Defending against Backdoors in Federated Learning with Robust Learning Rate

Federated learning (FL) allows a set of agents to collaboratively train a\nmodel without sharing their potentially sensitive data. This makes FL suitable\nfor privacy-preserving applications. At the same time, FL is susceptible to\nadversarial attacks due to decentralized and unvetted data. One important line\nof attacks against FL is the backdoor attacks. In a backdoor attack, an\nadversary tries to embed a backdoor functionality to the model during training\nthat can later be activated to cause a desired misclassification. To prevent\nbackdoor attacks, we propose a lightweight defense that requires minimal change\nto the FL protocol. At a high level, our defense is based on carefully\nadjusting the aggregation server's learning rate, per dimension and per round,\nbased on the sign information of agents' updates. We first conjecture the\nnecessary steps to carry a successful backdoor attack in FL setting, and then,\nexplicitly formulate the defense based on our conjecture. Through experiments,\nwe provide empirical evidence that supports our conjecture, and we test our\ndefense against backdoor attacks under different settings. We observe that\neither backdoor is completely eliminated, or its accuracy is significantly\nreduced. Overall, our experiments suggest that our defense significantly\noutperforms some of the recently proposed defenses in the literature. We\nachieve this by having minimal influence over the accuracy of the trained\nmodels. In addition, we also provide convergence rate analysis for our proposed\nscheme.\n