Data Poisoning Attacks Against Federated Learning Systems

Abstract

Federated learning (FL) is an emerging paradigm for distributed training of large-scale deep neural networks in which participants' data remains on their own devices with only model updates being shared with a central server. However, the distributed nature of FL gives rise to new threats caused by potentially malicious participants. In this paper, we study targeted data poisoning attacks against FL systems in which a malicious subset of the participants aim to poison the global model by sending model updates derived from mislabeled data. We first demonstrate that such data poisoning attacks can cause substantial drops in classification accuracy and recall, even with a small percentage of malicious participants. We additionally show that the attacks can be targeted, i.e., they have a large negative impact only on classes that are under attack. We also study attack longevity in early/late round training, the impact of malicious participant availability, and the relationships between the two. Finally, we propose a defense strategy that can help identify malicious participants in FL to circumvent poisoning attacks, and demonstrate its effectiveness.

References in corpus (17)

• PyTorch: An Imperative Style, High-Performance Deep Learning Library
• Fashion-MNIST: a Novel Image Dataset for Benchmarking Machine Learning Algorithms
• Comprehensive Privacy Analysis of Deep Learning: Passive and Active White-box Inference Attacks against Centralized and Federated Learning
• Federated Learning for Mobile Keyboard Prediction
• How To Backdoor Federated Learning
• Poisoning Attacks against Support Vector Machines
• The Hidden Vulnerability of Distributed Learning in Byzantium
• Can You Really Backdoor Federated Learning?
• Mitigating Sybils in Federated Learning Poisoning
• A generic framework for privacy preserving deep learning
• Is feature selection secure against training data poisoning?
• Support Vector Machines under Adversarial Label Contamination
• Poisoning Attacks to Graph-Based Recommender Systems
• Generative Poisoning Attack Method Against Neural Networks
• Transferable Clean-Label Poisoning Attacks on Deep Neural Nets
• Detection of Adversarial Training Examples in Poisoning Attacks through Anomaly Detection
• Towards Demystifying Membership Inference Attacks

Cited by in corpus (5)

• Towards Communication-efficient and Attack-Resistant Federated Edge Learning for Industrial Internet of Things
• FLTrust: Byzantine-robust Federated Learning via Trust Bootstrapping
• Spatio-Temporal Bayesian Learning for Mobile Edge Computing Resource Planning in Smart Cities
• The More, the Better? A Study on Collaborative Machine Learning for DGA Detection
• An Exploratory Analysis on Users' Contributions in Federated Learning