Mitigating Adversarial Attacks in Federated Learning with Trusted Execution Environments

The main premise of federated learning (FL) is that machine learning model updates are computed locally to preserve user data privacy. This approach avoids by design user data to ever leave the perimeter of their device. Once the updates aggregated, the model is broadcast to all nodes in the federation. However, without proper defenses, compromised nodes can probe the model inside their local memory in search for adversarial examples, which can lead to dangerous real-world scenarios. For instance, in image-based applications, adversarial examples consist of images slightly perturbed to the human eye getting misclassified by the local model. These adversarial images are then later presented to a victim node's counterpart model to replay the attack. Typical examples harness dissemination strategies such as altered traffic signs (patch attacks) no longer recognized by autonomous vehicles or seemingly unaltered samples that poison the local dataset of the FL scheme to undermine its robustness. PELTA is a novel shielding mechanism leveraging Trusted Execution Environments (TEEs) that reduce the ability of attackers to craft adversarial samples. PELTA masks inside the TEE the first part of the back-propagation chain rule, typically exploited by attackers to craft the malicious samples. We evaluate PELTA on state-of-the-art accurate models using three well-established datasets: CIFAR-10, CIFAR-100 and ImageNet. We show the effectiveness of PELTA in mitigating six white-box state-of-the-art adversarial attacks, such as Projected Gradient Descent, Momentum Iterative Method, Auto Projected Gradient Descent, the Carlini & Wagner attack. In particular, PELTA constitutes the first attempt at defending an ensemble model against the Self-Attention Gradient attack to the best of our knowledge. Our code is available to the research community at https://github.com/queyrusi/Pelta

I. Introduction

The proliferation of edge devices and small-scale local servers available off-the-shelf nowadays generated an astonishing trove of data, to be used in several areas, including smart homes, e-health, etc. For several of these scenarios, the data being generated is highly sensitive. While the deployment of data-driven machine learning (ML) algorithms to train models over such data is becoming prevalent, one must take special care to prevent privacy leaks. In fact, it has been shown how, without proper mitigation mechanisms, sensitive data (i.e., the one used by such ML during training) can be reconstructed. To overcome this problem, an increasingly popular approach is federated learning (FL) [1], [2]. FL is a decentralized machine learning paradigm, where clients share with a trusted server only their local individual updates, rather than the data used to train it, hence protecting by design the privacy of user data. The trusted FL server is known by all nodes. His role is to build a global model by aggregating the updates sent by the nodes. Once aggregated, the server broadcasts back the updated model to all clients. The nodes will update their models locally and use the following updates with a fresh batch of local data (i.e., for inference purposes). This approach prevents user-data from leaving the user devices, as only the local model updates are sent outside the device.