重新审视个性化联邦学习：抵御后门攻击的鲁棒性
Revisiting Personalized Federated Learning: Robustness Against Backdoor Attacks
AI总结：
本文首次系统评估个性化联邦学习对后门攻击的鲁棒性，发现部分模型共享更安全，并提出轻量防御 Simple-Tuning 与开源黑盒攻击基准。
摘要：
在本工作中，除了提升预测准确率之外，我们还研究个性化是否能为抵御后门攻击带来鲁棒性收益。我们开展了针对 pFL 框架中后门攻击的首次研究，在基准数据集 FEMNIST 和 CIFAR-10 上针对 6 种 pFL 方法测试了 4 种广泛使用的后门攻击，共计 600 次实验。研究表明，采用部分模型共享的 pFL 方法能够显著增强对后门攻击的鲁棒性。相比之下，采用全模型共享的 pFL 方法并未表现出鲁棒性。为分析鲁棒性表现存在差异的原因，我们对不同 pFL 方法进行了全面的消融研究。基于这些发现，我们进一步提出了一种轻量级防御方法 Simple-Tuning，实验表明该方法提升了针对后门攻击的防御性能。我们相信，本工作既能从鲁棒性方面为 pFL 应用提供指导，也能为未来设计更鲁棒的 FL 方法提供有价值的洞见。我们开源了代码，以建立 pFL 中黑盒后门攻击的首个基准：https://github.com/alibaba/FederatedScope/tree/backdoor-bench。
英文摘要：
In this work, besides improving prediction accuracy, we study whether personalization could bring robustness benefits to backdoor attacks. We conduct the first study of backdoor attacks in the pFL framework, testing 4 widely used backdoor attacks against 6 pFL methods on benchmark datasets FEMNIST and CIFAR-10, a total of 600 experiments. The study shows that pFL methods with partial model-sharing can significantly boost robustness against backdoor attacks. In contrast, pFL methods with full model-sharing do not show robustness. To analyze the reasons for varying robustness performances, we provide comprehensive ablation studies on different pFL methods. Based on our findings, we further propose a lightweight defense method, Simple-Tuning, which empirically improves defense performance against backdoor attacks. We believe that our work could provide both guidance for pFL application in terms of its robustness and offer valuable insights to design more robust FL methods in the future. We open-source our code to establish the first benchmark for black-box backdoor attacks in pFL: https://github.com/alibaba/FederatedScope/tree/backdoor-bench.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
