Unraveling the Connections between Privacy and Certified Robustness in Federated Learning Against Poisoning Attacks
Chulin Xie, Yunhui Long, Pin-Yu Chen, Qinbin Li, Arash Nourian, Sanmi Koyejo, Bo Li
TL;DR
The paper dissects how differential privacy in Federated Learning interacts with certified robustness against poisoning attacks, introducing two robustness criteria: certified prediction and certified attack inefficacy. It develops formal guarantees for both user-level and instance-level DPFL, showing that DP can yield certifiable resilience against a bounded number of adversaries, with robustness scaling with privacy parameters and data characteristics. The authors analyze privacy under DP-FL, provide improved privacy guarantees for FedSGD and FedAvg, and extend certifiability to instance-level DPFL, all supported by extensive experiments on MNIST, CIFAR, and Sent140 under multiple poisoning attacks. Empirically, stronger privacy generally enhances certified attack inefficacy but exhibits a nuanced effect on certified prediction, underscoring a privacy-utility tradeoff. The work offers a principled framework for measuring and improving private and robust FL deployments, highlighting practical guidance for selecting DP mechanisms and accounting approaches to achieve desired certification levels.
Abstract
Federated learning (FL) provides an efficient paradigm to jointly train a global model leveraging data from distributed users. As local training data comes from different users who may not be trustworthy, several studies have shown that FL is vulnerable to poisoning attacks. Meanwhile, to protect the privacy of local users, FL is usually trained in a differentially private way (DPFL). Thus, in this paper, we ask: What are the underlying connections between differential privacy and certified robustness in FL against poisoning attacks? Can we leverage the innate privacy property of DPFL to provide certified robustness for FL? Can we further improve the privacy of FL to improve such robustness certification? We first investigate both user-level and instance-level privacy of FL and provide formal privacy analysis to achieve improved instance-level privacy. We then provide two robustness certification criteria: certified prediction and certified attack inefficacy for DPFL on both user and instance levels. Theoretically, we provide the certified robustness of DPFL based on both criteria given a bounded number of adversarial users or instances. Empirically, we conduct extensive experiments to verify our theories under a range of poisoning attacks on different datasets. We find that increasing the level of privacy protection in DPFL results in stronger certified attack inefficacy; however, it does not necessarily lead to a stronger certified prediction. Thus, achieving the optimal certified prediction requires a proper balance between privacy and utility loss.