[Paper Review] Security of Distributed Machine Learning: A Game-Theoretic Approach to Design Secure DSVM

Rui Zhang, Quanyan Zhu|arXiv (Cornell University)|Mar 8, 2020

Network Security and Intrusion Detection49 references4 citations

TL;DR

This paper proposes a game-theoretic framework to secure distributed support vector machines (DSVMs) against data-poisoning and network-based attacks using an alternating direction method of multipliers (ADMM)-based distributed algorithm. The key contribution is demonstrating that network topology critically influences DSVM security, with high-degree nodes and dense networks being more vulnerable to adversarial manipulation, even under minimal noise injection in network attacks.

ABSTRACT

Distributed machine learning algorithms play a significant role in processing massive data sets over large networks. However, the increasing reliance on machine learning on information and communication technologies (ICTs) makes it inherently vulnerable to cyber threats. This work aims to develop secure distributed algorithms to protect the learning from data poisoning and network attacks. We establish a game-theoretic framework to capture the conflicting goals of a learner who uses distributed support vector machines (SVMs) and an attacker who is capable of modifying training data and labels. We develop a fully distributed and iterative algorithm to capture real-time reactions of the learner at each node to adversarial behaviors. The numerical results show that distributed SVM is prone to fail in different types of attacks, and their impact has a strong dependence on the network structure and attack capabilities.

Motivation & Objective

• To address the growing vulnerability of distributed machine learning (DML) systems to cyber threats, especially data poisoning and network-based attacks.
• To model the strategic interaction between a DSVM learner and an attacker who can modify training data and labels using game theory.
• To develop a fully distributed, iterative defense mechanism that enables real-time adaptation at each node.
• To analyze how network structure and attack types impact the security and robustness of DSVMs.
• To extend prior work by classifying attacks into machine learning-type and network-type, and evaluating their cascading effects.

Proposed method

• Formulates a minimax game-theoretic problem to model the adversarial interaction between a DSVM learner and an attacker modifying training data and labels.
• Applies the alternating direction method of multipliers (ADMM) to decompose the problem into local sub-problems solvable in a distributed manner.
• Each node independently solves a sub-min-problem (learner) and a sub-max-problem (attacker) in an iterative, real-time fashion.
• Models two attack types: ML attacks (data poisoning, label-flipping) and Net-attacks (node capture, Sybil, MITM) with controlled noise injection.
• Uses the Spambase dataset for numerical validation under various network topologies and attack scenarios.
• Analyzes per-node behavior and information propagation under adversarial conditions to assess system-wide risk.

Experimental results

Research questions

• RQ1 How do different attack models—particularly data-poisoning and network-based attacks—affect the performance and security of distributed SVMs?
• RQ2 What is the role of network topology in determining the resilience of DSVMs under adversarial conditions?
• RQ3 How does the degree of a node influence its vulnerability and the overall system's risk when under attack?
• RQ4 To what extent can small perturbations in transmitted information (e.g., noise in communication) compromise the entire DSVM system?
• RQ5 Can a game-theoretic, distributed defense strategy effectively counter multi-stage adversarial behaviors in real time?

Key findings

• Distributed SVMs are highly vulnerable to both data-poisoning and network-type attacks, with performance degrading significantly when more than half the nodes or connections are compromised.
• Networks with fewer nodes and higher degrees exhibit lower risk, indicating that balanced topologies are more resilient to system-wide attacks.
• Nodes with higher degrees are more vulnerable and cause greater system-wide damage when under attack, increasing the overall risk of failure.
• Even small noise injection (e.g., R=0.01–0.05) in network communications can severely degrade DSVM performance, especially in Sybil and MITM attacks.
• The attacker can cause complete DSVM failure—equivalent to random labeling—when controlling more than half the nodes or connections, demonstrating a critical threshold.
• The game-theoretic ADMM-based framework enables real-time, localized responses, making it suitable for dynamic, large-scale distributed ML systems.