[Paper Review] FedCIP: Federated Client Intellectual Property Protection with Traitor Tracking

Junchuan Liang, Rong Wang|arXiv (Cornell University)|Jun 2, 2023

Privacy-Preserving Technologies in Data4 citations

TL;DR

FedCIP is a novel federated learning framework that enables client-side intellectual property protection with traitor tracking while remaining compatible with secure aggregation protocols like parameter encryption. It uses dynamic, replaceable client-side watermarks and client selection to identify malicious clients who repeatedly steal models, achieving 100% watermark detection accuracy even after 50 fine-tuning rounds and robustness under pruning up to 50% sparsity.

ABSTRACT

Federated learning is an emerging privacy-preserving distributed machine learning that enables multiple parties to collaboratively learn a shared model while keeping each party's data private. However, federated learning faces two main problems: semi-honest server privacy inference attacks and malicious client-side model theft. To address privacy inference attacks, parameter-based encrypted federated learning secure aggregation can be used. To address model theft, a watermark-based intellectual property protection scheme can verify model ownership. Although watermark-based intellectual property protection schemes can help verify model ownership, they are not sufficient to address the issue of continuous model theft by uncaught malicious clients in federated learning. Existing IP protection schemes that have the ability to track traitors are also not compatible with federated learning security aggregation. Thus, in this paper, we propose a Federated Client-side Intellectual Property Protection (FedCIP), which is compatible with federated learning security aggregation and has the ability to track traitors. To the best of our knowledge, this is the first IP protection scheme in federated learning that is compatible with secure aggregation and tracking capabilities.

Motivation & Objective

• Address the gap in existing IP protection schemes that lack compatibility with federated learning's secure aggregation or the ability to track persistent model thieves.
• Protect client-side model intellectual property in federated learning without modifying server-side computations, ensuring compatibility with encryption-based security.
• Enable detection of malicious clients who repeatedly steal models by embedding unique, replaceable watermarks across training rounds.
• Minimize performance overhead while maintaining high watermark detection accuracy under common model manipulation attacks like pruning and fine-tuning.
• Provide a practical, scalable solution for identifying traitors in federated learning systems under honest-but-curious server and persistent client-side theft threats.

Proposed method

• Apply replaceable client-side watermarking that dynamically alters the watermark in each federated learning round, ensuring unique watermarks per client per round.
• Use client selection based on participation in rounds with suspicious model updates to form candidate sets of potential traitors.
• Compare overlapping clients across multiple suspicious model sets to identify the actual traitor through intersection analysis.
• Integrate with secure aggregation protocols such as Paillier encryption by requiring only client-side watermark embedding, not server-side modifications.
• Leverage the fact that only clients who participate in multiple rounds with unique watermarks can be flagged, increasing the cost of theft.
• Ensure backward compatibility with existing secure aggregation by avoiding any server-side model modifications beyond necessary aggregation.

Experimental results

Research questions

• RQ1 Can a watermarking scheme be designed that enables traitor tracking in federated learning while remaining compatible with secure aggregation protocols like parameter encryption?
• RQ2 How effective is the proposed method in detecting and identifying malicious clients who repeatedly steal models across multiple training rounds?
• RQ3 What is the resilience of the watermarking scheme against common model manipulation attacks such as pruning and fine-tuning?
• RQ4 How does the dynamic watermarking mechanism affect model accuracy and detection performance in real-world federated learning settings?
• RQ5 To what extent does the traitor tracking mechanism reduce the incentive for malicious clients to engage in model theft?

Key findings

• FedCIP maintains 100% watermark detection accuracy even after 50 rounds of fine-tuning, demonstrating strong resistance to model fine-tuning attacks.
• The watermark detection accuracy remains within 5% of original values under pruning with a sparsity coefficient up to 0.5, indicating robustness against weight pruning.
• The method successfully identifies malicious clients through intersection of suspicious client sets across multiple rounds, enabling accurate traitor tracking.
• FedCIP is fully compatible with secure aggregation protocols such as Paillier encryption, as it requires no server-side model modifications beyond aggregation.
• The dynamic watermarking mechanism increases the cost of model theft by making repeated stealing detectable, thus deterring persistent attackers.
• The framework preserves model accuracy across multiple datasets and models, confirming its practicality and scalability in real federated learning deployments.