[Paper Review] Cronus: Robust and Heterogeneous Collaborative Learning with Black-Box Knowledge Transfer

Hongyan Chang, Virat Shejwalkar+2 more|arXiv (Cornell University)|Dec 24, 2019

Privacy-Preserving Technologies in Data50 references91 citations

TL;DR

Cronus enables robust, privacy-preserving collaborative learning by transferring knowledge through black-box model predictions, supporting heterogeneous architectures and offering strong resistance to poisoning attacks with lower sample complexity.

ABSTRACT

Collaborative (federated) learning enables multiple parties to train a model without sharing their private data, but through repeated sharing of the parameters of their local models. Despite its advantages, this approach has many known privacy and security weaknesses and performance overhead, in addition to being limited only to models with homogeneous architectures. Shared parameters leak a significant amount of information about the local (and supposedly private) datasets. Besides, federated learning is severely vulnerable to poisoning attacks, where some participants can adversarially influence the aggregate parameters. Large models, with high dimensional parameter vectors, are in particular highly susceptible to privacy and security attacks: curse of dimensionality in federated learning. We argue that sharing parameters is the most naive way of information exchange in collaborative learning, as they open all the internal state of the model to inference attacks, and maximize the model's malleability by stealthy poisoning attacks. We propose Cronus, a robust collaborative machine learning framework. The simple yet effective idea behind designing Cronus is to control, unify, and significantly reduce the dimensions of the exchanged information between parties, through robust knowledge transfer between their black-box local models. We evaluate all existing federated learning algorithms against poisoning attacks, and we show that Cronus is the only secure method, due to its tight robustness guarantee. Treating local models as black-box, reduces the information leakage through models, and enables us using existing privacy-preserving algorithms that mitigate the risk of information leakage through the model's output (predictions). Cronus also has a significantly lower sample complexity, compared to federated learning, which does not bind its security to the number of participants.

Motivation & Objective

• Motivate and address privacy, security, and heterogeneity limitations in federated learning.
• Propose a knowledge-transfer based framework that exchanges predictions rather than model parameters.
• Provide robust aggregation with reduced dimensionality to enable strong theoretical guarantees.
• Demonstrate practicality on heterogeneous architectures and public data through empirical evaluation.

Proposed method

• Use black-box knowledge transfer to exchange distilled predictions on a public unlabeled dataset.
• Reduce update dimensionality from full model parameters to output predictions to enable robust aggregation.
• Aggregate predictions with a robust mean/aggregation algorithm designed for low-dimensional updates.
• Allow heterogeneous model architectures by treating local models as teachers and updates as soft labels.
• Incorporate privacy-preserving mechanisms for sharing predictions and regularize with distillation to mitigate information leakage.
• Evaluate Cronus against poisoning and membership inference attacks, comparing to FedAvg and other robust aggregations.

Experimental results

Research questions

• RQ1 Can black-box knowledge transfer enable robust and private collaborative learning across heterogeneous models?
• RQ2 Does Cronus provide provable robustness guarantees at smaller model dimensions than parameter-based federated learning?
• RQ3 How does Cronus perform under poisoning and membership inference attacks compared to existing aggregation schemes?
• RQ4 What is the empirical performance of Cronus on common benchmarks with heterogeneous architectures?

Key findings

• Cronus shows strong robustness: under strongest attacks, model accuracy drops are limited (examples include up to 2% drop across evaluated datasets).
• Cronus achieves markedly reduced sample complexity, enabling strong error guarantees with far fewer participants than standard federated learning.
• Empirical results show Cronus outperforms FedAvg and other aggregations under attack across SVHN, MNIST, Purchase, and CIFAR-10 benchmarks.
• The use of predictions on a public dataset reduces white-box information leakage and supports privacy-preserving collaboration.
• Heterogeneous architectures are supported without compromising final accuracy, thanks to distillation-based knowledge transfer.
• Across datasets, Cronus maintains higher or competitive accuracy compared to stand-alone and centralized baselines while offering enhanced security properties.