Cronus: Robust and Heterogeneous Collaborative Learning with Black-Box Knowledge Transfer

Abstract

Collaborative (federated) learning enables multiple parties to train a model without sharing their private data, but through repeated sharing of the parameters of their local models. Despite its advantages, this approach has many known privacy and security weaknesses and performance overhead, in addition to being limited only to models with homogeneous architectures. Shared parameters leak a significant amount of information about the local (and supposedly private) datasets. Besides, federated learning is severely vulnerable to poisoning attacks, where some participants can adversarially influence the aggregate parameters. Large models, with high dimensional parameter vectors, are in particular highly susceptible to privacy and security attacks: curse of dimensionality in federated learning. We argue that sharing parameters is the most naive way of information exchange in collaborative learning, as they open all the internal state of the model to inference attacks, and maximize the model's malleability by stealthy poisoning attacks. We propose Cronus, a robust collaborative machine learning framework. The simple yet effective idea behind designing Cronus is to control, unify, and significantly reduce the dimensions of the exchanged information between parties, through robust knowledge transfer between their black-box local models. We evaluate all existing federated learning algorithms against poisoning attacks, and we show that Cronus is the only secure method, due to its tight robustness guarantee. Treating local models as black-box, reduces the information leakage through models, and enables us using existing privacy-preserving algorithms that mitigate the risk of information leakage through the model's output (predictions). Cronus also has a significantly lower sample complexity, compared to federated learning, which does not bind its security to the number of participants.

References in corpus (17)

• Distilling the Knowledge in a Neural Network
• Deep Learning with Differential Privacy
• Communication-Efficient Learning of Deep Networks from Decentralized Data
• Do Deep Nets Really Need to be Deep?
• QSGD: Communication-Efficient SGD via Gradient Quantization and Encoding
• How To Backdoor Federated Learning
• Learning Differentially Private Recurrent Language Models
• Byzantine-Robust Distributed Learning: Towards Optimal Statistical Rates
• Communication-Efficient On-Device Machine Learning: Federated Distillation and Augmentation under Non-IID Private Data
• Semi-supervised Knowledge Transfer for Deep Learning from Private Training Data
• Generalized Byzantine-tolerant SGD
• Large scale distributed neural network training through online distillation
• Sever: A Robust Meta-Algorithm for Stochastic Optimization
• A Hybrid Approach to Privacy-Preserving Federated Learning
• Being Robust (in High Dimensions) Can Be Practical
• Learning Privately from Multiparty Data
• A Little Is Enough: Circumventing Defenses For Distributed Learning

Cited by in corpus (20)

• Ensemble Distillation for Robust Model Fusion in Federated Learning
• Distillation-Based Semi-Supervised Federated Learning for Communication-Efficient Collaborative Training with Non-IID Private Data
• Threats to Federated Learning: A Survey
• Federated Learning for Computationally-Constrained Heterogeneous Devices: A Survey
• No One Left Behind: Inclusive Federated Learning over Heterogeneous Devices
• FedICT: Federated Multi-task Distillation for Multi-access Edge Computing
• Enhanced Security and Privacy via Fragmented Federated Learning
• Federated Bayesian Optimization via Thompson Sampling
• FedGEMS: Federated Learning of Larger Server Models via Selective Knowledge Fusion
• Parameterized Knowledge Transfer for Personalized Federated Learning
• Federated Model Distillation with Noise-Free Differential Privacy
• Decentralized and Model-Free Federated Learning: Consensus-Based Distillation in Function Space
• Knowledge Cross-Distillation for Membership Privacy
• Federated Stain Normalization for Computational Pathology
• Communication-Efficient Federated Distillation
• Robust Asymmetric Heterogeneous Federated Learning with Corrupted Clients
• Federated Learning on Non-IID Data: A Survey
• ByGARS: Byzantine SGD with Arbitrary Number of Attackers
• Practical One-Shot Federated Learning for Cross-Silo Setting
• Adversarial Robustness through Bias Variance Decomposition: A New Perspective for Federated Learning