潜伏于阴影之中：揭示针对个性化联邦学习的隐蔽后门攻击
Lurking in the shadows: Unveiling Stealthy Backdoor Attacks against Personalized Federated Learning
AI总结：
本文针对个性化联邦学习提出隐蔽后门攻击方法PFedBA，通过优化触发器生成将后门任务与主任务对齐，在10种先进PFL算法上击败6种现有防御，揭示了PFL的深层安全脆弱性。
摘要：
联邦学习（Federated Learning, FL）是一种协作式机器学习技术，多个客户端与中央服务器共同训练全局模型，而无需共享其私有数据。然而，客户端非独立同分布（non-IID）数据集之间的分布偏移对这一“一模型通用”的方法构成了挑战，阻碍了全局模型有效适应每个客户端独特本地数据的能力。为应对这一挑战，个性化联邦学习（Personalized Federated Learning, PFL）被设计用于允许每个客户端创建针对其私有数据量身定制的个性化本地模型。尽管大量研究已经审视了FL中的后门风险，但在PFL应用中这一问题仍未得到充分探索。在本研究中，我们深入探究了PFL对后门攻击的脆弱性。我们的分析展示了一个“双城记”式的局面。一方面，PFL中的个性化过程可以稀释注入个性化本地模型中的后门投毒效应。此外，PFL系统还可以部署服务器端和客户端防御机制，以加强对后门攻击的屏障。另一方面，我们的研究表明，配备了这些防御方法的PFL可能会提供一种虚假的安全感。我们提出PFedBA，这是一种适用于PFL系统的隐蔽且有效的后门攻击策略。PFedBA通过优化触发器生成过程，巧妙地将后门学习任务与PFL的主学习任务对齐。我们的综合实验证明了PFedBA在将触发器无缝嵌入个性化本地模型方面的有效性。PFedBA在10种最先进的PFL算法上均取得了出色的攻击性能，击败了现有的6种防御机制。我们的研究揭示了PFL系统所面临的微妙而强大的后门威胁，敦促社区加强防御以应对新兴的后门挑战。
英文摘要：
Federated Learning (FL) is a collaborative machine learning technique where multiple clients work together with a central server to train a global model without sharing their private data. However, the distribution shift across non-IID datasets of clients poses a challenge to this one-model-fits-all method hindering the ability of the global model to effectively adapt to each client's unique local data. To echo this challenge, personalized FL (PFL) is designed to allow each client to create personalized local models tailored to their private data. While extensive research has scrutinized backdoor risks in FL, it has remained underexplored in PFL applications. In this study, we delve deep into the vulnerabilities of PFL to backdoor attacks. Our analysis showcases a tale of two cities. On the one hand, the personalization process in PFL can dilute the backdoor poisoning effects injected into the personalized local models. Furthermore, PFL systems can also deploy both server-end and client-end defense mechanisms to strengthen the barrier against backdoor attacks. On the other hand, our study shows that PFL fortified with these defense methods may offer a false sense of security. We propose \textit{PFedBA}, a stealthy and effective backdoor attack strategy applicable to PFL systems. \textit{PFedBA} ingeniously aligns the backdoor learning task with the main learning task of PFL by optimizing the trigger generation process. Our comprehensive experiments demonstrate the effectiveness of \textit{PFedBA} in seamlessly embedding triggers into personalized local models. \textit{PFedBA} yields outstanding attack performance across 10 state-of-the-art PFL algorithms, defeating the existing 6 defense mechanisms. Our study sheds light on the subtle yet potent backdoor threats to PFL systems, urging the community to bolster defenses against emerging backdoor challenges.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
