Abstract:With the undetectable characteristic, adaptive model poisoning attacks can combine with any other attacks, bypassing the detection and violating the availability of federated learning systems. Existing defences are vulnerable to adaptive model poisoning attacks, as model poisoning-related features are tailored to these methods and compromise the accuracy of the FL model. We first present a unified reformulation of existing adaptive model poisoning attacks. Analyzing the reformulated attacks, we find that the detectors should reduce the attacker’s optimization cost functions to defeat adaptive attacks. However, existing defences do not consider the causes of model parameters’ high dimensionality and data heterogeneity. We propose a novel robust FL algorithm, FedDet, to tackle the problems. By splitting the local models into layers for robust aggregation, FedDet can overcome the issue with high dimensionality while keeping the functionality of layers. During the robust aggregation, FedDet normalizes every slice of local models by the median norm value instead of excluding some clients, which can avoid deviation from the optimal model. Furthermore, we conduct a comprehensive security analysis of FedDet and an existing robust aggregation method. We propose the upper bounds on the perturbations disturbed by these adaptive attacks. It is found that FedDet can be more robust than Krum with a smaller perturbation upper bound under attacks. We evaluate the performance of FedDet and four baseline methods against these attacks under two classic datasets. It demonstrates that FedDet significantly outperforms the existing compared methods against adaptive attacks. FedDet can achieve 60.72% accuracy against min-max attacks.

FedPerturb: Covert Poisoning Attack on Federated Learning via Partial Perturbation

FedPerturb: Covert Poisoning Attack on Federated Learning Via Partial Perturbation.

Oblivion: Poisoning Federated Learning by Inducing Catastrophic Forgetting.

Poisoning Deep Learning Based Recommender Model in Federated Learning Scenarios.

Deep Model Poisoning Attack on Federated Learning

Defending Poisoning Attacks in Federated Learning via Adversarial Training Method

FL-PTD: A Privacy Preserving Defense Strategy Against Poisoning Attacks in Federated Learning.

Analyzing Federated Learning through an Adversarial Lens

Data Poisoning Attack Based on Privacy Reasoning and Countermeasure in Federated Learning

A Robust and Efficient Federated Learning Algorithm Against Adaptive Model Poisoning Attacks

Data Poisoning Attacks Against Federated Learning Systems

Depriving the Survival Space of Adversaries Against Poisoned Gradients in Federated Learning

Concealing Backdoor Model Updates in Federated Learning by Trigger-Optimized Data Poisoning

Mitigation of a poisoning attack in federated learning by using historical distance detection

Denial-of-Service or Fine-Grained Control: Towards Flexible Model Poisoning Attacks on Federated Learning

FedAttack: Effective and Covert Poisoning Attack on Federated Recommendation via Hard Sampling

Data Poisoning Attacks on Federated Learning by Using Adversarial Samples

FedMID: A Data-Free Method for Using Intermediate Outputs as a Defense Mechanism Against Poisoning Attacks in Federated Learning

Poisoning Attacks in Federated Learning: A Survey

Covert Model Poisoning Against Federated Learning: Algorithm Design and Optimization

Model Poisoning Attacks to Federated Learning via Multi-Round Consistency