CRFL: Certifiably Robust Federated Learning against Backdoor Attacks
CRFL: Certifiably Robust Federated Learning against Backdoor Attacks
Translation in progress — untranslated text is omitted.
The researchers propose the CRFL framework, which controls global model smoothness by clipping and smoothing model parameters, trains federated learning models that are certifiably robust against backdoor attacks, and provides sample-level robustness certification against backdoors with bounded magnitude. The problem this work addresses is that malicious clients can implant backdoors into the trained global model through poisoning and model replacement, while existing robust aggregation methods lack robustness certification. The certification also gives relationships with federated learning parameters such as the instance-level poisoning ratio, the number of attackers, and the number of training iterations. The paper conducts experiments on multiple federated learning datasets, provides the first benchmark for certified robustness against backdoors in federated learning, and the code is open-sourced at https://github.com/AI-secure/CRFL。
- In federated learning, malicious clients can inject backdoors through model replacement, while existing robust aggregation and empirical training protocols lack robustness certification against backdoors.
- CRFL performs norm clipping and adds Gaussian noise on the server side when training the aggregated model; at test time it performs parameter smoothing on the final model and takes a majority vote; theoretically it uses the Markov Kernel contraction coefficient to bound the KL divergence between the models obtained from clean and poisoned training, then via the parameter smoothing theorem gives a per-sample certified radius.
- On multiclass logistic regression and MNIST, EMNIST, and LOAN, the certified radius increases as the training noise σ increases, but accuracy decreases; the larger the number of attackers R, the poisoning ratio, and the scaling factor, the smaller the certifiable radius; under RFA aggregation the certifiable radius is much larger than under FedAvg; the larger the number of clients N, the larger the radius.
- The experiments cover only multiclass logistic regression (a convex problem) and three datasets; the authors point out that the Lipschitz gradient constant of general neural networks with respect to data inputs is difficult to compute efficiently, and that numerical issues with the Gaussian CDF prevent the certified radius from continuing to increase with the number of training rounds T.