Abstract
This paper puts forth a new training data-untethered model poisoning (MP) attack on federated learning (FL). The new MP attack extends an adversarial variational graph autoencoder (VGAE) to create malicious local models based solely on the benign local models overheard without any access to the training data of FL. Such an advancement leads to the VGAE-MP attack that is not only efficacious but also remains elusive to detection. VGAE-MP attack extracts graph structural correlations among the benign local models and the training data features, adversarially regenerates the graph structure, and generates malicious local models using the adversarial graph structure and benign models' features. Moreover, a new attacking algorithm is presented to train the malicious local models using VGAE and sub-gradient descent, while enabling an optimal selection of the benign local models for training the VGAE. Experiments demonstrate a gradual drop in FL accuracy under the proposed VGAE-MP attack and the ineffectiveness of existing defense mechanisms in detecting the attack, posing a severe threat to FL.
Abstract (translated)
本文提出了一种新的联邦学习(FL)数据无连接模欺骗(MP)攻击。新提出的MP攻击将对抗变分图形自动编码器(VGAE)扩展到仅根据未获得FL训练数据的恶意局部模型的创建。这种进步导致了一种VGAE-MP攻击，不仅有效，而且对攻击的检测仍然难以实现。VGAE-MP攻击提取了恶意局部模型和训练数据特征之间的图形结构相关性，以 adversarially 生成 graph 结构，并使用恶意图形结构和良性模型的特征生成恶意局部模型。此外，还提出了一种用VGAE和亚最小二乘法训练恶意局部模型的攻击算法，同时允许为训练VGAE选择最优的良性局部模型。实验证明，在提出的VGAE-MP攻击下，FL的准确性逐渐下降，而现有的防御机制在检测攻击方面无能为力，对FL构成了严重的威胁。
URL
https://arxiv.org/abs/2404.15042
