Abstract:We investigate a specific security risk in FL: a group of malicious clients has impacted the model during training by disguising their identities and acting as benign clients but later switching to an adversarial role. They use their data, which was part of the training set, to train a substitute model and conduct transferable adversarial attacks against the federated model. This type of attack is subtle and hard to detect because these clients initially appear to be benign. The key question we address is: How robust is the FL system to such covert attacks, especially compared to traditional centralized learning systems? We empirically show that the proposed attack imposes a high security risk to current FL systems. By using only 3\% of the client's data, we achieve the highest attack rate of over 80\%. To further offer a full understanding of the challenges the FL system faces in transferable attacks, we provide a comprehensive analysis over the transfer robustness of FL across a spectrum of configurations. Surprisingly, FL systems show a higher level of robustness than their centralized counterparts, especially when both systems are equally good at handling regular, non-malicious data. We attribute this increased robustness to two main factors: 1) Decentralized Data Training: Each client trains the model on its own data, reducing the overall impact of any single malicious client. 2) Model Update Averaging: The updates from each client are averaged together, further diluting any malicious alterations. Both practical experiments and theoretical analysis support our conclusions. This research not only sheds light on the resilience of FL systems against hidden attacks but also raises important considerations for their future application and development.

TEAR: Exploring Temporal Evolution of Adversarial Robustness for Membership Inference Attacks Against Federated Learning

MIA-BAD: An Approach for Enhancing Membership Inference Attack and its Mitigation with Federated Learning

MIA-Leak: Exploring Membership Inference Attacks in Federated Learning Systems

FedMIA: An Effective Membership Inference Attack Exploiting "All for One" Principle in Federated Learning

GEAR: A Margin-based Federated Adversarial Training Approach

FL-TIA: Novel Time Inference Attacks on Federated Learning

CS-MIA: Membership Inference Attack Based on Prediction Confidence Series in Federated Learning

Subject-Level Membership Inference Attack via Data Augmentation and Model Discrepancy

Delving into the Adversarial Robustness of Federated Learning

Adaptive Selection of Loss Function for Federated Learning Clients Under Adversarial Attacks

Defending Against Data Reconstruction Attacks in Federated Learning: An Information Theory Approach

Towards Understanding Adversarial Transferability in Federated Learning

Active Membership Inference Attack under Local Differential Privacy in Federated Learning

Protecting Sensitive Property in Federated Learning Via Adversarial Perturbation

Practical Attribute Reconstruction Attack Against Federated Learning

Source Inference Attacks in Federated Learning

Membership Information Leakage in Federated Contrastive Learning

Adversarial Robustness Unhardening via Backdoor Attacks in Federated Learning

FLIP: A Provable Defense Framework for Backdoor Mitigation in Federated Learning

Membership Inference Defense in Distributed Federated Learning Based on Gradient Differential Privacy and Trust Domain Division Mechanisms

Privacy Inference-Empowered Stealthy Backdoor Attack on Federated Learning under Non-IID Scenarios