Poisoning Attacks in Federated Learning: A Survey

Abstract

Federated learning faces many security and privacy issues. Among them, poisoning attacks can significantly impact global models, and malicious attackers can prevent global models from converging or even manipulating the prediction results of global models. Defending against poisoning attacks is a very urgent and challenging task. However, the systematic reviews of poisoning attacks and their corresponding defense strategies from a privacy-preserving perspective still need more effort. This survey provides an in-depth and up-to-date overview of poisoning attacks and corresponding defense strategies in federated learning. We first classify the poisoning attacks according to their methods and targets. Next, we analyze the differences and connections between the various categories of poisoning attacks. In addition, we classify the defense strategies against poisoning attacks in federated learning into three categories and analyze their advantages and disadvantages. Finally, we discuss the privacy protection problem in poisoning attacks and their countermeasure and propose potential research directions from the perspective of attack and defense, respectively.INDEX TERMS Federated learning, distributed machine learning, poisoning attacks, defense of poisoning attacks.

Evaluating Federated Learning for intrusion detection in Internet of Things: Review and challenges

“…However, like in centralized ML deployments, FL is subject to various types of security attacks, including Byzantine clients, which do not behave as expected. Specifically, poisoning attacks are intended to modify the data or directly the weights shared by clients with the aggregator to degrade the model's performance and hinder its convergence Xia, Chen, Yu, and Ma (2023). Indeed, previous works confirm FL's susceptibility to poisoning attacks Baruch, Baruch, and Goldberg (2019), particularly highlighting the vulnerability of the average function or FedAvg McMahan et al (2017) as an aggregation approach.…”

Random forest with differential privacy in federated learning framework for network attack detection and classification

“…In our work, we evaluate various approaches for combining local RF models for cybersecurity applications. In addition, differential privacy property is added to our model making it private by design and providing a countermeasure to potential data poisoning attacks [53]. To achieve that, we decided to follow the work from [17] where differential privacy is done with the Exponential mechanism giving strong privacy guarantees and high accuracy performances in practice.…”

Untargeted Poisoning Attack Detection in Federated Learning via Behavior AttestationAl

“…A recent survey in the field highlights the most advanced schemes of federated learning poisoning attacks and defenses [20]. They classify the defense strategies against poisoning attacks in federated learning into three categories: model analysis, byzantine robust aggregation and verification-based.…”