Byzantine-Resilient Secure Federated Learning

By Jinhyun So, Basak Guler, Amir Salman Avestimehr. 2020

330 citations recorded by the source corpus.

Secure federated learning is a privacy-preserving framework to improve machine learning models by training over large volumes of data collected by mobile users. This is achieved through an iterative process where, at each iteration, users update a global model using their local datasets. Each user then masks its local update via random keys, and the masked models are aggregated at a central server to compute the global model for the next iteration. As the local updates are protected by random masks, the server cannot observe their true values. This presents a major challenge for the resilience of the model against adversarial (Byzantine) users, who can manipulate the global model by modifying their local updates or datasets. Towards addressing this challenge, this paper presents the first single-server Byzantine-resilient secure aggregation framework (BREA) for secure federated learning. BREA is based on an integrated stochastic quantization, verifiable outlier detection, and secure model aggregation approach to guarantee Byzantine-resilience, privacy, and convergence simultaneously. We provide theoretical convergence and privacy guarantees and characterize the fundamental trade-offs in terms of the network size, user dropouts, and privacy protection. Our experiments demonstrate convergence in the presence of Byzantine users, and comparable accuracy to conventional federated learning benchmarks.

Subfields: Artificial Intelligence, Federated & Distributed Learning, Privacy & Security

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Federated & Distributed Learning

In Privacy & Security

Citations in the corpus

FedML: A Research Library and Benchmark for Federated Machine Learning (2020, background): “To tackle the challenge of trustworthiness, existing research focuses on developing new defense techniques for adversarial attacks to make FL robust [15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 24, 27, 28], and proposing methods such as differential privacy (DP) and secure multiparty computation”
Turbo-Aggregate: Breaking the Quadratic Aggregation Barrier in Secure Federated Learning (2020, methodology): “approach is combining secure aggregation with an outlier detection algorithm as proposed in [52], which has a communication cost of O(N2) that limits its scalability to large federated learning systems.”
Group Knowledge Transfer: Federated Learning of Large CNNs at the Edge (2020, background): “Others [29, 30, 31, 32, 33, 34, 35, 36, 37] optimize the communication cost without considering edge computational limitations.”
Secure Aggregation with Heterogeneous Quantization in Federated Learning (2020, background): “In these schemes, we provide a high privacy level for the model updates of the users by preventing the server 1 Recently, the authors in [20] propose a new framework that achieves secure Byzantine-robust federated learning without adapting the existing defenses mechanism. from learning a full…”
Learning from History for Byzantine Robust Optimization (2020, background): “Further, combining robustness with notions of privacy and security is also a crucial and challenging problem (He et al., 2020b; So et al., 2020a;b; Jin et al., 2020).”
Privacy-Enhanced Federated Learning Against Poisoning Adversaries (2021, methodology): “The closest to our method we noticed is [22], as it focuses on making the current distance-based outlier removal mechanism compatible with secure aggregation utilizing SMC.”
A Survey on Federated Learning Systems: Vision, Hype and Reality for Data Privacy and Protection (2019, methodology): “Inspired by robust aggregation in Byzantine tolerant distributed learning [19], [157], where the number of tolerated Byzantine adversaries is used to evaluate the robustness, we”
Edge Artificial Intelligence for 6G: Vision, Enabling Technologies, and Applications (2021, methodology): “To simultaneously preserve privacy for individual users while tolerating Byzantine adversaries, a Byzantine-resilient secure aggregation framework was developed in [171] to detect adversarial models without the knowledge of individual local models, as they are masked for privacy guarantees.”