FLAIR: Defense against Model Poisoning Attack in Federated Learning
FLAIR: Defense against Model Poisoning Attack in Federated Learning
复制标题
DOI：
10.1145/3579856.3582836
复制
发表时间：
2023-07
期刊：
影响因子：
--
通讯作者：
Atul Sharma;Wei Chen;Joshua C. Zhao;Qiang Qiu;S. Bagchi;S. Chaterji
中科院分区：
文献类型：
--
作者：
Atul Sharma;Wei Chen;Joshua C. Zhao;Qiang Qiu;S. Bagchi;S. Chaterji
联邦学习——分散环境中的多方分布式学习——比集中式学习更容易受到模型中毒攻击。这是因为恶意客户端可以串通并发送精心定制的模型更新，以使全局模型不准确。这推动了拜占庭弹性联邦学习算法的发展，如Krum、Bulyan、FABA和FoolsGold。然而，最近开发的一种非目标模型中毒攻击表明，所有先前的防御都可以绕过。这种攻击利用的直觉是，对于一组恶意客户端，只需改变优化器正在计算的梯度更新的符号，就可以从优化器中转移模型，从而增加测试错误率。在这项工作中，我们开发了flair -一种针对这种定向偏差攻击（DDA）的防御，这是一种最先进的模型中毒攻击。FLAIR基于我们的直觉，即在联邦学习中，梯度翻转的某些模式表示攻击。这种直觉在不同的学习算法、模型和数据集上都非常稳定。FLAIR根据客户在培训阶段的行为为参与的客户分配声誉分数，然后对客户的贡献进行加权。我们表明，当20-30%的客户端是恶意客户端时，现有的FABA [IJCAI ' 19], FoolsGold [Usenix ' 20]和FLTrust [NDSS ' 21]的防御基线失效，FLAIR提供了高达45%的恶意客户端百分比的拜占庭鲁棒性。我们还表明，FLAIR甚至可以针对DDA的白盒版本提供健壮性。
Federated learning—multi-party, distributed learning in a decentralized environment—is vulnerable to model poisoning attacks, more so than centralized learning. This is because malicious clients can collude and send in carefully tailored model updates to make the global model inaccurate. This motivated the development of Byzantine-resilient federated learning algorithms, such as Krum, Bulyan, FABA, and FoolsGold. However, a recently developed untargeted model poisoning attack showed that all prior defenses can be bypassed. The attack uses the intuition that simply by changing the sign of the gradient updates that the optimizer is computing, for a set of malicious clients, a model can be diverted from the optima to increase the test error rate. In this work, we develop FLAIR—a defense against this directed deviation attack (DDA), a state-of-the-art model poisoning attack. FLAIR is based on our intuition that in federated learning, certain patterns of gradient flips are indicative of an attack. This intuition is remarkably stable across different learning algorithms, models, and datasets. FLAIR assigns reputation scores to the participating clients based on their behavior during the training phase and then takes a weighted contribution of the clients. We show that where the existing defense baselines of FABA [IJCAI ’19], FoolsGold [Usenix ’20], and FLTrust [NDSS ’21] fail when 20-30% of the clients are malicious, FLAIR provides byzantine-robustness upto a malicious client percentage of 45%. We also show that FLAIR provides robustness against even a white-box version of DDA.