MPAF: Model Poisoning Attacks to Federated Learning based on Fake Clients
Existing model poisoning attacks to federated learning assume that an attacker has access to a large fraction of compromised genuine clients. However, such assumption is not realistic in production federated learning systems that involve millions of clients. In this work, we propose the first Model Poisoning Attack based on Fake clients called MPAF. Specifically, we assume the attacker injects fake clients to a federated learning system and sends carefully crafted fake local model updates to the cloud server during training, such that the learnt global model has low accuracy for many indiscriminate test inputs. Towards this goal, our attack drags the global model towards an attacker-chosen base model that has low accuracy. Specifically, in each round of federated learning, the fake clients craft fake local model updates that point to the base model and scale them up to amplify their impact before sending them to the cloud server. Our experiments show that MPAF can significantly decrease the test accuracy of the global model, even if classical defenses and norm clipping are adopted, highlighting the need for more advanced defenses.
Code (1)
Tasks
Federated LearningModel PoisoningMethods 이 논문이 사용한 방법론
Similar Papers 제목 키워드 기반
FLCert: Provably Secure Federated Learning against Poisoning Attacks
Due to its distributed nature, federated learning is vulnerable to poisoning attacks, in which malicious clients poison the training process via manipulating their local training data and/or local model updates sent to t…
Federated LearningPoisoning Attacks and Defenses to Federated Unlearning
Federated learning allows multiple clients to collaboratively train a global model with the assistance of a server. However, its distributed nature makes it susceptible to poisoning attacks, where malicious clients can c…
Federated LearningCATFL: Certificateless Authentication-based Trustworthy Federated Learning for 6G Semantic Communications
Federated learning (FL) provides an emerging approach for collaboratively training semantic encoder/decoder models of semantic communication systems, without private user data leaving the devices. Most existing studies o…
Data PoisoningDecoderFederated LearningManagement+2FedRecover: Recovering from Poisoning Attacks in Federated Learning using Historical Information
Federated learning is vulnerable to poisoning attacks in which malicious clients poison the global model via sending malicious model updates to the server. Existing defenses focus on preventing a small number of maliciou…
Federated LearningPoisoning Attacks and Defenses in Federated Learning: A Survey
Federated learning (FL) enables the training of models among distributed clients without compromising the privacy of training datasets, while the invisibility of clients datasets and the training process poses a variety …
Federated LearningSurvey