Search papers, labs, and topics across Lattice.
This paper analyzes the transferability of adversarial examples across different client models in federated learning (FL) to address vulnerabilities posed by adversarial attacks. The authors reveal that traditional poisoning and Byzantine attacks are less effective in realistic FL settings due to strong assumptions about client behavior. They propose a novel defense mechanism based on adversarial training that enhances model robustness against transferable adversarial examples, demonstrating superior performance on real-life datasets compared to existing methods.
Transferable adversarial examples can exploit vulnerabilities in federated learning, but a new defense mechanism shows how to turn this threat into a strength.
The development of federated learning (FL) techniques has helped improve the privacy preservation of users'data and extended the applications of machine learning models. However, the involvement of a large number of users in FL also creates open opportunities for different adversaries, such as poisoning attacks, Byzantine attacks, and adversarial example attacks. Yet, recent research has disclosed that existing poisoning attacks and Byzantine attacks can not achieve satisfactory penetration in realistic FL scenarios caused by strong assumptions, \textit{e.g.,} client selection rate, and the ratio of malicious attackers. In this paper, the transferability of adversarial examples among different client models is analyzed to understand the relation between adversarial examples and clients'data distribution. Moreover, to mitigate the attacks of transferable adversarial examples, we design a defense mechanism stemming from the transferability of model robustness by adversarial training. As a result, through theoretical analysis of transferability, we gain insights into adversarial examples and the vulnerability of federated learning systems. Our proposed adversarial attack and defense methods are evaluated via real-life datasets in various settings to show their performance over the existing state-of-the-art methods.
