[Paper Review] Abnormal Client Behavior Detection in Federated Learning

Suyi Li, Yong Cheng+3 more|arXiv (Cornell University)|Oct 22, 2019

Privacy-Preserving Technologies in Data29 references111 citations

TL;DR

The paper proposes a server-side anomaly-detection approach using autoencoders to identify abnormal client updates in federated learning and exclusion of malicious clients, improving accuracy over defense-based methods.

ABSTRACT

In federated learning systems, clients are autonomous in that their behaviors are not fully governed by the server. Consequently, a client may intentionally or unintentionally deviate from the prescribed course of federated model training, resulting in abnormal behaviors, such as turning into a malicious attacker or a malfunctioning client. Timely detecting those anomalous clients is therefore critical to minimize their adverse impacts. In this work, we propose to detect anomalous clients at the server side. In particular, we generate low-dimensional surrogates of model weight vectors and use them to perform anomaly detection. We evaluate our solution through experiments on image classification model training over the FEMNIST dataset. Experimental results show that the proposed detection-based approach significantly outperforms the conventional defense-based methods.

Motivation & Objective

• Motivate the need to detect abnormal (Byzantine) clients in federated learning to protect model quality and privacy.
• Propose a detection-based framework that uses anomaly scores derived from autoencoder-based reconstruction errors.
• Enable aggregation with credit scores that downweight or exclude anomalous clients while preserving convergence.
• Demonstrate that detection-based methods can outperform traditional defense-based approaches in non-iid federated settings.

Proposed method

• Assign a credit score to each client based on its anomaly score and local data size.
• Replace the FedAvg data-weighting term with a per-round credit term alpha_t+1^k to guide aggregation.
• Use a pre-trained autoencoder at the server to compute anomaly scores from low-dimensional surrogates of client weight updates.
• Apply dimensionality reduction to high-dimensional model weights to form surrogate inputs for the autoencoder.
• Compute anomaly score A_t+1^k from reconstruction error and a normalization term (Eq. 5).
• Optionally threshold anomaly scores to hard-limit contributions from suspected anomalous clients.

Experimental results

Research questions

• RQ1 How effective is server-side autoencoder-based anomaly detection in identifying abnormal federated learning clients?
• RQ2 Does incorporating anomaly-based credit scores improve aggregation performance compared to traditional defense-based methods under non-iid data and various attacks?
• RQ3 What is the impact of dimensionality reduction on detection efficacy and computational feasibility?
• RQ4 How does the detection-based approach perform relative to defense-based baselines such as GeoMed, Krum, and Trimmed Mean under targeted attacks?

Key findings

• Detection-based methods outperform defense-based schemes across evaluated attacks.
• Hard-thresholding the anomaly scores can make the jointly trained model nearly as good as FedAvg without attackers.
• Under sign-flipping attacks, the proposed approach improves model accuracy by 10% or more over GeoMed in the experiments.
• The method uses autoencoder-based anomaly detection with dimensionality reduction to handle high-dimensional model weights.
• Experiments on FEMNIST show the approach works in a non-iid federated setting with 3,500 writers and 20 selected clients per round.
• Thresholding and credit-score aggregation provide robust defense against malicious or malfunctioning clients.