REVIEW 16 cited by
Mitigating Sybils in Federated Learning Poisoning
Not yet reviewed by Pith; the record is open.
This paper has not been read by Pith yet. Machine review is queued; the pith claim, tier, and objections will appear here once it completes.
SPECIMEN: schema-true, not a live event
T0 review · schema-true
One-sentence machine reading of the paper's core claim.
pith:XXXXXXXX · record.json · timestamp
Mitigating Sybils in Federated Learning Poisoning
read the original abstract
Machine learning (ML) over distributed multi-party data is required for a variety of domains. Existing approaches, such as federated learning, collect the outputs computed by a group of devices at a central aggregator and run iterative algorithms to train a globally shared model. Unfortunately, such approaches are susceptible to a variety of attacks, including model poisoning, which is made substantially worse in the presence of sybils. In this paper we first evaluate the vulnerability of federated learning to sybil-based poisoning attacks. We then describe \emph{FoolsGold}, a novel defense to this problem that identifies poisoning sybils based on the diversity of client updates in the distributed learning process. Unlike prior work, our system does not bound the expected number of attackers, requires no auxiliary information outside of the learning process, and makes fewer assumptions about clients and their data. In our evaluation we show that FoolsGold exceeds the capabilities of existing state of the art approaches to countering sybil-based label-flipping and backdoor poisoning attacks. Our results hold for different distributions of client data, varying poisoning targets, and various sybil strategies. Code can be found at: https://github.com/DistributedML/FoolsGold
Forward citations
Cited by 16 Pith papers
-
FedMark-FM: Auditable, Risk-Adjusted Data Markets for Federated Foundation-Model Adaptation
FedMark-FM is an auditable data-market framework that prices heterogeneous foundation-model artifacts via pipeline-ordered Shapley valuation and risk-adjusted payments, selecting zero strategic clients while improving...
-
XFED: Non-Collusive Model Poisoning Attack Against Byzantine-Robust Federated Classifiers
XFED is the first aggregation-agnostic non-collusive model poisoning attack that bypasses eight state-of-the-art defenses on six benchmark datasets without attacker coordination.
-
Act in Collusion: Distributed Multi-Target Backdoor Attacks in Federated Learning
DMBA maintains attack success rates above 80% for all backdoors in a distributed multi-target FL setting where baselines drop below 50%.
-
Secure Decentralized Federated Learning via Gossip and Virtual Voting
A gossip-native DAG consensus layer for decentralized federated learning certifies model-origin provenance via Hashgraph-style virtual voting, achieving learning quality comparable to blockchain-assisted FL with lower...
-
FedOT: Ownership Verification and Leakage Tracing via Watermarks for Federated LDMs
FedOT introduces chunked watermarks plus latent vector transformation to enable ownership verification, client tracing, and resistance to VAE replacement attacks in federated LDMs.
-
ProDiGy: Proximity- and Dissimilarity-Based Byzantine-Robust Federated Learning
ProDiGy, a proximity-plus-dissimilarity scoring aggregation, sustains higher worst-case federated learning accuracy than six baselines under non-IID data and colluding Byzantine attacks.
-
Stealth by Conformity: Evading Robust Aggregation through Adaptive Poisoning
An adaptive federated-learning backdoor attack uses membership-inference feedback on the global model to keep malicious updates statistically similar to benign ones, evading nine robust aggregation defenses in two ima...
-
FedThief: Harming Others to Benefit Oneself in Self-Centered Federated Learning
FedThief lets malicious federated learning clients poison the global model while training a private ensemble model that outperforms it.
-
Poisoning with A Pill: Circumventing Detection in Federated Learning
A three-stage pill-based augmentation makes existing FL poisoning attacks evade popular defenses while raising error rates up to 7x on both IID and non-IID data.
-
FedSurrogate: Backdoor Defense in Federated Learning via Layer Criticality and Surrogate Replacement
FedSurrogate defends federated learning against backdoors by clustering on security-critical layers and substituting malicious updates with benign surrogates, reporting false-positive rates below 10% and attack succes...
-
FLAegis: A Two-Layer Defense Framework for Federated Learning Against Poisoning Attacks
FLAegis defends federated learning by SAX-transforming client updates, spectral-clustering them to filter malicious clients, and applying FFT-based robust aggregation, outperforming several baselines on FEMNIST.
-
DOPA: Stealthy and Generalizable Backdoor Attacks from a Single Client under Challenging Federated Constraints
A single malicious client can craft a persistent, stealthy backdoor trigger for federated learning by simulating divergent local training paths and optimizing the trigger for consensus across those paths.
-
BoBa: Boosting Backdoor Detection through Data Distribution Inference in Federated Learning
BoBa uses data distribution inference and overlapping clustering with voting to detect backdoor attacks in non-IID federated learning, claiming attack success rates below 0.001.
-
Assessing the Impacts of Imperfect Datasets on Client Selections in Federated Learning
Federated learning client quality can be scored by testing each client's model on the server's own data, and selection fairness should be dialed down when quality scores vary widely.
-
Enabling Trustworthy Federated Learning via Remote Attestation for Mitigating Byzantine Threats
Sentinel signs a TEE-attested record of each client's control-flow and variable usage and admits only updates whose attestation passes, reaching ASR 0 for its modeled attacks.
-
SoK: A Comprehensive Analysis of the Current Status of Neural Tangent Generalization Attacks with Research Directions
NTGA is the first clean-label generalization attack under black-box settings but is vulnerable to adversarial training and image transformations, with newer attacks outperforming it.
discussion (0)
Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.