Concealing Backdoor Model Updates in Federated Learning by Trigger-Optimized Data Poisoning
This addresses security vulnerabilities in Federated Learning for privacy-sensitive applications, representing a novel attack method rather than an incremental improvement.
The paper tackles the problem of backdoor attacks in Federated Learning by proposing DPOT, a strategy that optimizes triggers to minimize the effect of poisoned data on model updates, which undermines state-of-the-art defenses and outperforms existing attacks on various datasets.
Federated Learning (FL) is a decentralized machine learning method that enables participants to collaboratively train a model without sharing their private data. Despite its privacy and scalability benefits, FL is susceptible to backdoor attacks, where adversaries poison the local training data of a subset of clients using a backdoor trigger, aiming to make the aggregated model produce malicious results when the same backdoor condition is met by an inference-time input. Existing backdoor attacks in FL suffer from common deficiencies: fixed trigger patterns and reliance on the assistance of model poisoning. State-of-the-art defenses based on analyzing clients' model updates exhibit a good defense performance on these attacks because of the significant divergence between malicious and benign client model updates. To effectively conceal malicious model updates among benign ones, we propose DPOT, a backdoor attack strategy in FL that dynamically constructs backdoor objectives by optimizing a backdoor trigger, making backdoor data have minimal effect on model updates. We provide theoretical justifications for DPOT's attacking principle and display experimental results showing that DPOT, via only a data-poisoning attack, effectively undermines state-of-the-art defenses and outperforms existing backdoor attack techniques on various datasets.