Targeted Attacks and Defenses for Distributed Federated Learning in Vehicular Networks

TL;DR

The paper addresses the security of distributed federated learning (DFL) in vehicular networks by designing targeted data poisoning and backdoor attacks and evaluating their impact on anomaly detection. It demonstrates that while DFL offers robustness relative to isolated learning, sophisticated attacks can still degrade performance, with backdoor attacks showing strong potential to mislead under certain conditions. To bolster resilience, the authors propose clustering-based defenses against targeted poisoning and MAD-based anomaly detection against backdoors, reporting substantial improvements in malicious-label detection. The findings, validated on the VeReMi Extension dataset, highlight practical defense strategies with realistic runtimes, advancing secure, decentralized learning for edge-enabled defense and safety in dynamic vehicular environments.

Abstract

In emerging networked systems, mobile edge devices such as ground vehicles and unmanned aerial system (UAS) swarms collectively aggregate vast amounts of data to make machine learning decisions such as threat detection in remote, dynamic, and infrastructure-constrained environments where power and bandwidth are scarce. Federated learning (FL) addresses these constraints and privacy concerns by enabling nodes to share local model weights for deep neural networks instead of raw data, facilitating more reliable decision-making than individual learning. However, conventional FL relies on a central server to coordinate model updates in each learning round, which imposes significant computational burdens on the central node and may not be feasible due to the connectivity constraints. By eliminating dependence on a central server, distributed federated learning (DFL) offers scalability, resilience to node failures, learning robustness, and more effective defense strategies. Despite these advantages, DFL remains vulnerable to increasingly advanced and stealthy cyberattacks. In this paper, we design sophisticated targeted training data poisoning and backdoor (Trojan) attacks, and characterize the emerging vulnerabilities in a vehicular network. We analyze how DFL provides resilience against such attacks compared to individual learning and present effective defense mechanisms to further strengthen DFL against the emerging cyber threats.

Figures (7)

• Figure 1: Poisoning attack on DFL, where false information is injected to the learning process.
• Figure 2: Targeted poisoning attack. The adversary alters the labels ($y$) of nodes from Malicious ($M$) to Benign ($B$) (i.e., $y:M \rightarrow B)$.
• Figure 3: Backdoor attack, where the adversary selectively alters the input features $x$ and the corresponding labels $y$ of node-$n$ from $M$ to $B$ during training (upper figure). The attacked samples are colored red (e.g., $i\in\{2,N\}$). We manipulate features $(\mathrm{pos}_1,\mathrm{pos}_2)$ ($2$ out of $22$ input features, $j$) in our experiments that may target one or multiple nodes. During the test time (lower figure), triggers are added to the features ($\hat{x}$), e.g., $i\in\{1,4,999\}$, to evaluate the performance of attack that aims to result in ($\hat{y}$).
• Figure 4: Finer position-based backdoor attack results.
• Figure 5: Targeted poisoning attack FN vs. TP curves with and without prior knowledge on statistics.