PaperlayerView exact revision on arXiv

Source-linked AI summary

FLTrust: Byzantine-robust Federated Learning via Trust Bootstrapping

Xiaoyu Cao, Minghong Fang, Jia Liu, Neil Zhenqiang Gong

arXiv:2012.13995v3cs.CRcs.AIcs.DC

TL;DR

Existing Byzantine-robust federated learning methods can be corrupted because they lack a root of trust for judging client updates. FLTrust has the server collect a small clean root dataset, use a server model to score and normalize client updates, and aggregate them by trust; evaluations on six datasets found robustness against existing and adaptive attacks, including with large malicious-client fractions.

  • Problem

    Existing Byzantine-robust federated learning methods remain vulnerable to crafted client updates because the server lacks a root of trust.

  • Method

    FLTrust uses a clean root dataset and server model to score client-update directions, normalize magnitudes, and compute a trust-weighted aggregate.

  • Results

    FLTrust remained robust across six datasets, with testing error rates under untargeted attacks at most 0.04 higher than FedAvg without attacks.

  • Takeaways & Limitations

    A small server-collected root dataset can support Byzantine robustness against existing and adaptive attacks, including attacks involving a large fraction of malicious clients.

  • Takeaways & Limitations

    FLTrust may not be robust against a poisoned root dataset, and stronger local model-poisoning attacks remain possible future work.

Abstract

from arXiv · show

Byzantine-robust federated learning aims to enable a service provider to learn an accurate global model when a bounded number of clients are malicious. The key idea of existing Byzantine-robust federated learning methods is that the service provider performs statistical analysis among the clients' local model updates and removes suspicious ones, before aggregating them to update the global model. However, malicious clients can still corrupt the global models in these methods via sending carefully crafted local model updates to the service provider. The fundamental reason is that there is no root of trust in existing federated learning methods. In this work, we bridge the gap via proposing FLTrust, a new federated learning method in which the service provider itself bootstraps trust. In particular, the service provider itself collects a clean small training dataset (called root dataset) for the learning task and the service provider maintains a model (called server model) based on it to bootstrap trust. In each iteration, the service provider first assigns a trust score to each local model update from the clients, where a local model update has a lower trust score if its direction deviates more from the direction of the server model update. Then, the service provider normalizes the magnitudes of the local model updates such that they lie in the same hyper-sphere as the server model update in the vector space. Our normalization limits the impact of malicious local model updates with large magnitudes. Finally, the service provider computes the average of the normalized local model updates weighted by their trust scores as a global model update, which is used to update the global model. Our extensive evaluations on six datasets from different domains show that our FLTrust is secure against both existing attacks and strong adaptive attacks.

I. INTRODUCTION

Federated learning coordinates decentralized client training through server aggregation, but malicious clients can manipulate global models and existing Byzantine-robust methods lack a root of trust. FLTrust addresses this by using a clean server-held root dataset to bootstrap trust and evaluate client updates.

  • Federated learning lets decentralized clients jointly learn a global model without sharing raw local training data with the service provider.
  • Malicious clients can poison local data or model updates, causing untargeted or targeted corruption of the global model.
  • Existing Byzantine-robust methods compare client updates and remove statistical outliers, yet remain vulnerable because the server has no root of trust.
  • FLTrust bootstraps trust with a small clean root dataset and a server model maintained on that dataset alongside client updates.
  • FLTrust evaluates client updates using a new aggregation rule that considers both their directions and magnitudes.
  • On six datasets, FLTrust remained robust against existing and adaptive attacks, including attacks with 60% malicious clients and a root dataset below 100 examples.

2) Byzantine-robust Aggregation Rules:

Byzantine-robust FL methods use aggregation rules to tolerate malicious clients, but sophisticated local model poisoning attacks remain a central limitation. FLTrust is evaluated against these threats while targeting fidelity, robustness, and efficiency with a small clean root dataset.

  • Existing aggregation rules: Krum selects one client update using squared-distance scores, whereas Trimmed mean and Median aggregate each parameter coordinate-wise.Trimmed mean removes the largest and smallest k values before averaging; Median selects each coordinate’s median.
  • Limitations: Existing Byzantine-robust FL methods remain vulnerable to sophisticated local model poisoning attacks.The paper identifies the absence of a root of trust as the fundamental reason.
  • Threat model: Local model poisoning attacks manipulate client models or updates to corrupt global predictions through untargeted or targeted objectives.The paper focuses on local model poisoning because data poisoning can be transformed into it and recent studies find it more effective against FL.
  • Threat model: The attacker may control fake or compromised clients and send arbitrary local model updates without compromising the server.The server lacks client raw data and does not know the number of malicious clients.
  • Defense goals: The defense goals are to preserve FedAvg-level fidelity under no attack, robustness under strong poisoning, and client-side efficiency.The server may collect a clean root dataset, such as approximately 100 manually labeled training examples.

IV. OUR FLTRUST

FLTrust bootstraps server-side trust from a clean root dataset and server model, then combines direction-based trust, magnitude normalization, and weighted aggregation. This design incorporates both server and client updates while limiting directional and magnitude-based manipulation.

  • Overview: FLTrust uses a clean root dataset and server model to provide a server-side root of trust for aggregation.The server fine-tunes the current global model on the root dataset to obtain its update.
  • Trust scoring: The server assigns each client update a trust score based on its directional similarity to the server model update.The server model update supplies the reference direction for evaluating client updates.
  • Trust scoring: ReLU clipping excludes client updates whose cosine similarity with the server update is nonpositive.This prevents opposite-direction updates from contributing negatively to the aggregate.
  • Magnitude normalization: FLTrust rescales every local update to the hyper-sphere defined by the server update’s magnitude.The normalization prevents a single large-magnitude update from dominating the aggregate and enlarges small-magnitude updates to the server magnitude.
  • Aggregation: The global update is the trust-weighted average of normalized client updates.Each iteration sends the global model to selected clients, computes client and server updates, aggregates them, and applies the global learning rate α.

C. Complete FLTrust Algorithm

FLTrust repeatedly trains client and server updates, aggregates them into the global model, and analyzes convergence under explicit regularity and data-sampling assumptions. The theorem bounds the distance between the attacked FLTrust model and the optimal model with high probability.

  • Algorithm: Each FLTrust iteration sends the global model to clients, trains client and server updates, then aggregates them into the next global model.The server computes its update using the root dataset while clients use their local datasets.
  • Objective: FLTrust seeks a global model minimizing the empirical loss over the joint client training data.The optimal global model is defined through the expected loss optimization problem.
  • Assumptions: The formal analysis assumes strong convexity and smoothness, probabilistic Lipschitz behavior, bounded gradients, and independently sampled client and root datasets.These conditions are stated as Assumptions 1–3.
  • Guarantee: With Rl = 1 and β = 1, Theorem 1 bounds FLTrust’s distance from the optimal global model under an arbitrary number of malicious clients.The bound holds with probability at least 1 − δ under Assumptions 1–3.
  • Guarantee: When |1 − ρ| < 1, the asymptotic model distance is bounded by 12α∆1/ρ.The result is stated as limt→∞∥wt − w∗∥ ≤ 12α∆1/ρ.

V. ADAPTIVE ATTACKS

The paper constructs adaptive attacks specifically optimized for FLTrust by instantiating a general local model poisoning framework. The attack uses iterative zeroth-order projected gradient ascent over malicious clients’ update directions.

  • Attack formulation: The adaptive attack optimizes malicious client updates to move the global update opposite to its unattacked direction.The framework supports arbitrary aggregation rules and is instantiated with FLTrust’s rule.
  • Attack formulation: The attack represents each update by a unit direction vector and optimizes poisoned directions while retaining the FLTrust aggregation structure.The cosine similarity of a poisoned update with the server update equals the inner product of their corresponding unit vectors.
  • Optimization: Malicious directions are initialized with a Trim attack, iteratively updated, projected onto the unit sphere, and repeated across Q and V iterations.The resulting poisoned updates are sent to the server after optimization.
  • Attacker knowledge: The attacker is modeled as having full knowledge of the FL system, including server-update magnitude, signs, cosine similarities, and update directions.This defines a strong adaptive attacker for the optimization problem.
  • Optimization: The attack solves the direction optimization using zeroth-order gradient estimates because direct gradients involve computationally impractical Jacobians.Gaussian perturbations with smoothing parameter γ estimate the gradient, followed by projected gradient ascent.

VI. EVALUATION

The evaluation tests FLTrust against both existing poisoning attacks and adaptive attacks.

  • The evaluation includes existing poisoning attacks against federated learning.
  • The evaluation also includes adaptive attacks tailored to the federated learning setting.
  • Together, these experiments assess FLTrust under existing and adaptive attack strategies.

A. Experimental Setup

The experiments span heterogeneous datasets, client-data distributions, poisoning attacks, and configured federated-learning system settings. They include both IID and non-IID scenarios, multiple attack types, and CNN models for several image datasets.

  • Datasets: The evaluation uses five image-classification datasets and one smartphone-based human-activity-recognition dataset.
  • Data Distribution: The client-data parameter q controls heterogeneity: q = 1/M yields IID data, while larger q indicates more non-IID data.
  • Data Distribution: MNIST-0.1 uses q = 0.1 for IID client data, whereas MNIST-0.5, Fashion-MNIST, and CIFAR-10 use q = 0.5 for non-IID data.
  • Poisoning Attacks: The experiments evaluate label flipping, Krum, Trim, Scaling, and adaptive attacks.
  • Poisoning Attacks: The Scaling attack embeds trigger patterns, changes labels to an attacker-chosen target, and uses scaling factor λ = n.
  • Poisoning Attacks: The adaptive attack uses zeroth-order optimization with σ2 = 0.5, γ = 0.005, η = 0.01, and V = Q = 10.

3) Evaluation Metrics:

FLTrust is evaluated across multiple datasets, model settings, attacks, root-dataset configurations, and malicious-client fractions. The results indicate fidelity, robustness, and efficiency, including resilience to adaptive attacks and small root datasets.

  • Evaluation Metrics: Testing error rate measures untargeted-attack robustness, while Scaling attacks are additionally assessed by attack success rate.Lower testing error rates indicate greater robustness against the evaluated untargeted attacks.
  • Evaluation Setup: FLTrust is evaluated against multiple attacks on six datasets spanning image classification and smartphone-based human activity recognition.The comparison includes FedAvg, Krum, Trim-mean, and Median.
  • Results: FLTrust retains fidelity without attacks, with testing error rates similar to FedAvg and lower than several existing Byzantine-robust methods.On MNIST-0.1, FedAvg and FLTrust both achieve 0.04, compared with 0.10 for Krum and 0.06 for both Trim-mean and Median.
  • Results: Under untargeted attacks, FLTrust testing error rates are at most 0.04 higher than FedAvg without attacks across the six datasets.On MNIST-0.5, Krum attack raises Krum’s testing error rate from 0.10 to 0.91, while Trim attack raises Trim-mean and Median to 0.23 and 0.43.
  • Sensitivity and Efficiency: A root dataset of 100 training examples is sufficient in the reported MNIST-0.5 study, and FLTrust converges as fast as FedAvg without attacks.Increasing the root dataset beyond 100 examples further decreases testing error and attack success rates slightly.
  • Results: FLTrust tolerates up to 90% malicious clients under existing and adaptive attacks, while Scaling-attack success rates remain close to 0 up to 95%.Existing Byzantine-robust methods tolerate substantially fewer malicious clients in the reported comparisons.

VII. DISCUSSION AND LIMITATIONS

FLTrust exploits the server’s unique position in federated learning to bootstrap trust from a root dataset, while differing from related uses of validation data. Its main boundary is the need for clean root data and the possibility of stronger attacks.

  • FLTrust vs. fault-tolerant computing: Unlike conventional fault-tolerant computing, FLTrust bootstraps trust through the cloud server because federated-learning clients communicate only with that server.Fault-tolerant computing instead has clients communicate with each other to compute results.
  • Different uses of the root dataset: FLTrust uses its root dataset to assign client trust scores and normalize updates, rather than merely removing potentially malicious updates.The cited comparison reports that the alternative approach is ineffective in many cases.
  • Limitations: FLTrust requires a clean root dataset, so a poisoned dataset may undermine its robustness.The authors note that a service provider can collect a small clean dataset itself, such as by manually labeling examples.
  • Future work: The authors identify stronger local model poisoning attacks and hierarchical roots of trust as future work.A hierarchical root could contain subsets with different trust levels, with higher-trust subsets receiving greater aggregation impact.
  • Conclusion: With a small root dataset, FLTrust remains Byzantine-robust against a large fraction of malicious clients, including adaptive attacks matching attack-free FedAvg models.The conclusion reports evaluations on six datasets and identifies stronger attacks and hierarchical trust as future directions.

A. Proof of Theorem 1

The proof restates FLTrust’s gradient-based update analysis, bounds the aggregated gradient’s deviation from the true gradient, and combines these bounds under stated smoothness and concentration assumptions. Recursive application then yields the theorem’s convergence conclusion.

  • Proof setup: When R_l = 1, only the combined learning rate α·β matters, so the proof sets β = 1 and represents updates as negative gradients.The proof denotes client and server gradients by g_i and g_0, respectively.
  • Gradient bounds: Lemma 1 bounds the distance between the aggregated gradient g and the true gradient ∇F(w) for an arbitrary number of malicious clients.This is the proof’s central robustness bound for the aggregation step.
  • Aggregation properties: FLTrust’s normalization gives accepted client gradients the same magnitude as the server gradient, while positive cosine similarity determines the contributing set S.The proof uses these properties when analyzing the aggregated gradient.
  • Theorem proof: Under Assumption 1 and α = µ/(2L2), the proof derives per-iteration inequalities and combines them with Lemma 2, Lemma 4, and the assumption.The cited steps explicitly identify the learning-rate choice and the substitutions used in the theorem proof.
  • High-probability conclusion: A union-bound argument establishes probability at least 1 − δ for the required events, after which recursive application across iterations completes the proof.The final argument concludes using the established event bounds and recursive inequality.
Loading 2012.13995v3…