Detecting client isolation attacks in federated learning through overfitting monitoring
One example method includes receiving at a client node of a federation a global machine-learning model that is to be trained by the client node using a training dataset that is local to the client node. In response to receiving the global machine-learning model, determining at the client node if the global machine-learning model is trending toward an overfitted state using a validation dataset. The overfitted state indicates that the global machine-learning model has not been received from a server that is part of the federation because of a client isolation attack. In response to determining that the global machine-learning model is trending towards the overfitting state, causing the client node to leave the federation. In response to determining that the global machine-learning model is not trending towards the overfitted state, training the global machine-learning model using the training dataset to thereby update the global machine-learning model.
1. A method, comprising:
receiving at a client node of a federation a global machine-learning model that is to be trained by the client node using a training dataset that is local to the client node;
in response to receiving the global machine-learning model, determining at the client node if the global machine-learning model is trending toward an overfitted state using a validation dataset, the validation dataset being a subset of data local to the client node that is not included in the training dataset, the overfitted state being indicative that the global machine-learning model has not been received from a server that is part of the federation because of a client isolation attack on the client node, wherein determining if the global machine-learning model is trending toward an overfitted state using the validation dataset comprises:
determining a training error when the global machine-learning model is trained using the training dataset;
determining a validation error when the global machine-learning model is trained using the validation dataset;
comparing the training error to a training error threshold; and
comparing the validation error to a validation error threshold, and it is indicative that the global machine-learning model is in the overfitted state when the training error is above the training error threshold and the validation error is below the validation error threshold;
in response to determining that the global machine-learning model is trending towards the overfitting state, causing the client node to leave the federation; and
in response to determining that the global machine-learning model is not trending towards the overfitted state, training the global machine-learning model using the training dataset to thereby update the global machine-learning model.
2. The method of claim 1 , further comprising:
sending the updated global machine-learning model to the server.
3. The method of claim 1 , wherein the global machine-learning model is received from a malicious party who has intercepted a process flow between the client node and the server during the client isolation attack.
4. The method of claim 3 , wherein leaving the federation comprises causing the client node to interrupt communication with the server and/or the malicious party.
5. The method of claim 1 , further comprising:
generating the training dataset and the validation dataset prior to training the global machine-learning model.
6. The method of claim 5 , wherein generating the training dataset and the validation dataset comprises splitting an overall dataset that is local to the client node into at least the training dataset and the validation dataset.
7. The method of claim 1 , wherein it is indicative that the global machine-learning model is received from the server when the training error is below the training error threshold and the validation error is below the validation error threshold.
8. The method of claim 1 , wherein determining if the global machine-learning model is trending toward an overfitted state using the validation dataset comprises:
using the validation dataset as an input into a validation process that is configured to output a result indicating the overfitted state.
9. A non-transitory storage medium having stored therein instructions that are executable by one or more hardware processors to perform operations comprising:
receiving at a client node of a federation a global machine-learning model that is to be trained by the client node using a training dataset that is local to the client node;
in response to receiving the global machine-learning model, determining at the client node if the global machine-learning model is trending toward an overfitted state using a validation dataset, the validation dataset being a subset of data local to the client node that is not included in the training dataset, the overfitted state being indicative that the global machine-learning model has not been received from a server that is part of the federation because of a client isolation attack on the client node, wherein determining if the global machine-learning model is trending toward an overfitted state using the validation dataset comprises:
determining a training error when the global machine-learning model is trained using the training dataset;
determining a validation error when the global machine-learning model is trained using the validation dataset;
comparing the training error to a training error threshold; and
comparing the validation error to a validation error threshold, and it is indicative that the global machine-learning model is in the overfitted state when the training error is above the training error threshold and the validation error is below the validation error threshold;
in response to determining that the global machine-learning model is trending towards the overfitting state, causing the client node to leave the federation; and
in response to determining that the global machine-learning model is not trending towards the overfitted state, training the global machine-learning model using the training dataset to thereby update the global machine-learning model.
10. The non-transitory storage medium of claim 9 , further comprising the following operation:
sending the updated global machine-learning model to the server.
11. The non-transitory storage medium of claim 9 , wherein the global machine-learning model is received from a malicious party who has intercepted a process flow between the client node and the server during the client isolation attack.
12. The non-transitory storage medium of claim 11 , wherein leaving the federation comprises causing the client node to interrupt communication with the server and/or the malicious party.
13. The non-transitory storage medium of claim 9 , further comprising the following operation:
generating the training dataset and the validation dataset prior to training the global machine-learning model.
14. The non-transitory storage medium of claim 13 , wherein generating the training dataset and the validation dataset comprises splitting an overall dataset that is local to the client node into at least the training dataset and the validation dataset.
15. The non-transitory storage medium of claim 9 , wherein it is indicative that the global machine-learning model is received from the server when the training error is below the training error threshold and the validation error is below the validation error threshold.
16. The non-transitory storage medium of claim 9 , wherein determining if the global machine-learning model is trending toward an overfitted state using the validation dataset comprises:
using the validation dataset as an input into a validation process that is configured to output a result indicating the overfitted state.