Power to the Clients: Federated Learning in a Dictatorship Setting

TL;DR

The paper defines dictator clients as a new threat model for federated learning, where malicious participants preserve their own influence while erasing all others from the global model. It develops attack strategies for single and collaborative dictators and provides theoretical convergence analyses, complemented by empirical validation on computer vision and natural language processing benchmarks. The results show that a single dictator can dominate the global model, while collaborating dictators can erase benign participants, though such coalitions can be unstable and betray one another. The findings highlight the risk of bias toward particular clients in non-IID FL settings and motivate development of defenses for robust aggregation and detection of influence-preserving attacks.

Abstract

Federated learning (FL) has emerged as a promising paradigm for decentralized model training, enabling multiple clients to collaboratively learn a shared model without exchanging their local data. However, the decentralized nature of FL also introduces vulnerabilities, as malicious clients can compromise or manipulate the training process. In this work, we introduce dictator clients, a novel, well-defined, and analytically tractable class of malicious participants capable of entirely erasing the contributions of all other clients from the server model, while preserving their own. We propose concrete attack strategies that empower such clients and systematically analyze their effects on the learning process. Furthermore, we explore complex scenarios involving multiple dictator clients, including cases where they collaborate, act independently, or form an alliance in order to ultimately betray one another. For each of these settings, we provide a theoretical analysis of their impact on the global model's convergence. Our theoretical algorithms and findings about the complex scenarios including multiple dictator clients are further supported by empirical evaluations on both computer vision and natural language processing benchmarks.

Figures (8)

• Figure 1: Regular FL compared to scenarios where one dictator client or collaborative dictator clients try to remove other clients from the training procedure.
• Figure 2: Client 1 and 2 collaborate as dictators until iteration $E$, when client 1 betrays.
• Figure 3: Loss function on each client's dataset, comparing scenarios with no dictator clients and with one dictator client where in this figure client 3 is the dictator client.
• Figure 4: Loss function on each client's dataset, when two clients become collaborative dictators (left) and three clients become collaborative dictators (right).
• Figure 5: Loss functions for mutual domination scenario