2020

BaFFLe: Backdoor detection via Feedback-based Federated Learning

Andreina, Sebastien, Marson, Giorgia Azzurra, Möllering, Helen et al.

Understand

Recent studies have shown that federated learning (FL) is vulnerable to poisoning attacks that inject a backdoor into the global model.

These attacks are effective even when performed by a single client, and undetectable by most existing defensive techniques.
In this paper, we propose Backdoor detection via Feedback-based Federated Learning (BAFFLE), a novel defense to secure FL against backdoor attacks.
The core idea behind BAFFLE is to leverage data of multiple clients not only for training but also for uncovering model poisoning.

Built on

M. M. Breunig, H. Kriegel, R. T. Ng, and J. Sander, “LOF: identifying density-based local outliers,” in SIGMOD Conference . ACM, 2000, pp. 93–104
2000
Earlier work this paper cites.
T. Minka, “Estimating a dirichlet distribution,” 2000
2000
Earlier work this paper cites.
A. Krizhevsky and G. Hinton, “Learning multiple layers of features from tiny images,” Citeseer, Tech. Rep., 2009
2009
Earlier work this paper cites.
K. He, X. Zhang, S. Ren, and J. Sun, “Deep residual learning for image recognition,” CoRR , vol. abs/1512.03385, 2015. [Online]. Available: http://arxiv.org/abs/1512.03385
Original
2015
Earlier work this paper cites.
S. Shen, S. Tople, and P. Saxena, “Auror: defending against poisoning attacks in collaborative deep learning systems,” in ACSAC . ACM, 2016, pp. 508–519
2016
Earlier work this paper cites.
P. Blanchard, E. M. E. Mhamdi, R. Guerraoui, and J. Stainer, “Machine learning with adversaries: Byzantine tolerant gradient descent,” in NIPS , 2017, pp. 118–128
2017
Earlier work this paper cites.
K. Bonawitz, V. Ivanov, B. Kreuter, A. Marcedone, H. B. McMahan, S. Patel, D. Ramage, A. Segal, and K. Seth, “Practical secure aggregation for privacy-preserving machine learning,” in ACM Conference on Computer and Communications Security . ACM, 2017, pp. 1175–1191
2017
Earlier work this paper cites.
X. Chen, C. Liu, B. Li, K. Lu, and D. Song, “Targeted backdoor attacks on deep learning systems using data poisoning,” CoRR , vol. abs/1712.05526, 2017
Original
2017
Earlier work this paper cites.
G. Cohen, S. Afshar, J. Tapson, and A. van Schaik, “EMNIST: an extension of MNIST to handwritten letters,” CoRR , vol. abs/1702.05373, 2017
Original
2017
Earlier work this paper cites.

Similar

B. McMahan, E. Moore, D. Ramage, S. Hampson, and B. A. y Arcas, “Communication-efficient learning of deep networks from decentralized data,” in AISTATS , ser. Proceedings of Machine Learning Research, vol. 54. PMLR, 2017, pp. 1273–1282
2017
Cited alongside, same era.
S. Caldas, J. Konecný, H. B. McMahan, and A. Talwalkar, “Expanding the reach of federated learning by reducing client resource requirements,” CoRR , vol. abs/1812.07210, 2018
Original
2018
Cited alongside, same era.
E. M. E. Mhamdi, R. Guerraoui, and S. Rouault, “The hidden vulnerability of distributed learning in byzantium,” in ICML , ser. Proceedings of Machine Learning Research, vol. 80. PMLR, 2018, pp. 3518–3527
2018
Cited alongside, same era.
D. Yin, Y. Chen, K. Ramchandran, and P. L. Bartlett, “Byzantine-robust distributed learning: Towards optimal statistical rates,” in ICML , ser. Proceedings of Machine Learning Research, vol. 80. PMLR, 2018, pp. 5636–5645
2018
Cited alongside, same era.
A. N. Bhagoji, S. Chakraborty, P. Mittal, and S. B. Calo, “Analyzing federated learning through an adversarial lens,” in ICML , ser. Proceedings of Machine Learning Research, vol. 97. PMLR, 2019, pp. 634–643
2019
Cited alongside, same era.
G. A. blog, “Federated Learning: Collaborative Machine Learning without Centralized Training Data,” https://ai.googleblog.com/2017/04/federated-learning-collaborative.html , 2017, accessed: 2019-10-29
2019
Cited alongside, same era.
M. Fang, X. Cao, J. Jia, and N. Z. Gong, “Local model poisoning attacks to byzantine-robust federated learning,” 2019
2019
Cited alongside, same era.
L. Melis, C. Song, E. D. Cristofaro, and V. Shmatikov, “Exploiting unintended feature leakage in collaborative learning,” in IEEE Symposium on Security and Privacy . IEEE, 2019, pp. 691–706
2019
Cited alongside, same era.

Then

M. Nasr, R. Shokri, and A. Houmansadr, “Comprehensive privacy analysis of deep learning: Passive and active white-box inference attacks against centralized and federated learning,” in IEEE Symposium on Security and Privacy . IEEE, 2019, pp. 739–753
2019
Later among the works it cites.
K. Pillutla, S. M. Kakade, and Z. Harchaoui, “Robust aggregation for federated learning,” 2019
2019
Later among the works it cites.
Z. Sun, P. Kairouz, A. T. Suresh, and H. B. McMahan, “Can you really backdoor federated learning?” CoRR , vol. abs/1911.07963, 2019
Original
2019
Later among the works it cites.
E. Bagdasaryan, A. Veit, Y. Hua, D. Estrin, and V. Shmatikov, “How to backdoor federated learning,” in AISTATS , ser. Proceedings of Machine Learning Research, vol. 108. PMLR, 2020, pp. 2938–2948
2020
Closest in time.
C. Fung, C. J. M. Yoon, and I. Beschastnikh, “Mitigating sybils in federated learning poisoning,” CoRR , vol. abs/1808.04866, 2018, (conference paper to appear at RAID 2020)
Original
2020
Closest in time.
S. Li, Y. Cheng, W. Wang, Y. Liu, and T. Chen, “Learning to detect malicious clients for robust federated learning,” CoRR , vol. abs/2002.00211, 2020
Original
2020
Closest in time.
C. Xie, K. Huang, P.-Y. Chen, and B. Li, “Dba: Distributed backdoor attacks against federated learning,” in International Conference on Learning Representations , 2020. [Online]. Available: https://openreview.net/forum?id=rkgyS0VFvr
2020
Closest in time.
T. D. Nguyen, P. Rieger, H. Yalame, H. Möllering, H. Fereidooni, S. Marchal, M. Miettinen, A. Mirhoseini, A.-R. Sadeghi, T. Schneider, and S. Zeitouni, “FLGUARD: Secure and Private Federated Learning,” 2021
2021
Closest in time.

Beyond the bibliography

alphaXiv searches the wider corpus for related work and actual follow-ups.

Open on alphaXiv

alphaXiv is searching for related work…

Reading the bibliography…