缓解基于联邦学习的信号分类器中的规避攻击
Mitigating Evasion Attacks in Federated Learning-Based Signal Classifiers
AI总结：
本文提出USD-FL方法，通过保留数据集上的logits比较和时变阈值检测，在不依赖完美网络信息的情况下缓解联邦学习信号分类中的模型投毒攻击，显著提升分类准确率并降低误报率。
摘要：
近年来，利用联邦学习（FL）进行无线电信号分类（SC）任务的研究兴趣日益增长，已展现出前景，但基于FL的SC仍然容易受到模型投毒对抗攻击的影响。这些对抗攻击会误导机器学习模型的训练过程，损害整个网络中的机器学习模型，并导致SC性能下降。在本工作中，我们通过提出联邦学习底层服务器防御（USD-FL）来寻求缓解基于FL的SC上的模型投毒对抗攻击。与现有的服务器驱动防御不同，USD-FL不依赖于完美的网络信息，即不需要知道对手的数量、对抗攻击架构或对抗攻击的开始时间。我们提出的USD-FL方法包括：在一个保留数据集上为各设备的机器学习模型推导logits，通过1-Wasserstein距离对logits进行成对比较，然后确定一个时变阈值用于对抗检测。因此，USD-FL能够有效缓解FL网络中引入的模型投毒攻击。具体而言，当基线服务器驱动防御确实拥有完美的网络信息时，USD-FL通过以下方面优于它们：（i）将最终机器学习分类准确率提高至少6%，（ii）将误报对手检测率降低至少10%，以及（iii）将误分类信号的总数减少超过8%。此外，当基线防御不具备完美的网络信息时，我们表明USD-FL在独立同分布（i.i.d.）和非独立同分布（non-i.i.d.）设置下分别达到约74.1%和62.5%的准确率，优于现有的服务器驱动基线，后者在i.i.d.和non-i.i.d.设置下分别达到52.1%和39.2%。
英文摘要：
Recent interest in leveraging federated learning (FL) for radio signal classification (SC) tasks has shown promise but FL-based SC remains susceptible to model poisoning adversarial attacks. These adversarial attacks mislead the ML model training process, damaging ML models across the network and leading to lower SC performance. In this work, we seek to mitigate model poisoning adversarial attacks on FL-based SC by proposing the Underlying Server Defense of Federated Learning (USD-FL). Unlike existing server-driven defenses, USD-FL does not rely on perfect network information, i.e., knowing the quantity of adversaries, the adversarial attack architecture, or the start time of the adversarial attacks. Our proposed USD-FL methodology consists of deriving logits for devices' ML models on a reserve dataset, comparing pair-wise logits via 1-Wasserstein distance and then determining a time-varying threshold for adversarial detection. As a result, USD-FL effectively mitigates model poisoning attacks introduced in the FL network. Specifically, when baseline server-driven defenses do have perfect network information, USD-FL outperforms them by (i) improving final ML classification accuracies by at least 6%, (ii) reducing false positive adversary detection rates by at least 10%, and (iii) decreasing the total number of misclassified signals by over 8%. Moreover, when baseline defenses do not have perfect network information, we show that USD-FL achieves accuracies of approximately 74.1% and 62.5% in i.i.d. and non-i.i.d. settings, outperforming existing server-driven baselines, which achieve 52.1% and 39.2% in i.i.d. and non-i.i.d. settings, respectively.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
