[论文解读] FL-WBC: Enhancing Robustness against Model Poisoning Attacks in Federated Learning from a Client Perspective

Jingwei Sun, Ang Li+4 more|arXiv (Cornell University)|Oct 26, 2021

Privacy-Preserving Technologies in Data参考文献 28被引用 32

一句话总结

FL-WBC 引入了一种客户端侧防御，用以缓解已经污染全局 FL 模型的模型中毒，具有经认证的鲁棒性保证并收敛到 FedAvg。

ABSTRACT

Federated learning (FL) is a popular distributed learning framework that trains a global model through iterative communications between a central server and edge devices. Recent works have demonstrated that FL is vulnerable to model poisoning attacks. Several server-based defense approaches (e.g. robust aggregation), have been proposed to mitigate such attacks. However, we empirically show that under extremely strong attacks, these defensive methods fail to guarantee the robustness of FL. More importantly, we observe that as long as the global model is polluted, the impact of attacks on the global model will remain in subsequent rounds even if there are no subsequent attacks. In this work, we propose a client-based defense, named White Blood Cell for Federated Learning (FL-WBC), which can mitigate model poisoning attacks that have already polluted the global model. The key idea of FL-WBC is to identify the parameter space where long-lasting attack effect on parameters resides and perturb that space during local training. Furthermore, we derive a certified robustness guarantee against model poisoning attacks and a convergence guarantee to FedAvg after applying our FL-WBC. We conduct experiments on FasionMNIST and CIFAR10 to evaluate the defense against state-of-the-art model poisoning attacks. The results demonstrate that our method can effectively mitigate model poisoning attack impact on the global model within 5 communication rounds with nearly no accuracy drop under both IID and Non-IID settings. Our defense is also complementary to existing server-based robust aggregation approaches and can further improve the robustness of FL under extremely strong attacks.

研究动机与目标

• 在极端模型中毒攻击下，揭示基于服务器的防御在鲁棒性方面的不足。
• 使用新的度量指标 (AEP) 定量分析中毒对全局 FL 模型的长期影响。
• 设计一个客户端侧防御，以缓解已被污染的全局模型并提供理论保证。
• 在标准数据集上证明 FL-WBC 与服务器端鲁棒聚合的有效性与兼容性。

提出的方法

• 定义 Attack Effect on Parameter (AEP) 来衡量中毒对全局模型参数的影响。
• 推导一个关于轮次的残余攻击效应的正式估计量，并指出为何 AEP 持续存在于 Hessian 的核内。
• 通过在良性本地训练期间扰动小幅度的对角 Hessian 元素来提出 FL-WBC，从而破坏 AEP。
• 使用随机 Laplace 噪声扰动矩阵来扰动 Hessian 的核，同时保留良性任务性能。
• 在应用 FL-WBC 时，提供对 AEP 的认证鲁棒性保证和对 FedAvg 的收敛保证。
• 在 IID 和非 IID 设置下对 Fashion-MNIST 和 CIFAR-10 进行实验，以与鲁棒聚合和差分隐私基线进行比较。

实验结果

研究问题

• RQ1 在极端攻击下，模型中毒如何在全局 FL 模型上留下长期印记？
• RQ2 客户端侧防御能否破坏攻击效应持续的子空间，同时不牺牲良性任务性能？
• RQ3 将 FL-WBC 应用于 FedAvg 时有哪些理论保证（鲁棒性和收敛性）？
• RQ4 在 IID 与非 IID 数据分布下，FL-WBC 如何完善服务器端防御？
• RQ5 在标准数据集上，FL-WBC 对最先进的定向中毒攻击有多有效？

主要发现

• FL-WBC 在 1-5 个通信轮内缓解攻击影响，取决于 IID 设置和数据集，且对良性准确率损失很小。
• 攻击者的中毒效应可能持续存在，因为 AEP 位于 Hessians 的核中，服务器防御无法访问。
• FL-WBC 为 AEP 提供认证鲁棒性保证，并对 FedAvg 提供收敛性保证。
• 在单点和多点恶意数据存在下，FL-WBC 在缓解中毒方面优于差分隐私基线和鲁棒聚合。
• FL-WBC 与 CMA 互补，联合服务器端防御时提升鲁棒性。
• 在 IID 设置下，与 CMA 搭配的 FL-WBC 将攻击影响在1轮内降至接近零，在非 IID 设置下则在5轮内降至接近零。