[论文解读] WAFFLE: Watermarking in Federated Learning

Buse Gul Atli, Yuxi Xia+2 more|arXiv (Cornell University)|Aug 17, 2020

Privacy-Preserving Technologies in Data参考文献 60被引用 4

一句话总结

WAFFLE 是首个为联邦学习设计的水印方案，可在无需访问训练数据的情况下，将鲁棒水印嵌入深度神经网络模型。它在每次聚合后通过服务器端微调步骤，以极小的精度损失（-0.17%）和较低的计算开销（+3.2%）嵌入基于后门的水印，从而在去中心化训练环境中实现模型所有权验证。

ABSTRACT

Federated learning is a distributed learning technique where machine learning models are trained on client devices in which the local training data resides. The training is coordinated via a central server which is, typically, controlled by the intended owner of the resulting model. By avoiding the need to transport the training data to the central server, federated learning improves privacy and efficiency. But it raises the risk of model theft by clients because the resulting model is available on every client device. Even if the application software used for local training may attempt to prevent direct access to the model, a malicious client may bypass any such restrictions by reverse engineering the application software. Watermarking is a well-known deterrence method against model theft by providing the means for model owners to demonstrate ownership of their models. Several recent deep neural network (DNN) watermarking techniques use backdooring: training the models with additional mislabeled data. Backdooring requires full access to the training data and control of the training process. This is feasible when a single party trains the model in a centralized manner, but not in a federated learning setting where the training process and training data are distributed among several client devices. In this paper, we present WAFFLE, the first approach to watermark DNN models trained using federated learning. It introduces a retraining step at the server after each aggregation of local models into the global model. We show that WAFFLE efficiently embeds a resilient watermark into models incurring only negligible degradation in test accuracy (-0.17%), and does not require access to training data. We also introduce a novel technique to generate the backdoor used as a watermark. It outperforms prior techniques, imposing no communication, and low computational (+3.2%) overhead.

研究动机与目标

• 解决联邦学习中客户端可逆向工程并盗取模型的挑战。
• 开发一种适用于去中心化环境的水印技术，模型所有者无法访问训练数据，也无法控制训练过程。
• 确保水印对移除攻击具有鲁棒性，并可在黑盒访问下被验证。
• 在潜在恶意客户端存在的情况下，最小化性能下降和计算开销。
• 通过一种新颖的后门生成技术实现所有权证明，该技术无需通信开销且不依赖原始数据访问。

提出的方法

• 在每次聚合轮次后引入服务器端微调步骤，将水印嵌入全局模型。
• 采用一种新颖的基于后门的水印技术，利用在合成数据上训练的代理模型生成误标输入。
• 使用秘密水印模式在微调过程中嵌入至模型，确保对移除攻击的鲁棒性。
• 应用正则化损失以在嵌入水印的同时保持模型效用，从而最小化精度下降。
• 在不访问原始训练数据的情况下生成水印，依赖代理模型和数据增强技术。
• 通过黑盒测试利用嵌入的后门模式实现所有权验证，即使模型被提取或共享也能实现。

Figure 1: Architecture and adversary model for watermarking in federated learning. Parties under the control of an adversary are highlighted in red.

实验结果

研究问题

• RQ1 能否在无需访问训练数据的情况下，有效将水印嵌入通过联邦学习训练的DNN模型？
• RQ2 如何在去中心化训练环境中使水印对模型提取和移除攻击具有鲁棒性？
• RQ3 水印对联邦学习中模型精度和计算效率的影响如何？
• RQ4 是否可以仅通过黑盒访问模型来验证水印，而无需模型权重或梯度？
• RQ5 所提方法在非独立同分布（non-IID）数据分布和对抗性客户端行为下的可扩展性如何？

主要发现

• WAFFLE 在联邦学习模型中嵌入水印时，测试精度下降可忽略不计，仅为 -0.17%。
• 该方法仅带来 3.2% 的计算开销增加，适用于实际部署。
• 水印对模型窃取和移除攻击具有鲁棒性，即使攻击者尝试提取或修改模型也难以破坏水印。
• 该方法在非独立同分布（non-IID）数据分布下仍能有效运行，仅带来通信和计算量的轻微增加，同时保持水印鲁棒性和模型效用。
• 可通过黑盒测试验证水印，实现所有权证明，而无需访问模型的白盒信息。
• 所提出的后门生成技术无需通信开销，在训练数据不可访问时依然有效。

(a)