federated learning threat model: targeted model poisoningabhagoji/files/icml2019_poster.pdf ·...

Analyzing Federated Learning through an Adversarial LensArjun Nitin Bhagoji 1, Supriyo Chakraborty 2,

Prateek Mittal 1 and Seraphin Calo 2

1 Princeton University 2 I.B.M. Research

Federated Learning Threat Model: Targeted Model Poisoning

Attack Strategies for Model Poisoning

Estimation to improve attacks

Interpreting Poisoned Models

ReferencesConclusion

- Guided by privacy concerns, each agent performs computation on locally held data [1]

Global Server

. . . . . . .Compute Compute Compute

Model parameters:Updated to:

Agent 1 Agent 2 Agent k

wtG

<latexit sha1_base64="UI0H2JBfQjZQ+1CTPilgpC2I/+k=">AAACVHicdZDfahNBFMZnt1Zr1NrqpTeLQRAvwm4p1ctSBb0RK5g0kF3D2cnZdOj8WWbONoZhX8JbfS7Bd/HC2SSVVvTAMB/fbw7nzFfWUjhK059RvHVr+/adnbu9e/cf7D7c2380cqaxHIfcSGPHJTiUQuOQBEkc1xZBlRLPyovXHT+7ROuE0Z9oWWOhYK5FJThQsMZ5WS0+0/TtdK+fDdJVJeng6EocrMUV6rNNnU73o6N8ZnijUBOX4NwkS2sqPFgSXGLbyxuHNfALmOMkSA0KXeFXC7fJs+DMksrYcDQlK/d6hwfl3FKV4aUCOnd/s878F5s0VL0qvNB1Q6j5elDVyIRM0v0+mQmLnOQyCOBWhF0Tfg4WOIWMernGBTdKgZ75fNROssLn3Yyy8v2sbW/ykFz7By86+gZDEhbfB+tDjRbI2Bc+BztX8KX1m/t60v8Xo4NBlg6yj4f945NN5jvsCXvKnrOMvWTH7B07ZUPGmWRf2Tf2PfoR/Yq34u310zja9DxmNyre/Q37a7Yr</latexit><latexit sha1_base64="UI0H2JBfQjZQ+1CTPilgpC2I/+k=">AAACVHicdZDfahNBFMZnt1Zr1NrqpTeLQRAvwm4p1ctSBb0RK5g0kF3D2cnZdOj8WWbONoZhX8JbfS7Bd/HC2SSVVvTAMB/fbw7nzFfWUjhK059RvHVr+/adnbu9e/cf7D7c2380cqaxHIfcSGPHJTiUQuOQBEkc1xZBlRLPyovXHT+7ROuE0Z9oWWOhYK5FJThQsMZ5WS0+0/TtdK+fDdJVJeng6EocrMUV6rNNnU73o6N8ZnijUBOX4NwkS2sqPFgSXGLbyxuHNfALmOMkSA0KXeFXC7fJs+DMksrYcDQlK/d6hwfl3FKV4aUCOnd/s878F5s0VL0qvNB1Q6j5elDVyIRM0v0+mQmLnOQyCOBWhF0Tfg4WOIWMernGBTdKgZ75fNROssLn3Yyy8v2sbW/ykFz7By86+gZDEhbfB+tDjRbI2Bc+BztX8KX1m/t60v8Xo4NBlg6yj4f945NN5jvsCXvKnrOMvWTH7B07ZUPGmWRf2Tf2PfoR/Yq34u310zja9DxmNyre/Q37a7Yr</latexit><latexit sha1_base64="UI0H2JBfQjZQ+1CTPilgpC2I/+k=">AAACVHicdZDfahNBFMZnt1Zr1NrqpTeLQRAvwm4p1ctSBb0RK5g0kF3D2cnZdOj8WWbONoZhX8JbfS7Bd/HC2SSVVvTAMB/fbw7nzFfWUjhK059RvHVr+/adnbu9e/cf7D7c2380cqaxHIfcSGPHJTiUQuOQBEkc1xZBlRLPyovXHT+7ROuE0Z9oWWOhYK5FJThQsMZ5WS0+0/TtdK+fDdJVJeng6EocrMUV6rNNnU73o6N8ZnijUBOX4NwkS2sqPFgSXGLbyxuHNfALmOMkSA0KXeFXC7fJs+DMksrYcDQlK/d6hwfl3FKV4aUCOnd/s878F5s0VL0qvNB1Q6j5elDVyIRM0v0+mQmLnOQyCOBWhF0Tfg4WOIWMernGBTdKgZ75fNROssLn3Yyy8v2sbW/ykFz7By86+gZDEhbfB+tDjRbI2Bc+BztX8KX1m/t60v8Xo4NBlg6yj4f945NN5jvsCXvKnrOMvWTH7B07ZUPGmWRf2Tf2PfoR/Yq34u310zja9DxmNyre/Q37a7Yr</latexit><latexit sha1_base64="UI0H2JBfQjZQ+1CTPilgpC2I/+k=">AAACVHicdZDfahNBFMZnt1Zr1NrqpTeLQRAvwm4p1ctSBb0RK5g0kF3D2cnZdOj8WWbONoZhX8JbfS7Bd/HC2SSVVvTAMB/fbw7nzFfWUjhK059RvHVr+/adnbu9e/cf7D7c2380cqaxHIfcSGPHJTiUQuOQBEkc1xZBlRLPyovXHT+7ROuE0Z9oWWOhYK5FJThQsMZ5WS0+0/TtdK+fDdJVJeng6EocrMUV6rNNnU73o6N8ZnijUBOX4NwkS2sqPFgSXGLbyxuHNfALmOMkSA0KXeFXC7fJs+DMksrYcDQlK/d6hwfl3FKV4aUCOnd/s878F5s0VL0qvNB1Q6j5elDVyIRM0v0+mQmLnOQyCOBWhF0Tfg4WOIWMernGBTdKgZ75fNROssLn3Yyy8v2sbW/ykFz7By86+gZDEhbfB+tDjRbI2Bc+BztX8KX1m/t60v8Xo4NBlg6yj4f945NN5jvsCXvKnrOMvWTH7B07ZUPGmWRf2Tf2PfoR/Yq34u310zja9DxmNyre/Q37a7Yr</latexit>

wt+1G

<latexit sha1_base64="fj3OJj0BUS1IDIQdDxeMyX1tA84=">AAACWHicdZBdaxNBFIYnq/1Ka23rpTeLQSgVwm4p1cuigt6IFUxayG7D2cnZdOh8LDNnjWHYv+Gt/i39Nc4mqbSiB4Z5eZ9zOIe3qKRwlCQ/O9GDh2vrG5tb3e2dR7uP9/YPhs7UluOAG2nsZQEOpdA4IEESLyuLoAqJF8XNm5ZffEHrhNGfaV5hrmCqRSk4ULCyrChnV55epM343Xivl/aTRcVJ//RWHC/FLeqxVZ2P9zun2cTwWqEmLsG5UZpUlHuwJLjEppvVDivgNzDFUZAaFLrcL45u4ufBmcSlseFpihfu3QkPyrm5KkKnArp2f7PW/Bcb1VS+yr3QVU2o+XJRWcuYTNwmEE+ERU5yHgRwK8KtMb8GC5xCTt1M44wbpUBPfDZsRmnus3ZHUfpe2jT3eUiv+YNnLX2LIQmLH4L1sUILZOyRz8BOFXxt/Oq/m/T/xfC4nyb99NNJ7+z1KvNN9pQ9Y4csZS/ZGXvPztmAcVaxb+w7+9H5FbFoI9patkad1cwTdq+ig98EBLao</latexit><latexit sha1_base64="fj3OJj0BUS1IDIQdDxeMyX1tA84=">AAACWHicdZBdaxNBFIYnq/1Ka23rpTeLQSgVwm4p1cuigt6IFUxayG7D2cnZdOh8LDNnjWHYv+Gt/i39Nc4mqbSiB4Z5eZ9zOIe3qKRwlCQ/O9GDh2vrG5tb3e2dR7uP9/YPhs7UluOAG2nsZQEOpdA4IEESLyuLoAqJF8XNm5ZffEHrhNGfaV5hrmCqRSk4ULCyrChnV55epM343Xivl/aTRcVJ//RWHC/FLeqxVZ2P9zun2cTwWqEmLsG5UZpUlHuwJLjEppvVDivgNzDFUZAaFLrcL45u4ufBmcSlseFpihfu3QkPyrm5KkKnArp2f7PW/Bcb1VS+yr3QVU2o+XJRWcuYTNwmEE+ERU5yHgRwK8KtMb8GC5xCTt1M44wbpUBPfDZsRmnus3ZHUfpe2jT3eUiv+YNnLX2LIQmLH4L1sUILZOyRz8BOFXxt/Oq/m/T/xfC4nyb99NNJ7+z1KvNN9pQ9Y4csZS/ZGXvPztmAcVaxb+w7+9H5FbFoI9patkad1cwTdq+ig98EBLao</latexit><latexit sha1_base64="fj3OJj0BUS1IDIQdDxeMyX1tA84=">AAACWHicdZBdaxNBFIYnq/1Ka23rpTeLQSgVwm4p1cuigt6IFUxayG7D2cnZdOh8LDNnjWHYv+Gt/i39Nc4mqbSiB4Z5eZ9zOIe3qKRwlCQ/O9GDh2vrG5tb3e2dR7uP9/YPhs7UluOAG2nsZQEOpdA4IEESLyuLoAqJF8XNm5ZffEHrhNGfaV5hrmCqRSk4ULCyrChnV55epM343Xivl/aTRcVJ//RWHC/FLeqxVZ2P9zun2cTwWqEmLsG5UZpUlHuwJLjEppvVDivgNzDFUZAaFLrcL45u4ufBmcSlseFpihfu3QkPyrm5KkKnArp2f7PW/Bcb1VS+yr3QVU2o+XJRWcuYTNwmEE+ERU5yHgRwK8KtMb8GC5xCTt1M44wbpUBPfDZsRmnus3ZHUfpe2jT3eUiv+YNnLX2LIQmLH4L1sUILZOyRz8BOFXxt/Oq/m/T/xfC4nyb99NNJ7+z1KvNN9pQ9Y4csZS/ZGXvPztmAcVaxb+w7+9H5FbFoI9patkad1cwTdq+ig98EBLao</latexit><latexit sha1_base64="fj3OJj0BUS1IDIQdDxeMyX1tA84=">AAACWHicdZBdaxNBFIYnq/1Ka23rpTeLQSgVwm4p1cuigt6IFUxayG7D2cnZdOh8LDNnjWHYv+Gt/i39Nc4mqbSiB4Z5eZ9zOIe3qKRwlCQ/O9GDh2vrG5tb3e2dR7uP9/YPhs7UluOAG2nsZQEOpdA4IEESLyuLoAqJF8XNm5ZffEHrhNGfaV5hrmCqRSk4ULCyrChnV55epM343Xivl/aTRcVJ//RWHC/FLeqxVZ2P9zun2cTwWqEmLsG5UZpUlHuwJLjEppvVDivgNzDFUZAaFLrcL45u4ufBmcSlseFpihfu3QkPyrm5KkKnArp2f7PW/Bcb1VS+yr3QVU2o+XJRWcuYTNwmEE+ERU5yHgRwK8KtMb8GC5xCTt1M44wbpUBPfDZsRmnus3ZHUfpe2jT3eUiv+YNnLX2LIQmLH4L1sUILZOyRz8BOFXxt/Oq/m/T/xfC4nyb99NNJ7+z1KvNN9pQ9Y4csZS/ZGXvPztmAcVaxb+w7+9H5FbFoI9patkad1cwTdq+ig98EBLao</latexit>

wt+1G = wt

G +kX

j=1

↵j�t+1j

<latexit sha1_base64="Tknsbqs0VBAQXD7i/mX42s049rc=">AAACoXicdVHbjtMwEHXDbSm3LjzyYhEhIVaqkhUCXlZasYjLA6Ig2l0p7kYTx2nd2k5kO5TKygfxNbyyf4PTZhFFMJLl43NmNDPHWSW4sVF00QuuXL12/cbezf6t23fu3hvs35+YstaUjWkpSn2WgWGCKza23Ap2VmkGMhPsNFuetPrpV6YNL9UXu67YVMJM8YJTsJ5KByckK1bnzh7ETfoWH+HN03p4gImpZeoWR3FzvsQERDWHdOETpCM5ExaadNEVDsJ4GG0CR8Pnl+BwCy6lEHUxSvd7b0he0loyZakAY5I4quzUgbacCtb0SW1YBXQJM5Z4qEAyM3WbbRv82DM5Lkrtj7J4w/5Z4UAas5aZz5Rg5+ZvrSX/pSW1LV5OHVdVbZmi20ZFLbAtcWsdzrlm1Iq1B0A197NiOgcN1HqD+0SxFS2lBJU7MmmSeOpI2yMrXBg3za7uXW5+y6tWfc28E5p98NTHimmwpX7qCOiZhG+N6+6dVTK54/z/weRwGEfD+NOz8PhV9wd76CF6hJ6gGL1Ax+gdGqExoug7+oF+oosgDN4Ho+DzNjXodTUP0E4EyS/SfNIt</latexit><latexit sha1_base64="Tknsbqs0VBAQXD7i/mX42s049rc=">AAACoXicdVHbjtMwEHXDbSm3LjzyYhEhIVaqkhUCXlZasYjLA6Ig2l0p7kYTx2nd2k5kO5TKygfxNbyyf4PTZhFFMJLl43NmNDPHWSW4sVF00QuuXL12/cbezf6t23fu3hvs35+YstaUjWkpSn2WgWGCKza23Ap2VmkGMhPsNFuetPrpV6YNL9UXu67YVMJM8YJTsJ5KByckK1bnzh7ETfoWH+HN03p4gImpZeoWR3FzvsQERDWHdOETpCM5ExaadNEVDsJ4GG0CR8Pnl+BwCy6lEHUxSvd7b0he0loyZakAY5I4quzUgbacCtb0SW1YBXQJM5Z4qEAyM3WbbRv82DM5Lkrtj7J4w/5Z4UAas5aZz5Rg5+ZvrSX/pSW1LV5OHVdVbZmi20ZFLbAtcWsdzrlm1Iq1B0A197NiOgcN1HqD+0SxFS2lBJU7MmmSeOpI2yMrXBg3za7uXW5+y6tWfc28E5p98NTHimmwpX7qCOiZhG+N6+6dVTK54/z/weRwGEfD+NOz8PhV9wd76CF6hJ6gGL1Ax+gdGqExoug7+oF+oosgDN4Ho+DzNjXodTUP0E4EyS/SfNIt</latexit><latexit sha1_base64="Tknsbqs0VBAQXD7i/mX42s049rc=">AAACoXicdVHbjtMwEHXDbSm3LjzyYhEhIVaqkhUCXlZasYjLA6Ig2l0p7kYTx2nd2k5kO5TKygfxNbyyf4PTZhFFMJLl43NmNDPHWSW4sVF00QuuXL12/cbezf6t23fu3hvs35+YstaUjWkpSn2WgWGCKza23Ap2VmkGMhPsNFuetPrpV6YNL9UXu67YVMJM8YJTsJ5KByckK1bnzh7ETfoWH+HN03p4gImpZeoWR3FzvsQERDWHdOETpCM5ExaadNEVDsJ4GG0CR8Pnl+BwCy6lEHUxSvd7b0he0loyZakAY5I4quzUgbacCtb0SW1YBXQJM5Z4qEAyM3WbbRv82DM5Lkrtj7J4w/5Z4UAas5aZz5Rg5+ZvrSX/pSW1LV5OHVdVbZmi20ZFLbAtcWsdzrlm1Iq1B0A197NiOgcN1HqD+0SxFS2lBJU7MmmSeOpI2yMrXBg3za7uXW5+y6tWfc28E5p98NTHimmwpX7qCOiZhG+N6+6dVTK54/z/weRwGEfD+NOz8PhV9wd76CF6hJ6gGL1Ax+gdGqExoug7+oF+oosgDN4Ho+DzNjXodTUP0E4EyS/SfNIt</latexit><latexit sha1_base64="Tknsbqs0VBAQXD7i/mX42s049rc=">AAACoXicdVHbjtMwEHXDbSm3LjzyYhEhIVaqkhUCXlZasYjLA6Ig2l0p7kYTx2nd2k5kO5TKygfxNbyyf4PTZhFFMJLl43NmNDPHWSW4sVF00QuuXL12/cbezf6t23fu3hvs35+YstaUjWkpSn2WgWGCKza23Ap2VmkGMhPsNFuetPrpV6YNL9UXu67YVMJM8YJTsJ5KByckK1bnzh7ETfoWH+HN03p4gImpZeoWR3FzvsQERDWHdOETpCM5ExaadNEVDsJ4GG0CR8Pnl+BwCy6lEHUxSvd7b0he0loyZakAY5I4quzUgbacCtb0SW1YBXQJM5Z4qEAyM3WbbRv82DM5Lkrtj7J4w/5Z4UAas5aZz5Rg5+ZvrSX/pSW1LV5OHVdVbZmi20ZFLbAtcWsdzrlm1Iq1B0A197NiOgcN1HqD+0SxFS2lBJU7MmmSeOpI2yMrXBg3za7uXW5+y6tWfc28E5p98NTHimmwpX7qCOiZhG+N6+6dVTK54/z/weRwGEfD+NOz8PhV9wd76CF6hJ6gGL1Ax+gdGqExoug7+oF+oosgDN4Ho+DzNjXodTUP0E4EyS/SfNIt</latexit>

wtG


wtG

<latexit sha1_base64="UI0H2JBfQjZQ+1CTPilgpC2I/+k=">AAACVHicdZDfahNBFMZnt1Zr1NrqpTeLQRAvwm4p1ctSBb0RK5g0kF3D2cnZdOj8WWbONoZhX8JbfS7Bd/HC2SSVVvTAMB/fbw7nzFfWUjhK059RvHVr+/adnbu9e/cf7D7c2380cqaxHIfcSGPHJTiUQuOQBEkc1xZBlRLPyovXHT+7ROuE0Z9oWWOhYK5FJThQsMZ5WS0+0/TtdK+fDdJVJeng6EocrMUV6rNNnU73o6N8ZnijUBOX4NwkS2sqPFgSXGLbyxuHNfALmOMkSA0KXeFXC7fJs+DMksrYcDQlK/d6hwfl3FKV4aUCOnd/s878F5s0VL0qvNB1Q6j5elDVyIRM0v0+mQmLnOQyCOBWhF0Tfg4WOIWMernGBTdKgZ75fNROssLn3Yyy8v2sbW/ykFz7By86+gZDEhbfB+tDjRbI2Bc+BztX8KX1m/t60v8Xo4NBlg6yj4f945NN5jvsCXvKnrOMvWTH7B07ZUPGmWRf2Tf2PfoR/Yq34u310zja9DxmNyre/Q37a7Yr</latexit><latexit sha1_base64="UI0H2JBfQjZQ+1CTPilgpC2I/+k=">AAACVHicdZDfahNBFMZnt1Zr1NrqpTeLQRAvwm4p1ctSBb0RK5g0kF3D2cnZdOj8WWbONoZhX8JbfS7Bd/HC2SSVVvTAMB/fbw7nzFfWUjhK059RvHVr+/adnbu9e/cf7D7c2380cqaxHIfcSGPHJTiUQuOQBEkc1xZBlRLPyovXHT+7ROuE0Z9oWWOhYK5FJThQsMZ5WS0+0/TtdK+fDdJVJeng6EocrMUV6rNNnU73o6N8ZnijUBOX4NwkS2sqPFgSXGLbyxuHNfALmOMkSA0KXeFXC7fJs+DMksrYcDQlK/d6hwfl3FKV4aUCOnd/s878F5s0VL0qvNB1Q6j5elDVyIRM0v0+mQmLnOQyCOBWhF0Tfg4WOIWMernGBTdKgZ75fNROssLn3Yyy8v2sbW/ykFz7By86+gZDEhbfB+tDjRbI2Bc+BztX8KX1m/t60v8Xo4NBlg6yj4f945NN5jvsCXvKnrOMvWTH7B07ZUPGmWRf2Tf2PfoR/Yq34u310zja9DxmNyre/Q37a7Yr</latexit><latexit sha1_base64="UI0H2JBfQjZQ+1CTPilgpC2I/+k=">AAACVHicdZDfahNBFMZnt1Zr1NrqpTeLQRAvwm4p1ctSBb0RK5g0kF3D2cnZdOj8WWbONoZhX8JbfS7Bd/HC2SSVVvTAMB/fbw7nzFfWUjhK059RvHVr+/adnbu9e/cf7D7c2380cqaxHIfcSGPHJTiUQuOQBEkc1xZBlRLPyovXHT+7ROuE0Z9oWWOhYK5FJThQsMZ5WS0+0/TtdK+fDdJVJeng6EocrMUV6rNNnU73o6N8ZnijUBOX4NwkS2sqPFgSXGLbyxuHNfALmOMkSA0KXeFXC7fJs+DMksrYcDQlK/d6hwfl3FKV4aUCOnd/s878F5s0VL0qvNB1Q6j5elDVyIRM0v0+mQmLnOQyCOBWhF0Tfg4WOIWMernGBTdKgZ75fNROssLn3Yyy8v2sbW/ykFz7By86+gZDEhbfB+tDjRbI2Bc+BztX8KX1m/t60v8Xo4NBlg6yj4f945NN5jvsCXvKnrOMvWTH7B07ZUPGmWRf2Tf2PfoR/Yq34u310zja9DxmNyre/Q37a7Yr</latexit><latexit sha1_base64="UI0H2JBfQjZQ+1CTPilgpC2I/+k=">AAACVHicdZDfahNBFMZnt1Zr1NrqpTeLQRAvwm4p1ctSBb0RK5g0kF3D2cnZdOj8WWbONoZhX8JbfS7Bd/HC2SSVVvTAMB/fbw7nzFfWUjhK059RvHVr+/adnbu9e/cf7D7c2380cqaxHIfcSGPHJTiUQuOQBEkc1xZBlRLPyovXHT+7ROuE0Z9oWWOhYK5FJThQsMZ5WS0+0/TtdK+fDdJVJeng6EocrMUV6rNNnU73o6N8ZnijUBOX4NwkS2sqPFgSXGLbyxuHNfALmOMkSA0KXeFXC7fJs+DMksrYcDQlK/d6hwfl3FKV4aUCOnd/s878F5s0VL0qvNB1Q6j5elDVyIRM0v0+mQmLnOQyCOBWhF0Tfg4WOIWMernGBTdKgZ75fNROssLn3Yyy8v2sbW/ykFz7By86+gZDEhbfB+tDjRbI2Bc+BztX8KX1m/t60v8Xo4NBlg6yj4f945NN5jvsCXvKnrOMvWTH7B07ZUPGmWRf2Tf2PfoR/Yq34u310zja9DxmNyre/Q37a7Yr</latexit> wtG


�t+11

<latexit sha1_base64="AduokZVpDtRVWXcqCEh4hzwzDD0=">AAACcXicdVFdaxQxFM2OX3X92ton8SV0EcTCMili27eiIr6IFdxtYWdcbjJ3tqFJZkgyrkuY3+Kr/iR/h3/AzHYV148DIYdz7uXenPBaSefT9FsvuXL12vUbWzf7t27fuXtvsH1/4qrGChyLSlX2jINDJQ2OvfQKz2qLoLnCU37xovNPP6J1sjLv/bLGXMPcyFIK8FGaDXYyrkNWoPLQztiH4PdYOxsM09FByo6eMfo3YaN0hSFZ42S23XuVFZVoNBovFDg3ZWnt8wDWS6Gw7WeNwxrEBcxxGqkBjS4Pq+1b+igqBS0rG4/xdKX+3hFAO7fUPFZq8OfuT68T/+VNG18e5kGauvFoxOWgslHUV7SLghbSovBqGQkIK+OuVJyDBeFjYP3M4EJUWoMpQjZppywPWTeDl2HI2nbT5+Wi/WUvOvclxiQsvonS2xot+Mo+CRnYuYZPbVjfG0/hukv+Z7z0/2SyP2LpiL17Ojx+vv6DLfKQ7JLHhJEDckxekxMyJoIsyWfyhXztfU8eJDTZvSxNeuueHbKBZO8HsyjA3A==</latexit><latexit sha1_base64="AduokZVpDtRVWXcqCEh4hzwzDD0=">AAACcXicdVFdaxQxFM2OX3X92ton8SV0EcTCMili27eiIr6IFdxtYWdcbjJ3tqFJZkgyrkuY3+Kr/iR/h3/AzHYV148DIYdz7uXenPBaSefT9FsvuXL12vUbWzf7t27fuXtvsH1/4qrGChyLSlX2jINDJQ2OvfQKz2qLoLnCU37xovNPP6J1sjLv/bLGXMPcyFIK8FGaDXYyrkNWoPLQztiH4PdYOxsM09FByo6eMfo3YaN0hSFZ42S23XuVFZVoNBovFDg3ZWnt8wDWS6Gw7WeNwxrEBcxxGqkBjS4Pq+1b+igqBS0rG4/xdKX+3hFAO7fUPFZq8OfuT68T/+VNG18e5kGauvFoxOWgslHUV7SLghbSovBqGQkIK+OuVJyDBeFjYP3M4EJUWoMpQjZppywPWTeDl2HI2nbT5+Wi/WUvOvclxiQsvonS2xot+Mo+CRnYuYZPbVjfG0/hukv+Z7z0/2SyP2LpiL17Ojx+vv6DLfKQ7JLHhJEDckxekxMyJoIsyWfyhXztfU8eJDTZvSxNeuueHbKBZO8HsyjA3A==</latexit><latexit sha1_base64="AduokZVpDtRVWXcqCEh4hzwzDD0=">AAACcXicdVFdaxQxFM2OX3X92ton8SV0EcTCMili27eiIr6IFdxtYWdcbjJ3tqFJZkgyrkuY3+Kr/iR/h3/AzHYV148DIYdz7uXenPBaSefT9FsvuXL12vUbWzf7t27fuXtvsH1/4qrGChyLSlX2jINDJQ2OvfQKz2qLoLnCU37xovNPP6J1sjLv/bLGXMPcyFIK8FGaDXYyrkNWoPLQztiH4PdYOxsM09FByo6eMfo3YaN0hSFZ42S23XuVFZVoNBovFDg3ZWnt8wDWS6Gw7WeNwxrEBcxxGqkBjS4Pq+1b+igqBS0rG4/xdKX+3hFAO7fUPFZq8OfuT68T/+VNG18e5kGauvFoxOWgslHUV7SLghbSovBqGQkIK+OuVJyDBeFjYP3M4EJUWoMpQjZppywPWTeDl2HI2nbT5+Wi/WUvOvclxiQsvonS2xot+Mo+CRnYuYZPbVjfG0/hukv+Z7z0/2SyP2LpiL17Ojx+vv6DLfKQ7JLHhJEDckxekxMyJoIsyWfyhXztfU8eJDTZvSxNeuueHbKBZO8HsyjA3A==</latexit><latexit sha1_base64="AduokZVpDtRVWXcqCEh4hzwzDD0=">AAACcXicdVFdaxQxFM2OX3X92ton8SV0EcTCMili27eiIr6IFdxtYWdcbjJ3tqFJZkgyrkuY3+Kr/iR/h3/AzHYV148DIYdz7uXenPBaSefT9FsvuXL12vUbWzf7t27fuXtvsH1/4qrGChyLSlX2jINDJQ2OvfQKz2qLoLnCU37xovNPP6J1sjLv/bLGXMPcyFIK8FGaDXYyrkNWoPLQztiH4PdYOxsM09FByo6eMfo3YaN0hSFZ42S23XuVFZVoNBovFDg3ZWnt8wDWS6Gw7WeNwxrEBcxxGqkBjS4Pq+1b+igqBS0rG4/xdKX+3hFAO7fUPFZq8OfuT68T/+VNG18e5kGauvFoxOWgslHUV7SLghbSovBqGQkIK+OuVJyDBeFjYP3M4EJUWoMpQjZppywPWTeDl2HI2nbT5+Wi/WUvOvclxiQsvonS2xot+Mo+CRnYuYZPbVjfG0/hukv+Z7z0/2SyP2LpiL17Ojx+vv6DLfKQ7JLHhJEDckxekxMyJoIsyWfyhXztfU8eJDTZvSxNeuueHbKBZO8HsyjA3A==</latexit>

�t+12

<latexit sha1_base64="+SMv87LsCso/S2+quoQfuMrVbMk=">AAACcXicdVFdaxQxFM2OX3X92ton8SV0EcTCMili27eiIr6IFdxtYWdcbjJ3tqFJZkgyrkuY3+Kr/iR/h3/AzHYV148DIYdz7uXenPBaSefT9FsvuXL12vUbWzf7t27fuXtvsH1/4qrGChyLSlX2jINDJQ2OvfQKz2qLoLnCU37xovNPP6J1sjLv/bLGXMPcyFIK8FGaDXYyrkNWoPLQzvY/BL/H2tlgmI4OUnb0jNG/CRulKwzJGiez7d6rrKhEo9F4ocC5KUtrnwewXgqFbT9rHNYgLmCO00gNaHR5WG3f0kdRKWhZ2XiMpyv1944A2rml5rFSgz93f3qd+C9v2vjyMA/S1I1HIy4HlY2ivqJdFLSQFoVXy0hAWBl3peIcLAgfA+tnBhei0hpMEbJJO2V5yLoZvAxD1rabPi8X7S970bkvMSZh8U2U3tZowVf2ScjAzjV8asP63ngK113yP+Ol/yeT/RFLR+zd0+Hx8/UfbJGHZJc8JowckGPympyQMRFkST6TL+Rr73vyIKHJ7mVp0lv37JANJHs/ALUnwN0=</latexit><latexit sha1_base64="+SMv87LsCso/S2+quoQfuMrVbMk=">AAACcXicdVFdaxQxFM2OX3X92ton8SV0EcTCMili27eiIr6IFdxtYWdcbjJ3tqFJZkgyrkuY3+Kr/iR/h3/AzHYV148DIYdz7uXenPBaSefT9FsvuXL12vUbWzf7t27fuXtvsH1/4qrGChyLSlX2jINDJQ2OvfQKz2qLoLnCU37xovNPP6J1sjLv/bLGXMPcyFIK8FGaDXYyrkNWoPLQzvY/BL/H2tlgmI4OUnb0jNG/CRulKwzJGiez7d6rrKhEo9F4ocC5KUtrnwewXgqFbT9rHNYgLmCO00gNaHR5WG3f0kdRKWhZ2XiMpyv1944A2rml5rFSgz93f3qd+C9v2vjyMA/S1I1HIy4HlY2ivqJdFLSQFoVXy0hAWBl3peIcLAgfA+tnBhei0hpMEbJJO2V5yLoZvAxD1rabPi8X7S970bkvMSZh8U2U3tZowVf2ScjAzjV8asP63ngK113yP+Ol/yeT/RFLR+zd0+Hx8/UfbJGHZJc8JowckGPympyQMRFkST6TL+Rr73vyIKHJ7mVp0lv37JANJHs/ALUnwN0=</latexit><latexit sha1_base64="+SMv87LsCso/S2+quoQfuMrVbMk=">AAACcXicdVFdaxQxFM2OX3X92ton8SV0EcTCMili27eiIr6IFdxtYWdcbjJ3tqFJZkgyrkuY3+Kr/iR/h3/AzHYV148DIYdz7uXenPBaSefT9FsvuXL12vUbWzf7t27fuXtvsH1/4qrGChyLSlX2jINDJQ2OvfQKz2qLoLnCU37xovNPP6J1sjLv/bLGXMPcyFIK8FGaDXYyrkNWoPLQzvY/BL/H2tlgmI4OUnb0jNG/CRulKwzJGiez7d6rrKhEo9F4ocC5KUtrnwewXgqFbT9rHNYgLmCO00gNaHR5WG3f0kdRKWhZ2XiMpyv1944A2rml5rFSgz93f3qd+C9v2vjyMA/S1I1HIy4HlY2ivqJdFLSQFoVXy0hAWBl3peIcLAgfA+tnBhei0hpMEbJJO2V5yLoZvAxD1rabPi8X7S970bkvMSZh8U2U3tZowVf2ScjAzjV8asP63ngK113yP+Ol/yeT/RFLR+zd0+Hx8/UfbJGHZJc8JowckGPympyQMRFkST6TL+Rr73vyIKHJ7mVp0lv37JANJHs/ALUnwN0=</latexit><latexit sha1_base64="+SMv87LsCso/S2+quoQfuMrVbMk=">AAACcXicdVFdaxQxFM2OX3X92ton8SV0EcTCMili27eiIr6IFdxtYWdcbjJ3tqFJZkgyrkuY3+Kr/iR/h3/AzHYV148DIYdz7uXenPBaSefT9FsvuXL12vUbWzf7t27fuXtvsH1/4qrGChyLSlX2jINDJQ2OvfQKz2qLoLnCU37xovNPP6J1sjLv/bLGXMPcyFIK8FGaDXYyrkNWoPLQzvY/BL/H2tlgmI4OUnb0jNG/CRulKwzJGiez7d6rrKhEo9F4ocC5KUtrnwewXgqFbT9rHNYgLmCO00gNaHR5WG3f0kdRKWhZ2XiMpyv1944A2rml5rFSgz93f3qd+C9v2vjyMA/S1I1HIy4HlY2ivqJdFLSQFoVXy0hAWBl3peIcLAgfA+tnBhei0hpMEbJJO2V5yLoZvAxD1rabPi8X7S970bkvMSZh8U2U3tZowVf2ScjAzjV8asP63ngK113yP+Ol/yeT/RFLR+zd0+Hx8/UfbJGHZJc8JowckGPympyQMRFkST6TL+Rr73vyIKHJ7mVp0lv37JANJHs/ALUnwN0=</latexit>

�t+11


�t+12


�t+1k

<latexit sha1_base64="jNsc3lE0H1OrS17Dy1TKl2DQFcw=">AAACcXicdVFdixMxFE3Hr7V+dd0n8SVsEcSFMlnE1bdFRXwRV7Ddhc5Y7mTudEOTzJBkrCXkt/iqP8nf4R8w061i/TgQcjjnXu7NSdFIYV2afuslly5fuXpt53r/xs1bt+8Mdu9ObN0ajmNey9qcFWBRCo1jJ5zEs8YgqELiabF40fmnH9FYUev3btVgrmCuRSU4uCjNBntZoXxWonQQZosP3h2wMBsM09FRyp49YfRvwkbpGkOywclst/cqK2veKtSOS7B2ytLG5R6ME1xi6GetxQb4AuY4jVSDQpv79faBPohKSavaxKMdXau/d3hQ1q5UESsVuHP7p9eJ//Kmraue5l7opnWo+cWgqpXU1bSLgpbCIHdyFQlwI+KulJ+DAe5iYP1M45LXSoEufTYJU5b7rJtRVH7IQtj2i2oZftnLzn2JMQmDb6L0tkEDrjaPfAZmruBT8Jt76ymF6pL/GS/9P5kcjlg6Yu8eD4+fb/5gh9wn++QhYeSIHJPX5ISMCScr8pl8IV9735N7CU32L0qT3qZnj2whOfgBJv3BFg==</latexit><latexit sha1_base64="jNsc3lE0H1OrS17Dy1TKl2DQFcw=">AAACcXicdVFdixMxFE3Hr7V+dd0n8SVsEcSFMlnE1bdFRXwRV7Ddhc5Y7mTudEOTzJBkrCXkt/iqP8nf4R8w061i/TgQcjjnXu7NSdFIYV2afuslly5fuXpt53r/xs1bt+8Mdu9ObN0ajmNey9qcFWBRCo1jJ5zEs8YgqELiabF40fmnH9FYUev3btVgrmCuRSU4uCjNBntZoXxWonQQZosP3h2wMBsM09FRyp49YfRvwkbpGkOywclst/cqK2veKtSOS7B2ytLG5R6ME1xi6GetxQb4AuY4jVSDQpv79faBPohKSavaxKMdXau/d3hQ1q5UESsVuHP7p9eJ//Kmraue5l7opnWo+cWgqpXU1bSLgpbCIHdyFQlwI+KulJ+DAe5iYP1M45LXSoEufTYJU5b7rJtRVH7IQtj2i2oZftnLzn2JMQmDb6L0tkEDrjaPfAZmruBT8Jt76ymF6pL/GS/9P5kcjlg6Yu8eD4+fb/5gh9wn++QhYeSIHJPX5ISMCScr8pl8IV9735N7CU32L0qT3qZnj2whOfgBJv3BFg==</latexit><latexit sha1_base64="jNsc3lE0H1OrS17Dy1TKl2DQFcw=">AAACcXicdVFdixMxFE3Hr7V+dd0n8SVsEcSFMlnE1bdFRXwRV7Ddhc5Y7mTudEOTzJBkrCXkt/iqP8nf4R8w061i/TgQcjjnXu7NSdFIYV2afuslly5fuXpt53r/xs1bt+8Mdu9ObN0ajmNey9qcFWBRCo1jJ5zEs8YgqELiabF40fmnH9FYUev3btVgrmCuRSU4uCjNBntZoXxWonQQZosP3h2wMBsM09FRyp49YfRvwkbpGkOywclst/cqK2veKtSOS7B2ytLG5R6ME1xi6GetxQb4AuY4jVSDQpv79faBPohKSavaxKMdXau/d3hQ1q5UESsVuHP7p9eJ//Kmraue5l7opnWo+cWgqpXU1bSLgpbCIHdyFQlwI+KulJ+DAe5iYP1M45LXSoEufTYJU5b7rJtRVH7IQtj2i2oZftnLzn2JMQmDb6L0tkEDrjaPfAZmruBT8Jt76ymF6pL/GS/9P5kcjlg6Yu8eD4+fb/5gh9wn++QhYeSIHJPX5ISMCScr8pl8IV9735N7CU32L0qT3qZnj2whOfgBJv3BFg==</latexit><latexit sha1_base64="jNsc3lE0H1OrS17Dy1TKl2DQFcw=">AAACcXicdVFdixMxFE3Hr7V+dd0n8SVsEcSFMlnE1bdFRXwRV7Ddhc5Y7mTudEOTzJBkrCXkt/iqP8nf4R8w061i/TgQcjjnXu7NSdFIYV2afuslly5fuXpt53r/xs1bt+8Mdu9ObN0ajmNey9qcFWBRCo1jJ5zEs8YgqELiabF40fmnH9FYUev3btVgrmCuRSU4uCjNBntZoXxWonQQZosP3h2wMBsM09FRyp49YfRvwkbpGkOywclst/cqK2veKtSOS7B2ytLG5R6ME1xi6GetxQb4AuY4jVSDQpv79faBPohKSavaxKMdXau/d3hQ1q5UESsVuHP7p9eJ//Kmraue5l7opnWo+cWgqpXU1bSLgpbCIHdyFQlwI+KulJ+DAe5iYP1M45LXSoEufTYJU5b7rJtRVH7IQtj2i2oZftnLzn2JMQmDb6L0tkEDrjaPfAZmruBT8Jt76ymF6pL/GS/9P5kcjlg6Yu8eD4+fb/5gh9wn++QhYeSIHJPX5ISMCScr8pl8IV9735N7CU32L0qT3qZnj2whOfgBJv3BFg==</latexit>

�t+1k

<latexit sha1_base64="jNsc3lE0H1OrS17Dy1TKl2DQFcw=">AAACcXicdVFdixMxFE3Hr7V+dd0n8SVsEcSFMlnE1bdFRXwRV7Ddhc5Y7mTudEOTzJBkrCXkt/iqP8nf4R8w061i/TgQcjjnXu7NSdFIYV2afuslly5fuXpt53r/xs1bt+8Mdu9ObN0ajmNey9qcFWBRCo1jJ5zEs8YgqELiabF40fmnH9FYUev3btVgrmCuRSU4uCjNBntZoXxWonQQZosP3h2wMBsM09FRyp49YfRvwkbpGkOywclst/cqK2veKtSOS7B2ytLG5R6ME1xi6GetxQb4AuY4jVSDQpv79faBPohKSavaxKMdXau/d3hQ1q5UESsVuHP7p9eJ//Kmraue5l7opnWo+cWgqpXU1bSLgpbCIHdyFQlwI+KulJ+DAe5iYP1M45LXSoEufTYJU5b7rJtRVH7IQtj2i2oZftnLzn2JMQmDb6L0tkEDrjaPfAZmruBT8Jt76ymF6pL/GS/9P5kcjlg6Yu8eD4+fb/5gh9wn++QhYeSIHJPX5ISMCScr8pl8IV9735N7CU32L0qT3qZnj2whOfgBJv3BFg==</latexit><latexit sha1_base64="jNsc3lE0H1OrS17Dy1TKl2DQFcw=">AAACcXicdVFdixMxFE3Hr7V+dd0n8SVsEcSFMlnE1bdFRXwRV7Ddhc5Y7mTudEOTzJBkrCXkt/iqP8nf4R8w061i/TgQcjjnXu7NSdFIYV2afuslly5fuXpt53r/xs1bt+8Mdu9ObN0ajmNey9qcFWBRCo1jJ5zEs8YgqELiabF40fmnH9FYUev3btVgrmCuRSU4uCjNBntZoXxWonQQZosP3h2wMBsM09FRyp49YfRvwkbpGkOywclst/cqK2veKtSOS7B2ytLG5R6ME1xi6GetxQb4AuY4jVSDQpv79faBPohKSavaxKMdXau/d3hQ1q5UESsVuHP7p9eJ//Kmraue5l7opnWo+cWgqpXU1bSLgpbCIHdyFQlwI+KulJ+DAe5iYP1M45LXSoEufTYJU5b7rJtRVH7IQtj2i2oZftnLzn2JMQmDb6L0tkEDrjaPfAZmruBT8Jt76ymF6pL/GS/9P5kcjlg6Yu8eD4+fb/5gh9wn++QhYeSIHJPX5ISMCScr8pl8IV9735N7CU32L0qT3qZnj2whOfgBJv3BFg==</latexit><latexit sha1_base64="jNsc3lE0H1OrS17Dy1TKl2DQFcw=">AAACcXicdVFdixMxFE3Hr7V+dd0n8SVsEcSFMlnE1bdFRXwRV7Ddhc5Y7mTudEOTzJBkrCXkt/iqP8nf4R8w061i/TgQcjjnXu7NSdFIYV2afuslly5fuXpt53r/xs1bt+8Mdu9ObN0ajmNey9qcFWBRCo1jJ5zEs8YgqELiabF40fmnH9FYUev3btVgrmCuRSU4uCjNBntZoXxWonQQZosP3h2wMBsM09FRyp49YfRvwkbpGkOywclst/cqK2veKtSOS7B2ytLG5R6ME1xi6GetxQb4AuY4jVSDQpv79faBPohKSavaxKMdXau/d3hQ1q5UESsVuHP7p9eJ//Kmraue5l7opnWo+cWgqpXU1bSLgpbCIHdyFQlwI+KulJ+DAe5iYP1M45LXSoEufTYJU5b7rJtRVH7IQtj2i2oZftnLzn2JMQmDb6L0tkEDrjaPfAZmruBT8Jt76ymF6pL/GS/9P5kcjlg6Yu8eD4+fb/5gh9wn++QhYeSIHJPX5ISMCScr8pl8IV9735N7CU32L0qT3qZnj2whOfgBJv3BFg==</latexit><latexit sha1_base64="jNsc3lE0H1OrS17Dy1TKl2DQFcw=">AAACcXicdVFdixMxFE3Hr7V+dd0n8SVsEcSFMlnE1bdFRXwRV7Ddhc5Y7mTudEOTzJBkrCXkt/iqP8nf4R8w061i/TgQcjjnXu7NSdFIYV2afuslly5fuXpt53r/xs1bt+8Mdu9ObN0ajmNey9qcFWBRCo1jJ5zEs8YgqELiabF40fmnH9FYUev3btVgrmCuRSU4uCjNBntZoXxWonQQZosP3h2wMBsM09FRyp49YfRvwkbpGkOywclst/cqK2veKtSOS7B2ytLG5R6ME1xi6GetxQb4AuY4jVSDQpv79faBPohKSavaxKMdXau/d3hQ1q5UESsVuHP7p9eJ//Kmraue5l7opnWo+cWgqpXU1bSLgpbCIHdyFQlwI+KulJ+DAe5iYP1M45LXSoEufTYJU5b7rJtRVH7IQtj2i2oZftnLzn2JMQmDb6L0tkEDrjaPfAZmruBT8Jt76ymF6pL/GS/9P5kcjlg6Yu8eD4+fb/5gh9wn++QhYeSIHJPX5ISMCScr8pl8IV9735N7CU32L0qT3qZnj2whOfgBJv3BFg==</latexit>

8j, �t+1j = argmin

�Ltrain

�{xi

j , yij}

nj

i=1;wtG + �

�<latexit sha1_base64="hQyXOxqLHlPKFab7ohwX2jNXLtM=">AAADMXicfVHdbtMwGHXD3yh/HdzBjUVBGmyqEi4YP5o0ARJcgBgS7SbVXeS4TuvOdiLnC21l+QmQeBl4AF5jd4hbbnkAnLZAy4BPSfzlnGN/1jlJLkUBYXhcC06dPnP23Nr5+oWLly5faaxf7RRZaRhvs0xm5iChBZdC8zYIkPwgN5yqRPL95Ohpxe+/46YQmX4L05z3FB1okQpGwUNx4wNJM0OlxKMtTPyTKEv6XAJ1hxY2IxeP8A4m1AyU0LFdot1L/wt8AhYMFdo5TCRPYQMTr0on8ehQbE2rL3GxFTuRP0/HI/fYk+P4+SHgzeVhmBgxGMKduNEMW9th9PB+hE82USucVXO39ejTZ4TQXrxee0/6GSsV18AkLYpuFObQs9SAYJK7OikLnlN2RAe861tNFS96dmacw7c90sfeAf9qwDN0eYelqiimKvFKRWFY/MlV4N+4bgnpg54VOi+BazYflJYSQ4arFHBfGM5ATn1DmRH+rpgNqaEMfFZ1ovmYZUpR3bek47pRz5JqRpLaZuTcKu/9dL/o8Ul28pudVOwz7n0y/JWHXufcUMjMXTtLmHrpYv2fzIdtF+uKH4lyPr6fGeF/N517rShsRW98jk/QvNbQDXQTbaAIbaNd9ALtoTZi6Hvteq1ZuxV8DI6DL8HXuTSoLfZcQysVfPsB9ysPDg==</latexit><latexit sha1_base64="0EC2LeW0YUL4Rl5U8cySpMlgdwM=">AAADMXicfVHLjtMwFHXCayivDuxgY1GQBqaqEhYMD400AiRYgJiR6MxIdRs5rtO64ziRc0NbWf4CJNb8B0h8y+wQW7Z8AE5boGWAqyS+OefY1zonzqUoIAiOPf/U6TNnz62dr124eOnylfr61f0iKzXjbZbJTB/GtOBSKN4GAZIf5prTNJb8ID56WvEHb7kuRKbewDTn3ZQOlEgEo+CgqP6eJJmmUuJRExP3xKkhfS6B2p6BzdBGI7yNCdWDVKjILNH2pfsFPgEDmgplLSaSJ7CBiVMlk2jUE81p9SU2MmI7dOepaGQfO3IcPe8B3lwehokWgyHcieqNoLUVhA/vh/hkE7aCWTV2Wo8+fW7ufdiN1r13pJ+xMuUKmKRF0QmDHLqGahBMclsjZcFzyo7ogHdcq2jKi66ZGWfxbYf0sXPAvQrwDF3eYWhaFNM0dsqUwrD4k6vAv3GdEpIHXSNUXgJXbD4oKSWGDFcp4L7QnIGcuoYyLdxdMRtSTRm4rGpE8THL0pSqviH7thN2DalmxIlphNau8s5P+4sen2Qnv9lJxT7jzifNXznodc41hUzfNbOEqZMu1v/JXNhmsa74EafWxfczI/zvZv9eKwxa4Z7L8Qma1xq6gW6iDRSiLbSDXqBd1EYMffeuew3vlv/RP/a/+F/nUt9b7LmGVsr/9gMfmhAa</latexit><latexit sha1_base64="0EC2LeW0YUL4Rl5U8cySpMlgdwM=">AAADMXicfVHLjtMwFHXCayivDuxgY1GQBqaqEhYMD400AiRYgJiR6MxIdRs5rtO64ziRc0NbWf4CJNb8B0h8y+wQW7Z8AE5boGWAqyS+OefY1zonzqUoIAiOPf/U6TNnz62dr124eOnylfr61f0iKzXjbZbJTB/GtOBSKN4GAZIf5prTNJb8ID56WvEHb7kuRKbewDTn3ZQOlEgEo+CgqP6eJJmmUuJRExP3xKkhfS6B2p6BzdBGI7yNCdWDVKjILNH2pfsFPgEDmgplLSaSJ7CBiVMlk2jUE81p9SU2MmI7dOepaGQfO3IcPe8B3lwehokWgyHcieqNoLUVhA/vh/hkE7aCWTV2Wo8+fW7ufdiN1r13pJ+xMuUKmKRF0QmDHLqGahBMclsjZcFzyo7ogHdcq2jKi66ZGWfxbYf0sXPAvQrwDF3eYWhaFNM0dsqUwrD4k6vAv3GdEpIHXSNUXgJXbD4oKSWGDFcp4L7QnIGcuoYyLdxdMRtSTRm4rGpE8THL0pSqviH7thN2DalmxIlphNau8s5P+4sen2Qnv9lJxT7jzifNXznodc41hUzfNbOEqZMu1v/JXNhmsa74EafWxfczI/zvZv9eKwxa4Z7L8Qma1xq6gW6iDRSiLbSDXqBd1EYMffeuew3vlv/RP/a/+F/nUt9b7LmGVsr/9gMfmhAa</latexit><latexit sha1_base64="btjzKXfJKndywSHa1u+pw+jsfhw=">AAADMXicfVHdbtMwGHXC3yg/6+AObiwK0mBTlXDBQGjSBEhwAWJIrJtUt5HjOq0724mcL7SV5SdA4mV4mt0hbrnlAXC6Ai0DPiXxl3OO/VnnpIUUJUTRSRCeO3/h4qW1y40rV69dX29u3OiUeWUYP2C5zM1RSksuheYHIEDyo8JwqlLJD9Pj5zV/+IGbUuT6PcwK3lN0qEUmGAUPJc1PJMsNlRKPtzHxT6osGXAJ1PUtbMUuGeNdTKgZKqETu0S71/4X+BQsGCq0c5hInsEmJl6VTZNxX2zP6i9xiRW7sT9PJ2P31JOT5GUf8NbyMEyMGI7gftJsRe2dKH7yKMZnm7gdzauFFrWfbAQfySBnleIamKRl2Y2jAnqWGhBMctcgVckLyo7pkHd9q6niZc/OjXP4nkcG2DvgXw14ji7vsFSV5UylXqkojMo/uRr8G9etIHvcs0IXFXDNTgdllcSQ4zoFPBCGM5Az31BmhL8rZiNqKAOfVYNoPmG5UlQPLOm4btyzpJ6RZrYVO7fKez/dL3pylp3+Zqc1+4J7nwx/46G3BTcUcvPAzhOmXrpY/yfzYdvFuuJHqpyP72dG+N9N52E7jtrxu6i192wR5Bq6je6gTRSjHbSHXqF9dIAY+h7cClrB3fBzeBJ+Cb+eSsNgsecmWqnw2w+WRQzy</latexit>

Global Server

. . . . . . .Compute Compute Compute

Model parameters:Updated to:

Agent 1 Agent 2 Agent m

wtG


wt+1G

<latexit sha1_base64="fj3OJj0BUS1IDIQdDxeMyX1tA84=">AAACWHicdZBdaxNBFIYnq/1Ka23rpTeLQSgVwm4p1cuigt6IFUxayG7D2cnZdOh8LDNnjWHYv+Gt/i39Nc4mqbSiB4Z5eZ9zOIe3qKRwlCQ/O9GDh2vrG5tb3e2dR7uP9/YPhs7UluOAG2nsZQEOpdA4IEESLyuLoAqJF8XNm5ZffEHrhNGfaV5hrmCqRSk4ULCyrChnV55epM343Xivl/aTRcVJ//RWHC/FLeqxVZ2P9zun2cTwWqEmLsG5UZpUlHuwJLjEppvVDivgNzDFUZAaFLrcL45u4ufBmcSlseFpihfu3QkPyrm5KkKnArp2f7PW/Bcb1VS+yr3QVU2o+XJRWcuYTNwmEE+ERU5yHgRwK8KtMb8GC5xCTt1M44wbpUBPfDZsRmnus3ZHUfpe2jT3eUiv+YNnLX2LIQmLH4L1sUILZOyRz8BOFXxt/Oq/m/T/xfC4nyb99NNJ7+z1KvNN9pQ9Y4csZS/ZGXvPztmAcVaxb+w7+9H5FbFoI9patkad1cwTdq+ig98EBLao</latexit><latexit sha1_base64="fj3OJj0BUS1IDIQdDxeMyX1tA84=">AAACWHicdZBdaxNBFIYnq/1Ka23rpTeLQSgVwm4p1cuigt6IFUxayG7D2cnZdOh8LDNnjWHYv+Gt/i39Nc4mqbSiB4Z5eZ9zOIe3qKRwlCQ/O9GDh2vrG5tb3e2dR7uP9/YPhs7UluOAG2nsZQEOpdA4IEESLyuLoAqJF8XNm5ZffEHrhNGfaV5hrmCqRSk4ULCyrChnV55epM343Xivl/aTRcVJ//RWHC/FLeqxVZ2P9zun2cTwWqEmLsG5UZpUlHuwJLjEppvVDivgNzDFUZAaFLrcL45u4ufBmcSlseFpihfu3QkPyrm5KkKnArp2f7PW/Bcb1VS+yr3QVU2o+XJRWcuYTNwmEE+ERU5yHgRwK8KtMb8GC5xCTt1M44wbpUBPfDZsRmnus3ZHUfpe2jT3eUiv+YNnLX2LIQmLH4L1sUILZOyRz8BOFXxt/Oq/m/T/xfC4nyb99NNJ7+z1KvNN9pQ9Y4csZS/ZGXvPztmAcVaxb+w7+9H5FbFoI9patkad1cwTdq+ig98EBLao</latexit><latexit sha1_base64="fj3OJj0BUS1IDIQdDxeMyX1tA84=">AAACWHicdZBdaxNBFIYnq/1Ka23rpTeLQSgVwm4p1cuigt6IFUxayG7D2cnZdOh8LDNnjWHYv+Gt/i39Nc4mqbSiB4Z5eZ9zOIe3qKRwlCQ/O9GDh2vrG5tb3e2dR7uP9/YPhs7UluOAG2nsZQEOpdA4IEESLyuLoAqJF8XNm5ZffEHrhNGfaV5hrmCqRSk4ULCyrChnV55epM343Xivl/aTRcVJ//RWHC/FLeqxVZ2P9zun2cTwWqEmLsG5UZpUlHuwJLjEppvVDivgNzDFUZAaFLrcL45u4ufBmcSlseFpihfu3QkPyrm5KkKnArp2f7PW/Bcb1VS+yr3QVU2o+XJRWcuYTNwmEE+ERU5yHgRwK8KtMb8GC5xCTt1M44wbpUBPfDZsRmnus3ZHUfpe2jT3eUiv+YNnLX2LIQmLH4L1sUILZOyRz8BOFXxt/Oq/m/T/xfC4nyb99NNJ7+z1KvNN9pQ9Y4csZS/ZGXvPztmAcVaxb+w7+9H5FbFoI9patkad1cwTdq+ig98EBLao</latexit><latexit sha1_base64="fj3OJj0BUS1IDIQdDxeMyX1tA84=">AAACWHicdZBdaxNBFIYnq/1Ka23rpTeLQSgVwm4p1cuigt6IFUxayG7D2cnZdOh8LDNnjWHYv+Gt/i39Nc4mqbSiB4Z5eZ9zOIe3qKRwlCQ/O9GDh2vrG5tb3e2dR7uP9/YPhs7UluOAG2nsZQEOpdA4IEESLyuLoAqJF8XNm5ZffEHrhNGfaV5hrmCqRSk4ULCyrChnV55epM343Xivl/aTRcVJ//RWHC/FLeqxVZ2P9zun2cTwWqEmLsG5UZpUlHuwJLjEppvVDivgNzDFUZAaFLrcL45u4ufBmcSlseFpihfu3QkPyrm5KkKnArp2f7PW/Bcb1VS+yr3QVU2o+XJRWcuYTNwmEE+ERU5yHgRwK8KtMb8GC5xCTt1M44wbpUBPfDZsRmnus3ZHUfpe2jT3eUiv+YNnLX2LIQmLH4L1sUILZOyRz8BOFXxt/Oq/m/T/xfC4nyb99NNJ7+z1KvNN9pQ9Y4csZS/ZGXvPztmAcVaxb+w7+9H5FbFoI9patkad1cwTdq+ig98EBLao</latexit>

wtG


wtG

<latexit sha1_base64="UI0H2JBfQjZQ+1CTPilgpC2I/+k=">AAACVHicdZDfahNBFMZnt1Zr1NrqpTeLQRAvwm4p1ctSBb0RK5g0kF3D2cnZdOj8WWbONoZhX8JbfS7Bd/HC2SSVVvTAMB/fbw7nzFfWUjhK059RvHVr+/adnbu9e/cf7D7c2380cqaxHIfcSGPHJTiUQuOQBEkc1xZBlRLPyovXHT+7ROuE0Z9oWWOhYK5FJThQsMZ5WS0+0/TtdK+fDdJVJeng6EocrMUV6rNNnU73o6N8ZnijUBOX4NwkS2sqPFgSXGLbyxuHNfALmOMkSA0KXeFXC7fJs+DMksrYcDQlK/d6hwfl3FKV4aUCOnd/s878F5s0VL0qvNB1Q6j5elDVyIRM0v0+mQmLnOQyCOBWhF0Tfg4WOIWMernGBTdKgZ75fNROssLn3Yyy8v2sbW/ykFz7By86+gZDEhbfB+tDjRbI2Bc+BztX8KX1m/t60v8Xo4NBlg6yj4f945NN5jvsCXvKnrOMvWTH7B07ZUPGmWRf2Tf2PfoR/Yq34u310zja9DxmNyre/Q37a7Yr</latexit><latexit sha1_base64="UI0H2JBfQjZQ+1CTPilgpC2I/+k=">AAACVHicdZDfahNBFMZnt1Zr1NrqpTeLQRAvwm4p1ctSBb0RK5g0kF3D2cnZdOj8WWbONoZhX8JbfS7Bd/HC2SSVVvTAMB/fbw7nzFfWUjhK059RvHVr+/adnbu9e/cf7D7c2380cqaxHIfcSGPHJTiUQuOQBEkc1xZBlRLPyovXHT+7ROuE0Z9oWWOhYK5FJThQsMZ5WS0+0/TtdK+fDdJVJeng6EocrMUV6rNNnU73o6N8ZnijUBOX4NwkS2sqPFgSXGLbyxuHNfALmOMkSA0KXeFXC7fJs+DMksrYcDQlK/d6hwfl3FKV4aUCOnd/s878F5s0VL0qvNB1Q6j5elDVyIRM0v0+mQmLnOQyCOBWhF0Tfg4WOIWMernGBTdKgZ75fNROssLn3Yyy8v2sbW/ykFz7By86+gZDEhbfB+tDjRbI2Bc+BztX8KX1m/t60v8Xo4NBlg6yj4f945NN5jvsCXvKnrOMvWTH7B07ZUPGmWRf2Tf2PfoR/Yq34u310zja9DxmNyre/Q37a7Yr</latexit><latexit sha1_base64="UI0H2JBfQjZQ+1CTPilgpC2I/+k=">AAACVHicdZDfahNBFMZnt1Zr1NrqpTeLQRAvwm4p1ctSBb0RK5g0kF3D2cnZdOj8WWbONoZhX8JbfS7Bd/HC2SSVVvTAMB/fbw7nzFfWUjhK059RvHVr+/adnbu9e/cf7D7c2380cqaxHIfcSGPHJTiUQuOQBEkc1xZBlRLPyovXHT+7ROuE0Z9oWWOhYK5FJThQsMZ5WS0+0/TtdK+fDdJVJeng6EocrMUV6rNNnU73o6N8ZnijUBOX4NwkS2sqPFgSXGLbyxuHNfALmOMkSA0KXeFXC7fJs+DMksrYcDQlK/d6hwfl3FKV4aUCOnd/s878F5s0VL0qvNB1Q6j5elDVyIRM0v0+mQmLnOQyCOBWhF0Tfg4WOIWMernGBTdKgZ75fNROssLn3Yyy8v2sbW/ykFz7By86+gZDEhbfB+tDjRbI2Bc+BztX8KX1m/t60v8Xo4NBlg6yj4f945NN5jvsCXvKnrOMvWTH7B07ZUPGmWRf2Tf2PfoR/Yq34u310zja9DxmNyre/Q37a7Yr</latexit><latexit sha1_base64="UI0H2JBfQjZQ+1CTPilgpC2I/+k=">AAACVHicdZDfahNBFMZnt1Zr1NrqpTeLQRAvwm4p1ctSBb0RK5g0kF3D2cnZdOj8WWbONoZhX8JbfS7Bd/HC2SSVVvTAMB/fbw7nzFfWUjhK059RvHVr+/adnbu9e/cf7D7c2380cqaxHIfcSGPHJTiUQuOQBEkc1xZBlRLPyovXHT+7ROuE0Z9oWWOhYK5FJThQsMZ5WS0+0/TtdK+fDdJVJeng6EocrMUV6rNNnU73o6N8ZnijUBOX4NwkS2sqPFgSXGLbyxuHNfALmOMkSA0KXeFXC7fJs+DMksrYcDQlK/d6hwfl3FKV4aUCOnd/s878F5s0VL0qvNB1Q6j5elDVyIRM0v0+mQmLnOQyCOBWhF0Tfg4WOIWMernGBTdKgZ75fNROssLn3Yyy8v2sbW/ykFz7By86+gZDEhbfB+tDjRbI2Bc+BztX8KX1m/t60v8Xo4NBlg6yj4f945NN5jvsCXvKnrOMvWTH7B07ZUPGmWRf2Tf2PfoR/Yq34u310zja9DxmNyre/Q37a7Yr</latexit> wtG


�t+11


�t+12


�t+11


�t+12


8j 6= m, �t+1j = argmin

�Ltrain

�{xi

j , yij}

nj

i=1;wtG + �

�<latexit sha1_base64="cE/CRQDwGMhRrEmjnkchxe38LGc=">AAADOHicfVHLbhMxFPUMrxIeTWHJxhAhlaaKZlhQHqpUARIsQBSJpJXidORxPIlT2zN4bkgiy1/Amj9hxYrfYMcOsWXLBucBJBS4mhnfOefY1zonLaQoIYo+BeGp02fOnls7X7lw8dLl9erGlVaZDw3jTZbL3BymtORSaN4EAZIfFoZTlUp+kB4/mvIHb7gpRa5fwaTgHUV7WmSCUfBQUn1HstxQKfEAE81fY7WNiX9SZUmXS6DuyEI9dskA72JCTU8Jndgl2j3zv8DHYMFQoZ3DRPIMNjHxqmycDI7E9mT6JS6xYjf25+lk4B54cpQ8OQJcXx6GiRG9PtxKqrWosRPF9+7E+GQTN6JZ1fYa999/RAjtJxvBW9LN2VBxDUzSsmzHUQEdSw0IJrmrkGHJC8qOaY+3faup4mXHzvxz+KZHutgb4V8NeIYu77BUleVEpV6pKPTLP7kp+DeuPYTsbscKXQyBazYflA0lhhxPw8BdYTgDOfENZUb4u2LWp4Yy8JFVfCAjlitFddeSlmvHHUumM9LM1mLnVnnvp/tFj06y49/seMo+5t4nw5976EXBDYXcbNlZwtRLF+v/ZD5su1hX/EiV8/H9zAj/u2ndbsRRI37pc3yI5rWGrqEbaBPFaAftoadoHzURQ9+D68FWUA8/hJ/DL+HXuTQMFnuuopUKv/0AgJQRoQ==</latexit><latexit sha1_base64="ejdB+EZzSXgIfn+iRbDAp4AWKW0=">AAADOHicfVHLbhMxFHWGVwmPprBkY4iQSlNFMywoD1WqAAkWIFqJpJXiZORxPIlT2zN4bkgiy1/AGokPQULiT9ixQ2zZssF5AAkFrmbGd8459rXOSXIpCgjDT6Xg1OkzZ8+tnS9fuHjp8npl40qzyIaG8QbLZGaOElpwKTRvgADJj3LDqUokP0yOH035w9fcFCLTL2GS87aiPS1SwSh4KK68JWlmqJR4gInmr7DaxsQ/ibKkyyVQ17FQi1w8wLuYUNNTQsd2iXbP/C/wMVgwVGjnMJE8hU1MvCodx4OO2J5Mv8TFVuxG/jwdD9wDT47iJx3AteVhmBjR68OtuFIN6zthdO9OhE82UT2cVXWvfv/9h+2Dd/vxRukN6WZsqLgGJmlRtKIwh7alBgST3JXJsOA5Zce0x1u+1VTxom1n/jl80yNd7I3wrwY8Q5d3WKqKYqISr1QU+sWf3BT8G9caQnq3bYXOh8A1mw9KhxJDhqdh4K4wnIGc+IYyI/xdMetTQxn4yMo+kBHLlKK6a0nTtaK2JdMZSWqrkXOrvPfT/aJHJ9nxb3Y8ZR9z75Phzz30IueGQma27Cxh6qWL9X8yH7ZdrCt+JMr5+H5mhP/dNG/Xo7AeHfgcH6J5raFr6AbaRBHaQXvoKdpHDcTQ99L10lapFnwMPgdfgq9zaVBa7LmKVir49gOo9BKt</latexit><latexit sha1_base64="ejdB+EZzSXgIfn+iRbDAp4AWKW0=">AAADOHicfVHLbhMxFHWGVwmPprBkY4iQSlNFMywoD1WqAAkWIFqJpJXiZORxPIlT2zN4bkgiy1/AGokPQULiT9ixQ2zZssF5AAkFrmbGd8459rXOSXIpCgjDT6Xg1OkzZ8+tnS9fuHjp8npl40qzyIaG8QbLZGaOElpwKTRvgADJj3LDqUokP0yOH035w9fcFCLTL2GS87aiPS1SwSh4KK68JWlmqJR4gInmr7DaxsQ/ibKkyyVQ17FQi1w8wLuYUNNTQsd2iXbP/C/wMVgwVGjnMJE8hU1MvCodx4OO2J5Mv8TFVuxG/jwdD9wDT47iJx3AteVhmBjR68OtuFIN6zthdO9OhE82UT2cVXWvfv/9h+2Dd/vxRukN6WZsqLgGJmlRtKIwh7alBgST3JXJsOA5Zce0x1u+1VTxom1n/jl80yNd7I3wrwY8Q5d3WKqKYqISr1QU+sWf3BT8G9caQnq3bYXOh8A1mw9KhxJDhqdh4K4wnIGc+IYyI/xdMetTQxn4yMo+kBHLlKK6a0nTtaK2JdMZSWqrkXOrvPfT/aJHJ9nxb3Y8ZR9z75Phzz30IueGQma27Cxh6qWL9X8yH7ZdrCt+JMr5+H5mhP/dNG/Xo7AeHfgcH6J5raFr6AbaRBHaQXvoKdpHDcTQ99L10lapFnwMPgdfgq9zaVBa7LmKVir49gOo9BKt</latexit><latexit sha1_base64="5JXI7gUoPlcPiQVQyJF7l9Mh82E=">AAADOHicfVHLjtMwFHXCayivDizZGCqkYTqqEhYMCI00AiRYgBgk2hmpbiPHdVp3bCc4t7SV5S9gzc/wJ+zYIbZs2eB0CrQMcJXEN+cc+1rnpIUUJUTRpyA8c/bc+QsbF2uXLl+5eq2+eb1T5hPDeJvlMjdHKS25FJq3QYDkR4XhVKWSH6bHTyr+8B03pcj1G5gXvKfoUItMMAoeSuofSJYbKiUeY6L5W6x2MPFPqiwZcAnU9S00Y5eM8R4m1AyV0Ildod0L/wt8BhYMFdo5TCTPYAsTr8pmybgvdubVl7jEir3Yn6eTsXvkyWnyrA+4uToMEyOGI7ib1BtRazeKH96P8ekmbkWLaqBlHSSbwXsyyNlEcQ1M0rLsxlEBPUsNCCa5q5FJyQvKjumQd32rqeJlzy78c/iORwbYG+FfDXiBru6wVJXlXKVeqSiMyj+5Cvwb151A9qBnhS4mwDU7GZRNJIYcV2HggTCcgZz7hjIj/F0xG1FDGfjIaj6QKcuVonpgScd1454l1Yw0s43YuXXe++l+0dPT7Ow3O6vYp9z7ZPhLD70quKGQm227SJh66XL9n8yHbZfrmh+pcj6+nxnhfzede604asWvo8b+42WQG+gmuo22UIx20T56jg5QGzH0PbgVbAfN8GP4OfwSfj2RhsFyzw20VuG3Hx+uD4U=</latexit>

wt+1G = wt

G +X

j 6=m

↵j�t+1j + ↵m�t+1

m

<latexit sha1_base64="L8dCnEAUAOSS6/6taAdxJune/o4=">AAACw3icdZFdi9NAFIan8WutX1299GawCOJCSZZF92Zh8ftGXMF2F5oYTiYnbbYzSZyZWMswv9Bf4M/wVm+cNFkxogdC3rzPOZnkPUnFc6V9/9vAu3T5ytVrO9eHN27eun1ntHt3pspaMpyykpfyLAGFPC9wqnPN8aySCCLheJqsnjf89DNKlZfFB72pMBKwKPIsZ6CdFY8wTLL1R6P3Ahu/pkd0+6id3KOhqkVszmlY4CcqLA2BV0uInZEIE6bINdj4vJ1t2lsselh0rx6Ng4m/LepPnlyI/VZcoDHp6iTeHbwK05LVAgvNOCg1D/xKRwakzhlHOwxrhRWwFSxw7mQBAlVktnlY+tA5Kc1K6a5C063754QBodRGJK5TgF6qv1lj/ovNa50dRiYvqlpjwdqDsppTXdImXJrmEpnmGyeAydx9K2VLkMC0W8HQBblmpRBQpCac2XkQmbA5I8nMOLC2z90e7G+8bugLdElIfOusdxVK0KV8bEKQCwFfrOnuvV9JRC/5/4vZ/iTwJ8H7g/Hxs24HO+Q+eUAekYA8JcfkDTkhU8LIV/Kd/CA/vZfeypOeblu9QTdzj/TKs78AD2bfyw==</latexit><latexit sha1_base64="L8dCnEAUAOSS6/6taAdxJune/o4=">AAACw3icdZFdi9NAFIan8WutX1299GawCOJCSZZF92Zh8ftGXMF2F5oYTiYnbbYzSZyZWMswv9Bf4M/wVm+cNFkxogdC3rzPOZnkPUnFc6V9/9vAu3T5ytVrO9eHN27eun1ntHt3pspaMpyykpfyLAGFPC9wqnPN8aySCCLheJqsnjf89DNKlZfFB72pMBKwKPIsZ6CdFY8wTLL1R6P3Ahu/pkd0+6id3KOhqkVszmlY4CcqLA2BV0uInZEIE6bINdj4vJ1t2lsselh0rx6Ng4m/LepPnlyI/VZcoDHp6iTeHbwK05LVAgvNOCg1D/xKRwakzhlHOwxrhRWwFSxw7mQBAlVktnlY+tA5Kc1K6a5C063754QBodRGJK5TgF6qv1lj/ovNa50dRiYvqlpjwdqDsppTXdImXJrmEpnmGyeAydx9K2VLkMC0W8HQBblmpRBQpCac2XkQmbA5I8nMOLC2z90e7G+8bugLdElIfOusdxVK0KV8bEKQCwFfrOnuvV9JRC/5/4vZ/iTwJ8H7g/Hxs24HO+Q+eUAekYA8JcfkDTkhU8LIV/Kd/CA/vZfeypOeblu9QTdzj/TKs78AD2bfyw==</latexit><latexit sha1_base64="L8dCnEAUAOSS6/6taAdxJune/o4=">AAACw3icdZFdi9NAFIan8WutX1299GawCOJCSZZF92Zh8ftGXMF2F5oYTiYnbbYzSZyZWMswv9Bf4M/wVm+cNFkxogdC3rzPOZnkPUnFc6V9/9vAu3T5ytVrO9eHN27eun1ntHt3pspaMpyykpfyLAGFPC9wqnPN8aySCCLheJqsnjf89DNKlZfFB72pMBKwKPIsZ6CdFY8wTLL1R6P3Ahu/pkd0+6id3KOhqkVszmlY4CcqLA2BV0uInZEIE6bINdj4vJ1t2lsselh0rx6Ng4m/LepPnlyI/VZcoDHp6iTeHbwK05LVAgvNOCg1D/xKRwakzhlHOwxrhRWwFSxw7mQBAlVktnlY+tA5Kc1K6a5C063754QBodRGJK5TgF6qv1lj/ovNa50dRiYvqlpjwdqDsppTXdImXJrmEpnmGyeAydx9K2VLkMC0W8HQBblmpRBQpCac2XkQmbA5I8nMOLC2z90e7G+8bugLdElIfOusdxVK0KV8bEKQCwFfrOnuvV9JRC/5/4vZ/iTwJ8H7g/Hxs24HO+Q+eUAekYA8JcfkDTkhU8LIV/Kd/CA/vZfeypOeblu9QTdzj/TKs78AD2bfyw==</latexit><latexit sha1_base64="L8dCnEAUAOSS6/6taAdxJune/o4=">AAACw3icdZFdi9NAFIan8WutX1299GawCOJCSZZF92Zh8ftGXMF2F5oYTiYnbbYzSZyZWMswv9Bf4M/wVm+cNFkxogdC3rzPOZnkPUnFc6V9/9vAu3T5ytVrO9eHN27eun1ntHt3pspaMpyykpfyLAGFPC9wqnPN8aySCCLheJqsnjf89DNKlZfFB72pMBKwKPIsZ6CdFY8wTLL1R6P3Ahu/pkd0+6id3KOhqkVszmlY4CcqLA2BV0uInZEIE6bINdj4vJ1t2lsselh0rx6Ng4m/LepPnlyI/VZcoDHp6iTeHbwK05LVAgvNOCg1D/xKRwakzhlHOwxrhRWwFSxw7mQBAlVktnlY+tA5Kc1K6a5C063754QBodRGJK5TgF6qv1lj/ovNa50dRiYvqlpjwdqDsppTXdImXJrmEpnmGyeAydx9K2VLkMC0W8HQBblmpRBQpCac2XkQmbA5I8nMOLC2z90e7G+8bugLdElIfOusdxVK0KV8bEKQCwFfrOnuvV9JRC/5/4vZ/iTwJ8H7g/Hxs24HO+Q+eUAekYA8JcfkDTkhU8LIV/Kd/CA/vZfeypOeblu9QTdzj/TKs78AD2bfyw==</latexit>

- Server aggregates updates based on a rule such as linear weighted averaging (shown)

- Only model updates are shared with server

Key Question: What if one of the agents is malicious, and aims to poison the learning process?

- Server aggregates malicious update along with benign ones

�mal ! ��mal<latexit sha1_base64="3kejxoCMlGlIPTJW9+E4dJo1wFY=">AAAC5nicfVHLbhMxFHWGVwmvFJZsLCIkxCKaQRWFXUVZsEEUiaSV4lF0x3MnsWp7RraHJLLmC5DYIbZs+Rq29G/wJOERSrmS5aNzztW1z80qKayL47NOdOnylavXdq53b9y8dftOb/fuyJa14TjkpSzNSQYWpdA4dMJJPKkMgsokHmenh61+/B6NFaV+55YVpgqmWhSCgwvUpHfIMuVZjtJBM/HM4cJ5BbJpKDNiOnNgTDmnLEMH9CLrpNePB/tx8vxpQs+DZBCvqk82dTTZ7XxgeclrhdpxCdaOk7hyqQfjBJfYdFltsQJ+ClMcB6hBoU396rcNfRiYnBalCUc7umL/7PCgrF2qLDgVuJn9W2vJf2nj2hXPUi90VTvUfD2oqCV1JW2jo7kwyJ1cBgDciPBWymdggLsQcJdpnPNSKdC5Z6NmnKSetTOywveTptnWs2Le/JLn59XFb3XRqi8x5GTwdaDeVGjAleaxZ2CmCoJ1c//PJvTaFu6tPDLVru/njujFYPRkkAT8dq9/8GKzyB1ynzwgj0hC9skBeUWOyJBw8pV8I9/JWTSLPkafos9ra9TZ9NwjWxV9+QH97PM2</latexit><latexit sha1_base64="3kejxoCMlGlIPTJW9+E4dJo1wFY=">AAAC5nicfVHLbhMxFHWGVwmvFJZsLCIkxCKaQRWFXUVZsEEUiaSV4lF0x3MnsWp7RraHJLLmC5DYIbZs+Rq29G/wJOERSrmS5aNzztW1z80qKayL47NOdOnylavXdq53b9y8dftOb/fuyJa14TjkpSzNSQYWpdA4dMJJPKkMgsokHmenh61+/B6NFaV+55YVpgqmWhSCgwvUpHfIMuVZjtJBM/HM4cJ5BbJpKDNiOnNgTDmnLEMH9CLrpNePB/tx8vxpQs+DZBCvqk82dTTZ7XxgeclrhdpxCdaOk7hyqQfjBJfYdFltsQJ+ClMcB6hBoU396rcNfRiYnBalCUc7umL/7PCgrF2qLDgVuJn9W2vJf2nj2hXPUi90VTvUfD2oqCV1JW2jo7kwyJ1cBgDciPBWymdggLsQcJdpnPNSKdC5Z6NmnKSetTOywveTptnWs2Le/JLn59XFb3XRqi8x5GTwdaDeVGjAleaxZ2CmCoJ1c//PJvTaFu6tPDLVru/njujFYPRkkAT8dq9/8GKzyB1ynzwgj0hC9skBeUWOyJBw8pV8I9/JWTSLPkafos9ra9TZ9NwjWxV9+QH97PM2</latexit><latexit sha1_base64="3kejxoCMlGlIPTJW9+E4dJo1wFY=">AAAC5nicfVHLbhMxFHWGVwmvFJZsLCIkxCKaQRWFXUVZsEEUiaSV4lF0x3MnsWp7RraHJLLmC5DYIbZs+Rq29G/wJOERSrmS5aNzztW1z80qKayL47NOdOnylavXdq53b9y8dftOb/fuyJa14TjkpSzNSQYWpdA4dMJJPKkMgsokHmenh61+/B6NFaV+55YVpgqmWhSCgwvUpHfIMuVZjtJBM/HM4cJ5BbJpKDNiOnNgTDmnLEMH9CLrpNePB/tx8vxpQs+DZBCvqk82dTTZ7XxgeclrhdpxCdaOk7hyqQfjBJfYdFltsQJ+ClMcB6hBoU396rcNfRiYnBalCUc7umL/7PCgrF2qLDgVuJn9W2vJf2nj2hXPUi90VTvUfD2oqCV1JW2jo7kwyJ1cBgDciPBWymdggLsQcJdpnPNSKdC5Z6NmnKSetTOywveTptnWs2Le/JLn59XFb3XRqi8x5GTwdaDeVGjAleaxZ2CmCoJ1c//PJvTaFu6tPDLVru/njujFYPRkkAT8dq9/8GKzyB1ynzwgj0hC9skBeUWOyJBw8pV8I9/JWTSLPkafos9ra9TZ9NwjWxV9+QH97PM2</latexit><latexit sha1_base64="3kejxoCMlGlIPTJW9+E4dJo1wFY=">AAAC5nicfVHLbhMxFHWGVwmvFJZsLCIkxCKaQRWFXUVZsEEUiaSV4lF0x3MnsWp7RraHJLLmC5DYIbZs+Rq29G/wJOERSrmS5aNzztW1z80qKayL47NOdOnylavXdq53b9y8dftOb/fuyJa14TjkpSzNSQYWpdA4dMJJPKkMgsokHmenh61+/B6NFaV+55YVpgqmWhSCgwvUpHfIMuVZjtJBM/HM4cJ5BbJpKDNiOnNgTDmnLEMH9CLrpNePB/tx8vxpQs+DZBCvqk82dTTZ7XxgeclrhdpxCdaOk7hyqQfjBJfYdFltsQJ+ClMcB6hBoU396rcNfRiYnBalCUc7umL/7PCgrF2qLDgVuJn9W2vJf2nj2hXPUi90VTvUfD2oqCV1JW2jo7kwyJ1cBgDciPBWymdggLsQcJdpnPNSKdC5Z6NmnKSetTOywveTptnWs2Le/JLn59XFb3XRqi8x5GTwdaDeVGjAleaxZ2CmCoJ1c//PJvTaFu6tPDLVru/njujFYPRkkAT8dq9/8GKzyB1ynzwgj0hC9skBeUWOyJBw8pV8I9/JWTSLPkafos9ra9TZ9NwjWxV9+QH97PM2</latexit>

�00mal = argmin�

Lben

�{xi

m, yim}nmi=1;wG + ��0mal + �

�+ ⇢k� � �consk22

<latexit sha1_base64="h8HxA3a4tQoHpgFACdblBRfGn1M=">AAADenicfVLdbtMwGHVafkb56+CSG2sV2sagaqqJgVClCZDgAsSQaDepbiPHdVprthPZDm3l+Ql4QMS7cIGTtqNlwCc5Pjnn2J/l4zjjTJtW60dQqV67fuPm1q3a7Tt3792vbz/o6TRXhHZJylN1FmNNOZO0a5jh9CxTFIuY09P4/E2hn36lSrNUfjHzjA4EHkuWMIKNp6L6dxQLi0aUG+x2dyNk6MxYgbmDHYiwGgsmI7vmcR/8b2mKqXQOIk4Ts4e8JZlFYsiezosvcpFlndANrYyEe+XFafQOHkAUU4PhesvVbkVLVzouNYgUG0/MfsGqSQrRxZr4bA2v9iCp1M6hi6g9bEf1Rqt51ApfPg/hVRA2W2U1wLJOou3gGxqlJBdUGsKx1v2wlZmBxcowwqmroVzTDJNzPKZ9DyUWVA9smYCDjz0zgkmq/JAGluz6CouF1nMRe6fAZqL/1Aryb1o/N8mLgWUyyw2VZNEoyTk0KSzihCOmKDF87gEmivmzQjLBChPjQ68hSackFQLLkUU91w8HFhU94sQ2Quc2dR+Su5SnV9XZb3VWqG+pvydFP3rqU0YVNql6Yss3g711Of/PxuTC5ueN+4iF8/GtMoL/Br12M/T482Hj+PUyyC3wCOyAPRCCI3AM3oMT0AUk6AQk4IGo/KzuVPerBwtrJViueQg2qnr4C2zfJ/o=</latexit><latexit sha1_base64="h8HxA3a4tQoHpgFACdblBRfGn1M=">AAADenicfVLdbtMwGHVafkb56+CSG2sV2sagaqqJgVClCZDgAsSQaDepbiPHdVprthPZDm3l+Ql4QMS7cIGTtqNlwCc5Pjnn2J/l4zjjTJtW60dQqV67fuPm1q3a7Tt3792vbz/o6TRXhHZJylN1FmNNOZO0a5jh9CxTFIuY09P4/E2hn36lSrNUfjHzjA4EHkuWMIKNp6L6dxQLi0aUG+x2dyNk6MxYgbmDHYiwGgsmI7vmcR/8b2mKqXQOIk4Ts4e8JZlFYsiezosvcpFlndANrYyEe+XFafQOHkAUU4PhesvVbkVLVzouNYgUG0/MfsGqSQrRxZr4bA2v9iCp1M6hi6g9bEf1Rqt51ApfPg/hVRA2W2U1wLJOou3gGxqlJBdUGsKx1v2wlZmBxcowwqmroVzTDJNzPKZ9DyUWVA9smYCDjz0zgkmq/JAGluz6CouF1nMRe6fAZqL/1Aryb1o/N8mLgWUyyw2VZNEoyTk0KSzihCOmKDF87gEmivmzQjLBChPjQ68hSackFQLLkUU91w8HFhU94sQ2Quc2dR+Su5SnV9XZb3VWqG+pvydFP3rqU0YVNql6Yss3g711Of/PxuTC5ueN+4iF8/GtMoL/Br12M/T482Hj+PUyyC3wCOyAPRCCI3AM3oMT0AUk6AQk4IGo/KzuVPerBwtrJViueQg2qnr4C2zfJ/o=</latexit><latexit sha1_base64="h8HxA3a4tQoHpgFACdblBRfGn1M=">AAADenicfVLdbtMwGHVafkb56+CSG2sV2sagaqqJgVClCZDgAsSQaDepbiPHdVprthPZDm3l+Ql4QMS7cIGTtqNlwCc5Pjnn2J/l4zjjTJtW60dQqV67fuPm1q3a7Tt3792vbz/o6TRXhHZJylN1FmNNOZO0a5jh9CxTFIuY09P4/E2hn36lSrNUfjHzjA4EHkuWMIKNp6L6dxQLi0aUG+x2dyNk6MxYgbmDHYiwGgsmI7vmcR/8b2mKqXQOIk4Ts4e8JZlFYsiezosvcpFlndANrYyEe+XFafQOHkAUU4PhesvVbkVLVzouNYgUG0/MfsGqSQrRxZr4bA2v9iCp1M6hi6g9bEf1Rqt51ApfPg/hVRA2W2U1wLJOou3gGxqlJBdUGsKx1v2wlZmBxcowwqmroVzTDJNzPKZ9DyUWVA9smYCDjz0zgkmq/JAGluz6CouF1nMRe6fAZqL/1Aryb1o/N8mLgWUyyw2VZNEoyTk0KSzihCOmKDF87gEmivmzQjLBChPjQ68hSackFQLLkUU91w8HFhU94sQ2Quc2dR+Su5SnV9XZb3VWqG+pvydFP3rqU0YVNql6Yss3g711Of/PxuTC5ueN+4iF8/GtMoL/Br12M/T482Hj+PUyyC3wCOyAPRCCI3AM3oMT0AUk6AQk4IGo/KzuVPerBwtrJViueQg2qnr4C2zfJ/o=</latexit><latexit sha1_base64="h8HxA3a4tQoHpgFACdblBRfGn1M=">AAADenicfVLdbtMwGHVafkb56+CSG2sV2sagaqqJgVClCZDgAsSQaDepbiPHdVprthPZDm3l+Ql4QMS7cIGTtqNlwCc5Pjnn2J/l4zjjTJtW60dQqV67fuPm1q3a7Tt3792vbz/o6TRXhHZJylN1FmNNOZO0a5jh9CxTFIuY09P4/E2hn36lSrNUfjHzjA4EHkuWMIKNp6L6dxQLi0aUG+x2dyNk6MxYgbmDHYiwGgsmI7vmcR/8b2mKqXQOIk4Ts4e8JZlFYsiezosvcpFlndANrYyEe+XFafQOHkAUU4PhesvVbkVLVzouNYgUG0/MfsGqSQrRxZr4bA2v9iCp1M6hi6g9bEf1Rqt51ApfPg/hVRA2W2U1wLJOou3gGxqlJBdUGsKx1v2wlZmBxcowwqmroVzTDJNzPKZ9DyUWVA9smYCDjz0zgkmq/JAGluz6CouF1nMRe6fAZqL/1Aryb1o/N8mLgWUyyw2VZNEoyTk0KSzihCOmKDF87gEmivmzQjLBChPjQ68hSackFQLLkUU91w8HFhU94sQ2Quc2dR+Su5SnV9XZb3VWqG+pvydFP3rqU0YVNql6Yss3g711Of/PxuTC5ueN+4iF8/GtMoL/Br12M/T482Hj+PUyyC3wCOyAPRCCI3AM3oMT0AUk6AQk4IGo/KzuVPerBwtrJViueQg2qnr4C2zfJ/o=</latexit>

�0mal = argmin�

Lmal

�{xl, T l}nmal

l=1 ;wG + ��

<latexit sha1_base64="Ia97OOHmOXRc5IfEt2WO8A9WRb0=">AAADKnicfVHNbhMxGPQufyX8pfQISBYRogUU7XKgIFSpAiQ4gChSk1aKk63X+TaxantXXi9JsHzmwIEX4Wm4VVy58g44SSkJBT7J8uzMeG3NpIXgpYmioyA8c/bc+QsrF2uXLl+5eq2+er1d5pVm0GK5yPV+SksQXEHLcCNgv9BAZSpgLz18PtX33oMuea52zaSArqQDxTPOqPFUUv9IUmlJH4Sh7m5CDIyNlVQ4vIUJ1QPJVWIXLO61/zwxOUwEZGYdE+/Jxj3xYLcniEus2Ipdz6olr3vqPaPkJb6PF36IieaDodlI6o2ouRnFTx7F+DSIm9FsGtsbnz8cIIR2ktXgE+nnrJKgDBO0LDtxVJiupdpwJsDVSFVCQdkhHUDHQ0UllF07S8zhO57p4yzXfimDZ+ziCUtlWU5k6p2SmmH5pzYl/6Z1KpM97lquisqAYvOLskpgk+Np/LjPNTAjJh5Qprl/K2ZDqikzvqQaUTBiuZRU9S1pu07ctWR6R5rZRuzcsu7TdCfy6LQ6/q2Op+oL8DlpeOOptwVoanJ9z85Kpt56vP/PxtXc5velPFLpfH2/OsL/Bu2Hzdjjd77HZ2g+K+gGuo3WUYw20TZ6hXZQCzH0I1gLbga3wi/h1/Ao/Da3hsHxmTW0NOH3n2/0DYs=</latexit><latexit sha1_base64="UPUL5ofYQFizKwWFtQ0DIIplR6Y=">AAADKnicfVHNbhMxGPQufyH8pfQISBYRogUU7XKgIFSpAiQ4gChS01aKk5XX+TaxantXXi9JsHzmwIErT8CJp+FWceXKO+AkpSQU+CTLszPjtTWTFoKXJooOg/DU6TNnz9XO1y9cvHT5SmPl6m6ZV5pBm+Ui1/spLUFwBW3DjYD9QgOVqYC99ODpVN97C7rkudoxkwK6kg4UzzijxlNJ4z1JpSV9EIa62wkxMDZWUuHwJiZUDyRXiV2wuJf+89jkMBGQmTVMvCcb98S9nZ4gLrFiM3Y9q5a87rH3jJLn+C5e+CEmmg+GZj1pNKPWRhQ/ehDjkyBuRbNpbq1/fFfUPn/aTlaCD6Sfs0qCMkzQsuzEUWG6lmrDmQBXJ1UJBWUHdAAdDxWVUHbtLDGHb3mmj7Nc+6UMnrGLJyyVZTmRqXdKaobln9qU/JvWqUz2sGu5KioDis0vyiqBTY6n8eM+18CMmHhAmeb+rZgNqabM+JLqRMGI5VJS1bdk13XiriXTO9LMNmPnlnWfpjuWRyfV8W91PFWfgc9JwytPvS5AU5PrO3ZWMvXWo/1/Nq7mNr8v5ZFK5+v71RH+N9i934o9fuN7fILmU0PX0E20hmK0gbbQC7SN2oihH8FqcD24EX4Jv4aH4be5NQyOzqyipQm//wQxEQ7h</latexit><latexit sha1_base64="UPUL5ofYQFizKwWFtQ0DIIplR6Y=">AAADKnicfVHNbhMxGPQufyH8pfQISBYRogUU7XKgIFSpAiQ4gChS01aKk5XX+TaxantXXi9JsHzmwIErT8CJp+FWceXKO+AkpSQU+CTLszPjtTWTFoKXJooOg/DU6TNnz9XO1y9cvHT5SmPl6m6ZV5pBm+Ui1/spLUFwBW3DjYD9QgOVqYC99ODpVN97C7rkudoxkwK6kg4UzzijxlNJ4z1JpSV9EIa62wkxMDZWUuHwJiZUDyRXiV2wuJf+89jkMBGQmTVMvCcb98S9nZ4gLrFiM3Y9q5a87rH3jJLn+C5e+CEmmg+GZj1pNKPWRhQ/ehDjkyBuRbNpbq1/fFfUPn/aTlaCD6Sfs0qCMkzQsuzEUWG6lmrDmQBXJ1UJBWUHdAAdDxWVUHbtLDGHb3mmj7Nc+6UMnrGLJyyVZTmRqXdKaobln9qU/JvWqUz2sGu5KioDis0vyiqBTY6n8eM+18CMmHhAmeb+rZgNqabM+JLqRMGI5VJS1bdk13XiriXTO9LMNmPnlnWfpjuWRyfV8W91PFWfgc9JwytPvS5AU5PrO3ZWMvXWo/1/Nq7mNr8v5ZFK5+v71RH+N9i934o9fuN7fILmU0PX0E20hmK0gbbQC7SN2oihH8FqcD24EX4Jv4aH4be5NQyOzqyipQm//wQxEQ7h</latexit><latexit sha1_base64="XEFwmdqUCdOHm4OF5N970/OjfYU=">AAADKnicfVFLbxMxGPQurxJeaXsEJIsIUSiKdjm0IFSpAiQ4gChSk1aKk5XX+TaxantXXi9JZPnMgb/Cr+FWceXKf8B5UBIKfJLl2Znx2ppJC8FLE0WnQXjh4qXLV9au1q5dv3HzVn19o13mlWbQYrnI9XFKSxBcQctwI+C40EBlKuAoPXk51Y8+gi55rg7NpICupAPFM86o8VRS/0RSaUkfhKHuQUIMjI2VVDi8hwnVA8lVYpcs7q3/PDM5TARkZgsT78nGPfH4sCeIS6zYi13PqhWve+49o+Q13sZLP8RE88HQPEzqjai5G8XPdmJ8HsTNaDYNtJiDZD34TPo5qyQowwQty04cFaZrqTacCXA1UpVQUHZCB9DxUFEJZdfOEnP4vmf6OMu1X8rgGbt8wlJZlhOZeqekZlj+qU3Jv2mdymRPu5arojKg2PyirBLY5HgaP+5zDcyIiQeUae7fitmQasqML6lGFIxYLiVVfUvarhN3LZnekWa2ETu3qvs03Zk8Oq+Of6vjqfoKfE4a3nnqfQGamlw/srOSqbcu9v/ZuJrb/L6SRyqdr+9XR/jfoP2kGXv8IWrsv1gUuYZuo3toC8VoF+2jN+gAtRBDP4LN4E5wN/wSfg1Pw29zaxgszmyilQm//wSn4Qu5</latexit>

�0mal ! ��0mal<latexit sha1_base64="xrTPocZWRCrvEpMLdRC0Y4tVXTU=">AAAC6HicfVHLbhMxFHWGR0t4pbBkYxEhEItopkK07CoeEhtEkUhaKR5Fd5w7iantGdkeksiaL2DDDrFly9ewBH4GTxIeoZQrWT4651xd+9yslMK6OP7ais6dv3Bxa/tS+/KVq9eud3ZuDGxRGY59XsjCHGdgUQqNfSecxOPSIKhM4lF28qTRj96isaLQr92ixFTBRItccHCBGnWesUx5NkbpoL478szh3HkFsq4pM2IydWBMMaMsQwf0TO+o0417e3Hy6GFCT4OkFy+rS9Z1ONppvWPjglcKteMSrB0mcelSD8YJLrFus8piCfwEJjgMUINCm/rlf2t6JzBjmhcmHO3okv2zw4OydqGy4FTgpvZvrSH/pQ0rl++nXuiycqj5alBeSeoK2oRHx8Igd3IRAHAjwlspn4IB7kLEbaZxxgulQI89G9TDJPWsmZHlvpvU9aae5bP6lzw7rc5/q/NGfYohJ4MvAvWyRAOuMPc9AzNREKzr+382oVe2cG/kkalmfT93RM8Gg91eEvCrB92Dx+tFbpNb5Da5RxKyRw7Ic3JI+oSTz+QL+Ua+R2+i99GH6OPKGrXWPTfJRkWffgAeXvOY</latexit><latexit sha1_base64="xrTPocZWRCrvEpMLdRC0Y4tVXTU=">AAAC6HicfVHLbhMxFHWGR0t4pbBkYxEhEItopkK07CoeEhtEkUhaKR5Fd5w7iantGdkeksiaL2DDDrFly9ewBH4GTxIeoZQrWT4651xd+9yslMK6OP7ais6dv3Bxa/tS+/KVq9eud3ZuDGxRGY59XsjCHGdgUQqNfSecxOPSIKhM4lF28qTRj96isaLQr92ixFTBRItccHCBGnWesUx5NkbpoL478szh3HkFsq4pM2IydWBMMaMsQwf0TO+o0417e3Hy6GFCT4OkFy+rS9Z1ONppvWPjglcKteMSrB0mcelSD8YJLrFus8piCfwEJjgMUINCm/rlf2t6JzBjmhcmHO3okv2zw4OydqGy4FTgpvZvrSH/pQ0rl++nXuiycqj5alBeSeoK2oRHx8Igd3IRAHAjwlspn4IB7kLEbaZxxgulQI89G9TDJPWsmZHlvpvU9aae5bP6lzw7rc5/q/NGfYohJ4MvAvWyRAOuMPc9AzNREKzr+382oVe2cG/kkalmfT93RM8Gg91eEvCrB92Dx+tFbpNb5Da5RxKyRw7Ic3JI+oSTz+QL+Ua+R2+i99GH6OPKGrXWPTfJRkWffgAeXvOY</latexit><latexit sha1_base64="xrTPocZWRCrvEpMLdRC0Y4tVXTU=">AAAC6HicfVHLbhMxFHWGR0t4pbBkYxEhEItopkK07CoeEhtEkUhaKR5Fd5w7iantGdkeksiaL2DDDrFly9ewBH4GTxIeoZQrWT4651xd+9yslMK6OP7ais6dv3Bxa/tS+/KVq9eud3ZuDGxRGY59XsjCHGdgUQqNfSecxOPSIKhM4lF28qTRj96isaLQr92ixFTBRItccHCBGnWesUx5NkbpoL478szh3HkFsq4pM2IydWBMMaMsQwf0TO+o0417e3Hy6GFCT4OkFy+rS9Z1ONppvWPjglcKteMSrB0mcelSD8YJLrFus8piCfwEJjgMUINCm/rlf2t6JzBjmhcmHO3okv2zw4OydqGy4FTgpvZvrSH/pQ0rl++nXuiycqj5alBeSeoK2oRHx8Igd3IRAHAjwlspn4IB7kLEbaZxxgulQI89G9TDJPWsmZHlvpvU9aae5bP6lzw7rc5/q/NGfYohJ4MvAvWyRAOuMPc9AzNREKzr+382oVe2cG/kkalmfT93RM8Gg91eEvCrB92Dx+tFbpNb5Da5RxKyRw7Ic3JI+oSTz+QL+Ua+R2+i99GH6OPKGrXWPTfJRkWffgAeXvOY</latexit><latexit sha1_base64="xrTPocZWRCrvEpMLdRC0Y4tVXTU=">AAAC6HicfVHLbhMxFHWGR0t4pbBkYxEhEItopkK07CoeEhtEkUhaKR5Fd5w7iantGdkeksiaL2DDDrFly9ewBH4GTxIeoZQrWT4651xd+9yslMK6OP7ais6dv3Bxa/tS+/KVq9eud3ZuDGxRGY59XsjCHGdgUQqNfSecxOPSIKhM4lF28qTRj96isaLQr92ixFTBRItccHCBGnWesUx5NkbpoL478szh3HkFsq4pM2IydWBMMaMsQwf0TO+o0417e3Hy6GFCT4OkFy+rS9Z1ONppvWPjglcKteMSrB0mcelSD8YJLrFus8piCfwEJjgMUINCm/rlf2t6JzBjmhcmHO3okv2zw4OydqGy4FTgpvZvrSH/pQ0rl++nXuiycqj5alBeSeoK2oRHx8Igd3IRAHAjwlspn4IB7kLEbaZxxgulQI89G9TDJPWsmZHlvpvU9aae5bP6lzw7rc5/q/NGfYohJ4MvAvWyRAOuMPc9AzNREKzr+382oVe2cG/kkalmfT93RM8Gg91eEvCrB92Dx+tFbpNb5Da5RxKyRw7Ic3JI+oSTz+QL+Ua+R2+i99GH6OPKGrXWPTfJRkWffgAeXvOY</latexit>

wtG = wt�1

G + �[k]\m + ↵m�tm<latexit sha1_base64="J1I+8jzkYGgYzBrEYddMhKzbQNA=">AAADB3icfVFdixMxFE3Hr7V+dfXRl2ARRLHMLOLqg7CooC/iCra7MDMOdzKZNjTJDEnGbgn5AeKP8U189dV/4L/wVZ/MtF1tXfVCyOGcc3PDuXnNmTZh+LUTnDp95uy5rfPdCxcvXb7S27460lWjCB2SilfqMAdNOZN0aJjh9LBWFETO6UE+fdLqB2+p0qySr828pqmAsWQlI2A8lfWKZALGJnk5c29M9gw/wmuENXcj58k7x6SwSUG5AecyG09TnGhqBJONxsK1LuD1BDKB15yZ8O/2+uFgN4we3o/wSRANwkX10ar2s+3O+6SoSCOoNISD1nEU1ia1oAwjnLpu0mhaA5nCmMYeShBUp3YRh8M3PVPgslL+SIMX7HqHBaH1XOTeKcBM9J9aS/5NixtTPkgtk3VjqCTLQWXDsalwmy0umKLE8LkHQBTzf8VkAgqI8RvoJpLOSCUEyMImIxdHqU3aGXlp+5Fzm3qb/y95dlI9+q0etepT6nNS9IWnXtZUganUbZuAGgvw1tX9PxuTS5u/N/LIhfPrO94R/jcY7Qwij1/d6+89Xi1yC11HN9AtFKFdtIeeo300RAR9Qd/Qd/QjeBd8CD4Gn5bWoLPquYY2Kvj8E0Ut/pg=</latexit><latexit sha1_base64="J1I+8jzkYGgYzBrEYddMhKzbQNA=">AAADB3icfVFdixMxFE3Hr7V+dfXRl2ARRLHMLOLqg7CooC/iCra7MDMOdzKZNjTJDEnGbgn5AeKP8U189dV/4L/wVZ/MtF1tXfVCyOGcc3PDuXnNmTZh+LUTnDp95uy5rfPdCxcvXb7S27460lWjCB2SilfqMAdNOZN0aJjh9LBWFETO6UE+fdLqB2+p0qySr828pqmAsWQlI2A8lfWKZALGJnk5c29M9gw/wmuENXcj58k7x6SwSUG5AecyG09TnGhqBJONxsK1LuD1BDKB15yZ8O/2+uFgN4we3o/wSRANwkX10ar2s+3O+6SoSCOoNISD1nEU1ia1oAwjnLpu0mhaA5nCmMYeShBUp3YRh8M3PVPgslL+SIMX7HqHBaH1XOTeKcBM9J9aS/5NixtTPkgtk3VjqCTLQWXDsalwmy0umKLE8LkHQBTzf8VkAgqI8RvoJpLOSCUEyMImIxdHqU3aGXlp+5Fzm3qb/y95dlI9+q0etepT6nNS9IWnXtZUganUbZuAGgvw1tX9PxuTS5u/N/LIhfPrO94R/jcY7Qwij1/d6+89Xi1yC11HN9AtFKFdtIeeo300RAR9Qd/Qd/QjeBd8CD4Gn5bWoLPquYY2Kvj8E0Ut/pg=</latexit><latexit sha1_base64="J1I+8jzkYGgYzBrEYddMhKzbQNA=">AAADB3icfVFdixMxFE3Hr7V+dfXRl2ARRLHMLOLqg7CooC/iCra7MDMOdzKZNjTJDEnGbgn5AeKP8U189dV/4L/wVZ/MtF1tXfVCyOGcc3PDuXnNmTZh+LUTnDp95uy5rfPdCxcvXb7S27460lWjCB2SilfqMAdNOZN0aJjh9LBWFETO6UE+fdLqB2+p0qySr828pqmAsWQlI2A8lfWKZALGJnk5c29M9gw/wmuENXcj58k7x6SwSUG5AecyG09TnGhqBJONxsK1LuD1BDKB15yZ8O/2+uFgN4we3o/wSRANwkX10ar2s+3O+6SoSCOoNISD1nEU1ia1oAwjnLpu0mhaA5nCmMYeShBUp3YRh8M3PVPgslL+SIMX7HqHBaH1XOTeKcBM9J9aS/5NixtTPkgtk3VjqCTLQWXDsalwmy0umKLE8LkHQBTzf8VkAgqI8RvoJpLOSCUEyMImIxdHqU3aGXlp+5Fzm3qb/y95dlI9+q0etepT6nNS9IWnXtZUganUbZuAGgvw1tX9PxuTS5u/N/LIhfPrO94R/jcY7Qwij1/d6+89Xi1yC11HN9AtFKFdtIeeo300RAR9Qd/Qd/QjeBd8CD4Gn5bWoLPquYY2Kvj8E0Ut/pg=</latexit><latexit sha1_base64="J1I+8jzkYGgYzBrEYddMhKzbQNA=">AAADB3icfVFdixMxFE3Hr7V+dfXRl2ARRLHMLOLqg7CooC/iCra7MDMOdzKZNjTJDEnGbgn5AeKP8U189dV/4L/wVZ/MtF1tXfVCyOGcc3PDuXnNmTZh+LUTnDp95uy5rfPdCxcvXb7S27460lWjCB2SilfqMAdNOZN0aJjh9LBWFETO6UE+fdLqB2+p0qySr828pqmAsWQlI2A8lfWKZALGJnk5c29M9gw/wmuENXcj58k7x6SwSUG5AecyG09TnGhqBJONxsK1LuD1BDKB15yZ8O/2+uFgN4we3o/wSRANwkX10ar2s+3O+6SoSCOoNISD1nEU1ia1oAwjnLpu0mhaA5nCmMYeShBUp3YRh8M3PVPgslL+SIMX7HqHBaH1XOTeKcBM9J9aS/5NixtTPkgtk3VjqCTLQWXDsalwmy0umKLE8LkHQBTzf8VkAgqI8RvoJpLOSCUEyMImIxdHqU3aGXlp+5Fzm3qb/y95dlI9+q0etepT6nNS9IWnXtZUganUbZuAGgvw1tX9PxuTS5u/N/LIhfPrO94R/jcY7Qwij1/d6+89Xi1yC11HN9AtFKFdtIeeo300RAR9Qd/Qd/QjeBd8CD4Gn5bWoLPquYY2Kvj8E0Ut/pg=</latexit>

�[k]\m = �t�1[k]\m

<latexit sha1_base64="fLlnoqdq4q09corNnEW7BbUNLIg=">AAAC7nicfVFdixMxFE3Hr7V+dfXRl2ARRLDMLOLqg7CoD4KIK9juwsxYMpk7bWiSGZI7dkuYX+C7b+Krr/4a8U3/iZm26tZdvRByOOdcbnJuVklhMQy/dYIzZ8+dv7B1sXvp8pWr13rb10e2rA2HIS9laQ4zZkEKDUMUKOGwMsBUJuEgmz1t9YN3YKwo9RtcVJAqNtGiEJyhp8a9FzSZMnRJplySg0TWNGMXz1KaWEAldG2pauhjSo853jq8F51iG/f64WA3jB49iOhJEA3CZfXJuvbH2533SV7yWoFGLpm1cRRWmDpmUHAJTTepLVSMz9gEYg81U2BTt/x1Q297JqdFafzRSJfs8Q7HlLULlXmnYji1f2steZoW11g8TJ3QVY2g+WpQUUuKJW0jpLkwwFEuPGDcCP9WyqfMMI4+6G6iYc5LpZjOXTJq4ih1STsjK1w/appNPSvmzW95flI9+qMeteoz8DkZeOmpVxUYhqW56xJmJop56/r+n03olc3fG3lky/X92hH9NxjtDCKPX9/v7z1ZL3KL3CS3yB0SkV2yR56TfTIknHwhX8l38iOogg/Bx+DTyhp01j03yEYFn38CSPH0oQ==</latexit><latexit sha1_base64="fLlnoqdq4q09corNnEW7BbUNLIg=">AAAC7nicfVFdixMxFE3Hr7V+dfXRl2ARRLDMLOLqg7CoD4KIK9juwsxYMpk7bWiSGZI7dkuYX+C7b+Krr/4a8U3/iZm26tZdvRByOOdcbnJuVklhMQy/dYIzZ8+dv7B1sXvp8pWr13rb10e2rA2HIS9laQ4zZkEKDUMUKOGwMsBUJuEgmz1t9YN3YKwo9RtcVJAqNtGiEJyhp8a9FzSZMnRJplySg0TWNGMXz1KaWEAldG2pauhjSo853jq8F51iG/f64WA3jB49iOhJEA3CZfXJuvbH2533SV7yWoFGLpm1cRRWmDpmUHAJTTepLVSMz9gEYg81U2BTt/x1Q297JqdFafzRSJfs8Q7HlLULlXmnYji1f2steZoW11g8TJ3QVY2g+WpQUUuKJW0jpLkwwFEuPGDcCP9WyqfMMI4+6G6iYc5LpZjOXTJq4ih1STsjK1w/appNPSvmzW95flI9+qMeteoz8DkZeOmpVxUYhqW56xJmJop56/r+n03olc3fG3lky/X92hH9NxjtDCKPX9/v7z1ZL3KL3CS3yB0SkV2yR56TfTIknHwhX8l38iOogg/Bx+DTyhp01j03yEYFn38CSPH0oQ==</latexit><latexit sha1_base64="fLlnoqdq4q09corNnEW7BbUNLIg=">AAAC7nicfVFdixMxFE3Hr7V+dfXRl2ARRLDMLOLqg7CoD4KIK9juwsxYMpk7bWiSGZI7dkuYX+C7b+Krr/4a8U3/iZm26tZdvRByOOdcbnJuVklhMQy/dYIzZ8+dv7B1sXvp8pWr13rb10e2rA2HIS9laQ4zZkEKDUMUKOGwMsBUJuEgmz1t9YN3YKwo9RtcVJAqNtGiEJyhp8a9FzSZMnRJplySg0TWNGMXz1KaWEAldG2pauhjSo853jq8F51iG/f64WA3jB49iOhJEA3CZfXJuvbH2533SV7yWoFGLpm1cRRWmDpmUHAJTTepLVSMz9gEYg81U2BTt/x1Q297JqdFafzRSJfs8Q7HlLULlXmnYji1f2steZoW11g8TJ3QVY2g+WpQUUuKJW0jpLkwwFEuPGDcCP9WyqfMMI4+6G6iYc5LpZjOXTJq4ih1STsjK1w/appNPSvmzW95flI9+qMeteoz8DkZeOmpVxUYhqW56xJmJop56/r+n03olc3fG3lky/X92hH9NxjtDCKPX9/v7z1ZL3KL3CS3yB0SkV2yR56TfTIknHwhX8l38iOogg/Bx+DTyhp01j03yEYFn38CSPH0oQ==</latexit><latexit sha1_base64="fLlnoqdq4q09corNnEW7BbUNLIg=">AAAC7nicfVFdixMxFE3Hr7V+dfXRl2ARRLDMLOLqg7CoD4KIK9juwsxYMpk7bWiSGZI7dkuYX+C7b+Krr/4a8U3/iZm26tZdvRByOOdcbnJuVklhMQy/dYIzZ8+dv7B1sXvp8pWr13rb10e2rA2HIS9laQ4zZkEKDUMUKOGwMsBUJuEgmz1t9YN3YKwo9RtcVJAqNtGiEJyhp8a9FzSZMnRJplySg0TWNGMXz1KaWEAldG2pauhjSo853jq8F51iG/f64WA3jB49iOhJEA3CZfXJuvbH2533SV7yWoFGLpm1cRRWmDpmUHAJTTepLVSMz9gEYg81U2BTt/x1Q297JqdFafzRSJfs8Q7HlLULlXmnYji1f2steZoW11g8TJ3QVY2g+WpQUUuKJW0jpLkwwFEuPGDcCP9WyqfMMI4+6G6iYc5LpZjOXTJq4ih1STsjK1w/appNPSvmzW95flI9+qMeteoz8DkZeOmpVxUYhqW56xJmJop56/r+n03olc3fG3lky/X92hH9NxjtDCKPX9/v7z1ZL3KL3CS3yB0SkV2yR56TfTIknHwhX8l38iOogg/Bx+DTyhp01j03yEYFn38CSPH0oQ==</latexit>

- Malicious agent returns update computed to achieve targeted misclassification of a few samples

Ø Single malicious agent: aims to poison global model

Information available:Ø No access to

current updates from other agents

Ø Attacks with respect to previous global state

Dataset: Fashion MNIST [2]Model: CNN with 91.7% test set accuracy

Malicious objective is to ensure(sandal, class 5) is classifiedas a sneaker (class 7)

Targeted Model Poisoning Concatenated training

Repeat:Alternating minimizationwith distance constraints

�mal = argmin�

Lmal

�{xl, T l}nmal

l=1 ;wG + ��

<latexit sha1_base64="yE5HDQXNHdNgKeIPtq9oQHX1OP8=">AAADKXicfVHNbhMxGPQufyX8peVYDhYRUgso2uVAW6FKFSDBAUSRmrRSnCxe59vEqu1deb0kwfKVCwcehKfhBly58hA4SSkJBT7J8uzMeG3NpIXgpYmir0F47vyFi5dWLteuXL12/UZ9da1d5pVm0GK5yPVRSksQXEHLcCPgqNBAZSrgMD1+MtUP34Iuea4OzKSArqQDxTPOqPFUUn9PUmlJH4ShLiEGxsZKKhzexYTqgeQqsQsO98J/npocJgIys4GJ92Tjnrh/0BPEJVbsxq5n1ZLXPfKeUfIM38MLP8RE88HQbCb1RtTciuKdhzE+C+JmNJvG3ubHd28QQvvJavCB9HNWSVCGCVqWnTgqTNdSbTgT4GqkKqGg7JgOoOOhohLKrp0F5vAdz/Rxlmu/lMEzdvGEpbIsJzL1TknNsPxTm5J/0zqVyba7lquiMqDY/KKsEtjkeJo+7nMNzIiJB5Rp7t+K2ZBqyozvqEYUjFguJVV9S9quE3ctmd6RZrYRO7es+zTdqTw6q45/q+Op+hR8ThpeeupVAZqaXN+1s5Kpt57s/7NxNbf5fSmPVDpf36+O8L9B+0Ez9vi17/Exms8KWke30QaK0RbaQ8/RPmohhn4Ea8F6cCv8FH4Ov4Tf5tYwODlzEy1N+P0n2mYNWg==</latexit><latexit sha1_base64="bqQzWpH6dx/+zLFftmvNojZ+SMI=">AAADKXicfVHNbhMxGPQufyH8NC3HcrCIkFpA0S4HCkKVKkCCA4giNWmlOF15nW8Tq7Z35fWSBMtXLhy48gRceBpuwJUrD4GTlJJQ4JMsz86M19ZMWghemij6GoRnzp47f6F2sX7p8pWrK43VtU6ZV5pBm+Ui1wcpLUFwBW3DjYCDQgOVqYD99OjxVN9/DbrkudozkwJ6kg4UzzijxlNJ4y1JpSV9EIa6hBgYGyupcHgbE6oHkqvELjjcc/95YnKYCMjMBibek40PxZ29Q0FcYsV27A6tWvK6h94zSp7i23jhh5hoPhiazaTRjFpbUfzgXoxPg7gVzaa5s/n+TVH7+GE3WQ3ekX7OKgnKMEHLshtHhelZqg1nAlydVCUUlB3RAXQ9VFRC2bOzwBy+6Zk+znLtlzJ4xi6esFSW5USm3impGZZ/alPyb1q3Mtn9nuWqqAwoNr8oqwQ2OZ6mj/tcAzNi4gFlmvu3YjakmjLjO6oTBSOWS0lV35KO68Y9S6Z3pJltxs4t6z5NdyKPTqvj3+p4qj4Bn5OGF556WYCmJte37Kxk6q3H+/9sXM1tfl/KI5XO1/erI/xv0Lnbij1+5Xt8hOZTQ+voBtpAMdpCO+gZ2kVtxNCPYC1YD66Hn8LP4Zfw29waBsdnrqGlCb//BJuDDrA=</latexit><latexit sha1_base64="bqQzWpH6dx/+zLFftmvNojZ+SMI=">AAADKXicfVHNbhMxGPQufyH8NC3HcrCIkFpA0S4HCkKVKkCCA4giNWmlOF15nW8Tq7Z35fWSBMtXLhy48gRceBpuwJUrD4GTlJJQ4JMsz86M19ZMWghemij6GoRnzp47f6F2sX7p8pWrK43VtU6ZV5pBm+Ui1wcpLUFwBW3DjYCDQgOVqYD99OjxVN9/DbrkudozkwJ6kg4UzzijxlNJ4y1JpSV9EIa6hBgYGyupcHgbE6oHkqvELjjcc/95YnKYCMjMBibek40PxZ29Q0FcYsV27A6tWvK6h94zSp7i23jhh5hoPhiazaTRjFpbUfzgXoxPg7gVzaa5s/n+TVH7+GE3WQ3ekX7OKgnKMEHLshtHhelZqg1nAlydVCUUlB3RAXQ9VFRC2bOzwBy+6Zk+znLtlzJ4xi6esFSW5USm3impGZZ/alPyb1q3Mtn9nuWqqAwoNr8oqwQ2OZ6mj/tcAzNi4gFlmvu3YjakmjLjO6oTBSOWS0lV35KO68Y9S6Z3pJltxs4t6z5NdyKPTqvj3+p4qj4Bn5OGF556WYCmJte37Kxk6q3H+/9sXM1tfl/KI5XO1/erI/xv0Lnbij1+5Xt8hOZTQ+voBtpAMdpCO+gZ2kVtxNCPYC1YD66Hn8LP4Zfw29waBsdnrqGlCb//BJuDDrA=</latexit><latexit sha1_base64="9hn8EAK2BK1vZkuD9j5glWPGriA=">AAADKXicfVFLbxMxGPQurxJeaTmWg0WEVB6KdjlQEKpUARIcQBSpSSvFycrr/TaxantXXi9JZPnKhZ/Cr+EGXLnyI3AelIQCn2R5dma8tmbSUvDKRNHXIDx3/sLFSxuXG1euXrt+o7m51a2KWjPosEIU+jilFQiuoGO4EXBcaqAyFXCUnjyf6UfvQVe8UIdmWkJf0qHiOWfUeCppfiCptCQDYahLiIGJsZIKh/cwoXoouUrsisO99p+nJoeJgNzsYOI9+WQgHhwOBHGJFXuxG1i15nVPvWecvMT38coPMdF8ODJ3k2Yrau9G8ZNHMT4L4nY0nxZazkGyGXwkWcFqCcowQauqF0el6VuqDWcCXIPUFZSUndAh9DxUVELVt/PAHL7jmQznhfZLGTxnV09YKqtqKlPvlNSMqj+1Gfk3rVeb/HHfclXWBhRbXJTXApsCz9LHGdfAjJh6QJnm/q2YjaimzPiOGkTBmBVSUpVZ0nW9uG/J7I40t63YuXXdp+lO5fFZdfJbnczUF+Bz0vDGU29L0NQU+p6dl0y9dbn/z8bVwub3tTxS6Xx9vzrC/wbdh+3Y43dRa//ZssgNtI1uox0Uo120j16hA9RBDP0ItoLt4Fb4Kfwcfgm/LaxhsDxzE61N+P0nEmILiA==</latexit>

Global model trained using only 10 benign agents

Global model trained with one malicious model among 10

- Interpretability techniques [3] provide insights into the internal feature representations and working of a neural network

Attack stealth

measure: distance spread

For each strategy, we show the spread of distances between all the benign agents and between the malicious agent and the benign agents.

L2<latexit sha1_base64="2CswTSxOCSsqBSJ+HIzJToEN0LM=">AAACpHicfVFLb9NAEJ6YVwmvFiQuXFZEIMQhsnuA9lYBBw5FtCpJK8UmjDfjdNV9WLvrppHlX4C4wm/jwm9hnZRHKDDSaj593zea2Zm8lML5OP7aiS5dvnL12tr17o2bt27fWd+4O3SmspwG3Ehjj3J0JIWmgRde0lFpCVUu6TA/ednqh6dknTD6nZ+XlCmcalEIjj5QB7vjzfF6L+5vx8n2s4RdBEk/XkRv5/7+tw8AsDfe6HxMJ4ZXirTnEp0bJXHpsxqtF1xS000rRyXyE5zSKECNilxWL2Zt2KPATFhhbHjaswX7e0WNyrm5yoNToT92f2ot+TdtVPliK6uFLitPmi8bFZVk3rD242wiLHEv5wEgtyLMyvgxWuQ+rKebappxoxTqSZ0Om1GS1WnbIy/qXtI0q3pezJqf8uyievZLPWvVVxT2ZOlNoN6WZNEb+7RO0U4VBut5/p9N6KUt5JV95KoJ5/txI/ZvMNzsJwHvhzu+gGWswQN4CE8ggeewA69hDwbAYQqf4DN8iR5Hu9FBNFhao855zT1Yiej9d+3d1+Y=</latexit><latexit sha1_base64="aOFIipPZQobS1NWk7G+4etmbhbk=">AAACpHicfVFLThtBEG1PPhBDEghSNtm0YgUhFtYMixB2CFiwIAqI2CB5JlZNu8a06M+ouyfGGs0JENvkFNyCS2STs6THJh8HkpJa9fTeK1V1VZoLbl0YfmsEDx4+ejw3/6S5sPj02fOl5RddqwvDsMO00OY0BYuCK+w47gSe5gZBpgJP0vPdWj/5jMZyrT66cY6JhKHiGWfgPHV80N/oL7XC9lYYbb2N6F0QtcNJtLZfHn3n1zs3h/3lxmU80KyQqBwTYG0vCnOXlGAcZwKrZlxYzIGdwxB7HiqQaJNyMmtF33hmQDNt/FOOTtg/K0qQ1o5l6p0S3Jn9W6vJ+7Re4bJ3SclVXjhUbNooKwR1mtYfpwNukDkx9gCY4X5Wys7AAHN+Pc1Y4YhpKUENyrhb9aKkjOseaVa2oqqa1dNsVP2SR3fVi9/qRa3uod+Twfee+pCjAafNehmDGUrw1tv8PxtXU5vPM/tIZeXP9/NG9N+gu9GOPD7yd9wh05gnr8hrskYiskm2yT45JB3CyJBckS/ka7AaHATHQWdqDRq3NStkJoJPPwCB1Nmi</latexit><latexit sha1_base64="aOFIipPZQobS1NWk7G+4etmbhbk=">AAACpHicfVFLThtBEG1PPhBDEghSNtm0YgUhFtYMixB2CFiwIAqI2CB5JlZNu8a06M+ouyfGGs0JENvkFNyCS2STs6THJh8HkpJa9fTeK1V1VZoLbl0YfmsEDx4+ejw3/6S5sPj02fOl5RddqwvDsMO00OY0BYuCK+w47gSe5gZBpgJP0vPdWj/5jMZyrT66cY6JhKHiGWfgPHV80N/oL7XC9lYYbb2N6F0QtcNJtLZfHn3n1zs3h/3lxmU80KyQqBwTYG0vCnOXlGAcZwKrZlxYzIGdwxB7HiqQaJNyMmtF33hmQDNt/FOOTtg/K0qQ1o5l6p0S3Jn9W6vJ+7Re4bJ3SclVXjhUbNooKwR1mtYfpwNukDkx9gCY4X5Wys7AAHN+Pc1Y4YhpKUENyrhb9aKkjOseaVa2oqqa1dNsVP2SR3fVi9/qRa3uod+Twfee+pCjAafNehmDGUrw1tv8PxtXU5vPM/tIZeXP9/NG9N+gu9GOPD7yd9wh05gnr8hrskYiskm2yT45JB3CyJBckS/ka7AaHATHQWdqDRq3NStkJoJPPwCB1Nmi</latexit><latexit sha1_base64="E1dFJ79kskXGmpjD91mGsssLwnI=">AAACpHicfVFLT9tAEN6YPmjoA+iRy6oRVdVDZHMocEPAoQcQIJqAFLvReDMOK/Zh7a4bIsu/AHGF38a/6TpJHymUkVbz6fu+0czOpLng1oXhfSNYePb8xcvFV82l12/evlteWe1aXRiGHaaFNucpWBRcYcdxJ/A8NwgyFXiWXu7V+tkPNJZr9c2Nc0wkDBXPOAPnqdOD/kZ/uRW2t8No+0tEH4KoHU6iRWZx3F9pXMcDzQqJyjEB1vaiMHdJCcZxJrBqxoXFHNglDLHnoQKJNikns1Z03TMDmmnjn3J0wv5dUYK0dixT75TgLuy/Wk0+pvUKl20lJVd54VCxaaOsENRpWn+cDrhB5sTYA2CG+1kpuwADzPn1NGOFI6alBDUo427Vi5IyrnukWdmKqmpeT7NR9VsePVSv/qhXtbqPfk8GDz11lKMBp83nMgYzlOCts/yUjaupzee5faSy8uf7dSP6f9DdaEcen4Stnd3ZIRfJGvlAPpGIbJId8pUckw5hZEhuyC25Cz4GB8Fp0Jlag8as5j2Zi+D7T/7F1gE=</latexit>

Pre-optimization correction with previous step estimate of benign agents’ effects

- Federated learning is very vulnerable to model poisoning attacks

- Detection mechanisms can make these attacks more challenging but these can be overcome

- Open research question: Can we develop distributed learning algorithms robust to model poisoning attacks?

[1] McMahan et al., Communication-Efficient Learning of Deep Networks from Decentralized Data, AISTATS 2017[2] Xiao et al., Fashion-mnist: a novel image dataset for benchmarking machine learning algorithms, arXiv preprint arXiv:1708.07747, 2017[3] Alber et al., iNNvestigate neural networks!, arXiv preprint arXiv:1808.04260, 2018[4] Adebayo et al., Sanity checks for saliency maps, NeurIPS 2018

�t+1m

<latexit sha1_base64="fAHLjpEeKwjnlv2JMwEwcriQA/g=">AAACcXicdVFdixMxFE3Hr7V+bNd9El/CFkFcKJm1uJ23RUV8EVew3YXOWO6kd7phk8yQZKwlzG/xVX+Sv8M/YKZbxYoeCDmccy/35iSvpLCOse+d6Nr1Gzdv7dzu3rl77/5ub+/BxJa14TjmpSzNeQ4WpdA4dsJJPK8MgsolnuWXL1v/7BMaK0r9wa0qzBQstCgEBxekWW8/zZVP5ygdNDP10bvDuJn1+myQjEYJG1I2GDI2PD4K5FmSJM8ZjQdsjT7Z4HS213mdzkteK9SOS7B2GrPKZR6ME1xi001rixXwS1jgNFANCm3m19s39HFQ5rQoTTja0bX6Z4cHZe1K5aFSgbuwf3ut+C9vWrtilHmhq9qh5leDilpSV9I2CjoXBrmTq0CAGxF2pfwCDHAXAuumGpe8VAr03KeTZhpnPm1n5IXvx02z7efFsvltL1v3FYYkDL4N0rsKDbjSPPUpmIWCz43f3FtPyVWb/K946f/J5GgQB/5+2D95sfmDHfKIHJAnJCbH5IS8IadkTDhZkS/kK/nW+RE9jGh0cFUadTY9+2QL0eFPT1TBKw==</latexit><latexit sha1_base64="fAHLjpEeKwjnlv2JMwEwcriQA/g=">AAACcXicdVFdixMxFE3Hr7V+bNd9El/CFkFcKJm1uJ23RUV8EVew3YXOWO6kd7phk8yQZKwlzG/xVX+Sv8M/YKZbxYoeCDmccy/35iSvpLCOse+d6Nr1Gzdv7dzu3rl77/5ub+/BxJa14TjmpSzNeQ4WpdA4dsJJPK8MgsolnuWXL1v/7BMaK0r9wa0qzBQstCgEBxekWW8/zZVP5ygdNDP10bvDuJn1+myQjEYJG1I2GDI2PD4K5FmSJM8ZjQdsjT7Z4HS213mdzkteK9SOS7B2GrPKZR6ME1xi001rixXwS1jgNFANCm3m19s39HFQ5rQoTTja0bX6Z4cHZe1K5aFSgbuwf3ut+C9vWrtilHmhq9qh5leDilpSV9I2CjoXBrmTq0CAGxF2pfwCDHAXAuumGpe8VAr03KeTZhpnPm1n5IXvx02z7efFsvltL1v3FYYkDL4N0rsKDbjSPPUpmIWCz43f3FtPyVWb/K946f/J5GgQB/5+2D95sfmDHfKIHJAnJCbH5IS8IadkTDhZkS/kK/nW+RE9jGh0cFUadTY9+2QL0eFPT1TBKw==</latexit><latexit sha1_base64="fAHLjpEeKwjnlv2JMwEwcriQA/g=">AAACcXicdVFdixMxFE3Hr7V+bNd9El/CFkFcKJm1uJ23RUV8EVew3YXOWO6kd7phk8yQZKwlzG/xVX+Sv8M/YKZbxYoeCDmccy/35iSvpLCOse+d6Nr1Gzdv7dzu3rl77/5ub+/BxJa14TjmpSzNeQ4WpdA4dsJJPK8MgsolnuWXL1v/7BMaK0r9wa0qzBQstCgEBxekWW8/zZVP5ygdNDP10bvDuJn1+myQjEYJG1I2GDI2PD4K5FmSJM8ZjQdsjT7Z4HS213mdzkteK9SOS7B2GrPKZR6ME1xi001rixXwS1jgNFANCm3m19s39HFQ5rQoTTja0bX6Z4cHZe1K5aFSgbuwf3ut+C9vWrtilHmhq9qh5leDilpSV9I2CjoXBrmTq0CAGxF2pfwCDHAXAuumGpe8VAr03KeTZhpnPm1n5IXvx02z7efFsvltL1v3FYYkDL4N0rsKDbjSPPUpmIWCz43f3FtPyVWb/K946f/J5GgQB/5+2D95sfmDHfKIHJAnJCbH5IS8IadkTDhZkS/kK/nW+RE9jGh0cFUadTY9+2QL0eFPT1TBKw==</latexit><latexit sha1_base64="fAHLjpEeKwjnlv2JMwEwcriQA/g=">AAACcXicdVFdixMxFE3Hr7V+bNd9El/CFkFcKJm1uJ23RUV8EVew3YXOWO6kd7phk8yQZKwlzG/xVX+Sv8M/YKZbxYoeCDmccy/35iSvpLCOse+d6Nr1Gzdv7dzu3rl77/5ub+/BxJa14TjmpSzNeQ4WpdA4dsJJPK8MgsolnuWXL1v/7BMaK0r9wa0qzBQstCgEBxekWW8/zZVP5ygdNDP10bvDuJn1+myQjEYJG1I2GDI2PD4K5FmSJM8ZjQdsjT7Z4HS213mdzkteK9SOS7B2GrPKZR6ME1xi001rixXwS1jgNFANCm3m19s39HFQ5rQoTTja0bX6Z4cHZe1K5aFSgbuwf3ut+C9vWrtilHmhq9qh5leDilpSV9I2CjoXBrmTq0CAGxF2pfwCDHAXAuumGpe8VAr03KeTZhpnPm1n5IXvx02z7efFsvltL1v3FYYkDL4N0rsKDbjSPPUpmIWCz43f3FtPyVWb/K946f/J5GgQB/5+2D95sfmDHfKIHJAnJCbH5IS8IadkTDhZkS/kK/nW+RE9jGh0cFUadTY9+2QL0eFPT1TBKw==</latexit>

�t+1m

<latexit sha1_base64="fAHLjpEeKwjnlv2JMwEwcriQA/g=">AAACcXicdVFdixMxFE3Hr7V+bNd9El/CFkFcKJm1uJ23RUV8EVew3YXOWO6kd7phk8yQZKwlzG/xVX+Sv8M/YKZbxYoeCDmccy/35iSvpLCOse+d6Nr1Gzdv7dzu3rl77/5ub+/BxJa14TjmpSzNeQ4WpdA4dsJJPK8MgsolnuWXL1v/7BMaK0r9wa0qzBQstCgEBxekWW8/zZVP5ygdNDP10bvDuJn1+myQjEYJG1I2GDI2PD4K5FmSJM8ZjQdsjT7Z4HS213mdzkteK9SOS7B2GrPKZR6ME1xi001rixXwS1jgNFANCm3m19s39HFQ5rQoTTja0bX6Z4cHZe1K5aFSgbuwf3ut+C9vWrtilHmhq9qh5leDilpSV9I2CjoXBrmTq0CAGxF2pfwCDHAXAuumGpe8VAr03KeTZhpnPm1n5IXvx02z7efFsvltL1v3FYYkDL4N0rsKDbjSPPUpmIWCz43f3FtPyVWb/K946f/J5GgQB/5+2D95sfmDHfKIHJAnJCbH5IS8IadkTDhZkS/kK/nW+RE9jGh0cFUadTY9+2QL0eFPT1TBKw==</latexit><latexit sha1_base64="fAHLjpEeKwjnlv2JMwEwcriQA/g=">AAACcXicdVFdixMxFE3Hr7V+bNd9El/CFkFcKJm1uJ23RUV8EVew3YXOWO6kd7phk8yQZKwlzG/xVX+Sv8M/YKZbxYoeCDmccy/35iSvpLCOse+d6Nr1Gzdv7dzu3rl77/5ub+/BxJa14TjmpSzNeQ4WpdA4dsJJPK8MgsolnuWXL1v/7BMaK0r9wa0qzBQstCgEBxekWW8/zZVP5ygdNDP10bvDuJn1+myQjEYJG1I2GDI2PD4K5FmSJM8ZjQdsjT7Z4HS213mdzkteK9SOS7B2GrPKZR6ME1xi001rixXwS1jgNFANCm3m19s39HFQ5rQoTTja0bX6Z4cHZe1K5aFSgbuwf3ut+C9vWrtilHmhq9qh5leDilpSV9I2CjoXBrmTq0CAGxF2pfwCDHAXAuumGpe8VAr03KeTZhpnPm1n5IXvx02z7efFsvltL1v3FYYkDL4N0rsKDbjSPPUpmIWCz43f3FtPyVWb/K946f/J5GgQB/5+2D95sfmDHfKIHJAnJCbH5IS8IadkTDhZkS/kK/nW+RE9jGh0cFUadTY9+2QL0eFPT1TBKw==</latexit><latexit sha1_base64="fAHLjpEeKwjnlv2JMwEwcriQA/g=">AAACcXicdVFdixMxFE3Hr7V+bNd9El/CFkFcKJm1uJ23RUV8EVew3YXOWO6kd7phk8yQZKwlzG/xVX+Sv8M/YKZbxYoeCDmccy/35iSvpLCOse+d6Nr1Gzdv7dzu3rl77/5ub+/BxJa14TjmpSzNeQ4WpdA4dsJJPK8MgsolnuWXL1v/7BMaK0r9wa0qzBQstCgEBxekWW8/zZVP5ygdNDP10bvDuJn1+myQjEYJG1I2GDI2PD4K5FmSJM8ZjQdsjT7Z4HS213mdzkteK9SOS7B2GrPKZR6ME1xi001rixXwS1jgNFANCm3m19s39HFQ5rQoTTja0bX6Z4cHZe1K5aFSgbuwf3ut+C9vWrtilHmhq9qh5leDilpSV9I2CjoXBrmTq0CAGxF2pfwCDHAXAuumGpe8VAr03KeTZhpnPm1n5IXvx02z7efFsvltL1v3FYYkDL4N0rsKDbjSPPUpmIWCz43f3FtPyVWb/K946f/J5GgQB/5+2D95sfmDHfKIHJAnJCbH5IS8IadkTDhZkS/kK/nW+RE9jGh0cFUadTY9+2QL0eFPT1TBKw==</latexit><latexit sha1_base64="fAHLjpEeKwjnlv2JMwEwcriQA/g=">AAACcXicdVFdixMxFE3Hr7V+bNd9El/CFkFcKJm1uJ23RUV8EVew3YXOWO6kd7phk8yQZKwlzG/xVX+Sv8M/YKZbxYoeCDmccy/35iSvpLCOse+d6Nr1Gzdv7dzu3rl77/5ub+/BxJa14TjmpSzNeQ4WpdA4dsJJPK8MgsolnuWXL1v/7BMaK0r9wa0qzBQstCgEBxekWW8/zZVP5ygdNDP10bvDuJn1+myQjEYJG1I2GDI2PD4K5FmSJM8ZjQdsjT7Z4HS213mdzkteK9SOS7B2GrPKZR6ME1xi001rixXwS1jgNFANCm3m19s39HFQ5rQoTTja0bX6Z4cHZe1K5aFSgbuwf3ut+C9vWrtilHmhq9qh5leDilpSV9I2CjoXBrmTq0CAGxF2pfwCDHAXAuumGpe8VAr03KeTZhpnPm1n5IXvx02z7efFsvltL1v3FYYkDL4N0rsKDbjSPPUpmIWCz43f3FtPyVWb/K946f/J5GgQB/5+2D95sfmDHfKIHJAnJCbH5IS8IadkTDhZkS/kK/nW+RE9jGh0cFUadTY9+2QL0eFPT1TBKw==</latexit>

�t+1m = A

�{xi

m, yim}nmi=1, {x

l, T l}nmall=1 ;wt

G + ��

<latexit sha1_base64="QzX5/KcZFm2sStZTXflmVKOprzA=">AAADL3icfZFdixMxFIYz49dav7p6I3gTtwi7bikza3FbZGH9AL0RV9h2F5p2zKSZNmySGTIZ2xryCxT8Lf4a8Ua89dZfYKatuvXrwEwO53kPCe8bZ5zlOgg+ef6Zs+fOX1i7WLl0+crVa9X16908LRShHZLyVB3HOKecSdrRTHN6nCmKRczpUXzyuORHr6nKWSoP9SyjfYFHkiWMYO1GUfUdioVBQ8o1tgOjt0MbCbgHkcB6TDA3Dy1EnCZ6EyKD4mQaiQGrz8o/spFhe6HbkpGw9QUe8PrhgJeIL5FBmk61EZhbax84zSR6OtBwG566GCLFRmO9FVVrQaPdarWDJgwazSBo7u645l673b4fwLARzKu2v/X+zSsAwEG07r1Fw5QUgkpNOM7zXhhkum+w0oxwaiuoyGmGyQke0Z5rJRY075u5bRbecZMhTFLlPqnhfHp6w2CR5zMRO2VpR/47K4d/Y71CJ62+YTIrNJVkcVFScKhTWGYAh0xRovnMNZgo5t4KyRgrTLRLqoIknZBUCCyHBnVtL+ybeRxxYmqhtavc+Wl/4smfdPqLTkv6hDqfFH3uRi8yqrBO1V2DsBoJ7KTL838yJhcyd674EQvr4vuREfx3091phK5/6XJ8BBa1Bm6BDbAJQrAL9sEzcAA6gIBv3k3vtrfhf/A/+p/9Lwup7y13boCV8r9+B1ZODns=</latexit><latexit sha1_base64="xX3YYuXdrDcdn/DmIwXUePum9C8=">AAADL3icfZHLbhMxFIY9wy2ES1PYILExjZBaGkUzJaKJUKVykWCDKFKTVoqTkcfxJFZtz8jjkATLTwASW56APU+D2CC2bHkCPEmAhtuRZnx0vv/I1v/HGWe5DoJPnn/m7LnzF0oXy5cuX7m6Vlm/1snTsSK0TVKequMY55QzSduaaU6PM0WxiDk9ik8eFfzoJVU5S+WhnmW0J/BQsoQRrN0oqrxBsTBoQLnGtm/0dmgjAfcgEliPCObmgYWI00RvQmRQnEwj0We1WfFHNjJsL3RbMhK2tsB9Xjvs8wLxJTJI06k2AnNr7X2nmURP+hpuw1MXQ6TYcKS3oko1qLeazVbQgEG9EQSN3R3X3G21WvcCGNaDeVX3t96+ykrv3x1E695rNEjJWFCpCcd53g2DTPcMVpoRTm0ZjXOaYXKCh7TrWokFzXtmbpuFt91kAJNUuU9qOJ+e3jBY5PlMxE5Z2JH/zorh31h3rJNmzzCZjTWVZHFRMuZQp7DIAA6YokTzmWswUcy9FZIRVphol1QZSTohqRBYDgzq2G7YM/M44sRUQ2tXufPT/sSTP+n0F50W9DF1Pin6zI2eZ1Rhnao7BmE1FNhJl+f/ZEwuZO5c8SMW1sX3IyP476azUw9d/8Ll+BAsqgRugg2wCUKwC/bBU3AA2oCAb94N75a34X/wP/qf/S8Lqe8td66DlfK/fgcXaw/R</latexit><latexit sha1_base64="xX3YYuXdrDcdn/DmIwXUePum9C8=">AAADL3icfZHLbhMxFIY9wy2ES1PYILExjZBaGkUzJaKJUKVykWCDKFKTVoqTkcfxJFZtz8jjkATLTwASW56APU+D2CC2bHkCPEmAhtuRZnx0vv/I1v/HGWe5DoJPnn/m7LnzF0oXy5cuX7m6Vlm/1snTsSK0TVKequMY55QzSduaaU6PM0WxiDk9ik8eFfzoJVU5S+WhnmW0J/BQsoQRrN0oqrxBsTBoQLnGtm/0dmgjAfcgEliPCObmgYWI00RvQmRQnEwj0We1WfFHNjJsL3RbMhK2tsB9Xjvs8wLxJTJI06k2AnNr7X2nmURP+hpuw1MXQ6TYcKS3oko1qLeazVbQgEG9EQSN3R3X3G21WvcCGNaDeVX3t96+ykrv3x1E695rNEjJWFCpCcd53g2DTPcMVpoRTm0ZjXOaYXKCh7TrWokFzXtmbpuFt91kAJNUuU9qOJ+e3jBY5PlMxE5Z2JH/zorh31h3rJNmzzCZjTWVZHFRMuZQp7DIAA6YokTzmWswUcy9FZIRVphol1QZSTohqRBYDgzq2G7YM/M44sRUQ2tXufPT/sSTP+n0F50W9DF1Pin6zI2eZ1Rhnao7BmE1FNhJl+f/ZEwuZO5c8SMW1sX3IyP476azUw9d/8Ll+BAsqgRugg2wCUKwC/bBU3AA2oCAb94N75a34X/wP/qf/S8Lqe8td66DlfK/fgcXaw/R</latexit><latexit sha1_base64="YZJVaLgE5qxJQ6FxG7ciG9rgBDQ=">AAADL3icfZFdixMxFIYz49dav7p6I3gTtwirW8rMWtwWWVg/QG/EFbbdhaYzZNJMGzbJDJmMbQn5Bfpn/DXijXjrrb/ATFt169eBmRzO8x4S3jfJOSt0EHzy/HPnL1y8tHG5duXqtes36ps3+0VWKkJ7JOOZOklwQTmTtKeZ5vQkVxSLhNPj5PRZxY/fUlWwTB7peU6HAo8lSxnB2o3i+nuUCINGlGtsI6N3QhsLuA+RwHpCMDdPLEScpnobIoOSdBaLiDXn1R/Z2LD90G3JWNjmEke8eRTxCvEVMkjTmTYCc2vtY6eZxi8iDXfgmYshUmw80ffjeiNodTudbtCGQasdBO29Xdc87Ha7jwIYtoJFNcCqDuNN7x0aZaQUVGrCcVEMwiDXQ4OVZoRTW0NlQXNMTvGYDlwrsaDF0Cxss/Cem4xgmin3SQ0X07MbBouimIvEKSs7it9ZNfwbG5Q67QwNk3mpqSTLi9KSQ53BKgM4YooSzeeuwUQx91ZIJlhhol1SNSTplGRCYDkyqG8H4dAs4khS0witXefOT/sTT/+ks190VtHn1Pmk6Cs3ep1ThXWmHhiE1VhgJ12d/5MxuZS5c82PRFgX34+M4L+b/m4rdP2boHHwdBXkBrgDtsA2CMEeOAAvwSHoAQK+ebe9u96W/8H/6H/2vyylvrfauQXWyv/6HY47DKk=</latexit>

Analyzing Federated Learning through an Adversarial Lens

Convolutional Neural Network (CNN) with dropout as themodel architecture. With centralized training, this modelachieves 91.7% accuracy on the test set. The second datasetis the UCI Adult Census dataset3 for which we use a fullyconnected neural network achieving 84.8% accuracy on thetest set (Fernández-Delgado et al., 2014) for the model ar-chitecture. Further details about datasets and models are inSection 1 of the Supplementary.

For both datasets, we study the case with the number ofagents K set to 10 and 100. When K = 10, all the agentsare chosen at every iteration, while with K = 100, a tenthof the agents are chosen at random every iteration. We runfederated learning till a pre-specified test accuracy (91%for Fashion MNIST and 84% for the Adult Census data) isreached or the maximum number of time steps have elapsed(40 for K = 10 and 50 for K = 100). In Section 3, forillustrative purposes, we mostly consider the case wherethe malicious agent aims to mis-classify a single examplein a desired target class (r = 1). For the Fashion-MNISTdataset, the example belongs to class ‘5’ (sandal) with theaim of misclassifying it in class ‘7’ (sneaker) and for theAdult dataset it belongs to class ‘0’ with the aim of mis-classifying it in class ‘1’. We also consider the case withr = 10 but defer these results to the Supplementary mate-rial owing to space constraints.

3. Strategies for Model Poisoning AttacksIn this section, we use the adversarial goals laid out in theprevious section to formulate the adversarial optimizationproblem. We then show how explicit boosting can achievetargeted model poisoning. We further explore attack strate-gies that add stealth and improve convergence.

3.1. Adversarial optimization setup

From Eq. 1, two challenges for the adversary are immedi-ately clear. First, the objective represents a difficult combi-natorial optimization problem so we relax Eq. 1 in terms ofthe cross-entropy loss for which automatic differentiationcan be used. Second, the adversary does not have accessto the global parameter vector wt

G for the current iterationand can only influence it though the weight update �tm itprovides to the server S. So, it performs the optimizationover wt

G, which is an estimate of the value of wtG based on

all the information Itm available to the adversary. The ob-

jective function for the adversary to achieve targeted modelpoisoning on the tth iteration is

argmin�tm

L({xi, ⌧i}ri=1, wtG),

s.t. wtG = g(It

m),(2)

3https://archive.ics.uci.edu/ml/datasets/adult

0

0.2

0.4

0.6

0.8

1

2 4 6 8 10 12

0

20

40

60

80

100

Con

fiden

ce

Cla

ssifi

catio

nac

cura

cy

Time

Validation Accuracy (Global)Conf. (5!7) on Global

Figure 1. Targeted model poisoning for CNN on Fashion MNISTdata. The global model’s confidence on malicious objective (poi-soning) and the accuracy on validation data (targeted) are shown.

where g(·) is an estimator. For the rest of this section, weuse the estimate wt

G = wt�1G + ↵m�tm, implying that the

malicious agent ignores the updates from the other agentsbut accounts for scaling at aggregation. This assumption isenough to ensure the attack works in practice.

3.2. Targeted model poisoning for standard federatedlearning

The adversary can directly optimize the adversarial objec-tive L({xi, ⌧i}ri=1, w

tG) with wt

G = wt�1G +↵m�tm. How-

ever, this setup implies that the optimizer has to accountfor the scaling factor ↵m implicitly. In practice, we findthat when using a gradient-based optimizer such as SGD,explicit boosting is much more effective. The rest of thesection focuses on explicit boosting and an analysis of im-plicit boosting is deferred to Section 2 of the Supplemen-tary.

Explicit Boosting: Mimicking a benign agent, the mali-cious agent can run Em steps of a gradient-based optimizer(such as Adam (Kingma & Ba, 2015)) starting from wt�1

Gto obtain wt

m which minimizes the loss over {xi, ⌧i}ri=1.The malicious agent then obtains an initial update �tm =wt

m � wt�1G . However, since the malicious agent’s up-

date tries to ensure that the model learns labels differentfrom the true labels for the data of its choice (Daux), it hasto overcome the effect of scaling, which would otherwisemostly nullify the desired classification outcomes. Thishappens because the learning objective for all the otheragents is very different from that of the malicious agent,especially in the i.i.d. case. The final weight update sentback by the malicious agent is then �tm = ��tm, where �is the factor by which the malicious agent boosts the initialupdate. Note that with wt

G = wt�1G +↵m�tm and � = 1

↵m,

then wtG = wt

m, implying that if the estimation was exact,the global weight vector should now satisfy the maliciousagent’s objective.

Results: In the attack with explicit boosting, the maliciousagent uses Em = 5 to obtain �tm, and then boosts it by

−0.20 −0.15 −0.10 −0.05 0.00 0.05 0.10 0.15 0.20WeighW values

0

20000

40000

60000

80000

100000Benign0alicious

−0.20 −0.15 −0.10 −0.05 0.00 0.05 0.10 0.15 0.20WeighW values

0

20000

40000

60000

80000

100000Benign0alicious


0

0.2

0.4

0.6

0.8

1

2 4 6 8 10 12 14 16

0

20

40

60

80

100

Con

fiden

ce

Cla

ssifi

catio

nac

cura

cy

Time

Val. Acc. (Global)Conf. (5!7) Global

Acc. Mal. (stealth)Acc. Mal. (targeted)

(a) Confidence on malicious objective and accuracy on vali-dation data for wt

G. Stealth with respect to accuracy checkingis also shown for both the stealthy and targeted model poison-ing attacks. We use � = 10 and ⇢ = 1e�4.

(b) Comparison of weight update distributions forbenign and malicious agents

Figure 4. Stealthy model poisoning for CNN on Fashion MNIST

ther, the weight update distribution for the stealthy poison-ing attack (Figure 4b) is similar to that of a benign agent,owing to the additional terms in the loss function. Finally,in Figure 3, we see that the range of `2 distances for themalicious agent Rm is close to that between benign agents(see Section 2.3).

Concurrent work on model poisoning boosts the entire up-date (instead of just the malicious loss component) whenthe global model is close to convergence to attempt modelreplacement (Bagdasaryan et al., 2018) but this strategy isineffective when the model has not converged.

3.4. Alternating minimization for improved modelpoisoning

While the stealthy model poisoning attack ensures targetedpoisoning of the global model while maintaining stealth ac-cording to the two conditions required, it does not ensurethat the malicious agent’s update is chosen in every itera-tion. To achieve this, we propose an alternating minimiza-tion attack strategy which decouples the targeted objectivefrom the stealth objectives, providing finer control over therelative effect of the two objectives. It works as followsfor iteration t. For each epoch i, the adversarial objectiveis first minimized starting from wi�1,t

m , giving an update

0

0.2

0.4

0.6

0.8

1

2 4 6 8 10 12

0

20

40

60

80

100

Con

fiden

ce

Cla

ssifi

catio

nac

cura

cy

Time


Val. Acc. Mal.

Figure 5. Alternating minimization attack with distance con-straints for CNN on Fashion MNIST data. Stealth with respectto accuracy checking is also shown.

vector �i,tm . This is then boosted by a factor � and addedto wi�1,t

m . Finally, the stealth objective for that epoch isminimized starting from wi,t

m = wi�1,tm + ��i,tm , providing

the malicious weight vector wi,tm for the next epoch. The

malicious agent can run this alternating minimization untilboth the adversarial and stealth objectives have sufficientlylow values. Further, the independent minimization allowsfor each objective to be optimized for a different number ofsteps, depending on which is more difficult in achieve. Inparticular, we find that optimizing the stealth objective fora larger number of steps each epoch compared to the ma-licious objective leads to better stealth performance whilemaintaining targeted poisoning.

Results and effect on stealth: The adversarial objective isachieved at the global model with high confidence startingfrom time step t = 2 and the global model converges toa point with good performance on the validation set. Thisattack can bypass the accuracy checking method as the ac-curacy on validation data of the malicious model is closeto that of the global model.In Figure 3, we can see thatthe distance spread for this attack closely follows and evenoverlaps that of benign updates throughout, thus achievingcomplete stealth with respect to both properties.

4. Attacking Byzantine-resilient aggregationThere has been considerable recent work that has proposedgradient aggregation mechanisms for distributed learningthat ensure convergence of the global model (Blanchardet al., 2017; Chen et al., 2017b; Mhamdi et al., 2018; Chenet al., 2018; Yin et al., 2018). However, the aim of theByzantine adversaries considered in this line of work is toensure convergence to ineffective models, i.e. models withpoor classification performance. The goal of the adver-sary we consider is targeted model poisoning, which im-plies convergence to an effective model on the test data.This difference in objectives leads to the lack of robust-ness of these Byzantine-resilient aggregation mechanismsto our attacks. We consider the efficient aggregation mech-anisms Krum (Blanchard et al., 2017) and coordinate-wise


0

0.2

0.4

0.6

0.8

1

2 4 6 8 10 12 14 16

0

20

40

60

80

100

Con

fiden

ce

Cla

ssifi

catio

nac

cura

cy

Time


Acc. Mal. (stealth)Acc. Mal. (targeted)

(a) Confidence on malicious objective and accuracy on vali-dation data for wt

G. Stealth with respect to accuracy checkingis also shown for both the stealthy and targeted model poison-ing attacks. We use � = 10 and ⇢ = 1e�4.

(b) Comparison of weight update distributions forbenign and malicious agents

Figure 4. Stealthy model poisoning for CNN on Fashion MNIST

ther, the weight update distribution for the stealthy poison-ing attack (Figure 4b) is similar to that of a benign agent,owing to the additional terms in the loss function. Finally,in Figure 3, we see that the range of `2 distances for themalicious agent Rm is close to that between benign agents(see Section 2.3).

Concurrent work on model poisoning boosts the entire up-date (instead of just the malicious loss component) whenthe global model is close to convergence to attempt modelreplacement (Bagdasaryan et al., 2018) but this strategy isineffective when the model has not converged.

3.4. Alternating minimization for improved modelpoisoning

While the stealthy model poisoning attack ensures targetedpoisoning of the global model while maintaining stealth ac-cording to the two conditions required, it does not ensurethat the malicious agent’s update is chosen in every itera-tion. To achieve this, we propose an alternating minimiza-tion attack strategy which decouples the targeted objectivefrom the stealth objectives, providing finer control over therelative effect of the two objectives. It works as followsfor iteration t. For each epoch i, the adversarial objectiveis first minimized starting from wi�1,t

m , giving an update

0

0.2

0.4

0.6

0.8

1

2 4 6 8 10 12

0

20

40

60

80

100

Con

fiden

ce

Cla

ssifi

catio

nac

cura

cy

Time


Val. Acc. Mal.

Figure 5. Alternating minimization attack with distance con-straints for CNN on Fashion MNIST data. Stealth with respectto accuracy checking is also shown.

vector �i,tm . This is then boosted by a factor � and addedto wi�1,t

m . Finally, the stealth objective for that epoch isminimized starting from wi,t

m = wi�1,tm + ��i,tm , providing

the malicious weight vector wi,tm for the next epoch. The

malicious agent can run this alternating minimization untilboth the adversarial and stealth objectives have sufficientlylow values. Further, the independent minimization allowsfor each objective to be optimized for a different number ofsteps, depending on which is more difficult in achieve. Inparticular, we find that optimizing the stealth objective fora larger number of steps each epoch compared to the ma-licious objective leads to better stealth performance whilemaintaining targeted poisoning.

Results and effect on stealth: The adversarial objective isachieved at the global model with high confidence startingfrom time step t = 2 and the global model converges toa point with good performance on the validation set. Thisattack can bypass the accuracy checking method as the ac-curacy on validation data of the malicious model is closeto that of the global model.In Figure 3, we can see thatthe distance spread for this attack closely follows and evenoverlaps that of benign updates throughout, thus achievingcomplete stealth with respect to both properties.

4. Attacking Byzantine-resilient aggregationThere has been considerable recent work that has proposedgradient aggregation mechanisms for distributed learningthat ensure convergence of the global model (Blanchardet al., 2017; Chen et al., 2017b; Mhamdi et al., 2018; Chenet al., 2018; Yin et al., 2018). However, the aim of theByzantine adversaries considered in this line of work is toensure convergence to ineffective models, i.e. models withpoor classification performance. The goal of the adver-sary we consider is targeted model poisoning, which im-plies convergence to an effective model on the test data.This difference in objectives leads to the lack of robust-ness of these Byzantine-resilient aggregation mechanismsto our attacks. We consider the efficient aggregation mech-anisms Krum (Blanchard et al., 2017) and coordinate-wise


Figure 2. Comparison of weight update distributions for benignand malicious agents for targeted model poisoning attack for CNNon Fashion MNIST data.1

↵m= K. The results for the case with K = 10 for the

Fashion MNIST data are shown in Figure 1. The attackis clearly successful at causing the global model to clas-sify the chosen example in the target class. In fact, aftert = 3, the global model is highly confident in its (incor-rect) prediction. Further, the global model converges withgood performance on the validation set in spite of the tar-geted poisoning for one example. Results for the AdultCensus dataset (Section 3 of Supplementary) demonstratetargeted model poisoning is possible across datasets andmodels. Thus, the explicit boosting attack is able to achievetargeted poisoning in the federated learning setting.

Performance on stealth metrics: While the explicit boost-ing attack does not take stealth metrics into account, it isinstructive to study properties of the model update it gener-ates. Compared to the weight update from a benign agent,the update from the malicious agent is much sparser andhas a smaller range (Figure 2). In Figure 3, the spread ofL2 distances between all benign updates and between themalicious update and the benign updates is plotted. For thebaseline attack, both the minimum and maximum distanceaway from any of the benign updates keeps decreasing overtime steps, while it remains relatively constant for the otheragents. In Figure 4a the accuracy of the malicious model onthe validation data (Acc. Mal (Targeted)) is shown, whichis much lower than the global model’s accuracy.

3.3. Stealthy model poisoning

As discussed in Section 2.3, there are two properties whichthe server can use to detect anomalous updates: accuracyon validation data and weight update statistics. In order tomaintain stealth with respect to both of these properties, theadversary can add loss terms corresponding to both of thosemetrics to the model poisoning objective function from Eq.2 and improve targeted model poisoning. First, in order toimprove the accuracy on validation data, the adversary addsthe training loss over the malicious agent’s local data shard

30

40

50

60

70

80

90

100

110

2 4 6 8 10 12 14 16

Dis

tanc

e

Time

Targeted Model Poisoning (Benign)Targeted Model Poisoning (Malicious)

Stealthy Model Poisoning (Benign)Stealthy Model Poisoning (Malicious)

Alternating Minimization (Benign)Alternating Minimization (Malicious)

Figure 3. Range of `2 distances between all benign agents and be-tween the malicious agent and the benign agents.

Dm (L(Dm,wtG)) to the objective. Since the training data

is i.i.d. with the validation data, this will ensure that themalicious agent’s update is similar to that of a benign agentin terms of validation loss and will make it challenging forthe server to flag the malicious update as anomalous.

Second, the adversary needs to ensure that its update is asclose as possible to the benign agents’ updates in the ap-propriate distance metric. For our experiments, we use the`p norm with p = 2. Since the adversary does not haveaccess to the updates for the current time step t that aregenerated by the other agents, it constrains �tm with respectto �t�1

ben =P

i2[k]\m ↵i�t�1i , which is the average update

from all the other agents for the previous iteration, whichthe malicious agent has access to. Thus, the adversary adds⇢k�tm � �t�1

ben k2 to its objective as well. We note that theaddition of the training loss term is not sufficient to ensurethat the malicious weight update is close to that of the be-nign agents since there could be multiple local minima withsimilar loss values. Overall, the adversarial objective thenbecomes:

argmin�tm

�L({xi, ⌧i}ri=1, wtG) + L(Dm,wt

m)

+ ⇢k�tm � �t�1ben k2

(3)

Note that for the training loss, the optimization is just per-formed with respect to wt

m = wt�1G +�tm, as a benign agent

would do. Using explicit boosting, wtG is replaced by wt

m

as well so that only the portion of the loss corresponding tothe malicious objective gets boosted by a factor �.

Results and effect on stealth: From Figure 4a, it is clearthat the stealthy model poisoning attack is able to cause tar-geted poisoning of the global model. We set the accuracythreshold �t to be 10% which implies that the maliciousmodel is chosen for 10 iterations out of 15. This is in con-trast to the targeted model poisoning attack which never hasvalidation accuracy within 10% of the global model. Fur-

Attacking Byzantine-resilient aggregation


median (Yin et al., 2018) for our evaluation, both of whichare provably Byzantine-resilient and converge under appro-priate conditions 4 on the loss function.

Krum: Given n agents of which f are Byzantine, Krumrequires that n � 2f + 3. At any time step t, updates(�t1, . . . , �

tn) are received at the server. For each �ti , the

n � f � 2 closest (in terms of Lp norm) other updates arechosen to form a set Ci and their distances added up to givea score S(�ti) =

P�2Ci

k�ti � �k. Krum then chooses�krum = �ti with the lowest score to add to wt

i to givewt+1

i = wti + �krum. In Figure 6, we see the effect of

the alternating minimization attack on Krum with a boost-ing factor of � = 2 for a federated learning setup with 10agents. Since there is no need to overcome the constantscaling factor ↵m, the attack can use a much smaller boost-ing factor � than the number of agents to ensure model poi-soning. The malicious agent’s update is chosen by Krumfor 26 of 40 time steps which leads to the malicious ob-jective being met. Further, the global model converges toa point with good performance as the malicious agent hasadded the training loss to its stealth objective. With the useof targeted model poisoning, we can cause Krum to con-verge to a model with poor performance as well.

Coordinate-wise median: Given the set of updates{�ti}ki=1 at time step t, the aggregate update is �t :=coomed{{�ti}ki=1}, which is a vector with its jth co-ordinate �t(j) = med{�ti(j)}, where med is the 1-dimensional median. Using targeted model poisoning witha boosting factor of � = 1, i.e. no boosting, the maliciousobjective is met with confidence close to 0.9 for 11 of 14time steps (Figure 6). We note that in this case, unlike withKrum, there is convergence to an effective global model.We believe this occurs due to the fact that coordinate-wisemedian does not simply pick one of the updates to apply tothe global model and does indeed use information from allthe agents while computing the new update. Thus, modelpoisoning attacks are effective against two completely dif-ferent Byzantine-resilient aggregation mechanisms.

5. Discussion5.1. Model poisoning vs. data poisoning

In this section, we elucidate the differences between modelpoisoning and data poisoning both qualitatively and quan-titatively. Data poisoning attacks largely fall in two cate-gories: clean-label (Muñoz-González et al., 2017; Koh &Liang, 2017) and dirty-label (Chen et al., 2017a; Gu et al.,2017; Liu et al., 2017). Clean-label attacks assume that theadversary cannot change the label of any training data asthere is a process by which data is certified as belonging

4These conditions do not hold for neural networks so the guar-antees are only empirical.

0

0.2

0.4

0.6

0.8

1

5 10 15 20 25 30 35 40

0

20

40

60

80

100

Con

fiden

ce

Cla

ssifi

catio

nac

cura

cy

Time

Val. Acc. Global (Krum)Mal. Conf. Global (Krum)

Val. Acc. Global (Coomed)Mal. Conf. Global (Coomed)

Figure 6. Model poisoning attacks with Byzantine resilient ag-gregation mechanisms. We use targeted model poisoning forcoomed and alternating minimization for Krum.

to the correct class and the poisoning of data samples hasto be imperceptible. On the other hand, to carry out dirty-label poisoning, the adversary just has to introduce a num-ber of copies of the data sample it wishes to mis-classifywith the desired target label into the training set since thereis no requirement that a data sample belong to the correctclass. Dirty-label data poisoning has been shown to achievehigh-confidence targeted misclassification for deep neuralnetworks with the addition of around 50 poisoned samplesto the training data (Chen et al., 2017a).

Dirty-label data poisoning in federated learning: In ourcomparison with data poisoning, we use the dirty-labeldata poisoning framework for two reasons. First, federatedlearning operates under the assumption that data is nevershared, only learned models. Thus, the adversary is notconcerned with notions of imperceptibility for data certifi-cation. Second, clean-label data poisoning assumes accessat train time to the global parameter vector, which is absentin the federated learning setting. Using the same experi-mental setup as before (CNN on Fashion MNIST data, 10agents chosen every time step), we add copies of the sam-ple that is to be misclassified to the training set of the ma-licious agent with the appropriate target label. We experi-ment with two settings. In the first, we add multiple copiesof the same sample to the training set. In the second, weadd a small amount of random uniform noise to each pixel(Chen et al., 2017a) when generating copies. We observethat even when we add 1000 copies of the sample to thetraining set, the data poisoning attack is completely inef-fective at causing targeted poisoning in the global model.This occurs due to the fact that malicious agent’s update isscaled, which again underlies the importance of boostingwhile performing model poisoning. We note also that if theupdate generated using data poisoning is boosted, it affectsthe performance of the global model as the entire update isboosted, not just the malicious part. Thus, model poisoningattacks are much more effective than data poisoning in thefederated learning setting.

Ø Krum: chooses set of k-2 updates closest to each other

Ø Coomed: performs coordinate-wise median

Attack Targeted model poisoning

Alternating minimization

Estimation None Prev. Step None Prev. Stept=2 0.63 0.82 0.17 0.47t=3 0.93 0.98 0.34 0.89t=4 0.99 1.0 0.88 1.0

�mal =argmin�

L�{xi

m, yim}nmi=1;wG + �

�+

�L�{xl, T l}nmal

l=1 ;wG + ��+ ⇢k� � �consk22

<latexit sha1_base64="LZvuEI5uGPfEBWkeE+STFfhgqXU=">AAADq3icfVJdb9MwFHUWYKN8bfDIi0XFNGCrkoIYCE2aAAkehhhi3SbqNnJcp7VmO5Ht0FaefwGvvML/4t/gtIW1bONKia/OOffYvtdpwZk2UfQrWAqvXL22vHK9duPmrdt3VtfuHuq8VIS2SM5zdZxiTTmTtGWY4fS4UBSLlNOj9ORNxR99pUqzXB6YcUE7AvclyxjBxkPJWrCMUmFRj3KDXWKRoSNjBebOwR24DhFWfcGkJ85UDu4hTjOzAZGHs1EiumxzXP2Rd2A7setamQj3ypPD5B18AueKIVKsPzCPKhTV1lFKDYZ7cGo49evyzYMur7z4zGv+WJfYzvuqQQ7R6QK9BS+4Jsml9rdBp0mz20xW61FjO4pfPo/h+SRuRJOog1ns+9Z9Q72clIJKQzjWuh1HhelYrAwjnLoaKjUtMDnBfdr2qcSC6o6djMzBhx7pwSxX/pMGTtD5CouF1mOReqXAZqD/5SrwIq5dmuxFxzJZlIZKMt0oKzk0OazmD3tMUWL42CeYKObPCskAK0yMfyU1JOmQ5EJg2bPo0LXjjkXVHmlm67Fzi7yfg/tLD8+zozN2VLFvqe+Toh889LGgCptcPbaTF4a9dLb+T8bkVObXhX6kwvnx/ZkRvDw5bDbip43mp2f13dezQa6A++AB2AAx2Aa74D3YBy1AAhl8D34EP8Ot8HP4JURT6VIwq7kHFiKkvwE54jZQ</latexit>

Eval. Setup

- Compute update w.r.t.malicious objective

- Boost updatewhen sendingback to server

Takeaway: Malicious objective is met with high confidence while ensuring global model convergence but malicious update clearly distinguishable

- Add benign training and distance constraints

- Boost onlymaliciouscomponent

Takeaway: Malicious agent is closer in accuracy and weight update statistics to benign agents but convergence is erratic

- Alternate between malicious and benign objectives

- Can controlnumber ofsteps for each

Takeaway: Tighter control over the two objectives leads to targeted model poisoning with stealth in both accuracy and weight update statistics

Takeaway: Spread of distances for malicious agent with alternating minimization is almost indistinguishable from that between benign agents’

Attack works without boosting since no model averaging

Takeaway: Model poisoning is effective against Byzantine-resilient aggregation

Takeaway: Relevant input features used by the two models are almost visually imperceptible, further exposing the fragility of interpretability [4]

Takeaway: Estimation increases attack effectiveness, making it stronger earlier

federated learning threat model: targeted model poisoningabhagoji/files/icml2019_poster.pdf ·...

Documents