AFLGuard: Byzantine-robust Asynchronous Federated Learning

Fang, Minghong; Liu, Jia; Gong, Neil Zhenqiang; Bentley, Elizabeth Serena

doi:10.1145/3564625.3567991

Cited by 74 publications

(159 citation statements)

References 11 publications

Supporting

Mentioning

156

Contrasting

Order By: Relevance

“…The problems of the Byzantine attacks, that is, data poisoning attacks have recently been studied in many fields, such as crowdsourcing and crowdsensing scenarios [10], [27], applications of Internet of Things [31], [54], electric power grids [42] and machine learning algorithms [8], [25], [26]. However, combating Byzantine attacks in LDP protocols is a relatively new topic that has few state-of-the-art papers.…”

Section: Related Workmentioning

confidence: 99%

Differential Aggregation against General Colluding Attackers

Du¹,

Ye²,

Fu³

et al. 2023

Preprint

View full text Add to dashboard Cite

Local Differential Privacy (LDP) is now widely adopted in large-scale systems to collect and analyze sensitive data while preserving users' privacy. However, almost all LDP protocols rely on a semi-trust model where users are curiousbut-honest, which rarely holds in real-world scenarios. Recent works [7], [12], [65] show poor estimation accuracy of many LDP protocols under malicious threat models. Although a few works have proposed some countermeasures to address these attacks, they all require prior knowledge of either the attacking pattern or the poison value distribution, which is impractical as they can be easily evaded by the attackers.In this paper, we adopt a general opportunistic-and-colluding threat model and propose a multi-group Differential Aggregation Protocol (DAP) to improve the accuracy of mean estimation under LDP. Different from all existing works that detect poison values on individual basis, DAP mitigates the overall impact of poison values on the estimated mean. It relies on a new probing mechanism EMF (i.e., Expectation-Maximization Filter) to estimate features of the attackers. In addition to EMF, DAP also consists of two EMF postprocessing procedures (EMF* and CEMF*), and a group-wise mean aggregation scheme to optimize the final estimated mean to achieve the smallest variance. Extensive experimental results on both synthetic and real-world datasets demonstrate the superior performance of DAP over state-of-the-art solutions.

show abstract

Section: Related Workmentioning

confidence: 99%

Differential Aggregation against General Colluding Attackers

Du¹,

Ye²,

Fu³

et al. 2023

Preprint

View full text Add to dashboard Cite

show abstract

“…In untargeted attack poisoning, the adversary seeks to undermine the performance of the FL model. In a byzantine attack [63,13,173], the adversary players change their outputs to have the same distribution as the right model updates in order to evade detection. It behaves completely arbitrarily to diminish model performance.…”

Section: Threats In Model Training Of Federated Learningmentioning

confidence: 99%

“…Most of the above robust aggregation schemes suffer from significant performance degradation when a relatively large proportion of clients are compromised, or data among clients is highly Non-IID. Furthermore, recently proposed poisoning attacks [63,13,173] for FL can bypass these robust aggregation algorithms. Motivated by these new challenges, the Byzantine-robust federated optimization approaches have been proposed [218,157,158], which reveals the further challenges for robust aggregation techniques.…”

Section: Robustness To Byzantine Problemmentioning

confidence: 99%

“…For validation-based methods, Error Ratebased Rejection (ERR) rejects local updates that would decrease the global model's accuracy. Loss Function-based Rejection (LFR) [63] ranks the model's credibility according to the loss decrease. For gradient-based methods, Li et al [116] use a variational autoencoder (VAE) to capture modelupdate statistics and distinguish malicious clients from benign ones accordingly.…”

Section: Robustness To Byzantine Problemmentioning

confidence: 99%

“…However, these approaches require extra calculation on the server and client [260,260,116], or additional public data on the server [63].…”

Section: Robustness To Byzantine Problemmentioning

confidence: 99%

See 2 more Smart Citations

A survey on security and privacy threats to federated learning

Zhang

Zeng

et al. 2021

2021 International Conference on Networking and Network Applications (NaNA)

View full text Add to dashboard Cite

Trustworthy artificial intelligence (AI) technology has revolutionized daily life and greatly benefited human society. Among various AI technologies, Federated Learning (FL) stands out as a promising solution for diverse real-world scenarios, ranging from risk evaluation systems in finance to cutting-edge technologies like drug discovery in life sciences. However, challenges around data isolation and privacy threaten the trustworthiness of FL systems. Adversarial attacks against data privacy, learning algorithm stability, and system confidentiality are particularly concerning in the context of distributed training in federated learning. Therefore, it is crucial to develop FL in a trustworthy manner, with a focus on security, robustness, and privacy. In this survey, we propose a comprehensive roadmap for developing trustworthy FL systems and summarize existing efforts from three key aspects: security, robustness, and privacy. We outline the threats that pose vulnerabilities to trustworthy federated learning across different stages of development, including data processing, model training, and deployment. To guide the selection of the most appropriate defense methods, we discuss specific technical solutions for realizing each aspect of Trustworthy FL (TFL). Our approach differs from previous work that primarily discusses TFL from a legal perspective or presents FL from a high-level, non-technical viewpoint.

show abstract

Privacy preserving and secure robust federated learning: A survey

Han,

Lu,

Wang

et al. 2024

Concurrency and Computation

View full text Add to dashboard Cite

SummaryFederated learning (FL) has emerged as a promising solution to address the challenges posed by data silos and the need for global data fusion. It offers a distributed machine learning framework with privacy‐preserving features, allowing model training without the need to collect user data. However, FL also presents significant security and privacy threats that hinder its widespread adoption. The requirements of privacy and security in FL are inherently conflicting. Privacy necessitates the concealment of individual client updates, while security requires the disclosure of client updates to detect anomalies. While most existing research focused on the privacy and security aspects of FL, very few studies have addressed the compatibility of these two demands. In this work, we aim to bridge this gap by proposing a comprehensive defense scheme that ensures privacy, security, and compatibility in FL. We categorize the existing literature into two key directions: privacy defense and security defense. Privacy defense includes methods based on additive masks, differential privacy, homomorphic encryption, and trusted execution environment, whereas security defense encompasses distance‐, performance‐, clustering‐, and similarity‐based anomaly detection techniques and statistical information‐based anomaly update bypassing techniques when the server is trusted and privacy‐compatible anomaly update detection techniques when the server is not trusted. In addition, this article presents decentralized FL solutions based on blockchain. For each direction, we discuss specific technical solutions, their advantages, and disadvantages. By evaluating various defense methods, we identify the most suitable approach to address the primary challenge of “achieving a secure and robust FL system against malicious adversaries while protecting users' privacy.” We then propose a theoretical reference framework for end‐to‐end protection of privacy and security in FL for the key problem, which summarizes the attack surface of FL systems from the client to the server under the security model where the client and server are malicious. Leveraging the strengths and characteristics of existing schemes, our proposed framework integrates multiple techniques to strike a balance between privacy, usability, and efficiency. This framework serves as a valuable reference and provides insights for future work in the field. Finally, we also provide recommendations for future research directions in this field.

show abstract

AFLGuard: Byzantine-robust Asynchronous Federated Learning

Cited by 74 publications

References 11 publications

Differential Aggregation against General Colluding Attackers

Differential Aggregation against General Colluding Attackers

A survey on security and privacy threats to federated learning

Privacy preserving and secure robust federated learning: A survey

Contact Info

Product

Resources

About