[Paper Review] G$^2$uardFL: Safeguarding Federated Learning Against Backdoor Attacks through Attributed Client Graph Clustering

Hao Yu, Chuan Ma+6 more|arXiv (Cornell University)|Jun 8, 2023

Privacy-Preserving Technologies in Data8 citations

TL;DR

G2uardFL reframes malicious-client detection as attributed graph clustering to defend federated learning against backdoor attacks, with convergence guarantees and strong empirical results.

ABSTRACT

Federated Learning (FL) offers collaborative model training without data sharing but is vulnerable to backdoor attacks, where poisoned model weights lead to compromised system integrity. Existing countermeasures, primarily based on anomaly detection, are prone to erroneous rejections of normal weights while accepting poisoned ones, largely due to shortcomings in quantifying similarities among client models. Furthermore, other defenses demonstrate effectiveness only when dealing with a limited number of malicious clients, typically fewer than 10%. To alleviate these vulnerabilities, we present G$^2$uardFL, a protective framework that reinterprets the identification of malicious clients as an attributed graph clustering problem, thus safeguarding FL systems. Specifically, this framework employs a client graph clustering approach to identify malicious clients and integrates an adaptive mechanism to amplify the discrepancy between the aggregated model and the poisoned ones, effectively eliminating embedded backdoors. We also conduct a theoretical analysis of convergence to confirm that G$^2$uardFL does not affect the convergence of FL systems. Through empirical evaluation, comparing G$^2$uardFL with cutting-edge defenses, such as FLAME (USENIX Security 2022) [28] and DeepSight (NDSS 2022) [36], against various backdoor attacks including 3DFed (SP 2023) [20], our results demonstrate its significant effectiveness in mitigating backdoor attacks while having a negligible impact on the aggregated model's performance on benign samples (i.e., the primary task performance). For instance, in an FL system with 25% malicious clients, G$^2$uardFL reduces the attack success rate to 10.61%, while maintaining a primary task performance of 73.05% on the CIFAR-10 dataset. This surpasses the performance of the best-performing baseline, which merely achieves a primary task performance of 19.54%.

Motivation & Objective

• Address backdoor vulnerabilities in federated learning without data sharing.
• Overcome limitations of anomaly-based defenses by using graph-based client relationships.
• Reform malicious-client detection as attributed graph clustering with low-dimensional features.
• Provide an adaptive mechanism to eliminate previously embedded backdoors while preserving convergence.

Proposed method

• Construct an attributed inter-client graph from low-dimensional client features and model updates.
• Use three adjacency matrices (E1, E2, E3) to capture diverse poisoning patterns and combine them after normalization.
• Apply Graph Auto-Encoder based clustering on a sampled subgraph to group clients into clusters.
• Introduce dynamic filtering and clipping with benign scores to identify and limit the influence of malicious clusters.
• Incorporate an adaptive poison-eliminating module to steer the global model toward benign directions when backdoors are detected.
• Prove convergence of the federated learning process under G2uardFL to ensure no degradation in convergence behavior.

Experimental results

Research questions

• RQ1 Can G2uardFL accurately identify malicious clients under various backdoor attack types (data poisoning, model poisoning, or both)?
• RQ2 Does applying the attributed graph clustering defense preserve the primary task performance of the global model on benign data?
• RQ3 How does G2uardFL perform relative to state-of-the-art defenses across different backdoor attack scenarios?
• RQ4 Is the defense robust to varying numbers of malicious clients participating in rounds?
• RQ5 Does the adaptive poison-eliminating mechanism effectively remove embedded backdoors over time?

Key findings

• G2uardFL significantly mitigates backdoor attacks across datasets and attack scenarios compared to baselines.
• In an FL system with 25% malicious clients, it reduces attack success rate to 10.61%.
• The method maintains a primary task performance of 73.05% on CIFAR-10 under the 25% malicious setting, outperforming the best baseline which achieves 19.54%.
• The framework provides a convergence analysis showing that it does not affect FL convergence.
• G2uardFL outperforms cutting-edge defenses such as FLAME and DeepSight in the reported scenarios.
• The approach handles diverse backdoor types by leveraging low-dimensional client representations and attributed graph relations.