Eluding Secure Aggregation in Federated Learning via Model Inconsistency

TL;DR

This paper reveals that secure aggregation in federated learning can be bypassed by malicious servers through model inconsistency attacks, exposing private data despite cryptographic protections.

Contribution

It introduces two novel attacks that can infer private datasets in federated learning, highlighting vulnerabilities due to improper protocol usage and lack of validation.

Findings

Attacks are effective regardless of the number of users.

Vulnerabilities stem from incorrect implementation and parameter validation issues.

Current secure aggregation methods provide only a false sense of security.

Abstract

Secure aggregation is a cryptographic protocol that securely computes the aggregation of its inputs. It is pivotal in keeping model updates private in federated learning. Indeed, the use of secure aggregation prevents the server from learning the value and the source of the individual model updates provided by the users, hampering inference and data attribution attacks. In this work, we show that a malicious server can easily elude secure aggregation as if the latter were not in place. We devise two different attacks capable of inferring information on individual private training datasets, independently of the number of users participating in the secure aggregation. This makes them concrete threats in large-scale, real-world federated learning applications. The attacks are generic and equally effective regardless of the secure aggregation protocol used. They exploit a vulnerability of the federated learning protocol caused by incorrect usage of secure aggregation and lack of parameter validation. Our work demonstrates that current implementations of federated learning with secure aggregation offer only a "false sense of security".