Source-linked AI summary
Abnormal Client Behavior Detection in Federated Learning
Suyi Li, Yong Cheng, Yang Liu, Wei Wang, Tianjian Chen
TL;DR
Federated learning lacks full server control over client behavior, allowing malicious or malfunctioning clients to disrupt training. The paper detects anomalous clients server-side using autoencoder-based analysis of low-dimensional model-weight surrogates. Its detection-based approach outperforms conventional defense-based methods, including by at least 10% model accuracy in a reported comparison.
Problem
Federated learning must detect intentional or unintentional abnormal clients because servers lack full control over client behavior and data.
Method
The server applies anomaly detection to low-dimensional surrogates of client model-weight updates and uses anomaly-aware credit scores during aggregation.
Results
The detection-based approach outperforms conventional defense-based methods, achieving an improvement of 10% or more in model accuracy over GeoMed under sign-flipping attacks.
Takeaways & Limitations
Server-side detection can offer the option to opt out anomalous clients while achieving superior performance to defense-based methods.
Takeaways & Limitations
The convergence guarantee is stated conditional on convergence of the FedAvg algorithm.
Abstract
from arXiv · showhide
In federated learning systems, clients are autonomous in that their behaviors are not fully governed by the server. Consequently, a client may intentionally or unintentionally deviate from the prescribed course of federated model training, resulting in abnormal behaviors, such as turning into a malicious attacker or a malfunctioning client. Timely detecting those anomalous clients is therefore critical to minimize their adverse impacts. In this work, we propose to detect anomalous clients at the server side. In particular, we generate low-dimensional surrogates of model weight vectors and use them to perform anomaly detection. We evaluate our solution through experiments on image classification model training over the FEMNIST dataset. Experimental results show that the proposed detection-based approach significantly outperforms the conventional defense-based methods.
1 Introduction
Federated learning enables collaborative model training without sharing clients’ privacy-sensitive data, but autonomous clients may behave abnormally. The paper proposes server-side detection using low-dimensional weight-update surrogates and reports higher accuracy than defense-based methods.
- Federated learning lets multiple data owners collaboratively train a model without sending privacy-sensitive data to a server.
- A typical system repeatedly trains local models, sends updates to a server for aggregation, and returns the global update to clients.
- Clients may deviate intentionally through malicious attacks or unintentionally because of hardware or software defects.
- Detecting abnormal clients can minimize their impact, support reporting, prevent unintended model leakage, and avoid rewarding them.
- The proposed server-side approach detects abnormal local updates with dimensionality-reduced surrogates and improves jointly trained model accuracy by 10% or more over defense-based methods.
2 Related Work
Prior work largely uses defense-based algorithms to reduce malicious clients’ effects. This paper positions its contribution as the first detection-based approach applied to federated learning.
- Distributed machine learning has used defense-based methods including GeoMed, Krum, and Trimmed Mean against malicious attackers.
- A prior detection-based method assumes masked training features preserve the training-data distribution, an assumption described as inapplicable to federated learning.
- The paper presents its method as the first detection-based approach applied to the federated learning framework.
3 Abnormal Client Behavior Detection
The method assigns client credit scores from anomaly scores, incorporates them into FedAvg aggregation, and can exclude clients above a threshold. A server-side autoencoder detects abnormal updates using low-dimensional weight surrogates.
- Detection-Based Approach: The system uses a server-side anomaly detector to identify anomalous clients and reduce their impact during FedAvg training.
- Detection-Based Approach: Client credit scores combine the client’s data fraction with its anomaly score to produce targeted aggregation weights.
- Detection-Based Approach: The weighted aggregation procedure preserves convergence when FedAvg converges, because the anomaly-aware weighting effectively scales down the learning rate.
- Autoencoder-Based Anomaly Detection: An autoencoder is pretrained at the server on previously accumulated model weights and reconstructs compressed representations to obtain anomaly scores.
- Autoencoder-Based Anomaly Detection: Dimensionality reduction generates low-dimensional surrogates of extremely large model weights to reduce autoencoder and detection complexity.
- Detection-Based Approach: The method can set a client’s credit score to zero when its anomaly score exceeds a threshold, enabling hard abnormal-client decisions.
4 Experiments
Experiments evaluate anomaly detection in FEMNIST image classification using a CNN, a server-side autoencoder, and three adversarial attack models. The proposed methods outperform baseline schemes across the evaluated attack settings, with especially large gains over GeoMed under sign-flipping attacks.
- Experimental Settings: 801,074 FEMNIST samples are distributed unevenly among 3,500 writers, with 20 writers selected during each global round.Each writer represents a client, creating a heterogeneous federated setting.
- Experimental Settings: The evaluated image classifier is a CNN with two convolutional layers, a 1024-unit fully connected layer, and a 62-dimensional softmax output.The convolutional layers use 3 × 3 kernels, 32 channels, and 2 × 2 max-pooling.
- Experimental Settings: The server-side autoencoder uses a 3000-dimensional input sampled from the last convolutional layer and four hidden layers with 64, 32, 32, and 64 units.It is trained using reconstruction-error loss with dropout rate 0.2; the credit-score hyperparameter L is set to 2.
- Attack Models: The experiments consider sign-flipping, additive-noise, and gradient-ascent attacks against local model updates.Sign-flipping reverses model-weight signs, additive noise adds Gaussian noise, and gradient ascent replaces local gradient descent.
- Experimental Results: The proposed Thresholding and Credit Score methods outperform baseline schemes in model accuracy across sign-flipping, additive-noise, and gradient-ascent settings.Thresholding achieves almost the same performance as attacker-free FedAvg by removing abnormal updates.
- Experimental Results: 10% or more model-accuracy improvement over GeoMed is reported under sign-flipping attacks, while Krum and Trimmed Mean are ineffective in the considered non-iid settings.Krum and Trimmed Mean also require prior knowledge of the attacker fraction, which is unavailable in federated learning.
5 Summary
The paper concludes that server-side autoencoder anomaly detection can identify abnormal local model updates and that the detection-based approach outperforms defense-based methods.
- Server-side autoencoder anomaly detection identifies abnormal local model updates, while the detection-based approach outperforms defense-based methods.