[Paper Review] Meta Federated Learning

Omid Aramoon, Pin‐Yu Chen+2 more|arXiv (Cornell University)|Feb 10, 2021

Privacy-Preserving Technologies in Data4 citations

TL;DR

This paper proposes Meta Federated Learning (Meta-FL), a novel federated learning framework that enables effective defense against backdoor attacks while preserving client privacy via secure aggregation. By training multiple client cohorts per round and aggregating their updates securely, Meta-FL reduces variance in model updates, enhancing the robustness of existing defenses like Krum, coordinate-wise median, and trimmed mean, especially against model replacement attacks.

ABSTRACT

Due to its distributed methodology alongside its privacy-preserving features, Federated Learning (FL) is vulnerable to training time adversarial attacks. In this study, our focus is on backdoor attacks in which the adversary's goal is to cause targeted misclassifications for inputs embedded with an adversarial trigger while maintaining an acceptable performance on the main learning task at hand. Contemporary defenses against backdoor attacks in federated learning require direct access to each individual client's update which is not feasible in recent FL settings where Secure Aggregation is deployed. In this study, we seek to answer the following question, Is it possible to defend against backdoor attacks when secure aggregation is in place?, a question that has not been addressed by prior arts. To this end, we propose Meta Federated Learning (Meta-FL), a novel variant of federated learning which not only is compatible with secure aggregation protocol but also facilitates defense against backdoor attacks. We perform a systematic evaluation of Meta-FL on two classification datasets: SVHN and GTSRB. The results show that Meta-FL not only achieves better utility than classic FL, but also enhances the performance of contemporary defenses in terms of robustness against adversarial attacks.

Motivation & Objective

• Address the gap in defending against backdoor attacks under secure aggregation, a critical privacy-preserving protocol in modern FL.
• Overcome the limitation of existing defenses that require inspection of individual client updates—unfeasible under secure aggregation.
• Improve the robustness-utility trade-off in federated learning by designing a framework compatible with privacy-preserving aggregation.
• Demonstrate that increased cohort size reduces variance in aggregated updates, enabling better outlier detection and defense performance.

Proposed method

• Introduce Meta-FL, a federated learning framework that trains multiple disjoint client cohorts per round instead of a single cohort.
• Use secure aggregation (SecAgg) to compute and transmit only cohort-level aggregates to the server, preserving client-level privacy.
• Leverage the reduced variance in cohort aggregates to improve the performance of robust aggregation rules such as Krum, coordinate-wise median, and trimmed mean.
• Ensure fairness in evaluation by matching the number of aggregands (cohort aggregates in Meta-FL, individual updates in baseline FL) across both frameworks.
• Model adversarial behavior using sybil clients that coordinate to scale their updates, simulating realistic backdoor attacks under secure aggregation.
• Apply standard robust aggregation techniques (Krum, CWM, TM) on cohort aggregates to detect and mitigate malicious updates.

Experimental results

Research questions

• RQ1 Can backdoor attacks be effectively defended in federated learning when secure aggregation is deployed?
• RQ2 Does the use of multiple training cohorts per round improve the robustness of existing defenses against backdoor attacks?
• RQ3 How does the variance of cohort aggregates affect the performance of robust aggregation rules in detecting malicious updates?
• RQ4 To what extent does Meta-FL improve the robustness-utility trade-off compared to standard federated learning under the same attack conditions?
• RQ5 Are defenses effective against model replacement attacks—where adversaries replace entire model updates—under secure aggregation?

Key findings

• Meta-FL significantly reduces attack success rates for both naive and model replacement backdoor attacks compared to standard FL, with solid lines (Meta-FL) consistently below dashed lines (baseline FL) in Figures 3 and 4.
• Krum benefits the most from Meta-FL due to lower variance in cohort aggregates, enabling more effective separation of benign and malicious updates.
• Increasing cohort size from 5 to 15 reduces variance in aggregates, leading to improved robustness of Krum, CWM, and trimmed mean across all attack scenarios, especially under frequent sybil attacks.
• Defenses like RFA, differential privacy, and norm bounding show limited effectiveness against backdoor attacks, particularly model replacement attacks, due to the non-contradictory nature of backdoor objectives.
• The improved performance of anomaly-detection-based defenses (e.g., CWM, TM) in Meta-FL is attributed to a more stable and less variable distribution of normal updates.
• Meta-FL enhances robustness without sacrificing utility, achieving better performance than standard FL in both accuracy and defense effectiveness under identical conditions.