Targeted model poisoning attacks pose a significant threat to federated learning systems. Recent studies show that edge-case targeted attacks, which target a small fraction of the input space are nearly impossible to counter using existing fixed defense strategies. In this paper, we strive to design a learned-defense strategy against such attacks, using a small defense dataset. The defense dataset can be collected by the central authority of the federated learning task, and should contain a mix of poisoned and clean examples. The proposed framework, LearnDefend, estimates the probability of a client update being malicious. The examples in defense dataset need not be pre-marked as poisoned or clean. We also learn a poisoned data detector model which can be used to mark each example in the defense dataset as clean or poisoned. We estimate the poisoned data detector and the client importance models in a coupled optimization approach. Our experiments demonstrate that LearnDefend is capable of defending against state-of-the-art attacks where existing fixed defense strategies fail. We also show that LearnDefend is robust to size and noise in the marking of clean examples in the defense dataset.

本研究提出了使用一小部分的防御数据集来防范边缘用例攻击的观点。该模型LearnDefend可以估计客户更新是恶意的概率，并学习一个可以标记清洁或污染例子的被毒害数据检测器模型。同时，该学习防御模型在配对优化时还估计客户端的重要性模型。经实验证明，LearnDefend可以有效地防御目前最先进的攻击方法，并且对防御数据集中清洁样本的大小和噪音具有较强的鲁棒性。

基于联邦学习的针对性模型投毒攻击防御学习