FederatedReverse: A Detection and Defense Method Against Backdoor Attacks in Federated Learning

Zhao, Chen; Yu, Wen; Li, Shuailou; Liu, Fucheng; Meng, Dan

doi:10.1145/3437880.3460403

Cited by 17 publications

(8 citation statements)

References 43 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In FL settings, a number of strategies have been explored to defend against specific types of attacks or failures, including backdoor attacks [42], [43], free-rider attacks [44], [45], and gradient inversion attacks [46], [47]. On a more general level, Byzantine-robust FL solutions aim to mitigate the effect of arbitrary updates uploaded by malicious clients, instead of focusing on specific types of attacks [7].…”

Section: Byzantine-robust Flmentioning

confidence: 99%

An Experimental Study of Byzantine-Robust Aggregation Schemes in Federated Learning

Ngai

Voigt

2024

IEEE Trans. Big Data

View full text Add to dashboard Cite

Byzantine-robust federated learning aims at mitigating Byzantine failures during the federated training process, where malicious participants (known as Byzantine clients) may upload arbitrary local updates to the central server in order to degrade the performance of the global model. In recent years, several robust aggregation schemes have been proposed to defend against malicious updates from Byzantine clients and improve the robustness of federated learning. These solutions were claimed to be Byzantine-robust, under certain assumptions. Other than that, new attack strategies are emerging, striving to circumvent the defense schemes. However, there is a lack of systematical comparison and empirical study thereof. In this paper, we conduct an experimental study of Byzantine-robust aggregation schemes under different attacks using two popular algorithms in federated learning, FedSGD and FedAvg. We first survey existing Byzantine attack strategies, as well as Byzantine-robust aggregation schemes that aim to defend against the Byzantine attacks. We also propose a new scheme, ClippedClustering, to enhance the robustness of a clustering-based scheme by automatically clipping the updates. Then we provide an experimental evaluation of eight aggregation schemes in the scenario of five different Byzantine attacks. Our experimental results show that these aggregation schemes sustain relatively high accuracy in some cases, but they are not effective in all cases. In particular, our proposed ClippedClustering successfully defends against most attacks under independent and identically distributed (IID) local datasets. However, when the local datasets are Non-IID, the performance of all the aggregation schemes significantly decreases. With Non-IID data, some of these aggregation schemes fail even in the complete absence of Byzantine clients. Based on our experimental study, we conclude that the robustness of all the aggregation schemes is limited, highlighting the need for new defense strategies, in particular for Non-IID datasets.

show abstract

Section: Byzantine-robust Flmentioning

confidence: 99%

An Experimental Study of Byzantine-Robust Aggregation Schemes in Federated Learning

Ngai

Voigt

2024

IEEE Trans. Big Data

View full text Add to dashboard Cite

show abstract

“…The model’s performance is recovered through knowledge distillation. Zhao et al [ 36 ] Proposed how to realize the detection and defense of backdoor attacks of Federated learning from the perspective of combining participants and servers of Federated learning.…”

Section: Related Workmentioning

confidence: 99%

Edge-Cloud Collaborative Defense against Backdoor Attacks in Federated Learning

Yang

Zheng

Wang

et al. 2023

Sensors

View full text Add to dashboard Cite

Federated learning has a distributed collaborative training mode, widely used in IoT scenarios of edge computing intelligent services. However, federated learning is vulnerable to malicious attacks, mainly backdoor attacks. Once an edge node implements a backdoor attack, the embedded backdoor mode will rapidly expand to all relevant edge nodes, which poses a considerable challenge to security-sensitive edge computing intelligent services. In the traditional edge collaborative backdoor defense method, only the cloud server is trusted by default. However, edge computing intelligent services have limited bandwidth and unstable network connections, which make it impossible for edge devices to retrain their models or update the global model. Therefore, it is crucial to detect whether the data of edge nodes are polluted in time. This paper proposes a layered defense framework for edge-computing intelligent services. At the edge, we combine the gradient rising strategy and attention self-distillation mechanism to maximize the correlation between edge device data and edge object categories and train a clean model as much as possible. On the server side, we first implement a two-layer backdoor detection mechanism to eliminate backdoor updates and use the attention self-distillation mechanism to restore the model performance. Our results show that the two-stage defense mode is more suitable for the security protection of edge computing intelligent services. It can not only weaken the effectiveness of the backdoor at the edge end but also conduct this defense at the server end, making the model more secure. The precision of our model on the main task is almost the same as that of the clean model.

show abstract

“…In FL settings, a number of strategies have been explored to defend against specific types of attacks or failures, including backdoor attacks [47], [50], free-rider attacks [51], [52], and gradient inversion attacks [53], [54]. On a more general level, Byzantine-robust FL solutions aim to mitigate the effect of arbitrary updates uploaded by malicious clients, instead of focusing on specific types of attacks [7].…”

Section: Byzantine-robust Flmentioning

confidence: 99%

An Experimental Study of Byzantine-Robust Aggregation Schemes in Federated Learning

Li¹,

Ngai²,

Voigt³

2022

Preprint

View full text Add to dashboard Cite

<div> <div> <div> <p>Byzantine-robust federated learning aims at mitigating Byzantine failures during the federated training process, where malicious participants (known as Byzantine clients) may upload arbitrary local updates to the central server in order to degrade the performance of the global model. In recent years, several robust aggregation schemes have been proposed to defend against malicious updates from Byzantine clients and improve the robustness of federated learning. These solutions were claimed to be Byzantine-robust, under certain assumptions. Other than that, new attack strategies are emerging, striving to circumvent the defense schemes. However, there is a lack of systematical comparison and empirical study thereof. In this paper, we conduct an experimental study of Byzantine-robust aggregation schemes under different attacks using two popular algorithms in federated learning, FedSGD and FedAvg. We first survey existing Byzantine attack strategies, as well as Byzantine-robust aggregation schemes that aim to defend against the Byzantine attacks. We also propose a new scheme, ClippedClustering, to enhance the robustness of a clustering-based scheme by automatically clipping the updates. Then we provide an experimental evaluation of eight aggregation schemes in the scenario of five different Byzantine attacks. Our experimental results show that these aggregation schemes sustain relatively high accuracy in some cases, but they are not effective in all cases. In particular, our proposed ClippedClustering successfully defends against most attacks under independent and identically distributed (IID) local datasets. However, when the local datasets are Non-IID, the performance of all the aggregation schemes significantly decreases. With Non-IID data, some of these aggregation schemes fail even in the complete absence of Byzantine clients. Based on our experimental study, we conclude that the robustness of all the aggregation schemes is limited, highlighting the need for new defense strategies, in particular for Non-IID datasets. </p> </div> </div> </div>

show abstract

FederatedReverse: A Detection and Defense Method Against Backdoor Attacks in Federated Learning

Cited by 17 publications

References 43 publications

An Experimental Study of Byzantine-Robust Aggregation Schemes in Federated Learning

An Experimental Study of Byzantine-Robust Aggregation Schemes in Federated Learning

Edge-Cloud Collaborative Defense against Backdoor Attacks in Federated Learning

An Experimental Study of Byzantine-Robust Aggregation Schemes in Federated Learning

Contact Info

Product

Resources

About