Federated Learning Defense Against Model Poisoning

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Federated learning systems are vulnerable to adversarial attacks, particularly model poisoning attacks, due to the lack of access to local datasets at client nodes, making it difficult to defend against intentional falsification of updates in centralized models.

Innovation Solution

Implementing update perturbation and normalization techniques, where random noise is applied to each update before aggregating them into the global model, and optionally perturbing the global model's parameters to reduce the impact of adversarial information over multiple training rounds.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Loss of information

If federated learning aggregates updates from multiple client nodes without access to local datasets, then data privacy is preserved, but the system becomes vulnerable to adversarial attacks and model poisoning

Engineering Contradiction:

Improvedata privacyVSAvoidrobustness against adversarial attacks

Core Design Contradiction:

Loss of informationVSReliability

Solution Approach 1:

The patent introduces an intermediary verification mechanism that acts as a mediator between client nodes and the central server. This intermediary layer validates updates using statistical properties and cross-verification techniques before aggregation, preventing adversarial updates from compromising the global model while maintaining the privacy-preserving federated learning architecture.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The patent implements feedback mechanisms where the central server provides information about update validity and model performance back to client nodes. This feedback loop enables iterative refinement of update validation strategies and allows the system to adapt to emerging adversarial patterns without compromising data privacy.

Inventive Principle:

Principle #23Feedback

2Reliability

If Byzantine-robust algorithms are applied to defend against adversarial attacks in distributed systems, then reliability improves, but the algorithms are unsuitable for federated learning context

Engineering Contradiction:

Improvedefense against adversarial attacksVSAvoidsuitability for federated learning

Core Design Contradiction:

ReliabilityVSAdaptability or versatility

Solution Approach 1:

The patent applies local quality by implementing defense mechanisms tailored specifically to the federated learning context rather than using generic Byzantine-robust algorithms. The verification methods are adapted to leverage the specific characteristics of federated learning updates, such as the statistical properties of gradient updates and the structure of local model training, making the solution both reliable and suitable for FL.

Inventive Principle:

Principle #3Local quality

Solution Approach 2:

The patent modifies key parameters and assumptions of traditional Byzantine-robust algorithms to make them compatible with federated learning. This includes adapting the verification criteria to work with gradient updates rather than direct model parameters, and adjusting the aggregation rules to account for the distributed nature of FL training processes.

Inventive Principle:

Principle #35Parameter changes

3Productivity

If updates are aggregated without perturbation, then training efficiency is maintained, but adversarial information accumulates over multiple rounds

Engineering Contradiction:

Improvetraining efficiencyVSAvoidaccumulation of adverse information

Core Design Contradiction:

ProductivityVSObject-generated harmful factors

Solution Approach 1:

The patent applies preliminary anti-action by implementing verification and filtering mechanisms before updates are aggregated into the global model. This preliminary defense prevents adversarial information from entering the aggregation process in the first place, eliminating the need for later correction while maintaining training efficiency.

Inventive Principle:

Principle #9Preliminary anti-action

Solution Approach 2:

The patent converts the potential harm of adversarial updates into a benefit by using them as training signals for the verification mechanism. The presence of adversarial updates helps refine the detection algorithms and improves the system's ability to identify and filter malicious information, making the defense mechanism more robust over time.

Inventive Principle:

Principle #22Blessing in disguise (Convert harm into benefit)

Data Source

PatentUS11651292B2Methods and apparatuses for defense against adversarial attacks on federated learning systems

Publication Date: 2023.05.16 HUAWEI TECH CO LTD

AI summary

Methods and computing apparatuses for defending against model poisoning attacks in federated learning are described. One or more updates are obtained, where each update represents a respective difference between parameters (e.g. weights) of the global model and parameters (e.g. weights) of a respective local model. Random noise perturbation and normalization are applied to each update, to obtain one or more perturbed and normalized updates. The parameters (e.g. weights) of the global model are updated by adding an aggregation of the one or more perturbed and normalized updates to the parameters (e.g. weights) of the global model. In some examples, one or more learned parameters (e.g. weights) of the previous global model are also perturbed using random noise.