Without direct access to the client's data, federated learning (FL) is
well-known for its unique strength in data privacy protection among existing
distributed machine learning techniques. However, its distributive and
iterative nature makes FL inherently vulnerable to various poisoning attacks.
To counteract these threats, extensive defenses have been proposed to filter
out malicious clients, using various detection metrics. Based on our analysis
of existing attacks and defenses, we find that there is a lack of attention to
model redundancy. In neural networks, various model parameters contribute
differently to the model's performance. However, existing attacks in FL
manipulate all the model update parameters with the same strategy, making them
easily detectable by common defenses. Meanwhile, the defenses also tend to
analyze the overall statistical features of the entire model updates, leaving
room for sophisticated attacks. Based on these observations, this paper
proposes a generic and attack-agnostic augmentation approach designed to
enhance the effectiveness and stealthiness of existing FL poisoning attacks
against detection in FL, pointing out the inherent flaws of existing defenses
and exposing the necessity of fine-grained FL security. Specifically, we employ
a three-stage methodology that strategically constructs, generates, and injects
poison (generated by existing attacks) into a pill (a tiny subnet with a novel
structure) during the FL training, named as pill construction, pill poisoning,
and pill injection accordingly. Extensive experimental results show that FL
poisoning attacks enhanced by our method can bypass all the popular defenses,
and can gain an up to 7x error rate increase, as well as on average a more than
2x error rate increase on both IID and non-IID data, in both cross-silo and
cross-device FL systems.

通过对现有攻击和防御的分析，本文提出了一种通用的、针对检测中的联邦学习（FL）中的现有 FL 中毒攻击的增强手法，揭示了现有防御的固有缺陷并证明了细粒度 FL 安全性的必要性。该手法通过在 FL 训练中策略性地构建、生成和注入毒药（由现有攻击生成）进入一种具有新结构的微型子网，极大地增强了 FL 中毒攻击的有效性和隐蔽性。大量实验结果表明，通过我们的方法增强的 FL 中毒攻击可以绕过所有常见的防御，对于 IID 和非 IID 数据，在跨平台和跨设备的 FL 系统中，错误率可以增加多达 7 倍，并在平均错误率上增加了 2 倍以上。

一颗毒丸：绕过联邦学习检测

Poisoning with A Pill: Circumventing Detection in Federated Learning

Federated learning (FL) is a distributed machine learning paradigm that
enables training models on decentralized data. The field of FL security against
poisoning attacks is plagued with confusion due to the proliferation of
research that makes different assumptions about the capabilities of adversaries
and the adversary models they operate under. Our work aims to clarify this
confusion by presenting a comprehensive analysis of the various poisoning
attacks and defensive aggregation rules (AGRs) proposed in the literature, and
connecting them under a common framework. To connect existing adversary models,
we present a hybrid adversary model, which lies in the middle of the spectrum
of adversaries, where the adversary compromises a few clients, trains a
generative (e.g., DDPM) model with their compromised samples, and generates new
synthetic data to solve an optimization for a stronger (e.g., cheaper, more
practical) attack against different robust aggregation rules. By presenting the
spectrum of FL adversaries, we aim to provide practitioners and researchers
with a clear understanding of the different types of threats they need to
consider when designing FL systems, and identify areas where further research
is needed.

本文通过对文献中提出的各种污染攻击和防御聚合规则进行全面分析，并将它们归纳到一个共同框架下，旨在为从业者和研究人员提供对不同类型的威胁的清晰理解，并确定进一步的研究领域。

虚假还是被篡改？理解联邦学习中的恶意客户

Fake or Compromised? Making Sense of Malicious Clients in Federated  Learning

Gradient inversion attacks can leak data privacy when clients share weight
updates with the server in federated learning (FL). Existing studies mainly use
L2 or cosine distance as the loss function for gradient matching in the attack.
Our empirical investigation shows that the vulnerability ranking varies with
the loss function used. Gradient norm, which is commonly used as a
vulnerability proxy for gradient inversion attack, cannot explain this as it
remains constant regardless of the loss function for gradient matching. In this
paper, we propose a loss-aware vulnerability proxy (LAVP) for the first time.
LAVP refers to either the maximum or minimum eigenvalue of the Hessian with
respect to gradient matching loss at ground truth. This suggestion is based on
our theoretical findings regarding the local optimization of the gradient
inversion in proximity to the ground truth, which corresponds to the worst case
attack scenario. We demonstrate the effectiveness of LAVP on various
architectures and datasets, showing its consistent superiority over the
gradient norm in capturing sample vulnerabilities. The performance of each
proxy is measured in terms of Spearman's rank correlation with respect to
several similarity scores. This work will contribute to enhancing FL security
against any potential loss functions beyond L2 or cosine distance in the
future.

通过使用自适应的损失函数，本研究提出了一种用于梯度逆转攻击的敏感性代理指标，该指标能够更准确地捕捉样本的脆弱性，并为以后在联邦学习中应对多种潜在损失函数的安全问题提供了解决方案。