Targeted model poisoning attacks pose a significant threat to federated
learning systems. Recent studies show that edge-case targeted attacks, which
target a small fraction of the input space are nearly impossible to counter
using existing fixed defense strategies. In this paper, we strive to design a
learned-defense strategy against such attacks, using a small defense dataset.
The defense dataset can be collected by the central authority of the federated
learning task, and should contain a mix of poisoned and clean examples. The
proposed framework, LearnDefend, estimates the probability of a client update
being malicious. The examples in defense dataset need not be pre-marked as
poisoned or clean. We also learn a poisoned data detector model which can be
used to mark each example in the defense dataset as clean or poisoned. We
estimate the poisoned data detector and the client importance models in a
coupled optimization approach. Our experiments demonstrate that LearnDefend is
capable of defending against state-of-the-art attacks where existing fixed
defense strategies fail. We also show that LearnDefend is robust to size and
noise in the marking of clean examples in the defense dataset.

本研究提出了使用一小部分的防御数据集来防范边缘用例攻击的观点。该模型 LearnDefend 可以估计客户更新是恶意的概率，并学习一个可以标记清洁或污染例子的被毒害数据检测器模型。同时，该学习防御模型在配对优化时还估计客户端的重要性模型。经实验证明，LearnDefend 可以有效地防御目前最先进的攻击方法，并且对防御数据集中清洁样本的大小和噪音具有较强的鲁棒性。