Resisting Backdoor Attacks in Federated Learning via Bidirectional Elections and Individual Perspective

Abstract

Existing approaches defend against backdoor attacks in federated learning (FL) mainly through a) mitigating the impact of infected models, or b) excluding infected models. The former negatively impacts model accuracy, while the latter usually relies on globally clear boundaries between benign and infected model updates. However, model updates are easy to be mixed and scattered throughout in reality due to the diverse distributions of local data. This work focuses on excluding infected models in FL. Unlike previous perspectives from a global view, we propose Snowball, a novel anti-backdoor FL framework through bidirectional elections from an individual perspective inspired by one principle deduced by us and two principles in FL and deep learning. It is characterized by a) bottom-up election, where each candidate model update votes to several peer ones such that a few model updates are elected as selectees for aggregation; and b) top-down election, where selectees progressively enlarge themselves through picking up from the candidates. We compare Snowball with state-of-the-art defenses to backdoor attacks in FL on five real-world datasets, demonstrating its superior resistance to backdoor attacks and slight impact on the accuracy of the global model.

Accepted by AAAI 2024. Codes are publicly available at https://github.com/zhenqincn/Snowball

References in corpus (8)

• Fashion-MNIST: a Novel Image Dataset for Benchmarking Machine Learning Algorithms
• Can You Really Backdoor Federated Learning?
• DeepSight: Mitigating Backdoor Attacks in Federated Learning Through Deep Model Inspection
• Learning to Detect Malicious Clients for Robust Federated Learning
• Attack of the Tails: Yes, You Really Can Backdoor Federated Learning
• CRFL: Certifiably Robust Federated Learning against Backdoor Attacks
• FLDetector: Defending Federated Learning Against Model Poisoning Attacks via Detecting Malicious Clients
• Curse or Redemption? How Data Heterogeneity Affects the Robustness of Federated Learning

Cited by in corpus (1)

• FLAIN: Mitigating Backdoor Attacks in Federated Learning via Flipping Weight Updates of Low-Activation Input Neurons