Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

SRFed: Mitigating Poisoning Attacks in Privacy-Preserving Federated Learning with Heterogeneous Data

Yiwen Lu

TL;DR

SRFed, an efficient Byzantine-robust and privacy-preserving FL framework for Non-IID scenarios, is proposed, which outperforms state-of-the-art baselines in privacy protection, Byzantine robustness, and efficiency.

Abstract

Federated Learning (FL) enables collaborative model training without exposing clients' private data, and has been widely adopted in privacy-sensitive scenarios. However, FL faces two critical security threats: curious servers that may launch inference attacks to reconstruct clients' private data, and compromised clients that can launch poisoning attacks to disrupt model aggregation. Existing solutions mitigate these attacks by combining mainstream privacy-preserving techniques with defensive aggregation strategies. However, they either incur high computation and communication overhead or perform poorly under non-independent and identically distributed (Non-IID) data settings. To tackle these challenges, we propose SRFed, an efficient Byzantine-robust and privacy-preserving FL framework for Non-IID scenarios. First, we design a decentralized efficient functional encryption (DEFE) scheme to support efficient model encryption and non-interactive decryption. DEFE also eliminates third-party reliance and defends against server-side inference attacks. Second, we develop a privacy-preserving defensive model aggregation mechanism based on DEFE. This mechanism filters poisonous models under Non-IID data by layer-wise projection and clustering-based analysis. Theoretical analysis and extensive experiments show that SRFed outperforms state-of-the-art baselines in privacy protection, Byzantine robustness, and efficiency.

SRFed: Mitigating Poisoning Attacks in Privacy-Preserving Federated Learning with Heterogeneous Data

TL;DR

SRFed, an efficient Byzantine-robust and privacy-preserving FL framework for Non-IID scenarios, is proposed, which outperforms state-of-the-art baselines in privacy protection, Byzantine robustness, and efficiency.

Abstract

Federated Learning (FL) enables collaborative model training without exposing clients' private data, and has been widely adopted in privacy-sensitive scenarios. However, FL faces two critical security threats: curious servers that may launch inference attacks to reconstruct clients' private data, and compromised clients that can launch poisoning attacks to disrupt model aggregation. Existing solutions mitigate these attacks by combining mainstream privacy-preserving techniques with defensive aggregation strategies. However, they either incur high computation and communication overhead or perform poorly under non-independent and identically distributed (Non-IID) data settings. To tackle these challenges, we propose SRFed, an efficient Byzantine-robust and privacy-preserving FL framework for Non-IID scenarios. First, we design a decentralized efficient functional encryption (DEFE) scheme to support efficient model encryption and non-interactive decryption. DEFE also eliminates third-party reliance and defends against server-side inference attacks. Second, we develop a privacy-preserving defensive model aggregation mechanism based on DEFE. This mechanism filters poisonous models under Non-IID data by layer-wise projection and clustering-based analysis. Theoretical analysis and extensive experiments show that SRFed outperforms state-of-the-art baselines in privacy protection, Byzantine robustness, and efficiency.
Paper Structure (33 sections, 4 theorems, 19 equations, 6 figures, 5 tables)

This paper contains 33 sections, 4 theorems, 19 equations, 6 figures, 5 tables.

Table of Contents

  1. Introduction
  2. Related Works
  3. Privacy-Preserving Federated Learning
  4. Privacy-Preserving Federated Learning Against Malicious Participants
  5. Problem Statement
  6. System Model
  7. Threat Model
  8. Design Goals
  9. Building Blocks
  10. NDD-FE Scheme
  11. The Proposed Decentralized Efficient Functional Encryption Scheme
  12. System Design
  13. High-Level Description of SRFed
  14. Construction of SRFed
  15. Initialization
  16. ...and 18 more sections

Key Result

Theorem 6.1

SRFed achieves Honest but Curious Security under the DCR assumption, which means that for all inputs $\{C_t^i, {skf}_{t}^{i} \}_{i=1,...,I}$ and intermediate results ($V_t^i$, $W_{t+1}'$, $W_T$), SRFed holds: $\textbf{REAL}_{\mathcal{A}}^{SRFed}(C_t^i, {skf}_{t}^{i},skf_t^\mathsf{Agg},V_t^i,W_{t+1

Figures (6)

  • Figure 1: The workflow of SRFed.
  • Figure 2: The OA of the models obtained by four benchmarks under label-flipping attack.
  • Figure 3: The SA of the models obtained by four benchmarks under label-flipping attack.
  • Figure 4: The ASR of the models obtained by four benchmarks under label-flipping attack.
  • Figure 5: The OA of the models obtained by four benchmarks under Gaussian attack.
  • ...and 1 more figures

Theorems & Definitions (6)

  • Definition 6.1: Decisional Composite Residuosity (DCR) Assumption DCR
  • Definition 6.2: Honest but Curious Security (HBCS)
  • Theorem 6.1
  • Theorem 6.2
  • Theorem 6.3
  • Theorem 6.4