The increased demand for machine learning systems has grown privacy concerns, leading to the adoption of Federated Learning (FL) as a decentralized training process that ensures data privacy by maintaining the data localized to the participants. However, FL introduces important vulnerabilities, particularly data poisoning attacks, such as backdoor attacks, which exploit the collaborative nature of the system, without impacting performance over clean data. Traditional defense approaches against these attacks are often not affective in FL, leading to the need for research into alternative mitigation techniques. This paper studies the ability of three clipping-based approaches, including fixed clipping, adaptive clipping, and dynamic clipping, to mitigate backdoor attacks in FL across various levels of adversarial interference. These methods limit the impact of adversarial updates by using controlled thresholds on client updates, balancing attack protection with model accuracy. Experiments on the MNIST data set show that all the methods suppress the poisoning effect but that dynamic clipping, with per-client tailored thresholds, best optimizes the trade-off by reducing noise while effectively resisting adversarial updates. The findings show the benefit of utilizing personalized parameters compared to uniform clipping methods and reveal a viable line of defense against data poisoning attacks for FL without affecting model performance.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

Data Poisoning in FL: Clipping Malicious Updates

  • Georgios Spathoulas,
  • Athanasia Kollarou

摘要

The increased demand for machine learning systems has grown privacy concerns, leading to the adoption of Federated Learning (FL) as a decentralized training process that ensures data privacy by maintaining the data localized to the participants. However, FL introduces important vulnerabilities, particularly data poisoning attacks, such as backdoor attacks, which exploit the collaborative nature of the system, without impacting performance over clean data. Traditional defense approaches against these attacks are often not affective in FL, leading to the need for research into alternative mitigation techniques. This paper studies the ability of three clipping-based approaches, including fixed clipping, adaptive clipping, and dynamic clipping, to mitigate backdoor attacks in FL across various levels of adversarial interference. These methods limit the impact of adversarial updates by using controlled thresholds on client updates, balancing attack protection with model accuracy. Experiments on the MNIST data set show that all the methods suppress the poisoning effect but that dynamic clipping, with per-client tailored thresholds, best optimizes the trade-off by reducing noise while effectively resisting adversarial updates. The findings show the benefit of utilizing personalized parameters compared to uniform clipping methods and reveal a viable line of defense against data poisoning attacks for FL without affecting model performance.