Data Poisoning in FL: Clipping Malicious Updates
摘要
The increased demand for machine learning systems has grown privacy concerns, leading to the adoption of Federated Learning (FL) as a decentralized training process that ensures data privacy by maintaining the data localized to the participants. However, FL introduces important vulnerabilities, particularly data poisoning attacks, such as backdoor attacks, which exploit the collaborative nature of the system, without impacting performance over clean data. Traditional defense approaches against these attacks are often not affective in FL, leading to the need for research into alternative mitigation techniques. This paper studies the ability of three clipping-based approaches, including fixed clipping, adaptive clipping, and dynamic clipping, to mitigate backdoor attacks in FL across various levels of adversarial interference. These methods limit the impact of adversarial updates by using controlled thresholds on client updates, balancing attack protection with model accuracy. Experiments on the MNIST data set show that all the methods suppress the poisoning effect but that dynamic clipping, with per-client tailored thresholds, best optimizes the trade-off by reducing noise while effectively resisting adversarial updates. The findings show the benefit of utilizing personalized parameters compared to uniform clipping methods and reveal a viable line of defense against data poisoning attacks for FL without affecting model performance.