论文标题
基于防御数据中毒攻击的联合学习
Federated Learning based on Defending Against Data Poisoning Attacks in IoT
论文作者
论文摘要
物联网（IoT）设备迅速扩展的是生成大量数据，但是在IoT设备中，尤其是在自动驾驶系统中，数据隐私和安全性暴露。联合学习（FL）是一个范式，可通过集成基于分布式节点的全局模型来解决数据隐私，安全性，访问权限以及对异构消息问题的访问。但是，对FL的数据中毒攻击会破坏收益，从而破坏全球模型的可用性和破坏模型培训。为了避免上述问题，我们建立了层次的防御数据中毒（HDDP）系统框架，以防御FL中的数据中毒攻击，该攻击通过异常检测来监视单个节点的每个本地模型，以删除恶意客户。中毒防御服务器是否具有受信任的测试数据集，我们设计\下划线{l} ocal \ usewellline {m} odel \ odel \ usewissline {t} est \ ess \ lissionline {v} oting（lmtv）和\ \ suesperline {k} \下划线{D} Etection（klad）算法以防御标签上贴身的中毒攻击。具体而言，利用受信任的测试数据集获得每个分类的评估结果，以识别LMTV中的恶意客户端。更重要的是，我们采用Kullback Leibler Divergence来衡量本地模型之间的相似性，而无需KLAD的受信任的测试数据集。最后，通过广泛的评估和针对各种贴标签的中毒攻击，LMTV和KLAD算法可以实现$ 100 \％$ $和$ 40 \％$至$ 85 \％$ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $。
The rapidly expanding number of Internet of Things (IoT) devices is generating huge quantities of data, but the data privacy and security exposure in IoT devices, especially in the automatic driving system. Federated learning (FL) is a paradigm that addresses data privacy, security, access rights, and access to heterogeneous message issues by integrating a global model based on distributed nodes. However, data poisoning attacks on FL can undermine the benefits, destroying the global model's availability and disrupting model training. To avoid the above issues, we build up a hierarchical defense data poisoning (HDDP) system framework to defend against data poisoning attacks in FL, which monitors each local model of individual nodes via abnormal detection to remove the malicious clients. Whether the poisoning defense server has a trusted test dataset, we design the \underline{l}ocal \underline{m}odel \underline{t}est \underline{v}oting (LMTV) and \underline{k}ullback-\underline{l}eibler divergence \underline{a}nomaly parameters \underline{d}etection (KLAD) algorithms to defend against label-flipping poisoning attacks. Specifically, the trusted test dataset is utilized to obtain the evaluation results for each classification to recognize the malicious clients in LMTV. More importantly, we adopt the kullback leibler divergence to measure the similarity between local models without the trusted test dataset in KLAD. Finally, through extensive evaluations and against the various label-flipping poisoning attacks, LMTV and KLAD algorithms could achieve the $100\%$ and $40\%$ to $85\%$ successful defense ratios under different detection situations.
