Abstract: Methods and computing apparatuses for defending against model poisoning attacks in federated learning are described. One or more updates are obtained, where each update represents a respective difference between parameters (e.g. weights) of the global model and parameters (e.g. weights) of a respective local model. Random noise perturbation and normalization are applied to each update, to obtain one or more perturbed and normalized updates. The parameters (e.g. weights) of the global model are updated by adding an aggregation of the one or more perturbed and normalized updates to the parameters (e.g. weights) of the global model. In some examples, one or more learned parameters (e.g. weights) of the previous global model are also perturbed using random noise.

Abstract: Methods and systems for federated learning using a parameterized optimization algorithm are described. A central server receives, from each of a plurality of user devices, a proximal map and feedback representing a current state of each user device. The server computes an update to optimization parameters of a parameterized optimization algorithm, using the received feedback. Model updates are computed for each user device, using the received proximal maps and the parameterized optimization algorithm having the updated optimization parameters. Each model update is transmitted to each respective client for updating the respective model.

Abstract: Servers, methods and systems for second order federated learning (FL) are described. Client nodes send local curvature information to the server along with local learned parameter information. The local curvature information enables the server to approximate or estimate the curvature, i.e. a second-order derivative, of an objective function of each respective local model. Instead of averaging the local learned parameter information obtained from the client nodes, the server uses the local curvature information to aggregate the local learned parameter information obtained from each client node to correct for the bias that would ordinarily result from a straightforward averaging of the learned values of the local learnable parameters. The described examples may provide reduced bias and/or reduced communication costs, relative to existing FL approaches such as federated averaging. The described examples may provide greater accuracy in model performance and/or faster convergence in FL.

Abstract: Methods and computing apparatuses for defending against model poisoning attacks in federated learning are described. One or more updates are obtained, where each update represents a respective difference between parameters (e.g. weights) of the global model and parameters (e.g. weights) of a respective local model. Random noise perturbation and normalization are applied to each update, to obtain one or more perturbed and normalized updates. The parameters (e.g. weights) of the global model are updated by adding an aggregation of the one or more perturbed and normalized updates to the parameters (e.g. weights) of the global model. In some examples, one or more learned parameters (e.g. weights) of the previous global model are also perturbed using random noise.

Abstract: Methods and apparatuses for implementing federated learning are described. A set of updates is obtained, where each update represents a respective difference between a global model and a respective local model. The global model is updated using a weighted average of the set of updates. A set of weighting coefficients is calculated, to be used in calculating the weighted average. The set of weighting coefficients is calculated by performing multi-objective optimization towards a Pareto-stationary solution across the set of updates. The weighted average is calculated by applying the set of weighting coefficients to the set of updates, and the global model is updated by adding the weighted average to the global model.