基于联邦生成对抗网络的医学图像合成中的后门攻击与防御
Backdoor Attack and Defense in Federated Generative Adversarial Network-based Medical Image Synthesis
AI总结：
针对联邦GAN医学图像合成中的后门攻击，本文揭示其通过判别器过拟合破坏均衡的机理，并提出FedDetect依据客户端损失识别和阻断恶意客户端。
摘要：
基于深度学习的图像合成技术已应用于医疗研究，用于生成医学图像以支持开放研究并增强医学数据集。训练生成对抗神经网络（GAN）通常需要大量训练数据。联邦学习（FL）提供了一种使用分布式数据训练中央模型同时将原始数据保留在本地的方法。然而，由于FL服务器无法访问原始数据，它容易受到后门攻击，即通过投毒训练数据进行的对抗行为。大多数后门攻击策略集中于分类模型和集中式领域。现有后门攻击是否会影响GAN训练，以及如果会，在FL环境中如何防御该攻击，仍是一个悬而未决的问题。在本工作中，我们研究了联邦GAN（FedGAN）中被忽视的后门攻击问题。随后确定，这种攻击之所以成功，是因为某些局部判别器过拟合投毒数据并破坏局部GAN均衡，进而在平均生成器参数时污染其他客户端，并产生较高的生成器损失。因此，我们提出了FedDetect，这是一种在FL环境中防御后门攻击的高效且有效方法，允许服务器根据客户端的损失检测其对抗行为并阻止恶意客户端。我们在两个不同模态的医学数据集上进行的大量实验表明，对FedGAN的后门攻击可能导致合成图像保真度较低。在使用所提出的防御策略检测并抑制被发现的恶意客户端后，我们表明FedGAN可以合成高质量的医学数据集（带标签），用于数据增强以提高分类模型的性能。
英文摘要：
Deep Learning-based image synthesis techniques have been applied in healthcare research for generating medical images to support open research and augment medical datasets. Training generative adversarial neural networks (GANs) usually require large amounts of training data. Federated learning (FL) provides a way of training a central model using distributed data while keeping raw data locally. However, given that the FL server cannot access the raw data, it is vulnerable to backdoor attacks, an adversarial by poisoning training data. Most backdoor attack strategies focus on classification models and centralized domains. It is still an open question if the existing backdoor attacks can affect GAN training and, if so, how to defend against the attack in the FL setting. In this work, we investigate the overlooked issue of backdoor attacks in federated GANs (FedGANs). The success of this attack is subsequently determined to be the result of some local discriminators overfitting the poisoned data and corrupting the local GAN equilibrium, which then further contaminates other clients when averaging the generator's parameters and yields high generator loss. Therefore, we proposed FedDetect, an efficient and effective way of defending against the backdoor attack in the FL setting, which allows the server to detect the client's adversarial behavior based on their losses and block the malicious clients. Our extensive experiments on two medical datasets with different modalities demonstrate the backdoor attack on FedGANs can result in synthetic images with low fidelity. After detecting and suppressing the detected malicious clients using the proposed defense strategy, we show that FedGANs can synthesize high-quality medical datasets (with labels) for data augmentation to improve classification models' performance.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
