锤与砧：迈向联邦学习中后门的理论框架
Hammer and Anvil: Toward a Theory of Backdoors in Federated Learning
AI总结：
本文提出'锤与砧'理论框架，通过分析后门更新偏离程度δ，分类两种防御类型，证明单一类型或非原则性组合防御存在漏洞，而结合两种类型防御能有效抵御适应性攻击。
摘要：
联邦学习（FL）虽然支持分布式模型训练，但易受后门攻击，即恶意客户端将攻击者控制的行为嵌入全局模型。现有防御措施无法抵御适应性攻击。本文提出'锤与砧'理论框架，通过分析后门更新偏离程度δ，将后门分为两种基本防御类型：类型1（砧）包含异常检测和鲁棒聚合，有效对抗大偏离攻击；类型2（锤）包含移除类防御，有效对抗小偏离攻击。本文证明单一类型或非原则性组合防御会留下可被适应性攻击利用的漏洞。为弥补这一漏洞，本文提出结合类型1和类型2的原理性防御方法。在针对新、最坏情况、全信息适应性攻击者的评估中，该攻击者仍无法突破我们的综合防御。在各种数据集和设置下的实证评估显示，单一类型或非原则性组合防御极易被突破，通常由单个恶意客户端即可完成。相比之下，我们的最佳综合防御变体HA_Flame_CSFT、HA_Krum_CSFT和HA_Multi-Metrics_CSFT即使在最敌对的设置下仍无败绩。我们的结果为联邦学习中后门研究提供了原理性方法。
英文摘要：
Federated Learning (FL) enables distributed model training but is vulnerable to backdoor attacks, where malicious clients embed attacker-controlled behaviors into the global model. Existing defenses fail against adaptive adversaries. In this paper, we present "Hammer and Anvil", a principled theoretical framework that categorizes backdoors by the deviation, $δ$, of their updates to the mean of the updates. We identify two fundamental defense types: "Type 1 (The Anvil)", comprising outlier detection and robust aggregation effective against large-deviation attacks, and "Type 2 (The Hammer)", consisting of removal-based defenses effective against small-deviation attacks. We demonstrate that defenses of a single type and non-principled combined defenses inherently leave an exploitable gap for adaptive attackers. To bridge this gap, we propose the principled combination of Type 1 and Type 2 defenses. We evaluate our framework against a new, worst-case, full-information adaptive adversary that knows the benign updates, the aggregation algorithm, and its parameters, and yet this adversary fails against our combined defenses. Our empirical evaluation across various datasets and settings shows that single-typed and non-principled combined defenses are easily broken, often by a single malicious client. In contrast, our best combined defense variants, $HA_{Flame}^{CSFT}$, $HA_{Krum}^{CSFT}$, and $HA_{Multi-Metrics}^{CSFT}$, remain undefeated even in the most adversarial settings. Our results provide a principled approach for research on backdoors in federated learning.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
