No abstract

Data heterogeneity has been identified as one of the key features in federated learning but often overlooked in the lens of robustness to adversarial attacks. This paper focuses on characterizing and understanding its impact on backdooring attacks in federated learning through comprehensive experiments using synthetic and the LEAF benchmarks. The initial impression driven by our experimental results suggests that data heterogeneity is the dominant factor in the effectiveness of attacks and it may be a redemption for defending against backdooring as it makes the attack less efficient, more challenging to design effective attack strategies, and the attack result also becomes less predictable. However, with further investigations, we found data heterogeneity is more of a curse than a redemption as the attack effectiveness can be significantly boosted by simply adjusting the client-side backdooring timing. More importantly, data heterogeneity may result in overfitting at the local training of benign clients, which can be utilized by attackers to disguise themselves and fool skewed-feature based defenses. In addition, effective attack strategies can be made by adjusting attack data distribution. Finally, we discuss the potential directions of defending the curses brought by data heterogeneity. The results and lessons learned from our extensive experiments and analysis offer new insights for designing robust federated learning methods and systems.

Federated Learning (FL) enables learning a shared model across many clients without violating the privacy requirements. One of the key a ributes in FL is the heterogeneity that exists in both resource and data due to the di erences in computation and communication capacity, as well as the quantity and content of data among di erent clients. We conduct a case study to show that heterogeneity in resource and data has a signi cant impact on training time and model accuracy in conventional FL systems. To this end, we propose T FL, a Tier-based Federated Learning System, which divides clients into tiers based on their training performance and selects clients from the same tier in each training round to mitigate the straggler problem caused by heterogeneity in resource and data quantity. To further tame the heterogeneity caused by non-IID (Independent and Identical Distribution) data and resources, T FL employs an adaptive tier selection approach to update the tiering on-the-y based on the observed training performance and accuracy over time. We prototype T FL in a FL testbed following Google's FL architecture and evaluate it using popular benchmarks and the stateof-the-art FL benchmark LEAF. Experimental evaluation shows that T FL outperforms the conventional FL in various heterogeneous conditions. With the proposed adaptive tier selection policy, we demonstrate that T FL achieves much faster training performance while keeping the same (and in some cases -be er) test accuracy across the board.

No abstract

No abstract