Federated machine learning which enables resource constrained node devices
(e.g., mobile phones and IoT devices) to learn a shared model while keeping the
training data local, can provide privacy, security and economic benefits by
designing an effective communication protocol. However, the communication
protocol amongst different nodes could be exploited by attackers to launch data
poisoning attacks, which has been demonstrated as a big threat to most machine
learning models. In this paper, we attempt to explore the vulnerability of
federated machine learning. More specifically, we focus on attacking a
federated multi-task learning framework, which is a federated learning
framework via adopting a general multi-task learning framework to handle
statistical challenges. We formulate the problem of computing optimal poisoning
attacks on federated multi-task learning as a bilevel program that is adaptive
to arbitrary choice of target nodes and source attacking nodes. Then we propose
a novel systems-aware optimization method, ATTack on Federated Learning
(AT2FL), which is efficiency to derive the implicit gradients for poisoned
data, and further compute optimal attack strategies in the federated machine
learning. Our work is an earlier study that considers issues of data poisoning
attack for federated learning. To the end, experimental results on real-world
datasets show that federated multi-task learning model is very sensitive to
poisoning attacks, when the attackers either directly poison the target nodes
or indirectly poison the related nodes by exploiting the communication
protocol.

本文旨在研究联邦机器学习中的数据投毒攻击漏洞，使用一个基于多任务学习框架的联邦学习框架，提出了一个自适应的双层优化问题，并提出了一种系统感知的优化方法，ATTack on Federated Learning (AT2FL)，用于计算联邦机器学习中的设备投毒策略。实验结果表明，无论是直接毒害目标节点还是利用通信协议间接毒害相关节点，联邦多任务学习模型都非常容易受到投毒攻击的影响。