Unraveling the Connections between Privacy and Certified Robustness in Federated Learning Against Poisoning Attacks
University of Illinois at Urbana-Champaign（伊利诺伊大学厄巴纳-尚佩恩分校）；IBM Research（IBM研究院）；UC Berkeley（加州大学伯克利分校）；Amazon Web Services（亚马逊云服务）；Stanford University（斯坦福大学）
Chulin Xie, Yunhui Long, Pin-Yu Chen, Qinbin Li, Arash Nourian, Sanmi Koyejo, Bo Li
Federated learning (FL) provides an efficient paradigm to jointly train a global model leveraging data from distributed users. As local training data comes from different users who may not be trustworthy, several studies have shown that FL is vulnerable to poisoning attacks. Meanwhile, to protect the privacy of local users, FL is usually trained in a differentially private way (DPFL). Thus, in this paper, we ask: What are the underlying connections between differential privacy and certified robustness in FL against poisoning attacks? Can we leverage the innate privacy property of DPFL to provide certified robustness for FL? Can we further improve the privacy of FL to improve such robustness certification? We first investigate both user-level and instance-level privacy of FL and provide formal privacy analysis to achieve improved instance-level privacy. We then provide two robustness certification criteria: certified prediction and certified attack inefficacy for DPFL on both user and instance levels. Theoretically, we provide the certified robustness of DPFL based on both criteria given a bounded number of adversarial users or instances. Empirically, we conduct extensive experiments to verify our theories under a range of poisoning attacks on different datasets. We find that increasing the level of privacy protection in DPFL results in stronger certified attack inefficacy; however, it does not necessarily lead to a stronger certified prediction. Thus, achieving the optimal certified prediction requires a proper balance between privacy and utility loss.
Certified Robustness to Data Poisoning in Gradient-Based Training
Department of Computing, Imperial College London, United Kingdom（帝国理工学院伦敦分校计算机系）；Department of Computer Science, ETH Zurich, Switzerland（苏黎世联邦理工学院计算机科学系）；LogicStar.ai, Switzerland（LogicStar.ai公司）；The Alan Turing Institute, United Kingdom（艾伦·图灵研究所）
Unraveling Attacks in Machine Learning-based IoT Ecosystems: A Survey and the Open Libraries Behind Them
University of Maryland, Baltimore County（马里兰大学巴尔的摩县分校）；Deep Red Future Technology Co. Ltd.（深红未来科技有限公司）；CSIRO（澳大利亚联邦科学与工业研究组织）；University of Saskatchewan（萨斯喀彻温大学）；Sichuan University（四川大学）
