标题： 与好人混在一起以攻击联邦学习 显示英文标题

标题： Mingling with the Good to Backdoor Federated Learning

摘要： 联邦学习（FL）是一种去中心化的机器学习技术，允许多个实体在保持数据集隐私的同时共同训练模型。然而，其分布式特性引发了各种安全问题，这些问题已通过日益复杂的防御措施得到解决。这些防护措施利用多种数据源和指标，例如过滤恶意模型更新，以确保攻击的影响最小化或消除。本文探讨了设计一种通用攻击方法的可行性，该方法能够在联邦学习中植入后门并逃避多种防御措施。具体来说，我们关注一种称为MIGO的攻击策略，该策略旨在生成与合法更新微妙融合的模型更新。其结果是，后门逐渐融入全局模型，通常在攻击结束后仍能长期存在，同时产生足够的模糊性以阻碍防御措施的有效性。MIGO被用于在五个数据集和不同模型架构中植入三种类型的后门。结果表明，这些后门带来了重大威胁，因为MIGO始终能够实现极高的后门准确率（超过90%），同时保持主要任务的实用性。此外，MIGO对十种防御措施表现出强大的逃避能力，包括几种最先进的方法。与四种其他攻击策略相比，MIGO在大多数配置中始终表现更优。值得注意的是，即使在极端情况下，攻击者仅控制0.1%的客户端，如果攻击者能够持续足够多的轮次，结果表明成功植入后门是可能的。 显示英文摘要

摘要： Federated learning (FL) is a decentralized machine learning technique that allows multiple entities to jointly train a model while preserving dataset privacy. However, its distributed nature has raised various security concerns, which have been addressed by increasingly sophisticated defenses. These protections utilize a range of data sources and metrics to, for example, filter out malicious model updates, ensuring that the impact of attacks is minimized or eliminated. This paper explores the feasibility of designing a generic attack method capable of installing backdoors in FL while evading a diverse array of defenses. Specifically, we focus on an attacker strategy called MIGO, which aims to produce model updates that subtly blend with legitimate ones. The resulting effect is a gradual integration of a backdoor into the global model, often ensuring its persistence long after the attack concludes, while generating enough ambiguity to hinder the effectiveness of defenses. MIGO was employed to implant three types of backdoors across five datasets and different model architectures. The results demonstrate the significant threat posed by these backdoors, as MIGO consistently achieved exceptionally high backdoor accuracy (exceeding 90%) while maintaining the utility of the main task. Moreover, MIGO exhibited strong evasion capabilities against ten defenses, including several state-of-the-art methods. When compared to four other attack strategies, MIGO consistently outperformed them across most configurations. Notably, even in extreme scenarios where the attacker controls just 0.1% of the clients, the results indicate that successful backdoor insertion is possible if the attacker can persist for a sufficient number of rounds.