The decentralized nature of federated learning makes detecting and defending
against adversarial attacks a challenging task. This paper focuses on backdoor
attacks in the federated learning setting, where the goal of the adversary is
to reduce the performance of the model on targeted tasks while maintaining good
performance on the main task. Unlike existing works, we allow non-malicious
clients to have correctly labeled samples from the targeted tasks. We conduct a
comprehensive study of backdoor attacks and defenses for the EMNIST dataset, a
real-life, user-partitioned, and non-iid dataset. We observe that in the
absence of defenses, the performance of the attack largely depends on the
fraction of adversaries present and the "complexity'' of the targeted task.
Moreover, we show that norm clipping and "weak'' differential privacy mitigate
the attacks without hurting the overall performance. We have implemented the
attacks and defenses in TensorFlow Federated (TFF), a TensorFlow framework for
federated learning. In open-sourcing our code, our goal is to encourage
researchers to contribute new attacks and defenses and evaluate them on
standard federated datasets.

本文研究联邦学习中的后门攻击及防御，探讨了如何在 EMNIST 数据集上实现防御策略，结论表明采用范数削弱和差分隐私能够有效减轻后门攻击带来的影响，同时开放代码以期鼓励更多研究者参与其中。