Federated learning is a distributed learning technique where machine learning models are trained on client devices in which the local training data resides. The training is coordinated via a central server which is, typically, controlled by the intended owner of the resulting model. By avoiding the need to transport the training data to the central server, federated learning improves privacy and efficiency. But it raises the risk of model theft by clients because the resulting model is available on every client device. Even if the application software used for local training may attempt to prevent direct access to the model, a malicious client may bypass any such restrictions by reverse engineering the application software. Watermarking is a well-known deterrence method against model theft by providing the means for model owners to demonstrate ownership of their models. Several recent deep neural network (DNN) watermarking techniques use backdooring: training the models with additional mislabeled data. Backdooring requires full access to the training data and control of the training process. This is feasible when a single party trains the model in a centralized manner, but not in a federated learning setting where the training process and training data are distributed among several client devices. In this paper, we present WAFFLE, the first approach to watermark DNN models trained using federated learning. It introduces a retraining step at the server after each aggregation of local models into the global model. We show that WAFFLE efficiently embeds a resilient watermark into models incurring only negligible degradation in test accuracy (-0.17%), and does not require access to training data. We also introduce a novel technique to generate the backdoor used as a watermark. It outperforms prior techniques, imposing no communication, and low computational (+3.2%) overhead.
Server-Enforced Watermarking in U-Shaped Split Federated Learning
Software Engineering Institute, East China Normal University（东华大学软件工程学院）；College of Computer Science and Electronic Engineering, Hunan University（湖南大学计算机科学与电子工程学院）；College of Control Science and Engineering, China University of Petroleum (East China)（中国石油大学（华东）控制科学与工程学院）
Wavelet Scattering Transform and Fourier Representation for Offline Detection of Malicious Clients in Federated Learning
Department of Mathematical Sciences, Politecnico di Torino（波兰理工学院数学科学系）；Istituto Nazionale di Fisica Nucleare, Sezione di Torino（意大利国家核物理研究所托斯卡纳分部）；Tynk S.R.L.（Tynk公司）；Laboratoire de Physique de l’Ecole Normale Supérieure, ENS Université PSL（巴黎高等科学研究院物理实验室）；CNRS, Sorbonne Université, Université de Paris（法国国家科学研究中心、索邦大学、巴黎大学）
Ten Challenging Problems in Federated Foundation Models
WeBank（微众银行）；Universiti Malaya（马来亚大学）；Institute of Computing Technology, Chinese Academy of Sciences（中国科学院计算技术研究所）；Duke Kunshan University（昆山杜克大学）；KTH Royal Institute of Technology（瑞典皇家理工学院）；Beihang University（北京航空航天大学）；Shanghai Jiao Tong University（上海交通大学）；Xi’an Jiaotong University（西安交通大学）；Southwestern University of Finance and Economic（西南财经大学）
EmbTracker: Traceable Black-box Watermarking for Federated Language Models
School of Computer Science, Shanghai Jiao Tong University（上海交通大学计算机学院）；Inner Mongolia Research Institute, Shanghai Jiao Tong University（上海交通大学内蒙古研究院）；Ant Group（蚂蚁集团）；The University of Hong Kong（香港大学）；College of Electrical Engineering, Zhejiang University（浙江大学电气工程学院）
