[论文解读] Eavesdrop the Composition Proportion of Training Labels in Federated Learning

Lixu Wang, Shichao Xu+2 more|arXiv (Cornell University)|Oct 14, 2019

Privacy-Preserving Technologies in Data参考文献 52被引用 34

一句话总结

该论文提出三种推断攻击—Class Sniffing、Quantity Inference 和 Whole Determination—在不观察单个客户端更新的情况下揭示联邦学习中训练标签的组成比例，即使在安全聚合或差分隐私保护下也如此。

ABSTRACT

Federated learning (FL) has recently emerged as a new form of collaborative machine learning, where a common model can be learned while keeping all the training data on local devices. Although it is designed for enhancing the data privacy, we demonstrated in this paper a new direction in inference attacks in the context of FL, where valuable information about training data can be obtained by adversaries with very limited power. In particular, we proposed three new types of attacks to exploit this vulnerability. The first type of attack, Class Sniffing, can detect whether a certain label appears in training. The other two types of attacks can determine the quantity of each label, i.e., Quantity Inference attack determines the composition proportion of the training label owned by the selected clients in a single round, while Whole Determination attack determines that of the whole training process. We evaluated our attacks on a variety of tasks and datasets with different settings, and the corresponding results showed that our attacks work well generally. Finally, we analyzed the impact of major hyper-parameters to our attacks and discussed possible defenses.

研究动机与目标

• 在联邦学习中引入一个新的隐私漏洞面：推断训练标签的数量组成。
• 提出三种攻击（Class Sniffing、Quantity Inference、Whole Determination），不依赖于观察单个梯度更新。
• 在多种任务/数据集上展示有效性，并讨论超参数影响和防御措施。

提出的方法

• Class Sniffing：通过分析输出神经元输入连接的更新来推断在训练轮中是否出现了特定标签。
• Quantity Inference：通过比较正/负权重更新幅度并去除偏移效应，来估计拥有给定标签的客户端数量。
• Whole Determination：使用比率指标和派生特征的聚类，评估整个训练过程中的标签组成比例。

实验结果

研究问题

• RQ1 攻击者是否能够在不观察单个更新的情况下，在单个 FL 训练轮中确定某个特定标签的存在？
• RQ2 攻击者是否能够在单轮以及整个训练过程中，在没有明文更新访问的情况下推断数量组成（每个标签由多少个客户端拥有）？
• RQ3 在像安全聚合或差分隐私这样的聚合保护下，训练标签的组成比例是否可以被稳健估计？

主要发现

• 三种新的标签数量推断攻击在检测标签存在性和估计标签计数方面取得了高成功率。
• 攻击在安全聚合和差分隐私设置下仍然有效，因为它们依赖于全局模型更新和辅助数据。
• 定量技术能够实现单轮和全训练轮的标签组成泄漏，显示出联邦学习中隐私风险的新维度。