Using Adversarial Examples to against Backdoor Attack in Federated Learning

As a distributed learning paradigm, Federated Learning (FL) has achieved great success in aggregating information from different clients to train a shared global model. Unluckily, by uploading a carefully crafted updated model, a malicious client can insert a backdoor into the global model during federated learning training. Many secure aggregation policies and robust training protocols have been proposed to protect against backdoor attacks in FL. However, they still face the challenge of either being bypassed by adaptive attacks or compromising the main mission performance of FL. By empirically investigating backdoor attacks in FL, we gain an interesting insight that adversarial perturbations can activate backdoors in backdoor models. Thus, in the context of backdoor update detection, we compare the behavioral differences of models fed by adversarial examples. We present a novel FL backdoor defense method using adversarial examples. In particular, a small portion of the clean example dataset used for FL primary task training is collected in the sever that generates the adversarial examples. Through observing the updated models’ behavior under the adversarial examples, our method uses a clustering algorithm to choose benign models and exclude others, without any loss of performance on the main task of FL itself. An extensive assessment of the four datasets and corresponding DNNs shows that our method achieves state-of-the-art defense performance (SOTA) compared to the five baselines. Specifically, our method can reduce the attack success rate from 99. Furthermore, we verify the robustness of our method under adaptive attacks. Our method is open sourced to facilitate future research.