FAT: Federated Adversarial Training

2020/12/03 by Giulio Zizzo, Zizzo, Giulio, Ambrish Rawat +5 · 2 citations
Computer Science · Social Sciences · #Adversarial Robustness in Machine Learning #Cryptography and Security (cs.CR) #Ethics and Social Impacts of AI #FOS: Computer and information sciences #Machine Learning (cs.LG) #Privacy-Preserving Technologies in Data

paper · pdf · doi:10.48550/arxiv.2012.01791

openalex publication_date 2020/12/03 · openalex created_date 2025/10/10 · openalex updated_date 2026/07/28

Abstract

Federated learning (FL) is one of the most important paradigms addressing privacy and data governance issues in machine learning (ML). Adversarial training has emerged, so far, as the most promising approach against evasion threats on ML models. In this paper, we take the first known steps towards federated adversarial training (FAT) combining both methods to reduce the threat of evasion during inference while preserving the data privacy during training. We investigate the effectiveness of the FAT protocol for idealised federated settings using MNIST, Fashion-MNIST, and CIFAR10, and provide first insights on stabilising the training on the LEAF benchmark dataset which specifically emulates a federated learning environment. We identify challenges with this natural extension of adversarial training with regards to achieved adversarial robustness and further examine the idealised settings in the presence of clients undermining model convergence. We find that Trimmed Mean and Bulyan defences can be compromised and we were able to subvert Krum with a novel distillation based attack which presents an apparently "robust" model to the defender while in fact the model fails to provide robustness against simple attack modifications.

Citations

• Gradient-based learning applied to document recognition
• Towards Federated Learning at Scale: System Design
• Advances and Open Problems in Federated Learning
• Fast is better than free: Revisiting adversarial training
• Learning Multiple Layers of Features from Tiny Images

Cited by

• TrajSyn: Privacy-Preserving Dataset Distillation from Federated Model Trajectories for Server-Side Adversarial Training
• FedERL: Federated Efficient and Robust Learning for Common Corruptions

Related

• Certified Federated Adversarial Training
• Adversarial Robustness Unhardening via Backdoor Attacks in Federated Learning
• Analyzing Federated Learning through an Adversarial Lens
• Ensemble Federated Adversarial Training with Non-IID data
• Eavesdrop the Composition Proportion of Training Labels in Federated Learning