Federated Learning (FL) has been gaining popularity as a collaborative
learning framework to train deep learning-based object detection models over a
distributed population of clients. Despite its advantages, FL is vulnerable to
model hijacking. The attacker can control how the object detection system
should misbehave by implanting Trojaned gradients using only a small number of
compromised clients in the collaborative learning process. This paper
introduces STDLens, a principled approach to safeguarding FL against such
attacks. We first investigate existing mitigation mechanisms and analyze their
failures caused by the inherent errors in spatial clustering analysis on
gradients. Based on the insights, we introduce a three-tier forensic framework
to identify and expel Trojaned gradients and reclaim the performance over the
course of FL. We consider three types of adaptive attacks and demonstrate the
robustness of STDLens against advanced adversaries. Extensive experiments show
that STDLens can protect FL against different model hijacking attacks and
outperform existing methods in identifying and removing Trojaned gradients with
significantly higher precision and much lower false-positive rates.

本文提出了一种名为 STDLens 的三层取证框架，以保护联邦学习（FL）免受模型劫持的攻击。通过识别和驱逐 Trojaned 梯度，STDLens 可以对不同的模型劫持攻击进行保护，并且在识别和删除 Trojaned 梯度方面的精度和假阳性率方面均优于现有的方法。