[Paper Review] Delving into the Adversarial Robustness of Federated Learning

Jie Zhang, Bo Li+5 more|arXiv (Cornell University)|Feb 19, 2023

Adversarial Robustness in Machine Learning4 citations

TL;DR

This paper proposes Decision Boundary based Federated Adversarial Training (DBFAT), a novel federated learning method that enhances both clean accuracy and robustness by combining local re-weighting of samples near the decision boundary with global regularization using logits from the aggregated global model. DBFAT consistently outperforms state-of-the-art baselines across multiple datasets under both IID and non-IID data settings, achieving higher clean accuracy and robust accuracy without sacrificing adversarial defense performance.

ABSTRACT

In Federated Learning (FL), models are as fragile as centrally trained models against adversarial examples. However, the adversarial robustness of federated learning remains largely unexplored. This paper casts light on the challenge of adversarial robustness of federated learning. To facilitate a better understanding of the adversarial vulnerability of the existing FL methods, we conduct comprehensive robustness evaluations on various attacks and adversarial training methods. Moreover, we reveal the negative impacts induced by directly adopting adversarial training in FL, which seriously hurts the test accuracy, especially in non-IID settings. In this work, we propose a novel algorithm called Decision Boundary based Federated Adversarial Training (DBFAT), which consists of two components (local re-weighting and global regularization) to improve both accuracy and robustness of FL systems. Extensive experiments on multiple datasets demonstrate that DBFAT consistently outperforms other baselines under both IID and non-IID settings.

Motivation & Objective

• To investigate the adversarial robustness of federated learning systems, particularly the trade-off between clean accuracy and robustness under non-IID data distributions.
• To identify the negative impact of standard adversarial training in FL, which significantly degrades clean accuracy, especially in non-IID settings.
• To develop a new federated adversarial training method that simultaneously improves both clean accuracy and robustness without compromising either.

Proposed method

• Introduces local re-weighting during client updates, assigning higher weights to samples near the decision boundary to improve local robustness.
• Applies a global regularization term using logits from the global model to stabilize training and enhance clean accuracy across clients.
• Uses a hybrid loss function combining cross-entropy with adversarial examples and a decision boundary-aware regularization component.
• Employs a two-stage training process: local adversarial training with re-weighting, followed by global model aggregation with regularization.
• Treats the global model's logits as a knowledge distillation signal to guide local models toward better generalization.
• Optimizes the regularization strength via hyperparameter $eta$, which balances clean accuracy and robustness.

Experimental results

Research questions

• RQ1 Why does standard adversarial training in federated learning lead to a significant drop in clean accuracy, especially under non-IID data distributions?
• RQ2 How can we improve adversarial robustness in federated learning without sacrificing clean accuracy?
• RQ3 What role does the decision boundary play in the performance degradation of federated adversarial training?
• RQ4 Can local re-weighting and global regularization jointly enhance both robustness and accuracy in FL?
• RQ5 How does the proposed method compare to state-of-the-art federated adversarial training baselines across diverse datasets and data distribution settings?

Key findings

• DBFAT achieves 52.16% clean accuracy and 27.80% average robust accuracy on non-IID CIFAR10, outperforming all baselines.
• On ImageNet-12, DBFAT achieves 61.38% clean accuracy and 22.08% robust accuracy under AutoAttack, the highest among all methods tested.
• Abllation studies show that removing the re-weighting strategy causes a 3.72% drop in clean accuracy on CIFAR10, highlighting its critical role in mitigating data imbalance.
• The regularization term with $eta=1.5$ on MNIST yields 53.22% average robust accuracy, demonstrating optimal trade-off between accuracy and robustness.
• Training curves show that DBFAT maintains high clean accuracy throughout training, unlike PGD_AT, which performs poorly due to poor generalization.
• On FMNIST, DBFAT achieves 75.89% clean accuracy and 59.63% average robust accuracy, significantly outperforming methods without re-weighting or regularization.