PaperlayerView exact revision on arXiv

Source-linked AI summary

Free-riders in Federated Learning: Attacks and Defenses

Jierui Lin, Min Du, Jian Liu

arXiv:1911.12560v1cs.LGcs.CRstat.ML

TL;DR

Federated learning can reward clients that contribute genuine updates, creating an incentive for data-free clients to submit fabricated gradients. This paper studies free-rider attacks, evaluates anomaly-detection defenses, and proposes STD-DAGMM; its broader experiments indicate that differential privacy can favor detection, while the evaluation remains limited to MNIST and a two-layer fully connected model.

  • Problem

    Federated learning lacks a reliable way to determine whether rewarded client updates were trained on local data or artificially constructed.

  • Method

    The paper proposes free-rider attacks and evaluates Autoencoder, DAGMM, and STD-DAGMM defenses under multiple free riders and differential privacy.

  • Results

    STD-DAGMM is effective in detecting most free riders in the explored settings, and differential privacy favors their detection.

  • Takeaways & Limitations

    Free-rider detection is introduced as a research direction, with STD-DAGMM also showing potential for model-weight anomaly detection.

  • Takeaways & Limitations

    The experiments use only MNIST and a two-layer fully connected model, while secure aggregation may make free-rider detection challenging.

Abstract

from arXiv · show

Federated learning is a recently proposed paradigm that enables multiple clients to collaboratively train a joint model. It allows clients to train models locally, and leverages the parameter server to generate a global model by aggregating the locally submitted gradient updates at each round. Although the incentive model for federated learning has not been fully developed, it is supposed that participants are able to get rewards or the privilege to use the final global model, as a compensation for taking efforts to train the model. Therefore, a client who does not have any local data has the incentive to construct local gradient updates in order to deceive for rewards. In this paper, we are the first to propose the notion of free rider attacks, to explore possible ways that an attacker may construct gradient updates, without any local training data. Furthermore, we explore possible defenses that could detect the proposed attacks, and propose a new high dimensional detection method called STD-DAGMM, which particularly works well for anomaly detection of model parameters. We extend the attacks and defenses to consider more free riders as well as differential privacy, which sheds light on and calls for future research in this field.

I. INTRODUCTION

The paper identifies free-rider attacks as a threat to federated learning incentives and introduces attacks and defenses for detecting fabricated updates.

  • I. INTRODUCTION: Federated learning coordinates local training through a parameter server that aggregates clients’ gradient updates into a global model.Clients retain their data locally and communicate model parameters rather than raw data.
  • I. INTRODUCTION: Clients may fabricate updates without local data to obtain rewards or access to the final model, creating the free-rider problem.The paper frames detection as distinguishing genuinely trained updates from artificially constructed weights.
  • I. INTRODUCTION: The paper introduces random and delta-weights attacks and evaluates defenses for detecting them.The attacks construct updates without local training data, including updates based on differences between previously received global models.
  • I. INTRODUCTION: STD-DAGMM is proposed as a high-dimensional anomaly detector tailored to free-rider detection and model-weight anomalies.The method incorporates update standard deviation into DAGMM.
  • I. INTRODUCTION: The study extends its analysis to multiple free riders and differential privacy, which may make attacks less effective and easier to detect.These extensions broaden the evaluation beyond the initial attack and defense setting.

B. DAGMM

This section defines free riders and the detection setting, then describes random updates as a basic attack that can mimic the required update dimensions while lacking local-data training.

  • B. DAGMM: A free rider fakes a local gradient update using available global-model information to obtain federated-learning benefits without local data.The submitted update is made to appear as if it resulted from local training.
  • B. DAGMM: The problem assumes free riders remain free riders across rounds, do not collude, and are detected without historical client updates.The server uses the updates available in the current round.
  • B. DAGMM: Detection aims to identify clients whose entire gradient series is fabricated rather than produced through local-data updates.The setting considers multiple client update sequences and global-model sequences.
  • B. DAGMM: The basic defense comparison tests whether Autoencoder and DAGMM anomaly detection can identify randomly generated free-rider updates.The attack is designed to satisfy the parameter server’s dimensionality requirement while avoiding trivial zero updates.
  • B. DAGMM: A random-weights attacker generates an update with the same dimension as the global model by sampling values uniformly from [−R, R].The range parameter R controls the maximum and minimum sampled values and may be chosen to resemble normal updates.

B. Defense strategy

The defense strategy applies Autoencoder and DAGMM anomaly detection to flattened client updates, emphasizing DAGMM’s suitability for high-dimensional model weights and evaluating detection across training conditions.

  • B. Defense strategy: Both defenses flatten each client’s update matrix into a single vector before processing client updates in mini-batches.Autoencoder detection uses reconstruction error, while DAGMM processes the resulting high-dimensional vectors.
  • B. Defense strategy: Autoencoder detection reduces and reconstructs update vectors, using reconstruction error to identify atypical client updates.The approach is based on the expectation that common patterns are preserved better than outlier patterns.
  • B. Defense strategy: DAGMM is motivated as suitable for detecting anomalies in model-weight matrices because these matrices can contain millions of parameters.The paper’s two-layer MNIST model has nearly 0.2 million parameters.
  • B. Defense strategy: The experiments use 100 clients with one free rider on MNIST and compare settings with similar or differing client data distributions.The study also varies the random sampling range R.
  • B. Defense strategy: Detection performance depends on training time, with free riders reported as easier to detect near model convergence than early in training.The experiments therefore examine both early and near-converged periods.

1) Each client has similar local data distribution.:

With similarly distributed client data, random free-rider updates can evade Autoencoder detection, while DAGMM detects them across update ranges and training stages.

  • 1) Each client has similar local data distribution.:: The experiments evaluate random updates at rounds 5 and 80, representing early training and near convergence.Clients receive similarly distributed MNIST data, while the attacker samples update values uniformly within a selected range.
  • 1) Each client has similar local data distribution.:: Autoencoder fails on random updates from [−10^-4, 10^-4], assigning the free rider the smallest reconstruction error.The authors attribute this to the free rider’s smaller update standard deviation being easier for Autoencoder to memorize.
  • 1) Each client has similar local data distribution.:: DAGMM assigns the free rider the highest energy value, providing a broad threshold range for separating it from normal clients.The authors associate this detection ability with reduced-dimensional embeddings and Cosine distance.
  • 1) Each client has similar local data distribution.:: DAGMM detects random free-rider updates even when their standard deviation becomes inseparable from other clients’ after round 10.This holds for detection at both round 5 and round 80 when updates are sampled from [−10^-3, 10^-3].

2) Each client has different local data distribution.:

With heterogeneous client data, random free-rider updates are harder to distinguish using basic statistics, yet DAGMM still successfully detects them; the section also introduces delta weights attacks.

  • 2) Each client has different local data distribution.:: Heterogeneous client data makes free riders harder to detect because benign clients’ gradient updates also differ from one another.The experiment therefore focuses on the range R = 10^-3, which previously produced random updates with similar standard deviation to other clients.
  • 2) Each client has different local data distribution.:: DAGMM successfully detects random free-rider attacks when clients have different local data distributions and updates are sampled from [−10^-3, 10^-3].In this setting, client updates differ because most clients possess only one MNIST class, while model accuracy increases more slowly.
  • A. Attack specification: The delta weights attack constructs fake updates by subtracting two previously received global models, approximating the previous round’s average client update scaled by η.Because parameter changes are usually small after early epochs, these fake gradients can resemble genuine updates and evade validation-based utility checks.

B. Defense strategy

STD-DAGMM augments DAGMM with the standard deviation of each gradient update matrix to detect free riders across learning-rate conditions and sophisticated attacks.

  • B. Defense strategy: DAGMM works when η is close to 1 but fails when η is small, motivating a detector that combines DAGMM with standard deviation.For small η, fake updates are much smaller than other clients’ updates and have substantially smaller standard deviation.
  • B. Defense strategy: STD-DAGMM appends a gradient-update standard deviation metric to DAGMM’s estimation-network input alongside autoencoder embeddings and distance metrics.Its learning objective retains DAGMM’s reconstruction-error and likelihood terms.
  • B. Defense strategy: STD-DAGMM is reported to remain effective against sophisticated free-rider attacks lacking clear separation in basic gradient statistics.The method is evaluated in later experiments under conditions where DAGMM’s effectiveness varies with the global learning rate η.

C. Experimental validation

The experiments evaluate STD-DAGMM against delta-weights attacks across learning rates, showing that it addresses cases where DAGMM or STD alone fails.

  • C. Experimental validation: When η < 0.3, DAGMM initially fails because the scaled update is close to zero and its direction resembles benign updates.The failure is illustrated at an early training round such as round 5.
  • C. Experimental validation: STD-DAGMM detects the low-learning-rate free rider because its update standard deviation is much smaller and its energy value is substantially larger.The result is shown in Figure 6g, where a broad range of thresholds separates the free rider.
  • C. Experimental validation: At η = 1, STD alone cannot separate the free rider before round 10, whereas DAGMM captures high-dimensional patterns and STD-DAGMM remains effective.The combined method detects the attack despite STD curves overlapping with other clients.

2) Each client has different local data distribution.:

Under heterogeneous local data distributions, STD-DAGMM detects delta-weights attacks and remains effective for random-weights attacks across client-data settings.

  • 2) Each client has different local data distribution.: STD-DAGMM detects delta-weights free riders when clients hold only one or two MNIST classes.In this setting, free-rider updates have lower standard deviation because averaging reduces sparsity-related variation.
  • 2) Each client has different local data distribution.: Heterogeneous client updates have larger standard deviation because each benign client updates only a specific parameter subset.The free rider’s averaging produces a lower-STD update than these sparse benign updates.
  • 2) Each client has different local data distribution.: STD-DAGMM detects the random-weights attack regardless of whether clients have similar or different local data distributions.This result is presented as evidence of generality in free-rider detection.

VI. ATTACK III: ADVANCED DELTA WEIGHTS

The advanced delta-weights attack adds Gaussian noise to delta-weight updates, making repeated attacks less identical while testing whether detection remains robust.

  • VI. ATTACK III: ADVANCED DELTA WEIGHTS: Adding Gaussian noise is motivated by the fact that multiple identical delta-weight attacks would otherwise be trivial to detect.The attack therefore targets a specific weakness of repeated identical submissions.
  • VI. ATTACK III: ADVANCED DELTA WEIGHTS: The advanced delta-weights attack adds zero-mean Gaussian noise with standard deviation σ to delta-weight updates.The noise is intended to make multiple free riders’ updates less identical and harder to detect.

B. Defense strategy

STD-DAGMM remains effective against advanced delta-weight attacks even when Gaussian noise hides the free rider from DAGMM.

  • B. Defense strategy: Choosing Gaussian noise with standard deviation similar to benign updates makes the advanced attack harder for DAGMM to detect.The paper assumes a strong attacker has prior knowledge of the training process when choosing σ.
  • B. Defense strategy: STD-DAGMM continuously detects advanced delta-weight attacks, including cases where the free rider’s energy is hidden among normal clients.DAGMM fails to separate the free rider at both round 5 and round 80, while STD-DAGMM produces the largest energy value.
  • B. Defense strategy: The defense is evaluated in real-world settings that include unknown numbers of free riders and privacy-enhancing mechanisms.Differential privacy adds Gaussian noise to model parameters and may affect both attacks and detection.

A. More free riders

With more free riders, STD-DAGMM remains more effective than DAGMM, while differential privacy can make free riders easier to detect. Detection remains imperfect because no single threshold cleanly separates all attackers.

  • A. More free riders: For 20 free riders using the advanced delta weights attack, no single threshold separates free riders from benign clients.STD-DAGMM and DAGMM detection results are evaluated using energy-value histograms, while Gaussian noise increases free-rider standard-deviation variation.
  • A. More free riders: The section evaluates defenses with 20 free riders among 100 clients using the advanced delta weights attack.Each free rider subtracts two previous global models and adds Gaussian noise with σ = 10^-3.
  • A. More free riders: STD-DAGMM outperforms DAGMM across varying free-rider ratios.As the ratio of free riders increases, detection becomes more difficult for the defenses overall.
  • A. More free riders: The experiments examine free-rider detection under differential privacy and privacy amplification.Free riders participate intermittently and generate updates from previously received global models.
  • A. More free riders: Both DAGMM and STD-DAGMM detect all 20 free riders under differential privacy.The free riders’ updates have higher magnitude and standard deviation because they aggregate small updates across multiple rounds.

VIII. LIMITATION

The paper’s evaluation is limited to MNIST and a two-layer fully connected model, while newer federated-learning paradigms such as secure aggregation may alter attack and detection strategies. The authors identify broader datasets, models, and federated-learning solutions as future work.

  • VIII. LIMITATION: All experiments use the MNIST dataset and a two-layer fully connected model.The authors leave evaluation on other datasets and models, including language models and natural-language datasets, for future work.
  • VIII. LIMITATION: The proposed methods require further study across other datasets, models, and federated-learning paradigms.The paper identifies broader evaluation and adaptation to newer federated-learning solutions as future work.
  • VIII. LIMITATION: Secure aggregation may make free-rider detection challenging because the server cannot inspect client updates in plaintext.The authors note that different federated-learning solutions may affect attack and defense strategies.
Loading 1911.12560v1…