arXivDaily arXiv每日学术速递 周一至周五更新
arXiv 2201.07063cs.LGcs.CR

如何在个性化联邦学习中对超网络植入后门?

How to Backdoor HyperNetwork in Personalized Federated Learning?

SUNY-Albany(纽约州立大学奥尔巴尼分校);New Jersey Institute of Technology(新泽西理工学院);Qatar Computing Research Institute(卡塔尔计算研究所);University of Arkansas(阿肯色大学)

Phung Lai, NhatHai Phan, Issa Khalil, Abdallah Khreishah, Xintao Wu

AI总结:

针对 HyperNetFL 的后门风险,论文提出 HNTroj 模型转移攻击,利用多客户端一致恶意梯度将后门扩散至个性化局部模型,并证明其隐蔽性、低攻陷需求及绕过鲁棒防御的能力。

摘要:

本文通过投毒攻击探究基于 HyperNet 的个性化联邦学习(HyperNetFL)中此前未知的后门风险。在此基础上,我们提出一种新型模型转移攻击(称为 HNTroj),即此类攻击中的首个方法,它通过在整个训练过程中由所有被攻陷客户端计算出一致且有效的恶意局部梯度,将局部感染后门的模型转移到由 HyperNetFL 模型生成的所有合法且个性化的局部模型。因此,HNTroj 减少了成功发起攻击所需的被攻陷客户端数量,同时在合法数据样本上没有出现任何可观察到的模型效用突变或下降迹象,使我们的攻击具有隐蔽性。为防御 HNTroj,我们将若干抗后门联邦学习训练算法适配到 HyperNetFL 中。使用多个基准数据集开展的大量实验表明,HNTroj 显著优于数据投毒和模型替换攻击,并且即使在被攻陷客户端数量适中的情况下,也能绕过鲁棒训练算法。

英文摘要:

This paper explores previously unknown backdoor risks in HyperNet-based personalized federated learning (HyperNetFL) through poisoning attacks. Based upon that, we propose a novel model transferring attack (called HNTroj), i.e., the first of its kind, to transfer a local backdoor infected model to all legitimate and personalized local models, which are generated by the HyperNetFL model, through consistent and effective malicious local gradients computed across all compromised clients in the whole training process. As a result, HNTroj reduces the number of compromised clients needed to successfully launch the attack without any observable signs of sudden shifts or degradation regarding model utility on legitimate data samples making our attack stealthy. To defend against HNTroj, we adapted several backdoor-resistant FL training algorithms into HyperNetFL. An extensive experiment that is carried out using several benchmark datasets shows that HNTroj significantly outperforms data poisoning and model replacement attacks and bypasses robust training algorithms even with modest numbers of compromised clients.

机构、总结、中文摘要均由AI分析而来,可能存在错误,请以论文正文为准。

↑