Federated learning (FL) is one of the most important paradigms addressing
privacy and data governance issues in machine learning (ML). Adversarial
training has emerged, so far, as the most promising approach against evasion
threats on ML models. In this paper, we take the first known steps towards
federated adversarial training (FAT) combining both methods to reduce the
threat of evasion during inference while preserving the data privacy during
training. We investigate the effectiveness of the FAT protocol for idealised
federated settings using MNIST, Fashion-MNIST, and CIFAR10, and provide first
insights on stabilising the training on the LEAF benchmark dataset which
specifically emulates a federated learning environment. We identify challenges
with this natural extension of adversarial training with regards to achieved
adversarial robustness and further examine the idealised settings in the
presence of clients undermining model convergence. We find that Trimmed Mean
and Bulyan defences can be compromised and we were able to subvert Krum with a
novel distillation based attack which presents an apparently "robust" model to
the defender while in fact the model fails to provide robustness against simple
attack modifications.

本文介绍一种联邦对抗训练（FAT）方法，结合联邦学习和对抗训练，以降低诈骗攻击风险并在训练期间保护数据隐私，研究了对于 MNIST、Fashion-MNIST 和 CIFAR10 这几种理想的联邦学习数据集，以及在 LEAF 基准数据集上的理想设置下对于集群客户对于模型的会耗时的这种自然扩展，探讨挑战和未能在 Trimmed Mean 和 Bulyan 防御上取得的成果，但使用一种新型的蒸馏攻击，成功破解了 Krum，为防御者呈现了似乎 “强大” 的模型，实际上该模型对于简单攻击的修改并不提供鲁棒性。