[论文解读] Attacks and Defenses for Free-Riders in Multi-Discriminator GAN

Zilong Zhao, Jiyue Huang+2 more|arXiv (Cornell University)|Jan 24, 2022

Adversarial Robustness in Machine Learning被引用 4

一句话总结

本文提出了一种在多判别器生成对抗网络（MD-GANs）中的搭便车攻击，其中攻击者通过仅使用全局生成器而不参与判别器训练来绕过训练过程。该攻击利用模型参数可见性和梯度聚合机制，MD-GAN-Swap由于模型交换机制而表现出更高的脆弱性；防御机制在检测搭便车者方面最高可达到90.74%的精确率，但随着攻击者数量增加，性能下降。

ABSTRACT

Generative Adversarial Networks (GANs) are increasingly adopted by the industry to synthesize realistic images. Due to data not being centrally available, Multi-Discriminator (MD)-GANs training framework employs multiple discriminators that have direct access to the real data. Distributedly training a joint GAN model entails the risk of free-riders, i.e., participants that aim to benefit from the common model while only pretending to participate in the training process. In this paper, we conduct the first characterization study of the impact of free-riders on MD-GAN. Based on two production prototypes of MD-GAN, we find that free-riders drastically reduce the ability of MD-GANs to produce images that are indistinguishable from real data, i.e., they increase the FID score -- the standard measure to assess the quality of generated images. To mitigate the model degradation, we propose a defense strategy against free-riders in MD-GAN, termed DFG. DFG distinguishes free-riders and benign participants through periodic probing and clustering of discriminators' responses based on a reference response of free-riders, which then allows the generator to exclude the detected free-riders from the training. Furthermore, we extend our defense, termed DFG+, to enable discriminators to filter out free-riders at the variant of MD-GAN that allows peer exchanges of discriminators networks. Extensive evaluation on various scenarios of free-riders, MD-GAN architecture, and three datasets show that our defenses effectively detect free-riders. With 1 to 5 free-riders, DFG and DFG+ averagely decreases FID by 5.22% to 11.53% for CIFAR10 and 5.79% to 13.22% for CIFAR100 in comparison to an attack without defense. In a shell, the proposed DFG(+) can effectively defend against free-riders without affecting benign clients at a negligible computation overhead.

研究动机与目标

• 探究在多判别器生成对抗网络中，客户端仅从全局生成器获益而不贡献于判别器训练的搭便车攻击的可行性与影响。
• 评估不同MD-GAN框架（MD-GAN-Simple、MD-GAN-Swap、MD-GAN-Switch）在面对搭便车攻击时的脆弱性差异。
• 设计并评估能够检测和防止分布式生成对抗网络训练中搭便车行为的防御机制。
• 量化随着搭便车者数量增加，模型质量（以FID衡量）和防御准确率的下降程度。

提出的方法

• 攻击者观察其他判别器的生成器参数和梯度，利用这些信息生成假样本，而无需训练自身的判别器。
• 在MD-GAN-Swap中，攻击者利用点对点模型交换机制来掩盖其未参与训练的事实，可能伪装成活跃客户端。
• 防御机制通过在多轮训练中监控判别器行为，利用参数偏移或在不同数据输入下的性能不一致性来检测异常。
• 对于MD-GAN-Swap，防御机制结合参数差异分析与行为一致性检查以识别搭便车者。
• 系统初始化时包含一个共享生成器和每个客户端的本地判别器；训练以轮次进行，通过梯度聚合更新生成器。
• 防御机制在表格数据集和图像数据集（MNIST、CIFAR10、CIFAR100）上通过精确率、召回率以及假阳性和假阴性率进行评估。

实验结果

研究问题

• RQ1 搭便车者的存在如何影响MD-GAN框架中的FID分数和训练质量？
• RQ2 模型交换（MD-GAN-Swap）对搭便车攻击的可检测性和成功率有何影响？
• RQ3 基于行为和参数的异常检测能否有效识别多判别器生成对抗网络中的搭便车者？
• RQ4 搭便车者数量的增加如何影响防御机制在精确率和召回率方面的表现？
• RQ5 不同训练策略（MD-GAN-Simple、MD-GAN-Swap、MD-GAN-Switch）在抵御搭便车攻击方面的鲁棒性如何比较？

主要发现

• 在MD-GAN-Simple中，FID分数从无攻击者时的77.46上升至五名攻击者时的210.57，表明图像质量严重下降。
• 在MD-GAN-Swap中，FID分数从无攻击者时的75.33上升至五名攻击者时的160.17，表明其脆弱性高于MD-GAN-Simple。
• MD-GAN-Simple的防御机制在MNIST上检测一名攻击者时达到85.40%的精确率和100%的召回率，但五名攻击者时精确率下降至22.62%。
• 对于MD-GAN-Swap，防御机制在一名攻击者时正确阻止或允许90.74%的攻击，但五名攻击者时精确率下降至80.00%。
• MD-GAN-Swap的防御机制报告五名攻击者时错误允许率为0%，错误阻止率最高达7.88%，表明假阳性极低。
• 在五名攻击者的情况下，MD-GAN-Swap的防御机制在CIFAR10上保持100%的召回率，但精确率下降至80.00%，表明检测准确率随攻击者增加而下降。