PaperlayerView exact revision on arXiv

Source-linked AI summary

CRFL: Certifiably Robust Federated Learning against Backdoor Attacks

Chulin Xie, Minghao Chen, Pin-Yu Chen, Bo Li

arXiv:2106.08283v1cs.LG

TL;DR

Federated-learning backdoors threaten deployment, while existing defenses lack robustness certification. CRFL combines server-side parameter clipping and perturbation with test-time parameter smoothing, proving certification within bounded backdoor magnitude and examining federated-learning parameters empirically.

  • Problem

    Existing federated-learning defenses against backdoors lack robustness guarantees under specified conditions.

  • Method

    CRFL clips and perturbs aggregated model parameters during training, then applies parameter smoothing during testing to certify prediction consistency.

  • Results

    CRFL theoretically certifies robustness against backdoors within a certified bound and empirically evaluates how poisoning ratio, attacker count, and training iterations affect certification.

  • Takeaways & Limitations

    CRFL provides a framework for certifiable federated-learning robustness whose guarantees are related to federated-learning parameters and verified across three datasets.

  • Takeaways & Limitations

    The analyzed threat model assumes adversarial clients coordinate a single model-replacement attack at one round, with later rounds using benign datasets.

Abstract

from arXiv · show

Federated Learning (FL) as a distributed learning paradigm that aggregates information from diverse clients to train a shared global model, has demonstrated great success. However, malicious clients can perform poisoning attacks and model replacement to introduce backdoors into the trained global model. Although there have been intensive studies designing robust aggregation methods and empirical robust federated training protocols against backdoors, existing approaches lack robustness certification. This paper provides the first general framework, Certifiably Robust Federated Learning (CRFL), to train certifiably robust FL models against backdoors. Our method exploits clipping and smoothing on model parameters to control the global model smoothness, which yields a sample-wise robustness certification on backdoors with limited magnitude. Our certification also specifies the relation to federated learning parameters, such as poisoning ratio on instance level, number of attackers, and training iterations. Practically, we conduct comprehensive experiments across a range of federated datasets, and provide the first benchmark for certified robustness against backdoor attacks in federated learning. Our code is available at https://github.com/AI-secure/CRFL.

1. Introduction

CRFL addresses the lack of certified backdoor robustness guarantees in federated learning by combining server-side clipping, noise, and parameter smoothing. It provides theoretical certification and empirical analysis across datasets and federated-learning parameters.

  • Backdoor attacks create security concerns that impede real-world federated-learning deployment.
  • Existing robust aggregation and empirical training defenses lack certified robustness guarantees against backdoor attacks.
  • CRFL uses server-side aggregation, model-parameter norm clipping, random noise addition, and redistribution of the resulting model.
  • The framework combines Markov-Kernel analysis of aggregated-model closeness with parameter smoothing to certify final prediction robustness.
  • CRFL contributes the first certifiably robust federated-learning framework against backdoor attacks, with both theoretical and empirical components.
  • Experiments on MNIST, EMNIST, and financial datasets examine how poisoning ratio, attacker count, and training iterations affect certified robustness.

2. Related work

Prior federated-learning defenses target malicious updates through robust aggregation, validation, clipping, or noise, but do not provide certified robustness guarantees. CRFL differs from concurrent provable work through its protocol and certification scope.

  • Backdoor attacks submit malicious local updates to mislead the federated global model, including through model replacement and decentralized coordination.
  • Robust aggregation methods identify, down-weight, or center client updates, but the surveyed approaches do not provide certified robustness guarantees.
  • Validation, update clipping, and Gaussian noise can mitigate attacks empirically, yet these defenses remain uncertified.
  • Compared with Ensemble FL, CRFL uses a standard FL protocol and certifies robustness at feature, sample, and client levels rather than requiring hundreds of models.

3. Preliminaries

The preliminaries formalize federated averaging, local stochastic optimization, and the coordinated model-replacement threat model. Attackers poison local data, train malicious models, scale updates, and infect the global model.

  • Federated Averaging: Federated learning minimizes a weighted sum of client objectives, with nonnegative aggregation weights summing to one.
  • Federated Averaging: Each round sends the global model to clients, performs multiple local stochastic-gradient iterations, and aggregates the resulting local updates.
  • Threat Model: The backdoor objective is to preserve normal behavior on clean inputs while inducing target-label misclassification on patterned inputs.
  • Threat Model: The threat model assumes R adversarial clients jointly perform one model-replacement attack at round t_adv using poisoned local datasets and scaled malicious updates.
  • Threat Model: Poisoned samples modify input and label components, and the adversarial dataset differs from the benign union through injected backdoor perturbations.
  • Threat Model: More local iterations increase the divergence between malicious and benign local models before attackers scale and submit their updates.
  • Threat Model: Although attackers later resume benign training, the global model remains infected after the attack round.

4. Methodology

CRFL trains with clipped and perturbed global parameters, then tests with Gaussian parameter smoothing and Monte Carlo certification. The resulting procedure estimates prediction probabilities and returns a certified radius or abstains.

  • CRFL Training: CRFL consists of training-time and test-time subroutines designed to achieve certified robustness.
  • CRFL Training: During training, the server clips aggregated parameters to norm threshold ρ_t and adds isotropic Gaussian noise with variance σ_t^2.
  • CRFL Training: The noisy global model initializes clients in subsequent rounds, while the final round clips the global parameters without the preceding perturbation step.
  • Parameter Smoothing: At testing, CRFL constructs a smoothed classifier by majority voting over predictions from base classifiers evaluated with randomly sampled model parameters.
  • Parameter Smoothing: Gaussian parameter smoothing matches the training perturbation, and Monte Carlo samples estimate class probabilities for neural-network predictions.
  • Certification: Certification bounds the top and runner-up class probabilities using Hoeffding’s inequality, then computes a radius when the lower bound exceeds the upper bound.
  • Parameter Smoothing: Parameter smoothing is presented as distinct from prior centralized approaches because fixed noisy models are generated from the federated training process.
  • Certification: If the probability condition fails, the certification procedure abstains and returns radius 0.

5. Certified Robustness of CRFL

CRFL certifies prediction consistency between clean and backdoored smoothed FL models when the backdoor magnitude satisfies a derived bound. The analysis combines assumptions on client losses, Markov-kernel model closeness, and parameter smoothing, while relating the certified radius to FL and attack parameters.

  • CRFL seeks a certificate ensuring a test-point prediction remains unchanged when features in local training data are modified.
  • Theorem 1 establishes robustness under convexity, smoothness, Lipschitz-gradient, and protocol assumptions when the stated probability conditions hold.
  • Corollary 1 certifies hs(M(D′); xtest) = hs(M(D); xtest) = cA for all backdoor magnitudes below the certified radius RAD.
  • RAD increases with higher noise, smaller clipping thresholds, larger class-probability margins, fewer attackers, and smaller attacker influence or local-update parameters.
  • The framework bounds the closeness between clean and backdoored trained models using Markov kernels, then uses parameter smoothing to certify prediction consistency.
  • The framework discusses potential extensions to fixed-frequency and edge-case attacks, while efficient Lipschitz-gradient computation for general high-dimensional neural networks remains open.

6. Experiments

Experiments evaluate certified robustness across datasets and federated-learning parameters, showing how noise, attack strength, aggregation, client count, and training rounds affect certification.

  • Experimental Setup: The experiments use multi-class logistic regression on LOAN, MNIST, and EMNIST, evaluating certified rate and certified accuracy on clean test sets.Certified rate measures the fraction certified at radius r; certified accuracy additionally requires correct prediction consistency with the clean model.
  • Training-Time Noise: Higher training-time noise σ increases certifiable radius and certified rate but creates a trade-off with accuracy, while test-time smoothing has limited accuracy impact.The training-time noise can nullify malicious updates at early stages; large radii may be certified at lower accuracy.
  • Attacker Ability: Stronger attacks—more attackers, higher poison ratio, or larger scale factor γ—produce smaller certifiable radii across the evaluated datasets.After sufficient clean training rounds, the certified radius is reported as insensitive to attack timing.
  • Robust Aggregation: RFA certifies much larger radii than FedAvg as attackers increase, because malicious updates receive very low aggregation weights.The results suggest certified radius can evaluate the robustness of alternative aggregation rules.
  • Client Number and Training Rounds: Increasing the total client count N enables certification of larger backdoor magnitudes, partly because attacker aggregation weights decrease and benign updates increase.The paper also reports that certified accuracy rises with larger T, although the maximum certified radius does not increase in practice because of Gaussian-CDF numerical issues.
  • Additional Analyses: The certified radius increases with the number of noisy models M and is not very sensitive to the error tolerance α.Model-closeness experiments compare clean and backdoored global models across rounds to support the theoretical model-closeness statement.

7. Conclusion

The paper presents CRFL as the first framework for certifiably robust federated learning against backdoor attacks, combining parameter clipping, perturbation, and smoothing. Its theory relates certified robustness to federated-learning parameters, and experiments verify those relationships across three datasets.

  • Conclusion: CRFL combines model-parameter clipping and perturbation during training with parameter smoothing during testing to certify prediction consistency with an oracle clean model.The framework contains training-time and test-time subroutines implemented on the server side.
  • Conclusion: The theoretical analysis characterizes how certified robustness depends on federated-learning parameters, with empirical verification on MNIST, EMNIST, and financial data.The reported parameters include poisoning ratio, attacker count, and training iterations.
  • Conclusion: The appendix contains experimental details and results on backdoored test sets, proofs concerning model closeness and parameter smoothing, and related implementation analyses.Appendix A covers setups, Monte Carlo estimation, attack runtime, and backdoored-test-set results; Appendices B and C provide proofs.

A.1. More Details on Experiment Setup for Training

The experiments use multi-class logistic regression on LOAN, MNIST, and EMNIST, with pixel or feature backdoor patterns and certification after convergence.

  • Datasets and model: Experiments use multi-class logistic regression with a linear softmax layer and cross-entropy loss on LOAN, MNIST, and EMNIST.LOAN is a tabular dataset; MNIST and EMNIST use image-based backdoor patterns.
  • Attack setting: Attackers add image patterns or increase two LOAN features, then swap the affected samples' labels to target labels.The image target label is digit 0; the LOAN target is “Does not meet the credit policy.”
  • Training procedure: The global model is trained until convergence before Algorithm 2 evaluates robustness certification.

A.2. More Experimental Results on Clean Test Set

On the clean test set, certification depends on Monte Carlo settings but is relatively insensitive to error tolerance and attack timing after sufficient clean training.

  • Monte Carlo estimation: Larger M produces a larger certified radius, while smaller α reduces the radius but leaves certified accuracy broadly insensitive to α.M is the number of noisy models used for certification, and α is the error tolerance.
  • Figures: Figure 11 reports certified accuracy across M, α, and tadv on MNIST.
  • Figures: Figure 12 varies attack ability and includes robust aggregation RFA, while Figure 13 varies σ, N, and T on the MNIST backdoored test set.
  • Attack timing: Certified radius is not sensitive to attack timing tadv after sufficient rounds of clean-data training.The experiment uses a strong attack with γ=100 and R=2 and a common loose LZ based on ρ44.

A.3. Experimental Results on Backdoored Test Set

The paper evaluates certification on backdoored test inputs and develops a Markov-Kernel analysis of how clipping, aggregation, and Gaussian noise control model divergence.

  • Backdoored test set: Backdoored test samples contain the pattern while retaining their correct labels, and certified-accuracy results are similar to clean-test results.Figures 12 and 13 report these backdoored-test-set results.
  • Model closeness: After the attack round, clean training uses the same kernel, enabling contraction coefficients to bound divergence between benign and backdoored model distributions.The analysis measures model closeness with f-divergence between Gaussian-smoothed model distributions.
  • Markov-Kernel formulation: CRFL models each training iteration as a Markov Kernel mapping the previous global model through aggregation, clipping, and Gaussian noise.The resulting kernel receives ewt−1 and generates ewt.

B.3. Analysis for t = tadv

At the attack round, the analysis bounds the divergence between benign and backdoored global models by tracking local deviations, poisoned samples, scaling, and aggregation.

  • Goal: The analysis seeks to bound divergence between benign and backdoored global-model distributions at round tadv.
  • Accumulated local effect: Local deviation accumulates across local iterations, so larger τi yields a larger deviation Δi.
  • Scaling and aggregation: Poisoned samples, local scaling, and aggregation determine the deviation between benign and backdoored global parameters at tadv.Benign local updates cancel because they are identical in the two training processes.
  • Bound: Under the stated assumptions and ηi≤1, the resulting noisy global-model divergence is bounded.The bound follows by combining the local-deviation, poisoned-sample, and aggregation analyses.

B.4. Analysis for t > tadv

This section analyzes the contraction coefficient after the adversarial-training phase and develops intermediate lemmas toward bounding the final global-model divergence. The proof uses assumptions on convexity, smoothness, and bounded model norms.

  • B.4. Analysis for t > tadv: The analysis focuses on the contraction coefficient η_f(K_t) for rounds t > t_adv.
  • B.4. Analysis for t > tadv: Lemma 10 combines earlier lemmas under Assumption 3 to support the divergence analysis.
  • B.4. Analysis for t > tadv: The proof ultimately derives a bound on the KL divergence between smoothed models μ(M(D)) and μ(M(D′)).
  • B.4. Analysis for t > tadv: A separate lemma assumes convexity and smoothness to establish a bound used in the proof of Lemma 5.
  • B.4. Analysis for t > tadv: For multi-class logistic regression, the analysis bounds the gradient's Lipschitz dependence on data under an upper bound on model-parameter norms.

C.1. General Framework for Robustness Certification

CRFL certifies robustness by smoothing model parameters rather than test inputs and by checking class-vote specifications over distributions constrained by an f-divergence. For KL divergence, this framework yields a closed-form certificate relating smoothed predictions under perturbed model-parameter distributions.

  • General framework: Parameter smoothing constructs a smoothed classifier by applying randomized smoothing to model weights while keeping the test sample fixed.
  • General framework: The certification goal is to preserve the smoothed prediction when model parameters change within distance ϵ.
  • General framework: Robustness is checked pairwise between the predicted class and every competing class through specification functions over model-parameter space.
  • General framework: The framework represents perturbations as distributions within an f-divergence ball around a reference distribution and verifies nonnegative expected specifications.
  • General framework: Unlike prior input-smoothing certification, the framework smooths model parameters and makes the constraints on top-class and runner-up votes explicit.
  • Closed-form certificate for KL divergence: For KL divergence, CRFL specializes the general certification into a closed-form condition for the smoothed classifier.
Loading 2106.08283v1…