Invariant Aggregator for Defending against Federated Backdoor Attacks
Xiaoyang Wang, Dimitrios Dimitriadis, Sanmi Koyejo, Shruti Tople

TL;DR
This paper introduces an invariant aggregator for federated learning that effectively defends against backdoor attacks by focusing on invariant update directions, ensuring model robustness without sacrificing utility.
Contribution
The paper proposes a novel invariant aggregator that mitigates backdoor attacks in federated learning by masking malicious update elements, with theoretical guarantees and empirical validation.
Findings
Effectively mitigates backdoor attacks across multiple datasets.
Maintains high model utility with negligible performance loss.
Provably robust against attacks on flat loss landscapes.
Abstract
Federated learning enables training high-utility models across several clients without directly sharing their private data. As a downside, the federated setting makes the model vulnerable to various adversarial attacks in the presence of malicious clients. Despite the theoretical and empirical success in defending against attacks that aim to degrade models' utility, defense against backdoor attacks that increase model accuracy on backdoor samples exclusively without hurting the utility on other samples remains challenging. To this end, we first analyze the failure modes of existing defenses over a flat loss landscape, which is common for well-designed neural networks such as Resnet (He et al., 2015) but is often overlooked by previous works. Then, we propose an invariant aggregator that redirects the aggregated update to invariant directions that are generally useful via selectively…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
Taxonomy
TopicsPrivacy-Preserving Technologies in Data · Adversarial Robustness in Machine Learning · Artificial Intelligence in Healthcare and Education
MethodsAverage Pooling · Batch Normalization · 1x1 Convolution · Max Pooling · Residual Connection · Residual Block · Kaiming Initialization · Global Average Pooling · *Communicated@Fast*How Do I Communicate to Expedia? · Bottleneck Residual Block
