Resilient Average Consensus with Adversaries via Distributed Detection and Recovery

Consider the directed graph $\mathcal{G}=(\mathcal{V},\mathcal{E})$ consisting of the node set $\mathcal{V}=\{1,...,n\}$ and the edge set $\mathcal{E}\subset\mathcal{V}\times\mathcal{V}$. Here, the edge $(j,i)\in\mathcal{E}$ indicates that node $i$ can receive information from node $j$. Node $j$ is said to be an in-neighbor of node $i$, and node $i$ is an out-neighbor of node $j$. The sets of in-neighbors and out-neighbors of node $i$ are denoted by $\mathcal{N}_{i}^{-}=\{j\in\mathcal{V}:\,(j,i)\in\mathcal{E}\}$ and $\mathcal{N}_{i}^{+}=\{j\in\mathcal{V}:\,(i,j)\in\mathcal{E}\}$, respectively. The in-degree and out-degree of node $i$ are given by $d_{i}^{-}=\left|\mathcal{N}_{i}^{-}\right|$ and $d_{i}^{+}=\left|\mathcal{N}_{i}^{+}\right|$, respectively. Here, $\left|\mathcal{S}\right|$ is the cardinality of a finite set $\mathcal{S}$. If the graph $\mathcal{G}$ is undirected, the edge $(j,i)\in\mathcal{E}$ indicates $(i,j)\in\mathcal{E}$. A complete graph $\mathcal{K}_{n}=(\mathcal{V},\mathcal{E})$ is defined by $\mathcal{E}=\{(i,j)\in\mathcal{V}\times\mathcal{V}:i\neq j\}$. A path from node $i_{1}$ to $i_{m}$ is a sequence of distinct nodes $(i_{1},i_{2},\dots,i_{m})$, where $(i_{j},i_{j+1})\in\mathcal{E}$ for $j=1,\dots,m-1$. It is also referred to as an $(m-1)$-hop path. We say that node $i_{m}$ is reachable from node $i_{1}$. Node $i_{1}$ is an $(m-1)$-hop in-neighbor of node $i_{m}$. A directed graph $\mathcal{G}$ is said to be strongly connected¹¹1An undirected graph is simply said to be connected if every node is reachable from every other node. if every node is reachable from every other node. An undirected graph $\mathcal{G}$ is said to be $k^{\prime}$-connected if it contains at least $k^{\prime}+1$ nodes and does not contain a set of $k^{\prime}-1$ nodes whose removal disconnects the graph.

The problem of multi-agent average consensus can be described as follows: Consider a system with $n$ agents interacting over the network modeled by the directed graph $\mathcal{G}=(\mathcal{V},\mathcal{E})$. Each agent $i\in\mathcal{V}$ has a scalar state $x_{i}[k]\in\mathbb{R}$ to be updated over time $k\in\mathbb{Z}_{\geq 0}$. The goal is to design distributed algorithms that allow agents to eventually converge to the average value of their initial states $\overline{X}=\frac{1}{n}\sum_{i=1}^{n}x_{i}[0]$, where each agent utilizes only the local information from their neighboring agents during the consensus forming. The push-sum ratio consensus algorithm [42] was proposed to achieve this goal through two iterative processes on each agent. Here, we describe this algorithm for the time-varying graph $\mathcal{G}[k]=(\mathcal{V},\mathcal{E}[k])$, where $\mathcal{E}[k]\subseteq\mathcal{E}$. Denote the set of out-neighbors of agent $i$ at time $k$ by $\mathcal{N}_{i}^{+}[k]$ and the out-degree by $d_{i}^{+}[k]=|\mathcal{N}_{i}^{+}[k]|$; we employ similar notations for the set of in-neighbors $\mathcal{N}_{i}^{-}[k]$ and the in-degree $d_{i}^{-}[k]$.

We first introduce the push-sum algorithm, which is the basis of the running-sum algorithm. Each node $i$ has two state variables, $y_{i}[k]$ and $z_{i}[k]$, and updates them as

where $y_{i}[0]=x_{i}[0]$ and $z_{i}[0]=1$ for $i\in\mathcal{V}$. The algorithm requires each node $i$ to know its out-degree $d_{i}^{+}[k]$, and transmit to each out-neighbor the values

Then, by (1), these out-neighbors take the sum of received values as their new values.

At each time $k$, node $i$ calculates the ratio

Under some joint connectivity assumptions on the union of the underlying graphs in a certain time window, it was reported in, e.g., [24] that $r_{i}[k]$ asymptotically converges to the average of the initial values, i.e.,

Now, the running-sum ratio consensus algorithm is a variation of the push-sum algorithm used to overcome packet drops or unknown out degrees [11]. It can be summarized as follows. At each time $k$, node $i$ does not send $\overline{y}_{i}[k]$, $\overline{z}_{i}[k]$ in (2) to its out-neighbors. Instead, it sends the so-called $y$ and $z$ running sums denoted by $\lambda$ and $\gamma$, respectively. The two values contain the information of $\overline{y}_{i}[k]$ and $\overline{z}_{i}[k]$, and are defined as

Therefore, an out-neighbor obtains node $i$’s values $\overline{y}_{i}[k]$, $\overline{z}_{i}[k]$ by taking the difference of two consecutive $\lambda_{i}[k]$, $\gamma_{i}[k]$ as

Thus, the running-sum algorithm can achieve average consensus as the push-sum algorithm does, with additional bookkeeping procedures at each node.

Next, we formally outline the structure of the running-sum ratio consensus algorithm [11]. At each time $k$, node $i$ maintains two kinds of values: (i) the running-sum values $\lambda_{i}[k]$ and $\gamma_{i}[k]$ of its own; and (ii) the two incoming running-sums from each in-neighbor $j$. More specifically, node $i$ uses $\delta_{ij}[k]$ and $\omega_{ij}[k]$ to keep track of the $y$ and $z$ running sums from node $j$, respectively. They are given as

We now introduce the model of the adversaries and the general structure of the proposed resilient algorithm. First, the node set $\mathcal{V}$ is partitioned into the set of normal nodes $\mathcal{N}$ and the set of adversary nodes $\mathcal{A}$. The latter set is unknown to the normal nodes at time $k=0$. The adversary nodes in $\mathcal{A}$ try to prevent the normal nodes in $\mathcal{N}$ from reaching average consensus. All algorithms in this paper are synchronous.

In our problem setting, the adversary nodes can be quite powerful. We assume that they may behave arbitrarily, deviating from the protocols with which the normal nodes are equipped. Here, we define the threat model of this paper; see also [19, 22, 36, 39].

In this paper, we focus on the malicious model. This model is reasonable in applications such as wireless sensor networks and robotic networks, where neighbors’ information is obtained by broadcast communication or vision sensors [27]. This model is different from the Byzantine model, which is well-studied in computer science [1]. Specifically, a Byzantine node can send different values to its different neighbors. Here, we define a connectivity notion for directed graphs. A directed graph $\mathcal{G}$ is said to be $k^{\prime}$-strongly connected if after removing any set of nodes satisfying the ($k^{\prime}-1$)-local model, the remaining digraph is strongly connected.

As mentioned in the Introduction, the proposed algorithm for resilient average consensus is based on detection of the malicious nodes in the network. To this end, each normal node $i$ is equipped with a detection algorithm to monitor the behaviors of its own neighbors. The output of such an algorithm will be the set of malicious nodes known or detected by node $i$ by time $k$ and is denoted by $\mathcal{A}_{i}[k]$.

The overall structure of the proposed algorithm is as follows. At each time $k$, each normal node $i$ forms an information set denoted by $\Phi_{i}[k]$. This set will be shared with its out-neighbors, who will make use of it for their averaging and detection algorithms. The exact contents of the information sets will be given in the next subsection. Specifically, node $i$ conducts the four steps given below at time $k+1$:

1. Transmit the information set $\Phi_{i}[k]$ (described in (6) later) and the detection information $\mathcal{A}_{i}[k]$ to all its out-neighbors $j\in\mathcal{N}_{i}^{+}$.

2. Receive the information sets $\Phi_{j}[k]$ and the detection information $\mathcal{A}_{j}[k]$ from all in-neighbors $j\in\mathcal{N}_{i}^{-}$.

3. Detect neighbors according to the detection algorithm to obtain $\mathcal{A}_{i}[k+1]$.

4. Update $x_{i}[k+1]$ according to the resilient average consensus algorithm.

The RAC algorithm in Step 4 will be outlined in Section 3 whereas the detection algorithm in Step 3 will be given in Sections 4 and 5.

We now describe the general approach for our detection algorithms, based on the ideas from [36]. As mentioned above, each normal node monitors its neighboring nodes and checks if any inconsistencies can be found in their behaviors. In particular, our approach employs two-hop communication among the nodes. That is, each node sends the information received from its direct in-neighbors to its out-neighbors together with its own information. We assume that each node receives information from its two-hop in-neighbors via a sufficient number of different paths. Then, if any of its direct in-neigbors make changes in the information to be passed on, there will be inconsistencies in the data, which can lead to detections of misbehaviors. To formalize this approach, in this subsection, we first introduce the key notion of information sets of the nodes and then provide assumptions regarding these sets for both normal and malicious nodes.

Information sets define the data exchanged within the network for performing detection and averaging. Node $i$’s information set $\Phi_{i}[k]$ to be broadcasted at time $k+1$ is

It has three parts. The first is the set $\mathcal{A}_{i}[k]$ of adversaries detected by node $i$ by time $k$. The second and the third are node $i$’s own and its in-neighbors’ information. We use the notation $\delta_{ii}[k+1|k]$ to indicate that this value is in the set $\Phi_{i}[k]$ from time $k$. Note that $\Phi_{i}[k-1]$ and $\Phi_{i}[k]$ contain $\delta_{ii}[k|k-1]$ and $\delta_{ii}[k|k]$, respectively, and if node $i$ is malicious, these values may be different.

Next, we introduce assumptions on the nodes’ knowledge and the attacks generated by the malicious nodes.

By Assumption 1, each normal node has only partial knowledge about the network. To perform detection based on two-hop communication, normal nodes are aware of the topology of two-hop in-neighbors. This setting may be justified in sensor networks when the nodes are geographically fixed and the network topology remain the same. Similar settings are studied in [23, 39, 38]. We should highlight that this assumption can be met relatively easily and is of low cost. In MSR-based resilient consensus algorithms [32, 19], it is sufficient that fault-free nodes have access to the information only from their one-hop neighbors. Clearly, this requirement is weaker than Assumption 1, but MSR-based algorithms are not capable to detect malicious agents (though they can avoid their influences). Also, in contrast, each fault-free node must know the topology of the entire network in related works based on observer-based detection [20], [25], multi-hop communication [1], [31], and Byzantine agreement [43].

On the other hand, in Assumption 2, since two-hop communication is employed, a malicious node may modify not only its own states but also those received from its in-neighbors, which are part of its information set. This means that there are more options in terms of attacks compared to, e.g., the MSR-based algorithms. However, we emphasize that such attacks can be detected. For example, a malicious node may add or delete some pairs of agent IDs and values in its information set. It may also decide to remove information from some of its in-neighbors. Since the normal agents have the knowledge of up to their two-hop in-neighbors, attacks will be found by their direct out-neighbors. Moreover, in the case that a malicious node adopts an ID of another node, such attacks can be detected too [36]. Therefore, our approach does not assume that each node should identify the senders of incoming messages, which is imposed in [24, 38].

Consider a time-invariant directed graph $\mathcal{G}=(\mathcal{V},\mathcal{E})$. In our resilient average consensus (RAC) problem, the goal is to design distributed algorithms that allow normal agents to eventually converge to the average value of their initial states, i.e.,

regardless of the adversarial actions taken by the nodes in $\mathcal{A}$. In (7), the resilient average consensus is not defined on the true set $\mathcal{N}$ of normal agents but on the set $\mathcal{N}_{0}\supseteq\mathcal{N}$ of all nodes that behave properly over time. This is justified for the case where an adversary node acts as normal for all times. In this case, such an adversary agent’s value is included in the average computing since there is no way to detect such adversary nodes. See Section 5.5 for more discussions.

Similar problems have been studied in related works [22, 23, 38]. However, our approach has advantages over these works in different aspects as we discuss in due course.

To solve the RAC problem in a distributed iterative fashion, normal agents must know whether their neighbors are malicious or normal. Thereafter, they only interact with normal ones to obtain the desired average. Hence, our RAC algorithm contains two parts: (i) detection and (ii) averaging. The detection algorithm guarantees that each normal node can detect any malicious in-/out-neighbors. On the other hand, the averaging algorithm needs to ensure that each normal node can remove the erroneous effects received from malicious neighbors by the time those neighbors are detected as malicious.

In this section, we first present the averaging algorithm based on the RAC approach of [24], where each normal node is assumed to have access to the correct detection information of all normal nodes in the network. Note that the detection approach is not discussed in [24]. For ease of presentation, we assume that every normal node can obtain the correct detection of malicious neighbors by a certain time $k_{c}$. Our detection algorithms presented later in Sections 4 and 5 are tailored for working with this averaging algorithm and realize the important function of correct detection.

Recall that in the running-sum algorithm, each agent maintains two variables $\lambda$ and $\gamma$ to record the sum of its own $y$ and $z$ values from the initial time. This feature makes it a good basis for our RAC algorithm. Moreover, for the running-sum algorithm to achieve average consensus, the adjacency matrix needs to be column stochastic, which is easy to realize in directed networks. In contrast, the related resilient averaging works for undirected networks [23, 38] are based on average consensus via linear iterations [2], which require the adjacency matrix to be doubly stochastic. However, it may be difficult to design such an adjacency matrix for directed networks, and even tougher for time-varying networks.

Next, we introduce the major steps of our RAC algorithm. At each time $k$, each normal node $i$ utilizes the detection algorithm to update its detection information regarding in-/out-neighbors in $\mathcal{A}_{i}[k]$. Then it updates the set of non-faulty in-neighbors as $\mathcal{M}_{i}^{-}[k]=\mathcal{N}_{i}^{-}\setminus\mathcal{A}_{i}[k]$ and updates the set of non-faulty out-neighbors as $\mathcal{M}_{i}^{+}[k]=\mathcal{N}_{i}^{+}\setminus\mathcal{A}_{i}[k]$. Simultaneously, the out-degree is updated by $d_{i}^{+}[k]=|\mathcal{M}_{i}^{+}[k]|=|\mathcal{N}_{i}^{+}\setminus\mathcal{A}_{i}[k]|$. Given the new $\mathcal{A}_{i}[k]$, node $i$ updates its $y$ and $z$ using only the running sums from the in-neighbors in $\mathcal{M}_{i}^{-}[k]\cup\{i\}$:

By the assumption that every normal node obtains the correct detection of malicious neighbors by time $k_{c}$, eq. (8) constrains the averaging within only normal nodes for time $k>k_{c}$. Therefore, the running-sum algorithm on normal nodes achieves ratio consensus of the values of normal agents at time $k_{c}$ if the subgraph of normal nodes (i.e., the normal network) is strongly connected. However, due to possible erroneous effects from malicious neighbors, the sum of values of normal agents at time $k_{c}$ may not be the sum of initial values of normal agents. Thus, if the erroneous effects from malicious neighbors can be subtracted by normal agents and normal agents’ values sent to malicious neighbors can be compensated precisely, then normal agents can recover the sum of their initial values and achieve resilient average consensus.

In this part, we introduce how the normal agents conduct the subtraction of in-coming malicious values and compensation of out-going normal values, respectively. The two actions are different for the cases where in-neighbors or out-neighbors are detected as malicious for the first time. Note that the actions taken by each node $i$ are based on its own detection $\mathcal{A}_{i}[k]$.

Case 1: A malicious in-neighbor $j$ is detected for the first time at time $k$. In this case, node $i$ not only ignores node $j$’s values for updating as in (8) but also removes the effects received from node $j$ so far, i.e., $\delta_{ij}[k],\omega_{ij}[k]$ in (5). This subtraction of in-coming malicious values has to be done for each in-neighbor $j$ in the set $\Delta\mathcal{M}_{i}^{-}[k]=\mathcal{M}_{i}^{-}[k-1]\setminus\mathcal{M}_{i}^{-}[k]$, which consists of node $i$’s in-neighbors that are detected as malicious at time $k$. Specifically, we replace $y_{i}[k]$ and $z_{i}[k]$, respectively, with

Case 2: A malicious out-neighbor $q$ is detected for the first time at time $k$. In this case, node $i$ not only decreases its out-degree by one ($d_{i}^{+}[k]=d_{i}^{+}[k-1]-1$) but also compensates for all its own values sent to node $q$ while $q$ was considered normal. It does so by adding to its $y$ and $z$ values its own $y$ and $z$ running sums ($\lambda_{i}[k],\gamma_{i}[k]$), respectively. Similar to Case 1, this adjustment has to be done for every out-neighbor that is detected as malicious at time $k$. Let $\Delta\mathcal{M}_{i}^{+}[k]=\mathcal{M}_{i}^{+}[k-1]\setminus\mathcal{M}_{i}^{+}[k]$ be the set of node $i$’s out-neighbors that are detected as malicious at time $k$. Then $y_{i}[k]$ and $z_{i}[k]$ are updated as

This is needed because, e.g., $\lambda_{i}[k]$ is the cumulative $y$ values that were sent to any malicious out-neighbor by time $k$.

Finally, we are ready to present our RAC algorithm in Algorithm 1. By Assumption 1, node $i$ knows the sets $\mathcal{N}_{i}^{-}$, $\mathcal{N}_{i}^{+}$. Moreover, through our detection algorithms, node $i$ keeps track of the set of misbehaving in-/out-neighbors $\mathcal{A}_{i}[k]$ that it detected by time $k$. Then, by following the above two processes for malicious in-/out-neighbors, resilient average consensus can be achieved with Algorithm 1. The following proposition is the main convergence result for this algorithm from [24] with some enhanced applicability.

In the following sections, we present two detection algorithms for our RAC algorithm, which are redesigned based on the two-hop detection approach in our previous work [36]. In Section 4, we propose the sharing detection algorithm for undirected networks. In Section 5, we present the fully distributed detection algorithm for general directed networks. The latter algorithm is fully distributed and is efficient in storage usage compared to the related works [22, 24, 38], where each normal agent must obtain the correct detection of all malicious or normal agents in the network.

For this algorithm, the sharing detection function below is needed for the communication among the nodes when events of detecting adversaries occur.

This assumption also appeared in [37, 36] for resilient consensus. As we reported in [36], the sharing detection function can be realized by introducing fault-free mobile nodes which are appropriately distributed throughout the network and are capable to immediately verify if the detection reports from a node is true or false. Note that the deployment of such mobile agents is only for verification of detection reports instead of detecting malicious agents by themselves.

The sharing function is crucial for Algorithm 2 since it is necessary for detecting malicious nodes that are neighboring and cooperating with each other. We must emphasize that if we do not have this function for Algorithm 2, it can only handle the case where no neighboring malicious nodes exist (i.e., any malicious node is surrounded by normal nodes only). This is exactly the case studied in related works [23, 39, 38].

We now present Algorithm 2. To ensure that all nodes follow the correct averaging in Algorithm 1, the normal nodes check consistency among the neighbors’ information sets. In Algorithm 2, step 1 is to guarantee that each normal node should not use the values from the nodes detected as malicious already. Moreover, it ensures that a node does not falsely claim another node being malicious. Step 2 is to prevent the malicious nodes from faking any neighbors. Step 3 is to enforce the normal nodes not to modify the values received from their neighbors. Finally, step 4 is to guarantee that the neighbors follow the averaging in Algorithm 1.

In this part, we provide the necessary graph condition for Algorithm 2. We can observe that a malicious node can be detected if there is at least one normal node among its neighbors that monitors its behavior. However, such detection may fail if neighboring malicious nodes cooperate with each other. Hence, it is critical that one or more normal nodes are present as their common neighbors. We illustrate this graph structure in Fig. 1(a). Here, nodes $i$ and $j$ are malicious. They can cooperate as follows: Node $i$ manipulates $\delta_{ij}[k|k]$ in its information set, and node $j$ manipulates $\delta_{ji}[k|k]$ in its information set. If there is no normal node having access to the information sets of both nodes $i$ and $j$, such an attack will not be detected. In contrast, the detection works if there is a common neighbor $h$ of nodes $i$ and $j$.

Next, we state the necessary and sufficient graph condition for Algorithm 2 to detect all the misbehaving agents.

Given that the malicious nodes are unknown and possibly cooperate with each other to launch attacks, we should impose a connectivity requirement so that the condition in Lemma 1 holds for any possible combination of pairs of neighboring malicious nodes in the network. The following proposition is the main result of this section.

We proved in [36] that under the $f$-total model, the graph condition in Lemma 1 is equivalent to condition (a) in Proposition 4.2. Moreover, condition (b) in Proposition 4.2 guarantees that the normal network is connected. Thus, normal nodes using Algorithm 1 with Detection Algorithm 2 can achieve resilient average consensus as we proved in Proposition 1.

As we will further explain in Section 6.2, the graph condition for Algorithm 2 does not require dense graph structures. However, this feature is achieved at the cost of additional authentication from the secure mobile agents.

In the last section, we have seen that node $i$’s information set consists of two parts that need to be investigated by its out-neighbors: (i) the current value $\overline{y}_{i}[k]$ ($\overline{z}_{i}[k]$) to check if it is updated according to Algorithm 1; (ii) the past values $\delta_{ij}[k]$ ($\omega_{ij}[k]$) used as inputs for updates to check if they are equal to the true values of the corresponding nodes. In Algorithm 2, normal node $i$ can check whether part of the past values are manipulated in the information sets of its neighbors. More specifically, node $i$ knows the true past values of its direct neighbors. Then, using the sharing detection function, node $i$ can report a malicious node (or a pair of neighboring malicious nodes) if any values known by itself are manipulated.

However, to achieve fully distributed detection without any outside authentication, node $i$ should be able to independently verify whether any entries of the past values are manipulated in the information sets of its in-neighbors. We have seen that node $i$ can directly obtain the original value and the detection information of an in-neighbor $j$. For other values that node $i$ cannot directly obtain, we impose a certain graph structure so that it can access the original value and the detection information of a two-hop in-neighbor $h$ through majority voting. Specifically, if node $i$ receives $m$ values of node $h$, among the $m$ values, if more than $m/2$ values are the same, then node $i$ will take it as the true value of node $h$. In computer science, such redundancy schemes are common strategies to enhance the security and reliability of systems [41, 40].

Next, we formally introduce the notion of detectable nodes to indicate the kind of nodes that can be detected by node $i$ using Algorithm 3.

We illustrate the above graph condition in Fig. 2. Here, we also say that there is a detectable path from node $h$ to node $i$ if node $h$ is detectable by node $i$. To achieve fully distributed detection, we need to impose a certain graph structure so that each node can have access to the necessary information used in its neighbors’ updates (see Fig. 3). We introduce the graph condition for Algorithm 3 as follows.

Although the above graph condition may require a locally dense graph structure, such a graph does not necessarily have a small diameter. This means that the path length of the shortest path between any two nodes may not be small. In fact, we can construct graphs satisfying the conditions in large scales. See the examples in Section 5.4.

We now present Algorithm 3. Each normal node $i$ performs majority voting on two things: the nodes’ values and the detection information. Since we consider the $f$-local model in this section, if node $i$ receives the same information from at least $f+1$ distinct in-neighbors, it considers this information trustable. Additionally, node $i$ keeps a local set (only accessible to $i$) for the detection of two-hop in-neighbors as $\mathcal{A}_{i}^{2}[k]$ at time $k$. After obtaining the true values of its one-hop in-neighbors $\forall j\in\mathcal{N}_{i}^{-}$ and two-hop in-neighbors $\forall h\in\mathcal{N}_{i}^{2-}$, it follows similar procedures as the ones in Algorithm 2.

In Algorithm 3, we must impose the connectivity requirement in Assumption 4 on every node and its in-/out-neighbors. This enables the detection to be guaranteed for any combination of nodes being malicious in the network. The following theorem is the main result of this section.