Byzantine attacks hinder the deployment of federated learning algorithms. Although we know that the benign gradients and Byzantine attacked gradients are distributed differently, to detect the malicious gradients is challenging due to (1) the gradient is high-dimensional and each dimension has its unique distribution and (2) the benign gradients and the attacked gradients are always mixed (two-sample test methods cannot apply directly). To address the above, for the first time, we propose MANDERA which is theoretically guaranteed to efficiently detect all malicious gradients under Byzantine attacks with no prior knowledge or history about the number of attacked nodes. More specifically, we transfer the original updating gradient space into a ranking matrix. By such an operation, the scales of different dimensions of the gradients in the ranking space become identical. The high-dimensional benign gradients and the malicious gradients can be easily separated. The effectiveness of MANDERA is further confirmed by experimentation on four Byzantine attack implementations (Gaussian, Zero Gradient, Sign Flipping, Shifted Mean), comparing with state-of-the-art defenses. The experiments cover both IID and Non-IID datasets.

翻译：拜占庭攻击阻碍了联邦学习算法的部署。尽管已知良性梯度与遭受拜占庭攻击的梯度分布存在差异，但检测恶意梯度仍面临挑战，原因在于：(1) 梯度具有高维特性，且每个维度具有独特的分布特征；(2) 良性梯度与受攻击梯度始终混合存在（双样本检验方法无法直接适用）。针对上述问题，我们首次提出MANDERA方法，该方法在理论上能够保证在无需攻击节点数量先验知识或历史记录的情况下，高效检测所有受拜占庭攻击的恶意梯度。具体而言，我们将原始梯度更新空间转换为排序矩阵。通过该操作，梯度各维度在排序空间中的量级趋于一致，使得高维良性梯度与恶意梯度可被轻松分离。通过在四种拜占庭攻击实现（高斯攻击、零梯度攻击、符号翻转攻击、均值偏移攻击）下与现有最优防御方法的对比实验，进一步验证了MANDERA的有效性。实验覆盖同分布与非同分布数据集。