Better Together: Attaining the Triad of Byzantine-robust Federated Learning via Local Update Amplification

Shen, Liyue; Zhang, Yanjun; Wang, Jingwei; Bai, Guangdong

doi:10.1145/3564625.3564658

Cited by 3 publications

(5 citation statements)

References 9 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…However, the Average AGR-based FL can be manipulated by malicious clients. Therefore, multiple Byzantinerobust AGRs [1], [9], [10], [21]- [24], [36]- [38] are proposed to defend against poisoning attacks by malicious clients.…”

Section: B Poisoning Attacks Against Flmentioning

confidence: 99%

“…• Label-flip attack (L-flip) is a widely referenced poisoning attack [9], where the adversary manipulates the local training data, intentionally switching the label for training data. we utilize the setting as [1], which flips the label y to M − y − 1, where M denotes the number of labels.…”

Section: B Poisoning Attacksmentioning

confidence: 99%

“…We denote a r as the TA at iteration r without attack, while âr denote the test accuracy at iteration r under attack. The running time has a great impact on the TA [1]. Therefore, we utilize the averaged TA over a monitoring period as the evaluation metric, which can also alleviate the impact of irrelevant factors such as overfitting on the performance evaluation.…”

Section: Evaluation Metricsmentioning

confidence: 99%

“…Several mechanisms have been proposed to defend against the poisoning attacks [1], [9], [10], [12], [18]- [25]. One representative method is called Byzantine-robust defense mechanisms [1], [9], [10], [12], [20]- [24], in which the server employs a robust aggregation algorithm (AGR) to filter out or moderate suspicious local updates to mitigate the malicious impact of adversary contributions. There are three widely used AGR mechanisms, i.e., distance-based [20], [21], prediction-based [10], [12], [22], and trust bootstrapping-based techniques [9], [23], [24].…”

mentioning

confidence: 99%

See 3 more Smart Citations

AgrAmplifier: Defending Federated Learning Against Poisoning Attacks Through Local Update Amplification

Gong,

Shen,

Zhang

et al. 2024

IEEE Trans.Inform.Forensic Secur.

Self Cite

View full text Add to dashboard Cite

The collaborative nature of federated learning (FL) poses a major threat in the form of manipulation of local training data and local updates, known as the Byzantine poisoning attack. To address this issue, many Byzantine-robust aggregation rules (AGRs) have been proposed to filter out or moderate suspicious local updates uploaded by Byzantine participants.This paper introduces a novel approach called AGRAMPLI-FIER, aiming to simultaneously improve robustness, fidelity, and efficiency of the existing AGRs. The core idea of AGRAMPLIFIER is to amplify the "morality" of local updates by identifying the most repressive features of each gradient update, which provides a clearer distinction between malicious and benign updates, consequently improving the detection effect. To achieve this objective, two approaches, namely AGRMP and AGRXAI, are proposed. AGRMP organizes local updates into patches and extracts the largest value from each patch, while AGRXAI leverages explainable AI methods to extract the gradient of the most activated features. By equipping AGRAMPLIFIER with the existing Byzantine-robust mechanisms, we successfully enhance the model robustness, maintaining its fidelity and improving overall efficiency.AGRAMPLIFIER is universally compatible with the existing Byzantine-robust mechanisms. The paper demonstrates its effectiveness by integrating it with all mainstream AGR mechanisms. Extensive evaluations conducted on seven datasets from diverse domains against seven representative poisoning attacks consistently show enhancements in robustness, fidelity, and efficiency, with average gains of 40.08%, 39.18%, and 10.68%, respectively.

show abstract

Section: B Poisoning Attacks Against Flmentioning

confidence: 99%

Section: B Poisoning Attacksmentioning

confidence: 99%

Section: Evaluation Metricsmentioning

confidence: 99%

mentioning

confidence: 99%

See 2 more Smart Citations

AgrAmplifier: Defending Federated Learning Against Poisoning Attacks Through Local Update Amplification

Gong,

Shen,

Zhang

et al. 2024

IEEE Trans.Inform.Forensic Secur.

Self Cite

View full text Add to dashboard Cite

show abstract

“…In targeted poisoning attacks [29], attackers want the trained global model to output their specified target classification. In untargeted poisoning attacks [12,30,31], attackers want to disrupt the global model, so as to make it indiscriminately produce incorrect predictions. Furthermore, poisoning attacks can be classified into local data poisoning attacks [29,[32][33][34][35][36][37][38][39][40] (e.g., the Label Flipping attack [23]) and local parameter poisoning attacks [12][13][14][15][16].…”

Section: Poisoning Attacksmentioning

confidence: 99%

Better Safe Than Sorry: Constructing Byzantine-Robust Federated Learning with Synthesized Trust

2023

View full text Add to dashboard Cite

Byzantine-robust federated learning empowers the central server to acquire high-end global models amidst a restrictive set of malicious clients. The general idea of existing learning methods requires the central server to statistically analyze all local parameter (gradient or weight) updates, and to delete suspicious ones. The drawback of these approaches is that they lack a root of trust that would allow us to identify which local parameter updates are suspicious, which means that malicious clients can still disrupt the global model. The machine learning community has recently proposed a new method, FLTrust (NDSS’2021), where the server achieves robust aggregation by using a tiny, uncontaminated dataset (denoted as the root dataset) to generate the root of trust; however, the global model’s accuracy will significantly decline if the root dataset greatly deviates from the client’s dataset. To address the above problems, we propose FLEST: a Federated LEarning with Synthesized Trust method. Our method considers that trust and anomaly detection methods can complementarily solve their respective problems; therefore, we designed a new robust aggregation rule with synthesized trust scores (STS). Specifically, we propose the trust synthesizing mechanism, which can aggregate trust scores (TS) and confidence scores (CS) into STS through a dynamic trust ratio γ, and we use STS as the weight for aggregating the local parameter updates. Our experimental results demonstrated that FLEST is capable of resisting existing attacks, even when the root dataset distribution significantly differs from the total dataset distribution: for example, the global model trained by FLEST is 41% more accurate than FLTrust for adaptive attacks using the mnist-0.5 dataset with the bias probability set to 0.8.

show abstract

AgrEvader: Poisoning Membership Inference against Byzantine-robust Federated Learning

Zhang

Bai

Chamikara

et al. 2023

Proceedings of the ACM Web Conference 2023

View full text Add to dashboard Cite

Better Together: Attaining the Triad of Byzantine-robust Federated Learning via Local Update Amplification

Cited by 3 publications

References 9 publications

AgrAmplifier: Defending Federated Learning Against Poisoning Attacks Through Local Update Amplification

AgrAmplifier: Defending Federated Learning Against Poisoning Attacks Through Local Update Amplification

Better Safe Than Sorry: Constructing Byzantine-Robust Federated Learning with Synthesized Trust

AgrEvader: Poisoning Membership Inference against Byzantine-robust Federated Learning

Contact Info

Product

Resources

About