DeepSight: Mitigating Backdoor Attacks in Federated Learning Through Deep Model Inspection

Abstract

Federated Learning (FL) allows multiple clients to collaboratively train a Neural Network (NN) model on their private data without revealing the data. Recently, several targeted poisoning attacks against FL have been introduced. These attacks inject a backdoor into the resulting model that allows adversary-controlled inputs to be misclassified. Existing countermeasures against backdoor attacks are inefficient and often merely aim to exclude deviating models from the aggregation. However, this approach also removes benign models of clients with deviating data distributions, causing the aggregated model to perform poorly for such clients. To address this problem, we propose DeepSight, a novel model filtering approach for mitigating backdoor attacks. It is based on three novel techniques that allow to characterize the distribution of data used to train model updates and seek to measure fine-grained differences in the internal structure and outputs of NNs. Using these techniques, DeepSight can identify suspicious model updates. We also develop a scheme that can accurately cluster model updates. Combining the results of both components, DeepSight is able to identify and eliminate model clusters containing poisoned models with high attack impact. We also show that the backdoor contributions of possibly undetected poisoned models can be effectively mitigated with existing weight clipping-based defenses. We evaluate the performance and effectiveness of DeepSight and show that it can mitigate state-of-the-art backdoor attacks with a negligible impact on the model's performance on benign data.

arXiv comment18 pages, 8 figures; to appear in the Network and Distributed System Security Symposium (NDSS)

References in corpus (17)

• Scikit-learn: Machine Learning in Python
• Communication-Efficient Learning of Deep Networks from Decentralized Data
• Comprehensive Privacy Analysis of Deep Learning: Passive and Active White-box Inference Attacks against Centralized and Federated Learning
• How To Backdoor Federated Learning
• Learning Differentially Private Recurrent Language Models
• Byzantine-Robust Distributed Learning: Towards Optimal Statistical Rates
• The Hidden Vulnerability of Distributed Learning in Byzantium
• Can You Really Backdoor Federated Learning?
• Learning to Detect Malicious Clients for Robust Federated Learning
• Local Model Poisoning Attacks to Byzantine-Robust Federated Learning
• Byzantine-Robust Federated Machine Learning through Adaptive Model Averaging
• Abnormal Client Behavior Detection in Federated Learning
• Attack of the Tails: Yes, You Really Can Backdoor Federated Learning
• Updates-Leak: Data Set Inference and Reconstruction Attacks in Online Learning
• A Little Is Enough: Circumventing Defenses For Distributed Learning
• Eavesdrop the Composition Proportion of Training Labels in Federated Learning
• Client Adaptation improves Federated Learning with Simulated Non-IID Clients

Cited by in corpus (4)

• A Survey on Vulnerability of Federated Learning: A Learning Algorithm Perspective
• Resisting Backdoor Attacks in Federated Learning via Bidirectional Elections and Individual Perspective
• Securing Federated Sensitive Topic Classification against Poisoning Attacks
• BadSampler: Harnessing the Power of Catastrophic Forgetting to Poison Byzantine-robust Federated Learning