Threats to Federated Learning: A Survey

By Lingjuan Lyu, Han Yu, Qiang Yang. 2020

545 citations recorded by the source corpus.

With the emergence of data silos and popular privacy awareness, the traditional centralized approach of training artificial intelligence (AI) models is facing strong challenges. Federated learning (FL) has recently emerged as a promising solution under this new reality. Existing FL protocol design has been shown to exhibit vulnerabilities which can be exploited by adversaries both within and without the system to compromise data privacy. It is thus of paramount importance to make FL system designers to be aware of the implications of future FL algorithm design on privacy-preservation. Currently, there is no survey on this topic. In this paper, we bridge this important gap in FL literature. By providing a concise introduction to the concept of FL, and a unique taxonomy covering threat models and two major attacks on FL: 1) poisoning attacks and 2) inference attacks, this paper provides an accessible review of this important topic. We highlight the intuitions, key techniques as well as fundamental assumptions adopted by various attacks, and discuss promising future research directions towards more robust privacy preservation in FL.

Subfields: Artificial Intelligence

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

1. Philip S. Yu
2. Dacheng Tao
3. Lichao Sun
4. Medhi Bennis
5. Lingjuan Lyu
6. Qiang Yang
7. Jihong Park
8. Bo Du

Citations in the corpus

• Federated Model Distillation with Noise-Free Differential Privacy (2020, methodology): “In order to protect training data privacy in FL, various privacy protection techniques have been proposed in the literature [Geyer et al., 2017; McMahan et al., 2018; Bonawitz et al., 2017; Wang et al., 2019b; Zhao et al., 2020; Sun et al., 2021; Lyu et al., 2020].”
• Federated Learning in Smart City Sensing: Challenges and Opportunities (2020, unknown): “The authors in [42] presented a survey on the threats to Federated Learning, focusing on poisoning attacks and inference attacks.”
• Decentralized Federated Learning: A Survey and Perspective (2023, background): “…values indicating the relative strength of the respective FL approach in that domain. metrics, which are the focal points of current state-of-the-art (SOTA) research and worthy of further investigation [33], [34], [35], [36], [37], [38], [39], [40], [41], [42], [43], [44], [45], [46], [47], [48].”
• The Limitations of Federated Learning in Sybil Settings (2020, background): “Such sybil-based attacks [18], in which an adversary controls multiple malicious clients, have been mentioned only in passing in existing work on FL [6, 30, 33, 35].”
• Towards Personalized Federated Learning (2021, background): “Robustness: Although FL offers better privacy protection compared to traditional centralized model training approaches, recent research has exposed vulnerabilities of FL that could potentially compromise data privacy [Lyu et al., 2020a].”
• Privacy and Robustness in Federated Learning: Attacks and Defenses (2020, background): “However, CDP is geared to tackle thousands of users for training to converge and achieve an acceptable trade-off between privacy and accuracy [7], resulting in a convergence problem with a small number of participants [110].”
• A Survey on Federated Learning: The Journey From Centralized to Distributed On-Site Learning and Beyond (2021, background): “[20] take a different direction by surveying the threats that compromise FL systems.”
• Multi-center federated learning: clients clustering for better personalization (2020, background): “The work in [28, 39] surveyed the FL systems in relation to their functions on privacy protection and security threats.”
• Asynchronous Federated Learning on Heterogeneous Devices: A Survey (2021, background): “Since real-world data distribution across nodes is usually non-IID [59], it is meaningful to obtain a generalized model while maintaining the accuracy for each local data in AFL.”
• A Full Dive Into Realizing the Edge-Enabled Metaverse: Visions, Enabling Technologies, and Challenges (2022, background): “, recover the original training samples of users [243].”
• Federated Learning on Non-IID Data: A Survey (2021, background): “However, the local private data are more likely to be leaked or reverse-engineered [138, 92] for linear models than for other complex parametric models.”
• Advances, challenges and opportunities in creating data for trustworthy AI (2022, background): “…have important trade-offs and limitations: differential privacy (which adds noise to datasets to prevent leakage of private information) can degrade the ability to assess bias by subgroup 104 ; federated learning may still leak private information when model updates are shared across devices 105 .”
• Federated Learning for Healthcare Informatics (2019, background): “, personalization techniques [59], semi-supervised learning algorithms [49], threat models [68], and mobile edge networks [66].”
• Communication-Efficient and Distributed Learning Over Wireless Networks: Principles and Applications (2020, methodology): “To further improve the data privacy against the attacks inverting model parameters into raw data [41], [57], various privacy-preserving methods have been investigated, such as injecting fine-tuned noise into model parameters via a differential privacy mechanism [31], [58]–[60] and mixing model param”
• An Overview of Federated Deep Learning Privacy Attacks and Defensive Strategies (2020, background): “A recent survey paper [13] only lists attack methods and”