Turning Federated Learning Systems Into Covert Channels
arXiv:2104.10561 · doi:10.1109/ACCESS.2022.3229124
Abstract
Federated learning (FL) goes beyond traditional, centralized machine learning by distributing model training among a large collection of edge clients. These clients cooperatively train a global, e.g., cloud-hosted, model without disclosing their local, private training data. The global model is then shared among all the participants which use it for local predictions. In this paper, we put forward a novel attacker model aiming at turning FL systems into covert channels to implement a stealth communication infrastructure. The main intuition is that, during federated training, a malicious sender can poison the global model by submitting purposely crafted examples. Although the effect of the model poisoning is negligible to other participants, and does not alter the overall model performance, it can be observed by a malicious receiver and used to transmit a single bit.
References in corpus (12)
- Comprehensive Privacy Analysis of Deep Learning: Passive and Active White-box Inference Attacks against Centralized and Federated Learning
- Wild Patterns: Ten Years After the Rise of Adversarial Machine Learning
- Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoning
- BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chain
- Evasion Attacks against Machine Learning at Test Time
- Applied Federated Learning: Improving Google Keyboard Query Suggestions
- Mitigating Sybils in Federated Learning Poisoning
- Poisoning Attacks to Graph-Based Recommender Systems
- Dataset Security for Machine Learning: Data Poisoning, Backdoor Attacks, and Defenses
- Morpho-MNIST: Quantitative Assessment and Diagnostics for Representation Learning
- Backdooring Convolutional Neural Networks via Targeted Weight Perturbations
- VenoMave: Targeted Poisoning Against Speech Recognition