Backdoor Attacks in Federated Learning by Rare Embeddings and Gradient Ensembling
It addresses security vulnerabilities in federated learning for NLP applications, presenting an incremental improvement in attack methods.
The paper tackles backdoor attacks in federated learning by using rare word embeddings and gradient ensembling, achieving manipulation with less than 1% of adversary clients in text classification and as low as 0.1% for simpler datasets without performance drop on clean data.
Recent advances in federated learning have demonstrated its promising capability to learn on decentralized datasets. However, a considerable amount of work has raised concerns due to the potential risks of adversaries participating in the framework to poison the global model for an adversarial purpose. This paper investigates the feasibility of model poisoning for backdoor attacks through rare word embeddings of NLP models. In text classification, less than 1% of adversary clients suffices to manipulate the model output without any drop in the performance on clean sentences. For a less complex dataset, a mere 0.1% of adversary clients is enough to poison the global model effectively. We also propose a technique specialized in the federated learning scheme called Gradient Ensemble, which enhances the backdoor performance in all our experimental settings.