Poisoning with Cerberus: Stealthy and Colluded Backdoor Attack against Federated Learning

Abstract

Are Federated Learning (FL) systems free from backdoor poisoning with the arsenal of various defense strategies deployed? This is an intriguing problem with significant practical implications regarding the utility of FL services. Despite the recent flourish of poisoning-resilient FL methods, our study shows that carefully tuning the collusion between malicious participants can minimize the trigger-induced bias of the poisoned local model from the poison-free one, which plays the key role in delivering stealthy backdoor attacks and circumventing a wide spectrum of state-of-the-art defense methods in FL. In our work, we instantiate the attack strategy by proposing a distributed backdoor attack method, namely Cerberus Poisoning (CerP). It jointly tunes the backdoor trigger and controls the poisoned model changes on each malicious participant to achieve a stealthy yet successful backdoor attack against a wide spectrum of defensive mechanisms of federated learning techniques. Our extensive study on 3 large-scale benchmark datasets and 13 mainstream defensive mechanisms confirms that Cerberus Poisoning raises a significantly severe threat to the integrity and security of federated learning practices, regardless of the flourish of robust Federated Learning methods.

FLIBD: A Federated Learning-Based IoT Big Data Management Approach for Privacy-Preserving over Apache Spark with FATE

“…Despite its innovative approach, FL's security framework invites further scrutiny, especially within sectors managing exceptionally sensitive data, such as the healthcare industry [72][73][74]. Vulnerabilities in FL, including susceptibility to model poisoning, data heterogeneity, and model inversion attacks, possess the potential to undermine the efficacy of the Global Model [72][73][74][75][76].…”

“…Moreover, the meticulous orchestration of collusion among malicious participants can subtly reduce the bias triggered in the poisoned local model-minimising disparities from the poison-free model. This subtlety becomes critical in facilitating stealthy backdoor attacks and eluding a myriad of top-tier defence strategies currently available in FL [76]. Thus, a void exists, signalling an exigent need for additional research aimed at devising potent and encompassing defensive mechanisms to bolster the security infrastructure of FL systems.…”

FederatedReverse: A Detection and Defense Method Against Backdoor Attacks in Federated Learning

“…However, FL is seriously threatened by backdoor attacks [18], [19]. A backdoor attack refers to a situation in which attackers inject adversarial triggers (i.e., backdoor) into the trained model, enabling the model to fulfill a specific task preferred by the attacker (referred to as the backdoor task) while still satisfying the task required by FL (referred to as the main task) [20], [21]. For instance, in the FL that coordinates banks to train a model to predict the loan status (i.e., the main task), a malicious bank (i.e., attacker) may specify the value of some attribute names of its local data (for example, number of mortgage accounts equals 10) as malicious backdoor triggers, and set the corresponding label (e.g., the predicted loan status) as "Charged Off".…”

“…Backdoor attacks have also posed a substantial threat in other scenarios, such as digit image classification and news recommendation [22], [23]. What is worse, the greater autonomy owned by clients in FL facilitates the execution of backdoor attacks and positions them as one of the most prevalent security threats for FL [21].…”