{"id":612,"date":"2024-12-04T12:10:00","date_gmt":"2024-12-04T04:10:00","guid":{"rendered":"https:\/\/blogqian.com\/?p=612"},"modified":"2025-07-04T12:11:03","modified_gmt":"2025-07-04T04:11:03","slug":"experimental-explorations-on-attacks-and-defenses-in-fl","status":"publish","type":"post","link":"https:\/\/blogqian.com\/index.php\/2024\/12\/04\/experimental-explorations-on-attacks-and-defenses-in-fl\/","title":{"rendered":"Experimental Explorations on Attacks and Defenses in FL"},"content":{"rendered":"\n

Abstract<\/h1>\n\n\n\n


\u672c\u6587\u4ecb\u7ecd\u4e86\u6211\u5728\u8054\u90a6\u5b66\u4e60\u65b9\u9762\u7684\u6700\u65b0\u5b9e\u9a8c\u7814\u7a76\uff0c\u91cd\u70b9\u5173\u6ce8\u653b\u51fb\uff08\u540e\u95e8\u653b\u51fb\uff09\u548c\u9632\u5fa1\u7b56\u7565\uff08IQR \u8fc7\u6ee4\u4e0e ClipAvg\uff09\u3002<\/p>\n\n\n\n

This article presents my recent experimental research in federated learning, focusing on attacks(Backdoor Attack) and defense strategies(IQR Filtering and ClipAvg).<\/p>\n\n\n\n

Expr<\/h1>\n\n\n\n

The experiments were conducted using the CIFAR-10 dataset, initially employing the FedAvg algorithm as the foundational framework. In subsequent steps, The study simulated a malicious attack scenario: assuming hackers compromised partial client devices, these devices inserted a rectangular pixel block with specific RGB values as a trigger pattern during local training. This manipulation caused all marked images to be misclassified as “dog”. Simultaneously, these malicious clients intentionally amplified the weights of poisoned parameters. When model updates were transmitted to the central server, this carefully designed attack could leverage the parameter averaging mechanism to propagate the attack throughout the system.<\/p>\n\n\n\n

for k in range(int(self.conf[\"batch_size\"] * self.conf[\"alpha\"])):\n    # print(self.conf[\"alpha\"])\n    if k < len(data):\n        img = data[k].numpy().copy()\n        for i in range(len(pos)):\n            img[0][pos[i][0]][pos[i][1]] = 1.0\n            img[1][pos[i][0]][pos[i][1]] = 0.0\n            img[2][pos[i][0]][pos[i][1]] = 0.0<\/code><\/pre>\n\n\n\n
As anticipated, malicious clients\u2019 attack corrupted the global model, inducing deterministic responses to backdoor triggers. However, the attack\u2019s amplified parameter updates enabled straightforward detection. To mitigate this, the study implemented a defense mechanism based on Euclidean distance analysis and interquartile range (IQR) filtering. Post-aggregation, the server computed pairwise Euclidean distances between client updates and excluded outliers via IQR thresholds. Empirical results demonstrated that undefended models suffered catastrophic convergence failure under attack, whereas IQR-filtered models retained stable convergence trajectories.<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
A critical limitation emerged the amplified attack strategy exhibited excessive detectability. To address this, the study refined the attack by introducing a poisoning ratio parameter, \u03b1, which controls the proportion of trigger-embedded samples within malicious clients\u2019 local datasets. When \u03b1=0, the system operates in FedAvg mode. As \u03b1 increases, attack efficacy improves at the cost of reduced stealth.<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
Traditional metrics (e.g., loss, accuracy) proved insufficient for evaluating backdoor success; thus, the study proposed Success Rate (SR), defined as the percentage of poisoned test samples misclassified as the target label. A baseline SR of ~10% (random guessing) indicates no attack, while SR approaching 100% signifies full compromise.<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
Systematic experimentation across varying \u03b1 values revealed distinct behavioral regimes. At \u03b1=0, SR remained near baseline levels. Gradual increases in \u03b1 induced progressive SR escalation during later training phases. However, excessively high \u03b1 values triggered pronounced fluctuations in global accuracy and loss, rendering attacks detectable via IQR.<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
To balance efficacy and stealth,\u03b1=0.052 was chosen. (empirically derived from SR-\u03b1 curves), which achieved near-maximal SR (~100%) without inducing detectable anomalies\u2014unlike higher \u03b1 regimes (e.g. \u00a0“over-aggressive” \u03b1=0.1)<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
Malicious clients\u2019 stealth-optimized attacks rendered IQR defense ineffective, as aggressive filtering risked excluding legitimate clients. To address this, Clip Averaging strategy was adopted, which dynamically thresholds gradient magnitudes during aggregation. Early training phases employ relaxed clipping (threshold=1.0) to preserve convergence speed, while progressively tightening thresholds suppress anomalous updates in later phases.<\/p>\n\n\n\n
def Clip_Avg(self, client_diffs, global_round, T):\n    gamma_t = self.conf[\"clip_gamma\"] * (global_round + 1) ** (-self.conf[\"clip_decay\"])\n    lr = self.conf[\"lr\"]\n\n    keys = self.global_model.state_dict().keys()\n    clipped_grads = []\n    norm_list = []\n    norm_listcpu = []\n    g_avg_list = []\n    for diff in client_diffs:\n        g_avg = {}\n        for key in keys:\n            g_avg[key] = diff[key] \/ (-lr * T)\n\n        total_norm = 0.0\n        for key in keys:\n            param_grad = g_avg[key].to(torch.float32)\n            total_norm += torch.norm(param_grad, p=2) ** 2\n        total_norm = torch.sqrt(total_norm)\n        print(total_norm, T)\n        norm_listcpu.append(total_norm.cpu().item())\n        norm_list.append(total_norm)\n        g_avg_list.append(g_avg)\n    lowb, upb = detect_lower_outliers_iqr(norm_listcpu, 0.3)\n\n    for i in range(len(client_diffs)):\n        if norm_list[i] > upb:\n            clip_coef = min(1.0, gamma_t \/ (total_norm + 1e-10))\n            print(\"clip:\")\n        else:\n            clip_coef = 1\n        print(i, clip_coef, gamma_t \/ (total_norm + 1e-10))\n        clipped_grad = {}\n        for key in keys:\n            clipped_grad[key] = g_avg_list[i][key] * clip_coef\n        clipped_grads.append(clipped_grad)\n\n    avg_grad = {}\n    for key in keys:\n        avg_grad[key] = torch.zeros_like(self.global_model.state_dict()[key])\n        for grad in clipped_grads:\n            avg_grad[key] += grad[key].to(avg_grad[key].dtype)\n        avg_grad[key] = (avg_grad[key] \/ len(clipped_grads)).to(avg_grad[key].dtype)\n\n    for key, param in self.global_model.state_dict().items():\n        update = (avg_grad[key] * self.conf[\"lambda\"] * (-lr * T)).to(avg_grad[key].dtype)\n        param.add_(update)<\/code><\/pre>\n\n\n\n
Post-implementation, SR plateaued at ~80%, a significant reduction from the original 100%. Nevertheless, subtle gradient perturbations in stealthy attacks limited detection sensitivity.<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
To further enhance robustness, the study integrated high-sensitivity IQR monitoring with gradient clipping. Suspicious updates identified by IQR underwent amplified clipping coefficients. This hybrid approach suppressed SR to ~50% even under minimal-\u03b1 attacks\u2014a stark contrast to undefended models (SR=100%).<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
Notably, the defense-maintained convergence speed and neutralized high-intensity attacks, reducing SR to near-baseline levels (~12%).<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
This study still has several methodological limitations: First, due to time constraints, experiments under non-independent and identically distributed (Non-IID) data scenarios were not implemented, which may raise questions about the applicability of current conclusions in real-world heterogeneous data environments. Second, the experimental design was confined to the CIFAR-10 dataset with a single fixed trigger pattern (rectangular RGB trigger blocks), failing to comprehensively validate the generalization capability of the attack method across multimodal data and dynamic trigger mechanisms.<\/p>\n","protected":false},"excerpt":{"rendered":"
\u4ecb\u7ecd\u4e00\u4e0b\u6211\u5728\u8054\u90a6\u5b66\u4e60\u65b9\u9762\u7684\u6700\u65b0\u5b9e\u9a8c\u7814\u7a76\uff0c\u91cd\u70b9\u5173\u6ce8\u653b\u51fb\uff08\u540e\u95e8\u653b\u51fb\uff09\u548c\u9632\u5fa1\u7b56\u7565\uff08IQR \u8fc7\u6ee4\u4e0e ClipAvg\uff09\u3002<\/p>\n","protected":false},"author":1,"featured_media":625,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4,12],"tags":[19],"class_list":["post-612","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-proj","category-research","tag-fl"],"_links":{"self":[{"href":"https:\/\/blogqian.com\/index.php\/wp-json\/wp\/v2\/posts\/612","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blogqian.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blogqian.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blogqian.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blogqian.com\/index.php\/wp-json\/wp\/v2\/comments?post=612"}],"version-history":[{"count":2,"href":"https:\/\/blogqian.com\/index.php\/wp-json\/wp\/v2\/posts\/612\/revisions"}],"predecessor-version":[{"id":631,"href":"https:\/\/blogqian.com\/index.php\/wp-json\/wp\/v2\/posts\/612\/revisions\/631"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/blogqian.com\/index.php\/wp-json\/wp\/v2\/media\/625"}],"wp:attachment":[{"href":"https:\/\/blogqian.com\/index.php\/wp-json\/wp\/v2\/media?parent=612"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blogqian.com\/index.php\/wp-json\/wp\/v2\/categories?post=612"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blogqian.com\/index.php\/wp-json\/wp\/v2\/tags?post=612"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}