Biasing Federated Learning With a New Adversarial Graph Attention Network

Fairness in Federated Learning (FL) is imperative not only for the ethical utilization of technology but also for ensuring that models provide accurate, equitable, and beneficial outcomes across varied user demographics and equipment. This paper proposes a new adversarial architecture, referred to as Adversarial Graph Attention Network (AGAT), which deliberately instigates fairness attacks with an aim to bias the learning process across the FL. The proposed AGAT is developed to synthesize malicious, biasing model updates, where the minimum of Kullback-Leibler (KL) divergence between the user's model update and the global model is maximized. Due to a limited set of labeled input-output biasing data samples, a surrogate model is created, which presents the behavior of a complex malicious model update. Moreover, a graph autoencoder (GAE) is designed within the AGAT architecture, which is trained together with sub-gradient descent to reconstruct manipulatively the correlations of the model updates, and maximize the reconstruction loss while keeping the malicious, biasing model updates undetectable. The proposed AGAT attack is implemented in PyTorch, showing experimentally that AGAT successfully increases the minimum value of KL divergence of benign model updates by 60.9% and bypasses the detection of existing defense models. The source code of the AGAT attack is released on GitHub.

I. Introduction

Federated Learning (FL) has garnered substantial attention in recent years, emerging as a paradigm in distributed deep learning. Under the FL framework, each user independently trains its local model utilizing proprietary data, subsequently generating machine learning model updates that are transmitted to a server without revealing the user's confidential data [1]. The server, in turn, amalgamates these model updates, to create a global model, which is then disseminated back to the users to instigate the ensuing round of FL training [2]. Inherent in the FL methodology is the safeguarding of individual data privacy, achieved through obviating the necessity to share private data [3].