[Paper Review] FL-WBC: Enhancing Robustness against Model Poisoning Attacks in Federated Learning from a Client Perspective

Jingwei Sun, Ang Li+4 more|arXiv (Cornell University)|Oct 26, 2021

Privacy-Preserving Technologies in DataComputer Science28 references32 citations

TL;DR

FL-WBC introduces a client-side defense to mitigate model poisoning that has already polluted the global FL model, with a certified robustness guarantee and convergence to FedAvg.

ABSTRACT

Federated learning (FL) is a popular distributed learning framework that trains a global model through iterative communications between a central server and edge devices. Recent works have demonstrated that FL is vulnerable to model poisoning attacks. Several server-based defense approaches (e.g. robust aggregation), have been proposed to mitigate such attacks. However, we empirically show that under extremely strong attacks, these defensive methods fail to guarantee the robustness of FL. More importantly, we observe that as long as the global model is polluted, the impact of attacks on the global model will remain in subsequent rounds even if there are no subsequent attacks. In this work, we propose a client-based defense, named White Blood Cell for Federated Learning (FL-WBC), which can mitigate model poisoning attacks that have already polluted the global model. The key idea of FL-WBC is to identify the parameter space where long-lasting attack effect on parameters resides and perturb that space during local training. Furthermore, we derive a certified robustness guarantee against model poisoning attacks and a convergence guarantee to FedAvg after applying our FL-WBC. We conduct experiments on FasionMNIST and CIFAR10 to evaluate the defense against state-of-the-art model poisoning attacks. The results demonstrate that our method can effectively mitigate model poisoning attack impact on the global model within 5 communication rounds with nearly no accuracy drop under both IID and Non-IID settings. Our defense is also complementary to existing server-based robust aggregation approaches and can further improve the robustness of FL under extremely strong attacks.

Motivation & Objective

• Motivate robustness gaps in server-based defenses under extreme model poisoning attacks.
• Quantitatively analyze the long-lasting impact of poisoning on global FL models using a new metric (AEP).
• Design a client-side defense to mitigate already-polluted global models and provide theoretical guarantees.
• Demonstrate effectiveness and compatibility of FL-WBC with server-based robust aggregations across standard datasets.

Proposed method

• Define Attack Effect on Parameter (AEP) to measure poisoning impact on global model parameters.
• Derive a formal estimator for the residual attack effect over rounds and identify why AEP persists in the kernel of Hessians.
• Propose FL-WBC by perturbing small-magnitude diagonal Hessian elements during benign local training to disrupt AEP.
• Use a stochastic Laplace-noise perturbation matrix to perturb the Hessian kernel while preserving benign task performance.
• Provide a certified robustness guarantee and a convergence guarantee for FedAvg when FL-WBC is applied.
• Conduct experiments on Fashion-MNIST and CIFAR-10 under IID and non-IID settings to compare with robust aggregations and DP baselines.

Experimental results

Research questions

• RQ1 How does model poisoning leave a long-lasting imprint on the global FL model under extreme attacks?
• RQ2 Can a client-side defense disrupt the subspace where attack effects persist without sacrificing benign task performance?
• RQ3 What are the theoretical guarantees (robustness and convergence) when applying FL-WBC to FedAvg?
• RQ4 How does FL-WBC complement server-based defenses under IID and non-IID data distributions?
• RQ5 How effective is FL-WBC against state-of-the-art targeted poisoning attacks on standard datasets?

Key findings

• FL-WBC mitigates attack impact within 1-5 communication rounds depending on IID settings and dataset, with minimal benign accuracy loss.
• An attacker’s poisoning effect can persist because AEP resides in the kernel of Hessians, which server defenses cannot access.
• FL-WBC provides a certified robustness guarantee for AEP and a convergence guarantee to FedAvg.
• FL-WBC outperforms differential privacy baselines and robust aggregations in mitigating poisoning under both single and multiple malicious data points.
• FL-WBC is complementary to CMA and improves robustness when combined with server-based defenses.]
• Integration with CMA plus FL-WBC reduces attack impact to near zero within 1 round under IID settings and within 5 rounds under non-IID settings.