Client self-defense against model poisoning in federated learning

Client self-defense against model poisoning in federated learning

Zhu, Chaoyi (TU Delft Electrical Engineering, Mathematics and Computer Science)

Chen, Lydia Y. (mentor)
Erkin, Z. (graduation committee)
Al-Ars, Z. (graduation committee)
Roos, S. (graduation committee)

Delft University of Technology

Computer Science

2023-06-14

Federated Learning is highly susceptible to backdoor and targeted attacks as participants can manipulate their data and models locally without any oversight on whether they follow the correct process. There are a number of server-side defenses that mitigate the attacks by modifying or rejecting local updates submitted by clients. However, we find that bursty adversarial patterns with a high variance in the number of malicious clients can circumvent the existing defenses. We propose a client-self defense, LeadFL, that is combined with existing server-side defenses to thwart backdoor and targeted attacks. The core idea of LeadFL is a novel regularization term in local model training such that the Hessian matrix of local gradients is nullified. We provide the convergence analysis of LeadFL and its robustness guarantee in terms of certified radius. Our empirical evaluation shows that LeadFL is able to mitigate bursty adversarial patterns for both iid and non-iid data distributions. It frequently reduces the backdoor accuracy from more than 75% for state-of-the-art defenses to less than 10% while its impact on the main task accuracy is always less than for other client-side defenses.

Federated Learning
Poisoning attack
Federated Averaging

http://resolver.tudelft.nl/uuid:44963ca4-46f8-49a1-9285-1c01e4d49402

Student theses

master thesis

© 2023 Chaoyi Zhu