[go: up one dir, main page]
More Web Proxy on the site http://driver.im/ skip to main content
10.1145/3548606.3560611acmconferencesArticle/Chapter ViewAbstractPublication PagesccsConference Proceedingsconference-collections
research-article

EIFFeL: Ensuring Integrity for Federated Learning

Published: 07 November 2022 Publication History

Abstract

Federated learning (FL) enables clients to collaborate with a server to train a machine learning model. To ensure privacy, the server performs secure aggregation of updates from the clients. Unfortunately, this prevents verification of the well-formedness (integrity) of the updates as the updates are masked. Consequently, malformed updates designed to poison the model can be injected without detection. In this paper, we formalize the problem of ensuring both update privacy and integrity in FL and present a new system, EIFFeL, that enables secure aggregation of verified updates. EIFFeL is a general framework that can enforce arbitrary integrity checks and remove malformed updates from the aggregate, without violating privacy. Our empirical evaluation demonstrates the practicality of EIFFeL. For instance, with 100 clients and 10% poisoning, EIFFeL can train an MNIST classification model to the same accuracy as that of a non-poisoned federated learner in just 2.4s per iteration.

References

[1]
https://libntl.org/.
[2]
Youtube system requirements. https://support.google.com/youtube/answer/ 78358?hl=en.
[3]
Gergely Ács and Claude Castelluccia. I have a dream! differentially private smart metering. In Proceedings of the 13th International Conference on Information Hiding, IH'11, page 118--132, Berlin, Heidelberg, 2011. Springer-Verlag.
[4]
Nir Ailon and Bernard Chazelle. Approximate nearest neighbors and the fast johnson-lindenstrauss transform. In Proceedings of the Thirty-Eighth Annual ACM Symposium on Theory of Computing, STOC '06, page 557--563, New York, NY, USA, 2006. Association for Computing Machinery.
[5]
Eugene Bagdasaryan, Andreas Veit, Yiqing Hua, Deborah Estrin, and Vitaly Shmatikov. How to backdoor federated learning. In arXiv:1807.00459, 2018.
[6]
Raef Bassily, Albert Cheu, Shay Moran, Aleksandar Nikolov, Jonathan Ullman, and Zhiwei Steven Wu. Private query release assisted by public data. In ICML, 2020.
[7]
Donald Beaver. Efficient multiparty protocols using circuit randomization. In Joan Feigenbaum, editor, Advances in Cryptology - CRYPTO '91, pages 420--432, Berlin, Heidelberg, 1992. Springer Berlin Heidelberg.
[8]
Amos Beimel, Aleksandra Korolova, Kobbi Nissim, Or Sheffet, and Uri Stemmer. The power of synergy in differential privacy: Combining a small curator with local randomizers. In ITC, 2020.
[9]
James Henry Bell, Kallista A. Bonawitz, Adrià Gascón, Tancrède Lepoint, and Mar- iana Raykova. Secure single-server aggregation with (poly)logarithmic overhead. In Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communica- tions Security, CCS '20, page 1253--1269, New York, NY, USA, 2020. Association for Computing Machinery.
[10]
Arjun Nitin Bhagoji, Supriyo Chakraborty, Prateek Mittal, and Seraphin Calo. Analyzing federated learning through an adversarial lens. In Proceedings of the International Conference on Machine Learning, pages 634--643, 2019.
[11]
Abhishek Bhowmick, John C. Duchi, Julien Freudiger, Gaurav Kapoor, and Ryan M. Rogers. Protection against reconstruction and its applications in private federated learning. ArXiv, abs/1812.00984, 2018.
[12]
Battista Biggio, Blaine Nelson, and Pavel Laskov. Poisoning attacks against sup- port vector machines. In Proceedings of the International Coference on International Conference on Machine Learning, pages 1467--1474, 2012.
[13]
Richard E. Blahut. Theory and practice of error control codes. 1983.
[14]
Peva Blanchard, El Mahdi El Mhamdi, Rachid Guerraoui, and Julien Stainer. Machine learning with adversaries: Byzantine tolerant gradient descent. In Advances in Neural Information Processing Systems, pages 118--128, 2017.
[15]
Keith Bonawitz, Vladimir Ivanov, Ben Kreuter, Antonio Marcedone, H. Brendan McMahan, Sarvar Patel, Daniel Ramage, Aaron Segal, and Karn Seth. Practical secure aggregation for privacy-preserving machine learning. In Proceedings of the ACM SIGSAC Conference on Computer and Communications Security, pages 1175--1191, 2017.
[16]
Keith Bonawitz, Fariborz Salehi, Jakub Konecný, H. Brendan McMahan, and Marco Gruteser. Federated learning with autotuned communication-efficient secure aggregation. 2019 53rd Asilomar Conference on Signals, Systems, and Computers, pages 1222--1226, 2019.
[17]
Gabriel Bracha and Sam Toueg. Asynchronous consensus and broadcast protocols. J. ACM, 32(4):824--840, oct 1985.
[18]
Lukas Burkhalter, Hidde Lycklama, Alexander Viand, Nicolas Küchler, and An- war Hithnawi. Rofl: Attestable robustness for secure federated learning. In arXiv:2107.03311, 2021.
[19]
Xiaoyu Cao, Minghong Fang, Jia Liu, and Neil Zhenqiang Gong. Fltrust: Byzantine-robust federated learning via trust bootstrapping. 2021.
[20]
Lingjiao Chen, Hongyi Wang, Zachary Charles, and Dimitris Papailiopoulos. Draco: Byzantine-resilient distributed training via redundant gradients. In Proceedings of the International Conference on Machine Learning, 2018.
[21]
Xinyun Chen, Chang Liu, Bo Li, Kimberly Lu, and Dawn Song. Targeted backdoor attacks on deep learning systems using data poisoning. In arXiv:1712.05526, 2017.
[22]
Amrita Roy Chowdhury, Chuan Guo, Somesh Jha, and Laurens van der Maaten. Full paper, 2021.
[23]
Gregory Cohen, Saeed Afshar, Jonathan Tapson, and André van Schaik. Emnist: Extending mnist to handwritten letters. In 2017 International Joint Conference on Neural Networks (IJCNN), pages 2921--2926, 2017.
[24]
Henry Corrigan-Gibbs and Dan Boneh. Prio: Private, robust, and scalable com- putation of aggregate statistics. In Proceedings of the USENIX Symposium on Networked Systems Design and Implementation, 2017.
[25]
Gabriela F. Cretu, Angelos Stavrou, Michael E. Locasto, Salvatore J. Stolfo, and Angelos D. Keromytis. Casting out demons: Sanitizing training data for anomaly sensors. In IEEE Symposium on Security and Privacy (SP), pages 81--95, 2008.
[26]
Scott A. Crosby and Dan S. Wallach. Efficient data structures for tamper-evident logging. In Proceedings of the 18th Conference on USENIX Security Symposium, SSYM'09, page 317--334, USA, 2009. USENIX Association.
[27]
Georgios Damaskinos, El Mahdi El Mhamdi, Rachid Guerraoui, Rhicheek Patra, and Mahsa Taziki. Asynchronous byzantine machine learning (the case of sgd). In ICML, 2018.
[28]
W. Diffie and M. Hellman. New directions in cryptography. IEEE Transactions on Information Theory, 22(6):644--654, 1976.
[29]
Minghong Fang, Xiaoyu Cao, Jinyuan Jia, and Neil Zhenqiang Gong. Local model poisoning attacks to byzantine-robust federated learning. In USENIX Security Symposium, 2020.
[30]
Paul Feldman. A practical scheme for non-interactive verifiable secret sharing. In 28th Annual Symposium on Foundations of Computer Science (sfcs 1987), pages 427--438, 1987.
[31]
Clement Fung, Chris J.M. Yoon, and Ivan Beschastnikh. Mitigating sybils in federated learning poisoning. In arXiv:1808.04866, 2018.
[32]
Shuhong Gao. A New Algorithm for Decoding Reed-Solomon Codes, pages 55--68. Springer US, Boston, MA, 2003.
[33]
Tianyu Gu, Brendan Dolan-Gavitt, and Siddharth Garg. Badnets: Identifying vulnerabilities in the machine learning model supply chain. In arXiv:1708.06733, 2017.
[34]
Kaiming He, X. Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pages 770--778, 2016.
[35]
Lie He, Sai Praneeth Karimireddy, and Martin Jaggi. Secure byzantine-robust machine learning, 2020.
[36]
Peter Kairouz, H. Brendan McMahan, Brendan Avent, Aurelien Bellet, Mehdi Bennis, Arjun Nitin Bhagoji, Kallista Bonawitz, Zachary Charles, Graham Cormode, Rachel Cummings, Rafael G.L. D'Oliveira, Hubert Eichner, Salim El Rouayheb, David Evans, Josh Gardner, Zachary Garrett, Adria Gascon, Badih Ghazi, Phillip B. Gibbons, Marco Gruteser, Zaid Harchaoui, Chaoyang He, Lie He, Zhouyuan Huo, Ben Hutchinson, Justin Hsu, Martin Jaggi, Tara Javidi, Gauri Joshi, Mikhail Khodak, Jakub Konecny, Aleksandra Korolova, Farinaz Koushanfar, Sanmi Koyejo, Tancrede Lepoint, Yang Liu, Prateek Mittal, Mehryar Mohri, Richard Nock, Ayfer Ozgur, Rasmus Pagh, Hang Qi, Daniel Ramage, Ramesh Raskar, Mariana Raykova, Dawn Song, Weikang Song, Sebastian U. Stich, Ziteng Sun, Ananda Theertha Suresh, Florian Tramer, Praneeth Vepakomma, Jianyu Wang, Li Xiong, Zheng Xu, Qiang Yang, Felix X. Yu, Han Yu, and Sen Zhao. Advances and open problems in federated learning. In arXiv:1912.04977, 2019.
[37]
Jonathan Katz and Yehuda Lindell. Introduction to Modern Cryptography, Second Edition. Chapman & Hall/CRC, 2nd edition, 2014.
[38]
Jakub Konečný, H. Brendan McMahan, Felix X. Yu, Peter Richtárik, Ananda Theertha Suresh, and Dave Bacon. Federated learning: Strategies for improving communication efficiency. CoRR, abs/1610.05492, 2016.
[39]
Jakub Konecný, H. Brendan McMahan, Felix X. Yu, Peter Richtárik, Ananda Theertha Suresh, and Dave Bacon. Federated learning: Strategies for improving communication efficiency. ArXiv, abs/1610.05492, 2016.
[40]
Alex Krizhevsky. The cifar-10 dataset.
[41]
Y. Lecun, L. Bottou, Y. Bengio, and P. Haffner. Gradient-based learning applied to document recognition. Proceedings of the IEEE, 86(11):2278--2324, 1998.
[42]
Yann LeCun, Corinna Cortes, and Christopher J.C. Burges. The mnist database of handwritten digits.
[43]
Liping Li, Wei Xu, Tianyi Chen, Georgios Giannakis, and Qing Ling. Rsa: Byzantine-robust stochastic aggregation methods for distributed learning from heterogeneous datasets. Proceedings of the AAAI Conference on Artificial Intelligence, 33:1544--1551, 07 2019.
[44]
Suyi Li, Yong Cheng, Wei Wang, Yang Liu, and Tianjian Chen. Learning to detect malicious clients for robust federated learning. CoRR, abs/2002.00211, 2020.
[45]
Shu Lin and Daniel J. Costello. Error control coding: fundamentals and applications. Pearson/Prentice Hall, Upper Saddle River, NJ, 2004.
[46]
Kang Liu, Brendan Dolan-Gavitt, and Siddharth Garg. Fine-pruning: Defending against backdooring attacks on deep neural networks. pages 273--294, 2018.
[47]
Terrance Liu, Giuseppe Vietri, Thomas Steinke, Jonathan Ullman, and Zhi-wei Steven Wu. Leveraging public data for practical private query release, 2021.
[48]
R. J. McEliece. The guruswami--sudan decoding algorithm for reed--solomon codes, 2003.
[49]
Brendan McMahan and Daniel Ramage. Federated learning: Collaborative machine learning without centralized training data, 2017.
[50]
H. Brendan McMahan, Eider Moore, Daniel Ramage, Seth Hampson, and Blaise Agüera y Arcas. Communication-efficient learning of deep networks from decentralized data. In Proceedings of the International Conference on Artificial Intelligence and Statistics, 2017.
[51]
Shike Mei and Xiaojin Zhu. Using machine teaching to identify optimal training- set attacks on machine learners. In Proceedings of the AAAI Conference on Artificial Intelligence, pages 2871--2877, 2015.
[52]
Luca Melis, Congzheng Song, Emiliano De Cristofaro, and Vitaly Shmatikov. Exploiting unintended feature leakage in collaborative learning. In 2019 IEEE Symposium on Security and Privacy (SP), pages 691--706, 2019.
[53]
Milad Nasr, Reza Shokri, and Amir Houmansadr. Comprehensive privacy analysis of deep learning: Passive and active white-box inference attacks against centralized and federated learning. 2019 IEEE Symposium on Security and Privacy (SP), May 2019.
[54]
Jelani Nelson. Sketching algorithms
[55]
Thien Duc Nguyen, Phillip Rieger, Hossein Yalame, Helen Möllering, Hossein Fereidooni, Samuel Marchal, Markus Miettinen, Azalia Mirhoseini, Ahmad-Reza Sadeghi, Thomas Schneider, and Shaza Zeitouni. Flguard: Secure and private federated learning, 2021.
[56]
Xudong Pan, Mi Zhang, Duocai Wu, Qifan Xiao, Shouling Ji, and Zhemin Yang. Justinian's GAAvernor: Robust distributed learning with gradient aggregation agent. In USENIX Security, pages 1641--1658, 2020.
[57]
Shashank Rajput, Hongyi Wang, Zachary Charles, and Dimitris Papailiopoulos. Detox: A redundancy-based framework for faster and more robust gradient aggregation. 2019.
[58]
Edo Roth, Daniel Noble, Brett Hemenway Falk, and Andreas Haeberlen. Honey-crisp: Large-scale differentially private aggregation without a trusted core. In Proceedings of the 27th ACM Symposium on Operating Systems Principles, SOSP '19, page 196--210, New York, NY, USA, 2019. Association for Computing Machinery.
[59]
J. T. Schwartz. Fast probabilistic algorithms for verification of polynomial identi- ties. J. ACM, 27(4):701--717, October 1980.
[60]
Adi Shamir. How to share a secret. Commun. ACM, 22(11):612--613, November 1979.
[61]
Virat Shejwalkar and Amir Houmansadr. Manipulating the byzantine: Optimizing model poisoning attacks and defenses for federated learning. In NDSS, 2021.
[62]
Virat Shejwalkar and Amir Houmansadr. Manipulating the byzantine: Optimizing model poisoning attacks and defenses for federated learning. In NDSS, 2021.
[63]
Shiqi Shen, Shruti Tople, and Prateek Saxena. Auror: Defending against poisoning attacks in collaborative deep learning systems. In ACM ACSAC, pages 508--519, 2016.
[64]
Yanyao Shen and Sujay Sanghavi. Learning with bad training data via iterative trimmed loss minimization. In International Conference on Machine Learning (ICML), pages 5739--5748, 2019.
[65]
Jinhyun So, Basak Guler, and A. Salman Avestimehr. Byzantine-resilient secure federated learning. IEEE Journal in Selected Areas in Communications: Machine Learning in Communications and Networks, 2020.
[66]
Jinhyun So, Basak Guler, and A. Salman Avestimehr. Turbo-aggregate: Breaking the quadratic aggregation barrier in secure federated learning, 2021.
[67]
Jacob Steinhardt, Pang Wei W. Koh, and Percy S. Liang. Certified defenses for data poisoning attacks. In Advances in Neural Information Processing Systems (NeurIPS), pages 3517--3529, 2017.
[68]
Ziteng Sun, Peter Kairouz, Ananda Theertha Suresh, and H. Brendan McMahan. Can you really backdoor federated learning? In arXiv:1911.07963, 2019.
[69]
Ziteng Sun, Peter Kairouz, Ananda Theertha Suresh, and H. Brendan McMahan. Can you really backdoor federated learning? ArXiv, abs/1911.07963, 2019.
[70]
Bolun Wang, Yuanshun Yao, Shawn Shan, Huiying Li, Bimal Viswanath, Haitao Zheng, and Ben Y. Zhao. Neural cleanse: Identifying and mitigating backdoor attacks in neural networks. In IEEE Symposium on Security and Privacy (SP), pages 707--723, 2019.
[71]
Chulin Xie, Keli Huang, Pin-Yu Chen, and Bo Li. Dba: Distributed backdoor attacks against federated learning. In ICLR, 2020.
[72]
Cong Xie. Zeno: robust asynchronous SGD with arbitrary number of byzantine workers. CoRR, abs/1903.07020, 2019.
[73]
Cong Xie, Oluwasanmi Koyejo, and Indranil Gupta. Zeno: Distributed stochastic gradient descent with suspicion-based fault-tolerance. In Proceedings of the International Conference on Machine Learning, 2019.
[74]
Cong Xie, Oluwasanmi Koyejo, and Indranil Gupta. Zeno: Robust fully asynchronous SGD. In Proceedings of the International Conference on Machine Learning, 2020.
[75]
Dong Yin, Yudong Chen, Ramchandran Kannan, and Peter Bartlett. Byzantine- robust distributed learning: Towards optimal statistical rates. In International Conference on Machine Learning (ICML), 2019.
[76]
Hongxu Yin, Arun Mallya, Arash Vahdat, José Manuel Álvarez, Jan Kautz, and Pavlo Molchanov. See through gradients: Image batch recovery via gradinversion. 2021 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 16332--16341, 2021.
[77]
Zalando. Fashion mnist.
[78]
Ligeng Zhu, Zhijian Liu, and Song Han. Deep leakage from gradients. In NeurIPS, 2019.
[79]
Richard Zippel. Probabilistic algorithms for sparse polynomials. In Proceedings of the International Symposiumon on Symbolic and Algebraic Computation, EUROSAM '79, page 216--226, Berlin, Heidelberg, 1979. Springer-Verlag.

Cited By

View all
  • (2024)AegisFLProceedings of the 41st International Conference on Machine Learning10.5555/3692070.3692349(7207-7219)Online publication date: 21-Jul-2024
  • (2024)Secure Data Sharing in Federated Learning through Blockchain-Based AggregationFuture Internet10.3390/fi1604013316:4(133)Online publication date: 15-Apr-2024
  • (2024)MUDGUARD: Taming Malicious Majorities in Federated Learning using Privacy-preserving Byzantine-robust ClusteringProceedings of the ACM on Measurement and Analysis of Computing Systems10.1145/37004228:3(1-41)Online publication date: 13-Dec-2024
  • Show More Cited By

Index Terms

  1. EIFFeL: Ensuring Integrity for Federated Learning

      Recommendations

      Comments

      Please enable JavaScript to view thecomments powered by Disqus.

      Information & Contributors

      Information

      Published In

      cover image ACM Conferences
      CCS '22: Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security
      November 2022
      3598 pages
      ISBN:9781450394505
      DOI:10.1145/3548606
      Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than ACM must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from [email protected]

      Sponsors

      Publisher

      Association for Computing Machinery

      New York, NY, United States

      Publication History

      Published: 07 November 2022

      Permissions

      Request permissions for this article.

      Check for updates

      Author Tags

      1. input integrity
      2. poisoning attacks
      3. secure aggregation

      Qualifiers

      • Research-article

      Conference

      CCS '22
      Sponsor:

      Acceptance Rates

      Overall Acceptance Rate 1,261 of 6,999 submissions, 18%

      Upcoming Conference

      CCS '25

      Contributors

      Other Metrics

      Bibliometrics & Citations

      Bibliometrics

      Article Metrics

      • Downloads (Last 12 months)341
      • Downloads (Last 6 weeks)23
      Reflects downloads up to 01 Mar 2025

      Other Metrics

      Citations

      Cited By

      View all
      • (2024)AegisFLProceedings of the 41st International Conference on Machine Learning10.5555/3692070.3692349(7207-7219)Online publication date: 21-Jul-2024
      • (2024)Secure Data Sharing in Federated Learning through Blockchain-Based AggregationFuture Internet10.3390/fi1604013316:4(133)Online publication date: 15-Apr-2024
      • (2024)MUDGUARD: Taming Malicious Majorities in Federated Learning using Privacy-preserving Byzantine-robust ClusteringProceedings of the ACM on Measurement and Analysis of Computing Systems10.1145/37004228:3(1-41)Online publication date: 13-Dec-2024
      • (2024)Towards Practical Homomorphic Aggregation in Byzantine-Resilient Distributed LearningProceedings of the 25th International Middleware Conference10.1145/3652892.3700783(431-444)Online publication date: 2-Dec-2024
      • (2024)Trusted Model Aggregation With Zero-Knowledge Proofs in Federated LearningIEEE Transactions on Parallel and Distributed Systems10.1109/TPDS.2024.345576235:11(2284-2296)Online publication date: Nov-2024
      • (2024)The Impact of Adversarial Attacks on Federated Learning: A SurveyIEEE Transactions on Pattern Analysis and Machine Intelligence10.1109/TPAMI.2023.332278546:5(2672-2691)Online publication date: May-2024
      • (2024)A Survey for Federated Learning Evaluations: Goals and MeasuresIEEE Transactions on Knowledge and Data Engineering10.1109/TKDE.2024.338200236:10(5007-5024)Online publication date: Oct-2024
      • (2024)Efficient and Privacy-Preserving Cloud-Assisted Two-Party Computation Scheme in Heterogeneous NetworksIEEE Transactions on Industrial Informatics10.1109/TII.2023.334288220:5(8007-8018)Online publication date: May-2024
      • (2024)Collusion-Resilient and Maliciously Secure Cloud- Assisted Two-Party Computation Scheme in Mobile Cloud ComputingIEEE Transactions on Information Forensics and Security10.1109/TIFS.2024.342841019(7019-7032)Online publication date: 2024
      • (2024)A Flexible and Scalable Malicious Secure Aggregation Protocol for Federated LearningIEEE Transactions on Information Forensics and Security10.1109/TIFS.2024.337552719(4174-4187)Online publication date: 2024
      • Show More Cited By

      View Options

      Login options

      View options

      PDF

      View or Download as a PDF file.

      PDF

      eReader

      View online with eReader.

      eReader

      Figures

      Tables

      Media

      Share

      Share

      Share this Publication link

      Share on social media