FedRecover: Recovering from Poisoning Attacks in Federated Learning using Historical Information
FedRecover: Recovering from Poisoning Attacks in Federated Learning using Historical Information
复制标题
DOI：
10.1109/sp46215.2023.10179336
复制
发表时间：
2022-10
期刊：
影响因子：
--
通讯作者：
Xiaoyu Cao;Jinyuan Jia;Zaixi Zhang;N. Gong
中科院分区：
文献类型：
--
作者：
Xiaoyu Cao;Jinyuan Jia;Zaixi Zhang;N. Gong
联邦学习容易受到中毒攻击，其中恶意客户端通过向服务器发送恶意模型更新来毒害全局模型。现有的防御措施侧重于通过强大的联邦学习方法防止少量恶意客户端毒害全局模型，并在存在大量恶意客户端时检测恶意客户端。然而，如何在检测到恶意客户端后从中毒攻击中恢复全局模型仍然是一个开放的挑战。一个简单的解决方案是删除检测到的恶意客户端，并使用剩余的客户端从头开始训练一个新的全局模型。然而，这种从头开始的恢复方法会产生很大的计算和通信成本，这可能是无法忍受的资源受限的客户端，如智能手机和物联网设备。在这项工作中，我们提出了FedRecover，一种方法，可以恢复一个准确的全球模型从中毒攻击与小的计算和通信成本的客户端。我们的关键思想是服务器估计客户端的模型更新，而不是要求客户端在恢复过程中计算和传达它们。具体地，服务器在检测到恶意客户端之前训练中毒全局模型时，存储历史信息，包括全局模型和客户端在每轮中的模型更新。在恢复过程中，服务器使用其存储的历史信息来估计客户端在每一轮中的模型更新。此外，我们进一步优化FedRecover，以使用预热，定期校正，异常修复和最终调整策略来恢复更准确的全局模型，其中服务器要求客户端计算并传达其精确的模型更新。从理论上讲，我们证明了在某些假设下，FedRecover恢复的全局模型与从头开始训练恢复的模型接近或相同。从经验上讲，我们对四个数据集、三种联邦学习方法以及无针对性和有针对性的中毒攻击（例如，后门攻击）表明FedRecover既准确又高效。
Federated learning is vulnerable to poisoning attacks in which malicious clients poison the global model via sending malicious model updates to the server. Existing defenses focus on preventing a small number of malicious clients from poisoning the global model via robust federated learning methods and detecting malicious clients when there are a large number of them. However, it is still an open challenge how to recover the global model from poisoning attacks after the malicious clients are detected. A naive solution is to remove the detected malicious clients and train a new global model from scratch using the remaining clients. However, such train-from-scratch recovery method incurs a large computation and communication cost, which may be intolerable for resource-constrained clients such as smartphones and IoT devices.In this work, we propose FedRecover, a method that can recover an accurate global model from poisoning attacks with a small computation and communication cost for the clients. Our key idea is that the server estimates the clients’ model updates instead of asking the clients to compute and communicate them during the recovery process. In particular, the server stores the historical information, including the global models and clients’ model updates in each round, when training the poisoned global model before the malicious clients are detected. During the recovery process, the server estimates a client’s model update in each round using its stored historical information. Moreover, we further optimize FedRecover to recover a more accurate global model using warm-up, periodic correction, abnormality fixing, and final tuning strategies, in which the server asks the clients to compute and communicate their exact model updates. Theoretically, we show that the global model recovered by FedRecover is close to or the same as that recovered by train-from-scratch under some assumptions. Empirically, our evaluation on four datasets, three federated learning methods, as well as untargeted and targeted poisoning attacks (e.g., backdoor attacks) shows that FedRecover is both accurate and efficient.