Defending against Backdoors in Federated Learning with Robust Learning Rate

Mustafa Safa Ozdayi; Murat Kantarcioglu; Yulia R. Gel

Source-linked AI summary

Defending against Backdoors in Federated Learning with Robust Learning Rate

Mustafa Safa Ozdayi, Murat Kantarcioglu, Yulia R. Gel

arXiv:2007.03767v4Jul 7, 2020cs.LGcs.CRstat.ML

TL;DR

Federated learning enables private collaborative training but remains vulnerable to backdoor attacks. This paper proposes robust learning rate, which adjusts the server’s learning rate per dimension and round using update signs, and reports substantial backdoor reduction with minimal validation-accuracy degradation. Experiments cover multiple settings, alongside convergence analysis and comparisons with existing defenses.

Problem
Federated learning’s decentralized, privacy-preserving training remains susceptible to backdoor attacks that embed targeted misclassification behavior.
Method
The paper introduces robust learning rate, adjusting the aggregation server’s learning rate per dimension and round according to agents’ update signs.
Results
Experiments show substantially reduced backdoor accuracy or elimination of the backdoor, with minimal degradation in overall validation accuracy across evaluated settings.
Takeaways & Limitations
The defense significantly outperforms some recently proposed defenses while requiring only a lightweight change to the FL protocol.
Takeaways & Limitations
RLR depends on appropriately setting θ and on adversarial and honest loss functions differing; making them more aligned may reduce attack effectiveness but challenges the defense’s separation.

Abstract

from arXiv · show

Federated learning (FL) allows a set of agents to collaboratively train a model without sharing their potentially sensitive data. This makes FL suitable for privacy-preserving applications. At the same time, FL is susceptible to adversarial attacks due to decentralized and unvetted data. One important line of attacks against FL is the backdoor attacks. In a backdoor attack, an adversary tries to embed a backdoor functionality to the model during training that can later be activated to cause a desired misclassification. To prevent backdoor attacks, we propose a lightweight defense that requires minimal change to the FL protocol. At a high level, our defense is based on carefully adjusting the aggregation server's learning rate, per dimension and per round, based on the sign information of agents' updates. We first conjecture the necessary steps to carry a successful backdoor attack in FL setting, and then, explicitly formulate the defense based on our conjecture. Through experiments, we provide empirical evidence that supports our conjecture, and we test our defense against backdoor attacks under different settings. We observe that either backdoor is completely eliminated, or its accuracy is significantly reduced. Overall, our experiments suggest that our defense significantly outperforms some of the recently proposed defenses in the literature. We achieve this by having minimal influence over the accuracy of the trained models. In addition, we also provide convergence rate analysis for our proposed scheme.

1 Introduction

Federated learning enables collaborative model training without sharing data, but its decentralized setting permits backdoor attacks through malicious model updates. The paper proposes a server-side learning-rate defense and evaluates it against existing methods.

Federated learning lets agents collaboratively train models without sharing data, supporting settings where privacy is desired.
Backdoor attacks make models learn targeted misclassification functionality that can later be activated by an adversary.
In FL, adversaries typically use model poisoning because decentralized data limits access to the full training set.
The proposed defense adjusts the aggregation server’s learning rate and is reported to deter backdoors with minimal accuracy degradation.

2 Background

FL repeatedly aggregates client updates to optimize distributed loss functions, commonly through FedAvg. The background contrasts targeted backdoors and existing defenses, including robust aggregation, clipping with noise, and client-specific learning rates.

Federated Learning (FL): At each round, sampled agents train from the server’s current weights and return updates that the server aggregates into the next model.
Federated Learning (FL): Federated Averaging (FedAvg) uses weighted averaging to aggregate client updates with a server learning rate.
Backdoor Attacks and Model Poisoning: Targeted backdoors seek chosen-sample misclassification while minimally affecting main-task performance, unlike untargeted convergence attacks.
Robust Aggregation Methods: Existing defenses replace averaging with robust estimators, or combine update clipping and Gaussian noise to limit malicious influence.
Robust Aggregation Methods: Client-specific learning rates can fail when honest clients’ local distributions resemble one another, causing similar rates for honest and adversarial updates.

3 Robust Learning Rate

The paper conjectures that adversarial and honest updates differ in direction, then uses sign-based, per-dimension learning-rate adjustments to oppose insufficiently supported directions. It also analyzes convergence under stated smoothness, variance, distributional, and clipping assumptions.

Backdoor Task vs Main Task: The defense conjectures that aggregated adversarial and honest updates differ in direction when their target optima are different.
Robust learning rate (RLR): Robust learning rate (RLR) flips a dimension’s server learning rate when the summed update signs fall below threshold θ.
Robust learning rate (RLR): RLR adjusts learning rates per dimension while remaining agnostic to the aggregation function and compatible with clipping and noise addition.
Robust learning rate (RLR): Under the illustrative full-batch setting, low sign support moves parameters toward the gradient direction, attempting to maximize loss on that dimension.
Convergence Rate: The convergence-rate analysis assumes Lipschitz gradients, bounded variance, population weighted symmetry, and a universal update-clipping bound.

4 Experiments

The experiments evaluate RLR against backdoor attacks in i.i.d. and non-i.i.d. federated settings, using multiple aggregation baselines and attribution analyses. RLR provides strong backdoor protection with minimal validation-accuracy degradation, while switching to RLR later can improve convergence time.

Experimental setup: The experiments simulate backdoor attacks by poisoning a fraction of corrupt agents’ local data with trojan patterns and target-class relabeling.The evaluation considers a model trained over multiple rounds with a fraction of agents corrupt.
Experimental setup: The evaluation compares FedAvg, FedAvg with RLR, coordinate-wise median, FoolsGold, sign aggregation, and combinations with weight clipping.The study also uses a 5-layer convolutional network with about 1.2M parameters.
Attack construction: A 5-by-5 plus-sign trojan placed at the top-left targets sandals as sneakers in the i.i.d. case and digit 1s as digit 7s in the non-i.i.d. case.The experiments are also repeated with three additional trojan patterns in the Appendix.
IID setting: The i.i.d. Fashion MNIST experiments show that RLR provides significant protection against backdoor attacks compared with the evaluated baselines.Agents receive equal numbers of uniformly sampled training examples, and final accuracies are reported in Table 1.
Non-IID setting: The non-i.i.d. Federated EMNIST experiments indicate that RLR provides the best backdoor protection with minimal degradation in validation accuracy.Users may have different digit distributions, reflecting a more realistic federated setting.
Removing backdoors during training: Switching from FedAvg to RLR near convergence or when an attack is suspected can clean backdoors during training and improve time to convergence relative to using RLR from the start.RLR substantially improves backdoor prevention but reduces convergence speed when used throughout training.
Defense analysis: Feature-attribution results show similar feature maps for no attack and RLR, indicating that the defense prevents the model from focusing on the trojan pattern.The analysis compares a poisoned sample classified as its base class with RLR but as its target class under FedAvg.
Distributed backdoor attacks: The study also briefly tests distributed backdoor attacks that partition trojan pixels across adversarial agents to make malicious updates less distinguishable from honest updates.This evaluates RLR against a more stealthy attack construction.

5 Discussion

The experiments show that RLR substantially reduces trojan-pattern backdoor effectiveness while preserving model accuracy, and attribution analyses indicate why honest updates prevail.

RLR significantly reduces the effectiveness of trojan-pattern backdoor attacks while causing minimal degradation in overall validation accuracy.This result is reported across the evaluated settings.
The defense is compatible with clipping and noise addition, allowing it to deter semantic backdoors that require boosted, large-norm adversarial updates.The paper reports that trojan backdoors are strictly more powerful than semantic backdoors in FL because they do not require boosting.
FedAvg remains weak against the attack even with clipping and noise, whereas RLR prevents the backdoor with or without those protections.Clipping and noise may still be desirable for differential privacy or protection against arbitrarily large updates.
With RLR, net influence is positive, indicating that honest agents influence trojaned-sample mappings more than adversarial agents.Without RLR, net influence quickly becomes negative and backdoor loss decreases, producing a successful attack.
Feature maps show that RLR shifts model attention back toward actual objects rather than the trojan pattern.In the i.i.d. case, defended predictions are sandals with 100% confidence; in the non-i.i.d. case, predictions are digit 1 with 91.2% confidence.

6 Conclusion

The paper presents RLR as a simple server-side defense that adjusts learning rates using update signs. Experiments show substantially reduced backdoor accuracy with minimal validation-accuracy degradation.

RLR adjusts the aggregation server’s learning rate per dimension and round using the sign information of agents’ updates.
The defense substantially reduces backdoor accuracy while minimally degrading overall validation accuracy.
The experiments suggest that RLR outperforms some recently proposed defenses in the literature.
The paper relates RLR’s underlying insight to conflicting update directions caused by heterogeneous local distributions in non-i.i.d. training.Analyzing RLR’s influence in different non-i.i.d. settings is identified as future work.

A Hyperparameters of Experiments

The appendix specifies experiment notation, hyperparameters, and selected settings for i.i.d., non-i.i.d., and CIFAR10 evaluations.

The experiments simulate R rounds among K agents, with F denoting the corrupt-agent fraction and C the selected-agent fraction.Other notation includes P for trojaned samples, E for local epochs, B for batch size, η for server learning rate, and θ for the RLR threshold.
For i.i.d. experiments, θ is set to 4 when RLR is used, while η is 1e-3 for sign aggregation and 1 otherwise.
For non-i.i.d. experiments, θ is set to 7 when RLR is used.
The corrupt-agent fraction F and selected-agent fraction C are both fixed at 0.1, while P is set to 0.5 to simulate a strong adversary.The chosen P produced the quickest rise in backdoor accuracy during preliminary trials.

B Parameter Attribution Experiment

The parameter-attribution experiment measures how honest and adversarial agents influence trojaned-sample mappings, providing empirical support for RLR’s mechanism and testing a sign-negation bypass.

Influences are quantified after each round by selecting the 100 most important parameters using diagonal empirical Fisher Information Matrices.The matrices are computed on trojaned samples under adversarial and honest label mappings.
The experiment includes CIFAR10 hyperparameters and evaluates whether an adversary can bypass RLR by negating its loss function.The paper reports experimental confirmation that this sign-negation strategy does not bypass the defense.
RLR can update influential parameters in directions that minimize or maximize the relevant mapping loss.The analysis partitions selected parameters into sets based on whether updates minimize loss for adversarial or honest mappings.

C.4 Experiments for all M, σ combinations and Trojan Patterns

The experiments examine RLR across parameter settings, corruption rates, aggregation methods, and Trojan patterns in i.i.d. and non-i.i.d. federated learning. RLR with FedAvg generally provides the strongest backdoor defense while preserving model accuracy, though performance depends on activation timing and configuration.

Parameter selection: The parameter sweeps selected M values according to honest-agent update norms and stopped increasing σ at 5e−3 because training became imbalanced.The i.i.d. sweep used M = 6, 4, 2, while the non-i.i.d. sweep used M = 1, 0.5, 0.25.
Trojan-pattern experiments: RLR activation near convergence reduced backdoor accuracy from 100% to 0% while final validation and base-class accuracies were 92.8% and 98.5%.In the i.i.d. setting, RLR was activated at round 41 when validation accuracy exceeded 93%, and backdoor accuracy reached 0% at round 124.
Aggregation comparisons: FedAvg combined with RLR outperformed the other tested techniques across the reported Trojan experiments.Comed and sign also performed well for square, copyright, and Apple logo Trojans in the non-i.i.d. setting.
Adaptive attack: Negating the adversary’s loss did not provide a useful backdoor attack against FedAvg with RLR, but produced large adversarial update norms requiring server-side clipping.Clipping used M = 4 in the i.i.d. setting and M = 0.5 in the non-i.i.d. setting.

D Proof of Convergence Rate

The convergence analysis rewrites RLR’s coordinate-wise learning-rate adjustment as matrix multiplication and specializes the update to one local SGD step. The resulting notation expresses how sign-based indicators modify the aggregated model update.

Notation: The notation for η_θ,i can equivalently use an indicator function, which the authors choose to simplify the proof.The definition concerns the coordinate-specific learning-rate adjustment.
Matrix formulation: The indicator matrix represents coordinate-wise multiplication of the server learning rate with the aggregated update.Its diagonal entries encode whether each coordinate satisfies the sign-consensus threshold, while off-diagonal entries are zero.
Local-update specialization: For one local SGD iteration, each party sends update Δ_t^k = −∇f_k(w_t), which is then incorporated into the matrix-form model update.This connects the local gradient update to the RLR aggregation rule.

D.2 Assumptions

The convergence proof assumes smooth agent losses, bounded gradient variance, independent stochastic gradients, and population-weighted symmetry. It also constrains sign-reversal events and update norms to obtain a convergence-rate bound for RLR.

Distributional assumptions: The stochastic-gradient components are assumed unimodal and population-weighted symmetric, allowing asymmetric distributions through parameter β.β = 1 gives standard symmetry, while β ≠ 1 covers a broader asymmetric class.
Regularity assumptions: Each agent’s gradient is assumed Lipschitz continuous, and each agent’s update variance is bounded.These are listed as Assumptions 1 and 2 in the convergence analysis.
Proof simplification: The proof analyzes a simplified case where, at each round, either none or all coordinates undergo the sign-changing event.The element-wise case is stated to require more tedious but analogous derivations.
Convergence bound: The derived bound is E||∇f(ŵ_t)||^2 ≤ 2ηT(f(ŵ_0) − f*) + L^2M^2 + Lησ^2.The proof obtains this expression after telescoping the one-step inequality over T rounds and dividing by T.
Sign-reversal assumption: RLR reverses the standard gradient direction less than 0.25 of the time under the stated assumption.The paper motivates this assumption by minority attacker control and sufficiently frequent agreement among honest agents.