[Paper Review] Attacks and Defenses for Free-Riders in Multi-Discriminator GAN

Zilong Zhao, Jiyue Huang+2 more|arXiv (Cornell University)|Jan 24, 2022

Adversarial Robustness in Machine Learning4 citations

TL;DR

This paper proposes a free-rider attack in Multi-Discriminator GANs (MD-GANs), where an attacker bypasses training by only using the global generator without contributing to discriminator training. The attack exploits model parameter visibility and gradient aggregation, with MD-GAN-Swap showing higher vulnerability due to model swapping; defense mechanisms achieve up to 90.74% precision in detecting free-riders, but performance degrades with more attackers.

ABSTRACT

Generative Adversarial Networks (GANs) are increasingly adopted by the industry to synthesize realistic images. Due to data not being centrally available, Multi-Discriminator (MD)-GANs training framework employs multiple discriminators that have direct access to the real data. Distributedly training a joint GAN model entails the risk of free-riders, i.e., participants that aim to benefit from the common model while only pretending to participate in the training process. In this paper, we conduct the first characterization study of the impact of free-riders on MD-GAN. Based on two production prototypes of MD-GAN, we find that free-riders drastically reduce the ability of MD-GANs to produce images that are indistinguishable from real data, i.e., they increase the FID score -- the standard measure to assess the quality of generated images. To mitigate the model degradation, we propose a defense strategy against free-riders in MD-GAN, termed DFG. DFG distinguishes free-riders and benign participants through periodic probing and clustering of discriminators' responses based on a reference response of free-riders, which then allows the generator to exclude the detected free-riders from the training. Furthermore, we extend our defense, termed DFG+, to enable discriminators to filter out free-riders at the variant of MD-GAN that allows peer exchanges of discriminators networks. Extensive evaluation on various scenarios of free-riders, MD-GAN architecture, and three datasets show that our defenses effectively detect free-riders. With 1 to 5 free-riders, DFG and DFG+ averagely decreases FID by 5.22% to 11.53% for CIFAR10 and 5.79% to 13.22% for CIFAR100 in comparison to an attack without defense. In a shell, the proposed DFG(+) can effectively defend against free-riders without affecting benign clients at a negligible computation overhead.

Motivation & Objective

• To investigate the feasibility and impact of free-rider attacks in Multi-Discriminator GANs, where clients benefit from the global generator without contributing to discriminator training.
• To evaluate how different MD-GAN frameworks (MD-GAN-Simple, MD-GAN-Swap, MD-GAN-Switch) vary in susceptibility to free-rider attacks.
• To design and assess defense mechanisms that detect and prevent free-riding behavior in distributed GAN training.
• To quantify the degradation in model quality (measured by FID) and defense accuracy as the number of free-riders increases.

Proposed method

• The attacker observes generator parameters and gradients from other discriminators, using them to generate fake samples without training its own discriminator.
• In MD-GAN-Swap, the attacker leverages peer-to-peer model swapping to mask its lack of training, potentially impersonating active clients.
• The defense mechanism monitors discriminator behavior across rounds, detecting anomalies via parameter shifts or performance inconsistencies under different data inputs.
• For MD-GAN-Swap, defense uses a combination of parameter difference analysis and behavioral consistency checks to identify free-riders.
• The system is initialized with a shared generator and local discriminators per client; training proceeds in rounds with gradient aggregation for generator updates.
• Defenses are evaluated using precision, recall, and false positive/negative rates on tabular and image datasets (MNIST, CIFAR10, CIFAR100).

Experimental results

Research questions

• RQ1 How does the presence of free-riders affect the FID score and training quality in MD-GAN frameworks?
• RQ2 What is the impact of model swapping (MD-GAN-Swap) on the detectability and success rate of free-rider attacks?
• RQ3 Can behavioral and parameter-based anomaly detection effectively identify free-riders in multi-discriminator GANs?
• RQ4 How does the number of free-riders influence the performance of defense mechanisms in terms of precision and recall?
• RQ5 How do different training strategies (MD-GAN-Simple, MD-GAN-Swap, MD-GAN-Switch) compare in resilience to free-rider attacks?

Key findings

• In MD-GAN-Simple, the FID score increases from 77.46 (no attacker) to 210.57 with five attackers, indicating severe degradation in image quality.
• In MD-GAN-Swap, the FID score rises from 75.33 (no attacker) to 160.17 with five attackers, showing higher vulnerability than MD-GAN-Simple.
• The defense mechanism for MD-GAN-Simple achieves 85.40% precision and 100% recall in detecting one attacker on MNIST, but drops to 22.62% precision with five attackers.
• For MD-GAN-Swap, the defense correctly prevents or permits 90.74% of attacks with one attacker, but precision drops to 80.00% with five attackers.
• The defense for MD-GAN-Swap reports 0% wrong permission and up to 7.88% wrong prevention with five attackers, indicating low false positives.
• With five attackers, the defense for MD-GAN-Swap maintains 100% recall on CIFAR10, but precision drops to 80.00%, showing increasing difficulty in accurate detection.