[论文解读] Honest Score Client Selection Scheme: Preventing Federated Learning Label Flipping Attacks in Non-IID Scenarios

Yanli Li, Huaming Chen+3 more|arXiv (Cornell University)|Nov 10, 2023

Privacy-Preserving Technologies in Data被引用 5

一句话总结

该论文提出了一种诚实评分客户端选择（HSCS）方案，通过基于全局模型风险的对齐度来选择客户端，以防御非独立同分布（non-IID）联邦学习中的标签翻转攻击。该方法通过全局风险向量与客户端准确率向量的点积计算客户端的诚实评分，从而过滤掉恶意客户端。实验结果表明，HSCSFL在非IIDD条件下面对标签翻转攻击时仍能保持高鲁棒性和高准确率。

ABSTRACT

Federated Learning (FL) is a promising technology that enables multiple actors to build a joint model without sharing their raw data. The distributed nature makes FL vulnerable to various poisoning attacks, including model poisoning attacks and data poisoning attacks. Today, many byzantine-resilient FL methods have been introduced to mitigate the model poisoning attack, while the effectiveness when defending against data poisoning attacks still remains unclear. In this paper, we focus on the most representative data poisoning attack - "label flipping attack" and monitor its effectiveness when attacking the existing FL methods. The results show that the existing FL methods perform similarly in Independent and identically distributed (IID) settings but fail to maintain the model robustness in Non-IID settings. To mitigate the weaknesses of existing FL methods in Non-IID scenarios, we introduce the Honest Score Client Selection (HSCS) scheme and the corresponding HSCSFL framework. In the HSCSFL, The server collects a clean dataset for evaluation. Under each iteration, the server collects the gradients from clients and then perform HSCS to select aggregation candidates. The server first evaluates the performance of each class of the global model and generates the corresponding risk vector to indicate which class could be potentially attacked. Similarly, the server evaluates the client's model and records the performance of each class as the accuracy vector. The dot product of each client's accuracy vector and global risk vector is generated as the client's host score; only the top p\% host score clients are included in the following aggregation. Finally, server aggregates the gradients and uses the outcome to update the global model. The comprehensive experimental results show our HSCSFL effectively enhances the FL robustness and defends against the "label flipping attack."

研究动机与目标

• 为解决现有拜占庭容错联邦学习方法在非IIDD场景下对数据中毒攻击（尤其是标签翻转攻击）的脆弱性。
• 识别当前联邦学习方法在数据分布非独立同分布且存在攻击时无法维持鲁棒性的原因。
• 设计一种客户端选择机制，有效检测并排除非IIDD环境下的恶意客户端。
• 开发一种实用框架HSCSFL，将诚实评分计算与梯度聚合相结合，以提升模型鲁棒性。

提出的方法

• 服务器维护一个干净的手动收集的评估数据集，用于监控所有类别上的模型性能。
• 在每次训练迭代中，服务器通过按类别评估全局模型的性能，计算出全局风险向量。
• 每个客户端的模型在相同的评估数据集上进行评估，以生成每个类别的客户端特定准确率向量。
• 每个客户端的诚实评分（HS）通过全局风险向量与客户端准确率向量的点积计算得出。
• 每轮仅选择诚实评分最高的$p\%$客户端参与梯度聚合。
• 将所选客户端的梯度进行平均，以更新全局模型，从而增强对标签翻转攻击的鲁棒性。

实验结果

研究问题

• RQ1 现有拜占庭容错联邦学习方法在非IIDD数据设置下对标签翻转攻击的性能表现如何？
• RQ2 为何当前客户端选择方法在非IIDD场景下无法有效防御标签翻转攻击？
• RQ3 基于类别性能对齐的客户端选择机制是否能提升非IIDD联邦学习中的鲁棒性？
• RQ4 诚实评分在非IIDD设置下面对标签翻转攻击时，如何有效区分恶意客户端？
• RQ5 评估数据集的完整性对HSCSFL框架鲁棒性有何影响？

主要发现

• 现有拜占庭容错联邦学习方法在IID设置下保持鲁棒性，但在非IIDD场景下无法防御标签翻转攻击。
• HSCSFL框架在MNIST和Fashion-MNIST数据集上，针对多种非IIDD程度的标签翻转攻击均成功实现防御。
• HSCSFL在高比例标签翻转攻击下仍能保持高测试准确率，在非IIDD设置下优于基线方法。
• 诚实评分机制通过检测客户端性能与全局风险向量之间的不匹配，有效识别并排除恶意客户端。
• 即使评估数据集部分被污染，只要被攻击类别不在偏移类别中，该框架仍保持鲁棒性。
• 当被攻击类别的评估数据保持清洁时，HSCSFL框架对误报和漏报均具有鲁棒性。