论文标题
在连续训练下进行防御联邦后门攻击的防御
Towards a Defense Against Federated Backdoor Attacks Under Continuous Training
论文作者
论文摘要
在联邦学习（FL）中，后门攻击是危险的，难以预防，在长时间内，培训数据是从不受信任的客户那里采购的。出现这些困难是因为：（a）佛罗里达州的防守者无法获得原始培训数据，（b）我们确定的一种新现象称为后门泄漏，导致经过训练的模型不断训练，最终由于防御机制的累积错误而遭受了后门。我们提出了影子学习，这是一个在长期训练下在FL环境中防御后门攻击的框架。阴影学习并行训练两个模型：一个骨干模型和阴影模型。对骨干进行了训练，没有任何防御机制，可以在主要任务上获得良好的表现。影子模型将恶意客户端的过滤与早期阶段相结合，以控制攻击成功率，即使数据分布发生了变化。从理论上讲，我们激励我们的设计，并通过实验表明我们的框架可以显着改善现有的防御后门攻击。
Backdoor attacks are dangerous and difficult to prevent in federated learning (FL), where training data is sourced from untrusted clients over long periods of time. These difficulties arise because: (a) defenders in FL do not have access to raw training data, and (b) a new phenomenon we identify called backdoor leakage causes models trained continuously to eventually suffer from backdoors due to cumulative errors in defense mechanisms. We propose shadow learning, a framework for defending against backdoor attacks in the FL setting under long-range training. Shadow learning trains two models in parallel: a backbone model and a shadow model. The backbone is trained without any defense mechanism to obtain good performance on the main task. The shadow model combines filtering of malicious clients with early-stopping to control the attack success rate even as the data distribution changes. We theoretically motivate our design and show experimentally that our framework significantly improves upon existing defenses against backdoor attacks.
