DeepSight: Mitigating Backdoor Attacks in Federated Learning Through Deep Model Inspection

  • 2022-01-03 17:10:07
  • Phillip Rieger, Thien Duc Nguyen, Markus Miettinen, Ahmad-Reza Sadeghi
  • 14


Federated Learning (FL) allows multiple clients to collaboratively train aNeural Network (NN) model on their private data without revealing the data.Recently, several targeted poisoning attacks against FL have been introduced.These attacks inject a backdoor into the resulting model that allowsadversary-controlled inputs to be misclassified. Existing countermeasuresagainst backdoor attacks are inefficient and often merely aim to excludedeviating models from the aggregation. However, this approach also removesbenign models of clients with deviating data distributions, causing theaggregated model to perform poorly for such clients. To address this problem, we propose DeepSight, a novel model filteringapproach for mitigating backdoor attacks. It is based on three novel techniquesthat allow to characterize the distribution of data used to train model updatesand seek to measure fine-grained differences in the internal structure andoutputs of NNs. Using these techniques, DeepSight can identify suspicious modelupdates. We also develop a scheme that can accurately cluster model updates.Combining the results of both components, DeepSight is able to identify andeliminate model clusters containing poisoned models with high attack impact. Wealso show that the backdoor contributions of possibly undetected poisonedmodels can be effectively mitigated with existing weight clipping-baseddefenses. We evaluate the performance and effectiveness of DeepSight and showthat it can mitigate state-of-the-art backdoor attacks with a negligible impacton the model's performance on benign data.


Quick Read (beta)

loading the full paper ...