Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

SAFELearning: Enable Backdoor Detectability In Federated Learning With Secure Aggregation

Zhuosheng Zhang, Jiarui Li, Shucheng Yu, Christian Makaya

TL;DR

SAFELearning addresses the challenge of detecting backdoor attacks in federated learning when secure aggregation hides local model updates. It introduces two primitives, oblivious random grouping (ORG) and partial parameter disclosure (PPD), organized within a tree-based secure aggregation framework to enable anomaly detection while preserving privacy. The scheme reduces computational and communication complexity compared with prior secure aggregation methods and is backed by formal security proofs, plus extensive experiments showing effective backdoor mitigation with minimal impact on main task accuracy. The approach offers a practical path to robust, privacy-preserving federated learning with integrated backdoor defense.

Abstract

For model privacy, local model parameters in federated learning shall be obfuscated before sent to the remote aggregator. This technique is referred to as \emph{secure aggregation}. However, secure aggregation makes model poisoning attacks such backdooring more convenient considering that existing anomaly detection methods mostly require access to plaintext local models. This paper proposes SAFELearning which supports backdoor detection for secure aggregation. We achieve this through two new primitives - \emph{oblivious random grouping (ORG)} and \emph{partial parameter disclosure (PPD)}. ORG partitions participants into one-time random subgroups with group configurations oblivious to participants; PPD allows secure partial disclosure of aggregated subgroup models for anomaly detection without leaking individual model privacy. SAFELearning can significantly reduce backdoor model accuracy without jeopardizing the main task accuracy under common backdoor strategies. Extensive experiments show SAFELearning is robust against malicious and faulty participants, whilst being more efficient than the state-of-art secure aggregation protocol in terms of both communication and computation costs.

SAFELearning: Enable Backdoor Detectability In Federated Learning With Secure Aggregation

TL;DR

SAFELearning addresses the challenge of detecting backdoor attacks in federated learning when secure aggregation hides local model updates. It introduces two primitives, oblivious random grouping (ORG) and partial parameter disclosure (PPD), organized within a tree-based secure aggregation framework to enable anomaly detection while preserving privacy. The scheme reduces computational and communication complexity compared with prior secure aggregation methods and is backed by formal security proofs, plus extensive experiments showing effective backdoor mitigation with minimal impact on main task accuracy. The approach offers a practical path to robust, privacy-preserving federated learning with integrated backdoor defense.

Abstract

For model privacy, local model parameters in federated learning shall be obfuscated before sent to the remote aggregator. This technique is referred to as \emph{secure aggregation}. However, secure aggregation makes model poisoning attacks such backdooring more convenient considering that existing anomaly detection methods mostly require access to plaintext local models. This paper proposes SAFELearning which supports backdoor detection for secure aggregation. We achieve this through two new primitives - \emph{oblivious random grouping (ORG)} and \emph{partial parameter disclosure (PPD)}. ORG partitions participants into one-time random subgroups with group configurations oblivious to participants; PPD allows secure partial disclosure of aggregated subgroup models for anomaly detection without leaking individual model privacy. SAFELearning can significantly reduce backdoor model accuracy without jeopardizing the main task accuracy under common backdoor strategies. Extensive experiments show SAFELearning is robust against malicious and faulty participants, whilst being more efficient than the state-of-art secure aggregation protocol in terms of both communication and computation costs.

Paper Structure

This paper contains 27 sections, 5 theorems, 24 equations, 12 figures, 3 tables, 1 algorithm.

Table of Contents

  1. Introduction
  2. Models and Preliminaries
  3. System Model
  4. Attack Model
  5. Attacker Strategies
  6. Secure Aggregation with Pairwise Masking
  7. Overview of SAFELearning Design
  8. Tree-Based ORG and Secure Aggregation
  9. Tree Structure Definition
  10. Tree-Based Random Subgroup Generation
  11. Oblivious Secure Aggregation
  12. Backdoor Attack Detection
  13. Privacy-Preserving PPD
  14. Backdoor Attack Detection
  15. Numerical Complexity
  16. ...and 12 more sections

Key Result

Theorem 1

Let $\{X_i\}_{i\in [1,N]}$ be $N$ samples from some arbitrary distribution with mean vector $\overline{\mathbb{E}}(X)$ and variance $\overline{\sigma}_N^2$. The probability bound is:

Figures (12)

  • Figure 1: Backdoor/main model accuracy of bonawitz2017practical with one attacker.
  • Figure 2: Continuous attacks - scale factor vs. number of iterations
  • Figure 3: The random tree structure (blue and green dotted lines indicate subgroups at levels 2 and 3 respectively).
  • Figure 4: Tree structure generation protocol.
  • Figure 5: Graph representation of users inside a subgroup. Red nodes represent attackers. Edges denote pairwise masking relationship.
  • ...and 7 more figures

Theorems & Definitions (14)

  • Theorem 1
  • proof
  • Theorem 2
  • proof
  • Theorem 3
  • proof
  • Theorem 4
  • proof
  • Theorem 5
  • proof
  • ...and 4 more