Harsh Bimal Desai
ABSTRACT
Federated Learning (FL) is a distributed, and decentralized machine learning protocol. By executing FL, a set of agents can jointly train a model without sharing their datasets with each other, or a third-party. This makes FL particularly suitable for settings where data privacy is desired.
At the same time, concealing training data gives attackers an opportunity to inject backdoors into the trained model. It has been shown that an attacker can inject backdoors to the trained model during FL, and then can leverage the backdoor to make the model misclassify later. Several works tried to alleviate this threat by designing robust aggregation functions. However, given more sophisticated attacks are developed over time, which by-pass the existing defenses, we approach this problem from a complementary angle in this work. Particularly, we aim to discourage backdoor attacks by detecting, and punishing the attackers, possibly after the end of training phase.
To this end, we develop a hybrid blockchain-based FL framework that uses smart contracts to automatically detect, and punish the attackers via monetary penalties. Our framework is general in the sense that, any aggregation function, and any attacker detection algorithm can be plugged into it. We conduct experiments to demonstrate that our framework preserves the communication-efficient nature of FL, and provide empirical results to illustrate that it can successfully penalize attackers by leveraging our novel attacker detection algorithm.
Supplemental Material
- [n.d.]. Common architectures in convolutional neural networks. https://www. jeremyjordan.me/convnet-architectures/Google Scholar
- Elli Androulaki, Artem Barger, Vita Bortnikov, Christian Cachin, Konstantinos Christidis, Angelo De Caro, David Enyeart, Christopher Ferris, Gennady Laventman, Yacov Manevich, Srinivasan Muralidharan, Chet Murthy, Binh Nguyen, Manish Sethi, Gari Singh, Keith Smith, Alessandro Sorniotti, Chrysoula Stathakopoulou, Marko Vukolic, Sharon Weed Cocco, and Jason Yellick. 2018. Hyperledger Fabric: A Distributed Operating System for Permissioned Blockchains. In Proceedings of the Thirteenth EuroSys Conference (Porto, Portugal) (EuroSys '18). Association for Computing Machinery, New York, NY, USA, Article 30, 15 pages. https://doi.org/10.1145/3190508.3190538Google ScholarDigital Library
- Eugene Bagdasaryan, Andreas Veit, Yiqing Hua, Deborah Estrin, and Vitaly Shmatikov. 2020. How to backdoor federated learning. In International Conference on Artificial Intelligence and Statistics. 2938--2948.Google Scholar
- Jeremy Bernstein, Yu-Xiang Wang, Kamyar Azizzadenesheli, and Anima Anandkumar. 2018. signSGD: Compressed Optimisation for Non-Convex Problems. arxiv: 1802.04434 [cs.LG]Google Scholar
- Arjun Nitin Bhagoji, Supriyo Chakraborty, Prateek Mittal, and Seraphin Calo. 2019. Analyzing federated learning through an adversarial lens. In International Conference on Machine Learning. 634--643.Google Scholar
- Peva Blanchard, Rachid Guerraoui, Julien Stainer, et almbox. 2017. Machine learning with adversaries: Byzantine tolerant gradient descent. In Advances in Neural Information Processing Systems. 119--129.Google Scholar
- Keith Bonawitz, Vladimir Ivanov, Ben Kreuter, Antonio Marcedone, H Brendan McMahan, Sarvar Patel, Daniel Ramage, Aaron Segal, and Karn Seth. 2017. Practical secure aggregation for privacy-preserving machine learning. In Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security. 1175--1191.Google ScholarDigital Library
- Miguel Castro and Barbara Liskov. 2002. Practical Byzantine Fault Tolerance and Proactive Recovery. ACM Trans. Comput. Syst., Vol. 20, 4 (Nov. 2002), 398--461. https://doi.org/10.1145/571637.571640Google ScholarDigital Library
- Xinyun Chen, Chang Liu, Bo Li, Kimberly Lu, and Dawn Song. 2017. Targeted backdoor attacks on deep learning systems using data poisoning. arXiv preprint arXiv:1712.05526 (2017).Google Scholar
- H. Desai, K. Liu, M. Kantarcioglu, and L. Kagal. 2018. Adjudicating Violations in Data Sharing Agreements Using Smart Contracts. In 2018 IEEE International Conference on Internet of Things (iThings) and IEEE Green Computing and Communications (GreenCom) and IEEE Cyber, Physical and Social Computing (CPSCom) and IEEE Smart Data (SmartData). 1553--1560.Google Scholar
- Clement Fung, Chris J. M. Yoon, and Ivan Beschastnikh. 2020. Mitigating Sybils in Federated Learning Poisoning. arXiv preprint arXiv:1808.04866 (2020).Google Scholar
- Robin C Geyer, Tassilo Klein, and Moin Nabi. 2017. Differentially private federated learning: A client level perspective. arXiv preprint arXiv:1712.07557 (2017).Google Scholar
- Christian Gorenflo, Stephen Lee, Lukasz Golab, and Srinivasan Keshav. 2019. Fastfabric: Scaling hyperledger fabric to 20,000 transactions per second. In 2019 IEEE International Conference on Blockchain and Cryptocurrency (ICBC). IEEE, 455--463.Google ScholarCross Ref
- Y. Hao, Y. Li, X. Dong, L. Fang, and P. Chen. 2018. Performance Analysis of Consensus Algorithm in Private Blockchain. In 2018 IEEE Intelligent Vehicles Symposium (IV). 280--285.Google Scholar
- Markus Jakobsson and Ari Juels. 1999. Proofs of Work and Bread Pudding Protocols(Extended Abstract). Springer US, Boston, MA, 258--272.Google Scholar
- Seoung Kyun Kim, Zane Ma, Siddharth Murali, Joshua Mason, Andrew Miller, and Michael Bailey. 2018. Measuring ethereum network peers. In Proceedings of the Internet Measurement Conference 2018. 91--104.Google ScholarDigital Library
- Jakub Konený, H. Brendan McMahan, Felix X. Yu, Peter Richtárik, Ananda Theertha Suresh, and Dave Bacon. 2017. Federated Learning: Strategies for Improving Communication Efficiency. arxiv: 1610.05492 [cs.LG]Google Scholar
- Alex Krizhevsky, Vinod Nair, and Geoffrey Hinton. 2009. CIFAR-10 (Canadian Institute for Advanced Research). (2009). http://www.cs.toronto.edu/ kriz/cifar.htmlGoogle Scholar
- Yingqi Liu, Shiqing Ma, Yousra Aafer, Wen-Chuan Lee, Juan Zhai, Weihang Wang, and Xiangyu Zhang. 2018. Trojaning Attack on Neural Networks. In 25nd Annual Network and Distributed System Security Symposium, NDSS 2018, San Diego, California, USA, February 18-221, 2018. The Internet Society.Google Scholar
- Chuan Ma, Jun Li, Ming Ding, Long Shi, Taotao Wang, Zhu Han, and H. Vincent Poor. 2020. When Federated Learning Meets Blockchain: A New Distributed Learning Paradigm. arxiv: 2009.09338 [cs.NI]Google Scholar
- H Brendan McMahan, Eider Moore, Daniel Ramage, Seth Hampson, et almbox. 2016b. Communication-efficient learning of deep networks from decentralized data. arXiv preprint arXiv:1602.05629 (2016).Google Scholar
- H. Brendan McMahan, Eider Moore, Daniel Ramage, Seth Hampson, and Blaise Agüera y Arcas. 2016a. Communication-Efficient Learning of Deep Networks from Decentralized Data. arxiv: 1602.05629 [cs.LG]Google Scholar
- El Mahdi El Mhamdi, Rachid Guerraoui, and Sébastien Rouault. 2018. The hidden vulnerability of distributed learning in byzantium. arXiv preprint arXiv:1802.07927(2018).Google Scholar
- Vaikkunth Mugunthan, Ravi Rahman, and Lalana Kagal. 2020. BlockFLow: An Accountable and Privacy-Preserving Solution for Federated Learning. arxiv: 2007.03856 [cs.LG]Google Scholar
- Satoshi Nakamoto. 2009. Bitcoin: A Peer-to-Peer Electronic Cash System. Cryptography Mailing list at https://metzdowd.com (03 2009).Google Scholar
- Mustafa Safa Ozdayi, Murat Kantarcioglu, and Yulia R Gel. 2020. Defending Against Backdoors in Federated Learning with Robust Learning Rate. arXiv preprint arXiv:2007.03767 (2020).Google Scholar
- Krishna Pillutla, Sham M Kakade, and Zaid Harchaoui. 2019. Robust aggregation for federated learning. arXiv preprint arXiv:1912.13445 (2019).Google Scholar
- S. Pongnumkul, C. Siripanpornchana, and S. Thajchayapong. 2017. Performance Analysis of Private Blockchain Platforms in Varying Workloads. In 2017 26th International Conference on Computer Communication and Networks (ICCCN). 1--6.Google Scholar
- Felix Sattler, Simon Wiedemann, Klaus-Robert Müller, and Wojciech Samek. 2019. Robust and communication-efficient federated learning from non-iid data. IEEE transactions on neural networks and learning systems (2019).Google Scholar
- Ali Shafahi, W Ronny Huang, Mahyar Najibi, Octavian Suciu, Christoph Studer, Tudor Dumitras, and Tom Goldstein. 2018. Poison frogs! targeted clean-label poisoning attacks on neural networks. In Advances in Neural Information Processing Systems. 6103--6113.Google Scholar
- Neta Shoham, Tomer Avidor, Aviv Keren, Nadav Israel, Daniel Benditkis, Liron Mor-Yosef, and Itai Zeitak. 2019. Overcoming Forgetting in Federated Learning on Non-IID Data. arXiv preprint arXiv:1910.07796 (2019).Google Scholar
- Ziteng Sun, Peter Kairouz, Ananda Theertha Suresh, and H Brendan McMahan. 2019. Can you really backdoor federated learning? arXiv preprint arXiv:1911.07963 (2019).Google Scholar
- Gavin Wood. [n.d.]. Ethereum: A secure decentralised generalised transaction ledger. ([n.,d.]).Google Scholar
- Dong Yin, Yudong Chen, Ramchandran Kannan, and Peter Bartlett. 2018. Byzantine-Robust Distributed Learning: Towards Optimal Statistical Rates. In International Conference on Machine Learning. 5650--5659.Google Scholar
Index Terms
BlockFLA: Accountable Federated Learning via Hybrid Blockchain Architecture
Recommendations
Defending against Poisoning Backdoor Attacks on Federated Meta-learning
Federated learning allows multiple users to collaboratively train a shared classification model while preserving data privacy. This approach, where model updates are aggregated by a central server, was shown to be vulnerable to poisoning backdoor attacks: ...
Evil vs evil: using adversarial examples to against backdoor attack in federated learning
AbstractAs a distributed learning paradigm, federated learning (FL) has shown great success in aggregating information from different clients to train a shared global model. Unfortunately, by uploading carefully crafted updated models, a malicious client ...
CONTRA: Defending Against Poisoning Attacks in Federated Learning
AbstractFederated learning (FL) is an emerging machine learning paradigm. With FL, distributed data owners aggregate their model updates to train a shared deep neural network collaboratively, while keeping the training data locally. However, FL has little ...
Comments