Cronus: Robust and Heterogeneous Collaborative Learning with Black-Box Knowledge Transfer

By Hong Chang, Virat Shejwalkar, Reza Shokri, Amir Houmansadr. 2019

209 citations recorded by the source corpus.

Collaborative (federated) learning enables multiple parties to train a model without sharing their private data, but through repeated sharing of the parameters of their local models. Despite its advantages, this approach has many known privacy and security weaknesses and performance overhead, in addition to being limited only to models with homogeneous architectures. Shared parameters leak a significant amount of information about the local (and supposedly private) datasets. Besides, federated learning is severely vulnerable to poisoning attacks, where some participants can adversarially influence the aggregate parameters. Large models, with high dimensional parameter vectors, are in particular highly susceptible to privacy and security attacks: curse of dimensionality in federated learning. We argue that sharing parameters is the most naive way of information exchange in collaborative learning, as they open all the internal state of the model to inference attacks, and maximize the model's malleability by stealthy poisoning attacks. We propose Cronus, a robust collaborative machine learning framework. The simple yet effective idea behind designing Cronus is to control, unify, and significantly reduce the dimensions of the exchanged information between parties, through robust knowledge transfer between their black-box local models. We evaluate all existing federated learning algorithms against poisoning attacks, and we show that Cronus is the only secure method, due to its tight robustness guarantee. Treating local models as black-box, reduces the information leakage through models, and enables us using existing privacy-preserving algorithms that mitigate the risk of information leakage through the model's output (predictions). Cronus also has a significantly lower sample complexity, compared to federated learning, which does not bind its security to the number of participants.

Subfields: Artificial Intelligence, Health Informatics, Federated & Distributed Learning

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Health Informatics

In Federated & Distributed Learning

Citations in the corpus

Federated Model Distillation with Noise-Free Differential Privacy (2020, neutral): “More recently, FedMD [Li and Wang, 2019] and Cronus [Chang et al., 2019] attempted to apply knowledge distillation to FL by considering knowledge transfer via model distillation, in which, the logits on an unlabeled public dataset from parties’ models are averaged.”
Privacy and Robustness in Federated Learning: Attacks and Defenses (2020, background): “only sharing model predictions [16], [88], [137] in a blackbox manner may result in more robust privacy protection in FL.”
An Overview of Federated Deep Learning Privacy Attacks and Defensive Strategies (2020, background): “On the server-side, this is also true but recent studies propose models in which the server has no knowledge of the model other than its conception [25].”
Distillation-Based Semi-Supervised Federated Learning for Communication-Efficient Collaborative Training With Non-IID Private Data (2020, background): “Meanwhile, unlike [10], in this study, we investigate how DS-FL can achieve similar performance to FL benchmark under non-IID distributions in an efficient communicational manner.”
Learn from Others and Be Yourself in Heterogeneous Federated Learning (2022, background): “FedMD [38], CRONUS [4] and CFD [71] operate on labeled public data (with similar distribution) via knowledge distillation [2, 24].”
Manipulating the Byzantine: Optimizing Model Poisoning Attacks and Defenses for Federated Learning (2021, background): “Therefore, multiple Byzantine-robust AGRs for FL [8], [31], [37], [39], [2], [19], [10] are proposed to defend against poisoning attacks by malicious clients.”
Back to the Drawing Board: A Critical Evaluation of Poisoning Attacks on Production Federated Learning (2021, background): “1 O(Md) Certification Knowledge transfer Cronus [15] Needs public data O(d) O(d) filtering”
Heterogeneous Federated Learning: State-of-the-art and Research Challenges (2023, background): “However, FedMD calculates a global consensus through a common averaging strategy, whereas Cronus designs an aggregation algorithm that is robust against poisoning attacks.”
Threats to Federated Learning: A Survey (2020, methodology): “Curse of Dimensionality: Large models, with high dimensional parameter vectors, are particularly susceptible to privacy and security attacks [Chang et al. , 2019].”
Federated Learning on Non-IID Data: A Survey (2021, methodology): “propose Cronus, a collaborative robust learning method, by uploading learned features instead of local models to implement local personalization [13].”
A Survey on Federated Learning: The Journey From Centralized to Distributed On-Site Learning and Beyond (2021, background): “[112] has built a system to protect against poisoning attacks.”
A Comprehensive Survey of Privacy-preserving Federated Learning (2021, methodology): “• In the FL, the intermediate weights or gradients communicated between participants and the aggregator may reveal sensitive information about the participants’ training datasets, as shown in References [96, 137, 198, 212].”