FL-Defender: Combating targeted attacks in federated learning

Jebreel, Najeeb Moharram; Domingo-Ferrer, Josep

doi:10.1016/j.knosys.2022.110178

Cited by 31 publications

(11 citation statements)

References 10 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…We can see from the table that our layered defense framework can defend well against different types of backdoor attacks. Compared with the most advanced FL-Defender [ 21 ], the defense effect is almost identical or even better. Our main task model accuracy (CA) is comparable to the model accuracy of clean dataset training, reaching more than 90%.…”

Section: Experimental Evaluationmentioning

confidence: 99%

“…In addition, more types of backdoor attacks can be defended, including anti-label inversion attacks, feature collision attacks, dynamic backdoor attacks, and clean-label attacks. However, FL-Defender [ 21 ], FoolsGold [ 28 ] are not a good defense against dynamic and clean-label backdoor attacks. For example, the accuracy of the main task drops to 63.5%, and the attack success rate of constrain-and-scale [ 14 ] is 100%.…”

Section: Experimental Evaluationmentioning

confidence: 99%

“…Many scholars try to prevent backdoor attacks by limiting the impact of global model poisoning updates [ 20 ] or detecting triggers [ 15 ] to clean malicious model updates [ 21 , 22 , 23 ]. However, federated edge computing intelligent service applications may face more difficulties.…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Edge-Cloud Collaborative Defense against Backdoor Attacks in Federated Learning

Yang

Zheng

Wang

et al. 2023

Sensors

View full text Add to dashboard Cite

Federated learning has a distributed collaborative training mode, widely used in IoT scenarios of edge computing intelligent services. However, federated learning is vulnerable to malicious attacks, mainly backdoor attacks. Once an edge node implements a backdoor attack, the embedded backdoor mode will rapidly expand to all relevant edge nodes, which poses a considerable challenge to security-sensitive edge computing intelligent services. In the traditional edge collaborative backdoor defense method, only the cloud server is trusted by default. However, edge computing intelligent services have limited bandwidth and unstable network connections, which make it impossible for edge devices to retrain their models or update the global model. Therefore, it is crucial to detect whether the data of edge nodes are polluted in time. This paper proposes a layered defense framework for edge-computing intelligent services. At the edge, we combine the gradient rising strategy and attention self-distillation mechanism to maximize the correlation between edge device data and edge object categories and train a clean model as much as possible. On the server side, we first implement a two-layer backdoor detection mechanism to eliminate backdoor updates and use the attention self-distillation mechanism to restore the model performance. Our results show that the two-stage defense mode is more suitable for the security protection of edge computing intelligent services. It can not only weaken the effectiveness of the backdoor at the edge end but also conduct this defense at the server end, making the model more secure. The precision of our model on the main task is almost the same as that of the clean model.

show abstract

Section: Experimental Evaluationmentioning

confidence: 99%

Section: Experimental Evaluationmentioning

confidence: 99%

See 1 more Smart Citation

Edge-Cloud Collaborative Defense against Backdoor Attacks in Federated Learning

Yang

Zheng

Wang

et al. 2023

Sensors

View full text Add to dashboard Cite

show abstract

“…The comparison of this survey with the existing literature is summarized in Table I. It can be seen that some existing surveys, e.g., [44], [45], [46], and [47] considered backdoor attacks and backdoor defenses as a part of robustness threat on WFL, however, the limitations of the existing backdoor attack and defense methods were not highlighted. On the other hand, in [48], [49], [50], and [51], WFL was considered as one of the deep learning applications when discussing the impact of backdoor attacks, but no detailed analysis of vulnerabilities of backdoor attacks on WFL was provided.…”

Section: B Review Of Existing Surveys and Gap Analysismentioning

confidence: 99%

Defense Strategies Toward Model Poisoning Attacks in Federated Learning: A Survey

Wang

Qiao

Zhang

et al. 2022

2022 IEEE Wireless Communications and Networking Conference (WCNC)

View full text Add to dashboard Cite

Due to the greatly improved capabilities of devices, massive data, and increasing concern about data privacy, Federated Learning (FL) has been increasingly considered for applications to wireless communication networks (WCNs). Wireless FL (WFL) is a distributed method of training a global deep learning model in which a large number of participants each train a local model on their training datasets and then upload the local model updates to a central server. However, in general, nonindependent and identically distributed (non-IID) data of WCNs raises concerns about robustness, as a malicious participant could potentially inject a "backdoor" into the global model by uploading poisoned data or models over WCN. This could cause the model to misclassify malicious inputs as a specific target class while behaving normally with benign inputs. This survey provides a comprehensive review of the latest backdoor attacks and defense mechanisms. It classifies them according to their targets (data poisoning or model poisoning), the attack phase (local data collection, training, or aggregation), and defense stage (local training, before aggregation, during aggregation, or after aggregation). The strengths and limitations of existing attack strategies and defense mechanisms are analyzed in detail. Comparisons of existing attack methods and defense designs are carried out, pointing to noteworthy findings, open challenges, and potential future research directions related to security and privacy of WFL.

show abstract

“…† Both authors contributed equally to this research. on the global model by compromising their local models through either (i) untargeted attacks aimed at slowing down the learning process or decreasing the overall performance of the global model [6], or (ii) targeted attacks (also known as backdoor attacks) that introduce a backdoor into a model, causing it to exhibit malicious behaviors when the inputs contain a predefined trigger [7], [8]. Many poisoning attacks can swiftly impact the global model's performance or inject backdoors within a few FL rounds, persisting for a duration exceeding numerous rounds [9], thereby raising significant security concerns [10], [11].…”

Section: Introductionmentioning

confidence: 99%

Defending Against Data Poisoning Attacks: From Distributed Learning to Federated Learning

Tian

Zhang

Simpson

et al. 2021

The Computer Journal

View full text Add to dashboard Cite

Federated learning (FL), a variant of distributed learning (DL), supports the training of a shared model without accessing private data from different sources. Despite its benefits with regard to privacy preservation, FL’s distributed nature and privacy constraints make it vulnerable to data poisoning attacks. Existing defenses, primarily designed for DL, are typically not well adapted to FL. In this paper, we study such attacks and defenses. In doing so, we start from the perspective of DL and then give consideration to a real-world FL scenario, with the aim being to explore the requisites of a desirable defense in FL. Our study shows that (i) the batch size used in each training round affects the effectiveness of defenses in DL, (ii) the defenses investigated are somewhat effective and moderately influenced by batch size in FL settings and (iii) the non-IID data makes it more difficult to defend against data poisoning attacks in FL. Based on the findings, we discuss the key challenges and possible directions in defending against such attacks in FL. In addition, we propose detect and suppress the potential outliers(DSPO), a defense against data poisoning attacks in FL scenarios. Our results show that DSPO outperforms other defenses in several cases.

show abstract

FL-Defender: Combating targeted attacks in federated learning

Cited by 31 publications

References 10 publications

Edge-Cloud Collaborative Defense against Backdoor Attacks in Federated Learning

Edge-Cloud Collaborative Defense against Backdoor Attacks in Federated Learning

Defense Strategies Toward Model Poisoning Attacks in Federated Learning: A Survey

Defending Against Data Poisoning Attacks: From Distributed Learning to Federated Learning

Contact Info

Product

Resources

About