LoMar: A Local Defense Against Poisoning Attack on Federated Learning
LoMar: A Local Defense Against Poisoning Attack on Federated Learning
复制标题
DOI：
10.1109/tdsc.2021.3135422
复制
发表时间：
2022-01
影响因子：
7.3
通讯作者：
Xingyu Li;Zhe Qu;Shangqing Zhao;Bo Tang;Zhuo Lu;Yao-Hong Liu
中科院分区：
文献类型：
--
作者：
Xingyu Li;Zhe Qu;Shangqing Zhao;Bo Tang;Zhuo Lu;Yao-Hong Liu
联邦学习（FL）提供了一种高效的分散式机器学习框架，其中训练数据仍然分布在网络中的远程客户端。虽然FL使用物联网设备实现了隐私保护的移动的边缘计算框架，但最近的研究表明，这种方法容易受到来自远程客户端的中毒攻击。为了解决FL上的中毒攻击，我们提供了一个两阶段的防御算法，称为${\underline{Lo}cal\ \underline{Ma}licious\ Facto\underline{r}}$Lo_calMa_licious_Factor_flag（LoMar）。在第一阶段，LoMar通过使用核密度估计方法测量其邻居的相对分布来对来自每个远程客户端的模型更新进行评分。在第二阶段，一个最佳的阈值近似区分恶意和干净的更新从统计的角度来看。在四个真实数据集上进行了综合实验，实验结果表明，该防御策略能够有效地保护FL系统。具体而言，在标签翻转攻击下对Amazon数据集的防御性能表明，与FG+克鲁姆相比，LoMar将目标标签测试准确率从96.0\%$96.0%提高到98.8\%$98.8%，总体平均测试准确率从90.1\%$90.1%提高到97.0\%$97.0%。
Federated learning (FL) provides a high efficient decentralized machine learning framework, where the training data remains distributed at remote clients in a network. Though FL enables a privacy-preserving mobile edge computing framework using IoT devices, recent studies have shown that this approach is susceptible to poisoning attacks from the side of remote clients. To address the poisoning attacks on FL, we provide a two-phase defense algorithm called ${\underline{Lo}cal\ \underline{Ma}licious\ Facto\underline{r}}$Lo̲calMa̲liciousFactor̲ (LoMar). In phase I, LoMar scores model updates from each remote client by measuring the relative distribution over their neighbors using a kernel density estimation method. In phase II, an optimal threshold is approximated to distinguish malicious and clean updates from a statistical perspective. Comprehensive experiments on four real-world datasets have been conducted, and the experimental results show that our defense strategy can effectively protect the FL system. Specifically, the defense performance on Amazon dataset under a label-flipping attack indicates that, compared with FG+Krum, LoMar increases the target label testing accuracy from $96.0\%$96.0% to $98.8\%$98.8%, and the overall averaged testing accuracy from $90.1\%$90.1% to $97.0\%$97.0%.