通过方向一致性检测，精准识别联邦学习中的后门攻击更新。
Detecting Backdoor Attacks in Federated Learning via Direction Alignment Inspection
- 分析模型更新的方向与整体方向的一致性，识别异常
- 在IID和非IID数据上均显著优于现有防御方法
- 适合关注联邦学习安全的科研与工程人员
联邦学习（FL）的分布式特性使其易受后门攻击，恶意更新会损害全局模型在特定任务上的表现。现有防御方法因忽视良性与恶意更新在整体及细粒度方向上的不一致而效果有限。为此，我们提出AlignIns，一种新型防御机制，通过方向对齐检查分析每轮模型更新的方向特征。具体而言，该方法考察更新方向与总体方向的对齐程度，并分析关键参数符号分布与全量更新符号主趋势的一致性。显著偏离对齐度的更新被判定为恶意并过滤。我们提供了AlignIns鲁棒性的理论分析及其在联邦学习中的传播误差分析。实验证明，无论在独立同分布（IID）还是非独立同分布（non-IID）数据上，AlignIns均显著优于当前最先进防御方法。代码已开源：https://github.com/JiiahaoXU/AlignIns。
原文摘要 · Abstract (English)
The distributed nature of training makes Federated Learning (FL) vulnerable to backdoor attacks, where malicious model updates aim to compromise the global model's performance on specific tasks. Existing defense methods show limited efficacy as they overlook the inconsistency between benign and malicious model updates regarding both general and fine-grained directions. To fill this gap, we introduce AlignIns, a novel defense method designed to safeguard FL systems against backdoor attacks. AlignIns looks into the direction of each model update through a direction alignment inspection process. Specifically, it examines the alignment of model updates with the overall update direction and analyzes the distribution of the signs of their significant parameters, comparing them with the principle sign across all model updates. Model updates that exhibit an unusual degree of alignment are considered malicious and thus be filtered out. We provide the theoretical analysis of the robustness of AlignIns and its propagation error in FL. Our empirical results on both independent and identically distributed (IID) and non-IID datasets demonstrate that AlignIns achieves higher robustness compared to the state-of-the-art defense methods. The code is available at https://github.com/JiiahaoXU/AlignIns.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。