一句话：提出 FedSlice，通过将服务器端模型切片分发给参与者，在联邦学习中以低开销防御多种恶意攻击。
众包联邦学习（CFL）中，搭便车、对抗、梯度泄漏和推理等攻击会威胁 DNN 模型隐私，而传统防御因重加密或依赖 TEE 效率较低。本文提出 FedSlice：将服务器端模型切分成多个切片，每个参与者仅获得一个切片，因此恶意参与者只能访问服务器端模型的一个子集，难以有效发动攻击，同时维持 CFL 性能目标。评估显示，FedSlice 将服务器端模型泄漏率从 100% 降至 43.45%，对抗攻击成功率从 100% 降至 11.66%，成员推理平均准确率从 71.91% 降至 51.58%，共享梯度数据泄漏降至随机猜测水平；仅引入不到 2% 精度损失和约 14% 计算开销。作者称这是首篇讨论 CFL 框架中这些攻击防御的论文。
Crowdsourcing Federated learning (CFL) is a new crowdsourcing development paradigm for the Deep Neural Network (DNN) models, also called “software 2.0”. In practice, the privacy of CFL can be compromised by many attacks, such as free-rider attacks, adversarial attacks, gradient leakage attacks, and inference attacks. Conventional defensive techniques have low efficiency because they deploy heavy encryption techniques or rely on Trusted Execution Environments (TEEs). To improve the efficiency of protecting CFL from these attacks, this paper proposes FedSlice to prevent malicious participants from getting the whole server-side model while keeping the performance goal of CFL. FedSlice breaks the server-side model into several slices and delivers one slice to each participant. Thus, a malicious participant can only get a subset of the server-side model, preventing them from effectively conducting effective attacks. We evaluate FedSlice against these attacks, and results show that FedSlice provides effective defense: the server-side model leakage is reduced from 100% to 43.45%, the success rate of adversarial attacks is reduced from 100% to 11.66%, the average accuracy of membership inference is reduced from 71.91% to 51.58%, and the data leakage from shared gradients is reduced to the level of random guesses. Besides, FedSlice only introduces less than 2% accuracy loss and about 14% computation overhead. To the best of our knowledge, this is the first paper to discuss defense methods against these attacks to the CFL framework.
@inproceedings{ZhangLLCLGC23,
title = {FedSlice: Protecting Federated Learning Models from Malicious Participants with Model Slicing},
author = {Ziqi Zhang and Yuanchun Li and Bingyan Liu and Yifeng Cai and Ding Li and Yao Guo and Xiangqun Chen},
booktitle = {ICSE},
year = {2023},
doi = {10.1109/icse48619.2023.00049}
}