# The destiny of Dark Matter

Fabiano Tracanna Dark Cosmology Centre, Niels Bohr Institute, University of
Copenhagen,
Jagtvej 155, Copenhagen 2100, Denmark  Steen H. Hansen Dark Cosmology Centre,
Niels Bohr Institute, University of Copenhagen,
Jagtvej 155, Copenhagen 2100, Denmark

###### Abstract

The majority of baryons, which account for $15\%$ of the matter in the
Universe, will end their lives as carbon and oxygen inside cold black dwarfs.
Dark matter (DM) makes up the remaining $85\%$ of the matter in the universe,
however, the fate of DM is unknown. Here we show that the destiny of purely
gravitationally interacting DM particles follows one of two possible routes.
The first possible route, the ”radiation-destiny” scenario, is that massive DM
particles lose sufficient energy through gravitational radiation causing them
to spiral into a supermassive black hole that ultimately disappears through
Hawking radiation. The second possible route, the ”drifting-alone” destiny,
applies to lighter DM particles, where only the central DM halo region spirals
into the central BH which is then Hawking radiated away. The rest of the DM
halo is ripped apart by the accelerated expansion of the Universe.

dark matter, cosmology, gravitational waves, black holes

##  1 Introduction

In approximately 5 billion years, our Sun will evolve into a red giant,
expanding its radius by several hundred times and engulfing the innermost
planets of the solar system, likely including the Earth, which will become a
scorched and lifeless desert. During the same period, the Milky Way, our
galaxy, will collide with the Andromeda galaxy, forming a resulting galaxy
named Milkomeda. This new galaxy will continue as a large elliptical galaxy,
with its central black holes merging into a supermassive BH (Schiavi et al.,
2020). Due to the accelerated expansion of the Universe, only a few more
galaxies will collide with Milkomeda, and after several tens of billions of
years, all solar-mass stars will fade away, and after trillions of years, all
low-mass stars will have exhausted their fuel (Adams & Laughlin, 1997).

The Universe comprises not only stars and gas but also large amounts of dark
matter (DM). This has been observed in galaxies and clusters from the early
1930th (Lundmark, 1930; Oort, 1932; Zwicky, 1937), thoroughly established with
galactic rotations curves in the 1970th (Rubin et al., 1980), and confirmed on
the scales of the full universe through the cosmic microwave background
observations (Planck Collaboration et al., 2016).

DM particles have a negligible collisional cross-section (Markevitch et al.,
2004), which implies that they orbit the galaxy solely under the influence of
gravity. The ultimate fate of DM particles depends on their annihilation rate
or whether they decay. In some of the most popular particle scenarios, DM can
annihilate when two DM particles come close enough to each other (Bertone et
al., 2005) . These models establish a strong correlation between the DM
annihilation cross-section and the DM abundance. A typical annihilation cross-
section for such particles is of the order of $\sigma\sim
10^{-32}\left(\frac{m}{1{\rm TeV}}\right)^{2}{\rm cm}^{2}$, where the mass of
$1{\rm TeV}$ is often considered for thermally produced DM particles (Bertone
et al., 2005) This means that a significant fraction of DM in a typical galaxy
with a mass of $10^{12}M_{\odot}$ will annihilate within $10^{17}$ years.

During DM annihilation, the resulting products may include photons and other
high-speed particles that escape the galaxy. As more DM particles annihilate,
the central part of the galaxy vanishes. This causes a reduction in the
gravitational attraction, allowing DM particle velocities to exceed the escape
velocity when $\sim 10\%$ of the DM particles have annihilated (Binney &
Tremaine, 2008) (see Appendix A). As a result, if DM particles are thermally
produced, and hence typically have annihilation cross sections of the order
the weak interaction scale, then the DM in the galaxy disperse into the
emptiness of the expanding space. The ultimate fate of these dispersed DM
particles depends on their specific particle properties, including whether
they decay into lighter particles or not. Other popular particle candidates
for the DM considers decaying DM particle. For instance for the sterile
neutrino (Dodelson & Widrow, 1994) the decay time into active neutrinos or
photons is approximately $\tau_{\rm decay}\sim 10^{19}\,\left(\frac{10{\rm
keV}}{m}\right)^{3}$ years. As the particles decay away the resulting less
tightly bound galaxy will be ripped apart by the accelerated expansion of
space, and the dispersed DM particles will decay. We will not consider neither
thermally created DM particles or sterile neutrinos further.

In contrast, the destiny of the more general class of DM particles that only
interact through gravity is generally unknown, and we will here show how it
depends sensitively on their particle mass.

There is a long history of production of particles with no non-gravitational
interactions (Parker, 1969; Grib & Mamaev, 1969; Parker, 1971; Mamaev et al.,
1976; Grib et al., 1976), and this production may even lead to abundances
relevant for it being the DM (Dolgov & Kirilova, 1990; Traschen &
Brandenberger, 1990; Dolgov & Hansen, 1999; Kuzmin & Tkachev, 1999; Bassett &
Liberati, 1998; Chung et al., 1998, 2001). The DM can be created for instance
by allowing it to have a coupling to a scalar inflaton field $\phi$, such as
${\mathcal{L}}\sim{\phi}^{2}{\chi}^{2}$, where the DM is a scalar $\chi$. The
inflaton field oscillates towards the end of inflation, and the DM is produced
due to the nonadiabatic expansion of spacetime during the transition to the
matter or radiation dominated phase. An important restriction is that the DM
must have properties to prevent subsequent thermalization, which is often
achieved by considering very massive DM particles with no other coupling to
standard model particles. Alternatively, the coupling of DM can be directly to
gravity (and nothing else), through a conformal coupling like
${\mathcal{L}}\sim\xi R\chi^{2}$, where $R$ is the Ricci scalar curvature. The
fundamental cause of particle production is that the expanding Universe breaks
time-translation symmetry, which leads to non-conservation of energy in the
quantum particles (Ford, 2021). For recent lists of references, see for
instance (Ford, 2021; Lebedev, 2021; Kolb et al., 2023). This wide range of
production mechanisms have one thing in common, namely that the DM particles
today will appear essentially sterile and non-interacting, except through
gravity. Thus, for the rest of this paper, we are only considering the general
class of DM particles that today only interact through gravity.

Massive objects circling each other have been predicted to emit gravitational
waves (GW) (Einstein, 1918). This effect was measured indirectly by the
frequency change of pulsars (Weisberg et al., 1981), and more recently 100
years of search culminated with the direct observation of GW (Abbott et al.,
2016).

The purely gravitationally interacting DM particles emit gravitational waves
as they orbit the galaxy, and the power emitted by a single particle can be
expressed as $P_{m}(r)=\frac{32G}{5c^{5}}\Omega^{6}m^{2}r^{4}$, where $G$ is
the gravitational constant, $c$ is the speed of light, $\Omega$ is the angular
velocity of the particle, and $r$ is the radius of its orbit (see appendix B).
Notably, the power emitted depends on the square of the particle’s mass. Thus,
if we consider a wide range of DM candidates with masses ranging from that of
the axion particle ($m\sim 10^{-38}g$) to a 100 solar-mass DM candidate
($m\sim 10^{35}g$), there will be a difference of a factor of $10^{146}$ in
the emitted power. The angular velocity of the DM particle depends strongly on
the potential existence of a supermassive central black hole, since the
typical circular velocity can be expressed as $v_{\rm
circ}(r)=\sqrt{GM(r)/r}$. Therefore, a large central object will allow the DM
to emit more gravitational radiation and transit to a smaller orbit at a
faster rate. A central BH is not a permanent fixture, as it is subject to
Hawking radiation due to quantum effects (Hawking, 1975). The timescale for a
black hole to radiate away due to this effect is on the order of $\tau_{\rm
Hawking}\sim 10^{-19}\left(\frac{M_{\rm BH}}{g}\right)^{3}$ years. Thus, a BH
with a mass of $10^{6}M_{\odot}$ will completely evaporate in approximately
$10^{85}$ years.

Figure 1: The two main evolutionary tracks of dark matter haloes: for very
massive DM candidates the large amount of gravitational radiation emitted
leads to a quick inspiral onto the central BH. Subsequently this BH
evaporates, and all DM thereby disappear in radiation. Alternatively, for
light DM candidates, the central BH evaporates before a significant fraction
of the DM has collapsed onto the central BH, and subsequently the remaining
part of the DM halo will be dispersed into the expanding Universe.

##  2 The two possible destinies

For a given DM particle mass, $m$, we can calculate the timescale for a
fraction of the galaxy to inspiral due to energy loss from gravitational
radiation. For instance, we can ask how long it would take for the innermost
$10^{-9}$ of the galaxy’s mass to move on sufficiently small orbits that the
DM particles will get absorbed by the central BH. For a $10^{12}M_{\odot}$
galaxy with a density profile in reasonable agreement with observations and
numerical simulations (Hernquist, 1990) (see Appendix B2), and with an initial
central BH of $10^{6}M_{\odot}$, this timescale is approximately $10^{80}$
years for a DM particle with mass $m=100{\rm TeV}$. This is a shorter time
than the Hawking radiation timescale of $10^{85}{\rm yrs}$ discussed above.
For a DM candidate with mass $m=10^{-5}{\rm eV}$, the corresponding timescale
is on the order of $10^{118}$ years. Thus, the destiny of DM particles in a
$10^{12}M_{\odot}$ galaxy with a central BH of $10^{6}M_{\odot}$ is
fundamentally different for different DM particle masses. The most massive DM
candidates will lose enough energy through gravitational radiation to be
entirely absorbed by the central BH in a sufficiently short time, and their
fate is to end as Hawking radiation on timescales of the order of $10^{103}$
years. This is shown as ”radiation-destiny” in Figure 1. On the other hand,
lighter DM candidates will lose energy through gravitational radiation slowly
enough that the central BH will evaporate. Subsequently, the remaining galaxy
will be dispersed into the vast empty space. In this case, shown as ”drifting-
alone destiny” in Figure 1, a significant fraction of the individual DM
particles will survive.

Figure 2: The figure illustrates the fate of dark matter for a wide range of
galaxy parameters. The blue-colored surface and the region under it represent
the parameter space in which the central black hole evaporates rapidly enough
that at least half of the dark matter particles in the cosmological structure
end up dispersed in the Universe. Conversely, the non-colored region shows
parameters for which more than half of the structure ends up being engulfed by
the central black hole, which subsequently evaporates through Hawking
radiation. The calculation spans over 70 orders of magnitude in the dark
matter particle mass, $m_{\rm DM}$, and galaxy masses ranging from dwarf
galaxies of $10^{6}M_{\odot}$ to galaxy clusters of $10^{15}M_{\odot}$. It
also allows for the possibility of the central seed black hole having a range
of masses, from a single star to all the stars of the structure. The figure is
cut short at ${\rm log}\left(m_{\rm DM}/g\right)\sim 0$ to better visualize
the surface, as heavier dark matter particles lie out and above the blue-
colored surface for any galaxy and seed black hole mass shown.

##  3 Three parameters $M_{\rm gal}$, $M_{\rm BH}$ and $m_{\rm DM}$

As DM particles are treated as point-like, they only interact through 2-body
gravitational interactions that are long-range. The corresponding relaxation
process can affect their energy distribution, which may result in the ejection
of DM particles if their velocities exceed the local escape velocity (Spitzer,
1940). However, there is a counteracting effect of dynamical friction
(Chandrasekhar, 1943a), which reduces the velocity of the fastest particles.
Since relaxation is a stochastic process and dynamical friction provides a
systematic deceleration, the resulting energy distribution of DM particles
will not contain particles that will evaporate from the cosmological structure
(see appendix C for more details).

Galaxies can be distinguished based on the available gas and stellar matter,
the total mass of the dark matter halo, and the mass of individual dark matter
particles. Additionally, the initial mass of the central object can vary from
a single stellar mass to the mass of the Milky Way’s black hole, which is
approximately $10^{6}M_{\odot}$, or to supermassive black holes with masses
exceeding several $10^{9}M_{\odot}$. We have today observed a free-floating BH
of mass $\sim 7M_{\odot}$ (Sahu et al., 2022) and EHT took the first image of
the black hole at the center of galaxy Messier 87 (Event Horizon Telescope
Collaboration et al., 2019). The Milky Way has a BH of mass $4\cdot
10^{6}M_{\odot}$ (Ghez et al., 1998; Schodel et al., 2002), Andromeda has a BH
of mass $\sim 1.4\cdot 10^{8}M_{\odot}$ (Al-Baidhany et al., 2020), and it is
believed that most massive galaxies host a supermassive BH near its center
(Kormendy & Ho, 2013).

The gas and stellar matter will either be ejected from the galaxy or absorbed
by the central black hole on much shorter timescales than those of the dark
matter, and to avoid the details of this complication here, we simply allow
these options to be covered by the seed BH mass to range from stellar mass to
the entire mass of the cosmological structure (see Appendix C). 111In
principle, one should also consider collisions between stars and the DM
particles, in the case of sufficiently massive DM particles. For DM particles
not thermally created one can still assume to ignore the non-gravitational
scattering and hence just include gravitational interactions. In this case the
physical extend of the DM particle becomes relevant, since a point-like DM
particle with solar-mass could exhibit strong energy exchange with the white
(or cold, black) dwarfs. It is worth remembering that DM substructures created
from much smaller individual DM particles are very large, typically of the
order $10^{-2}$ pc for Earth mass DM haloes, and about $10$ pc for solar-mass
DM haloes (Diemand & Moore, 2011; Wang et al., 2020). A few of these
substructures typically survive the formation of the galaxies, and will hence
also affect the stellar motion. For simplicity, we will ignore the effects of
interactions between the black dwarfs and the DM particles in this paper.
Consequently, we can reduce the number of important parameters to three: the
mass of the seed black hole (which may include all the mass of present-day
stars and gas), the total mass of the cosmological structure, and the mass of
the individual dark matter particle.

In Figure 2, we present the fate calculation for a wide range of possible
parameters. The general conclusion is that dark matter survives, i.e., it does
not get absorbed by the central black hole, for small dark matter particle
masses. At the second order, smaller seed black hole masses allow for more
dark matter to survive.

##  4 Conclusion

The properties of DM particles are mostly unknown, and they may potentially
decay or undergo annihilation. This paper examines the scenario where DM
particles solely interact gravitationally over significantly longer timescales
compared to the current age of the Universe.

We have demonstrated that the fate of DM is highly dependent on the mass of
the DM particles. Extremely massive DM particles will promptly emit
gravitational waves, leading to their gradual spiral towards the central black
hole of the galaxies. Subsequently, the black hole will emit Hawking
radiation, causing the DM particles to ultimately disappear as radiation.

In the case of lighter DM particles, the emission of gravitational radiation
occurs at a significantly slower rate. As a result, only a minor portion of
the DM particles will be absorbed by the central black hole. Once the central
black hole ceases to exist, the potential of the galaxy is slightly reduced,
and the remaining DM particles within these cosmological structures will
gradually evaporate. Consequently, these DM particles will follow the
”drifting-alone” destiny.

##  Appendix A Evaporation of DM particles when central region has annihilated
away

As discussed in the introduction, some DM particle candidates have
annihilation cross section of the order the weak interaction scale. Such
particle most often also annihilate when two particles get close to each
other.

When DM particles have a non-zero annihilation cross section, then the central
part of the halo will first disappear since the annihilation rate is
proportional to $\rho^{2}$. In this case the potential of the structure is
reduced, and hence the high-energy tail of the DM distribution function may
evaporate from the halo. The corresponding calculation is as follows.

Consider a halo in equilibrium, with a density profile given by $\rho(r)$. One
can integrate the Jeans equation to show that the radial velocity velocity
dispersion is given by

$\sigma_{r}^{2}(r)=\frac{1}{\rho(r)}\int_{r}^{\infty}\frac{\rho(r^{\prime})GM(r^{\prime})}{r^{\prime
2}}\,dr^{\prime}\,$ (A1)

From numerical simulations it is known that the velocity distribution function
does not have an exponential tail, but instead has a rapid decline which goes
to zero around $v=2\sigma_{\rm tot}$ (Hansen et al., 2006). Thus, if the
escape velocity

$v_{\rm esc}(r)=\sqrt{-2\Phi(r)}\,$ (A2)

where $\Phi(r)$ is the potential of the structure, becomes smaller than
approximately 2 times the total velocity dispersion, then the high-energy
particles will escape. Assuming that the velocity anisotropy is zero, one has
$\sigma_{\rm tot}^{2}=3\sigma_{r}^{2}$, and we find that if $10\%$ of the
central mass (in a Hernquist structure) is removed, then the potential is
reduced by slightly more than $10\%$ at all radii. This will reduce the
potential even further, leading to a run-away process where all the DM
particles will evaporate. This is shown in figure 3.

Figure 3: Velocities as a function of radius in a typical DM halo, with scaled
distances and velocities. The total velocity dispersion is given by $\sigma$
(blue line) the circular velocity is $v_{circ}$ (orange line). The uppermost
curve is the escape velocity (green line) for the full structure, and the
reduced escape velocity (second from top, red line) is calculated when
removing the central total mass. When $v_{esc}/\sigma\approx 2$ at a given
radius, then the highest energy particles will escape, and through a run-away
process the entire structure will disperse.

Another popular particle candidate for DM is a decaying DM particle. For
instance, in the case of sterile neutrinos (Dodelson & Widrow, 1994), the
decay time into active neutrinos or photons is approximately $\tau_{\rm
decay}\sim 10^{19}\,\left(\frac{10{\rm keV}}{m}\right)^{3}$ years. As these
particles decay, the resulting galaxy becomes less tightly bound, some of the
particles now have velocities exceeding the escape velocity of the galaxy, and
eventually the remaining part of the galaxy is ripped apart by the accelerated
expansion of space. The dispersed DM particles will also decay.

##  Appendix B Linearized gravity

To describe the GW emission we work under the assumptions of linearized
gravity. This amounts to considering small GW amplitudes, large distances from
the source and short wavelength GWs.

Linearized gravity implies assuming that gravitational waves (GWs) are a small
perturbation to the Minkowski metric
$\eta_{\alpha\beta}\equiv\text{diag}(-1,1,1,1)$. The GWs will therefore be
described by a metric perturbation $h_{\alpha\beta}$ such that the metric
solving the Einstein equation can be written as

$g_{\alpha\beta}=\eta_{\alpha\beta}+h_{\alpha\beta},$ (B1)

with $h_{\alpha\beta}\ll 1$ for every $\alpha,\beta$.

In linearized gravity, the Einstein equation assumes the form

$\square\bar{h}_{\alpha\beta}=-16\pi T_{\alpha\beta}$ (B2)

(Hartle, 2003), in geometrized units ($c=G=1$, mass measured in length).
$T_{\alpha\beta}$ is the stress-energy tensor and the trace-reversed amplitude
$\bar{h}_{\alpha\beta}$ is defined by

$\bar{h}_{\alpha\beta}\equiv
h_{\alpha\beta}-\frac{1}{2}\eta_{\alpha\beta}h\,,$ (B3)

with $h$ being the trace of the metric perturbation (i.e. $h\equiv
h^{\gamma}_{\gamma}$), and $\eta_{\alpha\beta}$ being the Minkowski metric.
The d’Alembert operator $\square$ is defined as

$\square\equiv\frac{\partial}{\partial x_{\nu}}\frac{\partial}{\partial
x^{\nu}}=-\frac{\partial^{2}}{\partial t^{2}}+\nabla^{2},$

following the convention ($-$ \+ + +) for the metric signature. Imposing gauge
conditions allow to close the system and uniquely solve the equation. We
choose the Lorenz gauge, that can be conveniently expressed in terms of
$\bar{h}_{\alpha\beta}$ as

$\frac{\partial\bar{h}^{\alpha\beta}}{\partial x^{\beta}}=0\,.$ (B4)

It can be shown (Hartle, 2003) that the spatial components of the trace-
reversed GW amplitude can be written as

$\bar{h}^{ij}(t,\vec{x})\longrightarrow\frac{2}{r}\ddot{I}^{ij}(t-r),$ (B5)

where the second mass moment $I^{ij}$, here evaluated at the retarded time
$t-r/c=t-r$, is defined as

$I^{ij}\equiv\int x^{\prime i}x^{\prime j}\rho(t,\vec{x})d^{3}x^{\prime}.$
(B6)

The energy flux (energy per unit time per unit area) $f_{GW}$ of a linearized,
plane GW is proportional to the square of the amplitude of the GW, let us call
it $a$, times the square of its frequency $\omega$ (Hartle, 2003):

$f_{GW}=\frac{\omega^{2}a^{2}}{32\pi}.$ (B7)

Since we are looking at the GW far away from the source, and the amplitude in
Eq. B5 describes a spherical wave, the plane wave approximation is legitimate.
The frequency dependence in Eq. B7, together with Eq. B5, suggests a
dependence of $f_{GW}$ which is quadratic in the third time derivative of
$I^{ij}$. We can write:

$f_{GW}\propto\frac{1}{r^{2}}\Big{[}\xi\Big{(}\dddot
I^{ij}\Big{)}\Big{]}^{2}.$ (B8)

The right function $\xi$ can be found by noticing that there is no radiation
from a spherically symmetric mass distribution. The quadrupole moment tensor
can be expressed in terms of the second mass moment as

$Q^{ij}=3I^{ij}-\delta^{ij}I^{k}_{k},$ (B9)

satisfies such requirements. The total power radiated can be found by
integrating $f_{GW}$ over a surface encompassing the mass distribution, say a
sphere, in the limit $r\longrightarrow\infty$, i.e.

$P_{GW}=\lim_{r\to\infty}4\pi\int f_{GW}r^{2}dr\propto\dddot Q_{ij}\dddot
Q^{ij}$ (B10)

Including units we can finally express the total power radiated by
gravitational waves in the quadrupole approximation as

$P_{GW}=\frac{G}{45c^{5}}\left<\dddot Q_{ij}\dddot Q^{ij}\right>,$ (B11)

with $\left<{}\cdot{}\right>$ denoting a time average over a period (Hartle,
2003).

###  B.1 Test mass in central gravitational field

A DM mass $m$ is orbiting a central mass $M$, with $M\gg m$, in an elliptical
orbit with such a low eccentricity that we can assume the orbit to be
circular. Let $R$ be the initial radius of the orbit, $\Omega$ the orbital
frequency. By placing the origin of our Cartesian coordinate system to
coincide with the position of the central object and choosing the orbit to lie
the $xy$ plane we can describe the trajectory of the test mass as:

$\displaystyle x(t)$ $\displaystyle=$ $\displaystyle R\cos(\Omega t)$ (B12)
$\displaystyle y(t)$ $\displaystyle=$ $\displaystyle R\sin(\Omega t)$ (B13)
$\displaystyle z(t)$ $\displaystyle=$ $\displaystyle 0$ (B14)

The mass density of the system can be written as

$\rho(\vec{x})=M\delta(\vec{x})+m\delta(\vec{x}-\vec{r}),$ (B15)

and the components of the second mass moment can then be written

$\displaystyle I^{xx}$ $\displaystyle=$ $\displaystyle mR^{2}\cos^{2}(\Omega
t)=\frac{1}{2}mR^{2}[1+\cos(2\Omega t)]$ (B16) $\displaystyle I^{xy}$
$\displaystyle=$ $\displaystyle mR^{2}\cos(\Omega t)\sin(\Omega
t)=\frac{1}{2}mR^{2}\sin(2\Omega t)$ (B17) $\displaystyle I^{yy}$
$\displaystyle=$ $\displaystyle mR^{2}\sin^{2}(\Omega
t)=\frac{1}{2}mR^{2}[1-\cos(2\Omega t)]$ (B18) $\displaystyle I^{xz}$
$\displaystyle=$ $\displaystyle I^{yz}=I^{zz}=0.$ (B19)

The remaining components are determined by the fact that the second mass
moment is by definition a symmetric tensor, i.e., $I^{ij}=I^{ji}$. The third
time derivative of each non-zero component is easily calculated to be

$\displaystyle\dddot I^{xx}$ $\displaystyle=$
$\displaystyle-4\Omega^{3}mR^{2}\sin(2\Omega t)$ (B20) $\displaystyle\dddot
I^{xy}$ $\displaystyle=$ $\displaystyle 4\Omega^{3}mR^{2}\cos(2\Omega t)$
(B21) $\displaystyle\dddot I^{yy}$ $\displaystyle=$ $\displaystyle
4\Omega^{3}mR^{2}\sin(2\Omega t)=-\dddot I^{xx}.$ (B22)

Recalling the definition of the quadrupole moment B9 and noticing
$\dddot{I}^{kk}=0$, since $I^{k}_{k}=mR^{2}$ is independent of time,

$\dddot Q_{ij}\dddot Q^{ij}=144\Omega^{6}m^{2}R^{4}\big{[}\sin^{2}(2\Omega
t)+2\cos^{2}(2\Omega t)+\sin^{2}(2\Omega t)\big{]}=288\Omega^{6}m^{2}R^{4}.$
(B23)

The power radiated B11 is thus

$P_{GW}=\frac{32G}{5c^{5}}\Omega^{6}m^{2}R^{4}.$ (B24)

This is in agreement with the results of (Weinberg, 1972).

###  B.2 The mass profile of galaxies

We assume the DM mass distribution to be spherically symmetric, with a density
$\rho(r)$ described by the Hernquist profile (Hernquist, 1990)

$\rho(r)=\frac{M}{2\pi}\frac{a}{r}\frac{1}{(r+a)^{3}},$ (B25)

where $M$ is the total mass and $a$ a linear scale of the object. This profile
approximates well the mass distribution of galactic bulges and elliptical
galaxies, but also the DM distribution in haloes. We opt for this profile
instead of the NFW profile since the Hernquist mass is finite without the need
for a truncation at large radii. The cumulative mass profile, and the
corresponding potential pertaining to the density profile B25 are,
respectively (Hernquist, 1990),

$\displaystyle M(r)$ $\displaystyle=$ $\displaystyle
M\frac{r^{2}}{(r+a)^{2}},$ (B26) $\displaystyle\phi(r)$ $\displaystyle=$
$\displaystyle-\frac{GM}{r+a}.$ (B27)

The velocity dispersion $\sigma_{v}^{2}$ is obtained by solving the 1D Jeans
equation for a non-rotating, spherical system. Its radial component,
$\sigma_{v_{r}}^{2}$, is given by (Hernquist, 1990)

$\displaystyle\sigma_{v_{r}}^{2}$ $\displaystyle=$
$\displaystyle\frac{GM}{12a}\Biggl{\\{}\frac{12r(r+a)^{3}}{a^{4}}\ln{\left(\frac{r+a}{r}\right)}$
(B29)
$\displaystyle-\frac{r}{r+a}\Biggl{[}25+52\frac{r}{a}+42\biggl{(}\frac{r}{a}\biggr{)}^{2}+12\biggl{(}\frac{r}{a}\biggr{)}^{3}\Biggr{]}\Biggr{\\}}.$

The corresponding angular velocity is given by

$\Omega^{2}=\frac{\sigma_{v_{T}}^{2}}{r^{2}}=\frac{2\sigma_{v_{r}}^{2}}{r^{2}},$
(B30)

with $\sigma_{v_{T}}^{2}\equiv\sigma_{v_{\theta}}^{2}+\sigma_{v_{\phi}}^{2}$
being the transverse velocity dispersion. In fact, for a spherical system,
$\sigma_{v_{r}}^{2}=\sigma_{v_{\theta}}^{2}=\sigma_{v_{\phi}}^{2}$, so that
$\sigma_{v_{T}}^{2}=2\sigma_{v_{r}}^{2}$. The single particle GW power loss is
thus given by

$P_{\rm
m}(r)=\frac{32Gm^{2}}{5c^{5}}\frac{8\bigl{(}\sigma_{v_{r}}^{2}\bigr{)}^{3}}{r^{2}}.$
(B31)

In figure 4 we show that for a DM particle of mass $1TeV$ and an initial seed
BH of mass $10^{6}M_{\odot}$ the Hawking radiation timescale is longer than
the inspiral time for the entire galaxy, and hence this structure will
inspiral and gets absorbed by the central BH. In contrast a central initial
seed BH of only $10^{3}M_{\odot}$ will evaporate away before a fraction
$10^{-6}$ of the galaxy has inspiraled onto the BH. This implies that all
subsequent inspiraling DM will eventually evaporate through Hawking radiation,
until the remaining DM halo is sufficiently dilute that it will disperse
through the accelerated expansion of the Universe, and hence a significant
fraction of the DM particles will remain as DM particles in the expanding
Universe.

Figure 4: Timescales for inspiral and Hawking radiation as a function of the
fraction of the galaxy. The four dashed lines show the dependence on the mass
of the DM particle, where the upper-most curve are for the lightest DM
particle ($m_{\rm DM}=10^{-14}{\rm GeV})$ and the lowest curve is the most
massive ($m_{\rm DM}=10^{12}{\rm GeV})$. The four solid lines show the Hawking
radiation timescale dependence of the initial seed BH mass. If the initial
seed BH is small (lowest curve, $1M_{\odot}$) then the Hawking radiation
timescale is short, whereas a supermassive BH initial seed of
$10^{11}M_{\odot}$ leads to very long radiation timescales (uppermost solid
curve).

##  Appendix C Evaporation v.s. Dynamical Friction

It has almost become ”common knowledge” that gravitational 2-body interactions
lead to effectively relaxed systems, which implies a slow but steady
evaporation of particles from the system (Spitzer, 1940). The argument is that
the 2-body interactions leads to an exponential distribution of energies, and
since any exponential will have a high-energy tail beyond the systems escape-
velocity, then this implies that particles will evaporate. This conclusion is,
however, incorrect, as we will show now, since it ignores another important
gravitational effect: Dynamical Friction (DF) (Chandrasekhar, 1943a).

The relaxation time arises from long-range encounters causing a cumulative
diffusion of a stars velocity. It is frequently estimated by following the
trajectory of a subject star with initial velocity $v$, as it passes a field
star with impact parameter $b$. The acceleration from the field star gives the
subject star a perpendicular velocity of the order $\delta v=2Gm/(bv)$ (Binney
& Tremaine, 2008). If we consider a large spherical structure with radius $R$
and $N$ particles each with mass $m$, then we can calculate the number of
long-range encounters during one crossing. Each encounter produces a small
perturbation to the subject stars velocity, and since these are independent of
each other we can add the $\delta v^{2}$ linearly. Hereby one can integrate
over all impact parameters to find

$\Delta v^{2}\approx 8N\left(\frac{Gm}{Rv}\right)^{2}\,{\rm log}\Lambda\,$
(C1)

where the Coulomb logarithm comes from the maximum and minimum impact
parameters $b_{\rm max}\sim R$ and $b_{\rm min}\sim R/N$, giving ${\rm
log}\Lambda\sim{\rm log}N$. It is important to keep in mind that the standard
trick of numerical N-body simulations of the inclusion of a softening merely
leads to a slightly bigger value for $b_{\rm min}$, which only enters the
expression through the ${\rm log}\Lambda$. A typical velocity is given by

$v^{2}=\frac{GNm}{R}\,,$ (C2)

and we hence have

$\frac{\Delta v^{2}}{v^{2}}\approx\frac{8\,{\rm log}N}{N}\,,$ (C3)

which implies that after $\frac{N}{8\,{\rm log}N}$ crossings the totalt energy
exchange is of the same level as the initial energy (the stars orbit has been
completely randomized), and this gives the result

$t_{\rm relax}=\frac{N}{8{\rm log}N}\,t_{\rm cross}\,.$ (C4)

This effect is possibly most famous for Globular clusters, where $N\sim
10^{5}$ and crossing times of Myrs makes this 2-body relaxation important
given the age of the globular clusters. If these repeated encounters set up a
Maxwellian distribution of velocities, then the high-energy tail will contain
particles moving beyond the esacape velocity, and these particles will hence
evaporate. Given the small number of particles in the high-energy tail, one
often expects that the entire cosmological structure may evaporate at time-
scales around 100 times the relaxation time (Spitzer, 1940).

There is, however, another gravitational effect, which also must be included,
namely the Dynamical Friction (DF). This effect is often interpreted through
the gravitational focusing behind the particles path, which slows the particle
down, and hence transfers energy from the rapidly moving particles to the slow
ones. By integrating over impact parameters the acceleration is often written
by Chandrasekhars expression (Chandrasekhar, 1943a)

$\frac{d\vec{v}_{M}}{dt}=-16\pi^{2}\,G^{2}m\,\left(m+M\right)\,{\rm
log}N\,\frac{\vec{v}_{M}}{v_{M}^{3}}\,\int_{0}^{v_{M}}f(v_{m})v_{m}^{2}dv_{m}\,,$
(C5)

where the subject star has mass $M$ and the field stars have mass $m$. From
this formula it is clear that only the slower moving field particle contribute
to slowing the subject particle down. For a rapidly moving subject particle
the integral over the field particles is just the number density
$\int_{0}^{\infty}f(v_{m})v_{m}^{2}dv_{m}=n/(4\pi)$ and hence the magnitude of
the acceleration can be written as

$\frac{dv_{M}}{dt}=8\pi\left(\frac{Gm}{v_{M}}\right)^{2}\,{\rm log}N\,n$ (C6)

where we used $M=m$ when considering only DM particles. To make the comparison
with the relaxation time as explicit as possible we will again consider a
sphere of radius $R$ with $N$ particles of mass $m$, where a typical velocity
is still given by $v^{2}=GmN/R$. If we are considering a fast moving particle,
then we can ask the number of crossings (of crossing time $\tau_{\rm
cross}=R/N$) the particle needs, in order to reduce its velocity by the order
$v$

$\frac{dv_{M}}{dt}\,n_{\rm cross}\,\tau_{\rm cross}\approx v\,,$ (C7)

which is solved by

$n_{\rm cross}^{-1}\approx\frac{6\,{\rm log}N}{N}.$ (C8)

Comparing with eq. C3 we thus see that the timescale for reducing the velocity
of fastmoving particles is the same (within a factor of 3/4) as that of
evaporation.

The process of relaxation/evaporation is a stochastic process, whereas DF has
a systematic decelerating effect. Any given particle which happens to have a
velocity slightly larger than the field particles will therefore have its
velocity reduced by DF faster than the statistical process of relaxation can
push it beyond the escape velocity.

The inclusion of DF in the calculation of stellar evaporation was first
studied in (Chandrasekhar, 1943b) by considering the stochastic process of
relaxation as a diffusion process. The conclusions of (Chandrasekhar, 1943b)
was also that the effect of DF is crucial to include in order to calculate
evaporation, even though the paper (Chandrasekhar, 1943b) works under the
assumption of Gaussian distributions of velocities, which is today known to be
incorrect long before the onset of effects of both relaxation of DF (Hansen et
al., 2006). It is expected that the very rapid process of violent relaxation
(Binney & Tremaine, 2008) is responsible for the appearance of the non-
exponential shape of the velocity distribution function with no high-energy
particles. As shown in Figure 4, the stochastic appearance of high-energy
particles will immediately be damped by DF, and hence no DM particles will
evaporate. This calculation only considers $N=10^{3}$ particles, and the
effect of DF is only calculated accurately for the high-energy tail of the
energy distribution (the bulk of the particles have their energies adjusted
accordingly to assure energy conservation in each time-step), and thus a more
careful calculation is needed in order to address complicated dynamical
systems like Globular clusters. The above argument (and simple calculation) is
here partly used as an argument why we may allow the ”initial seed” BH to
cover everything from a single star, to the mass of the entire collection of
stars.

Figure 5: The normalized energy distribution. The yellow dashed histogram
shows an energy distribution of $N=10^{3}$ particles with random energies
between 0 and 1. By allowing the particles to exchange energy through elastic
collision one obtains the orange line analytically. Numerically by allowing
$10^{4}$ times $N/2$ collisions with a maximal energy exchange of $1\%$ of the
particle energies, one gets the green (up-sloping hatched) histogram, which
follows the analytical prediction. By including the effect of dynamical
friction for the $5\%$ of the particles with highest energy (corresponding to
the $2\sigma$ tail), one get a reduction of the high-energy tail, as
represented by the solid red histogram. Here we included the factor of $3/4$
as derived above. Interestingly, it is visible how the high-energy particles
are now slightly piled up at lower energies.

It is a pleasure thanking the referee for very constructive suggestions which
improved the paper. SHH thanks Jens Hjorth and Radek Wojtak for interesting
discussions.

## References

  * Abbott et al. (2016) Abbott, B., Abbott, R., Abbott, T., et al. 2016, Physical Review Letters, 116, doi: 10.1103/physrevlett.116.061102
  * Adams & Laughlin (1997) Adams, F. C., & Laughlin, G. 1997, Reviews of Modern Physics, 69, 337, doi: 10.1103/RevModPhys.69.337
  * Al-Baidhany et al. (2020) Al-Baidhany, I. A., Chiad, S. S., Jabbar, W. A., et al. 2020, AIP Conference Proceedings, 2290, 050050, doi: 10.1063/5.0027838
  * Bassett & Liberati (1998) Bassett, B. A., & Liberati, S. 1998, Phys. Rev. D, 58, 021302, doi: 10.1103/PhysRevD.60.049902
  * Bertone et al. (2005) Bertone, G., Hooper, D., & Silk, J. 2005, Physics Reports, 405, 279, doi: 10.1016/j.physrep.2004.08.031
  * Binney & Tremaine (2008) Binney, J., & Tremaine, S. 2008, Galactic Dynamics: Second Edition
  * Chandrasekhar (1943a) Chandrasekhar, S. 1943a, Astrophysical Journal, 97, 255, doi: 10.1086/144517
  * Chandrasekhar (1943b) —. 1943b, Astrophysical Journal, 97, 263, doi: 10.1086/144518
  * Chung et al. (2001) Chung, D. J. H., Crotty, P., Kolb, E. W., & Riotto, A. 2001, Phys. Rev. D, 64, 043503, doi: 10.1103/PhysRevD.64.043503
  * Chung et al. (1998) Chung, D. J. H., Kolb, E. W., & Riotto, A. 1998, Phys. Rev. Lett., 81, 4048, doi: 10.1103/PhysRevLett.81.4048
  * Diemand & Moore (2011) Diemand, J., & Moore, B. 2011, Adv. Sci. Lett., 4, 297, doi: 10.1166/asl.2011.1211
  * Dodelson & Widrow (1994) Dodelson, S., & Widrow, L. M. 1994, Physical Review Letters, 72, 17, doi: 10.1103/PhysRevLett.72.17
  * Dolgov & Hansen (1999) Dolgov, A. D., & Hansen, S. H. 1999, Nucl. Phys. B, 548, 408, doi: 10.1016/S0550-3213(99)00158-3
  * Dolgov & Kirilova (1990) Dolgov, A. D., & Kirilova, D. P. 1990, Sov. J. Nucl. Phys., 51, 172
  * Einstein (1918) Einstein, A. 1918, Sitzungsber. Preuss. Akad. Wiss. Berlin (Math. Phys. ), 1918, 154
  * Event Horizon Telescope Collaboration et al. (2019) Event Horizon Telescope Collaboration, Akiyama, K., Alberdi, A., et al. 2019, ApJ, 875, L1, doi: 10.3847/2041-8213/ab0ec7
  * Ford (2021) Ford, L. H. 2021, Rept. Prog. Phys., 84, doi: 10.1088/1361-6633/ac1b23
  * Ghez et al. (1998) Ghez, A. M., Klein, B. L., Morris, M., & Becklin, E. E. 1998, ApJ, 509, 678, doi: 10.1086/306528
  * Grib & Mamaev (1969) Grib, A. A., & Mamaev, S. G. 1969, Yad. Fiz., 10, 1276
  * Grib et al. (1976) Grib, A. A., Mamaev, S. G., & Mostepanenko, V. M. 1976, Gen. Rel. Grav., 7, 535, doi: 10.1007/BF00766413
  * Hansen et al. (2006) Hansen, S. H., Moore, B., Zemp, M., & Stadel, J. 2006, Journal of Cosmology and Astroparticle Physics, 2006, 014, doi: 10.1088/1475-7516/2006/01/014
  * Hartle (2003) Hartle, J. B. 2003, Gravity: an introduction to Einstein’s general relativity
  * Hawking (1975) Hawking, S. W. 1975, Communications in Mathematical Physics, 43, 199, doi: 10.1007/BF02345020
  * Hernquist (1990) Hernquist, L. 1990, Astrophysical Journal, 356, 359, doi: 10.1086/168845
  * Kolb et al. (2023) Kolb, E. W., Ling, S., Long, A. J., & Rosen, R. A. 2023, Journal of High Energy Physics, 2023, 181, doi: 10.1007/JHEP05(2023)181
  * Kormendy & Ho (2013) Kormendy, J., & Ho, L. C. 2013, ARA&A, 51, 511, doi: 10.1146/annurev-astro-082708-101811
  * Kuzmin & Tkachev (1999) Kuzmin, V., & Tkachev, I. 1999, Phys. Rev. D, 59, 123006, doi: 10.1103/PhysRevD.59.123006
  * Lebedev (2021) Lebedev, O. 2021, Prog. Part. Nucl. Phys., 120, 103881, doi: 10.1016/j.ppnp.2021.103881
  * Lundmark (1930) Lundmark, K. 1930, Meddelanden fran Lunds Astronomiska Observatorium Serie I, 125, 1
  * Mamaev et al. (1976) Mamaev, S. G., Mostepanenko, V. M., & Starobinsky, A. A. 1976, Zh. Eksp. Teor. Fiz., 70, 1577
  * Markevitch et al. (2004) Markevitch, M., Gonzalez, A. H., Clowe, D., et al. 2004, Astrophysical Journal, 606, 819, doi: 10.1086/383178
  * Oort (1932) Oort, J. H. 1932, Bull. Astron. Inst. Netherlands, 6, 249
  * Parker (1969) Parker, L. 1969, Physical Review, 183, 1057, doi: 10.1103/PhysRev.183.1057
  * Parker (1971) Parker, L. 1971, Phys. Rev. D, 3, 346, doi: 10.1103/PhysRevD.3.346
  * Planck Collaboration et al. (2016) Planck Collaboration, Ade, P. A. R., Aghanim, N., et al. 2016, A&A, 594, A13, doi: 10.1051/0004-6361/201525830
  * Rubin et al. (1980) Rubin, V. C., Ford, W. K., J., & Thonnard, N. 1980, ApJ, 238, 471, doi: 10.1086/158003
  * Sahu et al. (2022) Sahu, K. C., Anderson, J., Casertano, S., et al. 2022, The Astrophysical Journal, 933, 83, doi: 10.3847/1538-4357/ac739e
  * Schiavi et al. (2020) Schiavi, R., Capuzzo-Dolcetta, R., Arca-Sedda, M., & Spera, M. 2020, Astronomy and Astrophysics, 642, A30, doi: 10.1051/0004-6361/202038674
  * Schodel et al. (2002) Schodel, R., et al. 2002, Nature, 419, 694, doi: 10.1038/nature01121
  * Spitzer (1940) Spitzer, Lyman, J. 1940, Monthly Notices of the RAS, 100, 396, doi: 10.1093/mnras/100.5.396
  * Traschen & Brandenberger (1990) Traschen, J. H., & Brandenberger, R. H. 1990, Phys. Rev. D, 42, 2491, doi: 10.1103/PhysRevD.42.2491
  * Wang et al. (2020) Wang, J., Bose, S., Frenk, C. S., et al. 2020, Nature, 585, 39, doi: 10.1038/s41586-020-2642-9
  * Weinberg (1972) Weinberg, S. 1972, Gravitation and Cosmology: Principles and Applications of the General Theory of Relativity
  * Weisberg et al. (1981) Weisberg, J. M., Taylor, J. H., & Fowler, L. A. 1981, Scientific American, 245, 74, doi: 10.1038/scientificamerican1081-74
  * Zwicky (1937) Zwicky, F. 1937, ApJ, 86, 217, doi: 10.1086/143864


# Delving into the Adversarial Robustness of Federated Learning

Jie Zhang1∗ Bo Li2∗‡ Chen Chen3 Lingjuan Lyu3‡
Shuang Wu2 Shouhong Ding2 Chao Wu1‡

###### Abstract

In Federated Learning (FL), models are as fragile as centrally trained models
against adversarial examples. However, the adversarial robustness of federated
learning remains largely unexplored. This paper casts light on the challenge
of adversarial robustness of federated learning. To facilitate a better
understanding of the adversarial vulnerability of the existing FL methods, we
conduct comprehensive robustness evaluations on various attacks and
adversarial training methods. Moreover, we reveal the negative impacts induced
by directly adopting adversarial training in FL, which seriously hurts the
test accuracy, especially in non-IID settings. In this work, we propose a
novel algorithm called Decision Boundary based Federated Adversarial Training
(DBFAT), which consists of two components (local re-weighting and global
regularization) to improve both accuracy and robustness of FL systems.
Extensive experiments on multiple datasets demonstrate that DBFAT consistently
outperforms other baselines under both IID and non-IID settings.

11footnotetext: Equal contribution. Work done during Jie Zhang’s internship at
Tencent Youtu Lab and partly done at Sony AI.33footnotetext: Corresponding
author.

## Introduction

Nowadays, end devices are generating massive amounts of potentially sensitive
user data, raising practical concerns over security and privacy. Federated
Learning (FL) (McMahan et al. 2017) emerges as a privacy-aware learning
paradigm that allows multiple clients to collaboratively train neural networks
without revealing their raw data. Recently, FL has attracted increasing
attention from different areas, including medical image analysis (Liu et al.
2021a; Chen et al. 2021b), recommender systems (Liang, Pan, and Ming 2021; Liu
et al. 2021b), natural language processing (Zhu et al. 2020; Wang et al.
2021), etc.

Table 1: The accuracy (%) is tested under PGD-40 attack (Madry et al. 2017).
For MNIST, FMNIST, CIFAR10, ImageNet-12, CIFAR100, and Tiny-ImageNet, the
perturbation bound is $\\{0.3,32/255,0.031,0.031,0.031,0.031\\}$,
respectively. $A_{cln}$ and $A_{rob}$ refer to clean accuracy and robust
accuracy.

Type | Dataset | MNIST | FMNIST | ImageNet-12 | CIFAR10 | CIFAR100 | Tiny-ImageNet
---|---|---|---|---|---|---|---
Centralized | $A_{cln}$ | 99.42 | 92.47 | 78.96 | 94.26 | 86.93 | 57.93
$A_{rob}$ | 0 | 0 | 0 | 0 | 0 | 0
Federated | $A_{cln}$ | 99.01 | 88.51 | 71.65 | 85.81 | 81.28 | 49.79
$A_{rob}$ | 0 | 0 | 0 | 0 | 0 | 0

Prior studies have demonstrated that neural networks are vulnerable to evasion
attacks by adversarial examples (Goodfellow, Shlens, and Szegedy 2014) during
inference time. The goal of inference-time adversarial attack (Li et al.
2021a; Chen et al. 2022c; Zhang et al. 2022b; Chen et al. 2022b) is to damage
the global model by adding a carefully generated imperceptible perturbation on
the test examples. As shown in Table 1, federated models are as fragile to
adversarial examples as centrally trained models (i.e. zero accuracy under
PGD-40 attack (Madry et al. 2017)). Hence, it is also important to consider
how to defend against adversarial attacks in federated learning.

There are several works that aim to deal with adversarial attacks in FL (Zhang
et al. 2022c, a), i.e, federated adversarial training (FAT) (Zizzo et al.
2020; Hong et al. 2021; Shah et al. 2021; Chen, Zhang, and Lyu 2022; Chen et
al. 2022a). (Zizzo et al. 2020) and (Hong et al. 2021) proposed to conduct
adversarial training (AT) on a proportion of clients but conduct plain
training on other clients. (Shah et al. 2021) investigated the impact of local
training rounds in FAT. Nevertheless, these methods all ignore the issue that
the clean accuracy of federated adversarial training is very low.

Figure 1: Left: Test accuracy reduces for plainly trained model and
adversarially trained model under non-IID data. Meanwhile, adversarial
training hurts the performance. Right: Evaluations on CIFAR10 for both
accuracy and robustness, including several state-of-the-art defense methods
combined with FL. Our method outperforms existing baselines on both metric
dimensions.

To further show the problems of federated adversarial training, we first begin
with the comparison between the plainly-trained models and AT-trained (Madry
et al. 2017) models in both the IID (Independent and Identically Distributed)
and non-IID FL settings, measured by clean accuracy $A_{cln}$ and robust
accuracy $A_{rob}$, respectively. We show the test accuracy of plain training
and adversarial training (AT) on CIFAR10 dataset under both IID and non-IID FL
settings in Fig. 1 (left sub-figure). We summarize some valuable observations
as follows: 1) Compared with the plainly-trained models, AT-trained models
achieve a lower accuracy, which indicates that directly adopting adversarial
training in FL can hurt $A_{cln}$; 2) $A_{cln}$ drops heavily for both the
plainly-trained models and AT-trained models under non-IID distribution, which
is exactly the challenge that typical federated learning with heterogeneous
data encountered (Zhao et al. 2018); 3) The performance of AT-trained models
with non-IID data distribution decrease significantly compared with IID data
distribution. Motivated by these observations, we focus on improving both
adversarial robustness and clean accuracy of adversarial training in FL, i.e.,
we aim to increase $A_{cln}$ while keeping $A_{rob}$ as high as possible.

To achieve this goal, in this paper, we investigate the impact of decision
boundary, which can greatly influence the performance of the model in FAT.
Specifically, 1) we apply adversarial training with a re-weighting strategy in
local update to get a better $A_{rob}$. Our method takes the limited data of
each client into account, those samples that are close to/far from the
decision boundary are assigned larger/smaller weight. 2) Moreover, since the
global model in FL has a more accurate decision boundary through model
aggregation, we take advantage of the logits from the global model and
introduce a new regularization term to increase $A_{cln}$. This regularization
term aims to alleviate the accuracy reduction across distributed clients.

We conclude our major contributions as follows:

  * •

We conduct systematic studies on the adversarial robustness of FL, and provide
valuable observations from extensive experiments.

  * •

We reveal the negative impacts of adopting adversarial training in FL, and
then propose an effective algorithm called Decision Boundary based Federated
Adversarial Training (DBFAT), which utilized local re-weighting and global
regularization to improve both the accuracy and robustness of FL systems.

  * •

Extensive experiments on multiple datasets demonstrate that our proposed DBFAT
consistently outperforms other baselines under both IID and non-IID settings.
We present the performance of our method in Fig. 1 (right sub-figure), which
indicates the improvement in both robustness and accuracy of adversarial
training in FL.

Table 2: An empirical study on the adversarial robustness of FL, measured by
various combination of defense methods and FL algorithms. We report the clean
accuracy and robust accuracy, respectively. Best results are in bold.

Type | IID |  | Non-IID |
---|---|---|---|---
Methods | FedAvg | FedProx | FedNova | Scaffold | FedAvg | FedProx | FedNova | Scaffold
Performance | $A_{cln}$ | $A_{rob}$ | $A_{cln}$ | $A_{rob}$ | $A_{cln}$ | $A_{rob}$ | $A_{cln}$ | $A_{rob}$ | $A_{cln}$ | $A_{rob}$ | $A_{cln}$ | $A_{rob}$ | $A_{cln}$ | $A_{rob}$ | $A_{cln}$ | $A_{rob}$
PGD-AT | 57.99 | 31.95 | 58.17 | 32.06 | 58.45 | 31.74 | 56.84 | 29.26 | 46.84 | 26.79 | 48.03 | 27.46 | 46.95 | 26.54 | 42.44 | 27.19
ALP | 62.81 | 31.84 | 62.88 | 31.20 | 62.91 | 31.79 | 60.30 | 29.58 | 56.16 | 28.78 | 55.79 | 29.06 | 55.80 | 29.18 | 48.29 | 26.56
TRADES | 64.94 | 32.93 | 64.29 | 32.97 | 64.46 | 33.29 | 63.14 | 33.58 | 60.94 | 27.06 | 61.05 | 27.94 | 60.34 | 28.78 | 59.53 | 27.78
MMA | 65.14 | 30.29 | 63.65 | 31.29 | 65.27 | 29.31 | 64.28 | 32.98 | 59.69 | 28.64 | 60.17 | 28.09 | 61.03 | 28.47 | 61.53 | 28.13
AVMixup | 66.14 | 32.27 | 65.12 | 33.19 | 65.14 | 33.75 | 65.11 | 33.24 | 61.17 | 28.56 | 61.47 | 28.34 | 62.04 | 28.12 | 61.91 | 28.81

## Related Works

#### Federated Learning.

Following the success of DNNs in various tasks (Li et al. 2019; Li, Sun, and
Guo 2019; Huang et al. 2022b, a; Dong et al. 2021), FL has attracted
increasing attention. A recent survey has pointed out that existing FL systems
are vulnerable to various attacks that aim to either compromise data privacy
or system robustness (Lyu et al. 2022). In particular, robustness attacks can
be broadly classified into training-time attacks (data poisoning and model
poisoning) and inference-time attacks (evasion attacks, i.e., using
adversarial examples to attack the global model during inference phase). In
FL, the architectural design, distributed nature, and data constraints can
bring new threats and failures (Kairouz 2021).

#### Adversarial Attacks.

The white-box attacks have access to the whole details of threat models,
including parameters and architectures. Goodfellow et al. (Goodfellow, Shlens,
and Szegedy 2014) introduced the Fast Gradient Sign Method (FGSM) to generate
adversarial examples, which uses a single-step first-order approximation to
perform gradient ascent. Kurakin et al. (Kurakin, Goodfellow, and Bengio 2017)
iteratively applied FGSM with a small step-size to develop a significantly
stronger multi-step variant, called Iterative FGSM (I-FGSM). Based on these
findings, more powerful attacks have been proposed in recent years including
MIM (Dong et al. 2018), PGD (Madry et al. 2017), CW (Carlini and Wagner 2017),
and AA (Croce and Hein 2020).

#### Adversarial Training.

Adversarial training has been one of the most effective defense strategies
against adversarial attacks. Madry et al. (Madry et al. 2017) regarded
adversarial training as a min-max formulation using empirical risk
minimization under PGD attack. Kannan et al. (Kannan, Kurakin, and Goodfellow
2018) presented adversarial logit pairing (ALP), a method that encourages
logits for pairs of examples to be similar, to improve robust accuracy. To
quantify the trade-off between accuracy and robustness, Zhang et al. (Zhang et
al. 2019) introduced a TRADES loss to achieve a tight upper bound on the gap
between clean and robust error. Based on the margin theory and soft-labeled
data augmentation, Ding et al. (Ding et al. 2020) proposed Max-Margin
Adversarial (MMA) training and Lee et al. (Lee, Lee, and Yoon 2020) introduced
Adversarial Vertex mixup (AVmixup).

#### Federated Adversarial Training.

In terms of the adversarial robustness, Zizzo et al. (Zizzo et al. 2020)
investigated the effectiveness of the federated adversarial training protocol
for idealized federated settings, and showed the performance of their models
in a traditional centralized setting and a distributed FL scenario. Zhou et
al. (Zhou et al. 2022) decomposed the aggregation error of the central server
into bias and variance. However, all these methods sacrificed clean accuracy
(compared to plainly trained models) to gain robustness. In addition,
certified defense (Chen et al. 2021a) against adversarial examples in FL is
another interesting direction, which will be discussed in the future.

## Adversarial Robustness of FL

In this section, we briefly define the goal of federated adversarial training.
Then we conduct a systematic study on some popular federated learning
algorithms with the combination of various adversarial training methods and
evaluate their robustness under several attacks. Besides, we further reveal
the challenges of adversarial training in non-IID FL.

### Problem Definition

In typical federated learning, training data are distributed across all the
$K$ clients, and there is a central server managing model aggregations and
communications with clients. In general, federated learning attempts to
minimize the following optimization:

$\min_{w}f(w)=\sum_{k=1}^{K}\frac{n_{k}}{n}F_{k}(w).$ (1)

Here, we denote that the global approximate optimal is a sum of local
objectives weighted by the local data size $n_{k}$, and $n$ is the total data
size of all clients that participate in a communication round. Moreover, each
local objective measures the empirical risk over possibly different data
distributions $D_{k}$, which can be expressed as:

$F_{k}(w):=\mathbb{E}_{x_{k}\sim\mathcal{D}_{k}}\left[f_{k}\left(w;x_{k}\right)\right].$
(2)

Let $x$ denote the original image, $x^{adv}$ denote the corresponding
adversarial example, and $\delta$ denote the perturbation added on the
original image, then $x^{adv}=x+\delta$. To generate powerful adversarial
examples, we attempt to maximize the loss $L(x+\delta;w)$, where $L$ is the
loss function for local update.

To improve the robustness of the neural networks, many adversarial defense
methods have been proposed. Among them, adversarial training (Carlini and
Wagner 2017) is one of the most prevailing and effective algorithms. Combined
with adversarial training, the local objective becomes solving the following
min-max optimization problem:

$F_{k}(w)=\min\mathbb{E}_{x_{k}\sim\mathcal{D}_{k}}\left[\max_{\|x^{adv}-x\|_{\infty}\leq\delta}L(w,x^{adv},y)\right].$
(3)

The inner maximization problem aims to find effective adversarial examples
that achieve a high loss, while the outer optimization updates local models to
minimize training loss.

In this work, we conduct a systematic study on several state-of-the-art FL
algorithms including FedAvg (McMahan et al. 2017), FedProx (Li et al. 2018),
FedNova (Wang et al. 2020) and Scaffold (Karimireddy et al. 2020), and explore
their combinations with AT methods to defend against adversarial attacks. We
report detailed results in Table 2, here robustness is averaged over four
popular attacks (FGSM (Kurakin, Goodfellow, and Bengio 2017), MIM (Dong et al.
2018), PGD (Madry et al. 2017), and CW (Carlini and Wagner 2017)). Besides, we
implement some prevailing adversarial training methods including PGD_AT (Madry
et al. 2017) , TRADES (Zhang et al. 2019), ALP (Kannan, Kurakin, and
Goodfellow 2018), MMA (Ding et al. 2020) and AVMixup (Lee, Lee, and Yoon
2020). We observe that there is no federated adversarial learning algorithm
that can outperform all the others in all cases. Moreover, the clean accuracy
drops heavily under non-IID distribution. As such, we are motivated to develop
a more effective method. Due to the similar performance of these FL methods
observed from Table 2, we design our method based on FedAvg – a representative
algorithm in FL.

### Adversarial Traning with non-IID Data

Federated learning faces the statistical challenge in real-world scenarios.
The IID data makes the stochastic gradient as an unbiased estimate of the full
gradient (McMahan et al. 2017). However, the clients are typically highly
heterogeneous with various kinds of non-IID settings, such as label skewness
and feature skewness (Li et al. 2021b). According to previous studies (Wang et
al. 2020; Karimireddy et al. 2020), the non-IID data settings can degrade the
effectiveness of the deployed model.

Figure 2: Test accuracy on a randomly selected client.

Similarly, due to the non-IID data, the performance of AT may vary widely
across clients. To better understand the challenge of adversarial training
with non-IID data, we examine the performance of both clean accuracy and
robustness on a randomly selected client and report the results in Fig. 2.
Observed from Fig. 2, we can find that: 1) $A_{cln}$ on the plainly trained
model drops from majority classes to minority classes, which is exactly what
traditional imbalanced learning attempts to solve; 2) A similar decreasing
tendency reasonably occurs in $A_{rob}$. It is obvious that adopting
adversarial training in federated learning with non-IID data is more
challenging.

Figure 3:  Plain training and adversarial training under non-IID setting.
Compared with plainly trained situation, the aggregation of adversarially
trained models can lead to a more biased model which enlarges accuracy gap.
Consequently, it results in poor consistency between different clients.

According to above observations, we conjecture that AT-trained local models
with imbalanced data lead to a more biased decision boundary than plainly
trained ones. Since adversarial examples need a larger number of epochs to
achieve near-zero error (Zhang et al. 2021), it becomes harder to fit
adversarial examples than clean data. However, for the local client itself,
imbalanced clean data generates imbalanced adversarial examples, making it
more difficult for training and enlarging the accuracy gap, which can reduce
the performance both in accuracy and robustness. In Fig. 3, we also show the
differences between plain training and adversarial training in federated
settings. Compared with the plainly trained models, the aggregation of
adversarially trained models can enlarge the accuracy gap, which results in
poor consistency between different clients. To overcome this problem, we
propose a novel method to utilize local re-weighting and global regularization
to improve both the accuracy and robustness of FL systems.

## Methodology

The generalization performance of a neural network is closely related to its
decision boundary. However, models trained in the federated setting are biased
compared with the centrally trained models. This is mainly caused by
heterogeneous data and objective inconsistency between clients (Kairouz 2021).
Moreover, a highly skewed data distribution can lead to an extremely biased
boundary (Wang et al. 2020). We tackle this problem in two ways: 1) locally,
we take full advantage of the limited data on the distributed client; 2)
globally, we utilize the information obtained from the global model to
alleviate the biases between clients.

Figure 4: Left panel: Decision boundary of plainly trained model. Middle
panel: Decision boundary of AT-trained model. Right panel: Decision boundary
of DBFAT-trained model. We use the dotted line to represent the boundary of
the clean model, and solid line to represent the boundary of the robust model.
The size of the shape represents the value of the weight. Those samples that
are close to/far from boundary are assigned larger/smaller weight. The
decision boundary of DBFAT-trained model (see the right sub-figure) can
achieve a higher $A_{rob}$ and meanwhile maintain $A_{cln}$.

Subsequently, we propose a simple yet effective approach called Decision
Boundary based Federated Adversarial Training (DBFAT), which consists of two
components. For local training, we re-weight adversarial examples to improve
robustness; while for global aggregation, we utilize the global model to
regularize the accuracy for a lower boundary error $A_{bdy}$. We show the
training process of DBFAT in the supplementary and illustrate an example of
the decision boundary of our approach in Fig. 4.

### Re-weighting with Limited Data

Adversarial examples have the ability to approximately measure the distances
from original inputs to a classifier’s decision boundary (Heo et al. 2018),
which can be calculated by the least number of steps that iterative attack
(e.g. PGD attack (Madry et al. 2017)) needs in order to find its misclassified
adversarial variant. To better utilize limited adversarial examples, we
attempt to re-weight the adversarial examples to guide adversarial training.
For clean examples that are close to the decision boundary, we assign larger
weights; while those examples that are far from the boundary are assigned with
smaller weights.

In this paper, we use PGD-$S$ to approximately measure the geometric distance
to the decision boundary, $S$ denotes the number of maximum iteration. We
generate adversarial examples as follows (Madry et al. 2017):

$\displaystyle{x}^{adv}\leftarrow\Pi_{\mathcal{B}[x,\epsilon]}\left({x}^{adv}+\alpha\cdot\operatorname{sign}(\nabla_{{x}^{adv}}\ell({x}^{adv},y))\right).$
(4)

Here $\Pi_{\mathcal{B}[x,\epsilon]}$ is the projection function that projects
the adversarial data back into the $\epsilon$-ball centered at natural data,
$\alpha$ is the steps size, $\epsilon$ is perturbation bound.

We find the minimum step $d$, such that after $d$ step of PGD, the adversarial
variant can be misclassified by the network, i.e.,
$arg\;max_{c}f^{(c)}(x^{adv})\neq y$, where $f^{(c)}(x^{adv})$ is the logits
of the $c$-th label.

In this way, given a mini-batch samples $\\{(x_{i},y_{i})\\}_{i=1}^{m}$, then
the weight list $\rho$ can be formulated as :

$\rho\leftarrow 1-\\{\frac{d_{i}}{\sum_{i=1}^{m}d_{i}}\\}.$ (5)

### Regularization with Global Model

Early work (Zhang et al. 2019; Cui et al. 2021) claims that there exists a
trade-off between accuracy and robustness, standard adversarial training can
hurt accuracy. To achieve a lower boundary error $A_{bdy}$, we take advantage
of logits from the global model $f^{glo}$, which is trained after aggregation.
Particularly, in federated learning, the model owns the information obtained
from the averaged parameters on distributed clients.

Let $f^{loc}$ denote the adversarially trained model at each local client,
$f^{glo}$ has the most desirable classifier boundary for natural data. Then we
can modify the local objective mentioned in Equation 3 as below:

$\displaystyle\min\underbrace{\ell_{ce}(\rho\cdot
f^{loc}(x^{adv}),y)}_{\text{for robustness
}}+\beta\cdot\underbrace{\ell_{kl}(f^{loc}(x^{adv}),f^{glo}(x))}_{\text{for
accuracy regularization}}.$ (6)

Where $\ell_{ce}$ denotes the cross-entropy loss to improve the robustness,
and $\ell_{kl}$ is the KL divergence loss to constrain the logits of global
model and local model. Here, $\ell_{kl}$ appears as an additional
regularization term, which is designed to reduce the boundary error
$A_{bdy}=A_{cln}-A_{rob}$. Additionally, $\rho$ is the weight calculated by
Equation 5, $\beta$ is the parameter to be tuned.

Table 3: Loss functions of different adversarial training methods.

Defense | Loss Function
---|---
PGD_AT | $\operatorname{CE}\left(f\left(x^{adv}\right),y\right)$
ALP | $\operatorname{CE\left(f\left(x^{adv}\right),y\right)}+\beta\cdot\left\|f\left(x^{adv}\right)-f\left(x\right)\right\|_{2}^{2}$
TRADES | $\operatorname{CE\left(f\left(x\right),y\right)}+\beta\cdot\operatorname{KL}\left(f\left(x^{adv}\right)\|f\left(x\right)\right)$
MMA | $\operatorname{CE\left(f\left(x^{adv}\right),y\right)\cdot\mathbb{R}\left(h_{\boldsymbol{\theta}}(\mathbf{x})=y\right)}+\operatorname{CE\left(f\left(x\right),y\right)\cdot\mathbb{R}\left(h_{\boldsymbol{\theta}}(\mathbf{x})\neq y\right)}$
AVMixup | $\operatorname{CE}\left(f\left(x^{av}\right),y^{av}\right)$
DBFAT(ours) | $\rho\cdot\text{CE}(f(x^{adv}),y)+\beta\cdot\text{KL}\left(f\left(x^{adv}\right)\|f^{glo}\left(x\right)\right)$

To show the difference between our DBFAT and existing defense methods, we list
the loss functions of different adversarial training methods in Table 3.

## Experimental Results

### Experimental Setup

Following the previous work of FL (McMahan et al. 2017), we distribute
training data among 100 clients in both IID and non-IID fashion. For each
communication round, we randomly select 10 clients to average the model
parameters. All experiments are conducted with 8 Tesla V100 GPUs. More details
can be referred to the supplemental material.

#### Datasets

In this section, we show that DBFAT improves the robust generalization and
meanwhile maintains a high accuracy with extensive experiments on benchmark CV
datasets, including MNIST (Lecun et al. 1998), FashionMNIST (Xiao, Rasul, and
Vollgraf 2017) (FMNIST), CIFAR10 (Krizhevsky and Hinton 2009), CIFAR100
(Krizhevsky and Hinton 2009), Tiny-ImageNet (Le and Yang 2015), and
ImageNet-12 (Deng et al. 2009). The ImageNet-12 is generated via (Li et al.
2021c), which consists of 12 classes. We resize the original image with size
224*224*3 to 64*64*3 for fast training.

#### Data partitioning

In the federated learning setup, we evaluate all algorithms on two types of
non-IID data partitioning: Dirichlet sampled data and Sharding. For Dirichlet
sampled data, each local client is allocated with a proportion of the samples
of each label according to Dirichlet distribution (Li et al. 2020).
Specifically, we follow the setting in (Yurochkin et al. 2019), for each label
$c$, we sample $p_{c}\sim\operatorname{Dir}_{J}(0.5)$ and allocate $p_{c,j}$
proportion of the whole dataset of label $c$ to client $j$. In this setting,
some clients may entirely have no examples of a subset of classes. For
Sharding (McMahan et al. 2017), each client owns data samples of a fixed
number of labels. Let $K$ be the number of total clients, and $q$ is the
number of labels we assign to each client. We divide the dataset by label into
$K*q$ shards, and the amount of samples in each shard is $\frac{n}{K\cdot q}$.
We denote this distribution as shards_$q$, where $q$ controls the level of
difficulty. If $q$ is set to a smaller value, then the partition is more
unbalanced. An example of these partitioning strategies is shown in Fig. 5, in
which we visualize IID and non-IID distribution (Dirichlet sampled with
$p_{c}\sim\operatorname{Dir}_{J}(0.5)$ and Sharding with shards_$5$) on five
randomly selected clients.

Table 4: Accuracy and adversarial robustness on MNIST, FMNIST and CIFAR10
under both IID and non-IID distribution. An empirical study of FedAvg combined
with several defense methods, more detailed comparisons are reported in the
supplementary (Section B). Our method significantly outperforms other
baselines.

Type |  | IID | Non-IID
---|---|---|---
Dataset | Method | Clean | FGSM | MIM | PGD-20 | CW | AA | Clean | FGSM | MIM | PGD-20 | CW | AA
MNIST | Plain | 99.01 | 28.35 | 8.65 | 5.29 | 3.84 | 3.02 | 98.45 | 11.78 | 14.06 | 8.44 | 9.51 | 7.45
PGD_AT | 98.52 | 76.01 | 60.18 | 54.50 | 55.23 | 50.43 | 97.82 | 67.58 | 52.89 | 48.03 | 47.43 | 43.75
ALP | 98.46 | 57.37 | 55.61 | 48.74 | 51.17 | 44.25 | 97.92 | 46.49 | 51.01 | 46.41 | 46.24 | 41.95
TRADES | 97.89 | 76.79 | 63.29 | 58.25 | 57.24 | 53.72 | 92.03 | 48.45 | 51.56 | 47.21 | 45.81 | 42.36
AVMixup | 98.63 | 61.41 | 53.34 | 42.33 | 46.95 | 37.78 | 97.47 | 56.50 | 51.86 | 46.28 | 44.46 | 41.84
Ours | 98.86 | 78.06 | 70.97 | 68.39 | 63.09 | 59.39 | 97.95 | 68.54 | 54.18 | 50.33 | 49.12 | 44.32
FMNIST | Plain | 88.50 | 17.89 | 3.55 | 2.57 | 0.40 | 0.17 | 84.60 | 17.86 | 3.25 | 2.93 | 3.05 | -1.40
PGD_AT | 76.05 | 68.53 | 65.24 | 65.40 | 64.26 | 60.89 | 72.93 | 60.11 | 54.42 | 54.33 | 52.19 | 49.88
ALP | 75.99 | 67.31 | 63.66 | 63.79 | 61.55 | 59.19 | 75.34 | 57.67 | 53.37 | 55.11 | 51.12 | 51.04
TRADES | 78.13 | 59.33 | 52.65 | 52.78 | 51.44 | 48.78 | 74.93 | 56.53 | 44.01 | 44.01 | 31.80 | 39.61
AVMixup | 79.34 | 61.22 | 54.93 | 54.67 | 49.48 | 50.07 | 72.06 | 56.26 | 49.21 | 49.72 | 47.99 | 45.15
Ours | 81.49 | 69.23 | 66.22 | 66.24 | 65.71 | 61.49 | 76.19 | 63.11 | 56.45 | 58.31 | 56.96 | 53.91
CIFAR10 | Plain | 78.80 | 6.87 | 1.15 | 1.06 | 1.30 | 1.23 | 61.10 | 7.58 | 2.94 | 2.67 | 2.87 | 1.28
PGD_AT | 58.75 | 30.62 | 27.23 | 26.11 | 28.47 | 22.09 | 15.27 | 13.27 | 13.00 | 13.00 | 12.99 | 8.63
ALP | 63.23 | 29.42 | 26.75 | 28.49 | 28.13 | 23.97 | 32.91 | 21.41 | 20.26 | 20.19 | 17.74 | 15.83
TRADES | 68.58 | 31.53 | 25.92 | 25.49 | 23.07 | 20.89 | 46.30 | 24.81 | 22.20 | 22.05 | 19.59 | 17.85
AVMixup | 70.28 | 29.51 | 26.22 | 26.34 | 24.07 | 22.25 | 48.23 | 25.29 | 21.42 | 24.25 | 20.25 | 19.43
Ours | 72.21 | 31.47 | 28.57 | 29.03 | 29.31 | 24.25 | 52.24 | 27.03 | 24.12 | 27.02 | 22.13 | 21.20

Figure 5: Visualizations of IID and non-IID distribution (Dirichlet sampled
and Sharding) across 5 clients on CIFAR10 dataset. Shards_5 is a type of non-
IID setting, in which each client has five categories of data (McMahan et al.
2017). From left to right: client ID number #1-5.

#### MNIST and FMNIST setup

We use a simple CNN with two convolutional layers, followed by two fully
connected layers. Following the setting used in (Goodfellow, Shlens, and
Szegedy 2014), for MNIST, we set perturbation bound $\epsilon=0.3$, and step
size $\alpha=0.01$, and apply adversarial attacks for 20 iterations. For
FMNIST, we set perturbation bound $\epsilon=32/255$, and step size
$\alpha=0.031$, we adversarially train the network for 10 steps and apply
adversarial attacks for 20 iterations. Due to the simplicity of MNIST and
FMNIST, we mainly use non-IID data (Sharding), which is hard to train.

#### CIFAR10, CIFAR100, Tiny-ImageNet and ImageNet-12 setup

We apply a larger CNN architecture, and follow the setting used in (Madry et
al. 2017), i.e., we set the perturbation bound $\epsilon=0.031$, step size
$\alpha=0.007$. To evaluate the robustness, we conduct extensive experiments
with various data partitioning.

#### Baselines

For attack methods, we perform five popular attacks including FGSM (Kurakin,
Goodfellow, and Bengio 2017), MIM (Dong et al. 2018), PGD (Madry et al. 2017),
CW (Carlini and Wagner 2017) and AA (Croce and Hein 2020). We further use
Square (Andriushchenko et al. 2020) for black-box attack. To investigate the
effectiveness of existing FL algorithms, we implement FedAvg(McMahan et al.
2017), FedProx(Li et al. 2018), FedNova(Wang et al. 2020) and
Scaffold(Karimireddy et al. 2020). To defend against adversarial attacks, we
implement four most prevailing methods including PGD_AT(Madry et al. 2017),
TRADES (Zhang et al. 2019), ALP (Kannan, Kurakin, and Goodfellow 2018), MMA
(Ding et al. 2020) and AVMixup (Lee, Lee, and Yoon 2020). We compare the
performance of our DBFAT with various kinds of defense methods combined with
FL methods.

### Convergence For Local Training

Figure 6: Left: Convergence rate for different local epochs. Right: Training
curves of FedAvg combined with different AT methods.

To show the convergence rate of DBFAT, we use the Dirichlet sampled CIFAR10
dataset, where each client owns 500 samples from 5 classes. Fig. 6 (left sub-
figure) shows the impact of local epoch $E$ during adversarial training.
Indeed, for a very small epoch (e.g., $E=2$), it has an extremely slow
convergence rate, which may incur more communications. Besides, a large epoch
(e.g., $E=20$) also leads to a slow convergence, as model may overfit to the
local data. Considering both the communication cost and convergence issues, we
set $E=5$ in our experiments, which can maintain a proper communication
efficiency and fast convergence.

Table 5: Accuracy and adversarial robustness on CIFAR100, Tiny-ImageNet, and
ImageNet-12.

Dataset | CIFAR100 | Tiny-ImageNet | ImageNet-12
---|---|---|---
Method | Clean | PGD-20 | AA | Square | Clean | PGD-20 | AA | Square | Clean | PGD-20 | AA | Square
PGD_AT | 39.32 | 16.07 | 14.36 | 23.44 | 26.33 | 12.26 | 10.26 | 13.54 | 37.42 | 22.61 | 18.30 | 25.57
ALP | 41.12 | 18.46 | 14.78 | 24.54 | 32.78 | 14.62 | 12.19 | 16.48 | 54.96 | 24.78 | 19.57 | 27.73
TRADES | 43.39 | 20.05 | 16.85 | 26.43 | 37.81 | 15.49 | 13.26 | 19.38 | 58.82 | 25.49 | 21.81 | 28.96
AVMixup | 46.64 | 23.56 | 19.46 | 29.16 | 36.19 | 15.28 | 13.18 | 19.25 | 59.63 | 25.81 | 21.92 | 29.28
Ours | 48.31 | 24.47 | 22.46 | 31.57 | 38.24 | 16.17 | 13.96 | 20.26 | 61.38 | 26.47 | 22.08 | 30.91

### Effectiveness of Our Method

We verify the effectiveness of our method compared with several adversarial
training techniques on Dirichlet sampled CIFAR10. Evaluation of model
robustness is averaged under four attacks using the the same setting for a
fair comparison and all defense methods are combined with FedAvg.

To show the differences between DBFAT and above mentioned defense methods, we
report the training curves on non-IID CIFAR10 dataset in the right sub-figure
of Fig. 6. Fig. 6 confirms that our DBFAT achieves the highest clean accuracy.
We speculate that this benefit is due to the regularization term and re-
weighting strategy introduced in Equation 6. It is worth mentioning that in
the training curves, the model trained with PGD_AT performs very poorly. It
indicates that standard AT may not be a suitable choice for adversarial
robustness in FL, as it only uses cross-entropy loss with adversarial
examples, but ignores the negative impact on clean accuracy. We further report
the results on various datasets under both IID and non-IID settings in Table
4, which indicates that DBFAT significantly outperforms other methods in terms
of both accuracy and robustness.

Table 6: Ablation Study by cutting off different modules.

Dataset | CIFAR10 | FMNIST
---|---|---
Methods | $A_{cln}$ | Avg $A_{rob}$ | $A_{cln}$ | Avg $A_{rob}$
Ours | 52.16 | 27.80 | 75.89 | 59.63
Ours (w/o re-weighting) | 48.44 | 25.89 | 72.35 | 56.34
Ours (w/o regularization) | 51.04 | 26.84 | 73.96 | 58.23

#### Performance on large datasets

In Table 5, we show the accuracy and robustness of each method on large
datasets (e.g., CIFAR100, Tiny-ImageNet, and ImageNet-12). All results are
tested under PGD-20 attack (Madry et al. 2017), AutoAttack (Croce and Hein
2020), and Square attack (Andriushchenko et al. 2020) in non-IID settings.
From the results reported in Table 5, we can find that our method still
outperforms other baselines in terms of both clean accuracy and robustness.
Note that our method can achieve the highest accuracy and robustness of 61.38%
and 22.08% under AutoAttack, respectively. It thus proves that our method can
also be used to improve the accuracy and robustness of the model on large
datasets. We think that the higher clean accuracy is a result of the
regularization term introduced in Equation 6, while maintaining a high
robustness.

### Ablation Study

#### Cutting off different modules

As part of our ablation study, we first investigate the contributions of
different modules introduced in DBFAT. As shown in Table 6, turning off both
the re-weighting strategy and regularization term will lead to poor
performance, which demonstrates the importance of both modules. Moreover, cut-
offing the re-weighting strategy can lead to a more severe degradation. We
conjecture this is a reasonable phenomenon. As mentioned in Fig. 1, non-IID
data can cause a serious accuracy reduction. Our re-weighting strategy can
alleviate the bias by taking the limited data on each client into account.

Table 7: Effect of hyper-parameter $\beta$. “Avg $A_{rob}$” refers to the
average robustness under four attacks.

Dataset | MNIST | FMNIST
---|---|---
$\beta$ | $A_{cln}$ | Avg $A_{rob}$ | $A_{cln}$ | Avg $A_{rob}$
4 | 98.30 | 26.64 | 81.73 | 37.36
2 | 98.14 | 34.24 | 75.59 | 47.83
1.5 | 98.46 | 53.22 | 74.93 | 44.08
1 | 97.32 | 47.35 | 65.43 | 42.33
0.5 | 96.57 | 44.09 | 61.02 | 45.28

#### Effects of Regularization

The regularization parameter $\beta$ is an important hyperparameter in our
proposed method. We show how the regularization parameter affects the
performance of our robust classifiers by numerical experiments on two
datasets, MNIST and FMNIST. In Equation 6, $\beta$ controls the accuracy
obtained from the global model, which contains information from distributed
clients. Since directly training on adversarial examples could hurt the clean
accuracy, here we explore the effects of $\beta$ on both accuracy and
robustness. As shown in Table 7, we report the clean accuracy and robustness
by varying the value of $\beta$. We empirically choose the best $\beta$ for
different datasets. For example, for MNIST, $\beta=1.5$ can achieve better
accuracy and robustness. For FMNIST, we let $\beta=2$ for a proper trade-off
in accuracy and robustness.

## Conclusion

In this paper, we investigate an interesting yet not well explored problem in
FL: the robustness against adversarial attacks. We first find that directly
adopting adversarial training in federated learning can hurt accuracy
significantly especially in non-IID setting. We then propose a novel and
effective adversarial training method called DBFAT, which is based on the
decision boundary of federated learning, and utilizes local re-weighting and
global regularization to improve both accuracy and robustness of FL systems.
Comprehensive experiments on various datasets and detailed comparisons with
the state-of-the-art adversarial training methods demonstrate that our
proposed DBFAT consistently outperforms other baselines under both IID and
non-IID settings. This work would potentially benefit researchers who are
interested in adversarial robustness of FL.

## References

  * Andriushchenko et al. (2020) Andriushchenko, M.; Croce, F.; Flammarion, N.; and Hein, M. 2020.  Square Attack: a query-efficient black-box adversarial attack via random search.  arXiv:1912.00049.
  * Carlini and Wagner (2017) Carlini, N.; and Wagner, D. 2017.  Towards evaluating the robustness of neural networks.  In _2017 ieee symposium on security and privacy (sp)_ , 39–57. IEEE.
  * Chen et al. (2021a) Chen, C.; Kailkhura, B.; Goldhahn, R.; and Zhou, Y. 2021a.  Certifiably-Robust Federated Adversarial Learning via Randomized Smoothing.  arXiv:2103.16031.
  * Chen et al. (2022a) Chen, C.; Liu, Y.; Ma, X.; and Lyu, L. 2022a.  CalFAT: Calibrated Federated Adversarial Training with Label Skewness.  In _Advances in Neural Information Processing Systems_.
  * Chen, Zhang, and Lyu (2022) Chen, C.; Zhang, J.; and Lyu, L. 2022.  Gear: a margin-based federated adversarial training approach.  In _International Workshop on Trustable, Verifiable, and Auditable Federated Learning in Conjunction with AAAI_ , volume 2022.
  * Chen et al. (2022b) Chen, Z.; Li, B.; Wu, S.; Xu, J.; Ding, S.; and Zhang, W. 2022b.  Shape Matters: Deformable Patch Attack.  In Avidan, S.; Brostow, G. J.; Cissé, M.; Farinella, G. M.; and Hassner, T., eds., _Computer Vision - ECCV 2022_. Springer.
  * Chen et al. (2022c) Chen, Z.; Li, B.; Xu, J.; Wu, S.; Ding, S.; and Zhang, W. 2022c.  Towards Practical Certifiable Patch Defense With Vision Transformer.  In _Proceedings of the IEEE/CVF Conference on CVPR_ , 15148–15158.
  * Chen et al. (2021b) Chen, Z.; Zhu, M.; Yang, C.; and Yuan, Y. 2021b.  Personalized Retrogress-Resilient Framework for Real-World Medical Federated Learning.  In de Bruijne, M.; Cattin, P. C.; Cotin, S.; Padoy, N.; Speidel, S.; Zheng, Y.; and Essert, C., eds., _Medical Image Computing and Computer Assisted Intervention - MICCAI 2021 - 24th International Conference, Strasbourg, France, September 27 - October 1, 2021, Proceedings, Part III_ , volume 12903 of _Lecture Notes in Computer Science_ , 347–356. Springer.
  * Croce and Hein (2020) Croce, F.; and Hein, M. 2020.  Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks.  arXiv:2003.01690.
  * Cui et al. (2021) Cui, J.; Liu, S.; Wang, L.; and Jia, J. 2021.  Learnable boundary guided adversarial training.  In _Proceedings of the IEEE/CVF international conference on computer vision_ , 15721–15730.
  * Deng et al. (2009) Deng, J.; Dong, W.; Socher, R.; Li, L.-J.; Li, K.; and Fei-Fei, L. 2009.  Imagenet: A large-scale hierarchical image database.  In _2009 IEEE conference on computer vision and pattern recognition_ , 248–255.
  * Ding et al. (2020) Ding, G. W.; Sharma, Y.; Lui, K. Y. C.; and Huang, R. 2020.  MMA Training: Direct Input Space Margin Maximization through Adversarial Training.  arXiv:1812.02637.
  * Dong et al. (2021) Dong, J.; Cong, Y.; Sun, G.; Fang, Z.; and Ding, Z. 2021.  Where and How to Transfer: Knowledge Aggregation-Induced Transferability Perception for Unsupervised Domain Adaptation.  _IEEE Transactions on Pattern Analysis and Machine Intelligence_ , 11(1): 1–17.
  * Dong et al. (2018) Dong, Y.; Liao, F.; Pang, T.; Su, H.; Zhu, J.; Hu, X.; and Li, J. 2018.  Boosting adversarial attacks with momentum.  In _Proceedings of the IEEE conference on computer vision and pattern recognition_ , 9185–9193.
  * Goodfellow, Shlens, and Szegedy (2014) Goodfellow, I. J.; Shlens, J.; and Szegedy, C. 2014.  Explaining and harnessing adversarial examples.  _arXiv preprint arXiv:1412.6572_.
  * Heo et al. (2018) Heo, B.; Lee, M.; Yun, S.; and Choi, J. Y. 2018.  Knowledge Distillation with Adversarial Samples Supporting Decision Boundary.  arXiv:1805.05532.
  * Hong et al. (2021) Hong, J.; Wang, H.; Wang, Z.; and Zhou, J. 2021.  Federated Robustness Propagation: Sharing Adversarial Robustness in Federated Learning.  _arXiv preprint arXiv:2106.10196_.
  * Huang et al. (2022a) Huang, R.; Cui, C.; Chen, F.; Ren, Y.; Liu, J.; Zhao, Z.; Huai, B.; and Wang, Z. 2022a.  Singgan: Generative adversarial network for high-fidelity singing voice generation.  In _Proceedings of the 30th ACM International Conference on Multimedia_ , 2525–2535.
  * Huang et al. (2022b) Huang, R.; Lam, M. W.; Wang, J.; Su, D.; Yu, D.; Ren, Y.; and Zhao, Z. 2022b.  FastDiff: A Fast Conditional Diffusion Model for High-Quality Speech Synthesis.  _arXiv preprint arXiv:2204.09934_.
  * Kairouz (2021) Kairouz, P. 2021.  Advances and Open Problems in Federated Learning.  arXiv:1912.04977.
  * Kannan, Kurakin, and Goodfellow (2018) Kannan, H.; Kurakin, A.; and Goodfellow, I. 2018.  Adversarial logit pairing.  _arXiv preprint arXiv:1803.06373_.
  * Karimireddy et al. (2020) Karimireddy, S. P.; Kale, S.; Mohri, M.; Reddi, S.; Stich, S.; and Suresh, A. T. 2020.  SCAFFOLD: Stochastic controlled averaging for federated learning.  In _International Conference on Machine Learning_ , 5132–5143. PMLR.
  * Krizhevsky and Hinton (2009) Krizhevsky, A.; and Hinton, G. 2009.  Learning multiple layers of features from tiny images.  Technical Report 0, University of Toronto, Toronto, Ontario.
  * Kurakin, Goodfellow, and Bengio (2017) Kurakin, A.; Goodfellow, I.; and Bengio, S. 2017.  Adversarial examples in the physical world.  arXiv:1607.02533.
  * Le and Yang (2015) Le, Y.; and Yang, X. 2015.  Tiny imagenet visual recognition challenge.  _CS 231N_ , 7(7): 3.
  * Lecun et al. (1998) Lecun, Y.; Bottou, L.; Bengio, Y.; and Haffner, P. 1998.  Gradient-based learning applied to document recognition.  _Proceedings of the IEEE_ , 86(11): 2278–2324.
  * Lee, Lee, and Yoon (2020) Lee, S.; Lee, H.; and Yoon, S. 2020.  Adversarial vertex mixup: Toward better adversarially robust generalization.  In _Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition_ , 272–281.
  * Li, Sun, and Guo (2019) Li, B.; Sun, Z.; and Guo, Y. 2019.  SuperVAE: Superpixelwise Variational Autoencoder for Salient Object Detection.  In _The Thirty-Third AAAI Conference_.
  * Li et al. (2019) Li, B.; Sun, Z.; Tang, L.; Sun, Y.; and Shi, J. 2019.  Detecting Robust Co-Saliency with Recurrent Co-Attention Neural Network.  In Kraus, S., ed., _IJCAI_.
  * Li et al. (2021a) Li, B.; Xu, J.; Wu, S.; Ding, S.; Li, J.; and Huang, F. 2021a.  Detecting Adversarial Patch Attacks through Global-local Consistency.  In _ADVM ’21: Proceedings of the 1st International Workshop on Adversarial Learning for Multimedia_ , 35–41. ACM.
  * Li et al. (2021b) Li, Q.; Diao, Y.; Chen, Q.; and He, B. 2021b.  Federated Learning on Non-IID Data Silos: An Experimental Study.  _arXiv preprint arXiv:2102.02079_.
  * Li et al. (2018) Li, T.; Sahu, A. K.; Zaheer, M.; Sanjabi, M.; Talwalkar, A.; and Smith, V. 2018\.  Federated optimization in heterogeneous networks.  _arXiv preprint arXiv:1812.06127_.
  * Li et al. (2020) Li, X.; Huang, K.; Yang, W.; Wang, S.; and Zhang, Z. 2020.  On the Convergence of FedAvg on Non-IID Data.  arXiv:1907.02189.
  * Li et al. (2021c) Li, Y.; Lyu, X.; Koren, N.; Lyu, L.; Li, B.; and Ma, X. 2021c.  Anti-backdoor learning: Training clean models on poisoned data.  _NeurIPS_ , 34.
  * Liang, Pan, and Ming (2021) Liang, F.; Pan, W.; and Ming, Z. 2021.  FedRec++: Lossless Federated Recommendation with Explicit Feedback.  In _Thirty-Fifth AAAI Conference on Artificial Intelligence, AAAI 2021_ , 4224–4231. AAAI Press.
  * Liu et al. (2021a) Liu, Q.; Chen, C.; Qin, J.; Dou, Q.; and Heng, P. 2021a.  FedDG: Federated Domain Generalization on Medical Image Segmentation via Episodic Learning in Continuous Frequency Space.  In _IEEE Conference on Computer Vision and Pattern Recognition, CVPR 2021, virtual, June 19-25, 2021_ , 1013–1023. Computer Vision Foundation / IEEE.
  * Liu et al. (2021b) Liu, S.; Xu, S.; Yu, W.; Fu, Z.; Zhang, Y.; and Marian, A. 2021b.  FedCT: Federated Collaborative Transfer for Recommendation.  In Diaz, F.; Shah, C.; Suel, T.; Castells, P.; Jones, R.; and Sakai, T., eds., _SIGIR ’21: The 44th International ACM SIGIR Conference on Research and Development in Information Retrieval, Virtual Event, Canada, July 11-15, 2021_ , 716–725. ACM.
  * Lyu et al. (2022) Lyu, L.; Yu, H.; Ma, X.; Chen, C.; Sun, L.; Zhao, J.; Yang, Q.; and Philip, S. Y. 2022.  Privacy and robustness in federated learning: Attacks and defenses.  _IEEE transactions on neural networks and learning systems_.
  * Madry et al. (2017) Madry, A.; Makelov, A.; Schmidt, L.; Tsipras, D.; and Vladu, A. 2017.  Towards deep learning models resistant to adversarial attacks.  _arXiv preprint arXiv:1706.06083_.
  * McMahan et al. (2017) McMahan, B.; Moore, E.; Ramage, D.; Hampson, S.; and y Arcas, B. A. 2017.  Communication-efficient learning of deep networks from decentralized data.  In _Artificial Intelligence and Statistics_ , 1273–1282. PMLR.
  * Shah et al. (2021) Shah, D.; Dube, P.; Chakraborty, S.; and Verma, A. 2021.  Adversarial training in communication constrained federated learning.  _arXiv preprint arXiv:2103.01319_.
  * Wang et al. (2021) Wang, C.; Deng, J.; Meng, X.; Wang, Y.; Li, J.; Miao, F.; Rajasekaran, S.; and Ding, C. 2021.  A Secure and Efficient Federated Learning Framework for NLP.  In _EMNLP 2021_ , 7676–7682. Association for Computational Linguistics.
  * Wang et al. (2020) Wang, J.; Liu, Q.; Liang, H.; Joshi, G.; and Poor, H. V. 2020.  Tackling the objective inconsistency problem in heterogeneous federated optimization.  _arXiv preprint arXiv:2007.07481_.
  * Xiao, Rasul, and Vollgraf (2017) Xiao, H.; Rasul, K.; and Vollgraf, R. 2017.  Fashion-MNIST: a Novel Image Dataset for Benchmarking Machine Learning Algorithms.  arXiv:1708.07747.
  * Yurochkin et al. (2019) Yurochkin, M.; Agarwal, M.; Ghosh, S.; Greenewald, K.; Hoang, T. N.; and Khazaeni, Y. 2019.  Bayesian Nonparametric Federated Learning of Neural Networks.  arXiv:1905.12022.
  * Zhang et al. (2019) Zhang, H.; Yu, Y.; Jiao, J.; Xing, E.; El Ghaoui, L.; and Jordan, M. 2019.  Theoretically principled trade-off between robustness and accuracy.  In _International Conference on Machine Learning_ , 7472–7482. PMLR.
  * Zhang et al. (2022a) Zhang, J.; Chen, C.; Li, B.; Lyu, L.; Wu, S.; Ding, S.; Shen, C.; and Wu, C. 2022a.  DENSE: Data-Free One-Shot Federated Learning.  In _Advances in NeurIPS_.
  * Zhang et al. (2022b) Zhang, J.; Li, B.; Xu, J.; Wu, S.; Ding, S.; Zhang, L.; and Wu, C. 2022b.  Towards Efficient Data Free Black-Box Adversarial Attack.  In _Proceedings of the IEEE/CVF Conference on CVPR_ , 15115–15125.
  * Zhang et al. (2022c) Zhang, J.; Li, Z.; Li, B.; Xu, J.; Wu, S.; Ding, S.; and Wu, C. 2022c.  Federated Learning with Label Distribution Skew via Logits Calibration.  In _Proceedings of the ICML_. PMLR.
  * Zhang et al. (2021) Zhang, J.; Zhu, J.; Niu, G.; Han, B.; Sugiyama, M.; and Kankanhalli, M. 2021.  Geometry-aware Instance-reweighted Adversarial Training.  In _International Conference on Learning Representations_.
  * Zhao et al. (2018) Zhao, Y.; Li, M.; Lai, L.; Suda, N.; Civin, D.; and Chandra, V. 2018.  Federated Learning with Non-IID Data.  arXiv:1806.00582.
  * Zhou et al. (2022) Zhou, Y.; Wu, J.; Wang, H.; and He, J. 2022.  Adversarial robustness through bias variance decomposition: A new perspective for federated learning.  In _Proceedings of the 31st ACM International Conference on Information & Knowledge Management_, 2753–2762.
  * Zhu et al. (2020) Zhu, X.; Wang, J.; Hong, Z.; and Xiao, J. 2020.  Empirical Studies of Institutional Federated Learning For Natural Language Processing.  In Cohn, T.; He, Y.; and Liu, Y., eds., _Findings of the Association for Computational Linguistics: EMNLP 2020, Online Event, 16-20 November 2020_ , volume EMNLP 2020 of _Findings of ACL_ , 625–634. Association for Computational Linguistics.
  * Zizzo et al. (2020) Zizzo, G.; Rawat, A.; Sinn, M.; and Buesser, B. 2020.  FAT: Federated Adversarial Training.  arXiv:2012.01791.