Identify Backdoored Model in Federated Learning via Individual Unlearning

TL;DR

This paper introduces MASA, a novel method using individual unlearning to detect backdoored models in federated learning, effectively identifying malicious models even in challenging non-IID data settings.

Contribution

It is the first to leverage machine unlearning for backdoor detection in federated learning, with a new anomaly detection metric and model fusion for non-IID data.

Findings

MASA effectively detects backdoored models across various attacks.

The method performs well in both IID and non-IID data scenarios.

Extensive experiments validate the approach's robustness and effectiveness.

Abstract

Backdoor attacks present a significant threat to the robustness of Federated Learning (FL) due to their stealth and effectiveness. They maintain both the main task of the FL system and the backdoor task simultaneously, causing malicious models to appear statistically similar to benign ones, which enables them to evade detection by existing defense methods. We find that malicious parameters in backdoored models are inactive on the main task, resulting in a significantly large empirical loss during the machine unlearning process on clean inputs. Inspired by this, we propose MASA, a method that utilizes individual unlearning on local models to identify malicious models in FL. To improve the performance of MASA in challenging non-independent and identically distributed (non-IID) settings, we design pre-unlearning model fusion that integrates local models with knowledge learned from other datasets to mitigate the divergence in their unlearning behaviors caused by the non-IID data distributions of clients. Additionally, we propose a new anomaly detection metric with minimal hyperparameters to filter out malicious models efficiently. Extensive experiments on IID and non-IID datasets across six different attacks validate the effectiveness of MASA. To the best of our knowledge, this is the first work to leverage machine unlearning to identify malicious models in FL. Code is available at \url{https://github.com/JiiahaoXU/MASA}.