Understanding Distributed Poisoning Attack in Federated Learning

By Di Cao, Shan Chang, Zhijian Lin, Guohua Liu, Donghong Sun. 2019

252 citations recorded by the source corpus.

Federated learning is inherently vulnerable to poisoning attacks, since no training samples will be released to and checked by trustworthy authority. Poisoning attacks are widely investigated in centralized learning paradigm, however distributed poisoning attacks, in which more than one attacker colludes with each other, and injects malicious training samples into local models of their own, may result in a greater catastrophe in federated learning intuitively. In this paper, through real implementation of a federated learning system and distributed poisoning attacks, we obtain several observations about the relations between the number of poisoned training samples, attackers, and attack success rate. Moreover, we propose a scheme, Sniper, to eliminate poisoned local models from malicious participants during training. Sniper identifies benign local models by solving a maximum clique problem, and suspected (poisoned) local models will be ignored during global model updating. Experimental results demonstrate the efficacy of Sniper. The attack success rates are reduced to around 2% even a third of participants are attackers.

Subfields: Artificial Intelligence, Computer Networks and Communications

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Networks and Communications

Citations in the corpus

A Comprehensive Survey on Poisoning Attacks and Countermeasures in Machine Learning (2022, methodology): “to perturb the knowledge contained in the benign sample-label pairs [11, 17, 32, 84].”
Federated Learning for Vehicular Internet of Things: Recent Advances and Open Issues (2020, background): “In [31], Cao et al. analyze the effect of poisoned data and the number of attackers on the performance of distributed poisoning attacks, and propose a scheme to drop poisoned local models during the training of global model.”
Survey on Federated Learning Threats: concepts, taxonomy on attacks and defences, experimental study and challenges (2022, methodology): “In [51], they experiment with different data-poisoning attacks and conclude that: (1) the attack success increases linearly with”
Dataset Security for Machine Learning: Data Poisoning, Backdoor Attacks, and Defenses (2020, unknown): “[71] develop a targeted distributed label”