Federated learning (FL) [1] aims to build a robust machine learning (ML) model where local clients (LCs) distributively train their ML model using their locally collected data. In a typical FL setting, a central parameter server (PS) is connected to multiple clients and aggregates the models uploaded by the LCs. User privacy can be greatly protected since no local data is shared. However, it could be more harmful to the system when the malicious LCs launch Byzantine attacks by sending the poisoning model to the PS, which can directly degrade the overall learning performance. Furthermore, privacy is protected but not guaranteed in FL since attackers can still infer the private data and some key parameters such as gradients from the model in a membership inference attack [2].
The Byzantine attacks usually refers to the attacks initiated from the internal components in the systems. In FL, it is launched by the malicious LCs aims to degrade the learning performance. The model poisoning attacks can directly reduce the local task execution accuracy at LCs. Furthermore, the individual model of a single LC is invisible over the air or at the server due to the secure aggregation or other encoding methods. Only the aggregated model is available. Therefore, it is very difficult to identify malicious LCs in such a scenario. There have been extensive works to defend against Byzantine attacks in the distributed ML and FL. Most works aim to accommodate the attacks and mitigate the adverse effects, such as Krum aggregation [3] and geometric median aggregation [4]. Krum aggregation is based on majority and squared distance to select some representative clients as the benign and trusted clients and estimate the true center using their updates. This may result in a biased model, especially when the data among LCs is not independent and identically distributed (non-lID). Unlike the classical arithmetic averaging, the geometric median considers the compounding that occurs from time to time and mitigates the impacts of poisoning attacks. But this scheme needs to obtain an individual model, which may cause privacy disclosure in membership inference attacks that is to infer membership of individual training instances of a model. In [5], rather than accommodating the attacks as mentioned above, the work identified the attackers and removed the model updates coming from the attackers. However, it could be challenging to select the dynamic threshold used to determine the attackers.
Another method to provide enhanced privacy protection in FL is differential privacy (DP) [6]. A typical approach of DP is to add random noise to the model and hide the real model from the eavesdroppers. It does not affect the system performance since the Gaussian noise can be averaged out due to aggregation. Another way for privacy protection is to hide the individual model from the eavesdroppers, i.e., only the aggregated model is accessible. This can be achieved with the Secure Aggregation protocol (SecAgg) [7] or over-the-air computation (AirComp) [8] in wireless communications. Since the PS only needs to know the aggregated model, hiding the individual model does not impact the system performance.
In this work, we propose to use model update based (MUB) aggregation to defend against Byzantine attacks and enhance security. The individual client model initialization (ICMI) scheme is further used to enhance privacy protection. By combining the two techniques as MUB-ICMI, privacy and security are enhanced. To the best of our knowledge, this is the first paper to provide both security and privacy protection without the error between the data sample (Xi, Yi) and the mapping made by model parameters w. Since data is distributed among K clients, the objective (1) can be rewritten as changing the fundamental structure of the classical federated averaging algorithm FedAvg [9]. The critical contributions of the paper are summarized as follows.
• schemes are robust against attacks while still achieving good performance. The rest of the paper is organized as follows. Section II introduces the classical MB FedAvg algorithm. It also gives the motivations to apply MUB, ICMI, and MUB-ICMI schemes in FL. Section III presents the detailed algorithms for the three proposed schemes. Simulation results are given in Section IV. Finally, section V concludes the paper.
FL aims to learn a central ML model without data sharing. This is achieved by sharing the local ML models trained at each LC. The system is normally comprised of a central parameter server (PS) connected by K LCs. Each LC has its dataset, and the data can be non-lID across different LCs. Considering bandwidth restrictions, especially in a wireless setting, only a fraction C of total clients are selected to participate in the FL process in each round. In the classical MB FedAvg algorithm, the selected clients perform local learning based on their local dataset. Each LC then uploads the updated local model to the server for aggregation. The server employs the updated local models to get the latest global model via arithmetic averaging and then sends it back to all the LCs. The process repeats until the model converges.
The objective function of the FL system can be defined as
wERd where f( w) == 11 1 L:~=1 fi( w), IDI is the size of the dataset D. fi (w) == R(Xi, Yi; w) is the loss function used to capture where wf is defined in (3), i.e., the local model after the local learning process; wf' is the local model before local learning, which will be defined later in (7). The global model update is defined as (6) ~IDkl k
Ut+1 == ~lDT Ut .
k=1
The To understand the difference between MB and MUB, we first derive the distributions of model and model update, respectively, in the non-lID data case. In Fig. 2, the distribution of model update in Fig. 2(a) shows much less deviation than the model distribution in Fig. 2(b). Further, in Fig. 2 model of each client is accessible to the eavesdroppers during uploading. Thus the eavesdroppers have a chance to perform membership inference attacks to infer the private data at LCs. To address that, ICMI is introduced as a new model initialization scheme. ICMI lets LC initialize its own model rather than using a common initial model sent by the server. SecAgg or AirComp can be further used to hide each LC's model from others, including the server and possible eavesdroppers, during the uploading stage. The eavesdroppers can only obtain the aggregated model, which effectively prevents the membership inference attacks.
In the MUB scheme, since the model update rather than the model itself is shared by each client, the local model and the global model are effectively hidden from the eavesdroppers. However, due to the fact that the model initialization is done at the server and then is sent to each client, the eavesdroppers may still be able to calculate the local model and the global model based on the initial global model and subsequent local model updates. To avoid that, MUB can be combined with ICMI to form the MUB-ICMI scheme, providing further privacy protection. With MUB-ICMI, no model information is made accessible to the eavesdroppers. Therefore, there is no need to use SecAgg or AirComp to hide the individual models. This simplifies the design of ICMI scheme by avoiding extra computation or communication overhead. In the classical MB FedAvg, the global model is first initialized by the server and then sent to LCs. Thus, each client has the same learning initialization point. Besides, the In [10], the author proposed the update norm clipping approach to ensure the norm of each model update is small enough so that the server is less susceptible to the poisoning models on backdoor attacks. This is proved to be a valid defense method for backdoor attacks without much impact on the performance of the main task. From the distributions of model and model update in Fig. 2, the l2-norm of the model update distribution is much smaller than that of the model distribution. So the model update can naturally work like the norm-clipped model. And it should also apply to Byzantine attacks such as additive noise attacks and sign-flipping attacks. In the previous section, the motivation to apply the MUB scheme and ICMI scheme is articulated. In this section, the details of the proposed schemes are presented. The three substages can be summarized as:
In ML, the gradient is usually defined as 9 == \lF (w ), so the local gradient in FL is gf == \lF k (Wt), and the global d • .
- In the classical MB FedAvg, an LC only needs to perform local learning in each FL round. In MUB-FL, a client needs to execute the three substages, as shown in Fig. 3. This might result in different local models and different convergence behavior. When the model is initialized from the server and sent to LCs, the initial global model WI in the classical MB-FL is the same for all the clients. The local model after learning is w} == WI -r;\lFk(WI). [7], e.g., masking with one-time pads, dropped user recovery using secret sharing, exchanging secrets efficiently, and minimizing thrust in practice. As the aggregated model is hidden from eavesdroppers and other third parties, the membership inference attacks can not be executed. Since only the initial model WI is different across LCs while the rest part keeps the same as in the classical MB FedAvg, ICMI should also converge to a similar level as in classical MB-FL. This is verified in the simulation.
To enhance both security and privacy in FL, MUB and ICMI can be combined to form MUB-ICMI, where the model initialization is taken place at LCs, and only the model update (not the model itself) is uploaded. The MUB-ICMI algorithm is summarized in Algorithm 1. In the additive noise attack, malicious clients add Gaussian noise to their local model updates and send them to PS. The malicious clients have the desire to add the noise with significant power. However, it is easy to detect it by computing the l2-norm of the model update. In a sign-flipping attack, the malicious client flips the signs of the model updates while keeping the magnitude unchanged. So this attack is more brutal to be identified and thus more harmful to the system performance. F Fig. 5 presents the results of classical MB-FL with lID data under additive noise attacks as well as with non-lID data under sign-flipping attacks in the CNN model. When more malicious clients participate in model sharing, the performance becomes worse. The lID data distribution makes the test accuracy smoother under Byzantine attacks shown in Fig. 5(a). Due to the non-lID data distribution, the test accuracy results in Fig. 5(b) experience fluctuation during the learning. Compared with the additive noise attacks, sign-flipping attacks suffers much worse performance. When 40% of the clients are malicious clients, the model almost learns nothing under the sign-flipping attacks. As shown in Fig. 5, the non-lID data distribution is more vulnerable to sign-flipping attacks. So in the following result, only the testing result of non-lID data distribution under sign-flipping attacks will be presented to demonstrate the effectiveness of the proposed schemes.
In this section, we first show the convergence of the proposed three schemes as well as the classical MB FedAvg algorithm by using image classification tasks under no attacks. Then the testing results of four different schemes under two different Byzantine attacks, i.e., additive noise attacks and sign-flipping attacks are presented. Compared with the classical MB-FL scheme, MUB-ICMI scheme is effective in defending against Byzantine attacks while still achieving good performance.
We First, the convergence of the classical MB-FL and the proposed MUB-FL and ICMI-FL are demonstrated using MLP or CNN model under lID or non-lID data distributions without any attacks. Fig. 4 shows the testing accuracy of MNIST under a non-lID data distribution with the CNN model. All four algorithms converge after 200 training rounds and also converge to the levels that are very close to each other. The MUB algorithm even achieves slightly better performance than the classical MB-FL during the learning process. The heterogeneity of data distribution has less impact when the model update rather than the model is aggregated. Under lID data distribution, MUB-FL achieves similar performance compared with the classical MB-FL. The MUB-ICMI algorithm performs slightly worse than the other three algorithms.
To demonstrate the effectiveness of the proposed algorithms in defending against Byzantine attacks, we evaluate the proposed algorithms in several scenarios. First, we assume that 20%, 30%, or 40% of the clients are attackers. Two types of scheme to enhance privacy. The combined new MUB-ICMI can effectively improve both privacy and security in FL. Two types of Byzantine attacks were used to demonstrate the effectiveness of the proposed schemes. The convergence and effectiveness of the methods were presented using the MNIST dataset with both lID and non-lID data distributions. The theoretical analysis of the proposed algorithms and more simulation results on other datasets will be provided in the future. Fig. 6 provides the results of non-lID data with MLP model using MUB scheme under sign-flipping attacks, and Fig. 7 presents the results of ICMI scheme under sign-flipping attacks. From Fig. 6, we know MUB-FL can significantly defend against the sign-flipping attacks. After 100 learning rounds, even in the worst case with 40% malicious clients, the testing accuracy is still very close to the result without any attacks when it converges. Since the ICMI scheme is designed to enhance privacy, it does not help to defend the Byzantine attacks. Thus the testing results in Fig. 7 are similar to the results with the classical MB-FL algorithm shown in Fig. 5(b).
Finally, the MUB-ICMI scheme is applied to non-lID data distribution with the CNN model under sign-flipping attacks. To demonstrate the effectiveness of the algorithm, 200 training rounds are executed. In Fig. 8, the scenarios with 20% and 30% malicious clients achieve similar results to the "N0 Attack" case after 200 training rounds. For the attack with 40% malicious clients, although the performance is worse than the "no attack" scenario as expected, it is still much better than the classical MB-FL shown in Fig. 5(b).
In this paper, we proposed a new method using the MUB scheme in FL to defend against Byzantine attacks and the ICMI
Authorized licensed use limited to: Utah State University. Downloaded on February 03,2023 at 00:56:29 UTC from IEEE Xplore. Restrictions apply.