As Machine Learning (ML) is increasingly used in solving various tasks in real-world applications, it is crucial to ensure that ML algorithms are robust to any potential worst-case noises, adversarial attacks, and highly unusual situations when they are designed. Studying ML robustness will significantly help in the design of ML algorithms. In this paper, we investigate ML robustness using adversarial training in centralized and decentralized environments, where ML training and testing are conducted in one or multiple computers. In the centralized environment, we achieve a test accuracy of 65.41% and 83.0% when classifying adversarial examples generated by Fast Gradient Sign Method and DeepFool, respectively. Comparing to existing studies, these results demonstrate an improvement of 18.41% for FGSM and 47% for DeepFool. In the decentralized environment, we study Federated learning (FL) robustness by using adversarial training with independent and identically distributed (IID) and non-IID data, respectively, where CIFAR-10 is used in this research. In the IID data case, our experimental results demonstrate that we can achieve such a robust accuracy that it is comparable to the one obtained in the centralized environment. Moreover, in the non-IID data case, the natural accuracy drops from 66.23% to 57.82%, and the robust accuracy decreases by 25% and 23.4% in C&W and Projected Gradient Descent (PGD) attacks, compared to the IID data case, respectively. We further propose an IID data-sharing approach, which allows for increasing the natural accuracy to 85.04% and the robust accuracy from 57% to 72% in C&W attacks and from 59% to 67% in PGD attacks.

翻译：随着机器学习在解决现实世界各类任务中的广泛应用，确保算法设计时能抵抗潜在的最坏情况噪声、对抗性攻击及高度异常场景至关重要。研究机器学习鲁棒性将显著促进算法设计。本文通过集中式与分布式环境中的对抗训练探究机器学习鲁棒性，其中集中式环境指单机/多机场景下的训练与测试。在集中式环境中，针对Fast Gradient Sign Method和DeepFool生成的对抗样本，我们分别取得了65.41%和83.0%的测试准确率。与现有研究相比，该结果对FGSM和DeepFool分别提升了18.41%和47%的准确率。在分布式环境中，本文采用独立同分布与非独立同分布数据分别进行对抗训练以研究联邦学习鲁棒性，实验基于CIFAR-10数据集。在IID数据场景下，实验结果表明所实现的鲁棒准确率与集中式环境下的结果相当。而在非IID数据场景下，自然准确率从66.23%下降至57.82%，且相较于IID数据场景，C&W攻击下的鲁棒准确率降低25%，Projected Gradient Descent攻击下的鲁棒准确率降低23.4%。我们进一步提出一种IID数据共享方法，可将自然准确率提升至85.04%，同时在C&W攻击下将鲁棒准确率从57%提升至72%，在PGD攻击下从59%提升至67%。