FLARE: Defending Federated Learning Against Model Poisoning Attacks via Latent Space Representations
Ning Wang, Chaoyu Zhang, Yang Xiao, Yimin Chen, Wenjing Lou, Y. Thomas Hou · IEEE Transactions on Dependable and Secure Computing · 2024
Federated learning (FL) has been shown vulnerable to a new class of adversarial attacks, known asmodel poisoning attacks (MPA), where one or more malicious clients try to poison the global model by sending carefully crafted local model updates to the central parameter server. Existing defenses that have been fixated on analyzing model parameters show limited effectiveness in detecting such malicious models. In this work, we proposeFLARE, a robust model aggregation mechanism for FL, which is resilient against state-of-the-art MPAs. Instead of solely depending on model parameters,FLAREleverages thepenultimate layer representations (PLRs)of the model for characterizing the adversarial influence on each local model update. We further propose a trust evaluation method that estimates a trust score for each model update based on pairwise PLR discrepancies among all model updates. Under the assumption of honest majority,FLAREassigns a low trust score to model updates that are far from the benign cluster.FLAREthen aggregates the model updates weighted by their trust scores and finally updates the global model. Extensive experimental results demonstrate the effectiveness ofFLAREin defending FL against various MPAs, including semantic backdoor attacks, trojan backdoor attacks, and untargeted attacks, in various FL systems.