This paper puts forth a new training data-untethered model poisoning (MP)
attack on federated learning (FL). The new MP attack extends an adversarial
variational graph autoencoder (VGAE) to create malicious local models based
solely on the benign local models overheard without any access to the training
data of FL. Such an advancement leads to the VGAE-MP attack that is not only
efficacious but also remains elusive to detection. VGAE-MP attack extracts
graph structural correlations among the benign local models and the training
data features, adversarially regenerates the graph structure, and generates
malicious local models using the adversarial graph structure and benign models'
features. Moreover, a new attacking algorithm is presented to train the
malicious local models using VGAE and sub-gradient descent, while enabling an
optimal selection of the benign local models for training the VGAE. Experiments
demonstrate a gradual drop in FL accuracy under the proposed VGAE-MP attack and
the ineffectiveness of existing defense mechanisms in detecting the attack,
posing a severe threat to FL.

本文介绍了一种新的训练数据无控制模型污染攻击方法，该攻击针对联邦学习，在没有访问 FL 的训练数据的情况下，基于获取到的良性局部模型扩展了对抗性变分图自动编码器，从而生成了恶意局部模型。实验表明，基于该攻击方法的 VGAE-MP 攻击会导致联邦学习准确性下降，并且现有的防御机制无法检测到该攻击，对联邦学习构成严重威胁。