TLDR: This research paper reveals the vulnerability of Federated Learning (FL)-based Road Condition Classification (RCC) systems to Targeted Label Flipping Attacks (TLFAs), where malicious vehicles alter data labels to compromise model performance and transportation safety. It introduces a new “label distance” metric to quantify safety risks more accurately. The paper proposes FLARE, a novel defense mechanism that uses neuron-wise analysis of the model’s output layer to detect and filter out poisoned models and blacklist malicious clients. Extensive experiments demonstrate FLARE’s effectiveness in mitigating TLFA impact compared to existing countermeasures, though further improvements are still needed.
In the rapidly evolving landscape of autonomous driving, ensuring safety is paramount. One critical aspect is accurately classifying road conditions, which directly impacts vehicle control, traffic safety, and passenger comfort. Traditionally, training advanced Artificial Intelligence (AI) models for this purpose requires vast amounts of data. However, privacy concerns, highlighted by regulations like GDPR and CCPA, make sharing sensitive image data from vehicles impractical.
This is where Federated Learning (FL) steps in. FL is a distributed approach that allows AI models to be trained across multiple devices, like smart vehicles, without centralizing their private data. Instead of sharing raw images, vehicles exchange updated local model parameters with a central server, which then aggregates them to improve a global model. This collaborative method has shown great promise for camera-based Road Condition Classification (RCC) systems, enabling vehicles to learn from diverse scenarios while preserving user privacy.
However, the collaborative nature of FL introduces new vulnerabilities. A significant threat is the Targeted Label Flipping Attack (TLFA). In such an attack, malicious vehicles deliberately alter the labels of their training data. For instance, a malicious vehicle might falsely label a “severe-uneven” road condition as “smooth.” If this poisoned data is used in training, the global model could learn to misclassify dangerous conditions, potentially leading to accidents by causing vehicles to underestimate hazards and exceed safe speeds.
Until now, the specific vulnerability of FL-based RCC systems to TLFAs has been largely unaddressed. Existing research on RCC often uses standard evaluation metrics like accuracy, which don’t fully capture the safety implications of misclassifications. For example, misclassifying an “ice” road as “dry” is far more dangerous than misclassifying “slight-uneven” as “smooth,” but traditional metrics might treat them equally.
Quantifying Safety Risks
To address this, researchers have introduced a novel metric based on “label distance.” This metric precisely quantifies the safety risks posed by TLFAs by assigning a weighted distance to misclassifications. A larger label distance indicates a higher danger level. This allows for a more accurate assessment of how these attacks impact transportation safety, moving beyond simple accuracy to understand the real-world consequences of prediction errors.
Introducing FLARE: A New Defense Mechanism
To combat TLFAs, a new defensive mechanism called FLARE has been proposed. FLARE stands out because it leverages a “neuron-wise analysis” of the model’s output layer. Unlike previous countermeasures that look at the entire model or the whole output layer, FLARE focuses on specific parameters directly connected to the source (true) and target (falsified) classes. The intuition behind this is that adversaries mounting TLFAs and honest clients have contradicting objectives for local model training, which manifest as distinct differences in these critical parameters.
FLARE works in several steps: First, it identifies the potential source and target classes by analyzing the changes in model parameters connected to output layer neurons. The two neurons with the highest change magnitudes are identified as the likely source and target. Second, it uses a clustering method called HDBSCAN to detect outliers among the parameter changes related to these two identified classes. These outliers are considered to be from malicious clients. Third, the model parameters from these detected malicious clients are filtered out before the global model is aggregated, preventing the poisoned updates from affecting the overall model. Finally, FLARE maintains a blacklist of malicious clients, excluding them from future training rounds, which enhances defense efficiency over time.
Also Read:
- Enhancing Cooperative Driving for Autonomous Vehicles with Topology-Aware Reinforcement Learning
- Unified Face Anti-Spoofing: InstructFLIP’s Smart Solution for Attack Detection
Experimental Validation
Extensive experiments were conducted across three RCC tasks (friction, material, and unevenness classification) and three deep learning models (ResNet-18, EfficientNet-B1, and DeiT-Tiny). The results clearly demonstrated the severity of TLFAs on FL-RCC systems, showing significant drops in global accuracy and source recall, and a sharp increase in attack success rates and errors. For instance, the attack success rate for friction classification could jump from around 3.72% without attack to 45.59% with attack using FedAvg.
Crucially, FLARE consistently outperformed six state-of-the-art general countermeasures. It achieved better attack success rates and lower error values, especially under higher poisoning rates. This indicates that FLARE’s fine-grained, neuron-wise analysis is more effective in heterogeneous FL-RCC scenarios. While FLARE significantly mitigates the attack impact, the research acknowledges that a gap still exists between FLARE’s performance and a system with no attacks, highlighting the challenging nature of defending against TLFAs and suggesting areas for future improvement, such as correcting already poisoned global models.
This groundbreaking research not only exposes a critical vulnerability in FL-based RCC systems but also provides a robust, efficient defense mechanism. For more technical details, you can refer to the full research paper available here.
