Data and Model Poisoning Backdoor Attacks on Wireless Federated Learning, and the Defense Mechanisms: A Comprehensive Survey

TL;DR

This comprehensive survey reviews recent backdoor attacks and defense strategies in wireless federated learning, highlighting vulnerabilities, classification of attack types, and discussing future research challenges in securing WFL systems.

Contribution

It provides a detailed classification and analysis of backdoor attack methods and defense mechanisms in wireless federated learning, identifying gaps and future directions.

Findings

Existing attack strategies have specific strengths and limitations.

Defense mechanisms vary in effectiveness depending on the attack phase.

Open challenges include improving robustness and privacy in WFL.

Abstract

Due to the greatly improved capabilities of devices, massive data, and increasing concern about data privacy, Federated Learning (FL) has been increasingly considered for applications to wireless communication networks (WCNs). Wireless FL (WFL) is a distributed method of training a global deep learning model in which a large number of participants each train a local model on their training datasets and then upload the local model updates to a central server. However, in general, non-independent and identically distributed (non-IID) data of WCNs raises concerns about robustness, as a malicious participant could potentially inject a "backdoor" into the global model by uploading poisoned data or models over WCN. This could cause the model to misclassify malicious inputs as a specific target class while behaving normally with benign inputs. This survey provides a comprehensive review of the latest backdoor attacks and defense mechanisms. It classifies them according to their targets (data poisoning or model poisoning), the attack phase (local data collection, training, or aggregation), and defense stage (local training, before aggregation, during aggregation, or after aggregation). The strengths and limitations of existing attack strategies and defense mechanisms are analyzed in detail. Comparisons of existing attack methods and defense designs are carried out, pointing to noteworthy findings, open challenges, and potential future research directions related to security and privacy of WFL.