A Novel Defense Against Poisoning Attacks on Federated Learning: LayerCAM Augmented with Autoencoder

Jingjing Zheng,Xin Yuan,Kai Li,Wei Ni,Eduardo Tovar,Jon Crowcroft

2024-06-02

Abstract:Recent attacks on federated learning (FL) can introduce malicious model updates that circumvent widely adopted Euclidean distance-based detection methods. This paper proposes a novel defense strategy, referred to as LayerCAM-AE, designed to counteract model poisoning in federated learning. The LayerCAM-AE puts forth a new Layer Class Activation Mapping (LayerCAM) integrated with an autoencoder (AE), significantly enhancing detection capabilities. Specifically, LayerCAM-AE generates a heat map for each local model update, which is then transformed into a more compact visual format. The autoencoder is designed to process the LayerCAM heat maps from the local model updates, improving their distinctiveness and thereby increasing the accuracy in spotting anomalous maps and malicious local models. To address the risk of misclassifications with LayerCAM-AE, a voting algorithm is developed, where a local model update is flagged as malicious if its heat maps are consistently suspicious over several rounds of communication. Extensive tests of LayerCAM-AE on the SVHN and CIFAR-100 datasets are performed under both Independent and Identically Distributed (IID) and non-IID settings in comparison with existing ResNet-50 and REGNETY-800MF defense models. Experimental results show that LayerCAM-AE increases detection rates (Recall: 1.0, Precision: 1.0, FPR: 0.0, Accuracy: 1.0, F1 score: 1.0, AUC: 1.0) and test accuracy in FL, surpassing the performance of both the ResNet-50 and REGNETY-800MF. Our code is available at: <a class="link-external link-https" href="https://github.com/jjzgeeks/LayerCAM-AE" rel="external noopener nofollow">this https URL</a>

Cryptography and Security,Artificial Intelligence,Computer Vision and Pattern Recognition,Machine Learning

What problem does this paper attempt to address?

This paper attempts to address the issue in Federated Learning (FL) where malicious users launch model poisoning attacks by manipulating local model parameters, leading to a decline or complete failure in the performance of the global federated learning model. Existing distance-based defense mechanisms (such as Euclidean distance or cosine similarity) can filter out some suspicious or unreliable local model updates, but they have two main problems: 1. **Efficiency Issue**: Excessive removal of local model updates or expensive analysis of high-dimensional local model updates can lead to a significant decline in model quality. 2. **Bypassing Defense**: Attackers can construct a malicious local model update that is very similar to a benign local model by eavesdropping on the benign local model, thereby bypassing existing defense measures. To address these issues, this paper proposes a new defense strategy called LayerCAM-AE, which aims to identify and filter malicious local model updates in federated learning from the server side. Specifically, LayerCAM-AE utilizes an extended Layer Class Activation Mapping (LayerCAM) to generate heatmaps for each local model update and combines an Autoencoder to further process these heatmaps to enhance the detection capability of abnormal heatmaps and malicious local model updates. Additionally, a voting algorithm is designed to reduce the possibility of misclassification.

A Novel Defense Against Poisoning Attacks on Federated Learning: LayerCAM Augmented with Autoencoder

Backdoor Attacks and Defenses in Federated Learning: State-of-the-Art, Taxonomy, and Future Directions

Fed-LSAE: Thwarting Poisoning Attacks against Federated Cyber Threat Detection System via Autoencoder-based Latent Space Inspection

A Robust and Efficient Federated Learning Algorithm Against Adaptive Model Poisoning Attacks

Data-Agnostic Model Poisoning Against Federated Learning: A Graph Autoencoder Approach

Mitigating Malicious Attacks in Federated Learning via Confidence-aware Defense

Poisoning with A Pill: Circumventing Detection in Federated Learning

ADFL: A Poisoning Attack Defense Framework for Horizontal Federated Learning

FLDetector: Defending Federated Learning Against Model Poisoning Attacks via Detecting Malicious Clients

FLMAAcBD: Defending against backdoors in Federated Learning via Model Anomalous Activation Behavior Detection

Defending Poisoning Attacks in Federated Learning via Adversarial Training Method

Federated Learning in Adversarial Environments: Testbed Design and Poisoning Resilience in Cybersecurity

FedCC: Robust Federated Learning against Model Poisoning Attacks

RoseAgg: Robust Defense Against Targeted Collusion Attacks in Federated Learning

Using Anomaly Detection to Detect Poisoning Attacks in Federated Learning Applications

Optimized Client-side Detection of Model Poisoning Attacks in Federated learning

Detecting and mitigating poisoning attacks in federated learning using generative adversarial networks

A GAN-Based Data Poisoning Attack Against Federated Learning Systems and Its Countermeasure

MODEL: A Model Poisoning Defense Framework for Federated Learning via Truth Discovery

Model Poisoning Attack In Federated Learning Via Adversarial Examples

FedMID: A Data-Free Method for Using Intermediate Outputs as a Defense Mechanism Against Poisoning Attacks in Federated Learning