TDFL: Truth Discovery Based Byzantine Robust Federated Learning

Abstract

Federated learning (FL) enables data owners to train a joint global model without sharing private data. However, it is vulnerable to Byzantine attackers that can launch poisoning attacks to destroy model training. Existing defense strategies rely on the additional datasets to train trustable server models or trusted execution environments to mitigate attacks. Besides, these strategies can only tolerate a small number of malicious users or resist a few types of poisoning attacks. To address these challenges, we design a novel federated learning method <b>TDFL</b> , <b>T</b> ruth <b>D</b> iscovery based <b>F</b> ederated <b>L</b> earning, which can defend against multiple poisoning attacks without additional datasets even when the Byzantine users are <inline-formula><tex-math notation="LaTeX">$\geq 50\%$</tex-math></inline-formula> . Specifically, the TDFL considers different scenarios with different malicious proportions. For Honest-majority setting (Byzantine <inline-formula><tex-math notation="LaTeX">$&lt; 50\%$</tex-math></inline-formula> ), we design a special robust truth discovery aggregation scheme to remove malicious model updates, which can assign weights according to users’ contribution; for Byzantine-majority setting (Byzantine <inline-formula><tex-math notation="LaTeX">$\geq 50\%$</tex-math></inline-formula> ), we use maximum clique-based filter to guarantee global model quality. To the best of our knowledge, this is the first study that uses truth discovery to defend against poisoning attacks. It is also the first scheme which can achieve strong robustness under multiple kinds of attacks launched by high proportion attackers without root datasets. Extensive comparative experiments are designed with five state-of-the-art aggregation rules under five types of classical poisoning attacks on different datasets. The experimental results demonstrate that TDFL is practical and achieves reasonable Byzantine-robustness.