Adversarial Robustness through Bias Variance Decomposition: A New
  Perspective for Federated Learning
  Federated learning learns a neural network model by aggregating the knowledge
from a group of distributed clients under the privacy-preserving constraint. In
this work, we show that this paradigm might inherit the adversarial
vulnerability of the centralized neural network, i.e., it has deteriorated
performance on adversarial examples when the model is deployed. This is even
more alarming when federated learning paradigm is designed to approximate the
updating behavior of a centralized neural network. To solve this problem, we
propose an adversarially robust federated learning framework, named Fed_BVA,
with improved server and client update mechanisms. This is motivated by our
observation that the generalization error in federated learning can be
naturally decomposed into the bias and variance triggered by multiple clients'
predictions. Thus, we propose to generate the adversarial examples via
maximizing the bias and variance during server update, and learn the
adversarially robust model updates with those examples during client update. As
a result, an adversarially robust neural network can be aggregated from these
improved local clients' model updates. The experiments are conducted on
multiple benchmark data sets using several prevalent neural network models, and
the empirical results show that our framework is robust against white-box and
black-box adversarial corruptions under both IID and non-IID settings.
