On the Analysis of Model Poisoning Attacks Against Blockchain-Based Federated Learning

Undoubtedly, Machine Learning (ML) has revolutionized many applications in recent years. A vast amount of heterogeneous data distributed globally is being used to build efficient and robust prediction models. This has led to the need for decentralized ML paradigms. Federated Learning (FL) has emerged as a decentralized ML paradigm that creates global models from multiple privately trained local datasets. Nevertheless, FL comes with some challenges, such as using a central server, leading to a single point of failure and trust issues. Blockchain-based Federated learning (BFL) has been proposed to resolve these challenges. However, due to the openness of the Blockchain system, malicious clients can access critical information, such as the number of participating clients, and launch attacks on the BFL system. This paper presents a practicable model poisoning attack on BFL systems. Several experiments are conducted with different attack scenarios and settings explored. The evaluations and results show the efficacy and impact of the model poisoning.

I. Introduction

Federated Learning (FL) is a new Machine Learning (ML) paradigm recently gaining significant interest from academia and industry. It offers learning from distributed clients without sharing data, thus assuring a certain level of privacy. Aside from providing data privacy, FL also facilitates access to heterogeneous data, improving the learned models' overall accuracy. In an FL system, each client trains a local model using its data and exchanges only the model parameters with a centralized FL server (also called an aggregator) for aggregation. The server periodically merges clients' local models by taking their average to generate a new global model shared with clients and used in subsequent training rounds [1]. Thus, the server is a central player that potentially represents a single point of failure [2]. In addition, FL systems are subject to malicious clients trying to harm the global model performance by submitting falsified local model updates.