TLDR: MARS is a novel defense for Federated Learning that tackles sophisticated backdoor attacks. It introduces ‘backdoor energy’ to quantify maliciousness in model neurons and uses ‘concentrated backdoor energy’ with Wasserstein distance-based clustering to accurately identify and filter out compromised models. Experiments show MARS effectively counters state-of-the-art attacks, outperforming existing defenses and demonstrating robustness across various scenarios and datasets.
Federated Learning (FL) has emerged as a powerful approach to machine learning, allowing multiple participants to collaboratively train a high-quality global model without sharing their raw data. This privacy-preserving nature has led to its widespread adoption in sensitive fields like healthcare, finance, and even military applications. However, this distributed architecture also introduces significant security vulnerabilities, particularly to sophisticated backdoor attacks.
Backdoor attacks are a stealthy form of poisoning where malicious actors implant hidden triggers into the global model. These triggers cause the model to behave maliciously (e.g., misclassifying an image with a specific pattern) only when activated, while performing normally on clean, untriggered data. This makes them incredibly difficult for users to detect, posing a substantial threat to the integrity and trustworthiness of FL systems. Recent state-of-the-art attacks, such as 3DFed, DarkFed, and CerP, have become increasingly sophisticated, employing adaptive strategies and mimicking benign updates to bypass existing defense mechanisms.
A new research paper, titled MARS: A Malignity-Aware Backdoor Defense in Federated Learning, delves into the fundamental reasons behind the failure of current FL backdoor defenses. Authors Wei Wan, Yuxuan Ning, Zhicong Huang, Cheng Hong, Shengshan Hu, Ziqi Zhou, Yechao Zhang, Tianqing Zhu, Wanlei Zhou, and Leo Yu Zhang reveal that existing defenses primarily rely on empirical statistical measures like norm constraints, out-of-distribution (OOD) detection, and consistency checks. These measures are often “loosely coupled” with the actual malicious intent of backdoor attacks, allowing attackers to craft updates that appear benign, thereby evading detection.
Introducing MARS: A Malignity-Aware Approach
Motivated by this critical insight, the researchers propose a novel defense mechanism called MARS (Malignity-Aware Backdoor Defense). Unlike its predecessors, MARS directly targets the inherent maliciousness of backdoor attacks by introducing the concept of “backdoor energy” (BE). Backdoor energy quantifies the malicious extent of each neuron in a model, indicating its relevance to backdoor intent. A higher BE signifies a greater level of malignity within that neuron.
To further amplify this malignity and make detection more robust, MARS extracts the most prominent BE values from each layer of a local model, concatenating them into a one-dimensional vector called “concentrated backdoor energy” (CBE). This process effectively concentrates the backdoor-related information, minimizing interference from benign neurons.
Finally, MARS employs a novel clustering method based on Wasserstein distance to identify backdoor models. Traditional clustering techniques often use Euclidean or cosine distances, which are sensitive to the order of elements in a vector. However, the Wasserstein distance focuses on the overall distribution of elements, making it particularly effective for distinguishing between the CBEs of benign and malicious models, even when the exact order of high-energy neurons differs.
Also Read:
- A Novel Approach to Neutralize Malware in Neural Network Checkpoints
- Space AI Security: Balancing Performance and Protection in Satellite Constellations
Robust Performance and Practicality
Extensive experiments demonstrate MARS’s superior performance against various state-of-the-art backdoor attacks, including MRA, CerP, and 3DFed, across diverse datasets like MNIST, CIFAR-10, and CIFAR-100. MARS consistently outperforms existing defenses, maintaining high model accuracy while effectively neutralizing attacks. The defense also proves resilient against adaptive adversaries who possess prior knowledge of MARS and attempt to bypass it.
Furthermore, MARS exhibits remarkable robustness across a wide range of attacker proportions, even when malicious clients constitute a majority (up to 95%). It also performs well on larger, more complex datasets like ImageNet and is applicable to different model architectures, including Vision Transformers (ViT) and LSTM for NLP tasks. Crucially, MARS introduces no additional communication overhead and maintains a low computational footprint, making it practical for real-world FL deployments.
While MARS is a significant leap forward in securing federated learning, the authors acknowledge its specific focus on backdoor attacks. It is not designed to address other types of threats, such as free-rider attacks (lazy clients) or privacy-stealing attacks (like gradient inversion), which do not directly impact model performance or integrity in the same way. Nevertheless, MARS provides a robust and effective solution to a critical security challenge in the evolving landscape of distributed machine learning.
