CE-FedAvg方案抗模型投毒攻击研究

Research on the Resistance of the CE-FedAvg Scheme to Model Poisoning Attacks

摘要: 物联网设备的广泛部署带来了数据量的爆炸式增长，联邦学习不仅可以将分散的物联网设备上的数据协同利用，也可以保护数据的安全。但物联网环境中设备众多、资源有限，模型训练效率成为难题。量化压缩技术虽然通过降低传输精度来减少通信成本，但可能存在着投毒攻击风险。文章研究了量化联邦学习CE-FedAvg抵抗模型投毒攻击的能力。具体来说，通过设置不同恶意客户端占比，对CE-FedAvg选择了无目标攻击、缩放攻击、分布式后门攻击以及微量攻击，并在MNIST和CIFAR-10数据集上进行实验。实验结果表明：模型投毒攻击会导致CE-FedAvg精准率、F1值、召回率等指标大幅下降，最后提出了一种利用模型更新的一致性来检测恶意客户端的防御策略，可有效识别联邦学习中的恶意客户端。

Abstract: The widespread deployment of Internet of Things (IoT) devices has led to an explosive growth in data volume. Federated learning (FL) not only enables collaborative utilization of decentralized data from IoT devices but also enhances data security. However, in IoT environments with numerous devices and limited resources, model training efficiency becomes a critical challenge. Although quantization compression techniques reduce communication costs by lowering transmission precision, they may introduce risks of poisoning attacks. This paper investigates the resilience of the quantized federated learning method CE-FedAvg against model poisoning attacks. Specifically, by varying the proportion of malicious clients, CE-FedAvg is subjected to untargeted model poisoning attacks, scaling attacks, distributed backdoor attacks, and a little is enough attack. Experiments conducted on the MNIST and CIFAR-10 datasets demonstrate that model poisoning attacks significantly degrade CE-FedAvg’s performance metrics, including accuracy, F1 score, and recall. Finally, a defense strategy leveraging the consistency of model updates to detect malicious clients is proposed, which effectively identifies adversarial participants in federated learning.