[论文解读] Local Model Poisoning Attacks to Byzantine-Robust Federated Learning

Minghong Fang, Xiaoyu Cao+2 more|arXiv (Cornell University)|Nov 26, 2019

Adversarial Robustness in Machine Learning参考文献 66被引用 174

一句话总结

本文首次对本地模型中毒对抗拜占庭鲁棒联邦学习进行系统性研究，提出针对四种聚合规则的基于优化的攻击，并在混合有效性方面评估防御。

ABSTRACT

In federated learning, multiple client devices jointly learn a machine learning model: each client device maintains a local model for its local training dataset, while a master device maintains a global model via aggregating the local models from the client devices. The machine learning community recently proposed several federated learning methods that were claimed to be robust against Byzantine failures (e.g., system failures, adversarial manipulations) of certain client devices. In this work, we perform the first systematic study on local model poisoning attacks to federated learning. We assume an attacker has compromised some client devices, and the attacker manipulates the local model parameters on the compromised client devices during the learning process such that the global model has a large testing error rate. We formulate our attacks as optimization problems and apply our attacks to four recent Byzantine-robust federated learning methods. Our empirical results on four real-world datasets show that our attacks can substantially increase the error rates of the models learnt by the federated learning methods that were claimed to be robust against Byzantine failures of some client devices. We generalize two defenses for data poisoning attacks to defend against our local model poisoning attacks. Our evaluation results show that one defense can effectively defend against our attacks in some cases, but the defenses are not effective enough in other cases, highlighting the need for new defenses against our local model poisoning attacks to federated learning.

研究动机与目标

• 推动研究对联邦学习的完整性威胁关注，超越数据污染的层面。
• 将本地模型中毒形成优化问题，以影响学习过程为目标。
• 在真实数据集上对四种拜占庭鲁棒聚合规则评估攻击效果。
• 评估对这类攻击的通用防御的有效性。

提出的方法

• 将攻击建模为一个优化问题，设计受损的本地模型以最大化全局偏差。
• 攻击四种聚合规则：Krum、Bulyan、修剪均值和中位数。
• 在完全知识与部分知识情况下，提出两种近似方法求解对 Krum 的优化。
• 将来自数据污染的防御（RONI 启发式、TRIM 启发式）扩展为在聚合前拒绝受损本地模型。
• 为攻击者缺乏良性模型细节的部分知识情景提供策略。
• 在 MNIST、Fashion-MNIST、CH-MNIST 和 Breast Cancer Wisconsin 数据集上评估攻击有效性与防御性能。

实验结果

研究问题

• RQ1 本地模型中毒是否会显著降低对拜占庭鲁棒的联邦学习的性能？
• RQ2 当面对本地模型中毒攻击时，现有的数据污染防御有多大程度的有效性？
• RQ3 拟议的攻击是否能在不同的拜占庭鲁棒聚合规则（Krum、Bulyan、修剪均值、中位数）之间迁移？
• RQ4 哪些防御适配（ERR、LFR）对本地模型中毒最有效，在哪些方面会失效？

主要发现

• 攻击在鲁棒聚合下可显著提高全局模型误差率（例如在 MNIST 上使用 Krum：误差率从 0.11 增至 0.75）。
• 两种攻击形式（定向偏差和偏差）均有效，定向偏差在修剪均值与中位数上表现更优。
• 数据污染防御（RONI 启发式与 TRIM 启发式）在某些情形下保护有限，在其他情形下无效，需开发新防御。
• 基于损失函数的拒绝（LFR）在许多情形下优于基于误差率的拒绝（ERR），但两者并未在所有聚合规则上普遍有效。
• 攻击对聚合规则与知识情景具有可迁移性，表明威胁具有超越单一防御的广泛影响。