Identifying Backdoor Attacks in Federated Learning via Anomaly Detection

TL;DR

This paper introduces ARIBA, a novel anomaly detection-based method to identify and mitigate backdoor attacks in federated learning by analyzing the statistical distribution of model gradients.

Contribution

The paper presents a new defense approach, ARIBA, that detects backdoors by examining gradient distributions and outlier segments, improving security in federated learning.

Findings

ARIBA effectively detects backdoor attacks with high accuracy.

The method minimally impacts the overall model utility.

It outperforms existing defenses in experimental evaluations.

Abstract

Federated learning has seen increased adoption in recent years in response to the growing regulatory demand for data privacy. However, the opaque local training process of federated learning also sparks rising concerns about model faithfulness. For instance, studies have revealed that federated learning is vulnerable to backdoor attacks, whereby a compromised participant can stealthily modify the model's behavior in the presence of backdoor triggers. This paper proposes an effective defense against the attack by examining shared model updates. We begin with the observation that the embedding of backdoors influences the participants' local model weights in terms of the magnitude and orientation of their model gradients, which can manifest as distinguishable disparities. We enable a robust identification of backdoors by studying the statistical distribution of the models' subsets of gradients. Concretely, we first segment the model gradients into fragment vectors that represent small portions of model parameters. We then employ anomaly detection to locate the distributionally skewed fragments and prune the participants with the most outliers. We embody the findings in a novel defense method, ARIBA. We demonstrate through extensive analyses that our proposed methods effectively mitigate state-of-the-art backdoor attacks with minimal impact on task utility.