Pelta: Shielding Transformers to Mitigate Evasion Attacks in Federated Learning

Abstract

The main premise of federated learning is that machine learning model updates are computed locally, in particular to preserve user data privacy, as those never leave the perimeter of their device. This mechanism supposes the general model, once aggregated, to be broadcast to collaborating and non malicious nodes. However, without proper defenses, compromised clients can easily probe the model inside their local memory in search of adversarial examples. For instance, considering image-based applications, adversarial examples consist of imperceptibly perturbed images (to the human eye) misclassified by the local model, which can be later presented to a victim node's counterpart model to replicate the attack. To mitigate such malicious probing, we introduce Pelta, a novel shielding mechanism leveraging trusted hardware. By harnessing the capabilities of Trusted Execution Environments (TEEs), Pelta masks part of the back-propagation chain rule, otherwise typically exploited by attackers for the design of malicious samples. We evaluate Pelta on a state of the art ensemble model and demonstrate its effectiveness against the Self Attention Gradient adversarial Attack.

References in corpus (20)

• An Image is Worth 16x16 Words: Transformers for Image Recognition at Scale
• Explaining and Harnessing Adversarial Examples
• Intriguing properties of neural networks
• Estimating or Propagating Gradients Through Stochastic Neurons for Conditional Computation
• A guide to convolution arithmetic for deep learning
• BEiT: BERT Pre-Training of Image Transformers
• Megatron-LM: Training Multi-Billion Parameter Language Models Using Model Parallelism
• Attention Bottlenecks for Multimodal Fusion
• DarkneTZ: Towards Model Privacy at the Edge using Trusted Execution Environments
• Adversarial Training Can Hurt Generalization
• A New Defense Against Adversarial Images: Turning a Weakness into a Strength
• The Limitations of Adversarial Training and the Blind-Spot Attack
• Contrastive Learning Rivals Masked Image Modeling in Fine-tuning via Feature Distillation
• WaTZ: A Trusted WebAssembly Runtime Environment with Remote Attestation for TrustZone
• Shielding Federated Learning Systems against Inference Attacks with ARM TrustZone
• MULDEF: Multi-model-based Defense Against Adversarial Examples for Neural Networks
• Robust Federated Learning Against Adversarial Attacks for Speech Emotion Recognition
• Why adversarial training can hurt robust accuracy
• Mitigating Adversarial Attacks by Distributing Different Copies to Different Users
• Demystifying the Adversarial Robustness of Random Transformation Defenses