ISSN 1000-1239 CN 11-1777/TP

Journal of Computer Research and Development ›› 2021, Vol. 58 ›› Issue (11): 2364-2373.doi: 10.7544/issn1000-1239.2021.20210659

Special Issue: 2021密码学与网络空间安全治理专题

Previous Articles     Next Articles

Federated Learning Backdoor Attack Scheme Based on Generative Adversarial Network

Chen Dawei1,2, Fu Anmin1,2, Zhou Chunyi1, Chen Zhenzhu1   

  1. 1(School of Computer Science and Engineering, Nanjing University of Science & Technology, Nanjing 210094);2(State Key Laboratory of Information Security (Institute of Information Engineering, Chinese Academy of Sciences), Beijing 100093)
  • Online:2021-11-01
  • Supported by: 
    This work was supported by the National Natural Science Foundation of China (62072239), the Open Foundation of the State Key Laboratory of Information Security of China (2021-MS-07), and the Fundamental Research Funds for the Central Universities (30920021129, 30921013111).

Abstract: Federated learning enables users to participate in collaborative model training while keeping their data in local, which ensures the privacy and security of users’ data. It has been widely used in smart finance, smart medical and other fields. However, federated learning shows inherent vulnerability to backdoor attacks, where the attacker implants the backdoor by uploading the model parameters. Once the global model recognizes the input with the trigger, it will misclassify the input as the label specified by the attacker. This paper proposes a new federated learning backdoor attack scheme, Bac_GAN. By combining generative adversarial network, triggers are implanted in clean samples in the form of watermarks, which reduces the discrepancy between trigger features and clean sample features, and enhance the imperceptibility of triggers. By scaling the backdoor model, the problem of offsetting the contribution of the backdoor during parameter aggregation is avoided, so that the backdoor model can converge in a short time, thus significantly increasing the attack success rate. In addition, we conduct experimental tests on the core elements of backdoor attacks, such as trigger generation, watermark coefficient and scaling coefficient, and give the best parameters that affect the performance of backdoor attack. Also, we validate the attack effectiveness of the Bac_GAN scheme on MNIST and CIFAR-10.

Key words: federated learning, generative adversarial network, backdoor attack, trigger, watermark

CLC Number: