and Hossein Yalame.  ABY2.0: Improved Mixed-Protocol Secure Two-Party Computation.  In _USENIX Security_ , 2021.
  * Phong et al. (2018) Le Trieu Phong, Yoshinori Aono, Takuya Hayashi, Lihua Wang, and Shiho Moriai.  Privacy-Preserving Deep Learning via Additively Homomorphic Encryption.  _TIFS_ , 2018.
  * Rivest et al. (1978) R L Rivest, L Adleman, and M L Dertouzos.  On Data Banks and Privacy Homomorphisms.  _Foundations of Secure Computation_ , 1978.
  * Rubin (1996) Frank Rubin.  One-time pad cryptography.  _Cryptologia_ , 1996.
  * Russinovich et al. (2021) Mark Russinovich, Manuel Costa, Cédric Fournet, David Chisnall, Antoine Delignat-Lavaud, Sylvan Clebsch, Kapil Vaswani, and Vikas Bhatia.  Toward Confidential Cloud Computing.  _Communications of the ACM_ , 2021.
  * Sav et al. (2021) Sinem Sav, Apostolos Pyrgelis, Juan Ramón Troncoso-Pastoriza, David Froelicher, Jean-Philippe Bossuat, Joao Sa Sousa, and Jean-Pierre Hubaux.  POSEIDON: Privacy-Preserving Federated Neural Network Learning.  In _NDSS_ , 2021.
  * Schneider et al. (2023) Thomas Schneider, Ajith Suresh, and Hossein Yalame.  Comments on ”Privacy-Enhanced Federated Learning Against Poisoning Adversaries”.  _IEEE Trans. Inf. Forensics Secur._ , 18:1407–1409, 2023\.
  * Shejwalkar & Houmansadr (2021) Virat Shejwalkar and Amir Houmansadr.  Manipulating the Byzantine: Optimizing Model Poisoning Attacks and Defenses for Federated Learning.  In _NDSS_ , 2021.
  * Shejwalkar et al. (2022) Virat Shejwalkar, Amir Houmansadr, Peter Kairouz, and Daniel Ramage.  Back to the Drawing Board: A Critical Evaluation of Poisoning Attacks on Production Federated Learning.  In _IEEE SP_ , 2022.
  * So et al. (2021) Jinhyun So, Ramy E. Ali, Basak Guler, Jiantao Jiao, and Salman Avestimehr.  Securing Secure Aggregation: Mitigating Multi-Round Privacy Leakage in Federated Learning.  _CoRR_ , abs/2106.03328, 2021.
  * Subramanian et al. (2002) Lakshminarayanan Subramanian, Sharad Agarwal, Jennifer Rexford, and Randy H. Katz.  Characterizing the Internet Hierarchy from Multiple Vantage Points.  In _INFOCOM_ , 2002.
  * Suresh (2021) Ajith Suresh.  MPCLeague: Robust MPC Platform for Privacy-Preserving Machine Learning.  _PhD Thesis_ , abs/2112.13338, 2021.
  * Tian et al. (2022) Zhiyi Tian, Lei Cui, Jie Liang, and Shui Yu.  A Comprehensive Survey on Poisoning Attacks and Countermeasures in Machine Learning.  _ACM Computing Surveys_ , 2022.
  * Tolpegin et al. (2020) Vale Tolpegin, Stacey Truex, Mehmet Emre Gursoy, and Ling Liu.  Data Poisoning Attacks Against Federated Learning Systems.  In _ESORICS_ , 2020.
  * Wang et al. (2020) Hongyi Wang, Kartik Sreenivasan, Shashank Rajput, Harit Vishwakarma, Saurabh Agarwal, Jy-yong Sohn, Kangwook Lee, and Dimitris S. Papailiopoulos.  Attack of the Tails: Yes, You Really Can Backdoor Federated Learning.  In _NeurIPS_ , 2020.
  * Wang et al. (2021) Zhiyuan Wang, Hongli Xu, Jianchun Liu, He Huang, Chunming Qiao, and Yangming Zhao.  Resource-Efficient Federated Learning with Hierarchical Aggregation in Edge Computing.  In _INFOCOM_ , 2021.
  * Wen et al. (2022) Yuxin Wen, Jonas Geiping, Liam Fowl, Micah Goldblum, and Tom Goldstein.  Fishing for User Data in Large-Batch Federated Learning via Gradient Magnification.  In _ICML_ , 2022.
  * Xiao et al. (2012) Han Xiao, Huang Xiao, and Claudia Eckert.  Adversarial Label Flips Attack on Support Vector Machines.  In _ECAI_ , 2012.
  * Xie et al. (2020) Chulin Xie, Keli Huang, Pin-Yu Chen, and Bo Li.  DBA: Distributed Backdoor Attacks against Federated Learning.  In _ICLR_ , 2020.
  * Yang (2021) He Yang.  H-FL: A Hierarchical Communication Efficient and Privacy-Protected Architecture for Federated Learning.  In _IJCAI_ , 2021.
  * Yao (1986) Andrew Chi-Chih Yao.  How to Generate and Exchange Secrets (Extended Abstract).  In _FOCS_ , 1986.
  * Yin et al. (2018) Dong Yin, Yudong Chen, Kannan Ramchandran, and Peter L. Bartlett.  Byzantine-Robust Distributed Learning: Towards Optimal Statistical Rates.  In _ICML_ , 2018.
  * Zhu et al. (2019) Ligeng Zhu, Zhijian Liu, and Song Han.  Deep Leakage from Gradients.  In _NeurIPS_ , 2019.
  * Zink et al. (2021) Michael Zink, David E. Irwin, Emmanuel Cecchet, Hakan Saplakoglu, Orran Krieger, Martin C. Herbordt, Michael Daitzman, Peter Desnoyers, Miriam Leeser, and Suranga Handagala.  The Open Cloud Testbed (OCT): A Platform for Research into new Cloud Technologies.  In _IEEE CloudNet_ , 2021.

##  Appendix A Related Work

This section provides a succinct overview of related work.

###  A.1 Privacy Enhancing Technologies (PETs)

Privacy enhancing technologies (PETs) are techniques that allow for
computations to be performed on data while keeping that data private. There
are a variety of PETs available, but the three most widely considered in the
literature are secure multi-party computation (MPC), homomorphic encryption
(HE), and differential privacy (DP). Below, we provide a brief overview of
each of these methods.

####  A.1.1 Secure Multi-Party Computation (MPC)

MPC Yao (1986); Goldreich et al. (1987) enables a set of mutually distrusting
parties to evaluate a public function $f()$ on their private data while
preserving input data privacy. The corruption among the parties is often
modelled via an  _adversary_ that may try to take control of the corrupted
parties and coordinate their actions. There exists various orthogonal traits
of adversarial corruption like honest vs dishonest majority, semi-honest vs
malicious corruption, etc. Evans et al. (2018); Lindell (2020). For practical
efficiency, MPC with a small number of parties is often considered Chaudhari
et al. (2019); Patra & Suresh (2020); Chaudhari et al. (2020). In HyFL, we use
a minimal setting of two parties with semi-honest corruption and resort to a
trusted third party for efficiency Damgård et al. (2012; 2019); Knott et al.
(2021); Patra et al. (2021).

####  A.1.2 Homomorphic Encryption (HE)

HE schemes Rivest et al. (1978); Gentry (2009) enable computations on
encrypted data without the need for decryption. The additive homomorphic
encryption (AHE) scheme is a widely used method that allows for the generation
of a new ciphertext representing the sum of multiple plaintexts through
operations on their corresponding original ciphertexts Paillier (1999). In
scenarios involving multiple parties, recent schemes like multi-party
homomorphic encryption (MHE) have been shown to reduce the communication
complexity of their MPC counterpart, but incurs a significant computation
overhead Mouchet et al. (2021). Acar et al. (2018) presents a survey of
various HE schemes.

####  A.1.3 Differential Privacy (DP)

The concept of DP Dwork & Roth (2014) is based on the idea of adding noise to
data in order to reduce information leakage when sharing it, while still
allowing for meaningful computations to be carried out on the data. A
randomized algorithm $\Psi$ is said to satisfy $(\epsilon,\delta)$-DP, if for
all adjacent datasets $d,d^{\prime}\in\mathcal{D}$ and for all
$S\subseteq\mathsf{Range}(\Psi)$, it holds that

$\textsf{Pr}[\Psi(d)\in S]\leq
e^{\epsilon}\cdot\textsf{Pr}[\Psi(d^{\prime})\in S]+\delta$

At a high level, this means that when given a dataset $d$, the likelihood of
the algorithm $\Psi$ producing a result within set $S$ should not be greatly
different from the likelihood of the algorithm producing a result within the
same set $S$ when given an adjacent dataset $d^{\prime}$. We refer to
Desfontaines & Pejó (2020) for more elaborate details.

###  A.2 Privacy-preserving Machine Learning (PPML)

In recent years, there has been a surge in privacy concerns and privacy rules,
such as the European General Data Protection Regulation (GDPR) and California
Consumer Privacy Act (CCPA), leading the community to develop privacy-
preserving algorithms for machine learning applications, often known as PPML
Gilad-Bachrach et al. (2016); Dathathri et al. (2019); Suresh (2021). These
techniques aim to protect individuals’ privacy while still allowing for the
development of accurate and effective machine learning models. While there
exists a plethora of such PPML techniques utilizing PETs (cf. §A.1), we resort
to PPML training and inference using MPC techniques in HyFL Mohassel & Zhang
(2017); Koti et al. (2022b). In particular, most of these works employ 2-4 MPC
servers Mohassel & Rindal (2018); Byali et al. (2020); Koti et al. (2021;
2022b), while recent works started focusing on more servers Koti et al.
(2022a). We refer to Cabrero-Holgueras & Pastrana  for an overview of various
PPML approaches.

###  A.3 Federated Learning (FL)

Unlike conventional PPML techniques, FL Konečnỳ et al. (2016) allows for the
training of machine learning models over distributed data by allowing the
model to be trained locally on each device using its own data. The locally
trained models are then transferred to a central server and combined to form a
global model. This enables large models to be trained using data scattered
across different devices or companies without the need to centralize the data.
At a high level, an FL scheme iterates through the following steps:

  1. 1.

The global server $\mathcal{S}$ sends the current global model $W_{t}$ to a
selected subset of $n$ out of $N$ clients.

  2. 2.

Each selected client $C^{i}$, $i\in[n]$ utilizes its own local training data
$D^{i}$ for $E$ epochs to fine-tune the global model and obtains an updated
local model $w_{t+1}^{i}$:

$w_{t+1}^{i}\leftarrow W_{t}-\eta_{C^{i}}\frac{\partial
L(W_{t},B_{i,e})}{\partial W_{t}},$

where $L$ is a loss function, $\eta_{C^{i}}$ is the clients’ learning rate,
and $B_{i,e}\subseteq D^{i}$ is a batch drawn from $D^{i}$ in epoch $e$, where
$e\in[E]$. The local model updates $w_{t+1}^{i}$ are then transmitted back to
$\mathcal{S}$.

  3. 3.

$\mathcal{S}$ employs an aggregation rule $f_{\textit{agg}}$ to combine the
received local model updates $w_{t+1}^{i}$, resulting in a global model
$W_{t+1}$, which will serve as the starting point for next iteration:

$W_{t+1}\leftarrow W_{t}-\eta_{\mathsf{S}}\cdot
f_{\textit{agg}}(w_{t+1}^{i},\ldots,w_{t+1}^{n}),$

where $\eta_{\mathsf{S}}$ is the server’s learning rate.

The above procedure is repeated until a predefined stopping criterion, such as
a specified number of training iterations or a specific level of accuracy, is
satisfied.

####  A.3.1 Aggregation

With the advent of FL, the focus was shifted towards developing an efficient
aggregation function that could scale. Google presented FedAvg McMahan et al.
(2017), which aggregates the models using a simple weighted averaging
algorithm, given by

$\mathsf{FedAvg}(w_{t+1}^{1},\ldots,w_{t+1}^{n})=\sum_{i=1}^{n}\frac{|D^{i}|}{|D|}w_{t+1}^{i},$

where $w_{t+1}^{i}$ is the model trained on $|D^{i}|$ data samples and $|D|$
denotes the total number of training data samples.

One potential drawback of FL over PPML techniques is that FL increases the
attack surface for malicious actors. This is because in FL, each user trains
their own model locally, allowing them the potential to manipulate their model
instead of data Biggio et al. (2012); Bhagoji et al. (2019); Tolpegin et al.
(2020); Bagdasaryan et al. (2020); Fang et al. (2020). To counter these kind
of  _poisoning_ attacks, various robust aggregation methods have been
proposed, in which local models are analyzed and appropriate measures such as
outlier removal, norm scaling, and so on are applied Blanchard et al. (2017);
Yin et al. (2018); Li et al. (2019); Cao et al. (2021); Schneider et al.
(2023). See Shejwalkar & Houmansadr (2021) for a comprehensive overview of
different robust aggregations.

####  A.3.2 Secure Aggregation

Previous research had assumed that the use of standard FL with plain
aggregation would protect the privacy of client data. However, later works
have shown that it is possible to extract private information from individual
model updates Zhu et al. (2019); Geiping et al. (2020). To address this
concern, secure aggregation (SA) schemes have been proposed Bonawitz et al.
(2017); Mansouri et al. (2023). These schemes ensure that the aggregator
$\mathcal{S}$ only receives the final aggregated model, rather than individual
models, thus preserving the privacy of client data.

##### Single Server SA (Single $\mathcal{S}$).

When utilizing a single aggregator $\mathcal{S}$, several works used masking
techniques Rubin (1996) to hide individual updates from the aggregator
Bonawitz et al. (2017); Bell et al. (2020). However, more recent studies, such
as Phong et al. (2018), have shifted their focus towards using HE-based
techniques, specifically AHE Acar et al. (2018), to completely hide the
aggregated model from the server and make it available to the users.
Similarly, PrivFL Mandal & Gong (2019) proposed a HE-based training to protect
the global model from the users and reveal only to the aggregator, while
preserving privacy of individual updates. However, recent research has shown
that a single malicious server can reconstruct individual training data points
from users’ local models even when using secure aggregation protocols Bonawitz
et al. (2017); Bell et al. (2020).

##### Multi Server SA (Multi $\mathcal{S}$).

In this case, the aggregation will be carried out by a group of servers in a
private and distributed fashion Fereidooni et al. (2021). One major advantage
of these schemes is that, unlike a single aggregator case, users do not need
to communicate with each other or perform any key setup. In an orthogonal line
or work, such as SPINDLE Froelicher et al. (2021) and POSEIDON Sav et al.
(2021) adopt MHE techniques to perform a collaborative learning, but in a
federated fashion. However, these works do not scale well with the number of
parties and are thus limited for a cross-device setting. Recent works like
Dong et al. (2021) and Nguyen et al. (2022) proposed private and robust FL by
combining techniques from HE and MPC, but will incur significant overhead in
both computation and communication for a cross-device setting. In HyFL, we
employ a multi-server aggregation scheme with three servers and mitigate
scalability issues of existing works, especially for a cross-device setting.

####  A.3.3 Hierarchical Federated Learning (HFL)

A modified approach to standard FL, called hierarchical FL (HFL), was
introduced to address scalability and heterogeneity issues in real-world
systems Bonawitz et al. (2019). In HFL, aggregation occurs at multiple levels,
forming a hierarchical structure in which the aggregated values from one level
serve as inputs for the next higher level. This procedure eventually leads to
the top level, when the final model is aggregated Deng et al. (2021); Wang et
al. (2021). Previous works in the HFL setting has primarily focused on
improving scalability and communication. However, the recent work of Yang
(2021) introduced methods for ensuring the privacy of individual updates in
HFL, allowing for secure aggregation. Despite this advancement, Yang (2021)
did not address global model privacy or the robustness against malicious
users, which are crucial goals in our proposed HyFL framework.

##  Appendix B Additional Details for HyFL

###  B.1 MPC Functionalities in HyFL

The MPC functionalities utilized in HyFL are summarized in Tab. 6. While Share
and Reshare are used for generating the secret-shares as per the underlying
MPC semantics, Reveal is used to reconstruct the secret towards a designated
party. The Train and Predict functionalities correspond to PPML training and
inference protocols, respectively. Similarly, Agg denotes the secure
aggregation functionality in FL (cf. §A.3.2). In HyFL, these functionalities
are realized using the CrypTen framework, in which two semi-honest MPC servers
carry out the computation with the help of a trusted third server Damgård et
al. (2012); Demmler et al. (2015); Knott et al. (2021). However, HyFL is not
bound to any specific MPC setting and could be instantiated using any MPC
protocol.

Table 6: MPC functionalities used in HyFL framework.

Algo. | Input(s) | Description
---|---|---
Share | ${D},{V}$ |  Generates secret shares of data ${D}$ as per target ${V}$’s sharing semantics (${\langle{D}\rangle}_{{V}}$).
Reshare | ${\langle{D}\rangle}_{{U}},{V}$ |  Converts secret shares of data ${D}$ from source ${U}$’s sharing semantics to target ${V}$.
Agg | $\\{{\langle{W}^{j}\rangle}\\}$ |  Performs secure aggregation over $j$ secret-shared ML models.
Train | ${\langle{W}\rangle},{\langle{D}\rangle}$ |  Performs PPML Training on ML model ${W}$ using the data ${D}$.
Predict | ${\langle{W}\rangle},{\langle{Q}\rangle}$ |  Performs PPML Inference on ML model ${W}$ using the query ${Q}$.
Reveal | ${\langle{D}\rangle}_{{U}},{V}$ |  Reconstructs secret-shared data ${D}$ towards members in target set ${V}$.
TM-List | $\mathcal{W},{\alpha}$ |  Performs Trimmed Mean algorithm and returns $2{\alpha}$ outlier values (top and bottom ${\alpha}$) for each index position in elements of $\mathcal{W}$
TopK-Hitter | $\mathcal{U},\Gamma$ |  Returns list of $\Gamma$ values that occur most frequently in $\mathcal{U}$

The functionalities TM-List and TopK-Hitter are used in our proposed “Trimmed
Mean Variant” given in Alg. 2. TM-List takes as input a set of vectors, say
$\mathcal{W}$, consisting of ${\beta}$-sized vectors of the form $W_{j}^{i}$
for $i\in[{\beta}],j\in[\mathsf{N}_{\mathcal{W}}]$. Moreover, the values in
the vector comes from a fixed source, i.e, the Layer II MPC clusters in our
case, and are thus represented as a tuple of the form
$W_{j}^{i}=(u_{i},v_{i})_{j}$. Here $u_{i}$ denotes the source ID (MPC cluster
in HyFL) and $v_{i}$ represents the corresponding value.

W.l.o.g., consider the first index position of these vectors ($i=1$). TM-List
sorts the list $\\{(u,v)_{j}\\}_{j\in[\mathsf{N}_{\mathcal{W}}]}$ using the
value $v$ as the key and selects the IDs ($u$) associated with the top and
bottom ${\alpha}$ values. Intuitively, the operation results in selecting the
MPC clusters whose local update fall in either the top-${\alpha}$ or
bottom-${\alpha}$ position among all the updates at that index. This procedure
is performed in parallel for all ${\beta}$ indices and results in a set
$\mathcal{U}$ of $2{\alpha}{\beta}$ IDs (with duplicates). The TopK-Hitter
functionality, parameterized by $\Gamma$, takes this set $\mathcal{U}$ as
input and returns a set of $\Gamma$ values that occur most frequently in
$\mathcal{U}$.

###  B.2 Incorporating Data-Poisoning Attacks in HyFL

In this section, we provide a comprehensive overview of the attack setting and
the types of poisoning attacks implemented in the HyFL framework. It is
important to note that all poisoning attacks implemented in this framework are
data poisoning attacks, as model poisoning attacks are not applicable in the
context of HyFL.

Regarding the attack setting, it is assumed that all malicious clients are
controlled by a single attacker and are executing a coordinated attack. This
implies that only one attack is executed at a time, and if two malicious
clients possess the same data sample, the poisoned labels of these samples
will be identical. Additionally, it is assumed that a malicious client will
always poison all of their data samples to maximize the impact of the attack.
Furthermore, the data is only poisoned once, and the labels remain constant
throughout the training of the model.

For data poisoning attacks, we implement four different types of label-
flipping attacks: random label flipping (RLF Xiao et al. (2012)), static label
flipping (SLF Fang et al. (2020); Shejwalkar et al. (2022)), dynamic label
flipping (DLF Shejwalkar et al. (2022)), and targeted label flipping (TLF
Tolpegin et al. (2020)).

RLF is the most basic label-flipping attack. As the name suggests, each
poisoned sample is assigned a random class label, i.e.,
$\textit{new}\\_\textit{label}=\texttt{randint}(0,\textit{num}\\_\textit{classes}-1)$
with $\textit{num}\\_\textit{classes}$ as the number of classes in the
dataset. This attack shows the effect of random label noise added to the
training.

SLF, originally proposed by Fang et al. (2020) and named by Shejwalkar et al.
(2022), uses a fixed permutation to determine the new label for each poisoned
sample. The attack is described by the following equation:
$\textit{new}\\_\textit{label}=\textit{num}\\_\textit{classes}-\textit{old}\\_\textit{label}-1$.
This means for a 10 class dataset that labels 0 and 9, 1 and 8, 2 and 7, and
so on are switched. Since the permutation is fixed, it is called a static
attack Shejwalkar et al. (2022).

DLF Shejwalkar et al. (2022) uses a surrogate model to flip the labels of each
sample. In our implementation, the data from all malicious clients is combined
and used to train a model of the same architecture as used in HyFL training.
After training, the model is used for inference on the data and the labels are
set to the least probable output by the surrogate model. The name dynamic is
chosen because the labels depend on the trained model. By varying the training
setting, the poisoned labels will change. The exact train settings of the
surrogate model are given in Tab. 7.

Table 7: Training parameters for surrogate model in DLF.

Parameter | Value
---|---
Epochs | 50
Batch Size | 128
Learning Rate | 0.05
Momentum | 0.9
Weight Decay | 0.0005

TLF Tolpegin et al. (2020) is the only targeted data poisoning attack. It
simply flips all labels from a source class to a target class. In the
evaluation, we always set the source class as 0 and the target class as 1.

####  B.2.1 CrypTen Implementation Details

CrypTen itself has no oblivious sorting functionality built in, so we
implement privacy-preserving sorting for so-called CrypTensors. Sorting is
necessary to compute trimmed mean and our optimized trimmed mean variant. We
minimize the number of comparisons by implementing a bitonic sorting network
that generates the necessary comparisons between elements to allow for a non-
stable sorting algorithm. For trimmed mean, it is not necessary to preserve
the relative order of same valued keys as each of them would have been seen as
suspicious anyway. The comparisons are stored in plaintext, as they do not
reveal any information about the data. The comparison steps are only computed
once and then executed in parallel for each coordinate. For 100 elements, we
perform 1077 comparisons and for 10 elements only 31. As the result of each
comparison is hidden, we perform the swap operation for each pairs as
described in Lst. LABEL:listing:sorting_crypten.

⬇

1compare_indices = list(comparision_generator(tensors.size(1)))

2for (i, j) in compare_indices:

3 b = tensors[:, i].gt(tensors[:, j])

4 h = b * tensors[:, i] + (1 - b) * tensors[:, j]

5 l = b * tensors[:, j] + (1 - b) * tensors[:, i]

6 tensors[:, i] = l

7 tensors[:, j] = h

Listing 1: CrypTen: Parallel Sorting

⬇

1def bincount(self, indices, num_bins):

2 indices_list = crypten.cryptensor(torch.arange(0, num_bins))

3 counts = crypten.stack([indices for _ in
range(num_bins)],dim=1).eq(indices_list).sum(dim=0)

4 return counts[None, :]

5

6def exclude_topk_indices(self, indices, k):

7 sorted_indices = self.sort(indices).reshape(-1)

8 n = sorted_indices.shape[0]

9 return sorted_indices[:n-k]

10

11benign_indices = self.exclude_topk_indices(

12 self.bincount(outlier_indices, num_bins=n),

13 k=self.exclude_topk)

14

15all_indices = crypten.cryptensor(torch.arange(0,
n).repeat(benign_indices.size(0), 1)).t()

16agg_sum = gradients.matmul(all_indices.eq(benign_indices)).sum(dim=1)

17

18return agg_sum / (n - self.exclude_topk)

Listing 2: CrypTen: Sum of Benign Updates

When computing the proposed trimmed mean variant, we are only interested in
the indices of the outliers and therefore only perform the swap operations on
an indices list. This is done to minimize the compute operations and thereby
reduce time and communication. After identifying which gradients were most
often detected as outliers and then compute the set of benign indices, lastly
we compute the sum over those while preserving privacy. The procedure is shown
in Lst. LABEL:listing:sumofbenign.

####  B.2.2 Run configuration

In this section, we list all the hyper parameters used during training that do
not change between runs. The parameters which change between runs will be
explained in the appropriate section. Tab. 8 shows the settings that affect
the training by the clients and MPC clusters respectively. We consider 1000
clients overall from which 100 are randomly sampled during each training
iteration. In the FL setting, all sampled clients provide their computed
update directly to the aggregation server. In the HyFL setting, each of the 10
MPC clusters has 100 associated clients from which each samples 10 clients at
random. Each client has 200 data points assigned to it at random with
duplicates allowed between clients. To allow for a fair comparison between FL
and HyFL, we scale the learning rate from 0.005 for the FL setting to 0.05 for
the HyFL setting. Each client and MPC cluster performs 5 local training epochs
with either a batch size of 8 or 80, respectively, following the
recommendation of Goyal et al. (2017).

Table 8: Parameters used in the training in PyTorch and CrypTen. Parameter | FL | HyFL
---|---|---
# clients | 1000
# clients selected per round | 100
# MPC clusters | - | 10
# clients per MPC cluster | - | 100
# clients per MPC cluster per round | - | 10
size of client datasets | 200
learn rate | 0.005 | 0.05
# local epochs | 5
batch size | 8 | 80

Tab. 9 shows the hyper parameters used by the aggregation server. The trimmed
mean threshold ${\alpha}$ has been chosen such that it can exclude all
malicious updates on either side in the FL setting. The worst-case scenario we
consider is a 0.2 poison rate, which is equivalent to approximately 20
malicious clients selected per round.

In the HyFL setting, the cluster-focused setting is the strongest adversarial
setting and we therefore appropriately scale ${\alpha}$. For the trimmed mean
variant, we exclude complete updates based on how often they were detected as
outliers and therefore need to double ${\alpha}$ to later aggregate the same
number of parameters per coordinate.

FLTrust uses a root data set to calculate the server model. To be most
effective, the server model must be similar to the benign models and therefore
the root dataset must to be representative for the whole dataset. Therefore,
we sample (like for all clients) 200 data points for that dataset.

Table 9: Robust aggregation parameters. Parameter | FL | HyFL
---|---|---
Trimmed Mean ${\alpha}$ | 20 | 2
Trimmed Mean Variant excluded gradients | 40 | 4
FLTrust root data set size | 200

####  B.2.3 Additional Results for Q1

Fig. 6 shows the full 2000 training iterations. As seen in Fig. 2, HyFL trains
the model faster than regular FL and converges to a higher validation
accuracy. For MNIST, HyFL achieves 98.95% compared to 98.72% for regular FL,
and 89.04% compared to 82.14% on CIFAR10, respectively.

Figure 6: Validation accuracy for FL and HyFL for 2000 epochs (top:
LeNet/MNIST, bottom: ResNet9/CIFAR10)

####  B.2.4 Additional Results for Q4

##### ResNet9/CIFAR10

We present the full evaluation results for ResNet9 trained on CIFAR10 under
attack. We evaluate FedAvg, FLTrust, and trimmed mean in regular FL and HyFL
under four different data-poisoning attacks with three different poison rates
and three different distributions of malicious clients. Fig. 7 shows the
results for equally-distributed malicious clients for 2000 rounds. Fig. 8
shows the focused attack and Fig. 9 shows cluster-focused results.

HyFL outperforms regular FL in nearly all settings and has more than 5% higher
validation accuracy after 2000 rounds. In both regular FL and HyFL, all three
aggregation schemes show robustness against data poisoning in the realistic
settings with 0.01 and 0.1 poison rate and equally-distributed as well as
focused attacks. This is no longer the case for a poison rate of 0.2.
Especially FedAvg as a non-robust aggregation scheme struggles to converge.
Even robust aggregations cannot fully counteract the effect of the attacks.
The same is true for the cluster-focused attack distribution. Here, all
aggregations have spikes in their validation accuracy; only FLTrust manages to
train a model comparable to the other settings. This is because FLTrust is
designed to be robust against model poisoning, and the cluster-focused setting
is the closest to a model-poisoning attack.

##### LeNet/MNIST

We now show additional evaluation results for LeNet trained on MNIST. The
settings are the same as previously. Fig. 10 shows equally-distributed, Fig.
11 shows focused, and Fig 12 shows the cluster-focused attack distribution for
2000 iterations.

As for ResNet9, HyFL trains the model faster than regular FL, but both
converge to a similar accuracy in most cases after 2000 rounds. Here, the
advantage of HyFL over regular FL mostly lies in the faster convergence: after
only 100 rounds of training, HyFL nearly reaches 98% accuracy, regardless of
the attack or attack setting. Also, there is little difference between the
three aggregation schemes for the realistic settings. For the 0.2 poison rate,
FedAvg starts to struggle a lot to train the model. This can mostly be seen
for FedAvg in regular FL and sometimes in HyFL.

####  B.2.5 Additional Results for Q6

##### ResNet9/CIFAR10

We present the extended evaluation of the trimmed mean variant for CIFAR10
under all attacks and attack settings in HyFL. The plots are divided into the
three distributions for malicious clients and show the evaluation results for
2000 iterations. Fig. 13 shows equally-distributed, Fig. 14 shows focused, and
Fig. 15 shows cluster-focused. We compare trimmed mean with our trimmed mean
variant when samling 10, 100 and 1000 coordinates.

In most cases, all four aggregations perform equally and the final validation
accuracy is nearly the same. The only difference can be seen with the cluster-
focused attack distribution and 0.2 poison rate. Here, trimmed mean achieves a
substantially lower accuracy than the trimmed mean variant. We assume that is
because cluster-focused acts more like a model poisoning attack and trimmed
mean variant deals better with this by discarding whole gradients rather than
operating coordinate-wise.

##### LeNet/MNIST

We also compared trimmed mean against our trimmed mean variant for LeNet being
trained on MNIST. However, almost all settings, the aggregations perform very
similar. Hence, we omit the full plots.

Figure 7: Validation accuracy for ResNet9/CIFAR10 training with FedAvg,
FLTrust, and trimmed mean for 2000 iterations under RLF, SLF, DLF, and TLF
attacks in the equally-distributed setting. Figure 8: Validation accuracy for
ResNet9/CIFAR10 training with FedAvg, FLTrust, and trimmed mean for 2000
iterations under RLF, SLF, DLF, and TLF attacks in the focused setting. Figure
9: Validation accuracy for ResNet9/CIFAR10 training with FedAvg, FLTrust, and
trimmed mean for 2000 iterations under RLF, SLF, DLF, and TLF attacks in the
cluster-focused setting. Figure 10: Validation accuracy for LeNet/MNIST
training with FedAvg, FLTrust, and trimmed mean for 2000 iterations under RLF,
SLF, DLF, and TLF attacks in the equally-distributed setting. Figure 11:
Validation accuracy for LeNet/MNIST training with FedAvg, FLTrust, and trimmed
mean for 2000 iterations under RLF, SLF, DLF, and TLF attacks in the focused
setting. Figure 12: Validation accuracy for LeNet/MNIST training with FedAvg,
FLTrust, and trimmed mean for 2000 iterations under RLF, SLF, DLF, and TLF
attacks in the cluster-focused setting. Figure 13: Validation accuracy for
ResNet9/CIFAR10 training with trimmed mean and our trimmed mean variant for
2000 iterations under RLF, SLF, DLF, and TLF attacks in the equally-
distributed setting. Figure 14: Validation accuracy for ResNet9/CIFAR10
training with trimmed mean and our trimmed mean variant for 2000 iterations
under RLF, SLF, DLF, and TLF attacks in the focused setting. Figure 15:
Validation accuracy for ResNet9/CIFAR10 training with trimmed mean and our
trimmed mean variant for 2000 iterations under RLF, SLF, DLF, and TLF attacks
in the cluster-focused setting.