Towards Federated Learning with Byzantine-Robust Client Weighting

Round 1

Reviewer 1 Report

The paper presents a method to make federated learning robust against byzantine attacks. It is very well written and the method is presented clearly. The only improvement I want to suggest is a  more detailed explanation of the diagrams in Figure 4 and Figure A2. A more detailed definition of the different lines (passthrough, truncate, ignore) and using the same nomenclature in the diagram and the explanatory text would enhance the understanding of the diagrams. In Figure 4, for example, columns are marked as "Mean", "Median" and "Trimmed mean" and in the text the last 2 columns are called "robust mean aggregation" which is a bit puzzling. Moreover, concernig Figure A2 an explanation of the diagrams is missing; especially the obvious differences to the Shakespeare experiments require an explanation: Why does ignoring sample size in column 1, rows 2, 3 and 4 give a better accuracy? Especially in row 3!

But overall it's a very good paper.

Author Response

Please see the attachment.

Author Response File: Author Response.pdf

Reviewer 2 Report

While the paper is well-written, the authors made a lot of assumption to prove the approach, e.g., Assumption 3 - 8. 

 

It doesn't make sense if No Byzantine clients are involved. In practice, any device can be compromised and relying on clients' uploaded weights can be the trouble to the method. 

 

The reviewer didn't find how the authors solve the compromised attacks. Without clear explanations, it is unclear what are the contributions in the article. 

 

Some other comments may help the authors:

   + Algorithm 1 and Algorithm 2 should be explained clearer of how it works to address the problem. Otherwise, it looks a general FL model 

   + What is mwp in the formula 3? Some formulas are not indexed too. 

   + The authors mentioned attacks against wearable devices but no evaluation of the case. 

Author Response

Please see the attachment.

Author Response File: Author Response.pdf

Round 2

Reviewer 2 Report

The authors may revise the manuscript to clarify this "...One such case is training a  model on edge medical devices, where a compromised device could not only lead to lower model accuracy". The reviewer found no cases in the evaluation. 

Author Response

Please see the attachment.

Author Response File: Author Response.pdf