[论文解读] Cronus: Robust and Heterogeneous Collaborative Learning with Black-Box Knowledge Transfer

Hongyan Chang, Virat Shejwalkar+2 more|arXiv (Cornell University)|Dec 24, 2019

Privacy-Preserving Technologies in Data参考文献 50被引用 91

一句话总结

Cronus 实现稳健、隐私保护的协作学习，通过对黑箱模型预测的知识转移来实现，支持异构架构，并在较低样本复杂度下对中毒攻击具有较强韧性。

ABSTRACT

Collaborative (federated) learning enables multiple parties to train a model without sharing their private data, but through repeated sharing of the parameters of their local models. Despite its advantages, this approach has many known privacy and security weaknesses and performance overhead, in addition to being limited only to models with homogeneous architectures. Shared parameters leak a significant amount of information about the local (and supposedly private) datasets. Besides, federated learning is severely vulnerable to poisoning attacks, where some participants can adversarially influence the aggregate parameters. Large models, with high dimensional parameter vectors, are in particular highly susceptible to privacy and security attacks: curse of dimensionality in federated learning. We argue that sharing parameters is the most naive way of information exchange in collaborative learning, as they open all the internal state of the model to inference attacks, and maximize the model's malleability by stealthy poisoning attacks. We propose Cronus, a robust collaborative machine learning framework. The simple yet effective idea behind designing Cronus is to control, unify, and significantly reduce the dimensions of the exchanged information between parties, through robust knowledge transfer between their black-box local models. We evaluate all existing federated learning algorithms against poisoning attacks, and we show that Cronus is the only secure method, due to its tight robustness guarantee. Treating local models as black-box, reduces the information leakage through models, and enables us using existing privacy-preserving algorithms that mitigate the risk of information leakage through the model's output (predictions). Cronus also has a significantly lower sample complexity, compared to federated learning, which does not bind its security to the number of participants.

研究动机与目标

• 在联合学习中激发并解决隐私、安全和异质性方面的局限性。
• 提出一个基于知识转移的框架，通过交换预测而非模型参数来实现。
• 提供降维的鲁棒聚合，以实现强理论保证。
• 通过实证评估，在异构架构和公开数据上展示其实用性。

提出的方法

• 使用黑箱知识转移在公共未标记数据集上交换蒸馏预测。
• 将更新的维度从完整模型参数降至输出预测，以实现鲁棒聚合。
• 使用为低维更新设计的鲁棒均值/聚合算法对预测进行聚合。
• 通过将本地模型视为教师、更新视为软标签，允许异构模型架构。
• 纳入用于共享预测的隐私保护机制，并通过蒸馏正则化以降低信息泄露。
• 评估 Cronus 对抗中毒攻击和成员信息推断攻击的效果，并与 FedAvg 及其他鲁棒聚合方法进行比较。

实验结果

研究问题

• RQ1 黑箱知识转移是否能在异构模型之间实现稳健且私密的协作学习？
• RQ2 Cronus 是否在比基于参数的联邦学习更小的模型维度下提供可证明的鲁棒性保证？
• RQ3 与现有聚合方案相比，Cronus 在中毒攻击和成员推断攻击下的表现如何？
• RQ4 在具有异构架构的常见基准数据集上，Cronus 的经验性能如何？

主要发现

Dataset	Stand-alone	Centralized	FedAvg	Cronus
SVHN	87.5	96.4	95.9	91.1
MNIST	92.8	97.9	96.7	95.2
Purchase	76.3	94.3	93.3	89.6
CIFAR10	66.8	90.2	88.4	80.1

• Cronus 显示出强鲁棒性：在最强攻击下，模型准确率下降有限（在所评估的数据集上下降最多约为 2%）。
• Cronus 实现显著降低的样本复杂度，使得在比标准联邦学习需要的参与者数量更少的情况下获得强错误保证。
• 实证结果表明，在攻击下 Cronus 在 SVHN、MNIST、Purchase 和 CIFAR-10 基准上优于 FedAvg 和其他聚合方法。
• 在公共数据集上的预测使用减少了白盒信息泄漏，支持隐私保护的协作。
• 由于基于蒸馏的知识转移，异构架构在不影响最终准确性的前提下得到支持。
• 在各数据集上，Cronus 相对于独立和集中基线保持更高或具有竞争力的准确性，同时提供增强的安全属性。