DeepSight: Mitigating Backdoor Attacks in Federated Learning Through Deep Model Inspection
AI-generated Key Points
- Federated Learning (FL) allows multiple clients to train a Neural Network (NN) model collaboratively on their private data without revealing the data.
- FL has become vulnerable to targeted poisoning attacks that inject backdoors into the resulting model, allowing adversary-controlled inputs to be misclassified.
- Existing countermeasures against backdoor attacks are inefficient and often exclude benign models of clients with deviating data distributions, causing the aggregated model to perform poorly for such clients.
- DeepSight is a novel defense approach that uses three techniques to characterize the distribution of data used to train model updates and measure fine-grained differences in the internal structure and outputs of NNs.
- DeepSight's filtering scheme combines a classifier and clustering-based similarity estimations to identify suspicious model updates.
- The approach prevents models of benign clients with deviating data distributions from being filtered out, thereby increasing the performance of the aggregated model for these clients.
- DeepSight also proposes a Threshold Exceedings metric that analyzes parameter updates in real-time during training.
- DeepSight effectively mitigates targeted poisoning attacks on FL by combining deep-model-inspection with weight clipping enforcement strategy.
Authors: Phillip Rieger, Thien Duc Nguyen, Markus Miettinen, Ahmad-Reza Sadeghi
Abstract: Federated Learning (FL) allows multiple clients to collaboratively train a Neural Network (NN) model on their private data without revealing the data. Recently, several targeted poisoning attacks against FL have been introduced. These attacks inject a backdoor into the resulting model that allows adversary-controlled inputs to be misclassified. Existing countermeasures against backdoor attacks are inefficient and often merely aim to exclude deviating models from the aggregation. However, this approach also removes benign models of clients with deviating data distributions, causing the aggregated model to perform poorly for such clients. To address this problem, we propose DeepSight, a novel model filtering approach for mitigating backdoor attacks. It is based on three novel techniques that allow to characterize the distribution of data used to train model updates and seek to measure fine-grained differences in the internal structure and outputs of NNs. Using these techniques, DeepSight can identify suspicious model updates. We also develop a scheme that can accurately cluster model updates. Combining the results of both components, DeepSight is able to identify and eliminate model clusters containing poisoned models with high attack impact. We also show that the backdoor contributions of possibly undetected poisoned models can be effectively mitigated with existing weight clipping-based defenses. We evaluate the performance and effectiveness of DeepSight and show that it can mitigate state-of-the-art backdoor attacks with a negligible impact on the model's performance on benign data.
Ask questions about this paper to our AI assistant
You can also chat with multiple papers at once here.
Welcome to our AI assistant! Here are some important things to keep in mind:
- The assistant will only answer questions related to this specific paper.
- Please note that this is not a bot for casual chatting.
- If you want the answer in a language other than the language you chose for navigating the website, simply add "TRANSLATE IN LANGUAGE L" at the end of your query (replace "LANGUAGE L" with the language of your choice).
- For example, you could ask "Can you extract the most important aspect of the paper? TRANSLATE IN SPANISH".
- If you want to keep the history of your questions/answers you should create an account.
Assess the quality of the AI-generated content by voting
Why do we need votes?
Votes are used to determine whether we need to re-run our summarizing tools. If the count reaches -10, our tools can be restarted.
Similar papers summarized with our AI tools
Navigate through even more similar papers through atree representation
Look for similar papers (in beta version)
By clicking on the button above, our algorithm will scan all papers in our database to find the closest based on the contents of the full papers and not just on metadata. Please note that it only works for papers that we have generated summaries for and you can rerun it from time to time to get a more accurate result while our database grows.
Disclaimer: The AI-based summarization tool and virtual assistant provided on this website may not always provide accurate and complete summaries or responses. We encourage you to carefully review and evaluate the generated content to ensure its quality and relevance to your needs.