[Paper Review] Attack-Resistant Federated Learning with Residual-based Reweighting

Shuhao Fu, Chulin Xie+2 more|arXiv (Cornell University)|Dec 24, 2019

Privacy-Preserving Technologies in Data32 references58 citations

TL;DR

This paper presents a residual-based reweighting aggregation for federated learning that combines repeated median regression with IRLS-style weighting to defend against label-flipping and backdoor attacks in non-IID settings, with theoretical guarantees.

ABSTRACT

Federated learning has a variety of applications in multiple domains by utilizing private training data stored on different devices. However, the aggregation process in federated learning is highly vulnerable to adversarial attacks so that the global model may behave abnormally under attacks. To tackle this challenge, we present a novel aggregation algorithm with residual-based reweighting to defend federated learning. Our aggregation algorithm combines repeated median regression with the reweighting scheme in iteratively reweighted least squares. Our experiments show that our aggregation algorithm outperforms other alternative algorithms in the presence of label-flipping and backdoor attacks. We also provide theoretical analysis for our aggregation algorithm.

Motivation & Objective

• Motivate robust aggregation in federated learning under adversarial attacks and non-IID data.
• Develop an attack-resistant aggregation algorithm leveraging residuals and robust regression.
• Provide theoretical analysis of the proposed method and its robustness guarantees.
• Demonstrate empirical robustness across multiple datasets and task domains.

Proposed method

• Use a reweighted aggregation where each local model contributes with a weight determined by residuals to a robust regression line.
• Estimate a robust local-model regression via the repeated median estimator to obtain a regression line y = beta0 + beta1 x.
• Compute residuals and normalize them using IRLS-style scaling to derive parameter confidence scores.
• Assign weights to local models by aggregating parameter confidences, with an extreme-value correction to prevent outliers from dominating.
• Compute the global model as a weighted sum of local models using the derived model weights.
• Provide theoretical bounds showing the global model error is controlled under corrupted participants.

Experimental results

Research questions

• RQ1 Can a residual-based reweighting mechanism improve robustness of federated learning against label-flipping and backdoor attacks in non-IID settings?
• RQ2 How do robust regression estimators (like repeated median) and IRLS-inspired weighting affect aggregation quality and attack resilience?
• RQ3 What are the theoretical guarantees for the proposed attack-resistant aggregation under adversarial participation?

Key findings

• The proposed aggregation significantly mitigates the impact of attacked models under non-IID federated learning.
• The method outperforms baselines such as FedAvg, coordinate-wise median, trimmed mean, and FoolsGold under label-flipping and backdoor attacks in experiments across MNIST, CIFAR-10, Amazon Reviews, and Lending Club data.
• The approach combines repeated median regression with residual-based reweighting to assign model confidences, improving robustness without requiring extra reference datasets.
• Theoretical analysis provides bounds on the global model error in the presence of corrupted participants.
• Extreme value correction and model-wise weighting help prevent a small set of malicious updates from dominating the global model.