提出时空分析与鲁棒聚合结合的防御框架，提升联邦学习抗数据投毒能力。
STAR-FL: Secure Federated Learning with Spatial-Temporal Analysis and Robust Aggregation
- 通过时空聚类识别并剔除恶意模型更新
- 动态调整聚合学习率，降低未检测到攻击的影响
- 在多个数据集上验证有效，显著降低攻击成功率
数据投毒攻击对计算机视觉领域的联邦学习（FL）系统构成严重安全威胁。尽管研究关注度上升，现有防御方法仍面临两大挑战：准确区分良性与恶意模型更新，以及有效缓解中毒更新在模型聚合中的影响。为此，我们提出一种新型防御框架STAR-FL，针对定向投毒攻击，结合时空分析与鲁棒聚合。首先，采用时空聚类识别并移除潜在恶意更新；其次，在聚合过程中动态调整学习率，以减轻未被检测到的恶意更新影响；第三，基于多个基准数据集开展大量实验，验证时空分析与鲁棒聚合的协同效应。结果表明，STAR-FL能有效保护联邦学习系统，并持续优于现有先进防御方法，显著降低攻击成功率（ASR）。代码已开源：https://github.com/mlsysx/STAR-FL。
原文摘要 · Abstract (English)
Data poisoning attacks pose serious security threats to Federated Learning (FL) systems in Computer Vision. Despite growing research attention, two key challenges remain for existing defense techniques: (1) accurately distinguishing between benign and malicious model updates and (2) effectively mitigating the influence of poisoned model updates during model aggregation. To address these challenges, we propose a novel defense framework against targeted poisoning attacks with Spatial-Temporal Analysis and Robust aggregation for FL (STAR-FL). First, we employ spatial-temporal clustering to identify and remove potentially malicious updates from the FL training process. Second, we adjust the learning rate during aggregation to mitigate the impact of any malicious updates that evade detection. Third, we conduct extensive experiments across multiple benchmark datasets to evaluate the spatial-temporal analysis and robust aggregation in STAR-FL. Experimental results demonstrate their synergistic effect in enabling STAR-FL to effectively protect FL and consistently outperform state-of-the-art defenses against targeted poisoning attacks, significantly reducing Attack Success Rates (ASRs). The source code is available at https://github.com/mlsysx/STAR-FL.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。