Edge-Cloud Collaborative Defense against Backdoor Attacks in Federated Learning

Abstract

Federated learning has a distributed collaborative training mode, widely used in IoT scenarios of edge computing intelligent services. However, federated learning is vulnerable to malicious attacks, mainly backdoor attacks. Once an edge node implements a backdoor attack, the embedded backdoor mode will rapidly expand to all relevant edge nodes, which poses a considerable challenge to security-sensitive edge computing intelligent services. In the traditional edge collaborative backdoor defense method, only the cloud server is trusted by default. However, edge computing intelligent services have limited bandwidth and unstable network connections, which make it impossible for edge devices to retrain their models or update the global model. Therefore, it is crucial to detect whether the data of edge nodes are polluted in time. This paper proposes a layered defense framework for edge-computing intelligent services. At the edge, we combine the gradient rising strategy and attention self-distillation mechanism to maximize the correlation between edge device data and edge object categories and train a clean model as much as possible. On the server side, we first implement a two-layer backdoor detection mechanism to eliminate backdoor updates and use the attention self-distillation mechanism to restore the model performance. Our results show that the two-stage defense mode is more suitable for the security protection of edge computing intelligent services. It can not only weaken the effectiveness of the backdoor at the edge end but also conduct this defense at the server end, making the model more secure. The precision of our model on the main task is almost the same as that of the clean model.

Poisoning Attacks on Federated Learning for Autonomous Driving

“…FL is vulnerable to clients with malicious intent that may manipulate their local updates before sending it to the server, so-called poisoning attacks. Such attacks are multifaceted and may be untargeted [17], [18], i.e., aim to deteriorate the global model performance, or targeted, i.e., alter the behavior of the global model on specific data samples [12], [19], [20]. Poisoning attacks may be divided into data poisoning [21], [22], [23] and model poisoning [18], [24], [25], [26] where the former alters the underlying dataset and the latter directly manipulates the model weights.…”

“…From the adversary perspective, poisoning attacks on FL are commonly tailored towards classification problems [12], [13] with only a small number targeting regression problems [14], [15]. However, regression tasks are common in autonomous driving, e.g., vehicle speed prediction, distance estimation, time-to-collision prediction, and vehicle trajectory prediction.…”