用合成数据增强旧方法,就能有效防御联邦学习中的恶意攻击。
Do We Really Need to Design New Byzantine-robust Aggregation Rules?
- 服务器生成合成更新,与客户端原始更新一起参与聚合。
- 在多个真实数据集上,防御成功率超90%且收敛稳定。
- 适合希望快速部署安全联邦学习的工程师和研究者。
联邦学习(FL)允许多个客户端在不交换私有训练数据的情况下协同训练全局机器学习模型。然而,其去中心化特性使其易受投毒攻击,恶意客户端可通过发送篡改的本地模型更新来操纵全局模型。为应对此类攻击,已有多种抗拜占庭攻击的聚合规则被提出,但这些方法仍可能受到复杂攻击的威胁或依赖不切实际的服务器假设。本文证明:无需设计新的抗拜占庭聚合规则,仅通过增强现有成熟规则的鲁棒性即可实现安全防护。为此,我们提出FoundationFL,一种新型防御机制:服务器在接收客户端更新后生成合成更新,并将它们与原始更新一同输入经典鲁棒聚合规则(如剪裁均值、中位数)。我们理论上证明了FoundationFL在拜占庭设置下的收敛性能。在多个真实世界数据集上的全面实验验证了该方法的有效性。
原文摘要 · Abstract (English)
Federated learning (FL) allows multiple clients to collaboratively train a global machine learning model through a server, without exchanging their private training data. However, the decentralized aspect of FL makes it susceptible to poisoning attacks, where malicious clients can manipulate the global model by sending altered local model updates. To counter these attacks, a variety of aggregation rules designed to be resilient to Byzantine failures have been introduced. Nonetheless, these methods can still be vulnerable to sophisticated attacks or depend on unrealistic assumptions about the server. In this paper, we demonstrate that there is no need to design new Byzantine-robust aggregation rules; instead, FL can be secured by enhancing the robustness of well-established aggregation rules. To this end, we present FoundationFL, a novel defense mechanism against poisoning attacks. FoundationFL involves the server generating synthetic updates after receiving local model updates from clients. It then applies existing Byzantine-robust foundational aggregation rules, such as Trimmed-mean or Median, to combine clients' model updates with the synthetic ones. We theoretically establish the convergence performance of FoundationFL under Byzantine settings. Comprehensive experiments across several real-world datasets validate the efficiency of our FoundationFL method.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。