Digital twins for monitoring server attacks in federated learning environments
A digital twin is intertwined with a central server and configured to generate acceptability distributions based on updates received from clients at the server in the federated learning system. The acceptability distributions, which may account for the probability of transmission failures, are used to identify anomalous behaviors, including anomalies in global gradient updates, server attacks and/or suspicious behavior.
1 . A method comprising:
receiving local updates at a central server from clients that are each associated with a local model, wherein the local updates include local gradients and a belief score;
communicating the local updates to a digital twin of the central server;
generating a distribution using the local updates and a global update, the global update including a global gradient update to be sent to the clients;
determining whether the global update is anomalous based on the distribution; and
performing a corrective action when any anomaly is observed in the global gradient update.
2 . The method of claim 1 , wherein the belief score includes a probability of transmission failure related to transmitting the local updates.
3 . The method of claim 1 , further comprising modeling each of the local gradients as a list of random variables.
4 . The method of claim 1 , further comprising modelling each of the local gradients obtained by local training as obtained from a normal distribution
∼
𝒩
(
μ
i
x
,
θ
i
x
2
)
,
wherein an average μ i x is a gradient element G i x received by the digital twin and a standard deviation θ i x will be given by the product between the standard deviation θ i of the gradient i across all client gradients, wherein the belief score is a probability b i x of not having a failure during this transmission.
5 . The method of claim 4 , wherein a final aggregate gradient value is a weighted average of normal distributions, wherein the weighted average of normal distributions is a normal distribution G l ˜ (μ i , θ i 2 ).
6 . The method of claim 4 , further comprising determining a standard deviation that is a product between a standard deviation of a gradient across all client gradients and the belief score.
7 . The method of claim 6 , further comprising determining an acceptability distribution for each of the gradients.
8 . The method of claim 7 , further comprising determining a mean and a variance for the acceptability distributions.
9 . The method of claim 8 , further comprising identifying anomalous gradients based on the mean and the variance, wherein anomalous gradients are gradients outside of a confidence interval defined by the variance.
10 . The method of claim 1 , wherein the corrective actions include stopping a federated learning operation in which the clients and the central server are participating.
11 . A non-transitory storage medium having stored therein instructions that are executable by one or more hardware processors to perform operations comprising:
receiving local updates at a central server from clients that are each associated with a local model, wherein the local updates include local gradients and a belief score;
communicating the local updates to a digital twin of the central server;
generating a distribution using the local updates and a global update, the global update including a global gradient update to be sent to the clients;
determining whether the global update is anomalous based on the distribution; and
performing a corrective action when any anomaly is observed in the global gradient update.
12 . The non-transitory storage medium of claim 11 , wherein the belief score includes a probability of transmission failure related to transmitting the local update.
13 . The non-transitory storage medium of claim 11 , further comprising modeling each of the local gradients as a list of random variables.
14 . The non-transitory storage medium of claim 11 , further comprising modelling each of the local gradients obtained by local training as obtained from a normal distribution
∼
𝒩
(
μ
i
x
,
θ
i
x
2
)
,
wherein an average μ i x is a gradient element G i x received by the digital twin and a standard deviation θ i x will be given by the product between the standard deviation θ i of the gradient i across all client gradients, wherein the belief score is a probability b i x of not having a failure during this transmission.
15 . The non-transitory storage medium of claim 14 , wherein a final aggregate gradient value is a weighted average of normal distributions, wherein the weighted average of normal distributions is a normal distribution G l ˜ (μ i , θ i 2 ).
16 . The non-transitory storage medium of claim 14 , further comprising determining a standard deviation that is a product between a standard deviation of a gradient across all client gradients and the belief score.
17 . The non-transitory storage medium of claim 16 , further comprising determining an acceptability distribution for each of the gradients.
18 . The non-transitory storage medium of claim 17 , further comprising determining a mean and a variance for the acceptability distributions.
19 . The non-transitory storage medium of claim 18 , further comprising identifying anomalous gradients based on the mean and the variance, wherein anomalous gradients are gradients outside of a confidence interval defined by the variance.
20 . The non-transitory storage medium of claim 11 , wherein the corrective actions include stopping a federated learning operation in which the clients and the central server are participating.