Abstract:Despite federated learning endows distributed clients with a cooperative training mode under the premise of protecting data privacy and security, the clients are still vulnerable when encountering adversarial samples due to the lack of robustness. The adversarial samples can confuse and cheat the client models to achieve malicious purposes via injecting elaborate noise into normal input. In this paper, we introduce a novel Ensemble Federated Adversarial Training Method, termed as EFAT, that enables an efficacious and robust coupled training mechanism. Our core idea is to enhance the diversity of adversarial examples through expanding training data with different disturbances generated from other participated clients, which helps adversarial training perform well in Non-IID settings. Experimental results on different Non-IID situations, including feature distribution skew and label distribution skew, show that our proposed method achieves promising results compared with solely combining federated learning with adversarial approaches.

What problem does this paper attempt to address?

The problem that this paper attempts to solve is how to enhance the robustness of the model against adversarial sample attacks in the federated learning environment, especially in the case of non - independent and identically distributed (Non - IID) data. Specifically: 1. **The problem of adversarial sample attacks in federated learning**: - Although federated learning has advantages in protecting data privacy and security, client - side models are still vulnerable to attacks when encountering adversarial samples. - Adversarial samples can confuse and deceive client - side models by injecting carefully designed noise into normal inputs, thereby achieving malicious purposes. 2. **Limitations of existing methods**: - Existing adversarial training methods are mainly designed for independent and identically distributed (IID) data, while in federated learning, the data distribution of each client is usually non - independent and identically distributed (Non - IID). - Simply applying adversarial training to the federated learning environment will bring a series of problems because the data distribution differences between different clients are large, resulting in poor effectiveness of adversarial training. 3. **Research objectives**: - Propose a new Ensemble Federated Adversarial Training method (EFAT) to improve the robustness of the federated learning system against black - box attacks under non - independent and identically distributed data. - By increasing the diversity of adversarial samples, EFAT can perform adversarial training more effectively in the federated learning environment, thereby enhancing the robustness of the model. ### Main contributions of the paper 1. **Propose the EFAT method**: - Use adversarial samples generated by other clients to enhance local adversarial training, thereby improving the robustness of each client - side model. - EFAT increases the diversity of the adversarial data distribution by integrating adversarial samples from multiple clients, enabling the model to better cope with black - box attacks. 2. **Experimental verification**: - Experiments were carried out in two non - independent and identically distributed situations (skewed feature distribution and skewed label distribution). The results show that EFAT has a higher adversarial accuracy rate compared to baseline methods and other simplified versions of methods (such as EFNT and EFNT + AT). - The experimental results show that EFAT has achieved significant improvements on both the Digit - Five and CIFAR10 datasets, especially more prominent performance under black - box attacks. ### Formula summary - **PGD attack update rule**: \[ x_{\text{adv}}^{t + 1}=\Pi_{\text{clip}}(x_{\text{adv}}^t+\alpha\cdot\text{sign}(\nabla_x J(x_{\text{adv}}^t,y))) \] where $\alpha$ controls the maximum $L_\infty$ perturbation of the adversarial sample, and the $\text{clip}$ function ensures that $x$ is within a certain range. - **Adversarial training loss function**: \[ \text{Loss}=\sum_{x_i\in P_i}L(x_i|y_i)+\sum_{x_{\text{adv}}_i\in P_{\text{adv}}_i}L(x_{\text{adv}}_i|y_i) \] where $L((x|y)$ is the loss function of a single sample. - **EFAT loss function**: \[ \text{Loss}=\sum_{x_i\in P_i}L(x_i|y_i)+\sum_{x_{\text{adv}}_i\in L_{\text{adv}}_i}L(x_{\text{adv}}_i|y_i)+\sum_{x_{\text{adv}}_i\in E_{\text{adv}}_i}L(x_{\text{adv}}_i|y_i) \] Through these methods, EFAT not only improves the robustness of the federated learning system but also provides new ideas for future research.

Ensemble Federated Adversarial Training with Non-IID data

Delving into the Adversarial Robustness of Federated Learning

FedAA: Using Non-sensitive Modalities to Improve Federated Learning while Preserving Image Privacy

FedEL: Federated ensemble learning for non-iid data

Privacy-Preserving Federated Learning Against Label-Flipping Attacks on Non-IID Data

Towards Robust Federated Learning via Logits Calibration on Non-IID Data

Fedward: Flexible Federated Backdoor Defense Framework with Non-IID Data

FAT: Federated Adversarial Training

FedAT: Federated Adversarial Training for Distributed Insider Threat Detection

Combating Exacerbated Heterogeneity for Robust Models in Federated Learning

Personalized Federated Learning with Adaptive Feature Extraction and Category Prediction in Non-IID Datasets

Defending Against Data Poisoning Attack in Federated Learning With Non-IID Data

Improve Individual Fairness in Federated Learning via Adversarial training

Combating Exacerbated Heterogeneity for Robust Decentralized Models

Dataset Distillation-based Hybrid Federated Learning on Non-IID Data

Federated Learning for Non-IID Data Via Unified Feature Learning and Optimization Objective Alignment

LAFED: Towards robust ensemble models via latent feature diversification

Adversarial training in communication constrained federated learning

Logit Calibration and Feature Contrast for Robust Federated Learning on Non-IID Data

Using adversarial images to improve outcomes of federated learning for non-IID data

SF-CABD: Secure Byzantine fault tolerance federated learning on Non-IID data