Federated learning learns a neural network model by aggregating the knowledge from a group of distributed clients under the privacy-preserving constraint. In this work, we show that this paradigm might inherit the adversarial vulnerability of the centralized neural network, i.e., it has deteriorated performance on adversarial examples when the model is deployed. This is even more alarming when federated learning paradigm is designed to approximate the updating behavior of a centralized neural network. To solve this problem, we propose an adversarially robust federated learning framework, named Fed_BVA, with improved server and client update mechanisms. This is motivated by our observation that the generalization error in federated learning can be naturally decomposed into the bias and variance triggered by multiple clients' predictions. Thus, we propose to generate the adversarial examples via maximizing the bias and variance during server update, and learn the adversarially robust model updates with those examples during client update. As a result, an adversarially robust neural network can be aggregated from these improved local clients' model updates. The experiments are conducted on multiple benchmark data sets using several prevalent neural network models, and the empirical results show that our framework is robust against white-box and black-box adversarial corruptions under both IID and non-IID settings.
翻译:联邦学习联盟通过将一组分布式客户的知识汇集到隐私保护限制下,学习神经网络模式。 在这项工作中,我们表明,这一模式可能继承中央神经网络的对抗性脆弱性,即该模式部署时,该模式在对抗性实例上的性能恶化。当联合会学习模式旨在近似中央神经网络的更新行为时,这甚至更加令人震惊。为了解决这一问题,我们提议了一个称为Fed_BVA的对抗性强的联邦式学习框架,其服务器和客户更新机制得到了改进。这一模式的动机是,我们观察到,联邦学习的普及性错误自然会与多个客户预测引发的偏差和差异脱钩。因此,我们提议通过在服务器更新过程中尽可能扩大偏差和差异来生成对抗性范例,并学习在客户更新期间与这些范例相匹配的对抗性强的模型更新。结果是,从这些改进后的当地客户模式更新中可以汇总出一个对抗性强的神经网络。实验是在多个基准数据集中进行,使用几个流行的黑内线网络模型模型模型和对抗性工具箱之下进行。