Research map / Adversarial robustness and security / Certified and empirical robustness
On the Robustness of Distributed Machine Learning Against Transfer Attacks
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Shows that distributed ML ensembles with heterogeneous training data and hyperparameters (especially independent tuning of learning rate, momentum, weight decay) achieve better accuracy-robustness tradeoffs against transfer attacks (CW, SAM, CSE) than standard ensembles on CIFAR10 and FashionMNIST.
Problem
Robustness of distributed machine learning, where learners differ in data, architecture, optimizer, scheduler and hyperparameters, against transfer-based adversarial attacks, which has not been studied jointly for training and inference distribution.
Approach
Each weak learner uses its own disjoint data partition and independently tuned major parameters and hyperparameters (via Ray Tune), with probability-averaged inference; a gradient-similarity argument links model heterogeneity to reduced transferability.
Key results
- On CIFAR10, distributed instantiations reach robust accuracy up to 83% versus at most 37% for the standard ensemble baseline, with clean accuracy around 87%.
- For N=7 nodes with independent tuning, mean robustness is 0.74 vs 0.37 for ENS on CIFAR10; robustness increases about 2.88% per additional node in the regression.
- Independent tuning of hyperparameters (learning rate, momentum, weight decay) contributes a 34.53% robustness increase, while architecture, optimizer and scheduler diversity show no statistically significant effect.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Replace ensemble learning with distributed learning using architecture, optimizer, and scheduler diversity | CIFAR10 models, N=7 · CIFAR10, mean across attacks | robust accuracy: 0.37 -> 0.73 | Helped |
| Increase the number of nodes from 3 to 7 | D_AOS · CIFAR10, mean across attacks | robust accuracy: 0.66 -> 0.73 | Helped |
| Increase the number of nodes from 3 to 7 | ENS · CIFAR10, mean across attacks | robust accuracy: 31% to 37% | Helped |
| Use independent tuning to diversify learning rate, momentum, and weight decay | CIFAR10 distributed models · CIFAR10 | robust accuracy: 34.53% | Helped |
| Diversify optimizer (ablation) | CIFAR10 distributed models · CIFAR10 | robust accuracy: -0.0012 | No clear effect |
| Diversify architecture (ablation) | CIFAR10 distributed models · CIFAR10 | robust accuracy: 0.0076 | No clear effect |
| Diversify scheduler (ablation) | CIFAR10 distributed models · CIFAR10 | robust accuracy: -0.0089 | No clear effect |
| Use non-IID Dirichlet data instead of uniformly distributed data (ablation) | Independent tuning models · CIFAR10, N=3 and N=7 | mean robustness: increase of only 0.2% and 0.6% | No clear effect |
| Use hard voting instead of average voting (ablation) | D_O · CIFAR10, N=3 and N=7 | mean robustness: 2% and 1% | Hurt |
| Use weighted voting instead of average voting (ablation) | D_O · CIFAR10, N=3 and N=7 | mean robustness: 1% for N=3 and 1% for N=7 | Hurt |
| Use architecture diversity only (ablation) | CIFAR10 distributed models, N=7 · CIFAR10 | mean robustness: 0.73 -> 0.76 | No clear effect |
| Use optimizer diversity only (ablation) | CIFAR10 distributed models, N=7 · CIFAR10 | mean robustness: 0.73 -> 0.76 | No clear effect |
Surprising findings
- Diversity of architecture, optimizer, and scheduler has little or no statistically significant impact on robustness, contrary to the intuition that model heterogeneity drives transfer resistance.
- Non-IID (Dirichlet) data partitioning reduces accuracy by about 3% but has negligible effect on robustness.
Limitations
- Evaluated only on small image datasets (CIFAR10, FashionMNIST) with undefended models and a single transfer attack family (CW and derivatives).
- Accuracy drops as node count grows because each learner receives only a fraction of the data.
- Regression is linear and does not capture saturation of robustness gains as N grows.
Experimental setup
Datasets: CIFAR10 FashionMNIST
Benchmarks: CIFAR10 FashionMNIST
Metrics: clean accuracy robust accuracy attack success rate
Baselines: ENS (standard ensemble) Independent Tuning (IT) Common Weakness (CW) attack transfer baseline
Builds on: ensemble learning federated learning Common Weakness attack Ray Tune
Closest papers by meaning
- On the Tension between Byzantine Robustness and No-Attack Accuracy in Distributed Learning (ICML 2025 · similarity 0.87)
- Weight for Robustness: A Comprehensive Approach towards Optimal Fault-Tolerant Asynchronous ML (NeurIPS 2024 · similarity 0.86)
- Fault Tolerant ML: Efficient Meta-Aggregation and Synchronous Training (ICML 2024 · similarity 0.85)
- Competitive Advantage Attacks to Decentralized Federated Learning (NeurIPS 2025 · similarity 0.85)
- Position: Exploring the Robustness of Pipeline-Parallelism-Based Decentralized Training (ICML 2024 · similarity 0.85)
- RESIST: Resilient Decentralized Learning Using Consensus Gradient Descent (NeurIPS 2026 · similarity 0.85)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.