Untargeted Poisoning Attack Detection in Federated Learning via Behavior Attestation

Abstract

Federated Learning (FL) is a paradigm in Machine Learning (ML) that addresses data privacy, security, access rights and access to heterogeneous information issues by training a global model using distributed nodes. Despite its advantages, there is an increased potential for cyberattacks on FL-based ML techniques that can undermine the benefits. Model-poisoning attacks on FL target the availability of the model. The adversarial objective is to disrupt the training. We propose attestedFL, a defense mechanism that monitors the training of individual nodes through state persistence in order to detect a malicious worker. A fine-grained assessment of the history of the worker permits the evaluation of its behavior in time and results in innovative detection strategies. We present three lines of defense that aim at assessing if the worker is reliable by observing if the node is really training, advancing towards a goal. Our defense exposes an attacker's malicious behavior and removes unreliable nodes from the aggregation process so that the FL process converge faster. Through extensive evaluations and against various adversarial settings, attestedFL increased the accuracy of the model between 12% to 58% under different scenarios such as attacks performed at different stages of convergence, attackers colluding and continuous attacks.

A Survey on Federated Learning PoisoningAttacks and Defenses

“…FLTrust [80] ReLU cosine similarity, weighted mean High DnC [88] Random subsampling mean, numerical clipping High Ensemble [54] Group Training Voting low GAA [91] Credit scoring, validation dataset High attestedFL [92] Horizontal and vertical comparison test Medium…”

“…attestedFL [92]. This solution uses a fusion of multiple methods to determine whether a client is malicious or benign through multiple comparisons.…”

Poisoning Attacks in Federated Learning: A Survey

“…We can divide methods for detecting poisoning attacks based on evaluating model performance into two categories: evaluating local models [55], [57], [59], [62] and evaluating global models [56], [60], [63].…”

“…Yuao et al [57] updated the global model using only the local model that performed well on the test set and marked the client that uploaded a low-accuracy model as a malicious client. Furthermore, Mallah et al [59] defend the poisoning attack by monitoring: 1) the convergence of the local model during training, 2) the angular distance of successive local model updates, and 3) removing local model updates from clients whose performance does not improve to defend against poisoning attacks. In addition, Yi et al [62] proposed a method to automatically verify the validity of model updates through smart contracts in the blockchain, one of which is to test the performance of local models uploaded by users.…”

On the Security & Privacy in Federated Learning

“…Therefore, reducing the adversarial relevance on the global model. Other confidence or score-based anomaly detection have been proposed [77], [129], [130].…”