FAT: Federated Adversarial Training
This research addresses the critical problem of securing federated learning models against adversarial attacks for organizations and individuals concerned with both data privacy and model integrity. It is an incremental step in combining existing methods.
This paper explores Federated Adversarial Training (FAT) to enhance model robustness against evasion attacks in federated learning while preserving data privacy. The authors investigate FAT's effectiveness on datasets like MNIST, Fashion-MNIST, and CIFAR10, and identify challenges in achieving adversarial robustness in federated settings. They also demonstrate that common federated learning defenses like Trimmed Mean, Bulyan, and Krum can be compromised, with a novel distillation-based attack subverting Krum.
Federated learning (FL) is one of the most important paradigms addressing privacy and data governance issues in machine learning (ML). Adversarial training has emerged, so far, as the most promising approach against evasion threats on ML models. In this paper, we take the first known steps towards federated adversarial training (FAT) combining both methods to reduce the threat of evasion during inference while preserving the data privacy during training. We investigate the effectiveness of the FAT protocol for idealised federated settings using MNIST, Fashion-MNIST, and CIFAR10, and provide first insights on stabilising the training on the LEAF benchmark dataset which specifically emulates a federated learning environment. We identify challenges with this natural extension of adversarial training with regards to achieved adversarial robustness and further examine the idealised settings in the presence of clients undermining model convergence. We find that Trimmed Mean and Bulyan defences can be compromised and we were able to subvert Krum with a novel distillation based attack which presents an apparently "robust" model to the defender while in fact the model fails to provide robustness against simple attack modifications.