Manipulating the Byzantine: Optimizing Model Poisoning Attacks and Defenses for Federated Learning

By Virat Shejwalkar, Amir Houmansadr. Network and Distributed System Security Symposium, 2021

684 citations recorded by the source corpus.

—Federated learning (FL) enables many data owners (e.g., mobile devices) to train a joint ML model (e.g., a next-word prediction classiﬁer) without the need of sharing their private training data. However, FL is known to be susceptible to poisoning attacks by malicious participants (e.g., adversary-owned mobile devices) who aim at hampering the accuracy of the jointly trained model through sending malicious inputs during the federated training process. In this paper, we present a generic framework for model poisoning attacks on FL. We show that our framework leads to poisoning attacks that substantially outperform state-of-the-art model poisoning attacks by large margins. For instance, our attacks result in 1 . 5 × to 60 × higher reductions in the accuracy of FL models compared to previously discovered poisoning attacks. Our work demonstrates that existing Byzantine-robust FL algorithms are signiﬁcantly more susceptible to model poisoning than previously thought. Motivated by this, we design a defense against FL poisoning, called divide-and-conquer (DnC). We demonstrate that DnC outperforms all existing Byzantine-robust FL algorithms in defeating model poisoning attacks, speciﬁcally, it is 2 . 5 × to 12 × more resilient in our experiments with different datasets and models.

Subfields: Artificial Intelligence, Computer Networks and Communications

View Paper: https://www.semanticscholar.org/paper/be10a3afb028e971f38fa80347e4bd826724b86a

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Networks and Communications

Citations in the corpus

Back to the Drawing Board: A Critical Evaluation of Poisoning Attacks on Production Federated Learning (2021, background): “, model poisoning attacks [7], [23], [55].”
FLDetector: Defending Federated Learning Against Model Poisoning Attacks via Detecting Malicious Clients (2022, background): “Model poisoning attacks generally can be untargeted [8, 11, 18] and targeted [1–3, 20].”