Abstract:In distributed systems, data may partially overlap in sample and feature spaces, that is, horizontal and vertical data partitioning. By combining horizontal and vertical federated learning (FL), hybrid FL emerges as a promising solution to simultaneously deal with data overlapping in both sample and feature spaces. Due to its decentralized nature, hybrid FL is vulnerable to model poisoning attacks, where malicious devices corrupt the global model by sending crafted model updates to the server. Existing work usually analyzes the statistical characteristics of all updates to resist model poisoning attacks. However, training local models in hybrid FL requires additional communication and computation steps, increasing the detection cost. In addition, due to data diversity in hybrid FL, solutions based on the assumption that malicious models are distinct from honest models may incorrectly classify honest ones as malicious, resulting in low accuracy. To this end, we propose a secure and efficient hybrid FL against model poisoning attacks. Specifically, we first identify two attacks to define how attackers manipulate local models in a harmful yet covert way. Then, we analyze the execution time and energy consumption in hybrid FL. Based on the analysis, we formulate an optimization problem to minimize training costs while guaranteeing accuracy considering the effect of attacks. To solve the formulated problem, we transform it into a Markov decision process and model it as a multiagent reinforcement learning (MARL) problem. Then, we propose a malicious device detection (MDD) method based on MARL to select honest devices to participate in training and improve efficiency. In addition, we propose an alternative poisoned model detection (PMD) method considering model change consistency. This method aims to prevent poisoned models from being used in the model aggregation. Experimental results validate that under the random local model poisoning attack, the proposed MDD method can save over 50% training costs while guaranteeing accuracy. When facing the advanced adaptive local model poisoning (ALMP) attack, utilizing both the proposed MDD and PMD methods achieves the desired accuracy while reducing execution time and energy consumption.

Mitigation of a poisoning attack in federated learning by using historical distance detection

Poisoning Attack Detection Using Client Historical Similarity in Non-Iid Environments

Oblivion: Poisoning Federated Learning by Inducing Catastrophic Forgetting.

Poisoning Deep Learning Based Recommender Model in Federated Learning Scenarios.

Data Poisoning Attack Based on Privacy Reasoning and Countermeasure in Federated Learning

Deep Model Poisoning Attack on Federated Learning

Optimized Client-side Detection of Model Poisoning Attacks in Federated learning

FL-PTD: A Privacy Preserving Defense Strategy Against Poisoning Attacks in Federated Learning.

FLDetector: Defending Federated Learning Against Model Poisoning Attacks via Detecting Malicious Clients

Defending Poisoning Attacks in Federated Learning via Adversarial Training Method

Secure and Efficient Federated Learning Against Model Poisoning Attacks in Horizontal and Vertical Data Partitioning

Challenges and Countermeasures of Federated Learning Data Poisoning Attack Situation Prediction

Mitigating Sybil Attacks on Differential Privacy based Federated Learning

Detecting and mitigating poisoning attacks in federated learning using generative adversarial networks

FedPerturb: Covert Poisoning Attack on Federated Learning Via Partial Perturbation.

Efficient and Privacy-Preserving Federated Learning Against Poisoning Adversaries

MODEL: A Model Poisoning Defense Framework for Federated Learning via Truth Discovery

FedRecover: Recovering from Poisoning Attacks in Federated Learning using Historical Information

Depriving the Survival Space of Adversaries Against Poisoned Gradients in Federated Learning

MPHM: Model Poisoning Attacks on Federal Learning Using Historical Information Momentum

FedPerturb: Covert Poisoning Attack on Federated Learning via Partial Perturbation