Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Performance Guaranteed Poisoning Attacks in Federated Learning: A Sliding Mode Approach

Huazi Pan, Yanjun Zhang, Leo Yu Zhang, Scott Adams, Abbas Kouzani, Suiyang Khoo

TL;DR

This work tackles the problem of controllable poisoning attacks in federated learning, where an attacker aims to degrade global model performance to a predefined objective with adjustable speed. The authors propose FedSA, a sliding mode control–based attack that treats the FL process as a nonlinear dynamic system and enforces a finite-time convergence toward a poisoned reference model $ ilde{w}$ by steering the global state through a designed sliding surface. FedSA offers provable guarantees on convergence and allows dynamic adjustment of attack objectives via a constant $C$ and convergence speed via the gain $k$, enabling stealthier, faster, and more flexible poisoning than prior approaches. Extensive experiments on CIFAR-10, MNIST, and Tiny ImageNet against a broad set of Byzantine-robust defenses show FedSA achieving near-target accuracies with relatively few malicious clients, highlighting a pressing need for defense mechanisms specifically designed to counter controllable poisoning, including asynchronous FL scenarios in future work.

Abstract

Manipulation of local training data and local updates, i.e., the poisoning attack, is the main threat arising from the collaborative nature of the federated learning (FL) paradigm. Most existing poisoning attacks aim to manipulate local data/models in a way that causes denial-of-service (DoS) issues. In this paper, we introduce a novel attack method, named Federated Learning Sliding Attack (FedSA) scheme, aiming at precisely introducing the extent of poisoning in a subtle controlled manner. It operates with a predefined objective, such as reducing global model's prediction accuracy by 10%. FedSA integrates robust nonlinear control-Sliding Mode Control (SMC) theory with model poisoning attacks. It can manipulate the updates from malicious clients to drive the global model towards a compromised state, achieving this at a controlled and inconspicuous rate. Additionally, leveraging the robust control properties of FedSA allows precise control over the convergence bounds, enabling the attacker to set the global accuracy of the poisoned model to any desired level. Experimental results demonstrate that FedSA can accurately achieve a predefined global accuracy with fewer malicious clients while maintaining a high level of stealth and adjustable learning rates.

Performance Guaranteed Poisoning Attacks in Federated Learning: A Sliding Mode Approach

TL;DR

This work tackles the problem of controllable poisoning attacks in federated learning, where an attacker aims to degrade global model performance to a predefined objective with adjustable speed. The authors propose FedSA, a sliding mode control–based attack that treats the FL process as a nonlinear dynamic system and enforces a finite-time convergence toward a poisoned reference model by steering the global state through a designed sliding surface. FedSA offers provable guarantees on convergence and allows dynamic adjustment of attack objectives via a constant and convergence speed via the gain , enabling stealthier, faster, and more flexible poisoning than prior approaches. Extensive experiments on CIFAR-10, MNIST, and Tiny ImageNet against a broad set of Byzantine-robust defenses show FedSA achieving near-target accuracies with relatively few malicious clients, highlighting a pressing need for defense mechanisms specifically designed to counter controllable poisoning, including asynchronous FL scenarios in future work.

Abstract

Manipulation of local training data and local updates, i.e., the poisoning attack, is the main threat arising from the collaborative nature of the federated learning (FL) paradigm. Most existing poisoning attacks aim to manipulate local data/models in a way that causes denial-of-service (DoS) issues. In this paper, we introduce a novel attack method, named Federated Learning Sliding Attack (FedSA) scheme, aiming at precisely introducing the extent of poisoning in a subtle controlled manner. It operates with a predefined objective, such as reducing global model's prediction accuracy by 10%. FedSA integrates robust nonlinear control-Sliding Mode Control (SMC) theory with model poisoning attacks. It can manipulate the updates from malicious clients to drive the global model towards a compromised state, achieving this at a controlled and inconspicuous rate. Additionally, leveraging the robust control properties of FedSA allows precise control over the convergence bounds, enabling the attacker to set the global accuracy of the poisoned model to any desired level. Experimental results demonstrate that FedSA can accurately achieve a predefined global accuracy with fewer malicious clients while maintaining a high level of stealth and adjustable learning rates.

Paper Structure

This paper contains 28 sections, 1 theorem, 17 equations, 12 figures, 2 tables, 1 algorithm.

Table of Contents

  1. Introduction
  2. Background and Related Work
  3. Federated Learning
  4. Poisoning Attacks on FL
  5. Existing Byzantine-robust Defenses
  6. Sliding Mode Control
  7. The Design of FedSA
  8. Problem Formulation
  9. FedSA Details
  10. Performance Evaluation
  11. Experiment Setup
  12. Datasets and Models
  13. FL System Settings
  14. Attack Settings
  15. Evaluation Defenses
  16. ...and 13 more sections

Key Result

Theorem 1

Consider a FL system governed by the dynamics described in Eq. Eq:system with the error function given by Eq. Eq:Error2 and a sliding surface defined by Eq. Eq:surface. Let the control law $u_t$ be designed as in Eq. Eq:controllaw with constants $k > 0$, $\eta > 0$, and $C \in \mathbb{R}$, and the d

Figures (12)

  • Figure 1: Convergence of $s_t$.
  • Figure 2: The comparison of existing attacks and our attack. The attack effect is illustrated via loss contours---blue area indicates low loss and red area indicates high loss.
  • Figure 3: The mechanism of FedSA.
  • Figure 4: Comparison of FMPA and FedSA against various AGRs with different attack objectives on CIFAR10. Comparison figures on MNIST and Tiny ImageNet are given in Supp.-2.2.
  • Figure 5: Ablation Study Results.
  • ...and 7 more figures

Theorems & Definitions (3)

  • Theorem 1
  • proof
  • Remark 1