[论文解读] G$^2$uardFL: Safeguarding Federated Learning Against Backdoor Attacks through Attributed Client Graph Clustering

Hao Yu, Chuan Ma+6 more|arXiv (Cornell University)|Jun 8, 2023

Privacy-Preserving Technologies in Data被引用 8

一句话总结

G2uardFL 将恶意客户端检测重新表述为属性化图聚类，以防御联邦学习中的后门攻击，具收敛性保证与强实证结果。

ABSTRACT

Federated Learning (FL) offers collaborative model training without data sharing but is vulnerable to backdoor attacks, where poisoned model weights lead to compromised system integrity. Existing countermeasures, primarily based on anomaly detection, are prone to erroneous rejections of normal weights while accepting poisoned ones, largely due to shortcomings in quantifying similarities among client models. Furthermore, other defenses demonstrate effectiveness only when dealing with a limited number of malicious clients, typically fewer than 10%. To alleviate these vulnerabilities, we present G$^2$uardFL, a protective framework that reinterprets the identification of malicious clients as an attributed graph clustering problem, thus safeguarding FL systems. Specifically, this framework employs a client graph clustering approach to identify malicious clients and integrates an adaptive mechanism to amplify the discrepancy between the aggregated model and the poisoned ones, effectively eliminating embedded backdoors. We also conduct a theoretical analysis of convergence to confirm that G$^2$uardFL does not affect the convergence of FL systems. Through empirical evaluation, comparing G$^2$uardFL with cutting-edge defenses, such as FLAME (USENIX Security 2022) [28] and DeepSight (NDSS 2022) [36], against various backdoor attacks including 3DFed (SP 2023) [20], our results demonstrate its significant effectiveness in mitigating backdoor attacks while having a negligible impact on the aggregated model's performance on benign samples (i.e., the primary task performance). For instance, in an FL system with 25% malicious clients, G$^2$uardFL reduces the attack success rate to 10.61%, while maintaining a primary task performance of 73.05% on the CIFAR-10 dataset. This surpasses the performance of the best-performing baseline, which merely achieves a primary task performance of 19.54%.

研究动机与目标

• 在不共享数据的情况下解决联邦学习中的后门漏洞。
• 利用基于图的客户端关系，克服基于异常检测的防御的局限性。
• 将恶意客户端检测改写为低维特征的属性化图聚类。
• 提供自适应机制，在保持收敛性的同时消除先前植入的后门。

提出的方法

• 从低维客户端特征和模型更新中构建属性化的跨客户端图。
• 使用三种邻接矩阵（E1、E2、E3）捕捉多样化的中毒模式并在归一化后进行组合。
• 在抽样子图上应用基于图自编码器的聚类将客户端分组为簇。
• 引入带有良性分数的动态过滤和裁剪，以识别并限制恶意簇的影响。
• 引入自适应杀毒消除模块，在检测到后门时引导全局模型朝向良性方向。
• 证明在 G2uardFL 下联邦学习过程的收敛性，以确保收敛行为不受影响。

实验结果

研究问题

• RQ1 G2uardFL 能否在不同类型的后门攻击（数据污染、模型污染，或两者皆有）下准确识别恶意客户端？
• RQ2 在良性数据上应用属性化图聚类防御是否保持全局模型的主要任务性能？
• RQ3 在不同的后门攻击情景中，与最先进的防御相比，G2uardFL 的表现如何？
• RQ4 对于参与轮次的恶意客户端数量变化，防御是否稳健？
• RQ5 自适应杀毒消除机制是否能随时间有效移除嵌入的后门？

主要发现

• G2uardFL 在多数据集与多攻击情景下显著减轻后门攻击，相较基线表现更优。
• 在包含25%恶意客户端的 FL 系统中，将攻击成功率降至 10.61%。
• 在25%恶意设置下，方法保持 CIFAR-10 的主任务性能为 73.05%，高于表现最佳的基线 19.54%。
• 框架提供收敛性分析，证明不影响联邦学习的收敛性。
• 在所报道的情景中，G2uardFL 的表现优于前沿防御如 FLAME 与 DeepSight。
• 该方法通过利用低维客户端表示和属性化图关系，处理多样化的后门类型。