[Paper Review] Free-riders in Federated Learning: Attacks and Defenses

Jierui Lin, Min Du+1 more|arXiv (Cornell University)|Nov 28, 2019

Privacy-Preserving Technologies in Data34 references68 citations

TL;DR

The paper defines free-rider attacks in federated learning, introduces the STD-DAGMM detector to identify fake gradient updates, and evaluates defenses against random, delta, and advanced delta weight attacks under various data distributions and privacy settings.

ABSTRACT

Federated learning is a recently proposed paradigm that enables multiple clients to collaboratively train a joint model. It allows clients to train models locally, and leverages the parameter server to generate a global model by aggregating the locally submitted gradient updates at each round. Although the incentive model for federated learning has not been fully developed, it is supposed that participants are able to get rewards or the privilege to use the final global model, as a compensation for taking efforts to train the model. Therefore, a client who does not have any local data has the incentive to construct local gradient updates in order to deceive for rewards. In this paper, we are the first to propose the notion of free rider attacks, to explore possible ways that an attacker may construct gradient updates, without any local training data. Furthermore, we explore possible defenses that could detect the proposed attacks, and propose a new high dimensional detection method called STD-DAGMM, which particularly works well for anomaly detection of model parameters. We extend the attacks and defenses to consider more free riders as well as differential privacy, which sheds light on and calls for future research in this field.

Motivation & Objective

• Introduce the concept of free-rider attacks in federated learning and motivate their impact on rewards and model utility.
• Characterize possible fake-gradient attacks and analyze their detectability using existing anomaly detectors.
• Propose a new high-dimensional detection method (STD-DAGMM) to robustly detect fake updates.
• Evaluate attack defenses under varying data distributions and privacy considerations (including differential privacy).

Proposed method

• Define free-riders as clients that submit fake gradient updates without local data training.
• Develop and analyze attack strategies: random weights, delta weights, and advanced delta weights with Gaussian noise.
• Incorporate STD (standard deviation) into DAGMM to form STD-DAGMM for improved detection.
• Leverage DAGMM as a high-dimensional anomaly detector for model update vectors.
• Empirically evaluate detection performance on MNIST with varying data distributions and learning rates; extend discussion to differential privacy.

Experimental results

Research questions

• RQ1 How can free-rider clients construct fake gradient updates that evade common detectors in federated learning?
• RQ2 How effective are high-dimensional anomaly detectors (DAGMM) and the proposed STD-DAGMM in identifying fake updates under different attack strategies and data distributions?
• RQ3 How do learning rate, data heterogeneity, and differential privacy affect the detectability of free-rider attacks and the robustness of defenses?

Key findings

• Random weights attacks can evade autoencoder detectors but are detectable by DAGMM; STD-DAGMM further enhances detection.
• Delta weights attacks can evade DAGMM under certain settings, but STD-DAGMM remains effective across learning rates (eta) and data distributions.
• STD-DAGMM consistently detects free-riders including advanced delta weights with Gaussian noise, outperforming DAGMM alone across scenarios.
• Differential privacy can mitigate attack effectiveness and potentially aid detection, indicating DP impacts on both attack feasibility and defense.
• For multiple free riders and varying ratios, STD-DAGMM achieves higher AUC than DAGMM, though no threshold perfectly separates all attackers in all cases.