Defense-Guided Adaptive Attack on Byzantine-Robust Federated Learning

With the aid of a central server, federated learning enables several client devices to jointly learn a machine learning model. In particular, each client device simply needs to upload the local model to the server rather than sharing their local datasets. Recently, a novel federated learning technique called FLTrust has been proposed by the federated learning community. It performs a thorough Byzantine defense by initializing the magnitude of local model updates and evaluating the similarity of directions between local model updates and the root of trust. This approach claims to be robust to certain Byzantine failures of client devices (e.g., system failure, malicious manipulation). Also, this work proposed an adaptive attack against FLTrust. After evaluating this adaptive attack, we found that there are significant time overhead and computation overheads in implementing the adaptive attack. Although the attack is effective, it does not fit the real-world attacker model and can be easily detected by the central server. In this work, we studied the inherent drawbacks of the adaptive attack and designed a more efficient adaptive attack against FLTrust. To implement our adaptive attack, we introduced a cutting-edge framework recently proposed by the machine learning community, which can make model poisoning attacks more effective for a particular aggregation mode. We have implemented a robust and efficient adaptive attack against FLTrust by instantiating the framework with the FLTrust aggregation rule. We apply our adaptive attack to three cutting-edge Byzantine-robust federated learning approaches. According to research observations on four different datasets, our adaptive attack can achieve similar attack effects as FLTrust’s adaptive attack. Meanwhile, our adaptive attack is more efficient and better fits the actual distributed attack scenario.