TY - JOUR
T1 - SAFELearning
T2 - Secure Aggregation in Federated Learning With Backdoor Detectability
AU - Zhang, Zhuosheng
AU - Li, Jiarui
AU - Yu, Shucheng
AU - Makaya, Christian
N1 - Publisher Copyright:
© 2005-2012 IEEE.
PY - 2023
Y1 - 2023
N2 - For model privacy, local model parameters in federated learning shall be obfuscated before sent to the remote aggregator. This technique is referred to as secure aggregation. However, secure aggregation makes model poisoning attacks such as backdooring more convenient given that existing anomaly detection methods mostly require access to plaintext local models. This paper proposes a new federated learning technique SAFELearning to support backdoor detection for secure aggregation. We achieve this through two new primitives -oblivious random grouping (ORG) and partial parameter disclosure (PPD). ORG partitions participants into one-time random subgroups with group configurations oblivious to participants; PPD allows secure partial disclosure of aggregated subgroup models for anomaly detection without leaking individual model privacy. ORG is based on our construction of several new primitives including tree-based random subgroup generation, oblivious secure aggregation, and randomized Diffie-Hellman key exchange. ORG can thwart colluding attackers from knowing each other's group membership assignment with non-negligible advantage than random guess. Backdoor attacks are detected based on statistical distributions of the subgroup aggregated parameters of the learning iterations. SAFELearning can significantly reduce backdoor model accuracy without jeopardizing the main task accuracy under common backdoor strategies. Extensive experiments show SAFELearning is robust against malicious and faulty participants, whilst being more efficient than the state-of-art secure aggregation protocol in terms of both communication and computation costs.
AB - For model privacy, local model parameters in federated learning shall be obfuscated before sent to the remote aggregator. This technique is referred to as secure aggregation. However, secure aggregation makes model poisoning attacks such as backdooring more convenient given that existing anomaly detection methods mostly require access to plaintext local models. This paper proposes a new federated learning technique SAFELearning to support backdoor detection for secure aggregation. We achieve this through two new primitives -oblivious random grouping (ORG) and partial parameter disclosure (PPD). ORG partitions participants into one-time random subgroups with group configurations oblivious to participants; PPD allows secure partial disclosure of aggregated subgroup models for anomaly detection without leaking individual model privacy. ORG is based on our construction of several new primitives including tree-based random subgroup generation, oblivious secure aggregation, and randomized Diffie-Hellman key exchange. ORG can thwart colluding attackers from knowing each other's group membership assignment with non-negligible advantage than random guess. Backdoor attacks are detected based on statistical distributions of the subgroup aggregated parameters of the learning iterations. SAFELearning can significantly reduce backdoor model accuracy without jeopardizing the main task accuracy under common backdoor strategies. Extensive experiments show SAFELearning is robust against malicious and faulty participants, whilst being more efficient than the state-of-art secure aggregation protocol in terms of both communication and computation costs.
KW - Federated learning
KW - backdoor attack
KW - machine learning
KW - secure aggregation
UR - http://www.scopus.com/inward/record.url?scp=85161035137&partnerID=8YFLogxK
UR - http://www.scopus.com/inward/citedby.url?scp=85161035137&partnerID=8YFLogxK
U2 - 10.1109/TIFS.2023.3280032
DO - 10.1109/TIFS.2023.3280032
M3 - Article
AN - SCOPUS:85161035137
SN - 1556-6013
VL - 18
SP - 3289
EP - 3304
JO - IEEE Transactions on Information Forensics and Security
JF - IEEE Transactions on Information Forensics and Security
ER -