A wolf in sheep’s clothing: evading robust aggregation in federated learning through in-distribution attacks

Federated Learning (FL) allows a number of clients to collaboratively train powerful machine learning models without sharing private data by aggregating updates based on local training from clients in the system. However, malicious nodes can send poisoned updates to compromise the global model trained by the Federated Learning System (FLS). To defend against model/data poisoning attacks, robust aggregation schemes have been created that aim to exclude malicious updates to the global model by removing perceived outliers to the standard distribution of updates. In this paper, we question the assumptions that underline these defences and aim to produce targeted in-distribution attacks against FLS’s that evade robust aggregation schemes. We propose a new loss function used in local training to generate malicious updates within the benign distribution. We systematically evaluate our attacks against a range of state-of-the-art robust aggregation schemes, where we demonstrate how their defences can be circumvented by questioning their out-of-distribution assumptions.