XMAM:X-raying models with a matrix to reveal backdoor attacks for federated learning

Zhang, Jianyi; Zhang, Fangjiao; Jin, Qichao; Wang, Zhiqiang; Lin, Xiaodong; Hei, Xiali

doi:10.1016/j.dcan.2023.01.017

Cited by 1 publication

(1 citation statement)

References 2 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…However, FL is seriously threatened by backdoor attacks [18], [19]. A backdoor attack refers to a situation in which attackers inject adversarial triggers (i.e., backdoor) into the trained model, enabling the model to fulfill a specific task preferred by the attacker (referred to as the backdoor task) while still satisfying the task required by FL (referred to as the main task) [20], [21]. For instance, in the FL that coordinates banks to train a model to predict the loan status (i.e., the main task), a malicious bank (i.e., attacker) may specify the value of some attribute names of its local data (for example, number of mortgage accounts equals 10) as malicious backdoor triggers, and set the corresponding label (e.g., the predicted loan status) as "Charged Off".…”

Section: Introductionmentioning

confidence: 99%

FederatedReverse: A Detection and Defense Method Against Backdoor Attacks in Federated Learning

Zhao

et al. 2021

Proceedings of the 2021 ACM Workshop on Information Hiding and Multimedia Security

View full text Add to dashboard Cite

Federated Learning (FL) has garnered widespread adoption across various domains such as finance, healthcare, and cybersecurity. Nonetheless, FL remains under significant threat from backdoor attacks, wherein malicious actors insert triggers into trained models, enabling them to perform certain tasks while still meeting FL's primary objectives. In response, robust aggregation methods have been proposed, which can be divided into three types: ex-ante, ex-durante, and ex-post methods. Given the complementary nature of these methods, combining all three types is promising yet unexplored. Such a combination is non-trivial because it requires leveraging their advantages while overcoming their disadvantages. Our study proposes a novel whole-process certifiably robust aggregation (WPCRA) method for FL, which enhances robustness against backdoor attacks across three phases: ex-ante, ex-durante, and ex-post. Moreover, since the current geometric median estimation method fails to consider differences among clients, we propose a novel weighted geometric median estimation algorithm (WGME). This algorithm estimates the geometric median of model updates from clients based on each client's weight, further improving the robustness of WPCRA against backdoor attacks. We also theoretically prove that WPCRA offers improved certified robustness guarantees with a larger certified radius. We evaluate the advantages of our methods based on the task of loan status prediction. Comparison with baselines shows that our methods significantly improve FL's robustness against backdoor attacks. This study contributes to the literature with a novel WPCRA method and a novel WGME algorithm. Our code is available at https://github.com/brick-brick/WPCRAM.

show abstract

Section: Introductionmentioning

confidence: 99%

FederatedReverse: A Detection and Defense Method Against Backdoor Attacks in Federated Learning

Zhao

et al. 2021

Proceedings of the 2021 ACM Workshop on Information Hiding and Multimedia Security

View full text Add to dashboard Cite

show abstract

XMAM:X-raying models with a matrix to reveal backdoor attacks for federated learning

Cited by 1 publication

References 2 publications

FederatedReverse: A Detection and Defense Method Against Backdoor Attacks in Federated Learning

FederatedReverse: A Detection and Defense Method Against Backdoor Attacks in Federated Learning

Contact Info

Product

Resources

About