Adversarially Guided Stateful Defense Against Backdoor Attacks in Federated Deep Learning

TL;DR

This paper introduces AGSD, a novel adversarially guided stateful defense mechanism that effectively detects and mitigates backdoor attacks in federated learning, outperforming existing methods even with limited or no held-out data.

Contribution

The paper proposes AGSD, a new defense that uses adversarial perturbations and trust state history to identify and penalize malicious clients in federated learning.

Findings

AGSD outperforms state-of-the-art defenses in realistic FL settings.

AGSD maintains high accuracy with minimal drop even with limited or no held-out data.

The method is effective against backdoor attacks with small datasets and out-of-distribution data.

Abstract

Recent works have shown that Federated Learning (FL) is vulnerable to backdoor attacks. Existing defenses cluster submitted updates from clients and select the best cluster for aggregation. However, they often rely on unrealistic assumptions regarding client submissions and sampled clients population while choosing the best cluster. We show that in realistic FL settings, state-of-the-art (SOTA) defenses struggle to perform well against backdoor attacks in FL. To address this, we highlight that backdoored submissions are adversarially biased and overconfident compared to clean submissions. We, therefore, propose an Adversarially Guided Stateful Defense (AGSD) against backdoor attacks on Deep Neural Networks (DNNs) in FL scenarios. AGSD employs adversarial perturbations to a small held-out dataset to compute a novel metric, called the trust index, that guides the cluster selection without relying on any unrealistic assumptions regarding client submissions. Moreover, AGSD maintains a trust state history of each client that adaptively penalizes backdoored clients and rewards clean clients. In realistic FL settings, where SOTA defenses mostly fail to resist attacks, AGSD mostly outperforms all SOTA defenses with minimal drop in clean accuracy (5% in the worst-case compared to best accuracy) even when (a) given a very small held-out dataset -- typically AGSD assumes 50 samples (<= 0.1% of the training data) and (b) no heldout dataset is available, and out-of-distribution data is used instead. For reproducibility, our code will be openly available at: https://github.com/hassanalikhatim/AGSD.