Backdoor Attacks on Federated Meta-Learning

By Chien-Lun Chen, Leana Golubchik, Marco Paolieri. 2020

33 citations recorded by the source corpus.

Federated learning allows multiple users to collaboratively train a shared classification model while preserving data privacy. This approach, where model updates are aggregated by a central server, was shown to be vulnerable to backdoor attacks: a malicious user can alter the shared model to arbitrarily classify specific inputs from a given class. In this paper, we analyze the effects of backdoor attacks in federated meta-learning, where users train a model that can be adapted to different sets of output classes using only a few training examples. While the ability to adapt could, in principle, make federated learning more robust to backdoor attacks when new training examples are benign, we find that even 1-shot poisoning attacks can be very successful and persist after additional training. To address these vulnerabilities, we propose a defense mechanism inspired by matching networks, where the class of an input is predicted from the cosine similarity of its features with a support set of labeled examples. By removing the decision logic from the model shared with the federation, success and persistence of backdoor attacks are greatly reduced.

Subfields: Artificial Intelligence, Safety, Robustness & Interpretability, Federated & Distributed Learning

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

1. Qiang Yang
2. Bo Li
3. Yang Liu
4. Dawn Song
5. Murali Annavaram
6. Tom Goldstein
7. Chaoyang He
8. Quoc V. Le

In Safety, Robustness & Interpretability

1. Bo Li
2. Tom Goldstein
3. Aleksander Madry
4. Dawn Song
5. Dimitris Tsipras
6. Nicholas Carlini
7. Baoyuan Wu
8. Shutao Xia

In Federated & Distributed Learning

1. Qiang Yang
2. Murali Annavaram
3. Chaoyang He
4. Yang Liu
5. Praneeth Vepakomma
6. S. Avestimehr
7. Abhishek Singh
8. Yan Kang

Citations in the corpus

• FedML: A Research Library and Benchmark for Federated Machine Learning (2020, background): “…on developing new adversarial attack and defense techniques to make federated learning robust [13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 22], and proposing methods such as differential privacy (DP) and secure multiparty computation (SMPC) to protect privacy [25, 26, 27, 28, 29, 30, 31,…”
• Dataset Security for Machine Learning: Data Poisoning, Backdoor Attacks, and Defenses (2020, background): “[119] propose backdoor attacks for federated metalearning, where they collaboratively train a model that is able to quickly adapt to new tasks with a few training samples.”
• Backdoor Learning: A Survey (2020, background): “The backdoor attacks towards meta federated learning [38] and featurepartitioned collaborative learning [39] were also discussed.”
• Survey on Federated Learning Threats: concepts, taxonomy on attacks and defences, experimental study and challenges (2022, background): “[129] propose to perform fine-tuning in benign clients in order to increase the impact of these clients in the aggregation.”