Clustered Federated Learning (CFL) is an innovative architecture that effectively tackles the challenge of data heterogeneity in Federated Learning (FL). However, such a setup also introduces vulnerabilities that can be exploited by attackers to execute more severe attacks. This paper compares the efficacy of data reconstruction attacks utilizing Generative Adversarial Nets (GANs) in FL and CFL, respectively. It also proposes a general client-level data reconstruction attack scheme whose key is in that the attackers can eavesdrop the victim’s partial uploaded parameters. Experimental results demonstrate that the sample data generated in this kind of attack within the scenario of CFL exhibit a higher degree of similarity with the targeted data compared to FL. And it is observed that the attacks involving eavesdropping in CFL perform more effectively with a client-level attack accuracy. In addition, we design a lightweight and adaptive local differential privacy (LDP) mechanism to defend against this kind of attack. In this method, under the premise that the differential privacy budget decreases as the number of training round adds, each client dynamically adjusts the probability of adding differential privacy noise and the size of DP’s parameters according to the training accuracy and the resemblance to the reconstructed data generated by attackers. Our defense method can effectively alleviate the loss of training accuracy for each client caused by the accumulation of the differential privacy budget while ensuring the defense effect, and it also reduces clients’ computational burden.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

The Client-Level GAN-Based Data Reconstruction Attack and Defense in Clustered Federated Learning

  • Han Wu,
  • Lei Shi,
  • Junyu Ye,
  • Yuqi Fan,
  • Zengwei Lv

摘要

Clustered Federated Learning (CFL) is an innovative architecture that effectively tackles the challenge of data heterogeneity in Federated Learning (FL). However, such a setup also introduces vulnerabilities that can be exploited by attackers to execute more severe attacks. This paper compares the efficacy of data reconstruction attacks utilizing Generative Adversarial Nets (GANs) in FL and CFL, respectively. It also proposes a general client-level data reconstruction attack scheme whose key is in that the attackers can eavesdrop the victim’s partial uploaded parameters. Experimental results demonstrate that the sample data generated in this kind of attack within the scenario of CFL exhibit a higher degree of similarity with the targeted data compared to FL. And it is observed that the attacks involving eavesdropping in CFL perform more effectively with a client-level attack accuracy. In addition, we design a lightweight and adaptive local differential privacy (LDP) mechanism to defend against this kind of attack. In this method, under the premise that the differential privacy budget decreases as the number of training round adds, each client dynamically adjusts the probability of adding differential privacy noise and the size of DP’s parameters according to the training accuracy and the resemblance to the reconstructed data generated by attackers. Our defense method can effectively alleviate the loss of training accuracy for each client caused by the accumulation of the differential privacy budget while ensuring the defense effect, and it also reduces clients’ computational burden.