\section{Introduction}
\label{Intro}
Over the last two decades, data representation has evolved significantly. Several data types are used from different receiving sources, such as machine log data\footnote{Machine log data is machine-generated data like event logs, server data, and application logs.} and social media, which need to be processed, analyzed, and stored. This phenomenon has increased data volumes (see Fig. 1), and machine learning (ML) technology is the most promising approach to uphold big data analysis. However, due to the "over-fitting and over-parameterized model"\footnote{In the case of large and complex neural networks, the execution of an algorithm can take a prolonged time, indicating over learning (or over-fitting); this shows that while the learning system excels at fitting its learning data, it cannot generalize to new data. On the other hand, the over-parameterized model represents the number of parameters, where a model can contain more than the number of parameters estimated from data.} in some cases as neural networks \cite{panchal2011determination}, the complexity of existing problems \cite{yang2018end, leopold2018identifying}, as well as the centralized solutions which suffer in the case of drastic growth of data to store on single machines \cite{raicu2006astroportal}, make the solutions of traditional ML algorithms not feasible \cite{verbraeken2020survey}. Furthermore, it is computationally challenging to train sophisticated models like neural networks on a single machine. Hence, using a distributed system is necessary to distribute tasks across multiple machines and enhance the efficiency of optimization algorithms in terms of computing and communication costs while maintaining the highest level of accuracy.
\begin{figure}[H]
    \centering
    \includegraphics[width=\textwidth,keepaspectratio]{statistic_id871513_amount-of-information-globally-2010-2024}
    \caption{Growth of data from 2010 to 2024 was obtained from\cite{ArneHolst}. The star (*) in the chart reflects Statista's prediction of rising global data from 2021 to 2024, based on reached 2020 figure with a 5-year compound annual growth rate (CAGR). In comparison, the International Data Corporation (IDC) provides the prediction figures from 2018 to 2020.}

    \label{fig:GrowthData}
\end{figure}

\subsection{The domain of the survey}
Many data instances, high dimensional data, model and algorithm complexity, inference time constraints, prediction cascades\footnote{Speech recognition, object tracking, and machine translation, are a real-world issues that demand producing a series of interconnected predictions, this process known as prediction cascades. When considered as a single inference task, a cascade has a highly complicated joint output spaces, resulting in extremely high computing costs due to increasing computational complexity\cite{bekkerman2011scaling}.}, model selection, and parameter sweeps are reasons for scaling up ML \cite{bekkerman2011scaling}.  Towards the deployment\footnote{To get the best performance while implementing DML, it is necessary to consider High-performance computing (HPC)-style hardware such as NVLink (is a high-speed GPU-to-GPU interconnect introduced by NVIDIA \cite{harris-2020}), InfiniBand networking (is an HPC networking communications technology with extremely high performance and low latency \cite{InfiniBand-2019}), and GPUs with capabilities such as GPUDirect (is a Magnum IO suite of technologies that improve data transportation and access for NVIDIA data center GPUs \cite{GPUDirect-2021}).} of DML, many considerations \cite{verbraeken2020survey} must be taken (see Fig. 2).

\textit{ML algorithm} is a construction that allows making predictions from data and is based on three key features: type, goal, and method. The principal types are represented by supervised learning \cite{bekkerman2011scaling}, unsupervised learning \cite{bekkerman2011scaling}, semi-supervised learning \cite{chapelle2009semi}, and reinforcement learning \cite{ben2019demystifying}. The goal (purpose, objective) of machine learning is to find patterns in data and then make predictions based on those patterns, which are typically complicated, to help solve several types of problems (anomaly detection, classification, clustering, dimensionality reduction, representation learning, and regression), and the method is the model evolution's nature, which applies a variety of methodologies such as SGD, which goes back to the 1950s \cite{robbins1951stochastic}, SGD is a stochastic approximation variant of Gradient Descent (GD) and one of the most successful stochastic optimization algorithms.

\begin{figure}
    \centering
    \includegraphics[width=90mm,scale=0.9]{DML_deployment_consideration.pdf}

    \caption{Road map of DML deployment considerations. Five considerations are taken into account: (1) represents the set of ML algorithms, (2) denotes the problem of the choice of hyperparameters in the optimization process, (3) is an essential concept in DML deployment, which serves to combine several models to improve predictive performance, which shows the idea of Ensemble learning, (4) represents the network typology considered in DML deployment namely centralized and decentralized, and (5) expresses the type of communication technique such as synchronous and asynchronous schemes.}
    \label{fig:RoadMapDMLdeploymentCons}
\end{figure}

The \textit{hyperparameters optimization} problem extends back to the 1990s\cite{kohavi1995automatic}. The choice of algorithm hyperparameters has a considerable influence on the performance of ML algorithms. The learning rate and momentum in SGD \cite{maclaurin2015gradient} as examples of choosing hyperparameters. However, the ideal combination of hyperparameters varies depending on the problem domain, ML model, and dataset  \cite{verbraeken2020survey}. Several ways to solve this problem have been proposed, including Random searching of hyperparameters \cite{bergstra2012random}and Bayesian hyperparameter optimization strategies \cite{snoek2012practical}.
The optimization ML algorithms are divided into distinct families discussed in the literature \cite{beck2017first, bottou2018optimization, wright2015coordinate, brooks1998markov, ensor1997stochastic, bergstra2012random, shahriari2015taking}, each with its own set of methodologies. Our research study focuses on first-order algorithms, which go back to 1847 \cite{beck2017first}. First-order algorithms represent the set of "methods that exploit information on values and gradients/subgradients\footnote{The subgradient method is an Iterative method for tackling convex minimization problems and applied to a non-differentiable objective function. The observable differences from the standard gradient method are in step lengths which are fixed in advance, and the function value might grow in the subgradient method. Unlike the gradient approach, this is a descent method that uses exact or approximate line search \cite{boyd2003subgradient}.} of the functions comprising the model under consideration" \cite{beck2017first}.

Emulating human nature on a combination of different viewpoints to make an essential decision is the origin of \textit{ensemble learning} \cite{sagi2018ensemble}, a necessary concept in DML deployment. To enhance predictive performance, a single model is not accurate enough compared to combining them, which shows the idea of Ensemble learning \cite{sagi2018ensemble, verbraeken2020survey}. Ensemble learning is realized by several methods like AdaBoost \cite{freund1997decision}, which focuses on leveraging data misclassified by earlier models to train new models.

The \textit{network topology} is another important concept for the design of a DML deployment, and the authors in \cite{verbraeken2020survey} presented fourth topologies: Centralized (Ensembling), Decentralized (Tree, Parameter Server), and Fully Distributed (Peer to Peer). The following section will discuss the segmentation of the topologies approved in our survey.

Despite the benefits of distributed systems in ML, as using many processors to train a single task helps minimize training time, \textit{communication} is crucial in DML. The communication cost between processors can affect the system's scalability \cite{shi2018performance}, requiring data communication optimization.
In a distributed system, the identification of tasks that may be conducted in parallel, the task execution order, and ensuring a balanced load distribution among the available machines must all be taken into account \cite{xing2016strategies}. After then, the techniques Bulk Synchronous Parallel \cite{xing2016strategies}, Stale Synchronous Parallel \cite{ho2013more}, Approximate Synchronous Parallel \cite{hsieh2017gaia}, Barrierless Asynchronous Parallel \cite{luo2020processing}, and Total Asynchronous Parallel \cite{hsieh2017gaia} may improve communication efficiency. In contrast, our survey focuses on synchronous/asynchronous algorithms, the most prevalent and commonly utilized methods in DML.

However, heterogeneity, openness\footnote{Openness: is a feature that indicates the ability to extend and reimplement a computer system. Moreover, the ability to introduce new resource-sharing services and make them available for usage by a range of client programs, determines the openness of distributed systems \cite{coulouris2005distributed}.}, security, scalability, failure handling, concurrency, transparency, quality of service are the main challenges in distributed systems \cite{coulouris2005distributed}, hence the distributed ML systems. Handling failures is challenging, and many techniques are used to deal with various types of faults (hardware or software), including tolerating failures. \cite{coulouris2005distributed}. Fault tolerance in distributed environments is defined as the ability of a system to continue performing its intended task with the presence of failures \cite{ahmed2013survey}. The types of possible failures\cite{jalote1994fault} in distributed systems are depicted in Fig. 3, and the Byzantine failure is the general one\cite{lamport1982byzantine}. A Byzantine failure is where a component deviates out of its intended behavior unexpectedly and shows Byzantine behavior \cite{mostefaoui2018randomized}. This undesirable behavior is known as adversarial, compromised, attack, malicious, and arbitrary failure. It can be malevolent or merely the consequence of a transient malfunction that changed the component's local state, causing it to behave in an unanticipated manner \cite{mostefaoui2018randomized}. This failure type was first described in the synchronous distributed systems context \cite{lamport1982byzantine, pease1980reaching, raynal2010fault} before being examined in the asynchronous distributed systems situation \cite{attiya2004distributed, lynch1996distributed, raynal2012concurrent}.

\begin{figure}[H]
  \centering
  \begin{tikzpicture}[>=stealth',join=bevel,auto,on grid,decoration={markings,
    mark=at position .5 with \arrow{>}}]

    \coordinate (structuralNode) at (2:2cm);
    \coordinate (originNode) at (0:0cm);

    \draw[-, very thick,black] (structuralNode.south) -- (0.5,0)
    node[pos=0]{ }
    node[pos=0.1]{}
    node[pos=0.4]{}
    node[pos=0.7]{}
    node[pos=1]{};

    \draw[fill,black] (barycentric cs:structuralNode=0.9,originNode=0.0) circle (1.5pt);
    \draw[fill,black] (barycentric cs:structuralNode=0.65,originNode=0.2) circle (1.5pt);
    \draw[fill,black] (barycentric cs:structuralNode=0.35,originNode=0.35) circle (1.5pt);
    \draw[fill,black] (barycentric cs:structuralNode=1.5,originNode=4.0) circle (1.5pt);

    \draw[black] (0,0) circle (2.3cm);
    \draw[black,postaction={decorate,decoration={raise=-2.5ex,text along path,text align=right,text={Byzantine}}}] (0,0) circle (1.8cm);
    \draw[black,postaction={decorate,decoration={raise=-2.5ex,text along path,text align=right,text={Timing}}}] (0,0) circle (1.3cm);
    \draw[black,postaction={decorate,decoration={raise=-2.5ex,text along path,text align=right,text={Omission}}}] (0,0) circle (0.75cm);
    \draw[white,postaction={decorate,decoration={raise=-2.5ex,text along path,text align=right,text={Crash}}}] (0,0) circle (0.25cm);

  \end{tikzpicture}
  \caption{Faults type in a distributed system. Crash: it causes loss of the internal state of the component, Omission: the component does not respond to some inputs, Timing: the component reacts too early or too late, Byzantine: an arbitrary behavior of the component.}

  \label{fig:FaultsTypes}
\end{figure}
\subsection{Problem formulation and motivation of the survey}

This study aims to analyze the proposed BFT approaches for DML, considering synchronous and asynchronous training processes in centralized and decentralized settings. Examining to what extent BFT approaches in DML meet the requirements (Byzantine resilience methods, tolerate Byzantine fault in the distributed SGD algorithm, preserving privacy in collaborative DL ... etc.) and the obstacles they confront.

The Byzantine faults in distributed systems include software, hardware, computation errors, and network problems as propagating wrong data between nodes, which apply to distributed machine learning, thus impacting negatively on the intended results. In more detail, the problem of Byzantine fault in DML can occur during training (concerns the adversarial gradients) as \cite{blanchard2017machine}, or inference (concerns the adversarial examples\footnote{Represent the maliciously generated inputs \cite{szegedy2014intriguing} and consists of small imperceptible changes to humans in a regular test sample, but they may misclassify the examples in many ML models, including deep neural networks \cite{yuan2019adversarial, wang2016theoretical, NEURIPS2020_00e26af6}}) like \cite{wang2016theoretical}. The former is our study center, where the sets of adversaries during training can know the information of other nodes and replace the data transmission among them with arbitrary values, which may break the robustness of distributed optimization methods used in DML. Several studies, including \cite{blanchard2017machine, weng2019deepchain, chen2018draco, el2018hidden, melis2019exploiting, hitaj2017deep}, have explained that an adversary in the training phase can inject erroneous or malicious data samples as false labels or inputs. We can take an example that a Byzantine participant in the training process can select an arbitrary input, resulting in unwanted gradients. Hence,  as a possible consequence when aggregating, we may get incorrect gradients. Deducing sensitive and private information is another problem. In this context, adversaries might use the inference attack, for example, to extract sensitive model information. Furthermore, they might fool an already trained model with contradicting inputs, changing the model's parameters, or altering the gradient in the incorrect direction, leading it to deviate arbitrarily, shifting the average vector away from the desired direction. These scenarios can disrupt the training process, where they serve to achieve unwanted gradients, which significantly impact the parameter update stage and, therefore, negatively impact the expected model outcome.

This study concentrates on Byzantine failure, which occurs when worker machines act arbitrarily, making data privacy more challenging to protect \cite{weng2019deepchain}. Higher accuracy, for example, is desired in several artificial neural network tasks, such as image recognition; this requires a huge number of data to train deep learning models, resulting in high computational costs \cite{gupta2016model, chilimbi2014project}. Although distributed deep learning solves the latter issue, privacy remains a challenge throughout the training process due to inferring critical training data using intermediate gradients when partitioned and stored data separately \cite{song2017machine, melis2019exploiting, orekondy2018gradient}. Escaping saddle points is a significantly more challenging task. As shown in \cite{yin2019defending}, the adversary may modify the landscape of the loss function around a saddle point. Another challenge is achieving optimal convergence that Byzantine attackers may prevent. Byzantine attackers can send distorted data or effects the algorithms to force them to converge to the attackers' choice-value \cite{cao2019distributed}. \textbf{Specifically, the studied problem at the core of our analysis is how to ensure the robustness of the SGD-based training algorithms in DML}.

In the literature, and to the best of our knowledge, we observe that despite extensive research in the field of Byzantine fault tolerance in distributed machine learning, only one overview has been published \cite{yang2020adversary}. Since there is no consensus on the usage of the words distributed and decentralized in literature, Yang et al.\cite{yang2020adversary} chose to use them separately. They focused on the latest advances in Byzantine-resilient inference and learning. In this context, they provided the latest findings on the resilience of distributed/decentralized detection, estimation, and ML training algorithms in the presence of Byzantine attacks. The authors presented some approaches on Byzantine-resilient of distributed stochastic gradient descent and decentralized learning one, with comparative numerical experiments. Similarities and dissimilarities between distributed SGD approaches and those decentralized methods are provided in their work. However, this overview does not include any Byzantine fault tolerance approaches based on Blockchain or coding schemes in distributed machine learning to strengthen the discussion of proposed BFT solutions. Moreover, the authors have not classified the techniques used by BFT approaches in the overview, in addition to very restricted approaches that have been explained.

We push further the study, making it more exhaustive and covering the full structure of BFT in DML, which helps readers grasp the whole structure of BFT in DML.

\subsection{Scope of the survey}
On this hand, we define the scope of this survey as follow: \begin{itemize}
 \item Preliminaries of distributed machine learning
\item Description of key techniques used in BFT for DML
\item Description of fundamental approaches proposed to deal with the BFT issue in DML.
\end{itemize}
A discussion and a comparative analysis of the studied approaches are also given in subsequent sections.

\subsection{Our contributions}

The purpose of this paper is to survey the proposed approaches targeted to tolerate Byzantine faults in the context of first-order optimization methods based on SGD. Although works on this subject have already been conducted, a complete study that includes the most current approaches, the classification of techniques used by these approaches, and the open problems in BFT in the DML is still lacking. The points that we will cover are provided in the following paragraph

This study seeks to give a full overview of the BFT in the DML with preliminary definitions, achievements, and challenges, conducive to providing the reader with a basic understanding of our proposed work. Therefore, the reader will be aware of current research trends in this scope and will be able to identify the most demanding concerns.

The description of the contributions to recent field literature in this work can be summarized as follows:
\begin{itemize}
\item Providing an overview with a classification of the techniques and approaches used to achieve solutions of BFT in DML.
\item Identifying and examining solutions based on filtering schemes, coding schemes, and Blockchain technology to deal with BFT in ML with software environments.
\item Providing insights into existing BFT approaches in DML and future directions.
\end{itemize}

\subsection{Survey organization}

The remainder of this paper is structured as follows: Section 2 presents the essential terminologies related to DML. Section 3 describes fault tolerance in DML frameworks and provides a detailed study of tolerant systems, focusing on Byzantine ones in SGD. Section 4 discusses and compares the set of research works presented in section 3. Finally, section 5 offers the conclusion of our survey.
\section{Towards distributed machine learning}

\subsection{Machine learning and Deep learning}

ML is one of the most successful Artificial Intelligence (AI) models, using algorithms capable of solving problems with progressively less human intervention.  In other words, ML algorithms use data samples (training data) as inputs and produce predictions as output values without any explicit programming.

Among the most successful subfields of ML algorithms is Deep Learning (DL). The latter is based on bio-inspired Artificial Neural Networks (ANNs) and multilayer ANNs form a Deep Neural Network (DNN), which is illustrated in the architecture of DL (see Fig. 4).
\begin{figure}
    \centering
   \includegraphics[width=90mm,scale=0.8]{DNN_Architecture.png}

       \caption{Deep Neural Networks Architecture adapted from \cite{haris-iqbal-2018}. The DNN architecture example of 8-layer (could be more or less). Layers 1 through 5 comprise a convolution block, Rectified Linear Units (RELU), and pooling layers. Layer 6 represents the flattening layer. Layers 7 and 8 depict the dense layer and softmax layer, respectively.}
   \label{fig:DNN_Arch}

\end{figure}
DL methods are representation-based learning architectures as a cascade of linear and non-linear modules targeted to build different levels of abstractions in a hierarchical manner \cite{ lecun2015deep}.

In large-scale learning, the complexity of ML models is growing \cite{srivastava2015training}, which has driven learning schemes that require a set of computational resources. Consequently, the distribution of the computations among several workers in machine learning becomes necessary. A distributed training architecture is illustrated in Fig. 5.

\begin{figure}[H]
    \centering
    \includegraphics[width=90mm,scale=0.8]{distributed_training_architecture.pdf}

   \caption{General distributed training architecture. In the DML, the training process is realized based on data-parallel or model-parallel techniques. In the former, the model is replicated across n workers. Each worker performs its computations then shares the updates with the other workers.  In the latter, the model is divided across n workers, with each worker having a part of the model. Both techniques are based on synchronous or asynchronous updates, and more details are provided in the following section}
    \label{fig:General_DistTrainArch}
\end{figure}

\subsection{Distributed machine learning}

Distributed systems offer the advantage of enabling networked computers to cooperate to tackle complicated tasks that need several computers, reducing the time required to discover a solution. Hence giving performance gains when it comes to machine learning.

When it concerns distribution, two standard techniques are used to divide the problem among various computers (worker nodes) for efficient training: $ Data-parallelism $ or $Model-parallelism$. Both techniques are described in \cite{verbraeken2020survey} as follows:

In $ Data-parallelism $, the data is partitioned on various worker nodes with a full model copy. All worker nodes then apply the same algorithm to distinct data sets, with the results from each being a single coherent output somehow merged.

In $Model-parallelism$, various worker nodes are in charge of processing accurate copies of the whole data sets on different parts of a single model. As a result, the model is comprised of all model parts.

The approaches mentioned above may also be used in conjunction \cite{xing2016strategies}. In the same context, several DML approaches have been developed as those based on the distributed SGD optimization algorithm \cite{agarwal2018cpsgd, basu2019qsparse, shi2019distributed}.

Optimization methods, topologies, and communication are among the main features taken into account when deploying a DML, which we present in subsequent sections.

\subsubsection{Optimization methods}
Optimization has piqued the interest of researchers as a key component of machine learning. With the exponential rise of data and model complexity, optimization approaches in machine learning confront increasing hurdles. The commonly used optimization techniques are addressed in the literature \cite{bottou2018optimization,sun2019survey}, while we concentrate on the popular optimization methods family represented by first-order optimization methods (see Fig. 6). The latter is the set of methods that use the information included in the functions that make up the model being studied.

\begin{figure}
    \centering

\begin{forest}
    for tree={
      draw=black,
      rectangle,
      align=center,
            child anchor=north,
      parent anchor=south,
            drop shadow,
            l sep+=12.5pt,
            edge path={
        \noexpand\path[color=black, rounded corners=5pt,
          >={Stealth[length=10pt]}, line width=1pt, ->, \forestoption{edge}]
          (!u.parent anchor) -- +(0,-8pt) -|
          (.child anchor)\forestoption{edge label};
        },
            where level={3}{tier=tier3}{},
            where level={0}{l sep-=5pt}{},
            where level={1}{
        if n={1}{
             edge path={
        \noexpand\path[color=black, rounded corners=5pt,
              >={Stealth[length=10pt]}, line width=1pt, ->,
              \forestoption{edge}](!u.parent anchor) -- +(0,-5pt) -| (.child anchor)\forestoption{edge label};
        }
                }{
          edge path={
        \noexpand\path[color=black, rounded corners=5pt,
             >={Stealth[length=10pt]}, line width=1pt, ->,
             \forestoption{edge}](!u.parent anchor) -- +(0,-5pt) -| (.child anchor)\forestoption{edge label};
        },
        }
            }{}
    }
    [First-order\\optimization methods
    [Basic gradient\\descent methods\\and their variants
      [Gradient descent\\SGD\\Mini-Batch gradient]
      [Gradient methods\\with\\momentum\\\cite{polyak1964some, qian1999momentum}]
      [Adaptive learning\\rate methods\\ \cite{duchi2011adaptive, zeiler2012adadelta, tieleman2012lecture, kingma2014adam, dozat2016incorporating}]
      [Variance\\reduction\\methods
                [Stochastic\\average gradient\cite{le2012stochastic}]
                [Stochastic variance\\reduction gradient\\\cite{johnson2013accelerating}]
                [SAGA\\algorithm\cite{defazio2014saga}]
            ]
    ]
    [Alternating\\direction methods\\of Multipliers\cite{gabay1976dual}
        ]
    [Frank-Wolfe\\Method\cite{frank1956algorithm}]
    ]
\end{forest}

    \caption{Types of First Order Optimization Methods in ML}
    \label{fig:first_order_Opt_MLMeth}
\end{figure}
ML optimization is the process of fitting out the hyperparameters (or evaluating the weights) using one optimization technique. In the literature, gradient descent is the most widely used optimization method \cite{banavlikar2018crop}.

To reduce the prediction error of an ML model, Gradient Descent can be used. GD minimizes an objective function $J(\theta)$  as follows \cite{ruder2016overview}:

\begin{algorithm}
\caption{Gradient Descent}
\label{alg-gd}
\begin{algorithmic}[1]
\REPEAT
\STATE \( \theta := \theta - \alpha \cdot \nabla J(\theta)\)
\UNTIL{convergence}
\end{algorithmic}
\end{algorithm}

Where:
\begin{itemize}
\item$\theta$: model parameters
\item$\alpha$: the learning rate that determines the steps size taken to achieve good local minima at the convergence.
\item$J$: objective function
\item$\nabla J(\theta)$: first-order derivatives.
\end{itemize}

Our interest is the SGD optimization method, which behaves according to the following algorithm and differs from the GD, as shown in Fig 7:

\begin{algorithm}[H]
\caption{Stochastic Gradient Descent}
\label{alg-sgd}
\begin{algorithmic}[2]
\STATE Randomly shuffle training examples
\STATE for  \( i:=1, \ldots, m\{ \)
\REPEAT
\STATE \( \theta := \theta - \alpha \cdot \nabla J(\theta; x(i);y(i))\)\\
\STATE \( \} \)
\UNTIL{convergence}
\end{algorithmic}
\end{algorithm}

Where:
\begin{itemize}
\item  $m$: the number of training examples,
\item $x(i) ,y(i)$: the training examples.
\end{itemize}

 \begin{figure}[H]
    \centering
     \begin{tabular}{cc}
      \begin{tikzpicture}[
dot/.style = {circle, fill, inner sep=1pt,
              node contents={}},
ell/.style = {ellipse, draw=black, rotate=-5,
              minimum width=2*#1, minimum height=#1,node contents={}},
every edge/.style = {draw, ->,black, thick},
every edge quotes/.style = {font=\scriptsize, inner sep=1pt,
                            auto, sloped},
                      ]
\coordinate (originNode) at (0:0cm);
\foreach \i [count=\c from 1] in {1,6, 12, 18, 24, 30}
\node (n\c) [ell=\i mm, line width=0.5pt];
\node [dot];
\draw
   (n6.north west) edge [] (n5.west)
    (n5.west) edge [] (n4.north west)
   (n4.north west) edge [] (n3.west)
    (n3.west) edge [] (n2.north west)
    (n2.north west) edge [] (n1.west)
     (n1.west) edge [] (originNode);

    \end{tikzpicture}

    \begin{tikzpicture}[
dot/.style = {circle, fill, inner sep=1pt,node contents={}},
ell/.style = {ellipse, draw=black, rotate=-5,
              minimum width=2*#1, minimum height=#1,node contents={}},
every edge/.style = {draw, ->,black, thick},
every edge quotes/.style = {font=\scriptsize, inner sep=1pt,
                            auto, sloped}
                      ]
\coordinate (origin) at (0:0cm);
\foreach \i [count=\c from 1] in {1,6, 12, 18, 24, 30}
\node (n\c) [ell=\i mm, line width=0.5pt];
\node [dot];
\draw
    (n6.north west) edge [] (n5.north west)
    (n5.north west) edge [] (n4.north west)
    (n4.north west) edge [] (n3.north west)
    (n3.north west) edge [] (n2.north west)
   (n2.north west) edge [] (n1.north west)
   (n1.north west) edge [] (origin);
    \end{tikzpicture}
    \end{tabular}
    \caption{SGD (left) and GD (right) comparison adapted from \cite{shalev2014understanding}. In both GD and SGD, we iteratively update a set of parameters to minimize an error function. GD traverses the full dataset once before each update, while SGD selects just one data point randomly. SGD frequently converges considerably quicker compared to GD, although the error function is not as well reduced as in the case of GD.}
      \label{fig:SGDandGD}
  \end{figure}
The comparison discussed in \cite{ruder2016overview} and shown in Fig. 7 show that GD optimization can be costly in bulky datasets. It calculates the gradient of the cost function based on the complete training set for every update. Therefore, GD can be very slow and intractable in practice. Unlike SGD, which uses for each update one data point randomly to perform the parameter update, which makes it much faster. In addition, the convergence of GD is uncertain when there are several local minima (non-convex cases), which means when a global minima is required, the local minima may confine the training method to an inferior solution \cite{cetin1993global}. On the other hand, SGD avoids this problem by starting with a big step size and then reducing it after getting far enough away from the starting point \cite{kleinberg2018alternative}.

Despite the advantages of SGD, there are some challenges (as to improve the SGD robustness \cite{dean2012large}, Saddle Points and Selecting the Learning Rate \cite{ketkar2017stochastic}) that reinforce to propose other variants of SGD (Momentum \cite{qian1999momentum}, Nesterov accelerated gradient \cite{nesterov1983method}, Adagrad \cite{duchi2011adaptive}, Adadelta \cite{ zeiler2012adadelta}, RMSprop \cite{tieleman2012lecture}, Adam and AdaMax \cite{kingma2014adam}, Nadam  \cite{dozat2016incorporating}). Additionally, for large-batch training, AdaScale SGD, another proposed variant that reliably adapts learning rates \cite{pmlr-v119-johnson20a}. Furthermore, in over-parameterized learning, an accelerated convergence rate was reached by MaSS \cite{liu2019accelerating} over SGD.

Naturally, SGD is a sequential algorithm \cite{bottou1998online}. When the crucial growth in training data size over the years (see Fig. 1) becomes a fact issue; hence, parallelized and distributed implementation is necessary for SGD and its variants.

Distributed SGD implementations \cite{zhang2015deep} typically take the following form:
\begin{itemize}
\item The parameter server performs learning rounds to the training data \cite{li2013parameter}.
\item Then it diffuses the vector of parameters to the workers
\item Each worker calculates an estimate of the gradient
\item The parameter server aggregates the workers' calculation results
\item Finally, the parameter server updates the parameters vector
\end{itemize}

We cover in the next subsection the most common ways of communication used with SGD.

\subsubsection{Communication}
Synchronous/Asynchronous approaches are the most communication methods used in the training process with distributed SGD.
\begin{figure}
    \centering
    \includegraphics[width=100mm,scale=1.0]{DistributedSGD_Syn_ASyn.pdf}

    \caption{Asynchronous distributed SGD vs. Synchronous distributed SGD. Using Three worker machines and a parameter server are required (the number of worker machines shown in the figure is an example; there may be more, as well as the parameter server, which is based on the topology used in the training process, as indicated in the next subsection). The computation happens across all workers and the parameter server, with workers submitting gradients to the parameter server, which delivers the updated model to the workers. The gradients transfer and updated model are occurred synchronously in synchronous distributed SGD (right)  and asynchronously in asynchronous distributed SGD (left).}
    \label{fig:SynchAsynchDistSGD}
\end{figure}

Fig. 8 shows the synchronous distributed SGD vs. the asynchronous distributed SGD. The distinction between these methods is that no model update occurs until all workers have successfully calculated and delivered their gradients in the synchronous training case. In contrast to asynchronous training, no worker waits for a model update from another worker.

SGD optimization method (see Algorithm 2) works by determining the best weight parameters ($ \theta $) of the model by minimizing the objective function ($ J $). Thus, at each iteration, we minimize the error regarding the model's current parameters by following the gradient direction of the objective function of a single sample.

When training deep models on large datasets, we need to distribute our computations using multiple machines. As we mentioned previously, synchronous and asynchronous methods are the most popular communication approaches used in the DML. We will discuss them with the distributed SGD.

Depending on the architecture, multiple workers process data in parallel, and each worker connects with the parameter server and processes a mini-batch of data dependently on the others in the synchronous approach and independently of the others in the asynchronous approach \cite{chen2016revisiting}.

\paragraph{\bf{ Synchronous distributed SGD }}
Several works \cite{das2016distributed, zhang2018adaptive, zhao2019dynamic} used the synchronous method. The computation in the synchronous approach is deterministic and straightforward to implement. Every iteration, each worker calculates the model gradients in parallel using various mini-batches of data. Then, the parameter server waits for all workers to communicate their gradients before aggregating them and transmitting the updated parameters to all workers \cite{chen2016revisiting}.

\paragraph{\bf{ Asynchronous distributed SGD }}
The works \cite{lian2018asynchronous, reddi2015variance, zhang2013asynchronous} among the research papers are based on the asynchronous method. The asynchronous steps communication is presented in \cite{chen2016revisiting}. The worker obtains from the parameter server the most recent model parameters required to process the current mini-batch; It then computes gradients of the loss concerning these parameters; and finally, these gradients are returned to the parameter server, which updates the model accordingly.

In reality, When a worker retrieves the model's parameters while other workers update the parameter server, an overlap may occur, resulting in inconsistent results. Furthermore, there is no guarantee that model updates may have happened while a worker calculates its stochastic gradient; consequently, the resulting gradients are stale and often calculated regarding out-of-date parameters \cite{chen2016revisiting}.\\

The two most common distributed machine learning methods (synchronous/asynchronous) are built within a (centralized/decentralized) setting that we develop in the subsequent section.

\subsubsection{Topologies}

We mentioned in the introduction four possible topologies discussed in \cite{verbraeken2020survey} based on the degree of distribution\footnote{The degree of distribution is the frequency distribution of a network system's node degree over the whole communication network.}. Due to the lack of agreement on the definitions of distributed and decentralized  \cite{yang2020adversary}, we centered our survey on most topologies used in BFT for DML. We classified them into centralized and decentralized (multiple parameter servers, fully distributed) settings.
\begin{figure}
    \centering

    \includegraphics[width=\textwidth,keepaspectratio]{settings_diagram.pdf}
    \caption{ (a) Centralized setting, which shows a central node computing (server) and worker nodes connecting with the server (b) Decentralized setting, case of multiple parameter servers that shows several severs connecting with a decentralized set of workers (c) Decentralized setting, case of fully distributed setting that shows independent nodes that collaborate the solution together.}
    \label{fig:settings}
\end{figure}

\begin{enumerate}
\item \verb| Centralized setting|: the centralized setting is the classical one of the distributed machine learning paradigm, consisting of the parameter server model \cite{li2014scaling}, where there is a central node computing (server) and a set of data holders (worker nodes) that connect to the server (see Fig. 9.a). The worker nodes perform the gradient calculation locally and stream it to the server that updates the model parameter.

\item \verb| Decentralized setting|: to eliminate single points of failure in a centralized setting, there's a need to use a decentralized setting that excludes the necessary central entity (server) in the centralized settings. The decentralized setting focused on the cooperation among entities to produce the final result \cite{yang2020adversary}.

\paragraph{\bf{ Decentralized setting based on multiple parameter servers }}
In this setting, instead of using one parameter server to manage parts of the model, multiple centralized parameter servers are used with a decentralized set of workers \cite{verbraeken2020survey} (see Fig. 9.b).

\paragraph{\bf{ Fully distributed setting }}
There are no central nodes in a fully distributed setting, so there are no single points of failure. This setting can be represented by a directed or undirected graph, where the workers communicate with each other and transit their parameter vectors to their neighboring nodes. Once the parameter vectors have been received, each worker node calculates the gradient locally and broadcasts it to its neighbors. Finally, the worker nodes aggregate the training model parameter from each neighboring worker node and update the model \cite{guo2020towards, lian2017can}. A \textit{peer-to-peer} network is an example of implementation of this setting (see Fig. 9.c) also the based topology of \textit{Blockchain} technology, the core technology used to create the cryptocurrency \cite{nakamoto2008peer}. In other terms, Blockchain is a peer-to-peer distributed ledger technology that enables secure transactions and a bond of trust with its participating users \cite{dave2019survey}. Some of the works given in this survey rely on this technology in their proposed approaches, such as \cite{weng2019deepchain, chen2018machine, lugan2019secure, zhao2019mobile, rathore2019blockdeepnet}.

\end{enumerate}

\section{Byzantine fault tolerance in distributed machine learning}

\subsection{Fault tolerance in distributed machine learning}

A system is fault-tolerant if it can detect and eliminate fault-caused errors or crashes and automatically recover its execution. Following the growth of data and the necessity of an efficient system in many fields, including machine learning, fault tolerance is becoming increasingly crucial \cite{zhou2003evolving, leung2008fault, simon1995fault,arad1997fault}.
The checkpoint/restart is the simplest form of fault tolerance in machine learning \cite{ben2019demystifying}, and the SCAR (Self-Correcting Algorithm Recovery) framework was developed by Aurick et al. \cite{qiao2019fault} among approaches that used this form. The presented framework is based on the parameter server architecture (PS)\cite{li2013parameter, ho2013more,li2014communication}. It minimizes the size of the perturbation caused by failure, which is reduced by 78\% to 95\% \cite{qiao2019fault} compared
to fault tolerance training algorithms and models with a traditional checkpoint.
The increased number of proposed Byzantine fault-tolerant techniques is proportional to the number of different software faults that rise in tandem with various malicious attacks.
In this paper, we provide a comparative study among the works in the literature that aim to tolerate Byzantine fault in the first-order optimization methods, especially in the distributed SGD optimization methods.
\subsection{Byzantine fault tolerance in first-order optimization methods}
We classified the Byzantine fault tolerance approaches that deal with first-order optimization methods, precisely the SGD method, into two categories: synchronous and asynchronous training approaches. Based on these two categories shown in Fig. 8, we present a set of proposed algorithms, which are analyzed as follows:

\subsubsection{Synchronous training approaches VS Asynchronous training approaches}

Synchronous stochastic gradient descent is used in the training process when worker communication is dependent on the parameter server. In this case, the algorithms must wait for the parameter server to aggregate all the gradients sent by the workers before updating the new model and moving on to the next iteration. However, asynchronous stochastic gradient descent is used when worker communication with the parameter server is independent. In this situation, the algorithm does not wait until the collection of worker gradients is complete so that the settings server can update the new model and move on to the next iteration.\\

We classify the techniques used in first-order optimization methods for synchronous/asynchronous Byzantine fault tolerance into three types, as shown in Fig. 10.
\begin{figure} [H]
    \centering

    \includegraphics[width=100mm,scale=1.0]{BFT_IN_SGD.pdf}
    \caption{Brief description of the different types of techniques used in BFT in DML. In comparison to the asynchronous training method, a large part of BFT approaches in DML use the synchronous training method. Synchronous approaches use various techniques, while asynchronous approaches use the filter scheme technique.}
    \label{fig:BFT_typesTechniques_descr}
\end{figure}
\begin{enumerate}
\item \verb|Byzantine fault tolerance based on filtering schemes|: The aggregation rule as a geometric median \cite{cohen2016geometric} is used to calculate the average of the input vectors \cite{el2020robust} in the learning process. In the distributed training process and before the model update phase, aggregation must be passed by collecting the gradients to compute their average. Most of the BFT approaches in the literature are based on the filtering schemes presented by gradient filters (aggregation rules). In this type of method, the mistrustful gradients are filtering in some approaches before averaging by existing robust aggregation rules \cite{alistarh2018byzantine, xie2018zeno} as those based on median or mean \cite {tianxiang2019aggregation}. Another way to be accredited by other works is to use a robust aggregation rule that replaces the averaging aggregation operation \cite{blanchard2017byzantine, blanchard2017machine}. Other schemes are used in several ways, as \cite{su2018securing}, which used the iterative filtering based on robust mean estimation \cite{steinhardt2018resilience}, and the norm filtering used by \cite{gupta2019byzantine_b, gupta2019byzantine_a, li2019rsa} in addition to General Update Function (GUF) used with average aggregation by \cite{guo2020towards}.

\item \verb|Byzantine fault tolerance based on coding schemes|: these schemes are also known as redundancy schemes in some literary works. The two names come from the combination of redundant gradient calculations and the encoding scheme. The basic idea of the redundant mechanism is that each node evaluates a redundant gradient instead of a single gradient. More precisely, each computation node has a redundancy rate, which presents the average number of gradients assigned. So, in the presence of Byzantine workers, the parameter server can always recover the sum of the correct encoded gradients per iteration \cite{chen2018draco}. The coded gradient presents the phase of coding theory, as shown in \cite{zaharia2008improving}. The coding-theoretic techniques have been used before but not in the case of Byzantine fault tolerance; instead, they have been used to speed up distributed machine learning systems\cite{lee2017speeding}, gradient coding \cite{tandon2017gradient, raviv2018gradient}, encoding computation \cite{dutta2016short}, and data encoding\cite{karakus2017straggler}.

\item \verb|Byzantine fault tolerance based on Blockchain|: Blockchain was presented as a decentralized system characterized by auditability, privacy, and persistence \cite{zheng2017overview}. When a faulty component in a computer system exhibits an arbitrary behavior, we discuss the Byzantine faults. This issue introduces firstly by the Byzantine Generals Problem \cite{lamport1982byzantine}, an example of consensus methods to tolerate this type of problem. It is known as Byzantine Fault Tolerant (BFT) consensus protocol. "Proof of Work" is the principal consensus protocol of Bitcoin's public Blockchain to tolerate Byzantine faults \cite{nakamoto2008bitcoin}. Blockchain technology is used in machine learning systems to overcome Byzantine challenges and preserve security and privacy.
\end{enumerate}

\subsection{BFT approaches in first-order optimization methods}
This section presents various BFT approaches proposed in the literature. We introduce the principle of each approach, the BFT method used, with some advantages and weaknesses. Sections 3.3.1 and 3.3.2 discuss BFT approaches in synchronous training. Section 3.3.1 is centered on the SGD method and approaches based on other ML optimization methods shown in section 3.3.2. The BFT approaches in asynchronous training are presented in section 3.3.3, while section 3.3.4 introduces the BFT approaches in partially asynchronous training.\\

We use some abbreviations which are not standard. The authors are chosen according to the proposed approach.\\

We summarize the notations frequently used in the next subsections as follow:
\begin{itemize}
    \item $n$: The total number of worker machines. \item $f$: Byzantine workers.
    \item $d$: The model dimension.
    \item $T$: The set of iterations in an iterative algorithm.
\end{itemize}

\subsubsection{Synchronous training Byzantine fault tolerance approaches based initially on the SGD}

 A brief description of each proposed approach is in the following table, along with the kind of technique it lies in.

\begin{table}[H]
  \caption{Categorization of synchronous training BFT approaches based on the SGD. Each BFT synchronous training approach is presented with its basic technique (filtering scheme, coding scheme, Blockchain) and a summary of its main idea. \textbf{Zoom the PDF for better visualization}.}

  \label{tab:CategorizationSynBFT}

\resizebox{0.99\columnwidth}{!}{

\begin{tabular}{p{2.5 cm} |p{2.5 cm}| p{14 cm}}

    Approach&Technique Type&Brief Description\\

    \hline
     DeepChain&Blockchain&A robust Blockchain-based decentralized platform for privacy-preserving collaborative deep training\\
     \hline
    Krum and Multi-Krum&Filtering scheme&The first proved Byzantine resilience method for distributed SGD, which satisfies the aggregation rule resilience property when there are several Byzantine workers\\
         \hline
    ByzantineSGD&Filtering scheme&An optimal SGD version of sampling and temporal complexity, with optimal convex ML convergence rates\\
         \hline
    GBT-SGD&Filtering scheme&Presents the property of dimensional Byzantine resilience and generalized Byzantine failures\\
         \hline
    Tremean,Phocas&Filtering scheme&Two robust aggregation rules, along with proof of Byzantine resilience properties\\
         \hline
    DRACO&Coding scheme&Is based on algorithmic redundancy and incorporates coding theory concepts\\
         \hline
    Bulyan&Filtering scheme&Decreases the adversarial leeway that leads to sub-optimal models\\
         \hline
    Zeno&Filtering scheme&Uses a ranking-based preference mechanism when workers are suspected of being malicious\\
         \hline
    LearningChain&Blockchain&A decentralized privacy-preserving and secure machine learning system based on Blockchain and addresses and non-linear learning models\\
         \hline
   RSA&Filtering scheme&A collection of robust stochastic sub-gradient methods for distributed learning over heterogeneous datasets with an undetermined number of Byzantine workers\\
        \hline
   SIGNSGD&Filtering scheme&Is based on the sign of workers gradient vector and majority vote aggregation in the overall update\\
        \hline
   AGGREG-ATHOR&Filtering scheme&A rapid and lightweight framework that provides weak resilience through Multi-Krum and strong resilience via Bulyan\\
        \hline
   GuanYu&Filtering scheme&The first method for dealing with both Byzantine parameter servers and Byzantine workers\\
        \hline
   Trimmed mean&Filtering scheme&An aggregation rule-based on the mean aggregation rule that satisfies the condition of the dimensional Byzantine resilience\\
        \hline
   FABA&Filtering scheme&A fast aggregation algorithm that eliminates outliers from uploaded gradients and acquires gradients near genuine gradients\\
        \hline
   BRIDGE&Filtering scheme&A decentralized learning approach; it can learn effective models while dealing with a specific number of Byzantine nodes\\
        \hline
   LICM-SGD&Filtering scheme&A Lipschitz-inspired coordinate-wise median SGD method, which does not need to be aware of the Byzantine workers' number\\
        \hline
   Gradient-Filter CGC&Filtering scheme&A parallelized SGD method to deal with Byzantine faulty workers in synchronous settings, based on comparative gradient clipping\\
        \hline
   LIUBEI&Filtering scheme&Filtering out Byzantine servers without communicating with all servers and cutting down communication cycles\\
        \hline
   DETOX&(Filtering, coding) schemes&Is based on algorithmic redundancy and a robust aggregation method to deal with BFT in DML\\
        \hline
   RRR-BFT&Coding scheme&A deterministic and randomized scheme to tolerate Byzantine fault in the parallelized-SGD learning algorithm\\
        \hline
   Stochastic-Sign SGD&Filtering scheme&Is based on stochastic-sig; it improves privacy and accuracy by the compressor dp-sign and enhances the learning performance by using the error-feedback scheme\\
\end{tabular}

\bigskip
}
\end{table}

\begin{enumerate}
\item \verb|Byzantine fault tolerance approaches based on filtering schemes|:
\paragraph{\textbf{Krum and Multi-Krum}}
Blanchard et al. \cite{blanchard2017byzantine, blanchard2017machine} present the problem of tolerating Byzantine failure in the distributed SGD algorithms. The authors show that no aggregation rule in the previously proposed approach of \cite{blanchard2017byzantine} can tolerate one Byzantine failure. As the presence of only one attack means that the SGD algorithm does not converge, Krum is the proposed framework that allows defending against \textit{Gaussian} and \textit{Omniscient} Byzantine workers. This method to improve the tolerance of the SGD algorithm against adversarial workers is based on a combination of a convex function with a robust aggregation rule, which is a variant of the geometric median, with the assumption that $2f + 2 < n$.

More precisely, they defined the Krum aggregation rule as follows: for any  $i\neq j, i\rightarrow j$ denoted that $V_j\in(n - f - 2)$ approach vectors to $V_i$. For each worker $i$, the authors defined the score $s(i)$ where: $s(i)= \sum_{i\rightarrow j} \| V_i - V_j \|^2$. This sum belongs to the $n-f-2$ approaching vectors to $V_i$. Then, the authors defined the Krum function $KR(V_1, . . . , V_n)= V_{i_*}$, where, for all $i$: $s(i_*) \leq s(i)$.

Krum satisfies the Byzantine-resilient concept, which is founded from two conditions:
\begin{enumerate}
\item Lower bound on the scalar product of the vector F (the output vector) and g(the real gradient): the Euclidean distance generated by the aggregation rule between F and g must be minimum.

\item The moments of the correct gradient estimator G control the F's moments: that means this condition allows the aggregation rule to do this control instead of making it by the bounds on the moments of G that control the SGD dynamics' discrete nature's effects\cite{bottou1998online}.
\end{enumerate}
In the experimental evaluation, the authors defined Multi-Krum, a variant of Krum. Multi-Krum calculates the score as in the Krum function for each vector. Then, in multiple rounds of Krum, it takes the average on selected several vectors. The time complexity achieved by Krum is $O(n^2d)$.\\

\textit{Weaknesses:} Krum didn't converge in the non-convex function, and the Byzantine worker must be less than $n/2$.

\paragraph{\textbf{ByzantineSGD}}
Alistarh et al. \cite{alistarh2018byzantine} present the ByzantineSGD algorithm that solves the distributed stochastic convex optimization problem. Despite the $ alpha $ malicious Byzantine workers, the authors aim to converge to an optimum convex objective solution with this optimal variation of SGD. This method aggregates the reports sent by the machines using the median of means and tries to identify the honest workers by comparing their shared gradients with the median and then using the correct gradient information for parameter update.

ByzantineSGD achieves optimally two fundamental criteria (sample complexity and computational complexity). With few data samples, it should achieve high accuracy -sample complexity- and by distributing computation should achieve the preserving runtime speedups -computational complexity-. ByzantineSGD stays useful and converges when the dimension grows. So the authors prove the optimal robustness of the proposed algorithm.\\

\textit{Weaknesses:} ByzantineSGD didn't apply in the decentralized model, and it was less practical due to its need for the estimated upper bound of the variances of the stochastic gradients.

\paragraph{\textbf{GBT-SGD}}
Xie et al. \cite{xie2018generalized} to tolerate the Byzantine failure in the distributed synchronous SGD, a GBT-SGD (Generalized Byzantine-tolerant SGD) was proposed by the authors, which presented in three median-based aggregation rules. The attacks can be corrupt the model training where it converges slowly or make an incompatible converge to the lousy solution. The proposed aggregation rules based on median (GeoMed: geometric median, MarMed: marginal median, and MeaMed: mean around the median) prove the convergence to the good quality solutions by the synchronous SGD in a condition that $f < n/2$ for each dimension, and this property namely “dimensional Byzantine resilience”. The main advantages of this approach are ensuring aggregation rules convergence despite the Byzantine values and the low computation cost. According to the authors \cite{xie2018generalized} is the first approach that presents the property of dimensional Byzantine resilience (DBR) and generalized Byzantine failures (GBF) for synchronous SGD; also, it applies under non-convex settings.\\

\textit{Weaknesses:} GBT-SGD aggregation rules become incapable if more than half of the existing workers are Byzantine.

\paragraph{\textbf{Phocas, Trmean}}
Xie et al. \cite{xie2018phocas} presented the dimensional Byzantine-resilient algorithms (Phocas and Trmean), the Byzantine-resilient aggregation rules that are based on the generalized of the classic Byzantine resilience property \cite{blanchard2017machine}. The first condition is that the number of correct workers is higher than Byzantine workers \cite{xie2018generalized}. The authors define trimmed-mean-based aggregation rule Trmean, which is used to describe another aggregation rule, Phocas. The proposed rules use fewer assumptions and guarantee the convergence in the synchronous SGD, which is proved for the general smooth loss functions. According to the results of the experiments, Phocas and Trmean are performing, and it has linear time complexities.\\

\textit{Weaknesses:} Trmean's worst is under omniscient attack, which slows down the convergence and is difficult to implement in reality.

\paragraph{\textbf{Bulyan}}
El Mahdi et al. \cite{el2018hidden} treat the problem of the lousy convergence of SGD to an ineffectual model in the context of poisoning attacks in high dimension $d\gg 1$ with non-convex loss function, where the authors show the deficiency of the existing approaches which proven resilient despite the existing of Byzantine workers \cite{chen2017distributed, blanchard2017machine}. The proposed solution is the Bulyan algorithm, a defense hybrid mechanism. To pick the true gradients, it uses the geometric-median-based method, and to determine the update direction, it uses the coordinate-wise trimmed mean method. Bulyan reduces the leeway of an attacker (Byzantine workers) to an upper-bounded of $O(1\sqrt{d})$ and converges to successful learning models comparable to the reasonable benchmark.\\

\textit{Weaknesses:} Bulyan does not treat all the attacks problems.

\paragraph{\textbf{Zeno}}
Xie et al.\cite{xie2018zeno} generalized the works as the evasion and exploratory attacks \cite{xie2018generalized, xie2018phocas} and proposed Zeno. This new robust aggregation rule suspects the Byzantine workers in the SGD's distributed synchronous by using the weakest assumption (the existence of one correct worker at least).\\

\textit{Weaknesses:} Zeno requires the presence of a validation dataset on the parameter server, which is impractical in some circumstances.

\paragraph{\textbf{RSA}}
Li et al. \cite{li2019rsa} proposed RSA (Byzantine-Robust Stochastic Aggregation methods)to mitigate the Byzantine attacks' negative effects and make the learning task robust. RSA is a collection of resilient stochastic algorithms created to prevent Byzantine attacks on heterogeneous data sets. It used an aggregation of models to obtain a consensus model. In RSA, no assumption that the data are independent and identically distributed ( i.i.d. ).
Firstly, and by using subgradient recursions, the authors propose $\ell_1$-norm RSA (Byzantine-robust stochastic aggregation), which is robust to arbitrary attacks from Byzantine workers, due to the introduction of the $\ell_1$-norm regularized problem, which minimizes every variable of workers to be close to the master's variable. After that, the authors generalize the $\ell_1$-norm regularized problem to the $\ell_p$-norm regularized problem. The latter helps alleviate the Byzantine workers’ harmful influence.
As an advantage, the resulting SGD-based (RSA) methods have a convergence rate: the near-optimal solution, where the learning error depends on the number of Byzantine workers. Also, both SGD and RSA have a similar convergence rate in the Byzantine-free settings, which is an optimal solution at a sub-linear convergence rate.\\

\textit{Weaknesses:} the numerical test shows that $\ell_\infty$-norm does not offer competitive performance.

\paragraph{\textbf{SIGNSGD}}
Bernstein et al. \cite{bernstein2018signsgd} explored the SIGNSGD algorithm to obtain robust learning, where the set of workers, instead of transmitting their gradients, send only the sign of their gradient vector to the server. By majority vote, the global update is decided.

The authors assume that (fast algorithmic convergence, good generalization performance, communication efficiency, robustness to network faults) as a goal that achieved by the SIGNSGD as follows:
\begin{itemize}
\item The authors proposed compressing all communication among the server and the workers to one bit to attain communication efficiency.

\item Methods based on folk signs are performing well, which means SIGNSGD can quickly achieve algorithmic convergence. SIGNSGD provides a theoretical basis for fast algorithmic convergence in the mini-batch, and the authors show that its behavior changes theoretically from a high to low signal-to-noise ratio.

\item SIGNSGD accredited by majority vote theory to aggregate gradients to achieve robustness to network faults, which means that no individual worker has too much power. Despite the assumed model that considers robustness to Byzantine workers or to a worker that reverses their gradient estimate, it is still not the most general. However, SIGNSGD can achieve Byzantine fault tolerance, while the good generalization performance is immediate.
\end{itemize}
After the above theoretical guarantees, the authors give empirical validation.

As advantages, the authors prove the convergence of SIGNSGD in large and mini-batches, decrease communication by iteration compared to distributed SGD, and when more than half of the workers are Byzantine; SIGNSGD proves the robustness of majority voting, unlike SGD.\\

\textit{Weaknesses:} majority voting may require more optimization to prevent a single machine from becoming a communication bottleneck. Also, SIGNSGD still has a test set gap, and it fails to converge when the computing units are heterogeneous.

\paragraph{\textbf{AGGREGATHOR}}
Damaskinos et al. \cite{damaskinos2019aggregathor} presented AGGREGATHOR to leverage more workers to speed up learning. AGGREGATHOR was built around TensorFlow\footnote{TensorFlow is one of the Deep Learning frameworks. These Deep Learning frameworks may be interfaces or libraries that serve Data Scientists and ML Developers to develop Deep Learning models. Other frameworks include PyTorch, Keras, MXNet, and more.} and aimed to achieve two goals:
\begin{itemize}
\item The robust and distributed training on TensorFlow will be faster in the development and test cases.
\item In the second goal, the authors want to enable the deployment of Byzantine-resilient learning algorithms exterior the academic environment.
\end{itemize}
Each worker might communicate with the server duplications, and use the model sent by 2/3 of the duplications. As GAR and updating the model in the server are deterministic, good servers will present identical models to workers.

We can cite the advantages of the proposed framework in the following points:
\begin{itemize}
\item In the case of a saturated network, AGGREGATHOR used the communication protocol UDP instead of TCP, which provides a further speed up and makes it a performance booster for TensorFlow. And this advantage allows avoiding losing accuracy.
\item Through MULTI-KRUM \cite{blanchard2017byzantine}, AGGREGATHOR ensures the first level of robustness (weak resilience), and by BULYAN \cite{el2018hidden}, it provides the second level of robustness (strong resilience).
\item AGGREGATHOR has addressed a TensorFlow weakness to achieve Byzantine resilience.
\item AGGREGATHOR is used securely in the training process to distribute any ML model developed for TensorFlow.\\
\end{itemize}

\textit{Weaknesses:}
the overhead of AGGREGATHOR, Furthermore, the interaction between gradient descent's specificity and the state machine replication technique used by AGGREGATHOR will be difficult to implement efficiently.

\paragraph{\textbf{GuanYu}}
El-Mhamdi et al. \cite{el2019sgd} presented GuanYu, theoretically is the first algorithm that tolerates Byzantine parameter servers and Byzantine workers.

For each step of synchronous distributed SGD and to update the parameter vector, GuanYu uses several gradient aggregation rules (GAR) to aggregate all worker gradient estimates into one gradient. The authors use a contraction argument, taking advantage of the geometric properties of the median in high dimensional spaces, to demonstrate the Byzantine resilience of the proposed algorithm. Within each non-Byzantine server, this argument aims to avoid any drift on the models (with probability 1).

As an advantage of GuanYu, it achieves optimal convergence and asynchrony. Also, the authors built GuanYu on TensorFlow and deployed it in a distributed configuration. Consequently, compared to TensorFlow vanilla's deployment, the authors show that GuanYu can tolerate Byzantine behavior with reasonable overhead.\\

\textit{Weaknesses:} GuanYu's assumption of a limited difference between models on correct parameter servers cannot be implemented in some cases.

\paragraph{\textbf{Trimmed mean}}
TianXiang et al. \cite{ tianxiang2019aggregation} introduced the concept of Byzantine resilience; they proposed a new aggregation rule, Trimmed mean based on the mean aggregation rule. The proposed aggregation rule indicates the optimization direction, and in the dataset, it refers to the data pruning, and the data with the most significant difference is eliminated. Trimmed mean achieves several advantages as the satisfaction of the Byzantine resilience conditions, a nearly linear time complexity O(dnlogn). When the authors compare the Trimmed mean with the set of aggregation rules, they prove its robustness, where it can still converge to the optimal global solution.\\

\textit{Weaknesses:} Trimmed mean can be applicable only in the convex environment.

\paragraph{\textbf{FABA}}
Xia et al. \cite{xia2019faba} proposed FABA, which helps the participating workers obtain correct gradients and avoid outliers in the distributed training. FABA is a fast aggregation algorithm against Byzantine attacks, which is based on four essential things in the input phase:
\begin{itemize}
\item The set of workers where it computed the gradients.
\item The weights.
\item The learning rate.
\item The Byzantine workers assumed proportion.
\end{itemize}

Considering that $G_{mean}$ is the mean of all the gradients uploaded from workers, the FABA algorithm is executed as follows:

\begin{enumerate}
\item If the number of attack gradients $(k)$ is strictly less than the multiplication of all the gradients uploaded from the workers and The supposed proportion of Byzantine workers, FABA continues its execution; otherwise, it goes to step $5$.
\item Calculate $G_{mean}$ as $g0$.
\item For each gradient in $G_{mean}$, calculate the difference between $g0$ and it. Remove the one with the biggest difference from $G_{mean}$.
\item In this step, FABA adds $1$ to the number of attack gradients, $ k = k + 1$, and returns to step $1$.
\item Calculate the $G_{mean}$ as an aggregation result at a specific time.
\item Update the weights and return them to each worker.
\end{enumerate}
Many advantages of the proposed algorithm FABA; Its easy implementation; in the presence of Byzantine workers, FABA is fast to converge, and it can adaptively adjust performance. Its ability to achieve the same performance and accuracy as the non-Byzantine case, and compared to the previous algorithms of FABA, shows a higher efficiency. The authors also show that the FABA algorithm’s aggregation gradients are close to the indeed calculated gradients by honest workers. The authors proved that these true gradients bounded the gradients in the aggregation’s moments.\\

\textit{Weaknesses:} Among FABA's satisfaction conditions, the condition that ensures that all gradients from honest workers collect together and that their difference is small. This requirement is simple to satisfy when the dataset that each worker receives is consistently selected, and the batch size is not too tiny, which is not the case when each worker has their own private datasets, and the distribution of the datasets is unknown.

\paragraph{\textbf{BRIDGE}}
Yang and Bajwa \cite{yang2019bridge} presented BRIDGE (Byzantine-resilient decentralized gradient descent), a new decentralized learning method, which is a particular case of the distributed gradient descent (DGD) algorithm \cite{nedic2009distributed}. Compared to the DGD algorithm, the BRIDGE algorithm has a screening step before each update, making it Byzantine resilient. The screening method called coordinate-wise trimmed mean allows the elimination of all b values (largest and smallest) in each dimension, where b presents the bound of Byzantine nodes that the algorithm can tolerate. Therefore, the authors combine dimension-wise trimmed mean with decentralized gradient descent to solve the problem of decentralized vector-valued learning under Byzantine settings. The authors show the efficiency of the proposed algorithm to deal with decentralized vector-valued learning issues, provide theoretical assurance for the strongly convex problems, and show by numerical experiments the utility of BRIDGE on non-convex learning problems.\\

\textit{Weaknesses:} Because of the distance-based design strategy utilized, BRIDGE is still susceptible to some Byzantine attacks.

\paragraph{\textbf{LICM-SGD}}
Yang et al. \cite{yang2019byzantine} proposed Lipschitz-inspired coordinate-wise median (LICM-SGD) to mitigate Byzantine attacks.
As this intuition: "benign workers should generate stochastic gradients closely following the Lipschitz characteristics of the true gradients." the proposed LICM-SGD algorithm is inspired. Each true worker makes the stochastic gradient calculation based on the mini-batch and sends the result to the PS in the training process. The PS receives an arbitrary value in the case of a Byzantine worker. The PS and when it gets all stochastic gradients from the set of the workers, it computes the coordinate-wise median. In the last step, and before that, LICM-SGD updates the parameter vector, which makes the selection of true gradients based on Lipschitz characteristics. LICM-SGD features several advantages, as:
\begin{itemize}
\item In the non-convex setting, LICM-SGD converges certainly to the stationary region, where it can face up to half of the Byzantine workers.
\item For the practical implementations, LICM-SGD is interesting, where it needs no information on the attackers' number and the Lipschitz constant.
\item LICM-SGD has an optimal computational time complexity, as the standard SGD's time complexity under no attacks.
\item As its low computational time complexity, LICM-SGD achieves a faster running time.\\
 \end{itemize}

\textit{Weaknesses:}
LICM-SGD method is based only on the i.i.d data.

\paragraph{\textbf{Gradient Filter CGC}}
Gupta and Vaidya \cite{gupta2019byzantine_b} proposed the gradient-filter CGC $(Comparative$ $Gradient$ $Clipping)$ to achieve a solution for the linear regression problem by the master and to alleviate the Byzantine faulty workers' harmful effects, also to enhance the gradient aggregation phase of the parallelized SGD method. With the assumption of $ n > 2f $, the CGC works as follows, in each iteration, the algorithm work on clipped the set of the $f$ largest gradients to the $2$-norm, which is equal to the $2$-norm of, either the $(f +1)$-th largest gradient, or the $(n - f )$-th smallest gradient, and the rest of gradients remain unchanged. The resulting gradients are averaged in the next update of the current estimate.

As an advantage, a good estimate of the regression parameter w was obtained by the parallelized SGD where the number of defective Byzantine workers is less than half the number of participating workers, also in the case of $n = f$, the upper limit of the guarantee estimation error, increases only linearly.\\

\textit{Weaknesses:}
The synchronous master-workers system used by this approach still seems to be subject to a single point of failure.

\paragraph{\textbf{LIUBEI}}
El Mhamdi et al. \cite{mhamdi2019fast} presented the new work LIUBEI. LIUBEI, compared to standard non-Byzantine resilient algorithms, is a resilient Byzantine ML algorithm that does not trust any individual network component. This mechanism is based on the gradient aggregation rules (GARs), network synchrony, and Lipschitz continuity of the loss function. It replicates the parameter server on multiple machines to tolerate the Byzantine workers. The authors build LIUBEI using TensorFlow. LIUBEI introduces a new filtering mechanism used by workers to avoid extracting a suspected model from a parameter server composed of two components: the Lipschitz filter and models filter. The authors show that utilizing the Lipschitz filter without the model filter and vice versa does not ensure Byzantine resilience. The Lipschitz filter component is used in the filtering mechanism to limit the models' growing gradients. It uses the models' filter to limit the distance between models on the correct servers in two successive iterations. This bounded distance is guaranteed by the use of the $scatter / gather$ proposed protocol, which works iteratively in two main phases ($scatter$ and $gather$).

In the scattering phase:
\begin{enumerate}
\item The set of parameter servers is working on its local date.
\item There is no communication among the parameter servers.
\item Each worker in each iteration communicates with $f_{ps} + 1$ server to pull the model ($f_{ps}$: the set of servers which can be Byzantine).
\item Such a step continues for T learning iterations.
\end{enumerate}

And in the gather phase:
\begin{enumerate}
\item To aggregate the models, the set of parameter servers communicate together.
\item By the set of workers, LIUBEI aggregates models from all servers.
\item Such a step is carried out for a single learning iteration.
\end{enumerate}
Theoretically, the authors prove many advantages of LIUBEI, as Byzantine resilience obtained on both sides, servers, and workers, guarantees convergence, an accuracy loss of around 5\%, and about 24\% convergence compared to vanilla TensorFlow. Also, the throughput gain is 70\% compared to the Byzantine–resilient ML algorithm, which supposes an asynchrony of the network.\\

\textit{Weaknesses:} LIUBEI still requires more study in the context of enhancing convergence by using the gather step more often, as well as the overhead of communication in this step, which depends on data and model.

\paragraph{\textbf{Stochastic-Sign SGD}}
Jin et al. \cite{jin2020stochastic} are based on SIGNSGD \cite{bernstein2018signsgd} and used novel stochastic-sign-based gradient compressors to propose Stochastic-Sign SGD and another error-feedback of the proposed algorithm Stochastic-Sign SGD to enhance the federated learning performance. At first, the authors offer two stochastic compressors, sto-sign, and dp-sign. The sto-sign compressor extends to Sto-SIGNSGD. Workers in this scheme implement two-level stochastic quantization and send out the signs of quantized results as an alternate of directly passing signs of gradients. In addition, to ensure robustness and 1-bit compressed communication between server and worker, Sto-SIGNSGD used the majority vote rule in gradient aggregation. Then, a dp-sign differentially private stochastic compressor is proposed and extended to DP-SIGNSGD to improve privacy and accuracy and preserve communication efficiency. In addition, the authors developed the proposed algorithm for the Error-Feedback Stochastic-Sign SGD scheme, which exhibited the Stochastic-Sign SGD error feedback. In the majority vote operation, an error can be provoked, and the server uses this scheme to keep track of this error to compensate it during the next communication cycle.

With the objectives achieved above, the proposed approach can deal with heterogeneous data distribution. The authors prove its convergence with the same rate as SIGNSGD in the situation of homogeneous data distribution. In addition, the authors theoretically guaranteed the Byzantine resilience of their proposed approaches.\\

\textit{Weaknesses:} The significant perturbation produced by local DP reduces accuracy.

\begin{table}[H]
  \caption{Summary of some recent results concerning synchronous BFT in DML.($\checkmark$): means that the type of attack it takes into consideration in the analyzed approach, ($\times$) means the reverse of $\checkmark$, and ($-$) means that, to the best of our knowledge, information is not supplied in the original resource or other studies. $n$: The total number of worker machines. $f$: Byzantine workers. $d$: The model dimension.}
  \label{tab:attackSum}
  \begin{minipage}{\columnwidth}
  \begin{center}
  \small
  \begin{tabularx}{\linewidth}{llllllll}

\toprule
    Approach&\parbox[t]{2cm}{Time complexity}&\parbox[t]{2.5cm}{Condition on Byzantine workers number}&\parbox[t]{1cm}{Gaussian attack}&\parbox[t]{1.5cm}{Omniscient attack}&\parbox[t]{1cm}{Bit-ﬂip attack}&\parbox[t]{1cm}{Gambler attack}&\parbox[t]{1cm}{sign-ﬂipping attack}\\
    \midrule

   Krum, Multi-krum&$ O(n^2 d) $&$n > 2 f + 2$ &$\checkmark$&$\checkmark$&$\times$&$\times$&$\times$\\
   GBT-SGD(GeoMed)&$ O (nd log^3 1/\varepsilon)$&$n>2f$&$\checkmark$&$\checkmark$&$\checkmark$&$\checkmark$&$\times$\\
   GBT-SGD(MarMed)&$O(dn log n)$&$n>2f$&$\checkmark$&$\checkmark$&$\checkmark$&$\checkmark$&$\times$\\
   GBT-SGD(MeaMed)&$O(dn)$&$n>2f$&$\checkmark$&$\checkmark$&$\checkmark$&$\checkmark$&$\times$\\
   Phocas and Trmean&$O(dn)$&$n>2f$&$\checkmark$&$\checkmark$&$\checkmark$&$\checkmark$&$\times$\\
   Zeno&$O(nd)$&unbounded number&$\times$&$\checkmark$&$\times$&$\times$&$\checkmark$\\
   RSA&$-$&unbounded number&$\times$&$\times$&$\times$&$\times$&$\checkmark$\\
   SIGNSGD&$-$&$n>2f $&$\checkmark$&$\times$&$\times$&$\times$&$\times$\\
   Trimmed mean&$O(dnlogn)$&$n > 2f $&$\checkmark$&$\checkmark$&$\times$&$\times$&$\times$\\
   FABA&$-$&$f .n, f<0.5$&$\checkmark$&$\times$&$\times$&$\times$&$\times$\\
\bottomrule

\end{tabularx}
\end{center}
\bigskip
\end{minipage}
\end{table}
\item \verb|Byzantine fault tolerance approaches based on coding schemes|:

\paragraph{\textbf{DRACO}}
Chen et al. \cite{chen2018draco} Present the first work, which deals with the Byzantine workers by using a specific encoding scheme with the redundant gradient calculations. More clearly, DRACO treats the problem of adversarial computes nodes based on coding theory to achieve robust distributed training. DRACO is the proposed framework to eliminate the adversarial update's effects by the parameter server (PS); this one uses the redundant gradients evaluated by each computes node. Firstly PS detects the arbitrarily malicious compute nodes; after that, by the correct nodes shipped the gradient updates, PS recovers the correct gradient average; by this method, DRACO removes the Byzantine values. DRACO applies to many training algorithms (the authors focus on mini-batch SGD) and is robust to adversarial compute nodes. Maintaining the correct update rule, DRACO achieves the theoretical lower bound of redundancy, which is necessary to resist adversaries.\\

\textit{Weaknesses:} The main limits of this framework are that it defends against a few numbers of Byzantine workers and the reduced performance of inexact models by their updating.

\paragraph{\textbf{DETOX}}
The authors in \cite{rajput2019detox} present a Byzantine-resilient distributed training framework, DETOX. This framework applies to PS architecture and is based on two steps. Firstly it uses the algorithm's redundancy to filter the majority of the Byzantine gradients. In the second step, DETOX performs a hierarchical robust aggregation method, where it makes a few groups by the partition of filtered gradients and aggregates them. After that, and to minimize the remaining traces' effect of the original Byzantine gradients, it uses any robust aggregator to the averaged gradients. As an advantage of this framework, its scalability and flexibility, and nearly linear complexity, and when it combines with any previous robust aggregation rule, DETOX improves its efficiency and robustness. Also, when compared to the vanilla implementations of Byzantine-robust aggregation, DETOX increases accuracy to 40\% in the event of heavy Byzantine attacks.\\

\textit{Weaknesses:} DETOX needs PS as an owner to partition the data among the workers, which breaks the data privacy.

\paragraph{\textbf{RRR-BFT}}
Gupta and Vaidya \cite{gupta2019randomized} proposed two schemes (deterministic and randomized) for guaranteeing exact fault-tolerance \footnote{ The authors in \cite{gupta2019randomized}expressed that despite the presence of Byzantine workers, a parallelized-SGD method has exact fault-tolerance if the Master asymptotically converges to a minimum point w (w is a minimum point of the average loss evaluated for the data points.) exactly.} in the parallelized-SGD method. These schemes are based on the "computation efficiency" \footnote{ The computation efficiency of the coding scheme was presented by the ratio of two types of numbers. The first is the gradient's number used for parameter update, and the second is the gradient's number computed in total by the workers.} of a coding scheme, and the authors considered the case where $f (< n=2) $ of the workers are Byzantine faulty. If Byzantine workers could send failure data to the Master, the proposed approach used the reactive redundancy mechanism to identify and isolate this type of worker.

In the deterministic scheme:
\begin{enumerate}
\item The master uses a symbol (fault detection code) at each iteration.
\item The master used the reactive redundancy mechanism when it detected any fault(s) to correct the faults and identify the Byzantine worker that caused the fault(s).
\end{enumerate}

In the randomized scheme:
\begin{enumerate}
\item This scheme is used to improve upon the deterministic scheme's computation efficiency. Instead of using all iterations, the fault-detection codes used by the master are chosen randomly in the intermittent iterations.
\end{enumerate}

The main advantage of this work is the exact fault tolerance and favorable computation efficiency. The master can optimize the compromise between the expected calculation efficiency and the parallelized learning algorithm's convergence rate.\\

\textit{Weaknesses:}
RRR-BFT is still susceptible to a single point of failure.\\

\item \verb|Byzantine fault tolerance approaches based on Blockchain|:

\paragraph{\textbf{DeepChain}}
Weng et al. \cite{weng2019deepchain} presented DeepCHain for privacy-preserving deep learning training to provide auditability and fairness; this approach is a Blockchain-based technology and a decentralized mechanism to solve the perturbation problem in the collaborative training process, which caused by the malicious participants. DeepCHain is an incentive mechanism that pushes the participants to behave honestly for the training's correctness (collect gradients and update parameters) and jointly to share the obtained local gradients. The developed prototype proves DeepChain's performance in terms of confidentiality, auditability, and fairness.\\

\textit{Weaknesses:} the security challenge should be re-defined if DeepChain expands potential models' value to transfer learning.

\paragraph{\textbf{LearningChain}}
Chen et al. \cite{chen2018machine} discussed privacy and security problems in the linear/ non-linear learning models; the authors propose a framework based on Blockchain technology called LearningChain. LearningChain is a decentralized, privacy-preserving, and secure machine learning system. Explicitly, it consists of three processes. The first one is the \textit{Blockchain Initialization}; in this process, the computing nodes and data holders establish a connection and construct a fully decentralized peer-to-peer network. On the initial learning model settings, reach a consensus. The second process is the \textit{Local Gradient Computation}: based on the actual global model and common loss function, the data holders create pseudo-identities and calculate the local gradients. In the following, to perturb their local gradients, they use a differential privacy scheme. Finally, the messages are broadcast to all compute nodes after the computed local gradients are encapsulated with other related information. The third process is the \textit{Global Gradient Aggregation}: finding a solution to a mathematical puzzle is a condition of the computing nodes that compete for permission to add a new block to the chain. The aggregation scheme of tolerance to Byzantine attacks applies as soon as a compute node wins the game to aggregate the local gradients. And to update the model parameters w, it calculates the global gradient. Finally, the associated information adds a newly created block to the chain.
LearningChain can train a global predictive model by repetitively performing local gradient computation and global gradient aggregation by participants' collaboration in the network while keeping their own data privacy.

In summary, the advantages of the proposed approach are as follows:
The authors designed the decentralized Stochastic Gradient Descent (SGD) algorithm to learn a general predictive model over the Blockchain. In the latter, the authors develop a differential mechanism based on privacy to protect each party's data privacy. And to protect the system and defend against any possible Byzantine attacks, they come up with a $l$-nearest aggregation algorithm. In the implementation phase, the authors prove the LearningChain efficiency and effectiveness on Ethereum, also by its extension, LearningChainEx applied to all types of Blockchain.\\

\textit{Weaknesses:} LearningChain used the proof-of-work consensus, which requires substantial energy for every transaction. However, the energy efficiency has not been verified.
\end{enumerate}

\subsubsection{Synchronous training Byzantine fault tolerance approaches in other machine learning optimization methods}
\begin{enumerate}
\item \verb|BFT approaches based filtering schemes|:
\paragraph{\textbf{DSML-Adversarial}}
Chen et al. \cite{chen2017distributed} considered the decentralized systems to solve the problem of distributed statistical learning with existing Byzantine attacks. To achieve their goal, they aim to offer a robust algorithm, where the system in dimension $d$, can learn the real underlying parameter. Hence, the authors propose a new variant of standard gradient descent based on the geometric median aggregation rule.
They address the challenges facing Federated Learning (Security, Small local datasets versus high model complexity, Communication constraints) and propose their Byzantine gradient descent method. The latter is executed as follows:

The parameter server partitions the set of working machines $n$ into $k$ batches. At each iteration, to augment the Byzantine-free batches’ resemblance and stop the Byzantine machines’ interruption, it groups the gradients received in non-superimposed batches. After that, it computes the mean of each local received gradient in each batch. Then, it calculates the geometric median of the “k” batch means. Finally, it performs a gradient descent update with the aggregated gradient.

As advantages: the development method can tolerate Byzantine failures. With a small number of local data, it can learn a very complex model; also, it achieves a fast exponentially convergence.\\

\textit{Weaknesses:} the training data does not distribute equally, the irregular availability of mobile phones, and the algorithm does not adapt to the asynchronous parameter. Also, Federated Learning gives users control over their data through the ability to store training data locally. However, this data must be extracted to get a high-quality model trained. Therefore, the proposed algorithms must provide a precise description of the minimum confidentiality that has to be sacrificed in the Federated Learning paradigm.

\paragraph{\textbf{ByzRDL}}
Yin et al. \cite{yin2018byzantine} made a study around the BRDSL (Byzantine-robust distributed statistical learning) algorithms to solve the optimal statistical performance problem. The authors, based on the standard statistical setting of empirical risk minimization (ERM). In the goal of achieving the $Statistical$ $optimality$ and $Communication$ $efficiency$ simultaneously, they propose three algorithms. Two distributed gradient descent algorithms, where the first one is based on the coordinate-wise median, and the second is based on the coordinate-wise trimmed mean. The latest is the median-based robust algorithm, which only needs one communication round. The authors prove the statistical error rates for the three types of population loss functions (strongly convex, non-strongly convex, and non-convex) and the algorithms’ robustness against Byzantine failures. They verify the optimal error rates of the proposed algorithms: Under mild conditions, the median-based GD and Trimmed-mean-based GD achieve the order optimal for strongly convex loss. The median-based one-round algorithm achieves the optimal rate for strongly convex quadratic losses, similarly to the optimal error rate achieved by the robust distributed gradient descent algorithms. When the Byzantine workers are up to half of all workers, ByzRDL achieves convergence.\\

\textit{Weaknesses:} in the case where the Byzantine workers are more than half of all workers, ByzRDL does not converge.

\paragraph{\textbf{DGDAlgorithm}}
Cao et al. \cite{cao2019distributed} proposed an algorithm DGDAlgorithm Robust (Distributed Gradient Descent Algorithm Robust) to solve the problem of arbitrary Byzantine attackers which falsified the data. DGDAlgorithm based on the gradient computes then it tested the data sent by the workers. In the first step, the algorithm asks the PS to select a small set of clean data randomly. The next step is to compute a noisy version of the true gradient by selecting a small dataset at each iteration $t$. Finally, the unused information sent by the arbitrary workers is filtered by the noisy gradient, where the parameter server accepts the receiving gradients from the workers if the difference is within a threshold after it compares them with the noisy local gradients. Despite the existence of Byzantine workers, the authors prove the convergence towards the optimal value by the proposed algorithm.\\

\textit{Weaknesses:} DGDAlgorithm remains inapplicable on the non-convex cost function, vulnerable to the single point of failure due to the collection of gradients required on the parameter server. The threshold requires a manual adjustment.

\paragraph{\textbf{Securing-DML}}
Su and Xu \cite{su2018securing} propose a secured variant of the classical gradient descent method to tolerate the Byzantine workers in distributed/decentralized learning system. The authors considered the full gradient descent method and the $ d $–dimensional model. Based on the entire local sample, the proposed method asked each non-defective worker to calculate the gradient, then used the proposed filtering approach \cite{steinhardt2018resilience} for the problems of robust mean estimation to aggregate the gradients reported by the external workers robustly in the distributed statistical learning setting. The highly dependent among the iterations and the associated gradients can cause the arbitrary behavior of a set of Byzantine workers. To manage this unspecified dependence, the authors propose to set the sample covariance matrix's concentration of gradients uniformly at all possible model parameters.
Under the sub-Gaussian gradients assumption, the authors \cite{charikar2017learning} derived the same uniform convergence concentration of the sample covariance matrix. In the simplest linear regression example, they show the sub-exponential instead of sub-Gaussian gradients. Therefore, in \cite{su2018securing}, the authors develop a new concentration inequality for sub-exponential distributions’ sample covariance matrices, which might be of independent interest.

The version proposed of full gradient descent method can tolerate up to descent a Byzantine workers’ regular fraction and with $ O(logN) $ ($ N $: total number of data points distributed across $n$ workers) communication rounds, it converges to a statistical estimation error on the order of $ O(\sqrt{f/N} + \sqrt{d/N}) $.\\

\textit{Weaknesses:} Securing-DML remains inapplicable to the non-convex cost function.

\paragraph{\textbf{ByzantinePGD}}
Yin et al. \cite{yin2019defending} developed an algorithm, namely ByzantinePGD (Byzantine Perturbed Gradient Descent), to solve the real security problems in large-scale distributed learning, which are due to the existence of Byzantine machines with a non-convexity loss function. ByzantinePGD is based on the PGD algorithm described in \cite{jin2017escape} and employs the following strategy to combat Byzantine workers:

\begin{enumerate}
    \item It uses the three robust aggregation rules (median \cite{kogler2016efficient}, trimmed mean, iterative filtering \cite{diakonikolas2019robust, diakonikolas2017being, steinhardt2018resilience}), where the authors present GradAGG and ValueAGG subroutines that collect gradients and function values robustly from workers. These subroutines use the terminology of inexact oracle to formalize the guaranteed accuracy.
    \item It escapes saddle points by random perturbation in multiple rounds.
\end{enumerate}
By this method, the authors prove that ByzantinePGD converges to an approximate local minimizer and escapes the saddle points with the existence of the Byzantine machine and the nonconvex function.\\

\textit{Weaknesses:}  ByzantinePGD is still near-optimal in the high-dimensional setting

\paragraph{\textbf{ByRDiE}}
Yang and Bajwa \cite{yang2019byrdie} proposed the Byzantine resilient distributed coordinate descent (ByRDiE) algorithm to deal with Byzantine failures in decentralized settings. The authors proposed two main contributions in this work, where the algorithmic aspects of ByRDiE are leveraged on two separate lines of prior work. The first one, with Byzantine failures, an inexact solution is possible in certain types of scalar-valued distributed optimization issues \cite{su2015fault, su2016fault}. Second, break down the optimization problems of vector-valued into a sequence of scalar-valued problems with coordinate descent algorithms \cite{wright2015coordinate}. This phase represents the first main contribution of the proposed work and the second main contribution presented by the theoretical analysis. In particular, ByRDiE divides the empirical risk minimization (ERM) problem into P one-dimensional sub-problems using coordinate descent and then uses the Byzantine resilient approach presented in \cite{su2015fault} to solve each scalar-valued sub-problem.
The proposed ByRDiE and the theoretical results ensure its ability to minimize the statistical risk in a fully distributed environment (Decentralized settings). The authors also prove the resilience of ByRDiE to cope with Byzantine network failures for distributed convex and non-convex learning tasks.\\

\textit{Weaknesses:} ByRDiE still needs to strengthen its results regarding near-safe convergence and derivation of explicit convergence rates. Moreover, ByRDiE is still vulnerable to various Byzantine attacks and requires additional theoretical study to functions of constant step size and non-convex risk functions.

\paragraph{\textbf{SVRG-AdversarialML}}
Bulusu et al. \cite{bulusu2019convex} chose to use the stochastic variance reduced gradient (SVRG) optimization method to trait the problem of Byzantine workers in distributed settings. In the convex case, the authors consider $n$ workers and the finite-sum problem and propose a new robust variant of SVRG, where if the objective function $F$ is convex with the existing of $f$-fraction of Byzantine workers, the SVRG proposed algorithm serves to:

\begin{enumerate}
\item Firstly, finds an optimal point $x$ within $T$ iterations $ ( T= \tilde{O}(\frac{1}{\gamma}+\frac{1}{n\gamma^2}+\frac{f^2}{\gamma^2}))$, with $\gamma$ denotes the discount factor.
\item Secondly, $\mathbb{E}[F(x)- F(x^*)] $ must be satisfied.
\end{enumerate}
To achieve the SVRG's robustness, the authors calculate for each worker the intermediate gradients’ average through the number of iterations and calculate the median through all workers as the aggregation rule \cite{alistarh2018byzantine}.
As an advantage of the proposed variant of the SVRG algorithm, the authors prove its convergence in the convex case and show its robustness in the adversarial settings (adversarial attacks and reduced variance).\\

\textit{Weaknesses:} SVRG-AdversarialML algorithm remains inapplicable in non-convex and strongly convex cases.

\paragraph{\textbf{DRSL-Byzantine Mirror Descent}}
Ding et al. \cite{ding2019distributed} developed a distributed robust learning algorithm based on mirror descent \cite{bubeck2015convex} to solve the distributed statistical learning problem, safeguard against adversarial workers, and share fault information in a high-dimensional learning system. Considering that $ f $ represents the set of Byzantine workers from $ n $ workers, DRSL-Byzantine Mirror Descent deals against these Byzantine workers for $f \in [ 0.1⁄2)$ using the median aggregation rule. Knowing that the authors define two different formulations of the sum of the population $  B_T^i $ and $ A_T^i$, they describe the robust variant of mirror descent to the Byzantine setting as follows:
\begin{enumerate}
	\item For each honest worker $ (i) $, by the martingale concentration, $ B_T^i $ will concentrate in each iteration $t \in [T] $, on the population sum $B_T^\star$ of the gradient $ \bigtriangledown_t$, with an utmost deviation of $ \sqrt{T}$.
	\item The authors define a set of workers' machines as Byzantine machines if they are too far from the mean.
	\item With a small deviation in terms of $ B_t^i$, some Byzantine machines can be hidden.
	\item Hence, the authors identify such Byzantine machines by the martingale concentration for $ A_T^i$. In the case where $ A_T^i $ is too far away from the population sum $A_T^\star$, the authors consider them Byzantine machines.
	\item After that comes the step of removing the set of Byzantine workers and putting the rest in the set $\Omega_{t}$ (estimated collection of honest machines at iteration $t$).
\end{enumerate}
As advantages:
The proposed method is robust against the Byzantine workers for $ f  \in [0.1⁄2)$, also it achieves a statistical error bound $ O(1⁄\sqrt{nT}+ f⁄\sqrt{T}) $ for $T$ iterations in the convex and smooth objective function. This result concludes for a normed spaces' large class, and it corresponds to the known statistical error for the Byzantine stochastic gradient in the Euclidean space' framework. Byzantine mirror descent algorithm depends on dimension to the bound scales with the dual norm of the gradient, and in particular, its features depend logarithmically on the problem dimension d for probability simplex.\\

\textit{Weaknesses:} DRSL-Byzantine Mirror Descent is vulnerable to a single point of failure.

\paragraph{\textbf{MOZI}}
Guo et al. \cite{guo2020towards} proposed MOZI, a new Byzantine Fault Tolerance Algorithm (BFT) in decentralized learning systems. With an arbitrary number of faulty nodes,  MOZI allows the honest node to train a correct model under powerful Byzantine attacks thanks to a uniform Byzantine-resilient aggregation rule that selects in each training iteration useful parameters updates and filter out the harmful ones. MOZI detects the Byzantine parameters thanks to distance-based and performance-based strategies. These strategies are used to achieve two goals. The first objective and to obtain better performance, the distance-based strategy aims to reduce the candidate nodes' scope. And the performance-based strategy is used to achieve the second goal, lifting all defective nodes to achieve robust Byzantine fault tolerance.
The authors used a distance-based selection phase to handle sophisticated Byzantine attacks that can manipulate the baseline value. Each honest node used its own parameters as the baseline rather than the mean or medium value of received incorrect parameters. More specifically, the execution of a distance-based strategy is that each honest node selects a candidate pool from among the potential honest nodes based on comparing its own estimate with the Euclidean distance of each neighbor node's estimate. Therefore, improve the quality of selected nodes.
To relieve the unrealistic assumption in performance-based strategies of the server's availability of validation datasets in centralized systems, performance testing of the chosen parameters in the performance-based selection phase is realized by each honest node using its training samples. More specifically, each honest node to test the performance of each estimate reuses the training sample as validation data. And to get the final update value, it calculates the average of the selected estimates whose loss values are less than its own estimate.

In their theoretical analysis, the authors show the strong convergence of MOZI. The Experimental results prove the ability of MOZI within various system configurations and training tasks to deal with both sophisticated and simple Byzantine attacks with low computation overhead.\\

\textit{Weaknesses:} Mozi is intended only for supervised learning in i.i.d.

\paragraph{\textbf{Distributed Momentum}}
El-Mhamdi et al. \cite{el2020distributed} proved the robustness and the advantages of using Momentum on the workers' side (in considering that Momentum is generally used on the side of the server and Byzantine-resilient aggregation rules are not linear) to guarantee "quality gradient". Firstly, Momentum reduces the variance-standard ratio of estimating the gradient at the server level and grows the Byzantine resilient aggregation rules; secondly, its robustness affects distributed SGD. Also, the authors show that the combination between Momentum (at the worker side) and standard defense mechanisms (KRUM\cite{blanchard2017machine}, MEDIAN\cite{xie2018generalized}, BULYAN \cite{el2018hidden}) can be enough to defend and ensure the safety against the two presented attacks \cite{baruch2019little, xie2020fall}.\\

\textit{Weaknesses:} this work remains in need of a study and an in-depth analysis of the interaction between the dynamics of the two types of optimization methods (stale gradients and Momentum).\\

\item \verb|BFT approaches based coding schemes|:

\paragraph{\textbf{BRDO based Data Encoding}}
Data et al. \cite{data2020data} studied the distributed optimization in the master-worker architecture, with the presence of Byzantine adversaries, and focusing on two iterative algorithms: Proximal Gradient Descent (PGD) and Coordinate Descent (CD). The first algorithm is used in the data-parallel setting, while the second is used in the model-parallelism setting. In consideration that Gradient descent (GD) is a special case of both PGD and CD.

The proposed algorithm based on data encoding/decoding:
\begin{enumerate}
\item In the data encoding, the algorithm uses the sparse encoding matrices in the data used by the set of worker nodes.
\item An efficient decoding scheme using the error correction over real numbers \cite{candes2005decoding} has been developed at the master node to process the workers' inputs.
 \end{enumerate}
In the case of gradient descent, the developed scheme is used to calculate the correct gradient, and in the case of coordinate descent, it facilitates the calculation at working nodes. The proposed encoding scheme extends efficiently to the data streaming model and achieves stochastic gradient descent (SGD) Byzantine-resilient.

The proposed algorithm can tolerate an optimal number of corrupt worker nodes. In addition, it does not assume any distribution of statistical probabilities either on the data or on the Byzantine attack models.
Also, it can tolerate up to 1/3 of the corrupt worker nodes, with a constant overhead on both complexities of computational and communication and the storage requirements compared to the distributed PGD / CD process, which doesn't offer any security against adversaries.\\

\textit{Weaknesses:} This approach assumes i.i.d data; hence it falls short in the case of federated learning where the data encoding across various nodes is impossible.

\item \verb|BFT approaches based Blockchain|:
\paragraph{\textbf{TCLearn}}
Lugan et al. \cite{lugan2019secure} proposed scalable security architectures and Trusted Coalitions for Distributed Learning (TCLearn). TCLearn used adequate encryption and Blockchain mechanisms to preserve data privacy, ensure the reliable sequence of iterative learning, and share the learned model among each coalition member fairly.
In the proposed approach:
\begin{enumerate}
\item The coalition members shared a CNN model which optimized in an iterative sequence.
\item Each coalition member updates the shared model with new batches of local data in a sequential manner.
\item Validated the shared model via a process involving coalition members, then stored on the Blockchain.
\item Blockchain has provided an immutable ledger that allows retrieving each step of the model evolution.
\item The authors propose a new consensus mechanism Federated Byzantine Agreement (FBA). The used Blockchain in the proposed TCLearn depended on FBA to furnish for each stage of learning the shared model an iterative certification process, control the updated CNN model quality, and avoid any inadequate training to be added corrupted increments to the model. Therefore, concatenation of a new block to the chain and its integrity has been validated and controlled respectively by the proposed FBA.
\end{enumerate}
According to the common rules of the coalition, the authors have developed three methods that correspond to three distinct levels of trust:
\begin{itemize}
\item TCLearn-A method: public learned model, in which each coalition member is responsible for ensuring the confidentiality of their own data.
\item TCLearn-B Method: private learned model, where the coalition's members trust each other.
\item TCLearn-C Method: prevent any dishonest behavior from any coalition members that do not trust each other.
\end{itemize}
As the main advantage, the encryption system and off-chain storage used by the proposed TCLearn architectures ensure data privacy preservation and protection against degradation.\\

\textit{Weaknesses:} The proposed approach has not addressed the costs associated with privacy preservation.

\paragraph{\textbf{SDPP based-Blockchain System}}
Zhao et al. \cite{zhao2019mobile} presented a system based on (mobile edge computing, Blockchain technology, and reputation-based crowdsourcing federated learning). The proposed system used federated learning (FL) technology and designed an intelligent system to assist industrialists of IoT devices in exploiting customers' data to predict customers' needs and possible consumption behaviors by building a machine learning model. Then to deal with potential adversaries in federated learning training which can exploit the learned model, the authors used the differential privacy technique and kept the customers' data confidential. Finally, they take advantage of Blockchain technology to enhance the security of model updates.
The proposed system has many advantages, such as high computing power, confidentiality and auditing, and distributed storage. It preserves the privacy protection of customers' data and offers the security of the model updates. It provides incentives to customers to participate in the crowdsourcing tasks, which helps manufacturers of IoT smart devices improve their businesses based on predicting customers' consumption behaviors.\\

\textit{Weaknesses:} this system requires real-world IoT device manufacturers testing.

\paragraph{\textbf{BlockDeepNet}}
Rathore et al. \cite{rathore2019blockdeepnet} presented BlockDeepNet, a decentralized extensive data analysis approach that combines Blockchain technology and Deep Learning (DL) to achieve secure collaborative DL in IoT. In the Big Data analysis process on the modern IoT network, a set of attackers can exploit a large quantity of data maliciously. Therefore, the proposed BlockDeepNet system minimizes the possibility of data being negatively manipulated as follows:
\begin{itemize}
\item At the device level, collaborative DL is executed to beat privacy leaks and get enough data for DL.
\item To guarantee the confidentiality and integrity of DL collaboration in the IoT, the authors use Blockchain technology, where local learning models supported at the device level are aggregated through blockchain transactions at the edge server level.
\item To validate the effectiveness of the proposed approach, the authors develop a prototype model of BlockDeepNet in real-time scenarios.
\end{itemize}
BlockDeepNet experimental evaluation proves robustness, security, and feasibility of Big Data analysis task in IoT. It suggests BlockDeepNet mitigates the current issues as a single point of failure, privacy leak of IoT devices, lack of valuable data for DL, as well as data poisoning attacks. Therefore, Blockchain operation for DL in IoT achieves higher accuracy with acceptable latency and computational overhead.\\

\textit{Weaknesses:} BlockDeepNet still faces the problem of DL requirement of higher computing power.
\end{enumerate}

\subsubsection{Asynchronous training Byzantine fault tolerance approaches}

\paragraph{\textbf{Kardam}}
Damaskinos et al. \cite{damaskinos2018asynchronous} Introduce the Kardam SGD algorithm that tolerates the Asynchronous Byzantine behavior in ML. this algorithm was based on two essential components (filtering and dampening). Resilience is ensured by the filtering component found on scalar and against $1/3$ Byzantine workers. This filter acts as a self-stabilizer by leveraging the Lipschitzness of cost functions to protect the SGD model from adversarial attacks. It uses the frequency filter to prevent Byzantine workers from keeping honest workers from updating the training model by limiting the number of gradients received sequentially from a single worker. The dampening component is the second one, and through a generic gradient weighting scheme that adjusts to stale information, the dampening component bounds the convergence rate. Despite the existence of the Byzantine behaviour, Kardam ensures the convergence, which is almost certain. Kardam is the first SGD algorithm that tolerates the asynchronous distributed Byzantine behaviour in the authors' best knowledge.\\

\textit{Weaknesses:} Kardam demands a stronger restriction, where it can only deal with the number of Byzantine workers, which is less than 1/3 of the existing workers. Moreover, this is a weak assumption compared to the standard setting, where Byzantine workers can be half of existing workers. In addition, the filtering component can be suffered in the context of frequency filter, which is too harsh for asynchronous schemes. Finally, in terms of Byzantine resilience's cost, Kardam induces a slowdown.

\paragraph{\textbf{DBT-SGD in Era of Big Data}}
Jin et al. \cite{jin2019distributed} proposed two asynchronous SGD algorithms to tolerate an arbitrary number of Byzantine workers. In this work, the authors remove the need for a shared parameter server. The set of truthful collaborative workers is assumed to store the local model parameter, which can be used as the fundamental truth.  With this basic truth, the workers, at any time, can fetch and filter the shared model parameters from the other co-workers.

The first Algorithm corresponds to a known number of Byzantine workers, where an upper-bound $p$ of the number of Byzantine workers is assumed. To filter the erroneous data to avoid the Byzantine attack, each worker accepts an average of the parameters of the $n - p - 1$ model closest to the parameter of the honest worker model; finally, a gradient descent update based on this average value will be realized.

In the second Algorithm, the number of Byzantine workers is unknown. Firstly, based on the local training samples evaluation by the worker, the latter accepts the model parameters that eventually lead to the lowest empirical risk. After that, to make the gradient descent update step, the worker takes an average over the accepted model parameters.

As main advantages, the proposed algorithms work well against all types of Byzantine attacks examined and provide convergence.\\

\textit{Weaknesses:} the algorithms proposed to decide to accept certain information or not only take the current shared information into account and not use the past information.

\paragraph{\textbf{Zeno++}}
Xie et al. \cite{xie2020zeno++} proposed Zeno ++, the new robust, fully asynchronous procedure based on Zeno's Byzantine-tolerant synchronous SGD algorithm \cite{xie2018zeno}; the authors aim to tolerate Byzantine failures on anonymous workers (with the potential for an unlimited number of Byzantine workers).
The idea of this approach is centered on the training process. After applying the candidate gradient to the model's parameters, Zeno ++ works to estimate the descent of the loss; it scores the received gradients and accepts them according to the score. The authors also propose the lazy update for efficient calculation. The main advantage of this work is its convergence for non-convex problems, and Zeno ++ does better than the previous approaches, as shown by the empirical results.\\

\textit{Weaknesses:} Zeno++ does not apply in all contexts, such as federated learning.

\paragraph{\textbf{BASGD}}
Yang and Li \cite{yang2020basgd} proposed for Byzantine Learning (BL) a new method, called Buffered Asynchronous Stochastic Gradient Descent (BASGD). In asynchronous BL, the server does not have a stored training instance, and it receives one gradient at a time, so it isn't elementary to show deference between trust and the gradient received by the server. Therefore, BASGD solves this problem by the buffers B ($0 <B <= n$), introduced on the server, used in the aggregation phase of the gradients and updating the parameters.
The BASGD method is based on two components: $buffer$ and $aggregation$  $function$.

In the Buffer component: the training process in BASGD and ASGD is the same, only a modification of the update rule on the server, as follows:
\begin{enumerate}
\item B buffers $(0 <B <= n)$ are introduced on the server.
\item No update of the parameters when the gradient $(g)$ is received by the worker $(s)$ in the server buffer.
\item Each buffer $b$ temporarily stores the received gradient, where $b = s$ $mod$ $B$.
\item There is no execution of the new SGD step, only if all the buffers have been modified since the last SGD step.
\item Between two iterations, more than one gradient may have been received by each buffer $b$.
\item Each buffer stores the average of the gradients received.
\item An update rule is applicable for each buffer $b$.
\item After the update step, all buffers will be reset at the same time.
\end{enumerate}
In the aggregation function component:
The reliable gradient of the gradients $B$ of the buffers in the updating parameter phase, where the server has access to the candidate gradients $B$, can be aggregated by a chosen aggregation function. The latter takes the average of all candidate gradients but satisfies the authors' q-Byzantine Robust (q-BR) condition\footnote{ For an aggregation function, (q-BR) condition illustrates its Byzantine resilience ability quantitatively.}.

As advantages:
BASGD is more general than SBL methods and can preserve ABL's privacy because the server does not have a stored training instance and resists against the set of attackers. It also has the same theoretical convergence rate as vanilla asynchronous SGD (ASGD). BASGD can significantly surpass vanilla ASGD, and other ABL baselines in case of error or attack exist on the part of workers.\\

\textit{Weaknesses:} The authors assumed a limited number of Byzantine workers to verify the BASGD convergence and resilience against attack or error.

\paragraph{\textbf{ByzSGD}}
El-Mhamdi et al. \cite{el2020genuinely} studied the issue of Byzantine-resilient distributed machine learning in a decentralized architecture. They present ByzSGD, which aims to tolerate Byzantine failures in both sides servers (several replicas of the parameter server) and workers in an asynchronous setting. And to improve the performance of the proposed algorithm, the authors took advantage of the synchronous setting and used it to reduce the number of communicated messages required by ByzSGD. The proposed ByzSGD algorithm-based on three significant schemes:
\begin{enumerate}

\item Scatter/Gather scheme: into correct servers, this scheme limits the maximum drift among models, which is due to the no communication among the servers in the scatter phase, that the honest servers communicate and apply together with a Distributed Median-based Contraction (DMC) module in the gather phase.
\item Distributed Median Contraction (DMC): In high dimensional settings, DMC leverages the median geometric properties to approximate the honest servers' parameters closer to each other and achieve learning convergence. But ByzSGD still requires many communication messages, which are reduced by using the synchronous settings
\item Minimum–Diameter Averaging (MDA): to tolerate Byzantine workers, ByzSGD used MDA as a statistically–robust gradient aggregation rule (GAR).
\end{enumerate}
As advantages:
\begin{itemize}

\item ByzSGD resolves the problem of Byzantine parameter servers (1/3) and Byzantine workers (1/3) in the asynchronous framework in an optimal way.
\item It also guarantees Byzantine resilience without any adding communication rounds, unlike vanilla non-Byzantine alternatives.
\item It used the synchronous setting to reduce the communication messages.
\end{itemize}

\textit{Weaknesses:} ByzSGD is still not applied to fully decentralized settings and non-iid data.

\paragraph{\textbf{ColLearning Agreement}}
El-Mhamdi et al. \cite{ el2020collaborative}  solved Byzantine collaborative learning without trusting any node, considering the genuine Byzantine resilience. This approach is also based on asynchronous and heterogeneous settings, considering the general case of non–i.i.d. data. It is based on fully decentralized settings and the more general non–convex optimization case and the standard stochastic gradient descent as an applied scheme.

The new form of agreement called averaging agreement is equivalent to collaborative learning, as the authors put it. Each node begins with an initial vector and searches to approve approximately on a common vector, guaranteeing that this common vector stills within an averaging constant of the maximum distance between the main vectors.
Three asynchronous algorithms are presented by the authors to the averaging agreement as follows:
\begin{enumerate}
\item The first solution, Minimum–Diameter Averaging (MDA), needs $(n \geq ou \ge 6f + 1)$ to achieve asymptotically the best possible averaging constant based on the minimum volume ellipsoid. And the filtering scheme used by MDA ensures that no Byzantine input among the selected vectors exchanged among workers could be arbitrarily bad.
\item The second solution, Broadcast-based Averaging Agreement, and despite its need for cryptographic signatures and many communication rounds, it can achieve optimal Byzantine resilience $ (n \geq ou \ge 3f + 1) $ based on the reliable broadcast.
\item The third solution, Iterated Coordinate–wise Trimmed Mean ICwTM, does not rely on signatures, unlike the second one. In the algorithms of standard form, which do not use signatures, it is faster and reaches an optimal Byzantine resilience $ (n \geq ou \ge 4f + 1) $ based on the coordinate-wise trimmed mean.
\end{enumerate}

Despite the asynchronous setting considered in the proposed approach, the authors sometimes discuss the synchronous setting where they would suppose limits on the communication delays between truthful workers also their relative quickness.
The Byzantine-resilient averaging agreement algorithm achieves a quasi-linear complexity.\\

\textit{Weaknesses:} in ColLearning Agreement, an asymptotically optimal averaging constant remains open, it does not study the trade-off between the averaging constant that can be done and the Byzantine nodes' number that can be tolerated, and it has not applied any privacy preservation techniques.

\subsubsection{Partially  Asynchronous training Byzantine fault tolerance approaches}
\paragraph{\textbf{Norm Filtering and Norm-cap Filtering}}

Gupta and Vaidya \cite{gupta2019byzantine_a}, to solve the Byzantine fault tolerance problem in distributed linear regression in a multi-agent system, propose the algorithms based on the deterministic gradient descent, where it generalized the problem mentioned above to the class of distributed optimization problems. The authors consider a system composed of a server and several agents (workers). The latter is composed of non-faulty/faulty agents. Each agent has a fixed amount of data points and responses. The server's goal is to identify the defective Byzantine agents, and the authors offer two norm-based filtering techniques to help the server achieve this goal \textit{(Norm Filtering and Norm-cap Filtering)}. In a deterministic way and to solve the mentioned regression problem, the proposed techniques can reinforce the original algorithm of gradient descent distributed when $f = n$ is lower than the specified threshold values.
The first algorithm is the \textit{Gradient Descent with Norm Filtering}: this algorithm runs in two simple steps, where the server starts with the parameter' arbitrary estimate and iteratively updates it.

\textit{\textbf{Step 1}}: At the actual estimated value of the parameter, the server aggregates the gradients of all agent costs. It sorts them in ascending order of their $2$-norms (breaking the links arbitrarily in order).

\textbf{{Step 2}}: This step starts when the server uses the sum (vector) of the remaining gradients as the update direction, after filtering the gradients with $f$ largest $2$-norms. Hence, the results filtering scheme is called norm filtering.

The second algorithm is \textit{Gradient Descent with Norm-Cap Filtering}: this algorithm is similar to the first, with the difference in the second step, where the server caps the $f$ largest gradients' norms by the norm of $ (f + 1)-th$ largest reported gradient, instead of eliminating the $f$ largest agents' gradients. Hence, the filtering scheme is referred to as norm-cap filtering. Several advantages of the proposed algorithms, such as the partially asynchronous system and in the probability distribution of the data points, no assumption is needed. Also, the computational overhead is log-linear and linear to deal with Byzantine defective agents, in the number of agents and dimension of data points, respectively.\\

\textit{Weaknesses:} Just the deterministic gradient descent method was assumed in the proposed approach.

\section{Discussion}
\label{Disc}
This is the first survey of the literature on BFT in DML. the achieved results through the analysis phase illustrate that the proposed approaches to deal with Byzantine faults in DML address several challenging problems, whereas there are still some drawbacks.

Analysis and evaluation are drawn in from more than 40 methods, and Fig. 11 shows the applicability of the Synchronous (Synch) training process with 84\% over the Asynchronous (Asynch) training process with 14\% and 2\% of Partially Asynchronous (PAsynch) training process \footnote{The total of the papers we analyzed is 43, divided into synchronous (36 papers), asynchronous (6 papers), and partially asynchronous (1 paper). We used the triple rule, and the result we got, we rounded it to the unit and got the ratios (84\%, 14\% and 2\%).}.

Despite the idle time lost on waiting for slower workers in the synchronous training, several methods use this type of training to solve the problem of Byzantine workers in the Distributed Machine Learning training process, under two-level settings: centralized and decentralized.

\begin{figure}[H]
  \centering
\subfloat[][]{\resizebox{0.4\textwidth}{!}{
         \begin{tikzpicture}
\begin{axis}[
    ybar,
    enlargelimits=0.14,
    ylabel={Number of analyzed approaches},
    symbolic x coords={Synch,Asynch,PAsynch},
    xtick=data,
    nodes near coords,
    nodes near coords align={vertical},
    xtick pos=left,
    ytick pos=left
    ]
\addplot coordinates {(Synch,36) (Asynch,6) (PAsynch,1)};
\end{axis}
\end{tikzpicture}
}}
\subfloat[][]{\resizebox{0.5\textwidth}{!}{
         \begin{tikzpicture}[nodes = {font=\sffamily}]
  \foreach \percent/\name in {
      84/Synchronous,
      14/Asynchronous,
      2/Partially Asynchronous
    } {
      \ifx\percent\empty\else
        \global\advance\cyclecount by 1
        \global\advance\ind by 1
        \ifnum3<\cyclecount
          \global\cyclecount=0
          \global\ind=0
        \fi
        \pgfmathparse{{"teal!65","blue!40","teal!20","cyan!40"}[\the\ind]}
        \edef\color{\pgfmathresult}

        \draw[fill={\color},draw={\color}] (0,0) -- (0:3)
          arc (0:0+\percent*3.6:3) -- cycle;
        \node at (0+0.5*\percent*3.6:0.7*3) {\percent\,\%};
        \node[pin=0+0.5*\percent*3.6:\name]
          at (0+0.5*\percent*3.6:3) {};
        \pgfmathparse{0+\percent*3.6}
        \xdef0{\pgfmathresult}
      \fi
    };
\end{tikzpicture}
    }}

  \caption{(a) Applicability count (b) Applicability percentage of Byzantine fault tolerance training processes.}
 \label{percent_BFT_training_processes}
\end{figure}

It is conclusive that most centralized synchronous methods heavily rely on the assumption that the non-Byzantine workers lead the entire group, which means that most of the workers are non-Byzantine. Thus, such algorithms can eliminate the outliers from the candidates. The methods executed under centralized synchronous Byzantine fault tolerance remain relatively simple and easy to be implemented. But they still suffer from the fact that there is no guarantee that the number of Byzantine workers can be controlled during real-world attacks. For example, when the number of Byzantine workers is more than half of the existing workers, the proposed filtering schemes like Krum and Multi-Krum \cite{blanchard2017byzantine,blanchard2017machine}, DSML-Adversarial \cite{chen2017distributed}, ByzRDL \cite{yin2018byzantine}, ByzantineSGD \cite{alistarh2018byzantine},  GBT-SGD \cite{xie2018generalized} become incompetent. But, we notify that the synchronous SGD method Zeno  \cite{xie2018zeno} is proposed for an unbounded number of Byzantine workers. Moreover, analyzed filtering schemes \cite{blanchard2017byzantine, blanchard2017machine, yin2018byzantine, chen2017distributed, gupta2019byzantine_b, mhamdi2019fast} need redundant data points to achieve exact fault tolerance, which may increase data storage and processing requirements.

A generalized Byzantine failure with no such constraint is realized for the first time in the synchronous SGD by two filtering schemes methods (GBT-SGD and Phocas \cite{xie2018phocas}). But the filtering schemes in synchronous training still suffer from other problems as the single point of failure, which clearly shows in the DGDAlgorithm \cite{cao2019distributed}.  DGDAlgorithm is a heuristic mechanism that calculates a noisy version of the true gradient, assuming the parameter server has a small part of the dataset locally. DGDAlgorithm still requires a parameter server to collect gradients, which can be vulnerable to the single point of failure. Furthermore, when comparing the existing filtering schemes among each other, like \cite{alistarh2018byzantine, blanchard2017byzantine, chen2017distributed}, the Gradient Filter CGC \cite{gupta2019byzantine_b} gest at comparable fault-tolerance. As well as, the Gradient Filter CGC has no assumption on the probability distribution of the data points, unlike ByzRDL. At the expense of fault tolerance, Gradient Filter CGC does not increase the workers’ computational workload.

The most existing filtering schemes to tolerate Byzantine faults use robust aggregation rules as median and geometric median instead of the simple averaging aggregation operation or before averaging. In real-word, the geometric median-based methods have the best accuracy performance compared to those of coordinate-wise median-based methods, which are usually worse in practice, and LICM-SGD \cite{yang2019byzantine} also falls into the coordinate-wise median. In addition, the center of attention in some works is on detecting and removing adversaries and others on detecting and rejecting outliers in gradient aggregation based on gradients passed from workers to the server, unlike SIGNSGD \cite{bernstein2018signsgd} and Stochastic-Sign SGD \cite{jin2020stochastic}  based on the sign of the gradient vectors and the stochastic sign of the gradient vectors, respectively. These methods used majority voting as a natural way to protect against less harmful defects and ensure convergence towards critical points without any guarantees on their quality. Moreover, these methods require the data stored in the workers are i.i.d., which is impractical in the federated learning setting. Unlike RSA \cite{li2019rsa}, which does not rely on i.i.d. assumption, and use model aggregation aiming to find a consensus model and integrate a regularized term with the objective function. However, it needs strong convexity. The RSA assuming aggregation model may suffer high communication costs, in contrast to Stochastic-Sign SGD, which preserves communication efficiency, can deal with heterogeneous data distribution and guarantees Byzantine resilience.

The applicability of the Filtering Schemes (FSs) represents the most existence-based methods by 81\%, contrary to Coding Schemes (CSs), which are represented by 9\%, as shown in Fig. 12.

\begin{figure}[h]
  \centering
  \subfloat[][]{\resizebox{0.4\textwidth}{!}{
         \begin{tikzpicture}
\begin{axis}[
    ybar,
    enlargelimits=0.14,
    ylabel={Number of analyzed approaches},
    symbolic x coords={FSs,CSs,Blockchain},
    xtick=data,
    nodes near coords,
    nodes near coords align={vertical},
     xtick pos=left,
    ytick pos=left
    ]
\addplot coordinates {(FSs,35) (CSs,4) (Blockchain,5)};
\end{axis}
\end{tikzpicture}
}}
\subfloat[][]{\resizebox{0.5\textwidth}{!}{
         \begin{tikzpicture}[nodes = {font=\sffamily}]
  \foreach \percent/\name in {
      81/Filtering Schemes,
      12/Blockchain,
      9/Coding Schemes
    } {
      \ifx\percent\empty\else
        \global\advance\cyclecount by 1
        \global\advance\ind by 1
        \ifnum3<\cyclecount
          \global\cyclecount=0
          \global\ind=0
        \fi
        \pgfmathparse{{"teal!65","blue!40","teal!20","cyan!40"}[\the\ind]}
        \edef\color{\pgfmathresult}

        \draw[fill={\color},draw={\color}] (0,0) -- (0:3)
          arc (0:0+\percent*3.6:3) -- cycle;
        \node at (0+0.5*\percent*3.6:0.7*3) {\percent\,\%};
        \node[pin=0+0.5*\percent*3.6:\name]
          at (0+0.5*\percent*3.6:3) {};
        \pgfmathparse{0+\percent*3.6}
        \xdef0{\pgfmathresult}
      \fi
    };
\end{tikzpicture}
}}
  \caption{(a) Applicability count (b) Applicability percentage of Byzantine fault tolerance schemes.}
 \label{percent_BFT_schemes}
\end{figure}

DRACO \cite{chen2018draco} is a coding scheme that guarantees correct gradients recovery by increasing the workers' computational workload. Unlike Bulyan \cite{el2018hidden}, which requires heavy computational overhead on the PS side with $4f + 3$ workers, DRACO requires only $2f +1$ workers, making it strongly Byzantine-resilient. But the computation time of DRACO may be many times due to the encoding and decoding time, accordingly larger than the computation time of ordinary SGD, and the proposed method in AGGREGATHOR \cite{damaskinos2019aggregathor} with the redundant calculations can avoid this overhead. In addition, the storage redundancy factor required in DRACO compared to BRDO-based data encoding \cite{data2020data} increases linearly with the number of corrupted worker nodes, unlike BRDO-based data encoding, which is constant, which results in low compute at the worker node level. The authors in DETOX \cite{rajput2019detox} improve resiliency and overhead guarantees by combining deterministic coding scheme with robust aggregation rule; also, they show that computational efficiency will be enhanced in DRACO at the expense of exact fault tolerance when using the gradient filters.

The above coding schemes based methods (DRACO, BRDO-based data encoding, DETOX) are so close to each other that they used a similar deterministic coding scheme. However, BRDO-based Data encoding has a $2n/(n-2f)$ storage redundancy factor, in contrast to DRACO, which has a $2f +1$ storage redundancy factor, and with the corrupt workers’ number increases linearly. As far as we know, RRR-BFT \cite{gupta2019randomized} is the first proposed method that tolerates Byzantine workers in the context of parallel learning by using the idea of reactive redundancy. In addition, RRR-BFT compares the computational efficiency of its deterministic coding schemes to DRACO and enhances it using the randomization technique. Furthermore, the server in the synchronous setting can improve the computing efficiency by combining the gradient-filter method with the randomized coding scheme or deterministic coding scheme in RRR-BFT or DETOX, respectively. However, according to the authors, when the server employed the gradient filter, it could not identify all of the existing Byzantine workers. In Coding schemes, the most current methods are based on deterministic coding schemes as DRACO, DETOX, BRDO data encoding. At the same time, RRT-BFT used the two types of coding schemes (deterministic and randomized).

The most proposed centralized synchronous approaches are based on the SGD first-order optimization method.  However,  other publications, such as Distributed Momentum \cite{el2020distributed}, DRSL-Byzantine Mirror Descent \cite{ding2019distributed}, and SVRG-AdversarialML \cite{bulusu2019convex}, explore Momentum, Mirror Descent, and SVRG, respectively.  Momentum reduces gradient variation at the server and reinforces Byzantine resilient aggregation rules. Mirror Descent is used to secure training data against faulty information sharing. In SVRG-AdversarialML, the authors benefit from the advantages of SVRG over SGD as the reducing variance and propose the first method-based SVRG to fight against Byzantine adversaries in the distributed setting.

The main drawback of the discussed synchronous centralized methods is that they keep the training convergence and correctness at the expense of useful information. Also, these methods require certain assumptions that are not easy to apply in the federated learning paradigm, such as the need to relocate data points in DRACO. Additionally, the i.i.d. assumption is not the case in federated learning, where the units of computing are heterogeneous, and the difficulty of generalizing the existent algorithms in the non-i.i.d. setting. Furthermore, the existence of heterogeneous workers will certainly be due to the slowness of convergence. Finally, the synchronization with federated learning and edge computing offline workers cannot be done most of the time.

On the other hand, Decentralized synchronous methods are recently represented by multi-server parameter method as (GuanYu \cite{el2019sgd}, DSML-Adversarial and Securing-DML \cite{su2018securing}), without any server as (ByRDiE \cite{yang2019byrdie}, BRIDGE \cite{yang2019bridge} and MOZI \cite{guo2020towards}) and with Blockchain technology as (DeepChain \cite{weng2019deepchain}, LearningChain \cite{chen2018machine}, TCLearn \cite{lugan2019secure}, SDPP based-Blockchain System \cite{zhao2019mobile} and BlockDeepNet \cite{rathore2019blockdeepnet}).

For the proposed DSML-Adversarial, the authors, to simplify the explanation, assume in their article that there is only one parameter server, which is why we refer to the presented DSML-Adversarial with centralized synchronous methods discussed above. In addition, they show the applicability of their proposed method for multi-server parameters by their algorithm description and detailed analysis. GuanYu and Securing-DML assume the same decentralized setting as DSML-Adversarial with multi-server parameters. In addition, the parameter server architecture used in the centralized setting can be vulnerable to the single point of failure, as is done in DGDAlgorithm. So, eliminating the parameter server is necessary to avoid this issue and get a fully Decentralized setting. In ByRDiE and BRIDGE, the authors assume the fully decentralized setting. ByRDiE applies the trimmed-median rule to the coordinate descent optimization algorithm, and BRIDGE applies it to the SGD algorithm.

Nevertheless, BRIDGE has the best communication cost compared to ByRDiE. Yet, both remain vulnerable to some Byzantine attacks, in contrast to Mozi, which deals with both simple and sophisticated Byzantine attacks with low computation overhead. Likewise, we survey several decentralized methods (DeepChain, LearningChain, TCLearn, SDPP-based-Blockchain System, BlockDeepNet) based on Blockchain technology. These methods mitigate the challenges in previous works such as poisoning attacks, single point of failure, data privacy, and existing heterogeneous workers as federated learning. Most Blockchain-based methods achieve collaborative training and improve security, privacy, and auditability.

Through Fig. 11, we notice that 12\% of methods used Blockchain technology, which shows that researchers are slightly using them compared to filtering schemes.

In the synchronous settings, the authors can assume that the network is perfect and delivers messages within a certain time, which remain relatively simple and easy to be implemented, so we find that most of the proposed approaches considered the synchronous setting by 84\% compared to 14\% of the asynchronous approaches. Asynchronous settings are more practical and realistic, where the network cannot be assumed to be perfect, and implementation is more complex.

Asynchronous Byzantine learning is more general than Synchronous Byzantine learning, which motivates authors to change the research direction to the asynchronous setting. As well as, we present above that the workers in the synchronous setting have better computing capacity, it is necessary to wait for the struggling workers, which leads to wasted computing resources. As a result, Asynchronous Byzantine Learning is more convenient than Synchronous Byzantine Learning, which is another motivating reason for the authors they chose to propose solutions in the asynchronous framework to solve the Byzantine learning problems.

Kardam \cite{damaskinos2018asynchronous} is the first proposed method that tolerates Byzantine learning in the asynchronous distributed SGD algorithm. Kardam filters out the outliers by using a different filtering scheme method to those used in the synchronous approaches. Its filtering scheme is based on the Lipschitzness filter and frequency filter. However, Kardam cannot resist malicious attacks due to the weak threat model assuming. The second proposed method to deal with Byzantine attackers in the asynchronous distributed SGD algorithm is proposed in DBT-SGD in Era of Big Data \cite{jin2019distributed}.

Nonetheless, the authors \cite{jin2019distributed} proposed two different algorithms in a decentralized setting. They avoid the problem of a single point of failure caused by the parameter server, and they repose to the collaborative training among the set of workers. DBT-SGD in Era of Big Data is the first paper proposed to resolve the Byzantine problems in the asynchronous decentralized setting to the best of our knowledge; however, DBT-SGD in Era of Big Data can also be implemented with centralized settings. As a result, it may be vulnerable to a single point of failure. Another work based on the asynchronous setting is Zeno++ \cite{xie2020zeno++}. The author in Zeno++ proposes a strong threat model compared to the Kardam one; it also proves many advantages, unlike Kardam, which needs a majority of honest workers and workers’ bounded staleness, and when the server receives gradients, it needs to verify the identities of the workers. However, Zeno ++'s storage of the training data on the server for scoring will increase the risk of confidentiality leakage. BASGD \cite{yang2020basgd} uses two important components (buffer and aggregation function), proving its ability to resist error and malicious attack compared to Kardam. Unlike Zeno++, it avoids the problem of storing data on the server and preserves privacy in distributed learning.

On the other hand, ByzSGD \cite{el2020genuinely}  and  ColLearning Agreement \cite{ el2020collaborative}, to the best of our knowledge, are the only proposed approaches in the decentralized asynchronous settings with DBT-SGD in the Era of Big Data. Where ByzSGD considers the decentralized parameter servers settings and increases the efforts made by the centralized synchronous algorithms, as a result tolerating Byzantine servers in addition to Byzantine workers. But ColLearning Agreement considers the fully decentralized settings as ByRDiE, BRIDGE, and MOZI. However, these methods suppose that the data is i.i.d. and consider only convex optimization. In genuine Byzantine environments, the correct models can be influenced by Byzantine workers to distance them from each other. In comparison, MOZI assumes that the models do not drift from each other on good workers, which is impractical. Moreover, despite the two hypotheses (configuration of decentralized parameter servers and genuinely Byzantine adversaries) of ByzSGD with the hypothesis that the workers are drawn from the homogeneous, i.i.d., this solution is not collaborative like ColLearning Agreement.

To the best of our knowledge, the partially asynchronous training Byzantine fault tolerance setting is used by only one work \cite{gupta2019byzantine_a}. It takes advantage of this setting in terms of system robustness to bounded delay and achieves a log-linear and linear computational overhead.

Distribution of the applicability of the Byzantine fault tolerance training processes and settings by discussed methods is provided in Fig. 13.

Although Byzantine fault tolerance methods are widely used, the continued advancements in distributed machine learning, particularly federated learning, and the combination with other techniques such as IoT or fog computing increase the complexity of the systems as well as the probability of failure, broadening the scope of research on Byzantine fault tolerance methods in distributed machine learning.

Byzantine Fault Tolerance (BFT) is a field of study that attempts to preserve the system's continuity and dependability in arbitrary behaviour, making it extremely important because it keeps the system operating even if certain components fail. Many machine learning algorithms have an objective function that expresses their goal. Commonly, the learning algorithm minimizes the objective function to optimize the model, as an example, a low error in the case of classifying customer satisfaction score in e-commerce into positive or negative, or incoming messages in the mail into legitimate or spam. The training process is terminated when a near-optimal/optimal solution is identified, or the model is converged. Byzantine refers to the malicious nodes (workers/servers) and their (sent/update) gradients. For example, the Byzantine workers lead the objective function to converge to ineffective models and preclude the distributed algorithm process from converging to a satisfactory state. The latter is the state where accomplish an accuracy with Byzantine workers that is equivalent to the one reached without any Byzantine workers. Several BFT solutions in DML achieve near-optimal/optimal/fast convergence, nearly linear time complexity, and its ability to achieve the same performance and accuracy as the non-Byzantine case.
\begin{figure}[H]
  \centering
  \subfloat[][]{\resizebox{0.4\textwidth}{!}{
         \begin{tikzpicture}
\begin{axis}[
    ybar,
    enlargelimits=0.14,
    legend style={at={(0.5,-0.18)},
      anchor=north,legend columns=-1},
    ylabel={Number of analyzed approaches},
    symbolic x coords={Synch,Asynch,PAsynch},
    xtick=data,
    nodes near coords,
    nodes near coords align={vertical},
     xtick pos=left,
    ytick pos=left
    ]
\addplot coordinates {(Synch,25) (Asynch,3) (PAsynch,1)};
\addplot coordinates {(Synch,11) (Asynch,3) (PAsynch,0)};
\legend{Centralized,Decentralized}
\end{axis}
\end{tikzpicture}
}}
\subfloat[][]{\resizebox{0.5\textwidth}{!}{
         \begin{tikzpicture}[nodes = {font=\sffamily}]
  \foreach \percent/\name in {
      58/Synch Centralized,
      26/Synch Decentralized,
      7/Asynch Centralized,
      7/Asynch Decentralized,
      2/PAsynch Centralized,
    } {
      \ifx\percent\empty\else
        \global\advance\cyclecount by 1
        \global\advance\ind by 1
        \ifnum3<\cyclecount
          \global\cyclecount=0
          \global\ind=0
        \fi
        \pgfmathparse{{"teal!65","blue!40","teal!20","cyan!40"}[\the\ind]}
        \edef\color{\pgfmathresult}

        \draw[fill={\color},draw={\color}] (0,0) -- (0:3)
          arc (0:0+\percent*3.6:3) -- cycle;
        \node at (0+0.5*\percent*3.6:0.7*3) {\percent\,\%};
        \node[pin=0+0.5*\percent*3.6:\name]
          at (0+0.5*\percent*3.6:3) {};
        \pgfmathparse{0+\percent*3.6}
        \xdef0{\pgfmathresult}
      \fi
    };
\end{tikzpicture}
}}
  \caption{(a) Applicability count (b) Applicability percentage of Byzantine fault tolerance training processes and settings.}
\label{percent_BFT_training_process_and_settings}
\end{figure}

A summary of analysis methods under several metrics (type of scheme, type of optimization method, centralized and decentralized settings) are given in Table 4, Table 5, Table 6, and Table 7. We point out that ( $ \bullet $ ) it means applicable, (N.A) it means not applicable, and ($-$) indicates that, to the best of our knowledge, information is not supplied in the original resource or other studies.

\begin{table} [H]
  \caption{Summarizing different Synchronous Byzantine fault tolerance approaches.}
  \label{tab:SynBFT}
  \begin{minipage}{\columnwidth}
  \begin{center}
  \begin{tabular}{p{4 cm} c c c c p{3 cm}}

\toprule
    Approach&Filtering scheme&Coding scheme &Blockchain&Optimization method\\
    \midrule
    DeepChain& N.A& N.A&$ \bullet $&SGD\\
    Krum, Multi-Krum&$ \bullet $&N.A &N.A &SGD\\
    DSML-Adversarial&$ \bullet $& N.A& N.A&GD\\
    ByzRDL&$ \bullet $&N.A &N.A &GD\\
    ByzantineSGD&$ \bullet $&N.A&N.A&SGD\\
    GBT-SGD&$ \bullet $&N.A&N.A&SGD\\
    DGDAlgorithm&$ \bullet $&N.A&N.A&GD\\
    Securing-DML&$ \bullet $&N.A&N.A&GD\\
    Tremean and Phocas&$ \bullet $&N.A&N.A&SGD\\
    DRACO\footnote{applicable also to any first order method.}&N.A &$ \bullet $&N.A &Mini-batch SGD\\
    Bulyan&$ \bullet $&N.A&N.A&SGD\\
    ByzantinePGD\footnote{PGD:Perturbed Gradient Descent}&$ \bullet $&N.A&N.A&GD, PGD\\
    Zeno&$ \bullet $&N.A&N.A&SGD\\
    LearningChain&N.A&N.A&$ \bullet $&SGD\footnote{LearningChainEx applied to any gradient descent based machine learning systems.}\\
    RSA & $ \bullet $ &N.A&N.A& SGD\\
    signSGD & $ \bullet $ &N.A&N.A& SGD\\
    BRDO based Data Encoding\footnote{PGD: Proximal Gradient Descent, CD: Coordinate Descent}&N.A&$ \bullet $&N.A&PGD and CD\\
    AGGREGATHOR&$ \bullet $&N.A&N.A&SGD\\
    GuanYu&$ \bullet $&N.A&N.A&SGD\\
    Trimmed mean&$ \bullet $&N.A&N.A&SGD\\
    TCLearn&N.A&N.A&$ \bullet $&GD\\
    SDPP based-Blockchain System&N.A&N.A&$ \bullet $&$-$\\
    ByRDiE&$ \bullet $&N.A&N.A&Coordinate Descent\\
    BlockDeepNet&N.A&N.A&$ \bullet $&GD\\
    FABA&$ \bullet $&N.A&N.A&SGD\\
    BRIDGE&$ \bullet $&N.A&N.A&SGD\\
    LICM-SGD&$ \bullet $&N.A&N.A&SGD\\
    Gradient-Filter CGC & $ \bullet $&N.A &N.A & SGD\\
    SVRG-AdversarialML&$ \bullet $&N.A&N.A&SVRG\\
    LIUBEI&$ \bullet $&N.A&N.A&SGD\\
    DRSL-Byzantine Mirror Descent&$ \bullet $&N.A&N.A&Mirror Descent\\
    DETOX&$ \bullet $&$ \bullet $&N.A&Mini-batch SGD\\
    RRR-BFT &N.A&$ \bullet $&N.A & SGD\\
    MOZI&$ \bullet $&N.A&N.A&$-$\\
    Stochastic-Sign SGD &$ \bullet $& N.A& N.A& SGD\\
    Distributed Momentum&$ \bullet $&N.A &N.A &Momentum\\
  \bottomrule
\end{tabular}
\end{center}
\bigskip
\end{minipage}
\end{table}

\begin{table}[H]
  \caption{Summarizing different Asynchronous Byzantine fault tolerance approaches}
  \label{tab:ASynBFT}
  \begin{minipage}{\columnwidth}
  \begin{center}
\begin{tabular}{p{4 cm} c p{3 cm} c p{3 cm} c p{2 cm}p{2 cm}}

\toprule
    Approach&Filtering scheme&Coding scheme &Blockchain&Optimization method\\
    \midrule
    Kardam&$ \bullet $&N.A&N.A&SGD\\
    DBT-SGD in Era of Big Data&$ \bullet $&N.A&N.A&SGD\\
    Zeno++&$ \bullet $&N.A&N.A&SGD\\
    BASGD&$ \bullet $&N.A&N.A&SGD\\
    ByzSGD&$ \bullet $&N.A&N.A&SGD\\
    ColLearning Agreement &$ \bullet $&N.A&N.A&SGD\\

  \bottomrule
\end{tabular}
\end{center}
\bigskip
\end{minipage}
\end{table}

\begin{table}[]
  \caption{Summarizing different Partially Asynchronous Byzantine fault tolerance approaches}
  \label{tab:PArtially_ASynch}
  \begin{minipage}{\columnwidth}
  \begin{center}
 \begin{tabular}{p{4 cm} c p{3 cm} c p{3 cm} c p{2 cm}p{2 cm}}

\toprule
    Approach&Filtering scheme&Coding scheme &Blockchain&Optimization method\\
    \midrule

    Norm Filtering and Norm-cap Filtering&$ \bullet $&N.A&N.A&GD\\
\bottomrule
\end{tabular}
\end{center}
\bigskip
\end{minipage}
\end{table}

\begin{table}[]
  \caption{Summarizing different Centralized/Decentralized Byzantine fault tolerance approaches}
  \label{tab:CenDec}
  \begin{minipage}{\columnwidth}
  \begin{center}
  \begin{tabular}{p{4 cm} p{5 cm} p{5 cm}}

\toprule
Training process&Centralized&Decentralized\\
    \midrule
Synchronous&Krum and Multi-Krum \cite{blanchard2017byzantine,blanchard2017machine},
ByzRDL\cite{yin2018byzantine},
ByzantineSGD \cite{alistarh2018byzantine},
GBT-SGD \cite{xie2018generalized},
DGDAlgorithm \cite{cao2019distributed},
Phocas \cite{xie2018phocas},
DRACO \cite{chen2018draco},
Bulyan \cite{el2018hidden},
ByzantinePGD \cite{yin2019defending},
Zeno \cite{xie2018zeno},
RSA \cite{li2019rsa},
SIGNSGD \cite{bernstein2018signsgd},
BRDO based Data Encoding \cite{data2020data},
AGGREGATHOR \cite{damaskinos2019aggregathor},
Trimmed mean \cite{ tianxiang2019aggregation},
FABA \cite{xia2019faba},
LICM-SGD \cite{yang2019byzantine},
Gradient Filter CGC \cite{gupta2019byzantine_b},
SVRG-AdversarialML \cite{bulusu2019convex},
LIUBEI \cite{mhamdi2019fast},
DRSL-Byzantine Mirror Descent \cite{ding2019distributed},
DETOX \cite{rajput2019detox},
RRR-BFT \cite{gupta2019randomized},
Stochastic-Sign SGD \cite{jin2020stochastic},
Distributed Momentum \cite{el2020distributed}& DeepChain \cite{weng2019deepchain},
DSML-Adversarial\cite{chen2017distributed},
Securing-DML \cite{su2018securing},
GuanYu \cite{el2019sgd},
ByRDiE \cite{yang2019byrdie},
BRIDGE \cite{yang2019bridge},
MOZI \cite{guo2020towards},
LearningChain \cite{chen2018machine},
TCLearn \cite{lugan2019secure},
SDPP based-Blockchain System \cite{zhao2019mobile},
BlockDeepNet \cite{rathore2019blockdeepnet}\\

\\Asynchronous&Kardam \cite{damaskinos2018asynchronous},
Zeno++ \cite{xie2020zeno++},
BASGD \cite{yang2020basgd}&DBT-SGD in Era of Big Data \cite{jin2019distributed},
ByzSGD \cite{el2020genuinely},
ColLearning Agreement \cite{ el2020collaborative} \\
\\Partially Asynchronous&Norm Filtering and Norm-cap Filtering\cite{gupta2019byzantine_a}&N.A\\

\bottomrule
\end{tabular}
\end{center}
\bigskip
\end{minipage}
\end{table}

Based on the discussion above, and for future research, the following directions areas are recommended:
\begin{enumerate}
\item The most used optimization methods for the BFT problem in DML belong to the first-order optimization methods. Although the achieving results, several issues stay open as the high computational complexity or data privacy. Second-order methods are an interesting family optimization method that may give us more effective outcomes than first-order methods.
\item SGD is the popular method used in the BFT problem in DML, while it presents challenges that have led it to improve it by its proposed variants like (Adagrad, Adadelta, RMSprop ... etc.). That implies that the existing BFT approaches in DML with SGD may be improved using these variants instead of the SGD method. So, it's interesting coming up with new solutions with these variants to create a more robust, reliable, and secure DML.
\item Most of the analyzed approaches are based on synchronous/asynchronous training processes in centralized/decentralized settings (fewer approaches in the asynchronous). Overdone asynchronism can be hurtful to the convergence of some algorithms \cite{bertsekas1989parallel}, and synchronization cannot be done most of the time (case of federated learning). It would be exciting to enrich the results obtained by the analyzed approaches using other training processes, such as (semi-synchronous or partially asynchronous). In other words, exploring existing training processes can be used to avoid some problems in synchronous/asynchronous training processes.
\item The widely used Internet of Things means more devices, more data, and more requirements for storing, transmitting, and processing that data, as well as keeping it secure. Blockchain technology shows promising results in the BFT problem in DML in terms of data confidentiality and ensuring trusted collaborative model training(considering that Blockchain was used sparingly). Guaranteeing the same or a better result in the case of scale participant number and optimally reducing cost communication are open issues with the advent of new paradigms (IoT, Big Data, Edge computing, etc.). Thus, Blockchain is an interesting technology to explore new solutions to open problems in current paradigms.
\end{enumerate}

The possibilities of the research area are summarized in Fig. 14.
\begin{figure}[H]
    \centering
    \includegraphics[width=\textwidth,keepaspectratio]{TreeResearchDirection.pdf}
    \caption{Mind map of the BFT research area in DML. The mind map depicts the different optimization method families that can be used: existing techniques that may be developing (as filtering scheme, coding scheme and Blockchain), training topologies (as centralized and decentralized), training processes that can be combined in various ways, and existing problems in SGD, the most commonly used optimization method in DML, to propose more effective solutions.
}
    \label{fig:MindMap_BFTinDML}
\end{figure}

\section{Conclusion}
\label{Conclusion}

The Byzantine fault tolerance of a distributed machine learning system is a characteristic that makes the system more reliable. Preventing the model training convergence by the Byzantine workers in the distributed machine learning systems is a significant issue, and the first-order optimization methods are improved to resolve this type of problem. In this paper, we provided a general survey of recent Byzantine fault tolerance approaches which have been discussed, and the following conclusions have been made:
\begin{itemize}
\item Works mainly aim to address synchronous settings rather than asynchronous and centralized settings rather than decentralized settings.
\item The filtering scheme is used more frequently than the coding scheme and Blockchain technology in the studied works.
\item Despite the fewer proposed methods based on Blockchain technology, the latter achieves many important results (avoid single point of failure, attains collaborative learning and data privacy, and prevent poisoning attacks) compared to other schemes. Blockchain can improve recent results and expand its use under several settings with combinations to different schemes as a research direction.
\item Because node failures or adversarial behavior of specific nodes may make it difficult to develop a robust distributed algorithm in DML, the topic of BFT in DML becomes increasingly important. To handle these sorts of problems, We argue that it is required to be able to deal with node failures, heterogeneous nodes, malicious attackers, topology settings, communication issues, mainly but also other challenges, considering DML progress such as Federated learning. Byzantine fault tolerance in Federated Learning complements this survey and represents our future work.
\end{itemize}

This paper included a comparative study of the discussed approaches and shows possible future directions for research in the context of Byzantine fault tolerance in distributed machine learning systems.

  \printbibliography
\end{document}