Meta Federated Learning: A Federated Learning Backdoor Defense Method Compatible with Secure Aggregation
Meta Federated Learning
Translation in progress — untranslated text is omitted.
The researchers propose Meta Federated Learning (Meta-FL), a new federated learning variant compatible with secure aggregation and capable of supporting backdoor defenses. Existing backdoor defenses require direct access to each client's updates, which is infeasible when secure aggregation is deployed. Evaluations on the SVHN and GTSRB datasets show that Meta-FL has better utility than classical federated learning and enhances the robustness of existing defenses against adversarial attacks.
- After federated learning deploys Secure Aggregation, the server cannot inspect individual client updates, and existing backdoor defenses all rely on inspecting updates one by one and thus fail. The authors aim to answer: can backdoor attacks be defended against when SecAgg is in place?
- Proposes Meta-FL: each round selects multiple training groups, SecAgg is used for aggregation within each group, the server can only see group-level aggregates, and then defenses such as Krum and CWM are executed at the aggregation layer. The authors provide an analysis that the variance of group aggregates is lower than that of individual updates.
- On SVHN and GTSRB, compare Meta-FL and baseline FL under 6 defenses (Krum, CWM, TM, NB, DP, RFA). The authors state that under Meta-FL each defense has higher model accuracy and lower attack success rates for naive and model replacement attacks, with Krum benefiting the most; RFA, DP, NB remain ineffective against model replacement attacks.
- The paper does not specifically discuss limitations. The experiments cover only two image classification datasets, SVHN and GTSRB, pixel-pattern triggers, and two attacks, naive and model replacement; attackers appear at a fixed frequency; the paper does not report point-by-point numerical values of attack success rate or the number of repetitions.
Related papers
Both use: GTSRB
Show 3 more papers
Both use: GTSRB
Both use: SVHN