Uncheatable federated learning
In one embodiment, a device identifies a plurality of nodes of a distributed or federated learning system. The device receives model training results from the plurality of nodes. The device determines, based in part on the model training results or information about the plurality of nodes, whether a particular node or subset of nodes in the plurality of nodes provided fraudulent model training results. The device initiates a corrective measure with respect to the particular node or subset of nodes, based on a determination that the particular node or subset of nodes provided fraudulent model training results, in accordance with a policy.
1 . A method comprising:
identifying, by a device, a plurality of nodes of a distributed or federated learning system;
receiving, at the device, model training results from the plurality of nodes;
computing, by the device, a risk score for each node in the plurality of nodes based at least in part on the model training results;
determining that the risk score of one or more first nodes of the plurality of nodes satisfies a threshold; and
in response to determining that the risk score of one or more first nodes satisfies the threshold:
testing, by the device, the one or more first nodes;
classifying, by the device and based at least in part on the testing, the model training results from the one or more first nodes as fraudulent model training results, wherein the fraudulent model training results are indicative of the one or more first nodes not performing requested training, performing the requested training on a partial or incorrect dataset, or delegating the requested training; and
initiating, by the device, a corrective measure with respect to the one or more first nodes in accordance with a policy.
2 . The method as in claim 1 , wherein the plurality of nodes each train a machine learning model using local training data, to generate the model training results.
3 . The method as in claim 1 , wherein nodes in the plurality of nodes are geographically distributed.
4 . The method as in claim 1 , wherein the corrective measure entails blocking the one or more first nodes from performing further model training in the distributed or federated learning system.
5 . The method as in claim 1 , wherein the risk score of the one or more first nodes indicates a probability of the one or more first nodes supplying fraudulent model training results.
6 . The method as in claim 1 , wherein the testing comprises:
sending a honeypot machine learning model to the one or more first nodes on which it is supposed to generate its model training results, wherein the honeypot machine learning model includes one or more neurons that are not updated by the one or more first nodes during model training.
7 . The method as in claim 1 , wherein the testing comprises:
sending incorrect model weights to the one or more first nodes for model training, to assess how the one or more first nodes responds.
8 . The method as in claim 1 , wherein the testing comprises:
comparing the model training results of the one or more first nodes to those of one or more second nodes in the plurality of nodes.
9 . The method as in claim 1 , wherein the corrective measure comprises rolling back a machine learning model trained based in part on the model training results from the one or more first nodes.
10 . The method as in claim 1 , further comprising:
aggregating at least a portion of the model training results into an aggregated machine learning model.
11 . An apparatus, comprising:
one or more network interfaces;
a processor coupled to the one or more network interfaces; and
a memory configured to store instructions that, when executed by the processor, configure the processor to:
identify a plurality of nodes of a distributed or federated learning system;
receive model training results from the plurality of nodes;
compute a risk score for each node in the plurality of nodes based at least in part on the model training results or metadata regarding each node;
determine that the risk score of one or more first nodes of the plurality of nodes satisfies a threshold; and
in response to the determination that the risk score of one or more first nodes satisfies the threshold:
test the one or more first nodes;
classify, based at least in part on the test, the model training results from the one or more first nodes as fraudulent model training results, wherein the fraudulent model training results are indicative of the one or more first nodes not performing requested training, performing the requested training on a partial or incorrect dataset, or delegating the requested training; and
initiate a corrective measure with respect to the one or more first nodes in accordance with a policy.
12 . The apparatus as in claim 11 , wherein the plurality of nodes each train a machine learning model using local training data, to generate the model training results.
13 . The apparatus as in claim 11 , wherein nodes in the plurality of nodes are geographically distributed.
14 . The apparatus as in claim 11 , wherein the corrective measure entails blocking the one or more first nodes from performing further model training in the distributed or federated learning system.
15 . The apparatus as in claim 11 , wherein the risk score of the one or more first nodes indicates a probability of the one or more first nodes supplying fraudulent model training results.
16 . The apparatus as in claim 11 , wherein the testing comprises:
sending a honeypot machine learning model to the one or more first nodes on which it is supposed to generate its model training results, wherein the honeypot machine learning model includes one or more neurons that should not be updated by the one or more first nodes during model training.
17 . The apparatus as in claim 11 , wherein the testing comprises:
sending incorrect model weights to the one or more first nodes for model training, to assess how the one or more first nodes responds.
18 . The apparatus as in claim 11 , wherein the testing comprises:
comparing the model training results of the one or more first nodes to those of one or more second nodes in the plurality of nodes.
19 . The apparatus as in claim 11 , wherein the corrective measure comprises rolling back a machine learning model trained based in part on the model training results from the one or more first nodes.
20 . A tangible, non-transitory, computer-readable medium storing program instructions that cause a device to execute a process comprising:
identifying, by the device, a plurality of nodes of a distributed or federated learning system;
receiving, at the device, model training results from the plurality of nodes;
computing, by the device, a risk score for each node in the plurality of nodes based at least in part on the model training results or metadata regarding each node;
determining that the risk score of one or more first nodes of the plurality of nodes satisfies a threshold; and
based at least in part on determining that the risk score of one or more first nodes satisfies the threshold:
testing the one or more first nodes;
classifying, based at least in part on the testing, the model training results from the one or more first nodes as fraudulent model training results, wherein the fraudulent model training results are indicative of the one or more first nodes not performing requested training, performing the requested training on a partial or incorrect dataset, or delegating the requested training; and
initiating, by the device, a corrective measure with respect to the one or more first nodes in accordance with a policy.