Data Poisoning Attacks on Federated Machine Learning

Abstract

Federated Learning (FL) exposes vulnerabilities to targeted poisoning attacks that aim to cause misclassification specifically from the source class to the target class. However, using well-established defense frameworks, the poisoning impact of these attacks can be greatly mitigated. We introduce a generalized pre-training stage approach to Boost Targeted Poisoning Attacks against FL, called BoTPA. Its design rationale is to leverage the model update contributions of all data points, including ones outside of the source and target classes, to construct an Amplifier set, in which we falsify the data labels before the FL training process, as a means to boost attacks. We comprehensively evaluate the effectiveness and compatibility of BoTPA on various targeted poisoning attacks. Under data poisoning attacks, our evaluations reveal that BoTPA can achieve a median Relative Increase in Attack Success Rate (RI-ASR) between 15.3% and 36.9% across all possible source-target class combinations, with varying percentages of malicious clients, compared to its baseline. In the context of model poisoning, BoTPA attains RI-ASRs ranging from 13.3% to 94.7% in the presence of the Krum and Multi-Krum defenses, from 2.6% to 49.2% under the Median defense, and from 2.9% to 63.5% under the Flame defense.

Survey on Federated Learning Threats: concepts, taxonomy on attacks and defences, experimental study and challenges

“…For example, in a face recognition system that allows access to a house, to identify five specific people from the input set, who originally did not have access (negative label as origin label) as people who can access (positive label as a target label). Some works which implement this kind of the attack are [18] where the authors analyse the impact of different attacks scenarios, [40] where the authors prove that you can really backdoor FL even using existing defences and [41] where the aim is to present the data-poisoning attacks.…”

“…However, it is also possible that the goal of the attackers is not to impair of the local models, but only a specific subset of them. In Sun et al [41], they define a set of target nodes as those nodes (clients or server) to be compromised by the attack. According to this definition, we may differentiate between the following three types of data-poisoning attacks depending on the access level the attackers have to the target nodes:…”

Covert Channel Attack to Federated Learning Systems

“…They find that poisons injected late in the training process are significantly more effective than those injected early. Other proposals adopt a bi-level optimization approach for poisoning multi-task FL [56] and GAN-generated poisons [57]. Model Poisoning.…”

Byzantine-Robust Federated Learning with Optimal Statistical Rates and Privacy Guarantees

“…The privacy benefit has motivated the adoption of FL in a variety of sensitive applications, including Google GBoard, healthcare services, and self-driving cars. However, vanilla FL has been demonstrated to be vulnerable to a range of attacks (Bagdasaryan et al, 2020;Bhagoji et al, 2019;Fang et al, 2020;Nasr et al, 2019;Sun et al, 2021;Luo et al, 2021). There are two mainstream vulnerabilities in FL, namely Byzantine robustness and privacy.…”