TLDR: FIDELIS is a novel blockchain-based framework designed to protect federated learning from data poisoning attacks. It decentralizes the traditional global server, allowing clients to collaboratively train and agree upon a ‘judge model’ that identifies and filters out malicious model updates, ensuring the integrity and accuracy of the global AI model. Experiments show high detection accuracy and global model robustness against attacks, along with scalable judge model creation.
Federated learning (FL) is a revolutionary approach to training artificial intelligence models. Unlike traditional methods where data is sent to a central server, FL allows multiple devices, like your smartphone or IoT gadgets, to train a shared model using their own private data. This means your personal information stays on your device, addressing major privacy concerns. However, this distributed nature also introduces a significant vulnerability: data poisoning attacks. Malicious participants can subtly corrupt their training data, leading to a degraded or compromised global model.
Current methods for detecting these poisoning attacks in federated learning often fall short. Many rely on a single, trusted central server, which creates a single point of failure and goes against the decentralized spirit of FL. Others use blockchain technology to enhance security but lack a clear, standardized way to identify poisoned models.
Introducing FIDELIS: A Blockchain-Powered Shield
A new framework called FIDELIS (Blockchain-Enabled Protection Against Poisoning Attacks in Federated Learning) offers a robust solution to this problem. Developed by researchers Jane Carney, Kushal Upreti, Gaby G. Dagher, and Tim Andersen, FIDELIS leverages blockchain technology to decentralize the entire federated learning process, removing the need for a single, trusted global server.
The core innovation of FIDELIS is its “judge model.” Instead of a central authority, each participating client trains its own judge model, which is specifically designed to detect data poisoning in model updates. This judge model is an ‘isolation forest,’ a type of machine learning algorithm particularly good at identifying anomalies.
How FIDELIS Works
The process begins with clients collaboratively training their individual judge models using a public dataset. They then submit these models to the blockchain. To ensure fairness and accuracy, all clients collectively test each proposed judge model. Through an encrypted voting process, they reach a consensus on a single, universal judge model that will be used for the entire training process. This ensures that no single client can manipulate the detection mechanism.
Once the universal judge model is established, it plays a crucial role in maintaining the integrity of the global model. As clients train their local models and prepare to send updates, each update is first run through the agreed-upon judge model. If an update is flagged as malicious or anomalous, it is excluded from the aggregation process. Clients also vote on which model updates should be accepted, with a majority vote (over 50%) required for an update to be included. This multi-layered verification ensures that only legitimate and uncorrupted updates contribute to the global model.
Also Read:
- Protecting Federated Learning from Backdoor Attacks with Vision-Language Models
- Optimizing Federated Learning in Connected Vehicles: A New Approach to Client Selection and Data Balance
Demonstrated Robustness and Scalability
The effectiveness of FIDELIS has been rigorously tested. Experiments showed that the judge model achieved a high rate of malicious update detection, consistently performing with 95-100% accuracy in identifying poisoned contributions. Furthermore, the global model maintained an accuracy above 98% even when a significant portion (up to 35%) of the participating clients were malicious. This demonstrates FIDELIS’s strong resilience against poisoning attacks.
The framework also proved to be scalable. The time required to create the judge model increased linearly with the number of clients, indicating that FIDELIS can effectively operate in large-scale federated learning environments without becoming prohibitively slow.
In conclusion, FIDELIS offers a promising path forward for securing federated learning. By decentralizing trust and implementing a robust, consensus-driven detection mechanism, it helps ensure the integrity and reliability of AI models trained collaboratively. For more details, you can refer to the full research paper: FIDELIS: Blockchain-Enabled Protection Against Poisoning Attacks in Federated Learning.
