Source-linked AI summary
Attack-Resistant Federated Learning with Residual-based Reweighting
Shuhao Fu, Chulin Xie, Bo Li, Qifeng Chen
TL;DR
Federated learning aggregation is vulnerable to adversarial attacks that can corrupt the global model. This paper proposes residual-based reweighting using repeated median regression and IRLS-inspired confidence weighting. Experiments report robustness to label-flipping and backdoor attacks and better performance than alternative methods.
Problem
FedAvg and other simple aggregation methods are vulnerable to label-flipping and backdoor attacks that can poison the global model.
Method
The method estimates parameter confidence from residuals to repeated-median regression lines and uses those confidences to reweight local models.
Results
The proposed algorithm outperforms evaluated baselines across four datasets and mitigates attacked models in non-IID federated learning.
Takeaways & Limitations
The algorithm is robust to label-flipping and backdoor attacks and can be incorporated into existing federated-learning frameworks.
Takeaways & Limitations
The theoretical analysis assumes smoothness, a convex compact parameter space, and a bounded corruption setting.
Abstract
from arXiv · showhide
Federated learning has a variety of applications in multiple domains by utilizing private training data stored on different devices. However, the aggregation process in federated learning is highly vulnerable to adversarial attacks so that the global model may behave abnormally under attacks. To tackle this challenge, we present a novel aggregation algorithm with residual-based reweighting to defend federated learning. Our aggregation algorithm combines repeated median regression with the reweighting scheme in iteratively reweighted least squares. Our experiments show that our aggregation algorithm outperforms other alternative algorithms in the presence of label-flipping and backdoor attacks. We also provide theoretical analysis for our aggregation algorithm.
Introduction
Federated learning protects decentralized private data but remains vulnerable to poisoned local models and non-IID data challenges. The paper proposes residual-based reweighting that combines repeated median regression with IRLS-inspired weighting and reports stronger attack resistance than baselines.
- FedAvg is vulnerable to label-flipping and backdoor attacks because poisoned local models can poison the aggregated global model.
- Existing median and trimmed-mean methods degrade with non-IID data, while similarity-based defenses can misidentify harmless participants with similar local data.
- The proposed aggregation combines repeated median estimation with IRLS reweighting to estimate parameter confidence and robustly weight local models.
- Across MNIST, CIFAR-10, Amazon Reviews, and Lending Club, the method significantly mitigates attacked models and outperforms evaluated baselines.
Related Work
Prior work studies attacks and robust aggregation in distributed learning, but defenses face challenges from non-IID data and benign participants with similar objectives. The paper positions its method as a robustness-focused alternative for federated learning.
- Label-flipping attacks can seriously harm federated systems even when only a small number of attackers participate.
- Robust distributed learning: Median and trimmed-mean methods can be effective for IID distributed learning but may fail in federated learning with non-IID data.
- Defending federated learning: FoolsGold adjusts local-model learning rates using contribution similarity to defend against Sybil attacks, but similar benign data can complicate that strategy.
- Defending federated learning: The paper focuses on robustness so the global model behaves correctly despite malicious participants, rather than on differential-privacy enhancement.
Our Algorithm
The aggregation algorithm fits a robust regression line to each parameter across local models, converts residuals into confidence values, and accumulates them into model weights. It then forms a reweighted global average while correcting extreme low-confidence parameters.
- Aggregation Algorithm: The global model is a reweighted average of all local models, avoiding the information loss caused by using a single median under non-IID data.
- Aggregation Algorithm: Confidence is 1 near the regression line, decays from 1 to δ in an intermediate region, and becomes 0 farther away.
- Aggregation Algorithm: For each parameter, repeated median regression estimates a robust line from sorted local-model values, after which residuals measure vertical distance from that line.
- Aggregation Algorithm: Residuals are normalized using an IRLS-inspired procedure before being converted into parameter confidence values.
- Aggregation Algorithm: The algorithm corrects extremely large low-confidence parameters and weights models by accumulated confidence adjusted for parameter disagreement.
Experiments
Experiments evaluate the proposed aggregation method against several baselines across non-IID label-flipping and backdoor attacks. The method remains effective across datasets and model complexities, while baselines can fail under challenging settings.
- Label-flipping attacks: The method outperforms all other methods as attackers increase in MNIST label-flipping experiments and surpasses FoolsGold by 6% on average.Median methods have low accuracy even without attackers, whereas reweighted averaging retains more local-model information.
- Label-flipping attacks: On CIFAR-10 label-flipping experiments, FoolsGold can misidentify honest users when non-IID gradients are not sufficiently separated.The method is reported as suitable for both extremely non-IID MNIST and more common non-IID CIFAR-10 and Amazon Reviews settings.
- Label-flipping attacks: On Amazon Reviews, the method achieves comparable state-of-the-art results without performance degradation when fewer than 50% of participants are attackers.The experiment uses up to four attackers among ten participants, with attackers training for five additional epochs.
- Backdoor attacks: For backdoor attacks, the method is highest in MNIST accuracy, uniquely defends the CIFAR-10 naive attack, and maintains 9.65% attack success after 100 rounds.Other baselines slow attacks but still exceed 70% attack success within 100 rounds; FoolsGold fails on both main and backdoor tasks.
- Backdoor attacks: On LOAN under naive attacks, the method reaches 94.50% accuracy and 0.00% attack success, versus FedAvg’s 93.65% and 99.71%.Under model replacement, it reaches 95.06% accuracy and 0.00% attack success, versus FedAvg’s 94.11% and 98.96%.
- Backdoor attacks: All baselines fail against the CIFAR-10 naive backdoor attack and a ResNet-18 MNIST variant, while the method remains stable.The authors associate this robustness with model-wise reweighting, which preserves parameter structure and captures higher-level information.
Theoretical Analysis
The analysis bounds the error of the reweighted global model under adversarial and honest participants, using assumptions and prior bounds on median and honest-model deviations.
- Theoretical Analysis: Residuals are formed relative to the median local parameter, normalized by the median absolute residual, and used to define parameter confidence.These confidence values determine the reweighting applied to local models.
- Theoretical Analysis: The global model Mglobal is defined as a confidence-weighted average of local parameters, whose error is then bounded.The proof separates adversarial devices from normal users when analyzing this bound.
- Theoretical Analysis: The analysis assumes smooth losses, sub-exponential gradients, a convex compact parameter space, and a corruption ratio α = U/K.These conditions frame the stated theoretical guarantee.
- Theoretical Analysis: Prior results bound the median-to-optimum deviation and the maximum honest-model-to-optimum deviation with high probability.The paper identifies these bounds as the third and first terms, respectively, in Equation 15.
- Theoretical Analysis: The proof analyzes adversarial cases through residual thresholds to establish the resulting bound on the reweighted aggregation error.The argument combines the separate cases before concluding the bound.
Conclusion
The paper presents residual reweighting as a practical defense for federated learning, reporting robustness to label-flipping and backdoor attacks across several application domains.
- Conclusion: Residual reweighting makes federated learning robust to label-flipping and backdoor attacks while prior aggregation methods are not.The conclusion frames the method as an attack-resistant alternative to simple aggregation.
- Conclusion: The algorithm is easy to implement and can be incorporated into existing federated learning frameworks.