Towards a Defense Against Federated Backdoor Attacks Under Continuous Training

Shuaiqi Wang, Jonathan Hayase, Giulia Fanti, Sewoong Oh

Abstract: Backdoor attacks are dangerous and difficult to prevent in federated learning (FL), where training data is sourced from untrusted clients over long periods of time. These difficulties arise because: (a) defenders in FL do not have access to raw training data, and (b) a phenomenon we identify called backdoor leakage causes models trained continuously to eventually suffer from backdoors due to cumulative errors in defense mechanisms. We propose a framework called shadow learning for defending against backdoor attacks in the FL setting under long-range training. Shadow learning trains two models in parallel: a backbone model and a shadow model. The backbone is trained without any defense mechanism to obtain good performance on the main task. The shadow model combines filtering of malicious clients with early-stopping to control the attack success rate even as the data distribution changes. We theoretically motivate our design and show experimentally that our framework significantly improves upon existing defenses against backdoor attacks.

Submission Length: Regular submission (no more than 12 pages of main content)

Code: https://github.com/wsqwsq/Towards-a-Defense-against-Backdoor-Attacks-in-Continual-Federated-Learning

Assigned Action Editor: ~Murat_A_Erdogdu1

License: Creative Commons Attribution 4.0 International (CC BY 4.0)

Submission Number: 1004