FLMJR: Improving Robustness of Federated Learning via Model Stability

Abstract

Federated Learning (FL) is vulnerable to model poisoning attacks that hurt the joint training global model by sending malicious updates. Existing defenses rely heavily on restrictions on clients’ model updates to defend against attacks. However, the global model can be attacked by elaborate malicious perturbation under defensive restriction due to the sensitivity of the model to perturbations, which leads the model to be vulnerable. Therefore, in this work, we investigate the defense against attacks from a novel perspective of the model stability towards perturbation on parameters. We propose a new method named Federated Learning with Model Jacobian Regularization (FLMJR) to enhance the robustness of FL. Considering prediction volatility of the model is determined by the model-output Jacobian, we reduce the Jacobian regularization to improve model stability towards model perturbations while maintaining the model’s accuracy. We conduct extensive experiments under both IID and NonIID settings to evaluate the defense against state-of-the-art model poisoning attacks, which demonstrates that our method not only has superior fidelity and robustness, but can also be easily integrated to further improve the robustness of existing server-based robust aggregation approaches (e.g., Fedavg, Trimean, Median, Bulyan, and FLTrust).

Q. Guo and D. Wu—Equal contribution.

Appendices

A Impact of Hyperparameter $\lambda$

Fig. 6.

Impact of $\lambda$ on CIFAR10 with the IID setting and MNIST with the NonIID setting

To explore the impact of hyperparameter $\lambda$, we evaluate the defense performance of Trimean with and without FLMJR under LIE attacks with different $\lambda$. The experiment results are presented in Fig. 6. Accordingly, the selection of $\lambda$ determines the effects of FLMJR. On CIFAR10 with the IID setting, when $\lambda$ is set to $10^{-5}$, the impact of Model Jacobian Regularization is weak, which can not help the FL system to defend against attacks. Therefore, the global model only achieves the highest accuracy of $60.27\%$. While $\lambda$ is set to $10^{-4}$, the integration of FLMJR helps the model achieve the trade-off between robustness and availability. The accuracy of the global model has achieved $65.95\%$ and the impact of LIE attack is almost eliminated. With $\lambda$ growing to $10^{-3}$, the fraction of the Model Jacobian Regularization is large, which makes the Jacobian regularization dominant the training objective. As a result, the global model only has the highest accuracy of $55.50\%$ and can not achieve a satisfying performance as a general model.

Similarly, on the MNIST with the NonIID setting, while $\lambda$ is set to a large value, the global model can not achieve a general performance. On the contrary, while $\lambda$ is set to a small value, the global model is still affected by the attacks. As a result, the choice of $\lambda$ determines the balance between robustness and the general performance of the model. Therefore, for a specific situation, we need to carefully tune $\lambda$ to achieve a trade-off between the accuracy and the robustness. Note that, the accuracy start to decrease after reaching a certain peak value. This is because the impact of attack continues to increase after attacks are successful until the model loses availability (i.e., the accuracy reaches about 10%). Meanwhile, we can also find that a larger $\lambda =10^{-3}$ can still mitigate the attack impact under such extreme conditions to improve model availability (i.e., the accuracy reaches about 20%).

B Empirical Validation of the Generalization Ability of FLMJR

Fig. 7.

Empirical validation of the generalization ability of FLMJR

To further validate the generalization ability of FLMJR in the IID scenario with no attacks applied, we additionally conduct empirical evaluations on CIFAR10 dataset. Specifically, we estimate the generalization improvement of FLMJR on FL system with different aggregations. Besides the robust aggregations we used in main paper, we also evaluate the performance of FLMJR on generic aggregations including Fedavg [16], FedProx [15] and Scaffold [11]. As shown in Fig. 7, the integration of FLMJR enhance the performance of all the aggregations in the IID scenario. With Bulyan and Scafflod aggregations, the integration of FLMJR can slightly improve the generalization ability of the global model. Where as on Trimean, Fedavg, Median and FedProx, FLMJR can obviously enhance the performance of these aggregations.