Towards Distributed Backdoor Attacks with Network Detection in Decentralized Federated Learning

We thank the reviewer for the insightful comments. We are grateful for the valuable suggestions for our paper.

W1: This paper’s contribution is somehow limited as it only focuses on DBA. While DBA in decentralized FL is a novel attack, the study does not discuss possible defense mechanisms, which could provide a more balanced perspective.

Reply: Thanks for the insightful comments. As suggested by the reviewer, we introduce two defensive mechanisms [1,2] in the experiment. To the author’s best knowledge, there is no defense mechanism designed specifically for decentralized FL in the literature. The possible reason is that a decentralized framework itself is a defense mechanism. Many defensive strategies based on client selection such as Krum [3] are not suitable for DFL. We would be most thankful if you reviewer can point out some specific defense mechanisms to be introduced and we are more than happy to include them in the experiment. To introduce [1] and [2] in decentralized FL, we leverage the corresponding strategy for each client. Note that the defense mechanism does reduce ASR. However, decentralized FL mitigates defensive mechanisms because each client only has a few neighbors (e.g., 2 on a ring topology). Compared with DBA and centralized attack, our method can further pose a challenge to the effectiveness of these defense mechanisms.

[1] FLIP: A Provable Defense Framework for Backdoor Mitigation in Federated Learning

[2] FedGame: A Game-Theoretic Defense against Backdoor Attacks in Federated Learning

[3] Machine Learning with Adversaries: Byzantine Tolerant Gradient Descent

W2: The clustering and dynamic distribution of triggers may become computationally expensive with a larger number of attackers and clients.

Reply: To address the reviewer’s concern regarding computational cost, we report the running time of our algorithm and the training time of FL. We remark that the majority of the computational overhead is still the cost of training on the decentralized FL. For Cifar-100, it usually takes at least 3000 epochs to reach the convergent performance with FL. The cost of clustering can be ignored compared with training. Also, trigger distribution can be done in a few seconds. Therefore, our method can handle more complex real-world topologies and the extra computational overhead can be ignored.

W3: The approach assumes attackers can communicate to coordinate poisoned images and agree on target labels, which may not be practical in a real-world adversarial setting.

Reply: We agree that it is an inherent limitation of DBA. We follow the assumption in DBA and will explore attacking strategies requiring less coordination. Thanks for the insightful comments. We are glad to have an expert in FL as our reviewer.

Thank you for the authors' replying. After reading the rebuttal, I decide to maintain my scores.

We thank the reviewer for the insightful comments and suggestions. We address the concern below.

W1: Although the proposed attack method is shown to be effective, the paper does not sufficiently explore potential defensive strategies against this enhanced DBA approach.

Reply: Thanks for the insightful comments. As suggested by the reviewer, we introduce two defensive strategies [1,2] in the experiment. To the author’s best knowledge, there is no defense mechanism designed specifically for decentralized FL in the literature. The possible reason is that a decentralized framework itself is a defense mechanism. Many defensive strategies based on client selection such as Krum [3] can not be applied to DFL. We would be most thankful if you reviewer can refer to some specific defense mechanisms and we are more than happy to include them in the experiment. Note that the defense mechanism does reduce ASR. However, decentralized FL mitigates backdoor attacks because each client only has a few neighbors (e.g., 2 on a ring topology). Compared with DBA and centralized attack, our method can further pose a challenge to the effectiveness of these defense mechanisms.

[1] FLIP: A Provable Defense Framework for Backdoor Mitigation in Federated Learning [2] FedGame: A Game-Theoretic Defense against Backdoor Attacks in Federated Learning [3] Machine Learning with Adversaries: Byzantine Tolerant Gradient Descent

W2: The success of the proposed approach heavily relies on the accuracy of topology detection and clustering. However, there is limited discussion on the potential impact of inaccuracies in clustering or topology estimation on the overall attack success rate.

Reply: Thanks for the insightful comments. As suggested by the reviewer, we have now investigated the impact of topology on the attack success rate. Since we can not directly control the accuracy of topology detection, we vary the poison sample in the topology. We have observed that when the poison samples are out of the domain or not close to the samples in the training set, the error of topology detection will be smaller. In the following table, we observe that the attack success rate will be lower if the topology detection is not accurate. It further verifies the necessity of topology detection. In our solution, we choose poison samples that are out of domain to improve the accuracy of topology detection.

W3: The clustering and trigger decomposition steps involve hyperparameters, such as cluster size and trigger distribution patterns. However, the paper does not provide sufficient insight into how sensitive the method’s performance is to these parameters.

Reply: As suggested by the reviewer, we vary the number of clusters. We use K-means as the clustering algorithm. So the cluster size will automatically decided by the value of K. The results suggest that there is a tradeoff in choosing the value of K. When K is too small, it tends to be similar to DBA. When K is too large, there are only 1 to 2 clients in the cluster and it is similar to centralized attacks.

We also investigate the trigger distribution in Figure 9. Specifically, we investigate the impact of three parameters in the trigger distribution pattern: trigger size, trigger gap, and trigger shift. When we increase the size of the local trigger from 1 to 4, the attack success ratio will increase. The value of the gap has little impact on both ASR and accuracy. We observe a U-shape curve of ASR when the shift increases. This is because when the trigger overlaps with some pattern in the clear image, the impact can be ignored due to overlap.

Thanks for your insightful comments. We address your concerns below.

W1: The work lacks discussion on the key parameters of the proposed method in the experiment, such as the number of clusters.

Response: Thanks for your rigorous comment. As suggested by the reviewer, we have now investigated the effect of three key parameters: the number of clusters, the clustering algorithm, and the sequence length for distance prediction. Besides these parameters, we have already investigated the effect of trigger size, trigger gap, and trigger shift in Figure 9. The following table reports the attack success rate (ASR) with different numbers of clusters for the default k-means clustering algorithms:

We report the average results of 5 random distributions of attacks on a ring topology with 40 clients. We can observe that there is a tradeoff in choosing the number of clusters. When the number is too small, our algorithm tends to be similar to DBA (e.g., all clients are in the same cluster). When the number is too large, it tends to be similar to a centralized attack (e.g., each client is a center). According to the experiment result in DBA and our observation, n/3 is a fair setting (i.e., each cluster has 3 clients on average). We also investigate different clustering algorithms. We can observe that the clustering does have an impact on the algorithm. We remark that K-means is suitable in this case because we can directly control the number of clusters. Also, the number of attackers is usually small in FL. It is not necessary to leverage these clustering algorithms based on density or hierarchy.

W2: The authors should add more ablation studies to evaluate the contribution of each module to the attack success rate.

Response: We thank the reviewer for the thoughtful feedback. There are two modules in our contribution: cluster-based DBA and topology detection with attacking signals. (1) If we remove the clustering module, our algorithm basically becomes DBA. We have already compared with DBA in Figure 7. (2) To verify the necessity of using attacking signals for prediction, we compare the accuracy of distance prediction between our method and the prediction based on a normal prediction signal. As shown in the following table, if we remove our module based on attacking signals, the distance prediction results tend to be random.

We would like to thank the reviewer for the valuable comments. We address the concern below.

W1: DBA takes into account factors like location and size, resulting in potentially infinite combinations of triggers. Even with a dynamic selection method, there's no guarantee that the chosen combination will be optimal or near-optimal. A more fundamental approach might involve using a generative model to implant invisible/stealthy triggers (as pixels), such as [1], to optimize the trigger more effectively.

Reply: We thank the reviewer for referring [1]. We have now cited [1] and included it as a baseline. We remark that our method does not conflict with [1]. For any generative trigger, we can leverage DBA to further make it stealthier by decomposing it into distributed attackers. In the following table, we use the strategy in [1] to attack parameters in DFL. Specifically, we stop attacking at Epoch 1000 and report the ASR at Epoch 1100. The results indicate that DBA can further increase durability. This is because each decomposed trigger is small and it makes the one-line gradient project in [1] more invisible. We totally agree that finding an optimal combination of many parameters is a challenge for DBA. Our contribution is that for any combination of the parameters, our clustering algorithm can improve the attack success rate.

W2: Considering the clustering method as a major contribution to this paper, ablation studies are needed to assess the improvement gained from introducing clustering (and the number of clusters, threshold distance to dividing clusters) compared to not using clustering in a fair comparison.

Reply: As suggested by the reviewer, we add ablation studies to remove the clustering and vary the number of clusters. In the following table, “No clustering” indicates that we randomly assign the decomposed triggers to attackers. We use K-means as the clustering algorithm. The results suggest that our clustering algorithm is effective in improving the attack success rate.

W3: To showcase the effectiveness of proposed attack, performance under defense mechanisms is needed.

Reply: Thanks for the insightful comments. As suggested by the reviewer, we introduce two defensive mechanisms [1,2] in the experiment. To the author’s best knowledge, there is no defense mechanism designed specifically for decentralized FL in the literature. The possible reason is that a decentralized framework itself is a defense mechanism. Many defensive strategies based on client selection such as Krum [3] are not suitable for DFL. We would be most thankful if you reviewer can point out some specific defense mechanisms to be introduced and we are more than happy to include them in the experiment. To introduce [1] and [2] in decentralized FL, we leverage the corresponding strategy for each client. Note that the defense mechanism does reduce ASR. However, decentralized FL mitigates backdoor attacks because each client only has a few neighbors (e.g., 2 on a ring topology). Compared with DBA and centralized attack, our method can further pose a challenge to the effectiveness of these defense mechanisms.

[1] FLIP: A Provable Defense Framework for Backdoor Mitigation in Federated Learning [2] FedGame: A Game-Theoretic Defense against Backdoor Attacks in Federated Learning [3] Machine Learning with Adversaries: Byzantine Tolerant Gradient Descent