Logit Calibration and Feature Contrast for Robust Federated Learning on Non-IID Data

TL;DR

FatCC is proposed, which incorporates local logit Calibration and global feature Contrast into the vanilla federated adversarial training (Fat) process from both logit and feature perspectives, which enhances the robust accuracy (RA) and clean accuracy (CA) of the federated system.

Abstract

Federated learning (FL) is a privacy-preserving distributed framework for collaborative model training on devices in edge networks. However, challenges arise due to vulnerability to adversarial examples (AEs) and the non-independent and identically distributed (non-IID) nature of data distribution among devices, hindering the deployment of adversarially robust and accurate learning models at the edge. While adversarial training (AT) is commonly acknowledged as an effective defense strategy against adversarial attacks in centralized training, we shed light on the adverse effects of directly applying AT in FL that can severely compromise accuracy, especially in non-IID challenges. Given this limitation, this paper proposes FatCC, which incorporates local logit \underline{C}alibration and global feature \underline{C}ontrast into the vanilla federated adversarial training (\underline{FAT}) process from both logit and feature perspectives. This approach can effectively enhance the federated system's robust accuracy (RA) and clean accuracy (CA). First, we propose logit calibration, where the logits are calibrated during local adversarial updates, thereby improving adversarial robustness. Second, FatCC introduces feature contrast, which involves a global alignment term that aligns each local representation with unbiased global features, thus further enhancing robustness and accuracy in federated adversarial environments. Extensive experiments across multiple datasets demonstrate that FatCC achieves comparable or superior performance gains in both CA and RA compared to other baselines.

Figures (6)

• Figure 1: Overview of the proposed FatCC training process. The main difference from the standard FL is mainly in the local training stage (i.e., step 2). During the local AT stage, we introduce a local logit calibration strategy to enhance the adversarial robustness of the local model (Sec. \ref{['subsec:local_re_weight']}). Besides, we propose a global alignment term based on feature contrast to provide a consistency signal for further accuracy improvement (Sec. \ref{['subsec:global_regular']}).
• Figure 2: CA (%) comparison between FST and FAT strategies under both IID and non-IID scenarios with Fashion-MNIST dataset.
• Figure 3: Illustration of CA and RA comparisons with varying levels of label skewness on MNIST and FashionMNIST datasets. The two figures on the left present comparisons under MNIST, while the two figures on the right depict comparisons under FashionMNIST.
• Figure 4: Illustration of CA and RA comparisons with different numbers of clients on MNIST and CIFAR-10 datasets with Dir(0.5). The two figures on the left present comparisons under MNIST, while the two figures on the right depict comparisons under CIFAR-10.
• Figure 5: Comparison of communication efficiency of different benchmarks on CA, RA (FGSM), and RA (PGD-40) on MNIST. The comparisons start with CA, followed by RA under FGSM and PGD-40 attacks, respectively, from left to right.