Data and Model Poisoning Backdoor Attacks on Wireless Federated Learning, and the Defense Mechanisms: A Comprehensive Survey

In the paper

“In return, the attack strength is weak, and the backdoor effect will be quickly diluted.”

In the paper

“The backdoor effect can last longer if the attack success rate is higher.”

In the paper

“Consequently, the attackers need to know more about the entire network, and the attack cost is greatly increased.”

In the paper

“The trigger-based backdoor attack can be improved using a coordinated trigger pattern, achieving a higher attack success rate.”

In the paper

“In general, the model poisoning-based backdoor attacks outperform data poisoning-based backdoor attacks while yielding a higher complexity.”

In the paper

“It can be seen that the global model replacement backdoor attack [37] launched during the aggregation process achieves the highest BAR while also maintaining a reasonable MAR.”

What the sources say

• Not checked yetcites [37] source

In the paper

“It is noted that all defense methods in different phases can reduce backdoor effects while maintaining a steady MAR.”

In the paper

“It is worth mentioning that, in most of the existing attack methods, a typical assumption is that, malicious participants are more likely to be selected in each training round, and the proportion of clients controlled by the attacker is typically high.”

In the paper

“It is worth mentioning that, in most of the existing attack methods, a typical assumption is that, malicious participants are more likely to be selected in each training round, and the proportion of clients controlled by the attacker is typically high.”

In the paper

“In fact, backdoor detection relies on threshold design in different defense mechanisms.”

In the paper

“Meanwhile, several defense strategies are not compatible with the security aggregation protocols.”

In the paper

“A critical challenge faced by detecting and defending against backdoor attacks is that backdoor attacks often do not negatively impact the accuracy of the model on primary tasks and do not disrupt the normal system operation before they are activated [32].”

What the sources say

• Not checked yetcites [32] Bagdasaryan, How to backdoor federated learning

In the paper

“However, WFL will be more vulnerable to backdoor attacks than its wired counterpart due to a combination of factors inherent to wireless networks.”

In the paper

“By taking advantage of the overheard local models, the misbehaved participants can construct malicious local models to escape malicious model detection at the central server, poison the global model and subsequently the benign local models, and manipulate WFL [35].”

What the sources say

• Not checked yetcites [35] source

In the paper

“The WFL vulnerabilities potentially open the door for backdoor attacks.”

In the paper

“The detection of backdoors typically relies on threshold design, and the training of existing defense mechanisms often requires access to historical information about the attacks.”

In the paper

“In [52] and [53], the theoretical working mechanisms of backdoor attacks and defenses for WFL were reviewed. However, the limitations of the existing methodologies were not systematically analyzed.”

What the sources say

• Not checked yetcites [52] source
• Not checked yetcites [53] Nguyen, 2023, Backdoor attacks and defenses in federated learning: Survey, challenges and future research directions, arXiv:2303.02213

In the paper

“On the other hand, in [48], [49], [50], and [51], WFL was considered as one of the deep learning applications when discussing the impact of backdoor attacks, but no detailed analysis of vulnerabilities of backdoor attacks on WFL was provided.”

What the sources say

• Not checked yetcites [48] Gao, 2020, Backdoor attacks and countermeasures on deep learning: A comprehensive review, arXiv:2007.10760
• Not checked yetcites [49] source
• Not checked yetcites [50] source

In the paper

“This makes them more threatening and more difficult to defend against, as the defender needs to consider all steps in the process.”

In the paper

“Despite the rapid growth of WFL as a research area, there has not yet been a comprehensive and up-to-date review of it from the perspective of backdoor attacks.”

In the paper

“This property allows the backdoor to remain effective for a longer duration, making it difficult to eliminate fully.”

In the paper

“The detection of backdoors typically relies on threshold design, and the training of existing defense mechanisms often requires access to historical information about the attacks.”

In the paper

“In the survey [50], the backdoor attack strategies were discussed in depth, but they were not discussed in the context of WFL.”

What the sources say

• Not checked yetcites [50] source

In the paper

“This can make it more challenging to maintain constant security measures, making the system more prone to backdoor attacks.”

In the paper

“This inconsistency can lead to data corruption or loss, and an attacker might exploit the inconsistency to inject malicious backdoor attacks.”

In the paper

“Moreover, with the broadcast nature of wireless interfaces, adversaries can potentially overhear local model updates from multiple or even all clients and accordingly create malicious local models to compromise WFL, e.g., using generative neural networks and machine learning technologies.”

What the sources say

• Not checked yetcites [35] source
• Not checked yetcites [114] source

In the paper

“For example, in [35], [114], a new adversarial attack on WFL is studied by exploiting the broadcast nature of wireless channels, where a rogue client collects the local model updates that benign clients upload. The rogue client can take these overheard local model updates as input to a graph adversarial encoder (GAE) to produce a malicious local model update. The malicious local model update can”

What the sources say

• Not checked yetcites [35] source
• Not checked yetcites [114] source

In the paper

“In OTA-WFL with uncoded transmission, gradients are transmitted directly over wireless channels without encoding or encryption. The lack of coding or encryption in transmission means that any vulnerability in the wireless channel, such as weak signal encryption or interception by unauthorized receivers, can lead to significant privacy breaches. Moreover, since gradients carry information about the”

What the sources say

• Not checked yetcites [97] source

In the paper

“This makes managing and securing each device more difficult and increases the overall attack surface.”

In the paper

“Data transmissions over wireless links are through airwaves, making it easier for attackers to eavesdrop [75]-[78], jam [79], and manipulate data, e.g., replay attack and Sybil attack, or intrude the networks [80], [81].”

What the sources say

• Not checked yetcites [75]-[78]
• Not checked yetcites [79] source
• Not checked yetcites [80], [81]

In the paper

“The primary objective of the backdoor attack is to generate a converged global model with high accuracy of the main task and the backdoor-injected sub-task [107].”

What the sources say

• Not checked yetcites [107] source

In the paper

“Under the setting of OTA-WFL, the authors of [97] control the relative intensity of the receiver noise power at the central server by controlling the transmit powers of the clients. The resulting relative intensity of the receiver noises can offer privacy-preserving capability, like DP noises.”

What the sources say

• Not checked yetcites [97] source

In the paper

“The effectiveness of an aggregation phase attack is mainly determined by the knowledge of the model controlled by attackers.”

In the paper

“This is due to the fact that the random errors resulting from wireless fading and receiver noises can potentially serve to perturb the model updates, hence achieving the effect of DP and alleviating the impact of the attacks.”

In the paper

“The objective of a backdoor attack on WFL is to mislead the global model to misclassify malicious inputs with injected backdoor patterns into the target output, with application to image classification [127]-[136], word prediction [137][142], etc.”

What the sources say

• Not checked yetcites [127]-[136]
• Not checked yetcites [137][142]

In the paper

“Backdoor attacks conducted during the aggregation process generally do not alter the targeted model. Instead, the attacker is keen on tricking it into producing wrong predictions and causing security problems [32].”

What the sources say

• Not checked yetcites [32] Bagdasaryan, How to backdoor federated learning

In the paper

“The model will behave normally and predict a target class when the trigger appears, e.g., in the same room with a facial recognition lock, all men with glasses will be authorized to enter.”

In the paper

“Generally, a high BAR is equivalent to a high ASR and BTA.”

What the sources say

• Not checked yetcites [143] source
• Not checked yetcites [144] source
• Not checked yetcites [32] Bagdasaryan, How to backdoor federated learning

In the paper

“Compared with training process attacks, the aggregation phase attacks can have stronger attack effects while there is a trade-off between the stealthiness and the attack success rate (ASR).”

In the paper

“In a local data collection phase backdoor attack, an individual feature or a small region of the local training data is modified by malicious users deliberately [117].”

What the sources say

• Not checked yetcites [117] Schwarzschild, Just how toxic is data poisoning? A unified benchmark for backdoor and data poisoning attacks

In the paper

“The primary objective of backdoor attacks is to manipulate the converged global model to misclassify specifically crafted inputs with hidden backdoors into a desired target label while ensuring that normal inputs are classified accurately.”

In the paper

“The inevitable problem of the simple label-flipping method still exists in that the flipped data set under the targeted label results in a remarkable outlier in the model training. Thus, it can be detected by norm clipping [164] or differential privacy [38], [38], [164], [165].”

What the sources say

• Not checked yetcites [164] Xie, CRFL: Certifiably robust federated learning against backdoor attacks
• Not checked yetcites [38] Nguyen, FLAME: Taming backdoors in federated learning
• Not checked yetcites [165] Zhang, 2023, Bounded and unbiased composite differential privacy, arXiv:2311.02324

In the paper

“In general, label-flipping depends on the data sets and is agnostic to the models to be trained and the communication interfaces.”

In the paper

“Due to the nature of FL, the backdoor effect in the global model tends to be diluted with the increment of the training round.”

In the paper

“In label-flipping-based backdoor attacks, the training data set under the targeted label is replaced by the backdoored data set [162].”

What the sources say

• Not checked yetcites [162] source

In the paper

“Each client's data distribution is not representative of the global data distribution, implying that the categories in each client are incomplete.”

In the paper

“To improve the stealthiness of the label flipping-based backdoor attack, the target label is selected on the tail in [33]. In this case, the data distribution is required, and the edge data set is selected as the target.”

What the sources say

• Not checked yetcites [33] Wang, Attack of the tails: Yes, you really can backdoor federated learning

In the paper

“Different from Byzantine attacks, which aim to jeopardize the convergence of the global model [145]-[147], the backdoor attacks focus on inserting backdoor patterns into the global model while maintaining a reasonable MAR.”

What the sources say

• Not checked yetcites [145]-[147]

In the paper

“Different from backdoor attack designs, which pursue high BAR, MAR, and long lifespan, the defenders aim to minimize the BAR and lifespan of the backdoor effect while preventing the MAR from degradation.”

In the paper

“As shown in Table IV, label flipping attacks, coordinated trigger attacks, local model replacement attacks, and aggregation process attacks are likely to be exacerbated in WFL.”

In the paper

“Replacing the edge target data set with a backdoored data set, the local model behaves correctly with normal inputs while misclassifying the adversarial inputs on the edge label.”

What the sources say

• Not checked yetcites [33] Wang, Attack of the tails: Yes, you really can backdoor federated learning

In the paper

“This is due to the broadcast nature of wireless communications, which facilitates various forms of cyber threats, such as spoofing attacks, Sybil attacks, and eavesdropping attacks.”

In the paper

“The primary objective of triggerbased backdoor attacks is to mislead the model to classify the trigger-mounted inputs into the target label while behaving normally with non-trigger inputs [38], [116], [126].”

What the sources say

• Not checked yetcites [38] Nguyen, FLAME: Taming backdoors in federated learning
• Not checked yetcites [116] source
• Not checked yetcites [126] Zhang, Neurotoxin: Durable backdoors in federated learning

In the paper

“In a random trigger-based backdoor attack, the trigger is generated independently of the model [122], [140], [169], [170].”

What the sources say

• Not checked yetcites [122] Xie, DBA: Distributed backdoor attacks against federated learning
• Not checked yetcites [140] Pan, Hidden trigger backdoor attack on NLP models via linguistic style manipulation
• Not checked yetcites [169] source

In the paper

“According to the number of adversarial participants involved in an attack, trigger-based backdoor attacks can be classified into centralized trigger-based backdoor attacks and coordinated triggerbased backdoor attacks.”

In the paper

“With the additional knowledge of the local models along with the global model, the model-dependent triggers can be potentially further enhanced, e.g., by employing adversarial generative networks and training [174].”

What the sources say

• Not checked yetcites [174] source

In the paper

“The advantage is that the attack cost is greatly reduced.”

In the paper

“Depending on different patterns of the trigger, the triggerbased backdoor attacks can be further divided into random trigger backdoor attacks and model-dependent trigger backdoor attacks, as follows.”

In the paper

“The model-dependent trigger can help to excite the target label and has a higher probability of being successfully injected into the trained local model before aggregation [172].”

What the sources say

• Not checked yetcites [172] source

In the paper

“Both label-flipping-based and triggerbased data poisoning backdoor attacks can be treated as blackbox attacks [33].”

What the sources say

• Not checked yetcites [33] Wang, Attack of the tails: Yes, you really can backdoor federated learning

In the paper

“In the local model training phase, the backdoor attacks can be conducted by manipulating the model parameters during the training process or modifying the training algorithm [126], [177].”

What the sources say

• Not checked yetcites [126] Zhang, Neurotoxin: Durable backdoors in federated learning
• Not checked yetcites [177] source

In the paper

“The local training time that remains in a communication round would be short, leading to insufficiently trained local models and, hence, vulnerabilities to backdoor attacks.”

In the paper

“For instance, the increasingly widely deployed wireless communication technologies, e.g., 5G, operate in high-frequency bands of up to 40 GHz, and the wavelength of the carrier frequency can be as short as 7.5 millimeters [175].”

What the sources say

• Not checked yetcites [175] source

In the paper

“With a newly designed training algorithm, the norm difference between the backdoored and benign models decreases, the backdoor becomes harder to detect, and the attack success rate improves.”

In the paper

“The common problem of centralized triggerbased backdoor attacks is that the single attacker's effect is limited, and it cannot be ensured that the attacker is selected in every round.”

In the paper

“It has been discussed in the previous section that the simple label-flipping attack exhibits a low attack success rate.”

In the paper

“The attacks at this stage are also known as white box attacks.”

In the paper

“Furthermore, the knowledge of the defense mechanism adopted in the WFL network is also required to ensure the injection of the backdoor.”

In the paper

“The attacker needs to master the training data set, as well as the local training process.”

In the paper

“On the other hand, when frequency-division multiple-access (FDMA) protocols, including orthogonal frequency-division multiple-access (OFDMA) protocols, are considered, each selected client would enjoy much narrower bandwidths, which would prolong their model uploading time at the cost of their model training time [180].”

What the sources say

• Not checked yetcites [180] source

In the paper

“The proposed attack ensures that the backdoor is bound to be injected in one round and will not be diluted.”

In the paper

“The injected backdoor pattern is also easy to detect, and the life span of the backdoor effect is short.”

In the paper

“Such black-box attacks featured low attack costs but also relatively low backdoor effects [155].”

What the sources say

• Not checked yetcites [155] source

In the paper

“Once the attacker obtains the knowledge of the training algorithm, it can fully control the compromised client and initiate the model poisoning backdoor attack during the local model training phase.”

In the paper

“Moreover, the attack shows better performance when the global model is close to complete convergence, so the attacker also needs to know the information on the convergence progress of the global model.”

In the paper

“The label-flippingbased data poisoning backdoor attack is the easiest to implement.”

In the paper

“The malicious attacker can then conduct the attack by hijacking one or more compromised clients that are close to the essential node. Thus, the backdoor effect is more likely to be injected into the network and spread more broadly.”

In the paper

“However, in decentralized WFL, each client can behave as the server, and only receives model information from nodes within its neighborhood.”

In the paper

“A backdoor attack at this phase can only pollute the training data, and the attackers do not necessarily know the training algorithm and aggregation protocol.”

In the paper

“The global model replacement method aims to manipulate the local training algorithm, and the adversarial updates are guaranteed to be uploaded for aggregation.”

In the paper

“However, training the backdoor filter on the server side requires prior information about the backdoor patterns and backdoored data sets.”

In the paper

“The backdoor attack success rate under the defense mechanism reduces to zero, while the stability-based defense can ensure a high success rate for the main task.”

What the sources say

• Not checked yetcites [191] source

In the paper

“The attacks at this stage have a better attack success rate, but the requirement of the model training information increases the attack cost.”

In the paper

“The defense schemes can be classified into four types: defense at the local training phase, defense before the aggregation phase, defense during the aggregation phase, and defense after the aggregation phase.”

In the paper

“In return, the attackers need to master the local training data, local training algorithm, and the global aggregation protocol, making it hard to implement in practical scenarios.”

In the paper

“Moreover, the blur operation can only deal with the trigger in the pixel pattern.”

In the paper

“In the experimental setup, the number of participants is set to 10, and the training data are IID.”

What the sources say

• Not checked yetcites [191] source

In the paper

“Compared with benign clients, the backdoor attackers are likely to upload updates with relatively larger norms.”

In the paper

“Thus, the trade-off between the primary task accuracy and attack defense rate must be considered when adding the noise.”

In the paper

“The defense mechanisms at this stage are also compatible with the SecAgg protocol.”

In the paper

“The defense performance might degrade in the actual WFL, where the number of clients is larger, and the training data sets are typically non-IID.”

In the paper

“For this reason, the UDP is more commonly adopted in WFL [201].”

What the sources say

• Not checked yetcites [201] source

In the paper

“For instance, the TCP can ensure the reliable delivery of data across a network but requires one or multiple retransmissions in each communication cycle [200].”

What the sources say

• Not checked yetcites [200] source

In the paper

“Another commonly adopted defense strategy against backdoor attacks is to detect the anomaly updates before sending them to the aggregator.”

In the paper

“Wireless devices can be resource-constrained, e.g., in terms of energy supply and communication resources.”

In the paper

“The remaining challenges are that the defender requires the proper knowledge of the backdoor patterns, and the trade-off between the defense performance and significant task accuracy must also be considered [192].”

What the sources say

• Not checked yetcites [192] source

In the paper

“Many efforts have been carried out to deal with both data poisoning backdoor attack [193]-[195] and model poisoning backdoor attack [196]-[198].”

What the sources say

• Not checked yetcites [193]-[195]
• Not checked yetcites [196]-[198]

In the paper

“This can penalize the local models by reducing the local training time in a communication cycle.”

In the paper

“Client selection and scheduling are indispensable in the context of WFL.”

In the paper

“There is a significant opportunity to couple the designs of both in a holistic way to improve defense effectiveness and efficiency.”

In the paper

“To date, the client selection/scheduling has been designed in parallel to the backdoor defense studies.”

In the paper

“The encoder-decoder architecture requires extra unbiased updates to train the detector, and it is pretty hard to implement in real WFL applications.”

What the sources say

• Not checked yetcites [202] Li, 2020, Learning to detect malicious clients for robust federated learning, arXiv:2002.00211

In the paper

“After removing the noisy and redundant features of these data instances, the difference between benign and malicious updates becomes apparent.”

In the paper

“The basic idea of low-dimensional anomaly detection methods is to project the compact computed local model onto its low-dimension space, as given by:”

In the paper

“The malicious attacker cannot inject completed backdoor patterns in a short time, thus improving the robustness of the global model.”

What the sources say

• Not checked yetcites [204] source

In the paper

“The PCA-based method requires prior knowledge of the targeted backdoor label, which is also hard to know in practical defense implementation.”

What the sources say

• Not checked yetcites [203] source

In the paper

“The low-dimensional methods are also incompatible with the SecAgg protocol, and the privacy of the participants in the WFL network cannot be guaranteed.”

What the sources say

• Not checked yetcites [202] Li, 2020, Learning to detect malicious clients for robust federated learning, arXiv:2002.00211
• Not checked yetcites [203] source

In the paper

“The clipping should filter not only the updates from clients but different communication channels as well.”

In the paper

“Due to the feature of WCN, the communication channels with better signals can be better selected in WFL.”

In the paper

“The reconstruction error of the benign updates is much smaller than that of the malicious updates.”

What the sources say

• Not checked yetcites [202] Li, 2020, Learning to detect malicious clients for robust federated learning, arXiv:2002.00211

In the paper

“The proposed method ensures the privacy of the participants involved.”

What the sources say

• Not checked yetcites [204] source

In the paper

“The ratio of information gathered from remote network nodes should be considered to prevent backdoor effects and ensure fairness.”

In the paper

“Meanwhile, the above-mentioned methods can only distinguish label-flipping-based backdoor attacks and cannot deal with trigger-based backdoor attacks.”

What the sources say

• Not checked yetcites [202] Li, 2020, Learning to detect malicious clients for robust federated learning, arXiv:2002.00211
• Not checked yetcites [203] source

In the paper

“However, the data distortion and packet loss caused by network communications need to be considered when designing the norm clipping threshold.”

In the paper

“The biggest cluster is recognized as the benign update, while the malicious updates lie within a visibly different cluster.”

What the sources say

• Not checked yetcites [203] source

In the paper

“The defense schemes proposed in [204] and [205] require modifying the local training process, and the backdoor effect can only be suppressed and cannot be entirely eliminated.”

What the sources say

• Not checked yetcites [204] source
• Not checked yetcites [205] source

In the paper

“The method requires the number of malicious attacks to be smaller than 50% of the total selected clients in each round.”

What the sources say

• Not checked yetcites [204] source
• Not checked yetcites [205] source

In the paper

“In each round, the central server selects subsets of the participants. Each subset computer updates. Then, each subset follows the SecAgg protocol and sends the cryptographymasked updates. Although the server cannot access each client's update, it can migrate the effect of backdoor attacks by ignoring visibly different subset updates.”

What the sources say

• Not checked yetcites [205] source

In the paper

“It shows good defensive performance against both data poisoning and model poisoning backdoor attacks.”

What the sources say

• Not checked yetcites [38] Nguyen, FLAME: Taming backdoors in federated learning

In the paper

“In such a design, the participant's privacy is ensured, and it can be applied to defend against label-flipping-based, trigger-based, and model replacement-based backdoor attacks.”

What the sources say

• Not checked yetcites [205] source

In the paper

“Similar to the aggregation modification method, the proposed defense mechanism requires the individual to update information from the participant on the server side. Thus, it is not compatible with the SecAgg. The participants' privacy security cannot be guaranteed.”

What the sources say

• Not checked yetcites [212] source
• Not checked yetcites [213] source

In the paper

“The central server simulates the WFL tasks under various types of backdoor attacks. Then, the simulated model updates are collected to train a separate neural network model, which learns the potential vulnerability of the global model against different backdoor attacks.”

What the sources say

• Not checked yetcites [219] source

In the paper

“If the alignment score 𝑠 𝑖 is closer to + 1 , 𝑝 𝑖 is more likely to be a benign update. On the other hand, if 𝑠 𝑖 is close to -1 , 𝑝 𝑖 is likely to be an adversary update.”

What the sources say

• Not checked yetcites [219] source

In the paper

“In this design, the model weights are pre-processed to obtain the discernible patterns of filters. Multiple filters are then collected and fed into an unsupervised anomaly detection algorithm to detect the suspicious filters.”

What the sources say

• Not checked yetcites [220] Mi, 2022, ARIBA: Towards accurate and robust identification of backdoor attacks in federated learning, arXiv:2202.04311

In the paper

“This design has no constraints on the number of malicious clients, and it demonstrates reasonable performance against data poisoning attacks.”

What the sources say

• Not checked yetcites [218] Fung, The limitations of federated learning in Sybil settings

In the paper

“The FoolsGold is proposed in [218], and the adversarial attack is detected based on the diversity of the model updates. In a WFL framework, the benign client's updates tend to have richer diversity, while the adversary normally behaves similarly.”

What the sources say

• Not checked yetcites [218] Fung, The limitations of federated learning in Sybil settings

In the paper

“The aggregator requires the knowledge of individual model updates, which violates the SecAgg protocol. The proposed method performs poorly in the non-IID situation and cannot ensure privacy and security.”

What the sources say

• Not checked yetcites [211] Fu, 2019, Attack-resistant federated learning with residual-based reweighting, arXiv:1912.11464

In the paper

“The major problem of this defense method is that to distinguish the malicious updates, all possible backdoor attack patterns must be trained in the server before implementation. During the detection, the aggregator requires access to single local updates. Thus, the privacy of the participant is at risk of leaking.”

What the sources say

• Not checked yetcites [219] source

In the paper

“In the FedEraser design, no substantial modification is required to the existing WFL architecture and the training process of the participants. Thus, the proposed method is easy to implement.”

What the sources say

• Not checked yetcites [224] source

In the paper

“although the training data and the training process are not required, the FedEraser must target the attacker client, which is also pretty hard in actual implementation.”

What the sources say

• Not checked yetcites [224] source

In the paper

“In [224], the federated unlearning methodology, namely, FedEraser, is proposed. In this scheme, the central server stores the historical updates received from clients during the global model training process. Once the global model converges, the FedEraser reconstructs an unlearned model in the central server based on the stored historical parameters.”

What the sources say

• Not checked yetcites [224] source

In the paper

“The knowledge distillation method is proposed in [216], [226] to restore the global model's performance. In this design, the central server stores the historical parameters of the participating clients. Once the global model is obtained. The contribution of the targeted malicious clients is subtracted, and a skewed unlearning model is derived. Then, the knowledge distillation is performed. The”

What the sources say

• Not checked yetcites [216] source
• Not checked yetcites [226] Wu, 2022, Federated unlearning with knowledge distillation, arXiv:2201.09441

In the paper

“The unsupervised anomaly detection methods proposed in [220] and [222] are incompatible with the SecAgg protocol. Thus, data privacy and security can hardly be ensured.”

What the sources say

• Not checked yetcites [220] Mi, 2022, ARIBA: Towards accurate and robust identification of backdoor attacks in federated learning, arXiv:2202.04311
• Not checked yetcites [222] source

In the paper

“the emerging OTA-WFL may pose new challenges to the existing defense mechanisms designed for the aggregation phase due to the fact that the FL server would only access the aggregated global model under OTA-WFL [14], [101]. The local models of individual clients are obscured. While this helps improve the privacy of the individuals' local models to a great extent, it allows backdoor attacks to take”

What the sources say

• Not checked yetcites [14] source
• Not checked yetcites [101] source

In the paper

“The calibration process during the unlearned model training relies on the historical updates of the participating clients. The limited store capability of the hardware makes it hard to deploy in practice.”

What the sources say

• Not checked yetcites [224] source

In the paper

“The server will store the historic value gathered from participants to train a reference global model, based on which the trained converged WFL global model is examined to filter the anomaly contribution from suspicious clients. By excluding the influence of suspicious clients, the backdoor effect will be entirely eliminated.”

In the paper

“The post-aggregation backdoor defense mechanisms, i.e., performed upon the aggregated global models, can be particularly important for the emerging OTA-WFL systems to circumvent the obscurity of the local models in the OTAWFL processes.”

In the paper

“The defense during the aggregation is capable of identifying the backdoored updates from the malicious clients and excluding them from rejecting backdoor injection. The defenders are located on the server side, and normally, they are not compatible with SecAgg.”

In the paper

“Meanwhile, the proposed method is not compatible with SecAgg, and the privacy of the participants is at risk of leakage.”

What the sources say

• Not checked yetcites [216] source
• Not checked yetcites [226] Wu, 2022, Federated unlearning with knowledge distillation, arXiv:2201.09441

In the paper

“Defense before the aggregation phase is also mounted on the client side. The defender is keen to exclude suspicious updates before sending them to the aggregator. Some methodologies employ the modification of SecAgg, thus making it hard to be configured in practical WFL networks.”

In the paper

“The low BAR of triggerbased backdoor attacks could be due to insufficient CCR.”

In the paper

“It is also testified that the proposed knowledge distillation-based unlearning method can improve the robustness of the global model and defend against all types of backdoor attacks [227].”

What the sources say

• Not checked yetcites [227] source

In the paper

“The unlearning mechanism requires the knowledge of the target clients, and the attackers are normally stealthy in practical scenarios.”

What the sources say

• Not checked yetcites [216] source
• Not checked yetcites [226] Wu, 2022, Federated unlearning with knowledge distillation, arXiv:2201.09441

In the paper

“However, the attacker must obtain sufficient knowledge of the whole WFL network, introducing a considerable attack cost, as discussed in Section III-C.”

What the sources say

• Not checked yetcites [37] source

In the paper

“Defense methods at the local training phase are implemented on the client side, aiming at the data poisoning attacks. The defense cost is relatively low, and the defense mechanism at this stage is compatible with SecAgg.”

In the paper

“The defense after the aggregation phase will evaluate the converged global model to test whether it has been polluted by the backdoor pattern or not. The defense mechanism is also at the server side, and the historical information gathered from the participant is necessarily needed.”

In the paper

“The existing defense methods can be broadly divided into four categories: defense at the local training phase, defense before the aggregation phase, defense during the aggregation phase, and defense after the aggregation phase.”

In the paper

“Compared with a backdoor attack for data, a model-based backdoor attack shows better ASR and longer duration [164].”

What the sources say

• Not checked yetcites [164] Xie, CRFL: Certifiably robust federated learning against backdoor attacks

In the paper

“However, such defense methods [218], [224] require the historical information of local model updates and are not compatible with SecAgg, which brings more difficulty in the practical implementation.”

What the sources say

• Not checked yetcites [218] Fung, The limitations of federated learning in Sybil settings
• Not checked yetcites [224] source

In the paper

“Consequently, it is more unlikely to be detected, and the attack strength is relatively weaker.”

In the paper

“However, the model poisoning-based backdoor attack algorithms have relatively higher complexity and normally require much more information about the entire network.”

In the paper

“Meanwhile, the Gaussian noise introduced by differential privacy also adds extra disturbance to the global model training process.”

In the paper

“This type of 'tail backdoor' can remain undetected for a longer duration but only affects the classification of a subset of the training samples.”

In the paper

“The optimal weight must be carefully designed to achieve the highest ASR without detection.”

In the paper

“There is a trade-off between the ASR and the strength of the backdoor effect in this case.”

In the paper

“Third, the WFL framework is featured for its non-IID property.”

In the paper

“And there is no proven solution to deal with the injected backdoor pattern after the aggregation phase.”

In the paper

“Label-flipping-based attacks have low attack costs, but the flipped labels can cause noticeable outliers in the uploaded updates, making them easy to detect and eliminate [123].”

What the sources say

• Not checked yetcites [123] Rosenfeld, Certified robustness to label-flipping attacks via randomized smoothing

In the paper

“Compared to data poisoning with model poisoning, data poisoning backdoor attack shows a relatively lower attack cost, and model poisoning attack has a better attack accuracy rate and longer backdoor life span.”

In the paper

“The local model training process is difficult to tamper with, and the effects of a backdoor can be quickly diluted if compromised clients are not frequently selected.”

In the paper

“With a higher knowledge level known by the attack, the attack success rate is higher as well.”

In the paper

“In return, the attack cost will also dramatically increase.”

In the paper

“Backdoor attacks during the model aggregation phase have the highest success rate but also the highest cost [212].”

What the sources say

• Not checked yetcites [212] source

In the paper

“Within the data poisoning attack, label flipping is one of the easiest attack methods, resulting in a lower success rate, and can be easily detected.”

In the paper

“The defender usually clips the contribution from suspicious clients to get rid of the backdoor effect.”

In the paper

“The defender is hard to trace back to the compromised client and leaves it out of the network.”

In the paper

“Such a newly trained classifier requires information on all possible backdoor patterns, and the defense cost is high.”

In the paper

“Trigger-based attacks also create outliers, but these can be designed based on the target label to decrease the likelihood of detection.”

In the paper

“Since all defense methods inherently eliminate the suspicious backdoor effect by clipping the possible malicious updates, inevitably, a portion of honest updates will be neglected by mistake.”

In the paper

“In this process, some honest information will be miss-clipped, and the main task accuracy will be influenced.”

In the paper

“A trigger-based backdoor is the most adopted one, and with the proper design trigger pattern, the attack performance will be greatly improved.”

In the paper

“Defense methods based on differential privacy (DP) can add noise to the model, which can degrade its performance.”

In the paper

“However, considering all possible backdoor patterns to achieve good defense performance can be costly, and the defense may not be able to detect novel attacks.”

In the paper

“This type of defense is effective in defending against black-box backdoor attacks and can be used with a secure aggregation protocol.”

In the paper

“However, the training process of WFL is random, which raises questions about the reliability of historic values.”

In the paper

“However, such a coordinated attack is still based on the black box model, resulting in limited attack strength.”

In the paper

“Additionally, the defense requires the attacker to participate in every training round, which may not be practical.”

In the paper

“Furthermore, the non-IID structure of WFL frameworks can make it challenging to defend against backdoor attacks while preserving the privacy and security of participants.”

In the paper

“Such imbalanced data distribution will have a significant impact on model update calculation and upload.”