Get Rid Of Your Trail: Remotely Erasing Backdoors in Federated Learning

TL;DR

This paper introduces a novel method for adversaries in federated learning to effectively erase backdoors from the central model using machine unlearning techniques, enhancing stealth and security.

Contribution

It is the first work to apply machine unlearning in federated learning for backdoor removal, balancing model performance and unlearning precision.

Findings

Effective backdoor removal demonstrated across multiple attack scenarios.

Preserves model accuracy while erasing malicious backdoors.

Applicable to image classification tasks with state-of-the-art attacks.

Abstract

Federated Learning (FL) enables collaborative deep learning training across multiple participants without exposing sensitive personal data. However, the distributed nature of FL and the unvetted participants' data makes it vulnerable to backdoor attacks. In these attacks, adversaries inject malicious functionality into the centralized model during training, leading to intentional misclassifications for specific adversary-chosen inputs. While previous research has demonstrated successful injections of persistent backdoors in FL, the persistence also poses a challenge, as their existence in the centralized model can prompt the central aggregation server to take preventive measures to penalize the adversaries. Therefore, this paper proposes a methodology that enables adversaries to effectively remove backdoors from the centralized model upon achieving their objectives or upon suspicion of possible detection. The proposed approach extends the concept of machine unlearning and presents strategies to preserve the performance of the centralized model and simultaneously prevent over-unlearning of information unrelated to backdoor patterns, making the adversaries stealthy while removing backdoors. To the best of our knowledge, this is the first work that explores machine unlearning in FL to remove backdoors to the benefit of adversaries. Exhaustive evaluation considering image classification scenarios demonstrates the efficacy of the proposed method in efficient backdoor removal from the centralized model, injected by state-of-the-art attacks across multiple configurations.