CoChat
Sign Up
PreprintCited by 63Privacy-Preserving Technologies in DataBlockchain Technology Applications and SecurityCryptography and Data Security

Biscotti: A Ledger for Private and Secure Peer-to-Peer Machine Learning

Open access
Shayan, Muhammad, Fung, Clement, Yoon, Chris J. M., Beschastnikh, Ivan·2018·arXiv
DOI 10.48550/arxiv.1811.09904arXiv 1811.09904
Open this paper in CoChat — free accountOpen PDF

Abstract

Federated Learning is the current state of the art in supporting secure multi-party machine learning (ML): data is maintained on the owner's device and the updates to the model are aggregated through a secure protocol. However, this process assumes a trusted centralized infrastructure for coordination, and clients must trust that the central service does not use the byproducts of client data. In addition to this, a group of malicious clients could also harm the performance of the model by carrying out a poisoning attack. As a response, we propose Biscotti: a fully decentralized peer to peer (P2P) approach to multi-party ML, which uses blockchain and cryptographic primitives to coordinate a privacy-preserving ML process between peering clients. Our evaluation demonstrates that Biscotti is scalable, fault tolerant, and defends against known attacks. For example, Biscotti is able to protect the privacy of an individual client's update and the performance of the global model at scale when 30% of adversaries are trying to poison the model. The implementation can be found at: https://github.com/DistributedML/Biscotti

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Integrity signals

Registry

DataCite · 10.48550/arxiv.1811.09904

Cites

Statistics

Claims the paper makes

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

  • Fully decentralized federated learning removes the central server and lets clients communicate only with one-hop neighbors.

    “Therefore, some researches began to study fully decentralized framework where the central server is not required [41, 60, 85, 91]. The local clients are distributed over the graph/network where they only communicate with their one-hop neighbors.”

    From Federated Learning for Healthcare Informatics (2021) · cites this paper as [91]

    The Abstract (p. 1) describes Biscotti as a fully decentralized peer-to-peer approach, supporting the claim that it does not require a central server. The Noising protocol (p. 7) says a peer contacts selected noising peers, but our copy does not establish that clients communicate only with one-hop neighbors. (LLM, conf=0.87)

    Experimental — accuracy not yet measured

  • The incentive mechanism prevents poisoning attacks.

    “Specifically, by combining the Multi-KRUM [51,52] and the reputation-based incentive protocols [53], an incentive mechanism is designed to prevent the poisoning attack as well as reward contributors properly.”

    From Privacy-Preserving Blockchain-Based Federated Learning for IoT Devices (2021) · cites this paper as [52]

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

The self-check needs the paper’s full text.

Cites

Still being checked.

Research works printed but not linked: 38

  1. [4][4] ABADI, M., CHU, A., GOODFELLOW, I., MCMAHAN, B., MIRONOV, I., TALWAR, K., AND ZHANG, L. Deep learning with differential privacy. In 23rd ACM Conference on Computer and Communications Security (2016), CCS. -
  2. [6][6] BAGDASARYAN, E., VEIT, A., HUA, Y., ESTRIN, D., AND SHMATIKOV, V. How To Backdoor Federated Learning. ArXiv eprints (2018). -
  3. [7][7] BARACALDO, N., CHEN, B., LUDWIG, H., AND SAFAVI, J. A. Mitigating poisoning attacks on machine learning models: A data provenance based approach. In Proceedings of the 10th ACM Workshop on Artificial Intelligence and Security (2017), AISec. -
  4. [9][9] BHAGOJI, A. N., CHAKRABORTY, S., MITTAL, P., AND CALO, S. Analyzing federated learning through an adversarial lens. In Proceedings of the 36th International Conference on Machine Learning (2019). -
  5. [10][10] BIGGIO, B., NELSON, B., AND LASKOV, P. Poisoning Attacks Against Support Vector Machines. In Proceedings of the 29th International Coference on International Conference on Machine Learning (2012), ICML. -
  6. [11][11] BLANCHARD, P., EL MHAMDI, E. M., GUERRAOUI, R., AND STAINER, J. Machine learning with adversaries: Byzantine tolerant gradient descent. In Advances in Neural Information Processing Systems 30 , NIPS. 2017. -
  7. [12][12] BONAWITZ, K., IVANOV, V., KREUTER, B., MARCEDONE, A., MCMAHAN, H. B., PATEL, S., RAMAGE, D., SEGAL, A., AND SETH, K. Practical secure aggregation for privacy-preserving machine learning. In Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security (2017), CCS. -
  8. [13][13] BOTTOU, L. On-line learning in neural networks. Cambridge University Press, 1999. -
  9. [15][15] CASTRO, M., AND LISKOV, B. Practical byzantine fault tolerance. In Proceedings of the Third Symposium on Operating Systems Design and Implementation (1999), OSDI '99. -
  10. [16][16] CHENG, R., ZHANG, F., KOS, J., HE, W., HYNES, N., JOHNSON, N., JUELS, A., MILLER, A., AND SONG, D. Ekiden: A platform for confidentiality-preserving, trustworthy, and performant smart contract execution. ArXiv e-prints (2018). -
  11. [17][17] DEAN, J., CORRADO, G. S., MONGA, R., CHEN, K., DEVIN, M., LE, Q. V., MAO, M. Z., RANZATO, M., SENIOR, A., TUCKER, P., YANG, K., AND NG, A. Y. Large scale distributed deep networks. In Proceedings of the 25th International Conference on Neural Information Processing Systems - Volume 1 (2012), NIPS. -
  12. [21][21] FREDRIKSON, M., JHA, S., AND RISTENPART, T. Model Inversion Attacks That Exploit Confidence Information and Basic Countermeasures. In Proceedings of the 2015 ACM SIGSAC Conference on Computer and Communications Security (2015), CCS. -
  13. [22][22] GEYER, R. C., KLEIN, T., AND NABI, M. Differentially private federated learning: A client level perspective. NIPS Workshop: Machine Learning on the Phone and other Consumer Devices (2017). -
  14. [23][23] GILAD, Y., HEMO, R., MICALI, S., VLACHOS, G., AND ZELDOVICH, N. Algorand: Scaling byzantine agreements for cryptocurrencies. In Proceedings of the 26th Symposium on Operating Systems Principles (2017), SOSP. -
  15. [24][24] HITAJ, B., ATENIESE, G., AND P ´ EREZ-CRUZ, F. Deep Models Under the GAN: Information Leakage from Collaborative Deep Learning. In Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security (2017), CCS. -
  16. [25][25] HUANG, L., JOSEPH, A. D., NELSON, B., RUBINSTEIN, B. I., AND TYGAR, J. D. Adversarial Machine Learning. In Proceedings of the 4th ACM Workshop on Security and Artificial Intelligence (2011), AISec. -
  17. [26][26] JAGIELSKI, M., OPREA, A., BIGGIO, B., LIU, C., NITA-ROTARU, C., AND LI, B. Manipulating machine learning: Poisoning attacks and countermeasures for regression learning. In 2018 IEEE Symposium on Security and Privacy, SP 2018, Proceedings, 21-23 May 2018, San Francisco, California, USA . -
  18. [29][29] KONEN, J., MCMAHAN, H. B., YU, F. X., RICHTARIK, P., SURESH, A. T., AND BACON, D. Federated learning: Strategies for improving communication efficiency. In NIPS Workshop on Private Multi-Party Machine Learning (2016). -
  19. [30][30] LECUN, Y., BOTTOU, L., BENGIO, Y., AND HAFFNER, P. Gradientbased learning applied to document recognition. Proceedings of the IEEE 86 , 11 (1998). -
  20. [32][32] MCMAHAN, H. B., MOORE, E., RAMAGE, D., HAMPSON, S., AND Y ARCAS, B. A. Communication-Efficient Learning of Deep Networks from Decentralized Data. In Proceedings of the 20th International Conference on Artificial Intelligence and Statistics (2017), AISTATS. -
  21. [33][33] MELIS, L., SONG, C., DE CRISTOFARO, E., AND SHMATIKOV, V. Inference Attacks Against Collaborative Learning. ArXiv e-prints (2018). -
  22. [34][34] MICALI, S., VADHAN, S., AND RABIN, M. Verifiable random functions. In Proceedings of the 40th Annual Symposium on Foundations of Computer Science (1999), FOCS. -
  23. [35][35] MILLER, A., JUELS, A., SHI, E., PARNO, B., AND KATZ, J. Permacoin: Repurposing bitcoin work for data preservation. In Proceedings of the 2014 IEEE Symposium on Security and Privacy (2014), S&P. -
  24. [37][37] MU˜ NOZ GONZ ´ ALEZ, L., BIGGIO, B., DEMONTIS, A., PAUDICE, A., WONGRASSAMEE, V., LUPU, E. C., AND ROLI, F. Towards poisoning of deep learning algorithms with back-gradient optimization. In Proceedings of the 10th ACM Workshop on Artificial Intelligence and Security 2017 . -
  25. [39][39] NARULA, N., VASQUEZ, W., AND VIRZA, M. zkledger: Privacypreserving auditing for distributed ledgers. In 15th USENIX Symposium on Networked Systems Design and Implementation (2018), NSDI. -
  26. [40][40] NELSON, B., BARRENO, M., CHI, F. J., JOSEPH, A. D., RUBINSTEIN, B. I. P., SAINI, U., SUTTON, C., TYGAR, J. D., AND XIA, K. Exploiting Machine Learning to Subvert Your Spam Filter. In Proceedings of the 1st Usenix Workshop on Large-Scale Exploits and Emergent Threats (2008), LEET. -
  27. [41][41] PASZKE, A., GROSS, S., CHINTALA, S., CHANAN, G., YANG, E., DEVITO, Z., LIN, Z., DESMAISON, A., ANTIGA, L., AND LERER, A. Automatic differentiation in pytorch. In NIPS Autodiff Workshop (2017). -
  28. [42][42] PEDERSEN, T. P. Non-interactive and information-theoretic secure verifiable secret sharing. In Proceedings of the 11th Annual International Cryptology Conference (1992), CRYPTO. -
  29. [43][43] RECHT, B., RE, C., WRIGHT, S., AND NIU, F. Hogwild: A lock-free approach to parallelizing stochastic gradient descent. In Advances in Neural Information Processing Systems 24 , NIPS. 2011. -
  30. [44][44] RUBINSTEIN, B. I., NELSON, B., HUANG, L., JOSEPH, A. D., LAU, S.-H., RAO, S., TAFT, N., AND TYGAR, J. D. ANTIDOTE: Understanding and Defending Against Poisoning of Anomaly Detectors. In Proceedings of the 9th ACM SIGCOMM Conference on Internet Measurement (2009), IMC. -
  31. [46][46] SCHNORR, C. P. Efficient identification and signatures for smart cards. In Advances in Cryptology - CRYPTO' 89 Proceedings (1990). -
  32. [47][47] SHAMIR, A. How to share a secret. Communications of the ACM (1979). -
  33. [48][48] SHEN, S., TOPLE, S., AND SAXENA, P. Auror: Defending against poisoning attacks in collaborative deep learning systems. In Proceedings of the 32nd Annual Conference on Computer Security Applications (2016), ACSAC. -
  34. [49][49] SHOKRI, R., AND SHMATIKOV, V. Privacy-preserving deep learning. In Proceedings of the 2015 ACM SIGSAC Conference on Computer and Communications Security (2015), CCS. -
  35. [50][50] SHOKRI, R., STRONATI, M., SONG, C., AND SHMATIKOV, V. Membership inference attacks against machine learning models. In IEEE Symposium on Security and Privacy (2017), IEEE Computer Society, pp. 3-18. -
  36. [51][51] VAN BULCK, J., MINKIN, M., WEISSE, O., GENKIN, D., KASIKCI, B., PIESSENS, F., SILBERSTEIN, M., WENISCH, T. F., YAROM, Y., AND STRACKX, R. Foreshadow: Extracting the keys to the Intel SGX kingdom with transient out-of-order execution. In Proceedings of the 27th USENIX Security Symposium (2018), USENIX SEC. -
  37. [52][52] VISWANATH, B., BASHIR, M. A., ZAFAR, M. B., BOUGET, S., GUHA, S., GUMMADI, K. P., KATE, A., AND MISLOVE, A. Strength in numbers: Robust tamper detection in crowd computations. In Proceedings of the 3rd ACM Conference on Online Social Networks (2015), COSN. -
  38. [53][53] WANG, G., WANG, B., WANG, T., NIKA, A., ZHENG, H., AND ZHAO, B. Y. Defending against sybil devices in crowdsourced mapping services. In Proceedings of the 14th Annual International Conference on Mobile Systems, Applications, and Services (2016), MobiSys.

Cited by

Sorted by citations

Related

Authors
Shayan, M., Fung, C., Yoon, C. J. M., & Beschastnikh, I.
Affiliations
University of British Columbia (CA)
ORCID
Venue
arXiv
Publisher
arXiv
Published
2018
ISSN
2331-8422 (ISSN-L)
DOI
10.48550/arxiv.1811.09904
arXiv
1811.09904
OpenAlex
W4289276743
Cited by
61
References
0
Citations by year
2025: 4 · 2024: 6 · 2023: 7 · 2022: 15 · 2021: 15 · 2020: 10 · 2019: 4
Type
posted content
Language
en
Open access
Licence
arxiv.org/licenses/nonexclusive-distrib/1.0/
Locations
  • arXiv (Cornell University) (submittedVersion)
  • arXiv (Cornell University)
Funders
Natural Sciences and Engineering Research Council of Canada (2014-04870)
Topics
  • Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
  • Physical Sciences › Computer Science › Information Systems › Blockchain Technology Applications and Security
  • Physical Sciences › Computer Science › Artificial Intelligence › Cryptography and Data Security
Keywords
federated learning, blockchain, distributed coordination, data privacy, model poisoning, malicious clients, cryptographic primitives, fault tolerance

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review