用可解释AI识别并修复联邦学习中恶意模型层,防数据泄露。
Nosy Layers, Noisy Fixes: Tackling DRAs in Federated Learning Systems using Explainable AI
- 通过分析梯度贡献定位恶意模型层,精准防御
- 对恶意层局部加噪/裁剪,隐私保护率提升62.5%
- 在200客户端下保持87%平均准确率,适合实际部署
联邦学习(FL)虽能实现数据隐私保护下的协同建模,但面临数据重构攻击(DRA),如“LoKI”和“Robbing the Fed”,攻击者可通过服务器下发的恶意模型重建用户敏感数据。为此,本文提出DRArmor,一种结合可解释AI的针对性防御机制。该方法不防御整个模型,而是分析各层对输出的贡献,检测梯度异常,精准识别恶意层。随后对这些特定层实施噪声注入、像素化或剪枝等防御措施,缩小攻击面,保护客户端隐私。我们在包含MNIST、CIFAR-10、CIFAR-100和ImageNet的多种数据集上,在200客户端的环境下评估了对先进攻击LoKI的防御效果。结果表明,DRArmor在高真阳性率(0.910)与真阴性率(0.890)下有效缓解数据泄露,并维持平均87%的模型准确率,显著优于现有方案。当每客户端有500个样本时,数据泄露率降低62.5%。
原文摘要 · Abstract (English)
Federated Learning (FL) has emerged as a powerful paradigm for collaborative model training while keeping client data decentralized and private. However, it is vulnerable to Data Reconstruction Attacks (DRA) such as "LoKI" and "Robbing the Fed", where malicious models sent from the server to the client can reconstruct sensitive user data. To counter this, we introduce DRArmor, a novel defense mechanism that integrates Explainable AI with targeted detection and mitigation strategies for DRA. Unlike existing defenses that focus on the entire model, DRArmor identifies and addresses the root cause (i.e., malicious layers within the model that send gradients with malicious intent) by analyzing their contribution to the output and detecting inconsistencies in gradient values. Once these malicious layers are identified, DRArmor applies defense techniques such as noise injection, pixelation, and pruning to these layers rather than the whole model, minimizing the attack surface and preserving client data privacy. We evaluate DRArmor's performance against the advanced LoKI attack across diverse datasets, including MNIST, CIFAR-10, CIFAR-100, and ImageNet, in a 200-client FL setup. Our results demonstrate DRArmor's effectiveness in mitigating data leakage, achieving high True Positive and True Negative Rates of 0.910 and 0.890, respectively. Additionally, DRArmor maintains an average accuracy of 87%, effectively protecting client privacy without compromising model performance. Compared to existing defense mechanisms, DRArmor reduces the data leakage rate by 62.5% with datasets containing 500 samples per client.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。