Defending against adversarial attacks in federated learning
A computer-implemented method, a computer program product, and a computer system for defending against adversarial attacks in federated learning. In the federated learning comprising an aggregator and parties, the aggregator receives weights sent from the respective parties. The aggregator computes values of a performance metric for weight arrays obtained by the respective parties, using a validation dataset. The aggregator ranks the values of the performance metric in a list. The aggregator recursively splits the list in half until one or more adversary updates of the weights are isolated. The aggregator excludes one or more parties that send the one or more adversary updates from participating in a current round of training in the federated learning.
1. A computer-implemented method for defending against adversarial attacks in federated learning, the method comprising:
receiving, by an aggregator in the federated learning, weights sent from respective parties in the federated learning;
computing, by the aggregator, values of a performance metric for weight arrays obtained by the respective parties, using a validation dataset;
ranking, by the aggregator, the values of the performance metric in a list;
recursively splitting, by the aggregator, the list in half, and respective bottom halves thereafter, until one or more adversary updates of the weights are isolated by identifying two halves that are not statistically different and do have a difference in performance;
performing recursive splitting on a top half with higher performance of the two halves that are not statistically different until an honest update in the top half is isolated; and
excluding, by the aggregator, one or more parties that send the one or more adversary updates from participating in a current round of training in the federated learning, wherein the one or more adversary updates are a bottom half of the two halves that are not statistically different and the top half with the honest update excluded.
2. The computer-implemented method of claim 1 , further comprising:
averaging, by the aggregator, the weight arrays obtained by respective remaining parties, to update a global model in the federated learning.
3. The computer-implemented method of claim 1 , for recursively splitting the list, further comprising:
recursively splitting, by the aggregator, a half with lower performance into halves;
computing, by the aggregator, a mean of the values of the performance metric for each of the halves;
comparing, by the aggregator, means for the halves, using a statistical metric;
determining, by the aggregator, whether the halves are statistically different; and
in response to determining that the halves are statistically different, continuing, by the aggregator, recursive splitting.
4. The computer-implemented method of claim 3 , further comprising:
in response to determining that the halves are not statistically different, stopping, by the aggregator, the recursive splitting; and
identifying, by the aggregator, updates corresponding to current halves as the adversary updates.
5. The computer-implemented method of claim 3 , further comprising:
in response to determining that the halves are not statistically different, starting, by the aggregator, backtracking to recursively split a half with higher performance into two partitions;
computing, by the aggregator, a mean of the values of the performance metric for each of the two partitions;
comparing, by the aggregator, means for the two partitions, using the statistical metric;
determining, by the aggregator, whether the two partitions are statistically different;
in response to determining that the two partitions are not statistically different, continuing, by the aggregator, the backtracking, until a point separating honest updates and the one or more adversarial updates is found; and
in response to determining that the two partitions are statistically different, recursively splitting, by the aggregator, a partition with lower performance.
6. A computer program product for defending against adversarial attacks in federated learning, the computer program product comprising a computer readable storage medium having program instructions embodied therewith, the program instructions executable by one or more processors, the program instructions executable to:
receive, by an aggregator in the federated learning, weights sent from respective parties in the federated learning;
compute, by the aggregator, values of a performance metric for weight arrays obtained by the respective parties, using a validation dataset;
rank, by the aggregator, the values of the performance metric in a list;
recursively split, by the aggregator, the list in half, and respective bottom halves thereafter, until one or more adversary updates of the weights are isolated by identifying two halves that are not statistically different and do have a difference in performance;
perform recursive splitting on a top half with higher performance of the two halves that are not statistically different until an honest update in the top half is isolated; and
exclude, by the aggregator, one or more parties that send the one or more adversary updates from participating in a current round of training in the federated learning, wherein the one or more adversary updates are a bottom half of the two halves that are not statistically different and the top half with the honest update excluded.
7. The computer program product of claim 6 , further comprising the program instructions executable to:
average, by the aggregator, the weight arrays obtained by respective remaining parties, to update a global model in the federated learning.
8. The computer program product of claim 6 , for recursively splitting the list, further comprising the program instructions executable to:
recursively split, by the aggregator, a half with lower performance into halves;
compute, by the aggregator, a mean of the values of the performance metric for each of the halves;
compare, by the aggregator, means for the halves, using a statistical metric;
determine, by the aggregator, whether the halves are statistically different; and
in response to determining that the halves are statistically different, continue, by the aggregator, recursive splitting.
9. The computer program product of claim 8 , further comprising the program instructions executable to:
in response to determining that the halves are not statistically different, stop, by the aggregator, the recursive splitting; and
identify, by the aggregator, updates corresponding to current halves as the adversary updates.
10. The computer program product of claim 8 , further comprising program instructions executable to:
in response to determining that the halves are not statistically different, start, by the aggregator, backtracking to recursively split a half with higher performance into two partitions;
compute, by the aggregator, a mean of the values of the performance metric for each of the two partitions;
compare, by the aggregator, means for the two partitions, using the statistical metric;
determine, by the aggregator, whether the two partitions are statistically different;
in response to determining that the two partitions are not statistically different, continue, by the aggregator, the backtracking, until a point separating honest updates and the one or more adversarial updates is found; and
in response to determining that the two partitions are statistically different, recursively split, by the aggregator, a partition with lower performance.
11. A computer system for defending against adversarial attacks in federated learning, the computer system comprising one or more processors, one or more computer readable tangible storage devices, and program instructions stored on at least one of the one or more computer readable tangible storage devices for execution by at least one of the one or more processors, the program instructions executable to:
receive, by an aggregator in the federated learning, weights sent from respective parties in the federated learning;
compute, by the aggregator, values of a performance metric for weight arrays obtained by the respective parties, using a validation dataset;
rank, by the aggregator, the values of the performance metric in a list;
recursively split, by the aggregator, the list in half, and respective bottom halves thereafter, until one or more adversary updates of the weights are isolated by identifying two halves that are not statistically different and do have a difference in performance;
perform recursive splitting on a top half with higher performance of the two halves that are not statistically different until an honest update in the top half is isolated; and
exclude, by the aggregator, one or more parties that send the one or more adversary updates from participating in a current round of training in the federated learning, wherein the one or more adversary updates are a bottom half of the two halves that are not statistically different and the top half with the honest update excluded.
12. The computer system of claim 11 , further comprising the program instructions executable to:
average, by the aggregator, the weight arrays obtained by respective remaining parties, to update a global model in the federated learning.
13. The computer system of claim 11 , for recursively splitting the list, further comprising the program instructions executable to:
recursively split, by the aggregator, a half with lower performance into halves;
compute, by the aggregator, a mean of the values of the performance metric for each of the halves;
compare, by the aggregator, means for the halves, using a statistical metric;
determine, by the aggregator, whether the halves are statistically different; and
in response to determining that the halves are statistically different, continue, by the aggregator, recursive splitting.
14. The computer system of claim 13 , further comprising the program instructions executable to:
in response to determining that the halves are not statistically different, stop, by the aggregator, the recursive splitting; and
identify, by the aggregator, updates corresponding to current halves as the adversary updates.
15. The computer system of claim 13 , further comprising program instructions executable to:
in response to determining that the halves are not statistically different, starting, by the aggregator, backtracking to recursively split a half with higher performance into two partitions;
compute, by the aggregator, a mean of the values of the performance metric for each of the two partitions;
compare, by the aggregator, means for the two partitions, using the statistical metric;
determine, by the aggregator, whether the two partitions are statistically different;
in response to determining that the two partitions are not statistically different, continue, by the aggregator, the backtracking, until a point separating honest updates and the one or more adversarial updates is found; and
in response to determining that the two partitions are statistically different, recursively split, by the aggregator, a partition with lower performance.
16. A computer-implemented method for defending against adversarial attacks in federated learning, the method comprising:
receiving, by an aggregator in the federated learning, weights sent from respective parties in the federated learning;
computing, by the aggregator, values of loss for weight arrays obtained by the respective parties, using a validation dataset;
ranking, by the aggregator, the values of the loss in a list;
recursively splitting, by the aggregator, the list in half, and respective bottom halves thereafter, until one or more adversary updates of the weights are isolated by identifying two halves that are not statistically different and do have a difference in performance;
performing recursive splitting on a top half with higher performance of the two halves that are not statistically different until an honest update in the top half is isolated; and
excluding, by the aggregator, one or more parties that send the one or more adversary updates from participating in a current round of training in the federated learning, wherein the one or more adversary updates are a bottom half of the two halves that are not statistically different and the top half with the honest update excluded.
17. The computer-implemented method of claim 16 , further comprising:
averaging, by the aggregator, the weight arrays obtained by respective remaining parties, to update a global model in the federated learning.
18. The computer-implemented method of claim 16 , for recursively splitting the list, further comprising:
recursively split, by the aggregator, a half with higher loss values into halves;
computing, by the aggregator, a mean of the values of the loss for each of the halves;
comparing, by the aggregator, means for the halves, using a t-test;
determining, by the aggregator, whether the halves are statistically different; and
in response to determining that the halves are statistically different, continuing, by the aggregator, recursive splitting.
19. The computer-implemented method of claim 18 , further comprising:
in response to determining that the halves are not statistically different, stopping, by the aggregator, the recursive splitting; and
identifying, by the aggregator, updates corresponding to current halves as the adversary updates.
20. The computer-implemented method of claim 18 , further comprising:
in response to determining that the halves are not statistically different, starting, by the aggregator, backtracking to recursively split a half with lower loss values into two partitions;
computing, by the aggregator, a mean of the values of the loss for each of the two partitions;
comparing, by the aggregator, means for the two partitions, using the t-test;
determining, by the aggregator, whether the two partitions are statistically different;
in response to determining that the two partitions are not statistically different, continuing, by the aggregator, the backtracking, until a point separating honest updates and the one or more adversarial updates is found; and
in response to determining that the two partitions are statistically different, recursively splitting, by the aggregator, a partition with higher loss values.
21. A computer-implemented method for defending against adversarial attacks in federated learning, the method comprising:
receiving, by an aggregator in the federated learning, weights sent from respective parties in the federated learning;
computing, by the aggregator, values of accuracy for weight arrays obtained by the respective parties, using a validation dataset;
ranking, by the aggregator, the values of the accuracy in a list;
recursively splitting, by the aggregator, the list in half, and respective bottom halves thereafter, until one or more adversary updates of the weights are isolated by identifying two halves that are not statistically different and do have a difference in performance;
performing recursive splitting on a top half with higher performance of the two halves that are not statistically different until an honest update in the top half is isolated; and
excluding, by the aggregator, one or more parties that send the one or more adversary updates from participating in a current round of training in the federated learning, wherein the one or more adversary updates are a bottom half of the two halves that are not statistically different and the top half with the honest update excluded.
22. The computer-implemented method of claim 21 , further comprising:
averaging, by the aggregator, the weight arrays obtained by respective remaining parties, to update a global model in the federated learning.
23. The computer-implemented method of claim 21 , for recursively splitting the list, further comprising:
recursively split, by the aggregator, a half with lower accuracy values into halves;
computing, by the aggregator, a mean of the values of the accuracy for each of the halves;
comparing, by the aggregator, means for the halves, using a t-test;
determining, by the aggregator, whether the halves are statistically different; and
in response to determining that the halves are statistically different, continuing, by the aggregator, recursive splitting.
24. The computer-implemented method of claim 23 , further comprising:
in response to determining that the halves are not statistically different, stopping, by the aggregator, the recursive splitting; and
identifying, by the aggregator, updates corresponding to current halves as the adversary updates.
25. The computer-implemented method of claim 23 , further comprising:
in response to determining that the halves are not statistically different, starting, by the aggregator, backtracking to recursively split a half with higher accuracy values into two partitions;
computing, by the aggregator, a mean of the values of the accuracy for each of the two partitions;
comparing, by the aggregator, means for the two partitions, using the t-test;
determining, by the aggregator, whether the two partitions are statistically different;
in response to determining that the two partitions are not statistically different, continuing, by the aggregator, the backtracking, until a point separating honest updates and the one or more adversarial updates is found; and
in response to determining that the two partitions are statistically different, recursively splitting, by the aggregator, a partition with lower accuracy values.