[Paper Review] IronForge: An Open, Secure, Fair, Decentralized Federated Learning

Guangsheng Yu, Xu Wang+6 more|arXiv (Cornell University)|Jan 7, 2023

Privacy-Preserving Technologies in Data4 citations

TL;DR

IronForge is a fully decentralized federated learning framework that uses a Directed Acyclic Graph (DAG) to eliminate reliance on a central coordinator, enabling asynchronous, open, and fair model aggregation in realistic, resource-unequal networks. It introduces a secure, state-consistent incentive mechanism with proof-of-learning (PoL) challenges and defenses against model stealing, backdoor, and data privacy attacks, demonstrating superior performance, fairness, and security in real-world settings.

ABSTRACT

Federated learning (FL) provides an effective machine learning (ML) architecture to protect data privacy in a distributed manner. However, the inevitable network asynchrony, the over-dependence on a central coordinator, and the lack of an open and fair incentive mechanism collectively hinder its further development. We propose extsc{IronForge}, a new generation of FL framework, that features a Directed Acyclic Graph (DAG)-based data structure and eliminates the need for central coordinators to achieve fully decentralized operations. extsc{IronForge} runs in a public and open network, and launches a fair incentive mechanism by enabling state consistency in the DAG, so that the system fits in networks where training resources are unevenly distributed. In addition, dedicated defense strategies against prevalent FL attacks on incentive fairness and data privacy are presented to ensure the security of extsc{IronForge}. Experimental results based on a newly developed testbed FLSim highlight the superiority of extsc{IronForge} to the existing prevalent FL frameworks under various specifications in performance, fairness, and security. To the best of our knowledge, extsc{IronForge} is the first secure and fully decentralized FL framework that can be applied in open networks with realistic network and training settings.

Motivation & Objective

• To address the limitations of centralized federated learning, including single-point-of-failure, network asynchrony, and unfair incentives in resource-unequal environments.
• To eliminate the need for a central coordinator while maintaining system availability and training flexibility in open networks.
• To establish a fair and open incentive mechanism that rewards participants based on verifiable training contributions, even in the presence of resource disparities.
• To defend against critical attacks such as model stealing, collusion, backdoor, and data privacy leakage in decentralized FL.
• To design a secure, state-consistent DAG-based architecture that supports public verification and consensus in a decentralized manner.

Proposed method

• IronForge uses a Directed Acyclic Graph (DAG) to represent model updates, enabling asynchronous aggregation without a central coordinator.
• It employs Verifiable Random Function (VRF)-based committee elections to ensure fair and unpredictable selection of consensus nodes.
• A proof-of-learning (PoL) mechanism allows participants to challenge model owners, requiring them to reproduce training results on-demand for public verification.
• The system enforces state consistency over a time window ΔT, ensuring all nodes have a consistent view of the Global-DAG to prevent consensus attacks.
• Dataset obfuscation techniques are applied during PoL challenges to preserve data privacy while enabling model utility verification.
• Security defenses include replaying training from scratch during consensus and applying non-IID noise to reduce privacy leakage risks from repeated challenges.

Figure 1: System model of IronForge

Experimental results

Research questions

• RQ1 Can a fully decentralized federated learning system eliminate the need for a central coordinator while maintaining system stability under network asynchrony?
• RQ2 How can a fair and open incentive mechanism be established in a decentralized FL system with unevenly distributed training resources?
• RQ3 What mechanisms can prevent model stealing and collusion attacks in a public, open network where model ownership and training effort must be verifiable?
• RQ4 How can data privacy be preserved during public verification processes such as proof-of-learning challenges?
• RQ5 Can a DAG-based architecture ensure long-term state consistency and resistance to consensus attacks in a decentralized FL environment?

Key findings

• IronForge achieves full decentralization by eliminating the central coordinator, enabling operation in open networks with realistic network and training conditions.
• The DAG-based model structure supports asynchronous aggregation, significantly improving system resilience to network asynchrony compared to synchronous or pseudo-asynchronous FL frameworks.
• The proof-of-learning (PoL) mechanism enables public verification of training effort, effectively preventing model stealing and fake contribution claims.
• State consistency is maintained over a sufficiently long time window ΔT, ensuring consensus nodes agree on the Global-DAG state and preventing indefinite disagreement due to network delays.
• Dataset obfuscation during PoL challenges reduces privacy leakage risks without sacrificing model utility, protecting against model melting attacks.
• Experimental results on the FLSim testbed show IronForge outperforms existing frameworks in performance, fairness, and security across multiple metrics, including reward distribution stability and resistance to poisoning and backdoor attacks.

Figure 2: Task-DAG. The figure illustrates an overview of starting a new DAG-based FL task, also known as Task-DAG . One with aims to improve his model accuracy to a certain target with the help of the community can release a task as the task publisher. Some amount of token is deposited as the prize