Abstract:Without direct access to the client's data, federated learning (FL) is well-known for its unique strength in data privacy protection among existing distributed machine learning techniques. However, its distributive and iterative nature makes FL inherently vulnerable to various poisoning attacks. To counteract these threats, extensive defenses have been proposed to filter out malicious clients, using various detection metrics. Based on our analysis of existing attacks and defenses, we find that there is a lack of attention to model redundancy. In neural networks, various model parameters contribute differently to the model's performance. However, existing attacks in FL manipulate all the model update parameters with the same strategy, making them easily detectable by common defenses. Meanwhile, the defenses also tend to analyze the overall statistical features of the entire model updates, leaving room for sophisticated attacks. Based on these observations, this paper proposes a generic and attack-agnostic augmentation approach designed to enhance the effectiveness and stealthiness of existing FL poisoning attacks against detection in FL, pointing out the inherent flaws of existing defenses and exposing the necessity of fine-grained FL security. Specifically, we employ a three-stage methodology that strategically constructs, generates, and injects poison (generated by existing attacks) into a pill (a tiny subnet with a novel structure) during the FL training, named as pill construction, pill poisoning, and pill injection accordingly. Extensive experimental results show that FL poisoning attacks enhanced by our method can bypass all the popular defenses, and can gain an up to 7x error rate increase, as well as on average a more than 2x error rate increase on both IID and non-IID data, in both cross-silo and cross-device FL systems.

DPFLA: Defending Private Federated Learning Against Poisoning Attacks

DP-Poison: Poisoning Federated Learning under the Cover of Differential Privacy

FL-PTD: A Privacy Preserving Defense Strategy Against Poisoning Attacks in Federated Learning.

Efficient and Privacy-Preserving Federated Learning Against Poisoning Adversaries

SPFL: A Self-purified Federated Learning Method Against Poisoning Attacks

Defending Against Data Poisoning Attack in Federated Learning With Non-IID Data

APFed: Anti-Poisoning Attacks in Privacy-Preserving Heterogeneous Federated Learning.

Defending Against Data Poisoning Attacks: from Distributed Learning to Federated Learning

Data Poisoning Attacks Against Federated Learning Systems

PROFL: A Privacy-Preserving Federated Learning Method with Stringent Defense Against Poisoning Attacks

Robust and privacy-preserving federated learning with distributed additive encryption against poisoning attacks

Secure and Efficient Decentralized Federated Learning with Data Representation Protection

Unraveling the Connections between Privacy and Certified Robustness in Federated Learning Against Poisoning Attacks

Defending against Data Poisoning Attacks in Federated Learning via User Elimination

Poisoning with A Pill: Circumventing Detection in Federated Learning

ADFL: A Poisoning Attack Defense Framework for Horizontal Federated Learning

BPFL: Blockchain-Based Privacy-Preserving Federated Learning against Poisoning Attack

Shield Against Gradient Leakage Attacks: Adaptive Privacy-Preserving Federated Learning

Low Dimensional Secure Federated Learning Framework Against Poisoning Attacks

Denial-of-Service or Fine-Grained Control: Towards Flexible Model Poisoning Attacks on Federated Learning

A Fine-Grained Differentially Private Federated Learning Against Leakage from Gradients