Abstract
Federated learning can complete an enormous training task efficiently by inviting participants to train a deep learning model collaboratively, and the user privacy will be well preserved for the users only upload model parameters to the centralized server. However, the attackers can initiate poisoning attacks by uploading malicious updates in federated learning. Therefore, the accuracy of the global model will be impacted significantly after the attack. To address this vulnerability, we propose a novel poisoning defense generative adversarial network (PDGAN) to defend the poising attack. The PDGAN can reconstruct training data from model updates and audit the accuracy for each participant model by using the generated data. Precisely, the participant whose accuracy is lower than a predefined threshold will be identified as an attacker and model parameters of the attacker will be removed from the training procedure in this iteration. Experiments conducted on MNIST and Fashion-MNIST datasets demonstrate that our approach can indeed defend the poisoning attacks in federated learning.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
References
Ribeiro, M., Grolinger, K., Capretz, M.A.M.: MLaaS: machine learning as a service. In: Proceedings 14th International Conference on Machine Learning and Applications (ICMLA 2015), pp. 896–902 (2015)
Hesamifard, E., Takabi, H., Ghasemi, M., Wright, R.N.: Privacy-preserving machine learning as a service. In: Proceedings 19th Privacy Enhancing Technologies Symposium (PETS 2018), pp. 123–142 (2018)
Yu, S.: Big privacy: challenges and opportunities of privacy study in the age of big data. IEEE Access 4, 2751–2763 (2016)
McMahan, H.B., Moore, E., Ramage, D., Hampson, S., Arcas, B.A.: Communication-efficient learning of deep networks from decentralized data. In: Proceedings 20th International Conference on Artificial Intelligence and Statistics (AISTATS 2017), pp. 1–10 (2017)
Yang, Q., Liu, Y., Chen, T., Tong, Y.: Federated machine learning: concept and applications. ACM Trans. Intell. Syst. Technol. 10(2), 1–19 (2019)
Jagielski, M., Oprea, A., Biggio, B., Liu, C., N-Rotaru, C., Li, B.: Manipulating machine learning: poisoning attacks and countermeasures for regression learning. In: Proceedings 39th IEEE Symposium on Security and Privacy (SP 2018), pp. 19–35 (2018)
Biggio, B., Nelson, B., Laskov, P.: Poisoning attacks against support vector machines. In: Proceedings 29th International Conference on Machine Learning (ICML 2012), pp. 1807–1814 (2012)
Fang, M., Yang, G., Gong, N.Z., Liu, J.: Poisoning attacks to graph-based recommender systems. In: Proceedings 34th Annual Computer Security Applications Conference (ACSAC 2018), pp. 381–392 (2018)
Fung, C., Yoon, C.J.M., Beschastnikh, I.: Mitigating sybils in federated learning poisoning (2018). https://arxiv.org/abs/1808.04866
Bonawitz, K., et al.: Practical secure aggregation for privacy-preserving machine learning. In: Proceedings 24th ACM Conference on Computer and Communications Security (CCS 2017), pp. 1175–1191 (2017)
Mohassel, P., Zhang, Y.: SecureML: a system for scalable privacy-preserving machine learning. In: Proceedings 38th IEEE Symposium on Security and Privacy (SP 2017), pp. 19–38 (2017)
Phong, L.T., Aono, Y., Hayashi, T., Moriai, S.: Privacy-preserving deep learning via additively homomorphic encryption. IEEE Trans. Inf. Forensics Secur. 13(5), 1333–1645 (2018)
Blanchard, P., Mhanmdi, E.M.E., Guerraoui, R., Stainer, J.: Machine learning with adversaries: byzantine tolerant gradient descent. In: Proceedings 32th Annual Conference on Neural Information Processing Systems (NIPS 2017), pp. 119–129 (2017)
Yin, D., Chen, Y., Ramchandran, K., Bartlett, P.: Byzantine-robust distributed learning: towards optimal statistical rates. In: Proceedings 35th International Conference on Machine Learning (ICML 2018) (2018)
Shen, S., Tople, S., Saxena, P.: AUROR: defending against poisoning attacks in collaborative deep learning systems. In: Proceedings 32nd Annual Computer Security Applications Conference (ACSAC 2016), pp. 508–519 (2016)
Baracaldo, N., Chen, B., Ludwig, H., Safavi, J.A.: Mitigating poisoning attacks on machine learning models: a data provenance based approach. In: Proceedings 10th ACM Workshop on Artificial Intelligence and Security (AISec 2017), pp. 103–110 (2017)
Shokri, R., Shmatikov, V.: Privacy-preserving deep learning. In: Proceedings 22nd ACM Conference on Computer and Communications Security (CCS 2015), pp. 1310–1321 (2015)
Zhang, X., Felix, X.Y., Kumar, S., Chang, S.-F.: Learning spread-out local feature descriptors. In: Proceedings IEEE International Conference on Computer Vision (ICCV 2017), pp. 4595–4603 (2017)
Goodfellow, I., et al.: Generative adversarial nets. In: Proceedings 29th Annual Conference on Neural Information Processing Systems (NIPS 2014), pp. 2672–2680 (2014)
Pan, S., Hu, R., Long, G., Jiang, J., Yao, L., Zhang, C.: Adversarially regularized graph autoencoder for graph embedding. In: Proceedings 27th International Joint Conference on Artificial Intelligence (IJCAI 2018) (2018)
Bhagoji, A.N., Chakraborty, S., Mittal, P., Prateek, M., Calo, S.: Analyzing federated learning through an adversarial lens (2018). https://arxiv.org/abs/1811.12470
Wang, Z., Song, M., Zhang, Z., Song, Y., Wang, Q., Qi, H.: Beyond inferring class representatives: user-level privacy leakage from federated learning. In: Proceedings 38th Annual IEEE International Conference on Computer Communications (INFOCOM 2019) (2018)
Hitaj, B., Ateniese, G., Perez-Cruz, F.: Deep models under the GAN: information leakage from collaborative deep learning. In: Proceedings 2017 ACM SIGSAC Conference on Computer and Communications Security (CCS 2017), pp. 603–618 (2017)
LeCun, Y., Bottou, L., Bengio, Y., Haffner, P.: Gradient-based learning applied to document recognition. In: Proceedings of the IEEE, pp. 2278–2324 (1998)
Xiao, H., Rasul, K., Vollgraf, R.: Fashion-MNIST: a novel image dataset for benchmarking machine learning algorithms (2017). https://arxiv.org/abs/1708.07747
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2020 Springer Nature Switzerland AG
About this paper
Cite this paper
Zhao, Y., Chen, J., Zhang, J., Wu, D., Teng, J., Yu, S. (2020). PDGAN: A Novel Poisoning Defense Method in Federated Learning Using Generative Adversarial Network. In: Wen, S., Zomaya, A., Yang, L. (eds) Algorithms and Architectures for Parallel Processing. ICA3PP 2019. Lecture Notes in Computer Science(), vol 11944. Springer, Cham. https://doi.org/10.1007/978-3-030-38991-8_39
Download citation
DOI: https://doi.org/10.1007/978-3-030-38991-8_39
Published:
Publisher Name: Springer, Cham
Print ISBN: 978-3-030-38990-1
Online ISBN: 978-3-030-38991-8
eBook Packages: Mathematics and StatisticsMathematics and Statistics (R0)