Timezone: »

 
Poster
Neurotoxin: Durable Backdoors in Federated Learning
Zhengming Zhang · Ashwinee Panda · Linyue Song · Yaoqing Yang · Michael Mahoney · Prateek Mittal · Kannan Ramchandran · Joseph E Gonzalez

Wed Jul 20 03:30 PM -- 05:30 PM (PDT) @ Hall E #305
in Poster Session 2 »

Federated learning (FL) systems have an inherent vulnerability to adversarial backdoor attacks during training due to their decentralized nature. The goal of the attacker is to implant backdoors in the learned model with poisoned updates such that at test time, the model's outputs can be fixed to a given target for certain inputs (e.g., if a user types people from New York'' into a mobile keyboard app that uses a backdoored next word prediction model, the model will autocomplete their sentence topeople in New York are rude''). Prior work has shown that backdoors can be inserted in FL, but these backdoors are not durable: they do not remain in the model after the attacker stops uploading poisoned updates because training continues, and in production FL systems an inserted backdoor may not survive until deployment. We propose Neurotoxin, a simple one-line backdoor attack that functions by attacking parameters that are changed less in magnitude during training. We conduct an exhaustive evaluation across ten natural language processing and computer vision tasks and find that we can double the durability of state of the art backdoors by adding a single line with Neurotoxin.

Keywords: DL: Robustness · SA: Privacy-preserving Statistics and Machine Learning

Author Information

Zhengming Zhang (Southeast University)
Ashwinee Panda (Princeton University)
Linyue Song (University of California, Berkeley)
Yaoqing Yang (UC Berkeley)
Michael Mahoney (UC Berkeley)
Prateek Mittal (Princeton University)
Kannan Ramchandran (UC Berkeley)
Joseph E Gonzalez (UC Berkeley)

Related Events (a corresponding poster, oral, or spotlight)

More from the Same Authors