ByzULDP：拜占庭容错联邦学习结合用户级差分隐私的最优收敛算法
Optimal Byzantine-resilient Federated Learning with User-level Differential Privacy
做联邦学习或隐私计算的人应该看看这篇。它把拜占庭攻击防御和用户级差分隐私这两个难点一起处理，还给出了理论最优的收敛速率，不是只靠实验说话。如果你的场景要同时防恶意客户端和满足隐私合规，这套双层动量的思路可以直接参考。
一项新研究提出 ByzULDP，解决拜占庭容错联邦学习与用户级差分隐私结合时的收敛问题，并首次给出该设定下的信息论下界。
作者证明在用户级 DP 与客户端异构条件下，直接把非线性鲁棒聚合与中心化 DP 噪声叠加，无法保证收敛到平稳点的有界邻域。ByzULDP 采用客户端与服务器两端的双层动量设计：客户端动量在鲁棒聚合中降低随机梯度方差，服务器端动量则利用用户级 DP 的隐私敏感性取决于客户端更新构造方式这一特性来推动收敛。
理论上，该算法在强凸目标下达到次线性误差项以最优 O(1/T) 速率衰减的阶数最优收敛界，非凸目标下为 O(1/√T)；实验在真实数据集和多种隐私预算设置下验证了分析结果。
Optimal Byzantine-resilient Federated Learning with User-level Differential Privacy
Real-world deployment of federated learning (FL) requires resilience against adversarial clients and data privacy. Byzantine fault captures the worst-case behavior of adversarial clients, while differential privacy (DP) provides statistical guarantees against privacy loss. In particular, user-level DP guards a client's entire contribution and provides more realistic protection against information leakage. Despite intensive efforts, the minimax-optimal convergence bound of Byzantine-resilient FL with user-level DP remains open. We establish an information-theoretic lower bound for any Byzantine-resilient empirical risk minimization problem under user-level DP and heterogeneous clients. We propose ByzULDP, a central DP algorithm featuring a two-level momentum across the client and server. Client-side momentum mitigates stochastic gradient variance during robust aggregation. Unlike the fault-free case, naively combining non-linear Byzantine-resilient aggregation with central DP noise can be insufficient to guarantee convergence to a bounded neighborhood of a stationary point. Our key contribution is a server-side momentum that leverages a property specific to user-level DP, where privacy sensitivity depends on how client updates are constructed, to empower convergence. ByzULDP achieves the order-optimal convergence bound for strongly-convex objectives, with vanishing error terms decaying at the optimal $O(1/T)$ and $O(1/\sqrt{T})$ rates for strongly-convex and non-convex objectives, respectively. We corroborate our analysis with numerical experiments on real-world datasets across diverse privacy budgets.
This report is categorized under AITOP's "Papers" desk. Within our cross-regional analytical framework, it directly maps to AI developer toolchains, coding agents, and engineering workflows. Key entities and technical topics under continuous tracking include 联邦学习, 差分隐私, Byzantine, ByzULDP.
Source attribution: curated from arXiv cs.LG (@Ming Xiang, Stratis Ioannidis, Edmund Yeh, Carlee Joe-Wong, Lili Su).