A "Safe Kernel" Approach for Resilient Multi-Dimensional Consensus
Extracted source text · arXiv 1911.10836
%===============================================================================
% $Id: ifacconf.tex 19 2011-10-27 09:32:13Z jpuente $
% Template for IFAC meeting papers
% Copyright (c) 2007-2008 International Federation of Automatic Control
%===============================================================================
\documentclass{ifacconf}
\usepackage{natbib} % required for bibliography
\usepackage{graphicx}
\usepackage{amsmath}
\usepackage{amssymb}
%\usepackage{amsthm}
\usepackage{tikz,pgfplots}
\pgfplotsset{compat=newest}
\usetikzlibrary{patterns}
\usepackage{algorithm}
\usepackage{algorithmic}
\renewcommand{\algorithmicrequire}{ \textbf{Initialization:}} %Use Input in the format of Algorithm
\renewcommand{\algorithmicensure}{ \textbf{Main loop:}} %UseOutput in the format of Algorithm
\DeclareMathOperator*{\argmin}{argmin}
\DeclareMathOperator*{\Conv}{Conv}
\DeclareMathOperator*{\Ver}{Ver}
\newtheorem{proposition}{Proposition}
\newtheorem{theorem}{Theorem}
\newtheorem{definition}{Definition}
\newtheorem{lemma}{Lemma}
\newtheorem{corollary}{Corollary}
\newtheorem{remark}{Remark}
\newtheorem{assumption}{Assumption}
%===============================================================================
\begin{document}
\begin{frontmatter}
\title{A ``Safe Kernel'' Approach for Resilient Multi-Dimensional Consensus}
% Title, preferably not more than 10 words.
\author[First]{Jiaqi Yan}
\author[Second]{Yilin Mo}
\author[First]{Xiuxian Li}
\author[First]{Changyun Wen}
\address[First]{School of Electrical and Electronic Engineering, Nanyang Technological University, Singapore. (e-mails: jyan004@e.ntu.edu.sg, xiuxianli@ntu.edu.sg, ecywen@ntu.edu.sg)}
\address[Second]{Department of Automation and BNRist, Tsinghua University, Beijing, China. (e-mail: ylmo@tsinghua.edu.cn)}
\begin{abstract} % Abstract of not more than 250 words.
This paper considers the resilient multi-dimensional consensus problem in networked systems, where some of the agents might be malicious (or faulty). %The existing secure algorithms normally assume a scalar scenario, whereas the multi-dimensional cases are rarely considered. To fill in this research gap,
We propose a multi-dimensional consensus algorithm, where at each time step each healthy agent computes a ``safe kernel'' based on the information from its neighbors, and modifies its own state towards a point inside the kernel.
Assuming that the number of malicious agents is locally (or globally) upper bounded, sufficient conditions on the network topology are presented to guarantee that the benign agents exponentially reach an agreement within the convex hull of their initial states, regardless of the actions of the misbehaving ones. It is also revealed that the graph connectivity and robustness required to achieve the resilient consensus increases linearly with respect to the dimension of the agents' state, indicating the existence of a trade-off between the low communication cost and system security. Numerical examples are provided in the end to validate the theoretical results.
\end{abstract}
\begin{keyword}
Average consensus, Resilient algorithm, Multidimensional systems.
\end{keyword}
\end{frontmatter}
%===============================================================================
\section{Introduction}
Recent advances in signal processing and cooperative control have led to growing research interests in networked systems. One of the most important focuses in such systems is the average consensus problem. Given a set of autonomous agents (such as sensors, vehicles, \textit{etc.}), this problem seeks for a distributed protocol that the agents can utilize to reach a common decision/agreement on the average of their initial opinions (see \cite{lynch1996distributed,olfati2007consensus}).
In the past decades, considerable attention has been paid to the development of distributed consensus algorithms (\cite{olfati2007consensus,ren2007information,wei2012distributed}). The existing protocols, although effective in solving the problems under mild conditions, are normally based on the hypothesis that every computing agent is trustworthy and cooperate to follow the algorithms throughout the execution. Nevertheless, as the scale of the network increases, it becomes more difficult to secure every agent. One primary reason is that the widely-adopted communication infrastructures in the distributed framework make it much vulnerable to external adversaries (\cite{mo2012cyber}). Especially, malicious attackers can degrade the algorithm performance by manipulating the transmitted data on communication lines. On the other hand, some agents may not be willing to follow the given rules if they weigh their private interests more than the public ones. They might send out well-designed signals to manipulate the achieved solution for their benefits. It is possible that the misbehaving agents can dictate the final consensus value, or the network may fail to reach an agreement.
It is noted that the consensus problem has been widely applied to the safety-critical systems, such as transportation (\cite{ren2007information,raffard2004distributed}), power grids (\cite{kar2014distributed,kekatos2013distributed}). Since the system failures would cause irreparable harm to economy, environment, and even public health, security and resilience are becoming priory considerations when designing the algorithms (\cite{pasqualetti2012consensus,cardenas2008research}). In recent years, the secure protocols of reaching average consensus in the presence of faulty or misbehaving agents have been widely studied (\cite{dolev1986reaching,leblanc2013resilient,vaidya2012iterative}). %Investigations on the relationship of network topology and the maximum number of tolerable faulty agents are also provided in these works.
For example, \cite{dolev1986reaching} consider the approximate consensus problem, where the approximate, rather than exact, agreement is desired in the presence of malicious agents. They consider only complete networks. In order to overrule the effects of malicious nodes, an updating strategy, namely, Mean-Subsequence Reduced \textit{(MSR)} algorithm, is proposed: each normal agent is required to discard the most extreme values in its neighborhood and updates the state based on the remaining values at any time. In a recent work, \cite{leblanc2013resilient} generalize \textit{MSR} to the Weighted Mean-Subsequence-Reduced \textit{(W-MSR)} algorithm. Instead of complete networks, they attempt to analyze this algorithm in more general topologies. A novel property named network robustness is introduced, which characterizes the resilience properties of \textit{W-MSR} in terms of the graph structure. These algorithms, under certain conditions, ensure the agreement within the range of initial values of the normal nodes, even in an adversarial environment.
However, most of the research on resilient consensus assumes that the agents' states are scalar variables, producing crucial limitations in various practical applications, such as vehicle formation control on a 2D-plane. A naive way to generalize the results on scalar system to multi-dimensional system is to apply \textit{MSR} or \textit{W-MSR} to each entry of the state vectors. The region that the benign agents converge to can be immediately identified as a multi-dimensional ``box'' limited by the minimum and maximum value of their initial states in every dimension. However, is it possible to design a resilient consensus algorithm that provides more accurate convergence results?
As proved by \cite{su2015fault}, in the presence of the misbehaving agents, it is impossible for any distributed rule to reach the exact average of the initial states of all benign agents. As a compromise, in this paper, we aim to design a multi-dimensional consensus algorithm that converges to a convex combination of these states. In the developed algorithm, each benign agent creates a ``safe kernel'' and modifies its state towards a point inside the kernel. Under certain conditions on network topology, we prove that the proposed strategy guarantees the benign agents of reaching an agreement within the convex hull of their initial values, which improves the accuracy of that by simply applying the existing algorithms to each dimension. It is also noted that the ``safe kernel'' technique can be further extended to other consensus-based problems (\textit{e.g.}, distributed optimization, distributed estimation). Therefore, our work acts as leverage in handling misfunctioning component in multi-dimensional spaces.
%The rest of paper is organized as follows. Section \ref{sec:form} presents the problem of interests, and the detailed resilient distributed algorithm is elaborated in Section \ref{sec:alg}. In Section \ref{sec:analysis}, some technical preliminaries are introduced, followed by the resilient analysis of the proposed strategy.
%We discuss an extension to the distributed optimization problem and test the main results through numerical examples respectively in Section \ref{sec:discuss} and \ref{sec:casestudy}. Finally, Section \ref{sec:conclusion} concludes the paper.
\textit{Notations:} For a vector $a$, $a_i$ denotes its $i$-th component. For set $\mathcal{S}\subset \mathbb R^d$, $\Conv(\mathcal{S})$ denotes its convex hull, namely the set of all convex combinations of the points in $\mathcal{S}$. %For a scalar $v$, $\lfloor v \rfloor =\max\{p\in \mathbb{Z}| p\leq v \}$, where $\mathbb{Z}$ is the set of integers.
\section{Preliminaries}
We start by introducing some technical preliminaries on the graph theory, which would be applied in our further analysis.
Consider the network $\mathcal{G}=\{\mathcal{V},\mathcal{E}\}$, where $\mathcal{V}$ is the set of agents, and $\mathcal{E}\subset \mathcal{V}\times\mathcal{V}$ is the set of edges. An edge between agent $i$ and $j$ is denoted by $e_{ij}\in \mathcal{E}$, indicating these two agents can communicate directly with each other. We define the neighborhood of an agent $i\in \mathcal{V}$ as $$\mathcal{N}_i=\{j\in \mathcal{V}|e_{ij}\in \mathcal{E}\}.$$
Some definitions on the robustness of graph are discussed below (\cite{zhang2015notion}):
\begin{definition}($r$-robust network):
A network $\mathcal{G}=\{\mathcal{V},\mathcal{E}\}$ is said to be $r$-robust, if for any pair of disjoint and nonempty subsets $\mathcal{V}_1, \mathcal{V}_2\subsetneq\mathcal{V}$, at least one of the following statements hold:
\begin{enumerate}
\item There exists more than one agent in $\mathcal{V}_1$, such that it has at least $r$ neighbors outside $\mathcal{V}_1$;
\item There exists more than one agent in $\mathcal{V}_2$, such that it has at least $r$ neighbors outside $\mathcal{V}_2$.
\end{enumerate}
\end{definition}
\begin{definition}(($r,s$)-robust network):
A network $\mathcal{G}=\{\mathcal{V},\mathcal{E}\}$ is said to be ($r,s$)-robust, if for any pair of disjoint and nonempty subsets $\mathcal{V}_1, \mathcal{V}_2\subsetneq\mathcal{V}$, at least one of the following statements hold:
\begin{enumerate}
\item Any agent in $\mathcal{V}_1$ has at least $r$ neighbors outside $\mathcal{V}_1$;
\item Any agent in $\mathcal{V}_2$ has at least $r$ neighbors outside $\mathcal{V}_2$;
\item There are no less than $s$ agents in $\mathcal{V}_1\cup\mathcal{V}_2$, such that each of them has at least $r$ neighbors outside the set it belongs to ($\mathcal{V}_1$ or $\mathcal{V}_2$).
\end{enumerate}
\end{definition}
Intuitively, the definitions of network robustness claim that for any two disjoint and nonempty subsets of agents, there are ``many'' agents within those sets that have a sufficient number of neighbors outsides. As we will see, the robust graph plays an important role in our analysis of achieving a resilient agreement.
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\section{Problem Formulation}\label{sec:form}
%\subsection{Resilient consensus problem}
Consider the network modeled by an undirected and connected graph $\mathcal{G}=\{\mathcal{V},\mathcal{E}\}$, where $\mathcal{V}=\{1,2,...,N\}$. At any time $k\geq 0$, let $x^i(k)\in\mathbb{R}^d$ denote the current state of agent $i$. The agents are said to reach a (distributed) consensus if and only if there exists a constant $\tilde x$, such that $\lim_{k\rightarrow \infty}x^i(k)=\tilde{x}$ holds for every agent $i$. In particular, if $\tilde{x}=1/N\sum_{i=1}^{N}x^i(0)$, an average consensus is achieved.
Many practical applications fit into the framework of average consensus (see \cite{ren2007information,xiao2007distributed}). While various strategies have been developed to facilitate it, the linear algorithms have attracted much attention due to their simplicity and ease of implementation. In such strategies, every agent $i\in\mathcal{V}$ is initialized with $x^i(0)$. At each time $k$, it receives information from all of its neighbors, and updates its own state according to the following equation:
\begin{equation}\label{eqn:updatewithoutbenign}
x^i(k+1) = a_i^i(k)x^i(k)+\sum_{j\in\mathcal{N}_i}a_j^i(k)x^j(k),
\end{equation}
The new state will then be broadcasted to its neighbors preparing for the next updating stage. The conditions under different scenarios to ensure the achievement of average consensus have been investigated widely in the literatures (see \cite{nedic2010constrained,olfati2007consensus}), the details of which are omitted here due to the space limitation.
We should note that, an implicit assumption for the effectiveness of this approach, and other distributed algorithms as well, is that all agents are reliable throughout the execution, and cooperate to achieve the desired value. However, as the number of local agents increases, certain concerns arise that might make this assumption to be violated. As discussed before, its strong dependence on the communication infrastructures creates lots of vulnerabilities for cyber attacks, where the transmitted information might be manipulated by external adversaries. Additionally, ``non-participant'' agent may exist, who deviates from the normal update rule and sends out self-designed information for its own benefits. Clearly, such illegal behaviors would degrade the performance of distributed protocols: they can either prevent the benign agents from reaching a consensus, or manipulate the final agreement to be false.
The security concerns lead to the study of resilient consensus protocols. By saying ``resilient'', we hope to achieve the following objectives, regardless of the choice of initial states and even in the adversarial environment:
\begin{enumerate}
\item\emph{Agreement:} As $k$ goes to infinity, it is held that $x^i(k) = \bar{x}$ with some $\bar{x}\in\mathbb{R}^d$, for any benign agent $i$; %\comment{This is not the same as your definition before, since you require all states converges to a constant value. you can probabiliy call this ``weak'' consensus and the one before ``strong'' consensus.}
\item\emph{Validity:} At any time and for any benign agent, its state remains in the convex hull of all benign agents' initial values.
\end{enumerate}
We elucidate these conditions as below. Firstly, the states of the benign agents should converge to the same constant value even in the presence of misbehaving ones. In addition, they are not allowed to leave the convex hull of their initial states throughout the procedure. That is, they should avoid being influenced by the misbehaviors too much. It is observed that if $1$D problem is considered, then the validity condition would be degraded to that ``\textit{the state of any benign agent always remains in the interval forming by the minimum and maximum of their initial states}''. There has been much work proved to be effective in this simple case (\textit{e.g.}, \textit{MSR} proposed by \cite{dolev1986reaching} and \textit{W-MSR} proposed by \cite{leblanc2013resilient}). However, few research efforts have been devoted to the more general multi-dimensional systems.
A naive way to tackle this problem is by simply applying the existing scalar protocols to each component of the state vectors. Nevertheless, the region that the benign agents converge to can only be guaranteed as a multi-dimensional ``box'' limited by the minimum and maximum value of their initial states at every dimension, and thus the validity condition fails to be ensured in this manner. To see this, we present a $2$-dimensional illustration in Fig. \ref{Fig: boxvsconvexhull}, indicating this naive algorithm cannot guarantee the convergence to a point inside the convex hull of initial states. Therefore, this paper intends to address this problem and come up with a method satisfying both Conditions 1) and 2).
\begin{figure}[!htbp]
\centering
\input{tikz/boxvsconvexhull.tikz}
\caption{A $2$D illustration with agents marked with circles. The location of the node indicates its initial value. With the direct application of existing algorithms to each dimension, the final agreement is ensured to be within the rectangle represented by oblique lines. However, a better solution satisfying the validity condition of converging to the solid triangle is expected. }
\label{Fig: boxvsconvexhull}
\end{figure}
\subsection{Attack model}
We define $\mathcal{F}$ as the set of malicious/faulty agents. Any agent $i\in \mathcal{F}$ could either be the adversarial one with the value being manipulated by the attacker, or the non-participant agent who does not follow the standard updating rule. We also denote $\mathcal{B}$ as the collection of benign agents who will always follow the prescribed updating strategy. It is clear that $\mathcal{B}\cap\mathcal{F}=\varnothing$ and $\mathcal{B}\cup\mathcal{F}=\mathcal{V}$.
The faulty nodes could be characterized by the scope of threats:
\begin{enumerate}
\item ($F$-total attack model) There are at most $F$ misbehaving agents in the network. That is, $|\mathcal{F}|\leq F$.
\item ($F$-local attack model) There are at most $F$ misbehaving agents in the neighborhood of any benign agent. That is, $|\mathcal{F}\cap\mathcal{N}_i|\leq F$, for any agent $i\in\mathcal{B}$.
\end{enumerate}
It is easy to conclude that $F$-total attack model is a special case of $F$-local one.
%\begin{remark}
% As we will see, the resilient strategy proposed later would be effective to work against even the worst-case attacks. Consequently, it is equivalent to replace the cardinality requirement $|\mathcal{F}|= F$ and $|\mathcal{F}\cap\mathcal{N}_i|= F$ by $|\mathcal{F}|\leq F$ and $|\mathcal{F}\cap\mathcal{N}_i|\leq F$, respectively. Thereby, we could conclude that $F$-total attack model is a special case of $F$-local one.
%\end{remark}
%We can also classify the faulty agents by its transmission capabilities \cite{lynch1996distributed}:
%\begin{enumerate}
% \item An agent is called a \emph{malicious} agent if it can only send identical information to all of its neighbors at any time step;
% \item An agent is called a \emph{Byzantine} agent if it could send different data to different neighbors at some time.
%\end{enumerate}
%\begin{remark}
% In practice, if the network is realized through broadcast communication, then it is more suitable to assume a malicious agent model. On the other hand, if the agents are adopting a point-to-point communication protocol, a Byzantine assumption is of great possibility. It is clear that a malicious agent can be regarded as a `weaker' version of Byzantine ones.
%\end{remark}
Note that we do not pose any restrictions on the transmitted information of agent $i\in\mathcal{F}$, \textit{i.e.}, the malicious agents are allowed to send out arbitrary data to their neighbors. Furthermore, they could collude among themselves to decide on the deceptive values to be communicated.
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\section{A Resilient Multi-dimensional Consensus Strategy}\label{sec:alg}
In this section, we provide a resilient consensus algorithm. To simplify notations, we have the following definitions:
\begin{definition}
Consider a set $\mathcal{A}\subset \mathbb R^d$ with cardinality $m$\footnote{To be more precise, $\mathcal A$ should be defined as a multi-set since we allow duplicate elements in the set, e.g., the states of $m$ agents shall be counted as $m$ points even if some of them may be identical.}. Let $\mathcal{S}(\mathcal{A},n)$ be the set of all its subset with cardinality $m-n$.
\end{definition}
It is clear that the set $\mathcal{S}(\mathcal{A},n)$ contains $\binom{m}{n}$ elements, and each of them is associated with a convex hull. The intersection of all these convex hulls plays a crucial role in our algorithm, which is defined as follows:
\begin{definition}\label{def: intersection}
Consider the set $\mathcal{A}\subset\mathbb R^d$ with cardinality $m$. We define $\varPsi (\mathcal{A}, n)$ as
\begin{align}
\varPsi(\mathcal A,n) \triangleq \bigcap_{S\in \mathcal S(\mathcal A,n)} \Conv(S).
\end{align}
%the convex hull of each of them is a set of all convex combinations of its points.
\end{definition}
Given the $F$-total/ $F$-local attack model introduced before, the designed algorithm is formally presented as follows. Each agent $j\in \mathcal{V}$ is initialized with a starting state $x^j(0)\in \mathbb{R}^d$. At any time $k> 0$, every benign agent $i\in\mathcal{B}$ updates as outlined in Algorithm \ref{alg:resilient}.
\begin{algorithm}
1:\: Receive the states from all neighboring agents $j\in\mathcal{N}_i$, and collect these values in $\mathcal{X}^i(k)$.\\
2:\: Define $\mathcal{R}^i(k)\triangleq\varPsi (\mathcal{X}^i(k), F)$, and denote the vertices of this set to be $\Ver(\mathcal{R}^i(k))$. Agent $i$ updates its local state as:
\begin{equation}\label{eqn:updatewithattack}
\begin{split}
x^i(k+1) = a_i^i(k)x^i(k)+\sum_{\bar{x}^j(k)\in\Ver(\mathcal{R}^i(k))}a_j^i(k)\bar{x}^j(k),
\end{split}
\end{equation} \\
satisfying that each weight is lower bounded by some $\alpha>0$, and $a_i^i(k)+\sum_{\bar{x}^j(k)\in\Ver(\mathcal{R}^i(k))}a_j^i(k)=1$.\\
3:\: Transmit updated state $x^i(k+1)$ to all neighbors $j\in\mathcal{N}_i$. \\
\caption{Resilient consensus algorithm}
\label{alg:resilient}
\end{algorithm}
\begin{remark}
We can interpret $\mathcal{R}^i(k)$ as the ``safe kernel'' (illustrated in Fig. \ref{fig:safekernel}), which is guaranteed to be within the convex hull forming by only benign ones, as we will prove later. Intuitively, at any time, the healthy agent computes and moves its state toward a point inside the ``safe kernel''. As a result, the impact of malicious agents on the benign ones are limited. The proposed protocol can be implemented in a distributive fashion, as every fault-free agent is only required to access the local information, with no need to have any knowledge of the network topology or impose extra communication among agents.
\end{remark}
\begin{figure}
\centering
\input{tikz/safekernel.tikz}
\caption{A $2$D illustration of ``safe kernel''. Suppose agent $i\in\mathcal{B}$ has $5$ neighbors and each of their states is represented by the location of a circle. Let $F=1$. The green region denotes $\mathcal{R}^i(k)=\varPhi(\mathcal{X}^i(k), 1)$, namely the ``safe kernel''. }
\label{fig:safekernel}
\end{figure}
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\section{Algorithm Analysis}\label{sec:analysis}
This section is devoted to proving the effectiveness of Algorithm \ref{alg:resilient}. In this paper, we impose the following assumption on the network topology:
\begin{assumption}\label{assump:connect}
For any $i\in\mathcal{V}$, it is held that $|\mathcal N_i|\geq (d+1)F+1$.
\end{assumption}%Both of its realizability and resiliency would be discussed.
\subsection{Realizability}
Before analyzing the resiliency of the proposed algorithm, we need to prove its realizability. First, we show that $\mathcal R^i(k)$ is non-empty. To this end, we shall begin with the introduction of Helly's theorem, which is a basic result of convexity theory and key supporting technique of this paper.
\begin{theorem}[Helly's theorem](\cite{Danzer1963Helly})\label{thm:Helly}
Let $X_1,\cdots, X_p$ be a finite collection of convex subsets in $\mathbb{R}^d$, with $p > d$. If the intersection of every $d + 1$ of these sets is nonempty, then the whole collection has a nonempty intersection. That is,
$$\bigcap _{j=1}^{p}X_{j}\neq \varnothing. $$
\end{theorem}
A direct result of Helly's theorem is as follows:
\begin{corollary}\label{lm:existence}
Let $\mathcal{A}$ be a set with cardinality $m$ in $\mathbb{R}^d$. If $m\geq n(d+1)+1$, then for any $n\leq m$, the following relation holds $$\varPsi (\mathcal{A}, n) \neq \varnothing.$$
\end{corollary}
%\begin{pf}
% The result is obvious when $n=0$. Thus we only focus on the scenario when $n\geq 1$.
%
% According to Definition \ref{def: intersection}, $\varPsi (\mathcal{A}, n)$ is a intersection of $\binom{m}{n}$ convex hulls, and it is trivial to prove that $\binom{m}{n}>d$ holds.
% On the other hand, each of these convex hulls is created by excluding $n$ elements of $\mathcal{A}$. Then consider any $d+1$ of them, they discard at most $n(d+1)$ points in all. Since $m\geq n(d+1)+1$, it must be the case that at least one element in $\mathcal{A}$ is retained by all of them. This indicates that any $(d+1)$ convex hulls must have a nonempty intersection.
% By applying Theorem \ref{thm:Helly}, our proof is completed.
%\end{pf}
By Corollary \ref{lm:existence}, we note that Assumption \ref{assump:connect} guarantees that $\mathcal{R}^i(k) \neq \varnothing$ for any $i\in\mathcal{B}$ at any time.
Next we need to show the existence of $a_j^i(k)$. Notice that the number of vertices of $\mathcal R^i(k)=\varPsi (\mathcal{X}^i(k), F)$ is upper bounded\footnote{To see this, notice that each convex hull in $\mathcal S(\mathcal X^i(k),F)$ is a polytope limited with $|\mathcal X^i(k)|-F$ number of vertices and its number of facets is bounded due to the Upper Bound Theorem (\cite{ziegler2012lectures}). As each vertex of $\mathcal{R}^i(k)$ is an intersection of at least $d$ of these facets, we know that its number is upper bounded.}, so that the lower bound of the weights $\alpha$ exists. %\comment{helly's theorem should be here since otherwise the algorithm may not exist.}
Therefore, one concludes that the proposed strategy is realizable.
\subsection{Resiliency}
Before proceeding to the main results, we shall first present some preliminary conclusions regarding $\varPsi (\mathcal{A}, n)$ [cf. Definition \ref{def: intersection}]:
\begin{proposition}\label{pro:subset}
Consider two collections of sets $\left\{A_i\right\}_{i\in I}$ and $\left\{B_j\right\}_{j\in \mathcal J}$. If for any $j\in \mathcal J$, there exists an $i\in \mathcal I$, such that $B_j\supseteq A_i$, then
\begin{align*}
\bigcap _{j\in\mathcal J} B_j \supseteq\bigcap_{i\in\mathcal I}A_i.
\end{align*}
\end{proposition}
\begin{lemma}\label{lm: subset}
Consider any set $\mathcal{A}_1$ with cardinality $m_1$ and $\mathcal{A}_2$ with cardinality $m_2$. If $\mathcal{A}_1 \subset \mathcal{A}_2$, then for any $n\leq m_1$, the following statement holds: $$\varPsi (\mathcal{A}_1, n) \subset \varPsi (\mathcal{A}_2, n).$$
\end{lemma}
%\begin{pf}
% We shall prove that every set $S_2$ in $\mathcal S(\mathcal A_2,n)$ is a superset for some set $S_1$ in $\mathcal S(\mathcal A_1,n)$. To see this, notice that
% \begin{align*}
% S_2 &= \mathcal A_2 \backslash S_2^c \supset \left(\mathcal A_2\backslash S_2^c\right)\cap \mathcal A_1\\
% &=\mathcal A_1 \backslash \left(S_2^c\cap\mathcal A_1\right),
% \end{align*}
% where $S_2^c = \mathcal A_2\backslash S_2$ is a set with cardinality $n$. Notice that $S_2^c\cap\mathcal A_1$ has cardinality no greater than $n$, which means that $\mathcal A_1 \backslash \left(S_2^c\cap\mathcal A_1\right)$ is a superset of some set in $\mathcal S(\mathcal A_1,n)$. The proof is thus finished by invoking Proposition~\ref{pro:subset}.
%\end{pf}
%\begin{proof}
%It is observed that $\varPsi (\mathcal{A}_1, n)$ is a subset of $\Conv(\mathcal{A}_1)$. Then we could rewrite it as
%\begin{equation}
%\begin{split}
%&\varPsi (\mathcal{A}_1, n)\\=&\varPsi (\mathcal{A}_1, n) \cap \underbrace{ \Conv(\mathcal{A}_1) \cap \Conv(\mathcal{A}_1) \cap \cdots \cap \Conv(\mathcal{A}_1)}_{\binom{m_2}{n}-\binom{m_1}{n}}.
%\end{split}
%\end{equation}
%By doing so, $\varPsi (\mathcal{A}_1, n)$ would be regarded as the intersection of $\binom{m_2}{n}$ convex hulls. We denote the collection of these sets, and that of the convex hulls whose intersection forms $\varPsi (\mathcal{A}_2, n)$, as $\varPi(A_1)$ and $\varPi(A_2)$, respectively. Note that both of these collections have the cardinality $\binom{m_2}{n}$.
%
%Consider any member of $\varPi(A_1)$. Without loss of generality, we let it be the convex hull of $\pi_1$ [namely $\Conv(\pi_1)$], where $\pi_1=\{i_1, i_2,...,i_{m_1-n}\}$. By Definition \ref{def: intersection}, it is clear that $\pi_1\subset \mathcal{A}_1$. Since $\mathcal{A}_1 \subset \mathcal{A}_2$, one can always find some $\Conv(\pi_2)$ in $\varPi(A_2)$, with $\pi_2=\{i_1, i_2,...,i_{m_1-n}, \underbrace{ *, \cdots,*}_{m_2-m_1}\}$ [$*$ indicates some element in $\mathcal{A}_2$]. As $\pi_1\subset\pi_2$, Proposition \ref{pro:subsetofconv} gives that $\Conv(\pi_1)\subset\Conv(\pi_2)$. Likewise, for any convex hull belonging to $ \varPi(A_2)$, one of its subsets must exist in $\varPi(A_1)$. The proof is then completed as a result of Proposition \ref{pro:subset}.
%\end{proof}
\begin{lemma}\label{lm:y^i}
Let $\mathcal{A}$ be a set with cardinality $m$ in $\mathbb{R}^d$. Supposing that $m\geq (d+1)n+1$, the following relations hold for any $n\leq m$ and any $p\in\{1,2,..,d\}$:
\begin{enumerate}
\item If no more than $n$ elements of $\mathcal{A}$ has its $p^{th}$ entry greater than $\varepsilon$, then for any $y \in\varPsi (\mathcal{A}, n)$, it is held that $y_p\leq \varepsilon$;
\item If no more than $n$ elements of $\mathcal{A}$ has its $p^{th}$ entry less than $\varepsilon$, then for any $y \in\varPsi (\mathcal{A}, n)$, it is held that $y_p\geq \varepsilon$.
\end{enumerate}
%\comment{what do you mean be $y \leq\varepsilon$ when $y$ is a vector?}
\end{lemma}
%\begin{pf}
% By Lemma \ref{lm:existence}, $\varPsi (\mathcal{A}, n)\neq \varnothing$. We then clarify the rationale of the statements as follows:
% \begin{enumerate}
% \item Suppose that we remove exactly $n$ elements in $\mathcal{A}$, which includes all the values whose $p^{th}$ entry are greater than $\varepsilon$, let us consider the convex hull of the remaining elements. It is clear that each of these members has its $p^{th}$ component no more than $\varepsilon$. As a result, any element in the convex hull formed by them also has such an upper bound in its $p^{th}$ entry. We could infer from Definition \ref{def: intersection} that $\varPsi (\mathcal{A}, n)$ is a subset of this convex hull, and thus the first statement holds.
% \item The second statement is proved in a similar manner as above.
% \end{enumerate}
%\end{pf}
Now we are ready to provide our main results. For simplicity, we denote the convex hull of the states of all benign agents at time $k$ as $\varOmega(k)$. The following theorem presents the non-expansion property of $\varOmega(k)$:
\begin{theorem}[Validity]\label{thm:safety}
Consider the network $\mathcal{G}(\mathcal{V}, \mathcal{E})$. With Algorithm \ref{alg:resilient}, the following relation holds for any $k\geq 0$:
\begin{equation}
\varOmega(k+1)\subset \varOmega(k),
\end{equation}
under either $F$-local or $F$-total attack model.
\end{theorem}
%\begin{pf}
% %At time step $k$, we focus on the `safe kernel', \textit{i.e.}, $\mathcal{R}^i(k)$, established by any healthy agent $i$. Lemma \ref{lm:existence} shows that $\mathcal{R}^i(k)$ will never be empty.
% Consider the scenario under either $F$-local or $F$-total attacks. There exist no less than $|\mathcal{X}^i(k)|-F$ benign agents in the neighborhood of the benign agent $i$. By definition, one obtains that $\mathcal{R}^i(k)$ is included in the convex hull of any $|\mathcal{X}^i(k)|-F$ neighboring states of this agent, and thus it is trivial to derive that $\mathcal{R}^i(k)$ is a subset of the convex hull of the states of benign neighbors, which implies that $\mathcal{R}^i(k)\subset\varOmega(k).
% $
% As a result, one directly has that $x^i(k+1)\in\varOmega(k)$ as it is a convex combination of some points in $\varOmega(k)$.
%
% Because the above relation holds for any benign node, $\varOmega(k+1)\subset \varOmega(k)$ holds.
%
%\end{pf}
Theorem \ref{thm:safety} indicates that the proposed algorithm guarantees the validity condition of resilient consensus. That is, the healthy agents would never be out of the convex hull of their initial values, despite the influence of the misbehaving agents. In what follows, we will provide sufficient conditions on network topology, under which the agreement condition will also be satisfied. Due to the space limitation, the proof of these theorems are omitted.
\begin{theorem}[Agreement: $F$-local]\label{thm:consensus_local}
Consider the network $\mathcal{G}(\mathcal{V}, \mathcal{E})$. Suppose the misbehaving agents follow an $F$-local attack model. If the network is with $((d+1)F+1)$-robustness, then with Algorithm \ref{alg:resilient}, all the benign agents are guaranteed to achieve consensus exponentially, regardless of the actions of misbehaving agents.
\end{theorem}
%\begin{pf}
% To establish the achievement of consensus, it is equivalent to prove that the benign agents reach an agreement at any dimension $p=\{1,2,\cdots,d\}$. Due to the symmetry between different dimensions, without loss of generality, we would only focus on the first component of local states and clarify that its agreement gap finally vanishes.
%
% For notational convenience, we respectively define $M(k)$ and $m(k)$ to be the maximum and minimum value among the first component of benign agents' local states at time $k$. That is,
% \begin{equation}\label{eqn:M(k),m(k)}
% \begin{split}
% &M(k) \triangleq \max_{i\in\mathcal{B}} x^i_1(k),\\
% &m(k) \triangleq \min_{i\in\mathcal{B}} x^i_1(k).
% \end{split}
% \end{equation}
% Note that the subscript is dropped in the above notations for the sake of brevity. We denote the temporal difference as $\Delta(k)=M(k)-m(k)$, and try to show that $\Delta(k)$ asymptotically approaches $0$.
%
% We further make the following definitions for any $\bar{k}\geq k$, and any $\epsilon\in\mathbb{R}$:
% \begin{equation}
% \begin{split}
% \mathcal{V}^M(k,\bar{k},\epsilon)\triangleq\{i\in\mathcal{V}: x^i_1(\bar{k})>M(k)-\epsilon\},\\
% \mathcal{V}^m(k,\bar{k},\epsilon)\triangleq\{i\in\mathcal{V}: x^i_1(\bar{k})<m(k)+\epsilon\}.
% \end{split}
% \end{equation}
% Clearly, $\mathcal{V}_M(k,\bar{k},\epsilon)$ [resp. $\mathcal{V}_m(k,\bar{k},\epsilon)$] includes all agents whose state's first component are greater [resp. less] than $M(k)-\epsilon$ [resp. $m(k)+\epsilon$] at time $\bar{k}$. We then define
% \begin{equation}
% \begin{split}
% \mathcal{B}^M(k,\bar{k},\epsilon)\triangleq\mathcal{V}^M(k,\bar{k},\epsilon)\cap\mathcal{B},\\
% \mathcal{B}^m(k,\bar{k},\epsilon)\triangleq\mathcal{V}^m(k,\bar{k},\epsilon)\cap\mathcal{B},
% \end{split}
% \end{equation}
% which contains only benign agents in $\mathcal{V}^M(k,\bar{k},\epsilon)$ and $\mathcal{V}^m(k,\bar{k},\epsilon)$, respectively.
%
% Supposing that $M(k)\neq m(k)$, \textit{i.e.}, $\Delta(k)>0$ at some time step $k$. Define $\epsilon_0 = \Delta(k)/2$. By the definitions, we obtain that the sets $\mathcal{B}^M(k,k,\epsilon_0)$ and $\mathcal{B}^m(k,k,\epsilon_0)$ are disjoint. Furthermore, since each of these sets contains a benign agent with the first component being $M(k)$ or $m(k)$, both of them are nonempty. As the network is $((d+1)F+1)$-robust, there exists one benign node in either $\mathcal{B}^M(k,k,\epsilon_0)$ or $\mathcal{B}^m(k,k,\epsilon_0)$ that has at least $(d+1)F+1$ neighboring agents outside its set.
%
% Without loss of generality, let agent $i\in \mathcal{B}^M(k,k,\epsilon_0)$ be such an agent that has more than $(d+1)F+1$ neighbors in $\mathcal{V}\backslash\mathcal{B}^M(k,k,\epsilon_0)$. We denote the set of these neighbors' states as $\mathcal{Y}_i(k)$. Clearly, $\mathcal{Y}^i(k)\subset \mathcal{X}^i(k)$.
%
% Under the $F$-local attack model, we know that up to $F$ neighbors of agent $i$ belong to $\mathcal{V}^M(k,k,\epsilon_0)\backslash\mathcal{B}^M(k,k,\epsilon_0)$ (this set is comprised of the faulty agents with the first component of their states being greater than $M(k)-\epsilon_0$). %Then it must be the case that more than $dF+1$ neighbors of agent $i$ belong to the set $\mathcal{V}\backslash\mathcal{V}^M(k,k,\epsilon_0)$.
% The following statements could then be derived regarding $\varPsi (\mathcal{Y}^i(k), F)$ as a result of Corollary \ref{lm:existence} and Lemmas \ref{lm: subset}-\ref{lm:y^i}:
% \begin{enumerate}
% \item $\varPsi (\mathcal{Y}^i(k), F)\neq \varnothing$;
% \item For any $y \in\varPsi (\mathcal{Y}^i(k), F)$, it is held that $y_1\leq M(k)-\epsilon_0$;
% \item $\varPsi (\mathcal{Y}^i(k), F) \subset \varPsi (\mathcal{X}^i(k), F) $ .
% \end{enumerate}
% The above relations indicate that at least one vertice of $\varPsi (\mathcal{X}^i(k), F)$ would be applied in agent $i$'s updating stage, such that it has its first component upper bounded by $M(k)-\epsilon_0$. Consequently, we obtain that
% \begin{equation}
% \begin{split}
% x^i_1(k+1)&\leq (1-\alpha)M(k)+\alpha(M(k)-\epsilon_0)\\&=M(k)-\alpha\epsilon_0.
% \end{split}
% \end{equation}
% The above relation is due to the fact that each coefficient in the combination is lower bounded by $\alpha$ and that we place the largest possible weight on $M(k)$. It is pointed out that this upper bound also applies to any benign agent in $\mathcal{V}\backslash\mathcal{V}^M(k,k,\epsilon_0)$, as it will apply its own value in updating.
%
% Similarly, if the benign agent $j \in \mathcal{B}^m(k,k,\epsilon_0)$ has at least $(d+1)F+1$ neighbors outside its set, we have an analogous result that $x^j_1(k+1)\geq m(k)+\alpha\epsilon_0,$ which again, is the lower bound for every benign agent in $\mathcal{V}\backslash\mathcal{V}^m(k,k,\epsilon_0)$.
%
% Define $\epsilon_1=\alpha\epsilon_0$. From former discussions, we know that at least one benign agent in $\mathcal{B}^M(k,k,\epsilon_0)$ having its first component decreased to below $M(k)-\epsilon_1$, or one benign agent in $\mathcal{B}^m(k,k,\epsilon_0)$ having its first component increased to above $m(k)+\epsilon_1$, or both. As a result, it must be either $\mathcal{B}^M(k,k+1,\epsilon_1)\subsetneq\mathcal{B}^M(k,k,\epsilon_0),$ or $\mathcal{B}^m(k,k+1,\epsilon_1)\subsetneq\mathcal{B}^m(k,k,\epsilon_0),$ or both.
%
% We should note that $\epsilon_1<\epsilon_0$, and therefore the sets $\mathcal{B}^M(k,k+1,\epsilon_1)$ and $\mathcal{B}^m(k,k+1,\epsilon_1)$ are still disjoint. If both of the two sets are nonempty, as above, one can conclude that at least one of the following statements is true:
% $\mathcal{B}^M(k,k+2,\epsilon_2)\subsetneq\mathcal{B}^M(k,k+1,\epsilon_1),$ or $\mathcal{B}^m(k,k+2,\epsilon_2)\subsetneq\mathcal{B}^m(k,k+1,\epsilon_1),$
% where $\epsilon_2=\alpha^2\epsilon_0$.
%
% Therefore, for each $t\geq 1$, we can recursively define $\epsilon_t =\alpha^t \epsilon_0$. As long as both of $\mathcal{B}^M(k,k+t,\epsilon_t)$ and $\mathcal{B}^m(k,k+t,\epsilon_t)$ are nonempty, we can repeat the above analysis and get the conclusion that at least one of the two sets will shrink in the next time step. Since $|\mathcal{B}^M(k,k,\epsilon_0)| + |\mathcal{B}^m(k,k,\epsilon_0)| \leq |\mathcal{B}|$, there must be the case that either $\mathcal{B}^M(k,k+|\mathcal{B}|,\epsilon_{|\mathcal{B}|})=\varnothing,$ or $\mathcal{B}^m(k,k+|\mathcal{B}|,\epsilon_{|\mathcal{B}|})=\varnothing,$ or both. We assume the former statement hold. From the definition, we know that at time step $k+\mathcal{B}$, all the fault-free agents have their first elements being at most $M(k)-\epsilon_{|\mathcal{B}|}$, \textit{i.e.},
% $M(k+|\mathcal{B}|)\leq M(k)-\epsilon_{|\mathcal{B}|}.$ On the other hand, from Theorem \ref{thm:safety}, we have
% $m(k+|\mathcal{B}|)\geq m(k).$
% As a result, it is held that,
% \begin{equation}
% \Delta(k+|\mathcal{B}|)\leq (1-\frac{\alpha^{|\mathcal{B}|}}{2})\Delta(k).
% \end{equation}
% Consequently, we conclude that $\Delta(k)$ vanishes exponentially.
%\end{pf}
The next theorem elaborates a different condition for the proposed algorithm to succeed under $F$-total threats:
\begin{theorem}[Agreement: $F$-total]\label{thm:consensus_total}
Consider the network $\mathcal{G}(\mathcal{V}, \mathcal{E})$. Suppose the misbehaving agents follow an $F$-total attack model. If the network is with $(dF+1,F+1)$-robustness, then with Algorithm \ref{alg:resilient}, all the benign agents are guaranteed to achieve consensus exponentially, regardless of the actions of misbehaving agents.
\end{theorem}
%\begin{pf}
% The above theorem is proved in the same manner as in Theorem \ref{thm:consensus_local}. Notice that the essential point is that if $\mathcal{V}^M(k,k+t,\epsilon_t)$ and $\mathcal{V}^m(k,k+t,\epsilon_t)$ are nonempty and disjoint, and if both of these sets contain some benign agents, then under $(dF+1,F+1)$-robust graph, there exists at least one benign agent in either $\mathcal{V}^M(k,k+t,\epsilon_t)$ or $\mathcal{V}^m(k,k+t,\epsilon_t)$ that has no less than $dF+1$ neighboring agents outside its set. Suppose the benign agent $i\in \mathcal{V}^M(k,k+t,\epsilon_t)$ is such a node. Following a similar proof procedure of Theorem \ref{thm:consensus_local}, we know that agent $i$ will always apply a state who has its first entry being no more than $M(k)-\epsilon_t$ for updating, under Algorithm \ref{alg:resilient}. The result can be finally concluded by applying the proof techniques of Theorem \ref{thm:consensus_local}.
%\end{pf}
%
%It is emphasized that Theorems \ref{thm:consensus_local} and \ref{thm:consensus_total} only provide sufficient conditions for the consensus to be achieved. The necessary conditions of it under both $F$-total and $F$-local model are well investigated in \cite{leblanc2013resilient}, and we omit the details here.
%
\begin{remark}
By definitions, it is easy to see that a $((d+1)F+1)$-robust graph is $(dF+1,F+1)$-robust as well, but not vice versa. That is to say, the network which is able to tolerate $F$-local attacks could also survive the $F$-total ones, while the converse is not true. This observation is consistent with the fact that the $F$-globally bounded threats are special versions of locally bounded ones.
\end{remark}
Based on the above results, one obtains immediately that the proposed algorithm facilitates the resilient consensus. We formally state it in the next theorem:
\begin{theorem}\label{thm:converge}
Consider the network $\mathcal{G}(\mathcal{V}, \mathcal{E})$. Suppose the network satisfies one of the following conditions:\\
1) under $F$-local attack model, and is $((d+1)F+1)$-robust,\\
2) under $F$-total attack model, and is $(dF+1,F+1)$-robust.\\
With Algorithm \ref{alg:resilient}, all the benign agents finally achieve a consensus within the convex hull of the initial states of benign agents, regardless of
the actions of misbehaving ones. That is, as $k\to\infty$,
\begin{equation}
x^i(k)=x^j(k) = \hat{x} \quad\mbox{ for any } i, j\in\mathcal{B},
\end{equation}
where
$\hat{x}\in \varOmega(0).$
\end{theorem}
\begin{remark}
Since the convergence of proposed algorithm does not depend on the actions of misbehaving agents, it works effectively even in the worst-case scenario, where the misbehaving agents could have full knowledge of graph topology, updating rules, \textit{etc}, and could be able to send different data to different neighbors.
\end{remark}
%\begin{remark}
% It is noted that in Assumption \ref{assump:connect}, we assume the network is with large connectivity so that every agent has a sufficient number of neighbors. Furthermore, the resiliency analysis shows that the network robustness required to achieve the consensus increases linearly with the dimension of the agents' state. Thus, a natural question arises: how to tackle this problem if the network is not `connected' and `robust' enough to meet these assumptions?
%
% Suppose the network can tolerate $F$ (locally/globally) faulty agents only when the system dimensionality is no more than $d'(<d)$. An option to handle the consensus problem is to divide each $d'$ of the $d$ components of a state vector into a group (if $d$ is not divisible by $d'$, then we have a single group whose cardinality is less than $d'$.). At any time step, Algorithm \ref{alg:resilient} is applied within every group by every benign agent. The updated results will then be rejointed in order as a $d$-dimensional vector to be broadcast to its neighbors. It is worth pointing out that this approach fails to guarantee the validity condition and instead only restricts the achieved agreement within the convex hull on every $d'$ (or less) dimensions in a group. Particularly, if $d'=1$, its performance will degrade to that of directly applying \textit{MSR} or \textit{W-MSR}. Consequently, there is a trade-off between the network sparseness and its resilient performance. This attempt is rather straightforward. We would continue to investigate this problem and seek for an algorithm with a better guarantee in the future.
%\end{remark}
Theorem \ref{thm:converge} indicates that under certain requirements on network topology, Algorithm \ref{alg:resilient} guarantees that all benign agents reach an agreement on a weighted average of their initial states, \textit{i.e.}, $\hat{x}=\sum_{i\in\mathcal{B}}\gamma_{i} x_i(0)$ with $\gamma _{i}\geq 0$ and $\sum _{i\in\mathcal{B}}\gamma_{i}=1$. As proved by \cite{su2015fault}, if $\mathcal{F}$ is nonempty, it is impossible for any distributed rule to achieve the exact average of these states. Therefore, our algorithm is effective in the sense that a suboptimal result is achieved. It protects the states of the benign agents from being driven to arbitrary values, and thus could withstand the compromise of partial agents while providing a desired level of security.
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%\section{Discussions}\label{sec:discuss}
%It is noted that the developed ``safe kernel'' technique could also be extended to increase the security and resilience of other multi-dimensional consensus-based problems, such as distributed optimization (\cite{nedic2009distributed}), \textit{etc}. In this sense, we provide a tool to work against the security breaches in multi-dimensional spaces.
%
%To see this, we take the following optimization problem as an example:
%\begin{equation}\label{Pro: ori}
%\min_x \;\;\;\frac{1}{N}\sum_{i=1}^{N} f^i(x),\\
%\end{equation}
%where $f^i: \mathbb{R}^d\to\mathbb{R}$, only known by agent $i$, is the multi-dimensional convex function. The agents aim to cooperatively solve this problem with only local information.
%
%Suppose that the system is under $F$-total/local attacks. We could come up with an analogous solution as before, combining with the standard (sub)gradient method (\cite{nedic2010constrained}). Let $\{\beta_k\}$ be a sequence of nonnegative stepsizes satisfying that $\beta_{k+1}\leq\beta_{k}$, $\sum_{k=0}^{\infty}\beta_k=\infty$, $\lim_{k\to\infty}\beta_k=0$ and $\sum_{k=0}^{\infty}\beta_k^2<\infty.$
%Every agent $j\in \mathcal{V}$ is initialized with some state $x^j(0)$. At each time $k> 0$, the proposed strategy asks the benign agent $i\in\mathcal{B}$ to make update as illustrated in Algorithm \ref{alg:resilientopt}:
%\begin{algorithm}
% 1:\: Receive the states from all neighboring agents $j\in\mathcal{N}_i$, and collect these values in $\mathcal{X}^i(k)$.\\
% 2:\: Define $\mathcal{R}^i(k)\triangleq\varPsi (\mathcal{X}^i(k), F)$, and denote the vertices of this set to be $\Ver(\mathcal{R}^i(k))$. Agent $i$ updates its local state as:
% \begin{equation}
% \begin{split}
% x^i&(k+1) \\&= a_i^i(k)x^i(k)+\sum_{\bar{x}^j(k)\in\Ver(\mathcal{R}^i(k))}a_j^i(k)\bar{x}^j(k)-\beta_{k}d^i(k),
% \end{split}
% \end{equation} \\
% where each weight is lower bounded by some $\alpha>0$ with $a_i^i(k)+\sum_{\bar{x}^j(k)\in\Ver(\mathcal{R}^i(k))}a_j^i(k)=1$, and $d^i(k)$ is the (sub)gradient of $f^i$ at the point $ a_i^i(k)x^i(k)+\sum_{\bar{x}^j(k)\in\Ver(\mathcal{R}^i(k))}a_j^i(k)\bar{x}^j(k)$.\\
% 3:\: Transmit updated state $x^i(k+1)$ to all neighbors $j\in\mathcal{N}_i$. \\
% \caption{Resilient distributed optimization algorithm}
% \label{alg:resilientopt}
%\end{algorithm}
%
%We further make the following assumption:
%\begin{assumption}
% Each local function $f^i$ is with bounded (sub)gradient.
%\end{assumption}
%
%With certain conditions on network topology, a resilient solution within the convex hull of the local minimizers of healthy agents is guaranteed to be achieved. We formally state this result in Theorem \ref{thm:distopt}, whose proof is however omitted due to the space limitation.
%\begin{theorem}\label{thm:distopt}
% Consider the network $\mathcal{G}(\mathcal{V}, \mathcal{E})$. Suppose the network satisfies one of the following conditions:\\
% 1) under $F$-local attack model, and is $((d+1)F+1)$-robust,\\
% 2) under $F$-total attack model, and is $(dF+1,F+1)$-robust.\\
% Form a point set as $\mathcal{M}\triangleq\{x^i| x^i\in \argmin_{x}f^i(x), i\in\mathcal{B}\}$, containing the local minimizers of all benign agents. With Algorithm \ref{alg:resilientopt}, all the benign agents finally achieve an agreement and converge to the convex hull of $\mathcal{M}$, regardless of
% the actions of misbehaving agents. That is, as $k\to\infty$, then for any $i, j\in\mathcal{B}$,
% \begin{equation}
% x^i(k)-x^j(k) = 0,
% \label{eq:disoptconv}
% \end{equation}
% and
% \begin{equation}\label{eqn: converge_dis_opt}
% x^i(k) \in \Conv(\mathcal M).
% \end{equation}
%\end{theorem}
%
%
%Unlike that in the standard consensus problems, in the distributed optimization problems, the benign agents may not converge to a \textit{constant} value if the actions of misbehavior agents are well-designed (although they could always reach an agreement within $\Conv(\mathcal M)$). %\comment{this contradicts with \eqref{eq:disoptconv}. if this is true, you should change \eqref{eq:disoptconv} to $x^i(k)-x^j(k)$ converges to zero for all $i$ and $j$. and $x^i(k)$ always lies in $\Conv(\mathcal M)$ for all $k$. }.
%This phenomenon is also discussed by \cite{sundaram2018distributed}.
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\section{Numerical Example}\label{sec:casestudy}
In this section, we provide numerical examples to verify the theoretical results established in the previous sections. In the example, the communication network is given by Fig. \ref{Fig:network}, in which the node set is $\mathcal{V} = \{1,2, . . .,5\}$. It is verified that the graph is $(3,2)$-robust. Suppose that agent $1$ is compromised. It intends to prevent others from reaching a correct consensus by violating the rule in Algorithm \ref{alg:resilient} and setting its states as $x^1_1(k) = 1.5*\sin(k/5)$ and $x^1_2(k) = k/25+1$ at any time $k>0$. On the other hand, the benign agents are initialized with $x^2(0)=(1,2), x^3(0)=(2,0), x^4(0)=(1,3), x^5(0)=(2,4)$, and always follow \eqref{eqn:updatewithattack} as updates. For simplicity, let their updating weights be $ a_j^i(k)= 1/(|\Ver(\mathcal{R}^i(k))|+1)$ for each $j \in \Ver(\mathcal{R}^i(k)) \cup \{i\}$.
\begin{figure}[!htbp]
\centering
\input{tikz/topology.tikz}
\caption{Communication network.}
\label{Fig:network}
\end{figure}
\begin{figure}[!htbp]
\centering
\input{tikz/test.tikz}
\caption{The trajectory of local states under Algorithm \ref{alg:resilient}, where the area surrounded by the dashed lines is the convex hull of the initial states of benign agents.}
\label{fig:trajectory}
\end{figure}
% \begin{figure}[!htbp]
% \centering
% \subfigure[The first component.]{
% \begin{minipage}{\linewidth}
% \centering
% \input{x11.tikz}
% \end{minipage}
%}
%
%\subfigure[The second component.]{
% \begin{minipage}{\linewidth}
% \centering
% \input{x22.tikz}
% \end{minipage}
%}
%\caption{The improvement of local states under Algorithm \ref{alg:resilient}, where the values of faulty and benign agents are respectively indicated by the red dashed line and the black solid ones.}
%\label{fig:performance}
%\end{figure}
We test the performance of Algorithm \ref{alg:resilient} in Fig. \ref{fig:trajectory}. The result shows that the states of benign agents are always guaranteed within the convex hull of their initial states and they finally achieve a common value, which validates Theorem \ref{thm:consensus_total}. That is, the network could tolerate a single misbehaving node in this $2$-dimensional problem. Since the malicious agent is unable to affect the final agreement too much, our protocol helps to improve the system security.
%As another example, we investigate the effectiveness of Algorithm \ref{alg:resilientopt}. We adopt the same network topology and attack models as before, but in a distributed optimization scenario. The optimization variable is $x =[x_1\; x_2]'$, and the local cost functions of benign agents are provided as $f^2(x)=x_1^2+x_2^2, f^3(x)=(x_1-1)^2+(x_2-0.5)^2, f^4(x)=(x_1-0.5)^2+(x_2-1)^2$ and $f^5(x)=(x_1+1)^2+(x_2-1)^2$ (we regard the magnitude of their gradients to be capped by some
%sufficiently large number). The step size in the algorithm is settled as $\beta_k=\frac{1}{5k}$. From Fig. \ref{fig: xresult}, it is observed that the states of benign agents achieve consensus, which is checked within the convex hull of their local minimizers.
%\begin{figure}[!htbp]
% \centering
% \input{tikz/cdcdisopt.tikz}
% \caption{The local states along iteration under Algorithm \ref{alg:resilientopt}, where the values of faulty and benign agents are distinguished by red and black color, and the first and second component of the states are represented by solid and dashed lines, respectively.}
% \label{fig: xresult}
%\end{figure}
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\section{Conclusion}\label{sec:conclusion}
Due to its wide applications, the problem of average consensus attracts much research interest in recent years. In this paper, we are interested in the achievement of average consensus under malicious agents in the multi-dimensional spaces. We propose a resilient distributed algorithm. Under certain network topology, the designed protocol is proved to guarantee that all benign agents exponentially reach an agreement within the convex hull of their initial states, regardless of the actions of faulty ones.
The future work involves the design of a more effective algorithm in the scenario where the network topology fails to meet the sufficient conditions. Furthermore, the theoretical analysis of the accomodation of ``safe kernel'' techinique to other problem settings is also a possible research direction.
\bibliography{main} % bib file to produce the bibliography
% with bibtex (preferred)
\end{document}
\begin{thebibliography}{19}
\providecommand{\natexlab}[1]{#1}
\providecommand{\url}[1]{\texttt{#1}}
\providecommand{\urlprefix}{URL }
\expandafter\ifx\csname urlstyle\endcsname\relax
\providecommand{\doi}[1]{doi:\discretionary{}{}{}#1}\else
\providecommand{\doi}{doi:\discretionary{}{}{}\begingroup
\urlstyle{rm}\Url}\fi
\bibitem[{C{\'a}rdenas et~al.(2008)C{\'a}rdenas, Amin, and
Sastry}]{cardenas2008research}
C{\'a}rdenas, A.A., Amin, S., and Sastry, S. (2008).
\newblock Research challenges for the security of control systems.
\newblock In \emph{HotSec}.
\bibitem[{Danzer et~al.(1963)Danzer, Grünbaum, and Klee}]{Danzer1963Helly}
Danzer, L., Grünbaum, B., and Klee, V. (1963).
\newblock Helly's theorem and its relatives.
\newblock \emph{Proceedings of Symposia in Pure Mathematics}, 101--180.
\bibitem[{Dolev et~al.(1986)Dolev, Lynch, Pinter, Stark, and
Weihl}]{dolev1986reaching}
Dolev, D., Lynch, N.A., Pinter, S.S., Stark, E.W., and Weihl, W.E. (1986).
\newblock Reaching approximate agreement in the presence of faults.
\newblock \emph{Journal of the ACM (JACM)}, 33(3), 499--516.
\bibitem[{Kar et~al.(2014)Kar, Hug, Mohammadi, and Moura}]{kar2014distributed}
Kar, S., Hug, G., Mohammadi, J., and Moura, J.M. (2014).
\newblock Distributed state estimation and energy management in smart grids: A
consensus$+$innovations approach.
\newblock \emph{IEEE Journal of selected topics in signal processing}, 8(6),
1022--1038.
\bibitem[{Kekatos and Giannakis(2013)}]{kekatos2013distributed}
Kekatos, V. and Giannakis, G.B. (2013).
\newblock Distributed robust power system state estimation.
\newblock \emph{IEEE Transactions on Power Systems}, 28(2), 1617--1626.
\bibitem[{LeBlanc et~al.(2013)LeBlanc, Zhang, Koutsoukos, and
Sundaram}]{leblanc2013resilient}
LeBlanc, H.J., Zhang, H., Koutsoukos, X., and Sundaram, S. (2013).
\newblock Resilient asymptotic consensus in robust networks.
\newblock \emph{IEEE Journal on Selected Areas in Communications}, 31(4),
766--781.
\bibitem[{Lynch(1996)}]{lynch1996distributed}
Lynch, N.A. (1996).
\newblock \emph{Distributed algorithms}.
\newblock Elsevier.
\bibitem[{Mo et~al.(2012)Mo, Kim, Brancik, Dickinson, Lee, Perrig, and
Sinopoli}]{mo2012cyber}
Mo, Y., Kim, T.H.J., Brancik, K., Dickinson, D., Lee, H., Perrig, A., and
Sinopoli, B. (2012).
\newblock Cyber--physical security of a smart grid infrastructure.
\newblock \emph{Proceedings of the IEEE}, 100(1), 195--209.
\bibitem[{Nedic et~al.(2010)Nedic, Ozdaglar, and
Parrilo}]{nedic2010constrained}
Nedic, A., Ozdaglar, A., and Parrilo, P.A. (2010).
\newblock Constrained consensus and optimization in multi-agent networks.
\newblock \emph{IEEE Transactions on Automatic Control}, 55(4), 922--938.
\bibitem[{Olfati-Saber et~al.(2007)Olfati-Saber, Fax, and
Murray}]{olfati2007consensus}
Olfati-Saber, R., Fax, J.A., and Murray, R.M. (2007).
\newblock Consensus and cooperation in networked multi-agent systems.
\newblock \emph{Proceedings of the IEEE}, 95(1), 215--233.
\bibitem[{Pasqualetti et~al.(2012)Pasqualetti, Bicchi, and
Bullo}]{pasqualetti2012consensus}
Pasqualetti, F., Bicchi, A., and Bullo, F. (2012).
\newblock Consensus computation in unreliable networks: A system theoretic
approach.
\newblock \emph{IEEE Transactions on Automatic Control}, 57(1), 90--104.
\bibitem[{Raffard et~al.(2004)Raffard, Tomlin, and
Boyd}]{raffard2004distributed}
Raffard, R.L., Tomlin, C.J., and Boyd, S.P. (2004).
\newblock Distributed optimization for cooperative agents: Application to
formation flight.
\newblock In \emph{Decision and Control, 2004. CDC. 43rd IEEE Conference on},
volume~3, 2453--2459. IEEE.
\bibitem[{Ren et~al.(2007)Ren, Beard, and Atkins}]{ren2007information}
Ren, W., Beard, R.W., and Atkins, E.M. (2007).
\newblock Information consensus in multivehicle cooperative control.
\newblock \emph{IEEE Control systems magazine}, 27(2), 71--82.
\bibitem[{Su and Vaidya(2015)}]{su2015fault}
Su, L. and Vaidya, N.H. (2015).
\newblock Fault-tolerant distributed optimization (part iv): constrained
optimization with arbitrary directed networks.
\newblock \emph{arXiv preprint arXiv:1511.01821}.
\bibitem[{Vaidya et~al.(2012)Vaidya, Tseng, and Liang}]{vaidya2012iterative}
Vaidya, N.H., Tseng, L., and Liang, G. (2012).
\newblock Iterative approximate byzantine consensus in arbitrary directed
graphs.
\newblock In \emph{Proceedings of the 2012 ACM symposium on Principles of
distributed computing}, 365--374. ACM.
\bibitem[{Wei and Ozdaglar(2012)}]{wei2012distributed}
Wei, E. and Ozdaglar, A. (2012).
\newblock Distributed alternating direction method of multipliers.
\newblock In \emph{2012 IEEE 51st IEEE Conference on Decision and Control
(CDC)}, 5445--5450. IEEE.
\bibitem[{Xiao et~al.(2007)Xiao, Boyd, and Kim}]{xiao2007distributed}
Xiao, L., Boyd, S., and Kim, S.J. (2007).
\newblock Distributed average consensus with least-mean-square deviation.
\newblock \emph{Journal of parallel and distributed computing}, 67(1), 33--46.
\bibitem[{Zhang et~al.(2015)Zhang, Fata, and Sundaram}]{zhang2015notion}
Zhang, H., Fata, E., and Sundaram, S. (2015).
\newblock A notion of robustness in complex networks.
\newblock \emph{IEEE Transactions on Control of Network Systems}, 2(3),
310--320.
\bibitem[{Ziegler(2012)}]{ziegler2012lectures}
Ziegler, G.M. (2012).
\newblock \emph{Lectures on polytopes}, volume 152.
\newblock Springer Science \& Business Media.
\end{thebibliography}