Is it secure to measure the reliability of local models by similarity in
federated learning (FL)? This paper delves into an unexplored security threat
concerning applying similarity metrics, such as the L_2 norm, Euclidean
distance, and cosine similarity, in protecting FL. We first uncover the
deficiencies of similarity metrics that high-dimensional local models,
including benign and poisoned models, may be evaluated to have the same
similarity while being significantly different in the parameter values. We then
leverage this finding to devise a novel untargeted model poisoning attack,
Faker, which launches the attack by simultaneously maximizing the evaluated
similarity of the poisoned local model and the difference in the parameter
values. Experimental results based on seven datasets and eight defenses show
that Faker outperforms the state-of-the-art benchmark attacks by 1.1-9.0X in
reducing accuracy and 1.2-8.0X in saving time cost, which even holds for the
case of a single malicious client with limited knowledge about the FL system.
Moreover, Faker can degrade the performance of the global model by attacking
only once. We also preliminarily explore extending Faker to other attacks, such
as backdoor attacks and Sybil attacks. Lastly, we provide a model evaluation
strategy, called the similarity of partial parameters (SPP), to defend against
Faker. Given that numerous mechanisms in FL utilize similarity metrics to
assess local models, this work suggests that we should be vigilant regarding
the potential risks of using these metrics.

在联邦学习中，本文探讨了使用相似性度量（如 L_2 范数、欧氏距离和余弦相似度）保护联邦学习的一种未知安全威胁，揭示了相似性度量在高维本地模型中评估为相同但参数值显著不同的弱点，设计了一种新型的非定向模型中毒攻击 Faker，它通过同时最大化被中毒本地模型的评估相似性和参数值的差异来发起攻击，实验结果表明 Faker 在精度降低方面优于基准攻击，并可降低时间成本，甚至用于对 FL 系统具有有限知识的单个恶意客户端，Faker 可以一次性降低全局模型的性能，此外，本文还初步探讨了将 Faker 扩展到其他攻击类型，如后门攻击和赛贝尔攻击，并提供了一种模型评估策略 SPP 来防御 Faker，鉴于 FL 中许多机制使用相似性度量来评估本地模型，本研究表明我们应对使用这些度量的潜在风险保持警惕。